Merge branch 'microsoft:3.0-dev' into 3.0-dev

Author: AkarshHCL

.github/workflows/spec-review-stub.yml

@@ -0,0 +1,52 @@
+# Stub workflow — A copy of this workflow must live on the default branch (3.0) so that the pull_request_target
+# event can trigger it with access to secrets. It then delegates all real work to the reusable template on
+# tomls/base/main, which has the scripts, prompts, and agent definitions.
+#
+# This two-stage design lets fork PRs trigger the review safely: the stub runs in the
+# context of the default branch (with secret access), but the template checks out only
+# .spec files (data) from the PR head — never executable code.
+#
+# A stub is needed because pull_request_target workflows always run in the context of the default branch, so they can't
+# directly use a reusable workflow from the PR head (which would be a security risk since untrusted code could leak
+# the secrets). By having the stub on the default branch, we can safely ensure only the trusted reusable workflow from
+# the base is used, while still allowing the PR head to provide the .spec files as data input.
+name: Spec Review
+
+# pull_request_target is required here: we need secret access (COPILOT_TOKEN) to run the
+# spec review agent on fork PRs. The stub itself runs NO code from the PR — it only
+# delegates to a trusted reusable workflow pinned to tomls/base/main, which sparse-checks
+# out only .spec data files (never executable code) from the PR head.
+on: # zizmor: ignore[dangerous-triggers]
+  pull_request_target:
+    # Only trigger on PRs targeting the toml base branch which modify .spec files. We do
+    # not want to affect PRs targeting other branches.
+
+    branches:
+      - tomls/base/main
+    paths:
+      - '**/*.spec'
+
+permissions: {}
+
+concurrency:
+  group: spec-review-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  review:
+    # Prevent forks from running a stale/vulnerable copy of this stub with Actions enabled
+    if: github.repository == 'microsoft/azurelinux'
+    # Intentionally branch-pinned to our own repo so the
+    # reusable workflow picks up prompt/script/agent updates automatically.
+    uses: microsoft/azurelinux/.github/workflows/spec-review.yml@tomls/base/main # zizmor: ignore[unpinned-uses]
+    permissions:
+      contents: read
+      pull-requests: write # Post review comments and inline annotations on PRs
+    with:
+      pr-head-sha: ${{ github.event.pull_request.head.sha }}
+      pr-head-repo: ${{ github.event.pull_request.head.repo.full_name }}
+      pr-number: ${{ github.event.pull_request.number }}
+      repo: ${{ github.repository }}
+      scripts-ref: tomls/base/main
+    secrets:
+      COPILOT_TOKEN: ${{ secrets.COPILOT_TOKEN }}

.pipelines/containerSourceData/scripts/BuildGoldenDistrolessContainer.sh

@@ -4,6 +4,14 @@
 
 set -e
 
+function docker_cleanup {
+    echo "+++ Cleaning up Docker resources to free disk space"
+    docker system prune -f --volumes || true
+    docker builder prune -f || true
+    echo "+++ Docker cleanup completed"
+    df -h / || true
+}
+
 function DockerBuild {
     local containerName=$1
     local azureLinuxVersion=$2
@@ -41,6 +49,9 @@ function DockerBuild {
         --build-arg RPMS="$rpmsDir" \
         --build-arg LOCAL_REPO_FILE="$marinaraSrcDir/local.repo" \
         --no-cache
+
+    # Cleanup after build to free disk space
+    docker_cleanup
 }
 
 function create_distroless_container {

LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md

@@ -2947,6 +2947,7 @@
                 "nginx",
                 "ninja-build",
                 "nodejs",
+                "nodejs24",
                 "npth",
                 "nspr",
                 "nss",

LICENSES-AND-NOTICES/SPECS/data/licenses.json

@@ -68,7 +68,7 @@ ExcludeArch: i686
 Summary:          389 Directory Server (%{variant})
 Name:             389-ds-base
 Version:          3.1.1
-Release:          7%{?dist}
+Release:          10%{?dist}
 License:          GPL-3.0-or-later AND (0BSD OR Apache-2.0 OR MIT) AND (Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT) AND (Apache-2.0 OR BSL-1.0) AND (Apache-2.0 OR MIT OR Zlib) AND (Apache-2.0 OR MIT) AND (CC-BY-4.0 AND MIT) AND (MIT OR Apache-2.0) AND Unicode-DFS-2016 AND (MIT OR CC0-1.0) AND (MIT OR Unlicense) AND 0BSD AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND MIT AND MIT AND ISC AND MPL-2.0 AND PSF-2.0
 URL:              https://www.port389.org
 Vendor:           Microsoft Corporation
@@ -83,6 +83,7 @@ Source4:          389-ds-base.sysusers
 Source5:          https://fedorapeople.org/groups/389ds/libdb-5.3.28-59.tar.bz2
 %endif
 
+Patch0:           rust-1.90-fixes.patch
 Provides:         ldif2ldbm >= 0
 
 # Attach the buildrequires to the top level package:
@@ -732,6 +733,16 @@ exit 0
 %endif
 
 %changelog
+* Mon Feb 02 2026 Archana Shettigar <v-shettigara@microsoft.com> - 3.1.1-10
+- Bump release to rebuild with rust
+
+* Tue Jan 13 2025 Kavya Sree Kaitepalli <kkaitepalli@microsoft.com> - 3.1.1-9
+- Bump release to rebuild with rust
+- Add patch add explicit lifetime for ValueArrayRef iterator
+
+* Tue Jan 06 2026 Pawel Winogrodzki <pawelwi@microsoft.com> - 3.1.1-8
+- Bumping release to rebuild with new 'net-snmp' libs.
+
 * Fri Aug 08 2025 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 3.1.1-7
 - Bump release to rebuild with rust
 

SPECS-EXTENDED/389-ds-base/389-ds-base.spec

@@ -0,0 +1,25 @@
+From 3a0d6ff3272c4a3d5f2d552a436e4f0fe0756a0a Mon Sep 17 00:00:00 2001
+From: Kavya Sree Kaitepalli <kkaitepalli@microsoft.com>
+Date: Wed, 29 Oct 2025 06:38:08 +0000
+Subject: [PATCH] Add explicit lifetime for ValueArrayRef iterator for Rust 1.90
+
+---
+ src/slapi_r_plugin/src/value.rs | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/slapi_r_plugin/src/value.rs b/src/slapi_r_plugin/src/value.rs
+index 2fd35c8..fec74ac 100644
+--- a/src/slapi_r_plugin/src/value.rs
++++ b/src/slapi_r_plugin/src/value.rs
+@@ -61,7 +61,7 @@ impl ValueArrayRef {
+         ValueArrayRef { raw_slapi_val }
+     }
+ 
+-    pub fn iter(&self) -> ValueArrayRefIter {
++    pub fn iter(&self) -> ValueArrayRefIter<'_> {
+         ValueArrayRefIter {
+             idx: 0,
+             va_ref: &self,
+-- 
+2.45.4
+

SPECS-EXTENDED/389-ds-base/rust-1.90-fixes.patch

@@ -24,7 +24,7 @@ Distribution:   Azure Linux
 %bcond_with tests
 Name:           apache-commons-codec
 Version:        1.15
-Release:        3%{?dist}
+Release:        2%{?dist}
 Summary:        Apache Commons Codec Package
 License:        Apache-2.0
 Group:          Development/Libraries/Java
@@ -104,10 +104,6 @@ install -p -m 644 pom.xml %{buildroot}%{_mavenpomdir}/%{short_name}.pom
 # javadoc
 install -dm 0755 %{buildroot}%{_javadocdir}/%{name}
 cp -pr target/site/apidocs/* %{buildroot}%{_javadocdir}/%{name}/
-# Remove LICENSE from javadoc directory to avoid duplicate license warning
-mv %{buildroot}%{_javadocdir}/%{name}/legal/ADDITIONAL_LICENSE_INFO .
-mv %{buildroot}%{_javadocdir}/%{name}/legal/LICENSE .
-
 %fdupes -s %{buildroot}%{_javadocdir}
 
 %pre javadoc
@@ -117,18 +113,13 @@ fi
 
 %files -f .mfiles
 %license LICENSE.txt
-%license ADDITIONAL_LICENSE_INFO
 %doc RELEASE-NOTES.txt
 %{_javadir}/%{name}.jar
 
 %files javadoc
 %{_javadocdir}/%{name}
 
 %changelog
-* Fri Nov 28 2025 Durga Jagadeesh Palli <v-dpalli@microsoft.com> - 1.15-3
-- Address build error caused by license warning
-- License verified
-
 * Thu Oct 14 2021 Pawel Winogrodzki <pawelwi@microsoft.com> - 1.15-2
 - Converting the 'Release' tag to the '[number].[distribution]' format.
 

SPECS-EXTENDED/apache-commons-codec/apache-commons-codec.spec

@@ -1,17 +1,17 @@
-From 0b10cc9b13fa782b7e318fdbc0d8c790a472f722 Mon Sep 17 00:00:00 2001
+From bba585e9e4fdfc67de3b53b58b8d60923e1ccd0c Mon Sep 17 00:00:00 2001
 From: Michael Simacek <msimacek@redhat.com>
 Date: Mon, 12 Feb 2018 10:53:48 +0100
-Subject: [PATCH 1/3] Remove Brotli compressor
+Subject: [PATCH 1/2] Remove Brotli compressor
 
 ---
- .../compress/compressors/CompressorStreamFactory.java      | 7 +------
+ .../commons/compress/compressors/CompressorStreamFactory.java      | 7 +------
  1 file changed, 1 insertion(+), 6 deletions(-)
 
 diff --git a/src/main/java/org/apache/commons/compress/compressors/CompressorStreamFactory.java b/src/main/java/org/apache/commons/compress/compressors/CompressorStreamFactory.java
-index ca0973095..2406d5a44 100644
+index d730b9d..ab178a9 100644
 --- a/src/main/java/org/apache/commons/compress/compressors/CompressorStreamFactory.java
 +++ b/src/main/java/org/apache/commons/compress/compressors/CompressorStreamFactory.java
-@@ -30,8 +30,6 @@
+@@ -31,8 +31,6 @@ import java.util.Set;
  import java.util.SortedMap;
  import java.util.TreeMap;
 
@@ -20,7 +20,7 @@ index ca0973095..2406d5a44 100644
  import org.apache.commons.compress.compressors.bzip2.BZip2CompressorInputStream;
  import org.apache.commons.compress.compressors.bzip2.BZip2CompressorOutputStream;
  import org.apache.commons.compress.compressors.deflate.DeflateCompressorInputStream;
-@@ -545,10 +543,7 @@ public CompressorInputStream createCompressorInputStream(final String name, fina
+@@ -586,10 +584,7 @@ public class CompressorStreamFactory implements CompressorStreamProvider {
              }
 
              if (BROTLI.equalsIgnoreCase(name)) {
@@ -33,5 +33,5 @@ index ca0973095..2406d5a44 100644
 
              if (XZ.equalsIgnoreCase(name)) {
 -- 
-2.43.0
+2.14.3
 

SPECS-EXTENDED/apache-commons-compress/0001-Remove-Brotli-compressor.patch

@@ -1,58 +1,38 @@
-From d80b7b190c789c33a15f56613a21c44827a63c75 Mon Sep 17 00:00:00 2001
+From bab91e014f73296a8ac9a3aef2aaa324a85e9b96 Mon Sep 17 00:00:00 2001
 From: Michael Simacek <msimacek@redhat.com>
 Date: Mon, 12 Feb 2018 10:59:55 +0100
-Subject: [PATCH 2/3] Remove ZSTD compressor
+Subject: [PATCH 2/2] Remove ZSTD compressor
 
 ---
- .../compressors/CompressorStreamFactory.java  | 22 ++++---------------
- 1 file changed, 4 insertions(+), 18 deletions(-)
+ .../compress/compressors/CompressorStreamFactory.java      | 14 ++------------
+ 1 file changed, 2 insertions(+), 12 deletions(-)
 
 diff --git a/src/main/java/org/apache/commons/compress/compressors/CompressorStreamFactory.java b/src/main/java/org/apache/commons/compress/compressors/CompressorStreamFactory.java
-index 2406d5a44..9ed40a3d7 100644
+index ab178a9..3817704 100644
 --- a/src/main/java/org/apache/commons/compress/compressors/CompressorStreamFactory.java
 +++ b/src/main/java/org/apache/commons/compress/compressors/CompressorStreamFactory.java
-@@ -53,9 +53,6 @@
+@@ -54,9 +54,6 @@ import org.apache.commons.compress.compressors.xz.XZCompressorInputStream;
  import org.apache.commons.compress.compressors.xz.XZCompressorOutputStream;
  import org.apache.commons.compress.compressors.xz.XZUtils;
  import org.apache.commons.compress.compressors.z.ZCompressorInputStream;
 -import org.apache.commons.compress.compressors.zstandard.ZstdCompressorInputStream;
 -import org.apache.commons.compress.compressors.zstandard.ZstdCompressorOutputStream;
 -import org.apache.commons.compress.compressors.zstandard.ZstdUtils;
  import org.apache.commons.compress.utils.IOUtils;
- import org.apache.commons.compress.utils.Sets;
- 
-@@ -280,10 +277,6 @@ static String detect(final InputStream inputStream, final Set<String> compressor
+ import org.apache.commons.compress.utils.Lists;
+ import org.apache.commons.compress.utils.ServiceLoaderIterator;
+@@ -516,10 +513,6 @@ public class CompressorStreamFactory implements CompressorStreamProvider {
              return LZ4_FRAMED;
          }
 
--        if (compressorNames.contains(ZSTANDARD) && ZstdUtils.matches(signature, signatureLength)) {
+-        if (ZstdUtils.matches(signature, signatureLength)) {
 -            return ZSTANDARD;
 -        }
 -
          throw new CompressorException("No Compressor found for the stream signature.");
      }
- 
-@@ -405,10 +398,6 @@ public static String getZ() {
-         return Z;
-     }
- 
--    public static String getZstandard() {
--        return ZSTANDARD;
--    }
--
-     static void putAll(final Set<String> names, final CompressorStreamProvider provider, final TreeMap<String, CompressorStreamProvider> map) {
-         names.forEach(name -> map.put(toKey(name), provider));
-     }
-@@ -513,7 +502,7 @@ public CompressorInputStream createCompressorInputStream(final InputStream in, f
-      * Creates a compressor input stream from a compressor name and an input stream.
-      *
-      * @param name of the compressor, i.e. {@value #GZIP}, {@value #BZIP2}, {@value #XZ}, {@value #LZMA}, {@value #PACK200}, {@value #SNAPPY_RAW},
--     *             {@value #SNAPPY_FRAMED}, {@value #Z}, {@value #LZ4_BLOCK}, {@value #LZ4_FRAMED}, {@value #ZSTANDARD}, {@value #DEFLATE64} or
-+     *             {@value #SNAPPY_FRAMED}, {@value #Z}, {@value #LZ4_BLOCK}, {@value #LZ4_FRAMED}, {@value #DEFLATE64} or
-      *             {@value #DEFLATE}
-      * @param in   the input stream
-      * @return compressor input stream
-@@ -554,10 +543,7 @@ public CompressorInputStream createCompressorInputStream(final String name, fina
+     /**
+@@ -595,10 +588,7 @@ public class CompressorStreamFactory implements CompressorStreamProvider {
              }
 
              if (ZSTANDARD.equalsIgnoreCase(name)) {
@@ -64,16 +44,7 @@ index 2406d5a44..9ed40a3d7 100644
              }
 
              if (LZMA.equalsIgnoreCase(name)) {
-@@ -614,7 +600,7 @@ public CompressorInputStream createCompressorInputStream(final String name, fina
-      * Creates a compressor output stream from a compressor name and an output stream.
-      *
-      * @param name the compressor name, i.e. {@value #GZIP}, {@value #BZIP2}, {@value #XZ}, {@value #PACK200}, {@value #SNAPPY_FRAMED}, {@value #LZ4_BLOCK},
--     *             {@value #LZ4_FRAMED}, {@value #ZSTANDARD} or {@value #DEFLATE}
-+     *             {@value #LZ4_FRAMED} or {@value #DEFLATE}
-      * @param out  the output stream
-      * @return the compressor output stream
-      * @throws CompressorException      if the archiver name is not known
-@@ -665,7 +651,7 @@ public CompressorOutputStream createCompressorOutputStream(final String name, fi
+@@ -714,7 +704,7 @@ public class CompressorStreamFactory implements CompressorStreamProvider {
              }
 
              if (ZSTANDARD.equalsIgnoreCase(name)) {
@@ -83,5 +54,5 @@ index 2406d5a44..9ed40a3d7 100644
          } catch (final IOException e) {
              throw new CompressorException("Could not create CompressorOutputStream", e);
 -- 
-2.43.0
+2.14.3