fix: fail promise on invalid DNF options

Invalid DNF options are configuration errors and should fail the
promise as NOT_KEPT rather than logging warnings and continuing.

Changes:
- Renamed _try_apply_dnf_options -> _apply_dnf_options
- Removed try/except wrapper inside _apply_dnf_options
- Added try/except in callers to catch ConfigError and return NOT_KEPT
- Added test_invalid_dnf_option_not_kept to verify behavior

This aligns with strict configuration validation - if a user specifies
an invalid option, it's a policy error that should be fixed.

Author: nickanderson

promise-types/appstreams/appstreams.py

@@ -375,8 +375,8 @@ def _log_failed_packages(self, failed_packages):
         for pkg, error in failed_packages:
             self.log_error(f"  Package {pkg} failed: {error}")
 
-    def _try_apply_dnf_options(self, base, options):
-        """Apply DNF configuration options at best effort (logs errors but continues)"""
+    def _apply_dnf_options(self, base, options):
+        """Apply DNF configuration options, raising ConfigError on invalid options"""
         if not options:
             return
 
@@ -386,24 +386,21 @@ def _try_apply_dnf_options(self, base, options):
                 key = key.strip()
                 value = value.strip()
 
-                try:
-                    # Use DNF's set_or_append_opt_value to handle options generically
-                    base.conf.set_or_append_opt_value(key, value)
-                    self.log_verbose(f"Set DNF option: {key}={value}")
-                except dnf.exceptions.ConfigError as e:
-                    self.log_warning(f"Failed to set DNF option '{key}={value}': {e}")
-                except Exception as e:
-                    self.log_warning(
-                        f"Unexpected error setting DNF option '{key}={value}': {e}"
-                    )
+                # Raises dnf.exceptions.ConfigError if option is invalid
+                base.conf.set_or_append_opt_value(key, value)
+                self.log_verbose(f"Set DNF option: {key}={value}")
 
     def _switch_module(self, mpc, base, module_name, stream, profile, options=None):
         """Switch a module to a different stream using ModuleBase.switch_to()"""
         if options is None:
             options = []
 
         # Apply DNF configuration options
-        self._try_apply_dnf_options(base, options)
+        try:
+            self._apply_dnf_options(base, options)
+        except dnf.exceptions.ConfigError as e:
+            self.log_error(f"Invalid DNF option: {e}")
+            return Result.NOT_KEPT
 
         if not stream:
             self.log_error("Stream must be specified for module switch")
@@ -483,7 +480,11 @@ def _switch_module(self, mpc, base, module_name, stream, profile, options=None):
     def _install_module(self, mpc, base, module_name, stream, profile, options=None):
         """Enable a module stream and install the given (or default) profile's packages."""
         # Apply DNF options if specified
-        self._try_apply_dnf_options(base, options)
+        try:
+            self._apply_dnf_options(base, options)
+        except dnf.exceptions.ConfigError as e:
+            self.log_error(f"Invalid DNF option: {e}")
+            return Result.NOT_KEPT
 
         if not stream:
             try:

promise-types/appstreams/test_appstreams_logic.py

@@ -286,6 +286,34 @@ def test_profile_default_not_found(module, mock_base, mock_mpc):
     assert result == Result.NOT_KEPT
 
 
+def test_invalid_dnf_option_not_kept(module, mock_base, mock_mpc):
+    """Test that invalid DNF options cause NOT_KEPT (ConfigError from DNF)"""
+    from unittest.mock import PropertyMock
+
+    # Mock ConfigError to be raised when invalid option is set
+    mock_base.conf.set_or_append_opt_value.side_effect = (
+        mock_dnf.exceptions.ConfigError('Cannot set "invalid_option" to "value"')
+    )
+
+    mock_mpc.getModuleState.return_value = mock_mpc.ModuleState_ENABLED
+    mock_mpc.getEnabledStream.return_value = "12"
+    mock_mpc.getInstalledProfiles.return_value = []
+
+    result = module.evaluate_promise(
+        "nodejs",
+        {
+            "state": "installed",
+            "stream": "12",
+            "profile": "common",
+            "options": ["invalid_option=value"],
+        },
+        {},
+    )
+
+    # Should fail because invalid option raises ConfigError
+    assert result == Result.NOT_KEPT
+
+
 def test_remove_unknown_module_runtime_error(module, mock_base, mock_mpc):
     """Test removing a module when getEnabledStream raises RuntimeError"""
     mock_mpc.getModuleState.return_value = mock_mpc.ModuleState_ENABLED