build: stop redistributing the previous source on binNMU uploads
dpkg-genchanges/genbuildinfo handle a binary-only upload by referencing the previous source version textually (Source: pkg (prev), Binary-Only: yes, Binary-Only-Changes) while distributing no source files at all: pkh instead pulled the previous .dsc and its tarballs into both documents whenever they sat next to the artifacts, re-uploading the whole source on every binNMU. Drop that redistribution (and include_dsc_artifacts with it), and emit the missing Binary-Only: yes field, which the new differential test against real dpkg-buildpackage -b caught. The binNMU case shares its runner with the regular binary metadata differential; a unit test pins the exclusion even with the previous artifacts present.
This commit is contained in:
+109
-196
@@ -16,8 +16,6 @@ use std::sync::Arc;
|
||||
use crate::context::Context;
|
||||
use crate::debian::{ChecksumEntry, ControlInfo, FileChecksums, FilesList};
|
||||
|
||||
use super::parse_checksum_field;
|
||||
|
||||
/// Digests of one artifact.
|
||||
#[derive(Debug, Clone, Default)]
|
||||
struct ArtifactHashes {
|
||||
@@ -57,7 +55,7 @@ pub struct BinaryMetadataOptions {
|
||||
/// `dpkg-genchanges -b`: sorted `Binary` list, encounter-order `Architecture`
|
||||
/// accumulation, sorted `Description` lines formatted like dpkg, `.buildinfo`
|
||||
/// registration in `debian/files`, and binary-NMU handling (`Source:
|
||||
/// pkg (prev)` + previous `.dsc` redistribution when present).
|
||||
/// pkg (prev)` + `Binary-Only-Changes`, with no source files distributed).
|
||||
pub fn generate_binary_metadata(
|
||||
ctx: &Arc<Context>,
|
||||
package_dir: &Path,
|
||||
@@ -137,28 +135,24 @@ pub fn generate_binary_metadata(
|
||||
}
|
||||
|
||||
// ------------------------------------------------------------------
|
||||
// Binary-NMU: redistribute the previous source when present
|
||||
// Binary-NMU: reference the previous source version, textually only
|
||||
// ------------------------------------------------------------------
|
||||
let sversion = entry.version.no_epoch();
|
||||
let mut source_display = entry.source.clone();
|
||||
let mut binary_only_changes = None;
|
||||
|
||||
if entry.binary_only {
|
||||
// A binary-only upload must reference the previous source version;
|
||||
// a changelog that cannot yield it is a hard error, like in the
|
||||
// source-build path. Reuse the changelog read above instead of
|
||||
// reading the file a second time.
|
||||
// Like dpkg-genchanges/genbuildinfo, a binary-only upload references
|
||||
// the previous source version in the `Source` field and records the
|
||||
// entry in `Binary-Only-Changes`, but distributes NO source files:
|
||||
// the previous `.dsc` and its tarballs already sit in the archive,
|
||||
// and are not re-uploaded even when present next to the tree.
|
||||
if let Some(prev) = &previous_entry {
|
||||
source_display = format!("{} ({})", entry.source, prev.version.full());
|
||||
binary_only_changes = Some(format!(
|
||||
"{}\n\n -- {} <{}> {}",
|
||||
entry.changes_field, entry.maintainer_name, entry.maintainer_email, entry.date_raw
|
||||
));
|
||||
let dsc_name = format!("{}_{}.dsc", entry.source, prev.version.no_epoch());
|
||||
let dsc_path = upload_dir.join(&dsc_name);
|
||||
if ctx.exists(&dsc_path)? {
|
||||
include_dsc_artifacts(ctx, upload_dir, &dsc_name, &mut checksums)?;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -297,6 +291,7 @@ pub fn generate_binary_metadata(
|
||||
date: entry.date_raw.clone(),
|
||||
source: source_display,
|
||||
binaries,
|
||||
binary_only: entry.binary_only,
|
||||
built_for_profiles: opts.profiles.clone(),
|
||||
architecture: arch_values.join(" "),
|
||||
version: entry.version.full(),
|
||||
@@ -400,90 +395,6 @@ fn hashes_in_context(
|
||||
Ok(out)
|
||||
}
|
||||
|
||||
/// Pull the `.dsc` checksums (and its referenced tarballs) into the
|
||||
/// checksum registry, mirroring how binary-NMU uploads redistribute the
|
||||
/// previous source.
|
||||
fn include_dsc_artifacts(
|
||||
ctx: &Arc<Context>,
|
||||
upload_dir: &Path,
|
||||
dsc_name: &str,
|
||||
checksums: &mut FileChecksums,
|
||||
) -> Result<(), Box<dyn Error>> {
|
||||
let dsc_content = ctx.read_file(&upload_dir.join(dsc_name))?;
|
||||
let para = crate::debian::control::parse_paragraphs(
|
||||
crate::debian::control::strip_clearsigned_armour(&dsc_content),
|
||||
)
|
||||
.into_iter()
|
||||
.next()
|
||||
.ok_or_else(|| format!("'{dsc_name}' is empty"))?;
|
||||
|
||||
// Names and partial checksums are filled from the very same validated
|
||||
// lines, so a listed name can never miss its checksum entry.
|
||||
// Distribution order follows the Checksums fields (Checksums-Sha1 then
|
||||
// Checksums-Sha256), like dpkg-genchanges; the `Files` field only
|
||||
// supplements the md5 digests.
|
||||
let mut names: Vec<String> = Vec::new();
|
||||
let mut partials: BTreeMap<String, super::PartialChecksum> = BTreeMap::new();
|
||||
for field in ["Checksums-Sha1", "Checksums-Sha256", "Files"] {
|
||||
let Some(value) = para.get(field) else {
|
||||
continue;
|
||||
};
|
||||
for cl in parse_checksum_field(field, value)
|
||||
.map_err(|e| format!("cannot parse '{dsc_name}': {e}"))?
|
||||
{
|
||||
let slot = partials.entry(cl.name.clone()).or_default();
|
||||
match field {
|
||||
"Checksums-Sha1" => slot.sha1 = Some(cl.digest),
|
||||
"Checksums-Sha256" => slot.sha256 = Some(cl.digest),
|
||||
_ => slot.md5 = Some(cl.digest),
|
||||
}
|
||||
slot.size = Some(cl.size);
|
||||
if field != "Files" && !names.contains(&cl.name) {
|
||||
names.push(cl.name);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// The .dsc itself is hashed fresh (it may be signed/rewritten); the
|
||||
// tarballs reuse the .dsc-recorded digests, like dpkg-genchanges does.
|
||||
let dsc_hashes =
|
||||
hashes_in_context(ctx, upload_dir, std::slice::from_ref(&dsc_name.to_string()))?;
|
||||
if let Some(h) = dsc_hashes.get(dsc_name) {
|
||||
checksums.insert_entry(
|
||||
dsc_name,
|
||||
ChecksumEntry {
|
||||
size: h.size,
|
||||
md5: h.md5.clone(),
|
||||
sha1: h.sha1.clone(),
|
||||
sha256: h.sha256.clone(),
|
||||
// No SHA-512 digest available (see above).
|
||||
sha512: String::new(),
|
||||
},
|
||||
);
|
||||
}
|
||||
for name in &names {
|
||||
if name == dsc_name {
|
||||
continue;
|
||||
}
|
||||
let p = partials
|
||||
.get(name)
|
||||
.ok_or_else(|| format!("file '{name}' listed in '{dsc_name}' has no checksum entry"))?;
|
||||
checksums.insert_entry(
|
||||
name,
|
||||
ChecksumEntry {
|
||||
size: p.size.unwrap_or(0),
|
||||
md5: p.md5.clone().unwrap_or_default(),
|
||||
sha1: p.sha1.clone().unwrap_or_default(),
|
||||
sha256: p.sha256.clone().unwrap_or_default(),
|
||||
// The `.dsc` records no SHA-512 (dpkg only writes
|
||||
// sha1/sha256 there).
|
||||
sha512: String::new(),
|
||||
},
|
||||
);
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
@@ -521,109 +432,11 @@ mod tests {
|
||||
assert!(!environment.contains("DEBIAN_FRONTEND"), "{environment}");
|
||||
}
|
||||
|
||||
/// A minimal previous-version `.dsc` with a 3-column Checksums-Sha1
|
||||
/// field, a 4-column Checksums-Sha256 line and a 3-column `Files`.
|
||||
/// Regression: the old code filled `names` from any line with a third
|
||||
/// column but `partials` only from exactly-3-column lines, so the
|
||||
/// "bogus" name landed in `names` alone and `&partials["bogus"]`
|
||||
/// panicked. It must produce a build error instead.
|
||||
#[test]
|
||||
fn dsc_four_column_checksum_line_errors_instead_of_panicking() {
|
||||
let dsc_name = "hello_1.0-1.dsc";
|
||||
let dsc = "\
|
||||
Format: 3.0 (native)
|
||||
Source: hello
|
||||
Binary: hello
|
||||
Architecture: any
|
||||
Version: 1.0-1
|
||||
Maintainer: A B <a@b.c>
|
||||
Checksums-Sha1:
|
||||
aaa111 12 hello_1.0.orig.tar.xz
|
||||
Checksums-Sha256:
|
||||
bbb222 12 bogus hello_1.0-1.debian.tar.xz
|
||||
Files:
|
||||
ddd333 12 hello_1.0.orig.tar.xz
|
||||
";
|
||||
let base = tempfile::tempdir().expect("tempdir");
|
||||
std::fs::write(base.path().join(dsc_name), dsc).expect("write dsc");
|
||||
|
||||
let ctx = Arc::new(
|
||||
crate::context::Context::new(crate::context::ContextConfig::Local).expect("context"),
|
||||
);
|
||||
let mut checksums = FileChecksums::new();
|
||||
let err = include_dsc_artifacts(&ctx, base.path(), dsc_name, &mut checksums)
|
||||
.expect_err("malformed Checksums-Sha256 line must fail the build");
|
||||
let err = err.to_string();
|
||||
assert!(err.contains("Checksums-Sha256"), "{err}");
|
||||
assert!(err.contains("hello_1.0-1.debian.tar.xz"), "{err}");
|
||||
}
|
||||
|
||||
/// Happy path: tarball entries are assembled from the Checksums fields
|
||||
/// (sha1/sha256) and merged with the legacy 5-column `Files` md5, in
|
||||
/// Checksums-Sha1 order, with the `.dsc` itself hashed fresh first.
|
||||
#[test]
|
||||
fn include_dsc_artifacts_merges_legacy_files_layout() {
|
||||
let dsc_name = "hello_1.0-1.dsc";
|
||||
let tarball = "hello_1.0.orig.tar.xz";
|
||||
let dsc = "\
|
||||
Format: 3.0 (quilt)
|
||||
Source: hello
|
||||
Binary: hello
|
||||
Architecture: any
|
||||
Version: 1.0-1
|
||||
Maintainer: A B <a@b.c>
|
||||
Checksums-Sha1:
|
||||
aaa111 12 hello_1.0.orig.tar.xz
|
||||
Checksums-Sha256:
|
||||
bbb222 12 hello_1.0.orig.tar.xz
|
||||
Files:
|
||||
ddd333 12 devel optional hello_1.0.orig.tar.xz
|
||||
";
|
||||
let base = tempfile::tempdir().expect("tempdir");
|
||||
std::fs::write(base.path().join(dsc_name), dsc).expect("write dsc");
|
||||
std::fs::write(base.path().join(tarball), "tarball bytes").expect("write tarball");
|
||||
|
||||
let ctx = Arc::new(
|
||||
crate::context::Context::new(crate::context::ContextConfig::Local).expect("context"),
|
||||
);
|
||||
let mut checksums = FileChecksums::new();
|
||||
include_dsc_artifacts(&ctx, base.path(), dsc_name, &mut checksums)
|
||||
.expect("valid dsc must parse");
|
||||
|
||||
let collected: Vec<(String, crate::debian::ChecksumEntry)> = checksums
|
||||
.iter()
|
||||
.map(|(k, e)| (k.clone(), e.clone()))
|
||||
.collect();
|
||||
assert_eq!(
|
||||
collected
|
||||
.iter()
|
||||
.map(|(k, _)| k.as_str())
|
||||
.collect::<Vec<_>>(),
|
||||
vec![dsc_name, tarball],
|
||||
".dsc first, then Checksums-Sha1 order"
|
||||
);
|
||||
|
||||
// The .dsc is hashed fresh from disk.
|
||||
let dsc_entry = &collected[0].1;
|
||||
assert_eq!(dsc_entry.size, dsc.len() as u64);
|
||||
assert_eq!(dsc_entry.md5.len(), 32);
|
||||
assert_eq!(dsc_entry.sha1.len(), 40);
|
||||
assert_eq!(dsc_entry.sha256.len(), 64);
|
||||
|
||||
// The tarball reuses the .dsc-recorded digests, including the
|
||||
// legacy 5-column `Files` md5 (section/priority skipped).
|
||||
let tar_entry = &collected[1].1;
|
||||
assert_eq!(tar_entry.size, 12);
|
||||
assert_eq!(tar_entry.md5, "ddd333");
|
||||
assert_eq!(tar_entry.sha1, "aaa111");
|
||||
assert_eq!(tar_entry.sha256, "bbb222");
|
||||
}
|
||||
|
||||
/// A binary-only (binNMU) build whose changelog cannot yield the
|
||||
/// previous entry (malformed second header, unbalanced parenthesis) must
|
||||
/// fail the metadata generation with a diagnostic naming the problem,
|
||||
/// instead of silently emitting a plain `Source:` `.changes` with no
|
||||
/// `Binary-Only-Changes` and no redistributed previous `.dsc`.
|
||||
/// `Binary-Only-Changes` and no previous-version reference.
|
||||
#[test]
|
||||
fn binary_only_prev_version_parse_failure_errors_instead_of_wrong_metadata() {
|
||||
let changelog = "\
|
||||
@@ -739,4 +552,104 @@ Description: test package
|
||||
#[cfg(unix)]
|
||||
assert!(err.contains("Permission denied"), "{err}");
|
||||
}
|
||||
|
||||
/// A binary-only (binNMU) build references the previous source version
|
||||
/// (`Source: pkg (prev)`, `Binary-Only-Changes`) but must NOT
|
||||
/// redistribute any source file: like dpkg-genchanges/genbuildinfo, the
|
||||
/// previous `.dsc` and its tarballs stay out of both documents even when
|
||||
/// they exist next to the artifacts.
|
||||
#[test]
|
||||
fn binary_only_metadata_references_previous_source_without_redistributing_it() {
|
||||
let changelog = "\
|
||||
hello (1.0-1+b1) unstable; urgency=medium, binary-only=yes
|
||||
|
||||
* Binary-only rebuild.
|
||||
|
||||
-- A B <a@b.c> Mon, 01 Jan 2024 00:00:00 +0000
|
||||
|
||||
hello (1.0-1) unstable; urgency=medium
|
||||
|
||||
* Initial release.
|
||||
|
||||
-- A B <a@b.c> Sun, 31 Dec 2023 00:00:00 +0000
|
||||
";
|
||||
let control = "\
|
||||
Source: hello
|
||||
Section: devel
|
||||
Priority: optional
|
||||
Maintainer: A B <a@b.c>
|
||||
|
||||
Package: hello
|
||||
Architecture: all
|
||||
Description: test package
|
||||
";
|
||||
let base = tempfile::tempdir().expect("tempdir");
|
||||
let tree = base.path().join("hello-1.0");
|
||||
std::fs::create_dir_all(tree.join("debian")).expect("mkdir tree");
|
||||
std::fs::write(tree.join("debian/changelog"), changelog).expect("write changelog");
|
||||
std::fs::write(tree.join("debian/control"), control).expect("write control");
|
||||
std::fs::write(
|
||||
tree.join("debian/files"),
|
||||
"hello_1.0-1+b1_all.deb devel optional\n",
|
||||
)
|
||||
.expect("write files");
|
||||
std::fs::write(base.path().join("hello_1.0-1+b1_all.deb"), "deb payload")
|
||||
.expect("write deb");
|
||||
|
||||
// The trap: the previous source artifacts sit right next to the
|
||||
// binaries, as they would after a source build. dpkg does not
|
||||
// redistribute them for a binary-only upload, and neither must we.
|
||||
std::fs::write(
|
||||
base.path().join("hello_1.0-1.dsc"),
|
||||
"Format: 3.0 (quilt)\nSource: hello\nBinary: hello\nArchitecture: any\nVersion: \
|
||||
1.0-1\nMaintainer: A B <a@b.c>\nChecksums-Sha1:\n aaa111 12 \
|
||||
hello_1.0.orig.tar.xz\n",
|
||||
)
|
||||
.expect("write previous dsc");
|
||||
std::fs::write(base.path().join("hello_1.0.orig.tar.xz"), "tarball bytes")
|
||||
.expect("write previous tarball");
|
||||
|
||||
let ctx = Arc::new(
|
||||
crate::context::Context::new(crate::context::ContextConfig::Local).expect("context"),
|
||||
);
|
||||
let opts = BinaryMetadataOptions {
|
||||
profiles: Vec::new(),
|
||||
vendor: "debian".to_string(),
|
||||
exported_env: BTreeMap::new(),
|
||||
build_arch: "amd64".to_string(),
|
||||
host_arch: "amd64".to_string(),
|
||||
};
|
||||
let (buildinfo_path, changes_path) =
|
||||
generate_binary_metadata(&ctx, &tree, base.path(), &opts)
|
||||
.expect("binNMU metadata generation must succeed");
|
||||
|
||||
let changes = std::fs::read_to_string(&changes_path).expect("read changes");
|
||||
let buildinfo = std::fs::read_to_string(&buildinfo_path).expect("read buildinfo");
|
||||
|
||||
// The previous version is referenced textually.
|
||||
assert!(
|
||||
changes.contains("Source: hello (1.0-1)"),
|
||||
"changes must reference the previous version: {changes}"
|
||||
);
|
||||
assert!(
|
||||
buildinfo.contains("Binary-Only-Changes"),
|
||||
"buildinfo must record the binary-only entry: {buildinfo}"
|
||||
);
|
||||
// ... but no source file is distributed, on either side.
|
||||
for (doc, text) in [("changes", &changes), ("buildinfo", &buildinfo)] {
|
||||
assert!(
|
||||
!text.contains("hello_1.0-1.dsc"),
|
||||
"{doc} must not redistribute the previous .dsc: {text}"
|
||||
);
|
||||
assert!(
|
||||
!text.contains("hello_1.0.orig.tar.xz"),
|
||||
"{doc} must not redistribute the previous tarball: {text}"
|
||||
);
|
||||
}
|
||||
// The distributed set is exactly the binary artifacts + buildinfo.
|
||||
assert!(
|
||||
changes.contains("hello_1.0-1+b1_all.deb") && changes.contains(".buildinfo"),
|
||||
"changes must distribute the deb and the buildinfo: {changes}"
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user