Packaging: refuser Paru stable incompatible avant l’exécution #43

Merged

mathieu merged 1 commit from followup/issue-34-comment-1759 into main

2026-09-04 19:32:58 +00:00

hephaistos commented

2026-09-04 19:06:24 +00:00

Owner

Advances #34; this deliberately leaves the issue open for Mathieu's desktop verification rather than claiming the already-installed configuration is repaired automatically.

Diagnosis:

comment 1759 reproduces the same silent search because package release 0.1.0.r4.gd0ad113-1 can remain installed beside stable paru 2.1.0;
the virtual dependency paru fixed issue #40 but also lets the exact known-broken stable provider satisfy package metadata;
exact disposable reproduction confirms stable commit 70f66dc9 writes the complete menu and prompt to captured stdout, while stderr remains empty; the supported 9ac3578 build keeps the menu on stderr.

Changes:

publish package revision 0.1.0.r4.gd0ad113-2;
retain the resolvable virtual dependency paru, but declare conflicts=('paru<=2.1.0');
extend the package gate to prove stable paru 2.1.0 satisfies the virtual dependency yet is rejected at installation, then prove the unversioned paru provide from compatible paru-git does not falsely match the versioned conflict and installs successfully;
document the bootstrap/remediation boundary and preserve the grounded package-manager behavior.

TDD and verification:

RED: packaging/aur/scripts/test-package.sh exited 1 on the missing exact .SRCINFO conflict assertion;
CGO_ENABLED=1 go test ./... — pass;
go vet ./... — pass;
packaging/aur/scripts/test-package.sh — pass; built 0.1.0.r4.gd0ad113-2, rejected installation beside paru 2.1.0-1, then installed beside paru-git 2.1.0.r67.g9ac3578-1;
AUROSCOPE_E2E_DISPOSABLE_ARCH=1 scripts/e2e-disposable-arch.sh — pass;
AUROSCOPE_E2E_SUPPORTED_PARU=1 scripts/e2e-supported-paru.sh — pass against real pinned Paru 9ac3578;
bash -n on all packaging/E2E scripts and git diff --check — pass;
host namcap was unavailable; generated .SRCINFO parity and real Pacman transactions are covered by the disposable package gate.

Risk:

this is a package-state guard, not a parser for stable Paru's localized human output; supporting that output would violate the active one-version fail-closed contract;
a locally installed/unowned Paru binary is outside Pacman's conflict resolution and remains protected only by AURoscope's runtime fail-closed parser;
a downstream-patched package still versioned paru<=2.1.0 is conservatively rejected.

Review guidance:

verify PKGBUILD and generated .SRCINFO both contain depends = paru, conflicts = paru<=2.1.0, and pkgrel=2;
inspect the package gate's two sequential Pacman transactions: stable rejection, then paru-git success;
confirm the supported real-Paru E2E remains pinned to 9ac3578807a87858651e81a02586ceb947686e7c.

Advances #34; this deliberately leaves the issue open for Mathieu's desktop verification rather than claiming the already-installed configuration is repaired automatically. Diagnosis: - comment 1759 reproduces the same silent search because package release `0.1.0.r4.gd0ad113-1` can remain installed beside stable `paru 2.1.0`; - the virtual dependency `paru` fixed issue #40 but also lets the exact known-broken stable provider satisfy package metadata; - exact disposable reproduction confirms stable commit `70f66dc9` writes the complete menu and prompt to captured stdout, while stderr remains empty; the supported `9ac3578` build keeps the menu on stderr. Changes: - publish package revision `0.1.0.r4.gd0ad113-2`; - retain the resolvable virtual dependency `paru`, but declare `conflicts=('paru<=2.1.0')`; - extend the package gate to prove stable `paru 2.1.0` satisfies the virtual dependency yet is rejected at installation, then prove the unversioned `paru` provide from compatible `paru-git` does not falsely match the versioned conflict and installs successfully; - document the bootstrap/remediation boundary and preserve the grounded package-manager behavior. TDD and verification: - RED: `packaging/aur/scripts/test-package.sh` exited 1 on the missing exact `.SRCINFO` conflict assertion; - `CGO_ENABLED=1 go test ./...` — pass; - `go vet ./...` — pass; - `packaging/aur/scripts/test-package.sh` — pass; built `0.1.0.r4.gd0ad113-2`, rejected installation beside `paru 2.1.0-1`, then installed beside `paru-git 2.1.0.r67.g9ac3578-1`; - `AUROSCOPE_E2E_DISPOSABLE_ARCH=1 scripts/e2e-disposable-arch.sh` — pass; - `AUROSCOPE_E2E_SUPPORTED_PARU=1 scripts/e2e-supported-paru.sh` — pass against real pinned Paru `9ac3578`; - `bash -n` on all packaging/E2E scripts and `git diff --check` — pass; - host `namcap` was unavailable; generated `.SRCINFO` parity and real Pacman transactions are covered by the disposable package gate. Risk: - this is a package-state guard, not a parser for stable Paru's localized human output; supporting that output would violate the active one-version fail-closed contract; - a locally installed/unowned Paru binary is outside Pacman's conflict resolution and remains protected only by AURoscope's runtime fail-closed parser; - a downstream-patched package still versioned `paru<=2.1.0` is conservatively rejected. Review guidance: - verify `PKGBUILD` and generated `.SRCINFO` both contain `depends = paru`, `conflicts = paru<=2.1.0`, and `pkgrel=2`; - inspect the package gate's two sequential Pacman transactions: stable rejection, then `paru-git` success; - confirm the supported real-Paru E2E remains pinned to `9ac3578807a87858651e81a02586ceb947686e7c`.

Rows
Columns