Align ACL package manifests with Image Customizer

[Vince Perri (vinceaperri)]

This updates Azure Container Linux's package manifests to match the format used by Image Customizer in microsoft/azure-linux-image-tools#900.

Image and sysext builds now pass container-manifest-2 listings to the generator so each package's supplier comes from the RPM vendor. The published NEVRA lists stay as they are (they don't carry the vendor). Image manifests are named azurecontainerlinux. Sysexts keep their own names.

Package references now use PACKAGE_MANAGER, and documentNamespace starts with https://spdx.org/spdxdocs. I also updated epoch handling, package parsing, and deterministic JSON output to match Image Customizer. The fixtures are updated.

SPDX 2.2 validation still runs. The supplier-completeness check is removed.

The golden-manifest comparison, repeat-run byte-identity check, and generated SPDX 2.2 validation passed with build_library/rpm/tests/validate_golden_manifest.sh <workdir>. git diff --cached --check passed too. I haven't run an image build or kola tests.

[Copilot]

🟡 Changes recommended

The critical SPDX enum issue remains unresolved.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Aligns ACL RPM SPDX manifests with Image Customizer by consuming vendor-bearing container-manifest-2 listings while preserving published package lists.

Changes:

• Updates image and sysext manifest generation and naming.
• Aligns SPDX fields, parsing, suppliers, epochs, and deterministic JSON output.
• Refreshes fixtures and removes NTIA supplier validation.

File summaries

File	Reviewed changes and final comments
build_sysext	Uses vendor-bearing sysext manifest input. Nit (1 vote): Change “Fed” to “Feed” in the comment.
build_library/rpm/tests/validate_golden_manifest.sh	Retains SPDX validation.
build_library/rpm/tests/testdata/tdnf-installed.txt	Removes obsolete fixture.
build_library/rpm/tests/testdata/nevra-packages.txt	Removes obsolete fixture.
build_library/rpm/tests/testdata/expected-manifest.spdx.json	Refreshes expected manifest output.
build_library/rpm/tests/testdata/container-manifest-2-packages.txt	Adds container-manifest-2 fixture data.
build_library/rpm/tests/test_generate_package_manifest.sh	Updates generator tests for the new input format.
build_library/rpm/tests/requirements.txt	Removes the NTIA validator dependency.
build_library/rpm/generate_package_manifest.py	Adds manifest parsing and supplier metadata. Critical (3 votes): Use SPDX’s PACKAGE-MANAGER, not PACKAGE_MANAGER, for referenceCategory.
build_library/rpm/build_image_util.sh	Generates image manifest input listings from RPM metadata.
build_library/reports_util.sh	Updates manifest naming and input configuration.
build_library/build_image_util.sh	Cleans temporary manifest data.

Review details

Suppressed comments (1)

build_sysext:373

• This new comment uses the past tense “Fed” where the surrounding sentence is an instruction to the generator; use “Feed” for grammatical consistency.

    # Fed the container-manifest-2 diff rather than ${SYSEXTNAME}_packages.txt:

• Files reviewed: 12/12 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

Two moderate issues remain in RPM query failure handling and duplicate NEVRA processing.

Review details

Suppressed comments (2)

Previously missed (1) — in code that hasn't changed since the last review.

build_library/rpm/build_image_util.sh:1476

• rpm_query_manifest is piped directly into sort, but the image build enables only set -e (not pipefail). If rpm returns nonzero after emitting some rows, sort still succeeds and the nonempty-file check passes, allowing an incomplete SPDX manifest to be published while the separately generated NEVRA list remains complete. Capture and check the query before sorting the file.

build_library/rpm/generate_package_manifest.py:301

• After detecting a duplicate NEVRA, this code only warns and still appends the package. The generated SPDX document will then contain the same package/purl twice, so duplicate input is not actually handled; skip the duplicate (or fail as before) after warning.

        if package.nevra in seen:
            print(
                f"WARNING: {packages_file}:{number}: Duplicate installed package NEVRA [id={package.nevra}] [line={entry!r}]",
                file=sys.stderr,
            )

• Files reviewed: 12/12 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

Copilot review overview

🔵 Needs a closer look

Image builds and kola tests have not been run, so final human review is warranted.

Review effort: Lite
Findings: None

[Copilot]

Copilot review overview

🔵 Needs a closer look

Two moderate issues remain in sysext package diffing and RPM query error handling.

Review effort: Lite
Findings: None

[Copilot]

Copilot review overview

🔵 Needs a closer look

The changes span multiple packaging paths and have not been validated with image builds or kola tests.

Review effort: Lite
Findings: None

[Copilot]

Copilot review overview

🟡 Changes recommended

Namespace idempotence and RPM-query error handling issues remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1

Open (1)

• Detect RPM query failures instead of treating empty output as valid · New