Enable generate package manifest test

[Vince Perri (vinceaperri)]

Summary

Change Log

• Change
• Change

Type of Change

• Image build change (base image, sysexts, OEM images)
• Package/SPEC update
• CI/automation change
• SDK/toolchain update
• Configuration change
• Documentation update
• Bug fix

Does this affect the image build?

• Yes
• No

Associated Issues

Test Methodology

• Test details:

Merge Checklist

All applicable boxes should be checked before merging

• Image builds successfully with this change (or image build is not affected)
• Any updated packages/SPECs build successfully
• Relevant kola tests pass
• All package sources are available
• Source files have up-to-date hashes/manifests
• Documentation has been updated to match any changes
• Ready to merge

[Copilot]

🔵 Needs a closer look

It changes core image/sysext build outputs and CI enforcement paths, and verifying end-to-end correctness requires pipeline/runtime validation beyond what can be fully confirmed from the diff alone.

Pull request overview

This PR adds generation and validation of SPDX 2.2 package manifests for RPM-based builds, and wires that output into both image/sysext build flows and the PR validation/testing pipeline. The intent is to make package manifests reproducible (timestamp-pinned) and enforce their presence/format via scripted tests.

Changes:

• Add an RPM package-manifest generator (generate_package_manifest.py) plus golden/fixture-based conformance tests (and an optional deep validator).
• Generate and install package manifests into built images and sysexts under /usr/share/os-manifests, with deterministic timestamps.
• Enable PR pipeline and kola enforcement coverage for the new manifest expectations.

File summaries

File	Description
build_sysext	Pins SOURCE_DATE_EPOCH deterministically; generates sysext package manifests in RPM mode when packages are sysext-unique.
build_library/rpm/tests/validate_golden_manifest.sh	Adds optional SPDX/NTIA validation script for regenerated golden manifests (not intended for CI).
build_library/rpm/tests/testdata/tdnf-installed.txt	Adds test fixture for tdnf list installed format.
build_library/rpm/tests/testdata/nevra-packages.txt	Adds test fixture for NEVRA package list format.
build_library/rpm/tests/testdata/expected-manifest.spdx.json	Adds golden SPDX 2.2 JSON document used for byte-for-byte conformance testing.
build_library/rpm/tests/test_generate_package_manifest.sh	Adds CI-suitable conformance test for deterministic manifest generation and cross-format equivalence.
build_library/rpm/tests/requirements.txt	Pins Python validator dependencies for the optional golden-manifest validation script.
build_library/rpm/rpm_install.sh	Makes rpm_query_packages fail-safe under set -e by avoiding error-masking pipelines.
build_library/rpm/generate_package_manifest.py	Introduces the SPDX 2.2 manifest generator (packages → purl externalRefs, deterministic namespace UUID).
build_library/rpm/build_image_util.sh	Adds finish_image_package_manifest_rpm to write the final image package list + manifest from the final rpmdb.
build_library/reports_util.sh	Adds write_package_manifest helper and standardizes manifest output directory /usr/share/os-manifests.
build_library/prod_image_util.sh	Skips Portage-only package list writing in RPM mode (now handled by RPM manifest path).
build_library/build_image_util.sh	Calls finish_image_package_manifest_rpm at the correct point in the RPM image finalization flow.
acl/tests/kola_enforcing.yaml	Enforces a new kola test for package-manifest presence/behavior.
.pipelines/github-pr-validation.yml	Enables a pipeline parameter intended to run the new manifest generator tests in PR validation.

Review details

• Files reviewed: 15/15 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.