[Bug] Re-tagging release breaks scoop

[stevehipwell]

Bug Report

Current Behavior

If a Scoop release tag is mutated it blocks the update of Scoop until the tag is manually removed from the local machine. This isn't obvious as the error only says Update failed..

Expected Behavior

I'd expect Scoop release tags to be immutable for all of the supply chain reasons as well as to not break end-users. I'd also expect the error message in the case where the tag is blocking a Scoop update to be meaningful. If Git is intended to replace the tags this needs to be explicitly configured for the Scoop Git repo and shouldn't rely on Git global defaults.

Additional context/output

Possible Solution

Manually remove the tag from Scoop.

[chawyehsu]

I'd expect Scoop release tags to be immutable

I was expecting tag 0.5.4 to be used for #6436 as there's extra patch applied but @niheaven decided to mutate existing 0.5.3.

If Git is intended to replace the tags this needs to be explicitly configured for the Scoop Git repo and shouldn't rely on Git global defaults.

There are some configuration already, but tags haven't been considered before. To prevent this for future releases improvement may be added. Unfortunately, this will not fix for existing breaks.

https://github.com/ScoopInstaller/Scoop/blob/b588a06/libexec/scoop-update.ps1#L129-L140

[niheaven]

Wow, sorry. I forgot to test main branch update. Will avoid such broken update and will be fixed asap as @chawyehsu mentioned.

[stevehipwell]

I think this is the classic case of an auto-updating app blocking itself due to a lack of constraints. The current state of Scoop for anyone who got a mutated tag is that unless their global settings allow tags to be overwritten they will be blocked with an unhelpful error message.

Moving forwards. As we know GitHub tags can't be made immutable, we should see a meaningful error in this case with instructions for how to work around it. If tags should be mutable, which IMHO they shouldn't, then Scoop should handle this via something like setting the --tags and --force flags for Git pull by default.

[ibillingsley]

Just to spell it out for anyone currently stuck with the "Update failed." error:
The fix is to run git fetch --tags --force in ~\scoop\apps\scoop\current

[HUMORCE]

Should we put some fix script for this in shadow dependency manifest to reduce impact it caused?

Might be:

7zip.json / innounp.zip / dark.json / git.json ...

post_install: [
...
# Fixes scoop tags
Invoke-Git ...
]

[chawyehsu]

Should we put some fix script for this in shadow dependency manifest to reduce impact it caused?

Might be:

7zip.json / innounp.zip / dark.json / git.json ...

post_install: [
...
# Fixes scoop tags
Invoke-Git ...
]

This is not the right way to deliver a fix... Scripting with no direct relevance to the app should not be added to the manifest file.

Once you do that, there's no going back, it's a Pandora's box.

[HUMORCE]

Yeah, and I think it could be blocked by the antivirus.

Since Scoop Core did not ship telemetry program and unable to issue announcements to end users, we are unable to determine the number of users affected. Will Traffic count pulls? emmm, ignore that, it should have counted clones and pulls, regardless of whether they were success or not.