[MXS-3765] Republished deb-packages with same version, but different content - Ignored by APT Created: 2021-09-14  Updated: 2022-07-19  Resolved: 2021-09-24

Status: Closed
Project: MariaDB MaxScale
Component/s: build
Affects Version/s: None
Fix Version/s: N/A

Type: Bug Priority: Major
Reporter: Simon Hollenbach Assignee: Timofey Turenko
Resolution: Fixed Votes: 0
Labels: packaging
Environment:

Ubuntu 18.04 Bionic Beaver, Ubuntu 20.04 Focal Fossa, possibly others

Attachments: Text File maxscale-2.5-bionic_fetch-failure.txt    

 Description   

Problem

APT in Debian/Ubuntu determines packages to be upgraded by their version, but the maxscale APT repositories for Ubuntu Bionic and Focal in version 2.5 (the only ones I am tracking, this might affect every APT-packaged version) recently (Fetched by our mirror 2021-09-14, 12:00:00 UTC+0) swapped the file maxscale_2.5.15~bionic-1_amd64.deb. This will lead to "invisible" inconsistencies between installations being done before and after the swap.

Previously, I was unsure whether those republications were simple mistakes and no "real" code was touched, but this time I have, new file first: (<filename> <filesize in bytes> <sha1sum>)

maxscale_2.5.15~bionic-1_amd64.deb 52806694 39c0c1eeed27818d3c54577bc355d18cd148272d
maxscale_2.5.15~bionic-1_amd64.deb 56137056 f0ea486890755513d6073daea68257afeb253b13

The notably shrinking package size hints on something omitted from the new package that was previously, possibly by mistake, in there.

Possible Fix

Bumping the package to maxscale_2.5.15~bionic-2_amd64.deb, raising the debian_revision part would solve this specific case. Furthermore, uploading packages that are already existent should be generally prevented, as only new machines will ever see this change.

Notes

Output of diffoscope is too large to handle for me.
Please note that I left the severity unchanged, as I do not know how to correctly classify this issue according to your guidelines - Sorry if I missed reading up on something I should have.

 Comments   
Comment by Simon Hollenbach [ 2021-09-14 ]

Another thing to note is that your servers apparently returned 404 on https://downloads.mariadb.com/MaxScale/2.5/ubuntu/dists/bionic/Release for 40+ minutes, starting after 2021-09-14, 11:00:00 UTC+0

Comment by markus makela [ 2021-09-14 ]

tturenko can you check out why this happened? I don't know why it did but we didn't rebuild the 2.5.15 packages. If we did do a rebuild, we must increment the MAXSCALE_BUILD_NUMBER in the correct VERSION.cmake file.

Comment by Simon Hollenbach [ 2021-09-15 ]

Please note that timestamps on the files in the new, smaller package are around 2021-08-18 14:54 , the older package was apparently built around 2021-08-17 12:31. But the new package was picked up by our hourly sync job only yesterday.

Comment by Simon Hollenbach [ 2021-09-15 ]

FYI: Fetching the repository an hour earlier, at 2021-09-14 11:00:23+0000, yielded gpgv: Signature made Wed 18 Aug 2021 15:22:41 CEST. The new signature was made ~2 minutes later, gpgv: Signature made Wed 18 Aug 2021 15:24:23 CEST.

Comment by Timofey Turenko [ 2021-09-17 ]

I did resyc from ourr CI server to dl02.mariadb.com
Could you please check now?

Comment by Simon Hollenbach [ 2021-09-17 ]

Your resync seems to have made the repository "go back in time" to the old snapshot, e.g. Signature made Wed 18 Aug 2021 15:22:41 CEST is now printed again (for bionic). Edited to add that focal is showing the same behaviour.

That fix works for me, please note that you might still want to bump the build number, so everyone has the package in the repo.

Can you give any insight into what had happenend?

Comment by Timofey Turenko [ 2021-09-24 ]

I have not found the exact reason - probably some sync issue between our server and CDN

Generated at Thu Feb 08 04:23:47 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.