Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package melange for openSUSE:Factory checked in at 2026-02-09 15:35:11 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/melange (Old) and /work/SRC/openSUSE:Factory/.melange.new.1670 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "melange" Mon Feb 9 15:35:11 2026 rev:137 rq:1331937 version:0.41.1 Changes: -------- --- /work/SRC/openSUSE:Factory/melange/melange.changes 2026-02-05 18:03:27.607308657 +0100 +++ /work/SRC/openSUSE:Factory/.melange.new.1670/melange.changes 2026-02-09 15:35:47.241758475 +0100 @@ -1,0 +2,19 @@ +Mon Feb 09 06:18:50 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 0.41.1: + * sca: skip soname runtime deps for host provided libraries + (#2337) +- Update to version 0.41.0: + * chore: Restore APK size limits during tests, bump apko (#2336) + * chore: pin wolfictl to last working version (#2334) + * build(deps): bump + go.opentelemetry.io/otel/exporters/stdout/stdouttrace (#2333) + * build(deps): bump go.opentelemetry.io/otel/sdk from 1.39.0 to + 1.40.0 (#2332) + * build(deps): bump chainguard.dev/apko in the gomod group + (#2330) + * build(deps): bump go.opentelemetry.io/otel from 1.39.0 to + 1.40.0 (#2331) + * feat: add --pipeline-dirs flag to build command (#2323) + +------------------------------------------------------------------- Old: ---- melange-0.40.5.obscpio New: ---- melange-0.41.1.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ melange.spec ++++++ --- /var/tmp/diff_new_pack.krv0zH/_old 2026-02-09 15:35:48.229800054 +0100 +++ /var/tmp/diff_new_pack.krv0zH/_new 2026-02-09 15:35:48.233800223 +0100 @@ -17,7 +17,7 @@ Name: melange -Version: 0.40.5 +Version: 0.41.1 Release: 0 Summary: Build APKs from source code License: Apache-2.0 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.krv0zH/_old 2026-02-09 15:35:48.269801738 +0100 +++ /var/tmp/diff_new_pack.krv0zH/_new 2026-02-09 15:35:48.273801906 +0100 @@ -3,7 +3,7 @@ <param name="url">https://github.com/chainguard-dev/melange</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">v0.40.5</param> + <param name="revision">v0.41.1</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> <param name="changesgenerate">enable</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.krv0zH/_old 2026-02-09 15:35:48.297802916 +0100 +++ /var/tmp/diff_new_pack.krv0zH/_new 2026-02-09 15:35:48.301803085 +0100 @@ -1,6 +1,6 @@ <servicedata> <service name="tar_scm"> <param name="url">https://github.com/chainguard-dev/melange</param> - <param name="changesrevision">0f2f34dda06a67ca7b5952fe3f1f66edddfe17f1</param></service></servicedata> + <param name="changesrevision">61754ecffc527ac37e723f4ee766669eaac04e29</param></service></servicedata> (No newline at EOF) ++++++ melange-0.40.5.obscpio -> melange-0.41.1.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/melange-0.40.5/docs/md/melange_build.md new/melange-0.41.1/docs/md/melange_build.md --- old/melange-0.40.5/docs/md/melange_build.md 2026-02-04 22:35:47.000000000 +0100 +++ new/melange-0.41.1/docs/md/melange_build.md 2026-02-06 22:32:47.000000000 +0100 @@ -62,6 +62,7 @@ --package-append strings extra packages to install for each of the build environments --persist-lint-results persist lint results to JSON files in packages/{arch}/ directory --pipeline-dir string directory used to extend defined built-in pipelines + --pipeline-dirs strings directories used to extend defined built-in pipelines -r, --repository-append strings path to extra repositories to include in the build environment --rm clean up intermediate artifacts (e.g. container images, temp dirs) (default true) --runner string which runner to use to enable running commands, default is based on your platform. Options are ["bubblewrap" "docker" "qemu"] diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/melange-0.40.5/go.mod new/melange-0.41.1/go.mod --- old/melange-0.40.5/go.mod 2026-02-04 22:35:47.000000000 +0100 +++ new/melange-0.41.1/go.mod 2026-02-06 22:32:47.000000000 +0100 @@ -3,7 +3,7 @@ go 1.25.0 require ( - chainguard.dev/apko v1.1.3 + chainguard.dev/apko v1.1.6 github.com/chainguard-dev/clog v1.8.0 github.com/chainguard-dev/go-pkgconfig v0.0.0-20240404163941-6351b37b2a10 github.com/chainguard-dev/yam v0.2.47 @@ -34,9 +34,9 @@ github.com/ulikunitz/xz v0.5.15 github.com/yookoala/realpath v1.0.0 github.com/zealic/xignore v0.3.3 - go.opentelemetry.io/otel v1.39.0 - go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.39.0 - go.opentelemetry.io/otel/sdk v1.39.0 + go.opentelemetry.io/otel v1.40.0 + go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.40.0 + go.opentelemetry.io/otel/sdk v1.40.0 go.yaml.in/yaml/v2 v2.4.3 golang.org/x/crypto v0.47.0 golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546 @@ -75,7 +75,7 @@ require ( chainguard.dev/go-grpc-kit v0.17.15 // indirect - chainguard.dev/sdk v0.1.49 // indirect + chainguard.dev/sdk v0.1.50 // indirect cloud.google.com/go/auth v0.18.1 // indirect cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect cloud.google.com/go/compute/metadata v0.9.0 // indirect @@ -163,15 +163,15 @@ go.opentelemetry.io/auto/sdk v1.2.1 // indirect go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0 // indirect go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 // indirect - go.opentelemetry.io/otel/metric v1.39.0 // indirect - go.opentelemetry.io/otel/trace v1.39.0 // indirect + go.opentelemetry.io/otel/metric v1.40.0 // indirect + go.opentelemetry.io/otel/trace v1.40.0 // indirect go.step.sm/crypto v0.76.0 // indirect golang.org/x/mod v0.31.0 // indirect golang.org/x/net v0.49.0 // indirect golang.org/x/oauth2 v0.34.0 // indirect - google.golang.org/api v0.264.0 // indirect + google.golang.org/api v0.265.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20260122232226-8e98ce8d340d // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 // indirect google.golang.org/grpc v1.78.0 // indirect google.golang.org/protobuf v1.36.11 gopkg.in/warnings.v0 v0.1.2 // indirect diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/melange-0.40.5/go.sum new/melange-0.41.1/go.sum --- old/melange-0.40.5/go.sum 2026-02-04 22:35:47.000000000 +0100 +++ new/melange-0.41.1/go.sum 2026-02-06 22:32:47.000000000 +0100 @@ -1,9 +1,9 @@ -chainguard.dev/apko v1.1.3 h1:VLb6EdiaDu/j9UOZVwuLcphoTHcQxRvr2YeSp+7J72w= -chainguard.dev/apko v1.1.3/go.mod h1:jBoyxON09VaMNQ3WOuuE8NwCIfSkdwkIH4v6I3TR5eQ= +chainguard.dev/apko v1.1.6 h1:bnkcQwPKdOb1kQd9lrP6NRde6ZDS3F0POKJFec6zgjA= +chainguard.dev/apko v1.1.6/go.mod h1:t/XqZ3pRlqG6RotFsaUjkhoeNWPNgtkD24jAnkeydM8= chainguard.dev/go-grpc-kit v0.17.15 h1:y+FBjta2lsC0XxlkG+W5P1VxYl0zG74GRvoYN2o+p7s= chainguard.dev/go-grpc-kit v0.17.15/go.mod h1:1wAVAX2CCamtFlfMs9PFzfgQQxX1/TQyF6cbWApbJ2U= -chainguard.dev/sdk v0.1.49 h1:U9290jR9GHSaFsxSTb5st3t/JqoTwhODFEA6BnybXBc= -chainguard.dev/sdk v0.1.49/go.mod h1:b4isqRFaCBaRuVcHUrFeaqvt3d8J9GNOMS0RAyoawXw= +chainguard.dev/sdk v0.1.50 h1:rCoIYf30+ledJdaChqHVi2vh1BwIaWdVLjPfuPGdQ80= +chainguard.dev/sdk v0.1.50/go.mod h1:rH1bz4Kqs4JTrKUbJoPUGX9SRNI5PJCRyvRXWVP3MY0= cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw= cloud.google.com/go/auth v0.18.1 h1:IwTEx92GFUo2pJ6Qea0EU3zYvKnTAeRCODxfA/G5UWs= cloud.google.com/go/auth v0.18.1/go.mod h1:GfTYoS9G3CWpRA3Va9doKN9mjPGRS+v41jmZAhBzbrA= @@ -364,22 +364,22 @@ go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0/go.mod h1:fvPi2qXDqFs8M4B4fmJhE92TyQs9Ydjlg3RvfUp+NbQ= go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 h1:RbKq8BG0FI8OiXhBfcRtqqHcZcka+gU3cskNuf05R18= go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0/go.mod h1:h06DGIukJOevXaj/xrNjhi/2098RZzcLTbc0jDAUbsg= -go.opentelemetry.io/otel v1.39.0 h1:8yPrr/S0ND9QEfTfdP9V+SiwT4E0G7Y5MO7p85nis48= -go.opentelemetry.io/otel v1.39.0/go.mod h1:kLlFTywNWrFyEdH0oj2xK0bFYZtHRYUdv1NklR/tgc8= +go.opentelemetry.io/otel v1.40.0 h1:oA5YeOcpRTXq6NN7frwmwFR0Cn3RhTVZvXsP4duvCms= +go.opentelemetry.io/otel v1.40.0/go.mod h1:IMb+uXZUKkMXdPddhwAHm6UfOwJyh4ct1ybIlV14J0g= go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0 h1:GqRJVj7UmLjCVyVJ3ZFLdPRmhDUp2zFmQe3RHIOsw24= go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0/go.mod h1:ri3aaHSmCTVYu2AWv44YMauwAQc0aqI9gHKIcSbI1pU= go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.35.0 h1:xJ2qHD0C1BeYVTLLR9sX12+Qb95kfeD/byKj6Ky1pXg= go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.35.0/go.mod h1:u5BF1xyjstDowA1R5QAO9JHzqK+ublenEW/dyqTjBVk= -go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.39.0 h1:8UPA4IbVZxpsD76ihGOQiFml99GPAEZLohDXvqHdi6U= -go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.39.0/go.mod h1:MZ1T/+51uIVKlRzGw1Fo46KEWThjlCBZKl2LzY5nv4g= -go.opentelemetry.io/otel/metric v1.39.0 h1:d1UzonvEZriVfpNKEVmHXbdf909uGTOQjA0HF0Ls5Q0= -go.opentelemetry.io/otel/metric v1.39.0/go.mod h1:jrZSWL33sD7bBxg1xjrqyDjnuzTUB0x1nBERXd7Ftcs= -go.opentelemetry.io/otel/sdk v1.39.0 h1:nMLYcjVsvdui1B/4FRkwjzoRVsMK8uL/cj0OyhKzt18= -go.opentelemetry.io/otel/sdk v1.39.0/go.mod h1:vDojkC4/jsTJsE+kh+LXYQlbL8CgrEcwmt1ENZszdJE= -go.opentelemetry.io/otel/sdk/metric v1.39.0 h1:cXMVVFVgsIf2YL6QkRF4Urbr/aMInf+2WKg+sEJTtB8= -go.opentelemetry.io/otel/sdk/metric v1.39.0/go.mod h1:xq9HEVH7qeX69/JnwEfp6fVq5wosJsY1mt4lLfYdVew= -go.opentelemetry.io/otel/trace v1.39.0 h1:2d2vfpEDmCJ5zVYz7ijaJdOF59xLomrvj7bjt6/qCJI= -go.opentelemetry.io/otel/trace v1.39.0/go.mod h1:88w4/PnZSazkGzz/w84VHpQafiU4EtqqlVdxWy+rNOA= +go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.40.0 h1:MzfofMZN8ulNqobCmCAVbqVL5syHw+eB2qPRkCMA/fQ= +go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.40.0/go.mod h1:E73G9UFtKRXrxhBsHtG00TB5WxX57lpsQzogDkqBTz8= +go.opentelemetry.io/otel/metric v1.40.0 h1:rcZe317KPftE2rstWIBitCdVp89A2HqjkxR3c11+p9g= +go.opentelemetry.io/otel/metric v1.40.0/go.mod h1:ib/crwQH7N3r5kfiBZQbwrTge743UDc7DTFVZrrXnqc= +go.opentelemetry.io/otel/sdk v1.40.0 h1:KHW/jUzgo6wsPh9At46+h4upjtccTmuZCFAc9OJ71f8= +go.opentelemetry.io/otel/sdk v1.40.0/go.mod h1:Ph7EFdYvxq72Y8Li9q8KebuYUr2KoeyHx0DRMKrYBUE= +go.opentelemetry.io/otel/sdk/metric v1.40.0 h1:mtmdVqgQkeRxHgRv4qhyJduP3fYJRMX4AtAlbuWdCYw= +go.opentelemetry.io/otel/sdk/metric v1.40.0/go.mod h1:4Z2bGMf0KSK3uRjlczMOeMhKU2rhUqdWNoKcYrtcBPg= +go.opentelemetry.io/otel/trace v1.40.0 h1:WA4etStDttCSYuhwvEa8OP8I5EWu24lkOzp+ZYblVjw= +go.opentelemetry.io/otel/trace v1.40.0/go.mod h1:zeAhriXecNGP/s2SEG3+Y8X9ujcJOTqQ5RgdEJcawiA= go.opentelemetry.io/proto/otlp v1.7.1 h1:gTOMpGDb0WTBOP8JaO72iL3auEZhVmAQg4ipjOVAtj4= go.opentelemetry.io/proto/otlp v1.7.1/go.mod h1:b2rVh6rfI/s2pHWNlB7ILJcRALpcNDzKhACevjI+ZnE= go.step.sm/crypto v0.76.0 h1:K23BSaeoiY7Y5dvvijTeYC9EduDBetNwQYMBwMhi1aA= @@ -482,8 +482,8 @@ golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk= gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E= -google.golang.org/api v0.264.0 h1:+Fo3DQXBK8gLdf8rFZ3uLu39JpOnhvzJrLMQSoSYZJM= -google.golang.org/api v0.264.0/go.mod h1:fAU1xtNNisHgOF5JooAs8rRaTkl2rT3uaoNGo9NS3R8= +google.golang.org/api v0.265.0 h1:FZvfUdI8nfmuNrE34aOWFPmLC+qRBEiNm3JdivTvAAU= +google.golang.org/api v0.265.0/go.mod h1:uAvfEl3SLUj/7n6k+lJutcswVojHPp2Sp08jWCu8hLY= google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM= google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4= google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc= @@ -491,8 +491,8 @@ google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo= google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 h1:fCvbg86sFXwdrl5LgVcTEvNC+2txB5mgROGmRL5mrls= google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217/go.mod h1:+rXWjjaukWZun3mLfjmVnQi18E1AsFbDN9QdJ5YXLto= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260122232226-8e98ce8d340d h1:xXzuihhT3gL/ntduUZwHECzAn57E8dA6l8SOtYWdD8Q= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260122232226-8e98ce8d340d/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 h1:H86B94AW+VfJWDqFeEbBPhEtHzJwJfTbgE2lZa54ZAQ= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ= google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c= google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg= google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY= diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/melange-0.40.5/pkg/build/test.go new/melange-0.41.1/pkg/build/test.go --- old/melange-0.40.5/pkg/build/test.go 2026-02-04 22:35:47.000000000 +0100 +++ new/melange-0.41.1/pkg/build/test.go 2026-02-06 22:32:47.000000000 +0100 @@ -159,14 +159,7 @@ apko_build.WithExtraPackages(t.ExtraTestPackages), apko_build.WithIgnoreSignatures(t.IgnoreSignatures), apko_build.WithCache(t.ApkCacheDir, false, apk.NewCache(true)), - apko_build.WithTempDir(tmp), - apko_build.WithSizeLimits(options.SizeLimits{ - APKIndexDecompressedMaxSize: -1, - APKControlMaxSize: -1, - APKDataMaxSize: -1, - HTTPResponseMaxSize: -1, - }), - ) + apko_build.WithTempDir(tmp)) if err != nil { return "", fmt.Errorf("unable to create build context: %w", err) } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/melange-0.40.5/pkg/cli/build.go new/melange-0.41.1/pkg/cli/build.go --- old/melange-0.40.5/pkg/cli/build.go 2026-02-04 22:35:47.000000000 +0100 +++ new/melange-0.41.1/pkg/cli/build.go 2026-02-06 22:32:47.000000000 +0100 @@ -47,6 +47,7 @@ fs.StringVar(&flags.BuildDate, "build-date", "", "date used for the timestamps of the files inside the image") fs.StringVar(&flags.WorkspaceDir, "workspace-dir", "", "directory used for the workspace at /home/build") fs.StringVar(&flags.PipelineDir, "pipeline-dir", "", "directory used to extend defined built-in pipelines") + fs.StringSliceVar(&flags.PipelineDirs, "pipeline-dirs", []string{}, "directories used to extend defined built-in pipelines") fs.StringVar(&flags.SourceDir, "source-dir", "", "directory used for included sources") fs.StringVar(&flags.CacheDir, "cache-dir", "./melange-cache/", "directory used for cached inputs") fs.StringVar(&flags.CacheSource, "cache-source", "", "directory or bucket used for preloading the cache") @@ -97,6 +98,7 @@ BuildDate string WorkspaceDir string PipelineDir string + PipelineDirs []string SourceDir string CacheDir string CacheSource string @@ -191,9 +193,9 @@ build.WithBuildDate(flags.BuildDate), build.WithWorkspaceDir(flags.WorkspaceDir), // Order matters, so add any specified pipelineDir before - // builtin pipelines. + // builtin pipelines. Support both --pipeline-dir (singular, deprecated) + // and --pipeline-dirs (plural, new). --pipeline-dir is processed first. build.WithPipelineDir(flags.PipelineDir), - build.WithPipelineDir(BuiltinPipelineDir), build.WithCacheDir(flags.CacheDir), build.WithCacheSource(flags.CacheSource), build.WithPackageCacheDir(flags.ApkCacheDir), @@ -244,6 +246,13 @@ opts = append(opts, build.WithSourceDir(flags.SourceDir)) } + // Add multiple pipeline directories from --pipeline-dirs + for i := range flags.PipelineDirs { + opts = append(opts, build.WithPipelineDir(flags.PipelineDirs[i])) + } + // Always append built-in pipeline directory as fallback + opts = append(opts, build.WithPipelineDir(BuiltinPipelineDir)) + if auth, ok := os.LookupEnv("HTTP_AUTH"); !ok { // Fine, no auth. } else if parts := strings.SplitN(auth, ":", 4); len(parts) != 4 { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/melange-0.40.5/pkg/sca/sca.go new/melange-0.41.1/pkg/sca/sca.go --- old/melange-0.40.5/pkg/sca/sca.go 2026-02-04 22:35:47.000000000 +0100 +++ new/melange-0.41.1/pkg/sca/sca.go 2026-02-06 22:32:47.000000000 +0100 @@ -541,6 +541,9 @@ } for _, soname := range sonames { + if isHostProvidedLibrary(soname) { + continue + } log.Infof(" found soname %s for %s", soname, path) generated.Runtime = append(generated.Runtime, fmt.Sprintf("so:%s", soname)) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/melange-0.40.5/pkg/sca/sca_test.go new/melange-0.41.1/pkg/sca/sca_test.go --- old/melange-0.40.5/pkg/sca/sca_test.go 2026-02-04 22:35:47.000000000 +0100 +++ new/melange-0.41.1/pkg/sca/sca_test.go 2026-02-06 22:32:47.000000000 +0100 @@ -12,6 +12,7 @@ // See the License for the specific language governing permissions and // limitations under the License. +//go:generate go run ./../../ build --generate-index=false --out-dir=./testdata/generated ./testdata/nvidia-driver.yaml --arch=x86_64 //go:generate go run ./../../ build --generate-index=false --out-dir=./testdata/generated ./testdata/ld-so-conf-d-test.yaml --arch=x86_64 //go:generate go run ./../../ build --generate-index=false --out-dir=./testdata/generated ./testdata/shbang-test.yaml --arch=x86_64 //go:generate go run ./../../ build --generate-index=false --source-dir=./testdata/go-fips-bin/ --out-dir=./testdata/generated ./testdata/go-fips-bin/go-fips-bin.yaml --arch=x86_64 @@ -288,6 +289,31 @@ if diff := cmp.Diff(want, got); diff != "" { t.Errorf("Analyze(): (-want, +got):\n%s", diff) } +} + +func TestNvidiaLibrarySca(t *testing.T) { + ctx := slogtest.Context(t) + th := handleFromApk(ctx, t, "generated/x86_64/nvidia-driver-590.48.01-r0.apk", "nvidia-driver.yaml") + defer th.exp.Close() + + got := config.Dependencies{} + if err := Analyze(ctx, th, &got); err != nil { + t.Fatal(err) + } + + want := config.Dependencies{ + Runtime: []string{ + "so:libc.so.6", + "so:libdl.so.2", + "so:libm.so.6", + "so:libpthread.so.0", + "so:librt.so.1", + }, + Provides: nil, + } + if diff := cmp.Diff(want, got); diff != "" { + t.Errorf("Analyze(): (-want, +got):\n%s", diff) + } } func TestShbangDeps(t *testing.T) { Binary files old/melange-0.40.5/pkg/sca/testdata/generated/x86_64/nvidia-driver-590.48.01-r0.apk and new/melange-0.41.1/pkg/sca/testdata/generated/x86_64/nvidia-driver-590.48.01-r0.apk differ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/melange-0.40.5/pkg/sca/testdata/nvidia-driver.yaml new/melange-0.41.1/pkg/sca/testdata/nvidia-driver.yaml --- old/melange-0.40.5/pkg/sca/testdata/nvidia-driver.yaml 1970-01-01 01:00:00.000000000 +0100 +++ new/melange-0.41.1/pkg/sca/testdata/nvidia-driver.yaml 2026-02-06 22:32:47.000000000 +0100 @@ -0,0 +1,49 @@ +package: + name: nvidia-driver + version: "590.48.01" + epoch: 0 + description: NVIDIA driver userspace + copyright: + - license: LicenceRef-NVIDIA-DRIVER + license-path: NVIDIA-LICENSE + +environment: + contents: + repositories: + - https://packages.wolfi.dev/os + keyring: + - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub + packages: + - busybox + - jq + +pipeline: + - if: ${{build.arch}} == 'aarch64' + uses: fetch + with: + uri: https://us.download.nvidia.com/tesla/${{package.version}}/NVIDIA-Linux-${{build.arch}}-${{package.version}}.run + expected-sha256: 14ecfb7faa56d4d18cd9fef891b3fa2db3628f12a3e59b59d3c6e6d1a0befd80 + timeout: 30 + extract: false + + - if: ${{build.arch}} == 'x86_64' + uses: fetch + with: + uri: https://us.download.nvidia.com/tesla/${{package.version}}/NVIDIA-Linux-${{build.arch}}-${{package.version}}.run + expected-sha256: b9e2f80693781431cc87f4cd29109e133dcecb50a50d6b68d4b3bf2d696bd689 + timeout: 30 + extract: false + + - runs: | + chmod +x ./NVIDIA-Linux-${{build.arch}}-${{package.version}}.run + ./NVIDIA-Linux-${{build.arch}}-${{package.version}}.run --extract-only + cp NVIDIA-Linux-${{build.arch}}-${{package.version}}/LICENSE NVIDIA-LICENSE + + - working-directory: NVIDIA-Linux-${{build.arch}}-${{package.version}} + runs: | + mkdir -p ${{targets.contextdir}}/usr/lib + for i in libnvidia-ml.so libnvidia-allocator.so libnvidia-cfg.so; do + install -Dm0755 -t ${{targets.contextdir}}/usr/lib "$i.${{package.version}}" + ln -s "$i.${{package.version}}" ${{targets.contextdir}}/usr/lib/"$i.1" + done + ++++++ melange.obsinfo ++++++ --- /var/tmp/diff_new_pack.krv0zH/_old 2026-02-09 15:35:50.149880858 +0100 +++ /var/tmp/diff_new_pack.krv0zH/_new 2026-02-09 15:35:50.153881026 +0100 @@ -1,5 +1,5 @@ name: melange -version: 0.40.5 -mtime: 1770240947 -commit: 0f2f34dda06a67ca7b5952fe3f1f66edddfe17f1 +version: 0.41.1 +mtime: 1770413567 +commit: 61754ecffc527ac37e723f4ee766669eaac04e29 ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/melange/vendor.tar.gz /work/SRC/openSUSE:Factory/.melange.new.1670/vendor.tar.gz differ: char 82, line 1
