feat(rust-ctutils): add rust-ctutils component

[Autumn Nash (WithEnoughCoffee)]

Summary

New leaf Rust crate component, rust-ctutils, split out of #18405 (zip-prereqs) specifically so it can be built and tagged into the koji build repo before that PR, following the same pattern as rust-cpubits (#18446) and rust-cmov (#18445).

Why this needs to be its own PR

Koji scratch builds only resolve dynamic BuildRequires (%cargo_generate_buildrequires) against already-tagged packages in the target repo. rust-ctutils is "Built on the cmov crate" — a real, dynamically-resolved BuildRequires — so it cannot build in the same PR as an untagged rust-cmov. This is identical to why rust-cpubits was split out for rust-aes 0.9.1's crate(cpubits/default) requirement.

rust-ctutils 0.4.2 is a brand-new package (not previously in AZL), needed transitively via rust-digest's new "mac" feature subpackage (crate(ctutils/default) >= 0.4.0, < 0.5.0), which rust-hmac 0.13.0 requires as part of #18405's uv crate-alignment cascade.

%check disabled

rust-ctutils's test suite requires crate(proptest/default) >= 1.11.0, which is itself being bumped in #18405 in the same wave — a same-PR interdependent new-package BuildRequires that koji's scratch-build gate can never resolve. %check is disabled for now; revisit once the proptest bump has merged/tagged.

Verification

• Local chain build (azldev comp build --local-repo-with-publish -p rust-cmov -p rust-ctutils) using rust-cmov from feat(rust-cmov): add rust-cmov component #18445's branch — succeeded, confirming the real dependency resolves once cmov is tagged.
• Full 21-component chain build (cmov → cpubits → ctutils → all 18 zip-prereqs components) verified together end-to-end — all succeed, %check passing where enabled.
• rpm -qlp inspection: source-registry files only (/usr/share/cargo/registry/ctutils-0.4.2/...), no binaries — this is a cargo "source crate" style devel package, so no smoke-test beyond content inspection applies (consistent with the rust-cpubits precedent).
• azldev comp render -p rust-ctutils is idempotent (changed=false).
• azldev comp update -p rust-ctutils clean, no lock drift.

Sequencing

rust-cmov (#18445) has merged into 4.0, so crate(cmov/default) is satisfiable once it's tagged in koji. #18405 (zip-prereqs) can resolve crate(ctutils/default) dynamically once this PR merges/tags too.

[Copilot]

Pull request overview

Adds the pinned Fedora 43 rust-ctutils component required by the RustCrypto dependency chain.

Changes:

• Adds component configuration with %check disabled pending proptest 1.11.
• Adds lock and rendered RPM packaging files for version 0.4.2.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
base/comps/rust-ctutils/rust-ctutils.comp.toml	Defines the pinned component and build configuration.
locks/rust-ctutils.lock	Locks upstream resolution and inputs.
specs/r/rust-ctutils/rust-ctutils.spec	Provides the rendered RPM specification.
specs/r/rust-ctutils/rust-ctutils.azl.macros	Disables %check in the rendered build.
specs/r/rust-ctutils/sources	Records the crate source checksum.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 5 changed files in this pull request and generated no new comments.

Suppressed comments (1)

base/comps/rust-ctutils/rust-ctutils.comp.toml:17

• Disabling the bcond only through without omits the required structured %check justification, so check-disablement tooling cannot audit this temporary exception. Keep the bcond override because it prevents %cargo_generate_buildrequires from resolving the unavailable proptest dependency, but also record the skip and re-enable condition through build.check.

without = ["check"]

[Autumn Nash (WithEnoughCoffee)]

/azp run

[azure-pipelines]

Azure Pipelines:
2 pipeline(s) were filtered out due to trigger conditions.

[Autumn Nash (WithEnoughCoffee)]

/azp run

[azure-pipelines]

Azure Pipelines:
2 pipeline(s) were filtered out due to trigger conditions.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 5 changed files in this pull request and generated no new comments.

Suppressed comments (2)

base/comps/rust-ctutils/rust-ctutils.comp.toml:15

• New-component test disablements must be recorded through build.check.skip with a concrete skip_reason; the prose comment and generic bcond override are not captured by azldev's check-disablement policy. Keep without = ["check"] here because it prevents %cargo_generate_buildrequires from resolving the unavailable proptest dependency, but also add the structured check skip/reason, then refresh the lock and rendered spec.

without = ["check"]

base/comps/rust-ctutils/rust-ctutils.comp.toml:13

• This points readers to planning/uv/uv-investigation.md, but that path does not exist in the repository. Remove the dead reference or replace it with a checked-in tracking document or issue so the rationale remains actionable.

# #18405 merges/tags -- see planning/uv/uv-investigation.md for why this
# matters (untested cmov-CVE-class regressions in the meantime).

[reuben olinsky (reubeno)]

issue(blocking): Could you please remove point-in-time details from the comments that won't be relevant after merging? For example, once this is merged, this won't be a new component. Also, the context of which packages depend on it need not be included. Any justification for the explicit pin is fine.