Fix go install: no colons in tracked file paths

A module zip may not contain a colon in a file path -- the allowed
punctuation is "!#$%&()+,-.=@[]^_{}~" and nothing else, because a colon
is not a legal filename on Windows and the format refuses to produce
archives that unpack on some machines and not others.

internal/pkgdb/testdata/debian12 is a real dpkg database, and dpkg names
the multiarch file lists "libc6:amd64.list". Four such files made

    go install github.com/cwayne18/vexscan@latest

fail for every user on every platform, before compiling anything:

    create zip: internal/pkgdb/testdata/debian12/var/lib/dpkg/info/libc6:amd64.list:
    malformed file path: invalid char ':'

Store those four %3A-escaped and have debianFS materialise the fixture
into a temp directory with the colons restored, so the parser still sees
byte-for-byte what dpkg wrote -- the arch-qualified .list lookup is the
thing TestDebReadsFileLists exists to cover, and reading the escaped
name would quietly stop testing it.

Add TestTrackedFilesCanGoInAModuleZip so the next one is caught here
rather than by the first person to install a tag, which cannot be fixed
in place once published.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: cwayne18

internal/pkgdb/deb_test.go

@@ -1,6 +1,7 @@
 package pkgdb
 
 import (
+	"io/fs"
 	"os"
 	"path/filepath"
 	"strings"
@@ -14,9 +15,48 @@ import (
 // between them cover every filename shape dpkg produces. The status file is
 // untouched: parsing a database someone else wrote is the entire job, so the
 // fixture is not one this code's author got to design.
+//
+// The fixture is materialised into a temp directory rather than read in place
+// because of the one filename shape that matters most here. dpkg writes the
+// multiarch lists as "libc6:amd64.list", and a module zip cannot contain a
+// colon: the punctuation a module file path may use is "!#$%&()+,-.=@[]^_{}~"
+// and nothing else, so one such file makes "go install" of this module fail
+// for everyone, on every platform, before a line of it is compiled. The files
+// are stored %3A-escaped and the colon is put back here, which keeps the name
+// the parser sees byte-for-byte what dpkg wrote while keeping the repository
+// installable. TestTrackedFilesCanGoInAModuleZip pins the rule.
 func debianFS(t *testing.T) target.RootFS {
 	t.Helper()
-	return target.NewDirFS(filepath.Join("testdata", "debian12"))
+	return target.NewDirFS(unescapeTree(t, filepath.Join("testdata", "debian12")))
+}
+
+// unescapeTree copies a fixture tree into a temp directory, turning %3A in any
+// path element back into a colon.
+func unescapeTree(t *testing.T, src string) string {
+	t.Helper()
+	dst := t.TempDir()
+	err := filepath.WalkDir(src, func(path string, d fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		rel, err := filepath.Rel(src, path)
+		if err != nil {
+			return err
+		}
+		out := filepath.Join(dst, strings.ReplaceAll(rel, "%3A", ":"))
+		if d.IsDir() {
+			return os.MkdirAll(out, 0o755)
+		}
+		b, err := os.ReadFile(path)
+		if err != nil {
+			return err
+		}
+		return os.WriteFile(out, b, 0o644)
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return dst
 }
 
 func TestDebReadsARealDebianStatus(t *testing.T) {

…var/lib/dpkg/info/gcc-12-base:amd64.list …r/lib/dpkg/info/gcc-12-base%3Aamd64.listinternal/pkgdb/testdata/debian12/var/lib/dpkg/info/gcc-12-base:amd64.list renamed to internal/pkgdb/testdata/debian12/var/lib/dpkg/info/gcc-12-base%3Aamd64.list internal/pkgdb/testdata/debian12/var/lib/dpkg/info/gcc-12-base:amd64.list renamed to internal/pkgdb/testdata/debian12/var/lib/dpkg/info/gcc-12-base%3Aamd64.list

@@ -0,0 +1,66 @@
+package main
+
+import (
+	"os/exec"
+	"strings"
+	"testing"
+	"unicode"
+)
+
+// modulePunct is every punctuation character a file inside a module zip may
+// use. The full rule is that a path element may hold Unicode letters, ASCII
+// digits, the ASCII space, and these -- nothing else.
+const modulePunct = "!#$%&()+,-.=@[]^_{}~"
+
+// TestTrackedFilesCanGoInAModuleZip fails on a committed file that "go install"
+// cannot package.
+//
+// This is not a style rule. A module zip is built from the repository as it
+// stands, and one illegal character anywhere in the tree makes
+//
+//	go install github.com/cwayne18/vexscan@latest
+//
+// fail for every user on every platform, with an error naming a file none of
+// them asked for. The tag that carries the bad file is immutable once
+// published, so the only remedy is a new release -- which is why this is
+// checked here rather than found by the first person to try installing.
+//
+// The character set is Windows-driven: a colon, an asterisk or a quote cannot
+// be a filename there, so the module format forbids them everywhere rather
+// than producing archives that unpack on some machines and not others. That is
+// how it caught internal/pkgdb/testdata/debian12, whose fixture is a real dpkg
+// database and whose multiarch file lists are genuinely named "libc6:amd64.list".
+// See debianFS for how that fixture keeps the real names at test time.
+func TestTrackedFilesCanGoInAModuleZip(t *testing.T) {
+	out, err := exec.Command("git", "ls-files", "-z").Output()
+	if err != nil {
+		t.Skipf("git ls-files: %v", err)
+	}
+	for _, path := range strings.Split(strings.TrimRight(string(out), "\x00"), "\x00") {
+		if path == "" {
+			continue
+		}
+		for _, elem := range strings.Split(path, "/") {
+			if bad, ok := badChar(elem); ok {
+				t.Errorf("%s: %q cannot appear in a file inside a module zip; "+
+					"store the file under an escaped name and restore it in the test that reads it",
+					path, bad)
+				break
+			}
+		}
+	}
+}
+
+// badChar returns the first character of a path element that a module zip does
+// not allow.
+func badChar(elem string) (rune, bool) {
+	for _, r := range elem {
+		switch {
+		case unicode.IsLetter(r), '0' <= r && r <= '9', r == ' ':
+		case strings.ContainsRune(modulePunct, r):
+		default:
+			return r, true
+		}
+	}
+	return 0, false
+}