Interdependent packages *must* go in the same update - a reminder (ref. nss and nspr)
There are currently separate updates for nss 3.33.0 and nspr 4.17.0 in
both Fedora 26 and 27. However, nss 3.33.0 requires nspr 4.17.0.
As a reminder, this is a violation of the Updates Policy:
https://fedoraproject.org/wiki/Updates_Policy#Updating_inter-dependent_pa...
"When one updated package requires another (or more than one other),
the packages should be submitted together as a single update."
The problem with doing things this way is that, if the nss update
happened to be pushed stable before the nspr update (which could easily
happen due to human error, network issues etc. even if the maintainer
*intends* to push them together!), the dependencies in the stable
repository will be broken; nss will not be installable.
In this case there's an even worse consequence; if you do attempt to
update to nss 3.33.0 without nspr 4.17.0 dnf will 'skip' *most* of the
nss packages (as it notices that they are missing dependencies), but it
*will* install nss-softokn-freebl . With this mix of packages (most of
nss at 3.32.0, but nss-softokn-freebl at 3.33.0), nss and anything that
depends on it just fails to work at all - e.g. curl and dnf...so that's
an extremely bad outcome.
If both packages are in a single update, we cannot run into this
problem; either both packages get pushed stable or neither does. That
is why updates to interdependent packages should *always* be grouped
together. Please remember this, package maintainers. Thanks!
(note: this issue was caught by openQA, which tests individual updates
from updates-testing, rather than enabling the repository wholesale, so
it catches things like this.)
--
Adam Williamson
Fedora QA Community Monkey
IRC: adamw | Twitter: AdamW_Fedora | XMPP: adamw AT happyassassin . net
http://www.happyassassin.net