Handle invalid public index paths and PDSC entries

[edriouk]

Fixes

• Fixes [Bug]: cpackget add crashes when updating a filesystem hosted .Web/index.pidx generated by vidx2pidx #835

Changes

• Resolve public index sources consistently, including sources that already end with index.pidx.
• Skip malformed PDSC entries with warnings when reading PIDX files.
• Return false from DirExists for any filesystem error instead of risking a panic.
• Add unit tests for invalid index sources, malformed PDSC entries, and invalid directory paths.

Invalid PDSC entries are now excluded from the index, which may change behavior for previously accepted malformed metadata.

Checklist

• 🤖 This change is covered by unit tests (if applicable).
• 🤹 Manual testing has been performed (if necessary).
• 🛡️ Security impacts have been considered (if relevant).
• 📖 Documentation updates are complete (not required).
• 🧠 Third-party dependencies and TPIP updated (not required).

[qltysh]

Coverage Impact

⬆️ Merging this pull request will increase total coverage on main by 0.4%.

Modified Files with Diff Coverage (3)

Rating	File	% Diff	Uncovered Line #s
	cmd/xml/pidx.go	100.0%
	cmd/installer/root.go	83.3%	1018-1019
	cmd/utils/utils.go	100.0%
	Total	95.2%

🤖 Increase coverage with AI coding...

In the `fix/835` branch, add test coverage for this new code:

- `cmd/installer/root.go` -- Line 1018-1019

🚦 See full report on Qlty Cloud »

🛟 Help

• Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.

• Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.

• File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)

  • Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.

[github-actions]

Test Results

    4 files  ± 0     24 suites  ±0   1m 3s ⏱️ -1s
  805 tests + 4    805 ✅ + 4  0 💤 ±0  0 ❌ ±0 
3 203 runs  +16  3 203 ✅ +16  0 💤 ±0  0 ❌ ±0 

Results for commit 83cf70c. ± Comparison against base commit a1c542d.

♻️ This comment has been updated with latest results.

[Copilot]

🟡 Changes recommended

Three moderate issues remain unresolved in public-index handling and PDSC validation.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

This PR hardens public index handling, PIDX parsing, and directory error handling.

Changes:

• Resolves sources that already include index.pidx.
• Skips malformed PDSC entries with warnings.
• Makes DirExists safely return false on filesystem errors.
• Adds regression tests.

File summaries

File	Summary
cmd/xml/pidx.go	Validates and filters PDSC entries. Moderate findings: versionless entries remain accepted, and valid timezone-suffixed dates may be rejected (1 vote each).
cmd/xml/pidx_test.go	Adds malformed PDSC entry test coverage.
cmd/utils/utils.go	Handles filesystem errors safely in directory checks.
cmd/utils/utils_test.go	Adds invalid-directory regression coverage.
cmd/installer/root.go	Resolves public index sources. Moderate finding: file:// sources are not converted before local path handling (3 votes).
cmd/installer/root_test.go	Adds public-index source and invalid-path regression coverage.

Review details

Suppressed comments (2)

cmd/xml/pidx.go:483

• version is a required pdsc attribute in testdata/PackIndex.xsd:60, but this condition skips validation when it is empty. A versionless entry is still inserted under a Vendor.Name. key and can be selected as the public pack entry, so malformed PDSC records are not fully excluded. Validate the field unconditionally (or explicitly handle versionless entries as a separate supported format).

	if p.Version != "" && !utils.IsPackVersionValid(p.Version) {
		invalidFields = append(invalidFields, "version")

cmd/xml/pidx.go:487

• The PIDX schema declares deprecated as xs:date (testdata/PackIndex.xsd:62), whose lexical form permits a trailing Z or timezone offset. This exact layout rejects valid values such as 2026-09-14Z and skips the entire PDSC entry, so valid metadata can disappear; parse the full schema date form and keep computeIsDeprecated consistent with it.

	if p.Deprecated != "" {
		if _, err := time.Parse("2006-01-02", p.Deprecated); err != nil {
			invalidFields = append(invalidFields, "deprecated")

• Files reviewed: 6/6 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[jkrech]

LGTM