repo_publish.sh’s _archive_old/_remove_old_symlinks originally
matched “old version of this package” remotely via a shell glob:
'${_pkgname}'-*-*-'${_pkgarch}'.pkg.tar.*. Shell glob * is
unanchored (matches any number of --separated segments, not “exactly
one”), so pkgname c2t-git also matched files named
c2t-git-debug-<ver>-<rel>-<arch>.pkg.tar.* – i.e. a package’s own
-debug split package.
This only bit when -debug sorts alphabetically before the base
package’s remaining pkgver suffix in repo_release.sh’s
set -- "${pkgdir}"/*.pkg.tar.zst glob expansion (so the debug file
gets uploaded in the same repo_publish.sh call before the regular
one, letting the regular file’s _archive_old step wrongly scoop up
the just-uploaded debug file). Happens for any VCS package using the
common r<count>.<hash> pkgver convention (r > d alphabetically) –
essentially any -git package with debug packaging enabled.
Impact: by the time this was caught, 8cc-git-debug,
9cc-git-debug, ack-git-debug, and c2t-git-debug had all been
silently moved to archive/ right after being repo-add’d, leaving
each one’s db entry pointing at a file that no longer existed at
os/x86_64/ (a 404 for anyone installing the -debug package).
Fix: rewrote both functions to enumerate *.pkg.tar.* in the
directory and, for each candidate, strip -<arch>, -<pkgrel>,
-<pkgver> (same right-to-left logic _pkg_name already used locally)
down to a bare pkgname, then compare that via exact string equality
([ "x$name" != "x${_pkgname}" ]) instead of a glob. Verified against a
reproduction of the exact c2t-git/c2t-git-debug ordering.
Remediation: first pass moved (mv) the four wrongly-archived
debug packages back from archive/ to os/x86_64/, which incidentally
emptied archive/ of those entries – the user immediately flagged this
as wrong (see memory/feedback_archive_append_only.md, the new
auto-memory entry): archive/ must be treated as append-only, nothing
should ever be removed from it even to fix a misfiling. Corrected by
cping the same four packages (+ .sigs) from os/x86_64/ back into
archive/, so the end state has both: the correct, currently-referenced
copy in os/x86_64/ (matching what the db points at), and a copy
preserved in archive/ too.
No other packages were affected — checked archive/ contents against
every -debug package published up to that point.