From 73ad97d5a2723faa3abcc019920a3d95d7832ec9 Mon Sep 17 00:00:00 2001
From: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Date: Wed, 26 Aug 2026 17:13:23 -0300
Subject: [PATCH] fix(xcat-dep): gate publication on the whole manifest,
 whatever this run built

verify_assembled_repo filtered the manifest through required_pkgs() with this
invocation's --skip-genesis / --skip-xcat-dep. Since the documented publish-only
run IS `--skip-build --skip-genesis --publish`, the flags that describe what this
invocation built were also deciding what the published repository was allowed to
lack -- so a repository with no xcat-genesis-base passed its own publication
gate (PR #63 review).

Those flags mean "this invocation did not build it", never "the repository may
ship without it": a package built by an earlier run is still expected in the
tree, which the side tree is seeded from. The gate now takes the manifest whole.
The other two required_pkgs() call sites are unchanged and correct -- they choose
what to BUILD and what to validate in THIS arch's staging.

Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
---
 sbuild-all.pl | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/sbuild-all.pl b/sbuild-all.pl
index be4cb45..b843120 100755
--- a/sbuild-all.pl
+++ b/sbuild-all.pl
@@ -908,7 +908,13 @@ sub verify_assembled_repo {
                 push @all, "[$cn/$a] NO-MANIFEST section [$tgt] in $manifest, but $a is expected";
                 next;
             }
-            my @names = required_pkgs([sort keys %$req], $skip_genesis, $skip_xcat_dep);
+            # The WHOLE manifest, deliberately -- no required_pkgs() skip filtering here. The
+            # --skip-* flags say what this INVOCATION built, and the documented publish-only run
+            # passes --skip-genesis; honouring them here would let the run that publishes decide
+            # what the published repository is allowed to be missing, and a repo with no Genesis
+            # package would pass its own publication gate. Packages this invocation did not build
+            # are still expected in the tree (seeded from the previously published repo).
+            my @names = sort keys %$req;
             my $idx = "$adir/dists/$cn/main/binary-$a/Packages";
             unless (-f $idx) {
                 push @all, "[$cn/$a] MISSING-INDEX (no $idx)";