fix: select APT Docker versions at literal component boundaries

[soulteary]

Problem

VERSION=24.0 can select Docker 28.4.0 on Ubuntu noble because the existing lookup searches an entire apt-cache madison row and matches 24.04 in the distribution suffix. It can also confuse 24.0.1 with 24.0.10, or 22.0 with 22.02.1, because the requested version is interpreted as an unbounded regular expression.

This change selects the first package whose version field begins with the requested literal Docker version at a component boundary. An unavailable pin follows the existing error path before package installation.

Changes

• Share one field-aware selection helper between Docker Engine and CLI APT lookups.
• Preserve package versions with any numeric epoch or no epoch, partial version pins, the leading v shorthand, historical -ce releases, and Debian ~ pre-release spelling. Docker - pre-release separators are normalized to ~ before literal matching.
• Preserve repository ordering instead of introducing new sorting or channel policy.
• Reject pins containing embedded newlines so grep cannot interpret later fragments as additional expressions.
• Keep version matching outside the privileged shell command, so the requested version is passed as data.
• Add 24 fixture-driven installer regression checks, including independent CLI false positives and errors for unavailable versions. Add a dedicated offline CI job for sh and bash, and document what the checks establish.

Validation

• Baseline c57bd823: the first fixture fails and records docker-ce=5:28.4.0-1~ubuntu.24.04~noble for VERSION=24.0. With this change the same fixture records docker-ce=5:24.0.9-1~ubuntu.24.04~noble.
• The original Anchor VERSION match on the Docker epoch to avoid distro-version hits docker/docker-install#571 matching expression was also exercised through the installer with conventional single-space madison rows: it fixes the distro-suffix example, but still selects 24.0.10 for VERSION=24.0.1. The new helper selects 24.0.1.
• All 24 checks pass under both sh and bash in an Ubuntu 24.04 container with networking disabled and a read-only repository mount. The installer executes its APT installation flow against package-list fixtures; platform detection is fixed, repository/configuration commands are intercepted, and the final package installation arguments are recorded instead of executed.
• The existing offline mirror-option regression suite passes in the same Ubuntu 24.04 environment.
• sh -n and bash -n pass for the installer and new regression script.
• ShellCheck 0.11.0 passes with the repository's existing exclusions; git diff --check passes.

These are offline selection checks. Live repository availability, package downloads, actual installation, and daemon startup have not been tested. --dry-run still does not resolve version pins and is not used as proof of selection. RPM selection and distribution/mirror support are outside this change; the existing behavior for a missing separate CLI package is retained.

Source and attribution

Inspired by docker/docker-install#571, by fudianchn (付典), and its original signed-off commit. This is a fresh implementation that extends the reported fix with literal matching, version-component boundaries, and installer-flow regressions. The commit carries Su Yang's DCO sign-off.

Submission

This PR targets soulteary/docker-install:main. A separate branch based on upstream master contains only this fix, without the fork's mirror changes. Open the upstream comparison for manual submission. No upstream PR has been created.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-05T12:17:41.777296Z	149f5e5	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.