Fix concurrent publish operations causing missing package files

Makefile

@@ -107,7 +107,7 @@ test: prepare swagger etcd-install  ## Run unit tests (add TEST=regex to specify
 	@echo "\e[33m\e[1mStarting etcd ...\e[0m"
 	@mkdir -p /tmp/aptly-etcd-data; system/t13_etcd/start-etcd.sh > /tmp/aptly-etcd-data/etcd.log 2>&1 &
 	@echo "\e[33m\e[1mRunning go test ...\e[0m"
-	faketime "$(TEST_FAKETIME)" go test -v ./... -gocheck.v=true -check.f "$(TEST)" -coverprofile=unit.out; echo $$? > .unit-test.ret
+	faketime "$(TEST_FAKETIME)" go test -timeout 20m -v ./... -gocheck.v=true -check.f "$(TEST)" -coverprofile=unit.out; echo $$? > .unit-test.ret
 	@echo "\e[33m\e[1mStopping etcd ...\e[0m"
 	@pid=`cat /tmp/etcd.pid`; kill $$pid
 	@rm -f /tmp/aptly-etcd-data/etcd.log

api/publish.go

@@ -465,7 +465,18 @@ func apiPublishUpdateSwitch(c *gin.Context) {
 		published.MultiDist = *b.MultiDist
 	}
 
-	resources := []string{string(published.Key())}
+	// Lock the pool prefix and all published repos sharing it to prevent cleanup race conditions.
+	// Without prefix-level locking, concurrent publishes to different distributions under the
+	// same prefix can race during cleanup, causing one operation to delete the other's files.
+	poolLockKey := fmt.Sprintf("pool:%s:%s", storage, prefix)
+	resources := []string{poolLockKey, string(published.Key())}
+	poolSiblings := collection.ByStoragePrefix(storage, prefix)
+	for _, sibling := range poolSiblings {
+		if sibling.UUID != published.UUID {
+			resources = append(resources, string(sibling.Key()))
+		}
+	}
+
 	taskName := fmt.Sprintf("Update published %s repository %s/%s", published.SourceKind, published.StoragePrefix(), published.Distribution)
 	maybeRunTaskInBackground(c, taskName, resources, func(out aptly.Progress, _ *task.Detail) (*task.ProcessReturnValue, error) {
 		err = collection.LoadComplete(published, collectionFactory)
@@ -1024,7 +1035,18 @@ func apiPublishUpdate(c *gin.Context) {
 		published.MultiDist = *b.MultiDist
 	}
 
-	resources := []string{string(published.Key())}
+	// Lock the pool prefix and all published repos sharing it to prevent cleanup race conditions.
+	// Without prefix-level locking, concurrent publishes to different distributions under the
+	// same prefix can race during cleanup, causing one operation to delete the other's files.
+	poolLockKey := fmt.Sprintf("pool:%s:%s", storage, prefix)
+	resources := []string{poolLockKey, string(published.Key())}
+	poolSiblings := collection.ByStoragePrefix(storage, prefix)
+	for _, sibling := range poolSiblings {
+		if sibling.UUID != published.UUID {
+			resources = append(resources, string(sibling.Key()))
+		}
+	}
+
 	taskName := fmt.Sprintf("Update published %s repository %s/%s", published.SourceKind, published.StoragePrefix(), published.Distribution)
 	maybeRunTaskInBackground(c, taskName, resources, func(out aptly.Progress, _ *task.Detail) (*task.ProcessReturnValue, error) {
 		result, err := published.Update(collectionFactory, out)