(In reply to comment #41)
> The problem with this change is it will use any activated media, including
> third party media and backports. This is too risky. The need is not for updates
> to pull dependencies from anywhere, only from release media.
> 
> Sorry to kill hopes :)

If people don't want to install packages from a media, then they should not activate that media.

The patch from #c40 seems correct to me. Before the patch, MageiaUpdate :
- tag as searchmedia all update media
- load synthesis from update media only
- use searchmedia medias to find update candidates
- resolve dependencies for update candidates using all loaded synthesis

What the patch change is that synthesis from all active media are loaded, instead of only update ones. So it still uses only medias tagged as update to find update candidates for installed packages, but pull new dependencies from any active media. It treats updates media like --search-media.

If you have a third party or backports media but don't want to install packages from this media, why is it activated ? If the media is active, you should expect that some dependencies can be pulled from this media, otherwise what is the meaning of an active media ?

And that's also how urpmi works. If you urpmi some package, it will pull dependencies from any active media. And nobody complains about unwanted dependencies installed from third party or backports media in that case.

For backports users, there is currently two possibilities to configure backports :
- you want to install all available backports. In that case, you activate backport medias, and tag them as update.
- you don't want to install all available backports but want to cherry pick some of them only. In that case, you keep backport medias as disabled, and install backports using urpmi --searchmedia 'backport medias' or rpmdrake which support installing backports from disabled medias.

MageiaUpdate could be patched to use only medias listed as "updates_for" in media.cfg, but that seems wrong :
- this info is only available in media.cfg, and not everybody is using media.cfg to add their medias
- depending on infos only available in media.cfg is not really clean, if we're using this info, I think we should add it to urpmi.cfg. And this cannot be added easily in an update, as it would require that people remove and add again all their medias.
- if we're handling dependencies between medias, we should do it correctly, and everywhere, not only in MageiaUpdate. And this requires important changes, not really appropriate for an update to a stable release
- we have some infos about media dependencies with "updates_for", but we don't have all the dependencies infos. For instance we don't know that nonfree depends on core medias. Before starting to implement media dependencies we should properly define keyword used in media configuration and what they mean.
- urpmi is already complexe, and we should avoid adding useless complexity. And I don't think media dependencies is really useful.

By the way support for backports in rpmdrake could be improved and cleaned, as it is currently using hardcoded media names to detect medias. For Mageia 3, a backport keyword could be added to urpmi.cfg to tag backport medias. And then we could add a --backport option to urpmi to install from backport medias. I think that would be much more useful than trying to implement media dependencies.