Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package cmctl for openSUSE:Factory checked in at 2026-09-21 12:08:13 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/cmctl (Old) and /work/SRC/openSUSE:Factory/.cmctl.new.383539 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "cmctl" Mon Sep 21 12:08:13 2026 rev:34 rq:1379176 version:2.6.1 Changes: -------- --- /work/SRC/openSUSE:Factory/cmctl/cmctl.changes 2026-05-04 12:53:24.269201432 +0200 +++ /work/SRC/openSUSE:Factory/.cmctl.new.383539/cmctl.changes 2026-09-21 12:08:16.807827974 +0200 @@ -1,0 +2,100 @@ +Sun Sep 20 06:00:56 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 2.6.1 (2.6.0 was not released): + The one user-facing change in this release hardens cmctl inspect + secret. To report revocation status, that command fetches the + OCSP and CRL URLs written inside the certificate you are + inspecting. It previously trusted those URLs. A certificate from + an untrusted source could therefore make cmctl contact any + address, including one on your internal network, and could hang + it indefinitely. Requests now time out after 10 seconds, do not + follow redirects, stop reading after 1 MiB, and accept only http + and https for OCSP. Certificates from a trusted source behave as + before. Thanks to @FelixPhipps, who reported and fixed this. + Everything else is routine maintenance. This release moves from + cert-manager v1.20.2 to v1.21.2 and takes 120 dependency and CI + updates. + * Why there is no v2.6.0 release + We tagged v2.6.0 first, but the release build never ran. The CI + runner it used had been removed, so the tag produced no + binaries and no container image. + By the time we found out, v2.6.0 was already recorded in the Go + checksum database. Moving a tag that the checksum database has + already seen breaks go install for anyone who fetches direct + from GitHub, so we left it alone and released v2.6.1 instead. + The v2.6.0 tag still exists and the code at that tag is fine. + It is a usable Go module version, but there is nothing to + download and no image to pull. Please use v2.6.1. + * What's Changed + - fix: harden OCSP/CRL revocation checks against SSRF and DoS + in #517 + - fix(deps): update module sigs.k8s.io/controller-runtime to + v0.25.1 + - fix(deps): update module helm.sh/helm/v4 to v4.3.0 + - fix(deps): update module golang.org/x/crypto to v0.57.0 + - fix(deps): update module github.com/cert-manager/cert-manager + to v1.21.2 + - chore(deps): update module google.golang.org/grpc to v1.83.2 + [security] + - fix(deps): update golang.org/x deps + - fix(deps): update module sigs.k8s.io/gateway-api to v1.6.2 + - fix(deps): update module sigs.k8s.io/controller-runtime to + v0.25.0 + - fix(deps): update module golang.org/x/crypto to v0.56.0 + [security] + - chore(deps): update module google.golang.org/grpc to v1.83.1 + [security] + - chore(deps): update module go.etcd.io/etcd/client/pkg/v3 to + v3.7.1 [security] + - fix(deps): update kubernetes go deps to v0.37.0 + - fix(deps): update module github.com/stretchr/testify to + v1.12.1 + - fix(deps): update kubernetes go patches to v0.36.4 + - chore(deps): update module github.com/google/cel-go to + v0.30.0 [security] + - chore(deps): update module go.etcd.io/etcd/client/pkg/v3 to + v3.6.14 [security] + - fix(deps): update misc go deps + - fix(deps): update module golang.org/x/crypto to v0.55.0 + - fix(deps): update module golang.org/x/mod to v0.40.0 + [security] + - fix(deps): update module golang.org/x/mod to v0.39.0 + - chore(deps): update misc github actions + - fix(deps): update k8s.io/utils digest to cf1189d + - chore(deps): update module oras.land/oras-go/v2 to v2.6.2 + [security] + - Update module github.com/cert-manager/cert-manager to v1.21.1 + (#550) + - fix(deps): update misc go deps + - chore(deps): update actions/setup-go action to v7 + - fix(deps): update module k8s.io/kubectl to v0.36.3 + - fix(deps): update kubernetes go patches to v0.36.3 + - fix(deps): update module golang.org/x/crypto to v0.54.0 + - chore(deps): update module golang.org/x/text to v0.39.0 + [security] + - chore(deps): update module golang.org/x/net to v0.56.0 + [security] + - fix(deps): update module sigs.k8s.io/gateway-api to v1.6.1 + - fix(deps): update module golang.org/x/mod to v0.38.0 + - fix(deps): update module golang.org/x/sync to v0.22.0 + - fix(deps): update module sigs.k8s.io/gateway-api to v1.6.0 + - fix(deps): update module github.com/cert-manager/cert-manager + to v1.20.3 + - chore(deps): update misc github actions to v7 + - fix(deps): update misc go deps to v4.2.2 + - fix(deps): update kubernetes go patches to v0.36.2 + - fix(deps): update misc go deps to v4.2.1 + - fix(deps): update golang.org/x deps + - fix(deps): update k8s.io/utils digest to ff6756f + - chore(deps): update module golang.org/x/net to v0.55.0 + [security] + - chore(deps): update docker/login-action action to v4.2.0 + - fix(deps): update module golang.org/x/crypto to v0.52.0 + - fix(deps): update module helm.sh/helm/v4 to v4.2.0 + - fix(deps): update kubernetes go patches to v0.36.1 + - fix(deps): update module sigs.k8s.io/controller-runtime to + v0.24.1 + - fix(deps): update module golang.org/x/crypto to v0.51.0 + - fix(deps): update module golang.org/x/mod to v0.36.0 + +------------------------------------------------------------------- Old: ---- cmctl-2.5.0.obscpio New: ---- cmctl-2.6.1.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ cmctl.spec ++++++ --- /var/tmp/diff_new_pack.GNc1GA/_old 2026-09-21 12:08:18.010878410 +0200 +++ /var/tmp/diff_new_pack.GNc1GA/_new 2026-09-21 12:08:18.013878536 +0200 @@ -19,7 +19,7 @@ %define kubectl_plugin_name kubectl-cert_manager Name: cmctl -Version: 2.5.0 +Version: 2.6.1 Release: 0 Summary: CLI tool that can help you to manage cert-manager resources inside your cluster License: Apache-2.0 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.GNc1GA/_old 2026-09-21 12:08:18.062880590 +0200 +++ /var/tmp/diff_new_pack.GNc1GA/_new 2026-09-21 12:08:18.065880716 +0200 @@ -3,7 +3,7 @@ <param name="url">https://github.com/cert-manager/cmctl.git</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">refs/tags/v2.5.0</param> + <param name="revision">refs/tags/v2.6.1</param> <param name="versionformat">@PARENT_TAG@</param> <param name="changesgenerate">enable</param> <param name="versionrewrite-pattern">v(.*)</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.GNc1GA/_old 2026-09-21 12:08:18.088881680 +0200 +++ /var/tmp/diff_new_pack.GNc1GA/_new 2026-09-21 12:08:18.092881848 +0200 @@ -5,6 +5,6 @@ <param name="url">https://github.com/cert-manager/cmctl</param> <param name="changesrevision">4668ed9fb057dc73396e6050b3319532de74c0c5</param></service><service name="tar_scm"> <param name="url">https://github.com/cert-manager/cmctl.git</param> - <param name="changesrevision">46bd6766e7c7e345b29f1bc2dc737872bce6fb66</param></service></servicedata> + <param name="changesrevision">7e56321dbec4f62ea5428b8656c871c6dc0cc112</param></service></servicedata> (No newline at EOF) ++++++ cmctl-2.5.0.obscpio -> cmctl-2.6.1.obscpio ++++++ ++++ 11932 lines of diff (skipped) ++++++ cmctl.obsinfo ++++++ --- /var/tmp/diff_new_pack.GNc1GA/_old 2026-09-21 12:08:18.415895390 +0200 +++ /var/tmp/diff_new_pack.GNc1GA/_new 2026-09-21 12:08:18.420895600 +0200 @@ -1,5 +1,5 @@ name: cmctl -version: 2.5.0 -mtime: 1777577201 -commit: 46bd6766e7c7e345b29f1bc2dc737872bce6fb66 +version: 2.6.1 +mtime: 1789673476 +commit: 7e56321dbec4f62ea5428b8656c871c6dc0cc112 ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/cmctl/vendor.tar.gz /work/SRC/openSUSE:Factory/.cmctl.new.383539/vendor.tar.gz differ: char 13, line 1
