fix: ghc-zip-archive - remove flagged files

base/comps/components.toml

@@ -704,7 +704,6 @@ overlay-files = ["overlays/*.overlay.toml"]
 [components.ghc-xml-conduit]
 [components.ghc-xml-types]
 [components.ghc-yaml]
-[components.ghc-zip-archive]
 [components.ghc-zlib]
 [components.ghostscript]
 [components.gi-docgen]

base/comps/ghc-zip-archive/ghc-zip-archive.comp.toml

@@ -0,0 +1,46 @@
+[components.ghc-zip-archive]
+
+# Remove the password-protected test zip that fails the package-signing scan.
+# The archive is extracted, the matched file dropped, and the tarball
+# deterministically repacked; the resulting hash is pinned via the source-files
+# entry below.
+[[components.ghc-zip-archive.overlays]]
+description = "Remove password-protected test fixture zip_with_password.zip"
+type = "file-remove"
+archive = "zip-archive-0.4.3.2.tar.gz"
+file = "tests/zip_with_password.zip"
+[components.ghc-zip-archive.overlays.metadata]
+category = "azl-security-compliance"
+upstream-status = "inapplicable"
+
+# The encrypted-zip test cases consume the removed fixture. Keep the rest of the
+# Cabal suite running (%bcond tests 1) and surgically drop only those cases: their
+# TestList entries and their definitions.
+[[components.ghc-zip-archive.overlays]]
+description = "Drop encrypted-zip cases from the TestList (fixture removed)"
+type = "file-search-replace"
+archive = "zip-archive-0.4.3.2.tar.gz"
+file = "tests/test-zip-archive.hs"
+regex = '\n +, testExtractFilesFailOnEncrypted\n +, testPasswordProtectedRead\n +, testIncorrectPasswordRead'
+[components.ghc-zip-archive.overlays.metadata]
+category = "azl-security-compliance"
+upstream-status = "inapplicable"
+
+[[components.ghc-zip-archive.overlays]]
+description = "Drop encrypted-zip test definitions (fixture removed)"
+type = "file-search-replace"
+archive = "zip-archive-0.4.3.2.tar.gz"
+file = "tests/test-zip-archive.hs"
+regex = '(?s)testExtractFilesFailOnEncrypted :: FilePath -> Test\n.*?Nothing \(fromEncryptedEntry "INCORRECT" f\)\n\n'
+[components.ghc-zip-archive.overlays.metadata]
+category = "azl-security-compliance"
+upstream-status = "inapplicable"
+
+# Pin the post-overlay (repacked) tarball, replacing the upstream sources entry.
+[[components.ghc-zip-archive.source-files]]
+filename = "zip-archive-0.4.3.2.tar.gz"
+hash = "e031946f95c5bad31c979405c5853a21c856cb77e2048f0cafaf867e2f4fbdb301d0f015398fce4271ea8263f9759fe1722354b00ee7c1c21a9deaed20b00445"
+hash-type = "SHA512"
+origin = { type = "overlay" }
+replace-upstream = true
+replace-reason = "Removes tests/zip_with_password.zip (password-protected test fixture) that fails the package-signing scan, and the three test cases that read it; test-only, not shipped in any binary RPM."

locks/ghc-zip-archive.lock

@@ -3,5 +3,5 @@ version = 1
 import-commit = '1eb51c9a61d8824ee123fdb2d88058b1ed73ceae'
 upstream-commit = '1eb51c9a61d8824ee123fdb2d88058b1ed73ceae'
 manual-bump = 2
-input-fingerprint = 'sha256:d7ae1c32050d6039f9d4043f43106845a00988140dabd019bb043b0b7e9fadeb'
+input-fingerprint = 'sha256:1b954df877eb71a8aaf38332d7f06e20bf21c787f5b1d78cfeddf6837a02218e'
 resolution-input-hash = 'sha256:466421704711c4fd3c71f0b2ed715a0e61d49e3e26f3a2637fee755795849c8e'

specs/g/ghc-zip-archive/ghc-zip-archive.spec

@@ -2,7 +2,7 @@
 ## (rpmautospec version 0.8.3)
 ## RPMAUTOSPEC: autorelease, autochangelog
 %define autorelease(e:s:pb:n) %{?-p:0.}%{lua:
-    release_number = 8;
+    release_number = 9;
     base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}"));
     print(release_number + base_release_number - 1);
 }%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}}
@@ -180,6 +180,9 @@ dos2unix -k -n %{SOURCE1} %{pkg_name}.cabal
 
 %changelog
 ## START: Generated by rpmautospec
+* Tue Aug 25 2026 Andrew Phelps <anphel@microsoft.com> - 0.4.3.2-9
+- fix: ghc-zip-archive - remove flagged files
+
 * Wed Aug 19 2026 reuben olinsky <reubeno@users.noreply.github.com> - 0.4.3.2-8
 - build: mass rebuild auto-bumpable components
 

specs/g/ghc-zip-archive/sources

@@ -1 +1 @@
-SHA512 (zip-archive-0.4.3.2.tar.gz) = 8062598d6403e4f6ebbbb9db09ea04ecb58d4223d38e8b017d5050847d5194fa64c6abeb3d518f1e3bec963b641be8d7bd949a562b69b59feffb8c1e3e69aff6
+SHA512 (zip-archive-0.4.3.2.tar.gz) = e031946f95c5bad31c979405c5853a21c856cb77e2048f0cafaf867e2f4fbdb301d0f015398fce4271ea8263f9759fe1722354b00ee7c1c21a9deaed20b00445