bug#54350: Profile collisions are ignored, installing multiple versions of the same package is silently broken

[Ludovic Courtès]

Hi,

Maxime Devos <maximedevos@telenet.be> skribis:

> Ludovic Courtès schreef op di 15-03-2022 om 14:50 [+0100]:
>> $ ./pre-inst-env guix shell -D guile -n
>> guix shell: error: profile contains conflicting entries for bash-minimal
>> guix shell: error:   first entry: bash-minimal@5.1.8 
>> /gnu/store/chfwin3a4qp1znnpsjbmydr2jbzk0d6y-bash-minimal-5.1.8
>> guix shell: error:   second entry: bash-minimal@5.1.8 
>> /gnu/store/4y5m9lb8k3qkb1y9m02sw9w9a6hacd16-bash-minimal-5.1.8
>> hint: You cannot have two different versions or variants of `bash-minimal' 
>> in the same profile.
>> --8<---------------cut here---------------end--------------->8---

I wonder whether this is the exception rather than the rule.  Here’s an
unscientific not-quite-random sample:

--8<---------------cut here---------------start------------->8---
$ ./pre-inst-env guix shell -D guix
guix shell: error: profile contains conflicting entries for bzip2
guix shell: error:   first entry: bzip2@1.0.8 
/gnu/store/gzmwrl6cb8nxmc68hpgqzblng2kamkgc-bzip2-1.0.8
guix shell: error:   second entry: bzip2@1.0.8 
/gnu/store/s3hl12jxz9ybs7nsy7kq7ybzz7qnzmsg-bzip2-1.0.8
hint: You cannot have two different versions or variants of `bzip2' in the same 
profile.

$ ./pre-inst-env guix shell -D inkscape --no-grafts -n
guix shell: error: profile contains conflicting entries for libsigc++
guix shell: error:   first entry: libsigc++@3.0.6 
/gnu/store/ng4k2yl94d758p5vnashd4nvyb1aw8s1-libsigc++-3.0.6
guix shell: error:    ... propagated from cairomm@1.14.2
guix shell: error:    ... propagated from gtkmm@3.24.5
guix shell: error:   second entry: libsigc++@2.9.3 
/gnu/store/iad8jg1fm7jsq0pqj547f3n5s2jn9rp0-libsigc++-2.9.3
hint: Try upgrading both `gtkmm' and `libsigc++', or remove one of them from 
the profile.

$ ./pre-inst-env guix shell -D gimp --no-grafts -n
guix shell: error: profile contains conflicting entries for librsvg
guix shell: error:   first entry: librsvg@2.50.7 
/gnu/store/wj3sigq6pwjc2z68qgbpv8pxcv8haklf-librsvg-2.50.7
guix shell: error:   second entry: librsvg@2.50.7 
/gnu/store/q3vymxinnp6cxqq1cpz1rdqmnwq5x1ni-librsvg-2.50.7
hint: You cannot have two different versions or variants of `librsvg' in the 
same profile.

$ ./pre-inst-env guix shell -D openmpi --no-grafts -n
The following derivation would be built:
   /gnu/store/fpj74z159bf6v7cxsxs5rxm3xm4w2amz-profile.drv

$ ./pre-inst-env guix shell -D hwloc --no-grafts -n
The following derivation would be built:
   /gnu/store/ikf40sfmk3y7r3frxm9fbkzmma4ym8ay-profile.drv

$ ./pre-inst-env guix shell -D guile-gcrypt --no-grafts -n
The following derivation would be built:
   /gnu/store/3ip5kq50b97bsm6zhygz0fjx54w0fqa0-profile.drv

$ ./pre-inst-env guix shell -D libgit2 --no-grafts -n
The following derivation would be built:
   /gnu/store/8f83l9p88g40mrnl5l4wrzqg5zwgn6cm-profile.drv

$ ./pre-inst-env guix shell -D python-pytorch --no-grafts -n
substitute: updating substitutes from 'https://ci.guix.gnu.org'... 100.0%
substitute: updating substitutes from 'https://bordeaux.guix.gnu.org'... 100.0%
The following derivation would be built:
   /gnu/store/aly6xd3vi5j0qimjzj2hj0wry5zma376-profile.drv

37.2 MB would be downloaded
$ ./pre-inst-env guix shell -D python-itsdangerous --no-grafts -n
The following derivation would be built:
   /gnu/store/cgxgvj73wgx263lzd3f82vvjl39vn4pn-profile.drv

--8<---------------cut here---------------end--------------->8---

We should check automatically the fraction of packages for which
‘package->development-manifest’ contains colliding entries.

If it’s rather rare, we might as well have ‘guix shell’ default to
#:allow-collisions? #f.

(The issue for GIMP comes from librsvg vs. librsvg-bootstrap.  The one
for inkscape is a genuine problem.)

If we take that route, we could also add a linter that checks for
collisions in package dependencies.

>> These collisions are harmless but frequent in package development
>> environments, which is why ‘guix environment’ had to turn off those
>> checks (commit afd06f605bf88a796acefc7ed598b43879346a6b).
>> 
>> That’s a bit of a hack though.
>
> These collisions happen because the bag of a package contains of multiple
> variants of bash: the default canonical bash-minimal, from (gnu packages
> commencement), not directly visible (i.e., with "guix show" and
> 'specification->package'), which is overidden by the bash-minimal from
> native-inputs, which is visible from specification->package and as a public
> variable, and as I understand it, the bash-minimal supposed to end up
> in the references of non-bootstrap packages.
>
> For these kind of collisions, I think the non-canonical package (that's
> actually visible with "guix show FOO") is preferred here, so perhaps
> the canonical variants can be filtered out whenever that would resolve
> a collision?

I’m not fond of filtering out, because that can make it hard to
understand what the inputs of a package really are.

However, we could tweak the collision detection code to ignore
collisions with hidden packages or something along these lines.

Thoughts?

Ludo’.