Why does 'apt install node-body-parser' fail?

Question

I have a small Node.js app of my own running on a Raspberry Pi 3 B. A recent apt full-upgrade bumped the nodejs packet from version 4.8.2 to version 8.11.1, and in the process it removed the package node-body-parser which I need. Trying to apt install it again fails with a message telling me that either I have requested an impossible situation or I am using an unstable distribution, and that I have held broken packages. Here is a transcript with the full message:

pi@sionludino:~ $ sudo apt update  
[...]
All packages are up to date.
pi@sionludino:~ $ sudo apt install node-body-parser 
Reading package lists... Done
Building dependency tree       
Reading state information... Done
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
 node-body-parser : Depends: node-raw-body (>= 1.2.0) but it is not going to be installed
                    Depends: node-iconv (>= 2.1.4) but it is not going to be installed
E: Unable to correct problems, you have held broken packages.

I can't make sense of this error message, which I find quite unhelpful. Am I requesting “an impossible situation”? Why is it impossible? Is the distribution I am using (an up to date Raspbian Stretch Lite) considered “the unstable distribution”? And what does “you have held broken packages” mean? I have not held anything that I am aware of.

For now, I have worked around this issue by using npm instead apt. However, since apt is my tool of choice for keeping my computers up to date, it's quite unsettling for me to see it fail in a way I cannot understand. Am I doing something wrong? Is this a bug in the Raspbian (or Debian) packages? If so, should I report it as such? Could I expect it to be fixed?

Edit 1: Following OyaMist Aeroponics’ comment, I googled “apt broken packages” and followed the advice from the first answer:

• The commands sudo apt-get update --fix-missing, sudo dpkg --configure -a and sudo apt-get install -f ran with no errors, but they did not help (sudo apt install node-body-parser still outputs the same error).
• There is no mention of in node-body-parser in /var/lib/dpkg/status

Edit 2: As suggested here: dpkg -l | grep -v '^ii' does not show any package (only the list headers), dpkg --audit does not dot have any effect.

Edits 3 & 4: I don't think I have enabled the backports repository. Here is my /etc/apt/sources.list:

deb http://raspbian.raspberrypi.org/raspbian/ stretch main contrib non-free rpi
# Uncomment line below then 'apt-get update' to enable 'apt-get source'
#deb-src http://raspbian.raspberrypi.org/raspbian/ stretch main contrib non-free rpi

The directory /etc/apt/sources.list.d contains a single file named “raspi.list” with the following content:

deb http://archive.raspberrypi.org/debian/ stretch main ui
# Uncomment line below then 'apt-get update' to enable 'apt-get source'
#deb-src http://archive.raspberrypi.org/debian/ stretch main ui

I tried removing (sudo apt purge nodejs; sudo apt autoremove --purge; sudo apt clean) and re-installing nodejs. I again got version 8.11.1:

pi@raspberrypi:~ $ sudo apt install nodejs 
[...]
Get:4 http://archive.raspberrypi.org/debian stretch/main armhf nodejs armhf 8.11.1~dfsg-2~bpo9+1 [4 126 kB]
[...]
Selecting previously unselected package nodejs.
Preparing to unpack .../nodejs_8.11.1~dfsg-2~bpo9+1_armhf.deb ...
[...]

If I was really installing from backports, shouldn't the string "backports" appear on the "Get" line over there?

Answer 1

First off, I'd recommend using npm for this anyway, even if you prefer apt. Generally dependencies for Node.js projects are installed locally per-project rather than system-wide, allowing for multiple, potentially incompatible versions to be used in different projects.

Additionally, Debian's repositories are almost always hopelessly out-of-date with respect to Node packages. That's a consequence of Debian's focus on stability and testing rather than having the cutting edge. However, Node projects often expect you to have the latest packages, and iterate quickly (as opposed to many other tools in the Debian repositories which may only be updated every few years as necessary).

---

Is the distribution I am using (an up to date Raspbian Stretch Lite) considered “the unstable distribution”?

No. Currently Stretch is 'stable', because it is the latest major release. Packages from the 'sid' repository are considered unstable.

And what does “you have held broken packages” mean?

It means that some packages have been marked as held back and not installed as expected. The 'broken' bit indicates that there is some problem with installing the packages.

I can't make sense of this error message, which I find quite unhelpful. Am I requesting “an impossible situation”? Why is it impossible?

That's the question which takes a little more than a line to answer!

It appears that archive.raspberrypi.org now distribute an updated 8.11.1 version of Node in their repository; the official Debian repostiories distribute 4.8.2 with Stretch, reserving 8.11.1 for the backports repo.

Anyway, digging to the root of the problem, I think the issue is node-iconv:

The following packages have unmet dependencies:
 node-body-parser : Depends: node-raw-body (>= 1.2.0) but it is not going to be installed
                    Depends: node-iconv (>= 2.1.4) but it is not going to be installed

The above tells us that node-body-parser depends on node-raw-body and node-iconv. What isn't stated there, but makes things more clear, is that node-raw-body also depends on node-iconv. So, let's see what node-iconv depends on:

dep: libc6 (>= 2.17) [arm64, ppc64el]
GNU C Library: Shared libraries
also a virtual package provided by libc6-udeb

dep: libc6 (>= 2.4) [not arm64, ppc64el]

dep: libgcc1 (>= 1:3.0)
GCC support library

dep: libstdc++6 (>= 4.1.1)
GNU Standard C++ Library v3

dep: nodejs
evented I/O for V8 javascript

dep: nodejs-abi-46
virtual package provided by nodejs

dep: nodejs-dev (>= 4.6.0~dfsg-2~)
evented I/O for V8 javascript (development files)

The one that looks troubling to me is nodejs-abi-46. That looks to be the ABI for Node 4 rather than your Node 8. That of course leads to an impossible situation; you have got Node 8 but you are asking to install something which depends on Node 4. So, apt gives up and tells you that it couldn't install node-iconv.

Answer 2

Epilogue

Aurora0001's answer is correct and complete. I am posting this to summarize my findings, and as an update to tell here how this story wrapped up.

It appears this issue doesn't affect Raspbian proper. It is specific to the Raspbian image distributed by the Raspberry Pi foundation, which enables by default a repository for foundation-provided software.

Whereas the Raspbian repo only distributes nodejs 4.8.2, on July 9th the nodejs 8.11.1 package was uploaded to the foundation repo, together with nodered, which does require a recent Node.js. Since nodejs 4.8.2 provides the virtual package nodejs-abi-46, and nodejs 8.11.1 doesn't, this upload made every package depending on nodejs-abi-46 uninstallable.

After investigating the issue with the precious help of Aurora0001, I reported it on the Raspberry Pi forums: Upgraded nodejs makes some packages uninstallable. User ShiftPlusOne answered saying that he was the one to do the upload, that he did some testing before uploading, but did not watch for that particular dependency.

Today (2018-08-01), ShiftPlusOne uploaded updated versions of the packages that used to depend on nodejs-abi-46, and now depend on nodejs-abi-57. My test shows that node-body-parser is installable again, and it works as expected. I am grateful to ShiftPlusOne for quickly implementing the fix.