Add const for source type name

Signed-off-by: Brian Goff <[email protected]>

Fix incorrect format for deb version constraints

The format it was using is the or operator `|` that says either of these
constraints satisfies the dependency.
We need these to be be and-ed, which is done like any other package with
a `,`.

Signed-off-by: Brian Goff <[email protected]>
(cherry picked from commit ae886a3)
Signed-off-by: Brian Goff <[email protected]>

Fix incorrect format for deb version constraints

The format it was using is the or operator `|` that says either of these
constraints satisfies the dependency.
We need these to be be and-ed, which is done like any other package with
a `,`.

Signed-off-by: Brian Goff <[email protected]>
(cherry picked from commit ae886a3)
Signed-off-by: Brian Goff <[email protected]>

build(deps): bump the actions-all group with 2 updates

Bumps the actions-all group with 2 updates: [step-security/harden-runner](https://github.com/step-security/harden-runner) and [github/codeql-action](https://github.com/github/codeql-action).


Updates `step-security/harden-runner` from 2.13.0 to 2.13.1
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](step-security/harden-runner@ec9f2d5...f4a75cf)

Updates `github/codeql-action` from 3.30.1 to 3.30.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@f1f6e5f...192325c)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-version: 2.13.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-all
- dependency-name: github/codeql-action
  dependency-version: 3.30.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-all
...

Signed-off-by: dependabot[bot] <[email protected]>

source: http: make sure we set a source path for mounts

In the sources refactor we neglected to set a source path when mounting
http sources, as such they end up getting mounted as directories instead
of files.

Signed-off-by: Brian Goff <[email protected]>

Fix bullseye repo

Signed-off-by: Brian Goff <[email protected]>
(cherry picked from commit 9a77b92)
Signed-off-by: Brian Goff <[email protected]>

Fix bullseye repo

Signed-off-by: Brian Goff <[email protected]>
(cherry picked from commit 9a77b92)
Signed-off-by: Brian Goff <[email protected]>

rpm: make sure constraints are applied before install

This ensures platform is set in the so we can generate a correct cache
key for dnf cache mounts.

Signed-off-by: Brian Goff <[email protected]>

dnf: Remove explicit makecache and --refresh

This prevents extra round trips to the repository that are almost
certainly uneccessary.
It also gives the spec author/builder the power to control metadata
expiry in the cache.

dnf is not like apt (which requires explicit metadata updates), and by
default it will refresh metadata after a configured expiry time.

This is a backport of 3200f03 which
cannot be directly cherry-picked.

Signed-off-by: Brian Goff <[email protected]>

feat: Add support for building systemd system extensions (#734)

* feat: Add support for building systemd system extensions

Sysexts are not containers and therefore do not necessarily need to
include all their dependencies. Exactly how much to include ultimately
depends on how the sysext is intended to be used. To give the spec
author full control over this, only the built package and the
dependencies explicitly listed in the spec are installed to the sysext.
These are extracted rather than installed by the package manager.

For now, the generated sysext is a bare erofs filesystem rather than a
partitioned disk image.

This adds `/sysext` to the azlinux3 and noble targets. These are the
only targets with a new enough erofs-utils to include tar support.

/etc can only be included in confexts rather than sysexts. For now, move
anything in /etc (except systemd) to /usr/share/NAME/etc and copy that
data back again at runtime with systemd-tmpfiles. This is what Flatcar
does.

Any systemd services are automatically started when the sysext is
attached thanks to a drop-in against multi-user.target.

Signed-off-by: James Le Cuirot <[email protected]>

* Use a new "sysext" dependency type for sysexts rather than "runtime"

This allows existing specs to be extended for sysext use rather than
having to create new ones just to avoid unwanted runtime dependencies.

Signed-off-by: James Le Cuirot <[email protected]>

* Run the tests for sysext targets

Like the package targets, this builds a container to run the tests in
and then throws it away. It is not feasible to test the sysext itself.

Signed-off-by: James Le Cuirot <[email protected]>

* docs: Add system extension documentation

Signed-off-by: James Le Cuirot <[email protected]>

* Temporarily move */sysext targets to */testing/sysext while experimental

---------

Signed-off-by: James Le Cuirot <[email protected]>