[Bug 1934992] Re: rsync 3.2.x in Groovy depends on broken libxxhash 0.7.x

Fri Jul 9 15:39:12 UTC 2021

Sorry, the use cases you describe are not supported by Ubuntu.

You're welcome to hack your system as you wish, but that doesn't mean
that we will necessarily make changes in Ubuntu to accommodate that. We
do try to be helpful, of course. And in this case I agree that it is a
bug that rsync doesn't depend on a higher version of libxxhash
automatically. That's something we should fix, but it is of low priority
but I don't expect such a fix to be backported to Groovy because, as
presented at the moment, this doesn't meet our threshold of disrupting
users to achieve such a change. See
https://wiki.ubuntu.com/StableReleaseUpdates for details of our policies
in this area.

In particular:

> - I make a hypothetical package that depends on libxxhash < 0.8
because I want the "broken/old" xxh128 support

Such a hypothetical package does not exist in the Ubuntu archive in
practice. Adding third party packages is not something that Ubuntu can
realistically support. The scenario you present is exactly why we don't
support third party packages in the general case: they break
distribution release upgrades.

> - libxxhash-dev,
> + libxxhash-dev (>= 0.8),

I don't think your patch will work as-is. You've changed the build
dependency versioning, not the binary package dependency versioning. I
suspect what needs adjusting is the symbols file in the xxhash source
(debian/libxxhash0.symbols). However this needs further investigation
and the low priority of this issue means that I'm not going to spend any
more time on this unless a more important and supported use case is
presented here.

> (Ok, in fact, I think it's ultimately a bug in soname-version/symbol
handling of libxxhash. But that's not where the problem manifests
itself.)

Right. We track bugs and their fixes by following the status of a fix
against the root cause. So I'm going to reassign the bug to that package
as it seems likely to me that this is where the problem lies.

> I'll leave it as is if you still feel it should be closed.

I agree that it's not correct that the binary dependency is wrong, so
this bug can remain open if somebody wants to volunteer a fix. However,
I suggest you find the fix and send it to wherever the problem
originates in our ecosystem (maybe Debian? Or perhaps xxhash upstream?).
Unless a supported use case is presented, I think it's unlikely that
we'll carry a patch for this in Ubuntu.

> But at least it has some visibility/presence on the internet so others
are helped if they also run into this issue.

Sure. People affected by this are welcome to coordinate in this bug.

I'm going to explicitly mark a Groovy task as Won't Fix to make it clear
that we don't expect any change will be made in Groovy to fix this. The
bug remains open to being fixed in a future Ubuntu release if a
volunteer takes the appropriate steps to get the issue resolved at its
actual origin.

** Package changed: rsync (Ubuntu) => xxhash (Ubuntu)

** Also affects: xxhash (Ubuntu Groovy)
   Importance: Undecided
       Status: New

** Changed in: xxhash (Ubuntu Groovy)
       Status: New => Won't Fix

** Changed in: xxhash (Ubuntu)
       Status: New => Triaged

** Changed in: xxhash (Ubuntu)
   Importance: Undecided => Low

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to rsync in Ubuntu.
https://bugs.launchpad.net/bugs/1934992

Title:
  rsync 3.2.x in Groovy depends on broken libxxhash 0.7.x

Status in xxhash package in Ubuntu:
  Triaged
Status in xxhash source package in Groovy:
  Won't Fix

Bug description:
  **Problem**

    $ rsync root at focal-system:/etc/.pwd.lock . 
    ERROR: .pwd.lock failed verification -- update discarded.
    rsync error: some files/attrs were not transferred (see previous errors)
      (code 23) at main.c(1816) [generator=3.2.3]

    $ rsync root at focal-system:/etc/.pwd.lock . --debug=all
    opening connection using: ssh -l root focal-system rsync --server --sender \
      -e.LsfxCIvu . /etc/.pwd.lock  (10 args)
    (Client) Protocol versions: remote=31, negotiated=31
    Client negotiated checksum: xxh128
    ...

  **Cause**

    focal-system# dpkg -l | grep -E 'libxxhash|rsync'
    ii  libxxhash0:amd64  0.7.3-1         amd64
    ii  rsync             3.2.3-2ubuntu1  amd64

  **Why this affects only us and not more people?**

  On Ubuntu/Focal, there is no rsync 3.2.3, only 3.1.3-8. But because we
  need the lz4 compression support we've fetched a newer rsync (from
  Groovy).

  However: the rsync 3.2.3 depends on libxxhash0 0.7.1+, while in fact
  it needs 0.8+.

  **Details**

  On a Ubuntu/Focal system we have installed a rsync 3.2.3 package from Ubuntu/Groovy because we need the lz4 compression support.

  focal-system# apt-cache show rsync
  Package: rsync
  ...
  Version: 3.2.3-2ubuntu1
  Depends: lsb-base, libacl1 (>= 2.2.23), libc6 (>= 2.15),
    liblz4-1 (>= 0.0~r130), libpopt0 (>= 1.14), libssl1.1 (>= 1.1.0),
    libxxhash0 (>= 0.7.1), libzstd1 (>= 1.3.8), zlib1g (>= 1:1.1.4)
  ...

  Alongside this we had libxxhash0 0.7.3-1 from Focal:

  focal-system# apt-cache policy libxxhash0
  libxxhash0:
    Installed: 0.7.3-1
    Candidate: 0.7.3-1
    Version table:
   *** 0.7.3-1 500
          500 http://ARCHIVE/ubuntu focal/universe amd64 Packages
          100 /var/lib/dpkg/status

  According to the dependencies, this should work. But the combination does not, as this quote from the rsync maintainer would tell you:
  https://github.com/WayneD/rsync/issues/122#issuecomment-737690913
  > Yeah, Cyan4973 could have told you that the 128-bit xxhash only
  > just stabilized in its 0.8.0 release, so anything older than
  > that isn't compatible.

  **The fix**

  As the maintainer points out, version 0.7 is not stable (= broken for
  our intents and purposes) and thus not fit for use with rsync 3.2.

  I would argue that it's a good idea to bump the dependency of rsync
  3.2.3 on Groovy to libxxhash0>=0.8

  After all, in Groovy there is a libxxhash0 0.8.0-1ubuntu1.20.10.1, so
  that would not be a problem. And it would fix issues for those mixing
  and matching packages.

  Thanks!

  Walter Doekes
  OSSO B.V.

  (*) possible patch:

  $ diff -pu debian/control{.orig,}
  --- debian/control.orig	2021-07-08 09:56:57.646861644 +0200
  +++ debian/control	2021-07-08 09:57:38.499029903 +0200
  @@ -8,7 +8,7 @@ Build-Depends: debhelper-compat (= 13),
                  libacl1-dev,
                  libpopt-dev,
                  liblz4-dev,
  -               libxxhash-dev,
  +               libxxhash-dev (>= 0.8),
                  libzstd-dev,
                  zlib1g-dev,
                  libssl-dev

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/xxhash/+bug/1934992/+subscriptions