rmdepcheck always fails with bogus errors from krb5-server, insights-client, gnome-keyring on EPEL 9 #23

Closed
opened 2026-04-08 01:27:37 +00:00 by adamwill · 8 comments
Owner

I'm baffled as to why ATM, but it seems like whenever it's run on EPEL 9, rmdepcheck gives a bunch of bogus failures:

Dependencies of other packages that would be BROKEN by the tested packages:
package: gnome-keyring-40.0-3.el9.x86_64 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/
  /usr/libexec/gcr-ssh-askpass
package: gnome-keyring-40.0-4.el9_4.x86_64 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/
  /usr/libexec/gcr-ssh-askpass
package: insights-client-3.1.7-6.el9_0.noarch from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/
  /usr/libexec/platform-python
package: insights-client-3.1.7-8.el9.noarch from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/
  /usr/libexec/platform-python
package: insights-client-3.1.7-10.el9_1.noarch from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/
  /usr/libexec/platform-python
package: insights-client-3.1.7-12.el9.noarch from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/
  /usr/libexec/platform-python
package: insights-client-3.1.7-12.1.el9_2.noarch from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/
  /usr/libexec/platform-python
package: insights-client-3.2.2-1.el9_2.noarch from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/
  /usr/libexec/platform-python
package: insights-client-3.2.2-1.el9_3.noarch from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/
  /usr/libexec/platform-python
package: insights-client-3.2.2-2.el9.noarch from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/
  /usr/libexec/platform-python
package: krb5-server-1.19.1-15.el9_0.i686 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/
  /usr/share/dict/words
package: krb5-server-1.19.1-15.el9_0.x86_64 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/
  /usr/share/dict/words
package: krb5-server-1.19.1-22.el9.i686 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/
  /usr/share/dict/words
package: krb5-server-1.19.1-22.el9.x86_64 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/
  /usr/share/dict/words
package: krb5-server-1.19.1-23.el9_1.i686 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/
  /usr/share/dict/words
package: krb5-server-1.19.1-23.el9_1.x86_64 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/
  /usr/share/dict/words
package: krb5-server-1.19.1-24.el9_1.i686 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/
  /usr/share/dict/words
package: krb5-server-1.19.1-24.el9_1.x86_64 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/
  /usr/share/dict/words
package: krb5-server-1.20.1-8.el9.i686 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/
  /usr/share/dict/words
package: krb5-server-1.20.1-8.el9.x86_64 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/
  /usr/share/dict/words
package: krb5-server-1.20.1-9.el9_2.i686 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/
  /usr/share/dict/words
package: krb5-server-1.20.1-9.el9_2.x86_64 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/
  /usr/share/dict/words
package: krb5-server-1.21.1-1.el9.i686 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/
  /usr/share/dict/words
package: krb5-server-1.21.1-1.el9.x86_64 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/
  /usr/share/dict/words
package: krb5-server-1.21.1-2.el9_4.i686 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/
  /usr/share/dict/words
package: krb5-server-1.21.1-2.el9_4.x86_64 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/
  /usr/share/dict/words
package: krb5-server-1.21.1-3.el9.i686 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/
  /usr/share/dict/words
package: krb5-server-1.21.1-3.el9.x86_64 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/
  /usr/share/dict/words
package: krb5-server-1.21.1-4.el9_5.i686 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/
  /usr/share/dict/words
package: krb5-server-1.21.1-4.el9_5.x86_64 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/
  /usr/share/dict/words
package: krb5-server-1.21.1-6.el9.i686 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/
  /usr/share/dict/words
package: krb5-server-1.21.1-6.el9.x86_64 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/
  /usr/share/dict/words
package: libebml-devel-1.4.5-1.el9.x86_64 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/
  /usr/lib64/cmake
package: libmatroska-devel-1.6.3-3.el9.x86_64 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/
  /usr/lib64/cmake

Trying to figure this out. It's very weird.

I'm baffled as to why ATM, but it seems like whenever it's run on EPEL 9, rmdepcheck gives a bunch of bogus failures: ``` Dependencies of other packages that would be BROKEN by the tested packages: package: gnome-keyring-40.0-3.el9.x86_64 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/ /usr/libexec/gcr-ssh-askpass package: gnome-keyring-40.0-4.el9_4.x86_64 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/ /usr/libexec/gcr-ssh-askpass package: insights-client-3.1.7-6.el9_0.noarch from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/ /usr/libexec/platform-python package: insights-client-3.1.7-8.el9.noarch from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/ /usr/libexec/platform-python package: insights-client-3.1.7-10.el9_1.noarch from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/ /usr/libexec/platform-python package: insights-client-3.1.7-12.el9.noarch from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/ /usr/libexec/platform-python package: insights-client-3.1.7-12.1.el9_2.noarch from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/ /usr/libexec/platform-python package: insights-client-3.2.2-1.el9_2.noarch from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/ /usr/libexec/platform-python package: insights-client-3.2.2-1.el9_3.noarch from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/ /usr/libexec/platform-python package: insights-client-3.2.2-2.el9.noarch from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/ /usr/libexec/platform-python package: krb5-server-1.19.1-15.el9_0.i686 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/ /usr/share/dict/words package: krb5-server-1.19.1-15.el9_0.x86_64 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/ /usr/share/dict/words package: krb5-server-1.19.1-22.el9.i686 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/ /usr/share/dict/words package: krb5-server-1.19.1-22.el9.x86_64 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/ /usr/share/dict/words package: krb5-server-1.19.1-23.el9_1.i686 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/ /usr/share/dict/words package: krb5-server-1.19.1-23.el9_1.x86_64 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/ /usr/share/dict/words package: krb5-server-1.19.1-24.el9_1.i686 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/ /usr/share/dict/words package: krb5-server-1.19.1-24.el9_1.x86_64 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/ /usr/share/dict/words package: krb5-server-1.20.1-8.el9.i686 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/ /usr/share/dict/words package: krb5-server-1.20.1-8.el9.x86_64 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/ /usr/share/dict/words package: krb5-server-1.20.1-9.el9_2.i686 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/ /usr/share/dict/words package: krb5-server-1.20.1-9.el9_2.x86_64 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/ /usr/share/dict/words package: krb5-server-1.21.1-1.el9.i686 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/ /usr/share/dict/words package: krb5-server-1.21.1-1.el9.x86_64 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/ /usr/share/dict/words package: krb5-server-1.21.1-2.el9_4.i686 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/ /usr/share/dict/words package: krb5-server-1.21.1-2.el9_4.x86_64 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/ /usr/share/dict/words package: krb5-server-1.21.1-3.el9.i686 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/ /usr/share/dict/words package: krb5-server-1.21.1-3.el9.x86_64 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/ /usr/share/dict/words package: krb5-server-1.21.1-4.el9_5.i686 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/ /usr/share/dict/words package: krb5-server-1.21.1-4.el9_5.x86_64 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/ /usr/share/dict/words package: krb5-server-1.21.1-6.el9.i686 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/ /usr/share/dict/words package: krb5-server-1.21.1-6.el9.x86_64 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/ /usr/share/dict/words package: libebml-devel-1.4.5-1.el9.x86_64 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/ /usr/lib64/cmake package: libmatroska-devel-1.6.3-3.el9.x86_64 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/ /usr/lib64/cmake ``` Trying to figure this out. It's very weird.
adamwill added this to the Sprint 7 project 2026-04-08 01:27:42 +00:00
Author
Owner

Aha, figured it out. When setting up the modified base repos, we only download the primary repodata, because I thought this contained everything we need. But it doesn't. It only includes files in /etc and /usr/bin; info on the files in each package outside those paths is in the filelists metadata.

The problematic deps are file-based deps outside of the paths that are in the primary repodata. So when we do the unmodified repoclosure, using the real repodata, those deps are OK. When we do the modified repoclosure, using the modified repodata which contains only primary, those deps show up as not OK because we don't know the 'words' package contains /usr/share/dict/words etc.

To fix this, we need to download filelists as well as primary. And modify it too, I guess, to remove the same packages we remove from the primary repodata.

Aha, figured it out. When setting up the modified base repos, we only download the `primary` repodata, because I thought this contained everything we need. But it doesn't. It only includes files in `/etc` and `/usr/bin`; info on the files in each package outside those paths is in the `filelists` metadata. The problematic deps are file-based deps outside of the paths that are in the `primary` repodata. So when we do the unmodified repoclosure, using the real repodata, those deps are OK. When we do the modified repoclosure, using the modified repodata which contains only `primary`, those deps show up as not OK because we don't know the 'words' package contains `/usr/share/dict/words` etc. To fix this, we need to download `filelists` as well as `primary`. And modify it too, I guess, to remove the same packages we remove from the primary repodata.
Author
Owner

OK, well, this is proving more complex than expected. I added download and parsing of the filelist data and...the script promptly ground to a halt and hung my system till it got OOM killed. At first I thought I did something wrong, then I realized nope, that's not it, these are just sodding huge files, and we're parsing them with et.parse(), which loads the entire thing into memory. Loading EPEL 9 primary metadata actually uses 8G already (I'm a bit surprised the script doesn't choke when running in openQA, tbh) and loading the filelist metadata on top of that just blows away all my RAM.

I think I need to switch the metadata replacement function to using iterparse() instead, but I've got to go out in 20 minutes, so I'll do it tomorrow.

OK, well, this is proving more complex than expected. I added download and parsing of the filelist data and...the script promptly ground to a halt and hung my system till it got OOM killed. At first I thought I did something wrong, then I realized nope, that's not it, these are just *sodding huge files*, and we're parsing them with `et.parse()`, which loads the entire thing into memory. Loading EPEL 9 primary metadata actually uses 8G already (I'm a bit surprised the script doesn't choke when running in openQA, tbh) and loading the filelist metadata on top of that just blows away all my RAM. I think I need to switch the metadata replacement function to using `iterparse()` instead, but I've got to go out in 20 minutes, so I'll do it tomorrow.
Author
Owner

ugh, so, today's progress: even iterparse doesn't work easily, because the list of packages is nested inside one big <metadata that we also need to output, but to do that we need to load the whole thing into memory, I think...well, maybe there's a way to make it work, but I skipped instead to "write a hacky line parser that does just enough XML parsing to get the info we need".

This works, and uses less memory, but it's still very slow; parsing the filelists metadata for EPEL 9 takes ~8 minutes. This may just be as fast as we can read 1.8GB of text from disk and flush it back out again, I dunno, but I'll try optimizing it. (One idea is to figure out when we've deleted the last binary package from the filelists metadata and then quit parsing line-by-line and just flush the entire rest of the file into the 'modified' output; I don't know yet if this actually makes it any faster, though).

Another option is to not modify the filelists metadata, just copy it through unmodified, and trust that dnf just ignores filelists entries for packages that don't exist in primary (and doesn't use them to resolve dependencies). I may test this, and if it turns out to be the case, just go with that - just copy filelists into the 'modified' repodata without modification. It's faster at least.

Finally, another wrinkle showed up at the end: we also need to include the modularity metadata (modules.yaml.zst) in the modified repodata, or else all module packages are available to dnf's solver when doing repoclosure on the modified repo and we get some false "fixed" dependencies for non-modular packages:

Dependencies of other packages that would be FIXED by the tested packages:
package: nodejs-esbuild-0.27.2-1.el9.x86_64 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/
  nodejs(engine) >= 18
package: postgresql16-anonymizer-3.0.5-3.el9.x86_64 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/
  postgresql-server > 16
package: postgresql16-credcheck-3.0-8.el9.x86_64 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/
  postgresql-server > 16

those show up as "fixed" because there are appropriately-versioned nodejs and postgresql packages available in modules, but it's not valid for a non-module package to require a module package; if the repodata doesn't include the module metadata, though, all module packages are treated as non-module packages. So I need to copy the module metadata over too.

ugh, so, today's progress: even `iterparse` doesn't work easily, because the list of packages is nested inside one big `<metadata` that we also need to output, but to do that we need to load the whole thing into memory, I think...well, maybe there's a way to make it work, but I skipped instead to "write a hacky line parser that does just enough XML parsing to get the info we need". This *works*, and uses less memory, but it's still very slow; parsing the filelists metadata for EPEL 9 takes ~8 minutes. This may just be as fast as we can read 1.8GB of text from disk and flush it back out again, I dunno, but I'll try optimizing it. (One idea is to figure out when we've deleted the last binary package from the filelists metadata and then quit parsing line-by-line and just flush the entire rest of the file into the 'modified' output; I don't know yet if this actually makes it any faster, though). Another option is to *not* modify the filelists metadata, just copy it through unmodified, and trust that dnf just ignores filelists entries for packages that don't exist in primary (and doesn't use them to resolve dependencies). I may test this, and if it turns out to be the case, just go with that - just copy filelists into the 'modified' repodata without modification. It's faster at least. Finally, another wrinkle showed up at the end: we also need to include the modularity metadata (modules.yaml.zst) in the modified repodata, or else all module packages are available to dnf's solver when doing repoclosure on the modified repo and we get some false "fixed" dependencies for non-modular packages: ``` Dependencies of other packages that would be FIXED by the tested packages: package: nodejs-esbuild-0.27.2-1.el9.x86_64 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/ nodejs(engine) >= 18 package: postgresql16-anonymizer-3.0.5-3.el9.x86_64 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/ postgresql-server > 16 package: postgresql16-credcheck-3.0-8.el9.x86_64 from https://kojipkgs.fedoraproject.org/repos/epel9-build/latest/x86_64/ postgresql-server > 16 ``` those show up as "fixed" because there are appropriately-versioned nodejs and postgresql packages available in modules, but it's not valid for a non-module package to require a module package; if the repodata doesn't include the module metadata, though, all module packages are treated as non-module packages. So I need to copy the module metadata over too.
Author
Owner

OK, I now have a working fix, and thanks to Claude it's pretty fast (my version: 10 minutes, Claude's: 10 seconds), but I'm not sure I love it. I want to try an alternative approach and see if that works. Will probably pick one or the other tomorrow or Monday.

OK, I now have a working fix, and thanks to Claude it's pretty fast (my version: 10 minutes, Claude's: 10 seconds), but I'm not sure I love it. I want to try an alternative approach and see if that works. Will probably pick one or the other tomorrow or Monday.
Author
Owner

#24 is the Cursor/Claude text parser fix; #25 is my hack-around-iterparse fix. I've cleaned them both up to pass CI and tests. I'll probably go ahead and merge my iterparse version soon, but I might look into a third option - using pygixml or pugixml-python - first. I also might hack up openQA to run all the options and compare the results, that might be fun.

https://forge.fedoraproject.org/quality/rmdepcheck/pulls/24 is the Cursor/Claude text parser fix; https://forge.fedoraproject.org/quality/rmdepcheck/pulls/25 is my hack-around-iterparse fix. I've cleaned them both up to pass CI and tests. I'll *probably* go ahead and merge my iterparse version soon, but I might look into a third option - using [pygixml](https://github.com/MohammadRaziei/pygixml) or [pugixml-python](https://github.com/miute/pugixml-python) - first. I also might hack up openQA to run all the options and compare the results, that might be fun.
Author
Owner

So I came up with a different third option which is looking quite nice. It's a hybrid of #24 and #25: we read the file in as a chunked bytestream and parse out the package chunks, as in #24; we then parse the individual chunks with a real XML parser as in #25, not regexes as in #24. But we don't write back out with tostring like we do in #25 - we just use the XML parser to read the package blob and decide whether it should be skipped; if not, we write through the original unmodified bytes. All bytes outside of a package blob are written through unmodified.

With ElementTree this isn't any faster than #25, but with lxml it's nearly as fast as #24, while being (I reckon) substantially less fragile, but also has #24 's benefit of passing through the original input text unmodified except for the removals (in #25, ElementTree .tostring reformats the output somewhat). I couldn't use lxml in #25 because for some reason when I try to swap in lxml's iterparse for ElementTree's, it chokes and I couldn't figure out why or fix it.

I'll clean this up some tomorrow and post it as a new PR, then probably merge that one, I think.

So I came up with a *different* third option which is looking quite nice. It's a hybrid of #24 and #25: we read the file in as a chunked bytestream and parse out the package chunks, as in #24; we then parse the individual chunks with a real XML parser as in #25, not regexes as in #24. But we don't write back out with `tostring` like we do in #25 - we just use the XML parser to read the package blob and decide whether it should be skipped; if not, we write through the original unmodified bytes. All bytes outside of a package blob are written through unmodified. With ElementTree this isn't any faster than #25, but with lxml it's nearly as fast as #24, while being (I reckon) substantially less fragile, but also has #24 's benefit of passing through the original input text unmodified except for the removals (in #25, ElementTree .tostring reformats the output somewhat). I couldn't use lxml in #25 because for some reason when I try to swap in lxml's iterparse for ElementTree's, it chokes and I couldn't figure out why or fix it. I'll clean this up some tomorrow and post it as a new PR, then probably merge that one, I think.
Author
Owner

I've merged #26 , so this should be fixed now. Let's hope.

I've merged #26 , so this *should* be fixed now. Let's hope.
Author
Owner

Although, hmm. The end boss fourth approach to optimizing XML parsing might be...don't do XML parsing any more...

Although, hmm. The end boss fourth approach to optimizing XML parsing might be...[don't do XML parsing any more](https://forge.fedoraproject.org/quality/rmdepcheck/issues/5)...
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
quality/rmdepcheck#23
No description provided.