#1110359 libatlas3-base: insufficient dependency on libblas3

Package:
libatlas3-base
Source:
libatlas3-base
Description:
transitional package
Submitter:
Helmut Grohne
Date:
2025-08-10 09:37:01 UTC
Severity:
normal
Tags:
#1110359#5
Date:
2025-08-03 19:15:49 UTC
From:
To:
A partial upgrade of libatlas3-base may render the library broken and
libblas.so.3 may be gone. This situation does normally not arise,
because apt usually upgrades all binary packages from the same source
package together, but it can still be encountered in complex upgrades.

mmdebstrap bookworm /dev/null http://deb.debian.org/debian --variant=apt --include=libatlas3-base,libblas3 --chrooted-customize-hook='sed -i -e s/bookworm/trixie/ /etc/apt/sources.list && apt update && apt-get -o APT::Get::Upgrade-By-Source-Package=False install -y libatlas3-base && ls -la /usr/lib/x86_64-linux-gnu/libblas.so.3'

This reproducer lifts the lock-step upgrade to simulate upgrading to the
transitional package only. Once doing so, the alternative is a dangling
symbolic link and libblas.so.3 is gone. Upgrading libblas3 resolves the
problems, so most systems will not practically experience this symptom.

The solution to this problem is good practice: Transitional packages
should issue a versioned dependency. libatlas3-base should really
"Depends: libblas3 (= ${binary:Version})". Another good practice is for
them to be of the same architecture and Multi-Arch value as their target
package, so libatlas3-base should switch from Arch:all to Arch:any and
become M-A:same. Doing otherwise breaks multiarch-enabled upgrades.

I recommend trying to fix this for trixie.
--- a/debian/control
+++ b/debian/control
@@ -315,8 +315,9 @@
  This package contains a shared version of the library.

 Package: libatlas3-base
-Depends: libblas3, ${misc:Depends}
-Architecture: all
+Depends: libblas3 (= ${binary:Version}), ${misc:Depends}
+Architecture: any
+Multi-Arch: same
 Section: oldlibs
 Description: transitional package
  This is a transitional package. It can safely be removed.

Helmut

#1110359#10
Date:
2025-08-05 21:19:32 UTC
From:
To:
We believe that the bug you reported is fixed in the latest version of
lapack, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1110359@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Mo Zhou <lumin@debian.org> (supplier of updated lapack package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 05 Aug 2025 16:53:57 -0400
Source: lapack
Architecture: source
Version: 3.12.1-5
Distribution: unstable
Urgency: medium
Maintainer: Debian Science Team <debian-science-maintainers@lists.alioth.debian.org>
Changed-By: Mo Zhou <lumin@debian.org>
Closes: 1110359
Changes:
 lapack (3.12.1-5) unstable; urgency=medium
 .
   [ Helmut Grohne ]
   * Fix libatlas3-base: insufficient dependency on libblas3 (Closes: #1110359)
Checksums-Sha1:
 d8d123f28fa403b1a6143baa18003663f36b87ad 3414 lapack_3.12.1-5.dsc
 d7363325d0a9f82f44ce1db829d2368eec007521 28564 lapack_3.12.1-5.debian.tar.xz
 1164cab7131d6339543b15938dd07d85bfa256b9 6024 lapack_3.12.1-5_source.buildinfo
Checksums-Sha256:
 854444637fb805c5dff98bde8c179561bf71d7e15f42fa6bcfb82bea5ccd0b64 3414 lapack_3.12.1-5.dsc
 59adf24633137d691d45b29504f5f622a11247bbfcaf42d60117b067074089d6 28564 lapack_3.12.1-5.debian.tar.xz
 8cbc021c2d8573feeaf9f31b0dcad6def0596b790d6fa47d0e4c18209459b03e 6024 lapack_3.12.1-5_source.buildinfo
Files:
 76f8b60e39fdb0f23dec59c775936238 3414 libs optional lapack_3.12.1-5.dsc
 34f37b41c814fb50c01d9ce6fe861b32 28564 libs optional lapack_3.12.1-5.debian.tar.xz
 4de9117b9d26daea711566047f2a43c1 6024 libs optional lapack_3.12.1-5_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJFBAEBCgAvFiEEY4vHXsHlxYkGfjXeYmRes19oaooFAmiSb5oRHGx1bWluQGRl
Ymlhbi5vcmcACgkQYmRes19oaoqlkA//VFjrnd0MwKJfqKEnpuWAoUOucFHj2EOG
NHQt6O0M1OGfOlHFqlXFalV7LR8uqEzmhbQ+FjaeHRn1k6Zs5wMhoWbxQ6VW2hau
rUEvlJd1de8fgvR2Ip+81bYDhodQ9+/r+9rhZRyJKuZ5UaJ5FV6gq2ycs7lmkvNp
9uqiQKaGfYlO2AVzOlacGVIKHlhwIx7ef5IFqVilcoHTjBTFF5U8Ivibdgn+Y02e
N4IYXCbY5/0YE09eIYzUkyqcufRNuK/zQpqIBPy7uUXfhFOwMOQ4sVrR4C0cHLRS
Tlh+a7ZoD/MlD0LiMIvlwBRBczS2DplYoU0VPkrBfqBtznV9C+BuZs28KSzRfSC6
QNactN7luYbK5eZ9s1i5nWHhKdqlzFUjtPDh2lGUyl962/M8bQnpsLseFUlSwosn
JADfKIemb8ZzUtAtoFsbj94PfQ+KYccA//GSW0Flr9mxBjGRE+zTQ4mz1huweU3B
aUuP1HbpVuB6s8+B9yacKAfz/LNBQ3+rRybOfH+6RW92NY1/AAOobTEZ4NDdqw0k
8uIah8TOUtw9iO8LdO/ofv9pIY7j+5YioQRvjFHIPaIiG+aEa1uXLRRVb9MgGImW
S/9GRNnzMXJDBqvb3xK1fB1FF558qn3ROLQmx3HHAkL9M5atnTPQgXqMakCyOwbk
Jl1rXId7Wt0=
=rOUr
-----END PGP SIGNATURE-----

#1110359#15
Date:
2025-08-07 09:52:12 UTC
From:
To:
...
...

Should this be (>= ${binary:Version}) instead of (=)?

In other packages that migrated to another name via a transitional
package (gdk-pixbuf, pango1.0) we've seen that sometimes users of stable
releases have to keep the transitional package installed for a long
time, even after it has been eliminated from Debian (hopefully during
forky in this case), because third-party packages outside Debian still
have a dependency on the old name.

After upgrading the transitional libatlas3-base to its Debian 13 version
(for simplicity let's pretend that it's version 13) there are three
possible scenarios:

1. libatlas3-base (= 13), libblas3 (= 13): good.
    This is the only one allowed by the proposed dependency.

2. libatlas3-base (= 13), libblas3 (<< 13):
    bad, for the reasons Helmut gave on #1110466

3. libatlas3-base (= 13), libblas3 (>> 13):
    should be fine, we can assume that libblas3 (>> 13) is
    "better than" libblas3 (= 13)

So I think the best-practice for empty transitional packages is that
they should retain their previous Architecture and Multi-Arch, and have:

     Depends: the-new-package (>= some suitable version)

Thanks,
     smcv

#1110359#20
Date:
2025-08-07 10:49:43 UTC
From:
To:
Hi Simon,

Thank you. I concur. Is this something we might reasonable get into
Debian policy or the developers reference? It's not the first time that
someone (myself included) gets this wrong.

Helmut

#1110359#25
Date:
2025-08-07 17:50:10 UTC
From:
To:
Hi Simon,

Thanks for the suggestion. I revised the fix and uploaded
a new version to unstable. The debdiff can be found below:

So we will need to unblock lapack/3.12.1-6 after buildd
finishes their jobs.

```
diff --git a/debian/changelog b/debian/changelog
index bfa08538..adb4b650 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+lapack (3.12.1-6) unstable; urgency=medium
+
+  * Revise the deps for libatlas3-base (transitional) as suggested in #1110359
+    Thanks to Simon McVittie for the suggestion.
+
+ -- Mo Zhou <lumin@debian.org>  Thu, 07 Aug 2025 13:26:25 -0400
+
 lapack (3.12.1-5) unstable; urgency=medium

   [ Helmut Grohne ]
diff --git a/debian/control b/debian/control
index 1c61bc90..b57e0f62 100644
--- a/debian/control
+++ b/debian/control
@@ -315,7 +315,7 @@ Description: Basic Linear Algebra Reference implementations, shared library
  This package contains a shared version of the library.

 Package: libatlas3-base
-Depends: libblas3 (= ${binary:Version}), ${misc:Depends}
+Depends: libblas3 (>= ${binary:Version}), ${misc:Depends}
 Architecture: any
 Multi-Arch: same
 Section: oldlibs
```