dotnet/efcore · error · ValueError

Invalid Debian version format: {version}

Error message

Invalid Debian version format: {version}

What it means

Raised by parse_debian_version as a ValueError when the regex `^(?:(\d+):)?([^-]+)(?:-(.+))$` fails to match the version string. The upstream group `[^-]+` requires at least one non-hyphen character, so this only fires for an empty version or one beginning with '-'. Invoked transitively via compare_debian_versions during dependency/index parsing.

Source

Thrown at eng/common/cross/install-debs.py:160

def parse_release_file(content, path):
    """Parses the Release file and returns sha256 checksum of the specified path."""

    # data looks like this:
    # <checksum>  <size>  <path>
    matches = re.findall(r'^ (\S*) +(\S*) +(\S*)$', content, re.MULTILINE)

    for entry in matches:
        # the file has both md5 and sha256 checksums, we want sha256 which has a length of 64
        if entry[2] == path and len(entry[0]) == 64:
            return entry[0]

    raise Exception(f"Could not find checksum for {path} in Release file.")

def parse_debian_version(version):
    """Parse a Debian package version into epoch, upstream version, and revision."""
    match = re.match(r'^(?:(\d+):)?([^-]+)(?:-(.+))?$', version)
    if not match:
        raise ValueError(f"Invalid Debian version format: {version}")
    epoch, upstream, revision = match.groups()
    return int(epoch) if epoch else 0, upstream, revision or ""

def compare_upstream_version(v1, v2):
    """Compare upstream or revision parts using Debian rules."""
    def tokenize(version):
        tokens = re.split(r'([0-9]+|[A-Za-z]+)', version)
        return [int(x) if x.isdigit() else x for x in tokens if x]

    tokens1 = tokenize(v1)
    tokens2 = tokenize(v2)

    for token1, token2 in zip(tokens1, tokens2):
        if type(token1) == type(token2):
            if token1 != token2:
                return (token1 > token2) - (token1 < token2)
        else:
            return -1 if isinstance(token1, str) else 1

View on GitHub (pinned to dbf9771522)

Solutions

  1. Inspect the Packages.gz content for the offending version: `gzip -dc Packages.gz | grep -B2 -A2 Version` and look for empty/garbled values.
  2. Filter or skip the malformed package out of the desired package list / index before parsing.
  3. If from a real distro index, report the bad package to the mirror/package maintainer - well-formed Debian versions always match.
  4. Wrap compare_debian_versions in try/except ValueError to quarantine bad entries rather than aborting the whole run.

Example fix

# before
epoch, upstream, revision = parse_debian_version(version)
# after (quarantine malformed versions instead of aborting)
try:
    epoch, upstream, revision = parse_debian_version(version)
except ValueError:
    print(f"Skipping package with malformed version: {version!r}")
    continue
Defensive patterns

Strategy: validation

Validate before calling

# Validate a Debian version string before parse_debian_version sees it
import re

_DEBIAN_VERSION_RE = re.compile(r'^(?:(\d+):)?([^-]+)(?:-(.+))$')

def is_valid_debian_version(v):
    return isinstance(v, str) and bool(_DEBIAN_VERSION_RE.match(v))

for name, info in packages_info.items():
    if not is_valid_debian_version(info.get('Version')):
        print(f"Dropping {name}: bad Version {info.get('Version')!r}"); packages_info.pop(name)

Type guard

def is_valid_debian_version(version):
    """True iff parse_debian_version(version) will not raise."""
    import re
    return isinstance(version, str) and bool(
        re.match(r'^(?:(\d+):)?([^-]+)(?:-(.+))?$', version))

Try / catch

# compare_debian_versions is called transitively; quarantine bad entries
try:
    newer = compare_debian_versions(version, existing_version) > 0
except ValueError as e:
    if "Invalid Debian version format" in str(e):
        print(f"Skipping malformed version pair: {version!r} vs {existing_version!r}")
        continue
    raise

Prevention

When it happens

Trigger: parse_debian_version(version) (or compare_debian_versions(v1, v2)) called with a malformed Version field - empty string, a string starting with '-', or a string consisting solely of hyphens. Reached when parse_package_index compares two package versions and one of them is malformed.

Common situations: Packages.gz with a corrupt/garbled Version field; a third-party or custom package using a non-conforming version; locale/encoding damage to the index; an empty Version field from a partially-written index entry.

Related errors

AI-assisted analysis of dotnet/efcore@dbf9771522 (2026-08-06). Data as JSON: /api/errors/b8e239f0856cb36c. Report an issue: GitHub.