integrity:check-core reports FILE_MISSING for the mimetypelist.js test fixture in QA builds

Summary

occ integrity:check-core reports FILE_MISSING on the QA variants only (owncloud-11.0.0-qa, owncloud-complete-20260730-qa) for:

tests/data/integritycheck/app/core/js/mimetypelist.js
  expected: 27c74670adb750...830763fd
  current:

Non-QA variants are INTACT — they ship no tests/ directory, so the path never exists.

Root cause: signer/verifier exclusion asymmetry

ExcludeFileByNameFilterIterator excludes by a path-suffix regex (lib/private/IntegrityCheck/Iterator/ExcludeFileByNameFilterIterator.php:66):

private $excludedFilePathPatterns = [
    '|/core/js/mimetypelist.js$|', // regenerable via occ maintenance:mimetype:update-js
];

That regex is meant to exempt the one regenerable file at the server root, but $ -anchored suffix matching also hits the integritycheck test fixture:

/srv/owncloud/tests/data/integritycheck/app/core/js/mimetypelist.js   match=1
/srv/owncloud/core/js/mimetypelist.js                                 match=1

The signer (ocsign) excludes the exact path core/js/mimetypelist.js, so it signs the fixture and omits the real one. Verified in the published v11.0.0 complete-qa manifest:

• core/js/mimetypelist.js in manifest: false
• tests/data/integritycheck/app/core/js/mimetypelist.js in manifest: true

So the verifier skips on disk exactly the file the signer put in the manifest → FILE_MISSING.

Impact

Cosmetic-but-loud for QA builds: hasPassedCheck() treats FILE_MISSING as a failure, so QA installs show a code-integrity warning. No cryptographic issue — the envelope itself verifies: all 57 scopes in the published v11.0.0 complete-qa tarball pass ECDSA-P384/SHA-384 over the verbatim hashes bytes, leaf CN == scope id, chain to root-g2, and 0 manifest-vs-disk diffs on a pristine extraction.

Not a 11.0.0 regression — v11.0.0-rc3's complete-qa tarball reproduces it identically, and the exclusion has been in place since 0f29535218.

Suggested fix

Align the two sides. Either anchor the verifier pattern to the server root so it matches only the real file, e.g.

'|^' . preg_quote($root, '|') . '/core/js/mimetypelist\.js$|'

(the iterator already receives $root), or have the signer apply the same suffix rule. Anchoring the verifier is the narrower change and keeps the fixture signed and checked.

Reproduce

gh release download v11.0.0 --repo owncloud/core -p 'owncloud-complete-20260730-qa.tar.bz2'
tar xjf owncloud-complete-20260730-qa.tar.bz2
# install, then:
occ integrity:check-core