Support of Chocolatey in packages has flaws

[tdesveaux]

Description

We attempted using our GItea instance as a mirror of community.chocolatey.org and encountered an issue when using the command choco info git.

Our instance host both git and GitVersion packages.
Running choco info git returns information for the GitVersion package.

This is due to a shortcut in the implementation of the $filter argument.

Running with verbose choco info --verbose --ignore-http-cache git, we can see choco request information with a HTTP query https://{host}/api/packages/{org}/nuget/Packages()?$filter=(tolower(Id) eq 'git') and IsLatestVersion&semVerLevel=2.0.0

filter is used with toLower(Id) eq for match, while the implementation of Gitea assume it will always run with substringof (as can be seen in tests).

Using curl to send the same request, I can see Gitea returns multiple entries, where the GitVersion one is the first. I assume then choco only use the first entry from the response.

I think this should be pretty easily to reproduce as a case in the test linked before.
If needed, .nupkg can be downloaded directly from the packages page on community.chocolatey.org linked above.

Gitea Version

1.21

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

Gitea build ourselves from a fork with negligible changes (none that can concern the packages feature).
Hosted on a Debian, run from systemd.

Database

PostgreSQL

[tdesveaux]

I tested choco commands info, search, and install to see the queries made.
info and install both use the filter= Id eq pattern.
search uses searchTerm so current implementation is fine.

Here are the detailed requests:
choco info --ignore-http-cache --verbose git
will request:
/nuget/$metadata
/nuget/Packages()?$filter=(tolower(Id) eq 'git') and IsLatestVersion&semVerLevel=2.0.0

choco search --ignore-http-cache --verbose git
will request:
/nuget/Search()?$filter=IsLatestVersion&$orderby=Id&searchTerm='git'&targetFramework=''&includePrerelease=false&$skip=0&$top=30&semVerLevel=2.0.0
(repeated with different skip values)

choco install --ignore-http-cache --verbose git
will request (against: https://community.chocolatey.org/api/v2/)

GET https://community.chocolatey.org/api/v2/$metadata
GET https://community.chocolatey.org/api/v2/Packages()?$filter=(tolower(Id) eq 'git') and IsLatestVersion&semVerLevel=2.0.0
GET https://community.chocolatey.org/api/v2/Packages(Id='git',Version='2.45.1')
GET https://community.chocolatey.org/api/v2/FindPackagesById()?id='git.install'&semVerLevel=2.0.0
GET http://community.chocolatey.org/api/v2/FindPackagesById?id='git.install'&$skiptoken='1712241204370','2.24.0','git.install'
GET http://community.chocolatey.org/api/v2/FindPackagesById?id='git.install'&$skiptoken='1711994602130','2.10.1','git.install'
GET http://community.chocolatey.org/api/v2/FindPackagesById?id='git.install'&$skiptoken='1711461801530','2.13.1.2','git.install'
GET http://community.chocolatey.org/api/v2/FindPackagesById?id='git.install'&$skiptoken='1710086605527','2.11.1','git.install'
GET https://community.chocolatey.org/api/v2/FindPackagesById()?id='chocolatey-core.extension'&semVerLevel=2.0.0
GET http://community.chocolatey.org/api/v2/FindPackagesById?id='chocolatey-core.extension'&$skiptoken='1712192601110','1.0.1','chocolatey-core.extension'
GET https://community.chocolatey.org/api/v2/FindPackagesById()?id='chocolatey-compatibility.extension'&semVerLevel=2.0.0
GET http://community.chocolatey.org/api/v2/FindPackagesById?id='chocolatey-compatibility.extension'&$skiptoken='1715767803244','1.0.0','chocolatey-compatibility.extension'
GET https://community.chocolatey.org/api/v2/FindPackagesById()?id='chocolatey'&semVerLevel=2.0.0
GET http://community.chocolatey.org/api/v2/FindPackagesById?id='chocolatey'&$skiptoken='1712264601443','0.9.8.19-alpha1','chocolatey'
GET http://community.chocolatey.org/api/v2/FindPackagesById?id='chocolatey'&$skiptoken='1712257406173','0.9.8.28-alpha2','chocolatey'
GET http://community.chocolatey.org/api/v2/FindPackagesById?id='chocolatey'&$skiptoken='1712250204077','0.9.8.24-beta2','chocolatey'
GET http://community.chocolatey.org/api/v2/FindPackagesById?id='chocolatey'&$skiptoken='1712239407973','0.9.8.21','chocolatey'
GET http://community.chocolatey.org/api/v2/FindPackagesById?id='chocolatey'&$skiptoken='1712234003363','0.9.9.10','chocolatey'
GET https://community.chocolatey.org/api/v2/Packages(Id='git.install',Version='2.45.1')
GET https://community.chocolatey.org/api/v2/package/git.install/2.45.1

[KN4CK3R]

Fixed with #31188