fix: gnome-autoar - remove flagged files - #18617
Closed
Andrew Phelps (anphel31) wants to merge 1 commit into
Closed
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Replaces ESRP-flagged encrypted gnome-autoar test fixtures with a sanitized source archive while retaining the remaining test suite.
Changes:
- Adds a deterministic source-repacking helper.
- Configures azldev to use the staged sanitized archive.
- Refreshes generated source metadata, lock fingerprint, and release.
Reviewed changes
Copilot reviewed 5 out of 6 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
base/comps/gnome-autoar/modify_source.sh |
Removes flagged fixtures and dependent tests. |
base/comps/gnome-autoar/gnome-autoar.comp.toml |
Defines the replacement source archive. |
base/comps/components.toml |
Moves the customized component out of the inline list. |
locks/gnome-autoar.lock |
Refreshes the input fingerprint. |
specs/g/gnome-autoar/gnome-autoar.spec |
Bumps the rendered release. |
specs/g/gnome-autoar/sources |
Records the replacement archive hash. |
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| VERSION="0.4.5" | ||
| ORIGINAL_NAME="gnome-autoar-${VERSION}.tar.xz" | ||
|
|
||
| # Upstream Source0 (download.gnome.org) SHA512, from specs/g/gnome-autoar/sources. |
| cd "${WORKDIR}" | ||
|
|
||
| echo "[1/6] Downloading ${ORIGINAL_NAME}" | ||
| [[ -f "${ORIGINAL_NAME}" ]] || curl -fsSL --retry 3 -o "${ORIGINAL_NAME}" "${UPSTREAM_URL}" |
| ) | xz -T1 -9e > "${ORIGINAL_NAME}.modified" | ||
|
|
||
| MODIFIED_SHA512=$(sha512sum "${ORIGINAL_NAME}.modified" | awk '{print $1}') | ||
| echo "${MODIFIED_SHA512} ${ORIGINAL_NAME}" > "${ORIGINAL_NAME}.sha512" |
gnome-autoar ships three encrypted extract-test fixtures (tests/files/extract/test-encrypted*/input/arextract.zip) that fail the package-signing scan and block signing. %check runs %meson_test, so removing the fixtures also drops the three meson cases that read them (test_encrypted, test_encrypted_request_passphrase, test_encrypted_wrong_passphrase and their registrations); test-only, not shipped in any binary RPM. An azldev archive overlay cannot be used here because the tarball also ships an absolute-target symlink fixture (test-symlink-parent/reference/arextract -> /tmp) that azldev's overlay extractor rejects; instead modify_source.sh repacks the tarball out-of-band and it is served via origin=download.
Andrew Phelps (anphel31)
force-pushed
the
anphel/esrp-fix-gnome-autoar
branch
from
August 26, 2026 04:09
037f660 to
bd9c314
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 5 out of 6 changed files in this pull request and generated no new comments.
Suppressed comments (2)
base/comps/gnome-autoar/modify_source.sh:49
- If
curlexhausts its retries after creating a partial file, the next invocation treats that partial file as the cache, skips the download, and then fails checksum verification until it is manually deleted. Download to a temporary.partpath and rename it only after success, as inbase/comps/espeak-ng/modify_source.sh:63-67.
[[ -f "${ORIGINAL_NAME}" ]] || curl -fsSL --retry 3 -o "${ORIGINAL_NAME}" "${UPSTREAM_URL}"
base/comps/gnome-autoar/modify_source.sh:129
- This checksum entry names the unmodified cached archive, while
MODIFIED_SHA512was calculated from${ORIGINAL_NAME}.modified. Consequently,sha512sum -cagainst the generated sidecar always checks the wrong file and fails. Name the modified output in both the manifest entry and sidecar.
echo "${MODIFIED_SHA512} ${ORIGINAL_NAME}" > "${ORIGINAL_NAME}.sha512"
Member
Author
|
Superseded by #18626 (branch renamed; same change). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Remove three encrypted extract-test fixtures from gnome-autoar and drop the three meson test cases that read them.
gnome-autoar ships three encrypted extract-test fixtures (
tests/files/extract/test-encrypted*/input/arextract.zip, password-protected zips). The package-signing scan can't inspect encrypted archives and rejects the .src.rpm, blocking signing. The files/cases are test-only and not shipped in any binary RPM.%checkruns%meson_test, so removing the fixtures also drops the three meson cases that read them (test_encrypted,test_encrypted_request_passphrase,test_encrypted_wrong_passphraseand their registrations).Why not an azldev archive overlay (as used for the other packages)? The tarball also ships an absolute-target symlink fixture (
tests/files/extract/test-symlink-parent/reference/arextract -> /tmp) that azldev's overlay extractor rejects while extracting the whole archive — before overlays apply. Instead,modify_source.shrepacks the tarball out-of-band and it's served viaorigin=download.azldev comp render --check-onlyreports no drift.