Bodhi downgrading packages in stable releases

[Andre Robatino]

The stable versions of qemu, libpng, and just now bzip2 have been downgraded
in F23 (although qemu has been fixed). See
https://bugzilla.redhat.com/show_bug.cgi?id=1292914 . It would be a good
idea for packagers to keep track of what the latest stable version of their
package is, and not submit older versions for stable, and also obsolete any
older versions sitting in bodhi so they don't get karma and go to stable
automatically. This has been a public service announcement.

[Cole Robinson]

On 01/09/2016 01:15 AM, Andre Robatino wrote:
>  The stable versions of qemu, libpng, and just now bzip2 have been
> downgraded
>  in F23 (although qemu has been fixed). See
>  https://bugzilla.redhat.com/show_bug.cgi?id=1292914 . It would be a good
>  idea for packagers to keep track of what the latest stable version of their
>  package is, and not submit older versions for stable, and also obsolete any
>  older versions sitting in bodhi so they don't get karma and go to stable
>  automatically. This has been a public service announcement. 
Sorry on the qemu front, but I was under the impression that bodhi handles
obsoleting old updates when a new version is submitted. Am I wrong, or is
something busted on the bodhi side?

- Cole

[Andre Robatino]

>  Sorry on the qemu front, but I was under the impression that bodhi
> handles
>  obsoleting old updates when a new version is submitted. Am I wrong, or is
>  something busted on the bodhi side? 
See the bug. The downgrades happened when old updates were submitted for stable, either by
the packager submitting them or by getting enough karma to be submitted automatically.
Bodhi does not obsolete old updates, and until that's fixed, packagers will probably
have to obsolete them manually.

[Kevin Fenzi]

On Sat, 09 Jan 2016 16:51:15 -0000
"Andre Robatino" <robatino(a)fedoraproject.org&gt; wrote:

>  > Sorry on the qemu front, but I was under the impression that
> bodhi
>  > handles obsoleting old updates when a new version is submitted. Am
>  > I wrong, or is something busted on the bodhi side?   
It does, except in several cases: 

1) The older update is in a updates push (going to testing or stable)
and locked when you submit the new one. 

2) The older update has multiple packages in it and you submit a new
update with just one package. Bodhi can't know what to do here... the
old update might need the older version of your package when it goes
stable so if it was removed it might break the older update. 

So, as a maintainer you should be watching for these cases... 

>  See the bug. The downgrades happened when old updates were submitted
>  for stable, either by the packager submitting them or by getting
>  enough karma to be submitted automatically. Bodhi does not obsolete
>  old updates, and until that's fixed, packagers will probably have to
>  obsolete them manually.  
it does in the common/normal case, it just can't always. 

kevin

[Andre Robatino]

I don't see which of those apply for any of the three packages in the bug. Are you
sure you're not talking about the old bodhi?

[Kevin Fenzi]

On Sat, 09 Jan 2016 18:54:29 -0000
"Andre Robatino" <robatino(a)fedoraproject.org&gt; wrote:

>  I don't see which of those apply for any of the three packages in
> the
>  bug. Are you sure you're not talking about the old bodhi? -- 
Wed Nov 18 02:23:16 2015: libpng-1.6.17-3.fc23 tagged into f23-updates-candidate by
phracek
Wed Nov 18 02:24:32 2015: libpng-1.6.17-3.fc23 tagged into f23-updates-testing-pending by
bodhi
Thu Nov 19 03:23:02 2015: libpng-1.6.19-1.fc23 tagged into f23-updates-candidate by
phracek
Thu Nov 19 03:24:38 2015: libpng-1.6.19-1.fc23 tagged into f23-updates-testing-pending by
bodhi
Thu Nov 19 05:33:28 2015: libpng-1.6.17-3.fc23 untagged from f23-updates-candidate by
bodhi
Thu Nov 19 05:33:28 2015: libpng-1.6.17-3.fc23 tagged into f23-updates-testing by bodhi
Thu Nov 19 05:34:09 2015: libpng-1.6.17-3.fc23 untagged from f23-updates-testing-pending
by bodhi
Fri Nov 20 01:43:01 2015: libpng-1.6.19-1.fc23 untagged from f23-updates-candidate by
bodhi
Fri Nov 20 01:43:01 2015: libpng-1.6.19-1.fc23 tagged into f23-updates-testing by bodhi
Fri Nov 20 01:43:09 2015: libpng-1.6.19-1.fc23 untagged from f23-updates-testing-pending
by bodhi
Sat Nov 21 01:07:00 2015: libpng-1.6.19-1.fc23 tagged into f23-updates-pending by bodhi
Sun Nov 22 02:56:00 2015: libpng-1.6.19-1.fc23 untagged from f23-updates-testing by bodhi
Sun Nov 22 02:56:00 2015: libpng-1.6.19-1.fc23 tagged into f23-updates by bodhi [still
active]
Sun Nov 22 02:56:41 2015: libpng-1.6.19-1.fc23 untagged from f23-updates-pending by bodhi

That to me says the first one was submitted to testing then was going
right out in a bodhi push (bodhi tags things into -pending at the start
of it's run, then untags them at the end (this is to allow qa to
operate on them)). 

While that was pushing the next one was built and submitted to testing,
so not obsoleted. 

I can look at the other ones too, but don't have time right now, I
really think it's the same thing tho. 

kevin

[Andre Robatino]

I think you're looking at the wrong time period. libpng-1.6.19-1.fc23 went to stable
on 2015-11-23 (see https://bodhi.fedoraproject.org/updates/FEDORA-2015-9199a1bfe1 ). At
this time, 1.6.17-3 had already been pushed to testing and was just sitting there. Then it
was submitted for stable on 2016-01-06 and went to stable on 2016-01-07 (see
https://bodhi.fedoraproject.org/updates/FEDORA-2015-4ad4998d00 ), downgrading the newer
version.

[Michal Jaegermann]

On Sat, Jan 09, 2016 at 07:45:43PM -0000, Andre Robatino wrote:
>  I think you're looking at the wrong time period.
> libpng-1.6.19-1.fc23
>  went to stable on 2015-11-23 (see
>  https://bodhi.fedoraproject.org/updates/FEDORA-2015-9199a1bfe1 ). At
>  this time, 1.6.17-3 had already been pushed to testing and was just
>  sitting there. Then it was submitted for stable on 2016-01-06 and went
>  to stable on 2016-01-07 (see
>  https://bodhi.fedoraproject.org/updates/FEDORA-2015-4ad4998d00 ),
>  downgrading the newer version. 
To make things even more exciting in a changelog on koji one can find
these:

....
* Wed Nov 18 2015 Petr Hracek <phracek(a)redhat.com&gt; - 2:1.6.17-4
- Security fix for CVE-2015-8126 (#1281757, #1281756). Proper patch

* Wed Nov 18 2015 Petr Hracek <phracek(a)redhat.com&gt; - 2:1.6.17-3
- Security fix for CVE-2015-8126 (#1281757, #1281756).
....

On a face value of this an "unproper" fix went to bodhi. If the current
libpng-1.6.19 required any fixes at all it is not clear.

  Michal

[Kevin Fenzi]

On Sat, 09 Jan 2016 19:45:43 -0000
"Andre Robatino" <robatino(a)fedoraproject.org&gt; wrote:

>  I think you're looking at the wrong time period.  
I don't think so, but it's possible. :) 

>  libpng-1.6.19-1.fc23
>  went to stable on 2015-11-23 (see
>  https://bodhi.fedoraproject.org/updates/FEDORA-2015-9199a1bfe1 ). At
>  this time, 1.6.17-3 had already been pushed to testing and was just
>  sitting there. Then it was submitted for stable on 2016-01-06 and
>  went to stable on 2016-01-07 (see
>  https://bodhi.fedoraproject.org/updates/FEDORA-2015-4ad4998d00 ),
>  downgrading the newer version.  
The time it went stable doesn't matter. 

The time(s) that matter were when the newer one was submitted as an
update and what time the previous older one was being pushed. 

My contention is that the older one was in a push (and thus locked)
when the newer one was submitted (so bodhi couldn't obsolete it). Then
both updates were still live after that. (one in testing and one
pending testing in the next push).

Ideally here bodhi would queue up the obsoletion event and after the
push check to see if any updates went to testing that should be
obsoleted (then it would be unpushed and the new one would go out in
the next updates-testing push). 

kevin