fix(index): replace the stanza for a re-published version instead of appending

A re-cut release reuses its version number, but the publish path is
append-only: it downloads the channel's current Packages index, appends the
stanza for the .deb it just fetched, and re-signs. For a re-cut that leaves TWO
stanzas for the same name-version, both pointing at the same pool path:

    Package: wheels
    Version: 4.1.0
    Filename: pool/stable/w/wheels/wheels_4.1.0_all.deb
    Size: 114764828
    SHA256: 6bc9d8f8...

    Package: wheels
    Version: 4.1.0
    Filename: pool/stable/w/wheels/wheels_4.1.0_all.deb
    Size: 114770228
    SHA256: 6ddb239e...

The pool object was overwritten by the re-cut build, so only the second stanza
describes the file actually served. apt binds to the stale one and refuses the
download. Verified against the live repo with a real client:

    E: Failed to fetch https://apt.wheels.dev/pool/stable/w/wheels/wheels_4.1.0_all.deb
       File has unexpected size (114770228 != 114764828). Mirror sync in progress?

so `apt install wheels` fails outright on the stable channel until the index is
wrong-then-right by luck of ordering.

Changes:
  * scripts/replace-package-stanza.py - rewrites a Packages index so exactly one
    stanza exists per name-version. Stanzas for other versions are preserved
    byte-for-byte, including field order.
  * regenerate-apt-metadata.sh - emit the new stanza to a scratch file and
    replace rather than append, so a re-cut supersedes the previous record. The
    name/version used for matching come from the .deb's own control file, so
    they agree with what apt-ftparchive emits.

Verified on the live stable index (2 x 4.1.0 stanzas -> 1, other 6 versions
untouched, remaining stanza matches the served .deb's size and sha256).

Signed-off-by: Peter Amiri <peter@alurium.com>

Author: bpamiri

scripts/__pycache__/replace-package-stanza.cpython-314.pyc

@@ -43,6 +43,10 @@ if [ ! -f "$APT_CONF_TEMPLATE" ]; then
   exit 1
 fi
 
+# Scratch file for the stanza apt-ftparchive emits for the .deb being published.
+TMP_STANZA=$(mktemp)
+trap 'rm -f "$TMP_STANZA"' EXIT
+
 for DIST in $DISTRIBUTIONS; do
   echo "── Incrementally updating dists/${DIST}/ ──"
   DIST_DIR="dists/${DIST}"
@@ -57,6 +61,17 @@ for DIST in $DISTRIBUTIONS; do
   fi
   echo "  new package: ${NEW_DEB}"
 
+  # The name/version this .deb declares. Taken from the package's own control
+  # file rather than the filename so it matches what apt-ftparchive emits (and
+  # keeps matching if nfpm ever changes its filename convention).
+  NEW_PKG=$(dpkg-deb -f "$NEW_DEB" Package)
+  NEW_VER=$(dpkg-deb -f "$NEW_DEB" Version)
+  if [ -z "$NEW_PKG" ] || [ -z "$NEW_VER" ]; then
+    echo "::error::Could not read Package/Version from ${NEW_DEB}"
+    exit 1
+  fi
+  echo "  declared as: ${NEW_PKG} ${NEW_VER}"
+
   for COMPONENT in $COMPONENTS; do
     for ARCH in $ARCHITECTURES; do
       BIN_DIR="${DIST_DIR}/${COMPONENT}/binary-${ARCH}"
@@ -65,10 +80,21 @@ for DIST in $DISTRIBUTIONS; do
       # Existing index was downloaded by the workflow; first publish starts empty.
       [ -f "${BIN_DIR}/Packages" ] || : > "${BIN_DIR}/Packages"
 
-      # Emit the new package's stanza and append. `--arch` matches the old full
-      # scan: an `all` package is emitted for both arches, `amd64` only for
-      # binary-amd64 (arm64 yields an empty append, which is a no-op).
-      apt-ftparchive --arch "$ARCH" packages "$NEW_DEB" >> "${BIN_DIR}/Packages"
+      # Emit the new package's stanza. `--arch` matches the old full scan: an
+      # `all` package is emitted for both arches, `amd64` only for binary-amd64
+      # (arm64 yields an empty stanza, which is a no-op).
+      apt-ftparchive --arch "$ARCH" packages "$NEW_DEB" > "${TMP_STANZA}"
+
+      if [ -s "${TMP_STANZA}" ]; then
+        # Replace rather than append. Appending is what produced two stanzas for
+        # the same name-version when a version is re-cut with a different build;
+        # both referenced the same pool path, but the stale one described the
+        # previous artifact, so apt rejected the download with "File has
+        # unexpected size". A no-op append for the arch that emits nothing keeps
+        # the index unchanged.
+        python3 "$(dirname "$0")/replace-package-stanza.py" \
+          "${BIN_DIR}/Packages" "${TMP_STANZA}"
+      fi
 
       gzip -9 --keep --force "${BIN_DIR}/Packages"
     done

scripts/regenerate-apt-metadata.sh

@@ -0,0 +1,104 @@
+#!/usr/bin/env python3
+"""Replace a package stanza in an apt Packages index, keeping the file valid.
+
+Why this exists
+---------------
+The publish path is incremental: it downloads the channel's current Packages
+index, appends the stanza for the .deb it just downloaded, and re-signs. That
+append-only behaviour is wrong for a *re-cut*, where a version is republished
+with a different artifact. The channel ends up with TWO stanzas for the same
+name-version:
+
+    Package: wheels
+    Version: 4.1.0
+    Filename: pool/stable/w/wheels/wheels_4.1.0_all.deb
+    Size: 114764828
+    SHA256: 6bc9d8f8...
+
+    Package: wheels
+    Version: 4.1.0
+    Filename: pool/stable/w/wheels/wheels_4.1.0_all.deb
+    Size: 114770228
+    SHA256: 6ddb239e...
+
+Both point at the same pool path, but the pool object was overwritten by the
+re-cut build, so only the second stanza describes the file actually served.
+apt binds to the stale one and refuses the download:
+
+    E: Failed to fetch .../wheels_4.1.0_all.deb
+       File has unexpected size (114770228 != 114764828). Mirror sync in progress?
+
+This rewrites the index so exactly one stanza exists per name-version: any prior
+stanza for that pair is dropped and the new one is appended. Stanzas for other
+versions are preserved byte-for-byte, including field order.
+
+Usage:
+    replace-package-stanza.py <Packages-file> <new-stanza-file>
+
+The new stanza is read from <new-stanza-file> (the output of
+`apt-ftparchive --arch <arch> packages <deb>`); its Package/Version fields
+determine which existing stanzas are replaced.
+"""
+import sys
+
+
+def parse_stanzas(text):
+    """Split a Packages file into stanzas, preserving field order and text."""
+    stanzas = []
+    current = []
+    for line in text.splitlines():
+        if line.strip() == "":
+            if current:
+                stanzas.append(current)
+                current = []
+        else:
+            current.append(line)
+    if current:
+        stanzas.append(current)
+    return stanzas
+
+
+def field_of(stanza, name):
+    prefix = name + ":"
+    for line in stanza:
+        if line.startswith(prefix):
+            return line[len(prefix):].strip()
+    return None
+
+
+def main():
+    if len(sys.argv) != 3:
+        sys.exit("usage: replace-package-stanza.py <Packages-file> <new-stanza-file>")
+
+    packages_path, stanza_path = sys.argv[1], sys.argv[2]
+    new_stanza = [ln for ln in open(stanza_path, encoding="utf-8").read().splitlines() if ln.strip()]
+    if not new_stanza:
+        sys.exit("ERROR: new stanza is empty")
+
+    name = field_of(new_stanza, "Package")
+    version = field_of(new_stanza, "Version")
+    if not name or not version:
+        sys.exit("ERROR: new stanza is missing Package or Version")
+
+    try:
+        existing = open(packages_path, encoding="utf-8").read()
+    except FileNotFoundError:
+        existing = ""
+
+    kept, removed = [], 0
+    for stanza in parse_stanzas(existing):
+        if field_of(stanza, "Package") == name and field_of(stanza, "Version") == version:
+            removed += 1
+            continue
+        kept.append(stanza)
+
+    # Rebuild with a single blank line between stanzas and a trailing newline.
+    blocks = ["\n".join(s) for s in kept] + ["\n".join(new_stanza)]
+    with open(packages_path, "w", encoding="utf-8") as handle:
+        handle.write("\n\n".join(blocks) + "\n")
+
+    print(f"  {name} {version}: replaced {removed} existing stanza(s), kept {len(kept)} other(s)")
+
+
+if __name__ == "__main__":
+    main()