diff --git a/.azldev-version b/.azldev-version index 95552389490..9854d019785 100644 --- a/.azldev-version +++ b/.azldev-version @@ -1 +1 @@ -0256227f5434d9e00d7c8501b16848efa400a72b +830e6fed79750f8e24ae17cd630248f50c90c8a9 diff --git a/base/comps/anaconda-webui/anaconda-webui.comp.toml b/base/comps/anaconda-webui/anaconda-webui.comp.toml index 8431eb43ade..4e73781d9ee 100644 --- a/base/comps/anaconda-webui/anaconda-webui.comp.toml +++ b/base/comps/anaconda-webui/anaconda-webui.comp.toml @@ -1,19 +1 @@ [components.anaconda-webui] - -# The upstream Fedora spec requires fedora-logos (gated behind %if 0%{?fedora}). -# AZL uses generic-logos for branding; fedora-logos is not shipped and breaks -# repoclosure. Replace with system-logos, the distro-neutral virtual provide. -# Ref: https://github.com/microsoft/azurelinux/pull/16413 removed fedora-logos -# from the component list; this patches the consumer side. - -[[components.anaconda-webui.overlays]] -description = "Remove Requires: fedora-logos (Fedora-specific)" -type = "spec-remove-tag" -tag = "Requires" -value = "fedora-logos" - -[[components.anaconda-webui.overlays]] -description = "Add Requires: system-logos (distro-neutral virtual provide)" -type = "spec-add-tag" -tag = "Requires" -value = "system-logos" diff --git a/base/comps/anaconda-webui/overlays/0001-remove-requires-fedora-logos.overlay.toml b/base/comps/anaconda-webui/overlays/0001-remove-requires-fedora-logos.overlay.toml new file mode 100644 index 00000000000..fb502f6103c --- /dev/null +++ b/base/comps/anaconda-webui/overlays/0001-remove-requires-fedora-logos.overlay.toml @@ -0,0 +1,22 @@ +# The upstream Fedora spec requires fedora-logos (gated behind %if 0%{?fedora}). +# AZL uses generic-logos for branding; fedora-logos is not shipped and breaks +# repoclosure. Replace with system-logos, the distro-neutral virtual provide. +# Ref: https://github.com/microsoft/azurelinux/pull/16413 removed fedora-logos +# from the component list; this patches the consumer side. + +[metadata] +category = "azl-branding-policy" +upstream-status = "upstreamed" +commits = [{ url = "https://src.fedoraproject.org/rpms/anaconda-webui/c/d4ef9345b8787c46f9280b2239c07b23af83f0aa?branch=f44" }] + +[[overlays]] +description = "Remove Requires: fedora-logos (Fedora-specific)" +type = "spec-remove-tag" +tag = "Requires" +value = "fedora-logos" + +[[overlays]] +description = "Add Requires: system-logos (distro-neutral virtual provide)" +type = "spec-add-tag" +tag = "Requires" +value = "system-logos" diff --git a/base/comps/azurelinux-rpm-config/azurelinux-rpm-config.comp.toml b/base/comps/azurelinux-rpm-config/azurelinux-rpm-config.comp.toml index 3ab8ccb41d1..caa43f0f5d0 100644 --- a/base/comps/azurelinux-rpm-config/azurelinux-rpm-config.comp.toml +++ b/base/comps/azurelinux-rpm-config/azurelinux-rpm-config.comp.toml @@ -1,58 +1,2 @@ [components.azurelinux-rpm-config] spec = { type = "upstream", upstream-name = "redhat-rpm-config" } -overlays = [ - # - # Overlays for spec. - # - - # Set the component's name. - { type = "spec-set-tag", tag = "Name", value = "azurelinux-rpm-config" }, - # Set this distro's URL. - { type = "spec-set-tag", tag = "URL", value = "https://aka.ms/azurelinux" }, - # Set our version. - { type = "spec-update-tag", tag = "Version", value = "1004" }, - - # WORKAROUND: manually bump the Release value for Stage2 bring-up. - { type = "spec-update-tag", tag = "Release", value = "2%{?dist}" }, - - # Provide compatibility with Fedora's upstream version. - { type = "spec-add-tag", tag = "Provides", value = "redhat-rpm-config = %{version}-%{release}" }, - # Make sure this package takes precedence over (and would replace) any Fedora variant. - # Note that Fedora's version of redhat-rpm-config has a version equal to 300 + the release number - # (e.g., 343 for Fedora 43). - { type = "spec-add-tag", tag = "Obsoletes", value = "redhat-rpm-config < 1000" }, - { type = "spec-add-tag", tag = "Conflicts", value = "redhat-rpm-config < 1000" }, - - # Create symlink for our own name: /usr/lib/rpm/azurelinux -> /usr/lib/rpm/redhat - # Note that we don't do the reverse to avoid conflicts with upstream Fedora - # redhat-rpm-config during bootstrapping (replacing a dir with a symlink is - # problematic in RPM land). - # TODO: remove symlinks after bootstrap - { type = "spec-prepend-lines", section = "%install", lines = ["mkdir -p %{buildroot}/usr/lib/rpm", "ln -sf redhat %{buildroot}/usr/lib/rpm/azurelinux"] }, - { type = "spec-prepend-lines", section = "%files", lines = ["/usr/lib/rpm/azurelinux"] }, - - # Create symlink for lua dir: /usr/lib/rpm/lua/azurelinux -> /usr/lib/rpm/lua/fedora - # This allows the distro-specific name to be used with minimal required churn to - # spread references to the standard path in Fedora. - { type = "spec-append-lines", section = "%install", lines = ["ln -sf fedora %{buildroot}%{_rpmluadir}/azurelinux"] }, - { type = "spec-append-lines", section = "%files", lines = ["%{_rpmluadir}/azurelinux"] }, - - # - # Overlays for non-spec files. - # - - # Update all references to the Fedora version of this package to the Azure Linux one. - { type = "file-search-replace", file = "**/*", regex = "redhat-rpm-config", replacement = "azurelinux-rpm-config" }, - - # Update vendor macro. - { type = "file-search-replace", file = "macros", regex = "%_vendor.*", replacement = "%_vendor azurelinux" }, - - # Remove dist.sh file; we'll replace it wholesale with our own version. - { type = "file-remove", file = "dist.sh" }, - # Add our own version of dist.sh customized for Azure Linux. - { type = "file-add", file = "dist.sh", source = "dist.sh" }, - - # Targeted adjustments in some macros files. - { type = "file-search-replace", file = "macros.fedora-misc-srpm", regex = "/lib/swidtag/fedoraproject.org", replacement = "/lib/swidtag/microsoft.com" }, - { type = "file-search-replace", file = "macros.fedora-misc-srpm", regex = "[Ff]edora", replacement = "azurelinux" }, -] diff --git a/base/comps/azurelinux-rpm-config/overlays/0001-azl-rpm-config-customizations.overlay.toml b/base/comps/azurelinux-rpm-config/overlays/0001-azl-rpm-config-customizations.overlay.toml new file mode 100644 index 00000000000..3f13fa17be6 --- /dev/null +++ b/base/comps/azurelinux-rpm-config/overlays/0001-azl-rpm-config-customizations.overlay.toml @@ -0,0 +1,121 @@ +# +# Overlays for spec. +# + +# Set the component's name. + +[metadata] +category = "azl-branding-policy" +upstream-status = "inapplicable" + +[[overlays]] +type = "spec-set-tag" +tag = "Name" +value = "azurelinux-rpm-config" + +# Set this distro's URL. +[[overlays]] +type = "spec-set-tag" +tag = "URL" +value = "https://aka.ms/azurelinux" + +# Set our version. +[[overlays]] +type = "spec-update-tag" +tag = "Version" +value = "1004" + +# WORKAROUND: manually bump the Release value for Stage2 bring-up. +[[overlays]] +type = "spec-update-tag" +tag = "Release" +value = "2%{?dist}" + +# Provide compatibility with Fedora's upstream version. +[[overlays]] +type = "spec-add-tag" +tag = "Provides" +value = "redhat-rpm-config = %{version}-%{release}" + +# Make sure this package takes precedence over (and would replace) any Fedora variant. +# Note that Fedora's version of redhat-rpm-config has a version equal to 300 + the release number +# (e.g., 343 for Fedora 43). +[[overlays]] +type = "spec-add-tag" +tag = "Obsoletes" +value = "redhat-rpm-config < 1000" + +[[overlays]] +type = "spec-add-tag" +tag = "Conflicts" +value = "redhat-rpm-config < 1000" + +# Create symlink for our own name: /usr/lib/rpm/azurelinux -> /usr/lib/rpm/redhat +# Note that we don't do the reverse to avoid conflicts with upstream Fedora +# redhat-rpm-config during bootstrapping (replacing a dir with a symlink is +# problematic in RPM land). +# TODO: remove symlinks after bootstrap +[[overlays]] +type = "spec-prepend-lines" +section = "%install" +lines = ["mkdir -p %{buildroot}/usr/lib/rpm", "ln -sf redhat %{buildroot}/usr/lib/rpm/azurelinux"] + +[[overlays]] +type = "spec-prepend-lines" +section = "%files" +lines = ["/usr/lib/rpm/azurelinux"] + +# Create symlink for lua dir: /usr/lib/rpm/lua/azurelinux -> /usr/lib/rpm/lua/fedora +# This allows the distro-specific name to be used with minimal required churn to +# spread references to the standard path in Fedora. +[[overlays]] +type = "spec-append-lines" +section = "%install" +lines = ["ln -sf fedora %{buildroot}%{_rpmluadir}/azurelinux"] + +[[overlays]] +type = "spec-append-lines" +section = "%files" +lines = ["%{_rpmluadir}/azurelinux"] + +# +# Overlays for non-spec files. +# + +# Update all references to the Fedora version of this package to the Azure Linux one. +[[overlays]] +type = "file-search-replace" +file = "**/*" +regex = "redhat-rpm-config" +replacement = "azurelinux-rpm-config" + +# Update vendor macro. +[[overlays]] +type = "file-search-replace" +file = "macros" +regex = "%_vendor.*" +replacement = "%_vendor azurelinux" + +# Remove dist.sh file; we'll replace it wholesale with our own version. +[[overlays]] +type = "file-remove" +file = "dist.sh" + +# Add our own version of dist.sh customized for Azure Linux. +[[overlays]] +type = "file-add" +file = "dist.sh" +source = "../dist.sh" + +# Targeted adjustments in some macros files. +[[overlays]] +type = "file-search-replace" +file = "macros.fedora-misc-srpm" +regex = "/lib/swidtag/fedoraproject.org" +replacement = "/lib/swidtag/microsoft.com" + +[[overlays]] +type = "file-search-replace" +file = "macros.fedora-misc-srpm" +regex = "[Ff]edora" +replacement = "azurelinux" diff --git a/base/comps/chrony/chrony.comp.toml b/base/comps/chrony/chrony.comp.toml index 2a2b46b789a..2bd013a0257 100644 --- a/base/comps/chrony/chrony.comp.toml +++ b/base/comps/chrony/chrony.comp.toml @@ -1,19 +1,2 @@ [components.chrony] -[[components.chrony.overlays]] -description = "Enable use of confdir at /etc/chrony.d" -type = "spec-search-replace" -regex = "^touch -r examples/chrony.conf.example2 chrony.conf" -replacement = "echo -e '\\n# Use confdir\\nconfdir /etc/chrony.d' >> chrony.conf\n\ntouch -r examples/chrony.conf.example2 chrony.conf" - -[[components.chrony.overlays]] -description = "Create /etc/chrony.d dir" -type = "spec-search-replace" -regex = '\$RPM_BUILD_ROOT%\{_sysconfdir\}/\{sysconfig,logrotate.d\}' -replacement = '$RPM_BUILD_ROOT%{_sysconfdir}/{sysconfig,logrotate.d,chrony.d}' - -[[components.chrony.overlays]] -description = "Add /etc/chrony.d dir to package" -type = "spec-append-lines" -section = "%files" -lines = ["%dir %{_sysconfdir}/chrony.d"] diff --git a/base/comps/chrony/overlays/0001-enable-confdir-at-etc.overlay.toml b/base/comps/chrony/overlays/0001-enable-confdir-at-etc.overlay.toml new file mode 100644 index 00000000000..10c2bc1b8ce --- /dev/null +++ b/base/comps/chrony/overlays/0001-enable-confdir-at-etc.overlay.toml @@ -0,0 +1,21 @@ +[metadata] +category = "azl-compatibility" +upstream-status = "inapplicable" + +[[overlays]] +description = "Enable use of confdir at /etc/chrony.d" +type = "spec-search-replace" +regex = "^touch -r examples/chrony.conf.example2 chrony.conf" +replacement = "echo -e '\\n# Use confdir\\nconfdir /etc/chrony.d' >> chrony.conf\n\ntouch -r examples/chrony.conf.example2 chrony.conf" + +[[overlays]] +description = "Create /etc/chrony.d dir" +type = "spec-search-replace" +regex = "\\$RPM_BUILD_ROOT%\\{_sysconfdir\\}/\\{sysconfig,logrotate.d\\}" +replacement = "$RPM_BUILD_ROOT%{_sysconfdir}/{sysconfig,logrotate.d,chrony.d}" + +[[overlays]] +description = "Add /etc/chrony.d dir to package" +type = "spec-append-lines" +section = "%files" +lines = ["%dir %{_sysconfdir}/chrony.d"] diff --git a/base/comps/components.toml b/base/comps/components.toml index cfed7f265dd..76db24271c2 100644 --- a/base/comps/components.toml +++ b/base/comps/components.toml @@ -1,5 +1,15 @@ includes = ["**/*.comp.toml", "component-check-disablement.toml", "component-mingw-disablement.toml", "components-publish-channels.toml"] +# Project-wide default: every component automatically discovers per-file overlay +# documents under its own `overlays/` directory. The glob is resolved relative +# to each concrete component's config file, so components without an `overlays/` +# directory simply match nothing (non-matching globs are ignored). This lets +# components keep their overlays as one-logical-change-per-file `*.overlay.toml` +# documents without repeating `overlay-files` in every comp.toml. +# See https://github.com/microsoft/azure-linux-dev-tools/blob/main/docs/user/reference/config/overlays.md#per-file-overlay-format +[default-component-config] +overlay-files = ["overlays/*.overlay.toml"] + # # Components imported from Fedora with no per-component modifications. # Please keep this list sorted alphabetically for readability. diff --git a/base/comps/firewalld/firewalld.comp.toml b/base/comps/firewalld/firewalld.comp.toml index 4ea8c465ec2..5739a8ddb8b 100644 --- a/base/comps/firewalld/firewalld.comp.toml +++ b/base/comps/firewalld/firewalld.comp.toml @@ -1,11 +1,2 @@ [components.firewalld] -[[components.firewalld.overlays]] -type = "spec-remove-tag" -description = "Remove Fedora patch that opens mdns port in public (default) zone" -tag = "Patch0" - -[[components.firewalld.overlays]] -type = "file-remove" -description = "Remove Fedora patch that opens mdns port in public (default) zone" -file = "fedora-only-MDNS-default.patch" diff --git a/base/comps/firewalld/overlays/0001-remove-fedora-patch-opens.overlay.toml b/base/comps/firewalld/overlays/0001-remove-fedora-patch-opens.overlay.toml new file mode 100644 index 00000000000..beea5da17a8 --- /dev/null +++ b/base/comps/firewalld/overlays/0001-remove-fedora-patch-opens.overlay.toml @@ -0,0 +1,13 @@ +[metadata] +category = "azl-security-compliance" +upstream-status = "inapplicable" + +[[overlays]] +type = "spec-remove-tag" +description = "Remove Fedora patch that opens mdns port in public (default) zone" +tag = "Patch0" + +[[overlays]] +type = "file-remove" +description = "Remove Fedora patch that opens mdns port in public (default) zone" +file = "fedora-only-MDNS-default.patch" diff --git a/base/comps/gd/gd.comp.toml b/base/comps/gd/gd.comp.toml index 17627135933..8640ae61e48 100644 --- a/base/comps/gd/gd.comp.toml +++ b/base/comps/gd/gd.comp.toml @@ -5,10 +5,3 @@ release = { calculation = "manual" } # AZL does not ship libavif — disable avif support. # The avif bcond defaults ON via %bcond_without on Fedora. build.without = ["avif"] - -# Bump release for avif removal rebuild. -[[components.gd.overlays]] -description = "Bump release for avif removal rebuild" -type = "spec-set-tag" -tag = "Release" -value = "20%{?prever}%{?short}%{?dist}" diff --git a/base/comps/gd/overlays/0001-bump-release-avif-removal.overlay.toml b/base/comps/gd/overlays/0001-bump-release-avif-removal.overlay.toml new file mode 100644 index 00000000000..7e9d0ae148a --- /dev/null +++ b/base/comps/gd/overlays/0001-bump-release-avif-removal.overlay.toml @@ -0,0 +1,11 @@ +# Bump release for avif removal rebuild. + +[metadata] +category = "azl-release-management" +upstream-status = "inapplicable" + +[[overlays]] +description = "Bump release for avif removal rebuild" +type = "spec-set-tag" +tag = "Release" +value = "20%{?prever}%{?short}%{?dist}" diff --git a/base/comps/java-25-openjdk/java-25-openjdk.comp.toml b/base/comps/java-25-openjdk/java-25-openjdk.comp.toml index 9d65c43c3e0..99f649485ae 100644 --- a/base/comps/java-25-openjdk/java-25-openjdk.comp.toml +++ b/base/comps/java-25-openjdk/java-25-openjdk.comp.toml @@ -14,8 +14,3 @@ build.without = ["slowdebug"] # new AZL-only changes on top of the pinned upstream commit. azl_release = "2" -[[components.java-25-openjdk.overlays]] -description = "Add azl_release to upstream %{rpmrelease} so we can bump release independently of upstream while keeping a single-number Fedora-style Release schema" -type = "spec-search-replace" -regex = '^Release:\s+%\{\?eaprefix\}%\{rpmrelease\}%\{\?extraver\}%\{\?dist\}$' -replacement = 'Release: %{?eaprefix}%[%{rpmrelease} + %{azl_release}]%{?extraver}%{?dist}' diff --git a/base/comps/java-25-openjdk/overlays/0001-add-release-upstream-rpmrelease.overlay.toml b/base/comps/java-25-openjdk/overlays/0001-add-release-upstream-rpmrelease.overlay.toml new file mode 100644 index 00000000000..0d5211ce40b --- /dev/null +++ b/base/comps/java-25-openjdk/overlays/0001-add-release-upstream-rpmrelease.overlay.toml @@ -0,0 +1,9 @@ +[metadata] +category = "azl-release-management" +upstream-status = "inapplicable" + +[[overlays]] +description = "Add azl_release to upstream %{rpmrelease} so we can bump release independently of upstream while keeping a single-number Fedora-style Release schema" +type = "spec-search-replace" +regex = "^Release:\\s+%\\{\\?eaprefix\\}%\\{rpmrelease\\}%\\{\\?extraver\\}%\\{\\?dist\\}$" +replacement = "Release: %{?eaprefix}%[%{rpmrelease} + %{azl_release}]%{?extraver}%{?dist}" diff --git a/base/comps/kernel/kernel.comp.toml b/base/comps/kernel/kernel.comp.toml index 9f568dc9314..353a43fb959 100644 --- a/base/comps/kernel/kernel.comp.toml +++ b/base/comps/kernel/kernel.comp.toml @@ -34,387 +34,3 @@ filename = "open-gpu-kernel-modules-595.58.03.tar.gz" hash = "a422b6935209d590f57fa6766f59bb207d9130f8a6777af9245c4ff8cd0f4c4ccef4602a0b26d543e1e8efba24241180992fdb749ea4e5d2aa5218a584b85101" hash-type = "SHA512" origin = { type = "download", uri = "https://github.com/NVIDIA/open-gpu-kernel-modules/archive/refs/tags/595.58.03.tar.gz" } - -# Insert version and release information from the component defines into the spec file, and update the source URL to match the AzureLinux kernel source structure -[[components.kernel.overlays]] -description = "Set specrpmversion to 6.18.31" -type = "spec-search-replace" -regex = "%define specrpmversion .+" -replacement = "%define specrpmversion 6.18.31" - -[[components.kernel.overlays]] -description = "Derive specversion from specrpmversion. This becomes KVERREL which becomes the uname" -type = "spec-search-replace" -regex = "%define specversion .+" -replacement = "%define specversion %{specrpmversion}" - -[[components.kernel.overlays]] -description = "Derive tarfile_release from specrpmversion (include for completeness but later overridden)" -type = "spec-search-replace" -regex = "%define tarfile_release .+" -replacement = "%define tarfile_release %{specrpmversion}" - -[[components.kernel.overlays]] -description = "Set pkgrelease to azl_pkgrelease macro. Looks to only be realted to documentation" -type = "spec-search-replace" -regex = "%define pkgrelease .+" -replacement = "%define pkgrelease %{azl_pkgrelease}" - -[[components.kernel.overlays]] -description = "Set specrelease to kextraversion.azl_pkgrelease.dist so the 4th version component flows into Release:, uname -r, and /lib/modules/ path" -type = "spec-search-replace" -regex = "%define specrelease .+" -replacement = "%define specrelease %{kextraversion}.%{azl_pkgrelease}%{?buildid}%{?dist}" - -# Use the AzureLinux kernel source -[[components.kernel.overlays]] -description = "Use AzureLinux kernel source URL" -type = "spec-update-tag" -tag = "Source0" -value = "kernel-%{specrpmversion}.%{kextraversion}.tar.gz" - -[[components.kernel.overlays]] -description = "Fix tarball extraction path for AzureLinux" -type = "spec-search-replace" -regex = "linux-%{tarfile_release}" -replacement = "CBL-Mariner-Linux-Kernel-rolling-lts-azl4-%{specrpmversion}.%{kextraversion}" - -# Skip the Fedora process_configs.sh run — Fedora f43 configs target 6.18.13 and lack -# new config options in 6.18.31, causing -n (listnewconfig) to fail. Our AZL overlay at the -# end of %prep replaces all configs and re-runs process_configs.sh with strict validation. -[[components.kernel.overlays]] -description = "Skip Fedora process_configs.sh — f43 configs are for 6.18.13 and fail against 6.18.31 kernel. AZL re-runs at end of %prep." -type = "spec-search-replace" -regex = 'RHJOBS=\$RPM_BUILD_NCPUS SPECPACKAGE_NAME=%\{name\} \./process_configs\.sh \$OPTS %\{specrpmversion\}' -replacement = 'echo "AZL: skipping Fedora process_configs.sh (re-run with AZL configs below)" # RHJOBS=$RPM_BUILD_NCPUS SPECPACKAGE_NAME=%{name} ./process_configs.sh $OPTS %{specrpmversion}' - -# Disable redhat-specific sources and patches since they are not applicable to AzureLinux -[[components.kernel.overlays]] -description = "Disable copy of Makefile.rhelver (Source1) — not applicable to AzureLinux" -type = "spec-search-replace" -regex = "cp -a %{SOURCE1} ." -replacement = "# cp -a %{SOURCE1} . (disabled for AzureLinux — Makefile.rhelver is Red Hat-specific)" - -[[components.kernel.overlays]] -description = "Disable redhat patch declaration — not applicable to AzureLinux" -type = "spec-search-replace" -regex = "Patch1: patch-%{patchversion}-redhat.patch" -replacement = "# Patch1: patch-%{patchversion}-redhat.patch (disabled for AzureLinux)" - -[[components.kernel.overlays]] -description = "Disable redhat patch application — not applicable to AzureLinux" -type = "spec-search-replace" -regex = "ApplyOptionalPatch patch-%{patchversion}-redhat.patch" -replacement = "# ApplyOptionalPatch patch-%{patchversion}-redhat.patch (disabled for AzureLinux)" - -# Azure Linux kernel configs — full replacements for the Fedora-generated configs. -# The Fedora config pipeline runs fully (generate_all_configs.sh, merge.py, etc.), -# then we overwrite at the end of %prep with our AZL configs and re-run -# process_configs.sh to validate them (make olddefconfig + listnewconfig). - -[[components.kernel.overlays]] -description = "Add AZL x86_64 kernel config to sources" -type = "file-add" -file = "6.18-x86_64-azl.config" -source = "6.18-x86_64-azl.config" - -[[components.kernel.overlays]] -description = "Add AZL aarch64 kernel config to sources" -type = "file-add" -file = "6.18-aarch64-azl.config" -source = "6.18-aarch64-azl.config" - -[[components.kernel.overlays]] -description = "Add AZL signing CA certificate (embedded as builtin trusted key via CONFIG_SYSTEM_TRUSTED_KEYS)" -type = "file-add" -file = "azurelinux-ca-20230216.pem" -source = "azurelinux-ca-20230216.pem" - -[[components.kernel.overlays]] -description = "Register AZL x86_64 kernel config as Source5000" -type = "spec-insert-tag" -tag = "Source5000" -value = "6.18-x86_64-azl.config" - -[[components.kernel.overlays]] -description = "Register AZL aarch64 kernel config as Source5001" -type = "spec-insert-tag" -tag = "Source5001" -value = "6.18-aarch64-azl.config" - -[[components.kernel.overlays]] -description = "Register AZL signing CA certificate as Source5002" -type = "spec-insert-tag" -tag = "Source5002" -value = "azurelinux-ca-20230216.pem" - -[[components.kernel.overlays]] -description = "Overwrite Fedora-generated configs with AZL configs and re-validate with process_configs.sh at the end of %prep — lets the entire Fedora config pipeline run first, then overwrites with our complete configs. Only copies the config matching the build arch to avoid cross-arch make failures." -type = "spec-append-lines" -section = "%prep" -lines = [ - "# AZL: Copy mariner.pem signing CA cert into kernel source tree", - "%ifnarch noarch %nobuildarches", - "cp %{SOURCE5002} linux-%{KVERREL}/certs/mariner.pem", - "# AZL: Overwrite Fedora-generated configs with complete AZL kernel configs", - '%{log_msg "AZL: Overwrite configs with AZL kernel configs"}', - "cd linux-%{KVERREL}/configs", - "# Remove all Fedora-generated configs — we replace with AZL configs for build arch only", - "rm -f %{name}-%{specrpmversion}-*.config", - "%ifarch x86_64", - "cp %{SOURCE5000} %{name}-%{specrpmversion}-x86_64.config", - "%endif", - "%ifarch aarch64", - "cp %{SOURCE5001} %{name}-%{specrpmversion}-aarch64.config", - "%endif", - "# Re-run process_configs.sh to validate AZL configs (make olddefconfig + listnewconfig)", - 'OPTS="-w -n -c"', - "SPECPACKAGE_NAME=%{name} RHJOBS=$RPM_BUILD_NCPUS ./process_configs.sh $OPTS %{specrpmversion}", - "cd ../..", - "%endif", -] - -# ============================================================================ -# kmod subpackage framework — modular kmod builds alongside the kernel -# -# This framework allows building out-of-tree kernel modules as subpackages of -# the kernel RPM. Each kmod is defined in its own .inc file (e.g. -# kmod-nvidia-open.inc) with phase-gated sections that run at each RPM build -# phase (%description, %prep, %build, %install, %files). -# -# To add a new kmod: -# 1. Create kmod-.inc with phase-gated sections -# 2. Add file-add overlays for .inc and any extra source files -# 3. Add spec-insert-tag overlays to register sources (Source6xxx range) -# 4. Add spec-search-replace overlays targeting the AZL-KMOD-*-ANCHOR -# sentinels for each phase (the anchor survives replacement so the -# next kmod can chain onto it) -# ============================================================================ - -# --- kmod-nvidia-open: source file registration --- -# Registers the NVIDIA open GPU kernel module sources and configuration files. -# Source numbers 6000-6099 are reserved for nvidia-open. - -[[components.kernel.overlays]] -description = "Add kmod-nvidia-open.inc subpackage definition to sources" -type = "file-add" -file = "kmod-nvidia-open.inc" -source = "kmod-nvidia-open.inc" - -[[components.kernel.overlays]] -description = "Add NVIDIA modprobe config file for kmod-nvidia-open subpackage" -type = "file-add" -file = "kmod-nvidia-open-modprobe.conf" -source = "kmod-nvidia-open-modprobe.conf" - -[[components.kernel.overlays]] -description = "Register NVIDIA open-gpu-kernel-modules tarball as Source6000" -type = "spec-insert-tag" -tag = "Source6000" -value = "open-gpu-kernel-modules-%{nvidia_open_version}.tar.gz" - -[[components.kernel.overlays]] -description = "Register NVIDIA modprobe config as Source6001" -type = "spec-insert-tag" -tag = "Source6001" -value = "kmod-nvidia-open-modprobe.conf" - -[[components.kernel.overlays]] -description = "Register kmod-nvidia-open.inc as Source6002" -type = "spec-insert-tag" -tag = "Source6002" -value = "kmod-nvidia-open.inc" - -# --- kmod framework: phase anchor insertion --- -# These overlays insert unique sentinel comments at unconditional locations in -# the upstream spec. Per-kmod overlays below target these sentinels with -# spec-search-replace, replacing SENTINEL with + SENTINEL so -# each sentinel survives for the next kmod to chain onto. - -[[components.kernel.overlays]] -description = "Insert kmod package anchor after main %description — unconditional location for kmod subpackage declarations" -type = "spec-append-lines" -section = "%description" -lines = [ - "", - "# AZL-KMOD-PACKAGE-ANCHOR — do not remove (kmod overlays chain here)", -] - -[[components.kernel.overlays]] -description = "Insert kmod prep anchor at end of %prep — unconditional location for kmod source extraction" -type = "spec-append-lines" -section = "%prep" -lines = [ - "", - "# AZL-KMOD-PREP-ANCHOR — do not remove (kmod overlays chain here)", -] - -[[components.kernel.overlays]] -description = "Insert kmod build anchor before modsign macros — unconditional location at the end of the active %build body" -type = "spec-search-replace" -regex = '# Module signing \(modsign\)' -replacement = """# AZL-KMOD-BUILD-ANCHOR — do not remove (kmod overlays chain here) - -# Module signing (modsign)""" - -[[components.kernel.overlays]] -description = "Insert kmod install anchor before ### clean — unconditional location at the end of the active %install body" -type = "spec-search-replace" -regex = '### clean' -replacement = """# AZL-KMOD-INSTALL-ANCHOR — do not remove (kmod overlays chain here) - -### -### clean""" - -[[components.kernel.overlays]] -description = "Insert kmod files anchor after %files modules-extra-matched — unconditional location for kmod file lists" -type = "spec-append-lines" -section = "%files" -package = "modules-extra-matched" -lines = [ - "", - "# AZL-KMOD-FILES-ANCHOR — do not remove (kmod overlays chain here)", -] - -# --- kmod-nvidia-open: phase injection --- -# RPM %include is a preprocessor directive — it must appear directly in the spec -# text (not inside a %define macro). Each phase sets _kmod_phase and _kmod_name -# globals, then includes the kmod .inc file. The .inc file's %if guards select -# the correct section for that phase. -# -# To add a new kmod: duplicate the phase blocks below, changing _kmod_name and -# the %include path. Each block targets the framework anchor for its phase. - -[[components.kernel.overlays]] -description = "Run kmod 'package' phase at package anchor — declares kmod subpackages" -type = "spec-search-replace" -regex = '# AZL-KMOD-PACKAGE-ANCHOR' -replacement = """# AZL: kmod subpackage declarations (nvidia-open) -%global _kmod_phase package -%global _kmod_name nvidia-open -%include %{_sourcedir}/kmod-nvidia-open.inc - -# AZL-KMOD-PACKAGE-ANCHOR""" - -[[components.kernel.overlays]] -description = "Run kmod 'prep' phase at prep anchor — extracts kmod source tarballs" -type = "spec-search-replace" -regex = '# AZL-KMOD-PREP-ANCHOR' -replacement = """# AZL: Prepare kmod subpackage sources (nvidia-open) -%global _kmod_phase prep -%global _kmod_name nvidia-open -%include %{_sourcedir}/kmod-nvidia-open.inc - -# AZL-KMOD-PREP-ANCHOR""" - -[[components.kernel.overlays]] -description = "Run kmod 'build' phase at build anchor — compiles NVIDIA modules against the just-built kernel" -type = "spec-search-replace" -regex = '# AZL-KMOD-BUILD-ANCHOR' -replacement = """# AZL: Build kmod subpackage modules (nvidia-open) -%global _kmod_phase build -%global _kmod_name nvidia-open -%include %{_sourcedir}/kmod-nvidia-open.inc - -# AZL-KMOD-BUILD-ANCHOR""" - -[[components.kernel.overlays]] -description = "Run kmod 'install' phase at install anchor — installs NVIDIA modules, configs, and licenses" -type = "spec-search-replace" -regex = '# AZL-KMOD-INSTALL-ANCHOR' -replacement = """# AZL: Install kmod subpackage files (nvidia-open) -%global _kmod_phase install -%global _kmod_name nvidia-open -%include %{_sourcedir}/kmod-nvidia-open.inc - -# AZL-KMOD-INSTALL-ANCHOR""" - -[[components.kernel.overlays]] -description = "Run kmod 'files' phase at files anchor — adds %post/%postun/%files for NVIDIA kmod subpackage" -type = "spec-search-replace" -regex = '# AZL-KMOD-FILES-ANCHOR' -replacement = """# AZL: kmod subpackage file lists and scriptlets (nvidia-open) -%global _kmod_phase files -%global _kmod_name nvidia-open -%include %{_sourcedir}/kmod-nvidia-open.inc - -# AZL-KMOD-FILES-ANCHOR""" - -# Prepend AZL changelog entries to the top of %changelog. The kernel uses -# `release.calculation = "manual"` (no rpmautospec), so changelog entries are -# hand-curated here rather than derived from `git log`. Convention: one entry -# per lock-fingerprint change, mirroring what synthetic distgit / rpmautospec -# emit. When the lock fingerprint changes (edit to comp.toml, overlays, etc.), -# prepend a new entry here with the next release number. -# -# We intentionally do not use rpmautospec for changelog generation here since -# the kernel spec file is so complicated the tool struggles to parse it (it can -# take on the order of hours to run). Until we have a more robust solution for -# this a manual process will be used. -# -# NOTE: This changelog is best-effort, as upstream changes are integrated into -# the spec the logical ordering will deteriorate, the azl specific entries -# will always be at the top, resulting in a jumbled history. -[[components.kernel.overlays]] -description = "Prepend AZL changelog entries (one per lock-fingerprint change) above the inherited Fedora history. Release is manual, so rpmautospec does not generate these; convention mirrors synthetic distgit output." -type = "spec-prepend-lines" -section = "%changelog" -lines = [ - "* Wed May 27 2026 Daniel McIlvaney - 6.18.31-1.5", - "- feat(kernel): add hand-curated changelog entry", - "", - "* Wed May 27 2026 Elaheh Dehghani - 6.18.31-1.4", - "- feat(kernel): add kmod-nvidia-open subpackage framework", - "", - "* Mon May 18 2026 Rachel Menge - 6.18.31-1.3", - "- feat(kernel): disable CONFIG_AF_RXRPC and CONFIG_AFS_FS", - "", - "* Mon May 18 2026 Rachel Menge - 6.18.31-1.2", - "- feat(kernel): disable CONFIG_INET_ESPINTCP, CONFIG_INET6_ESPINTCP, CONFIG_XFRM_ESPINTCP", - "", - "* Mon May 18 2026 Rachel Menge - 6.18.31-1.1", - "- feat(kernel): update kernel and kernel-headers to 6.18.31.1", - "", - "* Thu May 14 2026 Rachel Menge - 6.18.29-1.2", - "- chore(kernel): remove unused azurelinux_version macro", - "", - "* Wed May 13 2026 Rachel Menge - 6.18.29-1.1", - "- feat(kernel): update source to 6.18.29.1 (rolling-lts/azl4)", - "", - "* Wed May 13 2026 Daniel McIlvaney - 6.18.13-1.12", - "- chore(locks): update kernel locks to work with azldev 9696597 (allow file replacement)", - "", - "* Mon May 11 2026 Tobias Brick - 6.18.13-1.11", - "- kernel: Add bpf and ipe to CONFIG_LSM", - "", - "* Mon May 11 2026 Rachel Menge - 6.18.13-1.10", - "- fix(kernel): enable CONFIG_MITIGATION_GDS", - "", - "* Mon May 11 2026 Rachel Menge - 6.18.13-1.9", - "- fix(kernel): enable CONFIG_IO_STRICT_DEVMEM", - "", - "* Mon May 11 2026 Rachel Menge - 6.18.13-1.8", - "- fix(kernel): drop CONFIG_MODIFY_LDT_SYSCALL", - "", - "* Mon May 11 2026 Rachel Menge - 6.18.13-1.7", - "- fix(kernel): disable CONFIG_LDISC_AUTOLOAD", - "", - "* Fri May 08 2026 Rachel Menge - 6.18.13-1.6", - "- security(kernel): harden memory mapping and IOMMU defaults", - "", - "* Fri May 08 2026 Rachel Menge - 6.18.13-1.5", - "- security(kernel): enable CET/IBT and remove legacy vsyscall on x86_64", - "", - "* Fri May 08 2026 Rachel Menge - 6.18.13-1.4", - "- security(kernel): disable slab cache merging to prevent cross-cache attacks", - "", - "* Fri May 08 2026 Rachel Menge - 6.18.13-1.3", - "- security(kernel): restore data structure integrity hardening", - "", - "* Tue May 05 2026 Rachel Menge - 6.18.13-1.2", - "- fix(kernel): skip selftests package build", - "", - "* Thu Apr 30 2026 Daniel McIlvaney - 6.18.13-1.1", - "- feat: introduce deterministic commit resolution via Azure Linux lock file", - "", -] diff --git a/base/comps/kernel/overlays/0001-azl-kernel-version-macros.overlay.toml b/base/comps/kernel/overlays/0001-azl-kernel-version-macros.overlay.toml new file mode 100644 index 00000000000..8308483c247 --- /dev/null +++ b/base/comps/kernel/overlays/0001-azl-kernel-version-macros.overlay.toml @@ -0,0 +1,37 @@ +# Point the kernel spec's version/release macros at the AZL kernel (its +# 4-part version scheme). This is about how AZL versions and ships the +# kernel, not a CPU-architecture change, so it can't go upstream. + +# These edits only rewrite version/release strings, so this is +# version/release mechanics -- matching how the sibling kernel-headers package +# categorizes the equivalent specversion/specrelease edits. +# upstream-status inapplicable: permanent AZL-only versioning, never sent upstream. +[metadata] +category = "azl-release-management" +upstream-status = "inapplicable" + +[[overlays]] +description = "Set specrpmversion to 6.18.31" +type = "spec-search-replace" +regex = "%define specrpmversion .+" +replacement = "%define specrpmversion 6.18.31" +[[overlays]] +description = "Derive specversion from specrpmversion. This becomes KVERREL which becomes the uname" +type = "spec-search-replace" +regex = "%define specversion .+" +replacement = "%define specversion %{specrpmversion}" +[[overlays]] +description = "Derive tarfile_release from specrpmversion (include for completeness but later overridden)" +type = "spec-search-replace" +regex = "%define tarfile_release .+" +replacement = "%define tarfile_release %{specrpmversion}" +[[overlays]] +description = "Set pkgrelease to azl_pkgrelease macro. Looks to only be realted to documentation" +type = "spec-search-replace" +regex = "%define pkgrelease .+" +replacement = "%define pkgrelease %{azl_pkgrelease}" +[[overlays]] +description = "Set specrelease to kextraversion.azl_pkgrelease.dist so the 4th version component flows into Release:, uname -r, and /lib/modules/ path" +type = "spec-search-replace" +regex = "%define specrelease .+" +replacement = "%define specrelease %{kextraversion}.%{azl_pkgrelease}%{?buildid}%{?dist}" diff --git a/base/comps/kernel/overlays/0002-azl-kernel-source.overlay.toml b/base/comps/kernel/overlays/0002-azl-kernel-source.overlay.toml new file mode 100644 index 00000000000..95724c385e6 --- /dev/null +++ b/base/comps/kernel/overlays/0002-azl-kernel-source.overlay.toml @@ -0,0 +1,17 @@ +# Build from AZL's own kernel source tree (CBL-Mariner-Linux-Kernel) +# instead of the Fedora tarball. Specific to how AZL sources the kernel. +[metadata] +category = "azl-branding-policy" +upstream-status = "inapplicable" + +# Use the AzureLinux kernel source +[[overlays]] +description = "Use AzureLinux kernel source URL" +type = "spec-update-tag" +tag = "Source0" +value = "kernel-%{specrpmversion}.%{kextraversion}.tar.gz" +[[overlays]] +description = "Fix tarball extraction path for AzureLinux" +type = "spec-search-replace" +regex = "linux-%{tarfile_release}" +replacement = "CBL-Mariner-Linux-Kernel-rolling-lts-azl4-%{specrpmversion}.%{kextraversion}" diff --git a/base/comps/kernel/overlays/0003-skip-fedora-process-configs.overlay.toml b/base/comps/kernel/overlays/0003-skip-fedora-process-configs.overlay.toml new file mode 100644 index 00000000000..901bbdc089d --- /dev/null +++ b/base/comps/kernel/overlays/0003-skip-fedora-process-configs.overlay.toml @@ -0,0 +1,15 @@ +# Skip Fedora's process_configs.sh: the f43 configs target 6.18.13 and +# fail listnewconfig against our 6.18.31 kernel. We re-run it with AZL +# configs at the end of %prep. A Fedora version-skew fix for AZL. +[metadata] +category = "azl-compatibility" +upstream-status = "inapplicable" + +# Skip the Fedora process_configs.sh run — Fedora f43 configs target 6.18.13 and lack +# new config options in 6.18.31, causing -n (listnewconfig) to fail. Our AZL overlay at the +# end of %prep replaces all configs and re-runs process_configs.sh with strict validation. +[[overlays]] +description = "Skip Fedora process_configs.sh — f43 configs are for 6.18.13 and fail against 6.18.31 kernel. AZL re-runs at end of %prep." +type = "spec-search-replace" +regex = "RHJOBS=\\$RPM_BUILD_NCPUS SPECPACKAGE_NAME=%\\{name\\} \\./process_configs\\.sh \\$OPTS %\\{specrpmversion\\}" +replacement = "echo \"AZL: skipping Fedora process_configs.sh (re-run with AZL configs below)\" # RHJOBS=$RPM_BUILD_NCPUS SPECPACKAGE_NAME=%{name} ./process_configs.sh $OPTS %{specrpmversion}" diff --git a/base/comps/kernel/overlays/0004-disable-redhat-sources-patches.overlay.toml b/base/comps/kernel/overlays/0004-disable-redhat-sources-patches.overlay.toml new file mode 100644 index 00000000000..91b1ba4c8e2 --- /dev/null +++ b/base/comps/kernel/overlays/0004-disable-redhat-sources-patches.overlay.toml @@ -0,0 +1,24 @@ +# Drop the Red Hat-specific pieces of the Fedora kernel spec — +# Makefile.rhelver (Source1) and the patch--redhat.patch series — +# which don't apply to the AZL kernel source. Removing inapplicable +# upstream content. +[metadata] +category = "azl-pruning" +upstream-status = "inapplicable" + +# Disable redhat-specific sources and patches since they are not applicable to AzureLinux +[[overlays]] +description = "Disable copy of Makefile.rhelver (Source1) — not applicable to AzureLinux" +type = "spec-search-replace" +regex = "cp -a %{SOURCE1} ." +replacement = "# cp -a %{SOURCE1} . (disabled for AzureLinux — Makefile.rhelver is Red Hat-specific)" +[[overlays]] +description = "Disable redhat patch declaration — not applicable to AzureLinux" +type = "spec-search-replace" +regex = "Patch1: patch-%{patchversion}-redhat.patch" +replacement = "# Patch1: patch-%{patchversion}-redhat.patch (disabled for AzureLinux)" +[[overlays]] +description = "Disable redhat patch application — not applicable to AzureLinux" +type = "spec-search-replace" +regex = "ApplyOptionalPatch patch-%{patchversion}-redhat.patch" +replacement = "# ApplyOptionalPatch patch-%{patchversion}-redhat.patch (disabled for AzureLinux)" diff --git a/base/comps/kernel/overlays/0005-azl-kernel-configs.overlay.toml b/base/comps/kernel/overlays/0005-azl-kernel-configs.overlay.toml new file mode 100644 index 00000000000..323878719a9 --- /dev/null +++ b/base/comps/kernel/overlays/0005-azl-kernel-configs.overlay.toml @@ -0,0 +1,46 @@ +# Replace the Fedora-generated kernel configs with complete AZL configs +# (and the AZL signing CA), then re-validate at the end of %prep. Core to +# how AZL builds and ships the kernel. +[metadata] +category = "azl-compatibility" +upstream-status = "inapplicable" + +# Azure Linux kernel configs — full replacements for the Fedora-generated configs. +# The Fedora config pipeline runs fully (generate_all_configs.sh, merge.py, etc.), +# then we overwrite at the end of %prep with our AZL configs and re-run +# process_configs.sh to validate them (make olddefconfig + listnewconfig). +[[overlays]] +description = "Add AZL x86_64 kernel config to sources" +type = "file-add" +file = "6.18-x86_64-azl.config" +source = "../6.18-x86_64-azl.config" +[[overlays]] +description = "Add AZL aarch64 kernel config to sources" +type = "file-add" +file = "6.18-aarch64-azl.config" +source = "../6.18-aarch64-azl.config" +[[overlays]] +description = "Add AZL signing CA certificate (embedded as builtin trusted key via CONFIG_SYSTEM_TRUSTED_KEYS)" +type = "file-add" +file = "azurelinux-ca-20230216.pem" +source = "../azurelinux-ca-20230216.pem" +[[overlays]] +description = "Register AZL x86_64 kernel config as Source5000" +type = "spec-insert-tag" +tag = "Source5000" +value = "6.18-x86_64-azl.config" +[[overlays]] +description = "Register AZL aarch64 kernel config as Source5001" +type = "spec-insert-tag" +tag = "Source5001" +value = "6.18-aarch64-azl.config" +[[overlays]] +description = "Register AZL signing CA certificate as Source5002" +type = "spec-insert-tag" +tag = "Source5002" +value = "azurelinux-ca-20230216.pem" +[[overlays]] +description = "Overwrite Fedora-generated configs with AZL configs and re-validate with process_configs.sh at the end of %prep — lets the entire Fedora config pipeline run first, then overwrites with our complete configs. Only copies the config matching the build arch to avoid cross-arch make failures." +type = "spec-append-lines" +section = "%prep" +lines = ["# AZL: Copy mariner.pem signing CA cert into kernel source tree", "%ifnarch noarch %nobuildarches", "cp %{SOURCE5002} linux-%{KVERREL}/certs/mariner.pem", "# AZL: Overwrite Fedora-generated configs with complete AZL kernel configs", "%{log_msg \"AZL: Overwrite configs with AZL kernel configs\"}", "cd linux-%{KVERREL}/configs", "# Remove all Fedora-generated configs — we replace with AZL configs for build arch only", "rm -f %{name}-%{specrpmversion}-*.config", "%ifarch x86_64", "cp %{SOURCE5000} %{name}-%{specrpmversion}-x86_64.config", "%endif", "%ifarch aarch64", "cp %{SOURCE5001} %{name}-%{specrpmversion}-aarch64.config", "%endif", "# Re-run process_configs.sh to validate AZL configs (make olddefconfig + listnewconfig)", "OPTS=\"-w -n -c\"", "SPECPACKAGE_NAME=%{name} RHJOBS=$RPM_BUILD_NCPUS ./process_configs.sh $OPTS %{specrpmversion}", "cd ../..", "%endif"] diff --git a/base/comps/kernel/overlays/0006-kmod-nvidia-open-framework.overlay.toml b/base/comps/kernel/overlays/0006-kmod-nvidia-open-framework.overlay.toml new file mode 100644 index 00000000000..260a22e5dfb --- /dev/null +++ b/base/comps/kernel/overlays/0006-kmod-nvidia-open-framework.overlay.toml @@ -0,0 +1,125 @@ +# AZL kmod subpackage framework: build out-of-tree modules (nvidia-open) +# as subpackages of the kernel via phase-gated .inc includes and anchor +# sentinels. An AZL-specific way of shipping kernel modules. +[metadata] +category = "azl-compatibility" +upstream-status = "inapplicable" + +# ============================================================================ +# kmod subpackage framework — modular kmod builds alongside the kernel +# +# This framework allows building out-of-tree kernel modules as subpackages of +# the kernel RPM. Each kmod is defined in its own .inc file (e.g. +# kmod-nvidia-open.inc) with phase-gated sections that run at each RPM build +# phase (%description, %prep, %build, %install, %files). +# +# To add a new kmod: +# 1. Create kmod-.inc with phase-gated sections +# 2. Add file-add overlays for .inc and any extra source files +# 3. Add spec-insert-tag overlays to register sources (Source6xxx range) +# 4. Add spec-search-replace overlays targeting the AZL-KMOD-*-ANCHOR +# sentinels for each phase (the anchor survives replacement so the +# next kmod can chain onto it) +# ============================================================================ + +# --- kmod-nvidia-open: source file registration --- +# Registers the NVIDIA open GPU kernel module sources and configuration files. +# Source numbers 6000-6099 are reserved for nvidia-open. +[[overlays]] +description = "Add kmod-nvidia-open.inc subpackage definition to sources" +type = "file-add" +file = "kmod-nvidia-open.inc" +source = "../kmod-nvidia-open.inc" +[[overlays]] +description = "Add NVIDIA modprobe config file for kmod-nvidia-open subpackage" +type = "file-add" +file = "kmod-nvidia-open-modprobe.conf" +source = "../kmod-nvidia-open-modprobe.conf" +[[overlays]] +description = "Register NVIDIA open-gpu-kernel-modules tarball as Source6000" +type = "spec-insert-tag" +tag = "Source6000" +value = "open-gpu-kernel-modules-%{nvidia_open_version}.tar.gz" +[[overlays]] +description = "Register NVIDIA modprobe config as Source6001" +type = "spec-insert-tag" +tag = "Source6001" +value = "kmod-nvidia-open-modprobe.conf" +[[overlays]] +description = "Register kmod-nvidia-open.inc as Source6002" +type = "spec-insert-tag" +tag = "Source6002" +value = "kmod-nvidia-open.inc" +# --- kmod framework: phase anchor insertion --- +# These overlays insert unique sentinel comments at unconditional locations in +# the upstream spec. Per-kmod overlays below target these sentinels with +# spec-search-replace, replacing SENTINEL with + SENTINEL so +# each sentinel survives for the next kmod to chain onto. +[[overlays]] +description = "Insert kmod package anchor after main %description — unconditional location for kmod subpackage declarations" +type = "spec-append-lines" +section = "%description" +lines = ["", "# AZL-KMOD-PACKAGE-ANCHOR — do not remove (kmod overlays chain here)"] +[[overlays]] +description = "Insert kmod prep anchor at end of %prep — unconditional location for kmod source extraction" +type = "spec-append-lines" +section = "%prep" +lines = ["", "# AZL-KMOD-PREP-ANCHOR — do not remove (kmod overlays chain here)"] +[[overlays]] +description = "Insert kmod build anchor before modsign macros — unconditional location at the end of the active %build body" +type = "spec-search-replace" +regex = "# Module signing \\(modsign\\)" +replacement = "# AZL-KMOD-BUILD-ANCHOR — do not remove (kmod overlays chain here)\n\n# Module signing (modsign)" +# Module signing (modsign)""" +[[overlays]] +description = "Insert kmod install anchor before ### clean — unconditional location at the end of the active %install body" +type = "spec-search-replace" +regex = "### clean" +replacement = "# AZL-KMOD-INSTALL-ANCHOR — do not remove (kmod overlays chain here)\n\n###\n### clean" +### +### clean""" +[[overlays]] +description = "Insert kmod files anchor after %files modules-extra-matched — unconditional location for kmod file lists" +type = "spec-append-lines" +section = "%files" +package = "modules-extra-matched" +lines = ["", "# AZL-KMOD-FILES-ANCHOR — do not remove (kmod overlays chain here)"] +# --- kmod-nvidia-open: phase injection --- +# RPM %include is a preprocessor directive — it must appear directly in the spec +# text (not inside a %define macro). Each phase sets _kmod_phase and _kmod_name +# globals, then includes the kmod .inc file. The .inc file's %if guards select +# the correct section for that phase. +# +# To add a new kmod: duplicate the phase blocks below, changing _kmod_name and +# the %include path. Each block targets the framework anchor for its phase. +[[overlays]] +description = "Run kmod 'package' phase at package anchor — declares kmod subpackages" +type = "spec-search-replace" +regex = "# AZL-KMOD-PACKAGE-ANCHOR" +replacement = "# AZL: kmod subpackage declarations (nvidia-open)\n%global _kmod_phase package\n%global _kmod_name nvidia-open\n%include %{_sourcedir}/kmod-nvidia-open.inc\n\n# AZL-KMOD-PACKAGE-ANCHOR" +# AZL-KMOD-PACKAGE-ANCHOR""" +[[overlays]] +description = "Run kmod 'prep' phase at prep anchor — extracts kmod source tarballs" +type = "spec-search-replace" +regex = "# AZL-KMOD-PREP-ANCHOR" +replacement = "# AZL: Prepare kmod subpackage sources (nvidia-open)\n%global _kmod_phase prep\n%global _kmod_name nvidia-open\n%include %{_sourcedir}/kmod-nvidia-open.inc\n\n# AZL-KMOD-PREP-ANCHOR" +# AZL-KMOD-PREP-ANCHOR""" +[[overlays]] +description = "Run kmod 'build' phase at build anchor — compiles NVIDIA modules against the just-built kernel" +type = "spec-search-replace" +regex = "# AZL-KMOD-BUILD-ANCHOR" +replacement = "# AZL: Build kmod subpackage modules (nvidia-open)\n%global _kmod_phase build\n%global _kmod_name nvidia-open\n%include %{_sourcedir}/kmod-nvidia-open.inc\n\n# AZL-KMOD-BUILD-ANCHOR" +# AZL-KMOD-BUILD-ANCHOR""" +[[overlays]] +description = "Run kmod 'install' phase at install anchor — installs NVIDIA modules, configs, and licenses" +type = "spec-search-replace" +regex = "# AZL-KMOD-INSTALL-ANCHOR" +replacement = "# AZL: Install kmod subpackage files (nvidia-open)\n%global _kmod_phase install\n%global _kmod_name nvidia-open\n%include %{_sourcedir}/kmod-nvidia-open.inc\n\n# AZL-KMOD-INSTALL-ANCHOR" +# AZL-KMOD-INSTALL-ANCHOR""" +[[overlays]] +description = "Run kmod 'files' phase at files anchor — adds %post/%postun/%files for NVIDIA kmod subpackage" +type = "spec-search-replace" +regex = "# AZL-KMOD-FILES-ANCHOR" +replacement = "# AZL: kmod subpackage file lists and scriptlets (nvidia-open)\n%global _kmod_phase files\n%global _kmod_name nvidia-open\n%include %{_sourcedir}/kmod-nvidia-open.inc\n\n# AZL-KMOD-FILES-ANCHOR" + +# AZL-KMOD-FILES-ANCHOR""" diff --git a/base/comps/kernel/overlays/0007-azl-changelog.overlay.toml b/base/comps/kernel/overlays/0007-azl-changelog.overlay.toml new file mode 100644 index 00000000000..2370c0ddabb --- /dev/null +++ b/base/comps/kernel/overlays/0007-azl-changelog.overlay.toml @@ -0,0 +1,27 @@ +# Hand-curated AZL changelog entries prepended above the inherited Fedora +# history. The kernel uses manual release calculation (no rpmautospec), +# so these are maintained here. Pure changelog mechanics. +[metadata] +category = "azl-release-management" +upstream-status = "inapplicable" + +# Prepend AZL changelog entries to the top of %changelog. The kernel uses +# `release.calculation = "manual"` (no rpmautospec), so changelog entries are +# hand-curated here rather than derived from `git log`. Convention: one entry +# per lock-fingerprint change, mirroring what synthetic distgit / rpmautospec +# emit. When the lock fingerprint changes (edit to comp.toml, overlays, etc.), +# prepend a new entry here with the next release number. +# +# We intentionally do not use rpmautospec for changelog generation here since +# the kernel spec file is so complicated the tool struggles to parse it (it can +# take on the order of hours to run). Until we have a more robust solution for +# this a manual process will be used. +# +# NOTE: This changelog is best-effort, as upstream changes are integrated into +# the spec the logical ordering will deteriorate, the azl specific entries +# will always be at the top, resulting in a jumbled history. +[[overlays]] +description = "Prepend AZL changelog entries (one per lock-fingerprint change) above the inherited Fedora history. Release is manual, so rpmautospec does not generate these; convention mirrors synthetic distgit output." +type = "spec-prepend-lines" +section = "%changelog" +lines = ["* Wed May 27 2026 Daniel McIlvaney - 6.18.31-1.5", "- feat(kernel): add hand-curated changelog entry", "", "* Wed May 27 2026 Elaheh Dehghani - 6.18.31-1.4", "- feat(kernel): add kmod-nvidia-open subpackage framework", "", "* Mon May 18 2026 Rachel Menge - 6.18.31-1.3", "- feat(kernel): disable CONFIG_AF_RXRPC and CONFIG_AFS_FS", "", "* Mon May 18 2026 Rachel Menge - 6.18.31-1.2", "- feat(kernel): disable CONFIG_INET_ESPINTCP, CONFIG_INET6_ESPINTCP, CONFIG_XFRM_ESPINTCP", "", "* Mon May 18 2026 Rachel Menge - 6.18.31-1.1", "- feat(kernel): update kernel and kernel-headers to 6.18.31.1", "", "* Thu May 14 2026 Rachel Menge - 6.18.29-1.2", "- chore(kernel): remove unused azurelinux_version macro", "", "* Wed May 13 2026 Rachel Menge - 6.18.29-1.1", "- feat(kernel): update source to 6.18.29.1 (rolling-lts/azl4)", "", "* Wed May 13 2026 Daniel McIlvaney - 6.18.13-1.12", "- chore(locks): update kernel locks to work with azldev 9696597 (allow file replacement)", "", "* Mon May 11 2026 Tobias Brick - 6.18.13-1.11", "- kernel: Add bpf and ipe to CONFIG_LSM", "", "* Mon May 11 2026 Rachel Menge - 6.18.13-1.10", "- fix(kernel): enable CONFIG_MITIGATION_GDS", "", "* Mon May 11 2026 Rachel Menge - 6.18.13-1.9", "- fix(kernel): enable CONFIG_IO_STRICT_DEVMEM", "", "* Mon May 11 2026 Rachel Menge - 6.18.13-1.8", "- fix(kernel): drop CONFIG_MODIFY_LDT_SYSCALL", "", "* Mon May 11 2026 Rachel Menge - 6.18.13-1.7", "- fix(kernel): disable CONFIG_LDISC_AUTOLOAD", "", "* Fri May 08 2026 Rachel Menge - 6.18.13-1.6", "- security(kernel): harden memory mapping and IOMMU defaults", "", "* Fri May 08 2026 Rachel Menge - 6.18.13-1.5", "- security(kernel): enable CET/IBT and remove legacy vsyscall on x86_64", "", "* Fri May 08 2026 Rachel Menge - 6.18.13-1.4", "- security(kernel): disable slab cache merging to prevent cross-cache attacks", "", "* Fri May 08 2026 Rachel Menge - 6.18.13-1.3", "- security(kernel): restore data structure integrity hardening", "", "* Tue May 05 2026 Rachel Menge - 6.18.13-1.2", "- fix(kernel): skip selftests package build", "", "* Thu Apr 30 2026 Daniel McIlvaney - 6.18.13-1.1", "- feat: introduce deterministic commit resolution via Azure Linux lock file", ""] diff --git a/base/comps/openbios/openbios.comp.toml b/base/comps/openbios/openbios.comp.toml index 4e34e5f6221..6565dc350b6 100644 --- a/base/comps/openbios/openbios.comp.toml +++ b/base/comps/openbios/openbios.comp.toml @@ -8,8 +8,3 @@ # Release: 1.git%{hash}%{?dist} release = { calculation = "manual" } -[[components.openbios.overlays]] -description = "Restrict build to x86_64 — forthstrap segfaults on aarch64 (upstream bug #18/#25)" -type = "spec-add-tag" -tag = "ExclusiveArch" -value = "x86_64" diff --git a/base/comps/openbios/overlays/0001-restrict-build-x86-64.overlay.toml b/base/comps/openbios/overlays/0001-restrict-build-x86-64.overlay.toml new file mode 100644 index 00000000000..3c4972b2092 --- /dev/null +++ b/base/comps/openbios/overlays/0001-restrict-build-x86-64.overlay.toml @@ -0,0 +1,19 @@ +# Fedora ships openbios as a single noarch RPM (built once on x86_64), so it +# never compiles forthstrap on aarch64 and never hits the segfault, +# so this is an AZL build-infrastructure difference, not a genuine +# per-arch binary adjustment. Hence azl-compatibility, and inapplicable since +# upstream would not add ExclusiveArch: x86_64 to a noarch package. + +[metadata] +category = "azl-compatibility" +upstream-status = "inapplicable" +bugs = [ + { url = "https://github.com/openbios/openbios/issues/18" }, + { url = "https://github.com/openbios/openbios/issues/25" }, +] + +[[overlays]] +description = "Restrict build to x86_64 — forthstrap segfaults on aarch64 (upstream bug #18/#25)" +type = "spec-add-tag" +tag = "ExclusiveArch" +value = "x86_64" diff --git a/base/comps/openfec/openfec.comp.toml b/base/comps/openfec/openfec.comp.toml index 621676cca62..c481c25814b 100644 --- a/base/comps/openfec/openfec.comp.toml +++ b/base/comps/openfec/openfec.comp.toml @@ -1,6 +1,2 @@ [components.openfec] -[[components.openfec.overlays]] -description = "Suppress *-debuginfo subpackages via `%global debug_package %{nil}` to work around an automated malware-scan false-positive (high-entropy heuristic) on the compressed DWARF ELFs in the openfec-debuginfo-*.rpm artefacts. Trade-off: loses post-mortem gdb/crash symbols for libopenfec.so.1.4.2." -type = "spec-prepend-lines" -lines = ["%global debug_package %{nil}"] diff --git a/base/comps/openfec/overlays/0001-suppress-debuginfo-subpackages-global.overlay.toml b/base/comps/openfec/overlays/0001-suppress-debuginfo-subpackages-global.overlay.toml new file mode 100644 index 00000000000..49ea9049f68 --- /dev/null +++ b/base/comps/openfec/overlays/0001-suppress-debuginfo-subpackages-global.overlay.toml @@ -0,0 +1,8 @@ +[metadata] +category = "azl-security-compliance" +upstream-status = "inapplicable" + +[[overlays]] +description = "Suppress *-debuginfo subpackages via `%global debug_package %{nil}` to work around an automated malware-scan false-positive (high-entropy heuristic) on the compressed DWARF ELFs in the openfec-debuginfo-*.rpm artefacts. Trade-off: loses post-mortem gdb/crash symbols for libopenfec.so.1.4.2." +type = "spec-prepend-lines" +lines = ["%global debug_package %{nil}"] diff --git a/base/comps/openssl/openssl.comp.toml b/base/comps/openssl/openssl.comp.toml index b345284c796..556a57f88c7 100644 --- a/base/comps/openssl/openssl.comp.toml +++ b/base/comps/openssl/openssl.comp.toml @@ -4,22 +4,3 @@ # CVE-2026-28390, CVE-2026-28389, CVE-2026-28388 (all High). # Fedora commit: https://src.fedoraproject.org/rpms/openssl/c/0990e54a2f6b6b8e4f3e238175382505fff8be51 spec = { type = "upstream", upstream-commit = "0990e54a2f6b6b8e4f3e238175382505fff8be51" } - -# Azure Linux does not ship fips.so. Extend the existing RHEL fips.so-deletion -# path to cover Azure Linux so the module and its config are excluded from the -# package. -[[components.openssl.overlays]] -type = "spec-search-replace" -regex = '%if \( %\{defined rhel\} && \(! %\{defined centos\}\) && \(! %\{defined eln\}\) \)' -replacement = '%if ( %{defined rhel} && (! %{defined centos}) && (! %{defined eln}) ) || %{defined azurelinux}' -description = "Remove fips.so from openssl on Azure Linux (not supported for public preview)" - -# The above replacement also hits the Requires: openssl-fips-provider guard. -# Suppress that dependency on Azure Linux — openssl-fips-provider is not -# shipped for public preview. -[[components.openssl.overlays]] -type = "spec-remove-tag" -tag = "Requires" -value = "openssl-fips-provider" -package = "libs" -description = "Don't require openssl-fips-provider on Azure Linux" diff --git a/base/comps/openssl/overlays/0001-remove-fips-openssl-supported.overlay.toml b/base/comps/openssl/overlays/0001-remove-fips-openssl-supported.overlay.toml new file mode 100644 index 00000000000..f5dc8f14f54 --- /dev/null +++ b/base/comps/openssl/overlays/0001-remove-fips-openssl-supported.overlay.toml @@ -0,0 +1,23 @@ +# Azure Linux does not ship fips.so. Extend the existing RHEL fips.so-deletion +# path to cover Azure Linux so the module and its config are excluded from the +# package. + +[metadata] +category = "azl-security-compliance" +upstream-status = "inapplicable" + +[[overlays]] +type = "spec-search-replace" +regex = "%if \\( %\\{defined rhel\\} && \\(! %\\{defined centos\\}\\) && \\(! %\\{defined eln\\}\\) \\)" +replacement = "%if ( %{defined rhel} && (! %{defined centos}) && (! %{defined eln}) ) || %{defined azurelinux}" +description = "Remove fips.so from openssl on Azure Linux (not supported for public preview)" + +# The above replacement also hits the Requires: openssl-fips-provider guard. +# Suppress that dependency on Azure Linux — openssl-fips-provider is not +# shipped for public preview. +[[overlays]] +type = "spec-remove-tag" +tag = "Requires" +value = "openssl-fips-provider" +package = "libs" +description = "Don't require openssl-fips-provider on Azure Linux" diff --git a/base/comps/realmd/overlays/0001-set-distro-redhat-realmd.overlay.toml b/base/comps/realmd/overlays/0001-set-distro-redhat-realmd.overlay.toml new file mode 100644 index 00000000000..56600742a1f --- /dev/null +++ b/base/comps/realmd/overlays/0001-set-distro-redhat-realmd.overlay.toml @@ -0,0 +1,14 @@ +# realmd uses --with-distro to select distro-specific behavior (e.g., package names, +# default client). Without this, it falls back to generic defaults that may not match +# Azure Linux's package set which aligns closely with RHEL. + +[metadata] +category = "azl-compatibility" +upstream-status = "inapplicable" + +[[overlays]] +description = "Set --with-distro=redhat so realmd uses RHEL-aligned packages and defaults" +type = "spec-search-replace" +section = "%build" +regex = "%configure" +replacement = "%configure --with-distro=redhat" diff --git a/base/comps/realmd/realmd.comp.toml b/base/comps/realmd/realmd.comp.toml index 813b04a9a24..bd516cb2baf 100644 --- a/base/comps/realmd/realmd.comp.toml +++ b/base/comps/realmd/realmd.comp.toml @@ -1,11 +1 @@ [components.realmd] - -# realmd uses --with-distro to select distro-specific behavior (e.g., package names, -# default client). Without this, it falls back to generic defaults that may not match -# Azure Linux's package set which aligns closely with RHEL. -[[components.realmd.overlays]] -description = "Set --with-distro=redhat so realmd uses RHEL-aligned packages and defaults" -type = "spec-search-replace" -section = "%build" -regex = '%configure' -replacement = '%configure --with-distro=redhat' diff --git a/base/comps/rpm/overlays/0001-customize-rpm-vendor.overlay.toml b/base/comps/rpm/overlays/0001-customize-rpm-vendor.overlay.toml new file mode 100644 index 00000000000..2e0d13e38e9 --- /dev/null +++ b/base/comps/rpm/overlays/0001-customize-rpm-vendor.overlay.toml @@ -0,0 +1,11 @@ +# Update vendor macro. + +[metadata] +category = "azl-branding-policy" +upstream-status = "inapplicable" + +[[overlays]] +description = "Customize RPM vendor" +type = "spec-search-replace" +regex = "RPM_VENDOR=redhat" +replacement = "RPM_VENDOR=azurelinux" diff --git a/base/comps/rpm/rpm.comp.toml b/base/comps/rpm/rpm.comp.toml index caa0074c4a8..5791865a769 100644 --- a/base/comps/rpm/rpm.comp.toml +++ b/base/comps/rpm/rpm.comp.toml @@ -1,11 +1,3 @@ [components.rpm] # Release: %{?snapver:0.%{snapver}.}%{baserelease}%{?dist} release = { calculation = "manual" } - -# Update vendor macro. -[[components.rpm.overlays]] -description = "Customize RPM vendor" -type = "spec-search-replace" -regex = "RPM_VENDOR=redhat" -replacement = "RPM_VENDOR=azurelinux" - diff --git a/base/comps/rust-dlwrap/overlays/0001-bump-release-force-rebuild.overlay.toml b/base/comps/rust-dlwrap/overlays/0001-bump-release-force-rebuild.overlay.toml new file mode 100644 index 00000000000..5c828da5303 --- /dev/null +++ b/base/comps/rust-dlwrap/overlays/0001-bump-release-force-rebuild.overlay.toml @@ -0,0 +1,11 @@ +# WORKAROUND: Manually bump the Release on this package to aid with Stage2 bring-up. + +[metadata] +category = "azl-temp-workaround" +upstream-status = "inapplicable" + +[[overlays]] +description = "Bump release to force rebuild and fix corrupted stage1 RPM (DB size mismatch)" +type = "spec-update-tag" +tag = "Release" +value = "2%{?dist}" diff --git a/base/comps/rust-dlwrap/rust-dlwrap.comp.toml b/base/comps/rust-dlwrap/rust-dlwrap.comp.toml index 72d84192945..c2acd92b955 100644 --- a/base/comps/rust-dlwrap/rust-dlwrap.comp.toml +++ b/base/comps/rust-dlwrap/rust-dlwrap.comp.toml @@ -1,8 +1 @@ [components.rust-dlwrap] - -# WORKAROUND: Manually bump the Release on this package to aid with Stage2 bring-up. -[[components.rust-dlwrap.overlays]] -description = "Bump release to force rebuild and fix corrupted stage1 RPM (DB size mismatch)" -type = "spec-update-tag" -tag = "Release" -value = "2%{?dist}" diff --git a/base/comps/rust-nix/overlays/0001-add-patch-file-handle.overlay.toml b/base/comps/rust-nix/overlays/0001-add-patch-file-handle.overlay.toml new file mode 100644 index 00000000000..28f4fe7dc8a --- /dev/null +++ b/base/comps/rust-nix/overlays/0001-add-patch-file-handle.overlay.toml @@ -0,0 +1,22 @@ +# AZL kernels have 4-part versions like 6.6.121.1-1.azl3, but the semver crate +# in nix's test helpers only understands 3. This patches require_kernel_version! +# to cope by trimming the extra part. +# +# It's a compatibility fix (about our version scheme, not the CPU), and it's +# upstreamable: RHEL/CentOS also use 4-part versions (e.g. 4.18.0-513.el8), so +# the fix helps more than just AZL. +[metadata] +category = "azl-compatibility" +upstream-status = "upstreamable" + +[[overlays]] +description = "Add patch file to handle 4-part kernel versions in the require_kernel_version test macro" +type = "file-add" +file = "fix-4part-kernel-version.patch" +source = "../fix-4part-kernel-version.patch" + +[[overlays]] +description = "Register the 4-part kernel version fix patch in the spec" +type = "spec-insert-tag" +tag = "Patch9999" +value = "fix-4part-kernel-version.patch" diff --git a/base/comps/rust-nix/overlays/0002-skip-inotify-tests-fail.overlay.toml b/base/comps/rust-nix/overlays/0002-skip-inotify-tests-fail.overlay.toml new file mode 100644 index 00000000000..abd1627841b --- /dev/null +++ b/base/comps/rust-nix/overlays/0002-skip-inotify-tests-fail.overlay.toml @@ -0,0 +1,13 @@ +# inotify tests fail with ENOSPC in containerized/mock build environments due +# to exhausted inotify instance limits. + +[metadata] +category = "azl-disable-unsupported-tests" +upstream-status = "inapplicable" + +[[overlays]] +description = "Skip inotify tests that fail in containerized build environments (ENOSPC on inotify_init)" +type = "spec-search-replace" +section = "%check" +regex = "--skip 'src/sys/socket/mod.rs'" +replacement = "--skip sys::test_inotify\n --skip 'src/sys/socket/mod.rs'" diff --git a/base/comps/rust-nix/rust-nix.comp.toml b/base/comps/rust-nix/rust-nix.comp.toml index 3c0a76673f8..b1203e415ec 100644 --- a/base/comps/rust-nix/rust-nix.comp.toml +++ b/base/comps/rust-nix/rust-nix.comp.toml @@ -1,25 +1 @@ [components.rust-nix] - -# Azure Linux kernels use 4-part versions (e.g. 6.6.121.1-1.azl3) which the -# semver crate in test helpers cannot parse. Patch the require_kernel_version! -# macro to handle this by truncating to 3 numeric components. -[[components.rust-nix.overlays]] -description = "Add patch file to handle 4-part kernel versions in the require_kernel_version test macro" -type = "file-add" -file = "fix-4part-kernel-version.patch" -source = "fix-4part-kernel-version.patch" - -[[components.rust-nix.overlays]] -description = "Register the 4-part kernel version fix patch in the spec" -type = "spec-insert-tag" -tag = "Patch9999" -value = "fix-4part-kernel-version.patch" - -# inotify tests fail with ENOSPC in containerized/mock build environments due -# to exhausted inotify instance limits. -[[components.rust-nix.overlays]] -description = "Skip inotify tests that fail in containerized build environments (ENOSPC on inotify_init)" -type = "spec-search-replace" -section = "%check" -regex = "--skip 'src/sys/socket/mod.rs'" -replacement = "--skip sys::test_inotify\n --skip 'src/sys/socket/mod.rs'" diff --git a/base/comps/rust-nix0.23/overlays/0001-add-patch-file-handle.overlay.toml b/base/comps/rust-nix0.23/overlays/0001-add-patch-file-handle.overlay.toml new file mode 100644 index 00000000000..28f4fe7dc8a --- /dev/null +++ b/base/comps/rust-nix0.23/overlays/0001-add-patch-file-handle.overlay.toml @@ -0,0 +1,22 @@ +# AZL kernels have 4-part versions like 6.6.121.1-1.azl3, but the semver crate +# in nix's test helpers only understands 3. This patches require_kernel_version! +# to cope by trimming the extra part. +# +# It's a compatibility fix (about our version scheme, not the CPU), and it's +# upstreamable: RHEL/CentOS also use 4-part versions (e.g. 4.18.0-513.el8), so +# the fix helps more than just AZL. +[metadata] +category = "azl-compatibility" +upstream-status = "upstreamable" + +[[overlays]] +description = "Add patch file to handle 4-part kernel versions in the require_kernel_version test macro" +type = "file-add" +file = "fix-4part-kernel-version.patch" +source = "../fix-4part-kernel-version.patch" + +[[overlays]] +description = "Register the 4-part kernel version fix patch in the spec" +type = "spec-insert-tag" +tag = "Patch9999" +value = "fix-4part-kernel-version.patch" diff --git a/base/comps/rust-nix0.23/rust-nix0.23.comp.toml b/base/comps/rust-nix0.23/rust-nix0.23.comp.toml index 5626342c2e7..aed8a5148f4 100644 --- a/base/comps/rust-nix0.23/rust-nix0.23.comp.toml +++ b/base/comps/rust-nix0.23/rust-nix0.23.comp.toml @@ -3,14 +3,3 @@ # Azure Linux kernels use 4-part versions (e.g. 6.6.121.1-1.azl3) which the # semver crate in test helpers cannot parse. Patch the require_kernel_version! # macro to handle this by truncating to 3 numeric components. -[[components.'rust-nix0.23'.overlays]] -description = "Add patch file to handle 4-part kernel versions in the require_kernel_version test macro" -type = "file-add" -file = "fix-4part-kernel-version.patch" -source = "fix-4part-kernel-version.patch" - -[[components.'rust-nix0.23'.overlays]] -description = "Register the 4-part kernel version fix patch in the spec" -type = "spec-insert-tag" -tag = "Patch9999" -value = "fix-4part-kernel-version.patch" diff --git a/base/comps/rust-nix0.28/overlays/0001-add-patch-file-handle.overlay.toml b/base/comps/rust-nix0.28/overlays/0001-add-patch-file-handle.overlay.toml new file mode 100644 index 00000000000..28f4fe7dc8a --- /dev/null +++ b/base/comps/rust-nix0.28/overlays/0001-add-patch-file-handle.overlay.toml @@ -0,0 +1,22 @@ +# AZL kernels have 4-part versions like 6.6.121.1-1.azl3, but the semver crate +# in nix's test helpers only understands 3. This patches require_kernel_version! +# to cope by trimming the extra part. +# +# It's a compatibility fix (about our version scheme, not the CPU), and it's +# upstreamable: RHEL/CentOS also use 4-part versions (e.g. 4.18.0-513.el8), so +# the fix helps more than just AZL. +[metadata] +category = "azl-compatibility" +upstream-status = "upstreamable" + +[[overlays]] +description = "Add patch file to handle 4-part kernel versions in the require_kernel_version test macro" +type = "file-add" +file = "fix-4part-kernel-version.patch" +source = "../fix-4part-kernel-version.patch" + +[[overlays]] +description = "Register the 4-part kernel version fix patch in the spec" +type = "spec-insert-tag" +tag = "Patch9999" +value = "fix-4part-kernel-version.patch" diff --git a/base/comps/rust-nix0.28/rust-nix0.28.comp.toml b/base/comps/rust-nix0.28/rust-nix0.28.comp.toml index 15cfc3d1e07..4ce1c9eda1b 100644 --- a/base/comps/rust-nix0.28/rust-nix0.28.comp.toml +++ b/base/comps/rust-nix0.28/rust-nix0.28.comp.toml @@ -3,14 +3,3 @@ # Azure Linux kernels use 4-part versions (e.g. 6.6.121.1-1.azl3) which the # semver crate in test helpers cannot parse. Patch the require_kernel_version! # macro to handle this by truncating to 3 numeric components. -[[components.'rust-nix0.28'.overlays]] -description = "Add patch file to handle 4-part kernel versions in the require_kernel_version test macro" -type = "file-add" -file = "fix-4part-kernel-version.patch" -source = "fix-4part-kernel-version.patch" - -[[components.'rust-nix0.28'.overlays]] -description = "Register the 4-part kernel version fix patch in the spec" -type = "spec-insert-tag" -tag = "Patch9999" -value = "fix-4part-kernel-version.patch" diff --git a/base/comps/rust-nix0.29/overlays/0001-add-patch-file-handle.overlay.toml b/base/comps/rust-nix0.29/overlays/0001-add-patch-file-handle.overlay.toml new file mode 100644 index 00000000000..28f4fe7dc8a --- /dev/null +++ b/base/comps/rust-nix0.29/overlays/0001-add-patch-file-handle.overlay.toml @@ -0,0 +1,22 @@ +# AZL kernels have 4-part versions like 6.6.121.1-1.azl3, but the semver crate +# in nix's test helpers only understands 3. This patches require_kernel_version! +# to cope by trimming the extra part. +# +# It's a compatibility fix (about our version scheme, not the CPU), and it's +# upstreamable: RHEL/CentOS also use 4-part versions (e.g. 4.18.0-513.el8), so +# the fix helps more than just AZL. +[metadata] +category = "azl-compatibility" +upstream-status = "upstreamable" + +[[overlays]] +description = "Add patch file to handle 4-part kernel versions in the require_kernel_version test macro" +type = "file-add" +file = "fix-4part-kernel-version.patch" +source = "../fix-4part-kernel-version.patch" + +[[overlays]] +description = "Register the 4-part kernel version fix patch in the spec" +type = "spec-insert-tag" +tag = "Patch9999" +value = "fix-4part-kernel-version.patch" diff --git a/base/comps/rust-nix0.29/rust-nix0.29.comp.toml b/base/comps/rust-nix0.29/rust-nix0.29.comp.toml index 769fa5b6e7c..afc25c43aab 100644 --- a/base/comps/rust-nix0.29/rust-nix0.29.comp.toml +++ b/base/comps/rust-nix0.29/rust-nix0.29.comp.toml @@ -3,14 +3,3 @@ # Azure Linux kernels use 4-part versions (e.g. 6.6.121.1-1.azl3) which the # semver crate in test helpers cannot parse. Patch the require_kernel_version! # macro to handle this by truncating to 3 numeric components. -[[components.'rust-nix0.29'.overlays]] -description = "Add patch file to handle 4-part kernel versions in the require_kernel_version test macro" -type = "file-add" -file = "fix-4part-kernel-version.patch" -source = "fix-4part-kernel-version.patch" - -[[components.'rust-nix0.29'.overlays]] -description = "Register the 4-part kernel version fix patch in the spec" -type = "spec-insert-tag" -tag = "Patch9999" -value = "fix-4part-kernel-version.patch" diff --git a/base/comps/rust-nix0.30/overlays/0001-add-patch-file-handle.overlay.toml b/base/comps/rust-nix0.30/overlays/0001-add-patch-file-handle.overlay.toml new file mode 100644 index 00000000000..28f4fe7dc8a --- /dev/null +++ b/base/comps/rust-nix0.30/overlays/0001-add-patch-file-handle.overlay.toml @@ -0,0 +1,22 @@ +# AZL kernels have 4-part versions like 6.6.121.1-1.azl3, but the semver crate +# in nix's test helpers only understands 3. This patches require_kernel_version! +# to cope by trimming the extra part. +# +# It's a compatibility fix (about our version scheme, not the CPU), and it's +# upstreamable: RHEL/CentOS also use 4-part versions (e.g. 4.18.0-513.el8), so +# the fix helps more than just AZL. +[metadata] +category = "azl-compatibility" +upstream-status = "upstreamable" + +[[overlays]] +description = "Add patch file to handle 4-part kernel versions in the require_kernel_version test macro" +type = "file-add" +file = "fix-4part-kernel-version.patch" +source = "../fix-4part-kernel-version.patch" + +[[overlays]] +description = "Register the 4-part kernel version fix patch in the spec" +type = "spec-insert-tag" +tag = "Patch9999" +value = "fix-4part-kernel-version.patch" diff --git a/base/comps/rust-nix0.30/rust-nix0.30.comp.toml b/base/comps/rust-nix0.30/rust-nix0.30.comp.toml index a90316e8fae..85f426817e7 100644 --- a/base/comps/rust-nix0.30/rust-nix0.30.comp.toml +++ b/base/comps/rust-nix0.30/rust-nix0.30.comp.toml @@ -3,14 +3,3 @@ # Azure Linux kernels use 4-part versions (e.g. 6.6.121.1-1.azl3) which the # semver crate in test helpers cannot parse. Patch the require_kernel_version! # macro to handle this by truncating to 3 numeric components. -[[components.'rust-nix0.30'.overlays]] -description = "Add patch file to handle 4-part kernel versions in the require_kernel_version test macro" -type = "file-add" -file = "fix-4part-kernel-version.patch" -source = "fix-4part-kernel-version.patch" - -[[components.'rust-nix0.30'.overlays]] -description = "Register the 4-part kernel version fix patch in the spec" -type = "spec-insert-tag" -tag = "Patch9999" -value = "fix-4part-kernel-version.patch" diff --git a/base/comps/selinux-policy/overlays/0001-remove-tmpfiles-write-sys.overlay.toml b/base/comps/selinux-policy/overlays/0001-remove-tmpfiles-write-sys.overlay.toml new file mode 100644 index 00000000000..8f0bb917359 --- /dev/null +++ b/base/comps/selinux-policy/overlays/0001-remove-tmpfiles-write-sys.overlay.toml @@ -0,0 +1,10 @@ +[metadata] +category = "azl-compatibility" +upstream-status = "unknown" + +[[overlays]] +description = "Remove tmpfiles write to /sys/fs/selinux/checkreqprot as it was deprecated in the kernel" +type = "file-search-replace" +file = "selinux-policy.conf" +regex = "w /sys/fs/selinux/checkreqprot - - - - 0\\n" +replacement = "" diff --git a/base/comps/selinux-policy/selinux-policy.comp.toml b/base/comps/selinux-policy/selinux-policy.comp.toml index 497eb541627..869c9104de8 100644 --- a/base/comps/selinux-policy/selinux-policy.comp.toml +++ b/base/comps/selinux-policy/selinux-policy.comp.toml @@ -2,9 +2,3 @@ # Pin to commit that has version 43.4, which was used in the 0405 stage 1 build. spec = { type = "upstream", upstream-commit = "332e840f1bfe14fc1638dc38dccdf3f701a54bfd" } -[[components.selinux-policy.overlays]] -description = "Remove tmpfiles write to /sys/fs/selinux/checkreqprot as it was deprecated in the kernel" -type = "file-search-replace" -file = "selinux-policy.conf" -regex = 'w /sys/fs/selinux/checkreqprot - - - - 0\n' -replacement = "" diff --git a/base/comps/shim-unsigned-aarch64/overlays/0001-release-management-change.overlay.toml b/base/comps/shim-unsigned-aarch64/overlays/0001-release-management-change.overlay.toml new file mode 100644 index 00000000000..5bb7b520d29 --- /dev/null +++ b/base/comps/shim-unsigned-aarch64/overlays/0001-release-management-change.overlay.toml @@ -0,0 +1,22 @@ +# Workaround: add dist tag to the release to avoid NEVR conflicts +# while we are still rebuilding all packages in new tags nightly. + +[metadata] +category = "azl-temp-workaround" +upstream-status = "inapplicable" + +[[overlays]] +type = "spec-update-tag" +tag = "Release" +value = "2%{?dist}" + +# Workaround: create a compat symlink that does not include the dist tag. +[[overlays]] +type = "spec-append-lines" +section = "%install" +lines = ["ln -s %{version}-%{release} %{buildroot}%{_datadir}/shim/%{version}-2"] + +[[overlays]] +type = "spec-append-lines" +section = "%files" +lines = ["%{_datadir}/shim/%{version}-2"] diff --git a/base/comps/shim-unsigned-aarch64/shim-unsigned-aarch64.comp.toml b/base/comps/shim-unsigned-aarch64/shim-unsigned-aarch64.comp.toml index e0fa86020dd..73f6ab06b9f 100644 --- a/base/comps/shim-unsigned-aarch64/shim-unsigned-aarch64.comp.toml +++ b/base/comps/shim-unsigned-aarch64/shim-unsigned-aarch64.comp.toml @@ -1,12 +1,3 @@ [components.shim-unsigned-aarch64] spec = { type = "upstream", upstream-distro = { name = "fedora", version = "43" }, upstream-commit = "67c1d520f9a8080f6b689714099f813f23154c8f" } -overlays = [ - # Workaround: add dist tag to the release to avoid NEVR conflicts - # while we are still rebuilding all packages in new tags nightly. - { type = "spec-update-tag", tag = "Release", value = "2%{?dist}" }, - - # Workaround: create a compat symlink that does not include the dist tag. - { type = "spec-append-lines", section = "%install", lines = ["ln -s %{version}-%{release} %{buildroot}%{_datadir}/shim/%{version}-2"] }, - { type = "spec-append-lines", section = "%files", lines = ["%{_datadir}/shim/%{version}-2"] } -] diff --git a/base/comps/shim-unsigned-x64/overlays/0001-release-management-change.overlay.toml b/base/comps/shim-unsigned-x64/overlays/0001-release-management-change.overlay.toml new file mode 100644 index 00000000000..5bb7b520d29 --- /dev/null +++ b/base/comps/shim-unsigned-x64/overlays/0001-release-management-change.overlay.toml @@ -0,0 +1,22 @@ +# Workaround: add dist tag to the release to avoid NEVR conflicts +# while we are still rebuilding all packages in new tags nightly. + +[metadata] +category = "azl-temp-workaround" +upstream-status = "inapplicable" + +[[overlays]] +type = "spec-update-tag" +tag = "Release" +value = "2%{?dist}" + +# Workaround: create a compat symlink that does not include the dist tag. +[[overlays]] +type = "spec-append-lines" +section = "%install" +lines = ["ln -s %{version}-%{release} %{buildroot}%{_datadir}/shim/%{version}-2"] + +[[overlays]] +type = "spec-append-lines" +section = "%files" +lines = ["%{_datadir}/shim/%{version}-2"] diff --git a/base/comps/shim-unsigned-x64/shim-unsigned-x64.comp.toml b/base/comps/shim-unsigned-x64/shim-unsigned-x64.comp.toml index be76c19f3c6..3fab1cf3a43 100644 --- a/base/comps/shim-unsigned-x64/shim-unsigned-x64.comp.toml +++ b/base/comps/shim-unsigned-x64/shim-unsigned-x64.comp.toml @@ -1,12 +1,3 @@ [components.shim-unsigned-x64] spec = { type = "upstream", upstream-distro = { name = "fedora", version = "43" }, upstream-commit = "bacb81905ea6806b97b968527e5ca9b2e3f0f7b4" } -overlays = [ - # Workaround: add dist tag to the release to avoid NEVR conflicts - # while we are still rebuilding all packages in new tags nightly. - { type = "spec-update-tag", tag = "Release", value = "2%{?dist}" }, - - # Workaround: create a compat symlink that does not include the dist tag. - { type = "spec-append-lines", section = "%install", lines = ["ln -s %{version}-%{release} %{buildroot}%{_datadir}/shim/%{version}-2"] }, - { type = "spec-append-lines", section = "%files", lines = ["%{_datadir}/shim/%{version}-2"] } -] diff --git a/base/comps/vmaf/overlays/0001-make-vmaf-models-arch.overlay.toml b/base/comps/vmaf/overlays/0001-make-vmaf-models-arch.overlay.toml new file mode 100644 index 00000000000..08e6a8270b9 --- /dev/null +++ b/base/comps/vmaf/overlays/0001-make-vmaf-models-arch.overlay.toml @@ -0,0 +1,22 @@ +# The vmaf spec has ExclusiveArch: x86_64, so libvmaf is only built for +# x86_64. However, the vmaf-models subpackage is BuildArch: noarch, which +# causes it to appear in all arch repos (including aarch64). Since +# vmaf-models requires libvmaf, this creates a repoclosure failure on +# aarch64 where libvmaf doesn't exist. +# +# Fix by removing BuildArch: noarch from the models subpackage so it is +# only available in the x86_64 repo alongside libvmaf. +# TODO(AB#18935): Drop this overlay once publishing is ExclusiveArch-aware +# for noarch subpackages and no longer publishes vmaf-models into arches +# where libvmaf is unavailable. + +[metadata] +category = "azl-temp-workaround" +upstream-status = "inapplicable" + +[[overlays]] +description = "Make vmaf-models arch-specific to avoid repoclosure failure on aarch64" +type = "spec-remove-tag" +tag = "BuildArch" +value = "noarch" +package = "models" diff --git a/base/comps/vmaf/vmaf.comp.toml b/base/comps/vmaf/vmaf.comp.toml index 3e244b25ba1..0cec9aabdfd 100644 --- a/base/comps/vmaf/vmaf.comp.toml +++ b/base/comps/vmaf/vmaf.comp.toml @@ -1,19 +1 @@ [components.vmaf] - -# The vmaf spec has ExclusiveArch: x86_64, so libvmaf is only built for -# x86_64. However, the vmaf-models subpackage is BuildArch: noarch, which -# causes it to appear in all arch repos (including aarch64). Since -# vmaf-models requires libvmaf, this creates a repoclosure failure on -# aarch64 where libvmaf doesn't exist. -# -# Fix by removing BuildArch: noarch from the models subpackage so it is -# only available in the x86_64 repo alongside libvmaf. -# TODO(AB#18935): Drop this overlay once publishing is ExclusiveArch-aware -# for noarch subpackages and no longer publishes vmaf-models into arches -# where libvmaf is unavailable. -[[components.vmaf.overlays]] -description = "Make vmaf-models arch-specific to avoid repoclosure failure on aarch64" -type = "spec-remove-tag" -tag = "BuildArch" -value = "noarch" -package = "models" diff --git a/external/schemas/azldev.schema.json b/external/schemas/azldev.schema.json index e2e8dd16836..23778d19f8c 100644 --- a/external/schemas/azldev.schema.json +++ b/external/schemas/azldev.schema.json @@ -119,6 +119,14 @@ "title": "Overlays", "description": "Overlays to apply to this component's spec and/or sources" }, + "overlay-files": { + "items": { + "type": "string" + }, + "type": "array", + "title": "Overlay files", + "description": "Path or glob patterns (relative to the component config file or matched spec directory) matched against the filesystem to locate per-file overlay documents after component config resolution. Use an empty list to disable inherited overlay-file patterns" + }, "build": { "$ref": "#/$defs/ComponentBuildConfig", "title": "Build configuration", @@ -161,6 +169,11 @@ "title": "Description", "description": "Description of this component group" }, + "metadata": { + "$ref": "#/$defs/OverlayMetadata", + "title": "Metadata", + "description": "Optional documentation metadata for this component group" + }, "components": { "items": { "type": "string" @@ -239,12 +252,12 @@ "section": { "type": "string", "title": "Section name", - "description": "The name of the section to which this overlay applies" + "description": "The name of the section to which this overlay applies. Optional for spec-prepend-lines/spec-append-lines/spec-search-replace; when omitted these overlays target the entire spec file." }, "package": { "type": "string", "title": "Package name", - "description": "The name of the sub-package to which this overlay applies" + "description": "The name of the sub-package to which this overlay applies. Cannot be combined with an omitted section on overlays that support whole-file targeting." }, "tag": { "type": "string", @@ -278,6 +291,11 @@ "type": "string", "title": "Source", "description": "For overlays that require a source file as input" + }, + "metadata": { + "$ref": "#/$defs/OverlayMetadata", + "title": "Metadata", + "description": "Optional documentation metadata describing the overlay's intent and provenance" } }, "additionalProperties": false, @@ -344,6 +362,11 @@ "title": "Distros", "description": "Definitions of distros to build for or consume from" }, + "resources": { + "$ref": "#/$defs/ResourcesConfig", + "title": "Resources", + "description": "Reusable named resource definitions" + }, "component-groups": { "additionalProperties": { "$ref": "#/$defs/ComponentGroupConfig" @@ -513,6 +536,11 @@ "type": "string", "title": "Mock config file", "description": "Path to the aarch64 mock config file for this version" + }, + "inputs": { + "$ref": "#/$defs/DistroVersionInputs", + "title": "Inputs", + "description": "Per-use-case input repositories" } }, "additionalProperties": false, @@ -521,6 +549,44 @@ "release-ver" ] }, + "DistroVersionInput": { + "properties": { + "repo": { + "type": "string", + "title": "Repo", + "description": "Name of an entry under [resources.rpm-repos]; mutually exclusive with set" + }, + "set": { + "type": "string", + "title": "Set", + "description": "Name of an entry under [resources.rpm-repo-sets]; mutually exclusive with repo" + } + }, + "additionalProperties": false, + "type": "object" + }, + "DistroVersionInputs": { + "properties": { + "rpm-build": { + "items": { + "$ref": "#/$defs/DistroVersionInput" + }, + "type": "array", + "title": "RPM-build inputs", + "description": "Repos and repo-sets made available to mock when building RPMs" + }, + "image-build": { + "items": { + "$ref": "#/$defs/DistroVersionInput" + }, + "type": "array", + "title": "Image-build inputs", + "description": "Repos and repo-sets made available to kiwi when building images" + } + }, + "additionalProperties": false, + "type": "object" + }, "ImageCapabilities": { "properties": { "machine-bootable": { @@ -643,7 +709,8 @@ "type": { "type": "string", "enum": [ - "download" + "download", + "custom" ], "title": "Origin type", "description": "Type of origin for this source file" @@ -655,6 +722,19 @@ "examples": [ "https://example.com/source.tar.gz" ] + }, + "script": { + "type": "string", + "title": "Script", + "description": "Shell script filename (relative to the component spec directory) to run in mock to generate this source file. Required when origin type is 'custom'." + }, + "mock-packages": { + "items": { + "type": "string" + }, + "type": "array", + "title": "Mock packages", + "description": "RPM packages to install in the mock chroot before running the generation script. Only valid when origin type is 'custom'." } }, "additionalProperties": false, @@ -663,6 +743,61 @@ "type" ] }, + "OverlayMetadata": { + "properties": { + "category": { + "type": "string", + "enum": [ + "upstream-backport", + "azl-pruning", + "azl-compatibility", + "azl-temp-workaround", + "azl-branding-policy", + "azl-disable-flaky-tests", + "azl-disable-unsupported-tests", + "azl-security-compliance", + "azl-release-management", + "azl-platform-adaptation" + ], + "title": "Category", + "description": "Classification of the overlay's intent" + }, + "commits": { + "items": { + "$ref": "#/$defs/URLRef" + }, + "type": "array", + "title": "Commits", + "description": "Upstream commits this overlay backports or references" + }, + "bugs": { + "items": { + "$ref": "#/$defs/URLRef" + }, + "type": "array", + "title": "Bug references", + "description": "References to issue-tracker entries related to this overlay" + }, + "upstream-status": { + "type": "string", + "enum": [ + "upstreamed", + "upstreamable", + "needs-upstream-hook", + "inapplicable", + "unknown" + ], + "title": "Upstream status", + "description": "Classifies the overlay's relationship to its upstream project" + } + }, + "additionalProperties": false, + "type": "object", + "required": [ + "category", + "upstream-status" + ] + }, "PackageConfig": { "properties": { "publish": { @@ -846,6 +981,206 @@ "additionalProperties": false, "type": "object" }, + "ResourcesConfig": { + "properties": { + "rpm-repos": { + "additionalProperties": { + "$ref": "#/$defs/RpmRepoResource" + }, + "propertyNames": { + "type": "string", + "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]*$", + "description": "Name; projected verbatim into dnf section headers and kiwi --add-repo arguments." + }, + "type": "object", + "title": "RPM repositories", + "description": "Reusable named RPM repository definitions" + }, + "rpm-repo-set-templates": { + "additionalProperties": { + "$ref": "#/$defs/RpmRepoSetTemplate" + }, + "propertyNames": { + "type": "string", + "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]*$", + "description": "Name; projected verbatim into dnf section headers and kiwi --add-repo arguments." + }, + "type": "object", + "title": "RPM repo set templates", + "description": "Named layout templates that describe a fixed matrix of sub-repos" + }, + "rpm-repo-sets": { + "additionalProperties": { + "$ref": "#/$defs/RpmRepoSet" + }, + "propertyNames": { + "type": "string", + "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]*$", + "description": "Name; projected verbatim into dnf section headers and kiwi --add-repo arguments." + }, + "type": "object", + "title": "RPM repo sets", + "description": "Template instantiations that expand to a group of related RPM repos" + } + }, + "additionalProperties": false, + "type": "object" + }, + "RpmRepoResource": { + "oneOf": [ + { + "not": { + "required": [ + "metalink" + ] + }, + "required": [ + "base-uri" + ] + }, + { + "not": { + "required": [ + "base-uri" + ] + }, + "required": [ + "metalink" + ] + } + ], + "properties": { + "description": { + "type": "string", + "title": "Description", + "description": "Human-readable description (diagnostic only)" + }, + "type": { + "type": "string", + "enum": [ + "rpm-md" + ], + "title": "Type", + "description": "Repository access protocol; defaults to rpm-md" + }, + "base-uri": { + "type": "string", + "pattern": "^https?://[^\\s]+$", + "format": "uri", + "title": "Base URI", + "description": "Repository base URI (dnf baseurl). Mutually exclusive with metalink. Must be an http(s) URL." + }, + "metalink": { + "type": "string", + "pattern": "^https?://[^\\s]+$", + "format": "uri", + "title": "Metalink", + "description": "Repository metalink URL. Mutually exclusive with base-uri. Must be an http(s) URL." + }, + "disable-gpg-check": { + "type": "boolean", + "title": "Disable GPG check", + "description": "Opt out of GPG signature verification for this repo (zero value = checking enabled)" + }, + "gpg-key": { + "type": "string", + "pattern": "^((https?|file)://\\S+|[^\\s:]\\S*)$", + "title": "GPG key", + "description": "Path or URI to the GPG key file. Accepted URI schemes: http, https, file. Bare paths are resolved relative to the defining TOML file." + }, + "arches": { + "items": { + "type": "string" + }, + "type": "array", + "title": "Arches", + "description": "Restrict to specific target architectures; empty = all" + } + }, + "additionalProperties": false, + "type": "object" + }, + "RpmRepoSet": { + "properties": { + "description": { + "type": "string", + "title": "Description", + "description": "Human-readable description (diagnostic only)" + }, + "template": { + "type": "string", + "title": "Template", + "description": "Name of the rpm-repo-set-template to instantiate" + }, + "base-uri": { + "type": "string", + "pattern": "^https?://[^\\s]+$", + "format": "uri", + "title": "Base URI", + "description": "URL prefix under which all sub-repos in this set live" + }, + "name-prefix": { + "type": "string", + "title": "Name prefix", + "description": "Prepended to each sub-repo's name to form the repo ID" + }, + "gpg-key": { + "type": "string", + "pattern": "^\\S+$", + "title": "GPG key", + "description": "Path or URI to the GPG key file. Accepted URI schemes: http, https, file. Bare paths are resolved relative to the defining TOML file." + }, + "disable-gpg-check": { + "type": "boolean", + "title": "Disable GPG check", + "description": "Opt out of GPG signature verification for repos in this set" + }, + "arches": { + "items": { + "type": "string" + }, + "type": "array", + "title": "Arches", + "description": "Restrict to specific target architectures; empty = all" + }, + "subrepos": { + "items": { + "type": "string" + }, + "type": "array", + "title": "Sub-repos", + "description": "Allowlist of template sub-repos to instantiate (default: all)" + } + }, + "additionalProperties": false, + "type": "object", + "required": [ + "template", + "base-uri" + ] + }, + "RpmRepoSetTemplate": { + "properties": { + "description": { + "type": "string", + "title": "Description", + "description": "Human-readable description (diagnostic only)" + }, + "subrepos": { + "items": { + "$ref": "#/$defs/SubrepoSpec" + }, + "type": "array", + "title": "Sub-repos", + "description": "Ordered list of sub-repos in the layout" + } + }, + "additionalProperties": false, + "type": "object", + "required": [ + "subrepos" + ] + }, "SourceFileReference": { "properties": { "filename": { @@ -934,6 +1269,36 @@ "type" ] }, + "SubrepoSpec": { + "properties": { + "name": { + "type": "string", + "title": "Name", + "description": "Stable short identifier; combined with the set's name-prefix to form the repo ID" + }, + "subpath": { + "type": "string", + "title": "Sub-path", + "description": "Relative path under the set's base URI; may contain $basearch" + }, + "kind": { + "type": "string", + "enum": [ + "binary", + "debug", + "source" + ], + "title": "Kind", + "description": "Sub-repo classification; defaults to binary" + } + }, + "additionalProperties": false, + "type": "object", + "required": [ + "name", + "subpath" + ] + }, "TestSuiteConfig": { "properties": { "description": { @@ -986,6 +1351,22 @@ }, "additionalProperties": false, "type": "object" + }, + "URLRef": { + "properties": { + "url": { + "type": "string", + "pattern": "^https?://", + "format": "uri", + "title": "URL", + "description": "HTTP(S) link to the referenced resource" + } + }, + "additionalProperties": false, + "type": "object", + "required": [ + "url" + ] } }, "$comment": "This schema was auto-generated by: azldev config generate-schema"