Skip to content

fix: minizip-ng - remove flagged files #18625

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Tobias Brick (tobiasb-ms) merged 1 commit into from
Aug 31, 2026
Merged

fix: minizip-ng - remove flagged files #18625

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion base/comps/components.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2080,7 +2080,6 @@ overlay-files = ["overlays/*.overlay.toml"]
[components.mimalloc]
[components.minicom]
[components.miniz]
[components.minizip-ng]
[components.mint-themes]
[components.mintlocale]
[components.miopen]
Expand Down
34 changes: 34 additions & 0 deletions base/comps/minizip-ng/minizip-ng.comp.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
[components.minizip-ng]

# Remove the two password-protected (encrypted) libFuzzer seed-corpus zips that
# fail the package-signing scan. The archive is repacked; the resulting hash is
# pinned via the source-files entry.
[[components.minizip-ng.overlays]]
description = "Remove encrypted fuzz seed-corpus zips"
type = "file-remove"

@anphel31 Andrew Phelps (anphel31) Aug 26, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Verified via azldev comp prepare-sources (inspected the repacked archive: both encrypted_*.zip removed, other seed corpus intact; CMakeLists.txt has only the unzip-pkcrypt/unzip-wzaes add_test blocks removed while unzip-tiny/bzip2/lzma and both create_compress_tests remain) and azldev comp render --check-only (no drift). The removed files are libFuzzer seed-corpus fixtures and the spec has no %check, so no tests run against them — only their two now-dangling CTest registrations were dropped. A full mock build isn't runnable in my environment; CI performs it.

archive = "minizip-ng-4.0.10.tar.gz"
file = "test/fuzz/unzip_fuzzer_seed_corpus/encrypted_*.zip"
[components.minizip-ng.overlays.metadata]
category = "azl-security-compliance"
upstream-status = "inapplicable"

# Drop the two CTest cases that read the removed fixtures. The spec has no %check
# so nothing runs them, but this keeps the test registration consistent.
[[components.minizip-ng.overlays]]
description = "Drop CTest cases that read the removed encrypted fuzz zips"
type = "file-search-replace"
archive = "minizip-ng-4.0.10.tar.gz"
file = "CMakeLists.txt"
regex = '(?s)\n +if\(MZ_PKCRYPT\)\n +add_test\(NAME unzip-pkcrypt.*?add_test\(NAME unzip-wzaes.*?\n +endif\(\)'
[components.minizip-ng.overlays.metadata]
category = "azl-security-compliance"
upstream-status = "inapplicable"

# Pin the post-overlay (repacked) tarball, replacing the upstream sources entry.
[[components.minizip-ng.source-files]]
filename = "minizip-ng-4.0.10.tar.gz"
hash = "9cb38550aec5f7983d8f3afd7ed376a05c9d0d4347507f8aea426d75da2d5d90555a671da9dbdd7982d3916f0371b4cb1cb647ed2a641e8256202cd8d4737fd7"
hash-type = "SHA512"
origin = { type = "overlay" }
replace-upstream = true
replace-reason = "Removes test/fuzz/unzip_fuzzer_seed_corpus/encrypted_{pkcrypt,wzaes}.zip (password-protected fuzz seed-corpus fixtures) that fail the package-signing scan, and the two CTest cases that read them; test-only, not shipped in any binary RPM."
2 changes: 1 addition & 1 deletion locks/minizip-ng.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,5 +3,5 @@ version = 1
import-commit = 'e0c98c9ec9570c6d92979b9b6cb03f7fa80e5a73'
upstream-commit = 'e0c98c9ec9570c6d92979b9b6cb03f7fa80e5a73'
manual-bump = 2
input-fingerprint = 'sha256:f44df5edb628d3924096deff909eebfb062d6ba23719f119a4d35dbd4c3338e7'
input-fingerprint = 'sha256:47f84d9c6de35182a7a68efc36ca009319aefc68e415e81a2297dc239d3c1514'
resolution-input-hash = 'sha256:466421704711c4fd3c71f0b2ed715a0e61d49e3e26f3a2637fee755795849c8e'
5 changes: 4 additions & 1 deletion specs/m/minizip-ng/minizip-ng.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
## (rpmautospec version 0.8.3)
## RPMAUTOSPEC: autorelease, autochangelog
%define autorelease(e:s:pb:n) %{?-p:0.}%{lua:
release_number = 5;
release_number = 6;
base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}"));
print(release_number + base_release_number - 1);
}%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}}
Expand Down Expand Up @@ -196,6 +196,9 @@ _EOF_

%changelog
## START: Generated by rpmautospec
* Tue Aug 25 2026 Andrew Phelps <anphel@microsoft.com> - 4.0.10-6
- fix: minizip-ng - remove flagged files

* Wed Aug 19 2026 reuben olinsky <reubeno@users.noreply.github.com> - 4.0.10-5
- build: mass rebuild auto-bumpable components

Expand Down
2 changes: 1 addition & 1 deletion specs/m/minizip-ng/sources
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
SHA512 (minizip-ng-4.0.10.tar.gz) = a74386e2cf89f63d7fc9bf53527c8203ac78c46f2511e4883d17d949ec4e7d1b6c3707bcb13c3fc7cc4db8255b5f50ddb61bedba10e683acb18d112470676f62
SHA512 (minizip-ng-4.0.10.tar.gz) = 9cb38550aec5f7983d8f3afd7ed376a05c9d0d4347507f8aea426d75da2d5d90555a671da9dbdd7982d3916f0371b4cb1cb647ed2a641e8256202cd8d4737fd7
Loading