fix: Fix 5 components with non-first-parent upstream commits

[Tonisal-byte]

Pin systemtap, linux-sgx, pcp, openscap, yarnpkg
to newer f43 HEAD commits to supersed previously
published versions that were built from non-first-parent commits.

• systemtap: 5.4-3 -> 5.5-1
• linux-sgx: 2.27 -> 2.28
• pcp: 7.1.0-6 -> 7.1.0-8
• openscap: 1.4.3-4 -> 1.4.4-4
• yarnpkg: 1.22.22-17 -> 1.22.22-18

[Copilot]

Pull request overview

This PR updates Azure Linux component pins/locks and rendered specs to move five Fedora 43–sourced components onto newer upstream commits (avoiding previously-selected non-first-parent commits), and carries through the corresponding rendered spec/source changes.

Changes:

• Pin/update upstream commits via *.comp.toml (where applicable) and refresh locks/*.lock for affected components.
• Update rendered specs and source manifests for systemtap, linux-sgx, pcp, openscap, and yarnpkg to match the new upstream commits.
• Adjust/remove/add patch payloads where upstream moved forward (notably linux-sgx and pcp).

Reviewed changes

Copilot reviewed 83 out of 88 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
specs/y/yarnpkg/yarnpkg.spec	Bump release and adjust Fedora-side BuildRequires/changelog entries.
specs/s/systemtap/systemtap.spec	Update to 5.5, adjust sysusers handling/scriptlets, dependency metadata, and remove obsolete gcc16 patch usage.
specs/s/systemtap/systemtap-gcc16.patch	Remove obsolete GCC16 workaround patch (upstream no longer needs it).
specs/s/systemtap/sources	Update systemtap tarball checksum for 5.5.
specs/p/pcp/pcp.spec	Bump release and add SELinux-related patches.
specs/p/pcp/pcp-avc-rocestat.patch	Add SELinux policy fix patch for rocestat PMDA AVC denials.
specs/p/pcp/pcp-avc-nvidia.patch	Add SELinux policy fix patch for nvidia PMDA AVC denials.
specs/o/openscap/sources	Update openscap tarball checksum for 1.4.4.
specs/o/openscap/openscap.spec	Bump openscap version to 1.4.4 and add upstream changelog entry.
specs/l/linux-sgx/sources	Refresh linux-sgx bundled source list/checksums for 2.28 / DCAP 1.25 stack updates.
specs/l/linux-sgx/repack.sh	Adjust repack contents to reflect new prebuilt enclave artifacts.
specs/l/linux-sgx/pccs.sysusers.conf	Remove PCCS sysusers config file from rendered sources.
specs/l/linux-sgx/pccs.service	Remove PCCS systemd service unit from rendered sources.
specs/l/linux-sgx/pccs-nodejs-bundler	Remove PCCS nodejs bundling helper script from rendered sources.
specs/l/linux-sgx/0403-pccsadmin-ignore-errors-trying-to-clear-the-keyring.patch	Drop now-obsolete PCCS admin keyring error-handling patch.
specs/l/linux-sgx/0402-pccsadmin-make-keyring-module-optional.patch	Drop now-obsolete PCCS admin keyring-optional patch.
specs/l/linux-sgx/0401-pccsadmin-remove-leftover-debugging-print-args-state.patch	Drop now-obsolete PCCS admin debug-print removal patch.
specs/l/linux-sgx/0400-service-sanitize-paths-to-all-resources.patch	Drop now-obsolete PCCS service path sanitization patch.
specs/l/linux-sgx/0203-Disable-sm2-and-sm4-crypto-algorithms.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0202-Disable-various-EC-crypto-features.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0201-Workaround-missing-output-directory.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0200-Enable-pointing-sgxssl-build-to-alternative-glibc-he.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0131-pcsclient-fix-name-of-input-file-in-cache-command-he.patch	Drop patch that’s no longer applicable after upstream changes.
specs/l/linux-sgx/0127-qgs-squash-global-placeholders-warning-from-boost-1..patch	Add/refresh patch to address Boost 1.90 placeholder deprecation warnings under -Werror.
specs/l/linux-sgx/0126-ensure-build-terminates-if-prepare_sgxssl.sh-fails.patch	Add/refresh patch to fail fast when prepare script commands fail.
specs/l/linux-sgx/0125-PCS-Client-Tool-Migrate-from-deprecated-pkg_resource.patch	Drop obsolete PCS client migration patch.
specs/l/linux-sgx/0125-disable-building-of-WASM-SIMDE-code.patch	Refresh patch metadata/offsets and adjust debug sanitizer flag placement.
specs/l/linux-sgx/0124-Disable-PcsClientTool-package-build.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0123-use-system-gtest-gmock-libraries.patch	Refresh patch metadata/offsets and update Makefile paths/flags for gtest/gmock usage.
specs/l/linux-sgx/0123-pcsclient-add-fallback-for-when-pyopenssl-is-not-ava.patch	Drop obsolete PCS client pyopenssl fallback patch.
specs/l/linux-sgx/0122-qgs-add-compat-for-boost-1.89-which-deprecated-deadl.patch	Refresh boost compatibility patch metadata/offsets and content.
specs/l/linux-sgx/0122-pcsclient-prefer-pycryptography-over-pyopenssl.patch	Drop obsolete PCS client pycryptography preference patch.
specs/l/linux-sgx/0121-qgs-add-compat-for-boost-1.87-which-drops-asio-io_se.patch	Refresh boost compatibility patch metadata/offsets.
specs/l/linux-sgx/0121-pcsclient-use-more-of-pycryptography-instead-of-pyop.patch	Drop obsolete PCS client migration patch.
specs/l/linux-sgx/0120-pcsclient-ignore-errors-trying-to-clear-the-keyring.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0120-pcsclient-fully-switch-to-pycryptography-for-CRL-ver.patch	Drop obsolete CRL verification migration patch.
specs/l/linux-sgx/0119-pcsclient-convert-from-asn1-to-pyasn1-python-module.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0118-pcsclient-make-keyring-module-optional.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0117-qgs-add-m-MODE-parameter-for-UNIX-socket-mode.patch	Refresh patch metadata/offsets; keep chmod cast fix.
specs/l/linux-sgx/0116-Don-t-stomp-on-VERBOSE-variable.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0114-Delete-broken-checks-for-GCC-version-that-break-fsta.patch	Refresh patch metadata/offsets and file path updates.
specs/l/linux-sgx/0113-Don-t-disable-cf-protection-for-qgs.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0112-Workaround-broken-GCC-15.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0111-Fix-soname-version-for-libsgx_qe3_logic.so-library.patch	Refresh patch metadata/offsets and version constants.
specs/l/linux-sgx/0110-pcsclient-remove-leftover-debugging-print-args-state.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0109-qgs-add-debug-parameter-to-control-logging.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0108-qgs-protect-against-format-strings-in-QL-log-message.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0107-qgs-add-space-between-program-name-first-arg-in-usag.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0106-Honour-CFLAGS-CXXFLAGS-LDFLAGS-for-various-tools-and.patch	Refresh patch metadata/offsets; keep build flags honoring changes.
specs/l/linux-sgx/0105-Look-for-PCKRetrievalTool-config-file-in-etc.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0104-pcsclient-only-import-pypac-module-on-Windows.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0103-Look-for-versioned-sgx_urts-library-in-PCKRetrievalT.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0102-Support-build-time-setting-of-enclave-load-directory.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0100-Drop-use-of-bundled-pre-built-openssl.patch	Refresh patch metadata/offsets and paths after upstream layout changes.
specs/l/linux-sgx/0050-Disable-inclusion-of-AESM-in-installer.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0016-fix-missing-def-of-uncaught_exception.patch	Add patch to fix missing uncaught_exception declaration for newer toolchains.
specs/l/linux-sgx/0016-Add-impl-of-__cxa_call_terminate.patch	Remove obsolete __cxa_call_terminate implementation patch.
specs/l/linux-sgx/0015-fix-BOM-for-mpa_manage-mpa_registration-files.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0014-sdk-avoid-failure-due-to-attribute-regparam-with-GCC.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0014-fix-BOM-for-pccs-with-DCAP.patch	Drop obsolete PCCS BOM fix patch.
specs/l/linux-sgx/0012-Add-wrapper-for-nasm-to-fix-cmake-compat.patch	Refresh patch metadata/offsets and switch wrapper to python3.
specs/l/linux-sgx/0011-Fix-modern-C-function-prototype-compliance.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0010-psw-make-aesm_service-build-verbose.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0009-sdk-honour-CFLAGS-LDFLAGS-set-from-environment.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0008-pcl-remove-redundant-use-of-bool-type.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0007-psw-fix-soname-for-libuae_service.so-library.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0006-psw-prefer-dev-sgx_provision-dev-sgx_enclave.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0005-disable-openmp-protobuf-sample_crypto-builds.patch	Refresh patch metadata/offsets; keep disabling unneeded bundled builds.
specs/l/linux-sgx/0004-Support-disabling-use-of-git-for-ippcp-code.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0003-Improve-make-debuggability.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0002-Add-support-for-building-against-host-CppMicroServic.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0001-Add-support-for-building-against-host-tinyxml2-lib.patch	Refresh patch metadata/offsets to match updated upstream content.
specs/l/linux-sgx/0000-Add-support-for-building-against-host-openssl-crypto.patch	Refresh patch metadata/offsets to match updated upstream content.
locks/yarnpkg.lock	Update yarnpkg upstream commit pin and fingerprints.
locks/systemtap.lock	Update systemtap upstream commit pin and fingerprints.
locks/pcp.lock	Update pcp upstream commit pin and fingerprints.
locks/openscap.lock	Update openscap upstream commit pin and fingerprints.
locks/linux-sgx.lock	Update linux-sgx upstream commit pin and fingerprints.
base/comps/systemtap/systemtap.comp.toml	Pin systemtap to a specific upstream commit beyond the default snapshot.
base/comps/pcp/pcp.comp.toml	Add pcp component file to pin upstream commit.
base/comps/openscap/openscap.comp.toml	Pin openscap to a specific upstream commit beyond the default snapshot.
base/comps/linux-sgx/linux-sgx.comp.toml	Add linux-sgx component file to pin upstream commit.
base/comps/components.toml	Remove inline entries for components moved to dedicated *.comp.toml files.

[Copilot]

Pull request overview

Copilot reviewed 83 out of 88 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (9)

specs/o/openscap/openscap.spec:1

• The spec's Release is 4, but the new changelog entry records -1. Please align these so the NVR matches (either reset Release to 1%{?dist} for the 1.4.4 update, or update the changelog entry to 1:1.4.4-4).
  specs/o/openscap/openscap.spec:1
• The spec's Release is 4, but the new changelog entry records -1. Please align these so the NVR matches (either reset Release to 1%{?dist} for the 1.4.4 update, or update the changelog entry to 1:1.4.4-4).
  specs/p/pcp/pcp.spec:1
• The spec Release is now 8, but the latest %changelog entry is still 7.1.0-6. Update the changelog to reflect the new release (and add any missing intermediate entries if required by your process) so the recorded NVR matches the build.
  specs/p/pcp/pcp.spec:1
• The spec Release is now 8, but the latest %changelog entry is still 7.1.0-6. Update the changelog to reflect the new release (and add any missing intermediate entries if required by your process) so the recorded NVR matches the build.
  specs/s/systemtap/systemtap.spec:1
• The comment says the testsuite needs nc/ncat, but the dependency was changed from Requires to Recommends, which can leave the testsuite non-functional on minimal installs. If the testsuite truly requires one of these to run, consider using an RPM rich dependency to ensure at least one is installed (e.g., require /usr/bin/nc OR /usr/bin/ncat) while still being resilient to provider changes.
  specs/s/systemtap/systemtap.spec:1
• The sysusers definitions removed explicit shells (previously /sbin/nologin). To avoid any behavior depending on sysusers/systemd defaults (and to keep the security posture explicit), it’s safer to specify the nologin shell for these system accounts in the sysusers entries.
  specs/s/systemtap/systemtap.spec:1
• The sysusers definitions removed explicit shells (previously /sbin/nologin). To avoid any behavior depending on sysusers/systemd defaults (and to keep the security posture explicit), it’s safer to specify the nologin shell for these system accounts in the sysusers entries.
  specs/s/systemtap/systemtap.spec:1
• The sysusers definitions removed explicit shells (previously /sbin/nologin). To avoid any behavior depending on sysusers/systemd defaults (and to keep the security posture explicit), it’s safer to specify the nologin shell for these system accounts in the sysusers entries.
  specs/y/yarnpkg/yarnpkg.spec:1
• The Release was bumped to 18, but in the provided %changelog excerpt there is no corresponding new 1.22.22-18 changelog entry. Please add a new top entry documenting the reason for the release bump (e.g., the corrected upstream pin / rebuild rationale) to keep the spec metadata consistent.