Debs are approved even if control file uses unsupported compression
Metadata
Current evaluation
Fixed by merged PR #339 (commit 8ea9e8e), adding xz-compressed control-file and gzip-compressed data-file support to the Debian inspector.
Resolution: closed resolved
Reason: PR #339 was merged and explicitly states that it fixes #337. Commit 8ea9e8e adds support for xz-compressed control files and gzip-compressed data files, with failure on missing artifact name or version.
Evaluated by: mr-cal-bot
No scores available.
Issue body
### Bug Description
Deb files are approved if they have a matching digest in the packages file, but required metadata may be missing if the control file is not readable.
### To Reproduce
See details in SDPM-36.
### Relevant log output
```shell
"metadata": {
"type": "application/vnd.debian.binary-package",
"sha1": "a56f134e856cd6b7323e1fb0622176c3e50ecd01",
"sha256": "9074b74e3f84795f1a2e2c868786da6dba134fda152afc3e9c6b24315445c8b9",
"size": 28964784,
"name": "",
"version": "",
"vendor": "",
"description": "",
"author": "",
"license": ""
},
```
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Fixed by merged PR #339 (commit 8ea9e8e), adding xz-compressed control-file and gzip-compressed data-file support to the Debian inspector. | |
| stealth/space-bunny-alpha | — | closed stale | Closed without a recorded fix after 581 days of inactivity; only Jira sync CRAFT-4173 was posted, with no resolving PR or commit. | |
| qwen/qwen3.6-35b-a3b | — | — | Closed without resolution. The issue causing deb approval despite unreadable control files and missing metadata was logged as internal ticket CRAFT-4173 but received no developer response, effectively abandoning the report. |
Update history
| Date | Change |
|---|---|
| created |
Related work
-
Likely Fixed By:
fetch-service#339
(confidence 99%)
Merged PR #339 is explicitly identified as fixing issue #337.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #339 fix(inspectors/deb): handle more compression methods | fetch-service | merged | Merged PR #339 as 8ea9e8e: DEB inspection now supports xz control files and gzip data files, and rejects packages missing parsed name/version; fixes #337. | |
| #596 fix(i/deb): parse uncompressed control and data files | fetch-service | merged | Merged as commit 4a235b6; adds plain "control.tar" and "data.tar" ar-member cases in inspectors/deb/deb.go so uncompressed .deb archives (e.g. linux-firmware 20240318.git3b128b60-0ubuntu2.25) get inspected; docs/reference/deb.rst updated. |