ocaml / opam-repository

Main public package repository for opam, the source package manager of OCaml.
https://opam.ocaml.org
Creative Commons Zero v1.0 Universal
509 stars 1.1k forks source link

Fix installation of Morbig 0.11.0 #26175

Closed Niols closed 2 days ago

Niols commented 3 days ago

As first reported in https://github.com/colis-anr/morbig/issues/189, Morbig 0.11.0 does not install properly via opam-repository, while pinning colis-anr/morbig does work. Previous version of Morbig are not affected.

The culprit is the change to the opam file made in https://github.com/ocaml/opam-repository/pull/23667 prior to publishing Morbig 0.11.0 in opam-repository. This change affects the build: field (before; after) in a way that makes it not install anything anymore.

The solution is not to revert the change because it introduces the use of make build instead of dune build, and make build includes some important extra steps. However, adding a field install: [make "install"] seems to do the trick.

Reproduce:

Niols commented 3 days ago

I am not sure I understand where the CI error is coming from:

2024-07-02 12:32.14: New job: Lint
2024-07-02 12:32.14: Checking out commit 31efb0b6. To reproduce:
                       git clone --recursive "https://github.com/ocaml/opam-repository.git" && cd "opam-repository" && git fetch origin "refs/pull/26175/head" && git reset --hard 31efb0b6
2024-07-02 12:32.14: Exec: "cp" "-a" "--" "/var/lib/ocurrent/var/git/opam-repository.git-a0bc4b41ddb868605dc1500002c27cfa79faf4389fe53b6754817ea16b48d458/.git" 
                           "/tmp/git-checkout209f466a"
2024-07-02 12:32.15: Exec: "git" "-C" "/tmp/git-checkout209f466a" "submodule" 
                           "deinit" "--force" "--all"
2024-07-02 12:32.16: Exec: "git" "-C" "/tmp/git-checkout209f466a" "reset" 
                           "--hard" "-q" "31efb0b673edd94691929b2901811137b5abbd57"
2024-07-02 12:32.22: Exec: "git" "-c" "protocol.file.allow=always" "-C" 
                           "/tmp/git-checkout209f466a" "submodule" "update" 
                           "--recursive" "--init" "--no-fetch"
2024-07-02 12:32.22: Exec: "git" "merge" "-q" "--" "175a8ca8b27d9a46ed86ec5d7b1130c98a153055"
2024-07-02 12:32.25: Exec: "git" "cat-file " "-e" "175a8ca8b27d9a46ed86ec5d7b1130c98a153055:packages/morbig"
git: 'cat-file ' is not a git command. See 'git --help'.

The most similar command is
    cat-file
2024-07-02 12:32.25: Warning in morbig.0.11.0: Possible name collision with package 'vorbis'
2024-07-02 12:32.42: Job failed: Warning in morbig.0.11.0: Possible name collision with package 'vorbis'
anadon commented 3 days ago

Somewhere in the string splitting, it is appending or preserving a space after cat-file making it cat-file. It looks like code outside of Morbig?

anadon commented 3 days ago

I re-ran the job and now it works. Apparently the issue was transient. And for some reason I can just re-issue jobs? That seems like a security vulnerability waiting to happen.

mseri commented 2 days ago

Thanks