packaging: one name to Windows is one file, and the tagged tree goes whatever happens

Outside review of #147. Two archives holding LICENSE and License with
different bytes put one over the other on a Windows disk without a word,
because the names were compared as written - they are compared folded
to one case now, and refused like any two copies that differ. The tree
of the tag is exported for the check before the card and again for the
installer, and removed after each whatever happened in between, so a
refusal no longer leaves it beside the release's files.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: donislawdev

.github/scripts/build_msi.py

@@ -155,6 +155,11 @@ def unpack(archives, version, into):
     A file both archives hold goes in once, and only when both hold the same
     bytes - the three documents, today. Two different copies of one file are a
     question about how the release was built, and the installer does not pick one.
+
+    One file means one name to Windows, where the installer puts it: LICENSE
+    and License are the same file there, so the names are compared folded to
+    one case. Compared as written, the second would have overwritten the first
+    without a word (outside review of #147).
     """
     came_from = {}
     for package in packages.PACKAGES:
@@ -173,23 +178,25 @@ def unpack(archives, version, into):
                                "unpacked into. That is not an archive the release built"
                                % (name, entry.filename))
                     target = os.path.join(into, *entry.filename.split("/"))
-                    if entry.filename in came_from:
-                        with open(target, "rb") as held:
+                    key = entry.filename.casefold()
+                    if key in came_from:
+                        first, held_at, held_as = came_from[key]
+                        with open(held_at, "rb") as held:
                             if held.read() != archive.read(entry):
-                                refuse("%s and %s both hold %s, and not the same bytes. One "
-                                       "installer carries one copy - look at how the release "
-                                       "built the two archives"
-                                       % (came_from[entry.filename], name, entry.filename))
+                                refuse("%s holds %s and %s holds %s, one file on Windows, and "
+                                       "not the same bytes. One installer carries one copy - "
+                                       "look at how the release built the two archives"
+                                       % (first, held_as, name, entry.filename))
                         continue
-                    came_from[entry.filename] = name
+                    came_from[key] = (name, target, entry.filename)
                     os.makedirs(os.path.dirname(target), exist_ok=True)
                     with archive.open(entry) as src, open(target, "wb") as dst:
                         shutil.copyfileobj(src, dst)
         except zipfile.BadZipFile as err:
             refuse("%s is not a zip archive it can read (%s). Download it again" % (path, err))
     for package in packages.PACKAGES:
         program = package.program + ".exe"
-        if program not in came_from:
+        if program.casefold() not in came_from:
             refuse("the archives hold no %s at the top, and the installer puts it on PATH. "
                    "That is not the shape the release builds" % program)
     return came_from

.github/scripts/sign_release.py

@@ -51,6 +51,7 @@
 presses the button.
 """
 import argparse
+import contextlib
 import datetime
 import hashlib
 import io
@@ -515,6 +516,23 @@ def export_tree(tag, into):
     print("  the tree of %s: %d file(s) in %s" % (tag, len(files_under(into)), into))
 
 
+@contextlib.contextmanager
+def tagged_tree(tag, into):
+    """The tree of the tag for as long as it is needed, and gone afterwards.
+
+    Gone whatever happened inside: a refusal anywhere between the check
+    before the card and the installer left the export behind until the next
+    run cleared it (outside review of #147). Exported twice rather than kept
+    between the two, because the steps in between are the card and the Mac,
+    and either can stop the run.
+    """
+    export_tree(tag, into)
+    try:
+        yield into
+    finally:
+        shutil.rmtree(into, ignore_errors=True)
+
+
 def installer_script(tree):
     """build_msi.py as the tag has it, or a refusal for a tag from before it."""
     script = os.path.join(tree, ".github", "scripts", "build_msi.py")
@@ -709,8 +727,8 @@ def main(argv=None):
     if is_candidate(args.tag):
         print("  %s is a release candidate, so it gets no installer" % args.tag)
     else:
-        export_tree(args.tag, tree)
-        check_installer(args.tag, tree)
+        with tagged_tree(args.tag, tree):
+            check_installer(args.tag, tree)
 
     print("\n[1/9] fetching the build for %s" % args.tag)
     fetch_build(args.tag, work)
@@ -733,8 +751,8 @@ def main(argv=None):
     if is_candidate(args.tag):
         print("  none for a release candidate")
     else:
-        build_installer(args.tag, tree, work, thumbprint, pin, signtool, args.dry_run)
-        shutil.rmtree(tree)
+        with tagged_tree(args.tag, tree):
+            build_installer(args.tag, tree, work, thumbprint, pin, signtool, args.dry_run)
 
     print("\n[7/9] checksums over what will be published")
     name_for_publication(work, args.tag)

internal/guard/msi_test.go

@@ -347,7 +347,14 @@ func TestTheInstallerIsBuiltFromBothArchivesOrNotAtAll(t *testing.T) {
 			"dotnet tool install --global wix --version 5.0.2"},
 		{"a document differs between the two archives", func(_ *testing.T, a archives, _, _ string) {
 			a[window]["LICENSE"] = "another licence"
-		}, "both hold LICENSE, and not the same bytes"},
+		}, "holds LICENSE, one file on Windows, and not the same bytes"},
+		// One file to Windows, where the installer puts it. Compared as
+		// written, the second name overwrote the first on a Windows disk
+		// and nothing was said (outside review of #147).
+		{"a document differs and its name only in letter case", func(_ *testing.T, a archives, _, _ string) {
+			delete(a[cli], "LICENSE")
+			a[cli]["License"] = "another licence"
+		}, "holds License, one file on Windows, and not the same bytes"},
 		{"the command line archive is missing", func(_ *testing.T, a archives, _, _ string) {
 			delete(a, cli)
 		}, "holds no " + cli},
@@ -489,6 +496,14 @@ try:
     print("missing tag: EXPORTED")
 except SystemExit as refusal:
     print("missing tag: " + ("REFUSED" if "git fetch --tags" in str(refusal) else str(refusal)))
+kept = os.path.join(base, "kept")
+try:
+    with sr.tagged_tree("HEAD", kept):
+        print("inside: %s" % os.path.isfile(os.path.join(kept, "go.mod")))
+        raise SystemExit("a refusal inside")
+except SystemExit:
+    pass
+print("left after a refusal: %s" % os.path.exists(kept))
 `
 	dir := t.TempDir()
 	file := filepath.Join(dir, "probe.py")
@@ -512,6 +527,8 @@ except SystemExit as refusal:
 		"candidate v0.5.0-rc1: True",
 		"candidate v1.0.0-beta.2: True",
 		"missing tag: REFUSED",
+		"inside: True",
+		"left after a refusal: False",
 	} {
 		if !strings.Contains(string(said), want+"\n") && !strings.Contains(string(said), want+"\r\n") {
 			t.Errorf("the probe did not say %q:\n%s", want, said)