feat(lockfile): record the feed set per target, and each package's origin

scripts/local-feeds/run.sh

@@ -94,7 +94,12 @@ repos:
 
 runtimes:
   dev:
-    packages: {}
+    packages:
+      # From `local-build`, so the lock's recorded origin has something to be
+      # right or wrong about. With every package coming from the baked distro
+      # repo, "provenance works" is indistinguishable from "provenance is a
+      # constant".
+      hello-feed: "*"
 
 extensions:
   app:
@@ -175,4 +180,29 @@ pass "stage scoping: runtime stage sees local-build only"
 grep -q '@vendor' ext.out || { cat ext.out; fail "vendor feed missing at ext stage"; }
 pass "stage scoping: ext stage sees vendor"
 
+# 8. The lock records WHICH feed each package came from, per target.
+#    `rpm` cannot answer this; dnf can, from the installroot's own history. The
+#    interesting assertion is not that a repo is recorded but that it is the
+#    NAMED feed rather than the baked distro one — otherwise the test passes for
+#    a constant.
+"$AVOCADO" --no-tui install --force > install-runtime.out 2>&1 || {
+  tail -20 install-runtime.out >&2; fail "runtime install"; }
+python3 - <<'PYEOF' || fail "lock provenance"
+import json, sys
+lock = json.load(open("avocado.lock"))
+targets = lock.get("targets", {})
+found = {}
+for t, tv in targets.items():
+    for rt in (tv.get("runtimes") or {}).values():
+        for name, rec in (rt.get("packages") or {}).items():
+            if isinstance(rec, dict):
+                found[name] = rec.get("repo")
+if found.get("hello-feed") != "local-build":
+    print(f"  hello-feed origin = {found.get('hello-feed')!r}, expected 'local-build'")
+    print(f"  recorded: {found}")
+    sys.exit(1)
+print(f"     hello-feed recorded as coming from {found['hello-feed']!r}")
+PYEOF
+pass "lock records the feed each package came from"
+
 echo "ALL PASSED  (workdir: $WORK)"

src/commands/clean.rs

@@ -471,8 +471,11 @@ sdk:
             let tl = lock.targets.entry("qemux86-64".to_string()).or_default();
             tl.kernel_versions
                 .insert("rootfs".to_string(), "6.6.123-yocto-standard".to_string());
-            let mut pkgs = std::collections::HashMap::new();
-            pkgs.insert("kernel-image".to_string(), "6.6.123-r0.0".to_string());
+            let mut pkgs = crate::utils::lockfile::PackageVersions::new();
+            pkgs.insert(
+                "kernel-image".to_string(),
+                crate::utils::lockfile::LockedPackage::new("6.6.123-r0.0"),
+            );
             tl.kernels
                 .insert("6.6.123-yocto-standard".to_string(), pkgs);
         }

src/commands/ext/install.rs

@@ -1192,6 +1192,25 @@ $DNF_SDK_HOST \
                         // runtime is in scope, legacy global namespace
                         // otherwise.
                         lock_file.update_sysroot_versions(target, &sysroot, installed_versions);
+                        // And where they came from, which matters most here:
+                        // extensions are the stage most likely to draw from a
+                        // second feed. Best effort — dnf answers from the
+                        // installroot's own history, and a lock records a bare
+                        // version when it cannot.
+                        let origins = container_helper
+                            .query_installed_origins(
+                                &sysroot,
+                                container_image,
+                                target,
+                                repo_url.cloned(),
+                                repo_release.cloned(),
+                                merged_container_args.clone(),
+                                runs_on_context,
+                                self.sdk_arch.as_ref(),
+                                self.runtime_env_vars(),
+                            )
+                            .await;
+                        lock_file.set_sysroot_origins(target, &sysroot, &origins);
                         if self.verbose {
                             print_info(
                                 &format!("Updated lock file with extension '{extension}' package versions."),

src/commands/rootfs/install.rs

@@ -1229,6 +1229,28 @@ $DNF_SDK_HOST $DNF_SDK_TARGET_REPO_CONF \
                 &params.sysroot_type,
                 installed_versions,
             );
+            // Then where each one came from. Best effort and deliberately not
+            // gated on `versions_recorded` being true for the origins as well: a
+            // lock that records a version without an origin is the normal case
+            // for a single-feed project, and a build must never fail because
+            // provenance could not be determined.
+            let origins = params
+                .container_helper
+                .query_installed_origins(
+                    &params.sysroot_type,
+                    params.container_image,
+                    params.target,
+                    params.repo_url.map(|s| s.to_string()),
+                    params.repo_release.map(|s| s.to_string()),
+                    params.merged_container_args.clone(),
+                    params.runs_on_context,
+                    params.sdk_arch,
+                    None,
+                )
+                .await;
+            params
+                .lock_file
+                .set_sysroot_origins(params.target, &params.sysroot_type, &origins);
             if params.verbose {
                 print_info(
                     &format!("Updated lock file with {label} package versions."),

src/commands/runtime/install.rs

@@ -813,7 +813,7 @@ $DNF_SDK_HOST \
                             merged_container_args.clone(),
                             runs_on_context,
                             self.sdk_arch.as_ref(),
-                            Some(runtime_env_vars),
+                            Some(runtime_env_vars.clone()),
                         )
                         .await?;
 
@@ -823,6 +823,24 @@ $DNF_SDK_HOST \
                             &sysroot,
                             installed_versions,
                         );
+                        // Then which feed each package came from. Best effort:
+                        // `rpm` gives the version and cannot give the origin, dnf
+                        // gives the origin from the installroot's own history, and
+                        // a lock records a bare version when it cannot be known.
+                        let origins = container_helper
+                            .query_installed_origins(
+                                &sysroot,
+                                container_image,
+                                &target_arch,
+                                repo_url.cloned(),
+                                repo_release.cloned(),
+                                merged_container_args.clone(),
+                                runs_on_context,
+                                self.sdk_arch.as_ref(),
+                                Some(runtime_env_vars.clone()),
+                            )
+                            .await;
+                        lock_file.set_sysroot_origins(&target_arch, &sysroot, &origins);
                         if self.verbose {
                             print_info(
                                 &format!(

src/commands/sdk/install.rs

@@ -805,6 +805,26 @@ $DNF_SDK_HOST $DNF_NO_SCRIPTS $DNF_SDK_TARGET_REPO_CONF \
                         &SysrootType::TargetSysroot,
                         installed_versions,
                     );
+                    // Then where each one came from. Best effort, and separate
+                    // from the versions for a reason: `rpm` is authoritative
+                    // about what is installed and cannot say where it came
+                    // from, dnf knows the origin from the installroot's own
+                    // history. A lock records a bare version when the origin
+                    // cannot be determined, so this never fails a build.
+                    let origins = container_helper
+                        .query_installed_origins(
+                            &SysrootType::TargetSysroot,
+                            container_image,
+                            target,
+                            repo_url.map(|s| s.to_string()),
+                            repo_release.map(|s| s.to_string()),
+                            merged_container_args.cloned(),
+                            runs_on_context,
+                            self.sdk_arch.as_ref(),
+                            None,
+                        )
+                        .await;
+                    final_lock.set_sysroot_origins(target, &SysrootType::TargetSysroot, &origins);
                 }
             }
         }