Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package wolfictl for openSUSE:Factory checked in at 2025-08-28 17:18:33 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/wolfictl (Old) and /work/SRC/openSUSE:Factory/.wolfictl.new.1977 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "wolfictl" Thu Aug 28 17:18:33 2025 rev:12 rq:1301648 version:0.38.13 Changes: -------- --- /work/SRC/openSUSE:Factory/wolfictl/wolfictl.changes 2025-08-25 20:39:08.422710808 +0200 +++ /work/SRC/openSUSE:Factory/.wolfictl.new.1977/wolfictl.changes 2025-08-28 17:19:05.944298123 +0200 @@ -1,0 +2,11 @@ +Thu Aug 28 04:52:32 UTC 2025 - Johannes Kastl <opensuse_buildserv...@ojkastl.de> + +- Update to version 0.38.13: + * build(deps): bump the chainguard group with 4 updates + * chore(sbom): resolve warning for directory source + * build(deps): bump github.com/stretchr/testify from 1.10.0 to + 1.11.0 (#1734) + * build(deps): bump chainguard-dev/actions from 1.4.11 to 1.4.12 + (#1733) + +------------------------------------------------------------------- Old: ---- wolfictl-0.38.12.obscpio New: ---- wolfictl-0.38.13.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ wolfictl.spec ++++++ --- /var/tmp/diff_new_pack.jLQDAT/_old 2025-08-28 17:19:08.564407933 +0200 +++ /var/tmp/diff_new_pack.jLQDAT/_new 2025-08-28 17:19:08.584408770 +0200 @@ -17,7 +17,7 @@ Name: wolfictl -Version: 0.38.12 +Version: 0.38.13 Release: 0 Summary: A CLI used to work with the Wolfi OSS project License: Apache-2.0 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.jLQDAT/_old 2025-08-28 17:19:08.884421344 +0200 +++ /var/tmp/diff_new_pack.jLQDAT/_new 2025-08-28 17:19:08.924423021 +0200 @@ -4,7 +4,7 @@ <param name="scm">git</param> <param name="exclude">.git</param> <param name="revision">main</param> - <param name="versionformat">v0.38.12</param> + <param name="versionformat">v0.38.13</param> <param name="versionrewrite-pattern">v(.*)</param> <param name="changesgenerate">enable</param> </service> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.jLQDAT/_old 2025-08-28 17:19:09.116431068 +0200 +++ /var/tmp/diff_new_pack.jLQDAT/_new 2025-08-28 17:19:09.144432241 +0200 @@ -1,6 +1,6 @@ <servicedata> <service name="tar_scm"> <param name="url">https://github.com/wolfi-dev/wolfictl</param> - <param name="changesrevision">30027b38aa81f649cd66af2434776707dd69e35d</param></service></servicedata> + <param name="changesrevision">ba80ed03624ebe05f0945684a3e2e0e82d4ea054</param></service></servicedata> (No newline at EOF) ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/wolfictl/vendor.tar.gz /work/SRC/openSUSE:Factory/.wolfictl.new.1977/vendor.tar.gz differ: char 60, line 1 ++++++ wolfictl-0.38.12.obscpio -> wolfictl-0.38.13.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/wolfictl-0.38.12/go.mod new/wolfictl-0.38.13/go.mod --- old/wolfictl-0.38.12/go.mod 2025-08-20 12:44:22.000000000 +0200 +++ new/wolfictl-0.38.13/go.mod 2025-08-27 13:18:26.000000000 +0200 @@ -11,15 +11,15 @@ replace modernc.org/sqlite v1.33.0 => modernc.org/sqlite v1.32.0 require ( - chainguard.dev/apko v0.30.5 - chainguard.dev/melange v0.30.6 + chainguard.dev/apko v0.30.6 + chainguard.dev/melange v0.31.0 cloud.google.com/go/storage v1.56.0 github.com/adrg/xdg v0.5.3 github.com/anchore/grype v0.98.0 github.com/anchore/stereoscope v0.1.8 github.com/anchore/syft v1.31.0 github.com/chainguard-dev/clog v1.7.0 - github.com/chainguard-dev/yam v0.2.29 + github.com/chainguard-dev/yam v0.2.30 github.com/charmbracelet/bubbles v0.21.0 github.com/charmbracelet/bubbletea v1.3.6 github.com/charmbracelet/lipgloss v1.1.1-0.20250319133953-166f707985bc @@ -51,7 +51,7 @@ github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 github.com/spf13/cobra v1.9.1 github.com/spf13/pflag v1.0.7 - github.com/stretchr/testify v1.10.0 + github.com/stretchr/testify v1.11.0 github.com/texttheater/golang-levenshtein/levenshtein v0.0.0-20200805054039-cae8b0eaed6c github.com/tmc/dot v0.2.0 go.lsp.dev/uri v0.3.0 @@ -67,7 +67,7 @@ require ( github.com/anchore/go-logger v0.0.0-20250318195838-07ae343dd722 - github.com/chainguard-dev/advisory-schema v0.37.18 + github.com/chainguard-dev/advisory-schema v0.37.19 github.com/hako/durafmt v0.0.0-20210608085754-5c1018a4e16b github.com/spf13/afero v1.14.0 ) @@ -160,7 +160,7 @@ github.com/deitch/magic v0.0.0-20230404182410-1ff89d7342da // indirect github.com/diskfs/go-diskfs v1.6.1-0.20250601133945-2af1c7ece24c // indirect github.com/distribution/reference v0.6.0 // indirect - github.com/docker/cli v28.3.2+incompatible // indirect + github.com/docker/cli v28.3.3+incompatible // indirect github.com/docker/distribution v2.8.3+incompatible // indirect github.com/docker/docker v28.3.3+incompatible // indirect github.com/docker/docker-credential-helpers v0.9.3 // indirect @@ -247,7 +247,7 @@ github.com/mitchellh/reflectwalk v1.0.2 // indirect github.com/moby/docker-image-spec v1.3.1 // indirect github.com/moby/locker v1.0.1 // indirect - github.com/moby/moby v28.3.2+incompatible // indirect + github.com/moby/moby v28.3.3+incompatible // indirect github.com/moby/sys/mountinfo v0.7.2 // indirect github.com/moby/sys/sequential v0.6.0 // indirect github.com/moby/sys/signal v0.7.1 // indirect @@ -348,7 +348,7 @@ google.golang.org/genproto/googleapis/api v0.0.0-20250721164621-a45f3dfb1074 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20250728155136-f173205681a0 // indirect google.golang.org/grpc v1.74.2 // indirect - google.golang.org/protobuf v1.36.6 // indirect + google.golang.org/protobuf v1.36.7 // indirect gopkg.in/ini.v1 v1.67.0 // indirect gopkg.in/warnings.v0 v0.1.2 // indirect gorm.io/gorm v1.30.1 // indirect diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/wolfictl-0.38.12/go.sum new/wolfictl-0.38.13/go.sum --- old/wolfictl-0.38.12/go.sum 2025-08-20 12:44:22.000000000 +0200 +++ new/wolfictl-0.38.13/go.sum 2025-08-27 13:18:26.000000000 +0200 @@ -1,11 +1,11 @@ cel.dev/expr v0.24.0 h1:56OvJKSH3hDGL0ml5uSxZmz3/3Pq4tJ+fb1unVLAFcY= cel.dev/expr v0.24.0/go.mod h1:hLPLo1W4QUmuYdA72RBX06QTs6MXw941piREPl3Yfiw= -chainguard.dev/apko v0.30.5 h1:FbkEqqvS2965PJ9lx/p7a8myFTg7TXrje0grJq20MQk= -chainguard.dev/apko v0.30.5/go.mod h1:WWlchAz28M73vw/GIoixD4ywoV5vAjzI1UCpZ9L1XWA= +chainguard.dev/apko v0.30.6 h1:TaXonng//kkqymddXpVf4bY645/Sim9m5KgLZ90j8Q4= +chainguard.dev/apko v0.30.6/go.mod h1:WWlchAz28M73vw/GIoixD4ywoV5vAjzI1UCpZ9L1XWA= chainguard.dev/go-grpc-kit v0.17.11 h1:m4ZL2yg6sSrdPA593qVh9KHTZ+XOmLwqv3Jt5vT0FuU= chainguard.dev/go-grpc-kit v0.17.11/go.mod h1:aYlrvAscMZBtVIA7bykUWfbjhL2fDoUCECHvopC2xWY= -chainguard.dev/melange v0.30.6 h1:2t7dreMOKfQeQC5p+bUlxpXFUyTkbrpWFGYKJ1xyWqg= -chainguard.dev/melange v0.30.6/go.mod h1:PJN4NbL9qnLg5BNzVeSUOtkEZ00fJP34l7QwFiCsoC0= +chainguard.dev/melange v0.31.0 h1:tYSN+DE6aBmB5sxP+2sNWbYwna4g1ngBEsXLEqSQcNA= +chainguard.dev/melange v0.31.0/go.mod h1:Hm4FcFn9lhsJowVII+koVRkff0wRD5PY+OnnvWez2Xo= chainguard.dev/sdk v0.1.37 h1:4hZ2enarpA/FZ1JMXE3EOlpzd18LmdWZ7UScwdSlrSs= chainguard.dev/sdk v0.1.37/go.mod h1:4HOnG9fVNC9ruzkJLMWWUNM1iVxxBL+bKqj0STERbcs= cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw= @@ -792,14 +792,14 @@ github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs= github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= -github.com/chainguard-dev/advisory-schema v0.37.18 h1:FCa8OQrLR/bT3Oc67SJJtvCRNMAeWlFJjwdCSM+9kmM= -github.com/chainguard-dev/advisory-schema v0.37.18/go.mod h1:7tP3Rz5aH2Xrp66q7KBpKIKX2WLo8HhYfa/CcT8VEGY= +github.com/chainguard-dev/advisory-schema v0.37.19 h1:d57Q5MPJterSJ3JutvnGQowgIK0nvPmajBWHB9bBz80= +github.com/chainguard-dev/advisory-schema v0.37.19/go.mod h1:oF4K+z+E1LonsvMIci5KkWqwIOw3O3yYd5L8RiuHXWk= github.com/chainguard-dev/clog v1.7.0 h1:guPznsK8vLHvzz1QJe2yU6MFeYaiSOFOQBYw4OXu+g8= github.com/chainguard-dev/clog v1.7.0/go.mod h1:4+WFhRMsGH79etYXY3plYdp+tCz/KCkU8fAr0HoaPvs= github.com/chainguard-dev/go-pkgconfig v0.0.0-20240404163941-6351b37b2a10 h1:XR2vgQC024I9/boh9r1ihVv8Z14+pbvWqXeYMCnZJpc= github.com/chainguard-dev/go-pkgconfig v0.0.0-20240404163941-6351b37b2a10/go.mod h1:1p6+MesLcjKeON5BRWa7I87mvAY0QmKjgginIM3w6BI= -github.com/chainguard-dev/yam v0.2.29 h1:kvcRdrjc2qL9N1smVvJA6BTsvcyNvxpqTy893ceXhPI= -github.com/chainguard-dev/yam v0.2.29/go.mod h1:FBsSbqX1ryE3iOVhxgDGi4tKi835l27xoH8dYWKa4XM= +github.com/chainguard-dev/yam v0.2.30 h1:lcONtkzeJBZdFy06ZRpclwP6gzlv5YGt4SswaDrA6Ts= +github.com/chainguard-dev/yam v0.2.30/go.mod h1:FBsSbqX1ryE3iOVhxgDGi4tKi835l27xoH8dYWKa4XM= github.com/charmbracelet/bubbles v0.21.0 h1:9TdC97SdRVg/1aaXNVWfFH3nnLAwOXr8Fn6u6mfQdFs= github.com/charmbracelet/bubbles v0.21.0/go.mod h1:HF+v6QUR4HkEpz62dx7ym2xc71/KBHg+zKwJtMw+qtg= github.com/charmbracelet/bubbletea v1.3.6 h1:VkHIxPJQeDt0aFJIsVxw8BQdh/F/L2KKZGsK6et5taU= @@ -905,8 +905,8 @@ github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E= github.com/djherbis/times v1.6.0 h1:w2ctJ92J8fBvWPxugmXIv7Nz7Q3iDMKNx9v5ocVH20c= github.com/djherbis/times v1.6.0/go.mod h1:gOHeRAz2h+VJNZ5Gmc/o7iD9k4wW7NMVqieYCY99oc0= -github.com/docker/cli v28.3.2+incompatible h1:mOt9fcLE7zaACbxW1GeS65RI67wIJrTnqS3hP2huFsY= -github.com/docker/cli v28.3.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= +github.com/docker/cli v28.3.3+incompatible h1:fp9ZHAr1WWPGdIWBM1b3zLtgCF+83gRdVMTJsUeiyAo= +github.com/docker/cli v28.3.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk= github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w= github.com/docker/docker v28.3.3+incompatible h1:Dypm25kh4rmk49v1eiVbsAtpAsYURjYkaKubwuBdxEI= @@ -1416,8 +1416,8 @@ github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo= github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg= github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc= -github.com/moby/moby v28.3.2+incompatible h1:K0SaQiU3VJxzMmHarwIa9MUyYFYC6FzCf0Qs9oQaFI4= -github.com/moby/moby v28.3.2+incompatible/go.mod h1:fDXVQ6+S340veQPv35CzDahGBmHsiclFwfEygB/TWMc= +github.com/moby/moby v28.3.3+incompatible h1:nzkZIIn9bQP9S553kNmJ+U8PBhdS2ciFWphV2vX/Zp4= +github.com/moby/moby v28.3.3+incompatible/go.mod h1:fDXVQ6+S340veQPv35CzDahGBmHsiclFwfEygB/TWMc= github.com/moby/sys/atomicwriter v0.1.0 h1:kw5D/EqkBwsBFi0ss9v1VG3wIkVhzGvLklJ+w3A14Sw= github.com/moby/sys/atomicwriter v0.1.0/go.mod h1:Ul8oqv2ZMNHOceF643P6FKPXeCmYtlQMvpizfsSoaWs= github.com/moby/sys/mountinfo v0.7.2 h1:1shs6aH5s4o5H2zQLn796ADW1wMrIwHsyJ2v9KouLrg= @@ -1659,8 +1659,8 @@ github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo= github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo= github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY= -github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA= -github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY= +github.com/stretchr/testify v1.11.0 h1:ib4sjIrwZKxE5u/Japgo/7SJV3PvgjGiRNAvTVGqQl8= +github.com/stretchr/testify v1.11.0/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw= github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8= github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU= @@ -2516,8 +2516,8 @@ google.golang.org/protobuf v1.29.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I= google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I= google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos= -google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY= -google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY= +google.golang.org/protobuf v1.36.7 h1:IgrO7UwFQGJdRNXH/sQux4R1Dj1WAKcLElzeeRaXV2A= +google.golang.org/protobuf v1.36.7/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY= gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/wolfictl-0.38.12/pkg/sbom/sbom.go new/wolfictl-0.38.13/pkg/sbom/sbom.go --- old/wolfictl-0.38.12/pkg/sbom/sbom.go 2025-08-20 12:44:22.000000000 +0200 +++ new/wolfictl-0.38.13/pkg/sbom/sbom.go 2025-08-27 13:18:26.000000000 +0200 @@ -116,9 +116,24 @@ } log.Debug("synthesized APK package for SBOM", "name", apkPackage.Name, "version", apkPackage.Version, "id", string(apkPackage.ID())) + syft.SetLogger(anchorelogger.NewSlogAdapter(log.Base())) + + apkPackageMetadata, ok := apkPackage.Metadata.(pkg.ApkDBEntry) + if !ok { + return nil, fmt.Errorf("expected APK package metadata to be of type pkg.ApkDBEntry, got %T", apkPackage.Metadata) + } + + // Syft logs a scary (but inconsequential) warning if we don't supply an "alias" -- an explicit way to identify the directory source. + alias := source.Alias{ + Name: fmt.Sprintf("%s/%s", apkPackageMetadata.Architecture, apkPackageMetadata.Package), + Version: apkPackageMetadata.Version, + Supplier: "chainguard", + } + src, err := directorysource.New( directorysource.Config{ - Path: tempDir, + Path: tempDir, + Alias: alias, }, ) if err != nil { @@ -126,8 +141,6 @@ } log.Debug("created Syft source from directory", "description", src.Describe()) - syft.SetLogger(anchorelogger.NewSlogAdapter(log.Base())) - cfg := syft.DefaultCreateSBOMConfig().WithCatalogerSelection( pkgcataloging.NewSelectionRequest().WithDefaults( pkgcataloging.ImageTag, diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/aarch64/crane-0.19.1-r6.apk.syft.json new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/aarch64/crane-0.19.1-r6.apk.syft.json --- old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/aarch64/crane-0.19.1-r6.apk.syft.json 2025-08-20 12:44:22.000000000 +0200 +++ new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/aarch64/crane-0.19.1-r6.apk.syft.json 2025-08-27 13:18:26.000000000 +0200 @@ -786,6 +786,7 @@ "id": "(redacted for determinism)", "name": "crane", "version": "0.19.1-r6", + "supplier": "chainguard", "type": "directory", "metadata": { "path": "testdata/apks/aarch64/crane-0.19.1-r6.apk" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/aarch64/jenkins-2.461-r0.apk.syft.json new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/aarch64/jenkins-2.461-r0.apk.syft.json --- old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/aarch64/jenkins-2.461-r0.apk.syft.json 2025-08-20 12:44:22.000000000 +0200 +++ new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/aarch64/jenkins-2.461-r0.apk.syft.json 2025-08-27 13:18:26.000000000 +0200 @@ -115116,6 +115116,7 @@ "id": "(redacted for determinism)", "name": "jenkins", "version": "2.461-r0", + "supplier": "chainguard", "type": "directory", "metadata": { "path": "testdata/apks/aarch64/jenkins-2.461-r0.apk" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/aarch64/jruby-9.4-9.4.7.0-r0.apk.syft.json new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/aarch64/jruby-9.4-9.4.7.0-r0.apk.syft.json --- old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/aarch64/jruby-9.4-9.4.7.0-r0.apk.syft.json 2025-08-20 12:44:22.000000000 +0200 +++ new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/aarch64/jruby-9.4-9.4.7.0-r0.apk.syft.json 2025-08-27 13:18:26.000000000 +0200 @@ -98163,6 +98163,7 @@ "id": "(redacted for determinism)", "name": "jruby-9.4", "version": "9.4.7.0-r0", + "supplier": "chainguard", "type": "directory", "metadata": { "path": "testdata/apks/aarch64/jruby-9.4-9.4.7.0-r0.apk" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/aarch64/openjdk-21-21.0.3-r3.apk.syft.json new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/aarch64/openjdk-21-21.0.3-r3.apk.syft.json --- old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/aarch64/openjdk-21-21.0.3-r3.apk.syft.json 2025-08-20 12:44:22.000000000 +0200 +++ new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/aarch64/openjdk-21-21.0.3-r3.apk.syft.json 2025-08-27 13:18:26.000000000 +0200 @@ -196,6 +196,7 @@ "id": "(redacted for determinism)", "name": "openjdk-21", "version": "21.0.3-r3", + "supplier": "chainguard", "type": "directory", "metadata": { "path": "testdata/apks/aarch64/openjdk-21-21.0.3-r3.apk" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/aarch64/openssl-3.3.0-r8.apk.syft.json new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/aarch64/openssl-3.3.0-r8.apk.syft.json --- old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/aarch64/openssl-3.3.0-r8.apk.syft.json 2025-08-20 12:44:22.000000000 +0200 +++ new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/aarch64/openssl-3.3.0-r8.apk.syft.json 2025-08-27 13:18:26.000000000 +0200 @@ -128,6 +128,7 @@ "id": "(redacted for determinism)", "name": "openssl", "version": "3.3.0-r8", + "supplier": "chainguard", "type": "directory", "metadata": { "path": "testdata/apks/aarch64/openssl-3.3.0-r8.apk" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/aarch64/perl-yaml-syck-1.34-r3.apk.syft.json new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/aarch64/perl-yaml-syck-1.34-r3.apk.syft.json --- old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/aarch64/perl-yaml-syck-1.34-r3.apk.syft.json 2025-08-20 12:44:22.000000000 +0200 +++ new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/aarch64/perl-yaml-syck-1.34-r3.apk.syft.json 2025-08-27 13:18:26.000000000 +0200 @@ -171,6 +171,7 @@ "id": "(redacted for determinism)", "name": "perl-yaml-syck", "version": "1.34-r3", + "supplier": "chainguard", "type": "directory", "metadata": { "path": "testdata/apks/aarch64/perl-yaml-syck-1.34-r3.apk" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/aarch64/php-odbc-8.2.11-r1.apk.syft.json new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/aarch64/php-odbc-8.2.11-r1.apk.syft.json --- old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/aarch64/php-odbc-8.2.11-r1.apk.syft.json 2025-08-20 12:44:22.000000000 +0200 +++ new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/aarch64/php-odbc-8.2.11-r1.apk.syft.json 2025-08-27 13:18:26.000000000 +0200 @@ -132,6 +132,7 @@ "id": "(redacted for determinism)", "name": "php-odbc", "version": "8.2.11-r1", + "supplier": "chainguard", "type": "directory", "metadata": { "path": "testdata/apks/aarch64/php-odbc-8.2.11-r1.apk" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/aarch64/powershell-7.4.1-r0.apk.syft.json new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/aarch64/powershell-7.4.1-r0.apk.syft.json --- old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/aarch64/powershell-7.4.1-r0.apk.syft.json 2025-08-20 12:44:22.000000000 +0200 +++ new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/aarch64/powershell-7.4.1-r0.apk.syft.json 2025-08-27 13:18:26.000000000 +0200 @@ -5549,6 +5549,7 @@ "id": "(redacted for determinism)", "name": "powershell", "version": "7.4.1-r0", + "supplier": "chainguard", "type": "directory", "metadata": { "path": "testdata/apks/aarch64/powershell-7.4.1-r0.apk" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/aarch64/py3-poetry-core-1.9.0-r1.apk.syft.json new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/aarch64/py3-poetry-core-1.9.0-r1.apk.syft.json --- old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/aarch64/py3-poetry-core-1.9.0-r1.apk.syft.json 2025-08-20 12:44:22.000000000 +0200 +++ new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/aarch64/py3-poetry-core-1.9.0-r1.apk.syft.json 2025-08-27 13:18:26.000000000 +0200 @@ -2495,6 +2495,7 @@ "id": "(redacted for determinism)", "name": "py3-poetry-core", "version": "1.9.0-r1", + "supplier": "chainguard", "type": "directory", "metadata": { "path": "testdata/apks/aarch64/py3-poetry-core-1.9.0-r1.apk" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/aarch64/python-3.11-base-3.11.9-r6.apk.syft.json new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/aarch64/python-3.11-base-3.11.9-r6.apk.syft.json --- old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/aarch64/python-3.11-base-3.11.9-r6.apk.syft.json 2025-08-20 12:44:22.000000000 +0200 +++ new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/aarch64/python-3.11-base-3.11.9-r6.apk.syft.json 2025-08-27 13:18:26.000000000 +0200 @@ -5389,6 +5389,7 @@ "id": "(redacted for determinism)", "name": "python-3.11-base", "version": "3.11.9-r6", + "supplier": "chainguard", "type": "directory", "metadata": { "path": "testdata/apks/aarch64/python-3.11-base-3.11.9-r6.apk" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/aarch64/terraform-1.5.7-r12.apk.syft.json new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/aarch64/terraform-1.5.7-r12.apk.syft.json --- old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/aarch64/terraform-1.5.7-r12.apk.syft.json 2025-08-20 12:44:22.000000000 +0200 +++ new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/aarch64/terraform-1.5.7-r12.apk.syft.json 2025-08-27 13:18:26.000000000 +0200 @@ -5960,6 +5960,7 @@ "id": "(redacted for determinism)", "name": "terraform", "version": "1.5.7-r12", + "supplier": "chainguard", "type": "directory", "metadata": { "path": "testdata/apks/aarch64/terraform-1.5.7-r12.apk" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/aarch64/thanos-0.32-0.32.5-r4.apk.syft.json new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/aarch64/thanos-0.32-0.32.5-r4.apk.syft.json --- old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/aarch64/thanos-0.32-0.32.5-r4.apk.syft.json 2025-08-20 12:44:22.000000000 +0200 +++ new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/aarch64/thanos-0.32-0.32.5-r4.apk.syft.json 2025-08-27 13:18:26.000000000 +0200 @@ -7825,6 +7825,7 @@ "id": "(redacted for determinism)", "name": "thanos-0.32", "version": "0.32.5-r4", + "supplier": "chainguard", "type": "directory", "metadata": { "path": "testdata/apks/aarch64/thanos-0.32-0.32.5-r4.apk" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/x86_64/crane-0.19.1-r6.apk.syft.json new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/x86_64/crane-0.19.1-r6.apk.syft.json --- old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/x86_64/crane-0.19.1-r6.apk.syft.json 2025-08-20 12:44:22.000000000 +0200 +++ new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/x86_64/crane-0.19.1-r6.apk.syft.json 2025-08-27 13:18:26.000000000 +0200 @@ -790,6 +790,7 @@ "id": "(redacted for determinism)", "name": "crane", "version": "0.19.1-r6", + "supplier": "chainguard", "type": "directory", "metadata": { "path": "testdata/apks/x86_64/crane-0.19.1-r6.apk" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/x86_64/jenkins-2.461-r0.apk.syft.json new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/x86_64/jenkins-2.461-r0.apk.syft.json --- old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/x86_64/jenkins-2.461-r0.apk.syft.json 2025-08-20 12:44:22.000000000 +0200 +++ new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/x86_64/jenkins-2.461-r0.apk.syft.json 2025-08-27 13:18:26.000000000 +0200 @@ -115116,6 +115116,7 @@ "id": "(redacted for determinism)", "name": "jenkins", "version": "2.461-r0", + "supplier": "chainguard", "type": "directory", "metadata": { "path": "testdata/apks/x86_64/jenkins-2.461-r0.apk" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/x86_64/jruby-9.4-9.4.7.0-r0.apk.syft.json new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/x86_64/jruby-9.4-9.4.7.0-r0.apk.syft.json --- old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/x86_64/jruby-9.4-9.4.7.0-r0.apk.syft.json 2025-08-20 12:44:22.000000000 +0200 +++ new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/x86_64/jruby-9.4-9.4.7.0-r0.apk.syft.json 2025-08-27 13:18:26.000000000 +0200 @@ -98163,6 +98163,7 @@ "id": "(redacted for determinism)", "name": "jruby-9.4", "version": "9.4.7.0-r0", + "supplier": "chainguard", "type": "directory", "metadata": { "path": "testdata/apks/x86_64/jruby-9.4-9.4.7.0-r0.apk" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/x86_64/openjdk-21-21.0.3-r3.apk.syft.json new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/x86_64/openjdk-21-21.0.3-r3.apk.syft.json --- old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/x86_64/openjdk-21-21.0.3-r3.apk.syft.json 2025-08-20 12:44:22.000000000 +0200 +++ new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/x86_64/openjdk-21-21.0.3-r3.apk.syft.json 2025-08-27 13:18:26.000000000 +0200 @@ -196,6 +196,7 @@ "id": "(redacted for determinism)", "name": "openjdk-21", "version": "21.0.3-r3", + "supplier": "chainguard", "type": "directory", "metadata": { "path": "testdata/apks/x86_64/openjdk-21-21.0.3-r3.apk" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/x86_64/openssl-3.3.0-r8.apk.syft.json new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/x86_64/openssl-3.3.0-r8.apk.syft.json --- old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/x86_64/openssl-3.3.0-r8.apk.syft.json 2025-08-20 12:44:22.000000000 +0200 +++ new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/x86_64/openssl-3.3.0-r8.apk.syft.json 2025-08-27 13:18:26.000000000 +0200 @@ -128,6 +128,7 @@ "id": "(redacted for determinism)", "name": "openssl", "version": "3.3.0-r8", + "supplier": "chainguard", "type": "directory", "metadata": { "path": "testdata/apks/x86_64/openssl-3.3.0-r8.apk" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/x86_64/perl-yaml-syck-1.34-r3.apk.syft.json new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/x86_64/perl-yaml-syck-1.34-r3.apk.syft.json --- old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/x86_64/perl-yaml-syck-1.34-r3.apk.syft.json 2025-08-20 12:44:22.000000000 +0200 +++ new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/x86_64/perl-yaml-syck-1.34-r3.apk.syft.json 2025-08-27 13:18:26.000000000 +0200 @@ -171,6 +171,7 @@ "id": "(redacted for determinism)", "name": "perl-yaml-syck", "version": "1.34-r3", + "supplier": "chainguard", "type": "directory", "metadata": { "path": "testdata/apks/x86_64/perl-yaml-syck-1.34-r3.apk" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/x86_64/php-odbc-8.2.11-r1.apk.syft.json new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/x86_64/php-odbc-8.2.11-r1.apk.syft.json --- old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/x86_64/php-odbc-8.2.11-r1.apk.syft.json 2025-08-20 12:44:22.000000000 +0200 +++ new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/x86_64/php-odbc-8.2.11-r1.apk.syft.json 2025-08-27 13:18:26.000000000 +0200 @@ -131,6 +131,7 @@ "id": "(redacted for determinism)", "name": "php-odbc", "version": "8.2.11-r1", + "supplier": "chainguard", "type": "directory", "metadata": { "path": "testdata/apks/x86_64/php-odbc-8.2.11-r1.apk" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/x86_64/powershell-7.4.1-r0.apk.syft.json new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/x86_64/powershell-7.4.1-r0.apk.syft.json --- old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/x86_64/powershell-7.4.1-r0.apk.syft.json 2025-08-20 12:44:22.000000000 +0200 +++ new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/x86_64/powershell-7.4.1-r0.apk.syft.json 2025-08-27 13:18:26.000000000 +0200 @@ -5549,6 +5549,7 @@ "id": "(redacted for determinism)", "name": "powershell", "version": "7.4.1-r0", + "supplier": "chainguard", "type": "directory", "metadata": { "path": "testdata/apks/x86_64/powershell-7.4.1-r0.apk" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/x86_64/py3-poetry-core-1.9.0-r1.apk.syft.json new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/x86_64/py3-poetry-core-1.9.0-r1.apk.syft.json --- old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/x86_64/py3-poetry-core-1.9.0-r1.apk.syft.json 2025-08-20 12:44:22.000000000 +0200 +++ new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/x86_64/py3-poetry-core-1.9.0-r1.apk.syft.json 2025-08-27 13:18:26.000000000 +0200 @@ -2495,6 +2495,7 @@ "id": "(redacted for determinism)", "name": "py3-poetry-core", "version": "1.9.0-r1", + "supplier": "chainguard", "type": "directory", "metadata": { "path": "testdata/apks/x86_64/py3-poetry-core-1.9.0-r1.apk" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/x86_64/python-3.11-base-3.11.9-r6.apk.syft.json new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/x86_64/python-3.11-base-3.11.9-r6.apk.syft.json --- old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/x86_64/python-3.11-base-3.11.9-r6.apk.syft.json 2025-08-20 12:44:22.000000000 +0200 +++ new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/x86_64/python-3.11-base-3.11.9-r6.apk.syft.json 2025-08-27 13:18:26.000000000 +0200 @@ -5389,6 +5389,7 @@ "id": "(redacted for determinism)", "name": "python-3.11-base", "version": "3.11.9-r6", + "supplier": "chainguard", "type": "directory", "metadata": { "path": "testdata/apks/x86_64/python-3.11-base-3.11.9-r6.apk" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/x86_64/terraform-1.5.7-r12.apk.syft.json new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/x86_64/terraform-1.5.7-r12.apk.syft.json --- old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/x86_64/terraform-1.5.7-r12.apk.syft.json 2025-08-20 12:44:22.000000000 +0200 +++ new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/x86_64/terraform-1.5.7-r12.apk.syft.json 2025-08-27 13:18:26.000000000 +0200 @@ -5964,6 +5964,7 @@ "id": "(redacted for determinism)", "name": "terraform", "version": "1.5.7-r12", + "supplier": "chainguard", "type": "directory", "metadata": { "path": "testdata/apks/x86_64/terraform-1.5.7-r12.apk" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/x86_64/thanos-0.32-0.32.5-r4.apk.syft.json new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/x86_64/thanos-0.32-0.32.5-r4.apk.syft.json --- old/wolfictl-0.38.12/pkg/sbom/testdata/goldenfiles/x86_64/thanos-0.32-0.32.5-r4.apk.syft.json 2025-08-20 12:44:22.000000000 +0200 +++ new/wolfictl-0.38.13/pkg/sbom/testdata/goldenfiles/x86_64/thanos-0.32-0.32.5-r4.apk.syft.json 2025-08-27 13:18:26.000000000 +0200 @@ -7829,6 +7829,7 @@ "id": "(redacted for determinism)", "name": "thanos-0.32", "version": "0.32.5-r4", + "supplier": "chainguard", "type": "directory", "metadata": { "path": "testdata/apks/x86_64/thanos-0.32-0.32.5-r4.apk" ++++++ wolfictl.obsinfo ++++++ --- /var/tmp/diff_new_pack.jLQDAT/_old 2025-08-28 17:19:10.516489744 +0200 +++ /var/tmp/diff_new_pack.jLQDAT/_new 2025-08-28 17:19:10.536490582 +0200 @@ -1,5 +1,5 @@ name: wolfictl -version: 0.38.12 -mtime: 1755686662 -commit: 30027b38aa81f649cd66af2434776707dd69e35d +version: 0.38.13 +mtime: 1756293506 +commit: ba80ed03624ebe05f0945684a3e2e0e82d4ea054