fix: rootlesskit: pin to Fedora 43 build commit eb6bc70fe34c

[binujp]

Pin rootlesskit to upstream commit eb6bc70fe34cb6947bb1fb1b61b23e34159273e7 (Fedora dist-git: golang-github-rootless-containers-rootlesskit) to fetch sources from the commit used to build the current f43 package.

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

• The toolchain has been rebuilt successfully (or no changes were made to it)
• The toolchain/worker package manifests are up-to-date
• Any updated packages successfully build (or no packages were changed)
• Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
• Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• All package sources are available
• cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
• LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
• All source files have up-to-date hashes in the *.signatures.json files
• sudo make go-tidy-all and sudo make go-test-coverage pass
• Documentation has been updated to match any changes to the build system
• Ready to merge

---

Summary

What does the PR accomplish, why was it needed?

Change Log

• Change
• Change
• Change

Does this affect the toolchain?

YES/NO

Associated issues

• #xxxx

Links to CVEs

• https://nvd.nist.gov/vuln/detail/CVE-YYYY-XXXX

Test Methodology

• Pipeline build id: xxxx

[Copilot]

Pull request overview

Pins the rootlesskit component to a specific Fedora 43 dist-git commit so Azure Linux fetches the same sources as the currently built Fedora 43 package, while moving the component definition to a dedicated *.comp.toml file.

Changes:

• Added base/comps/rootlesskit/rootlesskit.comp.toml with an upstream Fedora 43 commit pin for rootlesskit.
• Removed the now-redundant [components.rootlesskit] entry from base/comps/components-full.toml.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
base/comps/rootlesskit/rootlesskit.comp.toml	Introduces an upstream-commit pin for Fedora 43’s golang-github-rootless-containers-rootlesskit dist-git history.
base/comps/components-full.toml	Removes rootlesskit from the generated component list now that it has a dedicated component file.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The pin rationale is clear, but per the repo’s comp.toml guidance, pins to an upstream commit should include a full reference URL to the external source commit (e.g., the Fedora dist-git commit URL with the f43 branch) so future maintainers can quickly verify and remove the override when appropriate.

Suggested change

	# Pin to the f43 commit used to build the current Fedora 43 package.
	# Pin to the f43 commit used to build the current Fedora 43 package.
	# Fedora dist-git commit: https://src.fedoraproject.org/rpms/golang-github-rootless-containers-rootlesskit/c/eb6bc70fe34cb6947bb1fb1b61b23e34159273e7?branch=f43