Bug#1021702: debian-cd: Take constraints into account while building the cd packages pool

Hi Arnaud,

On Thu, Oct 13, 2022 at 05:13:03PM +0700, Arnaud Rebillout wrote:

...

>By entering a chroot, and trying to install the king-phisher package,
>using the pool of packages provided in the Kali installer, I get:
>
>  # apt install king-phisher
>  [...]
>  The following packages have unmet dependencies:
>   python3-fonttools : Depends: python3-unicodedata2 (>= 14.0.0) but it is not installable or
>                                python3-all (>= 3.11.0) but 3.10.6-1 is to be installed
>  E: Unable to correct problems, you have held broken packages.
>
>Looking at the dependency tree now:
>
>  king-phisher
>  +-- python3-matplotlib
>    +-- python3-fonttools
>      +-- python3-unicodedata2 (>= 14.0.0) | python3-all (>= 3.11.0)
>  
>In the pool of packages that are available in the Kali iso, we don't
>have python3-unicodedata2 , however we have python3-all , BUT it's at
>version 3.10.6-1 ... So nothing can satisfy the dependency.
>
>So it looks to me that it's a bug in debian-cd. I guess that the
>resolver that decides which packages are included in the pool didn't
>include python3-unicodedata2 because there was python3-all already, but
>it didn't take into account the constraints >= 3.11.0.

If you check in sort_deps.$ARCH.log, that'll tell you what dependency
resolution happened.

>As a sidenote, it looks like the maintainer of python3-fonttools is a
>bit ahead of time, his package depends on python3-unicodedata2 (>=
>14.0.0) | python3-all (>= 3.11.0) but 3.11 is not yet released, it's
>planned for end of October.
>
>Note that this is an issue only for installers that don't have access to
>the network. If network is available, I guess that python3-unicodedata2
>will be fetched from a remote package repository, so no problem for most
>users.

ACK.