fix: Fix 5 components with non-first-parent upstream commits

[Tonisal-byte]

Pin systemtap, linux-sgx, pcp, openscap, yarnpkg
to newer f43 HEAD commits to supersed previously
published versions that were built from non-first-parent commits.

• systemtap: 5.4-3 -> 5.5-1
• linux-sgx: 2.27 -> 2.28
• pcp: 7.1.0-6 -> 7.1.0-8
• openscap: 1.4.3-4 -> 1.4.4-4
• yarnpkg: 1.22.22-17 -> 1.22.22-18

[Copilot]

Pull request overview

This PR updates Azure Linux component pins/locks and rendered specs to move five Fedora 43–sourced components onto newer upstream commits (avoiding previously-selected non-first-parent commits), and carries through the corresponding rendered spec/source changes.

Changes:

• Pin/update upstream commits via *.comp.toml (where applicable) and refresh locks/*.lock for affected components.
• Update rendered specs and source manifests for systemtap, linux-sgx, pcp, openscap, and yarnpkg to match the new upstream commits.
• Adjust/remove/add patch payloads where upstream moved forward (notably linux-sgx and pcp).

Reviewed changes

Copilot reviewed 83 out of 88 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
specs/y/yarnpkg/yarnpkg.spec	Bump release and adjust Fedora-side BuildRequires/changelog entries.
specs/s/systemtap/systemtap.spec	Update to 5.5, adjust sysusers handling/scriptlets, dependency metadata, and remove obsolete gcc16 patch usage.
specs/s/systemtap/systemtap-gcc16.patch	Remove obsolete GCC16 workaround patch (upstream no longer needs it).
specs/s/systemtap/sources	Update systemtap tarball checksum for 5.5.
specs/p/pcp/pcp.spec	Bump release and add SELinux-related patches.
specs/p/pcp/pcp-avc-rocestat.patch	Add SELinux policy fix patch for rocestat PMDA AVC denials.
specs/p/pcp/pcp-avc-nvidia.patch	Add SELinux policy fix patch for nvidia PMDA AVC denials.
specs/o/openscap/sources	Update openscap tarball checksum for 1.4.4.
specs/o/openscap/openscap.spec	Bump openscap version to 1.4.4 and add upstream changelog entry.
specs/l/linux-sgx/sources	Refresh linux-sgx bundled source list/checksums for 2.28 / DCAP 1.25 stack updates.
specs/l/linux-sgx/repack.sh	Adjust repack contents to reflect new prebuilt enclave artifacts.
specs/l/linux-sgx/pccs.sysusers.conf	Remove PCCS sysusers config file from rendered sources.
specs/l/linux-sgx/pccs.service	Remove PCCS systemd service unit from rendered sources.
specs/l/linux-sgx/pccs-nodejs-bundler	Remove PCCS nodejs bundling helper script from rendered sources.
specs/l/linux-sgx/0403-pccsadmin-ignore-errors-trying-to-clear-the-keyring.patch	Drop now-obsolete PCCS admin keyring error-handling patch.
specs/l/linux-sgx/0402-pccsadmin-make-keyring-module-optional.patch	Drop now-obsolete PCCS admin keyring-optional patch.
specs/l/linux-sgx/0401-pccsadmin-remove-leftover-debugging-print-args-state.patch	Drop now-obsolete PCCS admin debug-print removal patch.
specs/l/linux-sgx/0400-service-sanitize-paths-to-all-resources.patch	Drop now-obsolete PCCS service path sanitization patch.
specs/l/linux-sgx/0203-Disable-sm2-and-sm4-crypto-algorithms.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0202-Disable-various-EC-crypto-features.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0201-Workaround-missing-output-directory.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0200-Enable-pointing-sgxssl-build-to-alternative-glibc-he.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0131-pcsclient-fix-name-of-input-file-in-cache-command-he.patch	Drop patch that’s no longer applicable after upstream changes.
specs/l/linux-sgx/0127-qgs-squash-global-placeholders-warning-from-boost-1..patch	Add/refresh patch to address Boost 1.90 placeholder deprecation warnings under -Werror.
specs/l/linux-sgx/0126-ensure-build-terminates-if-prepare_sgxssl.sh-fails.patch	Add/refresh patch to fail fast when prepare script commands fail.
specs/l/linux-sgx/0125-PCS-Client-Tool-Migrate-from-deprecated-pkg_resource.patch	Drop obsolete PCS client migration patch.
specs/l/linux-sgx/0125-disable-building-of-WASM-SIMDE-code.patch	Refresh patch metadata/offsets and adjust debug sanitizer flag placement.
specs/l/linux-sgx/0124-Disable-PcsClientTool-package-build.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0123-use-system-gtest-gmock-libraries.patch	Refresh patch metadata/offsets and update Makefile paths/flags for gtest/gmock usage.
specs/l/linux-sgx/0123-pcsclient-add-fallback-for-when-pyopenssl-is-not-ava.patch	Drop obsolete PCS client pyopenssl fallback patch.
specs/l/linux-sgx/0122-qgs-add-compat-for-boost-1.89-which-deprecated-deadl.patch	Refresh boost compatibility patch metadata/offsets and content.
specs/l/linux-sgx/0122-pcsclient-prefer-pycryptography-over-pyopenssl.patch	Drop obsolete PCS client pycryptography preference patch.
specs/l/linux-sgx/0121-qgs-add-compat-for-boost-1.87-which-drops-asio-io_se.patch	Refresh boost compatibility patch metadata/offsets.
specs/l/linux-sgx/0121-pcsclient-use-more-of-pycryptography-instead-of-pyop.patch	Drop obsolete PCS client migration patch.
specs/l/linux-sgx/0120-pcsclient-ignore-errors-trying-to-clear-the-keyring.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0120-pcsclient-fully-switch-to-pycryptography-for-CRL-ver.patch	Drop obsolete CRL verification migration patch.
specs/l/linux-sgx/0119-pcsclient-convert-from-asn1-to-pyasn1-python-module.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0118-pcsclient-make-keyring-module-optional.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0117-qgs-add-m-MODE-parameter-for-UNIX-socket-mode.patch	Refresh patch metadata/offsets; keep chmod cast fix.
specs/l/linux-sgx/0116-Don-t-stomp-on-VERBOSE-variable.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0114-Delete-broken-checks-for-GCC-version-that-break-fsta.patch	Refresh patch metadata/offsets and file path updates.
specs/l/linux-sgx/0113-Don-t-disable-cf-protection-for-qgs.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0112-Workaround-broken-GCC-15.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0111-Fix-soname-version-for-libsgx_qe3_logic.so-library.patch	Refresh patch metadata/offsets and version constants.
specs/l/linux-sgx/0110-pcsclient-remove-leftover-debugging-print-args-state.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0109-qgs-add-debug-parameter-to-control-logging.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0108-qgs-protect-against-format-strings-in-QL-log-message.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0107-qgs-add-space-between-program-name-first-arg-in-usag.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0106-Honour-CFLAGS-CXXFLAGS-LDFLAGS-for-various-tools-and.patch	Refresh patch metadata/offsets; keep build flags honoring changes.
specs/l/linux-sgx/0105-Look-for-PCKRetrievalTool-config-file-in-etc.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0104-pcsclient-only-import-pypac-module-on-Windows.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0103-Look-for-versioned-sgx_urts-library-in-PCKRetrievalT.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0102-Support-build-time-setting-of-enclave-load-directory.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0100-Drop-use-of-bundled-pre-built-openssl.patch	Refresh patch metadata/offsets and paths after upstream layout changes.
specs/l/linux-sgx/0050-Disable-inclusion-of-AESM-in-installer.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0016-fix-missing-def-of-uncaught_exception.patch	Add patch to fix missing uncaught_exception declaration for newer toolchains.
specs/l/linux-sgx/0016-Add-impl-of-__cxa_call_terminate.patch	Remove obsolete __cxa_call_terminate implementation patch.
specs/l/linux-sgx/0015-fix-BOM-for-mpa_manage-mpa_registration-files.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0014-sdk-avoid-failure-due-to-attribute-regparam-with-GCC.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0014-fix-BOM-for-pccs-with-DCAP.patch	Drop obsolete PCCS BOM fix patch.
specs/l/linux-sgx/0012-Add-wrapper-for-nasm-to-fix-cmake-compat.patch	Refresh patch metadata/offsets and switch wrapper to python3.
specs/l/linux-sgx/0011-Fix-modern-C-function-prototype-compliance.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0010-psw-make-aesm_service-build-verbose.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0009-sdk-honour-CFLAGS-LDFLAGS-set-from-environment.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0008-pcl-remove-redundant-use-of-bool-type.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0007-psw-fix-soname-for-libuae_service.so-library.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0006-psw-prefer-dev-sgx_provision-dev-sgx_enclave.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0005-disable-openmp-protobuf-sample_crypto-builds.patch	Refresh patch metadata/offsets; keep disabling unneeded bundled builds.
specs/l/linux-sgx/0004-Support-disabling-use-of-git-for-ippcp-code.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0003-Improve-make-debuggability.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0002-Add-support-for-building-against-host-CppMicroServic.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0001-Add-support-for-building-against-host-tinyxml2-lib.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0000-Add-support-for-building-against-host-openssl-crypto.patch	Refresh patch metadata/offsets to match updated upstream content.
locks/yarnpkg.lock	Update yarnpkg upstream commit pin and fingerprints.
locks/systemtap.lock	Update systemtap upstream commit pin and fingerprints.
locks/pcp.lock	Update pcp upstream commit pin and fingerprints.
locks/openscap.lock	Update openscap upstream commit pin and fingerprints.
locks/linux-sgx.lock	Update linux-sgx upstream commit pin and fingerprints.
base/comps/systemtap/systemtap.comp.toml	Pin systemtap to a specific upstream commit beyond the default snapshot.
base/comps/pcp/pcp.comp.toml	Add pcp component file to pin upstream commit.
base/comps/openscap/openscap.comp.toml	Pin openscap to a specific upstream commit beyond the default snapshot.
base/comps/linux-sgx/linux-sgx.comp.toml	Add linux-sgx component file to pin upstream commit.
base/comps/components.toml	Remove inline entries for components moved to dedicated *.comp.toml files.

[Copilot]

Pull request overview

Copilot reviewed 83 out of 88 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (9)

specs/o/openscap/openscap.spec:1

• The spec's Release is 4, but the new changelog entry records -1. Please align these so the NVR matches (either reset Release to 1%{?dist} for the 1.4.4 update, or update the changelog entry to 1:1.4.4-4).
  specs/o/openscap/openscap.spec:1
• The spec's Release is 4, but the new changelog entry records -1. Please align these so the NVR matches (either reset Release to 1%{?dist} for the 1.4.4 update, or update the changelog entry to 1:1.4.4-4).
  specs/p/pcp/pcp.spec:1
• The spec Release is now 8, but the latest %changelog entry is still 7.1.0-6. Update the changelog to reflect the new release (and add any missing intermediate entries if required by your process) so the recorded NVR matches the build.
  specs/p/pcp/pcp.spec:1
• The spec Release is now 8, but the latest %changelog entry is still 7.1.0-6. Update the changelog to reflect the new release (and add any missing intermediate entries if required by your process) so the recorded NVR matches the build.
  specs/s/systemtap/systemtap.spec:1
• The comment says the testsuite needs nc/ncat, but the dependency was changed from Requires to Recommends, which can leave the testsuite non-functional on minimal installs. If the testsuite truly requires one of these to run, consider using an RPM rich dependency to ensure at least one is installed (e.g., require /usr/bin/nc OR /usr/bin/ncat) while still being resilient to provider changes.
  specs/s/systemtap/systemtap.spec:1
• The sysusers definitions removed explicit shells (previously /sbin/nologin). To avoid any behavior depending on sysusers/systemd defaults (and to keep the security posture explicit), it’s safer to specify the nologin shell for these system accounts in the sysusers entries.
  specs/s/systemtap/systemtap.spec:1
• The sysusers definitions removed explicit shells (previously /sbin/nologin). To avoid any behavior depending on sysusers/systemd defaults (and to keep the security posture explicit), it’s safer to specify the nologin shell for these system accounts in the sysusers entries.
  specs/s/systemtap/systemtap.spec:1
• The sysusers definitions removed explicit shells (previously /sbin/nologin). To avoid any behavior depending on sysusers/systemd defaults (and to keep the security posture explicit), it’s safer to specify the nologin shell for these system accounts in the sysusers entries.
  specs/y/yarnpkg/yarnpkg.spec:1
• The Release was bumped to 18, but in the provided %changelog excerpt there is no corresponding new 1.22.22-18 changelog entry. Please add a new top entry documenting the reason for the release bump (e.g., the corrected upstream pin / rebuild rationale) to keep the spec metadata consistent.

[christopherco]

Please split these into individual commits in the PR, so we can rebase-merge them while preserving the individual commits (also changelog messages inherit the commit title that modifies the lock file).

Also I'm just curious on the background behind why we're moving these 5 commits forward.

[Tonisal-byte]

Also I'm just curious on the background behind why we're moving these 5 commits forward.

The reason we are moving these 5 commits forward has to do with a bug in azldev that picks commits for the lock files that aren't on our selected upstream Fedora branch. After looking through all the lock files, only these 5 components had pinned a commit not on the f43 lineage. This PR against azldev should fix the problem and prevent incorrect commits from being pinned in the future [here].

Continuing to carry these commits will result in errors when we update the component, as already observed in this commit to systemtap earlier 461439f.

[christopherco]

Thanks for making the updates. Looks like these aren't building in CT due to sources. I'll see if I can handle that.

[christopherco]

I've fixed the sources and everything looks good