{"action":"opened","issue":{"url":"https://api.github.com/repos/berkshelf/berkshelf/issues/1473","labels_url":"https://api.github.com/repos/berkshelf/berkshelf/issues/1473/labels{/name}","comments_url":"https://api.github.com/repos/berkshelf/berkshelf/issues/1473/comments","events_url":"https://api.github.com/repos/berkshelf/berkshelf/issues/1473/events","html_url":"https://github.com/berkshelf/berkshelf/issues/1473","id":115349866,"number":1473,"title":"Berkshelf may compare different version of cookbook then lock's during `trusted?`","user":{"login":"bbaugher","id":2530095,"avatar_url":"https://avatars.githubusercontent.com/u/2530095?v=3","gravatar_id":"","url":"https://api.github.com/users/bbaugher","html_url":"https://github.com/bbaugher","followers_url":"https://api.github.com/users/bbaugher/followers","following_url":"https://api.github.com/users/bbaugher/following{/other_user}","gists_url":"https://api.github.com/users/bbaugher/gists{/gist_id}","starred_url":"https://api.github.com/users/bbaugher/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bbaugher/subscriptions","organizations_url":"https://api.github.com/users/bbaugher/orgs","repos_url":"https://api.github.com/users/bbaugher/repos","events_url":"https://api.github.com/users/bbaugher/events{/privacy}","received_events_url":"https://api.github.com/users/bbaugher/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-11-05T18:59:21Z","updated_at":"2015-11-05T18:59:21Z","closed_at":null,"body":"I was able to get this to occur using Berkshelf 3.3.0 and 4.0.1. Its pretty simple to replicate.\r\n\r\nCreate Berksfile (effectively my Berksfile at the time)\r\n\r\n    source 'https://supermarket.getchef.com'\r\n    cookbook 'java'\r\n\r\nThen `berks install` (this is to ensure java 1.36.0 or higher is installed into shelf)\r\n\r\nUpdate Berksfile.lock to (this is effectively what I had in my Berksfile.lock previously)\r\n\r\n    DEPENDENCIES\r\n      java\r\n    \r\n    GRAPH\r\n      java (1.35.0)\r\n\r\nThen,\r\n\r\n    berks install\r\n    berks upload\r\n\r\nFails with,\r\n\r\n    The lockfile is out of sync! Run `berks install` to sync the lockfile\r\n\r\nRunning with debug shows,\r\n\r\n    I, [2015-11-05T12:46:56.017352 #10043]  INFO -- : Checking if lockfile is trusted\r\n    D, [2015-11-05T12:46:56.017434 #10043] DEBUG -- : Checking java (>= 0.0.0)\r\n    D, [2015-11-05T12:46:56.697593 #10043] DEBUG -- :   Detected there is a cached cookbook\r\n    D, [2015-11-05T12:46:56.697672 #10043] DEBUG -- :   Cached cookbook has different dependencies - cannot be trusted!\r\n\r\nThe java cookbook recently released 1.36.0 which includes a new dependency on apt. If you delete 1.36.0 of java from shelf everything works,\r\n\r\n    berks shelf uninstall java -f -v 1.36.0\r\n    berks upload\r\n\r\nSimilarly if you add a version constraint to the Berksfile `= 1.35.0` this also fixes the issue even if 1.36.0 is in shelf.\r\n\r\nBonus points if you can make figuring this out easier (i.e. what dependencies are different, what cookbook is causing the problem, tell me without using debug?)"}}