Bug#1021702: debian-cd: Take constraints into account while building the cd packages pool

[Arnaud Rebillout <arnaudr@kali.org>]

Package: debian-cd
Version: debian-cd: Please take constraints into account while building the cd packages pool
Severity: normal
User: devel@kali.org
Usertags: origin-kali

Dear Maintainer,

I'm documenting here something that we've hit in Kali lately. The
installer didn't include a package that was depended upon, and
therefore the installation failed.

The offending package was king-phisher (only in Kali). Syslog said:

  in-target: The following packages have unmet dependencies:
  in-target:  king-phisher : Depends: python3-matplotlib (>= 1.4.3) but it is not installable
  in-target:                 Recommends: python3-mpltoolkits.basemap (>= 1.0.7) but it is not installable
  
By entering a chroot, and trying to install the king-phisher package,
using the pool of packages provided in the Kali installer, I get:

  # apt install king-phisher
  [...]
  The following packages have unmet dependencies:
   python3-fonttools : Depends: python3-unicodedata2 (>= 14.0.0) but it is not installable or
                                python3-all (>= 3.11.0) but 3.10.6-1 is to be installed
  E: Unable to correct problems, you have held broken packages.

Looking at the dependency tree now:

  king-phisher
  +-- python3-matplotlib
    +-- python3-fonttools
      +-- python3-unicodedata2 (>= 14.0.0) | python3-all (>= 3.11.0)
  
In the pool of packages that are available in the Kali iso, we don't
have python3-unicodedata2 , however we have python3-all , BUT it's at
version 3.10.6-1 ... So nothing can satisfy the dependency.

So it looks to me that it's a bug in debian-cd. I guess that the
resolver that decides which packages are included in the pool didn't
include python3-unicodedata2 because there was python3-all already, but
it didn't take into account the constraints >= 3.11.0.

As a sidenote, it looks like the maintainer of python3-fonttools is a
bit ahead of time, his package depends on python3-unicodedata2 (>=
14.0.0) | python3-all (>= 3.11.0) but 3.11 is not yet released, it's
planned for end of October.

Note that this is an issue only for installers that don't have access to
the network. If network is available, I guess that python3-unicodedata2
will be fetched from a remote package repository, so no problem for most
users.

Thanks,

Arnaud