From 76c6d132fbc8341bdf14537bba7f00b073eddbc1 Mon Sep 17 00:00:00 2001
From: nsfisis <nsfisis@gmail.com>
Date: Fri, 24 Jul 2026 20:23:12 +0900
Subject: fix(package): rewrite dist-reference SHA regex without look-around

Package::set_source_dist_references and LockTransaction's dist-url
mirroring both used {(?<=/|sha=)[a-f0-9]{40}(?=/|$)}i, but the regex
crate has no look-around support at all and panics compiling it. Per
docs/dev/regex-porting.md, rewrote the boundary assertions into
capturing groups and switched to Preg::replace_callback, which
re-emits the captured delimiters around the replaced reference.
---
 crates/shirabe/src/package/package.rs | 24 +++++++++++++++++++++---
 1 file changed, 21 insertions(+), 3 deletions(-)

(limited to 'crates/shirabe/src/package')

diff --git a/crates/shirabe/src/package/package.rs b/crates/shirabe/src/package/package.rs
index e0bee0e6..ea415b9c 100644
--- a/crates/shirabe/src/package/package.rs
+++ b/crates/shirabe/src/package/package.rs
@@ -424,9 +424,27 @@ impl Package {
             )
         {
             self.set_dist_reference(Some(reference.clone()));
-            self.set_dist_url(Some(Preg::replace(
-                php_regex!("{(?<=/|sha=)[a-f0-9]{40}(?=/|$)}i"),
-                &reference,
+            // Regex pattern compatibility:
+            // The `regex` crate has no look-around, so `(?<=/|sha=)[a-f0-9]{40}(?=/|$)` is
+            // rewritten to capture the boundary delimiters instead of asserting them, and the
+            // callback re-emits them around the replaced reference. Unlike the zero-width
+            // lookaround, the capturing version consumes its boundary delimiter, so two 40-hex
+            // SHAs sharing a single `/` between them would not both match; harmless here since a
+            // dist URL never carries more than one SHA reference.
+            self.set_dist_url(Some(Preg::replace_callback(
+                php_regex!("{(/|sha=)[a-f0-9]{40}(/|$)}i"),
+                |m: &indexmap::IndexMap<
+                    shirabe_external_packages::composer::pcre::CaptureKey,
+                    String,
+                >|
+                 -> String {
+                    let get = |i: usize| -> String {
+                        m.get(&shirabe_external_packages::composer::pcre::CaptureKey::ByIndex(i))
+                            .cloned()
+                            .unwrap_or_default()
+                    };
+                    format!("{}{}{}", get(1), reference, get(2))
+                },
                 &self.get_dist_url().unwrap_or_default(),
             )));
         } else if self.get_dist_reference().is_some() {
-- 
cgit v1.3.1