@push.rocks/smartlinuxrepo 0.0.0-stage → 1.0.0

package/ts/rpm/reader.ts

@@ -0,0 +1,317 @@
+import { PackageByteSource } from '../readers/bytesource.js';
+import { decodeGoUtf8 } from '../readers/text.js';
+import { LinuxRepoError } from '../shared/errors.js';
+import { resolveLinuxPackageLimits, type ILinuxPackageLimits } from '../shared/limits.js';
+import type { IRpmChangelog, IRpmDependency, IRpmFile, IRpmPackageRecord } from '../shared/types.js';
+import { isValidUrl } from '../shared/url.js';
+import { isPathSegment } from '../shared/validation.js';
+import { readRpmHeaders, RPM_SIGNATURE_TAG, type RpmHeader } from './header.js';
+
+/** Main header tags Gitea 28.2.0 reads (go-rpmutils `tags.go`). */
+const TAG = {
+  name: 1000,
+  version: 1001,
+  release: 1002,
+  epoch: 1003,
+  summary: 1004,
+  description: 1005,
+  buildTime: 1006,
+  buildHost: 1007,
+  size: 1009,
+  vendor: 1011,
+  license: 1014,
+  packager: 1015,
+  group: 1016,
+  url: 1020,
+  arch: 1022,
+  fileModes: 1030,
+  fileMtimes: 1034,
+  fileFlags: 1037,
+  sourceRpm: 1044,
+  provideName: 1047,
+  requireFlags: 1048,
+  requireName: 1049,
+  requireVersion: 1050,
+  conflictFlags: 1053,
+  conflictName: 1054,
+  conflictVersion: 1055,
+  changelogTime: 1080,
+  changelogName: 1081,
+  changelogText: 1082,
+  obsoleteName: 1090,
+  provideFlags: 1112,
+  provideVersion: 1113,
+  obsoleteFlags: 1114,
+  obsoleteVersion: 1115,
+  dirIndexes: 1116,
+  baseNames: 1117,
+  dirNames: 1118,
+  longSize: 5009,
+} as const;
+
+const RPMSENSE_LESS = 1n << 1n;
+const RPMSENSE_GREATER = 1n << 2n;
+const RPMSENSE_EQUAL = 1n << 3n;
+const RPMFILE_GHOST = 1 << 6;
+const S_IFMT = 0xf000;
+const S_IFDIR = 0x4000;
+const S_IXANY = 0x40 | 0x8 | 0x1;
+
+/**
+ * Reads an RPM package into a record holding exactly what Gitea 28.2.0's
+ * `rpm.ParsePackage` derives (`modules/packages/rpm/metadata.go:102-299`),
+ * plus the digests of the whole file.
+ *
+ * Gitea reads only the lead and the two headers; so does the reader, which
+ * then drains the payload for the digests. The differences from Gitea:
+ * `installedSize` falls back to LONGSIZE (5009) and `archiveSize` to the
+ * signature tag LONGARCHIVESIZE (271) when the 32-bit tag gives no value;
+ * numbers above `Number.MAX_SAFE_INTEGER`, tags with more than `maxEntries`
+ * values, and a NAME or built version that is not a path segment (empty,
+ * `.`, `..`, or holding `/` or a control character) are refused. Strings are decoded with the shared
+ * Go-compatible decoder (each byte of an invalid UTF-8 sequence becomes
+ * U+FFFD); Gitea 28.2.0 refuses such packages because its JSON v2 encoder
+ * rejects invalid UTF-8; the codec accepts them, so it accepts a superset of
+ * what Gitea accepts.
+ */
+export async function readRpmPackage(
+  source: AsyncIterable<Uint8Array>,
+  limits?: Partial<ILinuxPackageLimits>,
+): Promise<IRpmPackageRecord> {
+  const resolved = resolveLinuxPackageLimits(limits);
+  const bytes = new PackageByteSource(source, resolved.maxPackageBytes);
+  const headers = await readRpmHeaders(bytes, resolved);
+  const main = headers.main;
+
+  // GetNEVRA (go-rpmutils header.go:350-381): every part is required
+  const name = requiredString(main, TAG.name, 'NAME');
+  const epochValues = main.entry(TAG.epoch) === null ? [0n] : main.uint64s(TAG.epoch);
+  if (epochValues === null) {
+    throw new LinuxRepoError('invalid-field', 'the RPM EPOCH tag is not an integer', { field: 'EPOCH' });
+  }
+  const epoch = (epochValues[0] ?? 0n).toString();
+  const upstreamVersion = requiredString(main, TAG.version, 'VERSION');
+  const release = requiredString(main, TAG.release, 'RELEASE');
+  const architecture = requiredString(main, TAG.arch, 'ARCH');
+  const version = epoch !== '0' ? `${epoch}-${upstreamVersion}-${release}` : `${upstreamVersion}-${release}`;
+  // both name a segment of the package's served path (a difference from Gitea, whose upload route does not check them)
+  if (!isPathSegment(name)) {
+    throw new LinuxRepoError('invalid-field', 'the RPM NAME cannot name a package path segment', { field: 'NAME' });
+  }
+  if (!isPathSegment(version)) {
+    throw new LinuxRepoError('invalid-field', 'the RPM version (EPOCH, VERSION, RELEASE) cannot name a package path segment', {
+      field: 'VERSION',
+    });
+  }
+
+  // Gitea clears an invalid URL before it stores the metadata (metadata.go:151-153)
+  const urlValues = main.strings(TAG.url);
+  const rawUrl = urlValues === null || urlValues.length === 0 ? new Uint8Array(0) : urlValues[0];
+  const projectUrl = isValidUrl(decodeGoUtf8(rawUrl)) ? decodeGoUtf8(rawUrl) : '';
+  const record: IRpmPackageRecord = {
+    format: 'rpm',
+    name,
+    version,
+    architecture,
+    // routers/api/packages/rpm/rpm.go:188
+    fileName: `${name}-${version}.${architecture}.rpm`,
+    digests: { size: 0, md5: '', sha1: '', sha256: '', sha512: '' },
+    metadata: {
+      epoch,
+      upstreamVersion,
+      release,
+      isSourcePackage: headers.isSource,
+      summary: optionalString(main, TAG.summary),
+      description: optionalString(main, TAG.description),
+      license: optionalString(main, TAG.license),
+      projectUrl,
+      vendor: optionalString(main, TAG.vendor),
+      group: optionalString(main, TAG.group),
+      packager: optionalString(main, TAG.packager),
+      sourceRpm: optionalString(main, TAG.sourceRpm),
+      buildHost: optionalString(main, TAG.buildHost),
+      buildTime: firstNumber(main, TAG.buildTime, 'BUILDTIME') ?? 0,
+      fileTime: firstNumber(main, TAG.fileMtimes, 'FILEMTIMES') ?? 0,
+      installedSize: firstNumber(main, TAG.size, 'SIZE') ?? firstNumber(main, TAG.longSize, 'LONGSIZE') ?? 0,
+      archiveSize:
+        firstNumber(headers.signature, RPM_SIGNATURE_TAG.payloadSize, 'PAYLOADSIZE') ??
+        firstNumber(headers.signature, RPM_SIGNATURE_TAG.longArchiveSize, 'LONGARCHIVESIZE') ??
+        0,
+      provides: dependencies(main, TAG.provideName, TAG.provideVersion, TAG.provideFlags),
+      requires: dependencies(main, TAG.requireName, TAG.requireVersion, TAG.requireFlags),
+      conflicts: dependencies(main, TAG.conflictName, TAG.conflictVersion, TAG.conflictFlags),
+      obsoletes: dependencies(main, TAG.obsoleteName, TAG.obsoleteVersion, TAG.obsoleteFlags),
+      files: files(main),
+      changelogs: changelogs(main),
+    },
+  };
+  await bytes.drain();
+  record.digests = bytes.digests();
+  return record;
+}
+
+/** A NEVRA part: absent, not a string, or without a value refuses the package. */
+function requiredString(headerArg: RpmHeader, tagArg: number, fieldArg: string): string {
+  if (headerArg.entry(tagArg) === null) {
+    throw new LinuxRepoError('missing-field', `the RPM ${fieldArg} tag is missing`, { field: fieldArg });
+  }
+  const values = headerArg.strings(tagArg);
+  if (values === null) {
+    throw new LinuxRepoError('invalid-field', `the RPM ${fieldArg} tag is not a string`, { field: fieldArg });
+  }
+  if (values.length === 0) {
+    throw new LinuxRepoError('invalid-field', `the RPM ${fieldArg} tag holds no value`, { field: fieldArg });
+  }
+  return decodeGoUtf8(values[0]);
+}
+
+/** Gitea's `getString`: the first value, or `''`. */
+function optionalString(headerArg: RpmHeader, tagArg: number): string {
+  const values = headerArg.strings(tagArg);
+  return values === null || values.length === 0 ? '' : decodeGoUtf8(values[0]);
+}
+
+/** Gitea's `getUInt64`: the first value, or `null` where Gitea records 0. */
+function firstNumber(headerArg: RpmHeader, tagArg: number, fieldArg: string): number | null {
+  const values = headerArg.uint64s(tagArg);
+  if (values === null || values.length === 0) {
+    return null;
+  }
+  return safeNumber(values[0], fieldArg);
+}
+
+function safeNumber(valueArg: bigint, fieldArg: string): number {
+  if (valueArg > BigInt(Number.MAX_SAFE_INTEGER)) {
+    throw new LinuxRepoError('invalid-field', `the RPM ${fieldArg} value exceeds the largest safe integer`, {
+      field: fieldArg,
+    });
+  }
+  return Number(valueArg);
+}
+
+/** Gitea's `getEntries` (metadata.go:174-231), including its early returns. */
+function dependencies(headerArg: RpmHeader, namesTagArg: number, versionsTagArg: number, flagsTagArg: number): IRpmDependency[] {
+  const names = headerArg.strings(namesTagArg);
+  if (names === null || names.length === 0) {
+    return [];
+  }
+  const flags = headerArg.uint64s(flagsTagArg);
+  if (flags === null || flags.length === 0) {
+    return [];
+  }
+  const versions = headerArg.strings(versionsTagArg);
+  if (versions === null || versions.length === 0) {
+    return [];
+  }
+  if (names.length !== flags.length || names.length !== versions.length) {
+    return [];
+  }
+  return names.map((nameBytes, i): IRpmDependency => {
+    const flag = flags[i];
+    let flagName: IRpmDependency['flags'] = '';
+    if ((flag & RPMSENSE_GREATER) !== 0n && (flag & RPMSENSE_EQUAL) !== 0n) {
+      flagName = 'GE';
+    } else if ((flag & RPMSENSE_LESS) !== 0n && (flag & RPMSENSE_EQUAL) !== 0n) {
+      flagName = 'LE';
+    } else if ((flag & RPMSENSE_GREATER) !== 0n) {
+      flagName = 'GT';
+    } else if ((flag & RPMSENSE_LESS) !== 0n) {
+      flagName = 'LT';
+    } else if ((flag & RPMSENSE_EQUAL) !== 0n) {
+      flagName = 'EQ';
+    }
+    const entry: IRpmDependency = { name: decodeGoUtf8(nameBytes), flags: flagName, epoch: '', version: '', release: '' };
+    const full = versions[i];
+    if (full.length !== 0) {
+      // strings.Split on '-' and then ':' over the raw bytes, exactly as Gitea does
+      const parts = splitBytes(full, HYPHEN);
+      const versionParts = splitBytes(parts[0], COLON);
+      if (versionParts.length === 2) {
+        entry.version = decodeGoUtf8(versionParts[1]);
+        entry.epoch = decodeGoUtf8(versionParts[0]);
+      } else {
+        entry.version = decodeGoUtf8(versionParts[0]);
+        entry.epoch = '0';
+      }
+      if (parts.length > 1) {
+        entry.release = decodeGoUtf8(parts[1]);
+      }
+    }
+    return entry;
+  });
+}
+
+/** Gitea's `getFiles` (metadata.go:233-271). The path joins the raw bytes before decoding. */
+function files(headerArg: RpmHeader): IRpmFile[] {
+  const baseNames = headerArg.strings(TAG.baseNames) ?? [];
+  const dirNames = headerArg.strings(TAG.dirNames) ?? [];
+  const dirIndexes = headerArg.uint32s(TAG.dirIndexes) ?? [];
+  const fileFlags = headerArg.uint32s(TAG.fileFlags) ?? [];
+  const fileModes = headerArg.uint32s(TAG.fileModes) ?? [];
+  const result: IRpmFile[] = [];
+  for (let i = 0; i < baseNames.length; i++) {
+    if (dirIndexes.length <= i) {
+      continue;
+    }
+    const dirIndex = dirIndexes[i];
+    if (dirNames.length <= dirIndex) {
+      continue;
+    }
+    let type: IRpmFile['type'] = '';
+    let isExecutable = false;
+    if (i < fileFlags.length && (fileFlags[i] & RPMFILE_GHOST) !== 0) {
+      type = 'ghost';
+    } else if (i < fileModes.length) {
+      if ((fileModes[i] & S_IFMT) === S_IFDIR) {
+        type = 'dir';
+      } else {
+        isExecutable = (fileModes[i] & S_IXANY) !== 0;
+      }
+    }
+    const directory = dirNames[dirIndex];
+    const path = new Uint8Array(directory.length + baseNames[i].length);
+    path.set(directory, 0);
+    path.set(baseNames[i], directory.length);
+    result.push({ path: decodeGoUtf8(path), type, isExecutable });
+  }
+  return result;
+}
+
+/** Gitea's `getChangelogs` (metadata.go:273-299). */
+function changelogs(headerArg: RpmHeader): IRpmChangelog[] {
+  const texts = headerArg.strings(TAG.changelogText);
+  if (texts === null || texts.length === 0) {
+    return [];
+  }
+  const authors = headerArg.strings(TAG.changelogName);
+  if (authors === null || authors.length === 0) {
+    return [];
+  }
+  const times = headerArg.uint32s(TAG.changelogTime);
+  if (times === null || times.length === 0) {
+    return [];
+  }
+  if (texts.length !== authors.length || texts.length !== times.length) {
+    return [];
+  }
+  return texts.map((text, i) => ({
+    author: decodeGoUtf8(authors[i]),
+    date: times[i],
+    text: decodeGoUtf8(text),
+  }));
+}
+
+const HYPHEN = 0x2d;
+const COLON = 0x3a;
+
+/** Go's `bytes.Split` for one separator byte. */
+function splitBytes(bytesArg: Uint8Array, separatorArg: number): Uint8Array[] {
+  const parts: Uint8Array[] = [];
+  let start = 0;
+  for (let i = bytesArg.indexOf(separatorArg); i >= 0; i = bytesArg.indexOf(separatorArg, start)) {
+    parts.push(bytesArg.subarray(start, i));
+    start = i + 1;
+  }
+  parts.push(bytesArg.subarray(start));
+  return parts;
+}

package/ts/rpm/repoconfig.ts

@@ -0,0 +1,45 @@
+import { LinuxRepoError } from '../shared/errors.js';
+import { hasControlCharacter } from '../shared/validation.js';
+
+/**
+ * The `.repo` text for dnf. Without `repoGpgcheck` it is exactly Gitea
+ * 28.2.0's text (`routers/api/packages/rpm/rpm.go:46-51`): `[id]`, `name=`,
+ * `baseurl=`, `enabled=1`, `gpgcheck=`, `gpgkey=`, with no trailing line
+ * break. `repoGpgcheck` adds a `repo_gpgcheck=` line after `gpgcheck=`.
+ * Values with a line break or another control character are `invalid-input`.
+ */
+export function renderRpmRepoConfig(input: {
+  id: string;
+  name: string;
+  baseUrl: string;
+  keyUrl: string;
+  gpgcheck: boolean;
+  repoGpgcheck?: boolean;
+}): string {
+  if (input === null || typeof input !== 'object') {
+    throw new LinuxRepoError('invalid-input', 'input must be an object', { field: 'input' });
+  }
+  for (const key of ['id', 'name', 'baseUrl', 'keyUrl'] as const) {
+    const value: unknown = input[key];
+    if (typeof value !== 'string' || hasControlCharacter(value) || (key === 'id' && (value === '' || /[\[\]]/.test(value)))) {
+      throw new LinuxRepoError('invalid-input', `${key} must be a single-line string${key === 'id' ? ' without brackets' : ''}`, {
+        field: key,
+      });
+    }
+  }
+  if (typeof input.gpgcheck !== 'boolean' || (input.repoGpgcheck !== undefined && typeof input.repoGpgcheck !== 'boolean')) {
+    throw new LinuxRepoError('invalid-input', 'gpgcheck and repoGpgcheck must be booleans', { field: 'gpgcheck' });
+  }
+  const lines = [
+    `[${input.id}]`,
+    `name=${input.name}`,
+    `baseurl=${input.baseUrl}`,
+    'enabled=1',
+    `gpgcheck=${input.gpgcheck ? 1 : 0}`,
+  ];
+  if (input.repoGpgcheck !== undefined) {
+    lines.push(`repo_gpgcheck=${input.repoGpgcheck ? 1 : 0}`);
+  }
+  lines.push(`gpgkey=${input.keyUrl}`);
+  return lines.join('\n');
+}

package/ts/rpm/repodata.ts

@@ -0,0 +1,219 @@
+import type { IRpmDependency, IRpmFile, IRpmPackageRecord } from '../shared/types.js';
+import { element, textElement, XML_HEADER } from './xml.js';
+
+/**
+ * The repodata documents Gitea 28.2.0 builds (`services/packages/rpm/repository.go`),
+ * written the way Go's `encoding/xml` writes Gitea's structs, with two
+ * corrections:
+ * - `filelists.xml` uses the namespace `http://linux.duke.edu/metadata/filelists`
+ *   (Gitea writes `…/other`, `repository.go:494`);
+ * - `primary.xml` lists a file when it is executable (Gitea's rule,
+ *   `repository.go:386-391`) or matches createrepo_c's `cr_is_primary`, once,
+ *   in header order.
+ * And one more change: every document lists a source RPM's
+ * architecture as `src` (`rpmListedArchitecture`), where Gitea writes its ARCH
+ * tag (`repository.go:395`, `:483`, `:530`). One solvable keeps one identity
+ * across primary, filelists and other, so dnf never chooses a source RPM for
+ * installation and still finds its files and changelog. The location href
+ * keeps Gitea's path with the ARCH tag (`rpmPackageLocation`).
+ * Entries arrive sorted; each `<package>` renders from its record alone.
+ */
+
+/**
+ * createrepo_c 1.2.6 `cr_is_primary` (`src/misc.h:111-119`): paths under
+ * `/etc/`, exactly `/usr/lib/sendmail`, or containing `bin/` anywhere. It is
+ * applied to every file entry, directories and ghosts included
+ * (`src/xml_dump.c:206`).
+ */
+export function isPrimaryPath(pathArg: string): boolean {
+  return pathArg.startsWith('/etc/') || pathArg === '/usr/lib/sendmail' || pathArg.includes('bin/');
+}
+
+/** The architecture every document lists: `src` for a source RPM, else the ARCH tag. */
+export function rpmListedArchitecture(recordArg: IRpmPackageRecord): string {
+  return recordArg.metadata.isSourcePackage ? 'src' : recordArg.architecture;
+}
+
+/** Gitea's package location below the repository root (`repository.go:420`), with the ARCH tag. */
+export function rpmPackageLocation(recordArg: IRpmPackageRecord): string {
+  const { name, version, architecture } = recordArg;
+  return `package/${name}/${version}/${architecture}/${name}-${version}.${architecture}.rpm`;
+}
+
+export function renderPrimary(entriesArg: IRpmPackageRecord[]): string {
+  return document(
+    'metadata',
+    [
+      ['xmlns', 'http://linux.duke.edu/metadata/common'],
+      ['xmlns:rpm', 'http://linux.duke.edu/metadata/rpm'],
+      ['packages', entriesArg.length],
+    ],
+    entriesArg.map(renderPrimaryPackage),
+  );
+}
+
+export function renderFilelists(entriesArg: IRpmPackageRecord[]): string {
+  return document(
+    'filelists',
+    [
+      ['xmlns', 'http://linux.duke.edu/metadata/filelists'],
+      ['packages', entriesArg.length],
+    ],
+    entriesArg.map((record) =>
+      element('package', packageIdentity(record), versionElement(record) + record.metadata.files.map(fileElement).join('')),
+    ),
+  );
+}
+
+export function renderOther(entriesArg: IRpmPackageRecord[]): string {
+  return document(
+    'otherdata',
+    [
+      ['xmlns', 'http://linux.duke.edu/metadata/other'],
+      ['packages', entriesArg.length],
+    ],
+    entriesArg.map((record) =>
+      element(
+        'package',
+        packageIdentity(record),
+        versionElement(record) +
+          record.metadata.changelogs
+            .map((changelog) =>
+              textElement('changelog', changelog.text, [
+                ['author', changelog.author],
+                ['date', changelog.date],
+              ]),
+            )
+            .join(''),
+      ),
+    ),
+  );
+}
+
+/** One `repomd.xml` `<data>` record. */
+export interface IRepomdData {
+  type: string;
+  checksum: string;
+  openChecksum: string;
+  href: string;
+  timestamp: number;
+  size: number;
+  openSize: number;
+}
+
+/** `repomd.xml` (`repository.go:239-255`). */
+export function renderRepomd(dataArg: IRepomdData[]): string {
+  return document(
+    'repomd',
+    [
+      ['xmlns', 'http://linux.duke.edu/metadata/repo'],
+      ['xmlns:rpm', 'http://linux.duke.edu/metadata/rpm'],
+    ],
+    dataArg.map((data) =>
+      element(
+        'data',
+        [['type', data.type]],
+        [
+          textElement('checksum', data.checksum, [['type', 'sha256']]),
+          textElement('open-checksum', data.openChecksum, [['type', 'sha256']]),
+          element('location', [['href', data.href]]),
+          textElement('timestamp', String(data.timestamp)),
+          textElement('size', String(data.size)),
+          textElement('open-size', String(data.openSize)),
+        ].join(''),
+      ),
+    ),
+  );
+}
+
+function renderPrimaryPackage(recordArg: IRpmPackageRecord): string {
+  const metadata = recordArg.metadata;
+  const files = metadata.files.filter((file) => file.isExecutable || isPrimaryPath(file.path));
+  return element(
+    'package',
+    [['type', 'rpm']],
+    [
+      textElement('name', recordArg.name),
+      textElement('arch', rpmListedArchitecture(recordArg)),
+      versionElement(recordArg),
+      textElement('checksum', recordArg.digests.sha256, [
+        ['type', 'sha256'],
+        ['pkgid', 'YES'],
+      ]),
+      textElement('summary', metadata.summary),
+      textElement('description', metadata.description),
+      textElement('packager', metadata.packager),
+      textElement('url', metadata.projectUrl),
+      element('time', [
+        ['file', metadata.fileTime],
+        ['build', metadata.buildTime],
+      ]),
+      element('size', [
+        ['package', recordArg.digests.size],
+        ['installed', metadata.installedSize],
+        ['archive', metadata.archiveSize],
+      ]),
+      element('location', [['href', rpmPackageLocation(recordArg)]]),
+      element(
+        'format',
+        [],
+        [
+          textElement('rpm:license', metadata.license),
+          textElement('rpm:vendor', metadata.vendor),
+          textElement('rpm:group', metadata.group),
+          textElement('rpm:buildhost', metadata.buildHost),
+          textElement('rpm:sourcerpm', metadata.sourceRpm),
+          dependencyList('rpm:provides', metadata.provides),
+          dependencyList('rpm:requires', metadata.requires),
+          dependencyList('rpm:conflicts', metadata.conflicts),
+          dependencyList('rpm:obsoletes', metadata.obsoletes),
+          files.map(fileElement).join(''),
+        ].join(''),
+      ),
+    ].join(''),
+  );
+}
+
+function document(nameArg: string, attributesArg: Array<[string, string | number]>, packagesArg: string[]): string {
+  return `${XML_HEADER}${element(nameArg, attributesArg, packagesArg.join(''))}`;
+}
+
+function packageIdentity(recordArg: IRpmPackageRecord): Array<[string, string]> {
+  return [
+    ['pkgid', recordArg.digests.sha256],
+    ['name', recordArg.name],
+    ['arch', rpmListedArchitecture(recordArg)],
+  ];
+}
+
+function versionElement(recordArg: IRpmPackageRecord): string {
+  return element('version', [
+    ['epoch', recordArg.metadata.epoch],
+    ['ver', recordArg.metadata.upstreamVersion],
+    ['rel', recordArg.metadata.release],
+  ]);
+}
+
+/** Gitea's `Entry` (metadata.go:81-87): `flags`, `ver`, `epoch` and `rel` are `omitempty`. */
+function dependencyList(nameArg: string, dependenciesArg: IRpmDependency[]): string {
+  return element(
+    nameArg,
+    [],
+    dependenciesArg
+      .map((dependency) =>
+        element('rpm:entry', [
+          ['name', dependency.name],
+          ['flags', dependency.flags || undefined],
+          ['ver', dependency.version || undefined],
+          ['epoch', dependency.epoch || undefined],
+          ['rel', dependency.release || undefined],
+        ]),
+      )
+      .join(''),
+  );
+}
+
+/** Gitea's `File` (metadata.go:89-93): `type` is `omitempty`. */
+function fileElement(fileArg: IRpmFile): string {
+  return textElement('file', fileArg.path, [['type', fileArg.type || undefined]]);
+}