fix(kata-containers): drop Windows-only vendored import libraries - #18706
fix(kata-containers): drop Windows-only vendored import libraries#18706Andrew Phelps (anphel31) wants to merge 1 commit into
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
The archive digest remains a placeholder, generated metadata is stale, and the changelog weekday is incorrect.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Adds an archive overlay to remove Windows-only import libraries from kata-containers’ vendored dependencies.
Changes:
- Removes flagged Windows-only static libraries during rendering.
- Pins the repacked vendor archive.
- Bumps the package release and changelog.
File summaries
| File | Description |
|---|---|
base/comps/kata-containers/kata-containers.comp.toml |
Adds the removal overlay and archive hash pin. |
specs/k/kata-containers/kata-containers.spec |
Updates the rendered release and changelog. |
Review details
- Files reviewed: 2/2 changed files
- Comments generated: 3
- Review effort level: Balanced
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
e5a3865 to
1df0131
Compare
There was a problem hiding this comment.
🟡 Changes recommended
The digest and lock are described as placeholders, and mandatory build, inspection, and smoke-test validation remains outstanding.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
Suppressed comments (1)
base/comps/kata-containers/kata-containers.comp.toml:48
- The PR description identifies this SHA-512 (and the derived
sources/lock state) as a placeholder pending rendering.origin = { type = "overlay" }uses this value to pin the repacked archive, so it must be replaced with the actual post-overlay digest and the dependentsourcesand lock files regenerated before merge.
hash = "aa029a4bc258ef4d13b0c219230112e20a95957cf302c02307919a28b85165c79586b525274232b00b15dc161c7e21093d1c33b45d5d3856dfe1123ad112f62d"
- Files reviewed: 3/4 changed files
- Comments generated: 1
- Review effort level: Balanced
There was a problem hiding this comment.
🟡 Changes recommended
The file-removal overlay uses an incorrect metadata category.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
- Files reviewed: 3/4 changed files
- Comments generated: 1
- Review effort level: Balanced
1df0131 to
5cdd572
Compare
|
/azp run |
|
Azure Pipelines: 2 pipeline(s) were filtered out due to trigger conditions. |
5cdd572 to
2b64357
Compare
There was a problem hiding this comment.
🟢 Approval recommended
The overlays are narrowly scoped, generated state is consistent, and the required build and smoke-test validation is documented.
Review details
- Files reviewed: 3/4 changed files
- Comments generated: 0 new
- Review effort level: Balanced
|
/azp run |
|
Azure Pipelines: 2 pipeline(s) were filtered out due to trigger conditions. |
There was a problem hiding this comment.
🟡 Changes recommended
The component configuration still contains an all-zero source hash inconsistent with the generated sources and claimed validation.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
- Files reviewed: 3/4 changed files
- Comments generated: 1
- Review effort level: Balanced
906ffcd to
48948c8
Compare
48948c8 to
3b7681d
Compare
There was a problem hiding this comment.
🟡 Changes recommended
The rendered 3.26.0-2 package lacks the changelog entry claimed in the PR description.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
- Files reviewed: 4/5 changed files
- Comments generated: 1
- Review effort level: Balanced
There was a problem hiding this comment.
🟡 Changes recommended
The related pruning overlays should share one per-file metadata block as required by repository guidance.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
- Files reviewed: 4/5 changed files
- Comments generated: 1
- Review effort level: Balanced
3b7681d to
891bb3f
Compare
|
/azp run |
|
Azure Pipelines: 2 pipeline(s) were filtered out due to trigger conditions. |
Andrew Phelps (anphel31)
changed the title
891bb3f to
6e9b6da
Compare
The vendored Rust dependencies ship target-gated Windows import libraries
(winapi-*-pc-windows-* and windows_*_{gnu,gnullvm,msvc}) whose lib/ static
archives hold ~1.6M ar members in aggregate, which blows up recursive source
package scanning. These crates are never compiled on Linux, so the lib/
archives are removed and their now-dangling entries are stripped from each
crate's .cargo-checksum.json, leaving cargo's resolve intact. The repacked
vendor tarball is pinned by SHA-512, and the release is bumped to 3.26.0-2
via the azl_release counter.
Signed-off-by: Andrew Phelps <anphel@microsoft.com>
6e9b6da to
a7cfea7
Compare
|
/azp run |
|
Azure Pipelines: 2 pipeline(s) were filtered out due to trigger conditions. |
|
Chatted with Andrew Phelps (@anphel31) offline and we can currently go with #18792 |
Removes the Windows-only static import libraries (and their now-dangling checksum references) from the kata-containers vendored-dependencies archive. The real problem these cause is that recursive source-archive scanning has to expand a ~1.6M-member
ar-archive explosion in the SRPM, which fails the source package signing scan; the crates are all target-gated to Windows and never compiled on Linux.What is removed
File removal — three
file-removeoverlays on the vendor archive (lib/only):**/winapi-*-pc-windows-*/lib/**— legacywinapiimport libraries.**/windows_*_gnu*/lib/**— thewindows_*_{gnu,gnullvm}crates (the big one: eachlibwindows.*.aholds ~21,689 members, vendored per arch/toolchain).**/windows_*_msvc*/lib/**— thewindows_*_msvc.libimport archives.Checksum cleanup — three
file-search-replaceoverlays strip the now-danglinglib/...entries from each affected crate's.cargo-checksum.json(regex'"lib/[^"]*":"[a-f0-9]{64}",', replacement omitted so the match is deleted).All these crates are target-gated (
[target.*-pc-windows-*]/cfg(target_env = ...)), so a Linux build never compiles them (the vendor archive is fully unpacked in%prep, but cargo only verifies manifests for crates it actually builds). Only thelib/archives (and their checksum entries) are dropped — each crate'sCargo.toml/src/skeleton is kept, so cargo's resolve stays intact.The repacked archive is pinned via
origin = { type = "overlay" }; the post-overlay SHA512 (2a9018a4...a447e4c) is filled into thesource-filesentry, the renderedsources, and the lock. The release is bumped to3.26.0-2via theazl_releasecounter (abuild.definesmacro folded into upstream'sReleaseby onespec-set-tagoverlay), matching the repo idiom for manual-release components (rubygem-rake,java-25-openjdk). No manual changelog entry is added — kata's spec isn't%autochangelog.Impact
ar-member count: ~1.6M -> 71 (verified by extracting every remaining.a/.libfrom the repacked tarball and summingar t; the 71 arerustixLinux syscall archives that must stay).lib/refs, 0 invalid JSON afterward).Validation
The three
AGENTS.mdchecks for output-affecting changes:azldev comp build -p kata-containerssucceeds ->kata-containers-3.26.0-2.azl4.x86_64.rpm. The Rust build resolves against the repacked vendor dir with the pruned manifests, confirming cargo tolerates both the removed files and the trimmed checksums on Linux.rpm -qlpshows the expected payload (/usr/bin/kata-runtime,kata-ctl,kata-monitor,containerd-shim-kata-v2,.../kata-agent, ...).kata-runtime --version->3.26.0,kata-monitor --version->0.3.0,kata-ctlloads (all rc=0).render --check-onlyandupdate --check-onlyboth pass with no drift.