Describe the problem

Libraries are identified by the "real name" defined in the name field of the library.properties metadata file (or by the folder name in the case of a "legacy"/"1.0 format" library that doesn't have a metadata file).

During the implementation of the Arduino Library Manager system, the unfortunate choice was made to reusing the user's library folder (<directories.data/libraries or LIBRARY_LOCATION_USER) instead of using a dedicated folder for Library Manager. This can be problematic because the set of libraries recognized by Library Manager include those installed by the user via alternative methods:

• manually
• arduino-cli lib install --git-url
• arduino-cli lib install --zip-file.

Libraries installed via arduino-cli lib install are always installed to a folder named by "sanitizing" the "real name". However, installations of a library made via other methods can have any arbitrary folder name.

This means that it is possible for multiple libraries with the same identifier to be installed in LIBRARY_LOCATION_USER.

🐛 If multiple libraries with the same identifier are installed in LIBRARY_LOCATION_USER, and one has an outdated version, the library is always shown as updatable.

To reproduce

$ arduino-cli version
arduino-cli.exe  Version: git-snapshot Commit: 3cd782d6 Date: 2022-09-07T19:10:31Z

$ export ARDUINO_DIRECTORIES_USER="/tmp/arduino-cli-directories/user"

$ arduino-cli lib install "Arduino SigFox for MKRFox1200"
Downloading Arduino SigFox for MKRFox1200@1.0.4...
Arduino SigFox for MKRFox1200@1.0.4 already downloaded
Installing Arduino SigFox for MKRFox1200@1.0.4...
Installed Arduino SigFox for MKRFox1200@1.0.4

$ export ARDUINO_LIBRARY_ENABLE_UNSAFE_INSTALL="true"

$ arduino-cli lib install --git-url https://github.com/arduino-libraries/SigFox#1.0.3
--git-url and --zip-path flags allow installing untrusted files, use it at your own risk.
Enumerating objects: 86, done.
Counting objects: 100% (86/86), done.
Compressing objects: 100% (62/62), done.
Total 86 (delta 30), reused 64 (delta 20), pack-reused 0
Library installed

$ ls "$ARDUINO_DIRECTORIES_USER/libraries"
Arduino_SigFox_for_MKRFox1200/  SigFox/

$ arduino-cli lib list
Name                          Installed Available      Location              Description
Name                          Installed Available      Location              Description
Arduino SigFox for MKRFox1200 1.0.4     -              LIBRARY_LOCATION_USER -
 "                            1.0.3     1.0.4          LIBRARY_LOCATION_USER Helper library for MKRFox1200 board a...

$ arduino-cli lib list --updatable
Name                          Installed     Available     Location              Description
Arduino SigFox for MKRFox1200 1.0.3         1.0.4         LIBRARY_LOCATION_USER Helper library for MKRFox1200 board a...

$ arduino-cli lib upgrade "Arduino SigFox for MKRFox1200"
Downloading Arduino SigFox for MKRFox1200@1.0.4...
Arduino SigFox for MKRFox1200@1.0.4 already downloaded
Installing Arduino SigFox for MKRFox1200@1.0.4...
Already installed Arduino SigFox for MKRFox1200@1.0.4

$ arduino-cli lib list --updatable
Name                          Installed     Available     Location              Description
Arduino SigFox for MKRFox1200 1.0.3         1.0.4         LIBRARY_LOCATION_USER Helper library for MKRFox1200 board a...

🐛 The library is listed as updatable even after attempting to upgrade it.

Expected behavior

I don't see that there is any good way for the Library Manager functionality to support multiple libraries with the same identifier in LIBRARY_LOCATION_USER. The only feasible resolution is to prohibit this.

Any operation that alters library installations should error if multiple installations of the library are present in LIBRARY_LOCATION_USER. The error message should clearly explain the problem to the user as well as the resolution of manually removing one of the redundant installations.

These are the commands which require this change:

• lib upgrade
• lib install
• lib uninstall

Arduino CLI version

3cd782d

Operating system

Windows, Ubuntu

Operating system version

Windows 10, Ubuntu 20.04

Additional context

A bug in Arduino CLI can cause it to produce these conditions: #1870

However, the conditions can still occur even after that bug is fixed because users can still produce multiple installations via manual installations.

Reports:

• https://forum.arduino.cc/t/arduino-ide-2-0-1-is-now-available/1046764/9

There is currently a bug which may be inadvertently mitigating the effects of multiple installations: #932

Once that bug is fixed, it is likely other commands will also be broken under these conditions.

Issue checklist

• I searched for previous reports in the issue tracker
• I verified the problem still occurs when using the nightly build
• My report contains all necessary details