Dear archive administrators,

We can across the following problem:

1. Step to reproduce: curl 'https://api.ftp-master.debian.org/file_in_archive/i/ifeffit/ifeffit%5c_1.2.11d.orig.tar.gz'
2. Expected result: a JSON document, with two entries, one for main and
   one for contrib.
2. Actual result: HTTP 500 Internal Server Error.

dgit and tag2upload actually fetch
<https://api.ftp-master.debian.org/file_in_archive/%25/ifeffit%5c_1.2.11d.orig.tar.gz>
which is similar but with more wildcards.  It gives the same error.

The %5c_ part of the URL is needed to quote the _ which would otherwise
be a one-character glob in sql pattern syntax.  We tried similar URLs
and they all give error 500 if the wildcards would match this particular
file.  Similar URLs which don't match this file seem to work.
For example this works fine:
https://api.ftp-master.debian.org/file_in_archive/x/xen/xen%5C_4.17.5+72-g01140da4e8.orig.tar.xz

Looking at projectb,

projectb=> with files as (select filename, id as file_id from files where filename like '%ifeffit\_%orig%' or filename like '%xen\_4.17%orig%') select file_id, filename, archive_id, c.name from files left join files_archive_map f using (file_id) left join component c on f.component_id = c.id  order by file_id;
 file_id  |                  filename                   | archive_id |  name
----------+---------------------------------------------+------------+---------
  4875375 | i/ifeffit/ifeffit_1.2.11d.orig.tar.gz       |          1 | main
  4875375 | i/ifeffit/ifeffit_1.2.11d.orig.tar.gz       |          1 | contrib
  4875375 | i/ifeffit/ifeffit_1.2.11d.orig.tar.gz       |          8 | main
  4875375 | i/ifeffit/ifeffit_1.2.11d.orig.tar.gz       |          8 | contrib
 36021597 | x/xen/xen_4.17.5+72-g01140da4e8.orig.tar.xz |          1 | main
 36021597 | x/xen/xen_4.17.5+72-g01140da4e8.orig.tar.xz |          8 | main
(6 rows)

This data seems fine but it looks like the ftp-master API service is
mishandling it.  We tried to verify this by doing

  with sq as (select file_id, count(distinct component_id) as comps from files_archive_map where archive_id = 1 group by file_id) select * from sq where comps > 1;

and that yielded 32 rows, the highest file_id of which was 31004991,
aka g/gpu-burn/gpu-burn_0+git20240115+ds.orig.tar.xz.  Sure enough

https://api.ftp-master.debian.org/file_in_archive/g/gpu-burn/gpu-burn%5c_0+git20240115+ds.orig.tar.xz

also gives HTTP 500.  In other words, at the time of writing there are,
it seems, exactly 32 files in the archive which show this bug.  If
anyone tries to upload those with git-debpush or just dgit, it will
probably fail.