depot package version requirements are too strict

[Nobody III]

Currently, if I modify a library or server to fix a bug or add a feature, I
can't get other packages to use the updated version without modifying them
also. This leads to two problems:
1. unnecessary installation of multiple versions of the same package
(unnecessary downloading and disk usage)
2. awkwardness with applying modifications globally

For example, if I fix an issue in libc, that fix cannot be cleanly applied
to all packages that use libc. It is possible to iterate through all
packages that depend on REPO/src/libc/VERSION and modify the version
information for each one, but this is awkward and doesn't scale well. To
make matters worse, this would have to be (partially) repeated each time a
package is downloaded.

A potential piece of a solution would be to allow packages to specify the
oldest version they are backward-compatible with, e.g. let libc/2018-06-05
specify that it is compatible with libc >= 2018-05-28.

For more flexibility, we could also allow packages to specify multiple
dependency options, e.g. let noux-system depend on bash or bash-minimal.

Also, we need some mechanism to allow cross-repo substitutions, e.g. let
blarson/src/libc replace genodelabs/src/libc, or vice versa. For security
reasons, there should be restrictions on which repos are allowed for
substitutions, so untrusted/src/libc cannot replace genodelabs/src/libc.

Any other thoughts or suggestions?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.genode.org/pipermail/users/attachments/20180606/572c9f89/attachment.html>