Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package netbird for openSUSE:Factory checked in at 2026-10-16 20:08:55 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/netbird (Old) and /work/SRC/openSUSE:Factory/.netbird.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "netbird" Fri Oct 16 20:08:55 2026 rev:49 rq:1385142 version:0.81.1 Changes: -------- --- /work/SRC/openSUSE:Factory/netbird/netbird.changes 2026-10-03 20:16:27.365939452 +0200 +++ /work/SRC/openSUSE:Factory/.netbird.new.3698736/netbird.changes 2026-10-16 20:10:19.900761879 +0200 @@ -1,0 +2,220 @@ +Fri Oct 16 07:27:22 UTC 2026 - Dirk MΓΌller <[email protected]> + +- fix initial config.json + +------------------------------------------------------------------- +Fri Oct 16 01:51:27 UTC 2026 - Marcus Rueckert <[email protected]> + +- Update to 0.81.1 + - [client] Keep interface discovery out of the bind open path + (#8226) (#8227) + +------------------------------------------------------------------- +Thu Oct 15 14:52:08 UTC 2026 - Marcus Rueckert <[email protected]> + +- Update to 0.81.0 + - Highlights + - Certificate Posture Checks + - A new Certificate posture check requires peers to hold a + device certificate issued by your own CA, and to prove they + still have the private key by signing a challenge from + management. A copied certificate without its key fails the + check. Management repeats the challenge every 4 hours while + the peer is connected, so a removed key or an expired + certificate closes access within that window. + - π nblink: forward into your network without root + - nblink is a new standalone binary that forwards local ports + into your NetBird network from an ordinary, unprivileged + process. It runs the client in userspace mode, so there is + no TUN device, no root, no installer, and /etc/resolv.conf + is never touched. Names on the upstream side resolve inside + the tunnel. It is built for places the regular agent cannot + run: managed laptops without admin rights, rootless + containers on OpenShift and Podman, CI jobs, MCP servers + and local AI agents that need an internal API, and sidecars + for apps that hardcode an HTTP endpoint. + - π Duplicate Policies + - Access Control and Agent Network policies now have a + Duplicate action in the row menu. It opens the create + wizard pre-filled with every setting of the source policy, + named <name> (copy), and nothing is saved until you click + Add Policy. Groups, posture checks, resources, providers + and guardrails are reused rather than cloned. + - π Managing Policies Β· dashboard#841 + - π£οΈ Path-based access control for Reverse Proxy services + - HTTP targets of a Reverse Proxy service can now override + the service's authentication for their path. Under a + target's Optional Settings, choose an Access action: Use + service authentication, Bypass authentication, Block + access. + - What's New + - π Security and Access Control + - Added the Certificate posture check, with a hardened + client, fresh challenge nonces, recovery from stuck proof + collections, and fixes for remaining edge cases. #7535, + #8052, #7890, #8174 + - Used single-use codes for the OIDC session handoff between + management and the proxy, and renamed the session code + query parameter. #7635, #7981 + - Enforced strict base64url decoding for JWT validation in + management and the proxy. #7554 + - Refactored the PKCE verifier store into a reusable + single-use store. #7634 + - Added a revocation guard hook to the proxy token API. #7732 + - Returned a permission-denied error when a setup key is + expired or invalid, instead of a generic failure. #8086 + - π₯οΈ Client Improvements + - Added nblink, an unprivileged forwarder into the network. + #7955 + - Replaced the eBPF WireGuard proxy with loopback endpoint + addressing, removing the eBPF dependency for kernel-mode + relayed connections. #7316 + - Stopped one unreachable relay from churning connections on + the others, and stopped offering to every peer when the + relay transport drops. #8098, #7092 + - Kept the advertised ICE session ID when following a remote + restart, avoiding unnecessary reconnects. #7814 + - Cached the box shared key per remote peer in the Signal + client, and cached the interface check shared by ICE + agents. #7807, #8001 + - Configured the userspace device through its typed API and + reused one wgctrl client in the kernel configurer. #7937, + #7912 + - Discovered interfaces lazily in stdnet instead of at + construction. #7346 + - Forced interactive login when extending the auth session, + evaluated the session deadline against the wall clock, and + dropped the pending login flow when a login switches + profile. #7216, #7959, #7882 + - Kept the updater silent until management decides the update + mode. #7455 + - Gated settings updates on value, not on field presence. + #7398 + - Added debug cpu start and stop commands for CPU profiling. + #7749 + - Classified Windows local accounts by NetBIOS name. #7628 + - Fixed the Windows UI exiting on first launch, and closed + the UI before InstallValidate in the MSI. #8138, #7395 + - Fixed the browser login popup shown from the daemon, and + kept the delete-profile dialog open until the delete + finishes. #7408, #7752 + - Added RTL layout support and Galician (gl) localization to + the desktop UI, warned on missing translations, and only + offered locales listed in _index.json. #8076, #7041, #8090, + #8091 + - π± Mobile + - Coalesced peer list change notifications to the Android and + iOS listener. #7546 + - Generated the Android debug bundle to a file. #7528 + - Resolved the Android network route peer by HA unique ID + instead of scanning the full status. #7705 + - Skipped late session warnings on desktop and scheduled them + in the app on Android. #7548 + - βοΈ Management Improvements + - Exposed peer MAC addresses and made peers searchable by + MAC. #6553 + - Added an account setting to return an error on peer name + collision during AddPeer. #8154 + - Refreshed only affected peers on DNS zone, DNS record and + IPv6 settings changes. #8050, #8051 + - Emitted activity events for batch group operations. #8180 + - Added a MySQL to PostgreSQL migration tool. #8095 + - Made the Let's Encrypt challenge listener address + configurable for management and signal. #7706 + - Tore down only the peer session that owns the stream. #8057 + - Updated proxy mappings on peer IP change and the reserved + IP exclusion when generating peer IPs. #8139, #8144 + - Expanded loaded snapshots in place, reducing allocations on + network map computation. #8177 + - Cleaned up Agent Network configuration on account deletion + and added a disabled state to the managed Agent Network + proxy API. #7812, #7744 + - Switched to libopenapi for managing the OpenAPI-based API, + and added the tenant delete endpoint to the spec. #8056, + #8054 + - Improved Base62 encoding and decoding performance and + robustness. #3391 + - Removed ingress ports. #8062 + - Extracted a shared database connection and data repository, + and handled connection close on error. #7649, #7740 + - Fixed the login filter, created HttpConfig before applying + TLS flag overrides, and moved the child-account check. + #7739, #8168, #8195 + - π Reverse Proxy + - Added per-target HTTP access actions (use service + authentication, bypass, block), backed by middleware + snapshot revisions and container E2E coverage. #8114, + #8115, #8116, #8117 + - Required a private proxy cluster for cluster and direct + upstream targets. #7984 + - Added an option to refuse private addresses on + direct-upstream dials. #7913 + - Fell back to the IdP for the proxy session email when the + token does not carry one. #8112 + - π‘ Signal and Relay + - Fixed a race in Relay server shutdown. #7607 + - Stopped Signal with an error when a server fails, instead + of continuing half-started. #8105 + - ποΈ Infrastructure and CI + - Added release-wired Red Hat UBI image variants for + management, signal, relay and the combined server, sharing + one license collection script. #8167, #7458, #7457, #7953, + #8055 + - Fixed Red Hat certification preflight artifact handling. + #7947, #8111 + - Fixed Traefik versioning and updated CrowdSec in the + self-hosted setup. #8152 + - Replaced the which dependency with command in configure.sh. + #8007 + - Added a Homebrew cask e2e test, moved the FreeBSD port test + to 15.1, and reported both peers' state when the connect + test times out. #7618, #7999, #7944 + - Exempted Crowdin service PRs from title and docs checks. + #7170 + - Test fixes for the update message tests, peer IP + allocation, and mysql-migrate container tests. #8000, + #8173, #8121, #8128 + - π Misc + - Used ASCII hyphens in the LICENSE header and extended the + copyright year to 2026. #8065, #8169 + - Dashboard (v2.95.0) + - Added the Certificate posture check with CA validation, + SHA-256 fingerprints, and a mobile-unsupported warning. + dashboard#798 + - Added Duplicate to the Access Control and Agent Network + policy row menus. dashboard#841 + - Added per-target HTTP access controls for Reverse Proxy + services, with access badges in target lists. dashboard#823 + - Added a setting to fail on peer name collision. + dashboard#851 + - Added peer search by MAC address. dashboard#683 + - Added OpenCode and Pi to Connect Agent with a provider and + model picker, and showed which models "All Models" covers. + dashboard#856, dashboard#816 + - Streamlined Agent Network onboarding, adjusted it for + existing empty accounts, and made sure it adds the user to + Users. dashboard#822, dashboard#839, dashboard#840 + - Drew the user view's agent policies from its peers. + dashboard#820 + - Prevented duplicate routing peers and fixed live routing + peer creation in the Control Center. dashboard#836 + - Showed enable and disable events for EDR and IdP sync + integrations. dashboard#849 + - Fixed searching group peers by owner and sortable column + headers for Name, Metric and Domain. dashboard#818, + dashboard#681 + - Blocked search engines by default with robots.txt. + dashboard#827 + - Added a Red Hat UBI image variant (-ubi). dashboard#829 + - Added Storybook with a visual regression check, and let the + e2e suite run against a deployed dashboard. dashboard#843, + dashboard#842 + - Pointed bug reports and feature requests to Discussions, + made Manage Plan a primary button, and updated + announcements. dashboard#824, dashboard#828, dashboard#830, + dashboard#848 +- refreshed patches + service-install-cli-change.patch + skip-ui.patch + +------------------------------------------------------------------- Old: ---- netbird-0.80.0.obscpio New: ---- netbird-0.81.1.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ netbird.spec ++++++ --- /var/tmp/diff_new_pack.7PuxqX/_old 2026-10-16 20:10:23.444910174 +0200 +++ /var/tmp/diff_new_pack.7PuxqX/_new 2026-10-16 20:10:23.446910258 +0200 @@ -32,7 +32,7 @@ %bcond_with stub_config Name: netbird -Version: 0.80.0 +Version: 0.81.1 Release: 0 Summary: Mesh VPN based on WireGuard License: AGPL-3.0-only AND BSD-3-Clause @@ -102,7 +102,7 @@ Management/signal/relay are not required for the netbird client application. %package relay -Summary: Backend signal portion for %{name} server +Summary: Backend relay portion for %{name} server %description relay Optional new relay component for %{name}. Please note that this does not @@ -177,7 +177,7 @@ BuildArch: noarch %description signal-bash-completion -Bash command line completion support for %{name}-signal. +Bash command line completion support for %{name}-management. %package signal-fish-completion Summary: Fish Completion for %{name}-signal @@ -264,7 +264,7 @@ install -d %{buildroot}%{_sysconfdir}/%{name} %if %{with stub_config} -echo <<EOF > %{buildroot}/etc/netbird/config.json +cat <<EOF > %{buildroot}/etc/netbird/config.json ## ## To add this machine to your netbird instance run: ## @@ -333,7 +333,24 @@ TestICEBind_HandlesConcurrentMixedTraffic TestRedirectAs_\* TestSSHProxy_CommandQuoting - TestJWTCache* + TestJWTCache_ServesTheOwner + TestJWTCache_RefusesAnotherLocalUser + TestJWTCache_EmptyCacheMatchesNobody + TestJWTCache_UnownedEntryMatchesNobody + TestJWTCache_ElevationDoesNotChangeTheOwner + TestJWTCache_Expiry + TestJWTCache_ClearDropsTheEntry + TestJWTCache_StoreFromAnEndedSessionIsDropped + TestJWTCache_StoreWorksAgainAfterClear + TestJWTCache_StoreReplacesThePreviousOwner + TestCachedJWT_ServesTheOwner + TestCachedJWT_RefusesAnotherCaller + TestCachedJWT_WithoutCallerIdentity + TestSwitchProfile_ClearsJWTCache + TestCleanupConnection_KeepsJWTCache + TestWaitJWTToken_DropsTokenFromASessionThatEndedBeforeTheWait + TestLogin_ProfileSwitchRejectsJWTObtainedUnderPreviousConfig + TestExchangeWithFallback_TCPTruncatesToClientSize ) # Assemble skip string by replacing spaces with a pipe. disable=$(echo ${failing_tests[*]} | sed 's/ /|/g') ++++++ _service ++++++ --- /var/tmp/diff_new_pack.7PuxqX/_old 2026-10-16 20:10:23.484911848 +0200 +++ /var/tmp/diff_new_pack.7PuxqX/_new 2026-10-16 20:10:23.486911932 +0200 @@ -3,7 +3,7 @@ <param name="url">https://github.com/netbirdio/netbird.git</param> <param name="scm">git</param> <param name="package-meta">yes</param> - <param name="revision">refs/tags/v0.80.0</param> + <param name="revision">refs/tags/v0.81.1</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> <param name="changesgenerate">disable</param> ++++++ netbird-0.80.0.obscpio -> netbird-0.81.1.obscpio ++++++ ++++ 92064 lines of diff (skipped) ++++++ netbird.obsinfo ++++++ --- /var/tmp/diff_new_pack.7PuxqX/_old 2026-10-16 20:10:26.605042402 +0200 +++ /var/tmp/diff_new_pack.7PuxqX/_new 2026-10-16 20:10:26.609042569 +0200 @@ -1,5 +1,5 @@ name: netbird -version: 0.80.0 -mtime: 1790863139 -commit: fca64287cf51a85552a41b022013abbfdb335452 +version: 0.81.1 +mtime: 1792109805 +commit: 28657607c14d4b5135c48cb79fcb9f4fd0600b42 ++++++ service-install-cli-change.patch ++++++ --- /var/tmp/diff_new_pack.7PuxqX/_old 2026-10-16 20:10:26.664044870 +0200 +++ /var/tmp/diff_new_pack.7PuxqX/_new 2026-10-16 20:10:26.668045038 +0200 @@ -2,7 +2,7 @@ =================================================================== --- netbird.orig/client/cmd/login.go +++ netbird/client/cmd/login.go -@@ -103,9 +103,16 @@ func doDaemonLogin(ctx context.Context, +@@ -100,9 +100,16 @@ func doDaemonLogin(ctx context.Context, conn, err := DialClientGRPCServer(ctx, daemonAddr) if err != nil { //nolint @@ -26,7 +26,7 @@ =================================================================== --- netbird.orig/client/cmd/root.go +++ netbird/client/cmd/root.go -@@ -439,9 +439,16 @@ func getClient(cmd *cobra.Command) (*grp +@@ -485,9 +485,16 @@ func getClient(cmd *cobra.Command) (*grp conn, err := DialClientGRPCServer(cmd.Context(), daemonAddr) if err != nil { //nolint @@ -248,7 +248,7 @@ =================================================================== --- netbird.orig/client/cmd/up.go +++ netbird/client/cmd/up.go -@@ -281,9 +281,16 @@ func runInDaemonMode(ctx context.Context +@@ -292,9 +292,16 @@ func runInDaemonMode(ctx context.Context conn, err := DialClientGRPCServer(ctx, daemonAddr) if err != nil { //nolint ++++++ skip-ui.patch ++++++ --- /var/tmp/diff_new_pack.7PuxqX/_old 2026-10-16 20:10:26.688045875 +0200 +++ /var/tmp/diff_new_pack.7PuxqX/_new 2026-10-16 20:10:26.697046251 +0200 @@ -2,7 +2,7 @@ =================================================================== --- netbird.orig/go.mod +++ netbird/go.mod -@@ -114,7 +114,6 @@ require ( +@@ -120,7 +120,6 @@ require ( github.com/ti-mo/conntrack v0.5.1 github.com/ti-mo/netfilter v0.5.2 github.com/vmihailenco/msgpack/v5 v5.4.1 @@ -10,7 +10,7 @@ github.com/yusufpapurcu/wmi v1.2.4 github.com/zcalusic/sysinfo v1.1.3 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 -@@ -323,6 +322,15 @@ require ( +@@ -365,6 +364,15 @@ require ( rsc.io/qr v0.2.0 // indirect ) ++++++ vendor.tar.zst ++++++ /work/SRC/openSUSE:Factory/netbird/vendor.tar.zst /work/SRC/openSUSE:Factory/.netbird.new.3698736/vendor.tar.zst differ: char 7, line 1
