feat(fscrypt): add fscrypt component and publish to rpm-base

[Tobias Brick (tobiasb-ms)]

Adds the fscrypt component to AZL 4.0 and publishes it to the rpm-base channel.

fscrypt is a Go/go2rpm package producing:

• fscrypt — the CLI for managing filesystem encryption (ext4/f2fs/UBIFS fscrypt)
• pam_fscrypt — PAM module for unlocking encrypted directories at login
• golang-github-google-fscrypt-devel — importable Go sources

Publish channels

• fscrypt's binaries are statically linked Go, so the runtime closure is just libc + libpam (pam already ships in base). Only fscrypt is added to base-packages.
• golang-github-google-fscrypt-devel (the Go source subpackage) is excepted back to rpm-sdk, matching every other golang-* source library.

Validation

• Native (unbundled) build succeeds — all Go deps resolve from AZL's golang-* ecosystem; %check passes.
• Mock smoke test: CLI, PAM module, config, and bash completion all install and work.
• azldev comp render --check-only reports no drift; lock gate passes.

AB#22587

[Copilot]

Pull request overview

Adds fscrypt to Azure Linux 4.0 and publishes its runtime packages to rpm-base.

Changes:

• Registers and locks the upstream fscrypt component.
• Adds rendered spec, sources, PAM configuration, and compatibility patches.
• Keeps the Go development subpackage in rpm-sdk.

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
base/comps/components.toml	Registers fscrypt.
base/comps/components-publish-channels.toml	Configures base and SDK publishing.
locks/fscrypt.lock	Pins upstream inputs.
specs/f/fscrypt/fscrypt.spec	Defines generated RPM packaging.
specs/f/fscrypt/fscrypt.pam	Provides PAM configuration.
specs/f/fscrypt/423.patch	Adds Go 1.24 compatibility.
specs/f/fscrypt/426.patch	Improves mount-device detection.
specs/f/fscrypt/sources	Records the source checksum.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 8 changed files in this pull request and generated 1 comment.

Suppressed comments (1)

specs/f/fscrypt/fscrypt.spec:36

• This imports upstream PR 423, which was closed after its "path: %s" formatting was rejected because it changes errors to the awkward path: /dir: ... form. Upstream merged PR 424 instead, using errors.Wrap to satisfy Go vet while preserving the existing /dir: ... output. Backport PR 424 rather than PR 423.

Patch0:         https://github.com/google/fscrypt/pull/423.patch

[Copilot]

Pull request overview

Copilot reviewed 7 out of 8 changed files in this pull request and generated no new comments.

Suppressed comments (1)

specs/f/fscrypt/fscrypt.spec:36

• Patch0 imports upstream PR #423, which was closed unmerged because it changes these errors to the awkward path: /dir: ... form. Upstream merged PR #424 instead; it uses errors.Wrap to satisfy Go 1.24 while preserving the existing /dir: ... message. Please backport #424 rather than shipping the rejected patch, then re-render the component.

Patch0:         https://github.com/google/fscrypt/pull/423.patch

[Copilot]

Pull request overview

Copilot reviewed 7 out of 8 changed files in this pull request and generated no new comments.

[Tobias Brick (tobiasb-ms)]

/azp run

[azure-pipelines]

Azure Pipelines:
2 pipeline(s) were filtered out due to trigger conditions.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 8 changed files in this pull request and generated no new comments.

Suppressed comments (1)

specs/f/fscrypt/fscrypt.spec:50

• pam_fscrypt installs a PAM service that invokes pam_unix.so (fscrypt.pam:2), but this subpackage only requires fscrypt. Its ELF autodependencies can install pam-libs, while pam_unix.so is shipped by the separate main pam package (specs/p/pam/pam.spec:314), so installing pam_fscrypt on a minimal system can succeed and then fail authentication at runtime. Add an explicit Requires: pam%{?_isa} to this subpackage through an overlay and re-render the spec.

Requires:       %{name}%{?_isa} = %{version}-%{release}

[Tobias Brick (tobiasb-ms)]

/azp run

[azure-pipelines]

Azure Pipelines:
2 pipeline(s) were filtered out due to trigger conditions.

[Tobias Brick (tobiasb-ms)]

/azp run

[azure-pipelines]

Azure Pipelines:
2 pipeline(s) were filtered out due to trigger conditions.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 8 changed files in this pull request and generated no new comments.