Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package cargo-auditable for openSUSE:Factory
checked in at 2026-09-16 17:40:44
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/cargo-auditable (Old)
and /work/SRC/openSUSE:Factory/.cargo-auditable.new.383539 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "cargo-auditable"
Wed Sep 16 17:40:44 2026 rev:11 rq:1378056 version:0.7.6~0
Changes:
--------
--- /work/SRC/openSUSE:Factory/cargo-auditable/cargo-auditable.changes
2026-05-28 17:24:13.492977773 +0200
+++
/work/SRC/openSUSE:Factory/.cargo-auditable.new.383539/cargo-auditable.changes
2026-09-16 17:41:07.736007059 +0200
@@ -1,0 +2,16 @@
+Tue Sep 15 00:39:45 UTC 2026 - [email protected]
+
+- Update to version 0.7.6~0:
+ * Fill in changelog, bump version
+ * Require target_abi before naming a device-family Apple platform
+ * Emit no build version for unrecognised Apple targets
+ * Emit LC_BUILD_VERSION in Mach-O metadata objects
+ * auditable-info: bump version to 0.10.1
+ * Upgrade miniz_oxide to 0.9
+ * Change example script location to XDG location
+ * add example for rustup +toolchain syntax when replacing cargo
+ * Add a link to Ubuntu
+ * wording
+ * Document Ubuntu adoption
+
+-------------------------------------------------------------------
Old:
----
cargo-auditable-0.7.5~0.tar.zst
New:
----
cargo-auditable-0.7.6~0.tar.zst
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ cargo-auditable.spec ++++++
--- /var/tmp/diff_new_pack.53AG7U/_old 2026-09-16 17:41:08.734048761 +0200
+++ /var/tmp/diff_new_pack.53AG7U/_new 2026-09-16 17:41:08.736048845 +0200
@@ -21,7 +21,7 @@
%define __cargo_common_opts %{?_smp_mflags}
Name: cargo-auditable
-Version: 0.7.5~0
+Version: 0.7.6~0
Release: 0
Summary: A tool to embed auditing information in ELF sections of rust
binaries
# If you know the license, put it's SPDX string here.
++++++ _service ++++++
--- /var/tmp/diff_new_pack.53AG7U/_old 2026-09-16 17:41:08.787050976 +0200
+++ /var/tmp/diff_new_pack.53AG7U/_new 2026-09-16 17:41:08.797051394 +0200
@@ -3,7 +3,7 @@
<param
name="url">https://github.com/rust-secure-code/cargo-auditable.git</param>
<param name="versionformat">@PARENT_TAG@~@TAG_OFFSET@</param>
<param name="scm">git</param>
- <param name="revision">v0.7.5</param>
+ <param name="revision">v0.7.6</param>
<param name="match-tag">v*</param>
<param name="versionrewrite-pattern">v(\d+\.\d+\.\d+)</param>
<param name="versionrewrite-replacement">\1</param>
++++++ _servicedata ++++++
--- /var/tmp/diff_new_pack.53AG7U/_old 2026-09-16 17:41:08.852053692 +0200
+++ /var/tmp/diff_new_pack.53AG7U/_new 2026-09-16 17:41:08.862054110 +0200
@@ -1,6 +1,6 @@
<servicedata>
<service name="tar_scm">
<param
name="url">https://github.com/rust-secure-code/cargo-auditable.git</param>
- <param
name="changesrevision">9dc5ff28ff204b73eae91bd96cde4413fdcb70e0</param></service></servicedata>
+ <param
name="changesrevision">fb744c1a27950229403054d3c950ca3fe36b78d4</param></service></servicedata>
(No newline at EOF)
++++++ cargo-auditable-0.7.5~0.tar.zst -> cargo-auditable-0.7.6~0.tar.zst ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/cargo-auditable-0.7.5~0/Cargo.lock
new/cargo-auditable-0.7.6~0/Cargo.lock
--- old/cargo-auditable-0.7.5~0/Cargo.lock 2026-05-22 01:24:53.000000000
+0200
+++ new/cargo-auditable-0.7.6~0/Cargo.lock 2026-09-13 17:59:28.000000000
+0200
@@ -35,7 +35,7 @@
[[package]]
name = "auditable-info"
-version = "0.10.0"
+version = "0.10.1"
dependencies = [
"auditable-extract",
"auditable-serde",
@@ -116,7 +116,7 @@
[[package]]
name = "cargo-auditable"
-version = "0.7.5"
+version = "0.7.6"
dependencies = [
"auditable-info",
"auditable-serde",
@@ -346,11 +346,12 @@
[[package]]
name = "miniz_oxide"
-version = "0.8.9"
+version = "0.9.1"
source = "registry+https://github.com/rust-lang/crates.io-index";
-checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
+checksum = "b63fbc4a50860e98e7b2aa7804ded1db5cbc3aff9193adaff57a6931bf7c4b4c"
dependencies = [
"adler2",
+ "serde",
]
[[package]]
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/cargo-auditable-0.7.5~0/README.md
new/cargo-auditable-0.7.6~0/README.md
--- old/cargo-auditable-0.7.5~0/README.md 2026-05-22 01:24:53.000000000
+0200
+++ new/cargo-auditable-0.7.6~0/README.md 2026-09-13 17:59:28.000000000
+0200
@@ -45,6 +45,8 @@
Multiple Linux distributions build their Rust packages with `cargo auditable`:
[Alpine Linux](https://www.alpinelinux.org/), [NixOS](https://nixos.org/),
[openSUSE](https://www.opensuse.org/), [Void Linux](https://voidlinux.org/),
[Chimera Linux](https://chimera-linux.org/) and [Wolfi OS](https://wolfi.dev).
If you install packages from their repositories, you can audit them!
+[Ubuntu 26.04](https://documentation.ubuntu.com/release-notes/26.04/) uses it
[for select
packages](https://documentation.ubuntu.com/release-notes/26.04/changes-since-previous-interim/#rust-cargo-auditable)
and lets others [opt
in](https://documentation.ubuntu.com/project/contributors/language-specific/rust/cargo-auditable/),
including in
[PPAs](https://documentation.ubuntu.com/launchpad/user/reference/packaging/ppas/ppa/).
+
[Chainguard](https://chainguard.dev/) includes `cargo auditable` in their
[rust base
container](https://images.chainguard.dev/directory/image/rust/overview), with a
default `cargo` wrapper to always call `cargo auditable`, so that Rust
applications built using this container are auditable by default.
## FAQ
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/cargo-auditable-0.7.5~0/REPLACING_CARGO.md
new/cargo-auditable-0.7.6~0/REPLACING_CARGO.md
--- old/cargo-auditable-0.7.5~0/REPLACING_CARGO.md 2026-05-22
01:24:53.000000000 +0200
+++ new/cargo-auditable-0.7.6~0/REPLACING_CARGO.md 2026-09-13
17:59:28.000000000 +0200
@@ -16,10 +16,19 @@
2. Copy the snippet provided below and replace '/path/to/cargo' with the path
you got at step 1
3. Save it to a file named `cargo`
4. Run `chmod +x cargo` to make the script executable
-5. Prepend the path to the directory where you saved the script to your `PATH`
environment variable. For example, if you saved the script as
`$HOME/.bin/cargo`, you need to add `$HOME/.bin/` to your `PATH`. The exact way
to do this varies depending on the shell; in bash it's `export
PATH="$HOME/.bin/:$PATH"`
+5. Prepend the path to the directory where you saved the script to your `PATH`
environment variable. For example, if you saved the script as
`$HOME/.local/bin/cargo`, you need to make sure `$HOME/.local/bin/` is on your
`PATH`. The exact way to do this varies depending on the shell; in bash it's
`export PATH="$HOME/.local/bin/:$PATH"`
```bash
#!/bin/sh
REAL_CARGO='/path/to/real/cargo' # replace this with your path
exec "$REAL_CARGO" auditable "$@"
```
+
+If you want to preserve rustup's `+toolchain` syntax, shift it before the
`auditable` subcommand:
+
+```bash
+case "$1" in
+ +*) toolchain="$1"; shift; exec "$REAL_CARGO" "$toolchain" auditable "$@" ;;
+ *) exec "$REAL_CARGO" auditable "$@" ;;
+esac
+```
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/cargo-auditable-0.7.5~0/auditable-info/Cargo.toml
new/cargo-auditable-0.7.6~0/auditable-info/Cargo.toml
--- old/cargo-auditable-0.7.5~0/auditable-info/Cargo.toml 2026-05-22
01:24:53.000000000 +0200
+++ new/cargo-auditable-0.7.6~0/auditable-info/Cargo.toml 2026-09-13
17:59:28.000000000 +0200
@@ -1,6 +1,6 @@
[package]
name = "auditable-info"
-version = "0.10.0"
+version = "0.10.1"
authors = ["Sergey \"Shnatsel\" Davidoff <[email protected]>"]
license = "MIT OR Apache-2.0"
repository = "https://github.com/rust-secure-code/cargo-auditable";
@@ -12,7 +12,7 @@
[dependencies]
auditable-extract = {version = "0.3.4", path = "../auditable-extract",
default-features = false }
-miniz_oxide = { version = "0.8.0", features = ["std"] }
+miniz_oxide = { version = "0.9", features = ["std"] }
auditable-serde = {version = "0.9.0", path = "../auditable-serde", optional =
true}
serde_json = { version = "1.0.57", optional = true }
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/cargo-auditable-0.7.5~0/auditable-info/src/error.rs
new/cargo-auditable-0.7.6~0/auditable-info/src/error.rs
--- old/cargo-auditable-0.7.5~0/auditable-info/src/error.rs 2026-05-22
01:24:53.000000000 +0200
+++ new/cargo-auditable-0.7.6~0/auditable-info/src/error.rs 2026-09-13
17:59:28.000000000 +0200
@@ -140,6 +140,7 @@
inflate::TINFLStatus::Done => Self::Done,
inflate::TINFLStatus::NeedsMoreInput => Self::NeedsMoreInput,
inflate::TINFLStatus::HasMoreOutput => Self::HasMoreOutput,
+ _ => Self::Failed, // Unknown status
}
}
}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/cargo-auditable-0.7.5~0/cargo-auditable/CHANGELOG.md
new/cargo-auditable-0.7.6~0/cargo-auditable/CHANGELOG.md
--- old/cargo-auditable-0.7.5~0/cargo-auditable/CHANGELOG.md 2026-05-22
01:24:53.000000000 +0200
+++ new/cargo-auditable-0.7.6~0/cargo-auditable/CHANGELOG.md 2026-09-13
17:59:28.000000000 +0200
@@ -5,6 +5,12 @@
The format is based on [Keep a
Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic
Versioning](https://semver.org/spec/v2.0.0.html).
+## [0.7.6] - 2026-09-13
+
+### Fixed
+
+ - Fixed a harmless linker warning on Apple platforms visible in Rust 1.97 and
later.
+
## [0.7.5] - 2026-05-22
### Fixed
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/cargo-auditable-0.7.5~0/cargo-auditable/Cargo.toml
new/cargo-auditable-0.7.6~0/cargo-auditable/Cargo.toml
--- old/cargo-auditable-0.7.5~0/cargo-auditable/Cargo.toml 2026-05-22
01:24:53.000000000 +0200
+++ new/cargo-auditable-0.7.6~0/cargo-auditable/Cargo.toml 2026-09-13
17:59:28.000000000 +0200
@@ -1,6 +1,6 @@
[package]
name = "cargo-auditable"
-version = "0.7.5"
+version = "0.7.6"
edition = "2021"
authors = ["Sergey \"Shnatsel\" Davidoff <[email protected]>"]
license = "MIT OR Apache-2.0"
@@ -15,7 +15,7 @@
[dependencies]
object = {version = "0.37", default-features = false, features = ["write"]}
auditable-serde = {version = "0.9.0", path = "../auditable-serde"}
-miniz_oxide = {version = "0.8.0"}
+miniz_oxide = {version = "0.9"}
serde_json = "1.0.57"
cargo_metadata = "0.23"
pico-args = { version = "0.5", features = ["eq-separator", "short-space-opt"] }
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/cargo-auditable-0.7.5~0/cargo-auditable/src/object_file.rs
new/cargo-auditable-0.7.6~0/cargo-auditable/src/object_file.rs
--- old/cargo-auditable-0.7.5~0/cargo-auditable/src/object_file.rs
2026-05-22 01:24:53.000000000 +0200
+++ new/cargo-auditable-0.7.6~0/cargo-auditable/src/object_file.rs
2026-09-13 17:59:28.000000000 +0200
@@ -47,6 +47,60 @@
Some(file.write().unwrap())
}
+/// Mach-O object files are expected to carry an `LC_BUILD_VERSION` load
command
+/// describing the platform they were built for. Without it Apple's `ld` has
nothing
+/// to read the platform from, so it guesses and reports the guess on stderr:
+///
+/// ```text
+/// ld: no platform load command found in '..._audit_data.o', assuming: macOS
+/// ```
+///
+/// Since Rust 1.97 the compiler surfaces linker output through the
`linker_messages`
+/// lint, which makes that message visible on every `cargo auditable build` on
macOS.
+///
+/// rustc emits the load command for the same reason, in the file this module
is
+/// adapted from: see `macho_object_build_version_for_target` in
+/// `compiler/rustc_codegen_ssa/src/back/metadata.rs`.
+///
+/// `minos` and `sdk` are deliberately left at zero. This object carries only
the
+/// dependency list and no code, so it constrains nothing at runtime, and
declaring a
+/// minimum OS version it does not actually require risks conflicting with the
+/// deployment target of the binary it is linked into. rustc omits the SDK
version for
+/// the same reason.
+fn macho_build_version(info: &RustcTargetInfo) ->
Option<write::MachOBuildVersion> {
+ let target_os = info.get("target_os").map(String::as_str);
+ let target_abi = info.get("target_abi").map(String::as_str);
+ let platform = match (target_os, target_abi) {
+ // macOS is the one Apple OS with no ABI variants — every
`*-apple-darwin`
+ // target reports an empty `target_abi` — so it is unambiguous even
when the
+ // key is missing entirely, which is what a pre-1.75-ish rustc gives
us.
+ (Some("macos"), _) => object::macho::PLATFORM_MACOS,
+ // For every other Apple OS the ABI is precisely what separates device
from
+ // simulator from Mac Catalyst, so an ABSENT `target_abi` is not
"device" —
+ // it is "unknown", and must fall through to emitting nothing.
+ (Some("ios"), Some("macabi")) => object::macho::PLATFORM_MACCATALYST,
+ (Some("ios"), Some("sim")) => object::macho::PLATFORM_IOSSIMULATOR,
+ (Some("ios"), Some(_)) => object::macho::PLATFORM_IOS,
+ (Some("tvos"), Some("sim")) => object::macho::PLATFORM_TVOSSIMULATOR,
+ (Some("tvos"), Some(_)) => object::macho::PLATFORM_TVOS,
+ (Some("watchos"), Some("sim")) =>
object::macho::PLATFORM_WATCHOSSIMULATOR,
+ (Some("watchos"), Some(_)) => object::macho::PLATFORM_WATCHOS,
+ (Some("visionos"), Some("sim")) =>
object::macho::PLATFORM_XROSSIMULATOR,
+ (Some("visionos"), Some(_)) => object::macho::PLATFORM_XROS,
+ // An Apple target we cannot identify: either an OS added after this
was
+ // written, or a device-family target built by a compiler too old to
+ // report `target_abi`. Emit nothing rather than assert a platform we
+ // cannot verify — the warning is the current behaviour and is
+ // recoverable, whereas a WRONG platform is a hard link failure
+ // (`ld: ... has platform iOS, which is different from target platform
+ // macCatalyst`).
+ _ => return None,
+ };
+ let mut build_version = write::MachOBuildVersion::default();
+ build_version.platform = platform;
+ Some(build_version)
+}
+
fn create_object_file(
info: &RustcTargetInfo,
target_triple: &str,
@@ -97,6 +151,11 @@
};
let mut file = write::Object::new(binary_format, architecture, endianness);
+ if binary_format == BinaryFormat::MachO {
+ if let Some(build_version) = macho_build_version(info) {
+ file.set_macho_build_version(build_version);
+ }
+ }
let e_flags = match architecture {
Architecture::Mips => {
// the original code matches on info we don't have to support
pre-1999 MIPS variants:
@@ -262,6 +321,108 @@
use super::*;
use crate::target_info::parse_rustc_target_info;
+ fn apple_target_info(target_os: &str, target_abi: Option<&str>) ->
RustcTargetInfo {
+ let mut info = HashMap::from([
+ ("target_vendor".to_owned(), "apple".to_owned()),
+ ("target_os".to_owned(), target_os.to_owned()),
+ ]);
+ if let Some(abi) = target_abi {
+ info.insert("target_abi".to_owned(), abi.to_owned());
+ }
+ info
+ }
+
+ #[test]
+ fn test_macho_platform_detection() {
+ use object::macho;
+
+ // Device targets report an EMPTY `target_abi`, which is what rustc
+ // actually emits (`aarch64-apple-ios` -> `target_abi=""`). A MISSING
key
+ // is a different case entirely and is covered by its own test below.
+ let cases = [
+ (("macos", Some("")), macho::PLATFORM_MACOS),
+ (("ios", Some("")), macho::PLATFORM_IOS),
+ (("ios", Some("sim")), macho::PLATFORM_IOSSIMULATOR),
+ (("ios", Some("macabi")), macho::PLATFORM_MACCATALYST),
+ (("tvos", Some("")), macho::PLATFORM_TVOS),
+ (("tvos", Some("sim")), macho::PLATFORM_TVOSSIMULATOR),
+ (("watchos", Some("")), macho::PLATFORM_WATCHOS),
+ (("watchos", Some("sim")), macho::PLATFORM_WATCHOSSIMULATOR),
+ (("visionos", Some("")), macho::PLATFORM_XROS),
+ (("visionos", Some("sim")), macho::PLATFORM_XROSSIMULATOR),
+ ];
+ for ((target_os, target_abi), expected) in cases {
+ let info = apple_target_info(target_os, target_abi);
+ assert_eq!(
+ macho_build_version(&info).expect("known platform").platform,
+ expected,
+ "target_os={target_os} target_abi={target_abi:?}"
+ );
+ }
+ }
+
+ /// The minimum OS version and SDK version are deliberately left unset:
this
+ /// object carries no code, so declaring a minimum it does not require
could
+ /// conflict with the deployment target of the binary it is linked into.
+ #[test]
+ fn test_macho_build_version_leaves_minos_and_sdk_unset() {
+ let version =
+ macho_build_version(&apple_target_info("macos",
None)).expect("known platform");
+ assert_eq!(version.minos, 0);
+ assert_eq!(version.sdk, 0);
+ }
+
+ /// An Apple target we do not recognise gets no load command at all, rather
+ /// than a platform we cannot verify.
+ #[test]
+ fn test_macho_build_version_absent_for_unknown_platform() {
+ assert!(macho_build_version(&apple_target_info("futureos",
None)).is_none());
+ }
+
+ /// Regression: a compiler too old to report `target_abi` must NOT be
treated
+ /// as "device". rustc 1.74 omits the key entirely for every Apple target —
+ /// verified against a real 1.74.0 toolchain — so `x86_64-apple-ios-macabi`
+ /// and `aarch64-apple-ios-sim` arrive indistinguishable from device iOS.
+ /// Guessing `PLATFORM_IOS` there is not a cosmetic error: the linker
rejects
+ /// the mismatch outright (`has platform iOS, which is different from
target
+ /// platform macCatalyst`), turning today's harmless warning into a build
+ /// failure. Emit nothing instead.
+ #[test]
+ fn test_macho_build_version_absent_when_target_abi_is_unavailable() {
+ for os in ["ios", "tvos", "watchos", "visionos"] {
+ assert!(
+ macho_build_version(&apple_target_info(os, None)).is_none(),
+ "{os} without target_abi must not be assumed to be a device
target"
+ );
+ }
+ }
+
+ /// ...but macOS is still identifiable without `target_abi`, because it is
the
+ /// one Apple OS with no ABI variants (every `*-apple-darwin` target
reports an
+ /// empty `target_abi`). Requiring the key here would silently drop the
load
+ /// command on the most common platform whenever an older compiler is
wrapped.
+ #[test]
+ fn test_macho_build_version_present_for_macos_without_target_abi() {
+ assert_eq!(
+ macho_build_version(&apple_target_info("macos", None))
+ .expect("macOS is unambiguous without target_abi")
+ .platform,
+ object::macho::PLATFORM_MACOS
+ );
+ }
+
+ /// Device targets report an EMPTY `target_abi`, not a missing one — that
is
+ /// what distinguishes them from the old-compiler case above.
+ #[test]
+ fn test_macho_build_version_empty_target_abi_is_a_device_target() {
+ assert_eq!(
+ macho_build_version(&apple_target_info("ios", Some("")))
+ .expect("empty target_abi is a device target")
+ .platform,
+ object::macho::PLATFORM_IOS
+ );
+ }
+
#[test]
fn test_riscv_abi_detection() {
// real-world target with double floats
++++++ cargo-auditable.obsinfo ++++++
--- /var/tmp/diff_new_pack.53AG7U/_old 2026-09-16 17:41:09.154066311 +0200
+++ /var/tmp/diff_new_pack.53AG7U/_new 2026-09-16 17:41:09.162066646 +0200
@@ -1,5 +1,5 @@
name: cargo-auditable
-version: 0.7.5~0
-mtime: 1779405893
-commit: 9dc5ff28ff204b73eae91bd96cde4413fdcb70e0
+version: 0.7.6~0
+mtime: 1789315168
+commit: fb744c1a27950229403054d3c950ca3fe36b78d4
++++++ vendor.tar.zst ++++++
/work/SRC/openSUSE:Factory/cargo-auditable/vendor.tar.zst
/work/SRC/openSUSE:Factory/.cargo-auditable.new.383539/vendor.tar.zst differ:
char 7, line 1
