package nginx 1.27 has wrong version
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 3.2k
- Forks
- 692
- PR merge metrics
- No merged PRs in 30d
Description
Describe the bug
Hi, as the nginx 1.26 has several vulnerabilities I tried upgrade it to 1.27 as it is written in https://github.com/vmware/photon/wiki/Security-Update-5.0-307 . The package itseld is in the base repo but it is not installable because the OS states the the upgrade would really be a downgrade.
I think the difference (the missing 1: in the version) between the old package (1:1.26.0) and the new one (1.27.0) causes that the tdnf thinks it is a downgrade.
Reproduction steps
$ tdnf update
$tdnf info nginx
Name : nginx
Arch : x86_64
Epoch : 1
Version : 1.26.2
Release : 4.ph5
Install Size : 1.08M (1130889)
Repo : @System
...
Name : nginx
Arch : x86_64
Epoch : 0
Version : 1.27.0
Release : 1.ph5
Install Size : 2.18M (2290145)
Download Size : 812.95k (832464)
Repo : photon
$ tdnf upgrade nginx
Nothing to do.
$ tdnf install nginx
Package nginx is already installed.
$ wget https://packages.vmware.com/photon/5.0/photon_5.0_x86_64/x86_64/nginx-1.27.0-1.ph5.x86_64.rpm
$ tdnf install nginx-1.27.0-1.ph5.x86_64.rpm
Downgrading:
nginx x86_64 1.27.0-1.ph5 @cmdline 2.18M 812.95k
Total installed size: 2.18M
Total download size: 812.95k
Is this ok [y/N]: y
Testing transaction
Running transaction
Installing/Updating: nginx-1.27.0-1.ph5.x86_64
Removing: nginx-1:1.26.2-4.ph5.x86_64
Expected behavior
The tdnf should update the package normally.
Additional context
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the Photon base-repository nginx package definition and inspecting how its RPM epoch, version, and release are set; compare them with the installed 1:1.26.2-4.ph5 and available 1.27.0-1.ph5 packages. Reproduce the issue with the tdnf update, info, upgrade, and local RPM install commands, and confirm that the corrected metadata is treated as an upgrade rather than a downgrade.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- nginx
- Domain
- operating-systems
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100