Hi,

if I have multiple versions of a package in the incoming directory that
supersede each other, correct processing depends on the order in which they
are processed. reprepro appears to use the order in which directory entries
are seen, which often depends on hash values or whether files were recently
deleted.

If version 2 is processed after version 1, this is fine, reprepro says that
files just added to the pool have been deleted, and the version 1 changes
files are gone.

If version 2 is seen first, version 1 fails the "higher version" check, the
.changes file is left in the incoming directory, and no new indexes are
built.

I think if "Permit: old_version" is active version 1 would actually get
added, overriding version 2, which would be especially bad (but I didn't
test that).

Just sorting the .changes files alphabetically might be wrong (because we'd
need to follow Debian's version ordering rules, but there is no guarantee
that .changes files follow a particular pattern), so it's probably
necessary to add a mechanism where a lower version being inserted inside
the same run that a higher version was seen is not an error, and/or a
configuration option to just silently discard older versions.

   Simon

- -- System Information:
Debian Release: 13.7
  APT prefers stable-security
  APT policy: (990, 'stable-security'), (990, 'stable'), (500, 'stable-debug')
Architecture: amd64 (x86_64)
Foreign Architectures: i386, riscv64

Kernel: Linux 7.2.9+deb13-amd64 (SMP w/8 CPU threads; PREEMPT)
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: sysvinit (via /sbin/init)
LSM: AppArmor: enabled

Versions of packages reprepro depends on:
ii  libarchive13t64  3.7.4-4+deb13u1
ii  libbz2-1.0       1.0.8-6
ii  libc6            2.41-12+deb13u4
ii  libdb5.3t64      5.3.28+dfsg2-9
ii  libgpg-error0    1.51-4
ii  libgpgme11t64    1.24.2-3
ii  liblzma5         5.8.1-1+deb13u2
ii  zlib1g           1:1.3.dfsg+really1.3.1-1+b1
ii  zstd             1.5.7+dfsg-1

Versions of packages reprepro recommends:
ii  apt  3.0.3

Versions of packages reprepro suggests:
ii  gpg-agent        2.4.7-21+deb13u1+b5
pn  inoticoming      <none>
ii  lzip             1.25-3
ii  pinentry-curses  1.3.1-2

- -- no debconf information
-----BEGIN PGP SIGNATURE-----

iQFDBAEBCgAtFiEEtjuqOJSXmNjSiX3Tfr04e7CZCBEFAmrdvBcPHHNqckBkZWJp
YW4ub3JnAAoJEH69OHuwmQgRk98H/jl8Frz+x6GSCiKsYGZjPzPb+OlVUd9YATYY
0Q+112RvXEKRiMxdJCly+gGYaynoE5tIXHpp06/318m2AGDbyqT0qb0RKOGyxMFv
F+ePyggCdoO4tbGVc4SM1V4cpBKfjebwCf3QYjPsPIIS6Y+L7eo5V6ST1ncrcm+U
vBVI1WvuF/vYOjlrWl9TmqvI3C4aubLIBug6t7KfY6OpyuhNfFw9A7noM3YxSWTe
99MMcqbcfrQUd6Ic+LHl8Fcf7tBQ3ioTlCWJo5QDFR5B/KtlQoXT5u19FMs66dab
rnILfLh17Nw9ivTCucb4NxqoJ19H8AdHxNPm+n7VwlcLI/vjA0k=
=kmOV
-----END PGP SIGNATURE-----