Inventory: software matching can silently attach new versions/installations to a trashed duplicate

[Megachip]

Bug description

When two glpi_softwares rows exist with identical name + manufacturer

• entity (e.g. a leftover duplicate that was moved to the trashbin
  after a manual merge), Glpi\Inventory\Asset\Software::populateSoftware()
  can resolve future inventory imports to the trashed row instead of
  the active one, so new SoftwareVersion/Item_SoftwareVersion entries
  keep landing on a deleted item.

Root cause: the existing-software lookup has no ORDER BY and no
is_deleted filter, and the surrounding while ($row = ...) loop
overwrites the cached id on every row instead of taking the first
match — so the last row returned by MySQL wins, which is undefined
without an explicit order and in practice tends to be the highest id.

Steps to reproduce

1. Let inventory create a software (e.g. via agent import).
2. Manually create a second glpi_softwares row with the exact same
   name/manufacturer/entities_id/is_recursive, then move it to the
   trashbin (is_deleted = 1), so it has a higher id than the active
   one.
3. Run a new inventory reporting that software name again.
4. Observe: the new SoftwareVersion/Item_SoftwareVersion is attached
   to the trashed (higher-id) software, not the active one.

Fix

ORDER BY is_deleted ASC, id ASC LIMIT 1 on the lookup, single fetch
instead of the loop. Active software is always preferred; among rows
with the same is_deleted status, the lowest id wins deterministically.
If only a deleted duplicate matches, it is still reused (unchanged
behavior) — this PR only fixes the priority between active and
deleted, not whether deleted rows are eligible at all.

Test plan

Added testDuplicatedSoftPrefersActiveOverDeleted() in
SoftwareTest.php: creates an active software (lower id) and a
trashed duplicate (higher id), runs an inventory, asserts the new
version/installation lands on the active one only.

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Powered by Qodo

[trasher]

Fix seem correct to me - waiting for tests suite to ends.

You'll have few CS issues to fix.

[trasher]

Tests are failing

[stonebuzz]

The assertions only look at glpi_softwareversions; the message claims "version/installation" but no Item_SoftwareVersion row is checked. Adding one assertion on the installation would cover the part of the bug that actually affects the asset sheet.

$installs = (new Item_SoftwareVersion())->find(['softwareversions_id' => (int) current($on_active)['id']]);
$this->assertCount(1, $installs);

[stonebuzz]

The computer is pre-created by hand, but the first inventory would create it anyway and nothing asserts that the inventory matched this row rather than creating a second one. Dropping the manual Computer::add() would make the fixture leaner without weakening the test.

[trasher]

Please address comments