sysupdate: disallow partial updates on arch, add ignored to popout

port 1.5

core/internal/server/sysupdate/backend_pacman.go

@@ -50,11 +50,42 @@ func (b pacmanBackend) Upgrade(ctx context.Context, opts UpgradeOptions, onLine
 }
 
 func pacmanUpgradeArgv(opts UpgradeOptions) []string {
-	argv := []string{"pacman", "-Syu", "--noconfirm", "--needed"}
-	if len(opts.Ignored) > 0 {
-		argv = append(argv, "--ignore", strings.Join(opts.Ignored, ","))
+	return privilegedArgv(opts, "pacman", "-Syu", "--noconfirm", "--needed")
+}
+
+// Dont allow partial updates on arch, if they wanna break their system they can do it outside of DMS:
+// https://wiki.archlinux.org/title/System_maintenance#Partial_upgrades_are_unsupported
+// AUR packages are exempt — holding those cannot break the repo dependency graph.
+func dropPacmanRepoIgnores(ignored []string, pending []Package) []string {
+	if len(ignored) == 0 {
+		return ignored
+	}
+	repoPending := make(map[string]bool, len(pending))
+	for _, p := range pending {
+		if p.Repo == RepoSystem {
+			repoPending[p.Name] = true
+		}
+	}
+	out := make([]string, 0, len(ignored))
+	for _, name := range ignored {
+		if repoPending[name] {
+			continue
+		}
+		out = append(out, name)
+	}
+	return out
+}
+
+func isPacmanFamily(b Backend) bool {
+	if b == nil {
+		return false
+	}
+	switch b.ID() {
+	case "pacman", "paru", "yay":
+		return true
+	default:
+		return false
 	}
-	return privilegedArgv(opts, argv...)
 }
 
 type archHelperBackend struct {

core/internal/server/sysupdate/manager.go

@@ -345,6 +345,9 @@ func (m *Manager) runUpgrade(ctx context.Context, opts UpgradeOptions) {
 		opts.Targets = append([]Package(nil), m.state.Packages...)
 		m.mu.RUnlock()
 	}
+	if isPacmanFamily(m.selection.System) {
+		opts.Ignored = dropPacmanRepoIgnores(opts.Ignored, opts.Targets)
+	}
 	opts.Targets = dropIgnoredTargets(opts.Targets, opts.Ignored)
 
 	backends := upgradeBackends(m.selection, opts)

core/internal/server/sysupdate/upgrade_commands_test.go

@@ -50,9 +50,9 @@ func TestUpgradeCommandBuilders(t *testing.T) {
 			want: []string{"paru", "-Syu", "--noconfirm", "--needed", "--ignore", "linux,discord"},
 		},
 		{
-			name: "pacman with ignored packages",
+			name: "pacman never passes --ignore",
 			got:  pacmanUpgradeArgv(UpgradeOptions{Ignored: []string{"linux"}}),
-			want: []string{"pkexec", "pacman", "-Syu", "--noconfirm", "--needed", "--ignore", "linux"},
+			want: []string{"pkexec", "pacman", "-Syu", "--noconfirm", "--needed"},
 		},
 		{
 			name: "dnf with ignored packages",
@@ -106,6 +106,18 @@ func TestUpgradeCommandBuilders(t *testing.T) {
 	}
 }
 
+func TestDropPacmanRepoIgnoresKeepsAURHolds(t *testing.T) {
+	pending := []Package{
+		{Name: "linux", Repo: RepoSystem},
+		{Name: "librewolf", Repo: RepoAUR},
+	}
+	got := dropPacmanRepoIgnores([]string{"linux", "librewolf", "not-pending"}, pending)
+	want := []string{"librewolf", "not-pending"}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("ignored = %#v, want %#v", got, want)
+	}
+}
+
 func TestAptUpgradeArgvHoldsIgnored(t *testing.T) {
 	argv := aptUpgradeArgv("apt-get", UpgradeOptions{Ignored: []string{"linux-image-generic", "bad;name"}})
 	if len(argv) < 2 || argv[len(argv)-2] != "-c" {