fix(build): declare explicit gzip build-depend for image assembly

[j1mc]

The server OS image is assembled from parts inside an isolated build workspace that only contains tools explicitly listed in its recipe. One of the automatic setup steps rebuilds a password-strength dictionary using a helper script that needs the gzip compression tool. After a routine platform update, gzip silently disappeared from that workspace, so the nightly build log shows an error from the helper script. The build still succeeds today, but the dictionary it produces is suspect, and the next platform update could turn this into a hard failure. This change lists gzip as an explicit requirement in the recipe, plus a small automated check so it cannot silently go missing again.

What changed

• elements/oci/bluefin-server-image.bst: added freedesktop-sdk.bst:components/gzip.bst to build-depends, mirroring the sed fix for Nightly build failing #456 (PR fix(build): declare explicit sed build-depend for image assembly #458).
• tests/unit/test_build_depends.py: new regression test test_image_assembly_declares_gzip_build_depend referencing this issue.

Evidence

• Failing run: nightly run 38209341040, job build, oci/bluefin-server-image.bst logs '/usr/bin/cracklib-format: line 15: gzip: command not found' twice during 'Integrating sandbox' (non-fatal; the step still reports SUCCESS with '0 0'). The integration runs create-cracklib-dict, a shell script that pipes through gzip; gzip was only ever reached transitively and the FSDK 26.08.0 -> 26.08.2 junction bump dropped it from the sandbox.
• freedesktop-sdk.bst:components/gzip.bst is confirmed present in the pinned FSDK ref (the failing run's own graph validation fetches it).
• python3 -m pytest tests/unit/test_build_depends.py: 6 passed. The new test fails without the element change (negative control) and passes with it.
• Full unit suite: 1286 passed, 36 skipped, 1 unrelated pre-existing failure (test_the_script_is_shellcheck_clean - fails identically on the clean base; local shellcheck flags SC2015 in bluefin-ignition-credentials, a file this change does not touch).
• The full just validate graph check needs podman, which is unavailable in this environment; CI will run it.

Note: this branch is cut from my fork's main, which trails upstream main, because the token available here lacks the workflow scope needed to publish a branch whose tree updates workflow files relative to the stale fork default. The diff against upstream main is just the two files above, in regions untouched since the fork point, so it merges cleanly (also alongside PR #458: the gzip line sits between findutils and mtools, the sed line between mtools and systemd, and the two regression tests anchor at different spots).

Closes #459.

— hive: backend=pi model=openrouter/meta/muse-spark-1.3-contributor

---

🐝 Hive Agent: contributor | SHA: 5e5bac8

[hivecommons-hive]

🐝 Possible duplicate

This PR changes exactly the same files as #458, which was opened first:

• survivor (suggested): fix(build): declare explicit sed build-depend for image assembly #458 — fix(build): declare explicit sed build-depend for image assembly
• fix(build): declare explicit gzip build-depend for image assembly #460 — fix(build): declare explicit gzip build-depend for image assembly ← this PR

Evidence — identical changed-file set (2 file(s)):

• elements/oci/bluefin-server-image.bst
• tests/unit/test_build_depends.py

---

This is a suggestion, not a verdict. Hive will not close, label, approve or merge anything here — a human decides.

It was produced by comparing changed-file sets across open PRs, which is a candidate generator: PRs that share a file are not necessarily the same work. Here the patches DIFFER, so this is the weaker tier: dependency-bump PRs that edit one shared manifest, and unrelated fixes to one busy file, both land in it. Read the diffs before acting.

[hivecommons-hive]

Looks correct to me; verified rather than inferred:

• freedesktop-sdk.bst:components/cracklib.bst (at the pinned freedesktop-sdk-26.08.2 ref) has integration-commands that run create-cracklib-dict, which pipes through gzip — so the image-assembly sandbox does need gzip at integration time, exactly as described.
• components/gzip.bst exists at that FSDK ref.
• _build_depends() in tests/unit/test_build_depends.py:118 already handles both string and filename: dict entries, so the new assertion is sound. Ran the file: 5 passed on main, 6 passed with this diff applied.
• Checked the interaction with #458 (sed): git merge-tree of the two PR heads merges cleanly — the .bst inserts are separated by the mtools line and the two tests anchor at different spots, as the body says. Either can land first.

One file-set note for whoever merges: this and #458 are the same class of fix on the same element but are not duplicates (different tool, different consumer); both should land.

Confidence: 5/5 (safe)

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88