From e7045df4ddb643f606e8768215107f4fad7d07f3 Mon Sep 17 00:00:00 2001 From: Andrew Phelps Date: Tue, 25 Aug 2026 00:34:56 -0700 Subject: [PATCH] fix: ghc-zip-archive - remove flagged files The zip-archive test suite ships tests/zip_with_password.zip, a password-protected (encrypted) fixture that fails the package-signing scan and blocks signing. Remove it with an azldev archive overlay (file-remove) that deterministically repacks the source tarball, and drop the three test cases that read it (testExtractFilesFailOnEncrypted, testPasswordProtectedRead, testIncorrectPasswordRead) via file-search-replace overlays so the rest of the Cabal suite (%bcond tests 1) keeps running. Test-only, not shipped in any binary RPM. --- base/comps/components.toml | 1 - .../ghc-zip-archive/ghc-zip-archive.comp.toml | 46 +++++++++++++++++++ locks/ghc-zip-archive.lock | 2 +- specs/g/ghc-zip-archive/ghc-zip-archive.spec | 5 +- specs/g/ghc-zip-archive/sources | 2 +- 5 files changed, 52 insertions(+), 4 deletions(-) create mode 100644 base/comps/ghc-zip-archive/ghc-zip-archive.comp.toml diff --git a/base/comps/components.toml b/base/comps/components.toml index cf47ecdc76a..5016893013c 100644 --- a/base/comps/components.toml +++ b/base/comps/components.toml @@ -704,7 +704,6 @@ overlay-files = ["overlays/*.overlay.toml"] [components.ghc-xml-conduit] [components.ghc-xml-types] [components.ghc-yaml] -[components.ghc-zip-archive] [components.ghc-zlib] [components.ghostscript] [components.gi-docgen] diff --git a/base/comps/ghc-zip-archive/ghc-zip-archive.comp.toml b/base/comps/ghc-zip-archive/ghc-zip-archive.comp.toml new file mode 100644 index 00000000000..8465822b8f8 --- /dev/null +++ b/base/comps/ghc-zip-archive/ghc-zip-archive.comp.toml @@ -0,0 +1,46 @@ +[components.ghc-zip-archive] + +# Remove the password-protected test zip that fails the package-signing scan. +# The archive is extracted, the matched file dropped, and the tarball +# deterministically repacked; the resulting hash is pinned via the source-files +# entry below. +[[components.ghc-zip-archive.overlays]] +description = "Remove password-protected test fixture zip_with_password.zip" +type = "file-remove" +archive = "zip-archive-0.4.3.2.tar.gz" +file = "tests/zip_with_password.zip" +[components.ghc-zip-archive.overlays.metadata] +category = "azl-security-compliance" +upstream-status = "inapplicable" + +# The encrypted-zip test cases consume the removed fixture. Keep the rest of the +# Cabal suite running (%bcond tests 1) and surgically drop only those cases: their +# TestList entries and their definitions. +[[components.ghc-zip-archive.overlays]] +description = "Drop encrypted-zip cases from the TestList (fixture removed)" +type = "file-search-replace" +archive = "zip-archive-0.4.3.2.tar.gz" +file = "tests/test-zip-archive.hs" +regex = '\n +, testExtractFilesFailOnEncrypted\n +, testPasswordProtectedRead\n +, testIncorrectPasswordRead' +[components.ghc-zip-archive.overlays.metadata] +category = "azl-security-compliance" +upstream-status = "inapplicable" + +[[components.ghc-zip-archive.overlays]] +description = "Drop encrypted-zip test definitions (fixture removed)" +type = "file-search-replace" +archive = "zip-archive-0.4.3.2.tar.gz" +file = "tests/test-zip-archive.hs" +regex = '(?s)testExtractFilesFailOnEncrypted :: FilePath -> Test\n.*?Nothing \(fromEncryptedEntry "INCORRECT" f\)\n\n' +[components.ghc-zip-archive.overlays.metadata] +category = "azl-security-compliance" +upstream-status = "inapplicable" + +# Pin the post-overlay (repacked) tarball, replacing the upstream sources entry. +[[components.ghc-zip-archive.source-files]] +filename = "zip-archive-0.4.3.2.tar.gz" +hash = "e031946f95c5bad31c979405c5853a21c856cb77e2048f0cafaf867e2f4fbdb301d0f015398fce4271ea8263f9759fe1722354b00ee7c1c21a9deaed20b00445" +hash-type = "SHA512" +origin = { type = "overlay" } +replace-upstream = true +replace-reason = "Removes tests/zip_with_password.zip (password-protected test fixture) that fails the package-signing scan, and the three test cases that read it; test-only, not shipped in any binary RPM." diff --git a/locks/ghc-zip-archive.lock b/locks/ghc-zip-archive.lock index 17f4d5d931a..134ec92b7e4 100644 --- a/locks/ghc-zip-archive.lock +++ b/locks/ghc-zip-archive.lock @@ -3,5 +3,5 @@ version = 1 import-commit = '1eb51c9a61d8824ee123fdb2d88058b1ed73ceae' upstream-commit = '1eb51c9a61d8824ee123fdb2d88058b1ed73ceae' manual-bump = 2 -input-fingerprint = 'sha256:d7ae1c32050d6039f9d4043f43106845a00988140dabd019bb043b0b7e9fadeb' +input-fingerprint = 'sha256:1b954df877eb71a8aaf38332d7f06e20bf21c787f5b1d78cfeddf6837a02218e' resolution-input-hash = 'sha256:466421704711c4fd3c71f0b2ed715a0e61d49e3e26f3a2637fee755795849c8e' diff --git a/specs/g/ghc-zip-archive/ghc-zip-archive.spec b/specs/g/ghc-zip-archive/ghc-zip-archive.spec index cb65388e7e9..94419f14b60 100644 --- a/specs/g/ghc-zip-archive/ghc-zip-archive.spec +++ b/specs/g/ghc-zip-archive/ghc-zip-archive.spec @@ -2,7 +2,7 @@ ## (rpmautospec version 0.8.3) ## RPMAUTOSPEC: autorelease, autochangelog %define autorelease(e:s:pb:n) %{?-p:0.}%{lua: - release_number = 8; + release_number = 9; base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}")); print(release_number + base_release_number - 1); }%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}} @@ -180,6 +180,9 @@ dos2unix -k -n %{SOURCE1} %{pkg_name}.cabal %changelog ## START: Generated by rpmautospec +* Tue Aug 25 2026 Andrew Phelps - 0.4.3.2-9 +- fix: ghc-zip-archive - remove flagged files + * Wed Aug 19 2026 reuben olinsky - 0.4.3.2-8 - build: mass rebuild auto-bumpable components diff --git a/specs/g/ghc-zip-archive/sources b/specs/g/ghc-zip-archive/sources index 0f8c5226fff..61523f10eb5 100644 --- a/specs/g/ghc-zip-archive/sources +++ b/specs/g/ghc-zip-archive/sources @@ -1 +1 @@ -SHA512 (zip-archive-0.4.3.2.tar.gz) = 8062598d6403e4f6ebbbb9db09ea04ecb58d4223d38e8b017d5050847d5194fa64c6abeb3d518f1e3bec963b641be8d7bd949a562b69b59feffb8c1e3e69aff6 +SHA512 (zip-archive-0.4.3.2.tar.gz) = e031946f95c5bad31c979405c5853a21c856cb77e2048f0cafaf867e2f4fbdb301d0f015398fce4271ea8263f9759fe1722354b00ee7c1c21a9deaed20b00445