add azl-compliance package (#9213)

Adds the azl-compliance package to our distro. This will be used to harden images for FIPS and FedRAMP.

Author: tobiasb-ms

SPECS/LICENSES-AND-NOTICES/LICENSES-MAP.md

@@ -2150,6 +2150,7 @@
                 "application-gateway-kubernetes-ingress",
                 "asc",
                 "azcopy",
+                "azl-compliance",
                 "azure-iot-sdk-c",
                 "azure-storage-cpp",
                 "azurelinux-sysinfo",

SPECS/LICENSES-AND-NOTICES/data/licenses.json

@@ -0,0 +1,5 @@
+{
+ "Signatures": {
+  "azl-compliance-1.0.1.tar.gz": "1d96b99ec755500383e5ff6bad01f1ac85848f067488f3ce29a99e6eb57a86b7"
+ }
+}

SPECS/azl-compliance/azl-compliance.signatures.json

@@ -0,0 +1,58 @@
+Summary:        Azure Linux compliance package to meet all sorts of compliance rules
+Name:           azl-compliance
+Version:        1.0.1
+Release:        1%{?dist}
+License:        BSD-3-Clause
+Vendor:         Microsoft Corporation
+Distribution:   Mariner
+Group:          System Environment/Base
+URL:            https://aka.ms/mariner
+Source0:        %{_mariner_sources_url}/%{name}-%{version}.tar.gz
+Requires:       dnf
+Requires:       gnutls
+Requires:       grub2
+Requires:       grubby
+Requires:       rpm
+Requires:       rsyslog
+Requires:       sudo
+BuildRequires:  rust
+
+%description
+Azure Linux compliance package to configure systems to meet FIPS and FedRAMP compliance.
+
+%prep
+%autosetup
+
+%build
+cd azl-compliance
+cargo build --release --offline
+
+%install
+mkdir -p %{buildroot}%{_sysconfdir}/azl-compliance/
+mkdir -p %{buildroot}%{_bindir}
+install -m 0755 ./azl-compliance/target/release/azl-compliance %{buildroot}%{_bindir}/azl-compliance
+mkdir -p %{buildroot}%{_sysconfdir}/azl-compliance/fips
+mkdir -p %{buildroot}%{_sysconfdir}/azl-compliance/fedramp/remediation_scripts
+install -m 0755 fips/*.sh %{buildroot}%{_sysconfdir}/azl-compliance/fips/
+install -m 0755 fedramp/*.sh %{buildroot}%{_sysconfdir}/azl-compliance/fedramp/
+install -m 0644 fedramp/*.txt %{buildroot}%{_sysconfdir}/azl-compliance/fedramp/
+install -m 0755 fedramp/remediation_scripts/* %{buildroot}%{_sysconfdir}/azl-compliance/fedramp/remediation_scripts/
+install -m 0644 azl-compliance-fips.json %{buildroot}%{_sysconfdir}/azl-compliance/
+install -m 0644 azl-compliance-fedramp.json %{buildroot}%{_sysconfdir}/azl-compliance/
+
+%files
+%license LICENSE
+%{_bindir}/azl-compliance
+%{_sysconfdir}/azl-compliance/fips
+%{_sysconfdir}/azl-compliance/azl-compliance-fips.json
+%{_sysconfdir}/azl-compliance/fedramp
+%{_sysconfdir}/azl-compliance/azl-compliance-fedramp.json
+
+%check
+cd azl-compliance
+cargo test --release --offline
+
+%changelog
+* Tue Mar 19 2024 Tobias Brick <tobiasb@microsoft.com> 1.0.1-1
+- Original version for CBL-Mariner.
+- License verified

SPECS/azl-compliance/azl-compliance.spec

@@ -860,6 +860,16 @@
         }
       }
     },
+    {
+      "component": {
+        "type": "other",
+        "other": {
+          "name": "azl-compliance",
+          "version": "1.0.1",
+          "downloadUrl": "https://azurelinuxsrcstorage.blob.core.windows.net/sources/core/azl-compliance-1.0.1.tar.gz"
+        }
+      }
+    },
     {
       "component": {
         "type": "other",