search

aptly-dev / aptly

aptly - Debian repository management tool
https://www.aptly.info/
MIT License
2.57k stars 374 forks source link

False positive in ImportPackageFiles when adding .deb files that have different metadata and name but same contents #1378

Open ferrreo opened 6 hours ago

ferrreo commented 6 hours ago

Detailed Description

If you have a bunch of packages that differ only in package name and depends then when you try add them to your repo via repo add and you have forceReplace set then one of them gets booted out even though they do not actually match or conflict.

This is due to ImportPackageFiles inside the force replace block it is doing a list.search but this is not a thorough as package.Equals, if you add check that matches package.Equals minus the filehash in the loop ranging over "conflictingFiles" then the problem goes away.

Ideally the fix would be in list.search or it's params.

Context

This caused some serious confusion when packages went "missing" from our Distro repo. This is a pretty common usecase when it comes to metapackages, as generally they have no content and just differ by their depends.

Possible Implementation

I fixed it locally with adding a check to package.SoftEquals in the looping over conflictingFiles and only marking as conflicted if the check passes. SoftEquals is just package.Equals minus the fileshash check.

Your Environment

Not really environment specific but I can provided debs or an example control file if needed.

neolynx commented 5 hours ago

Hi !

thanks for the analysis :-)

would you mind opening a PR, so we can have a look ?