prune: fix Archive.DoesNotExist when using --list, fixes #9416

format_item() can trigger lazy loading of archive metadata (e.g. hostname,
username, size) from the repository. Previously it was called after
archive.delete(), which caused Archive.DoesNotExist for pruned archives.

Fix: call formatter.format_item() early, before any deletion takes place.

Also added a test.

Author: ThomasWaldmann

src/borg/archiver/prune_cmd.py

@@ -179,29 +179,32 @@ def do_prune(self, args, repository, manifest):
             archives_deleted = 0
             uncommitted_deletes = 0
             pi = ProgressIndicatorPercent(total=len(to_delete), msg="Pruning archives %3.0f%%", msgid="prune")
-            for archive in archives:
+            for archive_info in archives:
                 if sig_int and sig_int.action_done():
                     break
-                if archive in to_delete:
+                # format_item may internally load the archive from the repository,
+                # so we must call it before deleting the archive.
+                archive_formatted = formatter.format_item(archive_info, jsonline=False)
+                if archive_info in to_delete:
                     pi.show()
                     if args.dry_run:
                         log_message = "Would prune:"
                     else:
                         archives_deleted += 1
                         log_message = "Pruning archive (%d/%d):" % (archives_deleted, to_delete_len)
-                        archive = Archive(manifest, archive.id, cache=cache)
+                        archive = Archive(manifest, archive_info.id, cache=cache)
                         archive.delete()
                         uncommitted_deletes += 1
                 else:
                     log_message = "Keeping archive (rule: {rule} #{num}):".format(
-                        rule=kept_because[archive.id][0], num=kept_because[archive.id][1]
+                        rule=kept_because[archive_info.id][0], num=kept_because[archive_info.id][1]
                     )
                 if (
                     args.output_list
-                    or (args.list_pruned and archive in to_delete)
-                    or (args.list_kept and archive not in to_delete)
+                    or (args.list_pruned and archive_info in to_delete)
+                    or (args.list_kept and archive_info not in to_delete)
                 ):
-                    list_logger.info(f"{log_message:<44} {formatter.format_item(archive, jsonline=False)}")
+                    list_logger.info(f"{log_message:<44} {archive_formatted}")
             pi.finish()
             if sig_int:
                 raise Error("Got Ctrl-C / SIGINT.")

src/borg/testsuite/archiver/prune_cmd_test.py

@@ -400,3 +400,19 @@ def test_prune_split_no_archives():
 
     assert keep == []
     assert kept_because == {}
+
+
+def test_prune_list_with_metadata_format(archivers, request):
+    # Regression test for: prune --list with a format string that requires loading
+    # archive metadata (e.g. {hostname}) must not fail when archives are deleted.
+    # The bug was that format_item() was called after archive.delete(), causing
+    # Archive.DoesNotExist when the formatter tried to lazy-load the archive.
+    archiver = request.getfixturevalue(archivers)
+    cmd(archiver, "repo-create", RK_ENCRYPTION)
+    cmd(archiver, "create", "test1", src_dir)
+    cmd(archiver, "create", "test2", src_dir)
+    # {hostname} is a "call key" that triggers lazy loading of the archive from the repo.
+    # With the buggy code this would raise Archive.DoesNotExist for the pruned archive.
+    output = cmd(archiver, "prune", "--list", "--keep-daily=1", "--format={name} {hostname}{NL}")
+    assert "test1" in output
+    assert "test2" in output