opencryptoki version churn has broken some systems

[Thomas Bushnell, BSG]

In the ongoing version churn of opencryptoki and libopencryptoki0, we have users who are in the following state:

Our archive (and apt-cache policy agrees) has version 2.3.1+dfsg-3ubuntu4 for both opencryptoki and libopencryptoki0.

But installed on the system are libopencryptoki0 2.3.1+dfsg-3ubuntu4 and and opencryptoki 2.3.1+dfsg-3ubuntu1.

apt-get dist-upgrade fails:

You might want to run 'apt-get -f install' to correct these.
The following packages have unmet dependencies:
opencryptoki : Depends: libopencryptoki0 (= 2.3.1+dfsg-3ubuntu1) but 2.3.1+dfsg-3ubuntu4 is installed
E: Unmet dependencies. Try using -f.

and apt-get -f install fails:

Reading package lists... Done
Building dependency tree
Reading state information... Done
Correcting dependencies... Done
The following extra packages will be installed:
 opencryptoki
The following packages will be upgraded:
 opencryptoki
1 upgraded, 0 newly installed, 0 to remove and 518 not upgraded.
1 not fully installed or removed.
Need to get 0 B/49.7 kB of archives.
After this operation, 1,024 B of additional disk space will be used.
Do you want to continue [Y/n]?
dpkg: dependency problems prevent configuration of opencryptoki:
opencryptoki depends on libopencryptoki0 (= 2.3.1+dfsg-3ubuntu1); however:
 Version of libopencryptoki0 on system is 2.3.1+dfsg-3ubuntu4.
dpkg: error processing opencryptoki (--configure):
dependency problems - leaving unconfigured
No apport report written because the error message indicates its a followup error from a previous failure.

Errors were encountered while processing:
opencryptoki
E: Sub-process /usr/bin/dpkg returned an error code (1)

This is particularly bad because it cannot be automatically fixed. Our normal procedure (dpkg --configure -a, apt-get -f install, apt-get dist-upgrade) is unable to resolve the problem.

[Thomas Bushnell, BSG (tbushnell)]

ping

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Stéphane Graber (stgraber)]

I remember seeing a chroot in that state but I assumed I created that mess by manually running "dpkg -i" on some locally built .deb.

I'd guess running "sudo dpkg --purge opencryptoki libopencryptoki0 && sudo apt-get install opencryptoki" should fix your problem in a relatively sane way.

I'd still be interested to hear about upgrade conditions from lucid => precise or oneiric => precise that would trigger that state, if that's reproducible, then we definitely need to fix the dependencies to avoid this.

[Thomas Bushnell BSG (tb-becket)]

Yes, we know for sure that purge & reinstall fixes the problem...that's our advice to affected users.

But the packaging system is supposed to work automatically, and we rely on that to maintain tens of thousands of machines. (Though obviously not that much is running precise right now.) This issue will automatically become irrelevant in a short amount of time; my real question is that I'd like to understand how it could happen.

A lucid=>precise upgrade shouldn't produce this problem; I think it's specific to the 2.3.1+dfsg-3ubuntu1 package which was momentarily available on precise.