wazuh-dashboard 5.0.0: DEB package is built as 4.14.12-latest because debian/changelog has a 4.14.12 entry on top  #1744

Description

On the 5.0.0 branch of wazuh-dashboard (commit 605e29c8a031), the DEB package build produces wazuh-dashboard_4.14.12-latest_<arch>.deb instead of wazuh-dashboard_5.0.0-latest_<arch>.deb. The builder then looks for the 5.0.0 file, does not find it, and the Generate packages job fails on amd64 and arm64. No 5.0.0 dashboard DEB package is published. The RPM dashboard packages build fine, because the spec takes its version from elsewhere.

Extent in the 5.0.0 Weekly run (orchestrator build https://jenkins-production.qa.wazuh.info/job/5.0.0/job/Weekly/58/, 2026-11-07):

• Stage_release_automatic build 293, DEB child stage_release_automatic_child build 1935: dashboard-deb-amd64 and dashboard-deb-arm64 failed in generate. The wazuh-dashboard workflow runs were 42320509075 (amd64) and 42320511730 (arm64). Because of this, sign, check and publish were skipped and no DASHBOARD_DEB_*_URI was published.
• Performance_Testing build 162 (agent soak) and build 163 (central components soak) failed at Validate Packages: DASHBOARD_DEB_AMD64_URI was missing from the package map.
• Credentials_Functional_Testing build 46 (CREDENTIALS-AIO, SHARD-2): no DEB bundle was available, so only RPM hosts were deployed. All 5 test_05_install_orders.py::test_install_and_start_one_by_one[*] (AIO-18) cases failed with "no amd64 deb host in the inventory".
• Demo_Environment build 71 (UNSTABLE): DASHBOARD_DEB_ARM64_URI was missing, so the pipeline fell back to the nightly backup map. The demo dashboard node was deployed with the 2026-11-06 package, not the one from this run.

This will happen in every nightly and weekly run on 5.0.0 until the changelog is fixed.

Analysis

Root cause. On commit 605e29c8a031, dev-tools/build-packages/deb/debian/changelog starts with a 4.14.12 entry, above the 5.0.0 entry:

1: wazuh-dashboard (4.14.12-RELEASE) stable; urgency=low
...
7: wazuh-dashboard (5.0.0-RELEASE) stable; urgency=low

dpkg-buildpackage takes the package version from the first changelog entry. deb-builder.sh only replaces the literal VERSION and RELEASE placeholders (lines 91-92: sed -i "s:VERSION:${version}:g" and sed -i "s:RELEASE:${revision}:g"). The entries carry hard-coded versions, so the package comes out as 4.14.12-latest. The builder, however, computes deb_file="${target}_${version}-${revision}_${architecture}.deb" (line 79) from the 5.0.0 version, and line 106 (cd ${pkg_path} && sha512sum ${deb_file}) fails.

Evidence from GHA run 42320509075, job Generate packages (amd64):

2026-11-07T01:22:21.4349001Z dpkg-buildpackage: info: source version 4.14.12-latest
2026-11-07T01:25:48.0622642Z dpkg-deb: building package 'wazuh-dashboard' in '../wazuh-dashboard_4.14.12-latest_amd64.deb'.
2026-11-07T01:27:56.9309264Z dpkg-genchanges: warning: the current version (4.14.12-latest) is earlier than the previous one (5.0.0-latest)
2026-11-07T01:27:58.5728424Z sha512sum: wazuh-dashboard_5.0.0-latest_amd64.deb: No such file or directory

The build was retried 3 times and failed the same way each time. Then Upload package to S3 failed:

2026-11-07T01:41:22.1719939Z aws: [ERROR]: The user-provided path .../dev-tools/build-packages/output/wazuh-dashboard_5.0.0-latest_amd64.deb does not exist.

The arm64 run 42320511730 shows the same thing (2026-11-07T01:45:45.0222662Z aws: [ERROR]: ... wazuh-dashboard_5.0.0-latest_arm64.deb does not exist.).

What changed. blame_line ties changelog line 1 to commit 8740783c from PR #1740 ("Merge 4.14.12 into 5.0.0"), merged 2026-11-06T15:46:44Z. The previous nightly (Stage_release_automatic build 292, child build 1926, wazuh-dashboard 56a3b09f) built dashboard-deb successfully before that merge. Open PR #1743 notes the same thing in its body: since #1740, the first entry of debian/changelog on 5.0.0 is 4.14.12-RELEASE, so the DEB cells fail in dpkg-buildpackage. The merge also put a 4.14.12 entry on top of the RPM spec %changelog (wazuh-dashboard.spec:553). That entry does not break the RPM build, but it is out of order for 5.0.0.

Downstream effects.

• Performance_Testing builds 162 and 163: ERROR:check_packages:Central package 'DASHBOARD_DEB_AMD64_URI' is needed by the environment but not defined in the input map. (02:50:42Z and 02:51:53Z).
• Credentials build 46: CREDENTIALS-AIO valid bundles found: [RPM-X86_64, RPM-AARCH64], then E no amd64 deb host in the inventory to install it on (03:49:08Z).
• Demo_Environment build 71: Missing required package(s) in provided parameter: DASHBOARD_DEB_ARM64_URI, AGENT_MACOS_ARM64_URI, then Warning: the newest package available is from 2026-11-06, so no nightly build was published today (2026-11-07). The missing AGENT_MACOS_ARM64_URI is a separate bug in the macOS agent package build.

Suggested fix. Remove the 4.14.12 entry from the top of debian/changelog on 5.0.0, or move it below the 5.0.0 entry. Do the same in the spec %changelog. The merge-forward procedure should keep the target branch's own version entry first. A guard in deb-builder.sh that compares the built package version with ${version} would make this kind of failure explicit.

Related

• Pull the package builder images from ghcr instead of building them #1743: Open PR whose description reports the same thing: since Merge 4.14.12 into 5.0.0 #1740 the first debian/changelog entry on 5.0.0 is 4.14.12-RELEASE and the DEB build fails in dpkg-buildpackage.