mirror of
https://github.com/xcat2/xcat-dep.git
synced 2026-09-12 12:36:23 +00:00
Daniel Hilst
aac092304c
The manifest pinned only the UPSTREAM version: deb_version() and
resolve_present_names() both reduced the version with deb_upstream_version()
before comparing, dropping the epoch and the debian_revision. A package can
carry the right upstream version and still be the wrong package:
* the debian_revision is the PACKAGING revision -- elilo-xcat 3.14-5 and
3.14-6 are different builds of the same upstream 3.14;
* the epoch overrides version comparison outright -- an un-epoched 2.19.0
sorts BELOW 2:2.18.0.
That matters here because xCAT's own debian/control declares versioned
dependencies on these packages -- goconserver (>= 0.3.3-snap...), ipmitool-xcat
(>= 1.8.17-1), grub2-xcat (>= 2.02-...) in xCAT, xCATsn and xCAT-server -- so an
upstream-only pin can accept a deb that the gate calls good and that
`apt install xCAT` then refuses.
The pin is now matched against the FULL [epoch:]upstream[-revision], exactly as
it appears in the built .deb and in the published Packages index. No new
operator was needed: the existing exact/glob/'*' grammar simply applies to the
whole version, which is stricter than a >= floor because it also rejects an
epoch the pin does not name. Six pins become fully exact; two stay globbed
because their revision is not owned by the checkout:
* goconserver=0.3.3-snap* -- upstream exact; the revision is the CD stamp
snap<SOURCE_DATE_EPOCH>, which changes every run. The glob still REQUIRES a
snap-stamped revision, so an unstamped deb is rejected.
* xcat-genesis-base=2.* -- its version is not owned by xcat-dep; it walks
with whatever xcat-core the genesis was built from (XCAT_CORE_REF), and the
two arches legitimately differ since each is converted from its own rpm.
The gate still enforces exactly one genesis FOR THIS ARCH.
deb_version() gained an optional $arch for that logical name: both arch-suffixed
genesis debs are staged on the amd64 host (the cross-arch ppc one for #7610) and
carry different revisions, so without it the pair would look like a version
conflict. This mirrors resolve_present_names, which already refuses to borrow
another arch's genesis.
Comparing full versions also exposed a pre-existing defect it had been masking:
the collector treated PREBUILT .deb files checked into the source tree as build
output. elilo/ ships elilo-xcat_3.14-5_all.deb, elilo-xcat_3.14-6_all.deb and
gnu-efi_3.0v-5_amd64.deb; the first and third were being published into the apt
repo under this run's name, and the stale 3.14-5 collided with the freshly built
3.14-6 once revisions were compared. The build now snapshots the .debs present
before the build and subtracts them afterwards -- a file the build overwrites
changes size/mtime and still counts as output. Verified in the noble chroot: only
elilo-xcat_3.14-6_all.deb is collected; gnu-efi and 3.14-5 are reported and left
behind.
deb_upstream_version() has no remaining callers and is removed.
Tests: version_matches over whole versions (stale revision rejected, unnamed
epoch rejected, both globs still enforcing what they should); deb_version
returning the full version, dying on two revisions of one upstream version (the
elilo case), and selecting the per-arch genesis; resolve_present_names handing
the full version to the comparator; and two end-to-end cases in t/verify-repo.t
asserting the gate now fails a stale packaging revision and an unnamed epoch.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>