release-file: improve invalid file-reference handling

if we encounter a file reference pointing to a component that is not
contained in the componenents list, we can just ignore it as unknown.
only treat parsing errors for references pointing to known components as
actual errors.

this currently triggers with (In)Release files for debian-updates and
debian-security, which reference (empty) files for a "non-free-firmware"
component that is not listed in the `Components` field of the release
file.

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>

diff --git a/src/deb822/release_file.rs b/src/deb822/release_file.rs
index ee805bb61cdb6230c4953156e29175ac9ea27f8c..606823823722bb6db97b42d5def5045001ede000 100644 (file)
--- a/src/deb822/release_file.rs
+++ b/src/deb822/release_file.rs
@@ -389,11 +389,16 @@ impl TryFrom<ReleaseFileRaw> for ReleaseFile {
             let (component, file_type) = components
                 .iter()
                 .find_map(|component| {
-                    FileReferenceType::parse(component, &file)
-                        .ok()
-                        .map(|file_type| (component.clone(), file_type))
+                    if !file.starts_with(&format!("{component}/")) {
+                        return None;
+                    }
+
+                    Some(
+                        FileReferenceType::parse(component, &file)
+                            .map(|file_type| (component.clone(), file_type)),
+                    )
                 })
-                .ok_or_else(|| format_err!("failed to parse file reference '{file}'"))?;
+                .unwrap_or_else(|| Ok(("UNKNOWN".to_string(), FileReferenceType::Unknown)))?;
 
             Ok((
                 FileReference {