pkg/60149: pkg_add -P $DESTDIR -K /usr/pkg/pkgdb sometimes uses /var/db/pkg instead

>Number:         60149
>Category:       pkg
>Synopsis:       pkg_add -P $DESTDIR -K /usr/pkg/pkgdb sometimes uses /var/db/pkg instead
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    pkg-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Mar 31 13:55:00 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current
>Organization:
The Ghost of /var/db/pkg Past
>Environment:
>Description:

	According to the pkg_add(1) man page, the command

		pkg_add -P $DESTDIR -K /usr/pkg/pkgdb $pkgs

	is supposed to install packages into a package database of
	$DESTDIR/usr/pkg/pkgdb.

	But if, _outside_ the destdir (!), /usr/pkg/pkgdb does not
	exist and /var/db/pkg does exist, then it uses
	$DESTDIR/var/db/pkg instead.

	This applies only on NetBSD, and only to the exact default
	paths, that is, /var/db/pkg and $PREFIX/pkgdb.  So if you use
	`-K /usr/pkg/pkgde' instead of `-K /usr/pkg/pkgdb', it doesn't
	happen.

>How-To-Repeat:

	touch /var/db/pkg
	pkg_add -P $DESTDIR -K /usr/pkg/pkgdb $pkgs

>Fix:

	Workaround: Use `-K /./usr/pkg/pkgdb' to bypass the naive
	string comparison.

	Possible fixes:
	1. Change the stat calls in lib/pkgdb.c pkgdb_get_dir to be
	   DESTDIR-relative.
	2. Don't do this if the `-K' argument was explicit.
	3. Come up with a transition plan that enables us to ditch this
	   logic forever.