Issue #494
Updated by cduryee over 9 years ago
Description of problem:
Currently users can easily get themselves into a situation where their pulp repository is unusable. If they are syncing a repository that replaces an old package with a new one with the same NVREA pulp will gladly sync the 2nd after syncing the first.
As a result pulp publishes yum metadata with two packages listed but since they only have the same filename, only one package actually makes it to the file system. Then a yum client comes along and tries to install/update that package it will pick on of the entries from the yum meatadata to use and there's a 50/50 chance of it being the wrong metadata and so checksum verification will fail.
I would expect that pulp should not generate metadata like this in the case that there are packages with the same nvrea in the repo. Alternatively the 2nd package should fail to sync/import into the repo.
This is a common problem and has occurred across many different upstream repos.
Version-Release number of selected component (if applicable):
2.4.0-1
Steps to Reproduce:
1. Create two rpms with the same nvrea
2. Upload them or sync them to a single repo
3. Publish the repo
4. Attempt to install that rpm from the repo
Actual results:
Client will throw an error as the checksum will not match
Expected results:
Only one package is in the primary.xml file and it matches whats actually on the file system.
Additional info:
+ This bug was cloned from "Bugzilla Bug #1132659":https://bugzilla.redhat.com/show_bug.cgi?id=1132659 +
More detail (added 4/27): Users will hit this issue if they sync a repo with unsigned RPMs, then resync and publish the repo once RPMs are signed.
.