Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package wolfictl for openSUSE:Factory checked in at 2026-06-05 14:57:03 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/wolfictl (Old) and /work/SRC/openSUSE:Factory/.wolfictl.new.2375 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "wolfictl" Fri Jun 5 14:57:03 2026 rev:45 rq:1357077 version:0.39.18 Changes: -------- --- /work/SRC/openSUSE:Factory/wolfictl/wolfictl.changes 2026-05-29 18:09:58.905527864 +0200 +++ /work/SRC/openSUSE:Factory/.wolfictl.new.2375/wolfictl.changes 2026-06-05 14:57:06.440383824 +0200 @@ -1,0 +2,20 @@ +Thu Jun 04 05:30:16 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 0.39.18: + * fix(dag): preserve provider priority in local repo + * refactor(dag): drop the unused per-origin package resolver + * build(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to + 5.19.1 (#1983) + * build(deps): bump cloud.google.com/go/storage from 1.62.1 to + 1.62.2 (#1984) + * build(deps): bump step-security/harden-runner from 2.19.3 to + 2.19.4 (#1985) + * build(deps): bump github.com/containerd/containerd/v2 (#1986) + * build(deps): bump golangci/golangci-lint-action from 9.2.0 to + 9.2.1 (#1987) + * build(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#1989) + * build(deps): bump chainguard-dev/actions from 1.6.19 to 1.6.21 + (#1990) + * build(deps): bump actions/checkout in /.github/actions (#1991) + +------------------------------------------------------------------- Old: ---- wolfictl-0.39.17.obscpio New: ---- wolfictl-0.39.18.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ wolfictl.spec ++++++ --- /var/tmp/diff_new_pack.CoqKBQ/_old 2026-06-05 14:57:08.020449169 +0200 +++ /var/tmp/diff_new_pack.CoqKBQ/_new 2026-06-05 14:57:08.024449334 +0200 @@ -17,7 +17,7 @@ Name: wolfictl -Version: 0.39.17 +Version: 0.39.18 Release: 0 Summary: A CLI used to work with the Wolfi OSS project License: Apache-2.0 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.CoqKBQ/_old 2026-06-05 14:57:08.060450823 +0200 +++ /var/tmp/diff_new_pack.CoqKBQ/_new 2026-06-05 14:57:08.068451154 +0200 @@ -4,7 +4,7 @@ <param name="scm">git</param> <param name="exclude">.git</param> <param name="revision">main</param> - <param name="versionformat">v0.39.17</param> + <param name="versionformat">v0.39.18</param> <param name="versionrewrite-pattern">v(.*)</param> <param name="changesgenerate">enable</param> </service> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.CoqKBQ/_old 2026-06-05 14:57:08.092452147 +0200 +++ /var/tmp/diff_new_pack.CoqKBQ/_new 2026-06-05 14:57:08.100452478 +0200 @@ -3,6 +3,6 @@ <param name="url">https://github.com/wolfi-dev/wolfictl</param> <param name="changesrevision">003075229f72beb1240bf7b5a6f60983f7851796</param></service><service name="tar_scm"> <param name="url">https://github.com/wolfi-dev/wolfictl.git</param> - <param name="changesrevision">5da495c7fe0bc9eaf32a67656ab2f3b2468c842b</param></service></servicedata> + <param name="changesrevision">cfbfc78b500a387481574b3c285731848d6d6d32</param></service></servicedata> (No newline at EOF) ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/wolfictl/vendor.tar.gz /work/SRC/openSUSE:Factory/.wolfictl.new.2375/vendor.tar.gz differ: char 117, line 2 ++++++ wolfictl-0.39.17.obscpio -> wolfictl-0.39.18.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/wolfictl-0.39.17/go.mod new/wolfictl-0.39.18/go.mod --- old/wolfictl-0.39.17/go.mod 2026-05-19 08:04:35.000000000 +0200 +++ new/wolfictl-0.39.18/go.mod 2026-06-03 18:02:53.000000000 +0200 @@ -13,7 +13,7 @@ require ( chainguard.dev/apko v1.2.13 chainguard.dev/melange v0.50.7 - cloud.google.com/go/storage v1.62.1 + cloud.google.com/go/storage v1.62.2 github.com/adrg/xdg v0.5.3 github.com/anchore/stereoscope v0.1.23 github.com/anchore/syft v1.38.0 @@ -31,7 +31,7 @@ github.com/facebookincubator/nvdtools v0.1.5 github.com/github/go-spdx/v2 v2.7.0 github.com/go-git/go-billy/v5 v5.9.0 - github.com/go-git/go-git/v5 v5.19.0 + github.com/go-git/go-git/v5 v5.19.1 github.com/google/go-cmp v0.7.0 github.com/google/go-github/v58 v58.0.0 github.com/google/uuid v1.6.0 // indirect @@ -89,7 +89,7 @@ github.com/Masterminds/semver/v3 v3.4.0 // indirect github.com/Masterminds/sprig/v3 v3.3.0 // indirect github.com/Microsoft/go-winio v0.6.2 // indirect - github.com/Microsoft/hcsshim v0.14.0-rc.1 // indirect + github.com/Microsoft/hcsshim v0.14.1 // indirect github.com/OneOfOne/xxhash v1.2.8 // indirect github.com/ProtonMail/go-crypto v1.4.0 // indirect github.com/STARRY-S/zip v0.2.3 // indirect @@ -153,7 +153,7 @@ github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be // indirect github.com/containerd/cgroups/v3 v3.1.3 // indirect github.com/containerd/containerd/api v1.10.0 // indirect - github.com/containerd/containerd/v2 v2.2.2 // indirect + github.com/containerd/containerd/v2 v2.2.4 // indirect github.com/containerd/continuity v0.4.5 // indirect github.com/containerd/errdefs v1.0.0 // indirect github.com/containerd/errdefs/pkg v0.3.0 // indirect diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/wolfictl-0.39.17/go.sum new/wolfictl-0.39.18/go.sum --- old/wolfictl-0.39.17/go.sum 2026-05-19 08:04:35.000000000 +0200 +++ new/wolfictl-0.39.18/go.sum 2026-06-03 18:02:53.000000000 +0200 @@ -71,8 +71,8 @@ cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk= cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs= cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0= -cloud.google.com/go/storage v1.62.1 h1:Os0G3XbUbjZumkpDUf2Y0rLoXJTCF1kU2kWUujKYXD8= -cloud.google.com/go/storage v1.62.1/go.mod h1:cpYz/kRVZ+UQAF1uHeea10/9ewcRbxGoGNKsS9daSXA= +cloud.google.com/go/storage v1.62.2 h1:WgR4U9n7bIzXkkVnwPKKE8bkaKUNsHG+0MAAlh9DGU4= +cloud.google.com/go/storage v1.62.2/go.mod h1:cpYz/kRVZ+UQAF1uHeea10/9ewcRbxGoGNKsS9daSXA= cloud.google.com/go/trace v1.11.7 h1:kDNDX8JkaAG3R2nq1lIdkb7FCSi1rCmsEtKVsty7p+U= cloud.google.com/go/trace v1.11.7/go.mod h1:TNn9d5V3fQVf6s4SCveVMIBS2LJUqo73GACmq/Tky0s= cyphar.com/go-pathrs v0.2.1 h1:9nx1vOgwVvX1mNBWDu93+vaceedpbsDqo+XuBGL40b8= @@ -113,8 +113,8 @@ github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY= github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY= github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU= -github.com/Microsoft/hcsshim v0.14.0-rc.1 h1:qAPXKwGOkVn8LlqgBN8GS0bxZ83hOJpcjxzmlQKxKsQ= -github.com/Microsoft/hcsshim v0.14.0-rc.1/go.mod h1:hTKFGbnDtQb1wHiOWv4v0eN+7boSWAHyK/tNAaYZL0c= +github.com/Microsoft/hcsshim v0.14.1 h1:CMuB3fqQVfPdhyXhUqYdUmPUIOhJkmghCx3dJet8Cqs= +github.com/Microsoft/hcsshim v0.14.1/go.mod h1:VnzvPLyWUhxiPVsJ31P6XadxCcTogTguBFDy/1GR/OM= github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU= github.com/OneOfOne/xxhash v1.2.8 h1:31czK/TI9sNkxIKfaUfGlU47BAxQ0ztGgd9vPyqimf8= github.com/OneOfOne/xxhash v1.2.8/go.mod h1:eZbhyaAYD41SGSSsnmcpxVoRiQ/MPUTjUdIIOT9Um7Q= @@ -317,8 +317,8 @@ github.com/containerd/cgroups/v3 v3.1.3/go.mod h1:PKZ2AcWmSBsY/tJUVhtS/rluX0b1uq1GmPO1ElCmbOw= github.com/containerd/containerd/api v1.10.0 h1:5n0oHYVBwN4VhoX9fFykCV9dF1/BvAXeg2F8W6UYq1o= github.com/containerd/containerd/api v1.10.0/go.mod h1:NBm1OAk8ZL+LG8R0ceObGxT5hbUYj7CzTmR3xh0DlMM= -github.com/containerd/containerd/v2 v2.2.2 h1:mjVQdtfryzT7lOqs5EYUFZm8ioPVjOpkSoG1GJPxEMY= -github.com/containerd/containerd/v2 v2.2.2/go.mod h1:5Jhevmv6/2J+Iu/A2xXAdUIdI5Ah/hfyO7okJ4AFIdY= +github.com/containerd/containerd/v2 v2.2.4 h1:8x2UdXqww7NYqGNabQ7i1nAgB5LegzjC9KQzO/900iA= +github.com/containerd/containerd/v2 v2.2.4/go.mod h1:YBcTO8D9149QY9zNmUjy04Mhuc4DlrZQ8FIOwKZEM7o= github.com/containerd/continuity v0.4.5 h1:ZRoN1sXq9u7V6QoHMcVWGhOwDFqZ4B9i5H6un1Wh0x4= github.com/containerd/continuity v0.4.5/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE= github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI= @@ -449,8 +449,8 @@ github.com/go-git/go-billy/v5 v5.9.0/go.mod h1:jCnQMLj9eUgGU7+ludSTYoZL/GGmii14RxKFj7ROgHw= github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4= github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII= -github.com/go-git/go-git/v5 v5.19.0 h1:+WkVUQZSy/F1Gb13udrMKjIM2PrzsNfDKFSfo5tkMtc= -github.com/go-git/go-git/v5 v5.19.0/go.mod h1:Pb1v0c7/g8aGQJwx9Us09W85yGoyvSwuhEGMH7zjDKQ= +github.com/go-git/go-git/v5 v5.19.1 h1:nX27AnaU43/K5bKktKwgBmR9lawoYVe1Ckg0rgzzN00= +github.com/go-git/go-git/v5 v5.19.1/go.mod h1:Pb1v0c7/g8aGQJwx9Us09W85yGoyvSwuhEGMH7zjDKQ= github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU= github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8= github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8= diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/wolfictl-0.39.17/pkg/dag/graph.go new/wolfictl-0.39.18/pkg/dag/graph.go --- old/wolfictl-0.39.17/pkg/dag/graph.go 2026-05-19 08:04:35.000000000 +0200 +++ new/wolfictl-0.39.18/pkg/dag/graph.go 2026-06-03 18:02:53.000000000 +0200 @@ -13,7 +13,6 @@ "path" "reflect" "sort" - "strconv" "strings" "github.com/dominikbraun/graph" @@ -90,7 +89,11 @@ opts.arch = "x86_64" } - localRepo := pkgs.Repository(opts.arch) + localRepo, err := pkgs.Repository(opts.arch) + if err != nil { + return nil, fmt.Errorf("creating local repository: %w", err) + } + localRepoSource := localRepo.Source() localOnlyResolver := apk.NewPkgResolver(ctx, []apk.NamedIndex{localRepo}) g.resolvers[localRepoSource] = localOnlyResolver @@ -104,8 +107,6 @@ errs = append(errs, err) continue } - // add the origin package as its own resolver, so that the subpackage can resolve to it - g.resolvers[c.String()] = singlePackageResolver(ctx, c, opts.arch) for i := range c.Subpackages { subpkg := pkgs.Config(c.Subpackages[i].Name, false) for _, subpkgVersion := range subpkg { @@ -867,46 +868,6 @@ return b, nil } -func getPriority(pkg *Configuration) uint64 { - val := pkg.Package.Dependencies.ProviderPriority - if val == "" { - return 0 - } - priority, err := strconv.ParseUint(val, 10, 64) - if err != nil { - // I don't care to plumb this error around, sorry everyone. - // There are other places that will catch this not being an integer. - return 0 - } - return priority -} - -func singlePackageResolver(ctx context.Context, pkg *Configuration, arch string) *apk.PkgResolver { - repo := apk.NewRepositoryFromComponents(Local, "latest", "", arch) - - packages := []*apk.Package{ - { - Arch: arch, - Name: pkg.Package.Name, - Version: fullVersion(&pkg.Package), - Description: pkg.Package.Description, - License: pkg.Package.LicenseExpression(), - Origin: pkg.Package.Name, - URL: pkg.Package.URL, - Dependencies: pkg.Environment.Contents.Packages, - ProviderPriority: getPriority(pkg), - Provides: pkg.Package.Dependencies.Provides, - RepoCommit: pkg.Package.Commit, - }, - } - index := &apk.APKIndex{ - Description: pkg.String(), - Packages: packages, - } - idx := apk.NewNamedRepositoryWithIndex("", repo.WithIndex(index)) - return apk.NewPkgResolver(ctx, []apk.NamedIndex{idx}) -} - // Targets returns a subgraph that flattens subpackages into their origins. func (g Graph) Targets() (*Graph, error) { //nolint:gocyclo subgraph := &Graph{ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/wolfictl-0.39.17/pkg/dag/packages.go new/wolfictl-0.39.18/pkg/dag/packages.go --- old/wolfictl-0.39.17/pkg/dag/packages.go 2026-05-19 08:04:35.000000000 +0200 +++ new/wolfictl-0.39.18/pkg/dag/packages.go 2026-06-03 18:02:53.000000000 +0200 @@ -432,7 +432,7 @@ // Repository provide the Packages as a apk.RepositoryWithIndex. To be used in other places that require // using alpine/go structs instead of ours. -func (p *Packages) Repository(arch string) apk.NamedIndex { +func (p *Packages) Repository(arch string) (apk.NamedIndex, error) { repo := apk.NewRepositoryFromComponents(Local, "latest", "", arch) // Precompute the number of packages to avoid growslice. @@ -448,7 +448,8 @@ for _, byVersion := range p.packages { for _, cfg := range byVersion { cfg := cfg - packages = append(packages, &apk.Package{ + + pkg := &apk.Package{ Arch: arch, Name: cfg.Package.Name, Version: fullVersion(&cfg.Package), @@ -459,10 +460,19 @@ Dependencies: cfg.Environment.Contents.Packages, Provides: cfg.Package.Dependencies.Provides, RepoCommit: cfg.Package.Commit, - }) + } + + priority, err := parseProviderPriority(cfg.Package.Dependencies.ProviderPriority) + if err != nil { + return nil, fmt.Errorf("%s provider-priority: %w", cfg.Package.Name, err) + } + pkg.ProviderPriority = priority + + packages = append(packages, pkg) + for i := range cfg.Subpackages { sub := cfg.Subpackages[i] - packages = append(packages, &apk.Package{ + subpkg := &apk.Package{ Arch: arch, Name: sub.Name, Version: fullVersion(&cfg.Package), @@ -473,7 +483,15 @@ Dependencies: cfg.Environment.Contents.Packages, Provides: sub.Dependencies.Provides, RepoCommit: sub.Commit, - }) + } + + priority, err := parseProviderPriority(sub.Dependencies.ProviderPriority) + if err != nil { + return nil, fmt.Errorf("%s subpackage %s provider-priority: %w", cfg.Package.Name, sub.Name, err) + } + subpkg.ProviderPriority = priority + + packages = append(packages, subpkg) } } } @@ -482,7 +500,7 @@ Packages: packages, } - return apk.NewNamedRepositoryWithIndex("", repo.WithIndex(index)) + return apk.NewNamedRepositoryWithIndex("", repo.WithIndex(index)), nil } func packageNameFromProvides(prov string) (name, version string) { @@ -500,3 +518,23 @@ func fullVersion(pkg *config.Package) string { return pkg.Version + "-r" + strconv.FormatUint(pkg.Epoch, 10) } + +// parseProviderPriority parses a melange provider-priority. melange permits a +// signed integer, and a negative value resolves to the default priority of zero +// in the built index, so treat it as zero here rather than rejecting it. +func parseProviderPriority(val string) (uint64, error) { + if val == "" { + return 0, nil + } + + priority, err := strconv.Atoi(val) + if err != nil { + return 0, fmt.Errorf("parsing %q: %w", val, err) + } + + if priority < 0 { + return 0, nil + } + + return uint64(priority), nil +} diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/wolfictl-0.39.17/pkg/dag/packages_test.go new/wolfictl-0.39.18/pkg/dag/packages_test.go --- old/wolfictl-0.39.17/pkg/dag/packages_test.go 2026-05-19 08:04:35.000000000 +0200 +++ new/wolfictl-0.39.18/pkg/dag/packages_test.go 2026-06-03 18:02:53.000000000 +0200 @@ -37,3 +37,54 @@ } }) } + +func TestPackagesRepositoryPreservesSubpackageProviderPriority(t *testing.T) { + ctx := context.Background() + testdir := "testdata/provider-priority" + + pkgs, err := NewPackages(ctx, os.DirFS(testdir), testdir, nil) + require.NoError(t, err) + + repo, err := pkgs.Repository("x86_64") + require.NoError(t, err) + + priorities := map[string]uint64{} + for _, pkg := range repo.Packages() { + priorities[pkg.Name] = pkg.ProviderPriority + } + + require.Equal(t, map[string]uint64{ + "gdal": 0, + "gdal-py3.13-dev": 313, + "gdal-compat": 0, + }, priorities) +} + +func TestParseProviderPriority(t *testing.T) { + tests := []struct { + name string + input string + want uint64 + wantErr string + }{ + {name: "empty", input: "", want: 0}, + {name: "positive", input: "313", want: 313}, + {name: "negative clamps to zero", input: "-1", want: 0}, + {name: "non-numeric", input: "invalid", wantErr: `parsing "invalid"`}, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + got, err := parseProviderPriority(tt.input) + + if tt.wantErr != "" { + require.ErrorContains(t, err, tt.wantErr) + require.Zero(t, got) + return + } + + require.NoError(t, err) + require.Equal(t, tt.want, got) + }) + } +} diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/wolfictl-0.39.17/pkg/dag/testdata/provider-priority/gdal.yaml new/wolfictl-0.39.18/pkg/dag/testdata/provider-priority/gdal.yaml --- old/wolfictl-0.39.17/pkg/dag/testdata/provider-priority/gdal.yaml 1970-01-01 01:00:00.000000000 +0100 +++ new/wolfictl-0.39.18/pkg/dag/testdata/provider-priority/gdal.yaml 2026-06-03 18:02:53.000000000 +0200 @@ -0,0 +1,29 @@ +package: + name: gdal + version: "3.13.0" + epoch: 0 + description: Geospatial Data Abstraction Library + target-architecture: + - all + copyright: + - paths: + - "*" + attestation: + license: MIT +environment: + contents: + packages: + - build-base +pipeline: + - runs: | + echo "pretending to build gdal" + +subpackages: + - name: gdal-py3.13-dev + dependencies: + provides: + - gdal-dev + provider-priority: 313 + - name: gdal-compat + dependencies: + provider-priority: -1 ++++++ wolfictl.obsinfo ++++++ --- /var/tmp/diff_new_pack.CoqKBQ/_old 2026-06-05 14:57:09.640516168 +0200 +++ /var/tmp/diff_new_pack.CoqKBQ/_new 2026-06-05 14:57:09.680517823 +0200 @@ -1,5 +1,5 @@ name: wolfictl -version: 0.39.17 -mtime: 1779170675 -commit: 5da495c7fe0bc9eaf32a67656ab2f3b2468c842b +version: 0.39.18 +mtime: 1780502573 +commit: cfbfc78b500a387481574b3c285731848d6d6d32
