From f522398456476ecaa0fc30e291f820f34584d771 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vin=C3=ADcius=20Ferr=C3=A3o?=
 <2031761+viniciusferrao@users.noreply.github.com>
Date: Fri, 4 Sep 2026 17:15:24 -0300
Subject: [PATCH] test(genesis): cover repository downgrades

---
 t/common-repo-gate.t              | 36 ++++++++++++----------
 t/genesis_openembedded_consumer.t | 50 ++++++++++++++++++++-----------
 2 files changed, 52 insertions(+), 34 deletions(-)

diff --git a/t/common-repo-gate.t b/t/common-repo-gate.t
index 5093e10..dd2b8f7 100644
--- a/t/common-repo-gate.t
+++ b/t/common-repo-gate.t
@@ -164,11 +164,7 @@ sub run_publish {
 
 # ---- a complete release publishes, and says it was gated -----------------------------------------
 {
-    my ($rc, $out, $common) = run_publish(
-        $RELEASE,
-        'full',
-        sub { $_[0]->{'xCAT-release'} = '>= 2.0.0' },
-    );
+    my ($rc, $out, $common) = run_publish($RELEASE, 'full');
     is($rc, 0, 'a complete release publishes') or diag($out);
     is(scalar(grep { !/\.src\.rpm$/ } glob("$common/*.rpm")), 8,
         'the published shared repo carries every architecture');
@@ -178,21 +174,29 @@ sub run_publish {
 
 {
     my ($rc, $out, $common) = run_publish($VERSION_1_RELEASE, 'version-1');
-    is($rc, 0, 'a complete version 1 release publishes') or diag($out);
-    is(scalar(grep { !/\.src\.rpm$/ } glob("$common/*.rpm")),
-        7,
-        'the version 1 repository keeps its seven architectures');
-    ok(!glob("$common/" . rpm_package_name('s390x') . '-*.rpm'),
-        'the version 1 repository does not require s390x');
-    like($out, qr/\[verify-repo\] common complete: 7 packages present/,
-        'the version 1 repository is gated against seven packages');
-    like($out, qr/WARNING: Genesis release version 1 omits current architectures: s390x/,
-        'version 1 publication reports its reduced architecture set');
+    isnt($rc, 0, 'a version 1 release cannot replace the current repository');
+    like($out, qr/Genesis release version 1 omits currently supported architectures: s390x/,
+        'version 1 refusal identifies the missing architecture');
+    ok(!-d $common || !glob("$common/*.rpm"),
+        'a version 1 release publishes nothing');
 }
 
 {
     my ($rc, $out, $common) = run_publish(
-        $VERSION_1_RELEASE,
+        $RELEASE,
+        'missing-non-genesis-package',
+        sub { $_[0]->{'xCAT-release'} = '>= 2.0.0' },
+    );
+    isnt($rc, 0, 'every common manifest package is verified');
+    like($out, qr/MISSING xCAT-release/,
+        'the common gate identifies a missing non-Genesis package');
+    ok(!-d $common || !glob("$common/*.rpm"),
+        'a missing non-Genesis package prevents publication');
+}
+
+{
+    my ($rc, $out, $common) = run_publish(
+        $RELEASE,
         'missing-current-package',
         sub { delete $_[0]->{ rpm_package_name('s390x') } },
     );
diff --git a/t/genesis_openembedded_consumer.t b/t/genesis_openembedded_consumer.t
index fab496a..1a36144 100644
--- a/t/genesis_openembedded_consumer.t
+++ b/t/genesis_openembedded_consumer.t
@@ -387,14 +387,8 @@ sub test_deb_consumer {
 
     local $ENV{SOURCE_DATE_EPOCH} = $epoch;
     my $log = "$tmp/deb-consumer.log";
-    my $manifest = "$tmp/deb-consumer.conf";
-    write_apt_manifest(
-        $manifest,
-        sub { $_[0]->{'xcat-release'} = '2.*' },
-    );
     my $status = run_apt_consumer(
         log => $log, output => $output, apt_dir => $apt_root,
-        manifest => $manifest,
         extra => [ '--genesis-release', $release_root ],
     );
     my $pool_package = "$shared_pool/$package";
@@ -564,17 +558,15 @@ sub test_version_1_deb_consumer {
     );
     my $pool = "$apt_root/pool/main/xcat-genesis-openembedded";
 
-    is($status, 0, 'APT accepts a complete version 1 release');
-    is(scalar(genesis_deb_names($pool)), 7,
-        'the version 1 pool keeps its seven architectures');
-    is(scalar(grep { /s390x/ } genesis_deb_names($pool)), 0,
-        'the version 1 pool does not require s390x');
+    isnt($status, 0, 'APT refuses a version 1 release for the current repository');
     like(read_binary($log),
-        qr/\[verify-repo\] shared pool complete: 7 packages present/,
-        'the version 1 pool is gated against seven packages');
-    like(read_binary($log),
-        qr/WARNING: Genesis release version 1 omits current architectures: s390x/,
-        'version 1 APT publication reports its reduced architecture set');
+        qr/Genesis release version 1 omits currently supported architectures: s390x/,
+        'the version 1 refusal identifies the missing architecture');
+    ok(!-d $pool, 'a version 1 release publishes no shared pool');
+
+    my $current_release = make_package_release(
+        "$tmp/deb-current-manifest", 'deb', architectures(),
+    );
 
     my $missing_manifest = "$tmp/deb-version-1-missing.conf";
     write_apt_manifest(
@@ -588,7 +580,7 @@ sub test_version_1_deb_consumer {
     my $missing_status = run_apt_consumer(
         log => $missing_log, output => $missing_output, apt_dir => $missing_apt,
         manifest => $missing_manifest,
-        extra => [ '--genesis-release', $release_root ],
+        extra => [ '--genesis-release', $current_release ],
     );
     isnt($missing_status, 0,
         'a version 1 release does not hide an incomplete current shared manifest');
@@ -609,7 +601,7 @@ sub test_version_1_deb_consumer {
     my $unknown_status = run_apt_consumer(
         log => $unknown_log, output => $unknown_output, apt_dir => $unknown_apt,
         manifest => $unknown_manifest,
-        extra => [ '--genesis-release', $release_root ],
+        extra => [ '--genesis-release', $current_release ],
     );
     isnt($unknown_status, 0, 'an unknown shared manifest package is refused');
     like(read_binary($unknown_log),
@@ -617,6 +609,28 @@ sub test_version_1_deb_consumer {
         'the shared manifest failure identifies the unknown package');
     ok(!-d "$unknown_apt/pool/main/xcat-genesis-openembedded",
         'an unknown shared manifest package publishes nothing');
+
+    my $non_genesis_manifest = "$tmp/deb-non-genesis-missing.conf";
+    write_apt_manifest(
+        $non_genesis_manifest,
+        sub { $_[0]->{'xcat-release'} = '2.*' },
+    );
+    my $non_genesis_apt = "$tmp/apt-non-genesis-missing";
+    my $non_genesis_output = "$tmp/deb-non-genesis-missing-output";
+    stage_apt_suites($non_genesis_output, "$tmp/deb-non-genesis-missing-legacy");
+    my $non_genesis_log = "$tmp/deb-non-genesis-missing.log";
+    my $non_genesis_status = run_apt_consumer(
+        log => $non_genesis_log,
+        output => $non_genesis_output,
+        apt_dir => $non_genesis_apt,
+        manifest => $non_genesis_manifest,
+        extra => [ '--genesis-release', $current_release ],
+    );
+    isnt($non_genesis_status, 0, 'every shared manifest package is verified');
+    like(read_binary($non_genesis_log), qr/MISSING xcat-release/,
+        'the shared gate identifies a missing non-Genesis package');
+    ok(!-d "$non_genesis_apt/pool/main/xcat-genesis-openembedded",
+        'a missing non-Genesis package prevents APT publication');
 }
 
 sub test_signed_common_rpm_repository {