[Pkg-rust-maintainers] Bug#1054156: Bug#1054156: librust-env-logger-0.7+default-dev shouldn't provide librust-env-logger+default-dev

[Adrian Bunk]

On Fri, Oct 27, 2023 at 05:07:12PM +0200, Fabian Grünbichler wrote:
> On Wed, Oct 18, 2023 at 02:06:48PM +0300, Adrian Bunk wrote:
> > Package: librust-env-logger-0.7+default-dev
> > Severity: serious
> > 
> > https://buildd.debian.org/status/fetch.php?pkg=mdevctl&arch=arm64&ver=1.2.0-4%2Bb3&stamp=1697626199&raw=0
> > 
> > ...
> > Merged Build-Depends: ..., librust-env-logger+default-dev,
> > ...
> > The following NEW packages will be installed:
> > ...
> >   librust-env-logger-0.7+default-dev librust-env-logger-0.7-dev
> > ...
> > error: failed to select a version for the requirement `env_logger = "^0.10.0"`
> > ...
> > 
> > 
> > This is due to:
> >   librust-env-logger+default-dev reverse Provides:
> >   librust-env-logger-0.7+default-dev 0.7.1-4 (= 0.7.1-4)
> >   librust-env-logger-dev 0.10.0-2 (= 0.10.0-2)
> > 
> > 
> > I'll file a separate bug for mdevctl having a too loose build dependency.
> 
> I am not sure why it shouldn't? librust-env-logger-0.7-dev does contain
> env_logger source code after all
>...

Having two in the archive makes it unpredictable which version the 
dependency solver uses when building a reverse dependency.

Different architectures might end up being built with different versions.

A binNMU might change the version used, even switching from 0.10 to 0.7.


rust-env-logger-0.7 (0.7.1-3) unstable; urgency=medium
  * Release as versioned package for other rdeps that can't update to 0.9

This should really only be used after an explicit opt-in.


>...
> depending on just librust-env-logger+default-dev without a
> version constraint says "I want env_logger with the default feature(s),
> but don't care about the version" - which in almost all cases isn't
> sensible.
>...


There are packages with
  Build-Depends: librust-env-logger+default-dev (>= 0.9)
in the archive, if these were >= 0.7 it would be the same problem.


cu
Adrian