Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package openbao for openSUSE:Factory checked in at 2026-07-15 16:52:29 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/openbao (Old) and /work/SRC/openSUSE:Factory/.openbao.new.1991 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "openbao" Wed Jul 15 16:52:29 2026 rev:22 rq:1365823 version:2.6.0 Changes: -------- --- /work/SRC/openSUSE:Factory/openbao/openbao.changes 2026-06-18 18:44:32.042829535 +0200 +++ /work/SRC/openSUSE:Factory/.openbao.new.1991/openbao.changes 2026-07-15 17:11:04.578455786 +0200 @@ -1,0 +2,314 @@ +Wed Jul 15 04:56:36 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 2.6.0: + * FEATURES + - Namespace Sealing: Allow Shamir seal configuration on + namespace creation. [GH-3297] + - Partitions tenant storage with distinct cryptographic key + material. + - Allows tenants to revoke access to their namespace via seal + operation without impacting other tenants. + - Uses global synchronization of namespace seal status, + allowing easier management from multi-node deployments. + - Auto Unseal plugins: Add a new kms plugin type that enables + Auto Unseal mechanisms to be distributed as external binary + plugins. [GH-2586] + - Declaratively register KMS plugins via plugin "kms" "name" + { } stanzas in the server configuration, making "name" + available as an Auto Unseal mechanism via seal "name" { }. + - KMS plugins automatically restart and recover from crashes, + avoiding a full instance restart when a seal reaches a bad + state (e.g., via a misbehaving PKCS#11 library). + - Pre-built plugins for many of the seals currently built + into OpenBao are available at + https://github.com/openbao/openbao-plugins. A plugin-based + seal takes priority over a built-in seal if a matching + plugin is installed. Note that several provider-specific + built-in seals will be removed from OpenBao in v2.7.0 and + remain available as external plugins only. Also see the + deprecations section of these release notes. + - Develop custom Auto Unseal mechanisms tailored to your use + case using the SDK. + - Workflows: This adds new endpoints under sys/workflows to + allow operators to create workflows and users to execute + them. + - Workflows allow the creation of simplified or managed + interfaces over OpenBao's standard API. + - Use of the allow_unauthenticated_workflows server + configuration value enables unauthenticated execution of + workflows; any dispatched requests still require + authentication but this can be provided as a request + parameter. + - Workflows are built on the common profile engine powering + declarative self-initialization and use the same syntax. + [GH-2728] + - Authenticated root generation: New /sys/generate-root-token + endpoints are available as replacements for the deprecated + unauthenticated ones. [GH-3041] + * SECURITY + - command/agent: Ensure previously rendered secrets do not + appear in stdout on failures. GHSA-444v-8vxr-p36h. [GH-3494] + - core/recovery: Use constant-time token comparison in recovery + mode. GHSA-34fc-gh42-pj53. [GH-3388] + - core/policies: Prevent LIST operations bypassing capabilities + = ["deny"] from a more specific wildcard ACL grant. + GHSA-xp3c-3jw3-4vcr. [GH-3389] + - core/policies: If the value of a template expression contains + a + or * character, it will now be rejected by default. Set + allow_wildcards_in_identity_templates = true to overwrite. + GHSA-59w7-v8rr-pr4p. [GH-3401] + - core/policies: If the value of a template expression contains + a / character, it will now be rejected by default. Set + allow_slashes_in_identity_templates = true to overwrite. + GHSA-59w7-v8rr-pr4p. [GH-3401] + - secret/pki: If the value of a template expression in + allowed_uri_sans_template and allowed_domains contains a * + character, it will now be rejected by default. Set + allow_globs_in_identity_templates = true to overwrite. + GHSA-59w7-v8rr-pr4p. [GH-3401] + - secret/ssh: If the value of a template expression in + allowed_users or allowed_domains contains a , character, it + will now be rejected by default. Set + allow_commas_in_identity_templates = true to overwrite. + GHSA-59w7-v8rr-pr4p. [GH-3401] + * IMPROVEMENTS + - command: Allow overriding the location of ~/.vault-token via + the BAO_TOKEN_PATH environment variable. [GH-2706] + - command/server: Error when unknown keys are present in the + declarative self-initialization configuration. [GH-2883] + - command/server: Add CEL support to self-initialization, + allowing finer control over structuring requests. [GH-2671] + - command/server: Add text/template support to + self-initialization, allowing templating of values from other + requests/responses. [GH-2727] + - command/server: Allow conditional execution of + self-initialization requests with when keyword. [GH-2739] + - command/server: Allow self-initialization stanzas in + development server mode. [GH-2463] + - command/server: Allow setting headers on declarative + self-initialization requests. [GH-2737] + - command/agent: Add uid and gid configuration options for the + file sink. [GH-2851] + - command/agent: SIGHUP now reloads the client TLS + configuration. [GH-3038] + - command/login: Support Kubernetes service account token + authentication via -method=kubernetes with both interactive + and non-interactive modes. [GH-1891] + - http: Always include full JSON parse and complexity errors in + the response instead of hiding it behind a constant error + message. [GH-3240] + - http: Ensure that passthrough_request_headers can pass the + Host header to plugins. [GH-3325] + - core: The sys/ backend is now a singleton shared across all + namespaces, reducing idle memory usage of the OpenBao + instance. [GH-3007] + - core/leases: Lease lookup responses will now include path, + namespace_path and revoke_error. [GH-1906] + - core/listeners: Add a parameter to allow cross-origin + requests to include credentials + (Access-Control-Allow-Credentials header). [GH-2262] + - core/profiles: Canonicalize headers before evaluating + request. [GH-3465] + - core/profiles: Parse login MFA from request header + information. [GH-3465] + - seal/azurekeyvault: Support explicitly setting Azure + authentication methods and add support for authenticating + using Azure managed identities. [GH-2519] + - seal/pkcs11: When using public/private key encryption, fall + back to finding the public key via the private key's CKA_ID + if both key halves did not share the same CKA_LABEL. + [GH-3231] + - physical/raft: Detect, log, and rollback transactions that + have never been committed or rolled-back. If you see the + message "transaction was leaked" in your logs, please open an + issue. [GH-2185] + - physical/raft: Improve snapshot duration while slightly + increasing snapshot size. [GH-3061] + - physical/raft: Support auto_join via DNS SRV records. + [GH-3397] + - auth/cert: Add support for X-Tls-Client-Cert, to allow + processing of a leaf certificate forwarded from a + TLS-terminating reverse proxy. [GH-2080] + - auth/jwt: Add new Kubernetes JWT provider that authenticates + to the Kubernetes API using a pod's service account token. + [GH-2114] + - auth/kerberos: Add the decode_pac option in order to improve + compatibility with Kerberos systems. [GH-2211] + - auth/userpass: Add password_hash field to allow providing a + pre-hashed bcrypt password instead of plaintext. [GH-2702] + - secrets/pki: Add encode_json and decode_json CEL helpers. + [GH-1549] + - secrets/totp: Add generated, expire_time, and period fields + to code generation response. [GH-2585] + - secrets/ssh: Search for public and private key files if + -public-key-path and -private-key-path flags aren't given, + respectively. [GH-2419] + - database/mysql: Add multi-host connection failover support. + Connection URLs can now specify multiple hosts (e.g., + tcp(host1:3306,host2:3306)) for automatic failover when a + host becomes unavailable. [GH-2312] + - api, sdk: Add additional constants for commonly used headers. + [GH-2323] + - api: Add ClientCertBytes and ClientKeyBytes as possible + in-memory cert contents in TLSConfig. [GH-2798] + - api: Add first-class support for /sys/namespaces APIs via + .Sys().CreateNamespace(...) & co. [GH-2955] + - api: Add methods to list and scan keys to the KVv1 and KVv2 + client. [GH-3220] + - api: Allow disabling automatic configuration from environment + variables in the API client via a DisableEnvironment field on + Config and a NewConfig constructor to create clean client + configurations. [GH-2834] + - sdk/helper/consts: Add AllowedJWTSignatureAlgorithmsEAB. + [GH-2464] + - ui: Add lang="en" attribute to html tag. [GH-2580] + - ui: Update EmberJS to v4.12 LTS. [GH-2653] + * CHANGES + - command: Remove buffering and delayed release of logs during + startup phase of server, agent, proxy & debug subcommands. + This includes the removal of the undocumented and hidden + -disable-gated-logs flag. [GH-2620] + - command: operator generate-root now uses the authenticated + /sys/generate-root-token endpoints instead of the deprecated + /sys/generate-root endpoints. [GH-3190] + - core: net/http.ServeMux in Go 1.26 now uses a 307 redirect + instead of a 301 redirect when given a bare path which + doesn't exist in the multiplexer but which a path with a + trailing slash exists for. This causes some POST/PUT + operations to fail with a 400 instead of 404, as OpenBao does + not allow writes to paths ending in a slash. See also: + https://go.dev/doc/go1.26. [GH-3072] + - core/identity: Remove corrupt namespace identity groups + created prior to v2.5.0 during unseal; affected groups must + be recreated by an administrator. Check for deleting corrupt + group in server startup logs. [GH-2454] + - sys/init, sys/rekey/init: The stored_shares parameter was + removed and will now be ignored. [GH-2662] + - sys/seal-status: Renamed misleading build_date response field + to commit_date. [GH-2678] + - sys/version-history: Renamed misleading build_date response + field to commit_date. [GH-2678] + - api: Removed the StoredShares field from InitRequest and + RotateInitRequest structs. [GH-2662] + - api: (*Sys).GenerateRoot* methods now use the authenticated + /sys/generate-root-token endpoints instead of the deprecated + /sys/generate-root endpoints. [GH-3190] + - packaging: Renamed misleading ldflags definition BuildDate to + CommitDate. Build systems need to adjust their pipelines to + reflect this change. [GH-2678] + - packaging/container: Removed name, maintainer, vendor, + version, release, revision, summary, and description labels + from container images in favor of the already attached + OpenContainers labels. If you have tooling that relies on + these labels, instruct it to use the OpenContainers labels + instead. [GH-2589] + - packaging/container: The openbao & openbao-hsm container + images now run under the openbao user rather than the root + user by default, matching the default behavior of openbao-ubi + variants: Note that the container entrypoint will always drop + down to the openbao user before starting OpenBao even if + started as root. The additional capabilities are only used + pre-startup to automatically fix up permissions of files + accessed by OpenBao. [GH-2589] If you rely on the container + initially running as root by default, you can revert to this + behavior by manually specifying the user in your container + engine. + - packaging/ui: Switch from yarn to pnpm. [GH-2791] + - releases: Artifacts on GitHub now follow consistent naming + across archives, SBOMs and signatures. Most notably, "x86_64" + or "amd64" is now always "amd64", and the operating system is + always lowercased. [GH-3209] + - releases: Checksums are now provided as a single, + consolidated checksums.txt artifact as opposed to per-OS + checksum files such as checksums-linux.txt. [GH-3209] + * BUG FIXES + - command: Fix bao operator rotate-keys and bao operator rekey + warning about new key shares when rotating the barrier root + key only. [GH-2648] + - command/agent: Fix in-memory sink panic when proxying + auth/token/lookup-self while unauthenticated. [GH-3462] + - command/server: Revoke the transient root token after + declarative self-initialization, including failure paths. + [GH-3346] + - core: Propagate keyring upgrades of sealable namespaces to + read-enabled standby nodes. [GH-3409] + - core/seal: Fix /sys/rotate/root/update returning a random, + unused key share value when rotating the barrier root key + using recovery keys. [GH-2648] + - core/listeners: Close HTTP servers first before closing the + underlying listener. [GH-2703] + - core/namespaces: Fix PATCH on a namespace returning status + 500 on missing or nonexistent namespace. [GH-2955] + - core/audit: Ensure config-driven audit mounts are removed + from storage when removed from configuration. [GH-3488] + - core/audit: Include request.id for path-help audit entries + [GH-3440] + - core/auth: Ensure inline auth does not generate in-memory + lease information. [GH-3343] + - core/mfa: Handle invalidation for login MFA within + namespaces, ensuring standby nodes respond appropriately on + writes. [GH-3283] + - core/workflows: Ensure logical.Request.Connection is set to + allow certificate auth and login MFA to work. [GH-3465] + - seal/pkcs11: Fix "invalid key format" error when key_id is + provided but key_label is not. [GH-3231] + - seal/pkcs11: Properly strip hex prefix when setting key_id as + hex value. [GH-3231] + - physical/raft: Forward bootstrap challenge/answer requests to + active node, fixing raft join failures via load balancer. + [GH-2976] + - sys/plugin: Fix plugin reload returning success for + non-existent plugin. [GH-2398] + - sys/quotas: Fix unintentional attempts to delete quotas on + standby nodes when mount is removed. [GH-3316] + - sys/raw: Prevent writes to and return distinctive error + reading storage associated with sealed namespaces. [GH-3426] + - secrets/pki: Add missing migration for not_after_bound and + not_before_bound role fields. [GH-3031] + - secrets/pki: /sign-verbatim now preserves the original + subject encoding from the CSR. Previously, UTF8String values + were re-encoded as PrintableString when the subject contained + only ASCII characters. [GH-2861] + - openapi: Add missing support for reporting SCAN on endpoints. + [GH-2902] + - openapi: Add missing support for reporting PATCH support on + endpoints. [GH-3289 + * DEPRECATIONS + - core/seal: Following the introduction of pluggable Auto + Unseal support in this release, the built-in versions of the + alicloudkms, awskms, azurekeyvault, gcpckms, ocikms and + pkcs11 Auto Unseal mechanisms will be removed in v2.7.0 and + remain available as external plugins only. [GH-2586] + - physical/file: Deprecate file storage backend for removal in + v2.7.0. [GH-2849] + - packaging, seal/pkcs11: Following the introduction of + pluginized HSM/PKCS#11 Auto Unseal support in this release, + the HSM distribution of OpenBao will be discontinued by + v2.7.0. PKCS#11 support remains available via the PKCS#11 + plugin which can be used together with the standard + distribution of OpenBao. [GH-2586] + - packaging: Drop builds for 32-bit ARM Windows as part of its + removal from Go 1.26. [GH-3191] + - packaging/container: Architecture-specific container image + tags such as openbao/openbao:2.6.0-arm64 will not be + published starting with this release. Refer to multi-arch + container images instead (simply openbao/openbao:2.6.0). + [GH-3209] + - auth/kerberos: The built-in Kerberos auth plugin has been ++++ 17 more lines (skipped) ++++ between /work/SRC/openSUSE:Factory/openbao/openbao.changes ++++ and /work/SRC/openSUSE:Factory/.openbao.new.1991/openbao.changes Old: ---- openbao-2.5.5.obscpio ui-2.5.5.tar.gz New: ---- openbao-2.6.0.obscpio ui-2.6.0.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ openbao.spec ++++++ --- /var/tmp/diff_new_pack.bpC5Hr/_old 2026-07-15 17:11:14.518794594 +0200 +++ /var/tmp/diff_new_pack.bpC5Hr/_new 2026-07-15 17:11:14.530795003 +0200 @@ -23,7 +23,7 @@ %define short_executable_name bao Name: openbao -Version: 2.5.5 +Version: 2.6.0 Release: 0 Summary: Manage, store, and distribute sensitive data License: MPL-2.0 @@ -155,6 +155,8 @@ go generate $SDK_PACKAGES cd .. +COMMIT_HASH="$(sed -n 's/commit: \(.*\)/\1/p' %_sourcedir/%{name}.obsinfo)" + DATE_FMT="+%%Y-%%m-%%dT%%H:%%M:%%SZ" BUILD_DATE=$(date -u -d "@${SOURCE_DATE_EPOCH}" "${DATE_FMT}" 2>/dev/null || date -u -r "${SOURCE_DATE_EPOCH}" "${DATE_FMT}" 2>/dev/null || date -u "${DATE_FMT}") @@ -168,9 +170,10 @@ -mod=vendor \ -buildmode=pie \ -ldflags=" \ - -X github.com/openbao/openbao/version.GitCommit=v%{version} \ - -X github.com/openbao/openbao/version.BuildDate=${BUILD_DATE}" \ - -tags="openbao ui" \ + -X github.com/openbao/openbao/version.fullVersion=%{version} \ + -X github.com/openbao/openbao/version.GitCommit=${COMMIT_HASH} \ + -X github.com/openbao/openbao/version.CommitDate=${BUILD_DATE}" \ + -tags="ui" \ -o bin/openbao . # @@ -273,7 +276,8 @@ %service_del_postun %{agent_service_name} %check -%{buildroot}/%{_bindir}/%{name} version | grep v%{version} +%{buildroot}/%{_bindir}/%{name} version +%{buildroot}/%{_bindir}/%{name} version | grep %{version} %files %doc README.md ++++++ _service ++++++ --- /var/tmp/diff_new_pack.bpC5Hr/_old 2026-07-15 17:11:14.778803457 +0200 +++ /var/tmp/diff_new_pack.bpC5Hr/_new 2026-07-15 17:11:14.806804411 +0200 @@ -1,8 +1,8 @@ <services> <service name="obs_scm" mode="manual"> - <param name="url">https://github.com/openbao/openbao</param> + <param name="url">https://github.com/openbao/openbao.git</param> <param name="scm">git</param> - <param name="revision">v2.5.5</param> + <param name="revision">refs/tags/v2.6.0</param> <param name="package-meta">yes</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.bpC5Hr/_old 2026-07-15 17:11:15.038812319 +0200 +++ /var/tmp/diff_new_pack.bpC5Hr/_new 2026-07-15 17:11:15.066813273 +0200 @@ -1,6 +1,8 @@ <servicedata> <service name="tar_scm"> <param name="url">https://github.com/openbao/openbao</param> - <param name="changesrevision">028992583c693c4de6350b8aa52ff85e30375a99</param></service></servicedata> + <param name="changesrevision">028992583c693c4de6350b8aa52ff85e30375a99</param></service><service name="tar_scm"> + <param name="url">https://github.com/openbao/openbao.git</param> + <param name="changesrevision">03e3a243b6f07d17c60ce0a182adee7cf4c424eb</param></service></servicedata> (No newline at EOF) ++++++ openbao-2.5.5.obscpio -> openbao-2.6.0.obscpio ++++++ /work/SRC/openSUSE:Factory/openbao/openbao-2.5.5.obscpio /work/SRC/openSUSE:Factory/.openbao.new.1991/openbao-2.6.0.obscpio differ: char 19, line 1 ++++++ openbao.obsinfo ++++++ --- /var/tmp/diff_new_pack.bpC5Hr/_old 2026-07-15 17:11:15.362823362 +0200 +++ /var/tmp/diff_new_pack.bpC5Hr/_new 2026-07-15 17:11:15.374823771 +0200 @@ -1,5 +1,5 @@ name: openbao -version: 2.5.5 -mtime: 1781694211 -commit: 028992583c693c4de6350b8aa52ff85e30375a99 +version: 2.6.0 +mtime: 1784046841 +commit: 03e3a243b6f07d17c60ce0a182adee7cf4c424eb ++++++ prepare_webassets.sh ++++++ --- /var/tmp/diff_new_pack.bpC5Hr/_old 2026-07-15 17:11:15.478827316 +0200 +++ /var/tmp/diff_new_pack.bpC5Hr/_new 2026-07-15 17:11:15.498827998 +0200 @@ -18,8 +18,8 @@ gawk \ make \ git-core \ - yarn \ npm \ + pnpm \ "${nodejs_package}" version="$( awk '/^Version:/ {print $2;exit;}' "${package_name}.spec" )" ++++++ ui-2.5.5.tar.gz -> ui-2.6.0.tar.gz ++++++ /work/SRC/openSUSE:Factory/openbao/ui-2.5.5.tar.gz /work/SRC/openSUSE:Factory/.openbao.new.1991/ui-2.6.0.tar.gz differ: char 13, line 1 ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/openbao/vendor.tar.gz /work/SRC/openSUSE:Factory/.openbao.new.1991/vendor.tar.gz differ: char 13, line 1
