ACL: add fasttrack support

[mayankfz]

Summary

This PR adds new feature support for Fasttrack repository integration to enable faster CVE resolution through priority installation of updated RPMs from the fasttrack-preview repository.

Change Log

Implements Fasttrack preview repository support by enabling the build system to accept and utilize a fasttrack .repo file for preferential installation of CVE-patched RPMs during image builds. The changes propagate the FASTTRACK_REPO_FILE environment variable through the SDK container workflow and add logging to track which packages are installed from the fasttrack repository.

• build_library/rpm/rpm_install.sh: Adds fasttrack preview repo file copying to installroot, logs available fasttrack packages before installation, and verifies which installed packages came from fasttrack after installation
• run_sdk_container and sdk_lib/sdk_entry.sh: Forward FASTTRACK_REPO_FILE environment variable through the SDK container and into the build environment
• acl/build_rpm_image.sh: Exports FASTTRACK_REPO_FILE variable to make it available for the ACL image build pipeline
• This PR also adds a staleness check for ACL-owned specs during regular RPM builds. The build fails when an ACL spec is behind PMC, helping catch packages that need to be rebased. Known exceptions can be configured when needed.

Type of Change

• Image build change (base image, sysexts, OEM images)
• Package/SPEC update
• CI/automation change
• SDK/toolchain update
• Configuration change
• Documentation update
• Bug fix

Does this affect the image build?

• Yes
• No

Associated Issues

https://dev.azure.com/mariner-org/ACL/_workitems/edit/21564/

Test Methodology

• Test details:
  https://dev.azure.com/mariner-org/ACL/_build/results?buildId=1198548&view=results
  https://dev.azure.com/mariner-org/ACL/_build/results?buildId=1198547&view=results

Merge Checklist

All applicable boxes should be checked before merging

• Image builds successfully with this change (or image build is not affected)
• Any updated packages/SPECs build successfully
• Relevant kola tests pass
• All package sources are available
• Source files have up-to-date hashes/manifests
• Documentation has been updated to match any changes
• Ready to merge

[Copilot]

Pull request overview

This PR adds “FastTrack preview” repository support to the ACL image build flow by propagating a FASTTRACK_REPO_FILE environment variable into the SDK container and using it during RPM installation to prefer CVE-patched RPMs, with additional logging to help verify behavior.

Changes:

• Forward FASTTRACK_REPO_FILE through acl/build_rpm_image.sh → run_sdk_container → sdk_lib/sdk_entry.sh.
• In RPM-mode installs, copy the fasttrack .repo file into the installroot and log fasttrack-available / fasttrack-installed package information.
• Add repoquery-based diagnostics around fasttrack availability and installed versions.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
sdk_lib/sdk_entry.sh	Persists FASTTRACK_REPO_FILE into the SDK user environment via .bashrc.
run_sdk_container	Passes FASTTRACK_REPO_FILE into the SDK container environment for builds.
build_library/rpm/rpm_install.sh	Installs fasttrack repo config into installroot and adds fasttrack-related repoquery/verification logging.
acl/build_rpm_image.sh	Exports FASTTRACK_REPO_FILE so it is available to the SDK container build pipeline.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 4 comments.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated 6 comments.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated 6 comments.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated 6 comments.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated 5 comments.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated 5 comments.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated 8 comments.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated 5 comments.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated 6 comments.

[Copilot]

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated no new comments.

Suppressed comments (7)

run_sdk_container:163

• FASTTRACK_REPO_FILE is treated as a boolean and replaced with a hard-coded in-container path via ${FASTTRACK_REPO_FILE:+...}. This prevents callers from specifying an explicit repo file path (the value they set is discarded), which makes the environment variable semantics surprising and can break non-CI usage.

        -e IMAGE_VERSION_ID="${IMAGE_VERSION_ID:-}"
        -e IMAGE_BUILD_ID="${IMAGE_BUILD_ID:-}"
        -e EXTRA_KERNEL_CMDLINE="${EXTRA_KERNEL_CMDLINE:-}"
        -e FASTTRACK_REPO_FILE="${FASTTRACK_REPO_FILE:+/mnt/host/source/src/scripts/__build__/fasttrack-repo/fasttrack-preview.repo}"

run_sdk_container:188

• This exec invocation also replaces the caller-provided FASTTRACK_REPO_FILE value with a hard-coded path. If the intent is to support a default pipeline-generated repo file, consider setting FASTTRACK_REPO_FILE to that default earlier (when empty) rather than overwriting non-empty values here.

call_docker exec "${tty[@]}" -i -e INJECT_DOCKER_SYSEXT="${INJECT_DOCKER_SYSEXT:-false}" -e FASTTRACK_REPO_FILE="${FASTTRACK_REPO_FILE:+/mnt/host/source/src/scripts/__build__/fasttrack-repo/fasttrack-preview.repo}" "${name}" /mnt/host/source/src/scripts/sdk_lib/sdk_entry.sh "$@"

build_library/rpm/rpm_install.sh:394

• dnf5 repoquery --repo=fasttrack-preview --available can return (and sort) a very large package list, and this block runs on every rpm_install_package invocation in fasttrack builds. This can significantly slow image builds and flood logs. Consider restricting the query to the packages being installed in this call.

    if [[ -n "${FASTTRACK_REPO_FILE:-}" ]] && [[ -f "${root_fs_dir}/etc/yum.repos.d/$(basename "${FASTTRACK_REPO_FILE}")" ]]; then
        info "=== FastTrack preview repo packages available ==="
        sudo /usr/bin/dnf5 repoquery --installroot="${root_fs_dir}" --releasever=3.0 \
            ${forcearch_arg} --repo=fasttrack-preview --available 2>/dev/null | sort || true
        info "=== End of fasttrack packages ==="

build_library/rpm/rpm_install.sh:438

• This verification loop iterates over all packages available in fasttrack-preview and runs rpm -q for each, which can be extremely expensive and noisy. A lower-cost approach is to scope the repoquery to the packages being installed in this call (or to the subset detected in the transaction log).

        done < <(sudo /usr/bin/dnf5 repoquery --installroot="${root_fs_dir}" --releasever=3.0 \
            ${forcearch_arg} --repo=fasttrack-preview --available --queryformat="%{name} %{evr}\n" 2>/dev/null || true)

build_library/rpm/check_pmc_staleness.sh:12

• The usage header says the script only takes <installroot>, but it also supports a second argument for the exception list. Keeping the usage text accurate helps avoid confusion when it fails with Usage: ....

# package and fails the build when PMC has moved ahead.
#
# Usage:  check_pmc_staleness.sh <installroot>
#

build_library/rpm/build_image_util.sh:105

• This PR is described as adding FastTrack repo support, but it also introduces a new build-blocking PMC staleness gate (including network repo queries) in the core RPM image build path. That’s a significant behavioral/CI policy change and should either be called out explicitly in the PR description (and rationale) or split into a separate PR so reviewers can evaluate it independently.

    # Check ACL SPECs for PMC staleness - fails the build if any package is stale.
    # The check compares pmc_base_version/pmc_base_release metadata in each
    # ACL SPEC against the current PMC repo to detect packages that need rebase.
    # Packages in the exception list are allowed to be stale (e.g. waiting for
    # ACL changes to land upstream).
    local staleness_exceptions="selinux-policy"
    if [[ -x "${BUILD_LIBRARY_DIR}/rpm/check_pmc_staleness.sh" ]]; then
        if ! "${BUILD_LIBRARY_DIR}/rpm/check_pmc_staleness.sh" "${root_fs_dir}" "${staleness_exceptions}"; then

build_library/rpm/check_pmc_staleness.sh:103

• FASTTRACK_URL extraction only matches lines that start exactly with baseurl=. Many .repo files use whitespace (e.g. baseurl = ...) or may indent entries, which would make FASTTRACK_URL empty and cause the staleness check to silently skip (due to the repoquery failure handler).

if [[ -n "${FASTTRACK_REPO_FILE:-}" ]] && [[ -f "${FASTTRACK_REPO_FILE}" ]]; then
    # Fasttrack build: query fasttrack + PMC (fasttrack has latest, PMC covers the rest)
    FASTTRACK_URL="$(grep -m1 '^baseurl=' "${FASTTRACK_REPO_FILE}" | cut -d= -f2-)"
    info "Checking against fasttrack repo: ${FASTTRACK_URL}"

[Copilot]

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.

Suppressed comments (1)

build_library/rpm/check_pmc_staleness.sh:25

• INSTALLROOT is required by the script interface but is never used/validated, which makes the usage misleading and can hide caller errors (e.g., passing a non-existent rootfs dir). At minimum, validate the directory exists before proceeding.

INSTALLROOT="${1:?Usage: check_pmc_staleness.sh <installroot>}"

[Copilot]

🟡 Changes recommended

The current FastTrack repo injection and staleness-exception configuration have avoidable safety/operability issues that should be addressed before merging.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 14/14 changed files
• Comments generated: 2
• Review effort level: Lite