Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package gitoxide for openSUSE:Factory checked in at 2026-08-09 21:44:37 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/gitoxide (Old) and /work/SRC/openSUSE:Factory/.gitoxide.new.16738 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "gitoxide" Sun Aug 9 21:44:37 2026 rev:9 rq:1370355 version:0.56.0 Changes: -------- --- /work/SRC/openSUSE:Factory/gitoxide/gitoxide.changes 2026-02-26 18:59:31.132718238 +0100 +++ /work/SRC/openSUSE:Factory/.gitoxide.new.16738/gitoxide.changes 2026-08-09 21:46:38.917412961 +0200 @@ -1,0 +2,45 @@ +Sat Aug 8 19:10:17 UTC 2026 - Martin Pluskal <[email protected]> + +- Update to 0.56.0: + * Fixes CVE-2026-40034 (boo#1266434): the CommandForbiddenInModules + trust check could be bypassed in gix_submodule::File::update(), + which allowed arbitrary command execution from a crafted + .gitmodules file + * Fixes a submodule name validation bypass that allowed traversal + out of .git/modules and disclosure of credentials + * Fixes symlinked .gitmodules files being followed and parsed from + outside the repository + * Fixes several denial-of-service vectors in gix-pack: unchecked + indexing panics and uncapped allocations from crafted pack data + * Fixes HTTP credentials being leaked to the redirected host by the + curl transport backend + * Add the gix config show, gix config list, gix config fmt, + gix free remote refs, gix free trust, gix dirwalk and gix tix + subcommands + * Add a gix status --untracked flag and gix merge tree --message + for creating commits + * gix exclude query is now index-aware and no longer reports ignore + matches for tracked files, matching git check-ignore + * Preserve all configured remote URLs rather than only the last one + * Fix fetching and cloning with tag refspecs in shallow clones, + relative worktree linking files and loose ref path-prefix + collisions + * Update the crates to the Rust 2024 edition +- Correct License to (Apache-2.0 OR MIT) AND MPL-2.0: the binaries + statically link the vendored uluru crate, which is MPL-2.0. This + corrects an existing condition rather than recording a new + dependency, as uluru was already linked in 0.50.0 - the derivation + is recorded in a Legal-Review-Notice comment above the tag. +- Require rust >= 1.85, the minimum declared by upstream (edition 2024). +- Build against pkgconfig(openssl) instead of openssl-devel. +- Follow the upstream repository move to the GitoxideLabs organisation. +- Refresh the vendored dependencies. Recording the state of the + remaining open CVE bugs against this version, none of which it is + affected by: + * CVE-2026-25541 (boo#1274525): the vendored bytes is now 1.12.1, + above the 1.11.1 fix + * CVE-2025-22620 (boo#1236139): gix-worktree-state is 0.33.0, far + above the 0.17.0 that fixed the world-writable checkout of + executable files + +------------------------------------------------------------------- Old: ---- gitoxide-0.50.0.tar.gz New: ---- gitoxide-0.56.0.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ gitoxide.spec ++++++ --- /var/tmp/diff_new_pack.nTA1Wi/_old 2026-08-09 21:46:42.157523451 +0200 +++ /var/tmp/diff_new_pack.nTA1Wi/_new 2026-08-09 21:46:42.157523451 +0200 @@ -17,18 +17,30 @@ Name: gitoxide -Version: 0.50.0 +Version: 0.56.0 Release: 0 Summary: An idiomatic & safe pure-Rust implementation of Git -License: Apache-2.0 OR MIT -Group: Development/Tools/Version Control -URL: https://github.com/Byron/gitoxide -Source0: https://github.com/Byron/gitoxide/archive/refs/tags/v%{version}.tar.gz#/%{name}-%{version}.tar.gz +# Legal-Review-Notice: gitoxide itself is "Apache-2.0 OR MIT", but the +# binaries statically link the vendored Rust dependencies. Derived on this +# re-vendor with "cargo tree --offline -p gitoxide -e normal" over the +# vendored tree (500 crates, 254 in the linked graph): the only copyleft +# licence in the graph is MPL-2.0, from uluru, an LRU cache pulled in via +# gix-pack (itself reached through gitoxide-core, gix and gix-odb). +# Everything else is permissive (MIT, Apache-2.0, Unicode-3.0, BSD, ISC, +# Zlib, Unlicense, 0BSD, CC0-1.0, BSL-1.0, CDLA-Permissive-2.0). r-efi +# offers an LGPL-2.1-or-later option but is UEFI-target-only and is absent +# from the Linux graph. MPL-2.0 section 3.2 is satisfied because the +# complete vendor.tar.zst ships in the src.rpm. +License: (Apache-2.0 OR MIT) AND MPL-2.0 +URL: https://github.com/GitoxideLabs/gitoxide +Source0: https://github.com/GitoxideLabs/gitoxide/archive/refs/tags/v%{version}.tar.gz#/%{name}-%{version}.tar.gz Source1: vendor.tar.zst BuildRequires: cargo-packaging BuildRequires: cmake -BuildRequires: openssl-devel -BuildRequires: rust >= 1.82.0 +BuildRequires: pkgconfig +# Upstream Cargo.toml: rust-version = "1.85" (edition 2024) +BuildRequires: rust >= 1.85 +BuildRequires: pkgconfig(openssl) ExclusiveArch: %{rust_arches} %description @@ -42,7 +54,7 @@ %{cargo_build} %install -%{cargo_install} +%cargo_install %check %{cargo_test} ++++++ gitoxide-0.50.0.tar.gz -> gitoxide-0.56.0.tar.gz ++++++ /work/SRC/openSUSE:Factory/gitoxide/gitoxide-0.50.0.tar.gz /work/SRC/openSUSE:Factory/.gitoxide.new.16738/gitoxide-0.56.0.tar.gz differ: char 12, line 1 ++++++ vendor.tar.zst ++++++ /work/SRC/openSUSE:Factory/gitoxide/vendor.tar.zst /work/SRC/openSUSE:Factory/.gitoxide.new.16738/vendor.tar.zst differ: char 8, line 1
