From 8b87e0eb7628dbdc32f966c1b3fb9a51e76e2a48 Mon Sep 17 00:00:00 2001
From: Ophestra <cat@gensokyo.uk>
Date: Sat, 30 May 2026 18:56:55 +0900
Subject: [PATCH] internal/rosa: annotate blocked updates

These situations, while unfortunate, are inevitable at a larger scale. This change enables annotation and optional hiding of blocked updates.

Signed-off-by: Ophestra <cat@gensokyo.uk>
---
 cmd/mbf/main.go                  | 24 +++++++++++++++++++++++-
 internal/rosa/package/openssl.az |  2 ++
 internal/rosa/state.go           |  3 +++
 3 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/cmd/mbf/main.go b/cmd/mbf/main.go
index 9cde0a94..ed7b71bf 100644
--- a/cmd/mbf/main.go
+++ b/cmd/mbf/main.go
@@ -360,7 +360,10 @@ func main() {
 	)
 
 	{
-		var flagJobs int
+		var (
+			flagJobs    int
+			flagNoBlock bool
+		)
 		c.NewCommand("updates", command.UsageInternal, func([]string) error {
 			var (
 				errsMu sync.Mutex
@@ -379,6 +382,11 @@ func main() {
 							continue
 						}
 
+						if !flagNoBlock && meta.Blocked != "" {
+							msg.Verbosef("%s is blocked: %s", meta.Name, meta.Blocked)
+							continue
+						}
+
 						v, err := meta.GetVersions(ctx)
 						if err != nil {
 							errsMu.Lock()
@@ -419,9 +427,23 @@ func main() {
 			&flagJobs,
 			"j", command.IntFlag(32),
 			"Maximum number of simultaneous connections",
+		).Flag(
+			&flagNoBlock,
+			"ignore-block", command.BoolFlag(false),
+			"Inhibit update blocking",
 		)
 	}
 
+	c.NewCommand("blocked", command.UsageInternal, func([]string) error {
+		for _, p := range rosa.Native().CollectAll() {
+			meta, _ := rosa.Native().Std().Load(p)
+			if meta.Blocked != "" {
+				fmt.Printf("%s: %s\n", meta.Name, meta.Blocked)
+			}
+		}
+		return nil
+	})
+
 	c.NewCommand(
 		"daemon",
 		"Service artifact IR with Rosa OS extensions",
diff --git a/internal/rosa/package/openssl.az b/internal/rosa/package/openssl.az
index 86e438bc..90dc616a 100644
--- a/internal/rosa/package/openssl.az
+++ b/internal/rosa/package/openssl.az
@@ -5,6 +5,8 @@ package openssl {
 	// strange malformed tags treated as pre-releases in Anitya
 	latest = anityaFallback;
 
+	block = "python";
+
 	version# = "3.6.2";
 	source = remoteGitHubRelease {
 		suffix = "openssl/openssl";
diff --git a/internal/rosa/state.go b/internal/rosa/state.go
index 1aa37ea9..a53a0ffa 100644
--- a/internal/rosa/state.go
+++ b/internal/rosa/state.go
@@ -96,6 +96,8 @@ type Metadata struct {
 	//
 	// [Anitya]: https://release-monitoring.org/
 	ID int `json:"-"`
+	// Maintainer-facing reason of blocked update.
+	Blocked string `json:"block,omitempty"`
 
 	// Whether to exclude from exported functions.
 	Exclude bool `json:"exclude,omitempty"`
@@ -944,6 +946,7 @@ func (ctx *evalContext) pf(
 		k("version"):     &meta.Version,
 		k("exclude"):     &meta.Exclude,
 		k("anitya"):      &anitya,
+		k("block"):       &meta.Blocked,
 		k("latest"):      &meta.latest,
 
 		k("writable"):    &attr.Writable,