Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package gopass for openSUSE:Factory checked in at 2026-08-31 15:56:21 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/gopass (Old) and /work/SRC/openSUSE:Factory/.gopass.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "gopass" Mon Aug 31 15:56:21 2026 rev:11 rq:1374706 version:1.17.0 Changes: -------- --- /work/SRC/openSUSE:Factory/gopass/gopass.changes 2025-12-15 12:05:45.865921766 +0100 +++ /work/SRC/openSUSE:Factory/.gopass.new.1265/gopass.changes 2026-08-31 15:56:41.117944450 +0200 @@ -1,0 +2,163 @@ +Sun Aug 30 14:48:52 UTC 2026 - Marcus Rueckert <[email protected]> + +- Update to 1.17.0: + - Security + - Bound symlink traversal to store root (H-2) + - Fix path traversal vulnerability in fs storage layer (C-1) + - Restrict template engine secret access and fix error + information leakage (H-1) + - Validate editor binary path before invocation (H-3) + - Warn on env command secret exposure via environment variables + (C-2) + - bound symlink walk to store root (H-2) + - document and warn on env command secret exposure (C-2) + - fix path traversal in fs storage layer (C-1) + - restrict template engine secret access and fix error leakage + (H-1) + - validate editor binary exists before invocation (H-3) + - Added + - Add --safe flag to set safecontent on demand (#3318) + - Add --stdin, --file, and --exec modes to gopass env + - Add JSON output to audit, list, find, and recipients commands + (I-3) + - Add gopass doctor diagnostic command (I-4) + - Add show.fuzzysearch config and --nofuzzysearch flag to + control automatic fuzzy lookup in show + - Add show.hidden-keys config option for customizable + safecontent redaction (I-5) + - Add stable structured exit codes; --exit-codes flag lists all + codes (I-2) + - add configurable show.hidden-keys for safecontent redaction + - changelog: migrate to Keep a Changelog 1.1.0 (#3506) (#3414) + - env: add --stdin, --file, and --exec modes to gopass env + - gpg: support v5/v6 PGP keys with 64-character fingerprints + (#3496) + - machine-readable JSON output (I-3) + - pwgen: add memorable generator support (#3494) + - show: add configurable fuzzy-search fallback toggle (#3449) + - structured exit codes (I-2) + - support -c=N to copy specific line to clipboard (#3386) + - Changed + - Define pkg/gopass API stability contract: best-effort stable + policy with [PKG-BREAK] changelog tag and minimum deprecation + window (A-12) + - Fix documentation vs. implementation mismatches in config.md, + show.md, find.md, generate.md, secrets.md, and + ARCHITECTURE.md + - Fully document wizard template format, attribute types, and + file naming convention (I-7) + - Protect autosyncLastRun with a mutex (S-6) + - Replace context-key config system with typed structs (A-2) + - Replace sort.Strings with slices.Sort throughout (S-3) + - Split Action handler into focused handler types (A-1) + - Standardize XKCD password generator flag names to --xkcd-sep, + --xkcd-lang etc. (U-4) + - Unified secret name validation rejects path traversal and + consecutive slashes (I-1) + - action: split Action god object into focused handler types + (A-1) + - age: share identity file parsing (#3559) + - ctxutil: replace context-key config system with typed structs + (A-2) + - Deprecated + - Surface GOPASS_AUTOSYNC_INTERVAL deprecation as a visible + warning (U-7) + - Removed + - Remove cryptic -t alias from --force-regen in generate (U-6) + - Remove misleading --force / -f aliases from --unsafe in show + and find (U-1) + - Fixed + - Add thread safety to SSH identity cache (M-3) + - Avoid NPE when attempting to edit a non-existing secret + (#3489) + - CI: moving to go 1.25 (#3322) + - Configure .gitattributes based on the backend (#3427) (#3409) + - Correctly honor show.safecontent overrides in substores + (#3337) + - Default audit output to summary when no format flag is given + (B-7) + - Disable grype, the builder seems to be broken (#3463) + - Fix autoSync debounce timestamp to update on success instead + of failure (B-2) + - Fix convert backend name in error messages (B-5, B-6) + - Fix create wizard maximum-length check (B-3) + - Fix grep match and error counters in audit summary (B-1) + - Fix queue goroutine leak and Add() post-Close() panic (B-8) + - REPL tab-completion for entries with spaces (#3360) + - Support HW Age identities (#3389) (#3387) + - Support strict character class enforcement in create + templates (#3352) (#3350) + - Update fish completion to remove warning (#3339) + - add case-insensitive secret name normalization (#3390) + (#2837) + - add hidden pull and push commands (#3532) + - address A-5, S-1, S-2, S-3, S-4, S-6 and I-1 from code + quality audit + - address CLI/UX issues from code quality audit + - address all confirmed bugs from code quality report + - age-agent: handle AGE-PLUGIN-* identities to fix 'malformed + secret key: mixed case' error (#3397) + - age: deterministically order identities for decryption + (#3566) (#3393) + - age: expand ~/ in age.ssh-key-path (#3474) + - age: only encrypt for recipients in .age-recipients (#3564) + (#3392) + - age: raise agent scanner buffer limit to handle large decrypt + payloads (#3529) (#3508) + - age: recover agent on missing identities, not only when + locked (#3488) + - age: send agent identities space-separated on a single line + (#3509) + - backend: add storage.backend config key to lock backend + selection (#3332) (#3398) + - clip flag (-c) for cli/v3 GenericFlag compatibility (#3448) + - config: restore sub-store fallback for core.exportkeys + (#3379) + - copy: preserve directory structure when copying with trailing + slash (#3396) + - docs: removing reference to invalid 'gopass binary' command, + and adding docs for 'fsmove' and 'fscopy' (#3321) + - drain background queue before exiting on failure (#3528) + - eliminate audit, queue, and test initialization races (#3540) + - fix lint issues and update tests for removed show -f/--force + alias + - gpg: make identity selection deterministic (#3577) + - highlight linked secrets in ls output (#3536) + - honor core.autopush during root-store move operations (#3535) + - pwgen: remove math/rand fallback (#3531) + - queue: fix Idle() TOCTOU race and Add() post-Close() panic + - recover from panic during shell completion with unknown flags + (#3388) + - require --age-sshkeys (or age.sshkeys config) to access + ~/.ssh (#3525) (#3522) + - restore clip flag through fuzzy search in show command + (#3466) + - secparse: replace panic in MustParse with testing.TB.Fatalf + (#3420) + - setup: rename --alias/--create to --team/--create-team + (#3568) (#3497) + - setup: suppress auto-commit in gitfs when setup remote is + specified (#2901) (#3391) + - store mount paths relative to home dir for cross-platform + portability (#3439) (#2897) + - tempfile: mount macOS ramdisk read-write (#3527) + - todos: resolve all stale TODOs from S-5 + - update bash completion flag for urfave/cli/v3 compatibility + (#3441) (#3440) + - updater: cap archive/icon extraction writes and surface + oversize errors (#3530) + - use imperative mood in generated commit messages (#3492) + (#1222) + - warn when recipient key is expired or unusable during + encryption (#3443) (#2885) + +------------------------------------------------------------------- +Mon May 18 19:24:29 UTC 2026 - Marcus Rueckert <[email protected]> + +- Update dependencies for security issues. Although it looks like + gopass is not really using any of them directly: + + github.com/FiloSottile/[email protected] (boo#1258620 CVE-2026-26958) + github.com/cloudflare/[email protected] (boo#1265550 CVE-2026-1229) + +------------------------------------------------------------------- Old: ---- gopass-1.16.1.tar.gz New: ---- gopass-1.17.0.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ gopass.spec ++++++ --- /var/tmp/diff_new_pack.ziLHfl/_old 2026-08-31 15:56:41.917972362 +0200 +++ /var/tmp/diff_new_pack.ziLHfl/_new 2026-08-31 15:56:41.920972466 +0200 @@ -1,7 +1,7 @@ # # spec file for package gopass # -# Copyright (c) 2025 SUSE LLC and contributors +# Copyright (c) 2026 SUSE LLC and contributors # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -18,12 +18,13 @@ %global make_args PREFIX=%{_prefix} GOPASS_REVISION=v%{version} Name: gopass -Version: 1.16.1 +Version: 1.17.0 Release: 0 +%global pkg_version 1.17.0 Summary: The slightly more awesome standard unix password manager for teams License: MIT URL: https://www.gopass.pw/ -Source: https://github.com/gopasspw/gopass/archive/refs/tags/v%{version}.tar.gz#/%{name}-%{version}.tar.gz +Source: https://github.com/gopasspw/gopass/archive/refs/tags/v%{pkg_version}.tar.gz#/%{name}-%{pkg_version}.tar.gz Source1: vendor.tar.xz Source2: system_config Source9: series @@ -112,7 +113,7 @@ This package provides a symlink to make this a drop in replacement for password-store. %prep -%autosetup -p1 -a1 +%autosetup -p1 -a1 -n %{name}-%{pkg_version} %build %make_build %{make_args} ++++++ gopass-1.16.1.tar.gz -> gopass-1.17.0.tar.gz ++++++ ++++ 462669 lines of diff (skipped) ++++++ vendor.tar.xz ++++++ ++++ 357846 lines of diff (skipped)
