Is it possible for an RPM package to have no version?

[shanebishop]

Context

Feel free to skip this context, and go straight to my question.

My team has written some software that uses librpm to retrieve the version and release for every RPM package installed on a system (we use RPMTAG_VERSION and RPMTAG_RELEASE respectively to retrieve this data). The software component on the host sends an event containing this data to a backend service that performs downstream processing on this data in order to meet the requirements of the larger application.

We have observed from our backend service's logs that there is a package that has an empty version string, and an empty release string. Specifically, this it the package information in the event our backend service flagged:

• Package name: "appdynamics-machine-agent"
• Epoch: "0"
• Version: ""
• Release: ""
• SOURCERPM value: "appdynamics-machine-agent---src.rpm"
• Vendor: "AppDynamics Inc"

The client-side software that generates the events has been distributed and is now running in production. We do not have access to the hosts, as the client runs on customer computers. Therefore, we are not free to SSH onto the host and run rpm -qa --queryformat to confirm the data in the event matches the data reported by rpm on the host itself.

Some investigation that I have performed

I downloaded what I believe to be an RPM installer for the latest version of this package, and installed the package. I noticed that the data reported on the package by rpm is different than the data in the event I describe above:

$ rpm -qa --queryformat '%{NAME},%{EPOCH},%{VERSION},%{RELEASE},%{SOURCERPM},%{VENDOR}\n' | grep -i appdynamics
appdynamics-machine-agent,0,24.1.0.3984,1,appdynamics-machine-agent-24.1.0.3984-1-src.rpm,AppDynamics Inc

I believe the reason why the data is different is because I installed using a newer version of the RPM installer than our customer used when they installed the package on their system. I could not find anywhere on the AppDynamics website that I could download any older versions of the RPM installer.

I also tried building an RPM installer from a .spec file that omits the Version property, but I got the error Version field must be present in package. Perhaps this is just because omitting the Version is no longer legal in my version of rpmbuild, which is version 4.11.3.

Question

Was it ever possible, at any point in the history of RPM, for a RPM package to be created without a version or a release?

[pmatilai]

Was it ever possible, at any point in the history of RPM, for a RPM package to be created without a version or a release?

No. Absolutely not.

A package with empty or missing name, version, release, arch, os, license or summary tags is simply invalid, and rpm could and should (but apparently doesn't) refuse to install it at all.

That package was either created by a modified rpmbuild (or perhaps more likely), custom-written 3rd party tool.