pkg/48620: pkgin loses dependency information in pkg_install database

[Thomas Klausner <wiz%NetBSD.org@localhost>]

>Number:         48620
>Category:       pkg
>Synopsis:       pkgin loses dependency information in pkg_install database
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    pkg-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Feb 26 15:35:00 +0000 2014
>Originator:     Thomas Klausner
>Release:        NetBSD 6.99.32
>Organization:
Curiosity is the very basis of education and if you tell me that 
curiosity killed the cat, I say only that the cat died nobly.
- Arnold Edinborough
>Environment:
        
        
Architecture: x86_64
Machine: amd64
>Description:
When using 'pkgin fug' to update packages, they lose the information by what 
packages
they are needed, while the packages needing them still know about this.
This causes problems later-on. For example, when you do pkg_delete -r, not all
depending packages are removed.
>How-To-Repeat:
Upgrade a package that is used by another one.
Example, after upgrading isl with 'pkgin fug':

# pkg_info isl
Information for isl-0.12.2:

Comment:
Integer set library required by gcc graphite

Requires:
gmp>=5.0.1

Description:
isl is a library for manipulating sets and relations of integer
points bounded by linear constraints. Supported operations on sets
include intersection, union, set difference, emptiness check, convex
hull, (integer) affine hull, integer projection, and computing the
lexicographic minimum using parametric integer programming. It also
includes an ILP solver based on generalized basis reduction.

Homepage:
http://isl.gforge.inria.fr/

# pkg_info gcc48
Information for gcc48-4.8.2nb1:

Comment:
The GNU Compiler Collection (GCC) - 4.8 Release Series

Requires:
gmp>=5.0.1
mpcomplex>=0.8.2
mpfr>=3.0.0.3
cloog>=0.18.0nb1
isl>=0.11.1

Required by:
icc11-11.1.080nb2

Description:
The GNU Compiler Collection (GCC) includes front ends for C, C++, Objective-C,
Fortran, Java, and Go, as well as libraries for these languages (libstdc++,
libgcj,...). This package provides the snapshot relases of version 4.8.
See http://gcc.gnu.org/gcc-4.8/changes.html for changes relative to 4.7.x.

Homepage:
http://gcc.gnu.org/

So isl doesn't know that gcc48 needs it, but gcc48 still remembers.

>Fix:
Do what 'make replace' does.
Move the file with the dependency information aside and restore it after
updating the package.


For bonus points: mark the depending packages with unsafe_depends, like
pkg_rr does.

>Unformatted: