fix(overlay): resolve same-batch lockstep breaks/upgrades at install and preflight

Two related overlay-install correctness fixes for lockstep-versioned package
sets (e.g. vim-runtime/vim-tiny), where a package Breaks: an older version of
another that the overlay upgrades in the same batch:

- install: pass --auto-deconfigure to dpkg -i so a transient Breaks: satisfied
  later in the same batch is deconfigured and reconfigured rather than aborting
  at unpack time, mirroring apt's behavior.

- preflight: evaluate a versioned Conflicts:/Breaks: against the POST-INSTALL
  version of the target, not the baseline version. When the overlay upgrades the
  target past the break range in the same batch there is no real conflict, so it
  must not be flagged. Extract a shared postInstallVersionIndex helper reused by
  classifyConflicts and classifyUnsatisfiedDeps.

Adds regression coverage for both paths.

Signed-off-by: Tyagi, Yogesh <yogesh.tyagi@intel.com>

Author: yktyagi

internal/image/overlay/depcheck_test.go

@@ -267,6 +267,7 @@ func TestClassifyConflicts(t *testing.T) {
 
 	tests := []struct {
 		name         string
+		resolved     []ResolvedPackage // the overlay's to-install set (post-install state)
 		conflicts    []ArtifactConflict
 		wantCount    int
 		wantTarget   string
@@ -296,10 +297,20 @@ func TestClassifyConflicts(t *testing.T) {
 			conflicts: []ArtifactConflict{{Package: "newpkg", Conflicts: DependencyAlternative{Name: "libbar", Constraint: &VersionConstraint{"<<", "2.0"}}}},
 			wantCount: 0,
 		},
+		{
+			// The overlay upgrades the target past the break range in the same batch,
+			// so the versioned break no longer covers the post-install version and must
+			// not be flagged (mirrors vim-runtime "Breaks: vim-tiny (<< X)" while the
+			// overlay upgrades vim-tiny to X).
+			name:      "versioned break resolved by a same-batch upgrade is skipped",
+			resolved:  []ResolvedPackage{{Name: "libfoo", Version: "2.0"}},
+			conflicts: []ArtifactConflict{{Package: "newpkg", Conflicts: DependencyAlternative{Name: "libfoo", Constraint: &VersionConstraint{"<<", "2.0"}}}},
+			wantCount: 0,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			actions := classifyConflicts(PackageManagerAPT, sliceA, tt.conflicts)
+			actions := classifyConflicts(PackageManagerAPT, sliceA, tt.resolved, tt.conflicts)
 			if len(actions) != tt.wantCount {
 				t.Fatalf("got %d actions, want %d: %+v", len(actions), tt.wantCount, actions)
 			}

internal/image/overlay/install.go

@@ -347,10 +347,23 @@ func (b *debInstallerBackend) install(req installRequest) error {
 
 	// Non-interactive install of the local artifacts. dpkg -i takes the prepared
 	// files directly (no network, no repository resolution), keeping the install
-	// strictly to the approved, pre-downloaded set. "--" terminates option parsing
-	// so a URL-derived artifact basename beginning with '-' is treated as a file
-	// path, not a dpkg option (shell-quoting stops word-splitting, not option parsing).
-	cmd := "dpkg -i -- " + strings.Join(paths, " ")
+	// strictly to the approved, pre-downloaded set.
+	//
+	// --auto-deconfigure lets dpkg temporarily deconfigure an installed package that
+	// a to-be-unpacked artifact transiently Breaks, then reconfigure it once the
+	// batch completes — mirroring what apt does. dpkg unpacks the artifacts in
+	// command-line order, so when an upgraded package (e.g. vim-runtime) declares
+	// `Breaks: <other> (<< newver)` against a baseline package that is ALSO being
+	// upgraded to newver later in the same batch (e.g. vim-tiny), the old version is
+	// still installed at unpack time and dpkg would otherwise abort with
+	// "deconfiguration is not permitted". The break is self-resolving within the
+	// batch (the satisfying version is in the same set), which is why the preflight
+	// conflict gate correctly permits it; this flag lets dpkg carry it out.
+	//
+	// "--" terminates option parsing so a URL-derived artifact basename beginning
+	// with '-' is treated as a file path, not a dpkg option (shell-quoting stops
+	// word-splitting, not option parsing).
+	cmd := "dpkg -i --auto-deconfigure -- " + strings.Join(paths, " ")
 	envVars := []string{
 		"DEBIAN_FRONTEND=noninteractive",
 		"DEBCONF_NONINTERACTIVE_SEEN=true",

internal/image/overlay/install_test.go

@@ -758,7 +758,7 @@ func TestInstallCommandsTerminateOptions(t *testing.T) {
 	}{
 		{
 			name: "dpkg install",
-			want: "dpkg -i -- ",
+			want: "dpkg -i --auto-deconfigure -- ",
 			run:  func(shell.Executor) { _ = (&debInstallerBackend{}).install(req) },
 		},
 		{
@@ -797,3 +797,33 @@ func TestInstallCommandsTerminateOptions(t *testing.T) {
 		})
 	}
 }
+
+// TestDebInstallUsesAutoDeconfigure guards that the deb install passes
+// --auto-deconfigure. Without it, dpkg unpacks artifacts in command-line order and
+// aborts ("deconfiguration is not permitted") when a to-be-unpacked artifact
+// transiently Breaks an installed package that is ALSO being upgraded later in the
+// same batch (the vim-runtime Breaks vim-tiny (<< newver) case): the old version is
+// still present at unpack time. The break is self-resolving within the batch, so
+// the preflight gate permits it; the flag lets dpkg complete it by temporarily
+// deconfiguring and then reconfiguring the affected package.
+func TestDebInstallUsesAutoDeconfigure(t *testing.T) {
+	req := installRequest{
+		chrootPath:        "/mnt/root",
+		artifactChrootDir: chrootArtifactDir,
+		items: []plannedInstall{
+			{pkg: ResolvedPackage{Name: "vim-runtime"}, artifact: "vim-runtime_9.deb"},
+			{pkg: ResolvedPackage{Name: "vim-tiny"}, artifact: "vim-tiny_9.deb"},
+		},
+	}
+	cap := &capturingExecutor{}
+	stubShell(t, cap)
+	if err := (&debInstallerBackend{}).install(req); err != nil {
+		t.Fatalf("install: %v", err)
+	}
+	if len(cap.cmds) != 1 {
+		t.Fatalf("expected exactly one command, got %v", cap.cmds)
+	}
+	if !strings.Contains(cap.cmds[0], "--auto-deconfigure") {
+		t.Errorf("dpkg install command missing --auto-deconfigure: %q", cap.cmds[0])
+	}
+}

internal/image/overlay/preflight.go

@@ -206,7 +206,7 @@ var simulateOverlayInstall = func(info *BaselineInfo, baseline []BaselinePackage
 	if err != nil {
 		return nil, err
 	}
-	return classifyConflicts(info.PackageManager, baselineVersionIndex(baseline), conflicts), nil
+	return classifyConflicts(info.PackageManager, baselineVersionIndex(baseline), plan.ToInstall, conflicts), nil
 }
 
 // Preflight runs the two-slice dependency/conflict preflight for an overlay
@@ -429,15 +429,7 @@ func classifyUnsatisfiedDeps(family PackageManager, sliceA map[string]BaselinePa
 	// Post-install version index: the baseline overlaid with what to-install adds.
 	// A dependency is checked against the state that will exist after install, so a
 	// pin satisfied by a co-installed to-install package is correctly not flagged.
-	postInstall := make(map[string]string, len(sliceA)+len(resolved))
-	for name, bp := range sliceA {
-		postInstall[name] = bp.Version
-	}
-	for _, rp := range resolved {
-		if name := strings.TrimSpace(rp.Name); name != "" {
-			postInstall[name] = rp.Version
-		}
-	}
+	postInstall := postInstallVersionIndex(sliceA, resolved)
 
 	var actions []PlannedAction
 	for _, dep := range deps {
@@ -499,11 +491,20 @@ func classifyObsoletions(family PackageManager, sliceA map[string]BaselinePackag
 // (rpm) on a present baseline package into an ActionConflict, so conflictPolicy
 // gates a conflict that the package manager would otherwise only reveal by
 // aborting at unpack time. A conflict whose target is absent from the baseline is
-// a no-op (nothing to clash with) and is skipped; a versioned conflict only fires
-// when the baseline version falls within the declared range, and an uncomparable
-// version is treated conservatively as a potential conflict (better to gate than
-// to miss it).
-func classifyConflicts(family PackageManager, sliceA map[string]BaselinePackage, conflicts []ArtifactConflict) []PlannedAction {
+// a no-op (nothing to clash with) and is skipped.
+//
+// A versioned conflict is evaluated against the POST-INSTALL version of the
+// target, not the baseline version: a Breaks:/Conflicts: bound to a version range
+// (e.g. vim-runtime's "Breaks: vim-tiny (<< 9.1.0016-1ubuntu7.17)") is a lockstep
+// upgrade marker, and when the overlay upgrades that target to a satisfying
+// version in the SAME batch the range no longer covers it, so there is no real
+// conflict — dpkg's --auto-deconfigure resolves the transient break at unpack
+// time. Checking the baseline version alone would spuriously block that upgrade.
+// An uncomparable version is treated conservatively as a potential conflict
+// (better to gate than to miss it).
+func classifyConflicts(family PackageManager, sliceA map[string]BaselinePackage, resolved []ResolvedPackage, conflicts []ArtifactConflict) []PlannedAction {
+	postInstall := postInstallVersionIndex(sliceA, resolved)
+
 	var actions []PlannedAction
 	for _, c := range conflicts {
 		target := strings.TrimSpace(c.Conflicts.Name)
@@ -514,10 +515,12 @@ func classifyConflicts(family PackageManager, sliceA map[string]BaselinePackage,
 		if !present {
 			continue // nothing installed under this name to conflict with
 		}
-		// A versioned conflict only clashes when the baseline copy's version
-		// satisfies the constraint; a version outside the range is not a conflict.
+		// A versioned conflict only clashes when the version that will be present
+		// after install falls within the declared range; a version outside it — most
+		// commonly because the overlay upgrades the target in the same batch — is not
+		// a conflict.
 		if vc := c.Conflicts.Constraint; vc != nil {
-			if cmp, err := comparePkgVersions(family, base.Version, vc.Ver); err == nil && !constraintSatisfied(vc.Op, cmp) {
+			if cmp, err := comparePkgVersions(family, postInstall[target], vc.Ver); err == nil && !constraintSatisfied(vc.Op, cmp) {
 				continue
 			}
 		}
@@ -533,6 +536,23 @@ func classifyConflicts(family PackageManager, sliceA map[string]BaselinePackage,
 	return actions
 }
 
+// postInstallVersionIndex builds a name→version map of the state that will exist
+// after the overlay install: the baseline overlaid with the versions the overlay
+// will install (which supersede the baseline copy for any upgraded package). It
+// backs the post-install checks in classifyConflicts and classifyUnsatisfiedDeps.
+func postInstallVersionIndex(sliceA map[string]BaselinePackage, resolved []ResolvedPackage) map[string]string {
+	postInstall := make(map[string]string, len(sliceA)+len(resolved))
+	for name, bp := range sliceA {
+		postInstall[name] = bp.Version
+	}
+	for _, rp := range resolved {
+		if name := strings.TrimSpace(rp.Name); name != "" {
+			postInstall[name] = rp.Version
+		}
+	}
+	return postInstall
+}
+
 // unsatisfiedVersionedAlternative reports whether a dependency edge is blocked by
 // the present-but-wrong-version case, returning the offending alternative. An
 // edge holds if ANY alternative is satisfied, so it is unsatisfied only when