Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package openai-codex for openSUSE:Factory checked in at 2026-10-15 12:19:04 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/openai-codex (Old) and /work/SRC/openSUSE:Factory/.openai-codex.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "openai-codex" Thu Oct 15 12:19:04 2026 rev:20 rq:1384815 version:0.162.1 Changes: -------- --- /work/SRC/openSUSE:Factory/openai-codex/openai-codex.changes 2026-10-10 15:37:42.984942312 +0200 +++ /work/SRC/openSUSE:Factory/.openai-codex.new.3698736/openai-codex.changes 2026-10-15 12:19:56.905587405 +0200 @@ -1,0 +2,15 @@ +Wed Oct 14 07:41:41 UTC 2026 - Martin Pluskal <[email protected]> + +- CVE-2026-109349: gix-pack aborts on the header of a crafted + pack-version-3 pack file (boo#1285151) +- CVE-2026-109350: gix-pack misresolves an ofs-delta base distance + on crafted input (boo#1285151) +- CVE-2026-109351: gix-pack can exhaust memory on the header + object count of a crafted pack file (boo#1285151) +- Re-vendor for the above: gix 0.81.0 -> 0.88.0 with its lockstep + gix-* siblings so the lock reaches the fixed gix-pack 0.75.0 + (codex-bump-gix-0.88.patch); adapt codex-git-utils to the gix 0.88 + error API (codex-gix-error-anyhow.patch); licence set re-derived + from the new vendor tree and unchanged. + +------------------------------------------------------------------- New: ---- codex-bump-gix-0.88.patch codex-gix-error-anyhow.patch ----------(New B)---------- New: gix-* siblings so the lock reaches the fixed gix-pack 0.75.0 (codex-bump-gix-0.88.patch); adapt codex-git-utils to the gix 0.88 error API (codex-gix-error-anyhow.patch); licence set re-derived New: (codex-bump-gix-0.88.patch); adapt codex-git-utils to the gix 0.88 error API (codex-gix-error-anyhow.patch); licence set re-derived from the new vendor tree and unchanged. ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ openai-codex.spec ++++++ --- /var/tmp/diff_new_pack.uibBJm/_old 2026-10-15 12:20:00.886753925 +0200 +++ /var/tmp/diff_new_pack.uibBJm/_new 2026-10-15 12:20:00.888754009 +0200 @@ -58,6 +58,15 @@ # 0.162.1 moves no crate at all - Cargo.lock is byte-identical to 0.162.0's # and the only source delta is first-party codex code (Apache-2.0) - so the # tag above is unchanged by that bump. +# This re-vendor (no upstream bump) moves gix 0.81.0 -> 0.88.0 with its +# lockstep gix-* siblings so the lock reaches the fixed gix-pack 0.75.0 +# (boo#1285151), plus knock-ons (fastrand, jiff, autocfg, memmap2, +# faster-hex, quick-xml 0.41.0 alongside 0.39.4). Re-derived with the same +# scope the set is unchanged: 760 third-party crates in the codex-cli +# closure (759 tallied, aws-lc-sys itemised separately as before) - +# Apache-2.0 526, MIT 181, Unicode-3.0 20, MPL-2.0 12, ISC 9, +# BSD-3-Clause 9, Zlib 5, BSD-2-Clause 1, CC0-1.0 1, +# CDLA-Permissive-2.0 1 - so the tag above is unchanged by this re-vendor. # - self_cell 1.2.2 is "Apache-2.0 OR GPL-2.0-only" and is the ONLY crate # anywhere in the graph offering GPL. Apache-2.0 is elected, so this # package carries no GPL obligation; please do not re-derive it as GPL. @@ -101,6 +110,10 @@ Patch1: codex-no-startup-update-check.patch # PATCH-FIX-OPENSUSE codex-system-libzstd.patch [email protected] -- link zstd-sys against the system libzstd instead of its bundled copy Patch2: codex-system-libzstd.patch +# PATCH-FIX-OPENSUSE codex-bump-gix-0.88.patch [email protected] -- bump gix 0.81.0 -> 0.88.0 so the lockfile reaches the fixed gix-pack 0.75.0 (boo#1285151) +Patch3: codex-bump-gix-0.88.patch +# PATCH-FIX-OPENSUSE codex-gix-error-anyhow.patch [email protected] -- adapt codex-git-utils to the gix 0.88 gix-error API (boo#1285151) +Patch4: codex-gix-error-anyhow.patch BuildRequires: cargo BuildRequires: cargo-packaging >= 1.2.0 BuildRequires: cmake ++++++ _service ++++++ --- /var/tmp/diff_new_pack.uibBJm/_old 2026-10-15 12:20:00.939756142 +0200 +++ /var/tmp/diff_new_pack.uibBJm/_new 2026-10-15 12:20:00.942756267 +0200 @@ -11,9 +11,14 @@ feature and leaves the lockfile, hence the vendored set, untouched. To regenerate: - tar xf codex-rust-v0.162.1.tar.gz - patch -p1 -d codex-rust-v0.162.1 < codex-drop-v8-code-mode.patch - rm -rf codex-rust-v0.162.1/codex-rs/vendor + tar xf codex-rust-v0.162.1.tar.gz + patch -p1 -d codex-rust-v0.162.1 < codex-drop-v8-code-mode.patch + patch -p1 -d codex-rust-v0.162.1 < codex-bump-gix-0.88.patch + (plus the Cargo.lock the bump resolves to: run cargo update + for gix in codex-rs/ and copy the lock in. The vendored + Cargo.lock overwrites the tarball's at build time, so the + tarball itself stays pristine.) + rm -rf codex-rust-v0.162.1/codex-rs/vendor osc service manualrun cargo_vendor rm -rf codex-rust-v0.162.1 ++++++ codex-bump-gix-0.88.patch ++++++ From: Martin Pluskal <[email protected]> Subject: Bump gix 0.81.0 -> 0.88.0 for the gix-pack security fixes gix-pack below 0.75.0 parses pack files unsafely: a crafted pack can assert on the pack-version-3 header (CVE-2026-109349), misresolve an ofs-delta base distance (CVE-2026-109350) or exhaust memory on the header object count (CVE-2026-109351) (boo#1285151). gix pins its gix-pack in lockstep (0.81.0 wants ^0.68.0, 0.88.0 wants ^0.75.0), so the manifest has to move for the lockfile to reach the fixed gix-pack 0.75.0. The matching Cargo.lock ships inside vendor.tar.zst. Downstream security backport, not suitable for upstream submission. --- a/codex-rs/Cargo.toml +++ b/codex-rs/Cargo.toml @@ -376,7 +376,7 @@ flate2 = "1.1.8" futures = { version = "0.3", default-features = false } gethostname = "1.1.0" -gix = { version = "0.81.0", default-features = false, features = ["sha1"] } +gix = { version = "0.88.0", default-features = false, features = ["sha1"] } gix-url = "0.35.2" glob = "0.3" globset = "0.4" ++++++ codex-gix-error-anyhow.patch ++++++ From: Martin Pluskal <[email protected]> Subject: Adapt to the gix 0.88 error API (gix-error Exn types) gix 0.88 routes fallible APIs through the new gix-error crate, whose Exn error type does not implement StdError: anyhow's `?` conversion and `.context()` no longer resolve for it. Enable gix's `anyhow` feature (gix-error/anyhow provides From<Exn> for anyhow::Error, so plain `?` works again) and convert explicitly at the one remaining `.context()` site in codex-git-utils. Part of the boo#1285151 re-vendor (with codex-bump-gix-0.88.patch). --- a/codex-rs/Cargo.toml +++ b/codex-rs/Cargo.toml @@ -376,7 +376,7 @@ flate2 = "1.1.8" futures = { version = "0.3", default-features = false } gethostname = "1.1.0" -gix = { version = "0.88.0", default-features = false, features = ["sha1"] } +gix = { version = "0.88.0", default-features = false, features = ["anyhow", "sha1"] } gix-url = "0.35.2" glob = "0.3" globset = "0.4" --- a/codex-rs/git-utils/src/baseline.rs +++ b/codex-rs/git-utils/src/baseline.rs @@ -315,6 +315,7 @@ fn blob_oid(repo: &gix::Repository, bytes: &[u8]) -> anyhow::Result<ObjectId> { gix::objs::compute_hash(repo.object_hash(), gix::objs::Kind::Blob, bytes) + .map_err(anyhow::Error::from) .context("compute git baseline blob oid") } ++++++ vendor.tar.zst ++++++ /work/SRC/openSUSE:Factory/openai-codex/vendor.tar.zst /work/SRC/openSUSE:Factory/.openai-codex.new.3698736/vendor.tar.zst differ: char 7, line 1
