fix(kf6-karchive) remove password protected files from source tarball

[anphel31]

Fixes: AB#19875

Summary

Strip autotests/data/password_protected.7z from the upstream karchive-6.23.0.tar.xz
so the SRPM can clear the AZL RPM-signing pipeline (ESRP), which rejects
encrypted/unscannable payloads.

Why

The upstream KDE tarball ships a deliberately password-protected 7-Zip archive
as a fixture for the karchive autotests. ESRP cannot scan it and refuses to
sign the SRPM.

The autotests are not built or run in our spec:

• No %check block.
• Upstream's CMake gates them on BUILD_TESTING=ON, which we don't set.
• %files does not reference autotests/, so it never ships in any binary RPM.

Stripping the fixture is functionally inert; the published RPMs are unchanged.

Mechanism

Same replace-upstream pattern used for firefox, yara, and exfatprogs:

1. base/comps/kf6-karchive/modify_source.sh — deterministic strip-and-repack
   helper. Downloads upstream, verifies its SHA-512, removes the fixture, and
   repacks with
   LC_ALL=C tar --sort=name --owner=0 --group=0 --numeric-owner --mtime=@1577836800 --format=gnu | xz -T 1 -9. Re-running yields a
   byte-identical tarball (verified across two local runs). Output lives at
   base/build/work/scratch/kf6-karchive/ (covered by the top-level
   .gitignore via build/). Prints a ready-to-paste az storage blob upload
   command.

2. base/comps/kf6-karchive/kf6-karchive.comp.toml — new dedicated comp file
   adding a [[components.kf6-karchive.source-files]] entry that points at the
   repacked tarball in the lookaside repo container under pkgs_modified/.
   Uses replace-upstream = true + replace-reason = "..." to swap the
   same-named upstream entry in the Fedora sources manifest in place — no
   spec edit, no file-remove overlay needed.

3. base/comps/components.toml — inline [components.kf6-karchive] replaced
   with a comment pointer to the new dedicated file (matches the convention
   used for firefox/yara/exfatprogs).

4. specs/k/kf6-karchive/sources — regenerated. Source0 SHA-512 now points at
   the repacked tarball; the karchive-6.23.0.tar.xz.sig line is left
   untouched (the spec doesn't gpgverify it, and a stale .sig is harmless;
   replacing it would also be wrong since we no longer match the upstream
   tarball it signed).

5. specs/k/kf6-karchive/kf6-karchive.spec — regenerated; rpmautospec advances
   the release counter (no functional change).

6. locks/kf6-karchive.lock — refreshed via azldev comp update.

Modified-tarball SHA-512

882c5890bca4dd75f82ef377ae05f1a5bb6b301b9aee9952b6875b8333307f7de04979b85a787e4e7e48b9227282fb952f9d436163778c5b5c2cd3e02247d8fe

Reproducible by anyone with the same upstream input — re-run
bash base/comps/kf6-karchive/modify_source.sh to verify.

Validation

• Render: clean (STATUS: ok).
• Lock: refreshed deterministically.
• Repack determinism: confirmed across two local runs (byte-identical output).
• Modified tarball uploaded to the lookaside path the comp.toml origin.uri
  references.
• Test build

[Copilot]

Pull request overview

This PR updates the kf6-karchive component to use a deterministically repacked upstream karchive-6.23.0.tar.xz with a password-protected test fixture removed, allowing the SRPM to pass the AZL RPM-signing (ESRP) scanning pipeline while keeping the produced RPMs functionally unchanged.

Changes:

• Add a kf6-karchive dedicated component definition that replaces upstream Source0 with a modified tarball hosted in the lookaside under pkgs_modified/.
• Add a deterministic modify_source.sh helper script to strip autotests/data/password_protected.7z and repack byte-identically.
• Regenerate rendered outputs (sources, .spec) and refresh the component lock fingerprint.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
base/comps/kf6-karchive/modify_source.sh	New deterministic strip-and-repack helper to remove the password-protected fixture and produce a reproducible tarball + SHA512.
base/comps/kf6-karchive/kf6-karchive.comp.toml	Defines a source-files replacement for upstream karchive-6.23.0.tar.xz pointing at the repacked lookaside blob with justification.
base/comps/components.toml	Removes the inline kf6-karchive entry and leaves a pointer to the new dedicated component file.
specs/k/kf6-karchive/sources	Updates Source0 SHA512 to match the repacked tarball.
specs/k/kf6-karchive/kf6-karchive.spec	Regenerated rendered spec with an rpmautospec Release bump only.
locks/kf6-karchive.lock	Updates the component input fingerprint after the component definition change.