- pkg_sync(): index.jsn and repo.url were updated as two independent
atomic writes with nothing serializing the pair against a second,
concurrent pkg_sync() call - each write stayed internally
consistent, but the pair didn't, so one sync's index could end up on
disk next to a different sync's source URL. Add a dedicated sync
lock (pkg_repo_acquire_sync_lock(), mirroring the existing installed-
db lock's blocking-retry-with-stale-reclaim pattern) around the
whole read-fetch-write sequence. Also renew the lock's mtime as data
actually arrives (pkg_repo_sink(), via a new renew_lock_path field
threaded through pkg_acquire_source()) rather than only stamping it
once at acquire time - a lock acquired once and then measured
against a fixed 10-minute staleness window could otherwise be
reclaimed mid-download on a large-enough file over a slow-enough
link, even though the download was still genuinely in progress.
pkg_reclaim_stale_lock() (renamed from pkg_install_reclaim_stale_lock,
made public) is shared between both lock kinds rather than
duplicated.
- pkg_install_prune_oldest_version(): deleted the pruned version's
on-disk payload directory before the updated installed database was
even durably saved. If pkg_metadata_save_installed() subsequently
failed, the payload was already gone but the last successfully-saved
instpkg.jsn could still list that version as installed. The victim
version is now handed back to the caller (threaded through
pkg_install_add_version()/pkg_install_update_installed()) so
pkg_install() can defer the actual directory removal until after the
save succeeds.
- pkg_metadata_version_token_cmp(): two version tokens with equal
numeric prefixes (e.g. "1a" and "1b", both parsing as 1) compared as
equal instead of falling back to a lexical comparison of what
follows the number, contradicting this function's own documented
behavior and silently treating genuinely different versions as the
same one. Compare the non-numeric remainder lexically when the
numeric prefixes match instead of falling through.
Assisted-by: Claude:claude-sonnet-5
Signed-off-by: aviralgarg05 <gargaviral99@gmail.com>
8571175bb9