From 6ef17ea546b55e82d13b500e2fa4e917040d6e5e Mon Sep 17 00:00:00 2001
From: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Date: Wed, 26 Aug 2026 17:11:52 -0300
Subject: [PATCH] test(xcat-dep): capture --skip-* weakening the publication
 gate

The documented publish-only invocation is
`sbuild-all.pl --skip-build --skip-genesis --publish`, and verify_assembled_repo
passes those same flags to required_pkgs() when deciding what the PUBLISHED
repository must contain. So the flags that say what this INVOCATION built also
decide what the repository is allowed to be missing, and a repo carrying no
xcat-genesis-base passes its own publication gate.

Assert the gate on a repo missing Genesis (with --skip-genesis) and on one
missing a compiled dep (with --skip-xcat-dep). Both fixtures keep native stanzas
for the arch, so the failure under test is the missing PACKAGE and not the arch
reading as absent. Both fail on the current gate.

Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
---
 t/verify-repo.t | 48 +++++++++++++++++++++++++++++++++++++++++-------
 1 file changed, 41 insertions(+), 7 deletions(-)

diff --git a/t/verify-repo.t b/t/verify-repo.t
index d3294e6..667b5fd 100644
--- a/t/verify-repo.t
+++ b/t/verify-repo.t
@@ -47,15 +47,22 @@ sub stanza {
 # The two Architecture:all packages ride into EVERY binary-<arch> index, exactly as apt-ftparchive
 # emits them -- which is why a non-empty ppc index is not evidence that ppc64el was built.
 sub arch_all_stanzas {
-    my ($genesis_arch) = @_;
-    return stanza('grub2-xcat', '2.12-1', 'all')
-         . stanza("xcat-genesis-base-$genesis_arch", '2.19.0-snap202608211200', 'all');
+    my ($genesis_arch, %o) = @_;
+    my $body = stanza('grub2-xcat', '2.12-1', 'all');
+    $body .= stanza("xcat-genesis-base-$genesis_arch", '2.19.0-snap202608211200', 'all')
+        unless $o{no_genesis};
+    return $body;
 }
 
 sub native_stanzas {
     my ($a, %o) = @_;
-    return stanza('ipmitool-xcat', $o{ipmi_version} // '1.8.18-snap202608211200', $a)
-         . stanza('goconserver',   '0.3.3-snap202608211200',  $a);
+    my $body = stanza('ipmitool-xcat', $o{ipmi_version} // '1.8.18-snap202608211200', $a);
+    # drop_dep names ONE compiled dep to leave out, so a "missing dep" fixture still carries native
+    # stanzas for this arch -- otherwise the arch itself reads as absent and the gate fails for that
+    # reason instead of the one under test.
+    $body .= stanza('goconserver', '0.3.3-snap202608211200', $a)
+        unless ($o{drop_dep} // '') eq 'goconserver';
+    return $body;
 }
 
 # make_repo(%opt): a fixture apt tree for codename 'noble'.
@@ -70,8 +77,11 @@ sub make_repo {
     my %native  = map { $_ => 1 } @{ $o{native} // [@arches] };
     my $dir = "$tmp/repo" . (++$repo_seq);
     for my $a (@arches) {
-        my $body = ($native{$a} ? native_stanzas($a, ipmi_version => $o{ipmi_version}) : '')
-                 . arch_all_stanzas($a);
+        my $body = ($native{$a}
+                      ? native_stanzas($a, ipmi_version => $o{ipmi_version},
+                                           drop_dep => $o{drop_dep})
+                      : '')
+                 . arch_all_stanzas($a, no_genesis => $o{no_genesis});
         write_file("$dir/dists/noble/main/binary-$a/Packages", $body);
     }
     write_file("$dir/dists/noble/Release",
@@ -120,6 +130,30 @@ sub run_gate {
                    '--dists', 'noble', '--arch', 'amd64', @extra);
 }
 
+# ---- a --skip-* flag must NOT weaken the PUBLICATION gate (PR #63 review) -----------------------
+# The documented publish-only invocation is `--skip-build --skip-genesis --publish`, and the gate fed
+# those flags into required_pkgs() when deciding what the PUBLISHED repository must carry. So a
+# repository with no Genesis package passed its own publication gate. The flags say what this
+# INVOCATION built; they never say what the published repository is allowed to be missing -- the
+# manifest is the source of truth for that, whole, every time.
+{
+    my $repo = make_repo(no_genesis => 1);
+    my ($rc, $out) = run_gate($repo, '--no-verify-signature', '--skip-genesis');
+    isnt($rc, 0, 'a published repo missing Genesis fails the gate even with --skip-genesis')
+        or diag($out);
+    like($out, qr/xcat-genesis-base/, '... and the failure names the missing package');
+}
+
+# The same reasoning for the compiled deps: --skip-xcat-dep means this invocation did not build
+# them, not that the repository may ship without them.
+{
+    my $repo = make_repo(drop_dep => 'goconserver');
+    my ($rc, $out) = run_gate($repo, '--no-verify-signature', '--skip-xcat-dep');
+    isnt($rc, 0, 'a published repo missing a compiled dep fails the gate even with --skip-xcat-dep')
+        or diag($out);
+    like($out, qr/goconserver/, '... and the failure names the missing dep');
+}
+
 # ---- a complete two-arch repo passes (the baseline: the gate is not simply always-red) -----------
 {
     my $repo = make_repo();