Hi,

I am surprised to find multiple entries for a given package and
architecture having different versions
in a specific (same distribution, release, component) source index file.
For instance:

curl -s https://ftp.debian.org/debian/dists/experimental/main/source/Sources.xz | xzgrep -A 7 "Package: sphinx"

gives:

Package: sphinx
Binary: python-sphinx, python3-sphinx, sphinx-common, sphinx-doc, libjs-sphinxdoc
Version: 1.5.6-2
Maintainer: Debian Python Modules Team <python-modules-team@lists.alioth.debian.org>
Uploaders: Dmitry Shachnev <mitya57@debian.org>
Build-Depends: debhelper (>= 9)
Build-Depends-Indep: dh-python, dh-strip-nondeterminism, python-all

= 2.6.6-4~), python3-all (>= 3.3.3-1~), python-six (>= 1.5),

python3-six (>= 1.5), python-setuptools (>= 0.6c5-1~),
python3-setuptools, python-docutils (>= 0.11), python3-docutils (>=
0.11), python-pygments (>= 2.1.1), python3-pygments (>= 2.1.1),
python-jinja2 (>= 2.3), python3-jinja2 (>= 2.3), python-sqlalchemy, python3-sqlalchemy, python-whoosh, python3-whoosh, python-pytest, python3-pytest, python-mock, python3-mock, python-babel (>= 1.3),
python3-babel (>= 1.3), python-alabaster (>= 0.7), python3-alabaster

= 0.7), python-imagesize, python3-imagesize, python-requests (>=

2.4.0), python3-requests (>= 2.4.0), python-html5lib,
python3-html5lib, python-enum34, libjs-jquery (>= 1.4),
libjs-underscore, texlive-latex-recommended, texlive-latex-extra, texlive-fonts-recommended, texinfo, texlive-luatex, texlive-xetex,
dvipng, graphviz, perl
Architecture: all
--
Package: sphinx
Binary: python3-sphinx, sphinx-common, sphinx-doc, libjs-sphinxdoc
Version: 3.2.1-2
Maintainer: Debian Python Team <team+python@tracker.debian.org>
Uploaders: Dmitry Shachnev <mitya57@debian.org>
Build-Depends: debhelper-compat (= 13)
Build-Depends-Indep: dh-python (>= 3.20180313~), dpkg-dev (>=
1.17.14), dvipng, fonts-freefont-otf, graphviz, imagemagick-6.q16,
libjs-jquery (>= 1.4), libjs-underscore, librsvg2-bin, perl,
python3-alabaster (>= 0.7), python3-all (>= 3.3.3-1~), python3-babel

= 1.3), python3-doc <!nodoc>, python3-docutils (>= 0.12),

python3-html5lib, python3-imagesize, python3-jinja2 (>= 2.3),
python3-lib2to3, python3-packaging, python3-pygments (>= 2.1.1), python3-pytest, python3-requests (>= 2.5.0), python3-setuptools, python3-snowballstemmer (>= 1.1), python3-sphinxcontrib.websupport
<!nodoc>, texinfo, texlive-fonts-recommended, texlive-latex-extra, texlive-latex-recommended, texlive-luatex, texlive-xetex
Architecture: all
--
Package: sphinx
Binary: python3-sphinx, sphinx-common, sphinx-doc, libjs-sphinxdoc
Version: 3.4.3-1
Maintainer: Debian Python Team <team+python@tracker.debian.org>
Uploaders: Dmitry Shachnev <mitya57@debian.org>
Build-Depends: debhelper-compat (= 13)
Build-Depends-Indep: dh-python (>= 3.20180313~), dpkg-dev (>=
1.17.14), dvipng, fonts-freefont-otf, graphviz, imagemagick-6.q16,
libjs-jquery (>= 1.4), libjs-underscore, librsvg2-bin, perl, python-requests-doc <!nodoc>, python3-alabaster (>= 0.7), python3-all

= 3.3.3-1~), python3-babel (>= 1.3), python3-doc <!nodoc>,

python3-docutils (>= 0.12), python3-html5lib, python3-imagesize,
python3-jinja2 (>= 2.3), python3-lib2to3, python3-packaging,
python3-pygments (>= 2.1.1), python3-pytest, python3-requests (>=
2.5.0), python3-setuptools, python3-snowballstemmer (>= 1.1), python3-sphinxcontrib.websupport <!nodoc>, texinfo,
texlive-fonts-recommended, texlive-latex-extra,
texlive-latex-recommended, texlive-luatex, texlive-xetex
Architecture: all
--
Package: sphinx
Binary: python3-sphinx, sphinx-common, sphinx-doc, libjs-sphinxdoc
Version: 3.5.2-1
Maintainer: Debian Python Team <team+python@tracker.debian.org>
Uploaders: Dmitry Shachnev <mitya57@debian.org>
Build-Depends: debhelper-compat (= 13)
Build-Depends-Indep: dh-python (>= 3.20180313~), dpkg-dev (>=
1.17.14), dvipng, fonts-freefont-otf, graphviz, imagemagick-6.q16,
libjs-jquery (>= 1.4), libjs-underscore, librsvg2-bin, perl, python-requests-doc <!nodoc>, python3-alabaster (>= 0.7), python3-all

= 3.3.3-1~), python3-babel (>= 1.3), python3-doc <!nodoc>,

python3-docutils (>= 0.12), python3-html5lib, python3-imagesize,
python3-jinja2 (>= 2.3), python3-lib2to3, python3-packaging,
python3-pygments (>= 2.1.1), python3-pytest, python3-requests (>=
2.5.0), python3-setuptools, python3-snowballstemmer (>= 1.1), python3-sphinxcontrib.websupport <!nodoc>, texinfo,
texlive-fonts-recommended, texlive-latex-extra,
texlive-latex-recommended, texlive-luatex, texlive-xetex
Architecture: all


And more over UDD is not showing this one:

udd=> select distribution,release,component,package,architecture,array_to_string(array_agg(version),
', ') from packages where release='experimental' group by distribution,release,component,package,architecture having count(*)>1;
distribution | release | component | package | architecture | array_to_string --------------+--------------+-----------+---------------------------+--------------+-------------------------------------------
debian | experimental | main | critterding-common |
all | 1.0-beta14+dfsg-2, 1.0-beta14+dfsg-2+b1
debian | experimental | main | gcc-10-locales |
all | 10.2.1-21, 10.2.1-20
debian | experimental | main | gcc-10-source |
all | 10.2.1-21, 10.2.1-20
debian | experimental | main | gitlab-common |
all | 13.5.4+dfsg-2, 13.8.5+dfsg2-1
debian | experimental | main | kfreebsd-source-11.0 |
all | 11.0~svn295083-1~debug2, 11.0~svn265310-1
debian | experimental | main | libgccjit-10-doc |
all | 10.2.1-20, 10.2.1-21
debian | experimental | main | libgtk-4-common |
all | 3.99.4-1, 4.0.3-4
debian | experimental | main | libgtk-4-doc |
all | 3.99.4-1, 4.0.3-4
debian | experimental | main | libnfft3-doc |
all | 3.4.0~rc1-1, 3.4.0~rc2-1
debian | experimental | main | libstdc++-10-doc |
all | 10.2.1-20, 10.2.1-21
debian | experimental | main | libwebkit2gtk-4.0-37-gtk2 |
all | 2.31.90-1, 2.31.1-1
debian | experimental | main | libwebkit2gtk-4.0-doc |
all | 2.31.1-1, 2.31.90-1
debian | experimental | main | redis |
all | 5:6.2.1-1, 5:6.2.0-1
debian | experimental | main | ruby-gitaly |
all | 13.8.5+dfsg2-1, 13.5.4+dfsg-2
debian | experimental | main | ruby3.0-doc |
all | 3.0.0~preview1-1, 3.0.0-1
(15 lignes)

Where am I wrong?

Thanks

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

note: I'm a normal Debian user

On 09/03/21 19:42, Patrice Duroux wrote:

I am surprised to find multiple entries for a given package and
architecture having different versions

there are some case that you can have multiple entries for the same package:
* different hardware architecture
* virtual package
* different repositories (for example: security, main)
* ...

curl -s https://ftp.debian.org/debian/dists/experimental/main/source/Sources.xz
| xzgrep -A 7 "Package: sphinx"

wow experimental!

gives:

Package: sphinx

sphinx is a virtual package

https://www.debian.org/doc/manuals/debian-faq/pkg-basics.en.html#virtual

And more over UDD is not showing this one:

I think that udd don't show virtual package, probably it show only real packages.
I don't know, I never used udd
(https://wiki.debian.org/UltimateDebianDatabase)

Ciao
Davide

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On 09/03/21 at 19:42 +0100, Patrice Duroux wrote:

Hi,

I am surprised to find multiple entries for a given package and
architecture having different versions
in a specific (same distribution, release, component) source index file.
For instance:

curl -s https://ftp.debian.org/debian/dists/experimental/main/source/Sources.xz
| xzgrep -A 7 "Package: sphinx"

[...]

Where am I wrong?

Hi,

This list includes source packages with Extra-Source-Only: yes (only
included because they are referenced by binary packages using
Built-Using).

See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=699268 for some
context.

A workaround is to filter on the extra_source_only column, or to use the sources_uniq view which excludes those.

Lucas

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Hi,

On 11/03/21 at 20:12 +0100, Patrice Duroux wrote:

Thanks!
But I am still surprise to see such case for instance:

curl -s https://ftp.debian.org/debian/dists/oldstable/main/source/Sources.xz | xzgrep -A 3 "Package: appdirs"
Package: appdirs
Binary: python-appdirs, python3-appdirs, pypy-appdirs
Version: 1.4.0-2
Maintainer: Benjamin Drung <benjamin.drung@profitbricks.com>
--
Package: appdirs
Binary: python-appdirs, python3-appdirs, pypy-appdirs
Version: 1.4.0-3
Maintainer: Benjamin Drung <benjamin.drung@profitbricks.com>

when looking at:
https://packages.debian.org/stretch/pypy-appdirs

we have only 'Package: pypy-appdirs (1.4.0-3)' for all arch.

I probably need to read your answers again!

Yes, that would be because another package was built using appdirs
1.4.0-2.

Lucas

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Thanks!
But I am still surprise to see such case for instance:

curl -s https://ftp.debian.org/debian/dists/oldstable/main/source/Sources.xz | xzgrep -A 3 "Package: appdirs"
Package: appdirs
Binary: python-appdirs, python3-appdirs, pypy-appdirs
Version: 1.4.0-2
Maintainer: Benjamin Drung <benjamin.drung@profitbricks.com>
--
Package: appdirs
Binary: python-appdirs, python3-appdirs, pypy-appdirs
Version: 1.4.0-3
Maintainer: Benjamin Drung <benjamin.drung@profitbricks.com>

when looking at:
https://packages.debian.org/stretch/pypy-appdirs

we have only 'Package: pypy-appdirs (1.4.0-3)' for all arch.

I probably need to read your answers again!

Cheers,
Patrice

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Hi,

So I'm assuming you are talking about the contents of Installed-Build-Depends which is part of the .buildinfo file of the build packages output.
Because I tried to check the .deb content, the UDD, the different index files of
the Debian pool and also DPT, to find such a relationship but without success. Are those from the packages provided the Debian pool publicly available anywhere? Could it be some sort in the https://ftp-master.debian.org/ vault?

Sorry for my curiosity, I was trying to figure out how Debian maintainers deal with packages like at random:
https://tracker.debian.org/pkg/beav
It seems to me that it has not been "touched" (in the broad sense) for a while: http://ftp.debian.org/debian/pool/main/b/beav/?C=M;O=A

I know there are Debian CI and Reproducible which surely do a regular check.

Thank you for your patience,
Patrice

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On 13/03/21 at 18:26 +0100, Patrice Duroux wrote:

Hi,

So I'm assuming you are talking about the contents of Installed-Build-Depends which is part of the .buildinfo file of the build packages output.
Because I tried to check the .deb content, the UDD, the different index files of
the Debian pool and also DPT, to find such a relationship but without success.
Are those from the packages provided the Debian pool publicly available anywhere? Could it be some sort in the https://ftp-master.debian.org/ vault?

No, I'm talking about Built-Using. See https://www.debian.org/doc/debian-policy/ch-relationships.html#additional-source-packages-used-to-build-the-binary-built-using

Sorry for my curiosity, I was trying to figure out how Debian maintainers deal
with packages like at random:
https://tracker.debian.org/pkg/beav
It seems to me that it has not been "touched" (in the broad sense) for a while:
http://ftp.debian.org/debian/pool/main/b/beav/?C=M;O=A

I know there are Debian CI and Reproducible which surely do a regular check.

For that specific package, it was rebuilt through a binNMU in 2018 https://buildd.debian.org/status/package.php?p=beav

There has been a recent effort to ensure that all packages were built at
least once recently: http://layer-acht.org/thinking/blog/20201231-no-source-change-source-uploads/

Lucas

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)