diff --git a/.azldev-version b/.azldev-version index b58154cc1d3..2cb66fd4ced 100644 --- a/.azldev-version +++ b/.azldev-version @@ -1 +1 @@ -661c69b6c5b1e3773cd15990765bf7b85e1856da +4bd46b9023f1eab6ec4f3bef55f4cf517066e494 diff --git a/base/comps/apache-commons-compress/apache-commons-compress.comp.toml b/base/comps/apache-commons-compress/apache-commons-compress.comp.toml index d794db4cc55..7b1fe207e61 100644 --- a/base/comps/apache-commons-compress/apache-commons-compress.comp.toml +++ b/base/comps/apache-commons-compress/apache-commons-compress.comp.toml @@ -17,25 +17,37 @@ # will be skipped/excluded at build time if they reference these # fixtures. # -# We replace Source0 (effectively) with a deterministically-repacked -# tarball that is byte-identical to upstream except for the stripped -# files. The repack is produced by -# base/comps/apache-commons-compress/modify_source.sh, which is -# reproducible — re-running it always yields the same SHA-512. We keep -# the upstream filename (commons-compress-1.27.1-src.tar.gz) and use the -# `replace-upstream` mechanism on the source-files entry below to swap it -# in place in the Fedora `sources` manifest — no spec edit required. -# -# When bumping the apache-commons-compress version (or changing -# REMOVE_PATHS): -# 1. Edit VERSION and UPSTREAM_SHA512 in modify_source.sh. -# 2. Re-run the script and copy the new SHA-512 into the source-files entry. -# 3. Upload the new tarball to the modified-source lookaside (see script output). +# Archive overlays strip the scanner-flagged fixtures from upstream Source0 +# during source preparation, avoiding a separate modified-source tarball. + +[[components.apache-commons-compress.overlays]] +type = "file-remove" +file = "src/test/resources/bla.encrypted.7z" +description = "Remove encrypted 7-Zip test fixture flagged by AZL signing-pipeline AV scanner" +archive = "commons-compress-1.27.1-src.tar.gz" + +[[components.apache-commons-compress.overlays]] +type = "file-remove" +file = "src/test/resources/password-encrypted.zip" +description = "Remove encrypted ZIP test fixture flagged by AZL signing-pipeline AV scanner" +archive = "commons-compress-1.27.1-src.tar.gz" + +[[components.apache-commons-compress.overlays]] +type = "file-remove" +file = "src/test/resources/COMPRESS-256.7z" +description = "Remove crafted 7-Zip test fixture flagged by AZL signing-pipeline AV scanner" +archive = "commons-compress-1.27.1-src.tar.gz" + +[[components.apache-commons-compress.overlays]] +type = "file-remove" +file = "src/test/resources/zip64support.tar.bz2" +description = "Remove crafted tar.bz2 test fixture flagged by AZL signing-pipeline AV scanner" +archive = "commons-compress-1.27.1-src.tar.gz" [[components.apache-commons-compress.source-files]] filename = "commons-compress-1.27.1-src.tar.gz" -hash = "aeecee8776c60a549cbca9fc3c0312c8c98a953d024db64e5c480c643357be7b270193df69fc2172632e472feb9b9221eedf3b40dd933997b881a398dfb3a02b" +hash = "cff58f1c9cb95e96e95230af6523b2e593ac5d1c775110d5845012775920468f8fc9013a0bdba6022cc6dc3391b5d92bd59cf6eacf4c10c82ef9b7792d63601f" hash-type = "SHA512" -origin = { type = "download", uri = "https://azltempstaginglookaside.blob.core.windows.net/repo/pkgs_modified/apache-commons-compress/commons-compress-1.27.1-src.tar.gz/sha512/aeecee8776c60a549cbca9fc3c0312c8c98a953d024db64e5c480c643357be7b270193df69fc2172632e472feb9b9221eedf3b40dd933997b881a398dfb3a02b/commons-compress-1.27.1-src.tar.gz" } +origin = { type = "overlay"} replace-upstream = true -replace-reason = "AZL-repacked tarball with scanner-flagged encrypted and crafted-archive test fixtures stripped; see modify_source.sh REMOVE_PATHS" +replace-reason = "Upstream source tarball contains test fixtures flagged as malware by the AZL RPM signing pipeline. These files are not needed at runtime and are removed to allow SRPM publication." diff --git a/base/comps/apache-commons-compress/modify_source.sh b/base/comps/apache-commons-compress/modify_source.sh deleted file mode 100755 index 59b0f42346f..00000000000 --- a/base/comps/apache-commons-compress/modify_source.sh +++ /dev/null @@ -1,171 +0,0 @@ -#!/usr/bin/env bash -# -# Reproducibly rebuild commons-compress--src.tar.gz with a curated -# set of files stripped out (see REMOVE_PATHS below). These are upstream -# Apache Commons Compress encrypted-archive test fixtures flagged by -# anti-malware scanning on the AZL RPM signing pipeline as suspicious / -# malware-like content. Such content blocks the SRPM from being published. -# -# This script is fully deterministic: given the same upstream tarball and -# the same REMOVE_PATHS list, it always produces a byte-identical output -# (so the SHA-512 in the `source-files` entry of -# apache-commons-compress.comp.toml is stable). -# -# Determinism is achieved by: -# * tar --sort=name (stable file order, independent of FS readdir order) -# * --owner=0 --group=0 --numeric-owner (no host-specific uid/gid) -# * --mtime=@ (fixed mtime for every entry) -# * --format=gnu (consistent header format, handles long paths) -# * gzip -n -9 (no filename/mtime in gzip header; -n is essential — -# without it, gzip embeds the local mtime and breaks -# determinism. Changing -9 or adding flags changes the -# SHA-512, so bump the hash in the comp.toml if you do.) -# * LC_ALL=C (locale-independent sort) -# -# Usage: -# modify_source.sh [--workdir DIR] [--keep] -# -# To bump the package version: edit VERSION and UPSTREAM_SHA512 below in -# lockstep, then re-run. There is no CLI flag for VERSION because the -# repacked tarball's hash and the upstream-verification hash are version- -# specific, so they must change together (and the comp.toml hash must be -# updated too). -# -# Output: /commons-compress--src.azl.tar.gz (+ .sha512) - -set -euo pipefail - -# Pinned package version. To bump, also update UPSTREAM_SHA512 below and -# the `hash` field in apache-commons-compress.comp.toml. -VERSION="1.27.1" -KEEP=0 -# Default workdir lives under the project work dir to comply with AGENTS.md. -WORKDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)/base/build/work/scratch/apache-commons-compress" - -while [[ $# -gt 0 ]]; do - case "$1" in - --workdir) WORKDIR="$2"; shift 2 ;; - --keep) KEEP=1; shift ;; - -h|--help) - sed -n '2,28p' "$0"; exit 0 ;; - *) echo "unknown arg: $1" >&2; exit 2 ;; - esac -done - -UPSTREAM_NAME="commons-compress-${VERSION}-src.tar.gz" -# Local-only artifact name (different from UPSTREAM_NAME so it doesn't -# collide with the downloaded upstream tarball in the same workdir). The -# blob uploaded to the lookaside MUST use UPSTREAM_NAME (replace-upstream -# matches by filename). -OUTPUT_NAME="commons-compress-${VERSION}-src.azl.tar.gz" -TOPDIR="commons-compress-${VERSION}-src" - -# Files (relative to ${TOPDIR}) to strip from the upstream tarball. These -# trip anti-malware scanning on the AZL RPM signing pipeline — an AV -# engine flags them as Trojan (or, for the two encrypted archives, as a -# generic "File is encrypted!" heuristic). Add new entries here as they -# are discovered. Every change to this list alters the repacked SHA-512 — -# bump the `hash` in apache-commons-compress.comp.toml accordingly. -# -# Categories: -# * Encrypted-archive test fixtures (bla.encrypted.7z, -# password-encrypted.zip): trip generic "encrypted archive" / malware -# heuristics. After other blockers were removed these dropped to -# non-blocking, but we keep them stripped so the scan report stays -# clean. -# * Crafted archive test fixtures (COMPRESS-256.7z, -# zip64support.tar.bz2): named Trojan blockers per the AV scan on -# 2026-05-15. These -# are small, intentionally-malformed/edge-case archives used by the -# project's read-side unit tests; same false-positive family as the -# encrypted fixtures. -REMOVE_PATHS=( - "src/test/resources/bla.encrypted.7z" - "src/test/resources/password-encrypted.zip" - "src/test/resources/COMPRESS-256.7z" - "src/test/resources/zip64support.tar.bz2" -) - -# Known upstream SHA-512 (from specs/a/apache-commons-compress/sources). -# Bump when version changes. -UPSTREAM_SHA512="c7a2cef26959e687ad19b96b5ba8393d7514095e13bf0f29bd41e6b3c3cb2260d8ff23283ff3d5fd137b2522b843e7f0f50ab46bcf0f66df5383674f35f223ab" - -# Fixed mtime for every entry in the repacked tarball: -# 2020-01-01T00:00:00Z (1577836800). Any fixed epoch works; do not change -# without also bumping the `hash` in the comp.toml. -MTIME_EPOCH=1577836800 - -UPSTREAM_URL="https://archive.apache.org/dist/commons/compress/source/${UPSTREAM_NAME}" - -mkdir -p "${WORKDIR}" -cd "${WORKDIR}" - -echo "[1/5] downloading ${UPSTREAM_NAME}" -if [[ ! -f "${UPSTREAM_NAME}" ]]; then - curl -fsSL --retry 3 -o "${UPSTREAM_NAME}.part" "${UPSTREAM_URL}" - mv "${UPSTREAM_NAME}.part" "${UPSTREAM_NAME}" -fi - -echo "[2/5] verifying upstream SHA-512" -echo "${UPSTREAM_SHA512} ${UPSTREAM_NAME}" | sha512sum -c - - -echo "[3/5] extracting" -rm -rf "${TOPDIR}" -tar -xzf "${UPSTREAM_NAME}" - -echo "[4/5] removing ${#REMOVE_PATHS[@]} file(s) from tarball" -for rel in "${REMOVE_PATHS[@]}"; do - full="${TOPDIR}/${rel}" - if [[ ! -f "${full}" ]]; then - echo "ERROR: expected file not found in upstream tarball: ${full}" >&2 - exit 1 - fi - echo " - ${full}" - rm -f "${full}" -done - -echo "[5/5] repacking deterministically -> ${OUTPUT_NAME}" -rm -f "${OUTPUT_NAME}" -# Build the file list with a stable, locale-independent sort. Pass it to tar -# via --files-from so `tar --sort=name` only has to do a final stable sort. -# gzip -n strips the filename and mtime from the gzip header (essential for -# determinism). -LC_ALL=C find "${TOPDIR}" -print0 \ - | LC_ALL=C sort -z \ - | LC_ALL=C tar \ - --create \ - --format=gnu \ - --sort=name \ - --owner=0 --group=0 --numeric-owner \ - --mtime="@${MTIME_EPOCH}" \ - --null --files-from=- \ - | gzip -n -9 -c > "${OUTPUT_NAME}" - -sha512sum "${OUTPUT_NAME}" | tee "${OUTPUT_NAME}.sha512" - -if [[ "${KEEP}" -eq 0 ]]; then - rm -rf "${TOPDIR}" -fi - -cat <&2 - echo " expected: ${UPSTREAM_SHA512}" >&2 - echo " computed: ${COMPUTED_UPSTREAM_SHA512}" >&2 - exit 1 -fi - -# --- Extract + strip -------------------------------------------------------- - -echo "[4/5] Extracting and stripping ${#REMOVE_PATHS[@]} fixture(s) from ${UPSTREAM_TOPDIR}" -rm -rf "${WORKDIR}/${UPSTREAM_TOPDIR}" -# `--no-same-owner` / `--no-same-permissions` prevent tar from applying the -# archive's uid/gid/mode bits to the extracted tree. They are already the -# default for non-root users, but explicit hardening makes the script safe -# to run under sudo (where the defaults flip) and defends against any -# setuid/setgid bits or unexpected ownership in the upstream tarball. -# `-z` requests gzip decompression explicitly rather than relying on tar's -# magic-byte auto-detection (GNU tar default, but not POSIX/BSD tar). -# Deterministic owner/group is re-asserted in the repack step below. -tar -C "${WORKDIR}" --no-same-owner --no-same-permissions -xzf "${UPSTREAM_CACHE}" -for REMOVE_PATH in "${REMOVE_PATHS[@]}"; do - if [[ ! -f "${WORKDIR}/${UPSTREAM_TOPDIR}/${REMOVE_PATH}" ]]; then - echo "ERROR: expected '${UPSTREAM_TOPDIR}/${REMOVE_PATH}' not present in upstream tarball" >&2 - exit 1 - fi - echo " stripping ${UPSTREAM_TOPDIR}/${REMOVE_PATH}" - rm -f "${WORKDIR}/${UPSTREAM_TOPDIR}/${REMOVE_PATH}" -done - -# --- Repack deterministically ----------------------------------------------- - -echo "[5/5] Repacking deterministically as ${UPSTREAM_FILENAME}" -# Deterministic flags: -# --sort=name stable entry order -# --owner=0 --group=0 no host uid/gid leakage -# --numeric-owner force numeric uid/gid -# --mtime=@ fixed mtime -# --format=gnu handles long paths deterministically -# LC_ALL=C pins sort collation so --sort=name is locale-independent. -# gzip -n strips the original filename and mtime from the gzip header, -# which would otherwise vary between runs. -9 picks max compression. -MODIFIED_TARBALL="${WORKDIR}/${UPSTREAM_FILENAME}" -rm -f "${MODIFIED_TARBALL}" -LC_ALL=C tar \ - -C "${WORKDIR}" \ - --sort=name \ - --owner=0 --group=0 --numeric-owner \ - --mtime="${DETERMINISTIC_MTIME}" \ - --format=gnu \ - -cf - "${UPSTREAM_TOPDIR}" \ - | gzip -n -9 -c > "${MODIFIED_TARBALL}" - -MODIFIED_SHA512="$(sha512sum "${MODIFIED_TARBALL}" | awk '{print $1}')" -echo "${MODIFIED_SHA512} ${UPSTREAM_FILENAME}" > "${MODIFIED_TARBALL}.sha512" - -echo -echo "================================================================" -echo "DONE" -echo " modified tarball: ${WORKDIR}/${UPSTREAM_FILENAME}" -echo " SHA512: ${MODIFIED_SHA512}" -echo "================================================================" -echo -echo " To upload the modified tarball to the lookaside (both paths):" -for SUBPATH in pkgs pkgs_modified; do - echo " az storage blob upload \\" - echo " --auth-mode login \\" - echo " --account-name azltempstaginglookaside \\" - echo " --container-name repo \\" - echo " --name \"${SUBPATH}/${COMPONENT}/${UPSTREAM_FILENAME}/sha512/${MODIFIED_SHA512}/${UPSTREAM_FILENAME}\" \\" - echo " --file \"${WORKDIR}/${UPSTREAM_FILENAME}\"" - echo -done diff --git a/base/comps/exfatprogs/exfatprogs.comp.toml b/base/comps/exfatprogs/exfatprogs.comp.toml index b64f4750708..b13ca365b4b 100644 --- a/base/comps/exfatprogs/exfatprogs.comp.toml +++ b/base/comps/exfatprogs/exfatprogs.comp.toml @@ -1,9 +1,15 @@ [components.exfatprogs] +[[components.exfatprogs.overlays]] +type = "file-remove" +file = "tests/**" +archive = "exfatprogs-1.3.1.tar.xz" +description = "Remove tests/ directory containing deliberately-corrupted exFAT filesystem images that trip AZL signing-pipeline AV scanner" + [[components.exfatprogs.source-files]] filename = "exfatprogs-1.3.1.tar.xz" -hash = "ded26326feab2b0013c1031fda7add53100e0581711555b8a64e8036448775a51304e4c5c368049cb26633dbf02e814b6f97bd804cafff324921a8e6a3a975d0" +hash = "defc23281368b219d3a00a1b6da97728ddbcd70804aa447e211cc3404a49d9bfc5bf7604b4d140e2d7f9281230f1b46f6ace580fc6a8a14f5c3b8902821b2338" hash-type = "SHA512" -origin = { type = "download", uri = "https://azltempstaginglookaside.blob.core.windows.net/repo/pkgs_modified/exfatprogs/exfatprogs-1.3.1.tar.xz/sha512/ded26326feab2b0013c1031fda7add53100e0581711555b8a64e8036448775a51304e4c5c368049cb26633dbf02e814b6f97bd804cafff324921a8e6a3a975d0/exfatprogs-1.3.1.tar.xz" } +origin = { type = "overlay" } replace-upstream = true -replace-reason = "The upstream `tests/` tree ships 19 deliberately-corrupted exFAT filesystem images (e.g. bad_bitmap, bad_dentries, bs_bad_csum, loop_chain) whose malformed metadata sends the malware scanner into runaway behaviour on the crafted FAT/dentry structures -- the shell harness alongside them (tests/upcase_table/, test_fsck.sh) is not itself problematic; it is removed as collateral because it becomes unused once the images are gone. The `tests/` tree is EXTRA_DIST-only, never built or installed, and the spec has no %check, so stripping it is functionally inert. See modify_source.sh." +replace-reason = "Upstream tests contain deliberately corrupted exFAT filesystem images that trip signing-pipeline scanning; the archive overlay removes the unused tests tree." diff --git a/base/comps/exfatprogs/modify_source.sh b/base/comps/exfatprogs/modify_source.sh deleted file mode 100755 index b82cdd3db1e..00000000000 --- a/base/comps/exfatprogs/modify_source.sh +++ /dev/null @@ -1,118 +0,0 @@ -#!/usr/bin/env bash -# -# exfatprogs: deterministic strip-and-repack of upstream `exfatprogs-1.3.1.tar.xz` -# with the `tests/` directory removed. Rationale lives in the comp.toml -# `replace-reason` field. -# -# Usage: bash base/comps/exfatprogs/modify_source.sh -# Output: base/build/work/scratch/exfatprogs/exfatprogs-1.3.1.tar.xz (+ .sha512) -# The upstream tarball is cached under a `.upstream` suffix; re-runs reuse it. - -set -euo pipefail - -# --- Constants -------------------------------------------------------------- - -readonly COMPONENT="exfatprogs" -readonly UPSTREAM_VERSION="1.3.1" -readonly UPSTREAM_FILENAME="exfatprogs-${UPSTREAM_VERSION}.tar.xz" -readonly UPSTREAM_TOPDIR="exfatprogs-${UPSTREAM_VERSION}" -readonly UPSTREAM_URL="https://github.com/${COMPONENT}/${COMPONENT}/releases/download/${UPSTREAM_VERSION}/${UPSTREAM_FILENAME}" - -readonly UPSTREAM_SHA512="28afefa6a4460a52d8078c47bcb63fdde42778a44e428481beff401f5f2ea305409ba42ae4357e03d7f3c9169e874c99c8caf00aca4d6223561cde11ac886cad" - -# Deterministic-repack mtime: 2020-01-01T00:00:00Z (1577836800). -# Any fixed epoch works; do not change without also bumping the -# `hash` in exfatprogs.comp.toml. -readonly DETERMINISTIC_MTIME="@1577836800" - -# --- Work directory --------------------------------------------------------- - -SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" -REPO_ROOT="$(cd "${SCRIPT_DIR}/../../.." && pwd)" -WORKDIR="${REPO_ROOT}/base/build/work/scratch/${COMPONENT}" - -mkdir -p "${WORKDIR}" -cd "${WORKDIR}" - -echo "[1/5] Working in ${WORKDIR}" - -# --- Download upstream ------------------------------------------------------ -# -# The upstream tarball is cached under a `.upstream` suffix so that -# the repacked output written at the canonical `${UPSTREAM_FILENAME}` -# path below cannot clobber the cache on re-runs. Treat the cache -# as authoritative only after SHA-512 verification. - -UPSTREAM_CACHE="${WORKDIR}/${UPSTREAM_FILENAME}.upstream" - -if [[ ! -f "${UPSTREAM_CACHE}" ]]; then - echo "[2/5] Downloading ${UPSTREAM_FILENAME} from ${UPSTREAM_URL}" - curl -fsSL --retry 3 -o "${UPSTREAM_CACHE}.part" "${UPSTREAM_URL}" - mv "${UPSTREAM_CACHE}.part" "${UPSTREAM_CACHE}" -else - echo "[2/5] Using cached upstream tarball ${UPSTREAM_CACHE}" -fi - -# --- Verify upstream SHA-512 ------------------------------------------------ - -echo "[3/5] Verifying upstream SHA-512" -COMPUTED_UPSTREAM_SHA512="$(sha512sum "${UPSTREAM_CACHE}" | awk '{print $1}')" -if [[ "${COMPUTED_UPSTREAM_SHA512}" != "${UPSTREAM_SHA512}" ]]; then - echo "ERROR: upstream SHA-512 mismatch (cache may be corrupt; delete ${UPSTREAM_CACHE} and re-run)" >&2 - echo " expected: ${UPSTREAM_SHA512}" >&2 - echo " computed: ${COMPUTED_UPSTREAM_SHA512}" >&2 - exit 1 -fi - -# --- Extract + strip -------------------------------------------------------- - -echo "[4/5] Extracting and stripping ${UPSTREAM_TOPDIR}/tests/" -rm -rf "${WORKDIR}/${UPSTREAM_TOPDIR}" -tar -C "${WORKDIR}" -xf "${UPSTREAM_CACHE}" -if [[ ! -d "${WORKDIR}/${UPSTREAM_TOPDIR}/tests" ]]; then - echo "ERROR: expected '${UPSTREAM_TOPDIR}/tests/' not present in upstream tarball" >&2 - exit 1 -fi -rm -rf "${WORKDIR}/${UPSTREAM_TOPDIR}/tests" - -# --- Repack deterministically ----------------------------------------------- - -echo "[5/5] Repacking deterministically as ${UPSTREAM_FILENAME}" -# Deterministic flags: -# --sort=name stable entry order -# --owner=0 --group=0 no host uid/gid leakage -# --numeric-owner force numeric uid/gid -# --mtime=@ fixed mtime -# --format=gnu handles long paths deterministically -# LC_ALL=C pins sort collation so --sort=name is locale-independent. -# xz -T 1 forces single-threaded encoding; multi-threaded xz splits -# the stream into non-reproducible blocks unless --block-size is -# also pinned, and the savings are marginal for a tarball this size. -MODIFIED_TARBALL="${WORKDIR}/${UPSTREAM_FILENAME}" -rm -f "${MODIFIED_TARBALL}" -LC_ALL=C tar \ - -C "${WORKDIR}" \ - --sort=name \ - --owner=0 --group=0 --numeric-owner \ - --mtime="${DETERMINISTIC_MTIME}" \ - --format=gnu \ - -cf - "${UPSTREAM_TOPDIR}" \ - | xz -T 1 -9 -c > "${MODIFIED_TARBALL}" - -MODIFIED_SHA512="$(sha512sum "${MODIFIED_TARBALL}" | awk '{print $1}')" -echo "${MODIFIED_SHA512} ${UPSTREAM_FILENAME}" > "${MODIFIED_TARBALL}.sha512" - -echo -echo "================================================================" -echo "DONE" -echo " modified tarball: ${WORKDIR}/${UPSTREAM_FILENAME}" -echo " SHA512: ${MODIFIED_SHA512}" -echo "================================================================" -echo -echo " To upload the modified tarball to the lookaside:" -echo " az storage blob upload \\" -echo " --auth-mode login \\" -echo " --account-name azltempstaginglookaside \\" -echo " --container-name repo \\" -echo " --name \"pkgs_modified/${COMPONENT}/${UPSTREAM_FILENAME}/sha512/${MODIFIED_SHA512}/${UPSTREAM_FILENAME}\" \\" -echo " --file \"${WORKDIR}/${UPSTREAM_FILENAME}\"" diff --git a/base/comps/firefox/firefox.comp.toml b/base/comps/firefox/firefox.comp.toml index 007f649083d..07c7addaeab 100644 --- a/base/comps/firefox/firefox.comp.toml +++ b/base/comps/firefox/firefox.comp.toml @@ -24,7 +24,8 @@ release = { calculation = "manual" } # tracking' (introduces the azl_release counter mechanism) # 4. 'feat(firefox): strip malware-flagged files from source tarball' # 5. 'fix(firefox): drop fdk-aac-free-devel and Fedora fdk-aac patch' -azl_release = "5" +# 6. 'refactor: replace source modification scripts with TOML overlays' +azl_release = "6" # Firefox 148.0's mfbt/tests/TestIntegerRange.cpp uses uint8_t/uint16_t/uint32_t/uint64_t # without #include . GCC 15 (used in Azure Linux bootstrap) enforces stricter @@ -143,28 +144,29 @@ replacement = 'Release: %[1 + %{azl_release}]%{?pre_tag}%{?dist}' # The authoritative list of stripped files lives in # base/comps/firefox/modify_source.sh (REMOVE_PATHS). # -# We replace Source0 with a deterministically-repacked tarball that is -# byte-identical to the upstream one except for the stripped files. -# The repack is produced by base/comps/firefox/modify_source.sh, which -# is reproducible — re-running it always yields the same SHA-512. We keep -# the upstream filename (firefox-.source.tar.xz) and use the -# `replace-upstream` mechanism on the source-files entry below to swap it -# in place in the Fedora `sources` manifest — no spec edit required. +# Archive overlays strip the scanner-flagged fixtures from upstream Source0 +# during source preparation, avoiding a separate modified-source tarball. # # When bumping the firefox version (or changing REMOVE_PATHS): -# 1. Edit VERSION and UPSTREAM_SHA512 in modify_source.sh. -# 2. Re-run the script and copy the new SHA-512 into the source-files entry. -# 3. Upload the new tarball to the modified-source lookaside (see script output). +# 1. Update the overlay paths below if upstream fixture paths change. +# 2. Re-render and build to verify the archive overlays still apply. -# Drop the upstream firefox-.source.tar.xz entry from the Fedora -# `sources` lookaside manifest so the build does not also try to fetch the -# unmodified upstream tarball alongside our repacked one. This is handled -# by `replace-upstream = true` on the source-files entry below. +[[components.firefox.overlays]] +type = "file-remove" +file = "toolkit/components/mediasniffer/test/unit/data/ff-inst.exe" +archive = "firefox-148.0.source.tar.xz" +description = "Remove obfuscated Windows executable test fixture flagged by AZL signing-pipeline AV scanner" + +[[components.firefox.overlays]] +type = "file-remove" +file = "dom/base/crashtests/607222.html" +archive = "firefox-148.0.source.tar.xz" +description = "Remove crashtest HTML fixture flagged by AZL signing-pipeline AV scanner" [[components.firefox.source-files]] filename = "firefox-148.0.source.tar.xz" -hash = "c9c9f29fbd8f889bf3cf3d88776e1a62da7b2a65d386538d2bd048dd70caaaf8324adb5303a5fa9aa73c2cf6eb9f89cb4b34f9e67c4208d88636dd5376af90a9" +hash = "4c536519140f142f3803351a5dafb936c076534c6e806af6b368f14bba88f3cdf91bfa695445035aa7b6720dec41dc2d7cd1af6cdf4510115d79bc2fcda26665" hash-type = "SHA512" -origin = { type = "download", uri = "https://azltempstaginglookaside.blob.core.windows.net/repo/pkgs_modified/firefox/firefox-148.0.source.tar.xz/sha512/c9c9f29fbd8f889bf3cf3d88776e1a62da7b2a65d386538d2bd048dd70caaaf8324adb5303a5fa9aa73c2cf6eb9f89cb4b34f9e67c4208d88636dd5376af90a9/firefox-148.0.source.tar.xz" } +origin = { type = "overlay" } replace-upstream = true -replace-reason = "AZL-repacked tarball with malware-flagged upstream test fixtures stripped (trips RPM signing pipeline); see modify_source.sh REMOVE_PATHS" +replace-reason = "Upstream source tarball contains test fixtures flagged by the signing-pipeline scanner; archive overlays remove them before SRPM creation." diff --git a/base/comps/firefox/modify_source.sh b/base/comps/firefox/modify_source.sh deleted file mode 100755 index 81acbff97f9..00000000000 --- a/base/comps/firefox/modify_source.sh +++ /dev/null @@ -1,154 +0,0 @@ -#!/usr/bin/env bash -# -# Reproducibly rebuild firefox-.source.tar.xz with a curated set of -# files stripped out (see REMOVE_PATHS below). These are upstream Mozilla -# test fixtures flagged by the AZL RPM signing pipeline as obfuscated / -# malware-like content (e.g. an obfuscated Windows executable used only by -# media-sniffer unit tests, crashtest HTML that trips malware scanners, -# etc.). Such content blocks the SRPM from being published. -# -# This script is fully deterministic: given the same upstream tarball and -# the same REMOVE_PATHS list, it always produces a byte-identical output -# (so the SHA-512 in the `source-files` entry of firefox.comp.toml is -# stable). -# -# Determinism is achieved by: -# * tar --sort=name (stable file order, independent of FS readdir order) -# * --owner=0 --group=0 --numeric-owner (no host-specific uid/gid) -# * --mtime=@ (fixed mtime for every entry) -# * --format=gnu (handles long paths > 100/255 bytes via ././@LongLink; -# ustar would silently drop Firefox test files with very -# long names, breaking the build. gnu is deterministic.) -# * xz -T 4 -9 --block-size=256MiB (deterministic: output depends only on -# these two values, not on host CPU count. Changing -T or -# --block-size changes the SHA-512, so bump the hash in -# firefox.comp.toml if you change them. -e is omitted for -# speed; size penalty is ~1-2%.) -# * LC_ALL=C (locale-independent sort) -# -# Usage: -# modify_source.sh [--workdir DIR] [--keep] -# -# To bump the package version: edit VERSION and UPSTREAM_SHA512 below in -# lockstep, then re-run. There is no CLI flag for VERSION because the -# repacked tarball's hash and the upstream-verification hash are version- -# specific, so they must change together (and the comp.toml hash must be -# updated too). -# -# Output: /firefox-.azl.source.tar.xz (+ .sha512) - -set -euo pipefail - -# Pinned package version. To bump, also update UPSTREAM_SHA512 below and -# the `hash` field in firefox.comp.toml. -VERSION="148.0" -KEEP=0 -# Default workdir lives under the project work dir to comply with AGENTS.md. -# Convention from Task 19805: base/build/work/scratch//. -WORKDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)/base/build/work/scratch/firefox" - -while [[ $# -gt 0 ]]; do - case "$1" in - --workdir) WORKDIR="$2"; shift 2 ;; - --keep) KEEP=1; shift ;; - -h|--help) - sed -n '2,22p' "$0"; exit 0 ;; - *) echo "unknown arg: $1" >&2; exit 2 ;; - esac -done - -UPSTREAM_NAME="firefox-${VERSION}.source.tar.xz" -OUTPUT_NAME="firefox-${VERSION}.azl.source.tar.xz" -TOPDIR="firefox-${VERSION}" - -# Files (relative to ${TOPDIR}) to strip from the upstream tarball. These trip -# the AZL RPM signing pipeline (obfuscated/malware-flagged content in upstream -# test fixtures). Add new entries here as they are discovered. Every change -# to this list alters the repacked SHA-512 — bump the `hash` in -# firefox.comp.toml accordingly. -REMOVE_PATHS=( - "toolkit/components/mediasniffer/test/unit/data/ff-inst.exe" - "dom/base/crashtests/607222.html" -) - -# Known upstream SHA-512 (from specs/f/firefox/sources). Bump when version changes. -UPSTREAM_SHA512="b0e862091f3a07a02890f6414e77b433893364a8beaf522d440e97ed0060c9b14bdb2fffdecdf12dca849efce8c57d95a534b23e04259d83a96ee8f29e078349" - -# Fixed mtime for every entry in the repacked tarball: -# 2020-01-01T00:00:00Z (1577836800). Any fixed epoch works; do not change -# without also bumping the `hash` in firefox.comp.toml. -MTIME_EPOCH=1577836800 - -UPSTREAM_URL="https://archive.mozilla.org/pub/firefox/releases/${VERSION}/source/${UPSTREAM_NAME}" - -mkdir -p "${WORKDIR}" -cd "${WORKDIR}" - -echo "[1/5] downloading ${UPSTREAM_NAME}" -if [[ ! -f "${UPSTREAM_NAME}" ]]; then - curl -fsSL --retry 3 -o "${UPSTREAM_NAME}.part" "${UPSTREAM_URL}" - mv "${UPSTREAM_NAME}.part" "${UPSTREAM_NAME}" -fi - -echo "[2/5] verifying upstream SHA-512" -echo "${UPSTREAM_SHA512} ${UPSTREAM_NAME}" | sha512sum -c - - -echo "[3/5] extracting" -rm -rf "${TOPDIR}" -# Use multi-threaded xz for the *decompress* — output goes to disk, no -# determinism requirement here. -XZ_OPT="-T0" tar -xJf "${UPSTREAM_NAME}" - -echo "[4/5] removing ${#REMOVE_PATHS[@]} file(s) from tarball" -for rel in "${REMOVE_PATHS[@]}"; do - full="${TOPDIR}/${rel}" - if [[ ! -f "${full}" ]]; then - echo "ERROR: expected file not found in upstream tarball: ${full}" >&2 - exit 1 - fi - echo " - ${full}" - rm -f "${full}" -done - -echo "[5/5] repacking deterministically -> ${OUTPUT_NAME}" -rm -f "${OUTPUT_NAME}" -# Build the file list with a stable, locale-independent sort. Pass it to tar -# via --files-from so `tar --sort=name` only has to do a final stable sort. -LC_ALL=C find "${TOPDIR}" -print0 \ - | LC_ALL=C sort -z \ - | LC_ALL=C tar \ - --create \ - --format=gnu \ - --sort=name \ - --owner=0 --group=0 --numeric-owner \ - --mtime="@${MTIME_EPOCH}" \ - --null --files-from=- \ - | xz -T 4 -9 --block-size=268435456 -c > "${OUTPUT_NAME}" - -sha512sum "${OUTPUT_NAME}" | tee "${OUTPUT_NAME}.sha512" - -if [[ "${KEEP}" -eq 0 ]]; then - rm -rf "${TOPDIR}" -fi - -cat <&2 - echo " expected: ${UPSTREAM_SHA512}" >&2 - echo " computed: ${COMPUTED_UPSTREAM_SHA512}" >&2 - exit 1 -fi - -# --- Extract + strip -------------------------------------------------------- - -echo "[4/5] Extracting and stripping ${#REMOVE_PATHS[@]} fixture(s) from ${UPSTREAM_TOPDIR}" -rm -rf "${WORKDIR}/${UPSTREAM_TOPDIR}" -# `--no-same-owner` / `--no-same-permissions` prevent tar from applying the -# archive's uid/gid/mode bits to the extracted tree. They are already the -# default for non-root users, but explicit hardening makes the script safe -# to run under sudo (where the defaults flip) and defends against any -# setuid/setgid bits or unexpected ownership in the upstream tarball. -# Deterministic owner/group is re-asserted in the repack step below. -tar -C "${WORKDIR}" --no-same-owner --no-same-permissions -xf "${UPSTREAM_CACHE}" -for REMOVE_PATH in "${REMOVE_PATHS[@]}"; do - if [[ ! -f "${WORKDIR}/${UPSTREAM_TOPDIR}/${REMOVE_PATH}" ]]; then - echo "ERROR: expected '${UPSTREAM_TOPDIR}/${REMOVE_PATH}' not present in upstream tarball" >&2 - exit 1 - fi - echo " stripping ${UPSTREAM_TOPDIR}/${REMOVE_PATH}" - rm -f "${WORKDIR}/${UPSTREAM_TOPDIR}/${REMOVE_PATH}" -done - -# --- Repack deterministically ----------------------------------------------- - -echo "[5/5] Repacking deterministically as ${UPSTREAM_FILENAME}" -# Deterministic flags: -# --sort=name stable entry order -# --owner=0 --group=0 no host uid/gid leakage -# --numeric-owner force numeric uid/gid -# --mtime=@ fixed mtime -# --format=gnu handles long paths deterministically -# LC_ALL=C pins sort collation so --sort=name is locale-independent. -# gzip -n strips the original filename and mtime from the gzip header, -# which would otherwise vary between runs. -9 picks max compression. -MODIFIED_TARBALL="${WORKDIR}/${UPSTREAM_FILENAME}" -rm -f "${MODIFIED_TARBALL}" -LC_ALL=C tar \ - -C "${WORKDIR}" \ - --sort=name \ - --owner=0 --group=0 --numeric-owner \ - --mtime="${DETERMINISTIC_MTIME}" \ - --format=gnu \ - -cf - "${UPSTREAM_TOPDIR}" \ - | gzip -n -9 -c > "${MODIFIED_TARBALL}" - -MODIFIED_SHA512="$(sha512sum "${MODIFIED_TARBALL}" | awk '{print $1}')" -echo "${MODIFIED_SHA512} ${UPSTREAM_FILENAME}" > "${MODIFIED_TARBALL}.sha512" - -echo -echo "================================================================" -echo "DONE" -echo " modified tarball: ${WORKDIR}/${UPSTREAM_FILENAME}" -echo " SHA512: ${MODIFIED_SHA512}" -echo "================================================================" -echo -echo " To upload the modified tarball to the lookaside:" -echo " az storage blob upload \\" -echo " --auth-mode login \\" -echo " --account-name azltempstaginglookaside \\" -echo " --container-name repo \\" -echo " --name \"pkgs_modified/${COMPONENT}/${UPSTREAM_FILENAME}/sha512/${MODIFIED_SHA512}/${UPSTREAM_FILENAME}\" \\" -echo " --file \"${WORKDIR}/${UPSTREAM_FILENAME}\"" diff --git a/base/comps/kf6-karchive/kf6-karchive.comp.toml b/base/comps/kf6-karchive/kf6-karchive.comp.toml index 23b4fc399a2..3e0de273626 100644 --- a/base/comps/kf6-karchive/kf6-karchive.comp.toml +++ b/base/comps/kf6-karchive/kf6-karchive.comp.toml @@ -12,16 +12,26 @@ # upstream's CMake gates them on BUILD_TESTING=ON, which we don't set), so # stripping these test fixtures is functionally inert. # -# Replace upstream Source0 with a deterministically-repacked tarball produced -# by base/comps/kf6-karchive/modify_source.sh. The upstream filename is -# preserved so `replace-upstream = true` swaps the entry in place in the -# Fedora `sources` manifest -- no spec edit required. +# Archive overlays strip these scanner-flagged fixtures from upstream Source0 +# during source preparation, avoiding a separate modified-source tarball. [components.kf6-karchive] +[[components.kf6-karchive.overlays]] +type = "file-remove" +file = "autotests/data/password_protected.7z" +archive = "karchive-6.23.0.tar.xz" +description = "Remove password-protected 7-Zip test fixture flagged by AZL signing-pipeline AV scanner" + +[[components.kf6-karchive.overlays]] +type = "file-remove" +file = "autotests/data/zip64_extra_zip64_size_first.zip.gz" +archive = "karchive-6.23.0.tar.xz" +description = "Remove ZIP64 edge-case test fixture flagged by AZL signing-pipeline AV scanner" + [[components.kf6-karchive.source-files]] filename = "karchive-6.23.0.tar.xz" -hash = "dc92a030772bfea4fd270e0bf5aa1e6b9f0bb45fed19ad8c2c992fd8f36238c4730efebe7ac2d950c6be91213cd062afd0f69f404733678e511c74b94d09ad4a" +hash = "a880069c33572d8c0f86bd535ce591eb8bb66a416ec992f7f8964935dd480bfa1c9a15f7ebf16bc7d0dde7afdeb2f68a5ea739ce820887cc855ad731c3c7df3f" hash-type = "SHA512" -origin = { type = "download", uri = "https://azltempstaginglookaside.blob.core.windows.net/repo/pkgs_modified/kf6-karchive/karchive-6.23.0.tar.xz/sha512/dc92a030772bfea4fd270e0bf5aa1e6b9f0bb45fed19ad8c2c992fd8f36238c4730efebe7ac2d950c6be91213cd062afd0f69f404733678e511c74b94d09ad4a/karchive-6.23.0.tar.xz" } +origin = { type = "overlay" } replace-upstream = true -replace-reason = "AZL-repacked tarball with autotest fixtures stripped that trip anti-malware scanning on the AZL RPM-signing pipeline: autotests/data/password_protected.7z (password-protected 7-Zip) and autotests/data/zip64_extra_zip64_size_first.zip.gz (ZIP64 edge-case fixture whose inner .zip the scanner rejects after decompressing the .gz wrapper). The autotests are not built or run in our spec (no %check, BUILD_TESTING is off), so removing these test fixtures is functionally inert. See modify_source.sh." +replace-reason = "Upstream autotest fixtures trigger signing-pipeline scanning and are not built or run; archive overlays remove them before SRPM creation." diff --git a/base/comps/kf6-karchive/modify_source.sh b/base/comps/kf6-karchive/modify_source.sh deleted file mode 100755 index 6e9b449e6b7..00000000000 --- a/base/comps/kf6-karchive/modify_source.sh +++ /dev/null @@ -1,139 +0,0 @@ -#!/usr/bin/env bash -# -# kf6-karchive: deterministic strip-and-repack of upstream `karchive-6.23.0.tar.xz` -# with autotest fixtures that trip anti-malware scanning on the AZL -# RPM-signing pipeline removed. Rationale lives in the comp.toml `replace-reason` field. -# -# Usage: bash base/comps/kf6-karchive/modify_source.sh -# Output: base/build/work/scratch/kf6-karchive/karchive-6.23.0.tar.xz (+ .sha512) -# The upstream tarball is cached under a `.upstream` suffix; re-runs reuse it. - -set -euo pipefail - -# --- Constants -------------------------------------------------------------- - -readonly COMPONENT="kf6-karchive" -readonly UPSTREAM_VERSION="6.23.0" -# KDE stable URL is .../stable/frameworks/./. -readonly UPSTREAM_MAJMIN="${UPSTREAM_VERSION%.*}" -readonly UPSTREAM_FILENAME="karchive-${UPSTREAM_VERSION}.tar.xz" -readonly UPSTREAM_TOPDIR="karchive-${UPSTREAM_VERSION}" -readonly UPSTREAM_URL="https://download.kde.org/stable/frameworks/${UPSTREAM_MAJMIN}/${UPSTREAM_FILENAME}" - -readonly UPSTREAM_SHA512="28e10e9de84304a0d025fd1304738de2fc15812cbca33c77ed174e3ec614ebd4b2ff2896380b600f978682cdecdb464e1b8bd0abacde1d3d92197d18d6957cd8" - -# Paths (relative to ${UPSTREAM_TOPDIR}) to strip. Each is a karchive autotest -# fixture flagged as an encrypted or unscannable payload by anti-malware -# scanning on the AZL RPM-signing pipeline. The autotests are not built or -# run in our spec (no %check, BUILD_TESTING is off), so stripping fixtures -# is functionally inert. -# -# - autotests/data/password_protected.7z -# Deliberately password-protected 7-Zip archive. -# - autotests/data/zip64_extra_zip64_size_first.zip.gz -# Gzipped ZIP64 edge-case fixture; the scanner decompresses the .gz -# wrapper and the inner .zip trips its detector. -readonly REMOVE_PATHS=( - "autotests/data/password_protected.7z" - "autotests/data/zip64_extra_zip64_size_first.zip.gz" -) - -# Deterministic-repack mtime: 2020-01-01T00:00:00Z (1577836800). -# Any fixed epoch works; do not change without also bumping the -# `hash` in kf6-karchive.comp.toml. -readonly DETERMINISTIC_MTIME="@1577836800" - -# --- Work directory --------------------------------------------------------- - -SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" -REPO_ROOT="$(cd "${SCRIPT_DIR}/../../.." && pwd)" -WORKDIR="${REPO_ROOT}/base/build/work/scratch/${COMPONENT}" - -mkdir -p "${WORKDIR}" -cd "${WORKDIR}" - -echo "[1/5] Working in ${WORKDIR}" - -# --- Download upstream ------------------------------------------------------ -# -# The upstream tarball is cached under a `.upstream` suffix so that -# the repacked output written at the canonical `${UPSTREAM_FILENAME}` -# path below cannot clobber the cache on re-runs. Treat the cache -# as authoritative only after SHA-512 verification. - -UPSTREAM_CACHE="${WORKDIR}/${UPSTREAM_FILENAME}.upstream" - -if [[ ! -f "${UPSTREAM_CACHE}" ]]; then - echo "[2/5] Downloading ${UPSTREAM_FILENAME} from ${UPSTREAM_URL}" - curl -fsSL --retry 3 -o "${UPSTREAM_CACHE}.part" "${UPSTREAM_URL}" - mv "${UPSTREAM_CACHE}.part" "${UPSTREAM_CACHE}" -else - echo "[2/5] Using cached upstream tarball ${UPSTREAM_CACHE}" -fi - -# --- Verify upstream SHA-512 ------------------------------------------------ - -echo "[3/5] Verifying upstream SHA-512" -COMPUTED_UPSTREAM_SHA512="$(sha512sum "${UPSTREAM_CACHE}" | awk '{print $1}')" -if [[ "${COMPUTED_UPSTREAM_SHA512}" != "${UPSTREAM_SHA512}" ]]; then - echo "ERROR: upstream SHA-512 mismatch (cache may be corrupt; delete ${UPSTREAM_CACHE} and re-run)" >&2 - echo " expected: ${UPSTREAM_SHA512}" >&2 - echo " computed: ${COMPUTED_UPSTREAM_SHA512}" >&2 - exit 1 -fi - -# --- Extract + strip -------------------------------------------------------- - -echo "[4/5] Extracting and stripping ${#REMOVE_PATHS[@]} fixture(s) from ${UPSTREAM_TOPDIR}" -rm -rf "${WORKDIR}/${UPSTREAM_TOPDIR}" -tar -C "${WORKDIR}" -xf "${UPSTREAM_CACHE}" -for REMOVE_PATH in "${REMOVE_PATHS[@]}"; do - if [[ ! -f "${WORKDIR}/${UPSTREAM_TOPDIR}/${REMOVE_PATH}" ]]; then - echo "ERROR: expected '${UPSTREAM_TOPDIR}/${REMOVE_PATH}' not present in upstream tarball" >&2 - exit 1 - fi - echo " stripping ${UPSTREAM_TOPDIR}/${REMOVE_PATH}" - rm -f "${WORKDIR}/${UPSTREAM_TOPDIR}/${REMOVE_PATH}" -done - -# --- Repack deterministically ----------------------------------------------- - -echo "[5/5] Repacking deterministically as ${UPSTREAM_FILENAME}" -# Deterministic flags: -# --sort=name stable entry order -# --owner=0 --group=0 no host uid/gid leakage -# --numeric-owner force numeric uid/gid -# --mtime=@ fixed mtime -# --format=gnu handles long paths deterministically -# LC_ALL=C pins sort collation so --sort=name is locale-independent. -# xz -T 1 forces single-threaded encoding; multi-threaded xz splits -# the stream into non-reproducible blocks unless --block-size is -# also pinned, and the savings are marginal for a tarball this size. -MODIFIED_TARBALL="${WORKDIR}/${UPSTREAM_FILENAME}" -rm -f "${MODIFIED_TARBALL}" -LC_ALL=C tar \ - -C "${WORKDIR}" \ - --sort=name \ - --owner=0 --group=0 --numeric-owner \ - --mtime="${DETERMINISTIC_MTIME}" \ - --format=gnu \ - -cf - "${UPSTREAM_TOPDIR}" \ - | xz -T 1 -9 -c > "${MODIFIED_TARBALL}" - -MODIFIED_SHA512="$(sha512sum "${MODIFIED_TARBALL}" | awk '{print $1}')" -echo "${MODIFIED_SHA512} ${UPSTREAM_FILENAME}" > "${MODIFIED_TARBALL}.sha512" - -echo -echo "================================================================" -echo "DONE" -echo " modified tarball: ${WORKDIR}/${UPSTREAM_FILENAME}" -echo " SHA512: ${MODIFIED_SHA512}" -echo "================================================================" -echo -echo " To upload the modified tarball to the lookaside:" -echo " az storage blob upload \\" -echo " --auth-mode login \\" -echo " --account-name azltempstaginglookaside \\" -echo " --container-name repo \\" -echo " --name \"pkgs_modified/${COMPONENT}/${UPSTREAM_FILENAME}/sha512/${MODIFIED_SHA512}/${UPSTREAM_FILENAME}\" \\" -echo " --file \"${WORKDIR}/${UPSTREAM_FILENAME}\"" diff --git a/base/comps/libabigail/libabigail.comp.toml b/base/comps/libabigail/libabigail.comp.toml index fce2d75e19a..13a112f03fd 100644 --- a/base/comps/libabigail/libabigail.comp.toml +++ b/base/comps/libabigail/libabigail.comp.toml @@ -10,27 +10,30 @@ # across separated-debuginfo + dwz layouts. The scanner flags both # .debug files as "packer_high_entropy:eod". # -# Replace upstream Source0 with a deterministically-repacked tarball produced -# by base/comps/libabigail/modify_source.sh, which strips the entire -# PR30329/ fixture directory so nothing in-tree references the missing -# files. The two corresponding `InOutSpec in_out_specs[]` entries in +# Archive overlays strip the entire PR30329/ fixture directory from upstream +# Source0 so nothing in-tree references the missing files. The two +# corresponding `InOutSpec in_out_specs[]` entries in # tests/test-abidiff-exit.cc are dropped by a companion overlay patch # (`tests-drop-PR30329-fixture-entries.patch`, applied below), keeping -# `make check` green. The upstream filename is preserved so -# `replace-upstream = true` swaps the entry in place in the Fedora `sources` -# manifest -- no spec edit required. +# `make check` green. This avoids a separate modified-source tarball. [components.libabigail] -[[components.libabigail.source-files]] -filename = "libabigail-2.9.tar.xz" -hash = "efa38b7de791d97910e292dc638537c98d920a68201110727bb5c2d6a6055b6da24beace05db5d540ef4349ce2b4f1592a6aceb4e4249e30a179a037bec2f5d4" -hash-type = "SHA512" -origin = { type = "download", uri = "https://azltempstaginglookaside.blob.core.windows.net/repo/pkgs_modified/libabigail/libabigail-2.9.tar.xz/sha512/efa38b7de791d97910e292dc638537c98d920a68201110727bb5c2d6a6055b6da24beace05db5d540ef4349ce2b4f1592a6aceb4e4249e30a179a037bec2f5d4/libabigail-2.9.tar.xz" } -replace-upstream = true -replace-reason = "Repacked source tarball with tests/data/test-abidiff-exit/PR30329/ removed (two libsqlite3.so.0.8.6.debug fixtures inside it were flagged as packer_high_entropy:eod by the AZL signing-pipeline AV scanner). The matching InOutSpec entries in tests/test-abidiff-exit.cc are dropped by the companion overlay patch tests-drop-PR30329-fixture-entries.patch. See modify_source.sh." +[[components.libabigail.overlays]] +type = "file-remove" +file = "tests/data/test-abidiff-exit/PR30329/**" +archive = "libabigail-2.9.tar.xz" +description = "Remove PR30329 fixture directory (two libsqlite3.so.0.8.6.debug files flagged as packer_high_entropy:eod by AZL signing-pipeline AV scanner)" [[components.libabigail.overlays]] description = "Drop the two tests/test-abidiff-exit.cc InOutSpec entries that exercise the PR30329 fixture set (removed from the AZL-repacked Source0 because its two libsqlite3.so.0.8.6.debug files are flagged packer_high_entropy:eod by the AZL signing-pipeline AV scanner). Without this patch `make check` fails trying to open the missing fixtures." type = "patch-add" file = "tests-drop-PR30329-fixture-entries.patch" source = "tests-drop-PR30329-fixture-entries.patch" + +[[components.libabigail.source-files]] +filename = "libabigail-2.9.tar.xz" +hash = "7efb30a2b9838fd4c00290f89b994acb57f03982e3f23464bd8a405f51a9c6cfb23eff29ff2e5d20a2394661a9741546e11852e86cd02627431a146b99330f7d" +hash-type = "SHA512" +origin = { type = "overlay" } +replace-upstream = true +replace-reason = "The PR30329 test fixture directory contains debuginfo files flagged by signing-pipeline scanning; the archive overlay removes it and a companion patch removes its tests." diff --git a/base/comps/libabigail/modify_source.sh b/base/comps/libabigail/modify_source.sh deleted file mode 100644 index 396f2d44b2e..00000000000 --- a/base/comps/libabigail/modify_source.sh +++ /dev/null @@ -1,168 +0,0 @@ -#!/usr/bin/env bash -# -# libabigail: deterministic strip-and-repack of upstream `libabigail-2.9.tar.xz` -# with the PR30329 testsuite fixture set (which trips anti-malware scanning on -# the AZL RPM-signing pipeline) removed. The corresponding two entries in -# `tests/test-abidiff-exit.cc` that exercise the removed fixture are dropped -# by a companion overlay patch (see `libabigail.comp.toml`); this script does -# file removal only, no in-tarball source patching. -# Rationale lives in the comp.toml `replace-reason` field. -# -# Usage: bash base/comps/libabigail/modify_source.sh -# Output: base/build/work/scratch/libabigail/libabigail-2.9.tar.xz (+ .sha512) -# The upstream tarball is cached under a `.upstream` suffix; re-runs reuse it. - -set -euo pipefail - -# Pin umask so the extraction step below produces the same mode bits -# regardless of the caller's umask. With `--no-same-permissions`, tar ANDs -# each entry's mode against `~umask`, so e.g. umask 077 would silently strip -# group/other read bits and change the bytes of the repacked tarball. The -# repack step does not re-assert per-file modes (only owner/group/mtime), so -# this pin is what guarantees a byte-identical output across machines. -umask 022 - -# --- Constants -------------------------------------------------------------- - -readonly COMPONENT="libabigail" -readonly UPSTREAM_VERSION="2.9" -readonly UPSTREAM_FILENAME="${COMPONENT}-${UPSTREAM_VERSION}.tar.xz" -readonly UPSTREAM_TOPDIR="${COMPONENT}-${UPSTREAM_VERSION}" -readonly UPSTREAM_URL="https://mirrors.kernel.org/sourceware/libabigail/${UPSTREAM_FILENAME}" - -readonly UPSTREAM_SHA512="5bdf5ec49a5931a61bf28317b41eee583d6277d00ac621b2d2a97bbc0d816c3662bcfe13a5ac7aeee11c947afb69a5a0a9a8015fcebad09965b45af9b1e23606" - -# Directory (relative to ${UPSTREAM_TOPDIR}) to strip in its entirety. The -# PR30329 fixture set is a libabigail abidiff regression test built around a -# pair of stripped sqlite3 shared libraries + their separated debuginfo + -# dwz-multifile components. The two `libsqlite3.so.0.8.6.debug` separated- -# debuginfo files inside it are flagged as encrypted/unscannable payloads by -# the AV scanner ("packer_high_entropy:eod") in the AZL RPM-signing pipeline. -# We strip the whole PR30329/ directory (not just the two .debug files) so -# nothing in the tarball still references the missing pieces; the two -# corresponding `InOutSpec` entries in tests/test-abidiff-exit.cc are dropped -# by the companion overlay patch -# `tests-drop-PR30329-fixture-entries.patch` (see libabigail.comp.toml) so -# `make check` still passes. -readonly REMOVE_DIRS=( - "tests/data/test-abidiff-exit/PR30329" -) - -# Deterministic-repack mtime: 2020-01-01T00:00:00Z (1577836800). -# Any fixed epoch works; do not change without also bumping the -# `hash` in libabigail.comp.toml. -readonly DETERMINISTIC_MTIME="@1577836800" - -# --- Work directory --------------------------------------------------------- - -SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" -REPO_ROOT="$(cd "${SCRIPT_DIR}/../../.." && pwd)" -WORKDIR="${REPO_ROOT}/base/build/work/scratch/${COMPONENT}" - -mkdir -p "${WORKDIR}" -cd "${WORKDIR}" - -echo "[1/5] Working in ${WORKDIR}" - -# --- Download upstream ------------------------------------------------------ -# -# The upstream tarball is cached under a `.upstream` suffix so that -# the repacked output written at the canonical `${UPSTREAM_FILENAME}` -# path below cannot clobber the cache on re-runs. Treat the cache -# as authoritative only after SHA-512 verification. - -UPSTREAM_CACHE="${WORKDIR}/${UPSTREAM_FILENAME}.upstream" - -if [[ ! -f "${UPSTREAM_CACHE}" ]]; then - echo "[2/5] Downloading ${UPSTREAM_FILENAME} from ${UPSTREAM_URL}" - # `--proto` / `--proto-redir` restrict the initial request *and* any - # redirect target to HTTPS, so a downgrade to plain HTTP is refused. - curl -fsSL --retry 3 \ - --proto '=https' --proto-redir '=https' \ - -o "${UPSTREAM_CACHE}.part" "${UPSTREAM_URL}" - mv "${UPSTREAM_CACHE}.part" "${UPSTREAM_CACHE}" -else - echo "[2/5] Using cached upstream tarball ${UPSTREAM_CACHE}" -fi - -# --- Verify upstream SHA-512 ------------------------------------------------ - -echo "[3/5] Verifying upstream SHA-512" -COMPUTED_UPSTREAM_SHA512="$(sha512sum "${UPSTREAM_CACHE}" | awk '{print $1}')" -if [[ "${COMPUTED_UPSTREAM_SHA512}" != "${UPSTREAM_SHA512}" ]]; then - echo "ERROR: upstream SHA-512 mismatch (cache may be corrupt; delete ${UPSTREAM_CACHE} and re-run)" >&2 - echo " expected: ${UPSTREAM_SHA512}" >&2 - echo " computed: ${COMPUTED_UPSTREAM_SHA512}" >&2 - exit 1 -fi - -# --- Extract + strip -------------------------------------------------------- - -echo "[4/5] Extracting and stripping ${#REMOVE_DIRS[@]} fixture dir(s) from ${UPSTREAM_TOPDIR}" -rm -rf "${WORKDIR}/${UPSTREAM_TOPDIR}" -# `--no-same-owner` / `--no-same-permissions` prevent tar from applying the -# archive's uid/gid/mode bits to the extracted tree. They are already the -# default for non-root users, but explicit hardening makes the script safe -# to run under sudo (where the defaults flip) and defends against any -# setuid/setgid bits or unexpected ownership in the upstream tarball. -# Deterministic owner/group is re-asserted in the repack step below. -tar -C "${WORKDIR}" --no-same-owner --no-same-permissions -xf "${UPSTREAM_CACHE}" -for REMOVE_DIR in "${REMOVE_DIRS[@]}"; do - if [[ ! -d "${WORKDIR}/${UPSTREAM_TOPDIR}/${REMOVE_DIR}" ]]; then - echo "ERROR: expected '${UPSTREAM_TOPDIR}/${REMOVE_DIR}' not present in upstream tarball" >&2 - exit 1 - fi - echo " stripping ${UPSTREAM_TOPDIR}/${REMOVE_DIR}" - rm -rf "${WORKDIR}/${UPSTREAM_TOPDIR}/${REMOVE_DIR}" -done - -# --- Repack deterministically ----------------------------------------------- - -echo "[5/5] Repacking deterministically as ${UPSTREAM_FILENAME}" -# Deterministic flags: -# --sort=name stable entry order -# --owner=0 --group=0 no host uid/gid leakage -# --numeric-owner force numeric uid/gid -# --mtime=@ fixed mtime -# --format=gnu handles long paths deterministically -# LC_ALL=C pins sort collation so --sort=name is locale-independent. -# xz -9e -T1 picks max compression with single-threaded output (multi-threaded -# xz produces non-deterministic byte streams). The upstream tarball is .xz so -# we re-emit .xz to keep the filename and Source0 unchanged. -# -# Heads-up: this step is slow. libabigail-2.9 unpacks to ~990 MiB (the source -# tree is dominated by abidiff regression-test fixtures), so the single- -# threaded `xz -9e` pass below is on the order of minutes, not seconds. -# Reference timing on a 12th-gen Intel desktop (i9-12900K, 12 vCPUs): ~6-7 -# minutes wall time for the full tar+xz pipeline (xz dominates; tar itself -# is a few seconds). The download (~500 MiB) and extract/strip steps before -# this finish in well under a minute on the same hardware. Slower CPUs can -# easily push this past 10 minutes -- so if it looks hung, give it time. -MODIFIED_TARBALL="${WORKDIR}/${UPSTREAM_FILENAME}" -rm -f "${MODIFIED_TARBALL}" -LC_ALL=C tar \ - -C "${WORKDIR}" \ - --sort=name \ - --owner=0 --group=0 --numeric-owner \ - --mtime="${DETERMINISTIC_MTIME}" \ - --format=gnu \ - -cf - "${UPSTREAM_TOPDIR}" \ - | xz -9e -T1 -c > "${MODIFIED_TARBALL}" - -MODIFIED_SHA512="$(sha512sum "${MODIFIED_TARBALL}" | awk '{print $1}')" -echo "${MODIFIED_SHA512} ${UPSTREAM_FILENAME}" > "${MODIFIED_TARBALL}.sha512" - -echo -echo "================================================================" -echo "DONE" -echo " modified tarball: ${WORKDIR}/${UPSTREAM_FILENAME}" -echo " SHA512: ${MODIFIED_SHA512}" -echo "================================================================" -echo -echo " To upload the modified tarball to the lookaside:" -echo " az storage blob upload \\" -echo " --auth-mode login \\" -echo " --account-name azltempstaginglookaside \\" -echo " --container-name repo \\" -echo " --name \"pkgs_modified/${COMPONENT}/${UPSTREAM_FILENAME}/sha512/${MODIFIED_SHA512}/${UPSTREAM_FILENAME}\" \\" -echo " --file \"${WORKDIR}/${UPSTREAM_FILENAME}\"" diff --git a/base/comps/libkml/libkml.comp.toml b/base/comps/libkml/libkml.comp.toml index b6251c7f145..e8b21a8883c 100644 --- a/base/comps/libkml/libkml.comp.toml +++ b/base/comps/libkml/libkml.comp.toml @@ -1,9 +1,28 @@ [components.libkml] +# Remove decompression-bomb test fixture flagged by AV scanner +[[components.libkml.overlays]] +type = "file-remove" +file = "testdata/kmz/bad-too-large.kmz" +archive = "libkml-1.3.0.tar.gz" +description = "Remove crafted decompression-bomb KMZ fixture flagged by AZL signing-pipeline AV scanner" + +# Surgically remove the TEST_F block that exercises the stripped fixture. +# The sed range `TEST_F(ZipFileTest, TestBadTooLarge) {` through the next +# column-0 `}` is safe because nested braces inside the test body are +# always indented. +[[components.libkml.overlays]] +type = "file-search-replace" +file = "tests/kml/base/zip_file_test.cc" +archive = "libkml-1.3.0.tar.gz" +regex = 'TEST_F\(ZipFileTest, TestBadTooLarge\) \{[^}]*\}\n' +replacement = '' +description = "Remove TestBadTooLarge test block that references stripped bad-too-large.kmz fixture" + [[components.libkml.source-files]] filename = "libkml-1.3.0.tar.gz" -hash = "6f93fcd390c6b21e307638df5d85b15dcb81af81c7409797a247b322df843fb1c36dc6c5eb7dc1346adbf228e09ec4ffdbf450dfe1f9b73cbc32e8803a098c58" +hash = "38bf79f2741166ab088a82b4673dcc27da42484f2577940608f1b4d1807ccf83353e640726f392c9fe269218a705a785380feeb7a8f6fb89eae71eb3810605bc" hash-type = "SHA512" -origin = { type = "download", uri = "https://azltempstaginglookaside.blob.core.windows.net/repo/pkgs_modified/libkml/libkml-1.3.0.tar.gz/sha512/6f93fcd390c6b21e307638df5d85b15dcb81af81c7409797a247b322df843fb1c36dc6c5eb7dc1346adbf228e09ec4ffdbf450dfe1f9b73cbc32e8803a098c58/libkml-1.3.0.tar.gz" } +origin = { type = "overlay" } replace-upstream = true -replace-reason = "Strips the scanner-flagged `testdata/kmz/bad-too-large.kmz` test fixture (a benign-by-intent crafted-malformed ZIP whose on-disk shape matches malicious-archive heuristics) and the matching `ZipFileTest.TestBadTooLarge` block from `tests/kml/base/zip_file_test.cc`. See `modify_source.sh` next to this file." +replace-reason = "The crafted bad-too-large.kmz test fixture trips signing-pipeline scanning; archive overlays remove the fixture and its dependent test." diff --git a/base/comps/libkml/modify_source.sh b/base/comps/libkml/modify_source.sh deleted file mode 100755 index f8df9c1930e..00000000000 --- a/base/comps/libkml/modify_source.sh +++ /dev/null @@ -1,255 +0,0 @@ -#!/usr/bin/env bash -# -# libkml — strip benign-but-scanner-tripping test fixtures from upstream -# tarball. -# -# Background -# ---------- -# An automated FS-aware deep scanner in the package-signing pipeline -# flags `testdata/kmz/bad-too-large.kmz` inside the upstream -# `libkml-1.3.0.tar.gz` tarball as malicious. -# -# Upstream intent of the fixture -# ------------------------------ -# `bad-too-large.kmz` is an intentionally-malformed ZIP whose -# uncompressed-size field is crafted to report 4,294,967,294 bytes -# (decompression-bomb shape). It is a test input by design, used by -# libkml's Google Test suite to verify parser-rejection of crafted -# decompression-bomb archives. The fixture is exercised by exactly -# one test case, `ZipFileTest.TestBadTooLarge` in -# `tests/kml/base/zip_file_test.cc`. The scanner flags the fixture -# because its on-disk shape matches the malicious-archive heuristics -# the test was designed to defeat. -# -# What this script does -# --------------------- -# 1. Removes `testdata/kmz/bad-too-large.kmz` from the tarball. -# 2. Surgically deletes the `ZipFileTest.TestBadTooLarge` block from -# `tests/kml/base/zip_file_test.cc`. Every sibling test in that -# file remains intact. The other 7 "bad" / "overflow" KMZ test -# fixtures shipped under `testdata/kmz/` are kept as-is (the -# scanner cleared them in the latest scan pass). -# 3. Repacks the tarball deterministically so the SHA512 is stable -# across re-runs. -# -# Loss in %check -# -------------- -# One Google Test case (out of >200 in the libkml test suite) is no -# longer compiled. The runtime code path it exercises (ZIP open -# rejection of a crafted oversized-uncompressed-size record) is -# unchanged and remains exercised indirectly by sibling tests that -# feed valid and invalid inputs through the same open / parse APIs. -# -# Block-removal anchoring -# ----------------------- -# Each `TEST_F` block has a unique `^TEST_F(Class, Name) {$` opening -# line and a matching `^}$` closing line at column 0. The remover -# uses the sed range `/^TEST_F(Class, Name) {$/,/^}$/d`, which is -# safe in this codebase because: -# * Nested braces inside the test body are always indented, so -# they never match `^}$`. -# * The closing `}` of an enclosing `namespace { ... }` is -# followed by `// end namespace ...`, so it does not match -# `^}$` either. -# Pre- and post-condition greps in `delete_test_f` enforce these -# invariants for every block. -# -# Reproducibility notes -# --------------------- -# - `tar --sort=name --mtime=...` produces a byte-deterministic output. -# - `gzip -n` strips mtime/filename metadata from the gzip header for -# the same reason. -# -# Output location -# --------------- -# The script writes its outputs to `base/build/work/scratch/libkml/` -# (resolved relative to the repository root). This path is covered by -# the repository's top-level `.gitignore` via `build/`, so no -# component-level `.gitignore` is needed and no script artefact can be -# accidentally committed. -# -# Usage: -# bash modify_source.sh -# -# Outputs (under base/build/work/scratch/libkml/): -# libkml-1.3.0-azl-stripped.tar.gz -# libkml-1.3.0-azl-stripped.tar.gz.sha512 -# -# After running, upload `libkml-1.3.0-azl-stripped.tar.gz` as the blob -# payload at the lookaside URL pattern (modified container) for -# filename `libkml-1.3.0.tar.gz`. The exact URL is printed by this -# script. - -set -euo pipefail - -UPSTREAM_URL="https://github.com/libkml/libkml/archive/1.3.0/libkml-1.3.0.tar.gz" -ORIGINAL_NAME="libkml-1.3.0.tar.gz" -ORIGINAL_SHA512="aa48158103d3af764bf98c1fb4cf3e1356b9cc6c8e79d80b96850916f0a8ccb1dac3a46427735dd0bf20647daa047d10e722ac3da2a214d4c1559bf6d5d7c853" -MODIFIED_NAME="libkml-1.3.0-azl-stripped.tar.gz" -EXTRACTED_DIRNAME="libkml-1.3.0" - -# Files to remove from the upstream tarball. See the header comment -# for the per-fixture upstream intent and the `TEST_F` block(s) that -# reference each one. -declare -a STRIP_PATHS=( - "${EXTRACTED_DIRNAME}/testdata/kmz/bad-too-large.kmz" -) - -# TEST_F blocks to surgically remove. Format: "file|Class|Name". -# Each entry is processed by `delete_test_f` below. -declare -a TEST_F_REMOVALS=( - "${EXTRACTED_DIRNAME}/tests/kml/base/zip_file_test.cc|ZipFileTest|TestBadTooLarge" -) - -# After all strips and TEST_F removals, every fixture basename below -# must have ZERO remaining references anywhere under `src/` or `tests/`. -declare -a FIXTURE_BASENAMES=( - "bad-too-large.kmz" -) - -# Sibling TEST_F cases that MUST survive in each touched `.cc` file. -# Drift here means the sed range was too greedy and stole an adjacent -# block. -declare -a TEST_F_RETAINED=( - "${EXTRACTED_DIRNAME}/tests/kml/base/zip_file_test.cc|ZipFileTest|TestBadPkZipData" - "${EXTRACTED_DIRNAME}/tests/kml/base/zip_file_test.cc|ZipFileTest|TestMaxUncompressedSize" - "${EXTRACTED_DIRNAME}/tests/kml/base/zip_file_test.cc|ZipFileTest|TestOpenFromString" - "${EXTRACTED_DIRNAME}/tests/kml/base/zip_file_test.cc|ZipFileTest|TestOpenFromFile" - "${EXTRACTED_DIRNAME}/tests/kml/base/zip_file_test.cc|ZipFileTest|TestCreate" - "${EXTRACTED_DIRNAME}/tests/kml/base/zip_file_test.cc|ZipFileTest|TestAddEntryBad" -) - -# Surgically delete a single `TEST_F(Class, Name) { ... }` block. -# Pre- and post-condition checks guard against drift. -delete_test_f() { - local file="$1" - local class="$2" - local name="$3" - - if [[ ! -f "${file}" ]]; then - echo "ERROR: file not present: ${file}" >&2 - exit 1 - fi - if ! grep -qE "^TEST_F\(${class}, ${name}\) \{$" "${file}"; then - echo "ERROR: TEST_F(${class}, ${name}) header not found in ${file}" >&2 - exit 1 - fi - - # sed range: from the unique `TEST_F(Class, Name) {` opening line - # through the next column-0 `}` (= the closing brace of the test - # body). Both anchors are validated by the surrounding greps. - sed -i "/^TEST_F(${class}, ${name}) {$/,/^}$/d" "${file}" - - if grep -qE "^TEST_F\(${class}, ${name}\) \{$" "${file}"; then - echo "ERROR: TEST_F(${class}, ${name}) still present after delete in ${file}" >&2 - exit 1 - fi -} - -SCRIPT_DIR="$(cd "$(dirname "$(realpath "$0")")" && pwd)" -REPO_ROOT="$(cd "${SCRIPT_DIR}/../../.." && pwd)" -WORKDIR="${REPO_ROOT}/base/build/work/scratch/libkml" -mkdir -p "${WORKDIR}" -cd "${WORKDIR}" - -echo "[1/6] Downloading ${ORIGINAL_NAME} from upstream into ${WORKDIR}" -curl -fsSL --retry 3 -o "${ORIGINAL_NAME}" "${UPSTREAM_URL}" - -echo "[2/6] Verifying original SHA512" -COMPUTED_ORIGINAL_SHA512=$(sha512sum "${ORIGINAL_NAME}" | awk '{print $1}') -if [[ "${COMPUTED_ORIGINAL_SHA512}" != "${ORIGINAL_SHA512}" ]]; then - echo "ERROR: upstream SHA512 mismatch" >&2 - echo " expected: ${ORIGINAL_SHA512}" >&2 - echo " computed: ${COMPUTED_ORIGINAL_SHA512}" >&2 - exit 1 -fi - -echo "[3/6] Extracting" -rm -rf "${EXTRACTED_DIRNAME}" -tar -xzf "${ORIGINAL_NAME}" - -echo "[4/6] Stripping flagged paths" -for p in "${STRIP_PATHS[@]}"; do - if [[ ! -e "${p}" ]]; then - echo "ERROR: expected path not present in upstream: ${p}" >&2 - exit 1 - fi - rm -v "${p}" -done - -echo "[5/6] Removing dependent TEST_F blocks" -for entry in "${TEST_F_REMOVALS[@]}"; do - IFS='|' read -r f cls nm <<<"${entry}" - echo " - ${f}: TEST_F(${cls}, ${nm})" - delete_test_f "${f}" "${cls}" "${nm}" -done - -echo "[5a/6] Post-condition: stripped fixture names must have no remaining references" -pushd "${EXTRACTED_DIRNAME}" >/dev/null -for fixture in "${FIXTURE_BASENAMES[@]}"; do - # Match the basename surrounded by ZIP-style "/kmz/" prefix to avoid - # `bad.kmz` matching `zermatt-photo-bad.kmz` (and similar substring - # collisions). All upstream references to these fixtures use that - # exact prefix. - if grep -rln --include='*.cc' --include='*.h' --include='*.cmake' --include='CMakeLists.txt' \ - -- "/kmz/${fixture}" src/ tests/ 2>/dev/null; then - echo "ERROR: post-edit source tree still references /kmz/${fixture}" >&2 - exit 1 - fi -done -popd >/dev/null - -echo "[5b/6] Post-condition: sibling TEST_F cases must still be present" -for entry in "${TEST_F_RETAINED[@]}"; do - IFS='|' read -r f cls nm <<<"${entry}" - if ! grep -qE "^TEST_F\(${cls}, ${nm}\) \{$" "${f}"; then - echo "ERROR: retained sibling TEST_F(${cls}, ${nm}) missing from ${f}; sed range too greedy" >&2 - exit 1 - fi -done - -echo "[6/6] Repacking deterministically as ${MODIFIED_NAME}" -# --sort=name : deterministic file ordering -# --mtime : pin mtime to a fixed epoch so the output is reproducible -# --owner=0 --group=0 --numeric-owner : strip uid/gid/uname/gname -# gzip -n : do not store the mtime/filename in the gzip header -rm -f "${MODIFIED_NAME}" -LC_ALL=C tar --sort=name \ - --mtime='2024-01-01 00:00:00 UTC' \ - --owner=0 --group=0 --numeric-owner \ - -cf - "${EXTRACTED_DIRNAME}" | gzip -n -9 > "${MODIFIED_NAME}" - -MODIFIED_SHA512=$(sha512sum "${MODIFIED_NAME}" | awk '{print $1}') -echo "${MODIFIED_SHA512} ${MODIFIED_NAME}" > "${MODIFIED_NAME}.sha512" - -cat </base/build/work/scratch/rubygem-pdf-reader/. - -set -euo pipefail - -VERSION="2.4.2" -ORIGINAL_NAME="pdf-reader-${VERSION}-spec.txz" -MODIFIED_NAME="pdf-reader-${VERSION}-spec-azl-fixtures-stripped.txz" - -# Upstream Source1 lookaside URL (standard `pkgs/` prefix; published -# alongside `Source0`, the .gem from rubygems.org). -UPSTREAM_SHA512="2421b51f1c8d8dbc23f9b542a1c0f32542667639c859656b44b67b34e0262a132d443419604469d7fb1ef7b2861401fd4f8fb7fb94bc14f8d11fc3c04abe3c3c" -UPSTREAM_URL="https://azltempstaginglookaside.blob.core.windows.net/repo/pkgs/rubygem-pdf-reader/${ORIGINAL_NAME}/sha512/${UPSTREAM_SHA512}/${ORIGINAL_NAME}" - -# PDF test fixtures removed from spec/data/ to avoid scan failures on -# the SRPM. All 47 are benign upstream regression PDFs (deliberately- -# malformed structures, encrypted-cipher variants) not consumed at -# AZL runtime. Paths are relative to the extracted top-level dir of -# the tarball (which has no version-named top-level directory; spec/ -# sits at the root). Sorted alphabetically. -FIXTURES_TO_REMOVE=( - spec/data/broken_string.pdf - spec/data/clearscan-with-image-removed.pdf - spec/data/clearscan.pdf - spec/data/content_stream_as_array.pdf - spec/data/content_stream_missing_final_operator.pdf - spec/data/content_stream_refers_to_invalid_font.pdf - spec/data/difference_table2.pdf - spec/data/difference_table_encrypted.pdf - spec/data/encrypted_version1_revision2_128bit_rc4_blank_user_password.pdf - spec/data/encrypted_version1_revision2_128bit_rc4_no_doc_id.pdf - spec/data/encrypted_version1_revision2_40bit_rc4_user_pass_apples.pdf - spec/data/encrypted_version2_revision3_128bit_rc4_blank_user_pass.pdf - spec/data/encrypted_version2_revision3_128bit_rc4_user_pass_apples.pdf - spec/data/encrypted_version4_revision4_128bit_aes_user_pass_apples_enc_metadata.pdf - spec/data/encrypted_version4_revision4_128bit_aes_user_pass_apples_unenc_metadata.pdf - spec/data/encrypted_version4_revision4_128bit_rc4_user_pass_apples_enc_metadata.pdf - spec/data/encrypted_version4_revision4_128bit_rc4_user_pass_apples_unenc_metadata.pdf - spec/data/encrypted_version5_revision5_256bit_aes_user_pass_apples_enc_metadata.pdf - spec/data/encrypted_version5_revision5_256bit_aes_user_pass_apples_unenc_metadata.pdf - spec/data/encrypted_version5_revision6_256bit_aes_user_pass_apples_enc_metadata.pdf - spec/data/encrypted_version5_revision6_256bit_aes_user_pass_apples_unenc_metadata.pdf - spec/data/form_xobject_recursive.pdf - spec/data/hard_lock_under_osx.pdf - spec/data/indirect_mediabox.pdf - spec/data/invisible.pdf - spec/data/junk_prefix.pdf - spec/data/junk_prefix_1024.pdf - spec/data/kids-as-direct-objects.pdf - spec/data/mediabox_and_cropbox_are_references.pdf - spec/data/mediabox_missing.pdf - spec/data/one-byte-identity.pdf - spec/data/overlapping-chars-x-fake-bold.pdf - spec/data/overlapping-chars-xy-fake-bold.pdf - spec/data/pages_object_missing_type.pdf - spec/data/rotate-180.pdf - spec/data/rotate-then-undo.pdf - spec/data/screwey_xref_offsets.pdf - spec/data/standard_font_with_no_difference.pdf - spec/data/symbol.pdf - spec/data/times-with-control-character.pdf - spec/data/truetype-arial.pdf - spec/data/type1-arial.pdf - spec/data/type3_font.pdf - spec/data/type3_font_with_rare_font_matrix.pdf - spec/data/zapf.pdf - spec/data/zeroed_xref_entry.pdf - spec/data/zlib_stream_issue.pdf -) - -# Helper file whose missing-fixture branch is patched from -# `raise ArgumentError, ...` to `skip "..."` so rspec gracefully -# marks affected examples pending instead of failing them. -HELPER_FILE="spec/support/reader_spec_helper.rb" - -SCRIPT_DIR="$(cd "$(dirname "$(realpath "$0")")" && pwd)" -REPO_ROOT="$(cd "${SCRIPT_DIR}/../../.." && pwd)" -WORKDIR="${REPO_ROOT}/base/build/work/scratch/rubygem-pdf-reader" -mkdir -p "${WORKDIR}" -cd "${WORKDIR}" - -echo "[1/6] Downloading ${ORIGINAL_NAME}" -[[ -f "${ORIGINAL_NAME}" ]] || curl -fsSL --retry 3 -o "${ORIGINAL_NAME}" "${UPSTREAM_URL}" - -echo "[2/6] Verifying upstream SHA512" -computed=$(sha512sum "${ORIGINAL_NAME}" | awk '{print $1}') -if [[ "${computed}" != "${UPSTREAM_SHA512}" ]]; then - echo "ERROR: upstream SHA512 mismatch" >&2 - echo " expected: ${UPSTREAM_SHA512}" >&2 - echo " computed: ${computed}" >&2 - exit 1 -fi - -echo "[3/6] Extracting" -EXTRACT_DIR="extracted" -rm -rf "${EXTRACT_DIR}" -mkdir "${EXTRACT_DIR}" -tar -xf "${ORIGINAL_NAME}" -C "${EXTRACT_DIR}" - -echo "[4/6] Removing ${#FIXTURES_TO_REMOVE[@]} flagged PDF fixtures" -for rel in "${FIXTURES_TO_REMOVE[@]}"; do - target="${EXTRACT_DIR}/${rel}" - if [[ ! -f "${target}" ]]; then - echo "ERROR: expected fixture not present in upstream tarball: ${rel}" >&2 - exit 1 - fi - rm -f "${target}" -done - -echo "[5/6] Patching ${HELPER_FILE} (skip only for stripped fixtures; still raise otherwise)" -helper="${EXTRACT_DIR}/${HELPER_FILE}" -if [[ ! -f "${helper}" ]]; then - echo "ERROR: helper missing from upstream tarball: ${HELPER_FILE}" >&2 - exit 1 -fi -# The original helper has a single `else / raise ArgumentError, ...` arm for -# the missing-fixture case. We surgically insert a new `elsif` arm BEFORE the -# existing `else`, gated by an explicit allow-list of the stripped basenames -# (with `.pdf` extension). Any other missing fixture still raises, -# so an unrelated upstream change that drops a different fixture surfaces as -# a hard error rather than a silent skip. -if ! grep -qF 'raise ArgumentError, "#{valid_filename} not found"' "${helper}"; then - echo "ERROR: anchor line not found in ${HELPER_FILE} -- upstream may have changed" >&2 - exit 1 -fi -# Build the Ruby allow-list literal from FIXTURES_TO_REMOVE basenames so -# script + comp.toml stay in lock-step. -allow_list_lines="" -for rel in "${FIXTURES_TO_REMOVE[@]}"; do - allow_list_lines+=" ${rel##spec/data/} -" -done -# Pass values to Python via env vars (heredoc + bash quoting do not interop -# cleanly with Python literals for multi-line strings). -export HELPER_PATH="${helper}" -export ALLOW_LIST_LINES="${allow_list_lines}" -python3 <<'PY' -import io, os -path = os.environ["HELPER_PATH"] -allow_list_lines = os.environ["ALLOW_LIST_LINES"] -expected = ( - ' else\n' - ' raise ArgumentError, "#{valid_filename} not found"\n' - ' end' -) -replacement = ( - ' elsif AZL_STRIPPED_FIXTURES.include?("#{base}.pdf")\n' - ' skip "PDF fixture #{File.basename(valid_filename)} stripped for downstream scan compliance"\n' - + expected -) -with io.open(path, "r", encoding="utf-8") as fh: - text = fh.read() -if text.count(expected) != 1: - raise SystemExit( - f"expected exactly 1 occurrence of else/raise anchor block, found {text.count(expected)}" - ) -text = text.replace(expected, replacement) -module_anchor = "module ReaderSpecHelper\n" -if module_anchor not in text: - raise SystemExit("module anchor not found") -const_block = ( - "\n" - " # AZL downstream: fixtures stripped from spec/data/ for package-\n" - " # signing-scan compliance. pdf_spec_file() skips (rather than raises)\n" - " # ONLY for entries in this set; any other missing fixture still raises.\n" - " AZL_STRIPPED_FIXTURES = %w[\n" - + allow_list_lines - + " ].freeze\n" -) -text = text.replace(module_anchor, module_anchor + const_block, 1) -with io.open(path, "w", encoding="utf-8") as fh: - fh.write(text) -PY -unset HELPER_PATH ALLOW_LIST_LINES -# Post-condition checks. -grep -qF 'AZL_STRIPPED_FIXTURES = %w[' "${helper}" || { echo "ERROR: allow-list constant not injected" >&2; exit 1; } -grep -qF 'elsif AZL_STRIPPED_FIXTURES.include?' "${helper}" || { echo "ERROR: elsif clause not inserted" >&2; exit 1; } -grep -qF 'raise ArgumentError, "#{valid_filename} not found"' "${helper}" || { echo "ERROR: original raise clause was unexpectedly removed" >&2; exit 1; } - -echo "[6/6] Repacking deterministically" -# Stable byte output: sorted names, fixed mtime, zeroed owner/group, -# single-threaded xz. -rm -f "${MODIFIED_NAME}" -( - cd "${EXTRACT_DIR}" - tar --sort=name \ - --mtime='2024-01-01 00:00:00 UTC' \ - --owner=0 --group=0 --numeric-owner \ - -cf - . -) | xz -T1 -9e > "${MODIFIED_NAME}" - -MODIFIED_SHA512=$(sha512sum "${MODIFIED_NAME}" | awk '{print $1}') -echo "${MODIFIED_SHA512} ${MODIFIED_NAME}" > "${MODIFIED_NAME}.sha512" - -cat <&2 - echo " expected: ${ORIGINAL_SHA512}" >&2 - echo " computed: ${COMPUTED_ORIGINAL_SHA512}" >&2 - exit 1 -fi - -echo "[3/5] Extracting" -rm -rf "${EXTRACTED_DIRNAME}" -tar -xzf "${ORIGINAL_NAME}" - -echo "[4/5] Stripping flagged paths" -for p in "${STRIP_PATHS[@]}"; do - if [[ ! -e "${p}" ]]; then - echo "ERROR: expected path not present in upstream: ${p}" >&2 - exit 1 - fi - rm -v "${p}" -done - -# Drop `test-pe` from the autotools `check_PROGRAMS` list in -# `Makefile.am`. `test-pe` references the four hash-named fixtures in -# `tests/data/` we just stripped (see STRIP_PATHS above); leaving the -# test in the autotools TESTS list would make `make check` fail at -# runtime. The spec runs `autoreconf --force --install` in %prep, so -# the regenerated `Makefile.in` picks up the edit and `test-pe` is -# omitted from the build's test driver entirely. `test-pe.c` itself -# stays in the tarball — harmless, unused. -# -# We also drop the now-orphan `test_pe_SOURCES`, `test_pe_LDADD`, -# `test_pe_LDFLAGS` variable declarations. `automake` runs with -# `-Werror` in upstream's configuration; leaving the orphan vars -# triggers a "variable defined but no program has 'test_pe' as -# canonical name (possible typo)" warning that fails autoreconf. -MAKEFILE_AM="${EXTRACTED_DIRNAME}/Makefile.am" -if ! grep -qE '^ test-pe \\$' "${MAKEFILE_AM}"; then - echo "ERROR: expected ' test-pe \\' line not found in ${MAKEFILE_AM}" >&2 - exit 1 -fi -if ! grep -qE '^test_pe_SOURCES\s*=' "${MAKEFILE_AM}"; then - echo "ERROR: expected 'test_pe_SOURCES =' line not found in ${MAKEFILE_AM}" >&2 - exit 1 -fi -sed -i '/^ test-pe \\$/d' "${MAKEFILE_AM}" -sed -i '/^test_pe_SOURCES\s*=/d;/^test_pe_LDADD\s*=/d;/^test_pe_LDFLAGS\s*=/d' "${MAKEFILE_AM}" -echo " dropped 'test-pe' entry and its test_pe_{SOURCES,LDADD,LDFLAGS} variables from ${MAKEFILE_AM}" - -echo "[5/5] Repacking deterministically as ${MODIFIED_NAME}" -# --sort=name : deterministic file ordering -# --mtime : pin mtime to a fixed epoch so the output is reproducible -# --owner=0 --group=0 --numeric-owner : strip uid/gid/uname/gname -# gzip -n : do not store the mtime/filename in the gzip header -rm -f "${MODIFIED_NAME}" -tar --sort=name \ - --mtime='2024-01-01 00:00:00 UTC' \ - --owner=0 --group=0 --numeric-owner \ - -cf - "${EXTRACTED_DIRNAME}" | gzip -n -9 > "${MODIFIED_NAME}" - -MODIFIED_SHA512=$(sha512sum "${MODIFIED_NAME}" | awk '{print $1}') -echo "${MODIFIED_SHA512} ${MODIFIED_NAME}" > "${MODIFIED_NAME}.sha512" - -cat < - 1.27.1-15 +- refactor: replace source modification scripts with TOML overlays + * Wed May 13 2026 Andrew Phelps - 1.27.1-14 - fix(apache-commons-compress): strip scanner-flagged test fixtures diff --git a/specs/a/apache-commons-compress/sources b/specs/a/apache-commons-compress/sources index fbeb8cc40f4..5deef5289dd 100644 --- a/specs/a/apache-commons-compress/sources +++ b/specs/a/apache-commons-compress/sources @@ -1 +1 @@ -SHA512 (commons-compress-1.27.1-src.tar.gz) = aeecee8776c60a549cbca9fc3c0312c8c98a953d024db64e5c480c643357be7b270193df69fc2172632e472feb9b9221eedf3b40dd933997b881a398dfb3a02b +SHA512 (commons-compress-1.27.1-src.tar.gz) = cff58f1c9cb95e96e95230af6523b2e593ac5d1c775110d5845012775920468f8fc9013a0bdba6022cc6dc3391b5d92bd59cf6eacf4c10c82ef9b7792d63601f diff --git a/specs/e/espeak-ng/espeak-ng.spec b/specs/e/espeak-ng/espeak-ng.spec index a0a10866eb1..3664a1c3f7d 100644 --- a/specs/e/espeak-ng/espeak-ng.spec +++ b/specs/e/espeak-ng/espeak-ng.spec @@ -3,7 +3,7 @@ Name: espeak-ng Version: 1.51.1 -Release: 14%{?dist} +Release: 15%{?dist} Summary: eSpeak NG Text-to-Speech License: GPL-3.0-only AND GPL-3.0-or-later AND Apache-2.0 AND BSD-2-Clause AND Unicode-DFS-2016 AND CC-BY-SA-3.0 diff --git a/specs/e/espeak-ng/sources b/specs/e/espeak-ng/sources index cf5c1585909..ce39029b589 100644 --- a/specs/e/espeak-ng/sources +++ b/specs/e/espeak-ng/sources @@ -1 +1 @@ -SHA512 (espeak-ng-1.51.1.tar.gz) = 84685a24e93e743c4f0be73dd9d553a96ed95bc8c2c0c683d84935183e517ae039066de93e3f83617b2114b27b427ec18ff8169972188d2a81b55f839c7c726f +SHA512 (espeak-ng-1.51.1.tar.gz) = 5de425918c64f621545f5cf025519bc92a7a2325751894bccf80eeb279e508b135914c1b8dddbe5681d4914639025e9535727fc2b5080d060e10e0b6108323f2 diff --git a/specs/e/exfatprogs/exfatprogs.spec b/specs/e/exfatprogs/exfatprogs.spec index 7cf644eab8f..077b2b23aa6 100644 --- a/specs/e/exfatprogs/exfatprogs.spec +++ b/specs/e/exfatprogs/exfatprogs.spec @@ -2,7 +2,7 @@ ## (rpmautospec version 0.8.3) ## RPMAUTOSPEC: autorelease, autochangelog %define autorelease(e:s:pb:n) %{?-p:0.}%{lua: - release_number = 4; + release_number = 5; base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}")); print(release_number + base_release_number - 1); }%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}} @@ -70,6 +70,9 @@ autoreconf -vif %changelog ## START: Generated by rpmautospec +* Tue Jul 21 2026 Antonio Salinas - 1.3.1-5 +- refactor: replace source modification scripts with TOML overlays + * Wed May 13 2026 Pawel Winogrodzki - 1.3.1-4 - exfatprogs: serve modified Source0 with upstream tests/ stripped diff --git a/specs/e/exfatprogs/sources b/specs/e/exfatprogs/sources index b23049d383f..cf1ba4db25c 100644 --- a/specs/e/exfatprogs/sources +++ b/specs/e/exfatprogs/sources @@ -1 +1 @@ -SHA512 (exfatprogs-1.3.1.tar.xz) = ded26326feab2b0013c1031fda7add53100e0581711555b8a64e8036448775a51304e4c5c368049cb26633dbf02e814b6f97bd804cafff324921a8e6a3a975d0 +SHA512 (exfatprogs-1.3.1.tar.xz) = defc23281368b219d3a00a1b6da97728ddbcd70804aa447e211cc3404a49d9bfc5bf7604b4d140e2d7f9281230f1b46f6ace580fc6a8a14f5c3b8902821b2338 diff --git a/specs/f/firefox/firefox.azl.macros b/specs/f/firefox/firefox.azl.macros index 0aa211138a9..c69169bee35 100644 --- a/specs/f/firefox/firefox.azl.macros +++ b/specs/f/firefox/firefox.azl.macros @@ -1,3 +1,3 @@ # Macros file automatically generated by azldev. # Do not edit manually; changes will be overwritten. -%azl_release 5 +%azl_release 6 diff --git a/specs/f/firefox/sources b/specs/f/firefox/sources index 38d70f86ccc..fa3f81b9d33 100644 --- a/specs/f/firefox/sources +++ b/specs/f/firefox/sources @@ -4,4 +4,4 @@ SHA512 (wasi-sdk-25.tar.gz) = 1285981d26aa5eff27f08ed4b409909639ddcd62c94ee0cff7 SHA512 (wasm-component-ld-vendor.tar.xz) = 707d942d31455ae0a4f68bf419fb09a20407b6747f831ca554dcd00925b7ea98ef4d03a8652b6d2ae54cf48d7ad15d85aa7eb8d0778ef66b89593eaa8b5c3465 SHA512 (cbindgen-vendor.tar.xz) = bea420e66bdd1c7c944655dd3e01abd6e7d6ac4b245c7ee190f31d800f7786f21e5cae11715b479bf795f4369d18c40dc12df19e0b643664f2f78e5c8a681415 SHA512 (firefox-langpacks-148.0-20260223.tar.xz) = 7e5d283e1a83787984e63901c915f6672eae48c38c5fd64b9f8055f154d83be77f76cb77de2048f2ea263353313a90eefa54b7c173533bec2db4dddf32436302 -SHA512 (firefox-148.0.source.tar.xz) = c9c9f29fbd8f889bf3cf3d88776e1a62da7b2a65d386538d2bd048dd70caaaf8324adb5303a5fa9aa73c2cf6eb9f89cb4b34f9e67c4208d88636dd5376af90a9 +SHA512 (firefox-148.0.source.tar.xz) = 4c536519140f142f3803351a5dafb936c076534c6e806af6b368f14bba88f3cdf91bfa695445035aa7b6720dec41dc2d7cd1af6cdf4510115d79bc2fcda26665 diff --git a/specs/g/gdal/gdal.spec b/specs/g/gdal/gdal.spec index 70f8a8fea31..804ac6654f9 100644 --- a/specs/g/gdal/gdal.spec +++ b/specs/g/gdal/gdal.spec @@ -58,7 +58,7 @@ Name: gdal Version: 3.11.5 -Release: 3%{?dist} +Release: 4%{?dist} Summary: GIS file format library License: MIT URL: http://www.gdal.org diff --git a/specs/g/gdal/sources b/specs/g/gdal/sources index f4c6c40d1ec..1bfbea19975 100644 --- a/specs/g/gdal/sources +++ b/specs/g/gdal/sources @@ -1,2 +1,2 @@ SHA512 (gdal-3.11.5-fedora.tar.xz) = a5492d5f45a35bbadc7c4af2b24ed40743c7f36e4c8b0824373495b3d2c032eb940e1239b64252920db9dd5bc0b2253052dbaac27ee9c69005b0957c5f6700a3 -SHA512 (gdalautotest-3.11.5.tar.gz) = a39cc826885a2336c80545203947c4693851aae3de02b980be25b4b579658e6314e058dc228660294b2370242df8f298c4fe64c6d3b1cd0bf5adf56b3e321b77 +SHA512 (gdalautotest-3.11.5.tar.gz) = d60d672407f1821a85ce55f708df264d41af60f7863fbd275f369b6a95adc1882bfb9b9f6b8c5e6f773afb754238d3a0c4a9aec91d2c8cd9f6db8c41cf6a59d7 diff --git a/specs/k/kf6-karchive/kf6-karchive.spec b/specs/k/kf6-karchive/kf6-karchive.spec index 4083b7ac0ec..c2624aaf9d2 100644 --- a/specs/k/kf6-karchive/kf6-karchive.spec +++ b/specs/k/kf6-karchive/kf6-karchive.spec @@ -5,7 +5,7 @@ Name: kf6-%{framework} Version: 6.23.0 -Release: 3%{?dist} +Release: 4%{?dist} Summary: KDE Frameworks 6 Tier 1 addon with archive functions License: LGPL-2.0-or-later AND BSD-2-Clause URL: https://invent.kde.org/frameworks/%{framework} diff --git a/specs/k/kf6-karchive/sources b/specs/k/kf6-karchive/sources index f5311c074ca..020e39ce02a 100644 --- a/specs/k/kf6-karchive/sources +++ b/specs/k/kf6-karchive/sources @@ -1,2 +1,2 @@ -SHA512 (karchive-6.23.0.tar.xz) = dc92a030772bfea4fd270e0bf5aa1e6b9f0bb45fed19ad8c2c992fd8f36238c4730efebe7ac2d950c6be91213cd062afd0f69f404733678e511c74b94d09ad4a +SHA512 (karchive-6.23.0.tar.xz) = a880069c33572d8c0f86bd535ce591eb8bb66a416ec992f7f8964935dd480bfa1c9a15f7ebf16bc7d0dde7afdeb2f68a5ea739ce820887cc855ad731c3c7df3f SHA512 (karchive-6.23.0.tar.xz.sig) = 80c15a80cbc6c27ff49272e05ad4402e7c93b80f08aae9e2cef0a0159c111a4c0ffb6e093a7049d65fa1366c505f4326a674481438f2f7e19c8522fd657db28a diff --git a/specs/l/libabigail/libabigail.spec b/specs/l/libabigail/libabigail.spec index 37fe3810483..434fd8a74e4 100644 --- a/specs/l/libabigail/libabigail.spec +++ b/specs/l/libabigail/libabigail.spec @@ -9,7 +9,7 @@ Name: libabigail Version: 2.9 -Release: 3%{?dist} +Release: 4%{?dist} Summary: Set of ABI analysis tools License: Apache-2.0 WITH LLVM-exception diff --git a/specs/l/libabigail/sources b/specs/l/libabigail/sources index 55e55c25342..7bf24a64ff4 100644 --- a/specs/l/libabigail/sources +++ b/specs/l/libabigail/sources @@ -1 +1 @@ -SHA512 (libabigail-2.9.tar.xz) = efa38b7de791d97910e292dc638537c98d920a68201110727bb5c2d6a6055b6da24beace05db5d540ef4349ce2b4f1592a6aceb4e4249e30a179a037bec2f5d4 +SHA512 (libabigail-2.9.tar.xz) = 7efb30a2b9838fd4c00290f89b994acb57f03982e3f23464bd8a405f51a9c6cfb23eff29ff2e5d20a2394661a9741546e11852e86cd02627431a146b99330f7d diff --git a/specs/l/libkml/libkml.spec b/specs/l/libkml/libkml.spec index 29ef1f3f97b..9491881b787 100644 --- a/specs/l/libkml/libkml.spec +++ b/specs/l/libkml/libkml.spec @@ -17,7 +17,7 @@ Name: libkml Version: 1.3.0 -Release: 59%{?dist} +Release: 60%{?dist} Summary: Reference implementation of OGC KML 2.2 License: BSD-3-Clause diff --git a/specs/l/libkml/sources b/specs/l/libkml/sources index 81346c35975..4671594330a 100644 --- a/specs/l/libkml/sources +++ b/specs/l/libkml/sources @@ -1,2 +1,2 @@ -SHA512 (libkml-1.3.0.tar.gz) = 6f93fcd390c6b21e307638df5d85b15dcb81af81c7409797a247b322df843fb1c36dc6c5eb7dc1346adbf228e09ec4ffdbf450dfe1f9b73cbc32e8803a098c58 +SHA512 (libkml-1.3.0.tar.gz) = 38bf79f2741166ab088a82b4673dcc27da42484f2577940608f1b4d1807ccf83353e640726f392c9fe269218a705a785380feeb7a8f6fb89eae71eb3810605bc SHA512 (minizip-1.3.0.tar.gz) = 4dab3635c09ba3f3832867b4e03ba9d45b6f1e87b98083a50164e6477b765c927fbf5256fe92860b38690f389ef6e07f56cba020b83bfee86e2b30afc816b906 diff --git a/specs/r/rubygem-pdf-reader/rubygem-pdf-reader.spec b/specs/r/rubygem-pdf-reader/rubygem-pdf-reader.spec index 2f1385bb903..a69538e077a 100644 --- a/specs/r/rubygem-pdf-reader/rubygem-pdf-reader.spec +++ b/specs/r/rubygem-pdf-reader/rubygem-pdf-reader.spec @@ -5,7 +5,7 @@ Name: rubygem-%{gem_name} Version: 2.4.2 -Release: 12%{?dist} +Release: 13%{?dist} Summary: A library for accessing the content of PDF files License: MIT URL: https://github.com/yob/pdf-reader diff --git a/specs/r/rubygem-pdf-reader/sources b/specs/r/rubygem-pdf-reader/sources index 8672f0cb8fb..f2e782bea07 100644 --- a/specs/r/rubygem-pdf-reader/sources +++ b/specs/r/rubygem-pdf-reader/sources @@ -1,2 +1,2 @@ -SHA512 (pdf-reader-2.4.2-spec.txz) = 49de5d0e3bb8067101624ecc00a6e5f646a6dbdb4200343b15b1b268776e2248071056e7c73432a3b038130d7e8d5f81e9911742bc016272335bee18c51fd708 +SHA512 (pdf-reader-2.4.2-spec.txz) = 13d874eed2885e655a0a818e5b2ca4ad8945ab948dc4e92d950e3e7ca2bbc3d0d074f0800ccfa4ffdb0a4b0cec9cbad2583a9048d7876387d23ad61b9225fea6 SHA512 (pdf-reader-2.4.2.gem) = 746a22d871acf23f26557af87b6b9590bdb95df07a5307ed60c4c1dfa4ae9803035cd686c8d648cfc6b46725a5324410dc2e836efd170ed5231b60decd258a9a diff --git a/specs/y/yara/sources b/specs/y/yara/sources index 3010463b8ff..7b28569f392 100644 --- a/specs/y/yara/sources +++ b/specs/y/yara/sources @@ -1 +1 @@ -SHA512 (yara-4.5.4.tar.gz) = 94d4aab0466c847dd04313754767ba7d022bfcd5dba403a260c9a3ff76fb7a8e6d731ad08e40d64e78169b034ae978fb03f617490aff25bf317b39402d7b646b +SHA512 (yara-4.5.4.tar.gz) = 6565e10f54625c3479685af04e356f1986c7ed926e14bf1fa2ccee70120d65ed3db7b15733fe1778846597e4c6bb8fc0a42c036ee941d509eedbebf3cacd5233 diff --git a/specs/y/yara/yara.spec b/specs/y/yara/yara.spec index 45d693623ce..63bfc21045d 100644 --- a/specs/y/yara/yara.spec +++ b/specs/y/yara/yara.spec @@ -2,7 +2,7 @@ ## (rpmautospec version 0.8.3) ## RPMAUTOSPEC: autorelease, autochangelog %define autorelease(e:s:pb:n) %{?-p:0.}%{lua: - release_number = 6; + release_number = 7; base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}")); print(release_number + base_release_number - 1); }%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}} @@ -201,6 +201,9 @@ make check || ( %changelog ## START: Generated by rpmautospec +* Tue Jul 21 2026 Antonio Salinas - 4.5.4-7 +- refactor: replace source modification scripts with TOML overlays + * Mon May 18 2026 Pawel Winogrodzki - 4.5.4-6 - fix(yara): strip 3 more oss-fuzz corpus fixtures flagged by fresh scan