Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package forgejo-runner for openSUSE:Factory checked in at 2025-03-27 22:32:10 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/forgejo-runner (Old) and /work/SRC/openSUSE:Factory/.forgejo-runner.new.2696 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "forgejo-runner" Thu Mar 27 22:32:10 2025 rev:17 rq:1256337 version:6.3.1 Changes: -------- --- /work/SRC/openSUSE:Factory/forgejo-runner/forgejo-runner.changes 2025-03-24 13:30:32.051531435 +0100 +++ /work/SRC/openSUSE:Factory/.forgejo-runner.new.2696/forgejo-runner.changes 2025-03-27 22:32:21.812760795 +0100 @@ -1,0 +2,8 @@ +Wed Mar 26 21:40:10 UTC 2025 - rra...@opensuse.org + +- Update to version 6.3.1: + * Fixed an issue which caused data races and timeouts in certain cases, which + would cause cache storing and retrieval to fail. + + +------------------------------------------------------------------- Old: ---- forgejo-runner-6.3.0.obscpio New: ---- forgejo-runner-6.3.1.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ forgejo-runner.spec ++++++ --- /var/tmp/diff_new_pack.tavTEU/_old 2025-03-27 22:32:22.584792752 +0100 +++ /var/tmp/diff_new_pack.tavTEU/_new 2025-03-27 22:32:22.584792752 +0100 @@ -19,7 +19,7 @@ %define services %{name}.service Name: forgejo-runner -Version: 6.3.0 +Version: 6.3.1 Release: 0 Summary: Daemon that connects to a Forgejo instance and runs CI jobs License: MIT ++++++ _service ++++++ --- /var/tmp/diff_new_pack.tavTEU/_old 2025-03-27 22:32:22.616794077 +0100 +++ /var/tmp/diff_new_pack.tavTEU/_new 2025-03-27 22:32:22.624794408 +0100 @@ -2,7 +2,7 @@ <service name="obs_scm" mode="manual"> <param name="url">https://code.forgejo.org/forgejo/runner</param> <param name="scm">git</param> - <param name="revision">refs/tags/v6.3.0</param> + <param name="revision">refs/tags/v6.3.1</param> <param name="versionformat">@PARENT_TAG@</param> <param name="changesgenerate">enable</param> <param name="versionrewrite-pattern">v(.*)</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.tavTEU/_old 2025-03-27 22:32:22.644795235 +0100 +++ /var/tmp/diff_new_pack.tavTEU/_new 2025-03-27 22:32:22.648795401 +0100 @@ -1,6 +1,6 @@ <servicedata> <service name="tar_scm"> <param name="url">https://code.forgejo.org/forgejo/runner</param> - <param name="changesrevision">d93829cf07746d02734c2c488a354443ac13720b</param></service></servicedata> + <param name="changesrevision">caeedc62a51d2753aa3dbd4b379292786ad4d985</param></service></servicedata> (No newline at EOF) ++++++ fix-CVE-2025-22869.patch ++++++ --- /var/tmp/diff_new_pack.tavTEU/_old 2025-03-27 22:32:22.660795898 +0100 +++ /var/tmp/diff_new_pack.tavTEU/_new 2025-03-27 22:32:22.664796064 +0100 @@ -1,13 +1,13 @@ diff -rub runner/go.mod runner-patched/go.mod ---- runner/go.mod 2025-03-22 13:52:50.285370496 +0100 -+++ runner-patched/go.mod 2025-03-22 13:55:17.656423733 +0100 +--- runner/go.mod 2025-03-26 22:40:10.789167735 +0100 ++++ runner-patched/go.mod 2025-03-26 22:42:07.953311152 +0100 @@ -1,8 +1,8 @@ module gitea.com/gitea/act_runner -go 1.23 +go 1.23.0 --toolchain go1.23.6 +-toolchain go1.23.7 +toolchain go1.24.1 require ( @@ -36,8 +36,8 @@ gopkg.in/warnings.v0 v0.1.2 // indirect gopkg.in/yaml.v2 v2.4.0 // indirect diff -rub runner/go.sum runner-patched/go.sum ---- runner/go.sum 2025-03-22 13:52:50.285370496 +0100 -+++ runner-patched/go.sum 2025-03-22 13:55:17.658423734 +0100 +--- runner/go.sum 2025-03-26 22:40:10.789167735 +0100 ++++ runner-patched/go.sum 2025-03-26 22:42:17.691323073 +0100 @@ -231,6 +231,8 @@ golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U= @@ -47,7 +47,7 @@ golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 h1:2dVuKD2vS7b0QIHQbpyTISPd0LeHDbnYEryqj5Q1ug8= golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY= golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= -@@ -265,14 +267,19 @@ +@@ -265,9 +267,13 @@ golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.29.0 h1:TPYlXGxvx1MGTn2GiZDhnjPA9wZzZeGKHHmKhHYvgaU= golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= @@ -61,11 +61,5 @@ golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= - golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo= - golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ= -+golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY= - golang.org/x/time v0.9.0 h1:EsRrnYcQiGH+5FfbgvV4AP7qEZstoyrHB0DzarOQ4ZY= - golang.org/x/time v0.9.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM= - golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= Only in runner-patched: vendor ++++++ forgejo-runner-6.3.0.obscpio -> forgejo-runner-6.3.1.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/forgejo-runner-6.3.0/.forgejo/workflows/build-release-integration.yml new/forgejo-runner-6.3.1/.forgejo/workflows/build-release-integration.yml --- old/forgejo-runner-6.3.0/.forgejo/workflows/build-release-integration.yml 2025-03-22 11:48:13.000000000 +0100 +++ new/forgejo-runner-6.3.1/.forgejo/workflows/build-release-integration.yml 2025-03-24 20:39:09.000000000 +0100 @@ -24,7 +24,7 @@ - uses: actions/checkout@v4 - id: forgejo - uses: https://data.forgejo.org/actions/setup-forgejo@v2.0.6 + uses: https://data.forgejo.org/actions/setup-forgejo@v2.0.10 with: user: root password: admin1234 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/forgejo-runner-6.3.0/.forgejo/workflows/build-release.yml new/forgejo-runner-6.3.1/.forgejo/workflows/build-release.yml --- old/forgejo-runner-6.3.0/.forgejo/workflows/build-release.yml 2025-03-22 11:48:13.000000000 +0100 +++ new/forgejo-runner-6.3.1/.forgejo/workflows/build-release.yml 2025-03-24 20:39:09.000000000 +0100 @@ -71,7 +71,7 @@ - name: build without TOKEN if: ${{ secrets.TOKEN == '' }} - uses: https://code.forgejo.org/forgejo/forgejo-build-publish/build@v5.3.1 + uses: https://code.forgejo.org/forgejo/forgejo-build-publish/build@v5.3.4 with: forgejo: "${{ env.GITHUB_SERVER_URL }}" owner: "${{ env.GITHUB_REPOSITORY_OWNER }}" @@ -88,7 +88,7 @@ - name: build with TOKEN if: ${{ secrets.TOKEN != '' }} - uses: https://code.forgejo.org/forgejo/forgejo-build-publish/build@v5.3.1 + uses: https://code.forgejo.org/forgejo/forgejo-build-publish/build@v5.3.4 with: forgejo: "${{ env.GITHUB_SERVER_URL }}" owner: "${{ env.GITHUB_REPOSITORY_OWNER }}" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/forgejo-runner-6.3.0/.forgejo/workflows/example-lxc-systemd.yml new/forgejo-runner-6.3.1/.forgejo/workflows/example-lxc-systemd.yml --- old/forgejo-runner-6.3.0/.forgejo/workflows/example-lxc-systemd.yml 2025-03-22 11:48:13.000000000 +0100 +++ new/forgejo-runner-6.3.1/.forgejo/workflows/example-lxc-systemd.yml 2025-03-24 20:39:09.000000000 +0100 @@ -51,7 +51,7 @@ done - id: forgejo - uses: https://data.forgejo.org/actions/setup-forgejo@v2.0.7 + uses: https://data.forgejo.org/actions/setup-forgejo@v2.0.10 with: user: root password: admin1234 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/forgejo-runner-6.3.0/.forgejo/workflows/publish-release.yml new/forgejo-runner-6.3.1/.forgejo/workflows/publish-release.yml --- old/forgejo-runner-6.3.0/.forgejo/workflows/publish-release.yml 2025-03-22 11:48:13.000000000 +0100 +++ new/forgejo-runner-6.3.1/.forgejo/workflows/publish-release.yml 2025-03-24 20:39:09.000000000 +0100 @@ -27,7 +27,7 @@ - uses: https://data.forgejo.org/actions/checkout@v4 - name: copy & sign - uses: https://data.forgejo.org/forgejo/forgejo-build-publish/publish@v5.3.1 + uses: https://data.forgejo.org/forgejo/forgejo-build-publish/publish@v5.3.4 with: from-forgejo: ${{ vars.FORGEJO }} to-forgejo: ${{ vars.FORGEJO }} diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/forgejo-runner-6.3.0/examples/lxc-systemd/README.md new/forgejo-runner-6.3.1/examples/lxc-systemd/README.md --- old/forgejo-runner-6.3.0/examples/lxc-systemd/README.md 2025-03-22 11:48:13.000000000 +0100 +++ new/forgejo-runner-6.3.1/examples/lxc-systemd/README.md 2025-03-24 20:39:09.000000000 +0100 @@ -30,6 +30,14 @@ - `forgejo-runner-service.sh upgrade X.Y.Z` +### Using a specific version of the Forgejo runner + +The goal is that a LXC container uses a version of the Forgejo runner +that is different from the default. It needs to be installed and pinned. + +- Install: `INPUTS_RUNNER_VERSION=6.3.0 forgejo-runner-service.sh install_runner` +- Pin the version in `/etc/forgejo-runner/N/env` (e.g. `INPUTS_RUNNER_VERSION=6.3.0`) + ## Description - Each runner is assigned a unique serial number (`$INPUTS_SERIAL`) @@ -63,7 +71,7 @@ - `INPUTS_SERIAL`: unique number in the range `[10-100]` (check `/etc/forgejo-runner`) - `INPUTS_TOKEN`: a runner registration token obtained from the web UI - `INPUTS_FORGEJO`: the Forgejo instance from which `INPUTS_TOKEN` was obtained (e.g. https://code.forgejo.org) -- `INPUTS_RUNNER_VERSION`: the version of the Forgejo runner as found in https://code.forgejo.org/forgejo/runner/releases (e.g. 6.2.0) +- `INPUTS_RUNNER_VERSION`: the version of the Forgejo runner as found in https://code.forgejo.org/forgejo/runner/releases (e.g. 6.3.0) - `INPUTS_LXC_CONFIG`: the value of the `--config` argument of [lxc-helpers](https://code.forgejo.org/forgejo/lxc-helpers/#usage) used when creating the LXC container for the runner (e.g. `docker`) - `INPUTS_LIFETIME`: the LXC container is re-created when its lifetime expires (e.g. 7d) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/forgejo-runner-6.3.0/examples/lxc-systemd/forgejo-runner-service.sh new/forgejo-runner-6.3.1/examples/lxc-systemd/forgejo-runner-service.sh --- old/forgejo-runner-6.3.0/examples/lxc-systemd/forgejo-runner-service.sh 2025-03-22 11:48:13.000000000 +0100 +++ new/forgejo-runner-6.3.1/examples/lxc-systemd/forgejo-runner-service.sh 2025-03-24 20:39:09.000000000 +0100 @@ -21,7 +21,7 @@ : ${INPUTS_FORGEJO:=https://code.forgejo.org} : ${INPUTS_LIFETIME:=7d} : ${INPUTS_LXC_HELPERS_VERSION:=1.0.3} -: ${INPUTS_RUNNER_VERSION:=6.2.2} +: ${INPUTS_RUNNER_VERSION:=6.3.0} : ${KILL_AFTER:=21600} # 6h == 21600 NODEJS_VERSION=20 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/forgejo-runner-6.3.0/go.mod new/forgejo-runner-6.3.1/go.mod --- old/forgejo-runner-6.3.0/go.mod 2025-03-22 11:48:13.000000000 +0100 +++ new/forgejo-runner-6.3.1/go.mod 2025-03-24 20:39:09.000000000 +0100 @@ -2,7 +2,7 @@ go 1.23 -toolchain go1.23.6 +toolchain go1.23.7 require ( code.gitea.io/actions-proto-go v0.4.0 @@ -102,4 +102,4 @@ gopkg.in/yaml.v2 v2.4.0 // indirect ) -replace github.com/nektos/act => code.forgejo.org/forgejo/act v1.25.0 +replace github.com/nektos/act => code.forgejo.org/forgejo/act v1.25.1 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/forgejo-runner-6.3.0/go.sum new/forgejo-runner-6.3.1/go.sum --- old/forgejo-runner-6.3.0/go.sum 2025-03-22 11:48:13.000000000 +0100 +++ new/forgejo-runner-6.3.1/go.sum 2025-03-24 20:39:09.000000000 +0100 @@ -1,5 +1,5 @@ -code.forgejo.org/forgejo/act v1.25.0 h1:UfQH75ZD88GzveWZeaZ0F3h0W9qpQGgyx7pq7nbHyA0= -code.forgejo.org/forgejo/act v1.25.0/go.mod h1:tSg5CAHnXp4WLNkMa2e9AEDSujMxKzNM4bF2pvvRCYQ= +code.forgejo.org/forgejo/act v1.25.1 h1:T0CsN9iEWIyJzIbmMHMM9pl1KHzmI41q8mtepqVqdCc= +code.forgejo.org/forgejo/act v1.25.1/go.mod h1:tSg5CAHnXp4WLNkMa2e9AEDSujMxKzNM4bF2pvvRCYQ= code.gitea.io/actions-proto-go v0.4.0 h1:OsPBPhodXuQnsspG1sQ4eRE1PeoZyofd7+i73zCwnsU= code.gitea.io/actions-proto-go v0.4.0/go.mod h1:mn7Wkqz6JbnTOHQpot3yDeHx+O5C9EGhMEE+htvHBas= code.gitea.io/gitea-vet v0.2.3 h1:gdFmm6WOTM65rE8FUBTRzeQZYzXePKSSB1+r574hWwI= ++++++ forgejo-runner.obsinfo ++++++ --- /var/tmp/diff_new_pack.tavTEU/_old 2025-03-27 22:32:22.788801196 +0100 +++ /var/tmp/diff_new_pack.tavTEU/_new 2025-03-27 22:32:22.792801362 +0100 @@ -1,5 +1,5 @@ name: forgejo-runner -version: 6.3.0 -mtime: 1742640493 -commit: d93829cf07746d02734c2c488a354443ac13720b +version: 6.3.1 +mtime: 1742845149 +commit: caeedc62a51d2753aa3dbd4b379292786ad4d985 ++++++ vendor.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/vendor/github.com/nektos/act/pkg/artifactcache/handler.go new/vendor/github.com/nektos/act/pkg/artifactcache/handler.go --- old/vendor/github.com/nektos/act/pkg/artifactcache/handler.go 2025-03-22 13:55:29.740431140 +0100 +++ new/vendor/github.com/nektos/act/pkg/artifactcache/handler.go 2025-03-26 22:42:45.226356776 +0100 @@ -260,25 +260,19 @@ return } - cache := &Cache{} - db, err := h.openDB() + cache, err := h.readCache(id) if err != nil { - h.responseJSON(w, r, 500, err) - return - } - defer db.Close() - if err := db.Get(id, cache); err != nil { if errors.Is(err, bolthold.ErrNotFound) { - h.responseJSON(w, r, 400, fmt.Errorf("cache %d: not reserved", id)) + h.responseJSON(w, r, 404, fmt.Errorf("cache %d: not reserved", id)) return } - h.responseJSON(w, r, 500, err) + h.responseJSON(w, r, 500, fmt.Errorf("cache Get: %w", err)) return } // Should not happen if cache.Repo != repo { - h.responseJSON(w, r, 500, ErrValidation) + h.responseJSON(w, r, 500, fmt.Errorf("cache repo is not valid")) return } @@ -286,16 +280,19 @@ h.responseJSON(w, r, 400, fmt.Errorf("cache %v %q: already complete", cache.ID, cache.Key)) return } - defer db.Close() start, _, err := parseContentRange(r.Header.Get("Content-Range")) if err != nil { - h.responseJSON(w, r, 400, err) + h.responseJSON(w, r, 400, fmt.Errorf("cache parseContentRange(%s): %w", r.Header.Get("Content-Range"), err)) return } if err := h.storage.Write(cache.ID, start, r.Body); err != nil { - h.responseJSON(w, r, 500, err) + h.responseJSON(w, r, 500, fmt.Errorf("cache storage.Write: %w", err)) + return + } + if err := h.useCache(id); err != nil { + h.responseJSON(w, r, 500, fmt.Errorf("cache useCache: %w", err)) + return } - h.useCache(db, cache) h.responseJSON(w, r, 200) } @@ -314,25 +311,19 @@ return } - cache := &Cache{} - db, err := h.openDB() + cache, err := h.readCache(id) if err != nil { - h.responseJSON(w, r, 500, err) - return - } - defer db.Close() - if err := db.Get(id, cache); err != nil { if errors.Is(err, bolthold.ErrNotFound) { - h.responseJSON(w, r, 400, fmt.Errorf("cache %d: not reserved", id)) + h.responseJSON(w, r, 404, fmt.Errorf("cache %d: not reserved", id)) return } - h.responseJSON(w, r, 500, err) + h.responseJSON(w, r, 500, fmt.Errorf("cache Get: %w", err)) return } // Should not happen if cache.Repo != repo { - h.responseJSON(w, r, 500, ErrValidation) + h.responseJSON(w, r, 500, fmt.Errorf("cache repo is not valid")) return } @@ -341,8 +332,6 @@ return } - db.Close() - size, err := h.storage.Commit(cache.ID, cache.Size) if err != nil { h.responseJSON(w, r, 500, err) @@ -351,7 +340,7 @@ // write real size back to cache, it may be different from the current value when the request doesn't specify it. cache.Size = size - db, err = h.openDB() + db, err := h.openDB() if err != nil { h.responseJSON(w, r, 500, err) return @@ -382,29 +371,26 @@ return } - cache := &Cache{} - db, err := h.openDB() + cache, err := h.readCache(id) if err != nil { - h.responseJSON(w, r, 500, err) - return - } - defer db.Close() - if err := db.Get(id, cache); err != nil { if errors.Is(err, bolthold.ErrNotFound) { h.responseJSON(w, r, 404, fmt.Errorf("cache %d: not reserved", id)) return } - h.responseJSON(w, r, 500, err) + h.responseJSON(w, r, 500, fmt.Errorf("cache Get: %w", err)) return } // Should not happen if cache.Repo != repo { - h.responseJSON(w, r, 500, ErrValidation) + h.responseJSON(w, r, 500, fmt.Errorf("cache repo is not valid")) return } - h.useCache(db, cache) + if err := h.useCache(id); err != nil { + h.responseJSON(w, r, 500, fmt.Errorf("cache useCache: %w", err)) + return + } h.storage.Serve(w, r, id) } @@ -478,9 +464,31 @@ return nil } -func (h *Handler) useCache(db *bolthold.Store, cache *Cache) { +func (h *Handler) readCache(id uint64) (*Cache, error) { + db, err := h.openDB() + if err != nil { + return nil, err + } + defer db.Close() + cache := &Cache{} + if err := db.Get(id, cache); err != nil { + return nil, err + } + return cache, nil +} + +func (h *Handler) useCache(id uint64) error { + db, err := h.openDB() + if err != nil { + return err + } + defer db.Close() + cache := &Cache{} + if err := db.Get(id, cache); err != nil { + return err + } cache.UsedAt = time.Now().Unix() - _ = db.Update(cache.ID, cache) + return db.Update(cache.ID, cache) } const ( diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/vendor/modules.txt new/vendor/modules.txt --- old/vendor/modules.txt 2025-03-22 13:55:30.310507947 +0100 +++ new/vendor/modules.txt 2025-03-26 22:42:45.548357170 +0100 @@ -315,7 +315,7 @@ # github.com/moby/sys/user v0.1.0 ## explicit; go 1.17 github.com/moby/sys/user -# github.com/nektos/act v0.2.49 => code.forgejo.org/forgejo/act v1.25.0 +# github.com/nektos/act v0.2.49 => code.forgejo.org/forgejo/act v1.25.1 ## explicit; go 1.22 github.com/nektos/act/pkg/artifactcache github.com/nektos/act/pkg/artifacts @@ -543,4 +543,4 @@ gotest.tools/v3/internal/difflib gotest.tools/v3/internal/format gotest.tools/v3/internal/source -# github.com/nektos/act => code.forgejo.org/forgejo/act v1.25.0 +# github.com/nektos/act => code.forgejo.org/forgejo/act v1.25.1