Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package containerized-data-importer1.65 for
openSUSE:Factory checked in at 2026-07-18 22:25:20
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/containerized-data-importer1.65 (Old)
and /work/SRC/openSUSE:Factory/.containerized-data-importer1.65.new.24530
(New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "containerized-data-importer1.65"
Sat Jul 18 22:25:20 2026 rev:2 rq:1366540 version:1.65.0
Changes:
--------
---
/work/SRC/openSUSE:Factory/containerized-data-importer1.65/containerized-data-importer1.65.changes
2026-06-22 17:25:22.465250442 +0200
+++
/work/SRC/openSUSE:Factory/.containerized-data-importer1.65.new.24530/containerized-data-importer1.65.changes
2026-07-18 22:26:40.069472578 +0200
@@ -1,0 +2,30 @@
+Sat Jul 18 16:19:17 UTC 2026 - [email protected]
+
+- Security: re-vendor the bundled Go dependencies (no upstream source
+ changes; tarball rebuilt from v1.65.0 with updated go.mod/vendor):
+ * golang.org/x/net v0.33.0 -> v0.55.0: CVE-2025-22870 (bsc#1238699),
+ CVE-2025-22872 (bsc#1241838), CVE-2025-47911 (bsc#1251495),
+ CVE-2025-58190 (bsc#1251689), CVE-2026-33814 (bsc#1265799),
+ CVE-2026-39821 (bsc#1266639), CVE-2026-25680, CVE-2026-25681,
+ CVE-2026-27136, CVE-2026-42502, CVE-2026-42506 (bsc#1267176)
+ * golang.org/x/crypto v0.31.0 -> v0.52.0: CVE-2026-39827,
+ CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831,
+ CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835,
+ CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598
+ (bsc#1266179)
+ * google.golang.org/grpc v1.65.0 -> v1.79.3: CVE-2026-33186
+ (bsc#1260295)
+ * github.com/moby/spdystream v0.4.0 -> v0.5.1: CVE-2026-35469
+ (bsc#1262269)
+ * github.com/ulikunitz/xz v0.5.12 -> v0.5.15: CVE-2025-58058
+ (bsc#1248946)
+ * github.com/go-jose/go-jose/v3 v3.0.3 -> v3.0.5: CVE-2026-34986
+ (bsc#1262952)
+- Build with Go >= 1.25 (required by golang.org/x/net 0.55; go.mod and
+ go.work directives bumped accordingly).
+- Add the tests subpackage: the upstream e2e (ginkgo) suite compiled to
+ a single static binary under /usr/share/cdi-1.65/tests/, following
+ the kubevirt*-tests precedent, so CI can run the functional tests
+ from the package instead of hand-built binaries. Fixtures excluded.
+
+-------------------------------------------------------------------
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ containerized-data-importer1.65.spec ++++++
--- /var/tmp/diff_new_pack.XTqRXN/_old 2026-07-18 22:26:41.889533676 +0200
+++ /var/tmp/diff_new_pack.XTqRXN/_new 2026-07-18 22:26:41.893533809 +0200
@@ -46,7 +46,7 @@
BuildRequires: pkgconfig
BuildRequires: rsync
BuildRequires: sed
-BuildRequires: golang(API) >= 1.22
+BuildRequires: golang(API) >= 1.25
ExclusiveArch: %{_exclusive_arch}
%description
@@ -143,6 +143,18 @@
This contains the built YAML manifests used to install CDI into a
kubernetes installation with kubectl apply.
+%package tests
+Summary: Compiled end-to-end test suite for CDI
+Provides: containerized-data-importer-tests = %{version}-%{release}
+Obsoletes: containerized-data-importer-tests < %{version}-%{release}
+Provides: containerized-data-importer-1.65-tests = %{version}-%{release}
+Obsoletes: containerized-data-importer-1.65-tests < %{version}-%{release}
+
+%description tests
+The upstream CDI functional (ginkgo) test suite compiled to a single
+binary, for running the e2e tests against a deployed CDI. Test fixture
+images are not included; a test runner supplies them.
+
%package -n obs-service-cdi1.65_containers_meta
Provides: obs-service-cdi_containers_meta = %{version}-%{release}
Obsoletes: obs-service-cdi_containers_meta < %{version}-%{release}
@@ -267,6 +279,12 @@
env DOCKER_PREFIX=$reg_path DOCKER_TAG=%{version}-%{release}
./hack/build/build-manifests.sh
+# Compiled ginkgo e2e suite (-tests subpackage). Static (CGO off) so the
+# test-runner container needs no extra libs; runs in the repo's go workspace
+# with the vendored deps like the main build.
+mkdir -p _out/tests
+CGO_ENABLED=0 GOFLAGS="-mod=vendor" go test -c -o _out/tests/cdi-tests ./tests/
+
%install
mkdir -p %{buildroot}%{_bindir}
@@ -293,6 +311,10 @@
install -m 0644 _out/manifests/release/cdi-operator.yaml
%{buildroot}%{_datadir}/cdi-1.65/manifests/release/
install -m 0644 _out/manifests/release/cdi-cr.yaml
%{buildroot}%{_datadir}/cdi-1.65/manifests/release/
+# Install the compiled e2e suite
+mkdir -p %{buildroot}%{_datadir}/cdi-1.65/tests
+install -p -m 0755 _out/tests/cdi-tests %{buildroot}%{_datadir}/cdi-1.65/tests/
+
# Install cdi_containers_meta build service
mkdir -p %{buildroot}%{_prefix}/lib/obs/service
install -m 0755 %{S:1} %{buildroot}%{_prefix}/lib/obs/service
@@ -343,6 +365,11 @@
%dir %{_datadir}/cdi-1.65
%{_datadir}/cdi-1.65/manifests
+%files tests
+%dir %{_datadir}/cdi-1.65
+%dir %{_datadir}/cdi-1.65/tests
+%{_datadir}/cdi-1.65/tests/cdi-tests
+
%files -n obs-service-cdi1.65_containers_meta
%license LICENSE
%doc README.md
++++++ containerized-data-importer-1.65.0.tar.gz ++++++
/work/SRC/openSUSE:Factory/containerized-data-importer1.65/containerized-data-importer-1.65.0.tar.gz
/work/SRC/openSUSE:Factory/.containerized-data-importer1.65.new.24530/containerized-data-importer-1.65.0.tar.gz
differ: char 12, line 1
