fix(i/apt): prevent false positives in deb inspection
Metadata
Current evaluation
Merged a fix preventing false positives in deb inspection. It ensures only the deb inspector grants final approval, validates Packages listings in Release files, and enforces transactional rejection. Approved by two reviewers and merged.
Suggested action: —
No scores available.
Issue body
Deb artifacts are inspected by both the deb inspector (for the content)
and Packages inspector (to verify if the digest is listed in the
Packages file). Only the deb inspector should give the final approval,
with transactional inspectors rejecting if their verification fail.
This avoids the situation where the Packages inspector approves and
the main inspector ignores the artifact, causing an non-inspected
artifact to be approved and reach the original client. Also the deb
inspector requires the artifact to be previously inspected by the
Packages inspector.
The same happens between the Release inspector and artifacts listed
in the InRelease file (Packages, Commands, and Translation files).
Additionally, check if the Packages file is listed in the Release file
when verifying the deb file digest. This avoids the situation where a
deb file is correctly listed in an invalid Packages file.
- [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
-----
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Merged a fix preventing false positives in deb inspection. It ensures only the deb inspector grants final approval, validates Packages listings in Release files, and enforces transactional rejection. Approved by two reviewers and merged. |
Update history
| Date | Change |
|---|---|
| created |
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #61 inspectors: add apt and deb file inspectors | fetch-service | merged | Merged. Added apt and deb file inspectors to validate .deb packages against Packages.xz and verify Packages.xz signatures against InRelease files. The stateful implementation includes caching and received approval from two reviewers. | |
| #428 fix(i/apt): keep existing packages metadata in inspector state | fetch-service | merged | Merged a fix for the apt inspector to preserve existing package metadata instead of overwriting it with empty content during repeated downloads. Approved by two reviewers and passed all CI checks. | |
| #75 inspectors/apt: add test for packages verification in release | fetch-service | merged | Merged after approval by two reviewers. The update adds a test for packages verification in the release process under inspectors/apt. Despite a zero-line diff, the change was successfully integrated. | |
| #279 fix(i/apt): allow reading very short packages files | fetch-service | merged | Merged a fix enabling the apt installer to read very short package files. Approved by two reviewers with passing CI checks. The commit contained zero line changes, indicating a metadata or configuration update. | |
| #425 refactor(i/apt): define release inspector id as a constant | fetch-service | merged | Merged after two approvals and passing all CI checks. The change refactors the i/apt package by defining the release inspector ID as a constant, updating four files with a +9/-7 line diff. | |
| #474 False negatives in deb package inspections | fetch-service | closed | Resolved false negatives in deb package inspections caused by parallel host and build environment updates. Fixed by restricting updates to the build environment only, eliminating contradictory verification errors. |