Backport fixes for kiwi-build command

3496.patch

@@ -0,0 +1,54 @@
+From ec7f9c2f6e26b74e6f41b3fe67998e9c2aa6dec0 Mon Sep 17 00:00:00 2001
+From: Tomas Kopecek <tkopecek@redhat.com>
+Date: Sep 15 2022 07:08:50 +0000
+Subject: kiwi: handle include protocols
+
+
+Related: https://pagure.io/koji/issue/3495
+
+---
+
+diff --git a/docs/source/plugins.rst b/docs/source/plugins.rst
+index 1a6994a..6654504 100644
+--- a/docs/source/plugins.rst
++++ b/docs/source/plugins.rst
+@@ -282,6 +282,13 @@ option. Similarly to other image tasks, alternative architecture failures can be
+ ignored for successful build by ``--can-fail`` option. ``--arch`` can be used to
+ limit build tag architectures.
+ 
++There are some limitation to used kiwi configuration:
++
++ * ``include`` node can use only ``this://`` protocol. Other types like ``file://``
++   or ``https://`` could reach out of the repo preventing reproducible build.
++ * All repositories from description (and included files) are removed and replaced
++   by buildroot repo and other repositories specified by ``--repo`` option.
++
+ Driver Update Disks building
+ ============================
+ 
+diff --git a/plugins/builder/kiwi.py b/plugins/builder/kiwi.py
+index 41ef82e..9148fc5 100644
+--- a/plugins/builder/kiwi.py
++++ b/plugins/builder/kiwi.py
+@@ -4,6 +4,7 @@ import xml.dom.minidom
+ from fnmatch import fnmatch
+ 
+ import koji
++import koji.util
+ from koji.tasks import ServerExit
+ from __main__ import BaseBuildTask, BuildImageTask, BuildRoot, SCM
+ 
+@@ -199,6 +200,12 @@ class KiwiCreateImageTask(BaseBuildTask):
+         # doing it recursively)
+         for inc_node in image.getElementsByTagName('include'):
+             path = inc_node.getAttribute('from')
++            if path.startswith('this://'):
++                path = koji.util.joinpath(desc_path, path[7:])
++            else:
++                # we want to ignore other protocols, e.g. file://, https://
++                # reachingoutside of repo
++                raise ValueError("Unhandled include protocol in include path: {path}.")
+             inc = xml.dom.minidom.parse(path)  # nosec
+             # every included xml has image root element again
+             for node in inc.getElementsByTagName('image').childNodes:
+

3498.patch

@@ -0,0 +1,23 @@
+From a8cbaf8195e8dcea4927cac5dde917592e313421 Mon Sep 17 00:00:00 2001
+From: Tomas Kopecek <tkopecek@redhat.com>
+Date: Sep 13 2022 13:59:14 +0000
+Subject: kiwi: Explicitely use koji-generated description
+
+
+Related: https://pagure.io/koji/issue/3497
+
+---
+
+diff --git a/plugins/builder/kiwi.py b/plugins/builder/kiwi.py
+index 41ef82e..2d2df67 100644
+--- a/plugins/builder/kiwi.py
++++ b/plugins/builder/kiwi.py
+@@ -365,6 +365,7 @@ class KiwiCreateImageTask(BaseBuildTask):
+         cmd.extend([
+             'system', 'build',
+             '--description', os.path.join(os.path.basename(scmsrcdir), desc_path),
++            '--kiwi-file', desc,
+             '--target-dir', target_dir,
+         ])
+         rv = broot.mock(['--cwd', broot.tmpdir(within=True), '--chroot', '--'] + cmd)
+

koji.spec

@@ -9,13 +9,19 @@
 
 Name: koji
 Version: 1.30.0
-Release: 1%{?dist}
+Release: 2%{?dist}
 # the included arch lib from yum's rpmUtils is GPLv2+
 License: LGPLv2 and GPLv2+
 Summary: Build system tools
 URL: https://pagure.io/koji/
 Source0: https://releases.pagure.org/koji/koji-%{version}.tar.bz2
 
+# Proposed upstream
+## From: https://pagure.io/koji/pull-request/3496
+Patch1: 3496.patch
+## From: https://pagure.io/koji/pull-request/3498
+Patch2: 3498.patch
+
 # Not upstreamable
 Patch100: fedora-config.patch
 
@@ -347,6 +353,9 @@ done
 %systemd_postun kojira.service
 
 %changelog
+* Thu Sep 22 2022 Neal Gompa <ngompa@fedoraproject.org> - 1.30.0-2
+- Backport fixes for kiwi-build command
+
 * Mon Aug 29 2022 Kevin Fenzi <kevin@scrye.com> - 1.30.0-1
 - Update to 1.30.0. Fixes rhbz#2122127