From d063e86860bbc695cbea0fb1b3dace6ef23b08cf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vin=C3=ADcius=20Ferr=C3=A3o?=
 <2031761+viniciusferrao@users.noreply.github.com>
Date: Sun, 6 Sep 2026 11:30:42 -0300
Subject: [PATCH] fix(genesis): validate repository manifests early

---
 lib/XCAT/GenesisRelease.pm | 13 +++++++++++++
 mockbuild-all.pl           | 18 +++++++-----------
 sbuild-all.pl              | 33 +++++++++++++++------------------
 3 files changed, 35 insertions(+), 29 deletions(-)

diff --git a/lib/XCAT/GenesisRelease.pm b/lib/XCAT/GenesisRelease.pm
index d81325b..c4b3bee 100644
--- a/lib/XCAT/GenesisRelease.pm
+++ b/lib/XCAT/GenesisRelease.pm
@@ -17,6 +17,7 @@ our @EXPORT_OK = qw(
   validate_architecture
   validate_complete_release
   validate_export
+  validate_repository_packages
   validate_release
   verify_release_file
 );
@@ -65,6 +66,18 @@ sub minimum_release_version {
     die "No release format supports the requested Genesis architectures\n";
 }
 
+sub validate_repository_packages {
+    my ($packages, $section, $prefix, @supported_names) = @_;
+    my %supported = map { $_ => 1 } @supported_names;
+    my @missing = grep { !exists $packages->{$_} } @supported_names;
+    my @unknown = grep {
+        index($_, $prefix) == 0 && !$supported{$_}
+    } sort keys %{$packages};
+    die "FATAL: [$section] is missing supported packages: @missing\n" if @missing;
+    die "FATAL: [$section] has unsupported packages: @unknown\n" if @unknown;
+    return $packages;
+}
+
 sub _read_key_values {
     my ($path, $allowed) = @_;
     my %values;
diff --git a/mockbuild-all.pl b/mockbuild-all.pl
index be8cb28..154bc85 100755
--- a/mockbuild-all.pl
+++ b/mockbuild-all.pl
@@ -35,6 +35,7 @@ use XCAT::BuildUtils qw(
 use XCAT::GenesisRelease qw(
   architectures
   rpm_package_name
+  validate_repository_packages
   validated_release_checksums
   verify_release_file
 );
@@ -1120,17 +1121,12 @@ sub common_repository_requirements {
     die "FATAL: no [common] section in $manifest -- cannot verify the shared Genesis repository\n"
         if !%common;
 
-    my @supported_names = map { rpm_package_name($_) } architectures();
-    my %supported = map { $_ => 1 } @supported_names;
-    my @manifest_missing = grep { !exists $common{$_} } @supported_names;
-    my @manifest_unknown = grep {
-        m{\AxCAT-genesis-openembedded-}xms && !$supported{$_}
-    } sort keys %common;
-    die "FATAL: [common] is missing supported packages: @manifest_missing\n"
-      if @manifest_missing;
-    die "FATAL: [common] has unsupported packages: @manifest_unknown\n"
-      if @manifest_unknown;
-    return \%common;
+    return validate_repository_packages(
+        \%common,
+        'common',
+        'xCAT-genesis-openembedded-',
+        map { rpm_package_name($_) } architectures(),
+    );
 }
 
 sub replace_common_repository {
diff --git a/sbuild-all.pl b/sbuild-all.pl
index aa3382f..b008692 100755
--- a/sbuild-all.pl
+++ b/sbuild-all.pl
@@ -312,6 +312,7 @@ if ($genesis_release ne '') {
     # the verifier runs would satisfy both the verifier and any single pass taken afterwards.
     require XCAT::BuildUtils;
     require XCAT::GenesisRelease;
+    shared_repository_requirements();
     my $before = XCAT::GenesisRelease::validated_release_checksums($genesis_release);
     XCAT::BuildUtils::run_command($^X, $verifier, '--complete', '--format', 'deb', $genesis_release);
     my $after = XCAT::GenesisRelease::validated_release_checksums($genesis_release);
@@ -1049,24 +1050,7 @@ sub install_genesis_release_debs {
 
 sub verify_shared_pool {
     my ($pool) = @_;
-    my %shared = %{ $MANIFEST{shared} // {} };
-    die "FATAL: no [shared] section in $manifest -- cannot verify the shared Genesis pool\n"
-        if !%shared;
-
-    my @supported_names = map {
-        XCAT::GenesisRelease::deb_package_name($_)
-    } XCAT::GenesisRelease::architectures();
-    my %supported = map { $_ => 1 } @supported_names;
-    my @manifest_missing = grep { !exists $shared{$_} } @supported_names;
-    my @manifest_unknown = grep {
-        m{\Axcat-genesis-openembedded-}xms && !$supported{$_}
-    } sort keys %shared;
-    die "FATAL: [shared] is missing supported packages: @manifest_missing\n"
-      if @manifest_missing;
-    die "FATAL: [shared] has unsupported packages: @manifest_unknown\n"
-      if @manifest_unknown;
-
-    my %req = %shared;
+    my %req = %{ shared_repository_requirements() };
     my @names = sort keys %req;
     my %present = map { $_ => deb_version($pool, $_) } @names;
     my @problems = verify_repo_packages(\%req, \%present);
@@ -1078,6 +1062,19 @@ sub verify_shared_pool {
     return 1;
 }
 
+sub shared_repository_requirements {
+    my %shared = %{ $MANIFEST{shared} // {} };
+    die "FATAL: no [shared] section in $manifest -- cannot verify the shared Genesis pool\n"
+        if !%shared;
+    return XCAT::GenesisRelease::validate_repository_packages(
+        \%shared,
+        'shared',
+        'xcat-genesis-openembedded-',
+        map { XCAT::GenesisRelease::deb_package_name($_) }
+          XCAT::GenesisRelease::architectures(),
+    );
+}
+
 sub assemble_into {
     my ($dir, $expect) = @_;
     if ($genesis_release ne '') {