Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package skillspector for openSUSE:Factory checked in at 2026-08-04 23:28:50 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/skillspector (Old) and /work/SRC/openSUSE:Factory/.skillspector.new.16738 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "skillspector" Tue Aug 4 23:28:50 2026 rev:3 rq:1369456 version:2.5.1 Changes: -------- --- /work/SRC/openSUSE:Factory/skillspector/skillspector.changes 2026-07-03 16:11:46.395549577 +0200 +++ /work/SRC/openSUSE:Factory/.skillspector.new.16738/skillspector.changes 2026-08-04 23:28:55.434861769 +0200 @@ -1,0 +2,17 @@ +Tue Aug 4 08:41:57 UTC 2026 - Martin Pluskal <[email protected]> + +- Update to version 2.5.1 (first tagged releases; switches the package + from a pinned git snapshot to the upstream release tags): + * Canonical inspection-ledger reporting: JSON and SARIF reports now + carry execution-completeness and analyzer status, so a consumer + can distinguish a clean zero-finding scan from one that did not + execute reliably + * SKILLSPECTOR_MAX_LLM_CONCURRENCY serializes or bounds asynchronous + LLM analyzer batches for rate-limited providers + * Read exact versions from Python lockfiles for OSV lookups + * Exclude valid OMS signatures from content analysis +- Ship the wheel metadata under the release version again: upstream's + pyproject version now matches the tag, so the dist-info glob follows + the package version + +------------------------------------------------------------------- Old: ---- skillspector-2.3.9~git20260701.326a2b48.obscpio New: ---- skillspector-2.5.1.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ skillspector.spec ++++++ --- /var/tmp/diff_new_pack.j2fkny/_old 2026-08-04 23:28:56.538900098 +0200 +++ /var/tmp/diff_new_pack.j2fkny/_new 2026-08-04 23:28:56.542900237 +0200 @@ -21,7 +21,7 @@ # %%{primary_python} so it stays correct as the primary interpreter moves. %define pythons %{primary_python} Name: skillspector -Version: 2.3.9~git20260701.326a2b48 +Version: 2.5.1 Release: 0 Summary: Security scanner for AI agent skills License: Apache-2.0 @@ -115,16 +115,23 @@ # they are deselected here (not skillspector bugs): the four in # test_input_handler_ssrf.py plus three equivalents added upstream in # test_input_handler.py. -%pytest --deselect tests/unit/test_input_handler_ssrf.py::TestGitCloneSSRF::test_github_url_allowed --deselect tests/unit/test_input_handler_ssrf.py::TestGitCloneSSRF::test_gitlab_url_allowed --deselect tests/unit/test_input_handler_ssrf.py::TestDownloadSSRF::test_raw_githubusercontent_allowed --deselect tests/unit/test_input_handler_ssrf.py::TestDownloadSSRF::test_download_does_not_follow_redirects --deselect tests/unit/test_input_handler.py::test_validate_url_host_scp_extracts_github --deselect tests/unit/test_input_handler.py::test_scp_valid_host_clones --deselect tests/unit/test_input_handler.py::test_https_url_unchanged +# +# test_mcp_stdio_initialize_registers_scan_skill re-execs "python -m +# skillspector.cli mcp" with PYTHONPATH *replaced* by the source src/ directory. +# The child therefore imports the module from the source tree, which carries no +# .dist-info, and dies with "PackageNotFoundError: No package metadata was found +# for skillspector" before the server ever speaks; the harness assumes an +# editable dev install, while we install into the buildroot. Its assertion -- +# that the server registers the scan_skill tool -- is covered in-process by +# test_build_server_registers_scan_skill, which does run here. +%pytest --deselect tests/unit/test_mcp_server.py::test_mcp_stdio_initialize_registers_scan_skill --deselect tests/unit/test_input_handler_ssrf.py::TestGitCloneSSRF::test_github_url_allowed --deselect tests/unit/test_input_handler_ssrf.py::TestGitCloneSSRF::test_gitlab_url_allowed --deselect tests/unit/test_input_handler_ssrf.py::TestDownloadSSRF::test_raw_githubusercontent_allowed --deselect tests/unit/test_input_handler_ssrf.py::TestDownloadSSRF::test_download_does_not_follow_redirects --deselect tests/unit/test_input_handler.py::test_validate_url_host_scp_extracts_github --deselect tests/unit/test_input_handler.py::test_scp_valid_host_clones --deselect tests/unit/test_input_handler.py::test_https_url_unchanged %files %license LICENSE %doc README.md skillspector-baseline.example.yaml %{_bindir}/skillspector %{python_sitelib}/skillspector -# Upstream pyproject pins a static version = 2.3.9, so the wheel dist-info -# keeps the release version, not the ~git snapshot RPM %%{version}. -%{python_sitelib}/skillspector-2.3.9.dist-info +%{python_sitelib}/skillspector-%{version}.dist-info %files mcp ++++++ _service ++++++ --- /var/tmp/diff_new_pack.j2fkny/_old 2026-08-04 23:28:56.586901764 +0200 +++ /var/tmp/diff_new_pack.j2fkny/_new 2026-08-04 23:28:56.590901903 +0200 @@ -2,8 +2,8 @@ <service name="obs_scm" mode="manual"> <param name="url">https://github.com/NVIDIA/skillspector.git</param> <param name="scm">git</param> - <param name="revision">326a2b489411a20ed742ff13701be39ba00063c8</param> - <param name="version">2.3.9~git20260701.326a2b48</param> + <param name="revision">v2.5.1</param> + <param name="version">2.5.1</param> <param name="changesgenerate">disable</param> </service> <service name="tar" mode="buildtime"/> ++++++ skillspector-2.3.9~git20260701.326a2b48.obscpio -> skillspector-2.5.1.obscpio ++++++ ++++ 24617 lines of diff (skipped) ++++++ skillspector.obsinfo ++++++ --- /var/tmp/diff_new_pack.j2fkny/_old 2026-08-04 23:28:57.010916485 +0200 +++ /var/tmp/diff_new_pack.j2fkny/_new 2026-08-04 23:28:57.022916902 +0200 @@ -1,5 +1,5 @@ name: skillspector -version: 2.3.9~git20260701.326a2b48 -mtime: 1782883813 -commit: 326a2b489411a20ed742ff13701be39ba00063c8 +version: 2.5.1 +mtime: 1785464779 +commit: 3f11bfa4117ed8beff02d45f660f557489f6bbe5
