bundle() does not check out requested version for non-default branch names

[mari0d]

Summary

zkg bundle --manifest silently produces a bundle containing the wrong working tree when a manifest entry specifies a non-default branch name. The bundle archives the default branch HEAD instead of the requested branch.

Root Cause

In zeekpkg/manager.py, the bundle() function calls git_clone() but never calls git_checkout() afterwards. The return value of git_clone() (a git.Repo object) is discarded. Every other code path in the manager (_info(), test(), _install()) correctly calls git_checkout() after cloning.

# manager.py — the clone result is discarded, no checkout follows
git_clone(git_url, clonepath, shallow=(not is_sha1(version)))

For non-default branch names, shallow=True is used, which fetches all remote refs (--no-single-branch), so the branch ref is present in the clone — but HEAD is never moved there. The bundle archives whatever the remote's default branch HEAD points to.

Affected version types

Version	Shallow	Working tree in bundle	Post-unbundle
Default branch	Yes	Correct (by accident)	Correct
Non-default branch	Yes	Wrong (default branch)	Correct*
SHA1	No	Wrong (default branch)	Correct*

* unbundle() calls _install() which calls git_checkout(), so the correct version is installed on the target system regardless. However the bundled working tree itself is wrong, which matters for any use case that reads the bundle archive directly rather than going through zkg unbundle.

Steps to reproduce

# Create a repo with a non-default branch
git init mypackage && cd mypackage
echo 'print "default";' > __load__.zeek && git add . && git commit -m init
git checkout -b feature && echo 'print "feature";' > __load__.zeek && git commit -am feature
git checkout main && echo 'print "main advanced";' > __load__.zeek && git commit -am advance

# Bundle pinned to the non-default branch
cat > manifest.ini <<EOF
[bundle]
/path/to/mypackage = feature
EOF
zkg bundle --force --manifest manifest.ini -- out.bundle

# Inspect the bundle working tree (not via zkg unbundle)
tar -xzf out.bundle mypackage/__load__.zeek
cat mypackage/__load__.zeek
# Prints "main advanced" — wrong, should print "feature"

Fix

Capture the return value of git_clone() and call git_checkout() when the version is a non-empty, non-SHA1 ref. git_checkout is already imported and git_clone already returns git.Repo.

A PR with the fix and a regression test is attached: #233

AI Disclosure

This issue was filed with assistance from Claude Code (Anthropic Claude Sonnet 4.6). The bug was identified and the reproduction case was developed with AI assistance. I reviewed and validated all content before submission.

[bbannier]

What is the actual problem? The internal structure of bundles is not part of a public API, and a workflow of zkg bundle/zkg unbundle seems to work. Promising anything about the internals of bundles could prevent changes we make to that format in the future and is probably something we would like to avoid. What is your use case which makes you care about the internals of bundles?

Please note that the Zeek project has an AI policy. We are not interested in conversing with bots.

[mari0d]

Will follow-up with you on Slack.