Add --extra-repo-priority for APT pinning + regression test - #50
Open
Simon Beaudoin (simonbeaudoin0935) wants to merge 6 commits into
Open
Add --extra-repo-priority for APT pinning + regression test#50Simon Beaudoin (simonbeaudoin0935) wants to merge 6 commits into
Simon Beaudoin (simonbeaudoin0935) wants to merge 6 commits into
Conversation
Downstream-patched packages published via --extra-repo lose to a newer upstream security release once its version number overtakes the +qcomN suffix, since APT/aptitude always prefers the highest version among equal-priority candidates. Pin each --extra-repo to its own APT Pin-Priority (by origin/hostname) via sbuild's --chroot-setup-commands, so a repo can be preferred even when its package version is lower. Fixes #48 Signed-off-by: Simon Beaudoin <sbeaudoi@qti.qualcomm.com>
Add a README usage example and an AGENTS.md common-command entry for the new --extra-repo-priority flag, so the pairing convention with --extra-repo is discoverable without reading --help. Signed-off-by: Simon Beaudoin <sbeaudoi@qti.qualcomm.com>
.github/ should only hold GitHub-special content (workflows, issue templates, dependabot config). Move the CI dummy-package fixture to a top-level test/ directory, where upcoming testing logic will also live, and update the one workflow step that references its path. Signed-off-by: Simon Beaudoin <sbeaudoi@qti.qualcomm.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Add test/pinning/: a source package that Build-Depends on a synthetic libqcomdummy-dev and fails unless the resolved version matches the hardcoded "patched" one, plus run-pinning-test.sh, which publishes two conflicting versions of that library via two throwaway repo containers (so each gets its own address on the default bridge network - APT's origin pin matches by hostname only and ignores port, so same-host repos on different ports can't be told apart by the mechanism --extra-repo-priority uses) and runs the build twice: once unpinned (expected to fail, reproducing the bug) and once pinned (expected to succeed, verifying the fix). Wire it into the existing container-build-and-upload.yml as a job depending on build-deb-arm64. Verified end-to-end in a local sandbox with Docker + an arm64 host: both the unpinned failure and the pinned success reproduce exactly as designed. Signed-off-by: Simon Beaudoin <sbeaudoi@qti.qualcomm.com>
Simon Beaudoin (simonbeaudoin0935)
force-pushed
the
fix/extra-repo-priority-pinning-48
branch
from
September 9, 2026 17:52
51b0b14 to
97417d7
Compare
Simon Beaudoin (simonbeaudoin0935)
requested review from
bkosuri and
Loïc Minier (lool)
September 9, 2026 17:52
Simon Beaudoin (simonbeaudoin0935)
marked this pull request as ready for review
September 9, 2026 17:52
Copilot started reviewing on behalf of
Simon Beaudoin (simonbeaudoin0935)
September 9, 2026 17:52
View session
Simon Beaudoin (simonbeaudoin0935)
changed the title
Simon Beaudoin (simonbeaudoin0935)
requested a review
from Robie Basak (basak-qcom)
September 9, 2026 17:54
There was a problem hiding this comment.
🟡 Changes recommended
There are a few correctness/reliability issues in the new CI fixtures/workflow (future-dated changelog timestamp, potentially flaky container readiness, and inconsistent checkout action versions) that should be fixed before merging.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Adds an APT pinning capability to docker_deb_build.py via a new --extra-repo-priority option (positionally paired with --extra-repo) and introduces a regression test that reproduces and validates the fix for issue #48.
Changes:
- Add
--extra-repo-priorityCLI option and generate APT preferences in the sbuild chroot to pin packages by repo origin hostname. - Add an end-to-end regression test (
test/pinning/) that demonstrates failure without pinning and success with pinning. - Move the CI dummy package fixture into
test/dummy-package/and wire the new pinning test into the CI workflow.
File summaries
| File | Description |
|---|---|
docker_deb_build.py |
Adds --extra-repo-priority parsing/validation and generates chroot setup commands to write APT pin preferences. |
README.md |
Documents how to use --extra-repo-priority for APT pinning. |
AGENTS.md |
Updates agent docs with a pinning usage example. |
.github/workflows/container-build-and-upload.yml |
Points dummy-package validation at test/dummy-package/ and adds a new pinning regression-test job. |
test/pinning/run-pinning-test.sh |
New end-to-end regression test that serves two conflicting repos and validates pinning behavior. |
test/pinning/package/debian/control |
New fixture source package that Build-Depends on the synthetic pinned dependency. |
test/pinning/package/debian/rules |
Asserts the resolved libqcomdummy-dev version matches the expected pinned version. |
test/pinning/package/debian/changelog |
New package changelog for the pinning fixture. |
test/pinning/package/debian/copyright |
License header for the pinning fixture package. |
test/pinning/package/debian/source/format |
Declares the pinning fixture as a native source package. |
test/dummy-package/README.md |
Relocated dummy-package fixture documentation under test/. |
test/dummy-package/dummy.txt |
Dummy payload installed by the CI dummy package. |
test/dummy-package/debian/source/format |
Declares the dummy package as a native source package. |
test/dummy-package/debian/rules |
Minimal dh-based rules for the dummy package fixture. |
test/dummy-package/debian/install |
Installs dummy payload into the package image. |
test/dummy-package/debian/control |
Package metadata for the CI dummy package fixture. |
test/dummy-package/debian/changelog |
Changelog for the CI dummy package fixture. |
test/dummy-package/debian/copyright |
License header for the dummy package fixture. |
Review details
- Files reviewed: 10/18 changed files
- Comments generated: 3
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Simon Beaudoin <sbeaudoi@qti.qualcomm.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Simon Beaudoin <sbeaudoi@qti.qualcomm.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
--extra-repo-priority, paired positionally with--extra-repo, to let a repo win APT dependency resolution even when a different source offers a higher version number. Implemented by writing an APT preferences file into the sbuild chroot (pinned by origin/hostname) via--chroot-setup-commands, sincesbuildhas no built-in pinning option.Also adds a real regression test (
test/pinning/) reproducing the actual bug: two throwaway containers each serve a conflicting version of a syntheticlibqcomdummy-devpackage, and a fixture source package fails to build unless the intended version resolves. The test runs the build twice - once unpinned (expected to fail, proving the bug) and once with--extra-repo-priority(expected to succeed, proving the fix) - wired intocontainer-build-and-upload.ymlas a job that runs afterbuild-deb-arm64.Also moves the existing
dummy-packageCI fixture from.github/dummy-package/totest/dummy-package/, keeping.github/limited to GitHub-special content, alongside the newtest/pinning/fixture.Related Issue
Fixes #48