Update watcher: bind an unattended update to the repository the install came from, not the package id
Maintainers usually reply within 1 day
A pull request for this has already been merged.
- #6541 by @rbuergi — merged
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 25/100
Research direction
Read PackageUpdateReconciler.cs:103-118 and trace how PluginUpdateWatcher passes repository listings to ReconcileInstalled, then find where install records are created and persisted. Add coverage for two watched repositories listing the same package id and check that an update only applies to the repository recorded at install. A linked open pull request (#6541) is already working on this issue.
Written by the indexing model from the issue text.
Description
Follow-up from the review of #6496 (https://github.com/Systemorph/MeshWeaver/pull/6496#discussion_r4242713496).
What: PluginUpdateWatcher hands a watched repository's listing to PackageUpdateReconciler.ReconcileInstalled. The reconciler matches install records by package id alone (PackageUpdateReconciler.cs:103-118). A second watched repository listing the same id can therefore auto-update a package it never installed. This applies to:
- a free package;
- a commercial package whose recorded authorizer is a person who is still Global Admin.
Not introduced by #6496. That PR closes the deployment-config case only: a source-less manifest under a deployment-config: principal is refused. The id-only binding for other principals is pre-existing.
Suggested fix:
- Bind each update to the watched repository the install record came from: record the source repository and subdirectory on install, and match on it in the reconciler.
- Refuse or skip a candidate from another repository, by name.
- Add a test with two watched repositories listing the same id.
🤖 Generated with Claude Code
- Dominant language
- C#
- Stars
- 12
- Forks
- 5
- Avg merge
- 4h 19m
- Merged PRs (30d)
- 932
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from Systemorph/MeshWeaver
-
bug sev:L
Difficulty 4/5 3-5 days Newbie friendliness 35/100
Systemorph/MeshWeaver#6648 · 5 comments ·
Maintainers usually reply within 1 day
-
bug sev:M
Difficulty 4/5 3-5 days Newbie friendliness 42/100
Systemorph/MeshWeaver#6647 ·
Maintainers usually reply within 1 day
-
bug sev:M
Difficulty 4/5 3-5 days Newbie friendliness 42/100
Systemorph/MeshWeaver#6646 · 2 comments ·
Maintainers usually reply within 1 day
-
bug sev:M
Difficulty 4/5 3-5 days Newbie friendliness 25/100
Systemorph/MeshWeaver#6645 · 2 comments ·
Maintainers usually reply within 1 day
-
bug sev:M
Difficulty 4/5 3-5 days Newbie friendliness 25/100
Systemorph/MeshWeaver#6644 · 2 comments ·
Maintainers usually reply within 1 day
All issues in Systemorph/MeshWeaver
Similar issues
-
python triage
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
microsoft/semantic-kernel#14590 ·
Maintainers usually reply within 3 days
-
Difficulty 1/5 Under an hour Newbie friendliness 90/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
nkdAgility/azure-devops-migration-tools#3226 ·
Maintainers usually reply within 1 day
-
t/bug
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
dotnet/maui#39362 · 1 reaction ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day