Release version 0.7.10

This commit adds the `pkgmgr_nix_store` volume mount (`/nix`) to all test
runners (unit, integration, container sanity checks, and E2E tests).

Previously only the Arch-based E2E container mounted a persistent `/nix`
store, causing all other distros (Debian, Ubuntu, Fedora, CentOS, etc.)
to download the entire Nix closure repeatedly during test runs.

Changes:
- Add `-v pkgmgr_nix_store:/nix` to:
  - scripts/test/test-container.sh
  - scripts/test/test-e2e.sh (remove Arch-only condition)
  - scripts/test/test-unit.sh
  - scripts/test/test-integration.sh
- Ensures all test containers reuse the same Nix store.

Benefits:
- Significantly faster test execution after the first run.
- Prevents redundant downloads from cache.nixos.org.
- Ensures consistent Nix environments across all test distros.

No functional changes to pkgmgr itself; only test infrastructure improved.

https://chatgpt.com/share/693890f5-2f54-800f-b47e-1925da85b434

CHANGELOG.md

@@ -1,3 +1,18 @@
+## [0.7.10] - 2025-12-09
+
+* Fixed test_install_pkgmgr_shallow.py
+
+
+## [0.7.9] - 2025-12-09
+
+* 'main' and 'master' are now both accepted as branches for branch close merge
+
+
+## [0.7.8] - 2025-12-09
+
+* Missing pyproject.toml doesn't lead to an error during release
+
+
 ## [0.7.7] - 2025-12-09
 
 * Added TEST_PATTERN parameter to execute dedicated tests

PKGBUILD

@@ -1,7 +1,7 @@
 # Maintainer: Kevin Veen-Birkenbach <info@veen.world>
 
 pkgname=package-manager
-pkgver=0.7.7
+pkgver=0.7.10
 pkgrel=1
 pkgdesc="Local-flake wrapper for Kevin's package-manager (Nix-based)."
 arch=('any')

debian/changelog

@@ -1,3 +1,21 @@
+package-manager (0.7.10-1) unstable; urgency=medium
+
+  * Fixed test_install_pkgmgr_shallow.py
+
+ -- Kevin Veen-Birkenbach <kevin@veen.world>  Tue, 09 Dec 2025 22:57:08 +0100
+
+package-manager (0.7.9-1) unstable; urgency=medium
+
+  * 'main' and 'master' are now both accepted as branches for branch close merge
+
+ -- Kevin Veen-Birkenbach <kevin@veen.world>  Tue, 09 Dec 2025 21:19:13 +0100
+
+package-manager (0.7.8-1) unstable; urgency=medium
+
+  * Missing pyproject.toml doesn't lead to an error during release
+
+ -- Kevin Veen-Birkenbach <kevin@veen.world>  Tue, 09 Dec 2025 21:03:24 +0100
+
 package-manager (0.7.7-1) unstable; urgency=medium
 
   * Added TEST_PATTERN parameter to execute dedicated tests

flake.nix

@@ -31,7 +31,7 @@
         rec {
           pkgmgr = pyPkgs.buildPythonApplication {
             pname   = "package-manager";
-            version = "0.7.7";
+            version = "0.7.10";
 
             # Use the git repo as source
             src = ./.;

package-manager.spec

@@ -1,5 +1,5 @@
 Name:           package-manager
-Version:        0.7.7
+Version:        0.7.10
 Release:        1%{?dist}
 Summary:        Wrapper that runs Kevin's package-manager via Nix flake
 
@@ -77,6 +77,15 @@ echo ">>> package-manager removed. Nix itself was not removed."
 /usr/lib/package-manager/
 
 %changelog
+* Tue Dec 09 2025 Kevin Veen-Birkenbach <kevin@veen.world> - 0.7.10-1
+- Fixed test_install_pkgmgr_shallow.py
+
+* Tue Dec 09 2025 Kevin Veen-Birkenbach <kevin@veen.world> - 0.7.9-1
+- 'main' and 'master' are now both accepted as branches for branch close merge
+
+* Tue Dec 09 2025 Kevin Veen-Birkenbach <kevin@veen.world> - 0.7.8-1
+- Missing pyproject.toml doesn't lead to an error during release
+
 * Tue Dec 09 2025 Kevin Veen-Birkenbach <kevin@veen.world> - 0.7.7-1
 - Added TEST_PATTERN parameter to execute dedicated tests
 

pkgmgr/actions/branch/__init__.py

@@ -1,4 +1,4 @@
-# pkgmgr/branch_commands.py
+# pkgmgr/actions/branch/__init__.py
 #!/usr/bin/env python3
 # -*- coding: utf-8 -*-
 
@@ -16,30 +16,43 @@ from typing import Optional
 from pkgmgr.core.git import run_git, GitError, get_current_branch
 
 
+# ---------------------------------------------------------------------------
+# Branch creation (open)
+# ---------------------------------------------------------------------------
+
 def open_branch(
     name: Optional[str],
     base_branch: str = "main",
+    fallback_base: str = "master",
     cwd: str = ".",
 ) -> None:
     """
-    Create and push a new feature branch on top of `base_branch`.
+    Create and push a new feature branch on top of a base branch.
+
+    The base branch is resolved by:
+        1. Trying 'base_branch' (default: 'main')
+        2. Falling back to 'fallback_base' (default: 'master')
 
     Steps:
-      1) git fetch origin
-      2) git checkout <base_branch>
-      3) git pull origin <base_branch>
-      4) git checkout -b <name>
-      5) git push -u origin <name>
+        1) git fetch origin
+        2) git checkout <resolved_base>
+        3) git pull origin <resolved_base>
+        4) git checkout -b <name>
+        5) git push -u origin <name>
 
-    If `name` is None or empty, the user is prompted on stdin.
+    If `name` is None or empty, the user is prompted to enter one.
     """
 
+    # Request name interactively if not provided
     if not name:
         name = input("Enter new branch name: ").strip()
 
     if not name:
         raise RuntimeError("Branch name must not be empty.")
 
+    # Resolve which base branch to use (main or master)
+    resolved_base = _resolve_base_branch(base_branch, fallback_base, cwd=cwd)
+
     # 1) Fetch from origin
     try:
         run_git(["fetch", "origin"], cwd=cwd)
@@ -50,18 +63,18 @@ def open_branch(
 
     # 2) Checkout base branch
     try:
-        run_git(["checkout", base_branch], cwd=cwd)
+        run_git(["checkout", resolved_base], cwd=cwd)
     except GitError as exc:
         raise RuntimeError(
-            f"Failed to checkout base branch {base_branch!r}: {exc}"
+            f"Failed to checkout base branch {resolved_base!r}: {exc}"
         ) from exc
 
-    # 3) Pull latest changes on base
+    # 3) Pull latest changes for base branch
     try:
-        run_git(["pull", "origin", base_branch], cwd=cwd)
+        run_git(["pull", "origin", resolved_base], cwd=cwd)
     except GitError as exc:
         raise RuntimeError(
-            f"Failed to pull latest changes for base branch {base_branch!r}: {exc}"
+            f"Failed to pull latest changes for base branch {resolved_base!r}: {exc}"
         ) from exc
 
     # 4) Create new branch
@@ -69,10 +82,10 @@ def open_branch(
         run_git(["checkout", "-b", name], cwd=cwd)
     except GitError as exc:
         raise RuntimeError(
-            f"Failed to create new branch {name!r} from base {base_branch!r}: {exc}"
+            f"Failed to create new branch {name!r} from base {resolved_base!r}: {exc}"
         ) from exc
 
-    # 5) Push and set upstream
+    # 5) Push new branch to origin
     try:
         run_git(["push", "-u", "origin", name], cwd=cwd)
     except GitError as exc:
@@ -81,15 +94,21 @@ def open_branch(
         ) from exc
 
 
+# ---------------------------------------------------------------------------
+# Base branch resolver (shared by open/close)
+# ---------------------------------------------------------------------------
+
 def _resolve_base_branch(
     preferred: str,
     fallback: str,
     cwd: str,
 ) -> str:
     """
-    Resolve the base branch to use for merging.
+    Resolve the base branch to use.
+
+    Try `preferred` first (default: main),
+    fall back to `fallback` (default: master).
 
-    Try `preferred` (default: main) first, then `fallback` (default: master).
     Raise RuntimeError if neither exists.
     """
     for candidate in (preferred, fallback):
@@ -104,6 +123,10 @@ def _resolve_base_branch(
     )
 
 
+# ---------------------------------------------------------------------------
+# Branch closing (merge + deletion)
+# ---------------------------------------------------------------------------
+
 def close_branch(
     name: Optional[str],
     base_branch: str = "main",
@@ -111,23 +134,22 @@ def close_branch(
     cwd: str = ".",
 ) -> None:
     """
-    Merge a feature branch into the main/master branch and optionally delete it.
+    Merge a feature branch into the base branch and delete it afterwards.
 
     Steps:
-      1) Determine branch name (argument or current branch)
-      2) Resolve base branch (prefers `base_branch`, falls back to `fallback_base`)
-      3) Ask for confirmation (y/N)
-      4) git fetch origin
-      5) git checkout <base>
-      6) git pull origin <base>
-      7) git merge --no-ff <name>
-      8) git push origin <base>
-      9) Delete branch locally and on origin
-
-    If the user does not confirm with 'y', the operation is aborted.
+        1) Determine the branch name (argument or current branch)
+        2) Resolve base branch (main/master)
+        3) Ask for confirmation
+        4) git fetch origin
+        5) git checkout <base>
+        6) git pull origin <base>
+        7) git merge --no-ff <name>
+        8) git push origin <base>
+        9) Delete branch locally
+       10) Delete branch on origin (best effort)
     """
 
-    # 1) Determine which branch to close
+    # 1) Determine which branch should be closed
     if not name:
         try:
             name = get_current_branch(cwd=cwd)
@@ -137,7 +159,7 @@ def close_branch(
     if not name:
         raise RuntimeError("Branch name must not be empty.")
 
-    # 2) Resolve base branch (main/master)
+    # 2) Resolve base branch
     target_base = _resolve_base_branch(base_branch, fallback_base, cwd=cwd)
 
     if name == target_base:
@@ -146,7 +168,7 @@ def close_branch(
             "Please specify a feature branch."
         )
 
-    # 3) Confirmation prompt
+    # 3) Ask user for confirmation
     prompt = (
         f"Merge branch '{name}' into '{target_base}' and delete it afterwards? "
         "(y/N): "
@@ -164,7 +186,7 @@ def close_branch(
             f"Failed to fetch from origin before closing branch {name!r}: {exc}"
         ) from exc
 
-    # 5) Checkout base branch
+    # 5) Checkout base
     try:
         run_git(["checkout", target_base], cwd=cwd)
     except GitError as exc:
@@ -172,7 +194,7 @@ def close_branch(
             f"Failed to checkout base branch {target_base!r}: {exc}"
         ) from exc
 
-    # 6) Pull latest base
+    # 6) Pull latest base state
     try:
         run_git(["pull", "origin", target_base], cwd=cwd)
     except GitError as exc:
@@ -180,7 +202,7 @@ def close_branch(
             f"Failed to pull latest changes for base branch {target_base!r}: {exc}"
         ) from exc
 
-    # 7) Merge feature branch into base
+    # 7) Merge the feature branch
     try:
         run_git(["merge", "--no-ff", name], cwd=cwd)
     except GitError as exc:
@@ -193,22 +215,21 @@ def close_branch(
         run_git(["push", "origin", target_base], cwd=cwd)
     except GitError as exc:
         raise RuntimeError(
-            f"Failed to push base branch {target_base!r} to origin after merge: {exc}"
+            f"Failed to push base branch {target_base!r} after merge: {exc}"
         ) from exc
 
-    # 9) Delete feature branch locally
+    # 9) Delete branch locally
     try:
         run_git(["branch", "-d", name], cwd=cwd)
     except GitError as exc:
         raise RuntimeError(
-            f"Failed to delete local branch {name!r} after merge: {exc}"
+            f"Failed to delete local branch {name!r}: {exc}"
         ) from exc
 
-    # 10) Delete feature branch on origin (best effort)
+    # 10) Delete branch on origin (best effort)
     try:
         run_git(["push", "origin", "--delete", name], cwd=cwd)
     except GitError as exc:
-        # Remote delete is nice-to-have; surface as RuntimeError for clarity.
         raise RuntimeError(
             f"Branch {name!r} was deleted locally, but remote deletion failed: {exc}"
         ) from exc

pkgmgr/actions/release/files.py

@@ -85,7 +85,6 @@ def _open_editor_for_changelog(initial_message: Optional[str] = None) -> str:
 # File update helpers (pyproject + extra packaging + changelog)
 # ---------------------------------------------------------------------------
 
-
 def update_pyproject_version(
     pyproject_path: str,
     new_version: str,
@@ -99,13 +98,25 @@ def update_pyproject_version(
         version = "X.Y.Z"
 
     and replaces the version part with the given new_version string.
+
+    If the file does not exist, it is skipped without failing the release.
     """
+    if not os.path.exists(pyproject_path):
+        print(
+            f"[INFO] pyproject.toml not found at: {pyproject_path}, "
+            "skipping version update."
+        )
+        return
+
     try:
         with open(pyproject_path, "r", encoding="utf-8") as f:
             content = f.read()
-    except FileNotFoundError:
-        print(f"[ERROR] pyproject.toml not found at: {pyproject_path}")
-        sys.exit(1)
+    except OSError as exc:
+        print(
+            f"[WARN] Could not read pyproject.toml at {pyproject_path}: {exc}. "
+            "Skipping version update."
+        )
+        return
 
     pattern = r'^(version\s*=\s*")([^"]+)(")'
     new_content, count = re.subn(

pkgmgr/actions/repository/install/installers/nix_flake.py

@@ -13,6 +13,13 @@ Behavior:
       * Then install the flake outputs (`pkgmgr`, `default`) via `nix profile install`.
   - Failure installing `pkgmgr` is treated as fatal.
   - Failure installing `default` is logged as an error/warning but does not abort.
+
+Special handling for dev shells / CI:
+  - If IN_NIX_SHELL is set (e.g. inside `nix develop`), the installer is
+    disabled. In that environment the flake outputs are already provided
+    by the dev shell and we must not touch the user profile.
+  - If PKGMGR_DISABLE_NIX_FLAKE_INSTALLER=1 is set, the installer is
+    globally disabled (useful for CI or debugging).
 """
 
 import os
@@ -36,14 +43,45 @@ class NixFlakeInstaller(BaseInstaller):
     FLAKE_FILE = "flake.nix"
     PROFILE_NAME = "package-manager"
 
+    def _in_nix_shell(self) -> bool:
+        """
+        Return True if we appear to be running inside a Nix dev shell.
+
+        Nix sets IN_NIX_SHELL in `nix develop` environments. In that case
+        the flake outputs are already available, and touching the user
+        profile (nix profile install/remove) is undesirable.
+        """
+        return bool(os.environ.get("IN_NIX_SHELL"))
+
     def supports(self, ctx: "RepoContext") -> bool:
         """
         Only support repositories that:
-          - Have a flake.nix
+          - Are NOT inside a Nix dev shell (IN_NIX_SHELL unset),
+          - Are NOT explicitly disabled via PKGMGR_DISABLE_NIX_FLAKE_INSTALLER=1,
+          - Have a flake.nix,
           - And have the `nix` command available.
         """
+        # 1) Skip when running inside a dev shell – flake is already active.
+        if self._in_nix_shell():
+            print(
+                "[INFO] IN_NIX_SHELL detected; skipping NixFlakeInstaller. "
+                "Flake outputs are provided by the development shell."
+            )
+            return False
+
+        # 2) Optional global kill-switch for CI or debugging.
+        if os.environ.get("PKGMGR_DISABLE_NIX_FLAKE_INSTALLER") == "1":
+            print(
+                "[INFO] PKGMGR_DISABLE_NIX_FLAKE_INSTALLER=1 – "
+                "NixFlakeInstaller is disabled."
+            )
+            return False
+
+        # 3) Nix must be available.
         if shutil.which("nix") is None:
             return False
+
+        # 4) flake.nix must exist in the repository.
         flake_path = os.path.join(ctx.repo_dir, self.FLAKE_FILE)
         return os.path.exists(flake_path)
 
@@ -76,6 +114,14 @@ class NixFlakeInstaller(BaseInstaller):
         Any failure installing `pkgmgr` is treated as fatal (SystemExit).
         A failure installing `default` is logged but does not abort.
         """
+        # Extra guard in case run() is called directly without supports().
+        if self._in_nix_shell():
+            print(
+                "[INFO] IN_NIX_SHELL detected in run(); "
+                "skipping Nix flake profile installation."
+            )
+            return
+
         # Reuse supports() to keep logic in one place
         if not self.supports(ctx):  # type: ignore[arg-type]
             return
@@ -91,7 +137,12 @@ class NixFlakeInstaller(BaseInstaller):
             try:
                 # For 'default' we don't want the process to exit on error
                 allow_failure = output == "default"
-                run_command(cmd, cwd=ctx.repo_dir, preview=ctx.preview, allow_failure=allow_failure)
+                run_command(
+                    cmd,
+                    cwd=ctx.repo_dir,
+                    preview=ctx.preview,
+                    allow_failure=allow_failure,
+                )
                 print(f"Nix flake output '{output}' successfully installed.")
             except SystemExit as e:
                 print(f"[Error] Failed to install Nix flake output '{output}': {e}")

pkgmgr/actions/repository/install/installers/os_packages/debian_control.py

@@ -17,7 +17,6 @@ apt/dpkg tooling are available.
 import glob
 import os
 import shutil
-
 from typing import List
 
 from pkgmgr.actions.repository.install.context import RepoContext
@@ -68,6 +67,32 @@ class DebianControlInstaller(BaseInstaller):
         pattern = os.path.join(parent, "*.deb")
         return sorted(glob.glob(pattern))
 
+    def _privileged_prefix(self) -> str | None:
+        """
+        Determine how to run privileged commands:
+
+          - If 'sudo' is available, return 'sudo '.
+          - If we are running as root (e.g. inside CI/container), return ''.
+          - Otherwise, return None, meaning we cannot safely elevate.
+
+        Callers are responsible for handling the None case (usually by
+        warning and skipping automatic installation).
+        """
+        sudo_path = shutil.which("sudo")
+
+        is_root = False
+        try:
+            is_root = os.geteuid() == 0
+        except AttributeError:  # pragma: no cover - non-POSIX platforms
+            # On non-POSIX systems, fall back to assuming "not root".
+            is_root = False
+
+        if sudo_path is not None:
+            return "sudo "
+        if is_root:
+            return ""
+        return None
+
     def _install_build_dependencies(self, ctx: RepoContext) -> None:
         """
         Install build dependencies using `apt-get build-dep ./`.
@@ -86,12 +111,25 @@ class DebianControlInstaller(BaseInstaller):
             )
             return
 
+        prefix = self._privileged_prefix()
+        if prefix is None:
+            print(
+                "[Warning] Neither 'sudo' is available nor running as root. "
+                "Skipping automatic build-dep installation for Debian. "
+                "Please install build dependencies from debian/control manually."
+            )
+            return
+
         # Update package lists first for reliable build-dep resolution.
-        run_command("sudo apt-get update", cwd=ctx.repo_dir, preview=ctx.preview)
+        run_command(
+            f"{prefix}apt-get update",
+            cwd=ctx.repo_dir,
+            preview=ctx.preview,
+        )
 
         # Install build dependencies based on debian/control in the current tree.
         # `apt-get build-dep ./` uses the source in the current directory.
-        builddep_cmd = "sudo apt-get build-dep -y ./"
+        builddep_cmd = f"{prefix}apt-get build-dep -y ./"
         run_command(builddep_cmd, cwd=ctx.repo_dir, preview=ctx.preview)
 
     def run(self, ctx: RepoContext) -> None:
@@ -101,7 +139,7 @@ class DebianControlInstaller(BaseInstaller):
         Steps:
           1. apt-get build-dep ./ (automatic build dependency installation)
           2. dpkg-buildpackage -b -us -uc
-          3. sudo dpkg -i ../*.deb
+          3. sudo dpkg -i ../*.deb   (or plain dpkg -i when running as root)
         """
         control_path = self._control_path(ctx)
         if not os.path.exists(control_path):
@@ -123,7 +161,17 @@ class DebianControlInstaller(BaseInstaller):
             )
             return
 
+        prefix = self._privileged_prefix()
+        if prefix is None:
+            print(
+                "[Warning] Neither 'sudo' is available nor running as root. "
+                "Skipping automatic .deb installation. "
+                "You can manually install the following files with dpkg -i:\n  "
+                + "\n  ".join(debs)
+            )
+            return
+
         # 4) Install .deb files
-        install_cmd = "sudo dpkg -i " + " ".join(os.path.basename(d) for d in debs)
+        install_cmd = prefix + "dpkg -i " + " ".join(os.path.basename(d) for d in debs)
         parent = os.path.dirname(ctx.repo_dir)
         run_command(install_cmd, cwd=parent, preview=ctx.preview)

pkgmgr/actions/repository/install/installers/os_packages/rpm_spec.py

@@ -7,8 +7,10 @@ Installer for RPM-based packages defined in *.spec files.
 This installer:
 
   1. Installs build dependencies via dnf/yum builddep (where available)
-  2. Uses rpmbuild to build RPMs from the provided .spec file
-  3. Installs the resulting RPMs via `rpm -i`
+  2. Prepares a source tarball in ~/rpmbuild/SOURCES based on the .spec
+  3. Uses rpmbuild to build RPMs from the provided .spec file
+  4. Installs the resulting RPMs via the system package manager (dnf/yum)
+     or rpm as a fallback.
 
 It targets RPM-based systems (Fedora / RHEL / CentOS / Rocky / Alma, etc.).
 """
@@ -16,8 +18,8 @@ It targets RPM-based systems (Fedora / RHEL / CentOS / Rocky / Alma, etc.).
 import glob
 import os
 import shutil
-
-from typing import List, Optional
+import tarfile
+from typing import List, Optional, Tuple
 
 from pkgmgr.actions.repository.install.context import RepoContext
 from pkgmgr.actions.repository.install.installers.base import BaseInstaller
@@ -59,6 +61,117 @@ class RpmSpecInstaller(BaseInstaller):
             return None
         return matches[0]
 
+    # ------------------------------------------------------------------
+    # Helpers for preparing rpmbuild topdir and source tarball
+    # ------------------------------------------------------------------
+    def _rpmbuild_topdir(self) -> str:
+        """
+        Return the rpmbuild topdir that rpmbuild will use by default.
+
+        By default this is:  ~/rpmbuild
+
+        In the self-install tests, $HOME is set to /tmp/pkgmgr-self-install,
+        so this becomes /tmp/pkgmgr-self-install/rpmbuild which matches the
+        paths in the RPM build logs.
+        """
+        home = os.path.expanduser("~")
+        return os.path.join(home, "rpmbuild")
+
+    def _ensure_rpmbuild_tree(self, topdir: str) -> None:
+        """
+        Ensure the standard rpmbuild directory tree exists:
+
+          <topdir>/
+            BUILD/
+            BUILDROOT/
+            RPMS/
+            SOURCES/
+            SPECS/
+            SRPMS/
+        """
+        for sub in ("BUILD", "BUILDROOT", "RPMS", "SOURCES", "SPECS", "SRPMS"):
+            os.makedirs(os.path.join(topdir, sub), exist_ok=True)
+
+    def _parse_name_version(self, spec_path: str) -> Optional[Tuple[str, str]]:
+        """
+        Parse Name and Version from the given .spec file.
+
+        Returns (name, version) or None if either cannot be determined.
+        """
+        name = None
+        version = None
+
+        with open(spec_path, "r", encoding="utf-8") as f:
+            for raw_line in f:
+                line = raw_line.strip()
+                # Ignore comments
+                if not line or line.startswith("#"):
+                    continue
+
+                lower = line.lower()
+                if lower.startswith("name:"):
+                    # e.g. "Name: package-manager"
+                    parts = line.split(":", 1)
+                    if len(parts) == 2:
+                        name = parts[1].strip()
+                elif lower.startswith("version:"):
+                    # e.g. "Version: 0.7.7"
+                    parts = line.split(":", 1)
+                    if len(parts) == 2:
+                        version = parts[1].strip()
+
+                if name and version:
+                    break
+
+        if not name or not version:
+            print(
+                "[Warning] Could not determine Name/Version from spec file "
+                f"'{spec_path}'. Skipping RPM source tarball preparation."
+            )
+            return None
+
+        return name, version
+
+    def _prepare_source_tarball(self, ctx: RepoContext, spec_path: str) -> None:
+        """
+        Prepare a source tarball in <HOME>/rpmbuild/SOURCES that matches
+        the Name/Version in the .spec file.
+        """
+        parsed = self._parse_name_version(spec_path)
+        if parsed is None:
+            return
+
+        name, version = parsed
+        topdir = self._rpmbuild_topdir()
+        self._ensure_rpmbuild_tree(topdir)
+
+        build_dir = os.path.join(topdir, "BUILD")
+        sources_dir = os.path.join(topdir, "SOURCES")
+
+        source_root = os.path.join(build_dir, f"{name}-{version}")
+        tarball_path = os.path.join(sources_dir, f"{name}-{version}.tar.gz")
+
+        # Clean any previous build directory for this name/version.
+        if os.path.exists(source_root):
+            shutil.rmtree(source_root)
+
+        # Copy the repository tree into BUILD/<name>-<version>.
+        shutil.copytree(ctx.repo_dir, source_root)
+
+        # Create the tarball with the top-level directory <name>-<version>.
+        if os.path.exists(tarball_path):
+            os.remove(tarball_path)
+
+        with tarfile.open(tarball_path, "w:gz") as tar:
+            tar.add(source_root, arcname=f"{name}-{version}")
+
+        print(
+            f"[INFO] Prepared RPM source tarball at '{tarball_path}' "
+            f"from '{ctx.repo_dir}'."
+        )
+
+    # ------------------------------------------------------------------
+
     def supports(self, ctx: RepoContext) -> bool:
         """
         This installer is supported if:
@@ -77,26 +190,13 @@ class RpmSpecInstaller(BaseInstaller):
         By default, rpmbuild outputs RPMs into:
           ~/rpmbuild/RPMS/*/*.rpm
         """
-        home = os.path.expanduser("~")
-        pattern = os.path.join(home, "rpmbuild", "RPMS", "**", "*.rpm")
+        topdir = self._rpmbuild_topdir()
+        pattern = os.path.join(topdir, "RPMS", "**", "*.rpm")
         return sorted(glob.glob(pattern, recursive=True))
 
     def _install_build_dependencies(self, ctx: RepoContext, spec_path: str) -> None:
         """
         Install build dependencies for the given .spec file.
-
-        Strategy (best-effort):
-
-          1. If dnf is available:
-               sudo dnf builddep -y <spec>
-          2. Else if yum-builddep is available:
-               sudo yum-builddep -y <spec>
-          3. Else if yum is available:
-               sudo yum-builddep -y <spec>   # Some systems provide it via yum plugin
-          4. Otherwise: print a warning and skip automatic builddep install.
-
-        Any failure in builddep installation is treated as fatal (SystemExit),
-        consistent with other installer steps.
         """
         spec_basename = os.path.basename(spec_path)
 
@@ -105,7 +205,6 @@ class RpmSpecInstaller(BaseInstaller):
         elif shutil.which("yum-builddep") is not None:
             cmd = f"sudo yum-builddep -y {spec_basename}"
         elif shutil.which("yum") is not None:
-            # Some distributions ship yum-builddep as a plugin.
             cmd = f"sudo yum-builddep -y {spec_basename}"
         else:
             print(
@@ -114,33 +213,17 @@ class RpmSpecInstaller(BaseInstaller):
             )
             return
 
-        # Run builddep in the repository directory so relative spec paths work.
         run_command(cmd, cwd=ctx.repo_dir, preview=ctx.preview)
 
-    def run(self, ctx: RepoContext) -> None:
+    def _install_built_rpms(self, ctx: RepoContext, rpms: List[str]) -> None:
         """
-        Build and install RPM-based packages.
+        Install or upgrade the built RPMs.
 
-        Steps:
-          1. dnf/yum builddep <spec> (automatic build dependency installation)
-          2. rpmbuild -ba path/to/spec
-          3. sudo rpm -i ~/rpmbuild/RPMS/*/*.rpm
+        Strategy:
+          - Prefer dnf install -y <rpms> (handles upgrades cleanly)
+          - Else yum install -y <rpms>
+          - Else fallback to rpm -Uvh <rpms> (upgrade/replace existing)
         """
-        spec_path = self._spec_path(ctx)
-        if not spec_path:
-            return
-
-        # 1) Install build dependencies
-        self._install_build_dependencies(ctx, spec_path)
-
-        # 2) Build RPMs
-        # Use the full spec path, but run in the repo directory.
-        spec_basename = os.path.basename(spec_path)
-        build_cmd = f"rpmbuild -ba {spec_basename}"
-        run_command(build_cmd, cwd=ctx.repo_dir, preview=ctx.preview)
-
-        # 3) Find built RPMs
-        rpms = self._find_built_rpms()
         if not rpms:
             print(
                 "[Warning] No RPM files found after rpmbuild. "
@@ -148,13 +231,52 @@ class RpmSpecInstaller(BaseInstaller):
             )
             return
 
-        # 4) Install RPMs
-        if shutil.which("rpm") is None:
+        dnf = shutil.which("dnf")
+        yum = shutil.which("yum")
+        rpm = shutil.which("rpm")
+
+        if dnf is not None:
+            install_cmd = "sudo dnf install -y " + " ".join(rpms)
+        elif yum is not None:
+            install_cmd = "sudo yum install -y " + " ".join(rpms)
+        elif rpm is not None:
+            # Fallback: use rpm in upgrade mode so an existing older
+            # version is replaced instead of causing file conflicts.
+            install_cmd = "sudo rpm -Uvh " + " ".join(rpms)
+        else:
             print(
-                "[Warning] rpm binary not found on PATH. "
+                "[Warning] No suitable RPM installer (dnf/yum/rpm) found. "
                 "Cannot install built RPMs."
             )
             return
 
-        install_cmd = "sudo rpm -i " + " ".join(rpms)
         run_command(install_cmd, cwd=ctx.repo_dir, preview=ctx.preview)
+
+    def run(self, ctx: RepoContext) -> None:
+        """
+        Build and install RPM-based packages.
+
+        Steps:
+          1. Prepare source tarball in ~/rpmbuild/SOURCES matching Name/Version
+          2. dnf/yum builddep <spec> (automatic build dependency installation)
+          3. rpmbuild -ba path/to/spec
+          4. Install built RPMs via dnf/yum (or rpm as fallback)
+        """
+        spec_path = self._spec_path(ctx)
+        if not spec_path:
+            return
+
+        # 1) Prepare source tarball so rpmbuild finds Source0 in SOURCES.
+        self._prepare_source_tarball(ctx, spec_path)
+
+        # 2) Install build dependencies
+        self._install_build_dependencies(ctx, spec_path)
+
+        # 3) Build RPMs
+        spec_basename = os.path.basename(spec_path)
+        build_cmd = f"rpmbuild -ba {spec_basename}"
+        run_command(build_cmd, cwd=ctx.repo_dir, preview=ctx.preview)
+
+        # 4) Find and install built RPMs
+        rpms = self._find_built_rpms()
+        self._install_built_rpms(ctx, rpms)

pkgmgr/actions/repository/install/installers/python.py

@@ -11,15 +11,28 @@ Strategy:
       3. "pip" from PATH as last resort
   - If pyproject.toml exists: pip install .
 
-All installation failures are treated as fatal errors (SystemExit).
+All installation failures are treated as fatal errors (SystemExit),
+except when we explicitly skip the installer:
+
+  - If IN_NIX_SHELL is set, we assume Python is managed by Nix and
+    skip this installer entirely.
+  - If PKGMGR_DISABLE_PYTHON_INSTALLER=1 is set, the installer is
+    globally disabled (useful for CI or debugging).
 """
 
+from __future__ import annotations
+
 import os
 import sys
+from typing import TYPE_CHECKING
 
 from pkgmgr.actions.repository.install.installers.base import BaseInstaller
 from pkgmgr.core.command.run import run_command
 
+if TYPE_CHECKING:
+    from pkgmgr.actions.repository.install.context import RepoContext
+    from pkgmgr.actions.repository.install import InstallContext
+
 
 class PythonInstaller(BaseInstaller):
     """Install Python projects and dependencies via pip."""
@@ -27,19 +40,54 @@ class PythonInstaller(BaseInstaller):
     # Logical layer name, used by capability matchers.
     layer = "python"
 
-    def supports(self, ctx) -> bool:
+    def _in_nix_shell(self) -> bool:
+        """
+        Return True if we appear to be running inside a Nix dev shell.
+
+        Nix sets IN_NIX_SHELL in `nix develop` environments. In that case
+        the Python environment is already provided by Nix, so we must not
+        attempt an additional pip-based installation.
+        """
+        return bool(os.environ.get("IN_NIX_SHELL"))
+
+    def supports(self, ctx: "RepoContext") -> bool:
         """
         Return True if this installer should handle the given repository.
 
         Only pyproject.toml is supported as the single source of truth
         for Python dependencies and packaging metadata.
+
+        The installer is *disabled* when:
+          - IN_NIX_SHELL is set (Python managed by Nix dev shell), or
+          - PKGMGR_DISABLE_PYTHON_INSTALLER=1 is set.
         """
+        # 1) Skip in Nix dev shells – Python is managed by the flake/devShell.
+        if self._in_nix_shell():
+            print(
+                "[INFO] IN_NIX_SHELL detected; skipping PythonInstaller. "
+                "Python runtime is provided by the Nix dev shell."
+            )
+            return False
+
+        # 2) Optional global kill-switch.
+        if os.environ.get("PKGMGR_DISABLE_PYTHON_INSTALLER") == "1":
+            print(
+                "[INFO] PKGMGR_DISABLE_PYTHON_INSTALLER=1 – "
+                "PythonInstaller is disabled."
+            )
+            return False
+
         repo_dir = ctx.repo_dir
         return os.path.exists(os.path.join(repo_dir, "pyproject.toml"))
 
     def _pip_cmd(self) -> str:
         """
         Resolve the pip command to use.
+
+        Order:
+          1) PKGMGR_PIP (explicit override)
+          2) sys.executable -m pip
+          3) plain "pip"
         """
         explicit = os.environ.get("PKGMGR_PIP", "").strip()
         if explicit:
@@ -50,12 +98,23 @@ class PythonInstaller(BaseInstaller):
 
         return "pip"
 
-    def run(self, ctx) -> None:
+    def run(self, ctx: "InstallContext") -> None:
         """
         Install Python project defined via pyproject.toml.
 
         Any pip failure is propagated as SystemExit.
         """
+        # Extra guard in case run() is called directly without supports().
+        if self._in_nix_shell():
+            print(
+                "[INFO] IN_NIX_SHELL detected in PythonInstaller.run(); "
+                "skipping pip-based installation."
+            )
+            return
+
+        if not self.supports(ctx):  # type: ignore[arg-type]
+            return
+
         pip_cmd = self._pip_cmd()
 
         pyproject = os.path.join(ctx.repo_dir, "pyproject.toml")

pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "package-manager"
-version = "0.7.7"
+version = "0.7.10"
 description = "Kevin's package-manager tool (pkgmgr)"
 readme = "README.md"
 requires-python = ">=3.11"

scripts/docker/entry.sh

@@ -2,28 +2,59 @@
 set -euo pipefail
 
 # ---------------------------------------------------------------------------
-# Ensure Nix has access to a valid CA bundle (TLS trust store)
+# Detect and export a valid CA bundle so Nix, Git, curl and Python tooling
+# can successfully perform HTTPS requests on all distros (Debian, Ubuntu,
+# Fedora, RHEL, CentOS, etc.)
 # ---------------------------------------------------------------------------
-if [[ -z "${NIX_SSL_CERT_FILE:-}" ]]; then
-  if [[ -f /etc/ssl/certs/ca-certificates.crt ]]; then
-    # Debian/Ubuntu-style path
-    export NIX_SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
-    echo "[docker] Using CA bundle: ${NIX_SSL_CERT_FILE}"
-  elif [[ -f /etc/pki/tls/certs/ca-bundle.crt ]]; then
-    # Fedora/RHEL/CentOS-style path
-    export NIX_SSL_CERT_FILE=/etc/pki/tls/certs/ca-bundle.crt
-    echo "[docker] Using CA bundle: ${NIX_SSL_CERT_FILE}"
-  else
-    echo "[docker] WARNING: No CA bundle found for Nix (NIX_SSL_CERT_FILE not set)."
-    echo "[docker] HTTPS access for Nix flakes may fail."
-  fi
+detect_ca_bundle() {
+  # Common CA bundle locations across major Linux distributions
+  local candidates=(
+    /etc/ssl/certs/ca-certificates.crt                       # Debian/Ubuntu
+    /etc/ssl/cert.pem                                       # Some distros
+    /etc/pki/tls/certs/ca-bundle.crt                        # Fedora/RHEL/CentOS
+    /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem       # CentOS/RHEL extracted bundle
+    /etc/ssl/ca-bundle.pem                                  # Generic fallback
+  )
+
+  for path in "${candidates[@]}"; do
+    if [[ -f "$path" ]]; then
+      echo "$path"
+      return 0
+    fi
+  done
+
+  return 1
+}
+
+# Use existing NIX_SSL_CERT_FILE if provided, otherwise auto-detect
+CA_BUNDLE="${NIX_SSL_CERT_FILE:-}"
+
+if [[ -z "${CA_BUNDLE}" ]]; then
+  CA_BUNDLE="$(detect_ca_bundle || true)"
+fi
+
+if [[ -n "${CA_BUNDLE}" ]]; then
+  # Export for Nix (critical)
+  export NIX_SSL_CERT_FILE="${CA_BUNDLE}"
+
+  # Export for Git, Python requests, curl, etc.
+  export SSL_CERT_FILE="${CA_BUNDLE}"
+  export REQUESTS_CA_BUNDLE="${CA_BUNDLE}"
+  export GIT_SSL_CAINFO="${CA_BUNDLE}"
+
+  echo "[docker] Using CA bundle: ${CA_BUNDLE}"
+else
+  echo "[docker] WARNING: No CA certificate bundle found."
+  echo "[docker] HTTPS access for Nix flakes and other tools may fail."
 fi
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 echo "[docker] Starting package-manager container"
 
-# Distro info for logging
+# ---------------------------------------------------------------------------
+# Log distribution info
+# ---------------------------------------------------------------------------
 if [[ -f /etc/os-release ]]; then
   # shellcheck disable=SC1091
   . /etc/os-release
@@ -34,9 +65,9 @@ fi
 echo "[docker] Using /src as working directory"
 cd /src
 
-# ------------------------------------------------------------
-# DEV mode: build/install package-manager from current /src
-# ------------------------------------------------------------
+# ---------------------------------------------------------------------------
+# DEV mode: rebuild package-manager from the mounted /src tree
+# ---------------------------------------------------------------------------
 if [[ "${PKGMGR_DEV:-0}" == "1" ]]; then
   echo "[docker] DEV mode enabled (PKGMGR_DEV=1)"
   echo "[docker] Rebuilding package-manager from /src via scripts/installation/run-package.sh..."
@@ -49,9 +80,9 @@ if [[ "${PKGMGR_DEV:-0}" == "1" ]]; then
   fi
 fi
 
-# ------------------------------------------------------------
-# Hand-off to pkgmgr / arbitrary command
-# ------------------------------------------------------------
+# ---------------------------------------------------------------------------
+# Hand off to pkgmgr or arbitrary command
+# ---------------------------------------------------------------------------
 if [[ $# -eq 0 ]]; then
   echo "[docker] No arguments provided. Showing pkgmgr help..."
   exec pkgmgr --help

scripts/installation/centos/dependencies.sh

@@ -13,6 +13,7 @@ dnf -y install \
   bash \
   curl-minimal \
   ca-certificates \
+  sudo \
   xz
 
 dnf clean all

scripts/test/test-container.sh

@@ -19,6 +19,7 @@ for distro in $DISTROS; do
     # Run the command and capture the output
     if OUTPUT=$(docker run --rm \
             -e PKGMGR_DEV=1 \
+            -v pkgmgr_nix_store:/nix \
             -v "$(pwd):/src" \
             -v "pkgmgr_nix_cache:/root/.cache/nix" \
             "$IMAGE" 2>&1); then

scripts/test/test-e2e.sh

@@ -8,14 +8,9 @@ for distro in $DISTROS; do
   echo ">>> Running E2E tests: $distro"
   echo "============================================================"
 
-  MOUNT_NIX=""
-  if [[ "$distro" == "arch" ]]; then
-    MOUNT_NIX="-v pkgmgr_nix_store:/nix"
-  fi
-
   docker run --rm \
     -v "$(pwd):/src" \
-    $MOUNT_NIX \
+    -v pkgmgr_nix_store:/nix \
     -v "pkgmgr_nix_cache:/root/.cache/nix" \
     -e PKGMGR_DEV=1 \
     -e TEST_PATTERN="${TEST_PATTERN}" \

scripts/test/test-integration.sh

@@ -7,6 +7,7 @@ echo "============================================================"
 
 docker run --rm \
   -v "$(pwd):/src" \
+  -v pkgmgr_nix_store:/nix \
   -v "pkgmgr_nix_cache:/root/.cache/nix" \
   --workdir /src \
   -e PKGMGR_DEV=1 \

scripts/test/test-unit.sh

@@ -8,6 +8,7 @@ echo "============================================================"
 docker run --rm \
   -v "$(pwd):/src" \
   -v "pkgmgr_nix_cache:/root/.cache/nix" \
+  -v pkgmgr_nix_store:/nix \
   --workdir /src \
   -e PKGMGR_DEV=1 \
   -e TEST_PATTERN="${TEST_PATTERN}" \

tests/e2e/test_install_pkgmgr_shallow.py

@@ -35,8 +35,8 @@ def remove_pkgmgr_from_nix_profile() -> None:
     prints a descriptive format without an index column inside the container.
 
     Instead, we directly try to remove possible names:
-      - 'pkgmgr'          (the actual name shown in `nix profile list`)
-      - 'package-manager' (the name mentioned in Nix's own error hints)
+      - 'pkgmgr'
+      - 'package-manager'
     """
     for spec in ("pkgmgr", "package-manager"):
         subprocess.run(
@@ -45,18 +45,34 @@ def remove_pkgmgr_from_nix_profile() -> None:
         )
 
 
+def configure_git_safe_directory() -> None:
+    """
+    Configure Git to treat /src as a safe directory.
+
+    Needed because /src is a bind-mounted repository in CI, often owned by a
+    different UID. Modern Git aborts with:
+      'fatal: detected dubious ownership in repository at /src/.git'
+
+    This fix applies ONLY inside this test container.
+    """
+    try:
+        subprocess.run(
+            ["git", "config", "--global", "--add", "safe.directory", "/src"],
+            check=False,
+        )
+    except FileNotFoundError:
+        print("[WARN] git not found – skipping safe.directory configuration")
+
+
 def pkgmgr_help_debug() -> None:
     """
     Run `pkgmgr --help` after installation *inside an interactive bash shell*,
     print its output and return code, but never fail the test.
 
-    Reason:
-      - The installer adds venv/alias setup into shell rc files (~/.bashrc, ~/.zshrc)
-      - Those changes are only applied in a new interactive shell session.
+    This ensures the installer’s shell RC changes are actually loaded.
     """
     print("\n--- PKGMGR HELP (after installation, via bash -i) ---")
 
-    # Simulate a fresh interactive bash, so ~/.bashrc gets sourced
     proc = subprocess.run(
         ["bash", "-i", "-c", "pkgmgr --help"],
         capture_output=True,
@@ -76,10 +92,6 @@ def pkgmgr_help_debug() -> None:
     print(f"returncode: {proc.returncode}")
     print("--- END ---\n")
 
-    # Important: this is **debug-only**. Do NOT fail the test here.
-    # If you ever want to hard-assert on this, you can add an explicit
-    # assertion in the test method instead of here.
-
 
 class TestIntegrationInstalPKGMGRShallow(unittest.TestCase):
     def test_install_pkgmgr_self_install(self) -> None:
@@ -87,12 +99,8 @@ class TestIntegrationInstalPKGMGRShallow(unittest.TestCase):
         End-to-end test that runs "python main.py install pkgmgr ..." inside
         the test container.
 
-        We isolate HOME into /tmp/pkgmgr-self-install so that:
-          - ~/.config/pkgmgr points to an isolated test config area
-          - ~/Repositories is owned by the current user inside the container
-            (avoiding Nix's 'repository path is not owned by current user' error)
+        HOME is isolated to avoid permission problems with Nix & repositories.
         """
-        # Use a dedicated HOME for this test to avoid permission/ownership issues
         temp_home = "/tmp/pkgmgr-self-install"
         os.makedirs(temp_home, exist_ok=True)
 
@@ -103,20 +111,24 @@ class TestIntegrationInstalPKGMGRShallow(unittest.TestCase):
             # Isolate HOME so that ~ expands to /tmp/pkgmgr-self-install
             os.environ["HOME"] = temp_home
 
-            # Optional: ensure XDG_* also use the temp HOME for extra isolation
+            # Optional XDG override for a fully isolated environment
             os.environ.setdefault("XDG_CONFIG_HOME", os.path.join(temp_home, ".config"))
             os.environ.setdefault("XDG_CACHE_HOME", os.path.join(temp_home, ".cache"))
             os.environ.setdefault("XDG_DATA_HOME", os.path.join(temp_home, ".local", "share"))
 
+            # 🔧 IMPORTANT FIX: allow Git to access /src safely
+            configure_git_safe_directory()
+
             # Debug before cleanup
             nix_profile_list_debug("BEFORE CLEANUP")
 
-            # Cleanup: aggressively try to drop any pkgmgr/profile entries
+            # Cleanup: drop any pkgmgr entries from nix profile
             remove_pkgmgr_from_nix_profile()
 
             # Debug after cleanup
             nix_profile_list_debug("AFTER CLEANUP")
 
+            # Prepare argv for module execution
             sys.argv = [
                 "python",
                 "install",
@@ -126,15 +138,15 @@ class TestIntegrationInstalPKGMGRShallow(unittest.TestCase):
                 "--no-verification",
             ]
 
-            # Run installation via main.py
+            # Execute installation via main.py
             runpy.run_module("main", run_name="__main__")
 
-            # After successful installation: run `pkgmgr --help` for debug
+            # Debug: interactive shell test
             pkgmgr_help_debug()
 
         finally:
+            # Restore system state
             sys.argv = original_argv
-            # Restore full environment
             os.environ.clear()
             os.environ.update(original_environ)
 

tests/unit/pkgmgr/actions/release/test_files.py

@@ -80,6 +80,21 @@ class TestUpdatePyprojectVersion(unittest.TestCase):
 
         self.assertNotEqual(cm.exception.code, 0)
 
+    def test_update_pyproject_version_missing_file_is_skipped(self) -> None:
+        """
+        If pyproject.toml does not exist, the function must not raise
+        and must not create the file. It should simply be skipped.
+        """
+        with tempfile.TemporaryDirectory() as tmpdir:
+            path = os.path.join(tmpdir, "pyproject.toml")
+            self.assertFalse(os.path.exists(path))
+
+            # Must not raise an exception
+            update_pyproject_version(path, "1.2.3", preview=False)
+
+            # Still no file created
+            self.assertFalse(os.path.exists(path))
+
 
 class TestUpdateFlakeVersion(unittest.TestCase):
     def test_update_flake_version_normal(self) -> None:
@@ -352,11 +367,11 @@ class TestUpdateSpecChangelog(unittest.TestCase):
             with open(path, "r", encoding="utf-8") as f:
                 content = f.read()
 
-        # Neue Stanza muss nach %changelog stehen
+        # New stanza must appear after the %changelog marker
         self.assertIn("%changelog", content)
         self.assertIn("Fedora changelog entry", content)
         self.assertIn("Test Maintainer <test@example.com>", content)
-        # Alte Einträge müssen erhalten bleiben
+        # Old entries must still be present
         self.assertIn("Old Maintainer <old@example.com>", content)
 
     def test_update_spec_changelog_preview_does_not_write(self) -> None:
@@ -396,7 +411,7 @@ class TestUpdateSpecChangelog(unittest.TestCase):
             with open(path, "r", encoding="utf-8") as f:
                 content = f.read()
 
-        # Im Preview-Modus darf nichts verändert werden
+        # In preview mode, the spec file must not change
         self.assertEqual(content, original)
 
 

tests/unit/pkgmgr/actions/test_branch.py

@@ -1,7 +1,6 @@
 from __future__ import annotations
 
 import unittest
-from types import SimpleNamespace
 from unittest.mock import patch
 
 from pkgmgr.actions.branch import open_branch
@@ -13,9 +12,10 @@ class TestOpenBranch(unittest.TestCase):
     def test_open_branch_with_explicit_name_and_default_base(self, mock_run_git) -> None:
         """
         open_branch(name, base='main') should:
+        - resolve base branch (prefers 'main', falls back to 'master')
         - fetch origin
-        - checkout base
-        - pull base
+        - checkout resolved base
+        - pull resolved base
         - create new branch
         - push with upstream
         """
@@ -25,6 +25,7 @@ class TestOpenBranch(unittest.TestCase):
 
         # We expect a specific sequence of Git calls.
         expected_calls = [
+            (["rev-parse", "--verify", "main"], "/repo"),
             (["fetch", "origin"], "/repo"),
             (["checkout", "main"], "/repo"),
             (["pull", "origin", "main"], "/repo"),
@@ -50,7 +51,7 @@ class TestOpenBranch(unittest.TestCase):
     ) -> None:
         """
         If name is None/empty, open_branch should prompt via input()
-        and still perform the full Git sequence.
+        and still perform the full Git sequence on the resolved base.
         """
         mock_run_git.return_value = ""
 
@@ -60,6 +61,7 @@ class TestOpenBranch(unittest.TestCase):
         mock_input.assert_called_once()
 
         expected_calls = [
+            (["rev-parse", "--verify", "develop"], "/repo"),
             (["fetch", "origin"], "/repo"),
             (["checkout", "develop"], "/repo"),
             (["pull", "origin", "develop"], "/repo"),
@@ -76,15 +78,20 @@ class TestOpenBranch(unittest.TestCase):
             self.assertEqual(kwargs.get("cwd"), cwd_expected)
 
     @patch("pkgmgr.actions.branch.run_git")
-    def test_open_branch_raises_runtimeerror_on_git_failure(self, mock_run_git) -> None:
+    def test_open_branch_raises_runtimeerror_on_fetch_failure(self, mock_run_git) -> None:
         """
-        If a GitError occurs (e.g. fetch fails), open_branch should
-        raise a RuntimeError with a helpful message.
+        If a GitError occurs on fetch, open_branch should raise a RuntimeError
+        with a helpful message.
         """
 
         def side_effect(args, cwd="."):
-            # Simulate a failure on the first call (fetch)
-            raise GitError("simulated fetch failure")
+            # First call: base resolution (rev-parse) should succeed
+            if args == ["rev-parse", "--verify", "main"]:
+                return ""
+            # Second call: fetch should fail
+            if args == ["fetch", "origin"]:
+                raise GitError("simulated fetch failure")
+            return ""
 
         mock_run_git.side_effect = side_effect
 
@@ -95,6 +102,45 @@ class TestOpenBranch(unittest.TestCase):
         self.assertIn("Failed to fetch from origin", msg)
         self.assertIn("simulated fetch failure", msg)
 
+    @patch("pkgmgr.actions.branch.run_git")
+    def test_open_branch_uses_fallback_master_if_main_missing(self, mock_run_git) -> None:
+        """
+        If the preferred base (e.g. 'main') does not exist, open_branch should
+        fall back to the fallback base (default: 'master').
+        """
+
+        def side_effect(args, cwd="."):
+            # First: rev-parse main -> fails
+            if args == ["rev-parse", "--verify", "main"]:
+                raise GitError("main does not exist")
+            # Second: rev-parse master -> succeeds
+            if args == ["rev-parse", "--verify", "master"]:
+                return ""
+            # Then normal flow on master
+            return ""
+
+        mock_run_git.side_effect = side_effect
+
+        open_branch(name="feature/fallback", base_branch="main", cwd="/repo")
+
+        expected_calls = [
+            (["rev-parse", "--verify", "main"], "/repo"),
+            (["rev-parse", "--verify", "master"], "/repo"),
+            (["fetch", "origin"], "/repo"),
+            (["checkout", "master"], "/repo"),
+            (["pull", "origin", "master"], "/repo"),
+            (["checkout", "-b", "feature/fallback"], "/repo"),
+            (["push", "-u", "origin", "feature/fallback"], "/repo"),
+        ]
+
+        self.assertEqual(mock_run_git.call_count, len(expected_calls))
+        for call, (args_expected, cwd_expected) in zip(
+            mock_run_git.call_args_list, expected_calls
+        ):
+            args, kwargs = call
+            self.assertEqual(args[0], args_expected)
+            self.assertEqual(kwargs.get("cwd"), cwd_expected)
+
 
 if __name__ == "__main__":
     unittest.main()