diff --git a/base/comps/components.toml b/base/comps/components.toml index cf47ecdc76a..5016893013c 100644 --- a/base/comps/components.toml +++ b/base/comps/components.toml @@ -704,7 +704,6 @@ overlay-files = ["overlays/*.overlay.toml"] [components.ghc-xml-conduit] [components.ghc-xml-types] [components.ghc-yaml] -[components.ghc-zip-archive] [components.ghc-zlib] [components.ghostscript] [components.gi-docgen] diff --git a/base/comps/ghc-zip-archive/ghc-zip-archive.comp.toml b/base/comps/ghc-zip-archive/ghc-zip-archive.comp.toml new file mode 100644 index 00000000000..cebfe73458f --- /dev/null +++ b/base/comps/ghc-zip-archive/ghc-zip-archive.comp.toml @@ -0,0 +1,57 @@ +[components.ghc-zip-archive] + +# Remove the password-protected test zip that fails the package-signing scan. +# The archive is extracted, the matched file dropped, and the tarball +# deterministically repacked; the resulting hash is pinned via the source-files +# entry below. +[[components.ghc-zip-archive.overlays]] +description = "Remove password-protected test fixture zip_with_password.zip" +type = "file-remove" +archive = "zip-archive-0.4.3.2.tar.gz" +file = "tests/zip_with_password.zip" +[components.ghc-zip-archive.overlays.metadata] +category = "azl-security-compliance" +upstream-status = "inapplicable" + +# The encrypted-zip test cases consume the removed fixture. Keep the rest of the +# Cabal suite running (%bcond tests 1) and surgically drop only those cases: their +# TestList entries and their definitions. +[[components.ghc-zip-archive.overlays]] +description = "Drop encrypted-zip cases from the TestList (fixture removed)" +type = "file-search-replace" +archive = "zip-archive-0.4.3.2.tar.gz" +file = "tests/test-zip-archive.hs" +regex = '\n +, testExtractFilesFailOnEncrypted\n +, testPasswordProtectedRead\n +, testIncorrectPasswordRead' +[components.ghc-zip-archive.overlays.metadata] +category = "azl-security-compliance" +upstream-status = "inapplicable" + +[[components.ghc-zip-archive.overlays]] +description = "Drop encrypted-zip test definitions (fixture removed)" +type = "file-search-replace" +archive = "zip-archive-0.4.3.2.tar.gz" +file = "tests/test-zip-archive.hs" +regex = '(?s)testExtractFilesFailOnEncrypted :: FilePath -> Test\n.*?Nothing \(fromEncryptedEntry "INCORRECT" f\)\n\n' +[components.ghc-zip-archive.overlays.metadata] +category = "azl-security-compliance" +upstream-status = "inapplicable" + +# The Cabal manifest lists the removed fixture under Extra-Source-Files; drop that +# entry too so the manifest stays consistent (Source1 .cabal used by the build). +[[components.ghc-zip-archive.overlays]] +description = "Drop removed test zip from the Cabal Extra-Source-Files manifest" +type = "file-search-replace" +file = "zip-archive-0.4.3.2.cabal" +regex = '(?m)^ +tests/zip_with_password\.zip\r?\n' +[components.ghc-zip-archive.overlays.metadata] +category = "azl-security-compliance" +upstream-status = "inapplicable" + +# Pin the post-overlay (repacked) tarball, replacing the upstream sources entry. +[[components.ghc-zip-archive.source-files]] +filename = "zip-archive-0.4.3.2.tar.gz" +hash = "e031946f95c5bad31c979405c5853a21c856cb77e2048f0cafaf867e2f4fbdb301d0f015398fce4271ea8263f9759fe1722354b00ee7c1c21a9deaed20b00445" +hash-type = "SHA512" +origin = { type = "overlay" } +replace-upstream = true +replace-reason = "Removes tests/zip_with_password.zip (password-protected test fixture) that fails the package-signing scan, and the three test cases that read it; test-only, not shipped in any binary RPM." diff --git a/locks/ghc-zip-archive.lock b/locks/ghc-zip-archive.lock index 17f4d5d931a..f01f601d734 100644 --- a/locks/ghc-zip-archive.lock +++ b/locks/ghc-zip-archive.lock @@ -3,5 +3,5 @@ version = 1 import-commit = '1eb51c9a61d8824ee123fdb2d88058b1ed73ceae' upstream-commit = '1eb51c9a61d8824ee123fdb2d88058b1ed73ceae' manual-bump = 2 -input-fingerprint = 'sha256:d7ae1c32050d6039f9d4043f43106845a00988140dabd019bb043b0b7e9fadeb' +input-fingerprint = 'sha256:76a1a7dd20c1b13194f728632c7e44e0ed75c1976e17b9bdcabe378c6cc7495b' resolution-input-hash = 'sha256:466421704711c4fd3c71f0b2ed715a0e61d49e3e26f3a2637fee755795849c8e' diff --git a/specs/g/ghc-zip-archive/ghc-zip-archive.spec b/specs/g/ghc-zip-archive/ghc-zip-archive.spec index cb65388e7e9..94419f14b60 100644 --- a/specs/g/ghc-zip-archive/ghc-zip-archive.spec +++ b/specs/g/ghc-zip-archive/ghc-zip-archive.spec @@ -2,7 +2,7 @@ ## (rpmautospec version 0.8.3) ## RPMAUTOSPEC: autorelease, autochangelog %define autorelease(e:s:pb:n) %{?-p:0.}%{lua: - release_number = 8; + release_number = 9; base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}")); print(release_number + base_release_number - 1); }%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}} @@ -180,6 +180,9 @@ dos2unix -k -n %{SOURCE1} %{pkg_name}.cabal %changelog ## START: Generated by rpmautospec +* Tue Aug 25 2026 Andrew Phelps - 0.4.3.2-9 +- fix: ghc-zip-archive - remove flagged files + * Wed Aug 19 2026 reuben olinsky - 0.4.3.2-8 - build: mass rebuild auto-bumpable components diff --git a/specs/g/ghc-zip-archive/sources b/specs/g/ghc-zip-archive/sources index 0f8c5226fff..61523f10eb5 100644 --- a/specs/g/ghc-zip-archive/sources +++ b/specs/g/ghc-zip-archive/sources @@ -1 +1 @@ -SHA512 (zip-archive-0.4.3.2.tar.gz) = 8062598d6403e4f6ebbbb9db09ea04ecb58d4223d38e8b017d5050847d5194fa64c6abeb3d518f1e3bec963b641be8d7bd949a562b69b59feffb8c1e3e69aff6 +SHA512 (zip-archive-0.4.3.2.tar.gz) = e031946f95c5bad31c979405c5853a21c856cb77e2048f0cafaf867e2f4fbdb301d0f015398fce4271ea8263f9759fe1722354b00ee7c1c21a9deaed20b00445 diff --git a/specs/g/ghc-zip-archive/zip-archive-0.4.3.2.cabal b/specs/g/ghc-zip-archive/zip-archive-0.4.3.2.cabal index 7453815f226..5eb45061a7d 100644 --- a/specs/g/ghc-zip-archive/zip-archive-0.4.3.2.cabal +++ b/specs/g/ghc-zip-archive/zip-archive-0.4.3.2.cabal @@ -1,106 +1,105 @@ -Name: zip-archive -Version: 0.4.3.2 -x-revision: 1 -Cabal-Version: 2.0 -Build-type: Simple -Synopsis: Library for creating and modifying zip archives. -Description: - The zip-archive library provides functions for creating, modifying, and - extracting files from zip archives. The zip archive format is - documented in . - . - Certain simplifying assumptions are made about the zip archives: in - particular, there is no support for strong encryption, zip files that - span multiple disks, ZIP64, OS-specific file attributes, or compression - methods other than Deflate. However, the library should be able to read - the most common zip archives, and the archives it produces should be - readable by all standard unzip programs. - . - Archives are built and extracted in memory, so manipulating large zip - files will consume a lot of memory. If you work with large zip files or - need features not supported by this library, a better choice may be - , which uses a - memory-efficient streaming approach. However, zip can only read and - write archives inside instances of MonadIO, so zip-archive is a better - choice if you want to manipulate zip archives in "pure" contexts. - . - As an example of the use of the library, a standalone zip archiver and - extracter is provided in the source distribution. -Category: Codec -Tested-with: GHC == 8.6.5, GHC == 8.8.1, GHC == 8.10.4, GHC == 9.0.1, - GHC == 8.8.3, GHC == 9.2.1 -License: BSD3 -License-file: LICENSE -Homepage: http://github.com/jgm/zip-archive -Author: John MacFarlane -Maintainer: jgm@berkeley.edu -Extra-Source-Files: changelog - README.markdown - tests/test4.zip - tests/test4/a.txt - tests/test4/b.bin - "tests/test4/c/with spaces.txt" - tests/zip_with_symlinks.zip - tests/zip_with_password.zip - tests/zip_with_evil_path.zip - -Source-repository head - type: git - location: git://github.com/jgm/zip-archive.git - -flag executable - Description: Build the Zip executable. - Default: False - -Library - Build-depends: base >= 4.11 && < 5, - pretty, - containers, - binary >= 0.7.2, - zlib, - filepath, - bytestring >= 0.10.0, - array, - mtl, - text >= 0.11, - digest >= 0.0.0.1, - directory >= 1.2.0, - time - Exposed-modules: Codec.Archive.Zip - Default-Language: Haskell98 - Hs-Source-Dirs: src - Ghc-Options: -Wall - if os(windows) - cpp-options: -D_WINDOWS - else - Build-depends: unix - -Executable zip-archive - if flag(executable) - Buildable: True - else - Buildable: False - Main-is: Main.hs - Hs-Source-Dirs: . - Build-Depends: base >= 4.5 && < 5, - directory >= 1.1, - bytestring >= 0.9.0, - zip-archive - Other-Modules: Paths_zip_archive - Autogen-Modules: Paths_zip_archive - Ghc-Options: -Wall - Default-Language: Haskell98 - -Test-Suite test-zip-archive - Type: exitcode-stdio-1.0 - Main-Is: test-zip-archive.hs - Hs-Source-Dirs: tests - Build-Depends: base >= 4.11 && < 5, - directory >= 1.3, bytestring >= 0.9.0, process, time, - HUnit, zip-archive, temporary, filepath - Default-Language: Haskell98 - Ghc-Options: -Wall - if os(windows) - cpp-options: -D_WINDOWS - else - Build-depends: unix +Name: zip-archive +Version: 0.4.3.2 +x-revision: 1 +Cabal-Version: 2.0 +Build-type: Simple +Synopsis: Library for creating and modifying zip archives. +Description: + The zip-archive library provides functions for creating, modifying, and + extracting files from zip archives. The zip archive format is + documented in . + . + Certain simplifying assumptions are made about the zip archives: in + particular, there is no support for strong encryption, zip files that + span multiple disks, ZIP64, OS-specific file attributes, or compression + methods other than Deflate. However, the library should be able to read + the most common zip archives, and the archives it produces should be + readable by all standard unzip programs. + . + Archives are built and extracted in memory, so manipulating large zip + files will consume a lot of memory. If you work with large zip files or + need features not supported by this library, a better choice may be + , which uses a + memory-efficient streaming approach. However, zip can only read and + write archives inside instances of MonadIO, so zip-archive is a better + choice if you want to manipulate zip archives in "pure" contexts. + . + As an example of the use of the library, a standalone zip archiver and + extracter is provided in the source distribution. +Category: Codec +Tested-with: GHC == 8.6.5, GHC == 8.8.1, GHC == 8.10.4, GHC == 9.0.1, + GHC == 8.8.3, GHC == 9.2.1 +License: BSD3 +License-file: LICENSE +Homepage: http://github.com/jgm/zip-archive +Author: John MacFarlane +Maintainer: jgm@berkeley.edu +Extra-Source-Files: changelog + README.markdown + tests/test4.zip + tests/test4/a.txt + tests/test4/b.bin + "tests/test4/c/with spaces.txt" + tests/zip_with_symlinks.zip + tests/zip_with_evil_path.zip + +Source-repository head + type: git + location: git://github.com/jgm/zip-archive.git + +flag executable + Description: Build the Zip executable. + Default: False + +Library + Build-depends: base >= 4.11 && < 5, + pretty, + containers, + binary >= 0.7.2, + zlib, + filepath, + bytestring >= 0.10.0, + array, + mtl, + text >= 0.11, + digest >= 0.0.0.1, + directory >= 1.2.0, + time + Exposed-modules: Codec.Archive.Zip + Default-Language: Haskell98 + Hs-Source-Dirs: src + Ghc-Options: -Wall + if os(windows) + cpp-options: -D_WINDOWS + else + Build-depends: unix + +Executable zip-archive + if flag(executable) + Buildable: True + else + Buildable: False + Main-is: Main.hs + Hs-Source-Dirs: . + Build-Depends: base >= 4.5 && < 5, + directory >= 1.1, + bytestring >= 0.9.0, + zip-archive + Other-Modules: Paths_zip_archive + Autogen-Modules: Paths_zip_archive + Ghc-Options: -Wall + Default-Language: Haskell98 + +Test-Suite test-zip-archive + Type: exitcode-stdio-1.0 + Main-Is: test-zip-archive.hs + Hs-Source-Dirs: tests + Build-Depends: base >= 4.11 && < 5, + directory >= 1.3, bytestring >= 0.9.0, process, time, + HUnit, zip-archive, temporary, filepath + Default-Language: Haskell98 + Ghc-Options: -Wall + if os(windows) + cpp-options: -D_WINDOWS + else + Build-depends: unix