Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package apko for openSUSE:Factory checked in at 2026-09-21 12:07:52 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/apko (Old) and /work/SRC/openSUSE:Factory/.apko.new.383539 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "apko" Mon Sep 21 12:07:52 2026 rev:137 rq:1379351 version:1.4.4 Changes: -------- --- /work/SRC/openSUSE:Factory/apko/apko.changes 2026-09-17 15:24:51.365660668 +0200 +++ /work/SRC/openSUSE:Factory/.apko.new.383539/apko.changes 2026-09-21 12:07:56.399972402 +0200 @@ -1,0 +2,38 @@ +Mon Sep 21 05:10:24 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 1.4.4: + * build(deps): bump chainguard.dev/sdk from 0.1.266 to 0.1.271 + (#2509) + * build(deps): bump google.golang.org/api from 0.297.0 to 0.298.0 + (#2510) + * paths: tolerate rare incomplete reads in the concurrency test + (#2512) + * apk: pin the pre-planted cache entry case; correct a sysctl + attribution (#2508) + * build(deps): bump chainguard.dev/sdk from 0.1.262 to 0.1.266 + (#2505) + +------------------------------------------------------------------- +Sun Sep 20 05:39:59 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 1.4.3: + * https://github.com/chainguard-dev/apko/commit/59da166d5b46bb374a4062b18827c748e11f624c + CVE-2026-54174 (GHSA-fpg8-7664-jc5q, 8d34c75) added a datahash + check to doFetchExpandAndVerify, but only the fetch path got + it. cachedPackage recomputes and checks the control section's + SHA-1 against the Q1 checksum from the signed index, then + locates the data section purely by filename and populates + PackageHash with hex.DecodeString of the value it was looking + for. Nothing measures the bytes. +- Update to version 1.4.2: + * apk: reject control characters in data written to the installed + database (#2507) + * build(deps): bump golang.org/x/term from 0.45.0 to 0.46.0 + (#2499) + * build(deps): bump chainguard.dev/sdk from 0.1.257 to 0.1.262 + (#2500) + * build(deps): bump the codeql group with 2 updates (#2501) + * build(deps): bump zizmorcore/zizmor-action from 0.6.3 to 0.6.4 + (#2502) + +------------------------------------------------------------------- Old: ---- apko-1.4.1.obscpio New: ---- apko-1.4.4.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ apko.spec ++++++ --- /var/tmp/diff_new_pack.S2A1bU/_old 2026-09-21 12:07:57.732028247 +0200 +++ /var/tmp/diff_new_pack.S2A1bU/_new 2026-09-21 12:07:57.734028331 +0200 @@ -17,7 +17,7 @@ Name: apko -Version: 1.4.1 +Version: 1.4.4 Release: 0 Summary: Build OCI images from APK packages directly without Dockerfile License: Apache-2.0 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.S2A1bU/_old 2026-09-21 12:07:57.778030175 +0200 +++ /var/tmp/diff_new_pack.S2A1bU/_new 2026-09-21 12:07:57.783030385 +0200 @@ -3,7 +3,7 @@ <param name="url">https://github.com/chainguard-dev/apko.git</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">refs/tags/v1.4.1</param> + <param name="revision">refs/tags/v1.4.4</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> <param name="changesgenerate">enable</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.S2A1bU/_old 2026-09-21 12:07:57.808031433 +0200 +++ /var/tmp/diff_new_pack.S2A1bU/_new 2026-09-21 12:07:57.811031559 +0200 @@ -3,6 +3,6 @@ <param name="url">https://github.com/chainguard-dev/apko</param> <param name="changesrevision">861f83f69e6fa9114405a2f7bb5cf6585ad00421</param></service><service name="tar_scm"> <param name="url">https://github.com/chainguard-dev/apko.git</param> - <param name="changesrevision">0d1e46dac33d555b1fdb6f274f452bdc13fe6fa5</param></service></servicedata> + <param name="changesrevision">7e72102a642f1ce74cbca37ef85f8b925d02a11b</param></service></servicedata> (No newline at EOF) ++++++ apko-1.4.1.obscpio -> apko-1.4.4.obscpio ++++++ ++++ 6064 lines of diff (skipped) ++++++ apko.obsinfo ++++++ --- /var/tmp/diff_new_pack.S2A1bU/_old 2026-09-21 12:07:58.290051641 +0200 +++ /var/tmp/diff_new_pack.S2A1bU/_new 2026-09-21 12:07:58.299052018 +0200 @@ -1,5 +1,5 @@ name: apko -version: 1.4.1 -mtime: 1789417119 -commit: 0d1e46dac33d555b1fdb6f274f452bdc13fe6fa5 +version: 1.4.4 +mtime: 1789940531 +commit: 7e72102a642f1ce74cbca37ef85f8b925d02a11b ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/apko/vendor.tar.gz /work/SRC/openSUSE:Factory/.apko.new.383539/vendor.tar.gz differ: char 13, line 1
