fix: stb - remove flagged files

[Andrew Phelps (anphel31)]

Remove the prebuilt Win32 demo executable tests/oversample/oversample.exe from stb.

It is a UPX-packed PE32 binary checked into upstream's test directory - the only compiled file among the archive's 430 - and the package-signing scan rejects the .src.rpm because of it. Nothing builds or runs it: tests/Makefile never references tests/oversample, and the directory is not shipped in any binary RPM.

• An azldev archive overlay (file-remove) drops the .exe and repacks the tarball; the post-overlay hash is pinned via origin = { type = "overlay" }.
• The rest of tests/oversample/ is kept, so the doc pointer in stb_truetype.h stays valid.

All 23 subpackages build, upstream's image_write_test still passes, and azldev comp render --check-only reports no drift.

[Copilot]

🟡 Changes recommended

The new source-files entry still contains a non-hash placeholder and the PR state is not yet self-consistent for lock/render drift checks.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR aims to prune a prebuilt Windows executable (tests/oversample/oversample.exe) from the stb upstream source archive by applying a file-remove overlay and pinning the resulting repacked tarball, while also moving stb from an inline stub to a dedicated component definition file.

Changes:

• Move stb from an inline [components.stb] entry to base/comps/stb/stb.comp.toml.
• Add a per-file overlay to remove tests/oversample/oversample.exe from the stb source tarball.
• Drop the now-redundant inline stub entry from base/comps/components.toml.

File summaries

File	Description
base/comps/stb/stb.comp.toml	Introduces a dedicated component file and a source-files replacement entry intended to pin the repacked (post-overlay) tarball.
base/comps/stb/overlays/0001-remove-prebuilt-windows-executable.overlay.toml	Adds a file-remove overlay (with metadata) to delete the prebuilt Windows .exe from the upstream archive.
base/comps/components.toml	Removes the inline stb stub so the component is defined solely via the dedicated *.comp.toml include.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Andrew Phelps (anphel31)]

Local verification on cc6c0bb (per AGENTS.md minimum required testing):

Build — azldev comp build -p stb produced all 23 subpackages. Upstream's own tests ran as part of it and passed with the .exe removed: gcc ... image_write_test.c -lm -o image_write_test in %build, then + ./tests/image_write_test in %check.

Overlay effect — the tarball embedded in the built SRPM holds 429 files (was 430), no .exe anywhere, and its SHA512 matches the pinned hash. tests/oversample/ keeps README.md, main.c, oversample.dsp, oversample.dsw and stb_wingraph.h, so the stb_truetype.h doc pointer still resolves. A file sweep over every remaining file finds no PE or ELF binary — the only hit is tests/ossfuzz.sh, a shell script — which confirms the PR's claim that the .exe was the sole compiled artifact.

Inspect — rpm -qlp across all 23 subpackages returns no oversample or .exe path, and grep -n oversample tests/Makefile returns no matches.

Smoke test — mock chroot, compiled against stb_image-devel, stb_image_write-devel and stb_truetype-devel:

stbi_write_png OK
stbi_load OK w=2 h=2 comp=3 first_px=(255,0,0)
ALL OK
SMOKE_EXIT=0

PNG write/read round-trip returns correct dimensions and pixel data; stb_truetype.h compiles and links.

Drift — render --check-only reports CHANGED=false and update --check-only exits 0, both re-run after committing.

One note on the build output: the SRPM is versioned -1.azl4 rather than -7. That is not related to this change — the SRPM ships %autorelease unexpanded, so rpmautospec resolves it inside the isolated build environment, whose synthetic git history yields 1. The rendered spec in specs/s/stb/ correctly carries release_number = 7.

[Copilot]

🟡 Changes recommended

The PR description/checklist appears stale relative to the committed state, and it’s unclear from the PR metadata whether the required build/smoke-test validation has been completed.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 5/6 changed files
• Comments generated: 1
• Review effort level: Lite

[reuben olinsky (reubeno)]

/azp run

[azure-pipelines]

Azure Pipelines:
2 pipeline(s) were filtered out due to trigger conditions.

[Copilot]

🟢 Approval recommended

The focused overlay is correctly configured, generated state is consistent, and validation covers the affected package behavior.

Review details

• Files reviewed: 5/6 changed files
• Comments generated: 0 new
• Review effort level: Balanced