Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package melange for openSUSE:Factory checked in at 2026-07-03 16:04:52 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/melange (Old) and /work/SRC/openSUSE:Factory/.melange.new.1982 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "melange" Fri Jul 3 16:04:52 2026 rev:168 rq:1363550 version:0.56.0 Changes: -------- --- /work/SRC/openSUSE:Factory/melange/melange.changes 2026-07-01 16:50:21.701668643 +0200 +++ /work/SRC/openSUSE:Factory/.melange.new.1982/melange.changes 2026-07-03 16:08:20.772418229 +0200 @@ -1,0 +2,8 @@ +Thu Jul 02 16:38:00 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 0.56.0: + * build(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#2576) + * FDO package metadata improvements (#2370) + * feat(config): add annotations field to subpackages (#2582) + +------------------------------------------------------------------- Old: ---- melange-0.55.0.obscpio New: ---- melange-0.56.0.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ melange.spec ++++++ --- /var/tmp/diff_new_pack.vAmM1L/_old 2026-07-03 16:08:22.396474554 +0200 +++ /var/tmp/diff_new_pack.vAmM1L/_new 2026-07-03 16:08:22.396474554 +0200 @@ -17,7 +17,7 @@ Name: melange -Version: 0.55.0 +Version: 0.56.0 Release: 0 Summary: Build APKs from source code License: Apache-2.0 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.vAmM1L/_old 2026-07-03 16:08:22.456476635 +0200 +++ /var/tmp/diff_new_pack.vAmM1L/_new 2026-07-03 16:08:22.464476912 +0200 @@ -3,7 +3,7 @@ <param name="url">https://github.com/chainguard-dev/melange.git</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">refs/tags/v0.55.0</param> + <param name="revision">refs/tags/v0.56.0</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> <param name="changesgenerate">enable</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.vAmM1L/_old 2026-07-03 16:08:22.560480242 +0200 +++ /var/tmp/diff_new_pack.vAmM1L/_new 2026-07-03 16:08:22.568480519 +0200 @@ -3,6 +3,6 @@ <param name="url">https://github.com/chainguard-dev/melange</param> <param name="changesrevision">3f6115b820985d70ca3c93cdf8519c1b3b4cfe81</param></service><service name="tar_scm"> <param name="url">https://github.com/chainguard-dev/melange.git</param> - <param name="changesrevision">ef24ddfc4e1a3d055e4fc39359e8110bc83f1b7d</param></service></servicedata> + <param name="changesrevision">dfe5f7f0a84d66f756d55f53f2065a1d56f8833b</param></service></servicedata> (No newline at EOF) ++++++ melange-0.55.0.obscpio -> melange-0.56.0.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/melange-0.55.0/e2e-tests/test-fixtures/melange-created.lst new/melange-0.56.0/e2e-tests/test-fixtures/melange-created.lst --- old/melange-0.55.0/e2e-tests/test-fixtures/melange-created.lst 2026-06-23 22:18:03.000000000 +0200 +++ new/melange-0.56.0/e2e-tests/test-fixtures/melange-created.lst 2026-07-02 15:08:39.000000000 +0200 @@ -141,6 +141,7 @@ ./.config/clang-42/x86_64-unknown-linux-gnu-clang++.cfg ./.config/clang-42/x86_64-unknown-linux-gnu-clang.cfg ./.melange.clang.cfg +./.melange.fdo.h ./.melange.gcc.spec ./create-git-repo ./melange-created.lst diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/melange-0.55.0/pkg/build/compiler_config.go new/melange-0.56.0/pkg/build/compiler_config.go --- old/melange-0.55.0/pkg/build/compiler_config.go 2026-06-23 22:18:03.000000000 +0200 +++ new/melange-0.56.0/pkg/build/compiler_config.go 2026-07-02 15:08:39.000000000 +0200 @@ -28,12 +28,44 @@ var packageMetadataTemplate = `{"type":"apk","os":"{{.Namespace}}","name":"{{.Configuration.Package.Name}}","version":"{{.Configuration.Package.FullVersion}}","architecture":"{{.Arch.ToAPK}}"{{if .Configuration.Package.CPE.Vendor}},"appCpe":"{{.Configuration.Package.CPEString}}"{{end}}}` var gccLinkTemplate = `*link: -+ --package-metadata=` + packageMetadataTemplate + ` ++ %{!r:--package-metadata=` + packageMetadataTemplate + `} ` var clangConfigTemplate = `-Xlinker --package-metadata='` + packageMetadataTemplate + `' ` +// fdoNoteTemplate is a C header, generated alongside the gcc spec file, that +// projects can #include to embed the very same FDO packaging metadata that the +// --package-metadata linker flag would emit. This is useful for statically +// linked or vendored code (e.g. a bundled allocator), which leaves no trace in +// the dynamic dependency graph and is therefore invisible to SBOM / CVE +// scanners: the note travels with the object into the final binary regardless. +// +// The note layout (NT_FDO_PACKAGING_METADATA, owner "FDO") follows +// https://uapi-group.org/specifications/specs/package_metadata_for_executable_files/ . The %s is the C-string-escaped +// metadata JSON, identical to what the linker flag carries. +var fdoNoteTemplate = `#ifndef MELANGE_PACKAGE_NOTE_H +#define MELANGE_PACKAGE_NOTE_H +#if defined(__ELF__) +#define MELANGE_PACKAGE_NOTE_JSON "%s" +__attribute__((used, retain, section(".note.package"), aligned(4))) +static const struct { + unsigned int namesz; + unsigned int descsz; + unsigned int type; + char name[4]; + char desc[sizeof(MELANGE_PACKAGE_NOTE_JSON)]; +} melange_package_note = { + sizeof("FDO"), + sizeof(MELANGE_PACKAGE_NOTE_JSON), + 0xcafe1a7e, + "FDO", + MELANGE_PACKAGE_NOTE_JSON +}; +#endif +#endif +` + // range of clang versions we may support in the foreseeable future var ( minClangVer = 15 @@ -58,6 +90,37 @@ return nil } +// renderPackageMetadata renders the package metadata JSON (the same payload +// carried by the --package-metadata linker flag) for this build. +func (b *Build) renderPackageMetadata() (string, error) { + var sb strings.Builder + tmpl := template.Must(template.New("packageMetadata").Parse(packageMetadataTemplate)) + if err := tmpl.Execute(&sb, b); err != nil { + return "", err + } + return sb.String(), nil +} + +// createFdoNoteHeader writes a C header next to the gcc spec file that projects +// can #include to embed the FDO packaging metadata note themselves. See +// fdoNoteTemplate for why this is useful for statically linked / vendored code. +func (b *Build) createFdoNoteHeader() error { + metadata, err := b.renderPackageMetadata() + if err != nil { + return err + } + + // Escape for embedding in a C string literal: backslash first so we don't + // double-escape the backslashes we introduce for the quotes. + escaped := strings.ReplaceAll(metadata, `\`, `\\`) + escaped = strings.ReplaceAll(escaped, `"`, `\"`) + + content := fmt.Sprintf(fdoNoteTemplate, escaped) + + // #nosec G306 -- header should be world-readable so builds can include it + return os.WriteFile(filepath.Join(b.WorkspaceDir, ".melange.fdo.h"), []byte(content), 0o644) +} + // create a clang config file that just includes other clang config files func createClangConfigFile(outputPath string, includePaths ...string) error { var content strings.Builder @@ -130,6 +193,9 @@ if err := b.createGccSpecFile(); err != nil { return err } + if err := b.createFdoNoteHeader(); err != nil { + return err + } if err := b.createClangConfigFiles(ctx); err != nil { return err } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/melange-0.55.0/pkg/build/compiler_config_test.go new/melange-0.56.0/pkg/build/compiler_config_test.go --- old/melange-0.55.0/pkg/build/compiler_config_test.go 2026-06-23 22:18:03.000000000 +0200 +++ new/melange-0.56.0/pkg/build/compiler_config_test.go 2026-07-02 15:08:39.000000000 +0200 @@ -72,8 +72,9 @@ // Should start with *link: assert.True(t, strings.HasPrefix(string(content), "*link:\n")) - // Should contain the package-metadata flag - assert.Contains(t, string(content), "+ --package-metadata=") + // Should contain the package-metadata flag, guarded so it is + // not emitted for relocatable (-r) links. + assert.Contains(t, string(content), "+ %{!r:--package-metadata=") }) } } @@ -106,6 +107,54 @@ }) } +func TestCreateFdoNoteHeader(t *testing.T) { + tmpDir := t.TempDir() + + b := &Build{ + WorkspaceDir: tmpDir, + Arch: apko_types.ParseArchitecture("x86_64"), + Namespace: "test", + Configuration: &config.Configuration{ + Package: config.Package{ + Name: "test-package", + Version: "1.0.0", + Epoch: 0, + }, + }, + } + + err := b.createFdoNoteHeader() + require.NoError(t, err) + + headerPath := filepath.Join(tmpDir, ".melange.fdo.h") + assert.FileExists(t, headerPath) + + content, err := os.ReadFile(headerPath) + require.NoError(t, err) + s := string(content) + + // The generated header carries the note attribute and the well-known + // variable name, in the FDO .note.package section. + assert.Contains(t, s, `__attribute__((used, retain, section(".note.package"), aligned(4)))`) + assert.Contains(t, s, "melange_package_note") + // 0xcafe1a7e is the NT_FDO_PACKAGING_METADATA note type defined by + // https://uapi-group.org/specifications/specs/package_metadata_for_executable_files/ . + assert.Contains(t, s, "0xcafe1a7e") + assert.Contains(t, s, `"FDO"`) + + // The JSON payload matches --package-metadata, but escaped as a C string + // literal (quotes backslash-escaped). + assert.Contains(t, s, `\"type\":\"apk\"`) + assert.Contains(t, s, `\"name\":\"test-package\"`) + assert.Contains(t, s, `\"version\":\"1.0.0-r0\"`) + assert.Contains(t, s, `\"architecture\":\"x86_64\"`) + + // World-readable so in-sandbox builds can include it. + info, err := os.Stat(headerPath) + require.NoError(t, err) + assert.Equal(t, os.FileMode(0o644), info.Mode().Perm()) +} + func TestCreateClangConfigFile(t *testing.T) { tests := []struct { name string diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/melange-0.55.0/pkg/build/package.go new/melange-0.56.0/pkg/build/package.go --- old/melange-0.55.0/pkg/build/package.go 2026-06-23 22:18:03.000000000 +0200 +++ new/melange-0.56.0/pkg/build/package.go 2026-07-02 15:08:39.000000000 +0200 @@ -82,6 +82,7 @@ Options: sub.Options, Scriptlets: sub.Scriptlets, Description: sub.Description, + Annotations: sub.Annotations, URL: sub.URL, Commit: sub.Commit, } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/melange-0.55.0/pkg/config/config.go new/melange-0.56.0/pkg/config/config.go --- old/melange-0.55.0/pkg/config/config.go 2026-06-23 22:18:03.000000000 +0200 +++ new/melange-0.56.0/pkg/config/config.go 2026-07-02 15:08:39.000000000 +0200 @@ -848,6 +848,8 @@ Scriptlets *Scriptlets `json:"scriptlets,omitempty" yaml:"scriptlets,omitempty"` // Optional: The human readable description of the subpackage Description string `json:"description,omitempty" yaml:"description,omitempty"` + // Optional: Annotations for this subpackage + Annotations map[string]string `json:"annotations,omitempty" yaml:"annotations,omitempty"` // Optional: The URL to the package's homepage URL string `json:"url,omitempty" yaml:"url,omitempty"` // Optional: The git commit of the subpackage build configuration @@ -1566,6 +1568,7 @@ Options: in.Options, Scriptlets: replaceScriptlets(r, in.Scriptlets), Description: r.Replace(in.Description), + Annotations: replaceMap(r, in.Annotations), URL: r.Replace(in.URL), Commit: replaceCommit(detectedCommit, in.Commit), Checks: in.Checks, diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/melange-0.55.0/pkg/config/config_test.go new/melange-0.56.0/pkg/config/config_test.go --- old/melange-0.55.0/pkg/config/config_test.go 2026-06-23 22:18:03.000000000 +0200 +++ new/melange-0.56.0/pkg/config/config_test.go 2026-07-02 15:08:39.000000000 +0200 @@ -496,6 +496,35 @@ require.Equal(t, "python", cfg.Package.Annotations["cgr.dev/ecosystem"]) } +func Test_subpackageAnnotations(t *testing.T) { + ctx := slogtest.Context(t) + fp := filepath.Join(os.TempDir(), "melange-test-subpackageAnnotations") + if err := os.WriteFile(fp, []byte(` +package: + name: parent + version: 0.0.1 + epoch: 1 + +subpackages: + - name: parent-docs + annotations: + cgr.dev/ecosystem: docs + cgr.dev/component: manual + +`), 0o644); err != nil { + t.Fatal(err) + } + cfg, err := ParseConfiguration(ctx, fp) + if err != nil { + t.Fatalf("failed to parse configuration: %s", err) + } + + require.Len(t, cfg.Subpackages, 1) + require.Equal(t, "docs", cfg.Subpackages[0].Annotations["cgr.dev/ecosystem"]) + require.Equal(t, "manual", cfg.Subpackages[0].Annotations["cgr.dev/component"]) + require.Nil(t, cfg.Package.Annotations, "subpackage annotations must not leak into parent") +} + func TestDuplicateSubpackage(t *testing.T) { ctx := slogtest.Context(t) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/melange-0.55.0/pkg/config/schema.cue new/melange-0.56.0/pkg/config/schema.cue --- old/melange-0.55.0/pkg/config/schema.cue 2026-06-23 22:18:03.000000000 +0200 +++ new/melange-0.56.0/pkg/config/schema.cue 2026-07-02 15:08:39.000000000 +0200 @@ -561,6 +561,9 @@ // Optional: The human readable description of the subpackage description?: string + // Optional: Annotations for this subpackage + annotations?: [string]: string + // Optional: The URL to the package's homepage url?: string diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/melange-0.55.0/pkg/config/schema.json new/melange-0.56.0/pkg/config/schema.json --- old/melange-0.55.0/pkg/config/schema.json 2026-06-23 22:18:03.000000000 +0200 +++ new/melange-0.56.0/pkg/config/schema.json 2026-07-02 15:08:39.000000000 +0200 @@ -1025,6 +1025,13 @@ "type": "string", "description": "Optional: The human readable description of the subpackage" }, + "annotations": { + "additionalProperties": { + "type": "string" + }, + "type": "object", + "description": "Optional: Annotations for this subpackage" + }, "url": { "type": "string", "description": "Optional: The URL to the package's homepage" ++++++ melange.obsinfo ++++++ --- /var/tmp/diff_new_pack.vAmM1L/_old 2026-07-03 16:08:25.084567781 +0200 +++ /var/tmp/diff_new_pack.vAmM1L/_new 2026-07-03 16:08:25.088567920 +0200 @@ -1,5 +1,5 @@ name: melange -version: 0.55.0 -mtime: 1782245883 -commit: ef24ddfc4e1a3d055e4fc39359e8110bc83f1b7d +version: 0.56.0 +mtime: 1782997719 +commit: dfe5f7f0a84d66f756d55f53f2065a1d56f8833b ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/melange/vendor.tar.gz /work/SRC/openSUSE:Factory/.melange.new.1982/vendor.tar.gz differ: char 13, line 1
