From 73fcc24335338669eaf8f438fe7dbcb5802b49ad Mon Sep 17 00:00:00 2001 From: Roland Date: Sun, 19 Jul 2026 12:58:38 -0600 Subject: [PATCH] upgrade: force-update the debian12-final tag fetch Same force-fetch fix as PR #551, applied to the Debian 12 / Postgres release line so the deployed guard picks up a moved debian12-final tag instead of pinning to a stale local tag. Signature still verified before checkout. --- scripts/upgrade.sh | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/scripts/upgrade.sh b/scripts/upgrade.sh index 6c7c2545..2d963f84 100755 --- a/scripts/upgrade.sh +++ b/scripts/upgrade.sh @@ -58,11 +58,14 @@ debian12_guard() { return 0 fi - # Debian 12 (or older): make sure the cutoff tag is present locally. + # Debian 12 (or older): make sure the cutoff tag is present AND current. # `debian12-final` is off the release line, so a plain fetch of the branch - # would not follow it. - git -C /opt/wrolpi fetch origin "refs/tags/${GUARD_TAG}:refs/tags/${GUARD_TAG}" 2>/dev/null \ - || git -C /opt/wrolpi fetch origin --tags 2>/dev/null || : + # would not follow it. Force (+ / --force) so a moved tag (e.g. a bumped + # final release) overwrites a stale local tag instead of being rejected as + # "would clobber existing tag" — otherwise the guard pins to the old target. + # Safe to force: the commit's signature is verified before checkout below. + git -C /opt/wrolpi fetch origin "+refs/tags/${GUARD_TAG}:refs/tags/${GUARD_TAG}" 2>/dev/null \ + || git -C /opt/wrolpi fetch --force --tags origin 2>/dev/null || : # --verify --quiet: fail cleanly (empty, non-zero) instead of echoing the # unresolved arg when the tag is absent.