Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package opa for openSUSE:Factory checked in at 2026-10-20 12:43:41 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/opa (Old) and /work/SRC/openSUSE:Factory/.opa.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "opa" Tue Oct 20 12:43:41 2026 rev:32 rq:1386425 version:1.21.3 Changes: -------- --- /work/SRC/openSUSE:Factory/opa/opa.changes 2026-10-13 17:46:02.163052183 +0200 +++ /work/SRC/openSUSE:Factory/.opa.new.3698736/opa.changes 2026-10-20 12:43:53.309465534 +0200 @@ -1,0 +2,109 @@ +Tue Oct 20 07:11:54 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 1.21.3: + * Bundle signature verification could be side-stepped (GHSA-g2pf-6v5v-qcc8) + - An attacker able to alter bundle bytes could supply arbitrary + policy and data to an OPA that was configured to verify + bundle signatures. This could happen if the attacker controls + any of: + - OPA bundle/discovery service (including an artifact store + it uses) + - MitM between OPA and bundle/discovery service + - write access to a file:// bundle path or the bundle + persistence directory + + Two separate side-steps are fixed: + + Issue 1. Signature verification keyed on keyid rather than on + the signing block + + OPA only required a .signatures.json file when signing.keyid + was set, so a bundle stripped of its signature was accepted + if only e.g. bundles[_].signing was set instead of + bundles[_].signing.keyid. Verification now depends on the + presence of a signing block, as documented; keyid only + selects which key to use. + + Affected: + - bundles[_].signing or discovery.signing configured without + keyid: an empty block, or one with only scope or + exclude_files. + - Embedders (SDK, custom plugins, v1/loader, v1/compile) + calling bundle.NewVerificationConfig(keys, "", ...) with an + empty key id. + + Not affected: + - Configurations with an explicit bundles[_].signing.keyid or + discovery.signing.keyid. + - opa run/opa eval/opa build with --verification-key, which + defaults --verification-key-id to default. Passing + --verification-key-id "" explicitly was affected. + - Configurations with top-level keys but no signing block: + not a verification opt-in before or after this fix. + Unsigned bundles are still accepted, and OPA now logs a + warning at startup for bundles in this state. + + Workaround: on affected versions, set an explicit keyid on + every bundle that must be signed: + + bundles: + authz: + service: acmecorp + resource: bundle.tar.gz + signing: + keyid: my_key # must name an entry under the top-level `keys` + discovery: + resource: /discovery.tar.gz + signing: + keyid: my_discovery_key + + keys: + my_key: + algorithm: RS256 + key: | + -----BEGIN PUBLIC KEY----- + ... + + Further behaviour changes: + - A signing block with no entries under the top-level keys is + now a startup configuration error, rather than a + configuration that rejects every signed bundle while + accepting unsigned ones. + - bundle.NewVerificationConfig now requires signatures by + default. Embedders can opt out with + WithSkipBundleVerification(true) or the new + (*VerificationConfig).WithOptionalSignature(). + + Issue 2. Unsigned delta bundle downgrade + + Delta bundles skipped verification entirely, so an attacker + could replace a signed snapshot bundle with an unsigned delta + bundle on the same resource. The signed policy stays active + while the attacker controls any data inside the bundle's + roots. Delta bundles not supporting signing was documented, + but unenforced. OPA now rejects them with delta bundles do + not support signature verification. + + Affected: + - Any bundle or discovery configuration with a signing block, + with or without keyid. + - opa run/opa eval with --verification-key. + + Not affected: + - Configurations that don't verify signatures: no signing + block, or --skip-verify. Nothing was verified to begin + with. + + Workaround: there is no configuration that makes affected + versions reject delta bundles. Until upgrading, ensure the + integrity of the bundle bytes themselves: TLS terminated by + OPA or a trusted hop, restricted write access to the bundle + service, artifact store and bundle persistence directory. + + Bundle services that must keep serving unsigned delta bundles + after upgrading can opt out per bundle with the new + bundles[_].signing.allow_unsigned_delta_bundles (or + discovery.signing.allow_unsigned_delta_bundles) field. + Snapshot bundles must still be signed. + +------------------------------------------------------------------- Old: ---- opa-1.21.2.obscpio New: ---- opa-1.21.3.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ opa.spec ++++++ --- /var/tmp/diff_new_pack.qLP2o3/_old 2026-10-20 12:43:58.793694961 +0200 +++ /var/tmp/diff_new_pack.qLP2o3/_new 2026-10-20 12:43:58.798695170 +0200 @@ -17,7 +17,7 @@ Name: opa -Version: 1.21.2 +Version: 1.21.3 Release: 0 Summary: Open source, general-purpose policy engine License: Apache-2.0 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.qLP2o3/_old 2026-10-20 12:43:58.873698308 +0200 +++ /var/tmp/diff_new_pack.qLP2o3/_new 2026-10-20 12:43:58.880698601 +0200 @@ -3,7 +3,7 @@ <param name="url">https://github.com/open-policy-agent/opa.git</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">refs/tags/v1.21.2</param> + <param name="revision">refs/tags/v1.21.3</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> <param name="changesgenerate">enable</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.qLP2o3/_old 2026-10-20 12:43:58.925700484 +0200 +++ /var/tmp/diff_new_pack.qLP2o3/_new 2026-10-20 12:43:58.931700735 +0200 @@ -3,6 +3,6 @@ <param name="url">https://github.com/open-policy-agent/opa</param> <param name="changesrevision">cc2c5c60a4c486f15a5e8de457e96ed0fefaf5fe</param></service><service name="tar_scm"> <param name="url">https://github.com/open-policy-agent/opa.git</param> - <param name="changesrevision">3f7474e6b3c631821d8aac25ca444f7e75a56483</param></service></servicedata> + <param name="changesrevision">fa9da828ec764aed7ff0ddb0ea12316edde9a8c9</param></service></servicedata> (No newline at EOF) ++++++ opa-1.21.2.obscpio -> opa-1.21.3.obscpio ++++++ ++++ 9364 lines of diff (skipped) ++++++ opa.obsinfo ++++++ --- /var/tmp/diff_new_pack.qLP2o3/_old 2026-10-20 12:44:03.427888828 +0200 +++ /var/tmp/diff_new_pack.qLP2o3/_new 2026-10-20 12:44:03.430888954 +0200 @@ -1,5 +1,5 @@ name: opa -version: 1.21.2 -mtime: 1791812538 -commit: 3f7474e6b3c631821d8aac25ca444f7e75a56483 +version: 1.21.3 +mtime: 1792444559 +commit: fa9da828ec764aed7ff0ddb0ea12316edde9a8c9 ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/opa/vendor.tar.gz /work/SRC/openSUSE:Factory/.opa.new.3698736/vendor.tar.gz differ: char 142, line 1
