libkml: strip scanner-flagged test fixture

[PawelWMS]

Fixes: AB#19880

The FS-aware deep scanner in the automated package-signing pipeline flagged testdata/kmz/bad-too-large.kmz shipped inside the upstream libkml-1.3.0.tar.gz tarball as malicious. The fixture is benign by intent — a crafted-malformed ZIP whose uncompressed-size field reports 4,294,967,294 bytes, used by libkml's Google Test suite to exercise the parser's decompression-bomb-rejection code path — but its on-disk shape matches the scanner's malicious-archive heuristics.

Stripped fixture

File	Upstream intent
testdata/kmz/bad-too-large.kmz	ZIP whose uncompressed-size field is crafted to report 4,294,967,294 bytes; exercises ZipFileTest.TestBadTooLarge regression coverage of libkml's decompression-bomb guard.

The other 7 "bad" / "overflow" KMZ test fixtures shipped under testdata/kmz/ (zermatt-photo-bad.kmz, bad.kmz, bad-pk-data.kmz, and the four overflow_*.kmz files) are kept as-is — the latest scan pass cleared them.

Approach

The change overrides Source0 with a byte-deterministic repack that drops the single fixture and surgically removes the matching TEST_F block from tests/kml/base/zip_file_test.cc:

• ZipFileTest.TestBadTooLarge

All sibling test cases in zip_file_test.cc (TestOpenFromString, TestOpenFromFile, TestCreate, TestAddEntryBad, TestBadPkZipData, TestMaxUncompressedSize, …) and every other test runner in the libkml suite are unchanged. The runtime parser code path the deleted test exercised (in src/kml/base/zip_file.cc) is unchanged and remains exercised indirectly by sibling tests that feed valid and invalid inputs through the same open / parse APIs.

Files

• base/comps/libkml/libkml.comp.toml — new dedicated component file with a replace-upstream source override (no spec overlays).
• base/comps/libkml/modify_source.sh — deterministic strip-and-repack helper.
• base/comps/components.toml — inline [components.libkml] row removed; the component is now defined in the dedicated file.
• specs/l/libkml/{libkml.spec,sources} — regenerated with the new Source0 hash.
• locks/libkml.lock — refreshed.

Validation

• azldev comp render -p libkml audit-WARN confirms the upstream libkml-1.3.0.tar.gz entry was swapped to 6f93fcd390c6b21e307638df5d85b15dcb81af81c7409797a247b322df843fb1c36dc6c5eb7dc1346adbf228e09ec4ffdbf450dfe1f9b73cbc32e8803a098c58.
• Lock converges (re-running azldev comp update -p libkml produces no diff).
• Modified tarball regenerates byte-deterministically across runs (two independent runs of modify_source.sh produced identical SHA-512s).
• Modified tarball uploaded to the lookaside path (HTTP 200, 6,623,485 bytes).
• Single GPG-signed commit.

[Copilot]

Pull request overview

Updates the libkml component to avoid automated malware-scanner false positives by replacing upstream Source0 with a deterministic repack that removes one scanner-flagged KMZ test fixture and the single GoogleTest case that references it.

Changes:

• Added a dedicated libkml.comp.toml that overrides Source0 via source-files with replace-upstream = true.
• Added a deterministic modify_source.sh helper to strip testdata/kmz/bad-too-large.kmz and remove ZipFileTest.TestBadTooLarge from the upstream test source.
• Regenerated rendered packaging artifacts (sources hash, spec Release bump) and refreshed the libkml lock fingerprint.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
base/comps/libkml/libkml.comp.toml	Introduces a Source0 override to a modified tarball to avoid scanner heuristics.
base/comps/libkml/modify_source.sh	Provides the deterministic strip-and-repack script used to produce the modified upstream tarball.
base/comps/components.toml	Removes the inline libkml entry now that the component is defined in a dedicated .comp.toml.
specs/l/libkml/sources	Updates the recorded SHA512 for libkml-1.3.0.tar.gz to match the modified tarball.
specs/l/libkml/libkml.spec	Bumps Release as part of the regenerated rendered spec output.
locks/libkml.lock	Updates the lock input fingerprint to reflect the component definition change.