Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package copacetic for openSUSE:Factory checked in at 2026-09-21 12:09:00 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/copacetic (Old) and /work/SRC/openSUSE:Factory/.copacetic.new.383539 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "copacetic" Mon Sep 21 12:09:00 2026 rev:10 rq:1379188 version:0.15.0 Changes: -------- --- /work/SRC/openSUSE:Factory/copacetic/copacetic.changes 2026-07-03 16:09:00.409792918 +0200 +++ /work/SRC/openSUSE:Factory/.copacetic.new.383539/copacetic.changes 2026-09-21 12:09:02.479741014 +0200 @@ -1,0 +2,141 @@ +Sun Sep 20 05:59:59 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 0.15.0: + Copacetic v0.15.0 expands support for minimal and + application-centric workloads, led by Ubuntu Chiseled image + patching and experimental Helm chart-aware patching. This release + also adds SLES 16 support and includes substantial correctness, + reproducibility, and performance improvements. + * Highlights + - Ubuntu Chiseled image patching + Copa can now patch both common Ubuntu Chiseled image layouts: + - Apt-less images that retain a full /var/lib/dpkg/status + support targeted updates from scanner reports and + comprehensive updates without a report. Copa applies + updates through external Ubuntu tooling while preserving + the full-status representation; the final image does not + gain /var/lib/dpkg/status.d, apt, dpkg, BusyBox, or a + shell. + - Native images containing /var/lib/chisel/manifest.wall + support comprehensive re-cuts of their selected Chisel + slices. Copa validates the manifest and resulting + filesystem, preserves paths not owned by the original + manifest and unaffected platform descriptors, rejects + downgrades, and records the resolved Chisel release as OCI + provenance. + Native Chisel release selection can be inferred from + /etc/os-release or overridden with --chisel-release. The CLI + and bulk mode accept a named release, local release + directory, or pinned HTTPS Git source; the BuildKit frontend + accepts a named release or a supplied local build context and + rejects Git URLs. + See the Ubuntu Chiseled image documentation and #1667. + - Experimental Helm chart-aware patching + The experimental chart mode renders a Helm chart with its + default values, discovers images from supported Kubernetes + workload locations, patches those images, and publishes a + self-contained wrapper chart containing the patched image + overrides. Patched images remain in their original + repositories in single-chart mode; bulk PatchConfig supports + a separate image target registry and explicit value-path + overrides where automatic resolution is ambiguous. + Chart mode requires the Helm CLI, COPA_EXPERIMENTAL=1, + --push, and credentials that can push both the patched images + and wrapper chart. + See the bulk and Helm chart patching documentation and #1547. + - SLES 16 support + Copa now supports SLES 16 BCI images and recognizes the + SQLite RPM database used by SLES 16 alongside the existing + NDB and Berkeley DB formats. Multi-platform fixtures and + package-manager coverage were added for the new release. + See #1621. + * Patching correctness and reliability + - Local image resolution — Docker and Podman inspection is + preferred before registry fallback, improving support for + local-only images and avoiding unnecessary remote lookups. + (#1614) + - Reliable RPM repatching — successive updates now compute + changes from the current patched state, preventing stale + files from being reintroduced. (#1589) + - Bounded image inspection — media-type discovery now honors + patch cancellation and timeout contexts instead of allowing + daemon or registry calls to block indefinitely. (#1587) + - Platform and VEX correctness — platform discovery no longer + panics on descriptors without platform metadata, and + generated OpenVEX documents now include the required + vulnerability name field for schema compliance. (#1672) + * Application-level Go patching + Experimental Go patching is more reliable and reproducible: + - go mod tidy -e allows CVE-relevant updates to proceed when an + upstream project has unrelated module-graph problems. (#1602) + - Pre-modules major-version dependencies such as + github.com/docker/docker receive the required +incompatible + suffix. (#1682) + - Copa skips stale scanner fixes that would downgrade or + reinstall an equal Go dependency and avoids claiming those + skipped findings as remediated in VEX output. (#1683) + - Go update lists, generated go.mod requirements, and rebuild + steps are emitted deterministically. (#1680) + * Performance and maintenance + - VEX generation, VEX file output, tar hardlink rewriting, + BuildKit progress forwarding, and terminal progress + bookkeeping now use substantially fewer allocations and less + CPU in large workloads. (#1639) + The release also updates BuildKit to 0.31.1 (#1675), + containerd to 2.2.5 (#1631), Go to 1.25.13 (#1673), and gRPC + to 1.83.1 (#1694), while expanding unit, integration, and + end-to-end coverage across patching paths. + * Important usage notes + - Native manifest.wall Chiseled images currently support + comprehensive patching only; do not pass a vulnerability + report. Trivy does not yet inventory packages from + manifest.wall. + - Updating an apt-less full-status Chiseled image installs + content from complete .deb archives and can add dependency + packages or package-owned files that were not present in the + original image. Maintainer scripts and dpkg triggers are + disabled, lifecycle-package updates such as dpkg, apt, or + bash are rejected, and the resulting filesystem and + application should be validated before deployment. + - Initial native Chisel support resolves public Ubuntu archives + only. Ubuntu Pro, ESM, FIPS, private mirrors, and + authenticated archives are not forwarded. + - Native Chisel patching does not support linux/arm/v6. + - Helm chart-aware patching remains experimental. Single-chart + mode has no custom values-file input, so it discovers only + images visible in the default render and supported workload + shapes. Digest-pinned images and ambiguous value paths are + rejected rather than silently publishing unsafe overrides. + * Dependencies + - chore: bump github.com/Masterminds/semver/v3 from 3.4.0 to + 3.5.0 (#1689) + - chore: bump github.com/testcontainers/testcontainers-go from + 0.40.0 to 0.44.0 (#1568) + - chore: bump the all group across 1 directory with 18 updates + (#1659) + - chore: bump github.com/moby/buildkit from 0.28.1 to 0.31.1 + (#1675) + - chore: bump github.com/moby/go-archive from 0.2.0 to 0.3.0 + (#1674) + - fix: update Go to 1.25.13 (#1673) + - chore: bump the all group across 1 directory with 7 updates + (#1658) + - chore: bump github.com/containerd/containerd/v2 from 2.2.1 to + 2.2.5 (#1631) + - chore: bump actions/checkout from 6.0.3 to 7.0.0 in the all + group (#1630) + - chore: bump the all group across 1 directory with 11 updates + (#1626) + - chore: bump the all group in /website with 2 updates (#1619) + - fix: update x/crypto for govulncheck (#1617) + - chore: bump the all group across 1 directory with 2 updates + (#1603) + - chore: bump github.com/in-toto/in-toto-golang from 0.10.0 to + 0.11.0 (#1600) + - chore: bump github.com/moby/moby/api from 1.54.1 to 1.54.2 + (#1584) + - chore: bump the all group across 1 directory with 12 updates + (#1606) + - fix: govuln fix - update go version to 1.25.10 (#1608) + +------------------------------------------------------------------- Old: ---- copacetic-0.14.2.obscpio New: ---- copacetic-0.15.0.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ copacetic.spec ++++++ --- /var/tmp/diff_new_pack.eSNTb0/_old 2026-09-21 12:09:04.092808130 +0200 +++ /var/tmp/diff_new_pack.eSNTb0/_new 2026-09-21 12:09:04.093808172 +0200 @@ -18,14 +18,14 @@ %define executable_name copa Name: copacetic -Version: 0.14.2 +Version: 0.15.0 Release: 0 Summary: CLI tool for directly patching container images using reports from vulnerability scanners License: Apache-2.0 URL: https://github.com/project-copacetic/copacetic Source: %{name}-%{version}.tar.gz Source1: vendor.tar.gz -BuildRequires: go1.25 >= 1.25.9 +BuildRequires: go1.25 >= 1.25.13 %description copa is a CLI tool written in Go and based on buildkit that can be used to ++++++ _service ++++++ --- /var/tmp/diff_new_pack.eSNTb0/_old 2026-09-21 12:09:04.128809628 +0200 +++ /var/tmp/diff_new_pack.eSNTb0/_new 2026-09-21 12:09:04.130809711 +0200 @@ -5,7 +5,7 @@ <param name="exclude">.git</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> - <param name="revision">refs/tags/v0.14.2</param> + <param name="revision">refs/tags/v0.15.0</param> <param name="changesgenerate">enable</param> </service> <service name="set_version" mode="manual"> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.eSNTb0/_old 2026-09-21 12:09:04.151810585 +0200 +++ /var/tmp/diff_new_pack.eSNTb0/_new 2026-09-21 12:09:04.160810960 +0200 @@ -3,6 +3,6 @@ <param name="url">https://github.com/project-copacetic/copacetic</param> <param name="changesrevision">f262411b1b8788772dee4d47256aa0ed670adf84</param></service><service name="tar_scm"> <param name="url">https://github.com/project-copacetic/copacetic.git</param> - <param name="changesrevision">875ab453477a1e863a41c44cf02c98b8557f758b</param></service></servicedata> + <param name="changesrevision">bce7b4305e378558f20420aa2ca48686cec850d0</param></service></servicedata> (No newline at EOF) ++++++ copacetic-0.14.2.obscpio -> copacetic-0.15.0.obscpio ++++++ ++++ 38102 lines of diff (skipped) ++++++ copacetic.obsinfo ++++++ --- /var/tmp/diff_new_pack.eSNTb0/_old 2026-09-21 12:09:04.748835426 +0200 +++ /var/tmp/diff_new_pack.eSNTb0/_new 2026-09-21 12:09:04.752835592 +0200 @@ -1,5 +1,5 @@ name: copacetic -version: 0.14.2 -mtime: 1783032618 -commit: 875ab453477a1e863a41c44cf02c98b8557f758b +version: 0.15.0 +mtime: 1788478310 +commit: bce7b4305e378558f20420aa2ca48686cec850d0 ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/copacetic/vendor.tar.gz /work/SRC/openSUSE:Factory/.copacetic.new.383539/vendor.tar.gz differ: char 13, line 1
