[SLING-10467] Converted content package referres to paths moved to repo-init

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Content-Package to Feature Model Converter 1.1.4
• Fix Version/s: Content-Package to Feature Model Converter 1.1.6
• Component/s: Content-Package to Feature Model Converter
• Assignee: Angela Schreiber
• Reporter: Angela Schreiber
• Created: 08/Jun/21 08:31
• Updated: 06/Jul/21 07:05
• Resolved: 30/Jun/21 14:37

Description

kpauls, in the light of the enforce-principal-based-supported-path configuration option i had a look at the converted content packages, which probably need to be used instead of the original packages if the modifications applied by converted are not to be reverted by later installing the original content package.

i therefore created a simple test content package demo-cp.zip that contains:

• a regular user in 'demo-cp' subfolder
• a regular group in 'demo-cp' subfolder
• a bunch of service users both with resource-based and principal-based ac setup
• content root at /demo-cp with a ac-policy (entries for user, group and service user)
• a serviceusermapping configuration below /apps/demo-cp
  and had the converter generate demo-cp-0.0.0-cp2fm-converted.zip

when trying to install the converted content package on a repository that content for service users and below /apps installed, i noticed that the converted package will actually remove that content.
i suspect that this is caused by META_INF/vault/filter.xml and/or META-INF/vault/definition/content.xml still referring to those parts that got 'moved' to repo-init. in case of the dependency/.content.xml it states that the import mode is replace (same as in original package).

maybe my test package is not correct.... but I would have expected that the paths that have been installed by repo-init statements should no longer be covered by the converted package (everything below /apps and /home/users/system) or/and should have the import-mode changed to the deprecated MERGE or new MERGE_PROPERTIES. the latter would be needed for any kind of resource-based AC setup for service users at mutable content nodes (NOTE: doesn't apply in case ac-setup for service users is migrated to principal-based authorization which entirely resides below the service user home).

edge case: if regular users were to be located below /home/users/system excluding that path from the package definition obviously doesn't work.... changing import mode would be required. alternatively: spotting regular users below home/users/system and abort converter.

wdyt?

Issue Links

• is blocked by: SLING-10571 Hardcoded application paths in VaultPackageUtils.detectPackageType
• Testing discovered: SLING-10481 Review filter.xml creation for content package output of converter
• links to: GitHub Pull Request #92