linter: update usrmerge and make it required

[justinvreeland]

Melange Pull Request Template

Notes:

Linter

• The new check is clean across Wolfi

I don't have a just newest copy of wolf packages locally but the failures I see are all packages we've replaced.

❯ melange lint packages/aarch64/wolfi-baselayout-20230201-r18.apk 
2025/03/10 14:48:58 INFO Required checks: [dev infodir tempdir usrmerge varempty]
2025/03/10 14:48:58 INFO Warning checks: [lddcheck object opt pkgconf python/docs python/multiple python/test setuidgid srv strip usrlocal worldwrite]
2025/03/10 14:48:58 INFO linting apk: wolfi-baselayout (size: 14 kB)
2025/03/10 14:48:58 WARN linter "usrlocal" failed on package "wolfi-baselayout": /usr/local path found in non-compat package: usr/local/lib64; suggest: This package should be a -compat package

❯ melange lint packages/aarch64/util-linux-misc-2.40.1-r0.apk 
2025/03/10 15:09:37 INFO Required checks: [dev infodir tempdir usrmerge varempty]
2025/03/10 15:09:37 INFO Warning checks: [lddcheck object opt pkgconf python/docs python/multiple python/test setuidgid srv strip usrlocal worldwrite]
2025/03/10 15:09:37 WARN parsing .melange.yaml: could not open .melange.yaml file: file does not exist
2025/03/10 15:09:37 INFO linting apk: util-linux-misc (size: 3.7 MB)
2025/03/10 15:09:37 WARN linter "setuidgid" failed on package "util-linux-misc": file is setgid; suggest: Unset the setuid/setgid bit on the relevant files, or remove this linter
2025/03/10 15:09:37 ERRO linter "usrmerge" failed on package "util-linux-misc": package contains non-symlink file at /sbin or /bin in violation of usrmerge; suggest: Move binary to /usr/{bin,sbin}


~/work/wolfi main ≡
❯ melange lint packages/aarch64/util-linux-misc-2.40.4-r31.apk 
2025/03/10 15:10:02 INFO Required checks: [dev infodir tempdir usrmerge varempty]
2025/03/10 15:10:02 INFO Warning checks: [lddcheck object opt pkgconf python/docs python/multiple python/test setuidgid srv strip usrlocal worldwrite]
2025/03/10 15:10:02 INFO linting apk: util-linux-misc (size: 8.8 MB)

[a-crate]

Ideally we should still warn about writing to paths we will usrmerge later (/usr/sbin,/lib) imo.

[murraybd]

Ideally we should still warn about writing to paths we will usrmerge later (/usr/sbin,/lib) imo.

While I agree we were just warning which I suspect nobody looks at.

[justinvreeland]

I can do a follow up change to add a new warning linter for those.

[xnox]

one can ignore build failures, as those are failing due to out of date remediations in wolfi, and not due to the proposed melange change.