publish: fix duplicated skel/AppStream files and missing by-hash entries - #1620
Closed
KereMath wants to merge 5 commits into
Closed
publish: fix duplicated skel/AppStream files and missing by-hash entries#1620KereMath wants to merge 5 commits into
KereMath wants to merge 5 commits into
Conversation
The skeleton and AppStream loops were nested inside the per-component loop while iterating over all components themselves, so every file was written once per component. Publishing main + contrib appended each payload twice. Release checksums are computed after the fact, so the duplicated content is signed and apt accepts it silently.
SkelIndex was the only index constructor not propagating acquireByHash, so with -acquire-by-hash the Release file advertises Acquire-By-Hash: yes while no by-hash/ entries exist for these files and apt gets a 404.
Publishing two components appended each skeleton payload twice; the existing skel test only publishes a single component so it did not catch it.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #1620 +/- ##
==========================================
- Coverage 77.37% 77.17% -0.21%
==========================================
Files 165 165
Lines 15747 15749 +2
==========================================
- Hits 12185 12155 -30
- Misses 2356 2399 +43
+ Partials 1206 1195 -11 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Publish moved the skel and AppStream emission out of the per-component loop, and codecov flags the relocated error branches as uncovered. Cover them with deterministic failures: - a regular file in the middle of the skel path makes the walk fail with ENOTDIR, which is not swallowed as a not-exist error - nested skel/AppStream names each within NAME_MAX flatten into a temporary index file name that exceeds it, failing index creation - an unreadable skel file (mode 0) fails the open (non-root only) - a ~1MB filesystem as TMPDIR runs out of space mid-write, reusing the /smallfs convention from DiskFullSuite Also add a unit-level happy path test publishing nested skel files and checking they land in the published tree and the Release checksums.
KereMath
force-pushed
the
fix/skel-appstream-publish
branch
from
August 20, 2026 08:04
4c51e7d to
c54d44e
Compare
Regression test for the duplicated skel payload: publishing two components used to append each skeleton file once per component. Fails against the previous code with doubled file contents, mirroring the PublishRepo40Test system test at unit level.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of the Change
Two bugs in publishing skeleton and AppStream (DEP-11) files:
The skel and AppStream loops sat inside the per-component loop while iterating over
all components themselves, so every file was written once per component. Publishing
main+contribappended each payload twice. Release checksums are computedafterwards, so the duplicated content is signed and apt accepts it silently.
SkelIndexwas the only index constructor not propagatingacquireByHash, so with-acquire-by-hashthe Release file advertisesAcquire-By-Hash: yeswhile noby-hash/entries exist for these files and apt gets a 404.Checklist
deb/publish_test.go)PublishRepo40Test)AUTHORS