sbp opened a new issue, #1368:
URL: https://github.com/apache/tooling-trusted-releases/issues/1368

   Note: I don't think that we confirmed this one in triage.
   
   -----
   
   | Attribute | Details |
   |---|---|
   | **Severity** | High |
   | **Verdict** | CONFIRMED |
   | **Category** | data-integrity |
   | **File** | `storage/writers/distributions.py:219-227` |
   | **Source** | chunk-52 |
   
   **Description**
   
   When an existing distribution row is `pending` and `record()` is called with 
`pending=False` (a now-confirmed publication), only `existing.pending` is 
flipped to False and committed. The freshly-resolved `upload_date`, `api_url`, 
`web_url` (and staging) passed into this call are never written to `existing`. 
So a distribution first recorded as a pending retry with null metadata keeps 
its stale null upload_date/api_url/web_url even after the platform confirms it. 
record_from_data() resolves the real upload_date then calls 
record(pending=False, upload_date=...), and that data is silently dropped.
   
   **Evidence**
   
   lines 224-227: `existing.pending = False; await self.__data.commit(); return 
existing, False` — no assignment of 
existing.upload_date/api_url/web_url/staging from the new arguments.
   
   **Verification — CONFIRMED**
   
   - **Trigger:** record_from_data(release, staging=False, dd, 
allow_retries=True) when the platform API first fails records a pending row 
with upload_date/api_url/web_url=None; a later record_from_data call with the 
API succeeding calls record(pending=False, upload_date=<real>, api_url=..., 
web_url=...), hits the `existing.pending` else branch which only sets 
existing.pending=False and commits, dropping the resolved metadata.
   - **Reasoning:** The else branch at lines 224-227 flips only `pending` and 
never assigns the new upload_date/api_url/web_url, unlike 
__upgrade_staging_to_final which copies all fields; the 
production-to-production path skips the staging-upgrade branch so the stale 
null metadata persists.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to