maintainer-feedback requested: [Bug 237437] ports-mgmt/pkg: "pkg install" picks wrong repository

[bugzilla-noreply at freebsd.org]

Bugzilla Automation <bugzilla at FreeBSD.org> has asked freebsd-pkg mailing list
<pkg at FreeBSD.org> for maintainer-feedback:
Bug 237437: ports-mgmt/pkg: "pkg install" picks wrong repository
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=237437



--- Description ---
I have configured 2 repositories for pkg:
default - current version of all ports installed on the machine, priority 0
ossec-hids - future versions of ossec-hids* ports (I am the maintainer),
priority 1

The ossec-hids* ports in "default" repository have version 3.1.0 and in
"ossec-hids" repository have version 3.2.0. Other ports (dependencies) that
exist in both repositories have the same version. All ports that exist in both
repositories have same options.

# pkg install ossec-hids-server-config

gives proper result trying to install the newer version of ossec-hids, but
strangely postgresql10-client dependency is incorrectly taken from "default"
repository:

New packages to be INSTALLED:
	ossec-hids-server-config: 3.2.0 [ossec-hids]
	ossec-hids-server: 3.2.0 [ossec-hids]
	openssl: 1.0.2r,1 [ossec-hids]
	expect: 5.45.4_1,1 [ossec-hids]
	tcl86: 8.6.9_1 [ossec-hids]
	libinotify: 20180201_1 [ossec-hids]
	postgresql10-client: 10.7_2 [default]
	perl5: 5.28.1_1 [ossec-hids]
	readline: 8.0.0 [ossec-hids]
	indexinfo: 0.3.1 [ossec-hids]

# pkg install security/ossec-hids-server-config

gives wrong result trying to install old version of ossec-hids, but
surprisingly the postgresql10-client dependency is correctly taken from
"ossec-hids" repository:

New packages to be INSTALLED:
	ossec-hids-server-config: 3.1.0_1 [default]
	ossec-hids-server: 3.1.0_3 [default]
	openssl: 1.0.2r,1 [default]
	expect: 5.45.4_1,1 [default]
	tcl86: 8.6.9_1 [default]
	readline: 8.0.0 [default]
	indexinfo: 0.3.1 [default]
	libinotify: 20180201_1 [default]
	postgresql10-client: 10.7_2 [ossec-hids]
	perl5: 5.28.1_1 [default]

Note that the postgresql10-client is the same in both repositories so selection
of the wrong repository does little harm in this particular case.