(#3461,#3487) Prevent dependency resolution from downgrading packages #3486

corbob · 2024-07-16T00:51:03Z

Description Of Changes

Prevent dependency resolution from downgrading packages when --allow-downgrade is not specified.
Prevent packages from installing if a dependent package fails installation.

Motivation and Context

Chocolatey 2.3.0 incorrectly allows a package to be downgraded to resolve a dependency when it has not been specified to allow downgrades.
Chocolatey 2.3.0 installs a package even if one or more of the packages it depends on fails to install resulting in a broken state.

Testing

Run tests through TeamCity/Test Kitchen
Run all integration tests with ./build.bat --testExecutionType=all --shouldRunOpenCover=false
Run a spattering of manual tests.

Operating Systems Testing

Windows Server 2019/2016
Windows 10

Change Types Made

Bug fix (non-breaking change).
Feature / Enhancement (non-breaking change).
Breaking change (fix or feature that could cause existing functionality to change).
Documentation changes.
PowerShell code changes.

Change Checklist

Requires a change to the documentation.
Documentation has been updated.
Tests to cover my changes, have been added.
All new and existing tests passed?
PowerShell code changes: PowerShell v3 compatibility checked?

Related Issue

corbob · 2024-07-16T00:51:53Z

This PR is in draft as I still need to run more tests as well as add more tests. And apparently bring the branch in line with the develop branch.

corbob · 2024-08-15T18:05:36Z

This PR is currently based upon #3500, while this will make a review of it prior to #3500 being merged a little awkward, the fix from #3500 is required for some of the pester tests to complete successfully.

tests/pester-tests/commands/choco-upgrade.Tests.ps1

gep13 · 2024-08-22T14:34:47Z

@corbob I am going to rebase this PR onto the head of develop, since my PR has now been merged, which will make reviewing this PR easier.

gep13

I have left a few comments for review.

src/chocolatey/infrastructure.app/services/NugetService.cs

tests/packages/failingdependency/tools/chocolateyinstall.ps1

tests/packages/upgradedowngradesdependency/Readme.md

tests/pester-tests/commands/choco-install.Tests.ps1

tests/packages/dependencyfailure/dependencyfailure.nuspec

tests/packages/failingdependency/failingdependency.nuspec

tests/packages/hasfailingnesteddependency/1.0.0/hasfailingnesteddependency.nuspec

tests/packages/hasnesteddependency/1.0.0/hasnesteddependency.nuspec

corbob · 2024-08-26T16:27:08Z

@gep13 I'll add it here instead of in the conversations... The var x and var nullResult I think were taken from my re-use of this code that is currently line 1187 in the PR:

    var nullResult = packageResultsToReturn.GetOrAdd(packageName, new PackageResult(installedPackage.PackageMetadata, pathResolver.GetInstallPath(installedPackage.PackageMetadata.Id)));
    nullResult.Messages.Add(new ResultMessage(ResultType.Error, logMessage));

I think, I did the var x as while debugging I wanted to investiage the object to see if there was anything I could do with it in lieu of what I was.

The var nullResult was a direct copy of the existing code, but as discussed earlier today, it is better to be clear about what the object is for, so I'll either come up with a better name, add a comment, or perhaps not even use a variable...

tests/packages/hasnesteddependency/1.0.0/hasnesteddependency.nuspec

src/chocolatey/infrastructure.app/services/NugetService.cs

AdmiringWorm

LGTM

Outdated review

When a package dependency fails to install, we will now fail the package as well.

Some of these package already existed on our internal repository, while some of them have been added for the tests being added.

We have added some tests for the install all command. This adds a new package source to the testing environment so that we can run the tests locally and in Test Kitchen.

Add a number of tests for dependency scenarios where we did not have tests before.

In the NugetService we were using a nullResult variable to allow us to add messages to the result. We do not need this variable if we're only adding a single message. This commit removes the unnecessary variables.

…ncies

…tests

This updates the `test-chocolateypath` package to have a description and removes the unneeded comments. This is related to a GitLab MR that noted these things when bringing this package into the internal repository. This reverts commit ffd9aab4b40dc8b47b84de5f3ce91ea22fda7a6d.

Address review comments by using full version string for PackageResults, and use case insensitive compares when determining if a package has dependencies that failed to install.

This adds logic to the Invoke-Tests file to output if a package failed fail to pack. This allows for improved developer experience by indicating if packages fail to build. This also allows impromptu improvement to the developer experience by allowing simple changes to the script to throw in place of outputting an errorand thus not allowing tests to run without the full set of test packages.

This commit removes templated values from the test packages being added in this PR.

corbob force-pushed the 3461-downgrades branch from 521b26b to c3c71b6 Compare July 18, 2024 19:56

corbob force-pushed the 3461-downgrades branch 2 times, most recently from 64f2ded to 1731d3e Compare August 12, 2024 23:41

corbob force-pushed the 3461-downgrades branch 2 times, most recently from 37574fb to 7e225aa Compare August 15, 2024 17:47

corbob changed the title ~~(#3461) Prevent dependency resolution from downgrading packages~~ (#3461,#3487) Prevent dependency resolution from downgrading packages Aug 15, 2024

corbob commented Aug 15, 2024

View reviewed changes

tests/pester-tests/commands/choco-upgrade.Tests.ps1 Outdated Show resolved Hide resolved

corbob force-pushed the 3461-downgrades branch 2 times, most recently from a4cf193 to 8b82e88 Compare August 15, 2024 20:53

gep13 self-requested a review August 16, 2024 15:24

gep13 force-pushed the 3461-downgrades branch from 8b82e88 to 695754d Compare August 22, 2024 14:38

gep13 reviewed Aug 22, 2024

View reviewed changes

gep13 previously requested changes Aug 26, 2024

View reviewed changes

corbob force-pushed the 3461-downgrades branch from 695754d to 950ce5d Compare August 26, 2024 16:57

corbob marked this pull request as ready for review August 27, 2024 14:49

corbob force-pushed the 3461-downgrades branch from e1a6373 to 8841937 Compare August 30, 2024 22:33

AdmiringWorm requested changes Sep 19, 2024

View reviewed changes

corbob force-pushed the 3461-downgrades branch 2 times, most recently from 7d074d5 to 0b93f0c Compare September 26, 2024 18:29

AdmiringWorm approved these changes Sep 27, 2024

View reviewed changes

corbob added 5 commits September 27, 2024 11:31

(maint) Convert common string to constant

4debd46

(chocolatey#3461) Prevent downgrade of dependency

d660ca5

(chocolatey#3487) Prevent package success on dependency fail

f911382

When a package dependency fails to install, we will now fail the package as well.

(chocolatey#3461) Add downgrade install pester test

522d520

(chocolatey#3461,chocolatey#3487) Add test packages for added tests

4a8479e

Some of these package already existed on our internal repository, while some of them have been added for the tests being added.

corbob added 9 commits September 27, 2024 11:31

(chocolatey#3461,chocolatey#3487) Add an all packages source for tests

e5c5838

We have added some tests for the install all command. This adds a new package source to the testing environment so that we can run the tests locally and in Test Kitchen.

(chocolatey#3461,chocolatey#3487) Add pester tests for dependencies

d77c0bd

Add a number of tests for dependency scenarios where we did not have tests before.

(maint) Remove unnecessary variable usage

53264d2

In the NugetService we were using a nullResult variable to allow us to add messages to the result. We do not need this variable if we're only adding a single message. This commit removes the unnecessary variables.

fixup! (chocolatey#3461,chocolatey#3487) Add pester tests for depende…

acdf0ba

…ncies

fixup! (chocolatey#3461,chocolatey#3487) Add test packages for added …

dc713f1

…tests

(chocolatey#3461,chocolatey#3487) Address review comments

a93c0c4

Address review comments by using full version string for PackageResults, and use case insensitive compares when determining if a package has dependencies that failed to install.

(maint) Remove templated values from test packages

ff7009e

This commit removes templated values from the test packages being added in this PR.

AdmiringWorm force-pushed the 3461-downgrades branch from 23b5661 to ff7009e Compare September 27, 2024 09:33

AdmiringWorm merged commit 48c93a3 into chocolatey:develop Sep 27, 2024
5 checks passed

corbob deleted the 3461-downgrades branch November 5, 2024 22:56

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

(#3461,#3487) Prevent dependency resolution from downgrading packages #3486

(#3461,#3487) Prevent dependency resolution from downgrading packages #3486

corbob commented Jul 16, 2024 •

edited

Loading

corbob commented Jul 16, 2024

corbob commented Aug 15, 2024

gep13 commented Aug 22, 2024

gep13 left a comment

corbob commented Aug 26, 2024

AdmiringWorm left a comment

(#3461,#3487) Prevent dependency resolution from downgrading packages #3486

(#3461,#3487) Prevent dependency resolution from downgrading packages #3486

Conversation

corbob commented Jul 16, 2024 • edited Loading

Description Of Changes

Motivation and Context

Testing

Operating Systems Testing

Change Types Made

Change Checklist

Related Issue

corbob commented Jul 16, 2024

corbob commented Aug 15, 2024

gep13 commented Aug 22, 2024

gep13 left a comment

Choose a reason for hiding this comment

corbob commented Aug 26, 2024

AdmiringWorm left a comment

Choose a reason for hiding this comment

corbob commented Jul 16, 2024 •

edited

Loading