bug#53883: strange conflicts with guix package -m manifest

[Leo Famulari]

On Tue, Feb 08, 2022 at 10:05:32PM +0100, Dr. Arne Babenhauserheide wrote:
> Hello Guix,
> 
> I see strange conflicts when trying to update packages via manifest:
> 
> guix package: error: profile contains conflicting entries for python-cffi
> guix package: error:   first entry: python-cffi@1.15.0 
> /gnu/store/fnkn12qv3bw7z3jhdgp2drd0nnn0p433-python-cffi-1.15.0
> guix package: error:    ... propagated from python-cmarkgfm@0.7.0
> guix package: error:    ... propagated from python-readme-renderer@32.0
> guix package: error:    ... propagated from python-twine@1.15.0
> guix package: error:   second entry: python-cffi@1.14.4 
> /gnu/store/4zz00w8rqrfazv5lsjajs0g8y04ysa8g-python-cffi-1.14.4
> guix package: error:    ... propagated from python-cryptography@3.3.1
> guix package: error:    ... propagated from python-pyopenssl@20.0.1
> guix package: error:    ... propagated from python-urllib3@1.26.7
> guix package: error:    ... propagated from python-requests@2.26.0
> guix package: error:    ... propagated from python-requests-toolbelt@0.9.1
> guix package: error:    ... propagated from python-twine@1.15.0
> 
> 
> As you can see, both packages are python-twine, and they have
> conflicting dependencies.

Basically, the python-twine package, as it is now, cannot be installed
in a profile.

That is because its dependency graph of propagated packages includes
different versions of python-cffi, and you cannot install both of these
cffi packages alongside each other in a symlink forest (i.e. a profile).

The solution is make this dependency graph only include one version of
cffi. Either python-cryptography should use cffi 1.15.0, or cmarkgfm
should use cffi 1.14.4. There may be other conflicts to resolve as well,
but we should try to resolve all of them.

Guix probably also printed a hint:

hint: You cannot have two different versions or variants of `python-twine' in 
the same profile.

That hint is misleading in this case and we should tweak the code that
generates it. The hint text was written when the only such conflicts
came from different packages propagated a colliding dependencies.