filter deb kernel updates by major.minor series

hosts/models.py

@@ -15,6 +15,8 @@
 # You should have received a copy of the GNU General Public License
 # along with Patchman. If not, see <http://www.gnu.org/licenses/>
 
+import re
+
 from django.db import models
 from django.db.models import Q
 from django.urls import reverse
@@ -363,6 +365,21 @@ def get_running_kernel_flavour(self):
         'linux-tools-',
     ]
 
+    def get_deb_kernel_series(self, pkg_name):
+        """Extract kernel major.minor series from a DEB kernel package name.
+
+        e.g. 'linux-image-6.8.0-51-generic' → '6.8'
+             'linux-image-6.17.0-19-generic' → '6.17'
+             'linux-modules-extra-6.1.0-28-cloud-amd64' → '6.1'
+        Returns None if the series cannot be determined.
+        """
+        for prefix in self.deb_kernel_prefixes:
+            if pkg_name.startswith(prefix):
+                remainder = pkg_name[len(prefix):]
+                m = re.match(r'(\d+\.\d+)', remainder)
+                return m.group(1) if m else None
+        return None
+
     def find_kernel_updates(self, kernel_packages, repo_packages):
 
         update_ids = set()
@@ -561,6 +578,10 @@ def find_deb_kernel_updates(self, kernel_packages, repo_packages, hostrepos):
                 continue
             processed_prefixes.add(prefix)
 
+            # extract kernel series (e.g. '6.8') to avoid cross-track
+            # comparisons (GA 6.8 vs HWE 6.17 in the same repo)
+            installed_series = self.get_deb_kernel_series(pkg_name)
+
             # build endswith filter for flavoured kernels
             name_filter = Q(
                 name__name__startswith=prefix,
@@ -570,8 +591,13 @@ def find_deb_kernel_updates(self, kernel_packages, repo_packages, hostrepos):
                 name_filter &= Q(name__name__endswith=f'-{running_flavour}')
 
             # find repo highest for this prefix+flavour, respecting priority
+            # and kernel series (GA vs HWE)
             repo_highest = None
             for rp in repo_packages.filter(name_filter):
+                if installed_series is not None:
+                    rp_series = self.get_deb_kernel_series(rp.name.name)
+                    if rp_series != installed_series:
+                        continue
                 if priority is not None:
                     rp_best_repo = find_best_repo(rp, hostrepos)
                     if not rp_best_repo or rp_best_repo.priority < priority:

hosts/tests/test_models.py

@@ -574,6 +574,92 @@ def test_deb_running_kernel_flavour(self):
         host.kernel = '5.14.0-503.el9'
         self.assertIsNone(host.get_running_kernel_flavour())
 
+    def test_deb_kernel_series_extraction(self):
+        """Test get_deb_kernel_series helper."""
+        host = self._create_host('6.8.0-51-generic', [self.img_51])
+        self.assertEqual(
+            host.get_deb_kernel_series('linux-image-6.8.0-51-generic'), '6.8'
+        )
+        self.assertEqual(
+            host.get_deb_kernel_series('linux-image-6.17.0-19-generic'), '6.17'
+        )
+        self.assertEqual(
+            host.get_deb_kernel_series('linux-modules-extra-6.1.0-28-cloud-amd64'), '6.1'
+        )
+        self.assertEqual(
+            host.get_deb_kernel_series('linux-image-unsigned-6.8.0-51-generic'), '6.8'
+        )
+        self.assertIsNone(host.get_deb_kernel_series('not-a-kernel'))
+
+    def test_deb_hwe_not_offered_to_ga_host(self):
+        """HWE kernels (6.17) should not be offered as updates to GA (6.8) hosts.
+
+        Reproduces GitHub issue: both GA and HWE kernels in the same repo
+        (noble-updates), same priority. Without series filtering, 6.17 would
+        be incorrectly picked as an update for a 6.8 host.
+        """
+        # add HWE kernel packages to the same repo/mirror
+        hwe_img_name = PackageName.objects.create(
+            name='linux-image-6.17.0-19-generic'
+        )
+        hwe_img = Package.objects.create(
+            name=hwe_img_name, arch=self.pkg_arch, epoch='',
+            version='6.17.0-19.19~24.04.2', release='', packagetype='D'
+        )
+        self.mirror.packages.add(hwe_img)
+
+        host = self._create_host(
+            '6.8.0-51-generic',
+            [self.img_49, self.img_51],
+        )
+        repo_packages = Package.objects.filter(mirror=self.mirror)
+        kernel_packages = host.packages.filter(
+            name__name__startswith='linux-image-'
+        )
+
+        host.find_kernel_updates(kernel_packages, repo_packages)
+
+        # should get GA update (6.8.0-51 → 6.8.0-53), NOT HWE (6.17)
+        self.assertEqual(host.updates.count(), 1)
+        update = host.updates.first()
+        self.assertEqual(update.oldpackage, self.img_51)
+        self.assertEqual(update.newpackage, self.img_53)
+
+    def test_deb_hwe_host_gets_hwe_updates(self):
+        """HWE host (6.17) should get HWE updates, not GA."""
+        hwe_img_19_name = PackageName.objects.create(
+            name='linux-image-6.17.0-19-generic'
+        )
+        hwe_img_19 = Package.objects.create(
+            name=hwe_img_19_name, arch=self.pkg_arch, epoch='',
+            version='6.17.0-19.19~24.04.2', release='', packagetype='D'
+        )
+        hwe_img_21_name = PackageName.objects.create(
+            name='linux-image-6.17.0-21-generic'
+        )
+        hwe_img_21 = Package.objects.create(
+            name=hwe_img_21_name, arch=self.pkg_arch, epoch='',
+            version='6.17.0-21.21~24.04.2', release='', packagetype='D'
+        )
+        self.mirror.packages.add(hwe_img_19, hwe_img_21)
+
+        host = self._create_host(
+            '6.17.0-19-generic',
+            [hwe_img_19],
+        )
+        repo_packages = Package.objects.filter(mirror=self.mirror)
+        kernel_packages = host.packages.filter(
+            name__name__startswith='linux-image-'
+        )
+
+        host.find_kernel_updates(kernel_packages, repo_packages)
+
+        # should get HWE update only
+        self.assertEqual(host.updates.count(), 1)
+        update = host.updates.first()
+        self.assertEqual(update.oldpackage, hwe_img_19)
+        self.assertEqual(update.newpackage, hwe_img_21)
+
 
 @override_settings(
     CELERY_TASK_ALWAYS_EAGER=True,
@@ -791,8 +877,10 @@ def test_deb_backports_lower_priority_no_update(self):
 
         self.assertEqual(host.updates.count(), 0)
 
-    def test_deb_backports_equal_priority_shows_update(self):
-        """DEB: backports kernel with equal priority SHOULD be flagged."""
+    def test_deb_backports_equal_priority_no_update(self):
+        """DEB: backports kernel with equal priority but different series
+        should NOT be flagged — series filtering prevents cross-track updates.
+        """
         host = self._create_host(main_priority=500, bp_priority=500)
         repo_packages = Package.objects.filter(
             mirror__in=[self.main_mirror, self.bp_mirror]
@@ -803,10 +891,10 @@ def test_deb_backports_equal_priority_shows_update(self):
 
         host.find_kernel_updates(kernel_packages, repo_packages)
 
-        self.assertEqual(host.updates.count(), 1)
+        self.assertEqual(host.updates.count(), 0)
 
-    def test_deb_priority_zero_no_filtering(self):
-        """DEB: priority 0 (unset) means no filtering — backward compat."""
+    def test_deb_priority_zero_no_cross_series_update(self):
+        """DEB: priority 0 (unset) still respects series filtering."""
         host = self._create_host(main_priority=0, bp_priority=0)
         repo_packages = Package.objects.filter(
             mirror__in=[self.main_mirror, self.bp_mirror]
@@ -817,10 +905,10 @@ def test_deb_priority_zero_no_filtering(self):
 
         host.find_kernel_updates(kernel_packages, repo_packages)
 
-        self.assertEqual(host.updates.count(), 1)
+        self.assertEqual(host.updates.count(), 0)
 
-    def test_deb_host_repos_only_false_no_filtering(self):
-        """DEB: host_repos_only=False skips priority filtering entirely."""
+    def test_deb_host_repos_only_false_no_cross_series_update(self):
+        """DEB: host_repos_only=False still respects series filtering."""
         host = self._create_host(
             main_priority=500, bp_priority=100, host_repos_only=False,
         )
@@ -833,7 +921,7 @@ def test_deb_host_repos_only_false_no_filtering(self):
 
         host.find_kernel_updates(kernel_packages, repo_packages)
 
-        self.assertEqual(host.updates.count(), 1)
+        self.assertEqual(host.updates.count(), 0)
 
     def test_rpm_backports_lower_priority_no_update(self):
         """RPM: kernel from lower-priority repo should NOT be flagged."""