feat(overlay): implement conflict-detection simulate in preflight

The simulateOverlayInstall seam was a no-op, so a to-install package
declaring Conflicts:/Breaks: against a present baseline package was not
caught by the preflight gate: conflictPolicy=fail had no conflict source
to act on, and the clash only surfaced as an opaque dpkg -i / rpm -i
abort at unpack time.

Implement the seam as a metadata-based simulation: read each to-install
artifact's declared conflicts on the host (dpkg -f Conflicts/Breaks, rpm
-qp --conflicts) and classify each one that names a package present in
the baseline (at a version the conflict's range covers) as an
ActionConflict, gated by conflictPolicy. It runs without a chroot or a
real package-manager invocation, so it is deterministic and always
executes. Undeclared file-level collisions are not covered here and
still fail loudly at install time; a future live simulator can augment
this.

Widen the seam signature to (info, baseline, plan) since a metadata
simulation needs the baseline installed set to know what is present.

Signed-off-by: Tyagi, Yogesh <yogesh.tyagi@intel.com>

Author: yktyagi

internal/image/overlay/depcheck.go

@@ -122,6 +122,134 @@ var readOverlayArtifactObsoletes = func(family PackageManager, plan *ResolutionP
 	return obs, nil
 }
 
+// ArtifactConflict records that a to-install package declares a conflict with
+// another package via its deb Conflicts:/Breaks: fields or its rpm Conflicts:.
+// When the conflicted package is present in the baseline, installing the
+// artifact would abort at the package-manager's unpack/configure step (dpkg -i
+// refuses a Conflicts, rpm -i/-U refuses a conflicting file/capability), so the
+// preflight classifies it as an ActionConflict gated by conflictPolicy — turning
+// an opaque mid-install failure into an up-front, actionable block.
+type ArtifactConflict struct {
+	// Package is the to-install package declaring the conflict.
+	Package string
+	// Conflicts is the (name + optional version constraint) of the package it
+	// conflicts with. Constraint is nil for an unversioned conflict (any version).
+	Conflicts DependencyAlternative
+}
+
+// readOverlayArtifactConflicts is the impure seam that reads the conflict
+// declarations of every plan.ToInstall artifact (deb Conflicts:/Breaks:, rpm
+// Conflicts:). Like the dependency and Obsoletes readers it is a best-effort
+// validation aid feeding the pure preflight, so a read failure is non-fatal: the
+// preflight simply loses this one net and the install would instead fail loudly
+// at unpack time. Tests override it to inject synthetic conflicts.
+var readOverlayArtifactConflicts = func(family PackageManager, plan *ResolutionPlan) ([]ArtifactConflict, error) {
+	if plan == nil || len(plan.ToInstall) == 0 {
+		return nil, nil
+	}
+	if strings.TrimSpace(plan.DownloadDir) == "" {
+		return nil, fmt.Errorf("overlay conflict check: plan has packages to install but no artifact download directory")
+	}
+
+	var conflicts []ArtifactConflict
+	for _, rp := range plan.ToInstall {
+		artifact, err := artifactFileFor(rp)
+		if err != nil {
+			return nil, err
+		}
+		hostPath := joinArtifactPath(plan.DownloadDir, artifact)
+
+		var edges []ArtifactConflict
+		switch family {
+		case PackageManagerDNF:
+			edges, err = readRPMArtifactConflicts(rp.Name, hostPath)
+		default:
+			edges, err = readDebArtifactConflicts(rp.Name, hostPath)
+		}
+		if err != nil {
+			// Best-effort: a single unreadable artifact must not fail the preflight;
+			// the two-slice model and the remaining artifacts still gate the build.
+			log.Warnf("Overlay conflict check: failed to read conflicts of %q from %s (continuing): %v", rp.Name, hostPath, err)
+			continue
+		}
+		conflicts = append(conflicts, edges...)
+	}
+	return conflicts, nil
+}
+
+// readDebArtifactConflicts reads the Conflicts and Breaks control fields of a
+// prepared .deb with `dpkg -f` and parses their (optionally versioned) entries.
+// Both fields are read because dpkg -i refuses to unpack over either one. The
+// file is read on the host, so no chroot is entered.
+func readDebArtifactConflicts(pkgName, hostPath string) ([]ArtifactConflict, error) {
+	var conflicts []ArtifactConflict
+	for _, field := range []string{"Conflicts", "Breaks"} {
+		// hostPath is a URL-derived artifact path; quote it before interpolating it
+		// into the bash -c command so metacharacters can't alter execution.
+		out, err := shell.ExecCmdSilent(fmt.Sprintf("dpkg -f %s %s", shell.QuoteArg(hostPath), field), true, shell.HostPath, nil)
+		if err != nil {
+			return nil, fmt.Errorf("reading %s of %s: %w", field, hostPath, err)
+		}
+		conflicts = append(conflicts, parseDebConflictsField(pkgName, out)...)
+	}
+	return conflicts, nil
+}
+
+// readRPMArtifactConflicts reads a prepared .rpm's Conflicts with
+// `rpm -qp --conflicts` (rpm is on the shell allowlist) and parses each entry.
+func readRPMArtifactConflicts(pkgName, hostPath string) ([]ArtifactConflict, error) {
+	// hostPath is a URL-derived artifact path; quote it before interpolating it
+	// into the bash -c command so metacharacters can't alter execution.
+	out, err := shell.ExecCmdSilent(fmt.Sprintf("rpm -qp --conflicts %s", shell.QuoteArg(hostPath)), true, shell.HostPath, nil)
+	if err != nil {
+		return nil, fmt.Errorf("reading conflicts of %s: %w", hostPath, err)
+	}
+	return parseRPMConflicts(pkgName, out), nil
+}
+
+// parseDebConflictsField parses a deb Conflicts/Breaks field value into conflict
+// entries. The field is a comma-separated list of "name[:arch] [(op ver)]" terms;
+// unlike Depends it carries no "a | b" alternatives (Debian policy forbids them
+// in Conflicts/Breaks), so each comma term is a single conflicted package. It
+// reuses parseDebAlternative for the name/version parsing.
+func parseDebConflictsField(pkgName, field string) []ArtifactConflict {
+	var conflicts []ArtifactConflict
+	for _, term := range strings.Split(field, ",") {
+		term = strings.TrimSpace(term)
+		if term == "" {
+			continue
+		}
+		if a, ok := parseDebAlternative(term); ok {
+			conflicts = append(conflicts, ArtifactConflict{Package: pkgName, Conflicts: a})
+		}
+	}
+	return conflicts
+}
+
+// parseRPMConflicts parses `rpm -qp --conflicts` output. Each non-empty line is
+// either a bare capability name or "name op version" (a versioned conflict).
+// File and rpmlib entries are skipped as in parseRPMObsoletes.
+func parseRPMConflicts(pkgName, out string) []ArtifactConflict {
+	var conflicts []ArtifactConflict
+	for _, line := range strings.Split(out, "\n") {
+		line = strings.TrimSpace(line)
+		if line == "" || strings.HasPrefix(line, "/") || strings.HasPrefix(line, "rpmlib(") {
+			continue
+		}
+		fields := strings.Fields(line)
+		switch len(fields) {
+		case 1:
+			// Unversioned conflict: conflicts with the named package at any version.
+			conflicts = append(conflicts, ArtifactConflict{Package: pkgName, Conflicts: DependencyAlternative{Name: fields[0]}})
+		case 3:
+			if c, ok := parseConstraint(fields[1] + " " + fields[2]); ok {
+				conflicts = append(conflicts, ArtifactConflict{Package: pkgName, Conflicts: DependencyAlternative{Name: fields[0], Constraint: &c}})
+			}
+		}
+	}
+	return conflicts
+}
+
 // readRPMArtifactObsoletes reads a prepared .rpm's Obsoletes with
 // `rpm -qp --obsoletes` (rpm is on the shell allowlist) and parses each entry.
 func readRPMArtifactObsoletes(pkgName, hostPath string) ([]ArtifactObsoletion, error) {

internal/image/overlay/depcheck_test.go

@@ -2,6 +2,7 @@ package overlay
 
 import (
 	"reflect"
+	"strings"
 	"testing"
 
 	"github.com/open-edge-platform/image-composer-tool/internal/config"
@@ -215,3 +216,148 @@ func TestEvaluatePreflight_UnsatisfiedDepAlternativeRescues(t *testing.T) {
 		t.Errorf("expected no block when an alternative satisfies the edge, got %+v", report)
 	}
 }
+
+func TestParseDebConflictsField(t *testing.T) {
+	// A realistic Conflicts line: a bare conflict, a versioned conflict, and a
+	// multiarch-qualified one. Conflicts/Breaks carry no "a | b" alternatives.
+	field := "oldpkg, libfoo (<< 2.0), bar:amd64 (= 1.0)"
+	conflicts := parseDebConflictsField("mypkg", field)
+	if len(conflicts) != 3 {
+		t.Fatalf("got %d conflicts, want 3: %+v", len(conflicts), conflicts)
+	}
+	if conflicts[0].Package != "mypkg" || conflicts[0].Conflicts.Name != "oldpkg" || conflicts[0].Conflicts.Constraint != nil {
+		t.Errorf("conflict[0] = %+v, want bare oldpkg", conflicts[0])
+	}
+	if conflicts[1].Conflicts.Name != "libfoo" || conflicts[1].Conflicts.Constraint == nil ||
+		conflicts[1].Conflicts.Constraint.Op != "<<" || conflicts[1].Conflicts.Constraint.Ver != "2.0" {
+		t.Errorf("conflict[1] = %+v, want libfoo (<< 2.0)", conflicts[1])
+	}
+	if conflicts[2].Conflicts.Name != "bar" || conflicts[2].Conflicts.Constraint == nil {
+		t.Errorf("conflict[2] = %+v, want bar (= 1.0) with arch stripped", conflicts[2])
+	}
+}
+
+func TestParseRPMConflicts(t *testing.T) {
+	out := "oldpkg\nlibfoo < 2.0\n/some/file\nrpmlib(Something) <= 4.0\n"
+	conflicts := parseRPMConflicts("mypkg", out)
+	// The bare name and the versioned conflict are kept; the file and rpmlib
+	// entries are skipped.
+	if len(conflicts) != 2 {
+		t.Fatalf("got %d conflicts, want 2: %+v", len(conflicts), conflicts)
+	}
+	if conflicts[0].Conflicts.Name != "oldpkg" || conflicts[0].Conflicts.Constraint != nil {
+		t.Errorf("conflict[0] = %+v, want bare oldpkg", conflicts[0])
+	}
+	if conflicts[1].Conflicts.Name != "libfoo" || conflicts[1].Conflicts.Constraint == nil ||
+		conflicts[1].Conflicts.Constraint.Op != "<" {
+		t.Errorf("conflict[1] = %+v, want libfoo < 2.0", conflicts[1])
+	}
+}
+
+// TestClassifyConflicts covers the pure conflict classifier: a declared conflict
+// against a present baseline package fires (bare and versioned-in-range), and a
+// conflict against an absent package or a versioned range that excludes the
+// baseline version does not.
+func TestClassifyConflicts(t *testing.T) {
+	sliceA := baselineVersionIndex([]BaselinePackage{
+		installedDeb("oldpkg", "1.0"),
+		installedDeb("libfoo", "1.5"),
+		installedDeb("libbar", "3.0"),
+	})
+
+	tests := []struct {
+		name         string
+		conflicts    []ArtifactConflict
+		wantCount    int
+		wantTarget   string
+		wantConflict string // the declaring artifact (ConflictWith)
+	}{
+		{
+			name:         "bare conflict on present package fires",
+			conflicts:    []ArtifactConflict{{Package: "newpkg", Conflicts: DependencyAlternative{Name: "oldpkg"}}},
+			wantCount:    1,
+			wantTarget:   "oldpkg",
+			wantConflict: "newpkg",
+		},
+		{
+			name:      "conflict on absent package is skipped",
+			conflicts: []ArtifactConflict{{Package: "newpkg", Conflicts: DependencyAlternative{Name: "absent-pkg"}}},
+			wantCount: 0,
+		},
+		{
+			name:         "versioned conflict in range fires",
+			conflicts:    []ArtifactConflict{{Package: "newpkg", Conflicts: DependencyAlternative{Name: "libfoo", Constraint: &VersionConstraint{"<<", "2.0"}}}},
+			wantCount:    1,
+			wantTarget:   "libfoo",
+			wantConflict: "newpkg",
+		},
+		{
+			name:      "versioned conflict out of range is skipped",
+			conflicts: []ArtifactConflict{{Package: "newpkg", Conflicts: DependencyAlternative{Name: "libbar", Constraint: &VersionConstraint{"<<", "2.0"}}}},
+			wantCount: 0,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			actions := classifyConflicts(PackageManagerAPT, sliceA, tt.conflicts)
+			if len(actions) != tt.wantCount {
+				t.Fatalf("got %d actions, want %d: %+v", len(actions), tt.wantCount, actions)
+			}
+			if tt.wantCount == 0 {
+				return
+			}
+			if actions[0].Type != ActionConflict {
+				t.Errorf("type = %s, want %s", actions[0].Type, ActionConflict)
+			}
+			if actions[0].Package != tt.wantTarget {
+				t.Errorf("target = %q, want %q", actions[0].Package, tt.wantTarget)
+			}
+			if actions[0].ConflictWith != tt.wantConflict {
+				t.Errorf("conflictWith = %q, want %q", actions[0].ConflictWith, tt.wantConflict)
+			}
+		})
+	}
+}
+
+// TestSimulateOverlayInstall_DeclaredConflictBlocked exercises the full seam:
+// the default simulateOverlayInstall reads artifact conflicts (overridden here to
+// avoid a real dpkg call) and feeds them through Preflight, which must block the
+// declared conflict against a present baseline package under the default fail
+// conflict policy — the end-to-end regression for the "conflict slips past the
+// gate" gap.
+func TestSimulateOverlayInstall_DeclaredConflictBlocked(t *testing.T) {
+	origRead := readOverlayArtifactConflicts
+	defer func() { readOverlayArtifactConflicts = origRead }()
+	readOverlayArtifactConflicts = func(PackageManager, *ResolutionPlan) ([]ArtifactConflict, error) {
+		return []ArtifactConflict{{Package: "newpkg", Conflicts: DependencyAlternative{Name: "oldpkg"}}}, nil
+	}
+
+	info := &BaselineInfo{OS: "ubuntu", Arch: "amd64", PackageManager: PackageManagerAPT}
+	baseline := []BaselinePackage{installedDeb("oldpkg", "1.0")}
+	plan := &ResolutionPlan{
+		DownloadDir: "/tmp/does-not-matter", // the reader is stubbed
+		ToInstall:   []ResolvedPackage{{Name: "newpkg", Version: "2.0", Arch: "amd64", URL: "https://x/newpkg.deb"}},
+	}
+
+	report, err := Preflight(info, baseline, plan, &config.OverlayPolicy{})
+	if err == nil || report == nil || !report.Blocked {
+		t.Fatalf("expected a blocked conflict, err=%v report=%+v", err, report)
+	}
+	if report.Conflicts != 1 {
+		t.Fatalf("conflicts = %d, want 1: %+v", report.Conflicts, report.Actions)
+	}
+	if report.Violations[0].Rule != ruleConflictPolicyFail {
+		t.Errorf("rule = %s, want %s", report.Violations[0].Rule, ruleConflictPolicyFail)
+	}
+	if report.Violations[0].Action.ConflictWith != "newpkg" {
+		t.Errorf("conflicting artifact = %q, want newpkg", report.Violations[0].Action.ConflictWith)
+	}
+	if report.Violations[0].Action.CurrentVersion != "1.0" {
+		t.Errorf("current version = %q, want 1.0 (from baseline)", report.Violations[0].Action.CurrentVersion)
+	}
+	for _, want := range []string{"newpkg", "oldpkg", "conflict"} {
+		if !strings.Contains(err.Error(), want) {
+			t.Errorf("error %q missing %q", err, want)
+		}
+	}
+}

internal/image/overlay/preflight.go

@@ -182,13 +182,31 @@ type PreflightInput struct {
 	Policy config.OverlayPolicy
 }
 
-// simulateOverlayInstall is a seam over the optional package-manager simulate
-// step (apt-get install --simulate / dnf install --assumeno). Its output is a
-// validation aid only — the two-slice model drives the policy decision — so the
-// default is a no-op. The install-wiring story can plug a real simulator in, and
-// tests override it to exercise the remove/conflict policy paths.
-var simulateOverlayInstall = func(info *BaselineInfo, plan *ResolutionPlan) ([]PlannedAction, error) {
-	return nil, nil
+// simulateOverlayInstall simulates the overlay install and returns the
+// remove/conflict actions it would trigger, for the policy gate to enforce. Its
+// output is a validation aid — the two-slice model still drives add/upgrade/
+// downgrade decisions — so a failure here is non-fatal (see Preflight).
+//
+// The default implementation is a METADATA-based simulation: it reads the
+// declared Conflicts:/Breaks: (deb) and Conflicts: (rpm) of every to-install
+// artifact on the host and reports each one that names a package present in the
+// baseline (at a version the conflict's range covers) as an ActionConflict. This
+// catches a declared conflict — which dpkg -i / rpm -i would otherwise only
+// reveal by aborting at unpack time — up front, without entering a chroot or
+// running the package manager, so it is deterministic and always executes.
+//
+// It does NOT catch a file-level collision that no package declares (two packages
+// shipping the same path): nothing in the artifact metadata expresses that, so it
+// still surfaces as a loud install-time failure. A future live simulator
+// (apt-get install --simulate / dnf install --assumeno, run in the mounted chroot
+// during the install phase) could augment this to cover those cases. Tests
+// override this seam to exercise the remove/conflict policy paths directly.
+var simulateOverlayInstall = func(info *BaselineInfo, baseline []BaselinePackage, plan *ResolutionPlan) ([]PlannedAction, error) {
+	conflicts, err := readOverlayArtifactConflicts(info.PackageManager, plan)
+	if err != nil {
+		return nil, err
+	}
+	return classifyConflicts(info.PackageManager, baselineVersionIndex(baseline), conflicts), nil
 }
 
 // Preflight runs the two-slice dependency/conflict preflight for an overlay
@@ -223,8 +241,11 @@ func Preflight(info *BaselineInfo, baseline []BaselinePackage, plan *ResolutionP
 
 	// The simulate step is an optional validation aid; its failure must not mask
 	// the authoritative two-slice decision, so a simulate error is logged and the
-	// preflight continues on the two-slice model alone.
-	simulated, err := simulateOverlayInstall(info, plan)
+	// preflight continues on the two-slice model alone. The default simulator reads
+	// the to-install artifacts' declared conflicts against the baseline (see
+	// simulateOverlayInstall), catching a declared Conflicts:/Breaks: before the
+	// install would abort at unpack time.
+	simulated, err := simulateOverlayInstall(info, baseline, plan)
 	if err != nil {
 		log.Warnf("Overlay preflight: package-manager simulation unavailable, continuing on two-slice model only: %v", err)
 		simulated = nil
@@ -474,6 +495,44 @@ func classifyObsoletions(family PackageManager, sliceA map[string]BaselinePackag
 	return actions
 }
 
+// classifyConflicts turns each declared Conflicts:/Breaks: (deb) or Conflicts:
+// (rpm) on a present baseline package into an ActionConflict, so conflictPolicy
+// gates a conflict that the package manager would otherwise only reveal by
+// aborting at unpack time. A conflict whose target is absent from the baseline is
+// a no-op (nothing to clash with) and is skipped; a versioned conflict only fires
+// when the baseline version falls within the declared range, and an uncomparable
+// version is treated conservatively as a potential conflict (better to gate than
+// to miss it).
+func classifyConflicts(family PackageManager, sliceA map[string]BaselinePackage, conflicts []ArtifactConflict) []PlannedAction {
+	var actions []PlannedAction
+	for _, c := range conflicts {
+		target := strings.TrimSpace(c.Conflicts.Name)
+		if target == "" {
+			continue
+		}
+		base, present := sliceA[target]
+		if !present {
+			continue // nothing installed under this name to conflict with
+		}
+		// A versioned conflict only clashes when the baseline copy's version
+		// satisfies the constraint; a version outside the range is not a conflict.
+		if vc := c.Conflicts.Constraint; vc != nil {
+			if cmp, err := comparePkgVersions(family, base.Version, vc.Ver); err == nil && !constraintSatisfied(vc.Op, cmp) {
+				continue
+			}
+		}
+		actions = append(actions, PlannedAction{
+			Type:           ActionConflict,
+			Package:        target,
+			CurrentVersion: base.Version,
+			Arch:           base.Arch,
+			ConflictWith:   c.Package,
+			Detail:         fmt.Sprintf("declared as a conflict by %q, which would abort the install at unpack time", c.Package),
+		})
+	}
+	return actions
+}
+
 // unsatisfiedVersionedAlternative reports whether a dependency edge is blocked by
 // the present-but-wrong-version case, returning the offending alternative. An
 // edge holds if ANY alternative is satisfied, so it is unsatisfied only when