Initial rewrite - #6
Draft
dralley wants to merge 19 commits into
Draft
Conversation
Use the rpm crate's Evr type for correct RPM version comparison. RPM version comparison is more complex than the typical semantic versioning.
Assisted-By: claude-opus-4.6
I have a use case for this eventually. Assisted-By: claude-opus-4.6
Determines which dependencies are unsatisfied across an entire repo without doing a full solve.
Everything but supplements and enhances, which are closely tied to rich deps Assisted-By: claude-opus-4.6
Introduce virtual solvables for RPM package groups, allowing group installation via the SAT solver. Groups are modeled as @group-id solvables whose Requires are the group's mandatory+default packages. - Add GroupInstallOptions to control which package types are included - Add LoadOptions.load_groups() to auto-parse comps.xml during repo load - Add RpmProvider::add_group() for manual group creation - Support @group-id syntax in the resolve CLI subcommand - Re-export CompsGroup and CompsPackageReq from rpmrepo_metadata Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Model each advisory as a `patch:ADVISORY-ID` virtual solvable following libsolv's convention. For each package in the advisory's pkglist, a constrains entry (>= fix version) is generated, forcing the solver to upgrade affected packages past the fixed version. Key design choices: - Uses bare package names (not arch-qualified) for constraints, since the provides map indexes by unqualified name and arch filtering happens at load time - Source-arch entries in advisory pkglists are skipped - Advisory loading is optional, controlled by LoadOptions.load_advisories - CLI detects `patch:` prefix in package args to auto-enable loading Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Store loaded advisories (UpdateRecord) in an index on RpmProvider, enabling programmatic queries without going through the SAT solver: - advisories() returns all loaded advisories - advisory_by_id() looks up by advisory ID (e.g. "RHSA-2024:1234") - advisories_for_package() finds advisories affecting a package name - advisories_by_type() filters by type (security, bugfix, enhancement) - advisories_by_cve() finds advisories by CVE reference The index is populated by add_advisory(), which now also stores the UpdateRecord and builds package-name and CVE-ID reverse indexes. Assisted-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds a `query` subcommand that exposes the advisory index for
interactive use and scripting:
resolvo-rpm query --repo <path> [--package <name>] [--cve <id>]
[--type <type>] [--severity <sev>] [--id <advisory-id>]
Filters are combinable with AND logic. When --id is given, full
detail is shown (title, dates, CVE references, affected packages
with NEVRAs). Otherwise, results are printed as an aligned table.
Assisted-By: Claude Opus 4.6 <noreply@anthropic.com>
Environments are collections of groups in comps.xml (e.g. "Server",
"Minimal Install"). Each has a mandatory grouplist and an optional
optionlist where entries carry a default flag.
Wire environments into the resolver as virtual solvables named
@{env_id}, whose Requires point to the @{group_id} solvables for
their constituent groups. Add EnvironmentInstallOptions to control
which optional groups are included (default: mandatory + default-flagged).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Use helper functions, etc.
Add a "fetch" subcommand that downloads RPM repository metadata from a remote URL. Provide options for TLS verification, client certs, CA certs, etc. By default downloads primary, filelists, other, updateinfo, and comps metadata. The --all flag downloads every record in repomd.xml. Each downloaded file is verified against its repomd.xml checksum. Assisted-By: Claude Opus 4.6 <noreply@anthropic.com>
Implements the equivalent of dnf's --whatprovides and --whatrequires queries. whatprovides looks up the ProvidesMap by capability name (with lazy filelists loading for file paths); whatrequires scans all solvables' Requires lists for matching entries. Both are exposed as subcommands under a new `repoquery` CLI command. Also extracts print_solvable_table as a shared helper used by both the new commands and print_resolution, and adds doc comments to all previously undocumented functions in main.rs. Assisted-By: Claude Opus 4.6 <noreply@anthropic.com>
Contributor
|
I did a quick read through and the resolvo integration looks solid! Bit hard for me to judge the rest. :) |
Also, experiment with some code which makes advisories actively require their packages. I'm not sure we actually want to enable that but I will leave it around for now. Assisted-By: Claude Opus 4.6
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is 100% not an "optimal" implementation, it's missing important optimizations (esp. around filelists memory use - be careful about which repos you try to fully load) and does not yet work correctly with resolvo mainline in all circumstances (see prefix-dev/resolvo#230)
But it's enough to look at and critique. Feedback welcome.
A few notes:
fetchcommand I added to download the repo metadata independently directly from the source (fedora, centos, etc.)Major TBD features: