chocolatey / chocolatey/choco

install - Installing a package depending on an already installed package that ignored dependencies will try to install its ignored dependency

Open
#1,966 1 comment 0 reactions 0 assignees View on GitHub
0 - Triaging
Dominant language
C#
Stars
11.5k
Forks
960
PR merge metrics
No merged PRs in 30d

Description

### What I Saw

I was installing something that depended on a package that was set to ignore its dependencies. It then tried to install said ignored dependencies.

### How It Happened

Because the `keepass` package's listed dependency is `keepass.install` and I wanted the portable version, I installed KeePass on my machine via the following method:
```
choco install -y keepass.portable --params="'/installPath:C:\Tools\KeePass'"
choco install -n -i keepass
```
This worked fine, with the latter package reporting it was installed to `C:\Tools\keepass` without any fuss.

However, I noticed something strange when I tried to install `keepass-plugin-keetheme`, which has a listed dependency of `keepass (≥ 2.0 && < 3.0)`... it tried to install `keepass.install` even though the `keepass` package is supposed to be ignoring dependencies. The only way around this was to install `keepass-plugin-keetheme` with `-i` as well.

### Expected Behavior

If it detects the dependency, that should be the end of it, it shouldn't stop to verify the dependency's dependencies, _especially_ if it's supposed to be ignoring them, and it _double-especially_ shouldn't try to install them.

### Sidenotes

As far as I can tell, this is how the program is currently supposed to behave, but if it's necessary, I will reproduce the behavior in a VM and attach a verbose debug log.

This issue is similar to #1215, but that is more focused on upgrades and it may or may not be remedied by enabling the `useRememberedArgumentsForUpgrades` feature (which I do), and in my opinion, it has confusing verbiage. I think a new issue about the overall behavior is appropriate.

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the commands with keepass.portable, keepass installed with -n -i, and keepass-plugin-keetheme. Trace dependency resolution for an installed package whose dependencies were ignored; done means installing the plugin does not attempt to install keepass.install unless dependency installation is explicitly requested.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
cli
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.