install - Installing a package depending on an already installed package that ignored dependencies will try to install its ignored dependency
- Dominant language
- C#
- Stars
- 11.5k
- Forks
- 960
- PR merge metrics
- No merged PRs in 30d
Description
### What I Saw
I was installing something that depended on a package that was set to ignore its dependencies. It then tried to install said ignored dependencies.
### How It Happened
Because the `keepass` package's listed dependency is `keepass.install` and I wanted the portable version, I installed KeePass on my machine via the following method:
```
choco install -y keepass.portable --params="'/installPath:C:\Tools\KeePass'"
choco install -n -i keepass
```
This worked fine, with the latter package reporting it was installed to `C:\Tools\keepass` without any fuss.
However, I noticed something strange when I tried to install `keepass-plugin-keetheme`, which has a listed dependency of `keepass (≥ 2.0 && < 3.0)`... it tried to install `keepass.install` even though the `keepass` package is supposed to be ignoring dependencies. The only way around this was to install `keepass-plugin-keetheme` with `-i` as well.
### Expected Behavior
If it detects the dependency, that should be the end of it, it shouldn't stop to verify the dependency's dependencies, _especially_ if it's supposed to be ignoring them, and it _double-especially_ shouldn't try to install them.
### Sidenotes
As far as I can tell, this is how the program is currently supposed to behave, but if it's necessary, I will reproduce the behavior in a VM and attach a verbose debug log.
This issue is similar to #1215, but that is more focused on upgrades and it may or may not be remedied by enabling the `useRememberedArgumentsForUpgrades` feature (which I do), and in my opinion, it has confusing verbiage. I think a new issue about the overall behavior is appropriate.
Contributor guide
Research direction
Start by reproducing the commands with keepass.portable, keepass installed with -n -i, and keepass-plugin-keetheme. Trace dependency resolution for an installed package whose dependencies were ignored; done means installing the plugin does not attempt to install keepass.install unless dependency installation is explicitly requested.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- cli
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100