fix(apache-commons-compress) repack source tarball without encrypted sources

[anphel31]

Summary

The upstream Apache Commons Compress source tarball
(commons-compress-1.27.1-src.tar.gz) ships encrypted-archive test
fixtures flagged by the AZL RPM signing pipeline (ESRP) as suspicious /
malware-like content:

• commons-compress-1.27.1-src/src/test/resources/bla.encrypted.7z
• commons-compress-1.27.1-src/src/test/resources/password-encrypted.zip

Such content blocks the SRPM from being published. Neither file is used
at runtime — they only feed Apache Commons Compress's encryption-related
unit tests, which are not run in our build (%mvn_build -j -f passes
-f to skip tests, and the spec has no %check) — so removing them has
no effect on the shipped package.

This PR replaces the upstream tarball (effectively, see below) with a
deterministically-repacked one that is byte-identical to upstream
except that those two files have been stripped. The swap is done via
azldev's replace-upstream mechanism, which rewrites the matching entry
in Fedora's sources lookaside manifest in place — so we keep the
upstream filename and the spec's Source0 line is untouched.

Changes

• base/comps/apache-commons-compress/modify_source.sh — New helper
  script that:

  • Downloads commons-compress-1.27.1-src.tar.gz from
    archive.apache.org and verifies its SHA-512 against
    specs/a/apache-commons-compress/sources.
  • Strips every file listed in REMOVE_PATHS (currently bla.encrypted.7z
    and password-encrypted.zip; add more there as new flags arise).
  • Deterministically repacks as commons-compress-1.27.1-src.azl.tar.gz:
    • tar --sort=name --owner=0 --group=0 --numeric-owner --mtime=@1577836800 --format=gnu — stable file order, fixed ownership and mtime.
    • gzip -n -9 — strips filename/mtime from the gzip header so the SHA-512 is identical across re-runs and machines.
  • Emits a SHA-512 sidecar and prints the az storage blob upload
    command for the AZL lookaside cache. The blob is uploaded under the
    upstream filename (no .azl.) because replace-upstream matches
    by filename.

• base/comps/apache-commons-compress/apache-commons-compress.comp.toml
  — Promoted the inline [components.apache-commons-compress] entry
  from base/comps/components.toml to a dedicated file (with a pointer
  comment left behind) and added a [[…source-files]] entry with:

  • filename = "commons-compress-1.27.1-src.tar.gz" (same as upstream).
  • hash / hash-type = "SHA512" of the repacked tarball.
  • origin URL pointing at the AZL lookaside cache.
  • replace-upstream = true + replace-reason = "…" so azldev
    transparently swaps the upstream entry in the sources manifest
    with auditable WARN-level logging.

Reproduction

./base/comps/apache-commons-compress/modify_source.sh
# Writes to base/build/work/scratch/apache-commons-compress/commons-compress-1.27.1-src.azl.tar.gz
# along with a .sha512 sidecar file.

Validation

• azldev comp render -p apache-commons-compress — succeeds; the
  rendered sources manifest has the new SHA-512 swapped in place.
• azldev comp build -p apache-commons-compress — succeeds; produced
  apache-commons-compress-1.27.1-14.azl4.src.rpm and
  apache-commons-compress-1.27.1-14.azl4.noarch.rpm.
• Confirmed the SRPM-embedded commons-compress-1.27.1-src.tar.gz
  matches the expected SHA-512 and contains neither flagged fixture.
• Test build

[Copilot]

Pull request overview

This PR repacks the Apache Commons Compress source tarball to remove ESRP-flagged encrypted test fixtures, then wires the modified source into the Azure Linux component definition and rendered outputs.

Changes:

• Adds a dedicated component definition with a replacement source tarball reference.
• Adds a helper script to reproduce the modified tarball and upload instructions.
• Updates rendered source hash, lock fingerprint, and rpmautospec release/changelog.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
base/comps/apache-commons-compress/apache-commons-compress.comp.toml	Defines the component-specific replacement source file.
base/comps/apache-commons-compress/modify_source.sh	Adds deterministic source repacking helper.
base/comps/components.toml	Removes the inline component entry and leaves a pointer comment.
locks/apache-commons-compress.lock	Refreshes component input fingerprint.
specs/a/apache-commons-compress/apache-commons-compress.spec	Updates rendered release and changelog.
specs/a/apache-commons-compress/sources	Updates rendered source hash for the repacked tarball.

Comments suppressed due to low confidence (2)

base/comps/apache-commons-compress/modify_source.sh:68

• This comment points maintainers to specs/a/apache-commons-compress/sources for the upstream hash, but this PR changes that manifest to the repacked tarball hash. The hard-coded value is still the original upstream hash, so future updates need a reliable upstream source for this value instead of the now-rewritten rendered manifest.

# Known upstream SHA-512 (from specs/a/apache-commons-compress/sources).
# Bump when version changes.
UPSTREAM_SHA512="c7a2cef26959e687ad19b96b5ba8393d7514095e13bf0f29bd41e6b3c3cb2260d8ff23283ff3d5fd137b2522b843e7f0f50ab46bcf0f66df5383674f35f223ab"

base/comps/apache-commons-compress/modify_source.sh:112

• This file list includes directory entries, and GNU tar recurses into directories by default when they are passed via --files-from. Because the same find output also lists every child, the repacked archive will contain duplicate entries rather than being byte-identical to upstream except for the removed fixtures; filter the list or disable recursion before computing the replacement hash.

LC_ALL=C find "${TOPDIR}" -print0 \
  | LC_ALL=C sort -z \
  | LC_ALL=C tar \