{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4754","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4754/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4754/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4754/events","html_url":"https://github.com/rapid7/metasploit-framework/issues/4754","id":57496747,"number":4754,"title":"metasploit_data_models version mismatch","user":{"login":"ZeroChaos-","id":1670905,"avatar_url":"https://avatars.githubusercontent.com/u/1670905?v=3","gravatar_id":"","url":"https://api.github.com/users/ZeroChaos-","html_url":"https://github.com/ZeroChaos-","followers_url":"https://api.github.com/users/ZeroChaos-/followers","following_url":"https://api.github.com/users/ZeroChaos-/following{/other_user}","gists_url":"https://api.github.com/users/ZeroChaos-/gists{/gist_id}","starred_url":"https://api.github.com/users/ZeroChaos-/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ZeroChaos-/subscriptions","organizations_url":"https://api.github.com/users/ZeroChaos-/orgs","repos_url":"https://api.github.com/users/ZeroChaos-/repos","events_url":"https://api.github.com/users/ZeroChaos-/events{/privacy}","received_events_url":"https://api.github.com/users/ZeroChaos-/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/bug","name":"bug","color":"e11d21"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/creds","name":"creds","color":"d4c5f9"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/external","name":"external","color":"bfdadc"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/library","name":"library","color":"fad8c7"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-02-12T18:05:50Z","updated_at":"2015-02-12T20:46:29Z","closed_at":null,"body":"Bundler could not find compatible versions for gem \"metasploit_data_models\":\r\n  In Gemfile:\r\n    metasploit-framework-db (>= 0) ruby depends on\r\n      metasploit-credential (~> 0.13.8) ruby depends on\r\n        metasploit_data_models (~> 0.22.5) ruby\r\n\r\n    metasploit-framework-db (>= 0) ruby depends on\r\n      metasploit_data_models (0.21.3)\r\n\r\nThis kinda says it all but I'll try to explain the situation.  In Gentoo and Pentoo, users can have multiple versions of metasploit installed side by side.  To support this, the metasploit gems are allowed to install multiple versions at a time as well.  Typically the latest release and metasploit head are installed at the same time.  Most of the gems in metasploit have deps like \"~>0.22.5\" which means \"0.22.5=< desired version <0.23\".\r\n\r\nAs such, the gems in gentoo have been \"slotted\" so that multiple 0.x versions can be installed at the same time, but only one of each 0.x.y version can be installed at once.\r\n\r\nEven forgetting the designed limitations in gentoo, it appears that the semantic versioning is broken here.  The installed metasploit-credential 0.13.16 satisfies the requirements for \"metasploit-credential ~>0.13.8\" but requires metasploit_data_models ~>0.22.5 which then causes an issue since metasploit 4.11 directly requires metasploit_data_models 0.21.3.\r\n\r\nI believe it would be best to drop any versions of metasploit-credential which require newer metasploit_data_models 0.22 and re-release at metasploit-credential-0.14.x; this is not the only solution, but it seems the most correct to me."},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/74149363","html_url":"https://github.com/rapid7/metasploit-framework/issues/4754#issuecomment-74149363","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4754","id":74149363,"user":{"login":"limhoff-r7","id":2230482,"avatar_url":"https://avatars.githubusercontent.com/u/2230482?v=3","gravatar_id":"","url":"https://api.github.com/users/limhoff-r7","html_url":"https://github.com/limhoff-r7","followers_url":"https://api.github.com/users/limhoff-r7/followers","following_url":"https://api.github.com/users/limhoff-r7/following{/other_user}","gists_url":"https://api.github.com/users/limhoff-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/limhoff-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/limhoff-r7/subscriptions","organizations_url":"https://api.github.com/users/limhoff-r7/orgs","repos_url":"https://api.github.com/users/limhoff-r7/repos","events_url":"https://api.github.com/users/limhoff-r7/events{/privacy}","received_events_url":"https://api.github.com/users/limhoff-r7/received_events","type":"User","site_admin":false},"created_at":"2015-02-12T20:46:29Z","updated_at":"2015-02-12T20:46:29Z","body":"As for the general point of when a gem should indicate an incompatible or compatible version change in semantic versioning: metasploit-credential should not make the assumption that downstream projects directly depend on metasploit_data_models.  They may only directly depend on the metasploit-credential API, in which case it is valid for the version of metasploit-credential to indicate compatibility in its version change while depending on an incompatible version of metasploit_data_models.  If we follow your recommendation, that would indicate that compatible vs incompatible version change would have to indicate incompatibility when any gem a project depends upon has an incompatible change.  Are you proposing we adopt this process for determining whether to make the version compatible or incompatible?"}}