Skip to content

Version grammar accepts architecture tokens (false positive as originally analysed) #1071

Description

@nikagra

False positive — closing. The original analysis below used the wrong oracle. Running the real
resolver says the opposite.

ccmlib.scylla_repository.setup("release:<v>", skip_downloads=True) against live S3:

version outcome
6.2.0-aarch64-rc ValueError: Not expected version number: 6.2.0~aarch64.0~rc
6.2.0-rc ValueError: Release packages have not been found
6.2.0-aarch64 ValueError: Release packages have not been found
6.2-aarch64 InvalidVersion: '6.2-aarch64'

6.2.0-aarch64-rc does not become 6.2.0-rc — the two fail with different errors and neither
resolves to any package. There is no moving selector and no repeated S3 resolution, so the stated
harm does not occur.

The arch deletion is real but unreachable from here. ccmlib/utils/version.py:46-50 sits in
ComparableScyllaVersion.parse, whose only call site in ccm is scylla_cluster.py:363
ScyllaManager.version, parsing sctool version output. Both drivers send -v release:, which
goes through normalize_scylla_version instead; nothing on that path touches arch tokens. ccm
selects architecture from the SCYLLA_ARCH environment variable (scylla_repository.py:258),
never from the version string.

The table in the original text was labelled "confirmed against ComparableScyllaVersion", which
is exactly the mistake: that class parses versions for comparison, not for package resolution.

What remains true is much smaller: an arch-bearing version is always unusable, and the grammar
lets five spellings through to fail at ccm with a confusing error (or an uncaught
InvalidVersion) instead of the Makefile's clear message. That is an error-quality nit, not the
P2 this was filed as. Reopen with that framing if it is worth a guard; SCYLLA_ARCH is the
supported way to pick an architecture.

Chasing this down did turn up a real defect: #1108 — the dated-build arm resolves nothing at all,
proven against an artifact that exists in the bucket.

Original report (superseded)

The prerelease rule requires the discriminating number to sit in the label itself
(_VERSION_LABEL = [A-Za-z]+[0-9][A-Za-z0-9]*). aarch64 satisfies it — aarch + 6 + 4
and ccm deletes it with a global str.replace, so the version was believed to reach ccm as a
moving selector. Seven forms were listed, "confirmed against ComparableScyllaVersion".

Refs: #1108, #1076, #1066, #1075

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions