fix(deps): qualify bare dep names, part 1 of 2 - #553
Merged
Conversation
Batch 1 of the index-wide sweep, split so the per-package install test covers ten packages rather than forty-six. The guard that enforces this lands with batch 2, once no bare name is left for it to trip on. A dep declared as `expat@2.6.2` rather than `xim:expat@2.6.2` resolves fine only while exactly one index provides that name -- and CI registers every CHANGED recipe a second time under `local:`, so the moment a PR touches both the consumer and the dependency, resolution reports `package 'expat@2.6.2' is ambiguous` and the install stops. It is latent by construction: the failure is a property of the changed set, not of the recipe, so it surfaces by accident on an unrelated PR (fontconfig, #497) rather than on the one that introduced it. Found by loading each recipe AS LUA rather than grepping it, and that is load-bearing: npm assigns one table to xpm.{linux,windows,macosx} after the literal, so a text sweep sees one dep where the load sees three rows on three platforms; code builds its version entries from top-level functions. Both parse correctly only because the recipe is executed. graphics.lua is the one file here that changes more than a prefix. Its `wsl-gl-host-link` dep was deliberately bare, with a comment explaining that the package was new and unpublished -- correct at the time, and it inverts once the package ships (#540): a published recipe that a PR also changes exists under both namespaces, where a bare name is ambiguous. The prefix is added and the comment rewritten to say why the exemption ended, rather than left asserting the opposite of the code. Verified: every changed file re-parsed and its deps re-enumerated per platform; stripping `xim:` from both sides makes nine of the ten byte-identical to main, and the tenth differs only by that comment block. 1116 static tests pass.
Sunrisepeak
added a commit
that referenced
this pull request
Aug 8, 2026
…gain (#555) The guard could not land with either sweep half -- it cannot pass while any bare name remains, and a guard merged red is a guard someone switches off. Both halves are in (#553, #554), so it goes in now. Touches no pkgs/, so its CI is minutes. Three assertions, each of which has already shipped as red CI: * a bare dep name that collides with a package this index provides * a prefix that disagrees with the provider's own declared namespace -- rustup-mirror is `config:`, so `xim:rustup-mirror` named nothing and rust failed to install on every platform * a dep whose provider has no section for the platform declaring it -- xim:python is linux+windows, so rosdep/vcstool/hermes-agent's macosx deps could never resolve xpm.debian and xpm.ubuntu are deliberately NOT reported: detect_platform() returns build_os(), which is linux/macosx/windows and nothing else, so a dep inside those sections cannot fail at install time. A check with unfixable findings gets ignored wholesale. TWO HARNESS FIXES FOR THINGS I BROKE OR MISREAD The loader/libc scan walked every file under xpkgs for every package. That is quadratic across a 25-package run: by the late alphabet the store holds every earlier payload, so the step printed its header and sat for minutes with nothing after it, which I read as a hang and reported as one. It was not -- the job passed in 21m48s. It is now scoped with `-newer` against a marker dropped just before the install, which covers this package and the deps pulled in with it: exactly the set this install could have broken. An older payload is still checked, on the run where it is the package under test. And the Windows bound I added redirected output to a file, so nothing printed until the process exited -- the log showed "==> [vc6] install" and then silence for the whole install. That is the same ambiguity the bound was meant to remove, relocated rather than fixed. It now tails the file while waiting, and prints only the unread remainder at the end. Co-authored-by: sunrisepeak <x.d2learn.org@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Batch 1 of 2 of the index-wide sweep, split so the per-package install test covers ten packages rather than forty-six. The guard that enforces this lands with batch 2, once no bare name is left for it to trip on.
The defect
A dep declared
expat@2.6.2rather thanxim:expat@2.6.2resolves only while exactly one index provides that name. CI registers every changed recipe a second time underlocal:, so the moment a PR touches both consumer and dependency, resolution reportspackage 'expat@2.6.2' is ambiguousand the install stops.Latent by construction: the failure is a property of the changed set, not of the recipe — so it surfaces by accident on an unrelated PR (fontconfig, #497) rather than on the one that introduced it.
Why the recipes are loaded, not grepped
npmassigns one table toxpm.{linux,windows,macosx}after the literal, so a text sweep sees one dep where the load sees three rows on three platforms.codebuilds its version entries from top-level functions. Both parse correctly only because the recipe is executed.One file changes more than a prefix
graphics.lua'swsl-gl-host-linkdep was deliberately bare, with a comment explaining the package was new and unpublished — correct at the time. That inverts once it ships (#540): a published recipe a PR also changes exists under both namespaces, where a bare name is ambiguous. Prefix added, comment rewritten to say why the exemption ended rather than left asserting the opposite of the code.Verification
Every changed file re-parsed and its deps re-enumerated per platform. Stripping
xim:from both sides makes nine of ten byte-identical to main; the tenth differs only by that comment block. 1116 static tests pass.🤖 Generated with Claude Code