Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package versitygw for openSUSE:Factory checked in at 2026-10-29 16:08:51 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/versitygw (Old) and /work/SRC/openSUSE:Factory/.versitygw.new.1255 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "versitygw" Thu Oct 29 16:08:51 2026 rev:5 rq:1393527 version:1.10.0 Changes: -------- --- /work/SRC/openSUSE:Factory/versitygw/versitygw.changes 2026-10-14 18:41:01.737820946 +0200 +++ /work/SRC/openSUSE:Factory/.versitygw.new.1255/versitygw.changes 2026-10-29 16:11:36.476316085 +0100 @@ -1,0 +2,74 @@ +Thu Oct 29 05:37:38 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 1.10.0: + * Notice + - VersityGW Security Update: Go crypto/x509 Certificate Distrust + This release updates VersityGW’s Go toolchain to include Go’s + fix for CVE-2026-111943 (Go issue 82345). The fix blocks + certificate chains containing compromised eMudhra + intermediate certificates. + VersityGW uses Go’s certificate verification when connecting + to TLS-protected services, including S3-compatible storage, + IAM/OIDC providers, Vault, LDAP, and webhooks. Before the + fix, a network attacker able to intercept or redirect one of + these connections could potentially use a certificate issued + through an affected intermediate to impersonate the service. + After the update, Go rejects those chains, and connections to + endpoints still presenting them may fail until their + certificates are replaced. + This fix applies to binaries rebuilt with a patched Go + toolchain. Go 1.26.10 and Go 1.27.3 contain the fix; use a + later patched release if available. Existing VersityGW + binaries must be rebuilt and redeployed. Connections + configured to skip certificate verification do not receive + this protection. These release artifacts are built with Go + 1.27.3. + Action: Upgrade to this VersityGW release and redeploy. If + you operate a TLS endpoint that VersityGW connects to, + confirm its certificate chain does not use a distrusted + intermediate. + * Changelog + - 2bece2f chore(deps): bump the dev-dependencies group with 38 + updates + - 626ec9a chore(deps): bump the dev-dependencies group with 8 + updates + - 9503489 docs(helm): note tpl caveats for extraObjects + - 1f7e6dd feat(helm): add extraObjects for additional manifests + - a987fb2 feat: run functional tests on FreeBSD in CI + - 1207dd1 fix(posix): make the listing skip-directory list + configurable + - c07ffdc fix(webui): send the LocationConstraint when creating + a bucket outside us-east-1 + - 7662573 fix: accept HTTP dates for LastModifiedTime in + DeleteObjects + - 9debca3 fix: echo the client ETag in InvalidPart errors and + stop duplicating request ID headers + - a7b91dd fix: honor encoding-type=url in ListObjects and + ListObjectsV2 + - 416acd3 fix: keep object keys literal under fiber v3.6 path + normalization + - 5d5ece2 fix: keep the version id and delete marker in s3 + backend GetObjectAttributes + - e63998f fix: log the client IP from a trusted proxy header + - e92ad0b fix: map quota and no-space errors when creating the + multipart upload directory + - 7edbd62 fix: only look up the parts count when ObjectParts is + requested + - 4a9748b fix: prevent OOM kills of FreeBSD functional tests in + CI + - a664004 fix: race between object uploads and deletes on + shared parent directories + - 5616f38 fix: reject posix object keys that resolve into the + .sgwtmp staging directory + - 3715b38 fix: return NoSuchUpload for malformed upload IDs + ahead of access and request checks + - f88fe63 fix: return the parts count in GetObjectAttributes + for multipart objects + - 112e50c fix: serialize concurrent CompleteMultipartUpload + claims under the publish lock + - b4f02dc fix: set the gateway region on the standalone admin + server + - f513678 fix: skip excluded directories and reserve their keys + - 81e287f fix: update staticcheck CI with Go 1.27.2 support + +------------------------------------------------------------------- Old: ---- versitygw-1.9.0.obscpio New: ---- versitygw-1.10.0.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ versitygw.spec ++++++ --- /var/tmp/diff_new_pack.MpfA2q/_old 2026-10-29 16:11:37.263349091 +0100 +++ /var/tmp/diff_new_pack.MpfA2q/_new 2026-10-29 16:11:37.265349175 +0100 @@ -17,7 +17,7 @@ Name: versitygw -Version: 1.9.0 +Version: 1.10.0 Release: 0 Summary: High-Performance S3 Translation Service License: Apache-2.0 @@ -25,8 +25,8 @@ Source0: %{name}-%{version}.tar.gz Source1: vendor.tar.gz Source21: system-user-%{name}.conf +BuildRequires: go1.26 >= 1.26.10 BuildRequires: sysuser-tools -BuildRequires: golang(API) >= 1.26 # shell completions BuildRequires: bash-completion BuildRequires: fish ++++++ _service ++++++ --- /var/tmp/diff_new_pack.MpfA2q/_old 2026-10-29 16:11:37.297350517 +0100 +++ /var/tmp/diff_new_pack.MpfA2q/_new 2026-10-29 16:11:37.302350727 +0100 @@ -4,7 +4,7 @@ <param name="scm">git</param> <param name="exclude">.git</param> <param name="versionformat">@PARENT_TAG@</param> - <param name="revision">refs/tags/v1.9.0</param> + <param name="revision">refs/tags/v1.10.0</param> <param name="versionrewrite-pattern">v(.*)</param> <param name="changesgenerate">enable</param> </service> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.MpfA2q/_old 2026-10-29 16:11:37.331351943 +0100 +++ /var/tmp/diff_new_pack.MpfA2q/_new 2026-10-29 16:11:37.335352111 +0100 @@ -1,6 +1,6 @@ <servicedata> <service name="tar_scm"> <param name="url">https://github.com/versity/versitygw.git</param> - <param name="changesrevision">ca4c8d30f579a5ac3dd8c91bbfa8340c69dac0ac</param></service></servicedata> + <param name="changesrevision">72f75bd0f4c67a7663d3c56b80f05a44f6732db8</param></service></servicedata> (No newline at EOF) ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/versitygw/vendor.tar.gz /work/SRC/openSUSE:Factory/.versitygw.new.1255/vendor.tar.gz differ: char 12, line 1 ++++++ versitygw-1.9.0.obscpio -> versitygw-1.10.0.obscpio ++++++ ++++ 12690 lines of diff (skipped) ++++++ versitygw.obsinfo ++++++ --- /var/tmp/diff_new_pack.MpfA2q/_old 2026-10-29 16:11:37.925376855 +0100 +++ /var/tmp/diff_new_pack.MpfA2q/_new 2026-10-29 16:11:37.930377065 +0100 @@ -1,5 +1,5 @@ name: versitygw -version: 1.9.0 -mtime: 1791930799 -commit: ca4c8d30f579a5ac3dd8c91bbfa8340c69dac0ac +version: 1.10.0 +mtime: 1792699748 +commit: 72f75bd0f4c67a7663d3c56b80f05a44f6732db8
