Hi,

in https://security.debian.org/pool/updates/main/p/python-cryptography/ the
arch:all package for python-cryptography 38.0.4-3~deb12u1 is missing, it's
also not in the package index. The arch-specific packages and source are
present.

Severity minor because it's a -doc package in oldstable-security, but
someone might still want to investigate how that happened.

According to my logfiles, the file existed and was referenced in the index
when I downloaded it on 2024-06-08 20:32:20 UTC.

   Simon

That's curious, because
https://snapshot.debian.org/package/python-cryptography/38.0.4-3~deb12u1/
has no record of having seen it on 2023-03-10 when the arch-specific
packages were indexed.

It's also not present in the security archive snapshots either side of
your timestamp, i.e.
https://snapshot.debian.org/archive/debian-security/20240605T203035Z/
and
https://snapshot.debian.org/archive/debian-security/20240609T121325Z/

As I mentioned in the discussion in #debian-devel, the queue report
from the original upload in March 2023 has:

binary:python-cryptography-doc
ACCEPT
REJECT

implying that the package was never actually installed into the
security archive.


Regards,

Adam

Hi Adam,

This is I believe a leftover from our test in
https://lists.debian.org/debian-release/2023/03/msg00072.html
https://lists.debian.org/debian-release/2023/03/msg00084.html

So I think we can close this as there was never meant to have this
version not beeing overriden.

Regards,
Salvatore

[...]

Fine by me, I'm just curious as to how Simon apparently downloaded
something that doesn't seem to have existed. :-)

Regards,

Adam

Hi Adam,

Or othermwise maybe the archive team could clean up the remmenants of
this experiment, so there won't be any furher confusion? (If so then
we can reassign the bug to ftp.d.o?)

Regards,
Salvatore

Hi,

I'm confused as well. Basically I have an autobuilder that builds
bookworm-security for riscv64, mostly for me to get some feeling for the
pitfalls of autobuilding stuff. This thing does not even know how to
build arch:all packages so it must have been imported from somewhere.

I'm importing source and arch:all packages, and then ask reprepro for
missing builds, this is how I found this after extending the search to
"any missing architectures."

I wonder if Debian needs any way to detect inconsistent states like this
as well.

Other than that, I think just removing it is probably fine (and will
allow me to test whether automatic removal works properly :> ).

    Simon