Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package in-toto for openSUSE:Factory checked in at 2026-10-18 19:26:55 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/in-toto (Old) and /work/SRC/openSUSE:Factory/.in-toto.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "in-toto" Sun Oct 18 19:26:55 2026 rev:3 rq:1386003 version:3.1.0 Changes: -------- --- /work/SRC/openSUSE:Factory/in-toto/in-toto.changes 2022-03-24 23:00:27.564392961 +0100 +++ /work/SRC/openSUSE:Factory/.in-toto.new.3698736/in-toto.changes 2026-10-18 19:27:30.597267781 +0200 @@ -1,0 +2,29 @@ +Fri Oct 16 14:24:35 UTC 2026 - Martin Pluskal <[email protected]> + +- Use static python3-FOO runtime Requires: bare python-FOO + names are never translated without python_subpackages and left + the package uninstallable (declined SR 1378861) +- Fix Summary style (capitalized, no trailing dot) + +------------------------------------------------------------------- +Sun Sep 13 12:02:47 UTC 2026 - Martin Pluskal <[email protected]> + +- Major update to version 3.1.0: + * requires securesystemslib >= 1.0, drops deprecated legacy + key arguments and legacy securesystemslib integration + * upstream removed the in-toto-keygen CLI, use standard + key formats with --signing-key/--verification-keys + * new --run-timeout and --inspection-timeout arguments + * CVE-2023-32076 (boo#1211293): fixed since 2.0.0, still fixed here +- Drop stale BuildRequires (poetry, setuptools, wheel, + sphinx/recommonmark): hatchling build backend only +- Run upstream test suite in %check, dedupe with %fdupes +- Tighten %files to the in_toto module and dist-info + +------------------------------------------------------------------- +Tue Jun 27 09:33:03 UTC 2023 - Adrian Schröter <[email protected]> + +- update to version 2.0.0 + https://github.com/in-toto/in-toto/releases/tag/v2.0.0 + +------------------------------------------------------------------- Old: ---- in-toto-1.2.0.tar.gz New: ---- in_toto-3.1.0.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ in-toto.spec ++++++ --- /var/tmp/diff_new_pack.IORmvd/_old 2026-10-18 19:27:31.153291078 +0200 +++ /var/tmp/diff_new_pack.IORmvd/_new 2026-10-18 19:27:31.154291119 +0200 @@ -1,7 +1,7 @@ # # spec file for package in-toto # -# Copyright (c) 2022 SUSE LLC +# Copyright (c) 2026 SUSE LLC and contributors # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -19,41 +19,52 @@ # we just build the application, not the modules %define pythons python3 Name: in-toto -Version: 1.2.0 +Version: 3.1.0 Release: 0 -Summary: in-toto is a framework to protect supply chain integrity. +Summary: Framework to protect supply chain integrity License: Apache-2.0 -Group: Development/Languages/Python URL: https://in-toto.io -Source: https://files.pythonhosted.org/packages/source/i/in-toto/%{name}-%{version}.tar.gz -BuildRequires: python3-recommonmark -BuildRequires: python3-setuptools -BuildRequires: python3-sphinx-argparse -BuildRequires: python3-sphinx_rtd_theme +Source: https://files.pythonhosted.org/packages/source/i/in-toto/in_toto-%{version}.tar.gz +BuildRequires: %{python_module attrs} +BuildRequires: %{python_module hatchling} +BuildRequires: %{python_module iso8601} +BuildRequires: %{python_module pathspec} +BuildRequires: %{python_module pip} +BuildRequires: %{python_module python-dateutil} +BuildRequires: %{python_module securesystemslib} +BuildRequires: fdupes +BuildRequires: gnupg Requires: python3-attrs Requires: python3-iso8601 Requires: python3-pathspec Requires: python3-python-dateutil -Requires: python3-securesystemslib +Requires: python3-securesystemslib >= 1.0 BuildArch: noarch %description in-toto provides a framework to protect the integrity of the software supply chain. It does so by verifying that each task in the chain is carried out as planned, by authorized personnel only, and that the product is not tampered with in transit. %prep -%setup -q +%setup -q -n in_toto-%{version} %build -%python_build +%pyproject_wheel %install -%python_install +%pyproject_install +%fdupes %{buildroot}%{python_sitelib} %check +# demo layouts invoke bare "python" (absent on openSUSE); shim it for tests +mkdir -p test-bin +ln -s %{__python3} test-bin/python +export PATH=$PWD/test-bin:$PATH +python3 -m unittest discover -s tests %files %doc README.md %license LICENSE %{_bindir}/in-toto* -%{python_sitelib}/* +%{python_sitelib}/in_toto +%{python_sitelib}/in_toto-%{version}*-info
