Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package ttl for openSUSE:Factory checked in at 2026-10-24 22:05:33 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/ttl (Old) and /work/SRC/openSUSE:Factory/.ttl.new.2252680 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "ttl" Sat Oct 24 22:05:33 2026 rev:15 rq:1392237 version:0.24.1 Changes: -------- --- /work/SRC/openSUSE:Factory/ttl/ttl.changes 2026-10-17 21:26:10.729823663 +0200 +++ /work/SRC/openSUSE:Factory/.ttl.new.2252680/ttl.changes 2026-10-24 22:07:32.568947540 +0200 @@ -1,0 +2,14 @@ +Fri Oct 23 18:51:59 UTC 2026 - Martin Hauke <[email protected]> + +- Update to version 0.24.1: + * webpki-roots and webpki-root-certs 1.0.7 → 1.0.10 + clear RUSTSEC-2026-0381 and RUSTSEC-2026-0383: the bundled + Mozilla root set still trusted intermediates issued by the + breached emSign CA. 'webpki-roots' backs the update check + ('ureq'); 'webpki-root-certs' reaches ttl via 'reqwest's + platform verifier (PeeringDB). + * rustls-webpki 0.103.15 → 0.103.16 clears RUSTSEC-2026-0382 + (certificate verification could accept distrusted intermediates). + Reaches ttl via 'rustls' in 'reqwest' and 'ureq'. + +------------------------------------------------------------------- Old: ---- ttl-0.24.0.obscpio New: ---- ttl-0.24.1.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ ttl.spec ++++++ --- /var/tmp/diff_new_pack.Ks4SdZ/_old 2026-10-24 22:07:34.140013246 +0200 +++ /var/tmp/diff_new_pack.Ks4SdZ/_new 2026-10-24 22:07:34.142013330 +0200 @@ -17,7 +17,7 @@ Name: ttl -Version: 0.24.0 +Version: 0.24.1 Release: 0 Summary: Modern traceroute/mtr-style TUI License: Apache-2.0 OR MIT ++++++ _service ++++++ --- /var/tmp/diff_new_pack.Ks4SdZ/_old 2026-10-24 22:07:34.226016843 +0200 +++ /var/tmp/diff_new_pack.Ks4SdZ/_new 2026-10-24 22:07:34.230017010 +0200 @@ -2,7 +2,7 @@ <service name="obs_scm" mode="manual"> <param name="url">https://github.com/lance0/ttl</param> <param name="scm">git</param> - <param name="revision">v0.24.0</param> + <param name="revision">v0.24.1</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(\d+\.\d+\.\d+)</param> <param name="changesgenerate">enable</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.Ks4SdZ/_old 2026-10-24 22:07:34.294019687 +0200 +++ /var/tmp/diff_new_pack.Ks4SdZ/_new 2026-10-24 22:07:34.303020064 +0200 @@ -1,6 +1,6 @@ <servicedata> <service name="tar_scm"> <param name="url">https://github.com/lance0/ttl</param> - <param name="changesrevision">141236898f97ff120ab7204703eb5a3c1a6fea29</param></service></servicedata> + <param name="changesrevision">0aae786e34dde4b0191194f1d2b91285e28b1a64</param></service></servicedata> (No newline at EOF) ++++++ ttl-0.24.0.obscpio -> ttl-0.24.1.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/ttl-0.24.0/CHANGELOG.md new/ttl-0.24.1/CHANGELOG.md --- old/ttl-0.24.0/CHANGELOG.md 2026-10-16 19:48:08.000000000 +0200 +++ new/ttl-0.24.1/CHANGELOG.md 2026-10-21 15:11:40.000000000 +0200 @@ -7,6 +7,12 @@ ## [Unreleased] +## [0.24.1] - 2026-10-21 + +### Security +- **`webpki-roots` and `webpki-root-certs` 1.0.7 → 1.0.10** clear RUSTSEC-2026-0381 and RUSTSEC-2026-0383: the bundled Mozilla root set still trusted intermediates issued by the breached emSign CA. `webpki-roots` backs the update check (`ureq`); `webpki-root-certs` reaches ttl via `reqwest`'s platform verifier (PeeringDB). +- **`rustls-webpki` 0.103.15 → 0.103.16** clears RUSTSEC-2026-0382 (certificate verification could accept distrusted intermediates). Reaches ttl via `rustls` in `reqwest` and `ureq`. + ## [0.24.0] - 2026-10-16 ### Added diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/ttl-0.24.0/Cargo.lock new/ttl-0.24.1/Cargo.lock --- old/ttl-0.24.0/Cargo.lock 2026-10-16 19:48:08.000000000 +0200 +++ new/ttl-0.24.1/Cargo.lock 2026-10-21 15:11:40.000000000 +0200 @@ -760,7 +760,7 @@ checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.52.0", + "windows-sys 0.59.0", ] [[package]] @@ -1529,7 +1529,7 @@ dependencies = [ "hermit-abi", "libc", - "windows-sys 0.52.0", + "windows-sys 0.59.0", ] [[package]] @@ -2766,7 +2766,7 @@ "errno", "libc", "linux-raw-sys", - "windows-sys 0.52.0", + "windows-sys 0.59.0", ] [[package]] @@ -2825,7 +2825,7 @@ "security-framework", "security-framework-sys", "webpki-root-certs", - "windows-sys 0.52.0", + "windows-sys 0.59.0", ] [[package]] @@ -2836,9 +2836,9 @@ [[package]] name = "rustls-webpki" -version = "0.103.15" +version = "0.103.16" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" +checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281" dependencies = [ "aws-lc-rs", "ring", @@ -3243,7 +3243,7 @@ "getrandom 0.4.2", "once_cell", "rustix", - "windows-sys 0.52.0", + "windows-sys 0.59.0", ] [[package]] @@ -3604,7 +3604,7 @@ [[package]] name = "ttl" -version = "0.24.0" +version = "0.24.1" dependencies = [ "anyhow", "chrono", @@ -3964,18 +3964,18 @@ [[package]] name = "webpki-root-certs" -version = "1.0.7" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "f31141ce3fc3e300ae89b78c0dd67f9708061d1d2eda54b8209346fd6be9a92c" +checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb" dependencies = [ "rustls-pki-types", ] [[package]] name = "webpki-roots" -version = "1.0.7" +version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "52f5ee44c96cf55f1b349600768e3ece3a8f26010c05265ab73f945bb1a2eb9d" +checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9" dependencies = [ "rustls-pki-types", ] @@ -4080,7 +4080,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"; checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.52.0", + "windows-sys 0.59.0", ] [[package]] diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/ttl-0.24.0/Cargo.toml new/ttl-0.24.1/Cargo.toml --- old/ttl-0.24.0/Cargo.toml 2026-10-16 19:48:08.000000000 +0200 +++ new/ttl-0.24.1/Cargo.toml 2026-10-21 15:11:40.000000000 +0200 @@ -1,6 +1,6 @@ [package] name = "ttl" -version = "0.24.0" +version = "0.24.1" edition = "2024" rust-version = "1.88" description = "Modern traceroute/mtr-style TUI with hop stats and optional ASN/geo enrichment" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/ttl-0.24.0/ROADMAP.md new/ttl-0.24.1/ROADMAP.md --- old/ttl-0.24.0/ROADMAP.md 2026-10-16 19:48:08.000000000 +0200 +++ new/ttl-0.24.1/ROADMAP.md 2026-10-21 15:11:40.000000000 +0200 @@ -1,6 +1,6 @@ # ttl Roadmap -Current release: **v0.24.0**. Changes since then are listed under [Unreleased](CHANGELOG.md#unreleased) in the changelog. +Current release: **v0.24.1**. Changes since then are listed under [Unreleased](CHANGELOG.md#unreleased) in the changelog. ## Market Context @@ -123,7 +123,7 @@ --- -## Completed (v0.24.0) +## Completed (v0.24.0, v0.24.1) - [x] Native Windows build (#141): the crate compiles and its tests run on Windows in CI; live tracing points to WSL2, `--replay`/`--diff` work natively - [x] One visual language across the TUI (#164): right-aligned stats, badge title flags, one popup and hint style, reworked hop detail, help legend, default theme readable on light terminals, ≥4.5:1 contrast enforced for every theme @@ -132,6 +132,7 @@ - [x] MPLS/interface details in text reports (#146); `--replay-size-limit` for large trusted recordings (#157) - [x] Docs reorganized around a short README front door, `docs/INSTALL.md` and a docs index (#162); demo re-recorded to show only the TUI (#165) - [x] Security: rustls 0.23.46 (RUSTSEC-2026-0346..0349), quinn-proto 0.11.19 (RUSTSEC-2026-0338..0342) +- [x] Security (v0.24.1): drop trust in the breached emSign CA's intermediates — webpki-roots / webpki-root-certs 1.0.10 (RUSTSEC-2026-0381, RUSTSEC-2026-0383), rustls-webpki 0.103.16 (RUSTSEC-2026-0382) --- ++++++ ttl.obsinfo ++++++ --- /var/tmp/diff_new_pack.Ks4SdZ/_old 2026-10-24 22:07:34.762039261 +0200 +++ /var/tmp/diff_new_pack.Ks4SdZ/_new 2026-10-24 22:07:34.769039554 +0200 @@ -1,5 +1,5 @@ name: ttl -version: 0.24.0 -mtime: 1792172888 -commit: 141236898f97ff120ab7204703eb5a3c1a6fea29 +version: 0.24.1 +mtime: 1792588300 +commit: 0aae786e34dde4b0191194f1d2b91285e28b1a64 ++++++ vendor.tar.zst ++++++ /work/SRC/openSUSE:Factory/ttl/vendor.tar.zst /work/SRC/openSUSE:Factory/.ttl.new.2252680/vendor.tar.zst differ: char 7, line 1
