fix(openfec): disable -debuginfo to work around malware scan's false positive

[PawelWMS]

Fixes: AB#19876

Summary

Suppresses the auto-generated *-debuginfo sub-package for openfec to work around a malware-scan false positive.

Failing artefacts

• openfec-debuginfo-1.4.2.6-7.azl4~20260420.x86_64.rpm
• openfec-debuginfo-1.4.2.6-7.azl4~20260420.aarch64.rpm

The runtime openfec, openfec-devel, and openfec-utils sub-packages are NOT flagged. The SRPM is NOT flagged. Only the auto-generated debuginfo RPMs fail signing.

Root cause

A high-entropy / packer detection heuristic in the signing pipeline's malware scanner fires on the per-library .debug ELF (/usr/lib/debug/usr/lib64/libopenfec.so.1.4.2-…<arch>.debug) produced by rpmbuild's standard find-debuginfo.sh + dwz pipeline. This is a textbook AV/EDR false positive on stripped DWARF debug-info: .debug_info / .debug_str / .debug_loc / .debug_abbrev sections plus the densely-packed string tables look statistically identical to packed/encrypted payloads, especially with rpm's default --compress-debug-sections=zlib. The same heuristic fires on both architectures from the same %build, which is itself strong evidence that the trigger is the standard rpmbuild debuginfo pipeline rather than anything in Source0.

Source0 (openfec_1.4.2.6.tar.gz) is a small Reed-Solomon / LDPC-Staircase forward-erasure-correction C library; its tests/ directory contains only .c files and there is no third-party blob anywhere in the tarball.

Fix

This PR adds a spec-search-replace overlay to base/comps/openfec/openfec.comp.toml that injects %global debug_package %{nil} immediately before the Name: line in specs/o/openfec/openfec.spec. That single directive causes rpmbuild to skip the find-debuginfo.sh extraction step entirely, so the two failing *-debuginfo RPMs simply stop being produced.

Trade-off

Loses post-mortem gdb / crash / eu-stack debugging support for libopenfec.so.1.4.2. This is acceptable because:

1. openfec is a small FEC math library with a narrow API surface.
2. Azure Linux's debuginfo repo is a non-default, on-demand SDK feed.
3. The same scanner heuristic would otherwise re-fire on every refresh of the same .debug ELF, since the trigger is the standard DWARF-extraction pipeline rather than anything specific to this build.

What was considered and not chosen

• Build-time -gz=none via CFLAGS (uncompressed DWARF). Lower-entropy but materially larger debuginfo RPMs and unverified whether AZL's azurelinux-rpm-config macros honour the per-spec %undefine _find_debuginfo_opts cleanly. Kept as a documented fallback if the canonical fix needs to be reverted.

Validation

• Render: azldev-in-container comp render -p openfec (rendered specs refreshed in specs/o/openfec/).
• Lock: azldev-in-container comp update -p openfec (lock file refreshed in locks/).
• The runtime openfec, openfec-devel, and openfec-utils sub-packages built from the three %files blocks in the spec are unaffected.

[Copilot]

Pull request overview

Suppresses generation of openfec debuginfo RPMs to avoid ESRP malware-scan false positives triggered by the standard rpmbuild debuginfo pipeline, while keeping the runtime/devel/utils subpackages unchanged.

Changes:

• Added a component overlay for openfec that injects %global debug_package %{nil} before the Name: tag to disable auto-generated debuginfo subpackages.
• Refreshed the rendered openfec.spec output (including a Release bump consistent with a packaging change).
• Updated component metadata to reflect the customization (moved from inline components.toml entry to a dedicated .comp.toml) and refreshed the lock fingerprint.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated no comments.

File	Description
base/comps/openfec/openfec.comp.toml	Introduces the overlay that disables *-debuginfo output for openfec.
specs/o/openfec/openfec.spec	Rendered spec updated to include %global debug_package %{nil} and bump Release.
base/comps/components.toml	Removes openfec from the inline “unmodified components” list now that it has custom overlays.
locks/openfec.lock	Updates the input fingerprint to match the new component definition.

[christopherco]

Generally changes look fine to me. Please squash commits together into 1 commit