mirror of
https://github.com/xcat2/xcat-dep.git
synced 2026-09-12 12:36:23 +00:00
Daniel Hilst
68f17873bb
Adds a real gate on the ASSEMBLED apt repo, per codename x arch, using debs-manifest.conf as the single source of truth, layered pure/testable: - BuildUtils: verify_repo_packages(\%expected,\%present) (MISSING/VERSION), verify_repo_signature(\%expected,\%observed) (UNSIGNED/WRONGKEY), and parse_packages_index($text) -- all PURE and unit-tested (happy+sad, no dpkg-deb). - sbuild-all.pl does the IO via one sub verify_assembled_repo: parses each published binary-<arch>/Packages (resolving arch-suffixed names like xcat-genesis-base-<arch>, reducing to upstream via deb_upstream_version to compare against the manifest pin), runs gpg --verify on each dists/<cn>/InRelease and extracts the signer fingerprint, then delegates to the two pure deciders and dies listing every [<cn>/<arch>] problem. - Runs AUTOMATICALLY at the end of assemble_apt (once Packages + signed Release exist); suppressible with --no-verify-repo; skipped under --dry-run. Also a standalone, lock-free, build-free '--verify-repo=<apt_dir>' mode using the script's --manifest/ --dists/--gpg-key-id/--gpg-home. Replaces the coarse pool-global hard-coded check. prove t/sbuild-all.t: 90/90 (was 71). Smoke-tested: complete tree passes; dropped pkg -> MISSING; wrong version -> VERSION; missing index -> MISSING-INDEX; all die nonzero. Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>