Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package owntone for openSUSE:Factory checked in at 2026-10-21 20:56:20 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/owntone (Old) and /work/SRC/openSUSE:Factory/.owntone.new.2252680 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "owntone" Wed Oct 21 20:56:20 2026 rev:13 rq:1386591 version:29.3 Changes: -------- --- /work/SRC/openSUSE:Factory/owntone/owntone.changes 2026-02-17 17:59:00.775109387 +0100 +++ /work/SRC/openSUSE:Factory/.owntone.new.2252680/owntone.changes 2026-10-21 20:57:42.224527130 +0200 @@ -1,0 +2,53 @@ +Mon Oct 19 11:34:24 UTC 2026 - Martin Pluskal <[email protected]> + +- Create owntone system user/group via sysusers.d instead of legacy + useradd/groupadd scriptlets, so the RPM Provides user(owntone) + and group(owntone): + * ship %{_sysusersdir}/owntone-user.conf (u owntone, + /var/lib/owntone, /sbin/nologin). + * drop Requires(pre): pwdutils with the old scriptlets. + +------------------------------------------------------------------- +Sat Oct 17 16:49:05 UTC 2026 - Martin Pluskal <[email protected]> + +- Update to version 29.3: + * fix: Spotify library missing due to malformed auth header. + * fix: heap-buffer-over-read in httpd. + * fix: Add support for Spotify audiobooks. + * fix: Minor web UI improvements. +- Security fixes shipped in the 29.0 -> 29.3 range (fixed upstream in 29.1): + * CVE-2026-41457 (boo#1262568): SQL injection via DAAP query and filter parameters. + * CVE-2026-41458 (boo#1262570): denial of service via DAAP login session-list race. + * CVE-2026-26828 (boo#1260348): NULL pointer dereference in DAAP reply handling. + +------------------------------------------------------------------- +Sun Jun 28 15:24:19 UTC 2026 - Adrian Schröter <[email protected]> + + - Updated to version 29.2 + * This release is functionally identical to 29.1.1. The purpose of the release is to fix a RPi packaging issue caused by the 29.1.1 version number. + * Version 29.1.1: + - fix: 29.1 broke some older AirPlay speakers ("Missing or invalid public key") + - fix: "Computer" always being selected in Apple Remote + - fix: Minor web UI improvements + * Version 29.1: + - fix: Samsung and Sonos Era speakers via support for Airplay 2 PTP timing + - fix: shairport-sync Airplay 2 mode via support for PTP timing + - fix: ipv6 on MacOS and BSD + - fix: if bind_address is configured, use it for all services + - fix: better mpd support of swmpc (fix sort tags and missing fields) + - fix: security (races conditions, segfaults, sql injection, timing attacks) + - fix: iTunes/Apple Music with password + - fix: artwork for radio statios sometimes not updating + - fix: playback not starting in the web UI + - new: Airplay 2 is now default + - new: support artwork for non-library items, e.g. from Spotify search + - new: set speaker offset via web UI + - new: option to skip startup Spotify rescan + - new: option to set Airplay speakers as "exclusive" + - new: deprecate config file playback offset and websocket interface + - new: add option for music-assistant/cliairplay to set playback start time + + - Update generated using pbuild-ai + - 0001-dacp-Fix-segfault-from-invalid-queries.patch is obsolete + +------------------------------------------------------------------- @@ -67,0 +121 @@ + Old: ---- 0001-dacp-Fix-segfault-from-invalid-queries.patch owntone-29.0.tar.xz New: ---- owntone-29.3.tar.xz owntone-user.conf ----------(Old B)---------- Old: - Update generated using pbuild-ai - 0001-dacp-Fix-segfault-from-invalid-queries.patch is obsolete ----------(Old E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ owntone.spec ++++++ --- /var/tmp/diff_new_pack.IJG5gY/_old 2026-10-21 20:57:42.968558319 +0200 +++ /var/tmp/diff_new_pack.IJG5gY/_new 2026-10-21 20:57:42.970558402 +0200 @@ -29,13 +29,13 @@ Summary: DAAP server for iTunes and Chromecast with MPD and RSP support License: GPL-2.0-or-later Name: owntone -Version: 29.0 +Version: 29.3 Release: 0 URL: https://github.com/owntone/owntone-server Source0: %url/releases/download/%{version}/%{name}-%{version}.tar.xz Source1: owntone_logrotate +Source2: %{name}-user.conf Patch0: harden_owntone.service.patch -Patch1: 0001-dacp-Fix-segfault-from-invalid-queries.patch Provides: forked-daapd = %version Obsoletes: forked-daapd < 28 BuildRequires: antlr3-tool @@ -46,6 +46,7 @@ BuildRequires: libunistring-devel BuildRequires: libxml2-devel BuildRequires: libxslt-devel +BuildRequires: sysuser-tools BuildRequires: pkgconfig(avahi-client) >= 0.6.24 BuildRequires: pkgconfig(json-c) BuildRequires: pkgconfig(libavcodec) @@ -62,11 +63,9 @@ BuildRequires: pkgconfig(openssl) BuildRequires: pkgconfig(sqlite3) >= 3.5.0 BuildRequires: pkgconfig(zlib) -Provides: group(%{groupname}) -Provides: user(%{username}) Requires: logrotate -Requires(pre): pwdutils +%sysusers_requires %if 0%{?suse_version} > 1500 BuildRequires: pkgconfig(libplist-2.0) @@ -118,6 +117,8 @@ --with-daapd-user=%{username} --with-daapd-group=%{groupname} %make_build +%sysusers_generate_pre %{SOURCE2} %{name} + %install make install DESTDIR=%{buildroot} docdir=%{_pkgdocdir} rm -f %{buildroot}%{_pkgdocdir}/INSTALL @@ -136,12 +137,9 @@ # install logrotate file install -D -m0644 %{SOURCE1} %{buildroot}/%{_sysconfdir}/logrotate.d/%{name} +install -Dpm0644 %{SOURCE2} %{buildroot}%{_sysusersdir}/%{name}-user.conf -%pre -getent group %{groupname} >/dev/null || groupadd -r %{groupname} -getent passwd %{username} >/dev/null || \ - useradd -r -g %{groupname} -d %{homedir} -s /sbin/nologin \ - -c '%{name} User' %{username} +%pre -f %{name}.pre %service_add_pre %{name}.service # try to rescuce former data due to package rename @@ -176,6 +174,7 @@ %{_libdir}/%{name}/ %{_datarootdir}/%{name}/ %{_unitdir}/%{name}.service +%{_sysusersdir}/%{name}-user.conf %attr(0750,%{username},%{groupname}) %{_localstatedir}/cache/%{name} %attr(0750,%{username},%{groupname}) %{homedir} %ghost %{_localstatedir}/log/%{name}.log ++++++ owntone-29.0.tar.xz -> owntone-29.3.tar.xz ++++++ ++++ 36067 lines of diff (skipped) ++++++ owntone-user.conf ++++++ # Type Name ID GECOS HOME SHELL u owntone - "owntone User" /var/lib/owntone /sbin/nologin
