Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package product-composer for
openSUSE:Factory checked in at 2026-02-20 17:42:49
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/product-composer (Old)
and /work/SRC/openSUSE:Factory/.product-composer.new.1977 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "product-composer"
Fri Feb 20 17:42:49 2026 rev:50 rq:1334057 version:0.9.1
Changes:
--------
--- /work/SRC/openSUSE:Factory/product-composer/product-composer.changes
2026-01-23 17:34:35.121688816 +0100
+++
/work/SRC/openSUSE:Factory/.product-composer.new.1977/product-composer.changes
2026-02-20 17:50:55.144253808 +0100
@@ -1,0 +2,23 @@
+Thu Feb 19 18:24:39 UTC 2026 - Adrian Schröter <[email protected]>
+
+- update to version 0.9.1
+ build options added
+ - discard_artifacts : can be used for test builds to drop
+ the binaries, but keep meta files for
+ inspection
+ - enable_cmssign : for post QA signing support by OBS
+
+-------------------------------------------------------------------
+Wed Feb 11 14:52:07 UTC 2026 - Adrian Schröter <[email protected]>
+
+- update to version 0.9.0
+ - Create SHA-512 instead of SHA-256 checksum files for isos.
+ - To configure in addition (or instead) SHA-256 ones extend
+ the iso section in the productcompose file like this:
+
+ iso:
+ checksums:
+ - sha256
+ - sha512
+
+-------------------------------------------------------------------
Old:
----
product-composer-0.8.2.tar.xz
New:
----
product-composer-0.9.1.tar.xz
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ product-composer.spec ++++++
--- /var/tmp/diff_new_pack.XlLBga/_old 2026-02-20 17:50:58.956413181 +0100
+++ /var/tmp/diff_new_pack.XlLBga/_new 2026-02-20 17:50:58.972413849 +0100
@@ -23,7 +23,7 @@
%endif
Name: product-composer
-Version: 0.8.2
+Version: 0.9.1
Release: 0
Summary: Product Composer
License: GPL-2.0-or-later
++++++ _scmsync.obsinfo ++++++
--- /var/tmp/diff_new_pack.XlLBga/_old 2026-02-20 17:50:59.360430072 +0100
+++ /var/tmp/diff_new_pack.XlLBga/_new 2026-02-20 17:50:59.396431576 +0100
@@ -1,5 +1,5 @@
-mtime: 1769161003
-commit: 0d6baa576a429d2922e4d3421cee81b43e2924552389690d8a503436af94b53d
+mtime: 1771527461
+commit: a1d847a5d1ee7f025220d6beb4b33de3269a19d46735322eea1be4bdcdbe2508
url: https://src.opensuse.org/tools/product-composer
revision: devel
++++++ _service ++++++
--- /var/tmp/diff_new_pack.XlLBga/_old 2026-02-20 17:50:59.608440440 +0100
+++ /var/tmp/diff_new_pack.XlLBga/_new 2026-02-20 17:50:59.656442446 +0100
@@ -2,8 +2,8 @@
<service name="obs_scm" mode="manual">
<param name="url">https://github.com/openSUSE/product-composer</param>
<param name="scm">git</param>
- <param name="revision">0.8.2</param>
- <param name="version">0.8.2</param>
+ <param name="revision">0.9.1</param>
+ <param name="version">0.9.1</param>
</service>
<service name="tar" mode="manual" />
<service name="recompress" mode="manual">
++++++ build.specials.obscpio ++++++
++++++ build.specials.obscpio ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/.gitignore new/.gitignore
--- old/.gitignore 1970-01-01 01:00:00.000000000 +0100
+++ new/.gitignore 2026-02-19 20:02:01.000000000 +0100
@@ -0,0 +1,5 @@
+.osc
+*.obscpio
+*.osc
+*.obscpio
+*.osc
++++++ product-composer-0.8.2.tar.xz -> product-composer-0.9.1.tar.xz ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/product-composer-0.8.2/docs/build_description.adoc
new/product-composer-0.9.1/docs/build_description.adoc
--- old/product-composer-0.8.2/docs/build_description.adoc 2026-01-23
10:18:18.000000000 +0100
+++ new/product-composer-0.9.1/docs/build_description.adoc 2026-02-19
19:23:37.000000000 +0100
@@ -239,11 +239,22 @@
Enabling this would result in a simply repacked base image, without
any package copied there.
+===== discard_artifacts
+
+Run the full build, but remove all iso and rpm trees in the end.
+Just SBOM files remain. This is intended for test builds. The
+install check can still get used.
+
+===== enable_cmssign
+
+Creating a cms signature file. Currently only a dummy file
+to be filled by OBS intrastructure.
+
===== no_product_provides
Product composer is validating by default that a rpm package is providing
the same product as well via a cpeid provider. It aborts when no
-matching providers is found.
+matching provider is found.
This option can be used to acknowledge that no product provider for the
product is available. Also no other product must be provided then.
@@ -266,6 +277,18 @@
Can be set to "drop" for creating only the iso files.
+===== joliet
+
+Can be set to false to skip joliet name generation.
+May be useful when running into limits, eg. due to
+file name length limits.
+
+===== checksums
+
+Define checksums to be generated. Currently supported ones
+are sha256 and sha512. sha512 is the default. Both or none
+may be listed.
+
===== base
Can be used to copy the result into a pre generated iso file.
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/product-composer-0.8.2/docs/productcomposer.html
new/product-composer-0.9.1/docs/productcomposer.html
--- old/product-composer-0.8.2/docs/productcomposer.html 2026-01-23
10:18:18.000000000 +0100
+++ new/product-composer-0.9.1/docs/productcomposer.html 2026-02-19
19:23:37.000000000 +0100
@@ -1062,6 +1062,27 @@
<div class="paragraph"><p>Enabling this would result in a simply repacked base
image, without
any package copied there.</p></div>
</div>
+<div class="sect4">
+<h5 id="_discard_artifacts">discard_artifacts</h5>
+<div class="paragraph"><p>Run the full build, but remove all iso and rpm trees
in the end.
+Just SBOM files remain. This is intended for test builds. The
+install check can still get used.</p></div>
+</div>
+<div class="sect4">
+<h5 id="_enable_cmssign">enable_cmssign</h5>
+<div class="paragraph"><p>Creating a cms signature file. Currently only a
dummy file
+to be filled by OBS intrastructure.</p></div>
+</div>
+<div class="sect4">
+<h5 id="_no_product_provides">no_product_provides</h5>
+<div class="paragraph"><p>Product composer is validating by default that a rpm
package is providing
+the same product as well via a cpeid provider. It aborts when no
+matching provider is found.</p></div>
+<div class="paragraph"><p>This option can be used to acknowledge that no
product provider for the
+product is available. Also no other product must be provided then.</p></div>
+<div class="paragraph"><p>Use with care as it breaks handling of such
repositories with management
+solutions like Multi-Linux-Manager.</p></div>
+</div>
</div>
<div class="sect3">
<h4 id="_iso_2">5.8.12. iso</h4>
@@ -1078,6 +1099,18 @@
<div class="paragraph"><p>Can be set to "drop" for creating only the iso
files.</p></div>
</div>
<div class="sect4">
+<h5 id="_joliet">joliet</h5>
+<div class="paragraph"><p>Can be set to false to skip joliet name generation.
+May be useful when running into limits, eg. due to
+file name length limits.</p></div>
+</div>
+<div class="sect4">
+<h5 id="_checksums">checksums</h5>
+<div class="paragraph"><p>Define checksums to be generated. Currently
supported ones
+are sha256 and sha512. sha512 is the default. Both or none
+may be listed.</p></div>
+</div>
+<div class="sect4">
<h5 id="_base">base</h5>
<div class="paragraph"><p>Can be used to copy the result into a pre generated
iso file.
product-composer itself is not creating bootable iso images,
@@ -1230,7 +1263,7 @@
<div id="footer">
<div id="footer-text">
Last updated
- 2025-05-27 10:43:38 CEST
+ 2025-05-02 11:43:20 CEST
</div>
</div>
</body>
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/product-composer-0.8.2/examples/ftp.productcompose
new/product-composer-0.9.1/examples/ftp.productcompose
--- old/product-composer-0.8.2/examples/ftp.productcompose 2026-01-23
10:18:18.000000000 +0100
+++ new/product-composer-0.9.1/examples/ftp.productcompose 2026-02-19
19:23:37.000000000 +0100
@@ -28,6 +28,9 @@
volume_id: 'Pop'
# tree: 'drop'
# base: 'agama-installer'
+# checksums:
+# - sha256
+# - sha512
build_options:
### For maintenance, otherwise only "the best" version of each package is
picked:
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/product-composer-0.8.2/src/productcomposer/createartifacts/createagamaiso.py
new/product-composer-0.9.1/src/productcomposer/createartifacts/createagamaiso.py
---
old/product-composer-0.8.2/src/productcomposer/createartifacts/createagamaiso.py
2026-01-23 10:18:18.000000000 +0100
+++
new/product-composer-0.9.1/src/productcomposer/createartifacts/createagamaiso.py
2026-02-19 19:23:37.000000000 +0100
@@ -1,9 +1,10 @@
import os
import shutil
import glob
+from .. import defaults
from ..utils.loggerutils import (note, die)
from ..utils.runhelper import run_helper
-from ..utils.cryptoutils import create_sha256_for
+from ..utils.cryptoutils import create_sha_for
from ..config import (verbose_level, ISO_PREPARER)
def create_agama_iso(outdir, isoconf, build_options, pool, workdir,
application_id, arch):
@@ -49,5 +50,7 @@
# just for the bootable image, signature is not yet applied, so ignore
that error
# FIXME: fatal=False due to unknown reported El Torrito error on s390x atm.
run_helper(['verifymedia', workdir + '.install.iso', '--ignore', 'ISO is
signed'], fatal=False, failmsg="verify install.iso")
- # creating .sha256 for iso file
- create_sha256_for(workdir + '.install.iso')
+ # creating .sha256/.sha512 for iso file
+ checksums = isoconf['checksums'] or [defaults.ISO_CHECKSUM_TYPE]
+ for checksum in checksums:
+ create_sha_for(workdir + ".install.iso", checksum)
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/product-composer-0.8.2/src/productcomposer/createartifacts/createiso.py
new/product-composer-0.9.1/src/productcomposer/createartifacts/createiso.py
--- old/product-composer-0.8.2/src/productcomposer/createartifacts/createiso.py
2026-01-23 10:18:18.000000000 +0100
+++ new/product-composer-0.9.1/src/productcomposer/createartifacts/createiso.py
2026-02-19 19:23:37.000000000 +0100
@@ -1,7 +1,8 @@
from ..utils.runhelper import run_helper
from ..config import (verbose_level, ISO_PREPARER)
-from ..utils.cryptoutils import create_sha256_for
+from ..utils.cryptoutils import create_sha_for
+from .. import defaults
def create_iso(outdir, isoconf, workdir, application_id):
verbose = True if verbose_level > 0 else False
@@ -19,5 +20,7 @@
# simple tag media call ... we may add options for pading or triggering
media check later
args = ['tagmedia', '--digest', 'sha256', workdir + '.iso']
run_helper(args, cwd=outdir, failmsg="tagmedia iso file", verbose=verbose)
- # creating .sha256 for iso file
- create_sha256_for(workdir + ".iso")
\ No newline at end of file
+ # creating .sha256 and/or .sha512 for iso file
+ checksums = isoconf['checksums'] or [defaults.ISO_CHECKSUM_TYPE]
+ for checksum in checksums:
+ create_sha_for(workdir + ".iso", checksum)
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/product-composer-0.8.2/src/productcomposer/createartifacts/createtree.py
new/product-composer-0.9.1/src/productcomposer/createartifacts/createtree.py
---
old/product-composer-0.8.2/src/productcomposer/createartifacts/createtree.py
2026-01-23 10:18:18.000000000 +0100
+++
new/product-composer-0.9.1/src/productcomposer/createartifacts/createtree.py
2026-02-19 19:23:37.000000000 +0100
@@ -203,6 +203,9 @@
# detached signature
args = ['/usr/lib/build/signdummy', '-d', repodatadir +
"/repodata/repomd.xml"]
run_helper(args, failmsg="create detached signature")
+ if 'enable_cmssign' in yml['build_options']:
+ args = ['/usr/lib/build/signdummy', '--cmssign',
repodatadir + "/repodata/repomd.xml"]
+ run_helper(args, failmsg="create cms signature")
# pubkey
with open(repodatadir + "/repodata/repomd.xml.key", 'w') as
pubkey_file:
@@ -276,3 +279,12 @@
repodatadir = workdir + "/repodata"
if os.path.exists(repodatadir):
shutil.rmtree(repodatadir)
+
+ # drop everything except selected meta data. intended for test builds
+ if 'discard_artifacts' in yml['build_options']:
+ for workdir in workdirectories:
+ for suffix in [ "", ".iso", ".install.iso" ]:
+ if os.path.exists(workdir + suffix):
+ warn("discard_artifacts enabled, removing " + workdir +
suffix)
+ shutil.rmtree(workdir + suffix)
+
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/product-composer-0.8.2/src/productcomposer/createartifacts/createupdateinfoxml.py
new/product-composer-0.9.1/src/productcomposer/createartifacts/createupdateinfoxml.py
---
old/product-composer-0.8.2/src/productcomposer/createartifacts/createupdateinfoxml.py
2026-01-23 10:18:18.000000000 +0100
+++
new/product-composer-0.9.1/src/productcomposer/createartifacts/createupdateinfoxml.py
2026-02-19 19:23:37.000000000 +0100
@@ -49,6 +49,10 @@
for u in sorted(pool.lookup_all_updateinfos()):
note("Add updateinfo " + u.location)
for update in u.root.findall('update'):
+ if update.get('type') == '_internal':
+ # just used for internal tracking, eg. patchinfo.ga
+ continue
+
needed = False
parent = update.findall('pkglist')[0].findall('collection')[0]
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/product-composer-0.8.2/src/productcomposer/defaults.py
new/product-composer-0.9.1/src/productcomposer/defaults.py
--- old/product-composer-0.8.2/src/productcomposer/defaults.py 2026-01-23
10:18:18.000000000 +0100
+++ new/product-composer-0.9.1/src/productcomposer/defaults.py 2026-02-19
19:23:37.000000000 +0100
@@ -9,3 +9,4 @@
CREATEREPO_CHECKSUM_TYPE: str = "sha512"
CREATEREPO_GENERAL_COMPRESS_TYPE: str = "zstd"
+ISO_CHECKSUM_TYPE: str = "sha512"
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/product-composer-0.8.2/src/productcomposer/utils/cryptoutils.py
new/product-composer-0.9.1/src/productcomposer/utils/cryptoutils.py
--- old/product-composer-0.8.2/src/productcomposer/utils/cryptoutils.py
2026-01-23 10:18:18.000000000 +0100
+++ new/product-composer-0.9.1/src/productcomposer/utils/cryptoutils.py
2026-02-19 19:23:37.000000000 +0100
@@ -2,13 +2,25 @@
from .runhelper import run_helper
+from .. import defaults
+from ..utils.loggerutils import die
-def create_sha256_for(filename: str) -> None:
- with open(f'{filename}.sha256', 'w') as sha_file:
+def create_sha_for(filename: str, checksum_type: str =
defaults.ISO_CHECKSUM_TYPE) -> None:
+
+ if checksum_type == "sha256":
+ suffix = '.sha256'
+ tool = 'sha256sum'
+ elif checksum_type == "sha512":
+ suffix = '.sha512'
+ tool = 'sha512sum'
+ else:
+ die(f'Unkown checksum type: {checksum_type}')
+
+ with open(f'{filename}{suffix}', 'w') as sha_file:
# argument must not have the path
run_helper(
- ['sha256sum', Path(filename).name],
+ [tool, Path(filename).name],
cwd=Path(filename).parent.absolute(),
stdout=sha_file,
- failmsg='create .sha256 file',
+ failmsg=f'create .{suffix} file'
)
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/product-composer-0.8.2/src/productcomposer/utils/rpmutils.py
new/product-composer-0.9.1/src/productcomposer/utils/rpmutils.py
--- old/product-composer-0.8.2/src/productcomposer/utils/rpmutils.py
2026-01-23 10:18:18.000000000 +0100
+++ new/product-composer-0.9.1/src/productcomposer/utils/rpmutils.py
2026-02-19 19:23:37.000000000 +0100
@@ -169,6 +169,10 @@
referenced_update_rpms = {}
for u in sorted(pool.lookup_all_updateinfos()):
for update in u.root.findall('update'):
+ if update.get('type') == '_internal':
+ # just used for internal tracking, eg. patchinfo.ga
+ continue
+
parent = update.findall('pkglist')[0].findall('collection')[0]
for pkgentry in parent.findall('package'):
referenced_update_rpms[pkgentry.get('src')] = 1
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/product-composer-0.8.2/src/productcomposer/verifiers/composeschema.py
new/product-composer-0.9.1/src/productcomposer/verifiers/composeschema.py
--- old/product-composer-0.8.2/src/productcomposer/verifiers/composeschema.py
2026-01-23 10:18:18.000000000 +0100
+++ new/product-composer-0.9.1/src/productcomposer/verifiers/composeschema.py
2026-02-19 19:23:37.000000000 +0100
@@ -12,6 +12,7 @@
tree: Optional[str] = None
base: Optional[str] = None
joliet: Optional[bool] = True
+ checksums: Optional[list[str]] = None
_compose_schema_supportstatus = Literal[
@@ -61,6 +62,8 @@
'take_all_available_versions',
'updateinfo_packages_only',
'OBS_unordered_product_repos',
+ 'discard_artifacts',
+ 'enable_cmssign',
]
compose_schema_source_and_debug = Literal['drop', 'include', 'split']
++++++ product-composer.obsinfo ++++++
--- /var/tmp/diff_new_pack.XlLBga/_old 2026-02-20 17:51:02.388556667 +0100
+++ /var/tmp/diff_new_pack.XlLBga/_new 2026-02-20 17:51:02.432558506 +0100
@@ -1,5 +1,5 @@
name: product-composer
-version: 0.8.2
-mtime: 1769159898
-commit: e9e006a14718ee2a515d4469ca266ae6bad8a009
+version: 0.9.1
+mtime: 1771525417
+commit: c3fb48d44369427148e795c79634ac9a0ee5c3e1
