fix: use semver-aware version comparison for GHCR tags

Lexicographic sorting was picking wrong tags (e.g. 2026.2.9 over
2026.2.23, or v-prefixed date tags over clean versions). Parse
versions with the semver crate, handling calver, v-prefix stripping,
two-component versions, and -rN release revisions.

Author: QaidVoid

Cargo.lock

@@ -39,6 +39,7 @@ rayon = "1.11"
 regex = "1"
 reqwest = { version = "0.13", default-features = false }
 rusqlite = { version = "0.38", features = ["bundled"] }
+semver = "1"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 saphyr = "0.0.6"

Cargo.toml

@@ -256,7 +256,9 @@ impl MongoDatabase {
     ) -> Result<i32> {
         let filter = doc! { "pkg_id": pkg_id, "host_triplet": host_triplet };
         let options = FindOneOptions::builder()
-            .projection(doc! { "base_version": 1, "remote_version": 1, "revision": 1, "recipe_hash": 1 })
+            .projection(
+                doc! { "base_version": 1, "remote_version": 1, "revision": 1, "recipe_hash": 1 },
+            )
             .build();
 
         let result = self

sbuild-cache/src/mongo.rs

@@ -6,7 +6,9 @@ use std::path::Path;
 
 use crate::error::{Error, Result};
 use crate::models::*;
-use crate::schema::{CREATE_SCHEMA, CREATE_VIEWS, MIGRATE_V1_TO_V2, MIGRATE_V2_TO_V3, SCHEMA_VERSION};
+use crate::schema::{
+    CREATE_SCHEMA, CREATE_VIEWS, MIGRATE_V1_TO_V2, MIGRATE_V2_TO_V3, SCHEMA_VERSION,
+};
 
 /// SQLite cache database
 pub struct CacheDatabase {

sbuild-cache/src/sqlite.rs

@@ -14,6 +14,7 @@ log.workspace = true
 regex.workspace = true
 reqwest = { workspace = true, features = ["json", "rustls"] }
 rusqlite.workspace = true
+semver.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 saphyr.workspace = true

sbuild-meta/Cargo.toml

@@ -3,6 +3,8 @@
 //! Provides functionality to interact with GitHub Container Registry
 //! for fetching manifests, tags, and package metadata.
 
+use std::cmp::Ordering;
+
 use reqwest::header::{HeaderMap, HeaderValue, ACCEPT, AUTHORIZATION};
 use serde::Deserialize;
 
@@ -86,12 +88,12 @@ impl RegistryClient {
             .collect()
     }
 
-    /// Get the latest tag for an architecture
+    /// Get the latest tag for an architecture using version-aware comparison
     pub fn get_latest_arch_tag<'a>(tags: &'a [String], arch: &str) -> Option<&'a String> {
         Self::filter_tags_by_arch(tags, arch)
             .into_iter()
             .filter(|t| !t.starts_with("latest"))
-            .max_by(|a, b| a.cmp(b)) // Version sort
+            .max_by(|a, b| version_compare_tags(a, b, arch))
     }
 
     /// Fetch manifest for a specific tag
@@ -163,6 +165,110 @@ impl Default for RegistryClient {
     }
 }
 
+/// Extract the version portion from a tag by stripping the `-{arch}` suffix.
+/// e.g. "v1.2.3-x86_64-linux" -> "v1.2.3", "2026.2.23-aarch64-linux" -> "2026.2.23"
+fn extract_version_from_tag<'a>(tag: &'a str, arch: &str) -> &'a str {
+    let arch_suffix = format!("-{}", arch);
+    tag.strip_suffix(&arch_suffix)
+        .or_else(|| {
+            // case-insensitive fallback
+            let lower = tag.to_lowercase();
+            let suffix_lower = arch_suffix.to_lowercase();
+            if lower.ends_with(&suffix_lower) {
+                Some(&tag[..tag.len() - arch_suffix.len()])
+            } else {
+                None
+            }
+        })
+        .unwrap_or(tag)
+}
+
+/// Parse a version string into a semver::Version, handling common non-semver formats.
+/// Strips leading 'v'/'V', handles calver (2026.2.23), release suffixes (-r1), etc.
+fn parse_version_lenient(version: &str) -> Option<semver::Version> {
+    let v = version
+        .strip_prefix('v')
+        .or(version.strip_prefix('V'))
+        .unwrap_or(version);
+
+    // Check for -rN release revision suffix first (e.g. "0.16.1-r2")
+    // These should sort HIGHER than the base version, but semver treats
+    // pre-release as LOWER, so we handle them specially.
+    let (base_str, revision) = extract_release_revision(v);
+
+    // Split on first '-' to separate version from extra info (dates, hashes, etc.)
+    let (numeric_base, extra) = match base_str.find('-') {
+        Some(idx) => (&base_str[..idx], Some(&base_str[idx + 1..])),
+        None => (base_str, None),
+    };
+
+    // Split base into numeric parts
+    let parts: Vec<u64> = numeric_base
+        .split('.')
+        .filter_map(|p| p.parse().ok())
+        .collect();
+
+    if parts.is_empty() {
+        return None;
+    }
+
+    let major = parts[0];
+    let minor = if parts.len() > 1 { parts[1] } else { 0 };
+    let mut patch = if parts.len() > 2 { parts[2] } else { 0 };
+
+    // Bump patch by revision so r2 > r1 > base
+    if let Some(rev) = revision {
+        patch += rev;
+    }
+
+    let mut ver = semver::Version::new(major, minor, patch);
+
+    // Any extra info (dates, hashes) goes into pre-release so it sorts LOWER
+    // than the clean version.
+    if let Some(extra_str) = extra {
+        let normalized: String = extra_str
+            .chars()
+            .map(|c| {
+                if c.is_alphanumeric() || c == '.' {
+                    c
+                } else {
+                    '.'
+                }
+            })
+            .collect();
+        if let Ok(pre) = semver::Prerelease::new(&normalized) {
+            ver.pre = pre;
+        }
+    }
+
+    Some(ver)
+}
+
+/// Extract a trailing -rN release revision from a version string.
+/// Returns (base_without_rN, Some(N)) or (original, None).
+fn extract_release_revision(v: &str) -> (&str, Option<u64>) {
+    if let Some(idx) = v.rfind("-r") {
+        let after = &v[idx + 2..];
+        if let Ok(rev) = after.parse::<u64>() {
+            return (&v[..idx], Some(rev));
+        }
+    }
+    (v, None)
+}
+
+/// Compare two tags by their version, using semver-aware sorting.
+fn version_compare_tags(a: &str, b: &str, arch: &str) -> Ordering {
+    let ver_a = extract_version_from_tag(a, arch);
+    let ver_b = extract_version_from_tag(b, arch);
+
+    match (parse_version_lenient(ver_a), parse_version_lenient(ver_b)) {
+        (Some(va), Some(vb)) => va.cmp(&vb),
+        (Some(_), None) => Ordering::Greater,
+        (None, Some(_)) => Ordering::Less,
+        (None, None) => a.cmp(b), // fallback to lexicographic
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -196,6 +302,68 @@ mod tests {
         assert_eq!(latest, Some(&"v1.1.0-x86_64-linux".to_string()));
     }
 
+    #[test]
+    fn test_get_latest_calver() {
+        let tags = vec![
+            "2026.1.8-x86_64-linux".to_string(),
+            "2026.1.12-x86_64-linux".to_string(),
+            "2026.2.9-x86_64-linux".to_string(),
+            "2026.2.17-x86_64-linux".to_string(),
+            "2026.2.23-x86_64-linux".to_string(),
+        ];
+
+        let latest = RegistryClient::get_latest_arch_tag(&tags, "x86_64-linux");
+        assert_eq!(latest, Some(&"2026.2.23-x86_64-linux".to_string()));
+    }
+
+    #[test]
+    fn test_get_latest_with_old_date_tags() {
+        let tags = vec![
+            "v0.16.1-2026-01-01_1767256526-x86_64-linux".to_string(),
+            "0.16.1-v0.16.1-2026-01-22_1769071133-x86_64-linux".to_string(),
+            "0.16.1-x86_64-linux".to_string(),
+            "0.16.1-r1-x86_64-linux".to_string(),
+            "0.16.1-r2-x86_64-linux".to_string(),
+        ];
+
+        let latest = RegistryClient::get_latest_arch_tag(&tags, "x86_64-linux");
+        assert_eq!(latest, Some(&"0.16.1-r2-x86_64-linux".to_string()));
+    }
+
+    #[test]
+    fn test_get_latest_release_revisions() {
+        let tags = vec![
+            "1.0.0-x86_64-linux".to_string(),
+            "1.0.0-r1-x86_64-linux".to_string(),
+            "1.0.0-r2-x86_64-linux".to_string(),
+        ];
+
+        let latest = RegistryClient::get_latest_arch_tag(&tags, "x86_64-linux");
+        assert_eq!(latest, Some(&"1.0.0-r2-x86_64-linux".to_string()));
+    }
+
+    #[test]
+    fn test_version_compare_v_prefix_vs_no_prefix() {
+        let tags = vec![
+            "v0.16.1-x86_64-linux".to_string(),
+            "0.16.2-x86_64-linux".to_string(),
+        ];
+
+        let latest = RegistryClient::get_latest_arch_tag(&tags, "x86_64-linux");
+        assert_eq!(latest, Some(&"0.16.2-x86_64-linux".to_string()));
+    }
+
+    #[test]
+    fn test_two_component_version() {
+        let tags = vec![
+            "1.5-x86_64-linux".to_string(),
+            "1.12-x86_64-linux".to_string(),
+        ];
+
+        let latest = RegistryClient::get_latest_arch_tag(&tags, "x86_64-linux");
+        assert_eq!(latest, Some(&"1.12-x86_64-linux".to_string()));
+    }
+
     #[test]
     fn test_download_url() {
         let url = RegistryClient::get_download_url(

sbuild-meta/src/registry.rs

@@ -393,28 +393,22 @@ async fn post_build_processing(
             };
 
             let (base_version, remote_version) = {
-                let version_content = std::fs::read_dir(outdir)
-                    .ok()
-                    .and_then(|entries| {
-                        entries
-                            .filter_map(|e| e.ok())
-                            .find(|e| {
-                                e.path()
-                                    .extension()
-                                    .map(|ext| ext == "version")
-                                    .unwrap_or(false)
-                            })
-                            .and_then(|e| std::fs::read_to_string(e.path()).ok())
-                    });
+                let version_content = std::fs::read_dir(outdir).ok().and_then(|entries| {
+                    entries
+                        .filter_map(|e| e.ok())
+                        .find(|e| {
+                            e.path()
+                                .extension()
+                                .map(|ext| ext == "version")
+                                .unwrap_or(false)
+                        })
+                        .and_then(|e| std::fs::read_to_string(e.path()).ok())
+                });
 
                 match version_content {
                     Some(content) => {
                         let lines: Vec<&str> = content.lines().collect();
-                        let base = lines
-                            .first()
-                            .unwrap_or(&"")
-                            .trim()
-                            .to_string();
+                        let base = lines.first().unwrap_or(&"").trim().to_string();
                         let base = if base.is_empty() {
                             "latest".to_string()
                         } else {
@@ -451,7 +445,13 @@ async fn post_build_processing(
                     if !uri.is_empty() {
                         match sbuild_cache::MongoDatabase::connect(&uri).await {
                             Ok(mongo_db) => mongo_db
-                                .get_revision(cache_pkg_id, &host, &base_version, remote_version.as_deref(), None)
+                                .get_revision(
+                                    cache_pkg_id,
+                                    &host,
+                                    &base_version,
+                                    remote_version.as_deref(),
+                                    None,
+                                )
                                 .await
                                 .ok(),
                             Err(e) => {
@@ -465,7 +465,13 @@ async fn post_build_processing(
                 } else if let Some(ref cache_path) = cli.cache {
                     match sbuild_cache::CacheDatabase::open(cache_path) {
                         Ok(cache_db) => cache_db
-                            .get_revision(cache_pkg_id, &host, &base_version, remote_version.as_deref(), None)
+                            .get_revision(
+                                cache_pkg_id,
+                                &host,
+                                &base_version,
+                                remote_version.as_deref(),
+                                None,
+                            )
                             .ok(),
                         Err(e) => {
                             warn!("Failed to open build cache: {}", e);