repo_publish.sh archive-matching bug (fixed 2026-07-07)

• repo_publish.sh’s _archive_old/_remove_old_symlinks originally matched “old version of this package” remotely via a shell glob: '${_pkgname}'-*-*-'${_pkgarch}'.pkg.tar.*. Shell glob * is unanchored (matches any number of --separated segments, not “exactly one”), so pkgname c2t-git also matched files named c2t-git-debug-<ver>-<rel>-<arch>.pkg.tar.* – i.e. a package’s own -debug split package.
• This only bit when -debug sorts alphabetically before the base package’s remaining pkgver suffix in repo_release.sh’s set -- "${pkgdir}"/*.pkg.tar.zst glob expansion (so the debug file gets uploaded in the same repo_publish.sh call before the regular one, letting the regular file’s _archive_old step wrongly scoop up the just-uploaded debug file). Happens for any VCS package using the common r<count>.<hash> pkgver convention (r > d alphabetically) – essentially any -git package with debug packaging enabled.
• Impact: by the time this was caught, 8cc-git-debug, 9cc-git-debug, ack-git-debug, and c2t-git-debug had all been silently moved to archive/ right after being repo-add’d, leaving each one’s db entry pointing at a file that no longer existed at os/x86_64/ (a 404 for anyone installing the -debug package).
• Fix: rewrote both functions to enumerate *.pkg.tar.* in the directory and, for each candidate, strip -<arch>, -<pkgrel>, -<pkgver> (same right-to-left logic _pkg_name already used locally) down to a bare pkgname, then compare that via exact string equality ([ "x$name" != "x${_pkgname}" ]) instead of a glob. Verified against a reproduction of the exact c2t-git/c2t-git-debug ordering.
• Remediation: first pass moved (mv) the four wrongly-archived debug packages back from archive/ to os/x86_64/, which incidentally emptied archive/ of those entries – the user immediately flagged this as wrong (see memory/feedback_archive_append_only.md, the new auto-memory entry): archive/ must be treated as append-only, nothing should ever be removed from it even to fix a misfiling. Corrected by cping the same four packages (+ .sigs) from os/x86_64/ back into archive/, so the end state has both: the correct, currently-referenced copy in os/x86_64/ (matching what the db points at), and a copy preserved in archive/ too.
• No other packages were affected — checked archive/ contents against every -debug package published up to that point.