[Buildroot] [PATCH v3 07/16] package/pkg-generic.mk: detect files overwritten in TARGET_DIR and HOST_DIR

[Yann E. MORIN]

Hervé, Thomas, All,

On 2021-08-17 10:39 +0200, Herve Codina spake thusly:
> From: Thomas Petazzoni <thomas.petazzoni at bootlin.com>
> Without per-package directory support, a package can happily overwrite
> files installed by other packages. Indeed, because the build order
> between packages is always guaranteed, Buildroot will always produce
> the same output.
[--SNIP--]
> This commit is a new implementation of such a detection, which is
> based on calculating and verifying MD5 hashes of installed files: the
> calculation is done at the beginning of the configure step, the
> verification during the newly introduced "install" step that takes
> place after all installation steps.

Following the various mails in the thread, and the discussion we had on
Tuesday, I'm markign this patch as Changes Requested.

I'll try to scavenge all I can from the remaining patches, and mark the
rest as Changes Requested as well.

So, to summarise the discussion, taking my previous example as a basis,
and with Arnout's comment in mind (Aha, pun!):

      .-<-- A --<-.                 S: skeleton
     /             \                F: target-finalize
    S --<-- B --<-- C
     \               \
      `-<-- D --<-----<-- F

 1. If C overwrites a file from (e.g.) A: we don't know the order in
    which the target-finalize will copy files.

    - we can guarantee that ordering by taking the dependency chain into
      account when doing target-finalize.

 2. If A and B install the same package: we don't know what to provide
    to package C:

    - adding an artificial dependency between A and B is not acceptable,
      or we could end up with a lot of such unmanageable dependencies,
      not even  accounting for packages in a br32-external tree;

    - if the file is a DB (like the GNU info DB), stuff is "added" to
      that DB; only providing an arbitrary version of the file (from A
      or from B) is incorrect.

 3. If a package in the C dependency chain (C included), and package D
    install the same file, then we're in the same boat as the above: we
    do not know what version to use in tergaet-finalize.

If I missed something, then feel free to complete. ;-)

Regards,
Yann E. MORIN.

-- 
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'