Fix non-root ownership of package files

[harkgill-amd]

Motivation

Addresses ROCm/ROCm#6496

Technical Details

Ownership for 7.14 packaged directories points to rocm-signer/rocm-signer or uid 1004 instead of root. This allows for non-root users who have uid == 1004 to overwrite files in the install tree. This is a regression from the mainline ROCm 6/7 releases where all files and directories were own by root:root.

 dpkg -c /var/cache/apt/archives/amdrocm-base7.14_7.14.0-3_amd64.deb
drwxr-xr-x rocm-signer/rocm-signer 0 2026-07-14 13:26 ./
drwxr-xr-x rocm-signer/rocm-signer 0 2026-07-09 20:08 ./opt/
drwxr-xr-x rocm-signer/rocm-signer 0 2026-07-09 20:08 ./opt/rocm/
drwxr-xr-x rocm-signer/rocm-signer 0 2026-07-09 20:08 ./opt/rocm/core-7.14/

ll /opt/rocm/core-7.14
total 48
drwxr-xr-x 10 1004 1005  4096 Jul 22 11:58 ./
drwxr-xr-x  3 1004 1005  4096 Jul 22 12:00 ../
lrwxrwxrwx  1 1004 1005    15 Jul  9 19:46 amdgcn -> lib/llvm/amdgcn/
drwxr-xr-x  3 1004 1005  4096 Jul 22 11:58 bin/
drwxr-xr-x  4 1004 1005  4096 Jul 22 11:58 etc/
drwxr-xr-x 56 1004 1005  4096 Jul 22 11:58 include/
drwxr-xr-x  2 1004 1005  4096 Jul 22 11:58 .info/

• --root-owner-group / %defattr(-, root, root, -) force 0/0 (root ownership) regardless of builder identity, fakeroot presence, or how staging owns files.
• do_fix_ownership() introduces post-inst mechanism to update existing installs

Test Plan

1. Reproduce the non-root ownership leak (root build, no fakeroot, payload staged as the build uid 1004:1005)
2. Apply the fix and confirm payload ownership is normalized to root:root, for both DEB and RPM
3. Confirm the postinst repair fixes already-installed systems on upgrade

Test Result

Reproduction + fix

• Before Patch -> Owner of /opt/rocm/core/bin/amd-smi = 1004/1005
• After Patch -> Owner of /opt/rocm/core/bin/amd-smi = root

postinst ownership repair (dpkg -i / rpm -i as root):

• Prior install owned by uid 1004 -> repaired to root:root recursively; exit 0
• Fresh install, prefix absent -> no abort (guard skips); exit 0

Submission Checklist

• Look over the contributing guidelines at https://github.com/ROCm/TheRock/blob/main/CONTRIBUTING.md.

[therock-pr-bot]

✅ All Checks Passed — Ready for Review

Check	Status	Details
🌿 Branch Name	✅ Pass	—
📝 PR Title/Description	✅ Pass	—
⛔ Forbidden Files	✅ Pass	—
🧪 Unit Test	✅ Pass	PR does not contain code files — Unit Test auto-passed
🔎 pre-commit	✅ Pass	—
🚫 Draft PR	🔜 To Be Enabled	—
🚩 Feature Flag	🔜 To Be Enabled	—
📊 Code Coverage	🔜 To Be Enabled	—
🤖 therock-pr-bot	✅ Pass	—

🎉 All checks passed! This PR is ready for review.

📖 Need help? See the Policy FAQ for details on every check and how to fix failures.

[therock-pr-bot]

🎉 All checks passed! This PR is ready for review.

[nunnikri]

Fix may not help. As the package promotion and signing is not done using this.

@yanyao-wang can we take these fixes in the promotion jobs?