Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package conftest for openSUSE:Factory checked in at 2026-09-21 12:13:40 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/conftest (Old) and /work/SRC/openSUSE:Factory/.conftest.new.383539 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "conftest" Mon Sep 21 12:13:40 2026 rev:41 rq:1379229 version:0.70.1 Changes: -------- --- /work/SRC/openSUSE:Factory/conftest/conftest.changes 2026-09-16 17:50:43.887038808 +0200 +++ /work/SRC/openSUSE:Factory/.conftest.new.383539/conftest.changes 2026-09-21 12:13:58.431101979 +0200 @@ -1,0 +2,12 @@ +Sun Sep 20 06:00:31 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 0.70.1: + * New Features + - 0b42cb5: feat: Sign build artifacts (#1424) + * Bug Fixes + - f01cab0: fix: share inter-query cache across all queries in + an Engine (#1423) + * Documentation Updates + - 634260c: docs: clarify private OCI registry URLs (#1395) + +------------------------------------------------------------------- Old: ---- conftest-0.70.0.obscpio New: ---- conftest-0.70.1.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ conftest.spec ++++++ --- /var/tmp/diff_new_pack.mFC7sL/_old 2026-09-21 12:13:59.930164638 +0200 +++ /var/tmp/diff_new_pack.mFC7sL/_new 2026-09-21 12:13:59.933164763 +0200 @@ -17,7 +17,7 @@ Name: conftest -Version: 0.70.0 +Version: 0.70.1 Release: 0 Summary: Tool to write tests against structured configuration data License: Apache-2.0 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.mFC7sL/_old 2026-09-21 12:13:59.972166394 +0200 +++ /var/tmp/diff_new_pack.mFC7sL/_new 2026-09-21 12:13:59.976166561 +0200 @@ -4,7 +4,7 @@ <param name="scm">git</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> - <param name="revision">refs/tags/v0.70.0</param> + <param name="revision">refs/tags/v0.70.1</param> <param name="changesgenerate">enable</param> </service> <service name="set_version" mode="manual"> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.mFC7sL/_old 2026-09-21 12:13:59.996167397 +0200 +++ /var/tmp/diff_new_pack.mFC7sL/_new 2026-09-21 12:14:00.000167564 +0200 @@ -1,6 +1,6 @@ <servicedata> <service name="tar_scm"> <param name="url">https://github.com/open-policy-agent/conftest.git</param> - <param name="changesrevision">944ef69f91e47fc38fb0bc309ba1dd4095c0c99b</param></service></servicedata> + <param name="changesrevision">0b42cb5cd1aa1dc1c9025a5e83c7e963166d08c0</param></service></servicedata> (No newline at EOF) ++++++ conftest-0.70.0.obscpio -> conftest-0.70.1.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/conftest-0.70.0/.github/workflows/release.yaml new/conftest-0.70.1/.github/workflows/release.yaml --- old/conftest-0.70.0/.github/workflows/release.yaml 2026-09-12 19:39:06.000000000 +0200 +++ new/conftest-0.70.1/.github/workflows/release.yaml 2026-09-19 18:32:18.000000000 +0200 @@ -4,6 +4,13 @@ push: tags: - 'v*' + +permissions: {} + +concurrency: + group: release-${{ github.ref }} + cancel-in-progress: false + env: IMAGE: openpolicyagent/conftest PLATFORMS: linux/amd64,linux/arm64 @@ -16,6 +23,8 @@ steps: - name: checkout source uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v5 + with: + persist-credentials: false # It is important to check the GoReleaser config before pushing to # Dockerhub to avoid having mismatches between what is in Dockerhub @@ -32,9 +41,13 @@ contents: read needs: - check + outputs: + digest: ${{ steps.build.outputs.digest }} steps: - name: checkout source uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v5 + with: + persist-credentials: false - name: login to docker hub uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # ratchet:docker/login-action@v3 @@ -44,12 +57,13 @@ - name: get version id: get-version - run: echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT + run: echo "VERSION=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT" - name: setup docker buildx run: docker buildx create --name conftestbuild --use - name: Build and push Docker image + id: build uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # ratchet:docker/[email protected] with: context: . @@ -67,9 +81,13 @@ contents: read needs: - check + outputs: + digest: ${{ steps.build.outputs.digest }} steps: - name: checkout source uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v5 + with: + persist-credentials: false - name: login to docker hub uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # ratchet:docker/login-action@v3 @@ -81,6 +99,7 @@ run: docker buildx create --name conftestbuild --use - name: Build and push examples image + id: build uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # ratchet:docker/[email protected] with: context: . @@ -89,10 +108,40 @@ tags: ${{ env.IMAGE }}:examples platforms: ${{ env.PLATFORMS }} + attest-images: + runs-on: ubuntu-latest + permissions: + id-token: write + attestations: write + artifact-metadata: write + needs: + - docker-conftest + - docker-examples + steps: + - name: login to docker hub + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # ratchet:docker/login-action@v3 + with: + username: ${{ secrets.DOCKER_LOGIN }} + password: ${{ secrets.DOCKER_PASSWORD }} + + - name: attest conftest image + uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # ratchet:actions/[email protected] + with: + subject-name: docker.io/${{ env.IMAGE }} + subject-digest: ${{ needs.docker-conftest.outputs.digest }} + push-to-registry: true + + - name: attest examples image + uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # ratchet:actions/[email protected] + with: + subject-name: docker.io/${{ env.IMAGE }} + subject-digest: ${{ needs.docker-examples.outputs.digest }} + push-to-registry: true + goreleaser: runs-on: ubuntu-latest permissions: - contents: write # GoReleaser creates the GitHub release + contents: write # GoReleaser creates the GitHub release. needs: - docker-conftest - docker-examples @@ -101,6 +150,7 @@ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v5 with: fetch-depth: 0 # Need to fetch the full history for the GoReleaser changelog. + persist-credentials: false - name: setup go uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # ratchet:actions/setup-go@v6 @@ -115,3 +165,35 @@ version: "~> v2" env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + attest-release: + runs-on: ubuntu-latest + permissions: + contents: write # Draft releases are only visible with write access. + id-token: write + attestations: write + needs: + - goreleaser + steps: + - name: download release assets + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: gh release download "${GITHUB_REF_NAME}" --repo "${GITHUB_REPOSITORY}" --dir assets + + - name: attest release assets + uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # ratchet:actions/[email protected] + with: + subject-path: assets/* + + publish: + runs-on: ubuntu-latest + permissions: + contents: write + needs: + - attest-images + - attest-release + steps: + - name: publish release + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: gh release edit "${GITHUB_REF_NAME}" --repo "${GITHUB_REPOSITORY}" --draft=false diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/conftest-0.70.0/.goreleaser.yml new/conftest-0.70.1/.goreleaser.yml --- old/conftest-0.70.0/.goreleaser.yml 2026-09-12 19:39:06.000000000 +0200 +++ new/conftest-0.70.1/.goreleaser.yml 2026-09-19 18:32:18.000000000 +0200 @@ -47,6 +47,11 @@ checksum: name_template: 'checksums.txt' +# The release is published by the workflow once all attestations succeed. +release: + draft: true + replace_existing_draft: true + changelog: use: github groups: diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/conftest-0.70.0/docs/install.md new/conftest-0.70.1/docs/install.md --- old/conftest-0.70.0/docs/install.md 2026-09-12 19:39:06.000000000 +0200 +++ new/conftest-0.70.1/docs/install.md 2026-09-19 18:32:18.000000000 +0200 @@ -14,6 +14,58 @@ sudo mv conftest /usr/local/bin ``` +## Verifying releases + +Every release asset, `checksums.txt` included, and every container image is attested with +[GitHub artifact attestations](https://docs.github.com/en/actions/concepts/security/artifact-attestations). +Each attestation is a SLSA build provenance statement signed keylessly through +Sigstore, so you can prove that an asset was built by this repository's release +workflow from a specific tag, without any keys to distribute. + +The commands below pin the signing workflow and the source tag. Both pins +matter: without them a valid attestation produced by any workflow run in the +repository, including one triggered from a pull request, would be accepted. +Make sure the version in the file name or image tag matches the version in +`--source-ref`. The examples below use the Linux x86_64 archive for version +0.70.1; substitute the asset you downloaded, which can be any archive, `.deb`, +or `.rpm` from the release. The commands work the same on Windows with the +`.zip` asset. + +Verify a downloaded archive or package with the +[GitHub CLI](https://cli.github.com/) (2.68.0 or newer): + +```console +gh attestation verify conftest_0.70.1_Linux_x86_64.tar.gz \ + --repo open-policy-agent/conftest \ + --signer-workflow open-policy-agent/conftest/.github/workflows/release.yaml \ + --source-ref refs/tags/v0.70.1 \ + --deny-self-hosted-runners +``` + +Verify a container image: + +```console +gh attestation verify oci://docker.io/openpolicyagent/conftest:v0.70.1 \ + --repo open-policy-agent/conftest \ + --signer-workflow open-policy-agent/conftest/.github/workflows/release.yaml \ + --source-ref refs/tags/v0.70.1 \ + --deny-self-hosted-runners +``` + +Image attestations are also pushed to Docker Hub, so +[cosign](https://github.com/sigstore/cosign) (3.0 or newer; older versions +report no signatures) can verify them directly against the registry. Pin the +exact certificate identity and the trigger: + +```console +cosign verify docker.io/openpolicyagent/conftest:v0.70.1 \ + --certificate-oidc-issuer https://token.actions.githubusercontent.com \ + --certificate-identity https://github.com/open-policy-agent/conftest/.github/workflows/release.yaml@refs/tags/v0.70.1 \ + --certificate-github-workflow-repository open-policy-agent/conftest \ + --certificate-github-workflow-ref refs/tags/v0.70.1 \ + --certificate-github-workflow-trigger push +``` + ## Brew Install with Homebrew on macOS or Linux: diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/conftest-0.70.0/docs/sharing.md new/conftest-0.70.1/docs/sharing.md --- old/conftest-0.70.0/docs/sharing.md 2026-09-12 19:39:06.000000000 +0200 +++ new/conftest-0.70.1/docs/sharing.md 2026-09-19 18:32:18.000000000 +0200 @@ -35,6 +35,14 @@ conftest pull oci://opa.azurecr.io/test ``` +Always include the `oci://` scheme for private or on-premises registries. This +explicitly tells Conftest to use its OCI downloader instead of trying to infer +the source type from the registry hostname: + +```console +conftest pull oci://registry.example.com/team/policies:latest +``` + See the [go-getter](https://github.com/hashicorp/go-getter) repository for more examples. @@ -59,3 +67,10 @@ ```console conftest test --update <url(s)> <file-to-test> ``` + +For example, to update policies from a private OCI registry before testing a +Kubernetes manifest: + +```console +conftest test --update oci://registry.example.com/team/policies:latest deployment.yaml +``` diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/conftest-0.70.0/policy/engine.go new/conftest-0.70.1/policy/engine.go --- old/conftest-0.70.0/policy/engine.go 2026-09-12 19:39:06.000000000 +0200 +++ new/conftest-0.70.1/policy/engine.go 2026-09-19 18:32:18.000000000 +0200 @@ -26,14 +26,14 @@ // Engine represents the policy engine. type Engine struct { - trace bool - builtinErrors bool - modules map[string]*ast.Module - compiler *ast.Compiler - store storage.Store - policies map[string]string - docs map[string]string - enableInterQueryCache bool + trace bool + builtinErrors bool + modules map[string]*ast.Module + compiler *ast.Compiler + store storage.Store + policies map[string]string + docs map[string]string + interQueryCache cache.InterQueryCache } // CompilerOptions defines the options for the Rego compiler. @@ -173,8 +173,11 @@ e.builtinErrors = true } +// EnableInterQueryCache enables OPA's inter-query builtin cache (used by http.send) for the +// lifetime of the Engine. The cache must outlive a single query so that results are shared +// across every rule and input evaluated by this Engine. func (e *Engine) EnableInterQueryCache() { - e.enableInterQueryCache = true + e.interQueryCache = cache.NewInterQueryCache(nil) } // Check executes all of the loaded policies against the input and returns the results. @@ -465,8 +468,8 @@ rego.PrintHook(ph), rego.BuiltinErrorList(builtInErrors), } - if e.enableInterQueryCache { - options = append(options, rego.InterQueryBuiltinCache(cache.NewInterQueryCacheWithContext(ctx, nil))) + if e.interQueryCache != nil { + options = append(options, rego.InterQueryBuiltinCache(e.interQueryCache)) } regoInstance := rego.New(options...) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/conftest-0.70.0/policy/engine_test.go new/conftest-0.70.1/policy/engine_test.go --- old/conftest-0.70.0/policy/engine_test.go 2026-09-12 19:39:06.000000000 +0200 +++ new/conftest-0.70.1/policy/engine_test.go 2026-09-19 18:32:18.000000000 +0200 @@ -1,11 +1,14 @@ package policy import ( - "context" + "fmt" + "net/http" + "net/http/httptest" "os" "path/filepath" "reflect" "sort" + "sync/atomic" "testing" "testing/fstest" @@ -23,7 +26,7 @@ } func TestException(t *testing.T) { - ctx := context.Background() + ctx := t.Context() policies := []string{"../examples/exceptions/policy"} engine, err := Load(policies, testOptions(t)) @@ -63,7 +66,7 @@ func TestTracing(t *testing.T) { t.Run("with tracing ", func(t *testing.T) { - ctx := context.Background() + ctx := t.Context() policies := []string{"../examples/kubernetes/policy"} engine, err := Load(policies, testOptions(t)) @@ -92,7 +95,7 @@ }) t.Run("without tracing", func(t *testing.T) { - ctx := context.Background() + ctx := t.Context() policies := []string{"../examples/kubernetes/policy"} engine, err := Load(policies, testOptions(t)) @@ -121,7 +124,7 @@ } func TestMultifileYaml(t *testing.T) { - ctx := context.Background() + ctx := t.Context() policies := []string{"../examples/kubernetes/policy"} engine, err := Load(policies, testOptions(t)) @@ -167,7 +170,7 @@ } func TestDockerfile(t *testing.T) { - ctx := context.Background() + ctx := t.Context() policies := []string{"../examples/docker/policy"} engine, err := Load(policies, testOptions(t)) @@ -295,7 +298,7 @@ for _, tt := range tests { t.Run(tt.desc, func(t *testing.T) { var e Engine - ctx := context.Background() + ctx := t.Context() if err := e.addFileInfo(ctx, tt.input); err != nil { t.Error(err) } @@ -622,7 +625,7 @@ for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - ctx := context.Background() + ctx := t.Context() files := fstest.MapFS{ "policy.rego": &fstest.MapFile{ @@ -668,3 +671,82 @@ }) } } + +func TestInterQueryCache(t *testing.T) { + newServer := func(t *testing.T) (*httptest.Server, *atomic.Int64) { + t.Helper() + var hits atomic.Int64 + srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { + hits.Add(1) + w.Header().Set("Content-Type", "application/json") + _, _ = w.Write([]byte(`{"message": "ok"}`)) + })) + t.Cleanup(srv.Close) + return srv, &hits + } + + newEngine := func(t *testing.T, url string) *Engine { + t.Helper() + policy := fmt.Sprintf(`package main + +teams := http.send({ + "url": %q, + "method": "get", + "raise_error": false, + "cache": true, + "force_cache": true, + "force_cache_duration_seconds": 60, +}) + +deny_is_twohundred contains msg if { + teams.status_code == 200 + msg := "Statuscode is 200!" +} + +deny_not_twohundred contains msg if { + teams.status_code != 200 + msg := "Statuscode is NOT 200!" +} +`, url) + dir := t.TempDir() + if err := os.WriteFile(filepath.Join(dir, "policy.rego"), []byte(policy), 0o600); err != nil { + t.Fatalf("write policy: %v", err) + } + opts := testOptions(t) + opts.RegoVersion = "v1" + engine, err := Load([]string{dir}, opts) + if err != nil { + t.Fatalf("load policies: %v", err) + } + return engine + } + + configs := map[string]any{ + "a.yaml": map[string]any{"kind": "a"}, + "b.yaml": map[string]any{"kind": "b"}, + } + + t.Run("disabled", func(t *testing.T) { + srv, hits := newServer(t) + engine := newEngine(t, srv.URL) + if _, err := engine.Check(t.Context(), configs, "main"); err != nil { + t.Fatalf("check: %v", err) + } + // Two deny rules evaluated against two inputs, with no cache shared between queries. + if got, want := hits.Load(), int64(4); got != want { + t.Errorf("expected %d requests without the cache, got %d", want, got) + } + }) + + t.Run("enabled", func(t *testing.T) { + srv, hits := newServer(t) + engine := newEngine(t, srv.URL) + engine.EnableInterQueryCache() + if _, err := engine.Check(t.Context(), configs, "main"); err != nil { + t.Fatalf("check: %v", err) + } + if got, want := hits.Load(), int64(1); got != want { + t.Errorf("expected %d request with the cache enabled, got %d", want, got) + } + }) +} ++++++ conftest.obsinfo ++++++ --- /var/tmp/diff_new_pack.mFC7sL/_old 2026-09-21 12:14:00.323181065 +0200 +++ /var/tmp/diff_new_pack.mFC7sL/_new 2026-09-21 12:14:00.334181525 +0200 @@ -1,5 +1,5 @@ name: conftest -version: 0.70.0 -mtime: 1789234746 -commit: 944ef69f91e47fc38fb0bc309ba1dd4095c0c99b +version: 0.70.1 +mtime: 1789835538 +commit: 0b42cb5cd1aa1dc1c9025a5e83c7e963166d08c0 ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/conftest/vendor.tar.gz /work/SRC/openSUSE:Factory/.conftest.new.383539/vendor.tar.gz differ: char 132, line 1
