New opinions wanted for bug #676485 (squeeze→wheezy GNOME upgrade)

[Josselin Mouette <joss@debian.org>]

Hi all,

we’re facing a very subtle APT upgrade bug with #676485 and we’d like
input from a larger number of developers before implementing an
imperfect solution.

Basically, a full GNOME upgrade from squeeze to wheezy is failing
because of a large number of lockstep upgrades using Depends/Breaks
pairs, for related packages.

The bug was triggered by fixing #677582 in gcc-4.7-base, adding a final
Breaks that makes APT lose itself in a loop involving glib, gdk-pixbuf,
libstdc++, gcc-4.*, gcj-4.*, and many others. This is clearly an APT bug
since it should just upgrade everything together, but so far we don’t
know the exact origin of this bug. (And as libstdc++ is involved,
upgrading APT first is not possible anyway.)

We found by testing a few ways to break this cycle and get the upgrade
to work.
1. Remove the gcj-4.7-jre → libgcj13-awt dependency
        → But applications depending on the JRE expect to have the GUI
        parts, so I don’t think this can work.
2. Remove some of the Breaks in gcc-4.7-base
        → This means bringing back parts of #677582, meaning some
        upgrades won’t be complete.
3. Remove most Breaks in libglib2.0-0 (all that depend directly or
     indirectly on libgdk-pixbuf2.0-0) 
      * The gvfs one can be kept as is. 
      * For gtk3, eog, gwaei and emacs23, the broken versions for which
        the Breaks was added are not in squeeze, so we could remove the
        Breaks safely. 
      * For gnome-session and gnome-control-center, it is mostly a
        question of missing functionality when the upgrade is not done
        together with glib, so the Breaks is less important. 
      * For gdm3, however, allowing partial upgrades leaves a
        possibility of a login session from which you can invoke stuff
        like a web browser, which is unacceptable from a security
        standpoint.

So far, we’re going towards removing all Breaks from libglib2.0-0
(except for gvfs) and uploading a new gdm3 in squeeze to remove that
risk (provided this upload is approved by the SRMs):
- export XDG_DATA_DIRS in the greeter session
- add the mimeapps.list and mime-dummy-handler.desktop from the wheezy
   package

If anyone has an idea to make these upgrades better than doing a stable
upload, it would be appreciated.

Cheers,
-- 
 .''`.      Josselin Mouette
: :' :
`. `'
  `-