On 2023-01-28 00:14, Bruno Wolff III wrote:
If there is a problem with not uodating dependencies when you do an install or an update on selected packages, the packages dependencies are not properly defined.
By definition, yes. But rpm auto-detects dependencies, and rpm doesn't do symbol-level dependency detection, so it doesn't capture minor-version dependency creep. In order for rpm to do this, you'd probably have to throw out the current implementation of dependency resolution that provides "libfoo.so.2()(64bit)" and instead provide a dependency like "(foo-libs >= 2.4 with foo-libs < 3)", at least for the cases where libraries do not provide versioned symbols -- which I believe includes the vast majority of them. (You'd also need to forbid restructuring packages within a stable release.)
I think the case where you don't want to keep the full system up to date, but a selective update or install causes problems as well is pretty rare. I think it might be reasonable to have an option that requests doing a recursive update. I would consider this to be a low priority feature request that has to compete with all of the other work being done on dnf, rather than a bug. I don't work on dnf and the people that do might feel differently.
Yeah, I agree, it's not super high priority. But it's also not really well understood among the community that partial updates (such as `dnf update --security`) and package installation without a contemporaneous update are unreliable.
I can work on some of those changes to documentation and to rpm or dnf, but I'd like input from the developer community before starting. (And at some point I think that Fedora, the org, should probably consider whether `dnf update --security` is broken and unreliable.)
_______________________________________________ devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
