chainguard-dev/melange

Pin the package version used during `melange test`

Opened this issue · 0 comments

As described #1518, we would like to be able to run melange test on a yaml file and reproduce results even after the version specified in that yaml has been surpassed.

From #1518:

However, there is no version of this package specified which means if you were to execute the tests on an older commit, or incorrectly publish a newer version of the package and then revert without withdrawing, the test will use the latest version instead of the version from the config (package.version and package.epoch)

The change that landed there unfortunately broke serveral wolfi packages. such as py3-fastbencode as decribed in #1579 :

For an example, see wolfi-dev/os/py3-fastbencode.yaml
The main package is provider-priority 0 and the subpackages have specific provider-priorities > 0.
With the pkg=version change, we got the main package installed, which is empty, and the test would fail.