[Pkg-javascript-devel] Bug#943526: node-tslib: directory vs. symlink conflict: /usr/share/nodejs/tslib

[Andreas Beckmann]

Package: node-tslib
Version: 1.10.0-2
Severity: serious
User: debian-qa at lists.debian.org
Usertags: piuparts
Control: affects -1 + node-rollup-plugin-typescript

Hi,

during a test with piuparts I noticed your package installs files over
an existing symlink shipped or created by another package.

Your package ships:

drwxr-xr-x root/root         0 2019-08-03 13:44 ./usr/share/nodejs/tslib/
-rw-r--r-- root/root       701 2019-06-10 22:24 ./usr/share/nodejs/tslib/package.json
-rw-r--r-- root/root      2290 2019-06-10 22:24 ./usr/share/nodejs/tslib/tslib.d.ts
-rw-r--r-- root/root        36 2019-06-10 22:24 ./usr/share/nodejs/tslib/tslib.es6.html
-rw-r--r-- root/root      9436 2019-06-10 22:24 ./usr/share/nodejs/tslib/tslib.es6.js
-rw-r--r-- root/root        32 2019-06-10 22:24 ./usr/share/nodejs/tslib/tslib.html
-rw-r--r-- root/root     12037 2019-06-10 22:24 ./usr/share/nodejs/tslib/tslib.js

but package node-typescript ships:

lrwxrwxrwx root/root         0 2019-10-15 06:12 ./usr/share/nodejs/tslib -> typescript/lib


Installing something over existing symlinks is considered bad practice.
See e.g. https://lists.debian.org/87ehlevcrf.fsf@windlord.stanford.edu

It may break in subtle ways and dpkg cannot detect this as a problem.
* Your package might silently overwrite files installed at the symlink
  destination by other packages.
* If the package shipping the symlink decides to make the link point
  somewhere else (or turn it into a real directory), the files owned
  by your package "will be lost" somewhere in the filesystem.
* Depending on installation order the problematic path will be created
  either as a symlink or a directory: the package installed first will
  "win" and all others have "lost".
  Note that dpkg intentionally does not replace directories with
  symlinks and vice versa, see in particular the end of point 4 in
  https://www.debian.org/doc/debian-policy/ch-maintainerscripts.html#details-of-unpack-phase-of-installation-or-upgrade
  (Note: Adding Pre-Depends is *not* a solution.)

Please move the files shipped in your package to the "real" location.

>From the attached log (scroll to the bottom...):

0m24.0s ERROR: installs objects over existing directory symlinks:
  /usr/share/nodejs/tslib/package.json (node-tslib) != /usr/share/nodejs/typescript/lib/package.json (?)
    /usr/share/nodejs/tslib -> typescript/lib
  /usr/share/nodejs/tslib/tslib.d.ts (node-tslib) != /usr/share/nodejs/typescript/lib/tslib.d.ts (?)
    /usr/share/nodejs/tslib -> typescript/lib
  /usr/share/nodejs/tslib/tslib.es6.html (node-tslib) != /usr/share/nodejs/typescript/lib/tslib.es6.html (?)
    /usr/share/nodejs/tslib -> typescript/lib
  /usr/share/nodejs/tslib/tslib.es6.js (node-tslib) != /usr/share/nodejs/typescript/lib/tslib.es6.js (?)
    /usr/share/nodejs/tslib -> typescript/lib
  /usr/share/nodejs/tslib/tslib.html (node-tslib) != /usr/share/nodejs/typescript/lib/tslib.html (?)
    /usr/share/nodejs/tslib -> typescript/lib
  /usr/share/nodejs/tslib/tslib.js (node-tslib) != /usr/share/nodejs/typescript/lib/tslib.js (?)
    /usr/share/nodejs/tslib -> typescript/lib


cheers,

Andreas
-------------- next part --------------
A non-text attachment was scrubbed...
Name: node-rollup-plugin-typescript_1.0.0-1.log.gz
Type: application/gzip
Size: 11252 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-javascript-devel/attachments/20191025/5e869d11/attachment.gz>