vmware / vmware/photon

package nginx 1.27 has wrong version

Open
#1,597 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
C
Stars
3.2k
Forks
692
PR merge metrics
No merged PRs in 30d

Description

Describe the bug

Hi, as the nginx 1.26 has several vulnerabilities I tried upgrade it to 1.27 as it is written in https://github.com/vmware/photon/wiki/Security-Update-5.0-307 . The package itseld is in the base repo but it is not installable because the OS states the the upgrade would really be a downgrade.

I think the difference (the missing 1: in the version) between the old package (1:1.26.0) and the new one (1.27.0) causes that the tdnf thinks it is a downgrade.

Reproduction steps
$ tdnf update

$tdnf info nginx
Name          : nginx
Arch          : x86_64
Epoch         : 1
Version       : 1.26.2
Release       : 4.ph5
Install Size  :   1.08M (1130889)
Repo          : @System

...

Name          : nginx
Arch          : x86_64
Epoch         : 0
Version       : 1.27.0
Release       : 1.ph5
Install Size  :   2.18M (2290145)
Download Size  : 812.95k (832464)
Repo          : photon

$ tdnf upgrade nginx
Nothing to do.
$ tdnf install nginx
Package nginx is already installed.

$ wget https://packages.vmware.com/photon/5.0/photon_5.0_x86_64/x86_64/nginx-1.27.0-1.ph5.x86_64.rpm

$ tdnf install nginx-1.27.0-1.ph5.x86_64.rpm 

Downgrading:
nginx                                      x86_64                          1.27.0-1.ph5                               @cmdline                          2.18M                             812.95k

Total installed size:   2.18M
Total download size: 812.95k
Is this ok [y/N]: y
Testing transaction
Running transaction
Installing/Updating: nginx-1.27.0-1.ph5.x86_64
Removing: nginx-1:1.26.2-4.ph5.x86_64
Expected behavior

The tdnf should update the package normally.

Additional context

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the Photon base-repository nginx package definition and inspecting how its RPM epoch, version, and release are set; compare them with the installed 1:1.26.2-4.ph5 and available 1.27.0-1.ph5 packages. Reproduce the issue with the tdnf update, info, upgrade, and local RPM install commands, and confirm that the corrected metadata is treated as an upgrade rather than a downgrade.

Written by the indexing model from the issue text.

Assessment

Tech stack
nginx
Domain
operating-systems
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.