From 2b6435725b245db68ff743b2fc6399a8b6b6f0a9 Mon Sep 17 00:00:00 2001 From: Andrew Phelps Date: Thu, 3 Sep 2026 22:56:28 +0000 Subject: [PATCH 1/2] fix: kata-containers - remove flagged files Remove the Windows-only static import libraries from the vendored-dependencies archive via file-remove overlays: the winapi-*-pc-windows-* crates and the windows_*_{gnu,gnullvm,msvc} (windows-targets) family. These crates are target-gated to Windows and never built on Linux, but their lib/ import archives (.a/.lib) ship ~1.6M ar members in aggregate (vendored several times per arch/toolchain) and are flagged during source package signing. Only the lib/ archives are dropped; each crate's Cargo.toml/src/checksum skeleton is kept so cargo's resolve stays intact. The repacked archive is pinned via the source-files SHA512, and the release is bumped for the changed source. --- .../kata-containers/kata-containers.comp.toml | 71 ++++++++++++++++++- locks/kata-containers.lock | 2 +- specs/k/kata-containers/kata-containers.spec | 5 +- specs/k/kata-containers/sources | 2 +- 4 files changed, 76 insertions(+), 4 deletions(-) diff --git a/base/comps/kata-containers/kata-containers.comp.toml b/base/comps/kata-containers/kata-containers.comp.toml index 9748496903a..d6865692fcb 100644 --- a/base/comps/kata-containers/kata-containers.comp.toml +++ b/base/comps/kata-containers/kata-containers.comp.toml @@ -1,3 +1,72 @@ [components.kata-containers] -# Release: 1%{?rcrel}%{?dist} +# Release: 2%{?rcrel}%{?dist} release = { calculation = "manual" } + +# Remove the Windows-only import libraries from the vendored-dependencies archive. +# The winapi-*-pc-windows-* and windows_*_{gnu,gnullvm,msvc} crates are all target-gated +# (`[target.*-pc-windows-*]` / `cfg(target_env = ...)`), so they are never compiled on +# Linux, but their lib/ static-import archives (`.a`/`.lib`) ship ~1.6M ar members in +# aggregate (vendored several times over per arch/toolchain) and are flagged during +# source package signing. Only the lib/ archives are dropped; each crate's Cargo.toml, +# src, and .cargo-checksum.json skeleton is kept so cargo's resolve stays intact. The +# archive is repacked; the resulting hash is pinned via the source-files entry below. +[[components.kata-containers.overlays]] +description = "Remove Windows-only winapi import libraries" +type = "file-remove" +archive = "kata-containers-3.26.0-vendor.tar.gz" +file = "**/winapi-*-pc-windows-*/lib/**" +[components.kata-containers.overlays.metadata] +category = "azl-pruning" +upstream-status = "inapplicable" + +[[components.kata-containers.overlays]] +description = "Remove Windows-only windows_* gnu/gnullvm import libraries" +type = "file-remove" +archive = "kata-containers-3.26.0-vendor.tar.gz" +file = "**/windows_*_gnu*/lib/**" +[components.kata-containers.overlays.metadata] +category = "azl-pruning" +upstream-status = "inapplicable" + +[[components.kata-containers.overlays]] +description = "Remove Windows-only windows_* msvc import libraries" +type = "file-remove" +archive = "kata-containers-3.26.0-vendor.tar.gz" +file = "**/windows_*_msvc*/lib/**" +[components.kata-containers.overlays.metadata] +category = "azl-pruning" +upstream-status = "inapplicable" + +# Bump the release for the repacked (flagged-files-removed) archive. This is a +# manual-release component, so the release is owned here via overlays rather than +# by autorelease. +[[components.kata-containers.overlays]] +description = "Bump release for flagged-file removal" +type = "spec-update-tag" +tag = "Release" +value = "2%{?rcrel}%{?dist}" +[components.kata-containers.overlays.metadata] +category = "azl-release-management" +upstream-status = "inapplicable" + +[[components.kata-containers.overlays]] +description = "Add changelog entry for flagged-file removal" +type = "spec-prepend-lines" +section = "%changelog" +lines = [ + "* Thu Sep 03 2026 Andrew Phelps - 3.26.0-2", + "- Remove flagged files", + "", +] +[components.kata-containers.overlays.metadata] +category = "azl-release-management" +upstream-status = "inapplicable" + +# Pin the post-overlay (repacked) vendor tarball, replacing the upstream sources entry. +[[components.kata-containers.source-files]] +filename = "kata-containers-3.26.0-vendor.tar.gz" +hash = "b2fe1d7f3bee04e651d53505f3570afcef87f7349256c881a25df4fec8d6c6648868244ff29f4def969ae93e9c59956469fcfce0f3994b4c2eaf781bd5a183a7" +hash-type = "SHA512" +origin = { type = "overlay" } +replace-upstream = true +replace-reason = "Removes the Windows-only winapi-*-pc-windows-* and windows_*_{gnu,gnullvm,msvc} static import libraries (lib/*.a and .lib) that are flagged during source package signing; the crates are target-gated to Windows and never built on Linux." diff --git a/locks/kata-containers.lock b/locks/kata-containers.lock index 1facb366214..6f8a64257ca 100644 --- a/locks/kata-containers.lock +++ b/locks/kata-containers.lock @@ -3,5 +3,5 @@ version = 1 import-commit = 'd4a94fd83f31e8a88a8c7d72e424d4f5d83bcdfa' upstream-commit = 'd4a94fd83f31e8a88a8c7d72e424d4f5d83bcdfa' manual-bump = 2 -input-fingerprint = 'sha256:12f7166a983055a79dd08a7770729bba4af6edee9a6d035d9c66cd35ffc9da0a' +input-fingerprint = 'sha256:b301877eaea94a92c3c10b13920bc45a6bc8c7bba8540bb5500b425edb2640e5' resolution-input-hash = 'sha256:466421704711c4fd3c71f0b2ed715a0e61d49e3e26f3a2637fee755795849c8e' diff --git a/specs/k/kata-containers/kata-containers.spec b/specs/k/kata-containers/kata-containers.spec index 51c4b1f2305..073e20fcde7 100644 --- a/specs/k/kata-containers/kata-containers.spec +++ b/specs/k/kata-containers/kata-containers.spec @@ -59,7 +59,7 @@ workload isolation and security advantages of VMs. https://katacontainers.io/.} # Unlike for RHEL, we cannot strip it down because we build all components # (RHEL builds only build kata-agent) Name: %{repo} -Release: 1%{?rcrel}%{?dist} +Release: 2%{?rcrel}%{?dist} Summary: Kata Containers version 3.x repository License: Apache-2.0 Url: https://%{download} @@ -393,6 +393,9 @@ fi %changelog +* Thu Sep 03 2026 Andrew Phelps - 3.26.0-2 +- Remove flagged files + * Mon Feb 09 2026 Christophe de Dinechin - 3.26.0-1 - kata-containers 3.26.0 diff --git a/specs/k/kata-containers/sources b/specs/k/kata-containers/sources index 8957fa978da..881e64d2d10 100644 --- a/specs/k/kata-containers/sources +++ b/specs/k/kata-containers/sources @@ -1,2 +1,2 @@ SHA512 (kata-containers-3.26.0.tar.gz) = 836cf4c0882a9813d854b98cacf22b86806f7e27db903256b6c2a2a6ff4345f50e8c1b2c60c74f08e094471cb08b8fba208412667700a330204d82834220b271 -SHA512 (kata-containers-3.26.0-vendor.tar.gz) = ca216accbb9aeb1f4bb68547d6e1bb7ffceb2b3da58cff4d6bfff1d5af4b5bf52f9a4ae687a56bd7d6269b15437de178b8892acaffe627724c39c375ef6ea56a +SHA512 (kata-containers-3.26.0-vendor.tar.gz) = b2fe1d7f3bee04e651d53505f3570afcef87f7349256c881a25df4fec8d6c6648868244ff29f4def969ae93e9c59956469fcfce0f3994b4c2eaf781bd5a183a7 From 891bb3f45b63bd54342c6d01fecc133037822b8f Mon Sep 17 00:00:00 2001 From: Andrew Phelps Date: Fri, 4 Sep 2026 01:57:00 -0700 Subject: [PATCH 2/2] fix: kata-containers - prune stale cargo checksum entries The file-remove overlays drop each Windows-only crate's lib/ import libraries, but their .cargo-checksum.json manifests still listed those paths, leaving 16947 dangling entries across 141 crates. Cargo's directory source verifies every path in the files map and fails with "failed to verify the checksum of " when one is missing; unlisted files are ignored, so removing the entries is the correct fix. The crates are target-gated to Windows and are not unpacked on a Linux build today, so this is latent rather than breaking, but it would surface if cargo's download filtering changed or a crate stopped being target-gated. --- .../kata-containers/kata-containers.comp.toml | 71 ++++--------------- ...move-windows-import-libraries.overlay.toml | 60 ++++++++++++++++ locks/kata-containers.lock | 2 +- .../kata-containers.azl.macros | 3 + specs/k/kata-containers/kata-containers.spec | 9 +-- specs/k/kata-containers/sources | 2 +- 6 files changed, 84 insertions(+), 63 deletions(-) create mode 100644 base/comps/kata-containers/overlays/0001-remove-windows-import-libraries.overlay.toml create mode 100644 specs/k/kata-containers/kata-containers.azl.macros diff --git a/base/comps/kata-containers/kata-containers.comp.toml b/base/comps/kata-containers/kata-containers.comp.toml index d6865692fcb..49e1ae4f7a1 100644 --- a/base/comps/kata-containers/kata-containers.comp.toml +++ b/base/comps/kata-containers/kata-containers.comp.toml @@ -1,72 +1,29 @@ [components.kata-containers] -# Release: 2%{?rcrel}%{?dist} +# Release: %[1 + %{azl_release}]%{?rcrel}%{?dist} release = { calculation = "manual" } -# Remove the Windows-only import libraries from the vendored-dependencies archive. -# The winapi-*-pc-windows-* and windows_*_{gnu,gnullvm,msvc} crates are all target-gated -# (`[target.*-pc-windows-*]` / `cfg(target_env = ...)`), so they are never compiled on -# Linux, but their lib/ static-import archives (`.a`/`.lib`) ship ~1.6M ar members in -# aggregate (vendored several times over per arch/toolchain) and are flagged during -# source package signing. Only the lib/ archives are dropped; each crate's Cargo.toml, -# src, and .cargo-checksum.json skeleton is kept so cargo's resolve stays intact. The -# archive is repacked; the resulting hash is pinned via the source-files entry below. -[[components.kata-containers.overlays]] -description = "Remove Windows-only winapi import libraries" -type = "file-remove" -archive = "kata-containers-3.26.0-vendor.tar.gz" -file = "**/winapi-*-pc-windows-*/lib/**" -[components.kata-containers.overlays.metadata] -category = "azl-pruning" -upstream-status = "inapplicable" - -[[components.kata-containers.overlays]] -description = "Remove Windows-only windows_* gnu/gnullvm import libraries" -type = "file-remove" -archive = "kata-containers-3.26.0-vendor.tar.gz" -file = "**/windows_*_gnu*/lib/**" -[components.kata-containers.overlays.metadata] -category = "azl-pruning" -upstream-status = "inapplicable" - -[[components.kata-containers.overlays]] -description = "Remove Windows-only windows_* msvc import libraries" -type = "file-remove" -archive = "kata-containers-3.26.0-vendor.tar.gz" -file = "**/windows_*_msvc*/lib/**" -[components.kata-containers.overlays.metadata] -category = "azl-pruning" -upstream-status = "inapplicable" +[components.kata-containers.build.defines] +# AZL-only release counter added to upstream's Release. Bump for an AZL rebuild, +# since manual release calculation can't auto-bump the Release. +azl_release = "1" -# Bump the release for the repacked (flagged-files-removed) archive. This is a -# manual-release component, so the release is owned here via overlays rather than -# by autorelease. [[components.kata-containers.overlays]] -description = "Bump release for flagged-file removal" -type = "spec-update-tag" +description = "Fold azl_release into upstream Release so AZL rebuilds bump independently (manual release calculation can't auto-bump)" +type = "spec-set-tag" tag = "Release" -value = "2%{?rcrel}%{?dist}" -[components.kata-containers.overlays.metadata] -category = "azl-release-management" -upstream-status = "inapplicable" - -[[components.kata-containers.overlays]] -description = "Add changelog entry for flagged-file removal" -type = "spec-prepend-lines" -section = "%changelog" -lines = [ - "* Thu Sep 03 2026 Andrew Phelps - 3.26.0-2", - "- Remove flagged files", - "", -] +value = "%[1 + %{azl_release}]%{?rcrel}%{?dist}" [components.kata-containers.overlays.metadata] category = "azl-release-management" upstream-status = "inapplicable" -# Pin the post-overlay (repacked) vendor tarball, replacing the upstream sources entry. +# The Windows-only import-library removal and the matching cargo-checksum pruning are one +# logical change; they live in overlays/0001-remove-windows-import-libraries.overlay.toml +# (auto-loaded via the project-wide overlay-files glob) under a single azl-pruning metadata +# block. The repacked vendor tarball they produce is pinned below. [[components.kata-containers.source-files]] filename = "kata-containers-3.26.0-vendor.tar.gz" -hash = "b2fe1d7f3bee04e651d53505f3570afcef87f7349256c881a25df4fec8d6c6648868244ff29f4def969ae93e9c59956469fcfce0f3994b4c2eaf781bd5a183a7" +hash = "2a9018a423a83ca80741b203b6b96a6895bae8734751f293e3ce7de772664cd69c87ae2fb8d556e77f31ae52051ce518d7075315858a05b5638290f7ea447e4c" hash-type = "SHA512" origin = { type = "overlay" } replace-upstream = true -replace-reason = "Removes the Windows-only winapi-*-pc-windows-* and windows_*_{gnu,gnullvm,msvc} static import libraries (lib/*.a and .lib) that are flagged during source package signing; the crates are target-gated to Windows and never built on Linux." +replace-reason = "Removes the Windows-only winapi-*-pc-windows-* and windows_*_{gnu,gnullvm,msvc} static import libraries (lib/*.a and .lib) that are flagged during source package signing, and drops the corresponding entries from each crate's .cargo-checksum.json; the crates are target-gated to Windows and never built on Linux." diff --git a/base/comps/kata-containers/overlays/0001-remove-windows-import-libraries.overlay.toml b/base/comps/kata-containers/overlays/0001-remove-windows-import-libraries.overlay.toml new file mode 100644 index 00000000000..2924ca553de --- /dev/null +++ b/base/comps/kata-containers/overlays/0001-remove-windows-import-libraries.overlay.toml @@ -0,0 +1,60 @@ +# Remove the Windows-only import libraries from the vendored-dependencies archive and +# drop their now-dangling entries from each crate's .cargo-checksum.json. +# +# The winapi-*-pc-windows-* and windows_*_{gnu,gnullvm,msvc} crates are all target-gated +# (`[target.*-pc-windows-*]` / `cfg(target_env = ...)`), so they are never compiled on a +# Linux build (the vendor archive is fully unpacked in %prep, but cargo only verifies +# manifests for crates it actually builds). Their lib/ static-import archives (`.a`/`.lib`) +# ship ~1.6M ar members in aggregate (vendored several times over per arch/toolchain), which +# blows up recursive source-package scanning. Only the lib/ archives are dropped; each +# crate's Cargo.toml/src/skeleton is kept so cargo's resolve stays intact. +# +# Cargo's directory source verifies every path listed in a manifest's `files` map and fails +# with "failed to verify the checksum of " when one is missing; it does not object to +# files that exist but are unlisted, so deleting the removed lib/ entries is the correct fix. +# In every affected manifest the lib/ keys sort between `build.rs` and `src/lib.rs`, so a +# trailing comma is always present and the JSON stays valid. The archive is repacked; the +# resulting hash is pinned via the source-files entry in kata-containers.comp.toml. + +[metadata] +category = "azl-pruning" +upstream-status = "inapplicable" + +[[overlays]] +description = "Remove Windows-only winapi import libraries" +type = "file-remove" +archive = "kata-containers-3.26.0-vendor.tar.gz" +file = "**/winapi-*-pc-windows-*/lib/**" + +[[overlays]] +description = "Remove Windows-only windows_* gnu/gnullvm import libraries" +type = "file-remove" +archive = "kata-containers-3.26.0-vendor.tar.gz" +file = "**/windows_*_gnu*/lib/**" + +[[overlays]] +description = "Remove Windows-only windows_* msvc import libraries" +type = "file-remove" +archive = "kata-containers-3.26.0-vendor.tar.gz" +file = "**/windows_*_msvc*/lib/**" + +[[overlays]] +description = "Drop removed winapi import libraries from cargo checksum manifests" +type = "file-search-replace" +archive = "kata-containers-3.26.0-vendor.tar.gz" +file = "**/winapi-*-pc-windows-*/.cargo-checksum.json" +regex = '"lib/[^"]*":"[a-f0-9]{64}",' + +[[overlays]] +description = "Drop removed windows_* gnu/gnullvm import libraries from cargo checksum manifests" +type = "file-search-replace" +archive = "kata-containers-3.26.0-vendor.tar.gz" +file = "**/windows_*_gnu*/.cargo-checksum.json" +regex = '"lib/[^"]*":"[a-f0-9]{64}",' + +[[overlays]] +description = "Drop removed windows_* msvc import libraries from cargo checksum manifests" +type = "file-search-replace" +archive = "kata-containers-3.26.0-vendor.tar.gz" +file = "**/windows_*_msvc*/.cargo-checksum.json" +regex = '"lib/[^"]*":"[a-f0-9]{64}",' diff --git a/locks/kata-containers.lock b/locks/kata-containers.lock index 6f8a64257ca..6f054425671 100644 --- a/locks/kata-containers.lock +++ b/locks/kata-containers.lock @@ -3,5 +3,5 @@ version = 1 import-commit = 'd4a94fd83f31e8a88a8c7d72e424d4f5d83bcdfa' upstream-commit = 'd4a94fd83f31e8a88a8c7d72e424d4f5d83bcdfa' manual-bump = 2 -input-fingerprint = 'sha256:b301877eaea94a92c3c10b13920bc45a6bc8c7bba8540bb5500b425edb2640e5' +input-fingerprint = 'sha256:7af9ed5d24d194c5e606597883d2437524b26367d248e189d3fdc2eb9962e0fe' resolution-input-hash = 'sha256:466421704711c4fd3c71f0b2ed715a0e61d49e3e26f3a2637fee755795849c8e' diff --git a/specs/k/kata-containers/kata-containers.azl.macros b/specs/k/kata-containers/kata-containers.azl.macros new file mode 100644 index 00000000000..60187b70289 --- /dev/null +++ b/specs/k/kata-containers/kata-containers.azl.macros @@ -0,0 +1,3 @@ +# Macros file automatically generated by azldev. +# Do not edit manually; changes will be overwritten. +%azl_release 1 diff --git a/specs/k/kata-containers/kata-containers.spec b/specs/k/kata-containers/kata-containers.spec index 073e20fcde7..d03dbc06776 100644 --- a/specs/k/kata-containers/kata-containers.spec +++ b/specs/k/kata-containers/kata-containers.spec @@ -1,6 +1,9 @@ # This spec file has been modified by azldev to include build configuration overlays. # Do not edit manually; changes may be overwritten. +# All Azure Linux specs with overlays include this macro file, irrespective of whether new macros have been added. +%{load:%{_sourcedir}/kata-containers.azl.macros} + # go-rpm-macros are not available on RHEL. %global have_go_rpm_macros 1 %global with_debug 0 @@ -59,7 +62,7 @@ workload isolation and security advantages of VMs. https://katacontainers.io/.} # Unlike for RHEL, we cannot strip it down because we build all components # (RHEL builds only build kata-agent) Name: %{repo} -Release: 2%{?rcrel}%{?dist} +Release: %[1 + %{azl_release}]%{?rcrel}%{?dist} Summary: Kata Containers version 3.x repository License: Apache-2.0 Url: https://%{download} @@ -69,6 +72,7 @@ Source2: kata-osbuilder.sh Source3: kata-osbuilder-generate.service Source4: 15-dracut.conf Source5: 50-kata +Source9999: kata-containers.azl.macros # Keep this patch downstream as it'd be hard to justify such change upstream Patch0999: 0999-osbuilder-Adjust-agent_version-for-our-builds.patch @@ -393,9 +397,6 @@ fi %changelog -* Thu Sep 03 2026 Andrew Phelps - 3.26.0-2 -- Remove flagged files - * Mon Feb 09 2026 Christophe de Dinechin - 3.26.0-1 - kata-containers 3.26.0 diff --git a/specs/k/kata-containers/sources b/specs/k/kata-containers/sources index 881e64d2d10..361019e3301 100644 --- a/specs/k/kata-containers/sources +++ b/specs/k/kata-containers/sources @@ -1,2 +1,2 @@ SHA512 (kata-containers-3.26.0.tar.gz) = 836cf4c0882a9813d854b98cacf22b86806f7e27db903256b6c2a2a6ff4345f50e8c1b2c60c74f08e094471cb08b8fba208412667700a330204d82834220b271 -SHA512 (kata-containers-3.26.0-vendor.tar.gz) = b2fe1d7f3bee04e651d53505f3570afcef87f7349256c881a25df4fec8d6c6648868244ff29f4def969ae93e9c59956469fcfce0f3994b4c2eaf781bd5a183a7 +SHA512 (kata-containers-3.26.0-vendor.tar.gz) = 2a9018a423a83ca80741b203b6b96a6895bae8734751f293e3ce7de772664cd69c87ae2fb8d556e77f31ae52051ce518d7075315858a05b5638290f7ea447e4c