Bug#841207: apt-rdepends: When multiple versions of a package exists, apt-rdepends uses the oldest

[spike.sp@free.fr]

Package: apt-rdepends
Version: 1.3.0-3
Severity: important
Tags: patch

Dear Maintainer,

I was using apt-rdepends to build a package dependencies when I noticed 
that the dependencies were incorrect.


For instance, here is an extract of "apt-cache show ansible" (ansible 
has 2 versions available):
	Package: ansible
	Version: 2.1.1.0-1~bpo8+1
	...
	Depends: python, python-crypto (>= 2.6), python-jinja2, 
python-paramiko, python-pkg-resources, python-yaml, python:any (<< 2.8), 
python:any (>= 2.7.5-5~), python-httplib2, python-netaddr
	...

	Package: ansible
	Version: 1.7.2+dfsg-2
	...
	Depends: python (>= 2.7), python (<< 2.8), python-paramiko, 
python-jinja2, python-yaml, python-pkg-resources, python-crypto (>= 
2.6), python-httplib2
	...


Now if I run "apt-rdepends ansible":
	Reading package lists... Done
	Building dependency tree
	Reading state information... Done
	ansible
	  Depends: python (<< 2.8)
	  Depends: python-crypto (>= 2.6)
	  Depends: python-httplib2
	  Depends: python-jinja2
	  Depends: python-paramiko
	  Depends: python-pkg-resources
	  Depends: python-yaml
	...


Clearly the output if for the 1.7.2+dfsg-2 version which is the oldest.
Now if you dig into apt-rdepends code a comment says (lines 247 & 248): 
"Notice how we get the last version for our forward dependencies."
Obviously this is not working (or was working in the past ?).
A few lines after (line 253) the version used is extracted from the list 
of versions using the pop() command. Replacing with a shift() command 
solves the issue.

Here is a patch:

--- /usr/bin/apt-rdepends       2012-09-16 11:47:10.000000000 +0200
+++ apt-rdepends        2016-10-18 14:51:10.579036849 +0200
@@ -256,7 +256,7 @@
   }
   else {
     if (my $i = $p->{VersionList}) {
-      if (my $j = pop(@$i)) {
+      if (my $j = shift(@$i)) {
        return $j->{DependsList};
       }
     }

Once applied, the output of "apt-rdepends ansible" is:
	Reading package lists... Done
	Building dependency tree
	Reading state information... Done
	ansible
	  Depends: python
	  Depends: python-crypto (>= 2.6)
	  Depends: python-httplib2
	  Depends: python-jinja2
	  Depends: python-netaddr
	  Depends: python-paramiko
	  Depends: python-pkg-resources
	  Depends: python-yaml
	  Depends: python:any (>= 2.7.5-5~)
	...

Which corresponds to the last version.


-- System Information:
Debian Release: 8.5
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: i386 (i686)

Kernel: Linux 3.16.0-4-686-pae (SMP w/1 CPU core)
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages apt-rdepends depends on:
ii  libapt-pkg-perl  0.1.29+b2
ii  perl             5.20.2-3+deb8u6

apt-rdepends recommends no packages.

Versions of packages apt-rdepends suggests:
pn  springgraph | graphviz  <none>
pn  vcg                     <none>

-- no debconf information