xbps-src will accept packages from remote repos as fullfilling dependencies even when they aren't available in srcpkgs/

ericonr commented 3 years ago

Writing a template to depend on zstd-devel (removed in d481489dae9449f5212f4e2b5fab74e858962242) should fail because srcpkgs/zstd-devel/template doesn't exist. Instead, if it's still available in remote repositories because it hasn't been cleaned up, it will be enough to satisfy the dependency.

An example from adding zstd-devel to depends for kicad-library.

   [target] zstd-devel: found (https://alpha.de.repo.voidlinux.org/current/musl)
   [runtime] kicad-footprints-5.1.10_1: found (https://alpha.de.repo.voidlinux.org/current/musl)
   [runtime] kicad-packages3D-5.1.10_1: found (https://alpha.de.repo.voidlinux.org/current/musl)
   [runtime] kicad-symbols-5.1.10_1: found (https://alpha.de.repo.voidlinux.org/current/musl)
   [runtime] kicad-templates-5.1.10_1: found (https://alpha.de.repo.voidlinux.org/current/musl)

This can lead to issues such as 5898b6cbe0efcf6c129799a0993943fc7128f1a7 (fixed in d0ae88846bf833a5e1171dff6dd44a65c4891466), where a package can be made to depend on another one that's no longer available.

When fixing this, care should be taken to not break virtual packages or others depending on the provides= mechanism (though arguably packages which are providesd by something are valid only in depends).