Fix V3 packageContent URL selection to compare parsed versions - #2019
Fix V3 packageContent URL selection to compare parsed versions#2019Eugene Tolmachev (et1975) wants to merge 2 commits into
Conversation
… 1657) Co-authored-by: et1975 <623703+et1975@users.noreply.github.com>
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
There was a problem hiding this comment.
Pull request overview
Fixes incorrect V3 .nupkg selection during Install/Save by replacing substring-based URL matching with parsed NuGetVersion comparisons, preventing version-prefix collisions (e.g., 1.2.3 vs 1.2.30) that can download the wrong payload into the requested version folder.
Changes:
- Replaced substring URL matching in V3 install paths with a new helper that extracts and compares parsed versions.
- Added a
TestHooksentry point so URL selection can be unit-tested without a live feed. - Added Pester coverage for prefix-collision versions, 4-part versions, prereleases, query-parameter URLs, and the not-found case.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| src/code/V3ServerAPICalls.cs | Introduces version-parsing URL matcher and uses it in sync/async install paths. |
| src/code/PSResourceInfo.cs | Adds TestHooks.SelectV3PackageContentUrl to expose selection logic for tests. |
| test/InstallPSResourceTests/InstallPSResourceV3ServerVersionSelection.Tests.ps1 | Adds tests covering exact-match selection across several URL/version shapes. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
…election Co-authored-by: et1975 <623703+et1975@users.noreply.github.com>
|
Adding a reproduction with public packages in support of this fix, plus one remaining collision the new matcher still lets through. Reproduction on 1.2.0Environment: PSResourceGet 1.2.0 on PowerShell 7.6.5 (Windows). Also seen on 1.1.0.1 under Windows PowerShell 5.1, and on macOS. Against a NuGet v3 feed that serves PowerShellGet's published versions (not tested against the PowerShell Gallery directly, which PSResourceGet reaches over v2 by default): Save-PSResource -Repository <v3-feed> -Name PowerShellGet -Version 2.2.4 -Path $dir -TrustRepository
Select-String -Path "$dir/PowerShellGet/2.2.4/PowerShellGet.psd1" -Pattern ModuleVersion
The PR fixes theseI compiled
Remaining collision: the file-name suffix checkFor if (segment.EndsWith($".{normalizedVersion}.nupkg", StringComparison.OrdinalIgnoreCase))Any version whose text ends in A possible fix is to pass the package name in (both if (segment.Equals($"{packageName}.{normalizedVersion}.nupkg", StringComparison.OrdinalIgnoreCase))or to drop the file-name check whenever a version path segment is present. A test in the style of the new file: It 'Should not select a url whose file name merely ends with the requested version' {
$responses = @(
"$packageBaseAddress/3.2.5.1/test_module.3.2.5.1.nupkg",
"$packageBaseAddress/2.5.1/test_module.2.5.1.nupkg"
)
$url = [Microsoft.PowerShell.PSResourceGet.UtilClasses.TestHooks]::SelectV3PackageContentUrl($responses, '2.5.1')
$url | Should -BeExactly "$packageBaseAddress/2.5.1/test_module.2.5.1.nupkg"
} |
Summary
Install-PSResource/Save-PSResource against a V3 feed can download the payload of a different version than requested while writing it under the requested version's folder. The V3 download path picked the packageContent URL by substring match, so a requested version that is a text prefix of another version matched the wrong entry.
V3ServerAPICalls.InstallHelper and InstallHelperAsync did:
Requesting 1.2.3 matches .../test_module/1.2.30/test_module.1.2.30.nupkg first. This also explains why exact-range syntax ([1.2.3]) doesn't help: by this point the spec is already a parsed NuGetVersion, and only the final URL selection is text-based. FindVersionHelper already compares parsed versions, which is why Find reports the right version while the downloaded content is wrong.
Closes #1657
Changes
src/code/V3ServerAPICalls.cs — new GetPackageContentUrlForVersion helper that extracts the version from a packageContent entry and compares it as a NuGetVersion. Recognized shapes: version path segment (.../{name}/{version}/...), .{version}.nupkg file name suffix, and version-bearing query parameters (e.g. MyGet-style ?packageVersion=). Both the sync and async install paths now use it.
src/code/PSResourceInfo.cs — TestHooks.SelectV3PackageContentUrl entry point, following the existing TestHooks pattern, so URL selection is testable without a live feed.
test/InstallPSResourceTests/InstallPSResourceV3ServerVersionSelection.Tests.ps1 — covers 1.2.3 vs 1.2.30, the reported 2024.5.20.1 vs 2024.5.20.12, prereleases (2.5.0-beta1 vs 2.5.0-beta10), query-parameter URLs, and the not-found case. The prefix cases fail against the previous substring logic.
Behavioral note
Entries whose version can't be recovered from the URL are no longer matched at all, rather than being matched on any incidental substring occurrence. Non-matching now surfaces the existing "could not be found in repository" error instead of silently downloading a neighboring version.
PR Checklist
.h,.cpp,.cs,.ps1and.psm1files have the correct copyright headerWIP:or[ WIP ]to the beginning of the title (theWIPbot will keep its status check atPendingwhile the prefix is present) and remove the prefix when the PR is ready.