Mistaken auto-syncs from Debian unstable or experimental

[Colin Watson]

[TL;DR for James: groovy clue requested near the bottom of this mail.]

It turns out that the Launchpad Archive.copyPackages method isn't safe
to use when doing auto-syncs, because it syncs the newest version
available in the source distribution, regardless of series:

  https://bugs.launchpad.net/launchpad/+bug/913722

I'm sorry for not catching this before doing the first API-based
auto-syncs over the weekend.  I regret to say that I synced several
packages from the wrong series without realising it until today.
Obviously I'm going to fix the Launchpad bug ASAP, but we also need to
analyse the effects on Ubuntu.  here's a complete report of the affected
packages:

  cufflinks 1.3.0-1
    sid 1.3.0-1
    wheezy 1.2.1-1
  groovy 2.0.0~beta2-1
    experimental 2.0.0~beta2-1
    wheezy 1.8.5-1
    sid 1.8.5-1
    squeeze 1.7.0-4
    lenny 1.5.6-1
  hyde 0.8.5a1-3
    sid 0.8.5a1-3
    wheezy 0.8.5a1-2
  kedpm 0.5.0-4
    sid 0.5.0-4
    wheezy 0.5.0-3
  libcdio 0.83-1
    experimental 0.83-1
    wheezy 0.81-5
    sid 0.81-5
    squeeze 0.81-4
    lenny 0.78.2+dfsg1-3
  linkchecker 7.4-1
    sid 7.4-1
    wheezy 7.3-1
    squeeze 5.2-2
    lenny 4.9-1
  linux-container 1-4
    sid 1-4
    wheezy 1-3
  maradns 2.0.04-1
    experimental 2.0.04-1
    wheezy 1.4.09-1
    sid 1.4.09-1
    squeeze 1.4.03-1.1
    lenny 1.3.07.09-2.1
  prerex 6.2-6.3.1-1
    sid 6.2-6.3.1-1
    wheezy 6.2-1
  pyew 2.0-3
    sid 2.0-3
    wheezy 2.0-2
  webcolors 1.3.1+hg~2c8ac6e0a03d-2
    sid 1.3.1+hg~2c8ac6e0a03d-2
    wheezy 1.3.1+hg~2c8ac6e0a03d-1
  wrapitk-python 3.20.1.2
    sid 3.20.1.2
    sid 3.20.1.1
    wheezy 3.20.0.1
    sid 3.20.0.1
  xen-api 1.3-15
    sid 1.3-15
    wheezy 1.3-13

Here's grep-excuses output for those packages that were synced from
unstable:

  cufflinks (1.2.1-1 to 1.3.0-1)
      Maintainer: Debian Med Packaging Team
      Section: non-free/science
      Too young, only 3 of 10 days old
      Not considered
  hyde (0.8.5a1-2 to 0.8.5a1-3)
      Maintainer: Julien Danjou
      Too young, only 6 of 10 days old
      Not considered
  kedpm (0.5.0-3 to 0.5.0-4)
      Maintainer: Antoine Beaupré
      Too young, only 3 of 10 days old
      Not considered
  linkchecker (7.3-1 to 7.4-1)
      Maintainer: Bastian Kleineidam
      Too young, only 1 of 10 days old
      Not considered
      Ignoring armhf depends: python2.7
      Ignoring s390x depends: python2.7
  linux-container (1-3 to 1-4)
      Maintainer: Daniel Baumann
      Too young, only 7 of 10 days old
      Not considered
  prerex (6.2-1 to 6.2-6.3.1-1)
      Maintainer: Ryan Kavanagh
      Too young, only 5 of 10 days old
      Not considered
      Ignoring armhf depends: poppler
      Ignoring armhf depends: qt4-x11
      Ignoring armhf depends: xterm
      Ignoring s390x depends: poppler
      Ignoring s390x depends: qt4-x11
      Ignoring s390x depends: xterm
  pyew (2.0-2 to 2.0-3)
      Maintainer: David Martínez Moreno
      Too young, only 2 of 10 days old
      Not considered
  webcolors (1.3.1+hg~2c8ac6e0a03d-1 to 1.3.1+hg~2c8ac6e0a03d-2)
      Maintainer: Kouhei Maeda
      Too young, only 5 of 10 days old
      Updating python-webcolors fixes old bugs: #652287
      Not considered
  wrapitk-python (3.20.0.1 to 3.20.1.2)
      Maintainer: Debian Med Packaging Team
      29 days old (needed 10 days)
      out of date on i386: python-insighttoolkit3 (from 3.20.1.1)
      out of date on kfreebsd-i386: python-insighttoolkit3 (from 3.20.1.1)
      out of date on mips: python-insighttoolkit3 (from 3.20.1.1)
      out of date on mipsel: python-insighttoolkit3 (from 3.20.0.1)
      wrapitk-python (source) has new bugs!
      Updating wrapitk-python introduces new bugs: #654718
      Updating wrapitk-python fixes old bugs: #651433
      Not considered
  xen-api (1.3-13 to 1.3-15)
      Maintainer: Pkg Xen
      Too young, only 1 of 10 days old
      Not considered

Everything there but wrapitk-python looks fairly harmless; it's too new
for testing, but not obviously broken.  wrapitk-python failed to build
in Ubuntu in the same way as shown in the linked Debian bug, but it's a
new package so this hasn't caused any real damage.  We should perhaps
sync more recent versions as and when this gets fixed, but it can stick
around for now.

That leaves the packages synced from experimental; groovy 2.0.0~beta2-1,
libcdio 0.83-1, and maradns 2.0.04-1.

groovy has a bunch of reverse build-dependencies (codenarc commons-jci
eucalyptus eucalyptus-commons-ext freemind freeplane gant gmetrics
gradle jasperreports jasperreports3.7 jenkins jenkins-json
libgpars-groovy-java libjson-java libspring-2.5-java libspring-java
libxbean-java logback maven-invoker-plugin mojarra mule red5 stapler).
James, could you perhaps have a look to see if anything is broken here,
or if there's anything we need to take special effort to validate?

libcdio seems to mainly be in experimental because of the new library
SONAMEs.  On the principle of cleaning up my own mess, I'll do the
requisite rebuilds for this.

As for maradns, I don't really know.  It has no reverse-dependencies so
it's probably not the end of the world, and the synced version is the
current upstream stable release, but I don't know if the configuration
file and init script issues alluded to in TODO.Debian
(http://bazaar.launchpad.net/+branch/debian/sid/maradns/view/head:/debian/TODO.Debian,
http://bazaar.launchpad.net/+branch/debian/experimental/maradns/view/head:/debian/TODO.Debian)
have been fixed.  Does anyone have an interest in this?

-- 
Colin Watson                                       [cjwatson at ubuntu.com]