refactor: replace source modification scripts with TOML overlays

.azldev-version

@@ -1 +1 @@
-661c69b6c5b1e3773cd15990765bf7b85e1856da
+4bd46b9023f1eab6ec4f3bef55f4cf517066e494

base/comps/apache-commons-compress/apache-commons-compress.comp.toml

@@ -17,25 +17,37 @@
 # will be skipped/excluded at build time if they reference these
 # fixtures.
 #
-# We replace Source0 (effectively) with a deterministically-repacked
-# tarball that is byte-identical to upstream except for the stripped
-# files. The repack is produced by
-# base/comps/apache-commons-compress/modify_source.sh, which is
-# reproducible — re-running it always yields the same SHA-512. We keep
-# the upstream filename (commons-compress-1.27.1-src.tar.gz) and use the
-# `replace-upstream` mechanism on the source-files entry below to swap it
-# in place in the Fedora `sources` manifest — no spec edit required.
-#
-# When bumping the apache-commons-compress version (or changing
-# REMOVE_PATHS):
-#   1. Edit VERSION and UPSTREAM_SHA512 in modify_source.sh.
-#   2. Re-run the script and copy the new SHA-512 into the source-files entry.
-#   3. Upload the new tarball to the modified-source lookaside (see script output).
+# Archive overlays strip the scanner-flagged fixtures from upstream Source0
+# during source preparation, avoiding a separate modified-source tarball.
+
+[[components.apache-commons-compress.overlays]]
+type = "file-remove"
+file = "src/test/resources/bla.encrypted.7z"
+description = "Remove encrypted 7-Zip test fixture flagged by AZL signing-pipeline AV scanner"
+archive = "commons-compress-1.27.1-src.tar.gz"
+
+[[components.apache-commons-compress.overlays]]
+type = "file-remove"
+file = "src/test/resources/password-encrypted.zip"
+description = "Remove encrypted ZIP test fixture flagged by AZL signing-pipeline AV scanner"
+archive = "commons-compress-1.27.1-src.tar.gz"
+
+[[components.apache-commons-compress.overlays]]
+type = "file-remove"
+file = "src/test/resources/COMPRESS-256.7z"
+description = "Remove crafted 7-Zip test fixture flagged by AZL signing-pipeline AV scanner"
+archive = "commons-compress-1.27.1-src.tar.gz"
+
+[[components.apache-commons-compress.overlays]]
+type = "file-remove"
+file = "src/test/resources/zip64support.tar.bz2"
+description = "Remove crafted tar.bz2 test fixture flagged by AZL signing-pipeline AV scanner"
+archive = "commons-compress-1.27.1-src.tar.gz"
 
 [[components.apache-commons-compress.source-files]]
 filename = "commons-compress-1.27.1-src.tar.gz"
-hash = "aeecee8776c60a549cbca9fc3c0312c8c98a953d024db64e5c480c643357be7b270193df69fc2172632e472feb9b9221eedf3b40dd933997b881a398dfb3a02b"
+hash = "cff58f1c9cb95e96e95230af6523b2e593ac5d1c775110d5845012775920468f8fc9013a0bdba6022cc6dc3391b5d92bd59cf6eacf4c10c82ef9b7792d63601f"
 hash-type = "SHA512"
-origin = { type = "download", uri = "https://azltempstaginglookaside.blob.core.windows.net/repo/pkgs_modified/apache-commons-compress/commons-compress-1.27.1-src.tar.gz/sha512/aeecee8776c60a549cbca9fc3c0312c8c98a953d024db64e5c480c643357be7b270193df69fc2172632e472feb9b9221eedf3b40dd933997b881a398dfb3a02b/commons-compress-1.27.1-src.tar.gz" }
+origin = { type = "overlay"}
 replace-upstream = true
-replace-reason = "AZL-repacked tarball with scanner-flagged encrypted and crafted-archive test fixtures stripped; see modify_source.sh REMOVE_PATHS"
+replace-reason = "Upstream source tarball contains test fixtures flagged as malware by the AZL RPM signing pipeline. These files are not needed at runtime and are removed to allow SRPM publication."

base/comps/espeak-ng/espeak-ng.comp.toml

@@ -12,16 +12,20 @@
 # our spec does not reference it or ship it in any binary RPM, so stripping
 # this file is functionally inert.
 #
-# Replace upstream Source0 with a deterministically-repacked tarball produced
-# by base/comps/espeak-ng/modify_source.sh. The upstream filename is preserved
-# so `replace-upstream = true` swaps the entry in place in the Fedora `sources`
-# manifest without requiring a `Source0`/filename change.
+# Archive overlays strip this scanner-flagged fixture from upstream Source0
+# during source preparation, avoiding a separate modified-source tarball.
 [components.espeak-ng]
 
+[[components.espeak-ng.overlays]]
+type = "file-remove"
+file = "chromium_extension/index.php"
+archive = "espeak-ng-1.51.1.tar.gz"
+description = "Remove PHP webshell demo flagged as PHP/Webshell.NWM by AZL signing-pipeline AV scanner"
+
 [[components.espeak-ng.source-files]]
 filename = "espeak-ng-1.51.1.tar.gz"
-hash = "84685a24e93e743c4f0be73dd9d553a96ed95bc8c2c0c683d84935183e517ae039066de93e3f83617b2114b27b427ec18ff8169972188d2a81b55f839c7c726f"
+hash = "5de425918c64f621545f5cf025519bc92a7a2325751894bccf80eeb279e508b135914c1b8dddbe5681d4914639025e9535727fc2b5080d060e10e0b6108323f2"
 hash-type = "SHA512"
-origin = { type = "download", uri = "https://azltempstaginglookaside.blob.core.windows.net/repo/pkgs_modified/espeak-ng/espeak-ng-1.51.1.tar.gz/sha512/84685a24e93e743c4f0be73dd9d553a96ed95bc8c2c0c683d84935183e517ae039066de93e3f83617b2114b27b427ec18ff8169972188d2a81b55f839c7c726f/espeak-ng-1.51.1.tar.gz" }
+origin = { type = "overlay" }
 replace-upstream = true
-replace-reason = "Strips the `chromium_extension/index.php` demo file flagged as PHP/Webshell.NWM by anti-malware scanners on the AZL RPM-signing pipeline. See `modify_source.sh` next to this file."
+replace-reason = "Upstream source tarball contains the chromium_extension/index.php demo payload, which is removed by the archive overlay to allow SRPM publication."