Replicas sharing a libSQL metadata database hold no package lock in
common, which left two publish races.
- Two publishes to one package could read the same packument, and the
one that committed second was refused with 409. It now rebases what it
changed (its versions, tags, times, and other fields) onto the
packument the store holds and commits again, a bounded number of
times. It does so only while the package's maintainers are the ones
the publish was authorized against. A batch of npm packuments rebases
each one; other formats keep answering the conflict.
- A refused publish removed the archives it had written, though another
replica may have found one in place with the same bytes and committed
it. On libSQL they now stay, referenced by nothing and never served. A
single SQLite instance keeps removing them under its package lock.
Zoltan Kochan
5285760255