Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package oras for openSUSE:Factory checked in at 2026-07-13 14:26:28 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/oras (Old) and /work/SRC/openSUSE:Factory/.oras.new.1991 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "oras" Mon Jul 13 14:26:28 2026 rev:9 rq:1365196 version:1.3.3 Changes: -------- --- /work/SRC/openSUSE:Factory/oras/oras.changes 2026-04-18 21:53:19.175042012 +0200 +++ /work/SRC/openSUSE:Factory/.oras.new.1991/oras.changes 2026-07-13 14:26:45.064717642 +0200 @@ -1,0 +2,82 @@ +Mon Jul 13 04:54:22 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 1.3.3: + ORAS CLI v1.3.3 is a maintenance release focused on security + hardening, dependency updates, and a few user-facing improvements + to oras attach. + * Highlights + - Security: upgraded oras-go to v2.6.2, which addresses a + tar-extraction path-traversal advisory (GHSA-fxhp-mv3v-67qp) + affecting hardlink entries during pull/extract. + - oras attach gains --config support, and --annotation + $config:* values now flow through to the packed manifest. + - Supply-chain hardening: GitHub Actions are now pinned to + commit SHAs, SBOMs are attached to release artifacts, and + static security scanning (gosec) runs in CI. + - Copy/mount fixes: no longer mounts when source and + destination credentials differ, and falls back to blob upload + when a cross-repo mount fails. + * Features + - Add --config flag support for oras attach by @ogulcanaydogan + in #2000 + - Pass --annotation $config:* through to PackManifestOptions + for attach by @SAY-5 in #2037 + - Allow setting org.opencontainers.image.title in the + annotation file by @rafaelgieschke in #1872 + - Add SBOMs to the release workflow by @bupd in #1940 + * Bug Fixes + - cp should not mount when source and destination credentials + differ by @wangxiaoxuan273 in #1903 + - Fall back to blob upload when cross-repo mount fails by @bupd + in #1924 + - Redact password values from e2e test execution logs by + @TerryHowe in #2042 + - Revert Alpine base image to fix multi-arch build by @bupd in + #1933 + - Set GOTOOLCHAIN=local in snapcraft.yaml to prevent + auto-download by @TerryHowe in #2012 + - Fix typo in logEntrySeparator const by @Ahmad-Faraj in #2087 + * Security + - Bump oras.land/oras-go/v2 to 2.6.2 (addresses + GHSA-fxhp-mv3v-67qp) by @dependabot in #2105, #2106 + - Add static security scanning (gosec) to CI by @bupd in #1934; + resolve gosec findings (G703, G117, G704) by @TerryHowe in + #1985 + - Pin GitHub Actions to commit SHAs by @TerryHowe in #2016; pin + to full version comments by @alliasgher in #2038 + - Add golangci-lint configuration with additional linters by + @bupd in #1936 + * Documentation + - Add examples to the logout command help text by + @ogulcanaydogan in #2079 + - Add multi-repository backup and restore proposal by + @shizhMSFT in #1917 + * Maintenance + - Upgrade to Go 1.25.7 by @TerryHowe / @adriansali in #1980, + #1910 + - Migrate from unmaintained gopkg.in/yaml.v3 to + go.yaml.in/yaml/v4 by @bupd in #1922 + - Add goheader (license headers) and revive linters, plus + gofmt/go modernize passes + - ~110 dependency updates across Go modules, Docker base + images, and GitHub Actions via Dependabot + - build(deps): bump github/codeql-action/init from 4.36.3 to + 4.37.0 (#2109) + - build(deps): bump github/codeql-action/analyze from 4.36.3 + to 4.37.0 (#2110) + - build(deps): bump actions/stale from 10.3.0 to 10.4.0 + (#2108) + - build(deps): bump library/golang from 1.26.4-alpine to + 1.26.5-alpine (#2107) + - build(deps): bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 + in /test/e2e (#2106) + - build(deps): bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 + (#2105) + - build(deps): bump golang.org/x/crypto from 0.45.0 to + 0.52.0 (#2104) + - build(deps): bump golang.org/x/term from 0.44.0 to 0.45.0 + (#2102) + - build(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 + (#2103) + +------------------------------------------------------------------- Old: ---- oras-1.3.2.obscpio New: ---- oras-1.3.3.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ oras.spec ++++++ --- /var/tmp/diff_new_pack.eiliMN/_old 2026-07-13 14:26:46.992783566 +0200 +++ /var/tmp/diff_new_pack.eiliMN/_new 2026-07-13 14:26:46.996783703 +0200 @@ -17,7 +17,7 @@ Name: oras -Version: 1.3.2 +Version: 1.3.3 Release: 0 Summary: OCI registry client - manage content like artifacts, images, packages License: Apache-2.0 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.eiliMN/_old 2026-07-13 14:26:47.024784660 +0200 +++ /var/tmp/diff_new_pack.eiliMN/_new 2026-07-13 14:26:47.036785071 +0200 @@ -1,9 +1,9 @@ <services> <service name="obs_scm" mode="manual"> - <param name="url">https://github.com/oras-project/oras</param> + <param name="url">https://github.com/oras-project/oras.git</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">v1.3.2</param> + <param name="revision">refs/tags/v1.3.3</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> <param name="changesgenerate">enable</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.eiliMN/_old 2026-07-13 14:26:47.060785891 +0200 +++ /var/tmp/diff_new_pack.eiliMN/_new 2026-07-13 14:26:47.064786028 +0200 @@ -1,6 +1,8 @@ <servicedata> <service name="tar_scm"> <param name="url">https://github.com/oras-project/oras</param> - <param name="changesrevision">fe425992fdfdf300a1cfb380bc4271b3e1a3d3db</param></service></servicedata> + <param name="changesrevision">fe425992fdfdf300a1cfb380bc4271b3e1a3d3db</param></service><service name="tar_scm"> + <param name="url">https://github.com/oras-project/oras.git</param> + <param name="changesrevision">210747c29c1d38732b3194878dfd8b5a6b9ad7eb</param></service></servicedata> (No newline at EOF) ++++++ oras-1.3.2.obscpio -> oras-1.3.3.obscpio ++++++ ++++ 7576 lines of diff (skipped) ++++++ oras.obsinfo ++++++ --- /var/tmp/diff_new_pack.eiliMN/_old 2026-07-13 14:26:47.628805313 +0200 +++ /var/tmp/diff_new_pack.eiliMN/_new 2026-07-13 14:26:47.636805586 +0200 @@ -1,5 +1,5 @@ name: oras -version: 1.3.2 -mtime: 1776504076 -commit: fe425992fdfdf300a1cfb380bc4271b3e1a3d3db +version: 1.3.3 +mtime: 1783708065 +commit: 210747c29c1d38732b3194878dfd8b5a6b9ad7eb ++++++ vendor.tar.gz ++++++ ++++ 36236 lines of diff (skipped)
