False negatives in deb package inspections
Metadata
Current evaluation
Resolved false negatives in deb package inspections caused by parallel host and build environment updates. Fixed by restricting updates to the build environment only, eliminating contradictory verification errors.
Suggested action: —
No scores available.
Issue body
### Bug Description
The Fetch Service reports some deb packages are failing verification against the Packages file (see log output below). Additionally it also says the artifact was not verified against the Packages file (which contradicts the previous statement that it failed verification).
### To Reproduce
Couldn't reproduce this behavior locally. Further investigation required to isolate the problem.
### Relevant log output
```shell
"response-inspection": {
"apt.packages": {
"opinion": "Rejected",
"reason": "deb file digest not listed in packages file"
},
"deb": {
"opinion": "Rejected",
"reason": "deb file not verified against Packages file"
}
},
...
"downloads": [
{
"start-time": "2025-10-10T10:15:29.488236184Z",
"end-time": "2025-10-10T10:15:29.512697246Z",
"method": "GET",
"url": "http://archive.ubuntu.com/ubuntu/pool/main/n/node-jquery/libjs-jquery_3.6.1+dfsg+~3.5.14-1_all.deb",
"address": "10.142.105.243:45994",
"user-agent": "Debian APT-HTTP/1.3 (2.7.14)",
```
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Resolved false negatives in deb package inspections caused by parallel host and build environment updates. Fixed by restricting updates to the build environment only, eliminating contradictory verification errors. |
Update history
| Date | Change |
|---|---|
| created |
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #422 fix(i/apt): prevent false positives in deb inspection | fetch-service | merged | Merged a fix preventing false positives in deb inspection. It ensures only the deb inspector grants final approval, validates Packages listings in Release files, and enforces transactional rejection. Approved by two reviewers and merged. |