deb/apk: make local repodata deterministic #119

2026-08-12T23:28:14+10:00

unkin-agent commented

2026-08-12 23:28:14 +10:00

Part of #117. Local generated repodata must be byte-identical across the two no-affinity replicas and across every regeneration, so apt/apk never hit a checksum mismatch between an index's advertised hash and the bytes actually served. This does the deb+apk half (the rpm half landed in #118).

How:

Derive the deb Release Date: from the newest persisted created_at (RFC1123Z, UTC) instead of time.Now(); carry created_at through the deb metadata SELECT and DebMetadata. An empty repo falls back to the Unix epoch. This also stops Date: running ahead of wall clock.
Pin the apk APKINDEX tar header ModTime to the Unix epoch instead of the zero-value time.Time, so it is never wall-clock derived.
Give both list queries a genuine total order by adding a file_path tiebreak (name/version/arch is not unique).
Add guard tests: deb generators byte-identical across generations; the Release checksum/size matches the served Packages/Packages.gz bytes (the exact apt invariant); Date: pinned to created_at; apk index byte-identical and tar ModTime pinned to epoch.

Part of #117. Local generated repodata must be byte-identical across the two no-affinity replicas and across every regeneration, so apt/apk never hit a checksum mismatch between an index's advertised hash and the bytes actually served. This does the deb+apk half (the rpm half landed in #118). How: - Derive the deb `Release` `Date:` from the newest persisted `created_at` (RFC1123Z, UTC) instead of `time.Now()`; carry `created_at` through the deb metadata SELECT and `DebMetadata`. An empty repo falls back to the Unix epoch. This also stops `Date:` running ahead of wall clock. - Pin the apk `APKINDEX` tar header `ModTime` to the Unix epoch instead of the zero-value `time.Time`, so it is never wall-clock derived. - Give both list queries a genuine total order by adding a `file_path` tiebreak (name/version/arch is not unique). - Add guard tests: deb generators byte-identical across generations; the `Release` checksum/size matches the served `Packages`/`Packages.gz` bytes (the exact apt invariant); `Date:` pinned to `created_at`; apk index byte-identical and tar `ModTime` pinned to epoch.

unkin-agent added 1 commit 2026-08-12 23:28:15 +10:00

deb/apk: make local repodata deterministic

ci/woodpecker/pr/build Pipeline was successful

Details

ci/woodpecker/pr/test Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

cea107d4b5

Part of #117. The two no-affinity replicas (and every regeneration) must
serve byte-identical local repodata so apt/apk never hit a checksum
mismatch between an index's advertised hash and the bytes actually served.

- Derive the deb Release Date: from the newest persisted created_at
  (RFC1123Z, UTC) instead of time.Now(); carry created_at through the deb
  metadata SELECT and DebMetadata struct.
- Pin the apk APKINDEX tar header ModTime to the Unix epoch instead of the
  zero-value time.Time, so it is never wall-clock derived.
- Give both list queries a genuine total order by adding a file_path
  tiebreak (name/version/arch is not unique).
- Add guard tests: deb generators byte-identical across generations, the
  Release checksum/size invariant matches the served Packages(.gz) bytes,
  the Date: is pinned to created_at; apk index byte-identical and tar
  ModTime pinned to epoch.

benvin merged commit 73c0bfc670 into master

2026-08-12 23:32:07 +10:00

benvin deleted branch benvin/deb-apk-repodata-deterministic

2026-08-12 23:32:08 +10:00

unkin-agent referenced this pull request

2026-08-12 23:33:23 +10:00

rpm-local repodata: intermittent checksum mismatch (repomd vs primary) breaks dnf #117

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/artifactapi#119