fix: minizip-ng - remove flagged files - #18625
Conversation
minizip-ng ships two password-protected (encrypted) libFuzzer seed-corpus zips (test/fuzz/unzip_fuzzer_seed_corpus/encrypted_pkcrypt.zip and encrypted_wzaes.zip) that fail the package-signing scan and block signing. Remove both with an azldev archive overlay (file-remove) that deterministically repacks the source tarball, and drop the two CTest cases (unzip-pkcrypt, unzip-wzaes) that read them via a file-search-replace overlay on CMakeLists.txt. The spec builds tests but has no %check; the files/cases are test-only and not shipped in any binary RPM.
There was a problem hiding this comment.
Pull request overview
Removes encrypted minizip-ng test fixtures that block source RPM signing.
Changes:
- Removes encrypted fuzz archives and dependent CTest registrations.
- Pins the repacked archive hash.
- Refreshes generated spec and lock metadata.
Reviewed changes
Copilot reviewed 4 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
base/comps/minizip-ng/minizip-ng.comp.toml |
Defines archive overlays and replacement source hash. |
base/comps/components.toml |
Moves minizip-ng to dedicated configuration. |
locks/minizip-ng.lock |
Refreshes the component fingerprint. |
specs/m/minizip-ng/minizip-ng.spec |
Updates generated release and changelog. |
specs/m/minizip-ng/sources |
Records the repacked archive hash. |
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| # pinned via the source-files entry. | ||
| [[components.minizip-ng.overlays]] | ||
| description = "Remove encrypted fuzz seed-corpus zips" | ||
| type = "file-remove" |
There was a problem hiding this comment.
Verified via azldev comp prepare-sources (inspected the repacked archive: both encrypted_*.zip removed, other seed corpus intact; CMakeLists.txt has only the unzip-pkcrypt/unzip-wzaes add_test blocks removed while unzip-tiny/bzip2/lzma and both create_compress_tests remain) and azldev comp render --check-only (no drift). The removed files are libFuzzer seed-corpus fixtures and the spec has no %check, so no tests run against them — only their two now-dangling CTest registrations were dropped. A full mock build isn't runnable in my environment; CI performs it.
Remove two password-protected (encrypted) libFuzzer seed-corpus zips from minizip-ng and drop the two CTest cases that read them.
minizip-ng ships
test/fuzz/unzip_fuzzer_seed_corpus/encrypted_pkcrypt.zipandencrypted_wzaes.zip. The package-signing scan can't inspect encrypted archives and rejects the .src.rpm, blocking signing. The files are test-only and not shipped in any binary RPM.file-remove, globencrypted_*.zip) removes both and repacks the tarball; the post-overlay hash is pinned viaorigin = { type = "overlay" }.file-search-replaceoverlay onCMakeLists.txtdrops only the two dependent CTest cases (unzip-pkcrypt,unzip-wzaes); the rest are untouched. The spec builds tests but has no%check.azldev comp render --check-onlyreports no drift.