Tobias Brick (tobiasb-ms) · Aug 3, 2026 · Aug 3, 2026 · Aug 3, 2026
@@ -3,14 +3,3 @@
 # incompatibility, and includes %install/%files fixes for bootstrap mode.
 # Our snapshot (2026-02-24) predates the fix (2026-03-21).
 spec = { type = "upstream", upstream-commit = "851a2e917df6169f4e8aa2bc12dd0d69c4ff73a4" }
-
-# Re-enable bootstrap mode so rebar3 can build itself without needing the old
-# broken erlang-rebar3 3.26.0 in the build tag. The latest upstream commit
-# disabled bootstrap (since Fedora already has a working 3.27.0), but AZL
-# doesn't yet.
-# TODO: Remove this overlay once rebar3 3.27.0 is in the AZL build tag.
-[[components.erlang-rebar3.overlays]]
-description = "Enable bootstrap mode to break self-dependency on broken erlang-rebar3 3.26.0"
-type = "spec-search-replace"
-regex = '^%global bootstrap 0$'
-replacement = '%global bootstrap 1'
@@ -0,0 +1,15 @@
+# Re-enable bootstrap mode so rebar3 can build itself without needing the old
+# broken erlang-rebar3 3.26.0 in the build tag. The latest upstream commit
+# disabled bootstrap (since Fedora already has a working 3.27.0), but AZL
+# doesn't yet.
+# TODO: Remove this overlay once rebar3 3.27.0 is in the AZL build tag.
+
+[metadata]
+category = "azl-temp-workaround"
+upstream-status = "inapplicable"
+
+[[overlays]]
+description = "Enable bootstrap mode to break self-dependency on broken erlang-rebar3 3.26.0"
+type = "spec-search-replace"
+regex = "^%global bootstrap 0$"
+replacement = "%global bootstrap 1"
@@ -1,14 +1 @@
-# golang-github-sagikazarmark-crypt has been a dead package since Fedora 43, which breaks
-# the transitive dependency chain: %go_generate_buildrequires generates imports that
-# transitively pull in golang-sigs-k8s-aws-iam-authenticator-devel →
-# golang-github-spf13-viper-devel → golang(github.com/sagikazarmark/crypt/config).
-# Remove this overlay once golang-github-sagikazarmark-crypt is available or viper
-# no longer requires it.
 [components.golang-github-envoyproxy-control-plane]
-
-[[components.golang-github-envoyproxy-control-plane.overlays]]
-description = "Disable dynamic BuildRequires generation — transitive dep on dead golang-github-sagikazarmark-crypt"
-type = "spec-search-replace"
-section = "%generate_buildrequires"
-regex = '%go_generate_buildrequires'
-replacement = '# Disabled: transitive dep on dead golang-github-sagikazarmark-crypt (see comp.toml)'
@@ -0,0 +1,17 @@
+# golang-github-sagikazarmark-crypt has been a dead package since Fedora 43, which breaks
+# the transitive dependency chain: %go_generate_buildrequires generates imports that
+# transitively pull in golang-sigs-k8s-aws-iam-authenticator-devel →
+# golang-github-spf13-viper-devel → golang(github.com/sagikazarmark/crypt/config).
+# Remove this overlay once golang-github-sagikazarmark-crypt is available or viper
+# no longer requires it.
+
+[metadata]
+category = "azl-temp-workaround"
+upstream-status = "inapplicable"
+
+[[overlays]]
+description = "Disable dynamic BuildRequires generation — transitive dep on dead golang-github-sagikazarmark-crypt"
+type = "spec-search-replace"
+section = "%generate_buildrequires"
+regex = "%go_generate_buildrequires"
+replacement = "# Disabled: transitive dep on dead golang-github-sagikazarmark-crypt (see comp.toml)"
@@ -1,11 +1 @@
-# golang-github-aws-sdk is built in bootstrap mode, which suppresses all
-# golang(...) Requires from its -devel RPM. The sigv4 subpackage imports
-# aws-sdk-go, which transitively needs github.com/jmespath/go-jmespath.
-# Add an explicit BuildRequires so the sigv4 tests can compile.
 [components.golang-github-prometheus-common]
-
-[[components.golang-github-prometheus-common.overlays]]
-description = "Add missing jmespath BuildRequires — transitive dep of aws-sdk-go, not pulled in due to bootstrap mode"
-type = "spec-add-tag"
-tag = "BuildRequires"
-value = "golang(github.com/jmespath/go-jmespath)"
@@ -0,0 +1,14 @@
+# golang-github-aws-sdk is built in bootstrap mode, which suppresses all
+# golang(...) Requires from its -devel RPM. The sigv4 subpackage imports
+# aws-sdk-go, which transitively needs github.com/jmespath/go-jmespath.
+# Add an explicit BuildRequires so the sigv4 tests can compile.
+
+[metadata]
+category = "azl-temp-workaround"
+upstream-status = "inapplicable"
+
+[[overlays]]
+description = "Add missing jmespath BuildRequires — transitive dep of aws-sdk-go, not pulled in due to bootstrap mode"
+type = "spec-add-tag"
+tag = "BuildRequires"
+value = "golang(github.com/jmespath/go-jmespath)"
@@ -1,10 +1 @@
 [components.golang-mongodb-mongo-driver]
-
-# The aws-sdk-go-devel bootstrap build has auto-generated Requires stripped,
-# so it doesn't transitively pull in golang-github-jmespath-devel. Add the
-# missing build dependency explicitly until a non-bootstrap aws-sdk-go is available.
-[[components.golang-mongodb-mongo-driver.overlays]]
-description = "Add missing transitive BuildRequires on go-jmespath (needed by aws-sdk-go, missing in bootstrap builds)"
-type = "spec-add-tag"
-tag = "BuildRequires"
-value = "golang(github.com/jmespath/go-jmespath)"
@@ -0,0 +1,13 @@
+# The aws-sdk-go-devel bootstrap build has auto-generated Requires stripped,
+# so it doesn't transitively pull in golang-github-jmespath-devel. Add the
+# missing build dependency explicitly until a non-bootstrap aws-sdk-go is available.
+
+[metadata]
+category = "azl-temp-workaround"
+upstream-status = "inapplicable"
+
+[[overlays]]
+description = "Add missing transitive BuildRequires on go-jmespath (needed by aws-sdk-go, missing in bootstrap builds)"
+type = "spec-add-tag"
+tag = "BuildRequires"
+value = "golang(github.com/jmespath/go-jmespath)"
@@ -1,10 +1 @@
 [components.libnbd]
-
-# Disable OCaml bindings — OCaml libraries have ABI mismatches in the
-# bootstrap build tag (ocaml-findlib-devel requires ocamlx() hashes
-# that don't match the available OCaml packages).
-[[components.libnbd.overlays]]
-description = "Disable OCaml bindings until OCaml bootstrap is resolved"
-type = "spec-search-replace"
-regex = '%global have_ocaml 1'
-replacement = '%global have_ocaml 0'
@@ -0,0 +1,13 @@
+# Disable OCaml bindings — OCaml libraries have ABI mismatches in the
+# bootstrap build tag (ocaml-findlib-devel requires ocamlx() hashes
+# that don't match the available OCaml packages).
+
+[metadata]
+category = "azl-temp-workaround"
+upstream-status = "inapplicable"
+
+[[overlays]]
+description = "Disable OCaml bindings until OCaml bootstrap is resolved"
+type = "spec-search-replace"
+regex = "%global have_ocaml 1"
+replacement = "%global have_ocaml 0"
@@ -1,12 +1 @@
-# golang-github-aws-sdk is built in bootstrap mode, which suppresses
-# golang(...) Requires. This means its transitive Go imports (like jmespath)
-# are not automatically pulled into the buildroot via RPM dependencies.
-# Add explicit BuildRequires for the missing transitive deps so the aws_s3
-# source driver can compile.
 [components.migrate]
-
-[[components.migrate.overlays]]
-description = "Add missing jmespath BuildRequires — transitive dep of aws-sdk-go, not pulled in due to bootstrap mode"
-type = "spec-add-tag"
-tag = "BuildRequires"
-value = "golang(github.com/jmespath/go-jmespath)"
@@ -0,0 +1,15 @@
+# golang-github-aws-sdk is built in bootstrap mode, which suppresses
+# golang(...) Requires. This means its transitive Go imports (like jmespath)
+# are not automatically pulled into the buildroot via RPM dependencies.
+# Add explicit BuildRequires for the missing transitive deps so the aws_s3
+# source driver can compile.
+
+[metadata]
+category = "azl-temp-workaround"
+upstream-status = "inapplicable"
+
+[[overlays]]
+description = "Add missing jmespath BuildRequires — transitive dep of aws-sdk-go, not pulled in due to bootstrap mode"
+type = "spec-add-tag"
+tag = "BuildRequires"
+value = "golang(github.com/jmespath/go-jmespath)"
@@ -1,26 +1 @@
 [components.nbdkit]
-
-# Disable libguestfs plugin — libguestfs is not yet building due to
-# bootstrap QEMU having Xen enabled (missing xen libs in build tag).
-# The upstream spec already gates this behind !rhel, so this mirrors
-# the RHEL build configuration.
-[[components.nbdkit.overlays]]
-description = "Disable libguestfs plugin until libguestfs is buildable"
-type = "spec-search-replace"
-regex = '%global have_libguestfs 1'
-replacement = '%global have_libguestfs 0'
-
-# Disable OCaml plugin — OCaml libraries have ABI mismatches in the
-# bootstrap build tag. Also gated behind !rhel upstream.
-[[components.nbdkit.overlays]]
-description = "Disable OCaml plugin until OCaml bootstrap is resolved"
-type = "spec-search-replace"
-regex = '%global have_ocaml 1'
-replacement = '%global have_ocaml 0'
-
-# Azure Linux does not ship mingw cross-compilation toolchains.
-[[components.nbdkit.overlays]]
-description = "Disable mingw subpackage — Azure Linux does not ship mingw toolchains"
-type = "spec-search-replace"
-regex = '%global have_mingw 1'
-replacement = '%global have_mingw 0'
@@ -0,0 +1,22 @@
+# Disable libguestfs plugin — libguestfs is not yet building due to
+# bootstrap QEMU having Xen enabled (missing xen libs in build tag).
+# The upstream spec already gates this behind !rhel, so this mirrors
+# the RHEL build configuration.
+
+[metadata]
+category = "azl-temp-workaround"
+upstream-status = "inapplicable"
+
+[[overlays]]
+description = "Disable libguestfs plugin until libguestfs is buildable"
+type = "spec-search-replace"
+regex = "%global have_libguestfs 1"
+replacement = "%global have_libguestfs 0"
+
+# Disable OCaml plugin — OCaml libraries have ABI mismatches in the
+# bootstrap build tag. Also gated behind !rhel upstream.
+[[overlays]]
+description = "Disable OCaml plugin until OCaml bootstrap is resolved"
+type = "spec-search-replace"
+regex = "%global have_ocaml 1"
+replacement = "%global have_ocaml 0"
@@ -0,0 +1,11 @@
+# Azure Linux does not ship mingw cross-compilation toolchains.
+
+[metadata]
+category = "azl-pruning"
+upstream-status = "needs-upstream-hook"
+
+[[overlays]]
+description = "Disable mingw subpackage — Azure Linux does not ship mingw toolchains"
+type = "spec-search-replace"
+regex = "%global have_mingw 1"
+replacement = "%global have_mingw 0"
@@ -0,0 +1,21 @@
+# Pin to 25.1.0 because 25.2.0+ requires cryptography >= 45.0.7, but we ship
+# python-cryptography 45.0.4 (pinned because 46.x needs crate(asn1) >= 0.22.0,
+# not yet available). 25.1.0 requires cryptography >= 41.0.5, < 46 which is
+# compatible with our 45.0.4.
+# Re-align to latest when python-cryptography is updated to >= 45.0.7.
+
+[metadata]
+category = "azl-temp-workaround"
+upstream-status = "inapplicable"
+
+[[overlays]]
+description = "Pin python3-cryptography to 45.x to match the version we ship (python-cryptography is pinned to 45.0.4)"
+type = "spec-add-tag"
+tag = "BuildRequires"
+value = "python3-cryptography >= 45.0.4"
+
+[[overlays]]
+description = "Prevent building against cryptography 46.x which we do not ship"
+type = "spec-add-tag"
+tag = "BuildRequires"
+value = "python3-cryptography < 46"
@@ -1,19 +1,2 @@
-# Pin to 25.1.0 because 25.2.0+ requires cryptography >= 45.0.7, but we ship
-# python-cryptography 45.0.4 (pinned because 46.x needs crate(asn1) >= 0.22.0,
-# not yet available). 25.1.0 requires cryptography >= 41.0.5, < 46 which is
-# compatible with our 45.0.4.
-# Re-align to latest when python-cryptography is updated to >= 45.0.7.
 [components.pyOpenSSL]
 spec = { type = "upstream", upstream-commit = "8ac54d517e6d9db673dc83b4e2b12b83d1f99724" }
-
-[[components.pyOpenSSL.overlays]]
-description = "Pin python3-cryptography to 45.x to match the version we ship (python-cryptography is pinned to 45.0.4)"
-type = "spec-add-tag"
-tag = "BuildRequires"
-value = "python3-cryptography >= 45.0.4"
-
-[[components.pyOpenSSL.overlays]]
-description = "Prevent building against cryptography 46.x which we do not ship"
-type = "spec-add-tag"
-tag = "BuildRequires"
-value = "python3-cryptography < 46"