Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package keybase-client for openSUSE:Factory checked in at 2026-09-07 11:34:03 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/keybase-client (Old) and /work/SRC/openSUSE:Factory/.keybase-client.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "keybase-client" Mon Sep 7 11:34:03 2026 rev:41 rq:1375968 version:6.6.3 Changes: -------- --- /work/SRC/openSUSE:Factory/keybase-client/keybase-client.changes 2026-07-18 22:26:15.960663206 +0200 +++ /work/SRC/openSUSE:Factory/.keybase-client.new.1265/keybase-client.changes 2026-09-07 11:34:53.855698823 +0200 @@ -1,0 +2,8 @@ +Sat Sep 5 17:57:12 UTC 2026 - Matthias Bach <[email protected]> + +- CVE-2026-56855,CVE-2026-56854,CVE-2026-78662: authentication bypass and deadlocks in the crypto/ssh library + * Add update-go-crypto.patch to update affected dependency (bsc#1278586). +- Update to go 1.26 as required to update go crypto library + * Add fix-go-1.26.patch to fix build issues with go 1.26. + +------------------------------------------------------------------- New: ---- fix-go-1.26.patch update-go-crypto.patch ----------(New B)---------- New:- Update to go 1.26 as required to update go crypto library * Add fix-go-1.26.patch to fix build issues with go 1.26. New:- CVE-2026-56855,CVE-2026-56854,CVE-2026-78662: authentication bypass and deadlocks in the crypto/ssh library * Add update-go-crypto.patch to update affected dependency (bsc#1278586). - Update to go 1.26 as required to update go crypto library ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ keybase-client.spec ++++++ --- /var/tmp/diff_new_pack.92TVql/_old 2026-09-07 11:34:55.277748639 +0200 +++ /var/tmp/diff_new_pack.92TVql/_new 2026-09-07 11:34:55.283748849 +0200 @@ -36,8 +36,10 @@ Patch4: update-golang-image-1.patch Patch5: update-golang-image-2.patch Patch6: update-golang-net.patch +Patch7: update-go-crypto.patch +Patch8: fix-go-1.26.patch BuildRequires: fdupes -BuildRequires: go1.25 +BuildRequires: go1.26 BuildRequires: golang-packaging BuildRequires: gzip BuildRequires: pkgconfig ++++++ fix-go-1.26.patch ++++++ From: Matthias Bach <[email protected]> Date: Sat, 5 Sep 2026 20:07:23 +0200 Subject: [PATCH] Fix errors preventing build on on Go 1.26 Upstream: tbd --- go/keybase/main.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/go/keybase/main.go b/go/keybase/main.go index 1bc9f44661..392e1b0ed1 100644 --- a/go/keybase/main.go +++ b/go/keybase/main.go @@ -495,14 +495,14 @@ func startProfile(g *libkb.GlobalContext) { g.Log.Debug("dumping periodic memory profile") f, err := os.CreateTemp("", "keybase_memprofile") if err != nil { - g.Log.Debug("could not create memory profile: ", err) + g.Log.Debug("could not create memory profile: %v", err) continue } debug.FreeOSMemory() runtime.GC() // get up-to-date statistics if err := pprof.WriteHeapProfile(f); err != nil { - g.Log.Debug("could not write memory profile: ", err) + g.Log.Debug("could not write memory profile: %v", err) continue } f.Close() -- 2.51.0 ++++++ update-go-crypto.patch ++++++ From: Matthias Bach <[email protected]> Date: Sat, 5 Sep 2026 19:12:15 +0200 Subject: [PATCH] Update Go Crypto library to 0.56.0 References: bsc#1266596 Upstream: tbd This version addresses CVE-2026-56855,CVE-2026-56854, and CVE-2026-78662. --- go/go.mod | 14 ++++++-------- go/go.sum | 20 ++++++++++---------- 2 files changed, 16 insertions(+), 18 deletions(-) diff --git a/go/go.mod b/go/go.mod index b023d94d27..8861b5a86a 100644 --- a/go/go.mod +++ b/go/go.mod @@ -1,8 +1,6 @@ module github.com/keybase/client/go -go 1.25.0 - -toolchain go1.25.5 +go 1.26.0 require ( bazil.org/fuse v0.0.0-20200424023519-3c101025617f @@ -71,13 +69,13 @@ require ( github.com/urfave/cli v1.22.1 github.com/vividcortex/ewma v1.1.2-0.20170804035156-43880d236f69 go.uber.org/zap v1.24.0 - golang.org/x/crypto v0.54.0 + golang.org/x/crypto v0.56.0 golang.org/x/image v0.43.0 golang.org/x/mobile v0.0.0-20251209145715-2553ed8ce294 // indirect golang.org/x/net v0.57.0 golang.org/x/sync v0.22.0 golang.org/x/sys v0.47.0 - golang.org/x/text v0.40.0 + golang.org/x/text v0.41.0 golang.org/x/time v0.14.0 gopkg.in/src-d/go-billy.v4 v4.3.2 gopkg.in/src-d/go-git.v4 v4.13.1 @@ -182,9 +180,9 @@ require ( go.uber.org/atomic v1.7.0 // indirect go.uber.org/multierr v1.6.0 // indirect go4.org v0.0.0-20161118210015-09d86de304dc // indirect - golang.org/x/mod v0.37.0 // indirect - golang.org/x/telemetry v0.0.0-20260625142307-59b4966ccb57 // indirect - golang.org/x/tools v0.47.0 // indirect + golang.org/x/mod v0.38.0 // indirect + golang.org/x/telemetry v0.0.0-20260708182218-49f421fb7959 // indirect + golang.org/x/tools v0.48.0 // indirect golang.org/x/vuln v1.1.4 // indirect google.golang.org/appengine v1.6.8 // indirect google.golang.org/protobuf v1.36.11 // indirect diff --git a/go/go.sum b/go/go.sum index 0787f4d044..a4d62714e6 100644 --- a/go/go.sum +++ b/go/go.sum @@ -528,8 +528,8 @@ golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDf golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8= golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk= golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc= -golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw= -golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk= +golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y= +golang.org/x/crypto v0.56.0/go.mod h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I= golang.org/x/image v0.43.0 h1:FLxcP4ec2350nTfOC8ysKtqYSIFbk/QGjw1ZHNP4tsY= golang.org/x/image v0.43.0/go.mod h1:rrpelvGFt+kLPAjPM4HeWPgrl0FtafueU//e5N0qk/Q= golang.org/x/mobile v0.0.0-20251209145715-2553ed8ce294 h1:Cr6kbEvA6nqvdHynE4CtVKlqpZB9dS1Jva/6IsHA19g= @@ -541,8 +541,8 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c= golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c= -golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ= -golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0= +golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk= +golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40= golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20181220203305-927f97764cc3/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= @@ -617,8 +617,8 @@ golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE= -golang.org/x/telemetry v0.0.0-20260625142307-59b4966ccb57 h1:nwGZBCt+FnXUrGsj5vjzAsEmkcaFvd82BbOjECiFYZc= -golang.org/x/telemetry v0.0.0-20260625142307-59b4966ccb57/go.mod h1:3AWMyWHS+caVoiEXpiq6+tzKA40J4vQT3MYr80ZtQpc= +golang.org/x/telemetry v0.0.0-20260708182218-49f421fb7959 h1:RJhm5l6Fo4rmEIcndxDllNhhf/fAx8qIm4t6A7vpm2A= +golang.org/x/telemetry v0.0.0-20260708182218-49f421fb7959/go.mod h1:LV7u5Oco+Z/g6XI7PqN+EUUUGGkEcmB1uj2ceI0fOVg= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= @@ -642,8 +642,8 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ= -golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs= -golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY= +golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8= +golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M= golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI= golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= @@ -657,8 +657,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58= golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk= -golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q= -golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA= +golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE= +golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk= golang.org/x/tools/go/expect v0.1.1-deprecated h1:jpBZDwmgPhXsKZC6WhL20P4b/wmnpsEAGHaNy0n/rJM= golang.org/x/tools/go/expect v0.1.1-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY= golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated h1:1h2MnaIAIXISqTFKdENegdpAgUXz6NrPEsbIeWaBRvM= -- 2.51.0 ++++++ vendor-6.6.3.tar.xz ++++++ /work/SRC/openSUSE:Factory/keybase-client/vendor-6.6.3.tar.xz /work/SRC/openSUSE:Factory/.keybase-client.new.1265/vendor-6.6.3.tar.xz differ: char 15, line 1
