[Jiri Appl (jiria)]

Summary

Ensure five runtime RPMs are actually selected rather than relying on library dependencies or standalone catalog entries. This restores bzip2/zstd tar support and adds traffic-control, systemd machine-management, and dm-integrity tools. The final diff changes only build_library/rpm/package_catalog.yaml.

Change Log

• Select bzip2, zstd, and systemd-container under the existing sys-apps/systemd umbrella; extend sys-apps/iproute2 with iproute-tc and sys-fs/cryptsetup with integritysetup.
• Document deliberate base-catalog omissions, with reasons: quota-rpc, quota-warnquota, tdb-tools, idn2, psl, xxhash, vim-extra, erofs-utils, bind-dnssec-utils, p11-kit-server, glibc-nscd, and libseccomp-devel. Existing containerd-sysext selection of erofs-utils is unchanged. Comments do not select packages.
• No resolver changes, new Flatcar-specific aliases, or polkit changes; Include polkit in systemd RPM package selection #116 remains separate. The two validation scripts were removed from the final diff at author request and retained outside the repository as validation artifacts.

Type of Change

• Image build change (base image, sysexts, OEM images)
• Package/SPEC update
• CI/automation change
• SDK/toolchain update
• Configuration change
• Documentation update
• Bug fix

Does this affect the image build?

• Yes
• No

Associated Issues

N/A

Test Methodology

• Test details:
  • The following script paths describe the historical validation source copy, not files included in the final PR diff. Both scripts are preserved as external validation artifacts. The catalog is byte-for-byte unchanged by their removal.
  • bash build_library/rpm/tests/test_runtime_package_selection.sh — passed, using the actual catalog installation/resolution path with the RPM transaction mocked: amd64/arm64 × UKI/GRUB. Checked all five requested packages and intentional optional-package exclusions. Rerun after the test-file removal: all four cases passed against the identical catalog in the retained validation source copy.
  • bash -n build_library/rpm/tests/test_runtime_package_selection.sh acl/tests/run-runtime-package-test.sh — passed, including a rerun against the retained scripts after removal from this branch. git diff --check — passed after removal.
  • Native-labeling SDK build, ./build_image --image_compression_formats=none --nogenerate_update --board=amd64-usr --group=production --base_sysexts=oem-azure --disk_layout=vm --image_name=acl_runtime_parity_image.bin — failed during finalization: setfiles reported Could not set context ... Invalid argument for paths including /etc/.pwd.lock and /etc/systemd/system, and exited 255. The real installation transaction and installed-package manifest included all five requested RPMs before that failure. A Fedora-host/target SELinux policy incompatibility is a hypothesis, not a proven per-type diagnosis: the rejected target context types were not recorded or established.
  • Fresh SDK build, ./build_image --image_compression_formats=none --nogenerate_update --board=amd64-usr --group=production --base_sysexts=containerd --disk_layout=vm --image_name=acl_runtime_parity_image.bin — passed with a validation-only workaround: an isolated remote source copy inserted an early return 0 in finish_image_selinux_rpm, skipping its explicit final /etc relabel command, sudo setfiles -Dv -r "${root_fs_dir}" "${file_contexts}" "${root_fs_dir}/etc" >/dev/null. Other SELinux policy setup remained active. That bypass is not in this PR. Finalization, cleanup, UKI generation and verity generation completed; this is not a production-equivalent labeled-build pass.
  • ./image_to_vm.sh --image_compression_formats=none --from=../build/images/amd64-usr/latest --board=amd64-usr --format=qemu_uefi --image_name=acl_runtime_parity_image.bin — passed. Booted this fresh image in an isolated KVM/QEMU UEFI guest, without Secure Boot; guest SELinux reported Enforcing and /usr used the read-only verity device plus containerd/oem-qemu extensions. Enforcement mode alone does not establish correct file labels or domain transitions. No label/domain-transition/AVC audit was performed; Ignition logged that it was compiled without relabeling support.
  • sudo bash -s, with the then-present acl/tests/run-runtime-package-test.sh supplied over SSH on stdin — passed inside the fresh guest. Verified installed executable targets, executed compression CLIs, tc, machinectl, systemd-nspawn, integritysetup, and the importd/machined helpers, and round-tripped valid tar archives through both bzip2 and zstd. Confirmed final-image RPM database and documentation cleanup. This was not merely an installroot or build-host package test. The runtime script is preserved externally, not included in the final diff.
  • sudo dnf5 --installroot="$p/query-aarch64" --releasever=3.0 --forcearch=aarch64 --setopt=reposdir=/nonexistent --repofrompath=azl,https://packages.microsoft.com/azurelinux/3.0/prod/base/aarch64 --setopt=azl.gpgcheck=0 install --downloadonly -y bzip2 zstd iproute-tc systemd-container integritysetup — passed, resolving/downloading 87 packages into an isolated validation directory ($p). Inspected the five ARM64 RPM payloads for the expected CLI/helper paths. This download-only check did not install packages or validate RPM signatures; it is not an ARM64 image-build/boot result.
  • ARM64/GRUB image boot, Secure Boot, and kola were not run. Production-equivalent SELinux labeling still needs validation. Temporary validation guests and SDK containers were stopped/removed; isolated image artifacts and logs were retained. No new image rebuild was performed for the test-file removal because the catalog did not change.

Merge Checklist

All applicable boxes should be checked before merging

• Image builds successfully with this change (or image build is not affected)
• Any updated packages/SPECs build successfully
• Relevant kola tests pass
• All package sources are available
• Source files have up-to-date hashes/manifests
• Documentation has been updated to match any changes
• Ready to merge

No package sources/SPECs were changed, so their build/hash checklist items are not applicable. The image-build checkbox remains open for a build without the remote-only labeling bypass.

[Copilot]

🔵 Needs a closer look

Production-equivalent image validation remains incomplete because the successful build bypassed final SELinux relabeling.

No open issues 🎉

What changed in this PR

Explicitly selects five runtime RPMs for ACL images, restoring compression support and adding system-management tools.

Changes:

• Adds bzip2, zstd, systemd-container, iproute-tc, and integritysetup to existing mappings.
• Documents deliberate optional-package omissions without changing resolver behavior or polkit selection.

File	Description
build_library/​rpm/​package_catalog.yaml	Selects missing runtime tools and documents optional-package omissions.

_{Review effort: Balanced}

[Lanze Liu (liulanze)]

lgtm

[Copilot]

🔵 Needs a closer look

Production-equivalent SELinux labeling remains unvalidated because the successful image build required a labeling bypass.

No open issues 🎉

_{Review effort: Balanced}

[Jiri Appl (jiria)]

/azp run