Skip to content

fix(maybeInstallable): match TERMS_EXTS_NON_BUILD against filename, not URL#21

Merged
coolaj86 merged 1 commit into
mainfrom
fix-maybe-installable-version-suffix
May 7, 2026
Merged

fix(maybeInstallable): match TERMS_EXTS_NON_BUILD against filename, not URL#21
coolaj86 merged 1 commit into
mainfrom
fix-maybe-installable-version-suffix

Conversation

@coolaj86

@coolaj86 coolaj86 commented May 7, 2026

Copy link
Copy Markdown
Member

Summary

Fix a false-positive in Triplet.maybeInstallable that drops package versions ending in .1 when the download URL is a GitHub source-archive endpoint.

Bug

maybeInstallable checks each entry in TERMS_EXTS_NON_BUILD (which includes .1 for matching man-page section-1 files like mytool.1) against the full build.download URL:

for (let ext of Triplet.TERMS_EXTS_NON_BUILD) {
    if (build.download.endsWith(ext)) {
        return false;
    }
}

For packages that publish only as GitHub source archives, the download URL is the API endpoint:

https://api.github.com/repos/bnnanet/serviceman/tarball/v1.0.1
                                                          ^^
                                                  ends with ".1"

maybeInstallable returns false, _classify silently returns null, and transformAndUpdate's "ignore known, non-package extensions" path drops the build with no error message. The package's newest release becomes invisible to the resolver.

Repro

let T = require('./triplet.js');
let v101 = {
    name: 'serviceman-v1.0.1.tar.gz',
    version: '1.0.1',
    ext: 'tar.gz',
    download: 'https://api.github.com/repos/bnnanet/serviceman/tarball/v1.0.1',
};
T.maybeInstallable({ name: 'serviceman' }, v101);
// before: false   ← bug
// after:  true

Fix

Check build.name (the canonical filename) instead of build.download. The filename for serviceman-v1.0.1.tar.gz ends in .tar.gz, not .1. Real .1 man-page files have .1 in their name too, so detection of those is unaffected. Same change applied to the _RE_TERMS_NON_BUILD loop for consistency.

Test plan

  • Unit verification (in commit message body):
    • serviceman-v1.0.1.tar.gztrue (was false)
    • serviceman-v1.0.0.tar.gztrue (unchanged)
    • mytool.1 (manpage) → false (unchanged)
  • Run webicached + webi serviceman end-to-end and confirm v1.0.1 (or whatever the newest patch.1 version is) resolves to the tarball, not v1.0.0.
  • Confirm no regression in other packages — particularly any that publish actual .1/.deb/.rpm/etc. files.

Impact

Affects any package whose version ends in .1 and whose download URL is a GitHub source-archive endpoint (/tarball/vX.Y.1 or /zipball/vX.Y.1). Observed in the wild for serviceman v1.0.1 (patch releases generally), aliasman, and the source-only vim plugins.

Surfaced while validating PR #1074 in webinstall/webi-installers — the resolver was returning v1.0.0 instead of v1.0.1 for serviceman, which traced back to this classifier rejection.

coolaj86 added a commit to webinstall/webi-installers that referenced this pull request May 7, 2026
Pulls in webinstall/webi-build-classifier#21 which fixes
`maybeInstallable` rejecting any package version ending in `.1` whose
download URL is a GitHub source-archive endpoint (`/tarball/vX.Y.1` or
`/zipball/vX.Y.1`). Affected packages: serviceman v1.0.1, aliasman, vim
plugins — their newest patch releases were silently dropped from the
in-memory cache.

This PR's `_enumerateTriplets` priority fix correctly picks the
`posix_2017-ANYARCH-none` triplet for those packages, but until the
classifier fix lands the triplet's newest version is still missing
v1.0.1. The two fixes need to land together.

Bumps SHA to 3f6d085 (the head of the build-classifier PR branch).
After webi-build-classifier#21 merges to main, this SHA remains in
that history.
…ot URL

`maybeInstallable` was checking `build.download.endsWith(ext)` for each
extension in `TERMS_EXTS_NON_BUILD`. That list includes `.1` (intended
for matching man-page section-1 files like `mytool.1`).

Some packages publish via GitHub source-archive URLs of the form
`https://api.github.com/repos/{owner}/{repo}/tarball/v1.0.1`. That URL
ends in `.1` (the version's patch number), so the check incorrectly
rejects the package's tarball as "not installable" — and silently,
because `_classify` returns `null` and `transformAndUpdate`'s "ignore
known, non-package extensions" comment hides the drop in the noise.

Concrete impact: any package whose version ends in `.1` and whose
download URL is a GitHub source-archive endpoint gets its newest
release dropped. Observed for serviceman v1.0.1 (and v1.0.x patch
releases generally), aliasman, vim plugins, etc.

Fix: check `build.name` (the canonical filename) instead of
`build.download`. The filename for `serviceman-v1.0.1.tar.gz` doesn't
end in `.1` — it ends in `.tar.gz`. Real `.1` man-page files have
`.1` in their `name` too, so detection of those is unaffected.
@coolaj86 coolaj86 force-pushed the fix-maybe-installable-version-suffix branch from 3f6d085 to 574eff5 Compare May 7, 2026 06:16
@coolaj86 coolaj86 merged commit 574eff5 into main May 7, 2026
3 checks passed
@coolaj86 coolaj86 deleted the fix-maybe-installable-version-suffix branch May 7, 2026 06:16
coolaj86 added a commit to webinstall/webi-installers that referenced this pull request May 7, 2026
Pulls in webinstall/webi-build-classifier#21 which fixes
`maybeInstallable` rejecting any package version ending in `.1` whose
download URL is a GitHub source-archive endpoint (`/tarball/vX.Y.1` or
`/zipball/vX.Y.1`). Affected packages: serviceman v1.0.1, aliasman, vim
plugins — their newest patch releases were silently dropped from the
in-memory cache.

This PR's `_enumerateTriplets` priority fix correctly picks the
`posix_2017-ANYARCH-none` triplet for those packages, but until the
classifier fix lands the triplet's newest version is still missing
v1.0.1. The two fixes need to land together.

Bumps SHA to 3f6d085 (the head of the build-classifier PR branch).
After webi-build-classifier#21 merges to main, this SHA remains in
that history.
coolaj86 added a commit to webinstall/webi-installers that referenced this pull request May 7, 2026
Pulls in webinstall/webi-build-classifier#21 (merged 2026-05-07,
SHA 574eff5) and the host-target x64/win32 fix from #20 (SHA 71c0768)
that landed alongside it.

#21 fixes `maybeInstallable` rejecting any package version ending in
`.1` whose download URL is a GitHub source-archive endpoint
(`/tarball/vX.Y.1` or `/zipball/vX.Y.1`). Without it, this PR's
`_enumerateTriplets` priority fix is undermined: even after picking
the correct posix_2017 triplet, the newest version (e.g. serviceman
v1.0.1) is silently dropped by the classifier and the resolver falls
back to v1.0.0.

Confirmed on next.webi.sh after deploying this branch with the bumped
submodule: `serviceman@stable.sh` now resolves to v1.0.1/zip on macOS
arm64 (was v1.0.0/zip with the pre-rebase pre-fix submodule).
coolaj86 added a commit to webinstall/webi-installers that referenced this pull request May 7, 2026
Pulls in webinstall/webi-build-classifier#21 (merged 2026-05-07,
SHA 574eff5) and the host-target x64/win32 fix from #20 (SHA 71c0768)
that landed alongside it.

#21 fixes `maybeInstallable` rejecting any package version ending in
`.1` whose download URL is a GitHub source-archive endpoint
(`/tarball/vX.Y.1` or `/zipball/vX.Y.1`). Without it, this PR's
`_enumerateTriplets` priority fix is undermined: even after picking
the correct posix_2017 triplet, the newest version (e.g. serviceman
v1.0.1) is silently dropped by the classifier and the resolver falls
back to v1.0.0.

Confirmed on next.webi.sh after deploying this branch with the bumped
submodule: `serviceman@stable.sh` now resolves to v1.0.1/zip on macOS
arm64 (was v1.0.0/zip with the pre-rebase pre-fix submodule).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant