ACL: add fasttrack support

[mayankfz]

Summary

This PR adds new feature support for Fasttrack repository integration to enable faster CVE resolution through priority installation of updated RPMs from the fasttrack-preview repository.

Change Log

Implements Fasttrack preview repository support by enabling the build system to accept and utilize a fasttrack .repo file for preferential installation of CVE-patched RPMs during image builds. The changes propagate the FASTTRACK_REPO_FILE environment variable through the SDK container workflow and add logging to track which packages are installed from the fasttrack repository.

• build_library/rpm/rpm_install.sh: Adds fasttrack preview repo file copying to installroot, logs available fasttrack packages before installation, and verifies which installed packages came from fasttrack after installation
• run_sdk_container and sdk_lib/sdk_entry.sh: Forward FASTTRACK_REPO_FILE environment variable through the SDK container and into the build environment
• acl/build_rpm_image.sh: Exports FASTTRACK_REPO_FILE variable to make it available for the ACL image build pipeline

Type of Change

• Image build change (base image, sysexts, OEM images)
• Package/SPEC update
• CI/automation change
• SDK/toolchain update
• Configuration change
• Documentation update
• Bug fix

Does this affect the image build?

• Yes
• No

Associated Issues

• Test details:
  https://dev.azure.com/mariner-org/ACL/_build/results?buildId=1156891&view=results
  https://dev.azure.com/mariner-org/ACL/_build/results?buildId=1156313&view=results

Merge Checklist

All applicable boxes should be checked before merging

• Image builds successfully with this change (or image build is not affected)
• Any updated packages/SPECs build successfully
• Relevant kola tests pass
• All package sources are available
• Source files have up-to-date hashes/manifests
• Documentation has been updated to match any changes
• Ready to merge

[Copilot]

Pull request overview

This PR adds “FastTrack preview” repository support to the ACL image build flow by propagating a FASTTRACK_REPO_FILE environment variable into the SDK container and using it during RPM installation to prefer CVE-patched RPMs, with additional logging to help verify behavior.

Changes:

• Forward FASTTRACK_REPO_FILE through acl/build_rpm_image.sh → run_sdk_container → sdk_lib/sdk_entry.sh.
• In RPM-mode installs, copy the fasttrack .repo file into the installroot and log fasttrack-available / fasttrack-installed package information.
• Add repoquery-based diagnostics around fasttrack availability and installed versions.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
sdk_lib/sdk_entry.sh	Persists FASTTRACK_REPO_FILE into the SDK user environment via .bashrc.
run_sdk_container	Passes FASTTRACK_REPO_FILE into the SDK container environment for builds.
build_library/rpm/rpm_install.sh	Installs fasttrack repo config into installroot and adds fasttrack-related repoquery/verification logging.
acl/build_rpm_image.sh	Exports FASTTRACK_REPO_FILE so it is available to the SDK container build pipeline.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 4 comments.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated 6 comments.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated 6 comments.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated 6 comments.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated 5 comments.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated 5 comments.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated 8 comments.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated 5 comments.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated 6 comments.

[Copilot]

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated no new comments.

Suppressed comments (7)

run_sdk_container:163

• FASTTRACK_REPO_FILE is treated as a boolean and replaced with a hard-coded in-container path via ${FASTTRACK_REPO_FILE:+...}. This prevents callers from specifying an explicit repo file path (the value they set is discarded), which makes the environment variable semantics surprising and can break non-CI usage.

        -e IMAGE_VERSION_ID="${IMAGE_VERSION_ID:-}"
        -e IMAGE_BUILD_ID="${IMAGE_BUILD_ID:-}"
        -e EXTRA_KERNEL_CMDLINE="${EXTRA_KERNEL_CMDLINE:-}"
        -e FASTTRACK_REPO_FILE="${FASTTRACK_REPO_FILE:+/mnt/host/source/src/scripts/__build__/fasttrack-repo/fasttrack-preview.repo}"

run_sdk_container:188

• This exec invocation also replaces the caller-provided FASTTRACK_REPO_FILE value with a hard-coded path. If the intent is to support a default pipeline-generated repo file, consider setting FASTTRACK_REPO_FILE to that default earlier (when empty) rather than overwriting non-empty values here.

call_docker exec "${tty[@]}" -i -e INJECT_DOCKER_SYSEXT="${INJECT_DOCKER_SYSEXT:-false}" -e FASTTRACK_REPO_FILE="${FASTTRACK_REPO_FILE:+/mnt/host/source/src/scripts/__build__/fasttrack-repo/fasttrack-preview.repo}" "${name}" /mnt/host/source/src/scripts/sdk_lib/sdk_entry.sh "$@"

build_library/rpm/rpm_install.sh:394

• dnf5 repoquery --repo=fasttrack-preview --available can return (and sort) a very large package list, and this block runs on every rpm_install_package invocation in fasttrack builds. This can significantly slow image builds and flood logs. Consider restricting the query to the packages being installed in this call.

    if [[ -n "${FASTTRACK_REPO_FILE:-}" ]] && [[ -f "${root_fs_dir}/etc/yum.repos.d/$(basename "${FASTTRACK_REPO_FILE}")" ]]; then
        info "=== FastTrack preview repo packages available ==="
        sudo /usr/bin/dnf5 repoquery --installroot="${root_fs_dir}" --releasever=3.0 \
            ${forcearch_arg} --repo=fasttrack-preview --available 2>/dev/null | sort || true
        info "=== End of fasttrack packages ==="

build_library/rpm/rpm_install.sh:438

• This verification loop iterates over all packages available in fasttrack-preview and runs rpm -q for each, which can be extremely expensive and noisy. A lower-cost approach is to scope the repoquery to the packages being installed in this call (or to the subset detected in the transaction log).

        done < <(sudo /usr/bin/dnf5 repoquery --installroot="${root_fs_dir}" --releasever=3.0 \
            ${forcearch_arg} --repo=fasttrack-preview --available --queryformat="%{name} %{evr}\n" 2>/dev/null || true)

build_library/rpm/check_pmc_staleness.sh:12

• The usage header says the script only takes <installroot>, but it also supports a second argument for the exception list. Keeping the usage text accurate helps avoid confusion when it fails with Usage: ....

# package and fails the build when PMC has moved ahead.
#
# Usage:  check_pmc_staleness.sh <installroot>
#

build_library/rpm/build_image_util.sh:105

• This PR is described as adding FastTrack repo support, but it also introduces a new build-blocking PMC staleness gate (including network repo queries) in the core RPM image build path. That’s a significant behavioral/CI policy change and should either be called out explicitly in the PR description (and rationale) or split into a separate PR so reviewers can evaluate it independently.

    # Check ACL SPECs for PMC staleness - fails the build if any package is stale.
    # The check compares pmc_base_version/pmc_base_release metadata in each
    # ACL SPEC against the current PMC repo to detect packages that need rebase.
    # Packages in the exception list are allowed to be stale (e.g. waiting for
    # ACL changes to land upstream).
    local staleness_exceptions="selinux-policy"
    if [[ -x "${BUILD_LIBRARY_DIR}/rpm/check_pmc_staleness.sh" ]]; then
        if ! "${BUILD_LIBRARY_DIR}/rpm/check_pmc_staleness.sh" "${root_fs_dir}" "${staleness_exceptions}"; then

build_library/rpm/check_pmc_staleness.sh:103

• FASTTRACK_URL extraction only matches lines that start exactly with baseurl=. Many .repo files use whitespace (e.g. baseurl = ...) or may indent entries, which would make FASTTRACK_URL empty and cause the staleness check to silently skip (due to the repoquery failure handler).

if [[ -n "${FASTTRACK_REPO_FILE:-}" ]] && [[ -f "${FASTTRACK_REPO_FILE}" ]]; then
    # Fasttrack build: query fasttrack + PMC (fasttrack has latest, PMC covers the rest)
    FASTTRACK_URL="$(grep -m1 '^baseurl=' "${FASTTRACK_REPO_FILE}" | cut -d= -f2-)"
    info "Checking against fasttrack repo: ${FASTTRACK_URL}"

[Copilot]

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.

Suppressed comments (1)

build_library/rpm/check_pmc_staleness.sh:25

• INSTALLROOT is required by the script interface but is never used/validated, which makes the usage misleading and can hide caller errors (e.g., passing a non-existent rootfs dir). At minimum, validate the directory exists before proceeding.

INSTALLROOT="${1:?Usage: check_pmc_staleness.sh <installroot>}"