Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package apptainer for openSUSE:Factory checked in at 2026-07-26 11:30:31 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/apptainer (Old) and /work/SRC/openSUSE:Factory/.apptainer.new.2004 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "apptainer" Sun Jul 26 11:30:31 2026 rev:48 rq:1367794 version:1.5.3 Changes: -------- --- /work/SRC/openSUSE:Factory/apptainer/apptainer.changes 2026-07-18 22:26:04.032262115 +0200 +++ /work/SRC/openSUSE:Factory/.apptainer.new.2004/apptainer.changes 2026-07-26 11:33:02.144141901 +0200 @@ -1,0 +2,19 @@ +Sat Jul 25 16:00:39 UTC 2026 - Egbert Eich <[email protected]> + +- Update apptainer to version 1.5.3 + + * If the ptrace() system call does not work while building an image as + an unprivileged user, skip using PRoot to preserve file ownership and + print an INFO message. + * Bind getopt from the host when using fakeroot command mode, to make + the fakeroot command work with base containers which no longer contain + getopt by default. + * Update fixes CVE-2026-56852 (GO-2026-5970) (bsc#1272115) + golang.org/x/text/unicode/norm: + A norm.Iter can enter an infinite loop when handling input + containing invalid UTF-8 bytes. +- From version 1.5.2: + * Extended the mksquashfs segmentation fault workaround for cases + where mksquashfs uses many processor cores. + +------------------------------------------------------------------- Old: ---- apptainer-1.5.1.tar.gz New: ---- apptainer-1.5.3.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ apptainer.spec ++++++ --- /var/tmp/diff_new_pack.yrT2Kz/_old 2026-07-26 11:33:05.188246781 +0200 +++ /var/tmp/diff_new_pack.yrT2Kz/_new 2026-07-26 11:33:05.188246781 +0200 @@ -31,7 +31,7 @@ License: BSD-3-Clause-LBNL AND OpenSSL Group: Productivity/Clustering/Computing Name: apptainer -Version: 1.5.1 +Version: 1.5.3 Release: 0 # https://spdx.org/licenses/BSD-3-Clause-LBNL.html URL: https://apptainer.org @@ -184,15 +184,20 @@ sed -i -e "/allow setuid/s@\(.* =\).*@\1 no@" \ %{buildroot}%{_sysconfdir}/apptainer/apptainer.conf %endif - -%check %if %{with vulncheck} +status=0 +echo "VULNCHECK START ===================================================" for i in $(find %{buildroot} -executable -and -not -type d -and -not -name "*.debug" -and -not -name "*.so*"); do file $i | grep -q "^$i: ELF" || continue - govulncheck -mode=binary -db file:///usr/share/vulndb/ $i + govulncheck -mode=binary -db file:///usr/share/vulndb/ $i || status=$? done +echo "VULNCHECK END =====================================================" +[ $status -eq 0 ] || exit $status %endif + +%check + %pre suid -f %{name}.pre %post suid ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.yrT2Kz/_old 2026-07-26 11:33:05.340252018 +0200 +++ /var/tmp/diff_new_pack.yrT2Kz/_new 2026-07-26 11:33:05.344252156 +0200 @@ -1,4 +1,4 @@ -mtime: 1784351799 -commit: a3a64bb20fcfe64b851b8fc1f1ab3498d9f26c45e61591177961a699acb6ece4 +mtime: 1785044455 +commit: 2545813e0691a23985fe7992708e8b894b5a3cc47d5611a43eaa471b41e91612 url: https://src.opensuse.org/Cluster/apptainer.git ++++++ _service ++++++ --- /var/tmp/diff_new_pack.yrT2Kz/_old 2026-07-26 11:33:05.364252845 +0200 +++ /var/tmp/diff_new_pack.yrT2Kz/_new 2026-07-26 11:33:05.368252983 +0200 @@ -1,20 +1,8 @@ <services> <service name="go_modules" mode="disabled"> <param name="replace"> - github.com/go-jose/go-jose/v4=github.com/go-jose/go-jose/[email protected] - </param> - <param name="replace"> - google.golang.org/grpc=google.golang.org/[email protected] - </param> - <param name="replace"> golang.org/x/net=golang.org/x/[email protected] </param> - <param name="replace"> - golang.org/x/crypto=golang.org/x/[email protected] - </param> - <!-- <param name="replace"> - github.com/cilium/ebpf=github.com/cilium/[email protected] - </param> --> </service> </services> ++++++ apptainer-1.5.1.tar.gz -> apptainer-1.5.3.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/apptainer-1.5.1/.github/workflows/ci.yml new/apptainer-1.5.3/.github/workflows/ci.yml --- old/apptainer-1.5.1/.github/workflows/ci.yml 2026-06-04 17:00:22.000000000 +0200 +++ new/apptainer-1.5.3/.github/workflows/ci.yml 2026-07-21 20:47:49.000000000 +0200 @@ -227,14 +227,14 @@ - name: Install and test unprivileged for openSUSE leap env: - OS_TYPE: opensuse/leap + OS_TYPE: registry.opensuse.org/opensuse/leap OS_VERSION: latest TEST_TYPE: unpriv run: ./scripts/ci-docker-run - name: Install and test unprivileged for openSUSE tumbleweed env: - OS_TYPE: opensuse/tumbleweed + OS_TYPE: registry.opensuse.org/opensuse/tumbleweed OS_VERSION: latest TEST_TYPE: unpriv run: ./scripts/ci-docker-run @@ -302,7 +302,7 @@ - name: Build and test rpm under docker env: - OS_TYPE: opensuse/leap + OS_TYPE: registry.opensuse.org/opensuse/leap OS_VERSION: latest GO_ARCH: linux-amd64 GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} @@ -310,9 +310,9 @@ - name: Install and test unprivileged for openSUSE leap env: - OS_TYPE: opensuse/leap + OS_TYPE: registry.opensuse.org/opensuse/leap OS_VERSION: latest - INS_OPTS: -o -d suse15 + INS_OPTS: -o -d opensuse-leap TEST_TYPE: unpriv run: ./scripts/ci-docker-run @@ -326,7 +326,7 @@ - name: Build and test rpm under docker env: - OS_TYPE: opensuse/tumbleweed + OS_TYPE: registry.opensuse.org/opensuse/tumbleweed OS_VERSION: latest GO_ARCH: linux-amd64 GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} @@ -334,7 +334,7 @@ - name: Install and test unprivileged for openSUSE tumbleweed env: - OS_TYPE: opensuse/tumbleweed + OS_TYPE: registry.opensuse.org/opensuse/tumbleweed OS_VERSION: latest INS_OPTS: -o -d opensuse-tumbleweed TEST_TYPE: unpriv diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/apptainer-1.5.1/CHANGELOG.md new/apptainer-1.5.3/CHANGELOG.md --- old/apptainer-1.5.1/CHANGELOG.md 2026-06-04 17:00:22.000000000 +0200 +++ new/apptainer-1.5.3/CHANGELOG.md 2026-07-21 20:47:49.000000000 +0200 @@ -5,6 +5,26 @@ and re-branded as Apptainer. For older changes see the [archived Singularity change log](https://github.com/apptainer/singularity/blob/release-3.8/CHANGELOG.md). +## v1.5.3 - \[2026-07-21\] + +- If the `ptrace()` system call does not work while building an image as + an unprivileged user, skip using PRoot to preserve file ownership and + print an INFO message. +- Bind `getopt` from the host when using fakeroot command mode, to make + the fakeroot command work with EL10 and Fedora base containers which + no longer contain getopt by default. + +## v1.5.2 - \[2026-06-23\] + +- Extended the mksquashfs segmentation fault workaround for cases where + mksquashfs uses many processor cores. +- Whe building an rpm using a Red Hat version of golang, set + GOEXPERIMENT=strictfipsruntime. That makes attempting to run non-FIPS + compliant containers on a FIPS-enabled system exit with a helpful + error message instead of a crash. +- Skip building PRoot on x86_64 Fedora 45 because of difficult to fix + compilation problems. + ## v1.5.1 - \[2026-06-04\] ### Security fix diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/apptainer-1.5.1/INSTALL.md new/apptainer-1.5.3/INSTALL.md --- old/apptainer-1.5.1/INSTALL.md 2026-06-04 17:00:22.000000000 +0200 +++ new/apptainer-1.5.3/INSTALL.md 2026-07-21 20:47:49.000000000 +0200 @@ -37,15 +37,27 @@ sudo apt-get install -y libsubid-dev ``` -On RHEL or its derivatives or Fedora: +On RHEL or its derivatives start with: ```sh # Install basic tools for compiling sudo dnf groupinstall -y 'Development Tools' -# Ensure EPEL repository is available (skip on Fedora) +# Ensure EPEL repository is available sudo dnf install -y epel-release -# Enable the CodeReady Builder repository (skip on Fedora) +# Enable the CodeReady Builder repository sudo crb enable +``` + +Or on Fedora start with: + +```sh +# Install basic tools for compiling +sudo dnf group install -y development-tools +``` + +Then on either Fedora or RHEL or its derivatives: + +```sh # Install RPM packages for dependencies sudo dnf install -y \ libseccomp-devel \ @@ -57,8 +69,8 @@ wget git ``` -For including libsubid support, use --enablerepo=devel for el8 and el9 but not -for el10 or fedora: +For including libsubid support, use --enablerepo=devel for EL8 and EL9 but not +for EL10 or Fedora: ```sh sudo dnf --enablerepo=devel install -y shadow-utils-subid-devel @@ -164,7 +176,7 @@ for example: ```sh -git checkout v1.5.1 +git checkout v1.5.3 ``` ## Compiling Apptainer @@ -211,7 +223,7 @@ zlib1g-dev liblzo2-dev liblz4-dev liblzma-dev libzstd-dev ``` -On RHEL or derivatives: +On Fedora or RHEL or derivatives: ```sh sudo dnf install -y fuse3-devel lzo-devel lz4-devel @@ -333,7 +345,7 @@ <!-- markdownlint-disable MD013 --> ```sh -VERSION=1.5.1 # this is the apptainer version, change as you need +VERSION=1.5.3 # this is the apptainer version, change as you need # Fetch the source wget https://github.com/apptainer/apptainer/releases/download/v${VERSION}/apptainer-${VERSION}.tar.gz ``` diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/apptainer-1.5.1/LICENSE_DEPENDENCIES.md new/apptainer-1.5.3/LICENSE_DEPENDENCIES.md --- old/apptainer-1.5.1/LICENSE_DEPENDENCIES.md 2026-06-04 17:00:22.000000000 +0200 +++ new/apptainer-1.5.3/LICENSE_DEPENDENCIES.md 2026-07-21 20:47:49.000000000 +0200 @@ -1467,217 +1467,6 @@ ``` -## github.com/containerd/stargz-snapshotter/estargz - -**License:** Apache-2.0 - -``` - - Apache License - Version 2.0, January 2004 - http://www.apache.org/licenses/ - - TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION - - 1. Definitions. - - "License" shall mean the terms and conditions for use, reproduction, - and distribution as defined by Sections 1 through 9 of this document. - - "Licensor" shall mean the copyright owner or entity authorized by - the copyright owner that is granting the License. - - "Legal Entity" shall mean the union of the acting entity and all - other entities that control, are controlled by, or are under common - control with that entity. For the purposes of this definition, - "control" means (i) the power, direct or indirect, to cause the - direction or management of such entity, whether by contract or - otherwise, or (ii) ownership of fifty percent (50%) or more of the - outstanding shares, or (iii) beneficial ownership of such entity. - - "You" (or "Your") shall mean an individual or Legal Entity - exercising permissions granted by this License. - - "Source" form shall mean the preferred form for making modifications, - including but not limited to software source code, documentation - source, and configuration files. - - "Object" form shall mean any form resulting from mechanical - transformation or translation of a Source form, including but - not limited to compiled object code, generated documentation, - and conversions to other media types. - - "Work" shall mean the work of authorship, whether in Source or - Object form, made available under the License, as indicated by a - copyright notice that is included in or attached to the work - (an example is provided in the Appendix below). - - "Derivative Works" shall mean any work, whether in Source or Object - form, that is based on (or derived from) the Work and for which the - editorial revisions, annotations, elaborations, or other modifications - represent, as a whole, an original work of authorship. For the purposes - of this License, Derivative Works shall not include works that remain - separable from, or merely link (or bind by name) to the interfaces of, - the Work and Derivative Works thereof. - - "Contribution" shall mean any work of authorship, including - the original version of the Work and any modifications or additions - to that Work or Derivative Works thereof, that is intentionally - submitted to Licensor for inclusion in the Work by the copyright owner - or by an individual or Legal Entity authorized to submit on behalf of - the copyright owner. For the purposes of this definition, "submitted" - means any form of electronic, verbal, or written communication sent - to the Licensor or its representatives, including but not limited to - communication on electronic mailing lists, source code control systems, - and issue tracking systems that are managed by, or on behalf of, the - Licensor for the purpose of discussing and improving the Work, but - excluding communication that is conspicuously marked or otherwise - designated in writing by the copyright owner as "Not a Contribution." - - "Contributor" shall mean Licensor and any individual or Legal Entity - on behalf of whom a Contribution has been received by Licensor and - subsequently incorporated within the Work. - - 2. Grant of Copyright License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - copyright license to reproduce, prepare Derivative Works of, - publicly display, publicly perform, sublicense, and distribute the - Work and such Derivative Works in Source or Object form. - - 3. Grant of Patent License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - (except as stated in this section) patent license to make, have made, - use, offer to sell, sell, import, and otherwise transfer the Work, - where such license applies only to those patent claims licensable - by such Contributor that are necessarily infringed by their - Contribution(s) alone or by combination of their Contribution(s) - with the Work to which such Contribution(s) was submitted. If You - institute patent litigation against any entity (including a - cross-claim or counterclaim in a lawsuit) alleging that the Work - or a Contribution incorporated within the Work constitutes direct - or contributory patent infringement, then any patent licenses - granted to You under this License for that Work shall terminate - as of the date such litigation is filed. - - 4. Redistribution. You may reproduce and distribute copies of the - Work or Derivative Works thereof in any medium, with or without - modifications, and in Source or Object form, provided that You - meet the following conditions: - - (a) You must give any other recipients of the Work or - Derivative Works a copy of this License; and - - (b) You must cause any modified files to carry prominent notices - stating that You changed the files; and - - (c) You must retain, in the Source form of any Derivative Works - that You distribute, all copyright, patent, trademark, and - attribution notices from the Source form of the Work, - excluding those notices that do not pertain to any part of - the Derivative Works; and - - (d) If the Work includes a "NOTICE" text file as part of its - distribution, then any Derivative Works that You distribute must - include a readable copy of the attribution notices contained - within such NOTICE file, excluding those notices that do not - pertain to any part of the Derivative Works, in at least one - of the following places: within a NOTICE text file distributed - as part of the Derivative Works; within the Source form or - documentation, if provided along with the Derivative Works; or, - within a display generated by the Derivative Works, if and - wherever such third-party notices normally appear. The contents - of the NOTICE file are for informational purposes only and - do not modify the License. You may add Your own attribution - notices within Derivative Works that You distribute, alongside - or as an addendum to the NOTICE text from the Work, provided - that such additional attribution notices cannot be construed - as modifying the License. - - You may add Your own copyright statement to Your modifications and - may provide additional or different license terms and conditions - for use, reproduction, or distribution of Your modifications, or - for any such Derivative Works as a whole, provided Your use, - reproduction, and distribution of the Work otherwise complies with - the conditions stated in this License. - - 5. Submission of Contributions. Unless You explicitly state otherwise, - any Contribution intentionally submitted for inclusion in the Work - by You to the Licensor shall be under the terms and conditions of - this License, without any additional terms or conditions. - Notwithstanding the above, nothing herein shall supersede or modify - the terms of any separate license agreement you may have executed - with Licensor regarding such Contributions. - - 6. Trademarks. This License does not grant permission to use the trade - names, trademarks, service marks, or product names of the Licensor, - except as required for reasonable and customary use in describing the - origin of the Work and reproducing the content of the NOTICE file. - - 7. Disclaimer of Warranty. Unless required by applicable law or - agreed to in writing, Licensor provides the Work (and each - Contributor provides its Contributions) on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or - implied, including, without limitation, any warranties or conditions - of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A - PARTICULAR PURPOSE. You are solely responsible for determining the - appropriateness of using or redistributing the Work and assume any - risks associated with Your exercise of permissions under this License. - - 8. Limitation of Liability. In no event and under no legal theory, - whether in tort (including negligence), contract, or otherwise, - unless required by applicable law (such as deliberate and grossly - negligent acts) or agreed to in writing, shall any Contributor be - liable to You for damages, including any direct, indirect, special, - incidental, or consequential damages of any character arising as a - result of this License or out of the use or inability to use the - Work (including but not limited to damages for loss of goodwill, - work stoppage, computer failure or malfunction, or any and all - other commercial damages or losses), even if such Contributor - has been advised of the possibility of such damages. - - 9. Accepting Warranty or Additional Liability. While redistributing - the Work or Derivative Works thereof, You may choose to offer, - and charge a fee for, acceptance of support, warranty, indemnity, - or other liability obligations and/or rights consistent with this - License. However, in accepting such obligations, You may act only - on Your own behalf and on Your sole responsibility, not on behalf - of any other Contributor, and only if You agree to indemnify, - defend, and hold each Contributor harmless for any liability - incurred by, or claims asserted against, such Contributor by reason - of your accepting any such warranty or additional liability. - - END OF TERMS AND CONDITIONS - - APPENDIX: How to apply the Apache License to your work. - - To apply the Apache License to your work, attach the following - boilerplate notice, with the fields enclosed by brackets "[]" - replaced with your own identifying information. (Don't include - the brackets!) The text should be enclosed in the appropriate - comment syntax for the file format. We also recommend that a - file or class name and description of purpose be included on the - same "printed page" as the copyright notice for easier - identification within third-party archives. - - Copyright [yyyy] [name of copyright owner] - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. - -``` - - ## github.com/containernetworking/cni **License:** Apache-2.0 @@ -6689,30 +6478,35 @@ ## github.com/gorilla/handlers -**License:** BSD-2-Clause +**License:** BSD-3-Clause ``` -Copyright (c) 2013 The Gorilla Handlers Authors. All rights reserved. +Copyright (c) 2023 The Gorilla Authors. All rights reserved. Redistribution and use in source and binary forms, with or without -modification, are permitted provided that the following conditions are met: - - Redistributions of source code must retain the above copyright notice, this - list of conditions and the following disclaimer. +modification, are permitted provided that the following conditions are +met: - Redistributions in binary form must reproduce the above copyright notice, - this list of conditions and the following disclaimer in the documentation - and/or other materials provided with the distribution. + * Redistributions of source code must retain the above copyright +notice, this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above +copyright notice, this list of conditions and the following disclaimer +in the documentation and/or other materials provided with the +distribution. + * Neither the name of Google Inc. nor the names of its +contributors may be used to endorse or promote products derived from +this software without specific prior written permission. -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND -ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED -WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE -FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL -DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR -SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER -CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, -OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ``` @@ -7932,36 +7726,6 @@ ``` - -## github.com/mitchellh/go-homedir - -**License:** MIT - -``` -The MIT License (MIT) - -Copyright (c) 2013 Mitchell Hashimoto - -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is -furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in -all copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN -THE SOFTWARE. - -``` - ## github.com/moby/docker-image-spec/specs-go/v1 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/apptainer-1.5.1/dist/rpm/apptainer.spec.in new/apptainer-1.5.3/dist/rpm/apptainer.spec.in --- old/apptainer-1.5.1/dist/rpm/apptainer.spec.in 2026-06-04 17:00:22.000000000 +0200 +++ new/apptainer-1.5.3/dist/rpm/apptainer.spec.in 2026-07-21 20:47:49.000000000 +0200 @@ -35,8 +35,13 @@ %global fuse_overlayfs_version 1.16 %global squashfs_tools_version 4.7.5 %ifnarch ppc64le s390x +%if 0%{?fedora} < 45 || "%{_arch}" != "x86_64" +# On fedora45 x86_64 building PRoot dies with +# "relocation truncated to fit: R_X86_64_PC32 against `.rodata'" +# See https://github.com/proot-me/proot/issues/414 %global PRoot_version 5.4.0-rootless.3 %endif +%endif # The last singularity version number in EPEL/Fedora %global last_singularity_version 3.8.7-3 @@ -184,6 +189,13 @@ %endif %build +if go version | grep -q "Red Hat"; then + # With Red Hat's golang this changes crashes when running non-FIPS + # compliant containers on FIPS-enabled machines into helpful error + # messages. + export GOEXPERIMENT=strictfipsruntime +fi + %if "%{?SOURCE1}" != "" GOVERSION="$(echo %SOURCE1|sed 's,.*/,,;s/go//;s/\.src.*//')" if ! ./mlocal/scripts/check-min-go-version go $GOVERSION; then diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/apptainer-1.5.1/e2e/imgbuild/imgbuild.go new/apptainer-1.5.3/e2e/imgbuild/imgbuild.go --- old/apptainer-1.5.1/e2e/imgbuild/imgbuild.go 2026-06-04 17:00:22.000000000 +0200 +++ new/apptainer-1.5.3/e2e/imgbuild/imgbuild.go 2026-07-21 20:47:49.000000000 +0200 @@ -2052,6 +2052,15 @@ e2e.ExpectExit(0), ) + // also test recent redhat in mode 3 to make sure getopt is bound in + c.env.RunApptainer( + t, + e2e.WithProfile(e2e.UserProfile), + e2e.WithCommand("build"), + e2e.WithArgs("--force", "--build-arg", "FROMIMAGE=fedora:latest", "--userns", "--ignore-subuid", fmt.Sprintf("%s/openssh-mode3b.sif", tmpDir), "testdata/redhat_build.def"), + e2e.ExpectExit(0), + ) + // running under the mode 4(https://apptainer.org/docs/user/main/fakeroot.html) c.env.RunApptainer( t, diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/apptainer-1.5.1/e2e/internal/e2e/docker.go new/apptainer-1.5.3/e2e/internal/e2e/docker.go --- old/apptainer-1.5.1/e2e/internal/e2e/docker.go 2026-06-04 17:00:22.000000000 +0200 +++ new/apptainer-1.5.3/e2e/internal/e2e/docker.go 2026-07-21 20:47:49.000000000 +0200 @@ -26,6 +26,7 @@ "github.com/docker/distribution/configuration" dcontext "github.com/docker/distribution/context" "github.com/docker/distribution/registry/handlers" + "github.com/gorilla/mux" // necessary imports for registry drivers _ "github.com/docker/distribution/registry/storage/driver/filesystem" @@ -68,9 +69,9 @@ ctx := context.Background() - authListener, err := net.Listen("tcp", "127.0.0.1:0") + listener, err := net.Listen("tcp", "127.0.0.1:0") if err != nil { - t.Fatalf("could not setup listener for docker auth server: %s", err) + t.Fatalf("could not setup listener for docker registry: %s", err) } certsDir := filepath.Join(env.TestDir, "certs") @@ -102,12 +103,10 @@ t.Fatalf("openssl command failed: %s: error output:\n%s", res.Error, res.Stderr()) } - go func() { - // for simplicity let this be brutally stopped once test finished - if err := startAuthServer(authListener, certFile, keyFile); err != nil && err != http.ErrServerClosed { - panic(fmt.Errorf("failed to start docker auth server: %s", err)) - } - }() + authHandler, err := newAuthHandler(certFile, keyFile) + if err != nil { + t.Fatalf("failed to create docker auth handler: %s", err) + } regDir := filepath.Join(env.TestDir, "local-registry") if err := os.Mkdir(regDir, 0o755); err != nil { @@ -124,7 +123,7 @@ RootCertBundle string }{ RootDir: regDir, - Realm: fmt.Sprintf("http://%s/auth";, authListener.Addr().String()), + Realm: fmt.Sprintf("http://%s/auth";, listener.Addr().String()), RootCertBundle: certFile, } @@ -141,47 +140,39 @@ ctx = dcontext.WithLogger(ctx, dcontext.GetLogger(ctx)) app := handlers.NewApp(ctx, config) + + router := mux.NewRouter() + // The auth server shares the registry's host:port, distinguished by the + // /auth path. This matches the Realm advertised in the registry config. + router.Handle("/auth", authHandler) + router.HandleFunc("/", func(w http.ResponseWriter, _ *http.Request) { + w.Header().Set("Cache-Control", "no-cache") + w.WriteHeader(http.StatusOK) + }).Methods(http.MethodGet) + router.PathPrefix("/").Handler(app) + server := &http.Server{ - Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - if r.URL.Path == "/" { - w.Header().Set("Cache-Control", "no-cache") - w.WriteHeader(http.StatusOK) - return - } - app.ServeHTTP(w, r) - }), + Handler: router, ReadHeaderTimeout: httpTimeout, } - registryListener, err := net.Listen("tcp", "127.0.0.1:0") - if err != nil { - t.Fatalf("could not setup listener for docker registry: %s", err) - } - go func() { - if err := server.Serve(registryListener); err != nil && err != http.ErrServerClosed { + if err := server.Serve(listener); err != nil && err != http.ErrServerClosed { panic(fmt.Errorf("failed to start docker local registry: %s", err)) } }() - _, port, err := net.SplitHostPort(registryListener.Addr().String()) - if err != nil { - t.Fatalf("failed to retrieve local registry port: %s", err) - } - - addr := net.JoinHostPort("localhost", port) - for i := 0; i < 30; i++ { - resp, err := http.Get(fmt.Sprintf("http://%s/";, addr)) + resp, err := http.Get(fmt.Sprintf("http://%s/";, listener.Addr().String())) resp.Body.Close() if err != nil || resp.StatusCode != 200 { time.Sleep(time.Second) continue } - return addr + return listener.Addr().String() } t.Fatalf("local registry not reachable") - return addr + return listener.Addr().String() } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/apptainer-1.5.1/e2e/internal/e2e/docker_auth_server.go new/apptainer-1.5.3/e2e/internal/e2e/docker_auth_server.go --- old/apptainer-1.5.1/e2e/internal/e2e/docker_auth_server.go 2026-06-04 17:00:22.000000000 +0200 +++ new/apptainer-1.5.3/e2e/internal/e2e/docker_auth_server.go 2026-07-21 20:47:49.000000000 +0200 @@ -3,7 +3,7 @@ // For website terms of use, trademark policy, privacy policy and other // project policies see https://lfprojects.org/policies // Copyright (c) 2020, Control Command Inc. All rights reserved. -// Copyright (c) 2021, Sylabs Inc. All rights reserved. +// Copyright (c) 2021-2026, Sylabs Inc. All rights reserved. // This software is licensed under a 3-clause BSD license. Please consult the // LICENSE.md file distributed with the sources of this project regarding your // rights to use or distribute this software. @@ -12,7 +12,6 @@ import ( "fmt" - "net" "net/http" "strings" "sync" @@ -80,7 +79,7 @@ return []string{"pull", "push"}, nil } -func startAuthServer(ln net.Listener, crt, key string) error { +func newAuthHandler(crt, key string) (http.Handler, error) { authnz := new(authnz) opt := ®istry.Option{ @@ -94,14 +93,10 @@ srv, err := registry.NewAuthServer(opt) if err != nil { - return err + return nil, err } - http.Handle("/auth", &dockerAuthHandler{srv: srv}) - server := &http.Server{ - ReadHeaderTimeout: httpTimeout, - } - return server.Serve(ln) + return &dockerAuthHandler{srv: srv}, nil } func (d *dockerAuthHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/apptainer-1.5.1/e2e/testdata/redhat_build.def new/apptainer-1.5.3/e2e/testdata/redhat_build.def --- old/apptainer-1.5.1/e2e/testdata/redhat_build.def 1970-01-01 01:00:00.000000000 +0100 +++ new/apptainer-1.5.3/e2e/testdata/redhat_build.def 2026-07-21 20:47:49.000000000 +0200 @@ -0,0 +1,5 @@ +Bootstrap: docker +From: {{ FROMIMAGE }} + +%post + dnf install -y openssh-clients diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/apptainer-1.5.1/go.mod new/apptainer-1.5.3/go.mod --- old/apptainer-1.5.1/go.mod 2026-06-04 17:00:22.000000000 +0200 +++ new/apptainer-1.5.3/go.mod 2026-07-21 20:47:49.000000000 +0200 @@ -5,7 +5,6 @@ require ( github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2 github.com/ProtonMail/go-crypto v1.4.1 - github.com/adigunhammedolalekan/registry-auth v0.0.0-20200730122110-8cde180a3a60 github.com/apex/log v1.9.0 github.com/apptainer/container-key-client v0.8.0 github.com/apptainer/container-library-client v1.4.14 @@ -23,8 +22,9 @@ github.com/docker/go-units v0.5.0 github.com/fatih/color v1.19.0 github.com/go-log/log v0.2.0 - github.com/google/go-containerregistry v0.21.3 + github.com/google/go-containerregistry v0.21.6 github.com/google/uuid v1.6.0 + github.com/gorilla/mux v1.8.1 github.com/gosimple/slug v1.15.0 github.com/moby/go-archive v0.2.0 github.com/moby/moby/client v0.4.1 @@ -41,24 +41,25 @@ github.com/seccomp/containers-golang v0.6.0 github.com/seccomp/libseccomp-golang v0.11.1 github.com/shopspring/decimal v1.4.0 - github.com/sigstore/sigstore v1.10.5 + github.com/sigstore/sigstore v1.10.6 github.com/spf13/cobra v1.10.2 github.com/spf13/pflag v1.0.10 github.com/sylabs/json-resp v0.9.5 github.com/vbauerster/mpb/v8 v8.12.0 go.yaml.in/yaml/v4 v4.0.0-rc.4 - golang.org/x/crypto v0.50.0 - golang.org/x/sys v0.43.0 - golang.org/x/term v0.42.0 - golang.org/x/text v0.36.0 + golang.org/x/crypto v0.51.0 + golang.org/x/sys v0.44.0 + golang.org/x/term v0.43.0 + golang.org/x/text v0.37.0 gotest.tools/v3 v3.5.2 mvdan.cc/sh/v3 v3.13.1 ) require ( github.com/BurntSushi/toml v1.6.0 + github.com/adigunhammedolalekan/registry-auth v0.0.0-20200730122110-8cde180a3a60 github.com/buger/goterm v1.0.4 - github.com/docker/cli v29.4.2+incompatible + github.com/docker/cli v29.4.3+incompatible github.com/docker/distribution v2.8.3+incompatible github.com/docker/docker v28.5.2+incompatible github.com/moby/sys/sequential v0.6.0 @@ -84,7 +85,6 @@ github.com/containerd/errdefs v1.0.0 // indirect github.com/containerd/errdefs/pkg v0.3.0 // indirect github.com/containerd/log v0.1.0 // indirect - github.com/containerd/stargz-snapshotter/estargz v0.18.2 // indirect github.com/containers/libtrust v0.0.0-20230121012942-c1716e8a8d01 // indirect github.com/containers/ocicrypt v1.2.1 // indirect github.com/containers/storage v1.59.1 // indirect @@ -98,16 +98,15 @@ github.com/docker/go-metrics v0.0.1 // indirect github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7 // indirect github.com/felixge/httpsnoop v1.0.4 // indirect - github.com/fsnotify/fsnotify v1.9.0 // indirect + github.com/fsnotify/fsnotify v1.10.1 // indirect github.com/garyburd/redigo v0.0.0-20150301180006-535138d7bcd7 // indirect - github.com/go-jose/go-jose/v4 v4.1.3 // indirect + github.com/go-jose/go-jose/v4 v4.1.4 // indirect github.com/go-logr/logr v1.4.3 // indirect github.com/go-logr/stdr v1.2.2 // indirect github.com/godbus/dbus/v5 v5.1.0 // indirect github.com/golang/protobuf v1.5.4 // indirect github.com/google/go-cmp v0.7.0 // indirect - github.com/gorilla/handlers v1.5.1 // indirect - github.com/gorilla/mux v1.8.1 // indirect + github.com/gorilla/handlers v1.5.2 // indirect github.com/gosimple/unidecode v1.0.1 // indirect github.com/hashicorp/errwrap v1.1.0 // indirect github.com/hashicorp/go-multierror v1.1.1 // indirect @@ -115,7 +114,7 @@ github.com/insomniacslk/dhcp v0.0.0-20240829085014-a3a4c1f04475 // indirect github.com/josharian/native v1.1.0 // indirect github.com/json-iterator/go v1.1.12 // indirect - github.com/klauspost/compress v1.18.4 // indirect + github.com/klauspost/compress v1.18.6 // indirect github.com/klauspost/pgzip v1.2.6 // indirect github.com/mattn/go-colorable v0.1.14 // indirect github.com/mattn/go-isatty v0.0.20 // indirect @@ -125,7 +124,6 @@ github.com/mdlayher/packet v1.1.2 // indirect github.com/mdlayher/socket v0.5.1 // indirect github.com/miekg/pkcs11 v1.1.1 // indirect - github.com/mitchellh/go-homedir v1.1.0 // indirect github.com/moby/docker-image-spec v1.3.1 // indirect github.com/moby/moby/api v1.54.2 // indirect github.com/moby/patternmatcher v0.6.0 // indirect @@ -141,13 +139,13 @@ github.com/prometheus/client_golang v1.23.2 // indirect github.com/prometheus/client_model v0.6.2 // indirect github.com/prometheus/common v0.67.5 // indirect - github.com/prometheus/procfs v0.16.1 // indirect + github.com/prometheus/procfs v0.20.1 // indirect github.com/rootless-containers/proto/go-proto v0.0.0-20230421021042-4cd87ebadd67 // indirect github.com/russross/blackfriday/v2 v2.1.0 // indirect github.com/safchain/ethtool v0.6.2 // indirect github.com/secure-systems-lab/go-securesystemslib v0.9.1 // indirect - github.com/sigstore/fulcio v1.8.5 // indirect - github.com/sigstore/protobuf-specs v0.5.0 // indirect + github.com/sigstore/fulcio v1.8.6 // indirect + github.com/sigstore/protobuf-specs v0.5.1 // indirect github.com/smallstep/pkcs7 v0.1.1 // indirect github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6 // indirect github.com/u-root/uio v0.0.0-20240224005618-d2acac8f3701 // indirect @@ -160,18 +158,18 @@ github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect github.com/xeipuuv/gojsonschema v1.2.0 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect - go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 // indirect - go.opentelemetry.io/otel v1.38.0 // indirect - go.opentelemetry.io/otel/metric v1.38.0 // indirect - go.opentelemetry.io/otel/trace v1.38.0 // indirect - go.yaml.in/yaml/v2 v2.4.3 // indirect + go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 // indirect + go.opentelemetry.io/otel v1.43.0 // indirect + go.opentelemetry.io/otel/metric v1.43.0 // indirect + go.opentelemetry.io/otel/trace v1.43.0 // indirect + go.yaml.in/yaml/v2 v2.4.4 // indirect go.yaml.in/yaml/v3 v3.0.4 // indirect - golang.org/x/mod v0.34.0 // indirect - golang.org/x/net v0.52.0 // indirect + golang.org/x/mod v0.36.0 // indirect + golang.org/x/net v0.54.0 // indirect golang.org/x/sync v0.20.0 // indirect - google.golang.org/genproto/googleapis/api v0.0.0-20251222181119-0a764e51fe1b // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20251222181119-0a764e51fe1b // indirect - google.golang.org/grpc v1.78.0 // indirect + google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20260511170946-3700d4141b60 // indirect + google.golang.org/grpc v1.81.1 // indirect google.golang.org/protobuf v1.36.11 // indirect gopkg.in/yaml.v2 v2.4.0 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/apptainer-1.5.1/go.sum new/apptainer-1.5.3/go.sum --- old/apptainer-1.5.1/go.sum 2026-06-04 17:00:22.000000000 +0200 +++ new/apptainer-1.5.3/go.sum 2026-07-21 20:47:49.000000000 +0200 @@ -72,8 +72,6 @@ github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk= github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I= github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo= -github.com/containerd/stargz-snapshotter/estargz v0.18.2 h1:yXkZFYIzz3eoLwlTUZKz2iQ4MrckBxJjkmD16ynUTrw= -github.com/containerd/stargz-snapshotter/estargz v0.18.2/go.mod h1:XyVU5tcJ3PRpkA9XS2T5us6Eg35yM0214Y+wvrZTBrY= github.com/containernetworking/cni v1.3.0 h1:v6EpN8RznAZj9765HhXQrtXgX+ECGebEYEmnuFjskwo= github.com/containernetworking/cni v1.3.0/go.mod h1:Bs8glZjjFfGPHMw6hQu82RUgEPNGEaBb9KS5KtNMnJ4= github.com/containernetworking/plugins v1.9.1 h1:8oU6WsIsU3bpnNZuvHp74a6cE1MJwbj2P7s4/yTUNlA= @@ -106,8 +104,8 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk= github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E= -github.com/docker/cli v29.4.2+incompatible h1:nhxMY4v7wB0QMMc5ppeqV6FBMwzqv0n4t2gogu/R2DQ= -github.com/docker/cli v29.4.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= +github.com/docker/cli v29.4.3+incompatible h1:u+UliYm2J/rYrIh2FqHQg32neRG8GjbvNuwQRTzGspU= +github.com/docker/cli v29.4.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w= github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk= github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w= @@ -126,16 +124,15 @@ github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4= github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w= github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE= -github.com/felixge/httpsnoop v1.0.1/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U= github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg= github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U= github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo= -github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k= -github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0= +github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho= +github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo= github.com/garyburd/redigo v0.0.0-20150301180006-535138d7bcd7 h1:LofdAjjjqCSXMwLGgOgnE+rdPuvX9DxCqaHwKy7i/ko= github.com/garyburd/redigo v0.0.0-20150301180006-535138d7bcd7/go.mod h1:NR3MbYisc3/PwhQ00EMzDiPmrwpPxAn5GI05/YaO1SY= -github.com/go-jose/go-jose/v4 v4.1.3 h1:CVLmWDhDVRa6Mi/IgCgaopNosCaHz7zrMeF9MlZRkrs= -github.com/go-jose/go-jose/v4 v4.1.3/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= +github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA= +github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as= github.com/go-log/log v0.2.0 h1:z8i91GBudxD5L3RmF0KVpetCbcGWAV7q1Tw1eRwQM9Q= github.com/go-log/log v0.2.0/go.mod h1:xzCnwajcues/6w7lne3yK2QU7DBPW7kqbgPGG5AF65U= @@ -166,16 +163,16 @@ github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= -github.com/google/go-containerregistry v0.21.3 h1:Xr+yt3VvwOOn/5nJzd7UoOhwPGiPkYW0zWDLLUXqAi4= -github.com/google/go-containerregistry v0.21.3/go.mod h1:D5ZrJF1e6dMzvInpBPuMCX0FxURz7GLq2rV3Us9aPkc= +github.com/google/go-containerregistry v0.21.6 h1:T+yqQIlJXKrM98Om4DlW3GoWQAmhZuLMwoDOvVrtiUM= +github.com/google/go-containerregistry v0.21.6/go.mod h1:U7MMSBIJynke2MVQrQk19NP9k/uQsGz/h0amIFSHMbo= github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= github.com/google/pprof v0.0.0-20250820193118-f64d9cf942d6 h1:EEHtgt9IwisQ2AZ4pIsMjahcegHh6rmhqxzIRQIyepY= github.com/google/pprof v0.0.0-20250820193118-f64d9cf942d6/go.mod h1:I6V7YzU0XDpsHqbsyrghnFZLO1gwK6NPTNvmetQIk9U= github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= -github.com/gorilla/handlers v1.5.1 h1:9lRY6j8DEeeBT10CvO9hGW0gmky0BprnvDI5vfhUHH4= -github.com/gorilla/handlers v1.5.1/go.mod h1:t8XrUpc4KVXb7HGyJ4/cEnwQiaxrX/hz1Zv/4g96P1Q= +github.com/gorilla/handlers v1.5.2 h1:cLTUSsNkgcwhgRqvCNmdbRWG0A3N4F+M2nWKdScwyEE= +github.com/gorilla/handlers v1.5.2/go.mod h1:dX+xVpaxdSw+q0Qek8SSsl3dfMk3jNddUkMzo0GtH0w= github.com/gorilla/mux v1.7.4/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So= github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY= github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ= @@ -183,8 +180,8 @@ github.com/gosimple/slug v1.15.0/go.mod h1:UiRaFH+GEilHstLUmcBgWcI42viBN7mAb818JrYOeFQ= github.com/gosimple/unidecode v1.0.1 h1:hZzFTMMqSswvf0LBJZCZgThIZrpDHFXux9KeGmn6T/o= github.com/gosimple/unidecode v1.0.1/go.mod h1:CP0Cr1Y1kogOtx0bJblKzsVWrqYaqfNOnHzpgWw4Awc= -github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.4 h1:kEISI/Gx67NzH3nJxAmY/dGac80kKZgZt134u7Y/k1s= -github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.4/go.mod h1:6Nz966r3vQYCqIzWsuEl9d7cf7mRhtDmm++sOxlnfxI= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 h1:5VipnvEpbqr2gA2VbM+nYVbkIF28c5ZQfqCBQ5g2xfk= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0/go.mod h1:Hyl3n6Twe1hvtd9XUXDec4pTvgMSEixRuQKPTMH2bNs= github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I= github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= @@ -210,8 +207,8 @@ github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM= github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo= github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w= -github.com/klauspost/compress v1.18.4 h1:RPhnKRAQ4Fh8zU2FY/6ZFDwTVTxgJ/EMydqSTzE9a2c= -github.com/klauspost/compress v1.18.4/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4= +github.com/klauspost/compress v1.18.6 h1:2jupLlAwFm95+YDR+NwD2MEfFO9d4z4Prjl1XXDjuao= +github.com/klauspost/compress v1.18.6/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/klauspost/pgzip v1.2.6 h1:8RXeL5crjEUFnR2/Sn6GJNWtSQ3Dk8pq4CL3jvdDyjU= github.com/klauspost/pgzip v1.2.6/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs= github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ= @@ -252,8 +249,6 @@ github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE= github.com/miekg/pkcs11 v1.1.1 h1:Ugu9pdy6vAYku5DEpVWVFPYnzV+bxB+iRdbuFSu7TvU= github.com/miekg/pkcs11 v1.1.1/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs= -github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y= -github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0= github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0= github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo= github.com/moby/go-archive v0.2.0 h1:zg5QDUM2mi0JIM9fdQZWC7U8+2ZfixfTYoHL7rWUcP8= @@ -349,8 +344,8 @@ github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk= github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA= github.com/prometheus/procfs v0.0.3/go.mod h1:4A/X28fw3Fc593LaREMrKMqOKvUAntwMDaekg4FpcdQ= -github.com/prometheus/procfs v0.16.1 h1:hZ15bTNuirocR6u0JZ6BAHHmwS1p8B4P6MRqxtzMyRg= -github.com/prometheus/procfs v0.16.1/go.mod h1:teAbpZRB1iIAJYREa1LsoWUXykVXA1KlTmWl8x/U+Is= +github.com/prometheus/procfs v0.20.1 h1:XwbrGOIplXW/AU3YhIhLODXMJYyC1isLFfYCsTEycfc= +github.com/prometheus/procfs v0.20.1/go.mod h1:o9EMBZGRyvDrSPH1RqdxhojkuXstoe4UlK79eF5TGGo= github.com/rogpeppe/fastuuid v1.1.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc= @@ -378,12 +373,12 @@ github.com/sergi/go-diff v1.3.1/go.mod h1:aMJSSKb2lpPvRNec0+w3fl7LP9IOFzdc9Pa4NFbPK1I= github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k= github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME= -github.com/sigstore/fulcio v1.8.5 h1:HYTD1/L5wlBp8JxsWxUf8hmfaNBBF/x3r3p5l6tZwbA= -github.com/sigstore/fulcio v1.8.5/go.mod h1:tSLYK3JsKvJpDW1BsIsVHZgHj+f8TjXARzqIUWSsSPQ= -github.com/sigstore/protobuf-specs v0.5.0 h1:F8YTI65xOHw70NrvPwJ5PhAzsvTnuJMGLkA4FIkofAY= -github.com/sigstore/protobuf-specs v0.5.0/go.mod h1:+gXR+38nIa2oEupqDdzg4qSBT0Os+sP7oYv6alWewWc= -github.com/sigstore/sigstore v1.10.5 h1:KqrOjDhNOVY+uOzQFat2FrGLClPPCb3uz8pK3wuI+ow= -github.com/sigstore/sigstore v1.10.5/go.mod h1:k/mcVVXw3I87dYG/iCVTSW2xTrW7vPzxxGic4KqsqXs= +github.com/sigstore/fulcio v1.8.6 h1:vkvRpdhVAZjZHa0ltiJeLSILG9U8ADJoe5Z+RdZSLJk= +github.com/sigstore/fulcio v1.8.6/go.mod h1:7RwoGdMM0xpc9qc382sjSw7P9OLKbKIwQZXvYz4JPb4= +github.com/sigstore/protobuf-specs v0.5.1 h1:/5OPaNuolRJmQfeZLayJGFXMpsRJEdgC6ah1/+7Px7U= +github.com/sigstore/protobuf-specs v0.5.1/go.mod h1:DRBzpFuE+LnvQMN10/dU6nBeKwVLGEQ6o2FovN2Rats= +github.com/sigstore/sigstore v1.10.6 h1:YWhMQfTrJSK80QB1pbxjYeAwGKx+5UwWPPAY9hrPPZg= +github.com/sigstore/sigstore v1.10.6/go.mod h1:k/mcVVXw3I87dYG/iCVTSW2xTrW7vPzxxGic4KqsqXs= github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo= github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE= github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88= @@ -446,32 +441,32 @@ github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= -go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 h1:RbKq8BG0FI8OiXhBfcRtqqHcZcka+gU3cskNuf05R18= -go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0/go.mod h1:h06DGIukJOevXaj/xrNjhi/2098RZzcLTbc0jDAUbsg= -go.opentelemetry.io/otel v1.38.0 h1:RkfdswUDRimDg0m2Az18RKOsnI8UDzppJAtj01/Ymk8= -go.opentelemetry.io/otel v1.38.0/go.mod h1:zcmtmQ1+YmQM9wrNsTGV/q/uyusom3P8RxwExxkZhjM= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0 h1:GqRJVj7UmLjCVyVJ3ZFLdPRmhDUp2zFmQe3RHIOsw24= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0/go.mod h1:ri3aaHSmCTVYu2AWv44YMauwAQc0aqI9gHKIcSbI1pU= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 h1:OyrsyzuttWTSur2qN/Lm0m2a8yqyIjUVBZcxFPuXq2o= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0/go.mod h1:C2NGBr+kAB4bk3xtMXfZ94gqFDtg/GkI7e9zqGh5Beg= +go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I= +go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0 h1:THuZiwpQZuHPul65w4WcwEnkX2QIuMT+UFoOrygtoJw= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0/go.mod h1:J2pvYM5NGHofZ2/Ru6zw/TNWnEQp5crgyDeSrYpXkAw= go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.35.0 h1:xJ2qHD0C1BeYVTLLR9sX12+Qb95kfeD/byKj6Ky1pXg= go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.35.0/go.mod h1:u5BF1xyjstDowA1R5QAO9JHzqK+ublenEW/dyqTjBVk= -go.opentelemetry.io/otel/metric v1.38.0 h1:Kl6lzIYGAh5M159u9NgiRkmoMKjvbsKtYRwgfrA6WpA= -go.opentelemetry.io/otel/metric v1.38.0/go.mod h1:kB5n/QoRM8YwmUahxvI3bO34eVtQf2i4utNVLr9gEmI= -go.opentelemetry.io/otel/sdk v1.38.0 h1:l48sr5YbNf2hpCUj/FoGhW9yDkl+Ma+LrVl8qaM5b+E= -go.opentelemetry.io/otel/sdk v1.38.0/go.mod h1:ghmNdGlVemJI3+ZB5iDEuk4bWA3GkTpW+DOoZMYBVVg= -go.opentelemetry.io/otel/sdk/metric v1.38.0 h1:aSH66iL0aZqo//xXzQLYozmWrXxyFkBJ6qT5wthqPoM= -go.opentelemetry.io/otel/sdk/metric v1.38.0/go.mod h1:dg9PBnW9XdQ1Hd6ZnRz689CbtrUp0wMMs9iPcgT9EZA= -go.opentelemetry.io/otel/trace v1.38.0 h1:Fxk5bKrDZJUH+AMyyIXGcFAPah0oRcT+LuNtJrmcNLE= -go.opentelemetry.io/otel/trace v1.38.0/go.mod h1:j1P9ivuFsTceSWe1oY+EeW3sc+Pp42sO++GHkg4wwhs= -go.opentelemetry.io/proto/otlp v1.7.1 h1:gTOMpGDb0WTBOP8JaO72iL3auEZhVmAQg4ipjOVAtj4= -go.opentelemetry.io/proto/otlp v1.7.1/go.mod h1:b2rVh6rfI/s2pHWNlB7ILJcRALpcNDzKhACevjI+ZnE= +go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM= +go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY= +go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg= +go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg= +go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw= +go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A= +go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A= +go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0= +go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g= +go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk= go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs= go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= go.yaml.in/yaml/v2 v2.4.0 h1:1wUho2rqHvQlbIzGvWDqpyuGtd8ClFDJx7sxsblGvig= go.yaml.in/yaml/v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ= -go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0= -go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8= +go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ= +go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ= go.yaml.in/yaml/v3 v3.0.1 h1:XDp0bdmK8yhjHY72LqCnqEpEHMlIZgqKewnYfT7YV/U= go.yaml.in/yaml/v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= @@ -487,16 +482,16 @@ golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU= golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8= golang.org/x/crypto v0.30.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk= -golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI= -golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q= +golang.org/x/crypto v0.51.0 h1:IBPXwPfKxY7cWQZ38ZCIRPI50YLeevDLlLnyC5wRGTI= +golang.org/x/crypto v0.51.0/go.mod h1:8AdwkbraGNABw2kOX6YFPs3WM22XqI4EXEd8g+x7Oc8= golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c= golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c= -golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI= -golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY= +golang.org/x/mod v0.36.0 h1:JJjpVx6myfUsUdAzZuOSTTmRE0PfZeNWzzvKrP7amb4= +golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ= golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= @@ -510,8 +505,8 @@ golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk= golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44= golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM= -golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0= -golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw= +golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w= +golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ= golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= @@ -552,8 +547,8 @@ golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= -golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI= -golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ= +golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= @@ -563,8 +558,8 @@ golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk= golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY= golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM= -golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY= -golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY= +golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4= +golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= @@ -575,10 +570,10 @@ golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ= -golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg= -golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164= -golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI= -golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4= +golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc= +golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38= +golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= +golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk= @@ -586,20 +581,20 @@ golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58= golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk= -golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s= -golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0= +golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8= +golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= -gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk= -gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E= -google.golang.org/genproto/googleapis/api v0.0.0-20251222181119-0a764e51fe1b h1:uA40e2M6fYRBf0+8uN5mLlqUtV192iiksiICIBkYJ1E= -google.golang.org/genproto/googleapis/api v0.0.0-20251222181119-0a764e51fe1b/go.mod h1:Xa7le7qx2vmqB/SzWUBa7KdMjpdpAHlh5QCSnjessQk= -google.golang.org/genproto/googleapis/rpc v0.0.0-20251222181119-0a764e51fe1b h1:Mv8VFug0MP9e5vUxfBcE3vUkV6CImK3cMNMIDFjmzxU= -google.golang.org/genproto/googleapis/rpc v0.0.0-20251222181119-0a764e51fe1b/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ= -google.golang.org/grpc v1.78.0 h1:K1XZG/yGDJnzMdd/uZHAkVqJE+xIDOcmdSFZkBUicNc= -google.golang.org/grpc v1.78.0/go.mod h1:I47qjTo4OKbMkjA/aOOwxDIiPSBofUtQUI5EfpWvW7U= +gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= +gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= +google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 h1:yQugLulqltosq0B/f8l4w9VryjV+N/5gcW0jQ3N8Qec= +google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478/go.mod h1:C6ADNqOxbgdUUeRTU+LCHDPB9ttAMCTff6auwCVa4uc= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260511170946-3700d4141b60 h1:seT2EwLWM78plQ7wcDfuWBc/4FAEAXDDiaSol4ku4qo= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260511170946-3700d4141b60/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= +google.golang.org/grpc v1.81.1 h1:VnnIIZ88UzOOKLukQi+ImGz8O1Wdp8nAGGnvOfEIWQQ= +google.golang.org/grpc v1.81.1/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I= google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw= google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc= google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/apptainer-1.5.1/internal/pkg/fakeroot/fakefake.go new/apptainer-1.5.3/internal/pkg/fakeroot/fakefake.go --- old/apptainer-1.5.1/internal/pkg/fakeroot/fakefake.go 2026-06-04 17:00:22.000000000 +0200 +++ new/apptainer-1.5.3/internal/pkg/fakeroot/fakefake.go 2026-07-21 20:47:49.000000000 +0200 @@ -97,6 +97,34 @@ } } +// Given an existing environment, modify it as needed to successfully +// execute the fakeroot command. If cleanLdLibraryPath is true, also +// remove any existing $LD_LIBRARY_PATH variable. +func GetFakeEnviron(environ []string, cleanLdLibraryPath bool) []string { + hasPath := false + for idx := range environ { + if cleanLdLibraryPath && strings.HasPrefix(environ[idx], "LD_LIBRARY_PATH=") { + // Remove any incoming LD_LIBRARY_PATH + environ[idx] = "LD_LIBRARY_PATH=" + } else if strings.HasPrefix(environ[idx], "PATH=") && environ[idx] != "PATH=" { + hasPath = true + // Append /:singularity.d/libs to the PATH for getopt + environ[idx] = environ[idx] + ":/.singularity.d/libs" + } + } + if !hasPath { + environ = append(environ, "PATH="+env.DefaultPath+":/.singularity.d/libs") + } + + // Without this workaround fakeroot does not work + // properly in a user namespace. It is especially + // noticeable with debian containers. Learned from + // https://salsa.debian.org/clint/fakeroot/-/merge_requests/4 + environ = append(environ, "FAKEROOTDONTTRYCHOWN=1") + + return environ +} + // Get the binds needed to map the fakeroot command into the container // The incoming parameter is the path to fakeroot func GetFakeBinds(fakerootPath string) ([]string, error) { @@ -109,29 +137,19 @@ if fakerootPath == args[0] { // The binding has already been done, this is for nesting + // Include getopt if it was included previously + if _, err := os.Stat("/.singularity.d/libs/getopt"); err == nil { + binds = append(binds, "/.singularity.d/libs/getopt") + } return binds, nil } // Start by examining the environment fakeroot creates cmd := osExec.Command(fakerootPath, "env") - environ := os.Environ() - hasPath := false - for idx := range environ { - if strings.HasPrefix(environ[idx], "LD_LIBRARY_PATH=") { - // Remove any incoming LD_LIBRARY_PATH - environ[idx] = "LD_LIBRARY_PATH=" - } else if strings.HasPrefix(environ[idx], "PATH=") && - environ[idx] != "PATH=" { - hasPath = true - } - } - if !hasPath { - environ = append(environ, "PATH="+env.DefaultPath) - } - cmd.Env = environ + cmd.Env = GetFakeEnviron(os.Environ(), true) stdout, err := cmd.StdoutPipe() if err != nil { - return binds, fmt.Errorf("error make fakeroot stdout pipe: %v", err) + return binds, fmt.Errorf("error making fakeroot stdout pipe: %v", err) } err = cmd.Start() @@ -190,5 +208,11 @@ break } } + // Check if getopt exists and add it to binds if it does + if getoptPath, err := bin.FindBin("getopt"); err == nil { + binds = append(binds, getoptPath+":/.singularity.d/libs/getopt") + } else { + sylog.Infof("getopt not found; could interfere with fakeroot command") + } return binds, nil } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/apptainer-1.5.1/internal/pkg/image/packer/squashfs.go new/apptainer-1.5.3/internal/pkg/image/packer/squashfs.go --- old/apptainer-1.5.1/internal/pkg/image/packer/squashfs.go 2026-06-04 17:00:22.000000000 +0200 +++ new/apptainer-1.5.3/internal/pkg/image/packer/squashfs.go 2026-07-21 20:47:49.000000000 +0200 @@ -15,6 +15,7 @@ "os" "os/exec" "strings" + "syscall" "github.com/apptainer/apptainer/internal/pkg/client" "github.com/apptainer/apptainer/internal/pkg/util/bin" @@ -23,6 +24,25 @@ "github.com/blang/semver/v4" ) +// hasWorkingPtrace returns true if the ptrace() system call is usable. +// proot relies on ptrace, which can be unavailable because of a seccomp +// filter, an AppArmor/Yama restriction, or because Apptainer itself is +// running inside another container without the CAP_SYS_PTRACE capability. +func hasWorkingPtrace() bool { + // Use the currently running executable as the traced child: since + // PTRACE_TRACEME causes the child to stop with SIGTRAP right after + // the exec call and before running any of its own code, it doesn't + // matter which binary is exec'd as long as it exists and is runnable. + cmd := exec.Command("/proc/self/exe") + cmd.SysProcAttr = &syscall.SysProcAttr{Ptrace: true} + err := cmd.Start() + if err == nil { + _ = cmd.Process.Kill() + _, _ = cmd.Process.Wait() + } + return err == nil +} + // Squashfs represents a squashfs packer type Squashfs struct { MksquashfsPath string @@ -79,20 +99,26 @@ ignoreProot := os.Getenv("APPTAINER_IGNORE_PROOT") proot, err := bin.FindBin("proot") if ignoreProot == "" && err == nil { - // Insert proot around mksquashfs to take advantage of - // file owner and group information stored by umoci in - // a "rootlesscontainers" extended attribute. - // https://github.com/apptainer/apptainer/issues/2830 - args = append([]string{"-S", "/", prog}, args...) - prog = proot - // Add the MALLOC settings to workaround segfaults seen - // in mksquashfs on Ubuntu 22.04 - // https://github.com/apptainer/apptainer/issues/3486 - extraEnv = append(extraEnv, - "MALLOC_MMAP_MAX_=0", - "MALLOC_ARENA_MAX=32", - ) - } else { + if hasWorkingPtrace() { + // Insert proot around mksquashfs to take advantage of + // file owner and group information stored by umoci in + // a "rootlesscontainers" extended attribute. + // https://github.com/apptainer/apptainer/issues/2830 + args = append([]string{"-S", "/", prog}, args...) + prog = proot + // Add the MALLOC settings to workaround segfaults seen + // in mksquashfs on Ubuntu 22.04 + // https://github.com/apptainer/apptainer/issues/3486 + // https://github.com/apptainer/apptainer/issues/3560 + extraEnv = append(extraEnv, + "MALLOC_MMAP_MAX_=0", + "MALLOC_ARENA_MAX=1000000", + ) + } else { + sylog.Infof("Skipping preservation of file ownership because ptrace() does not work") + } + } + if prog != proot { args = append(args, "-all-root") } } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/apptainer-1.5.1/internal/pkg/image/packer/squashfs_test.go new/apptainer-1.5.3/internal/pkg/image/packer/squashfs_test.go --- old/apptainer-1.5.1/internal/pkg/image/packer/squashfs_test.go 2026-06-04 17:00:22.000000000 +0200 +++ new/apptainer-1.5.3/internal/pkg/image/packer/squashfs_test.go 2026-07-21 20:47:49.000000000 +0200 @@ -107,6 +107,14 @@ checkArchive(t, imageName, []string{"squashfs.go", "squashfs_test.go"}) } +func TestHasWorkingPtrace(t *testing.T) { + // ptrace is expected to work in the environment running the unit + // tests (no seccomp filter or similar restriction in place). + if !hasWorkingPtrace() { + t.Error("expected ptrace to work in the test environment") + } +} + func TestSquashfs(t *testing.T) { if s := NewSquashfs(); !s.HasMksquashfs() { t.Skip("mksquashfs not found, skipping") diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/apptainer-1.5.1/internal/pkg/runtime/engine/apptainer/process_linux.go new/apptainer-1.5.3/internal/pkg/runtime/engine/apptainer/process_linux.go --- old/apptainer-1.5.1/internal/pkg/runtime/engine/apptainer/process_linux.go 2026-06-04 17:00:22.000000000 +0200 +++ new/apptainer-1.5.3/internal/pkg/runtime/engine/apptainer/process_linux.go 2026-07-21 20:47:49.000000000 +0200 @@ -945,11 +945,7 @@ sylog.Verbosef("Running command with %v", filepath.Base(fakerootPath)) args = append(fakeargs, args...) - // Without this workaround fakeroot does not work - // properly in a user namespace. It is especially - // noticeable with debian containers. Learned from - // https://salsa.debian.org/clint/fakeroot/-/merge_requests/4 - penv = append(penv, "FAKEROOTDONTTRYCHOWN=1") + penv = fakeroot.GetFakeEnviron(penv, false) if engineConfig.GetFakerootPath() == "" { // Must be joining an instance, so also set BIND diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/apptainer-1.5.1/internal/pkg/util/bin/bin.go new/apptainer-1.5.3/internal/pkg/util/bin/bin.go --- old/apptainer-1.5.1/internal/pkg/util/bin/bin.go 2026-06-04 17:00:22.000000000 +0200 +++ new/apptainer-1.5.3/internal/pkg/util/bin/bin.go 2026-07-21 20:47:49.000000000 +0200 @@ -57,6 +57,7 @@ "fakeroot-sysv", "fuse-overlayfs", "fuse2fs", + "getopt", "go", "mksquashfs", "newgidmap", diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/apptainer-1.5.1/scripts/compile-dependencies new/apptainer-1.5.3/scripts/compile-dependencies --- old/apptainer-1.5.1/scripts/compile-dependencies 2026-06-04 17:00:22.000000000 +0200 +++ new/apptainer-1.5.3/scripts/compile-dependencies 2026-07-21 20:47:49.000000000 +0200 @@ -21,8 +21,8 @@ for PKG in squashfs-tools squashfuse e2fsprogs fuse-overlayfs gocryptfs PRoot; do TGZ="$(echo $SRC/${PKG}[_-]*.tar.gz)" if [ ! -f "$TGZ" ]; then - echo "\$PKG[_-]*.tar.gz not found in $SRC, skipping" >&2 - continue + echo "\$PKG[_-]*.tar.gz not found in $SRC, skipping" >&2 + continue fi DIR=${TGZ%.tar.gz} DIR=${DIR/*\//} @@ -30,49 +30,49 @@ tar -xf $TGZ cd $DIR for PATCH in $(echo $SRC/$PKG-*.patch); do - if [ -f "$PATCH" ]; then - patch -p1 <$PATCH - fi + if [ -f "$PATCH" ]; then + patch -p1 <$PATCH + fi done case "$PKG" in - squashfs-tools) - make -C squashfs-tools mksquashfs unsquashfs GZIP_SUPPORT=1 \ - LZO_SUPPORT=1 LZ4_SUPPORT=1 XZ_SUPPORT=1 ZSTD_SUPPORT=1 - ;; - squashfuse) - ./autogen.sh - FLAGS=-std=c99 ./configure --enable-multithreading - make squashfuse_ll - ;; - e2fsprogs) - ./configure - make libs && make -C misc fuse2fs - mv misc/fuse2fs . - ;; - fuse-overlayfs) - ./autogen.sh - ./configure - make - ;; - gocryptfs) - VER=${DIR/*-/} - echo "v$VER" >VERSION - # Don't hardcode the amd64 microarchitecture - sed -e '/GOAMD64.*v2/d' -i.orig build.bash - # GOPROXY=off makes sure we fail instead of making network requests - # the -B ldflags prevent rpm complaints about "No build ID note found" - CGO_ENABLED=0 GOPROXY=off ./build.bash \ - -mod=vendor -tags without_openssl \ - -buildvcs=false -ldflags="-X main.GitVersion=v$VER \ - -B 0x`head -c20 /dev/urandom|od -An -tx1|tr -d ' \n'`" - ;; - PRoot) - make -C src proot - ;; - *) - echo "unrecognized package $PKG" >&2 - exit 1 - ;; + squashfs-tools) + make -C squashfs-tools mksquashfs unsquashfs GZIP_SUPPORT=1 \ + LZO_SUPPORT=1 LZ4_SUPPORT=1 XZ_SUPPORT=1 ZSTD_SUPPORT=1 + ;; + squashfuse) + ./autogen.sh + FLAGS=-std=c99 ./configure --enable-multithreading + make squashfuse_ll + ;; + e2fsprogs) + ./configure + make libs && make -C misc fuse2fs + mv misc/fuse2fs . + ;; + fuse-overlayfs) + ./autogen.sh + ./configure + make + ;; + gocryptfs) + VER=${DIR/*-/} + echo "v$VER" >VERSION + # Don't hardcode the amd64 microarchitecture + sed -e '/GOAMD64.*v2/d' -i.orig build.bash + # GOPROXY=off makes sure we fail instead of making network requests + # the -B ldflags prevent rpm complaints about "No build ID note found" + CGO_ENABLED=0 GOPROXY=off ./build.bash \ + -mod=vendor -tags without_openssl \ + -buildvcs=false -ldflags="-X main.GitVersion=v$VER \ + -B 0x`head -c20 /dev/urandom|od -An -tx1|tr -d ' \n'`" + ;; + PRoot) + make -C src proot + ;; + *) + echo "unrecognized package $PKG" >&2 + exit 1 + ;; esac cd .. done diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/apptainer-1.5.1/scripts/download-dependencies new/apptainer-1.5.3/scripts/download-dependencies --- old/apptainer-1.5.1/scripts/download-dependencies 2026-06-04 17:00:22.000000000 +0200 +++ new/apptainer-1.5.3/scripts/download-dependencies 2026-07-21 20:47:49.000000000 +0200 @@ -32,30 +32,40 @@ done echo "$LINE")) if [[ "$LINE" = *http* ]]; then - URL="${LINE/*http/http}" - if [[ "$LINE" = "URL:"*http* ]]; then - # the file name is on the next line - continue - fi - # take the file name from the base of the URL - LINE="${LINE/*\//}" + URL="${LINE/*http/http}" + if [[ "$LINE" = "URL:"*http* ]]; then + # the file name is on the next line + continue + fi + # take the file name from the base of the URL + LINE="${LINE/*\//}" fi if [[ "$LINE" = *PRoot* ]]; then # skip architectures known to not be supported by PRoot case $(arch) in ppc*|s390*|riscv*) continue;; + x86*) if [ -f /etc/os-release ]; then + . /etc/os-release + if [ "$ID" = fedora ] && [ "$VERSION_ID" -ge 45 ]; then + # On fedora45 x86_64 building PRoot dies with + # "relocation truncated to fit: R_X86_64_PC32 against `.rodata'" + # See https://github.com/proot-me/proot/issues/414 + continue + fi + fi + ;; esac fi if [ -n "$GITHUB_TOKEN" ] && [[ "$URL" = *github.com/*.patch ]]; then - # use github API instead because the public URL downloads - # sometimes hit server busy (429) when run in github actions - URL="$(echo "$URL"|sed -e 's,github.com/,api.github.com/repos/,' \ - -e 's,/pull/,/pulls/,' -e 's,\.patch,,')" - curl -f -L -sS -o $DIR/$LINE \ - -H "Accept: application/vnd.github.diff" \ - -H "Authorization: Bearer $GITHUB_TOKEN" $URL + # use github API instead because the public URL downloads + # sometimes hit server busy (429) when run in github actions + URL="$(echo "$URL"|sed -e 's,github.com/,api.github.com/repos/,' \ + -e 's,/pull/,/pulls/,' -e 's,\.patch,,')" + curl -f -L -sS -o $DIR/$LINE \ + -H "Accept: application/vnd.github.diff" \ + -H "Authorization: Bearer $GITHUB_TOKEN" $URL else - curl -f -L -sS -o $DIR/$LINE $URL + curl -f -L -sS -o $DIR/$LINE $URL fi done diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/apptainer-1.5.1/scripts/install-dependencies new/apptainer-1.5.3/scripts/install-dependencies --- old/apptainer-1.5.1/scripts/install-dependencies 2026-06-04 17:00:22.000000000 +0200 +++ new/apptainer-1.5.3/scripts/install-dependencies 2026-07-21 20:47:49.000000000 +0200 @@ -35,8 +35,8 @@ set -ex for CMD in squashfs-tools-*/squashfs-tools/{mksquashfs,unsquashfs} squashfuse-*/squashfuse_ll e2fsprogs-*/fuse2fs fuse-overlayfs-*/fuse-overlayfs gocryptfs[_-]*/gocryptfs PRoot-*/src/proot; do if [ ! -f "$CMD" ]; then - echo "$CMD not found, skipping" >&2 - continue + echo "$CMD not found, skipping" >&2 + continue fi cp -f $CMD $DIR done diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/apptainer-1.5.1/tools/install-unprivileged.sh new/apptainer-1.5.3/tools/install-unprivileged.sh --- old/apptainer-1.5.1/tools/install-unprivileged.sh 2026-06-04 17:00:22.000000000 +0200 +++ new/apptainer-1.5.3/tools/install-unprivileged.sh 2026-07-21 20:47:49.000000000 +0200 @@ -12,9 +12,9 @@ # Works with apptainer versions 1.1.4 and higher. REQUIREDCMDS="curl rpm2cpio cpio" - -# assumes at least a 1 Mbit connection -CURLOPTS="--connect-timeout 5 -Y 125000 -y 10 -Ls" +MAXRETRIES=5 +# assumes at least a 0.5 Mbit connection +CURLOPTS="--connect-timeout 10 -Y 50000 -y 10 -Ls" usage() { @@ -143,7 +143,7 @@ DIST=el9 fi ;; - suse15|opensuse-leap) + suse15|suse16|opensuse-leap) if $NOOPENSUSE; then DIST=el8 fi @@ -194,10 +194,16 @@ EXTRASREPOURL=$OSREPOURL OSSPLIT=false ;; - suse15|opensuse-leap) + suse16|opensuse-leap) + OSREPOURL="https://download.opensuse.org/distribution/leap/16.0/repo/oss/$ARCH"; + EPELREPOURL="https://download.opensuse.org/repositories/network:/cluster/16.0/$ARCH"; + EXTRASREPOURL="https://download.opensuse.org/repositories/filesystems/16.0/$ARCH"; + OSSPLIT=false + ;; + suse15) OSREPOURL="https://download.opensuse.org/distribution/leap/15.6/repo/oss/$ARCH"; EPELREPOURL="https://download.opensuse.org/repositories/network:/cluster/15.6/$ARCH"; - EXTRASREPOURL="https://download.opensuse.org/repositories/filesystems/15.6/$ARCH"; + EXTRASREPOURL="https://download.opensuse.org/repositories/filesystems/15.7/$ARCH"; OSSPLIT=false ;; *) fatal "$1 distribution not supported";; @@ -240,7 +246,7 @@ URL="${URL/\/Packages\///os/Packages/}" latesturl "$URL" "$2" false false return $? - elif [ $RETRY -lt 3 ]; then + elif [ $RETRY -lt $MAXRETRIES ]; then RETRY=$((RETRY+1)) if $SHOWERRORS; then echo "Retrying..." >&2 @@ -270,7 +276,7 @@ APPTAINERURL="$KOJIURL/$REL/$ARCH/apptainer-$VERSION-$REL.$ARCH.rpm" fi -# Retry url to 3 times if download fails +# Retry url up to $MAXTRIES times if download fails extracturl() { typeset URL="$1" @@ -282,7 +288,7 @@ break fi RETRY=$((RETRY+1)) - if [ "$RETRY" -ge 3 ]; then + if [ "$RETRY" -ge $MAXRETRIES ]; then fatal "Failure extracting $URL" fi if $SHOWERRORS; then @@ -312,7 +318,7 @@ fatal "error removing usr" fi -OSUTILS="" +OSUTILS="util-linux" NEEDSFUSE2FS=true LIBEXEC=libexec if [ "$DIST" == suse15 ] || [ "$DIST" == opensuse-leap ]; then @@ -450,7 +456,7 @@ mv tmp/lib*/* utils/lib 2>/dev/null || true # optional mv tmp/usr/*bin/*squashfs utils/libexec mv tmp/usr/*bin/fuse* utils/libexec 2>/dev/null || true # optional -mv tmp/usr/bin/fake*sysv utils/bin +mv tmp/usr/bin/fake*sysv tmp/usr/bin/getopt utils/bin cat >utils/bin/.wrapper <<'!EOF!' #!/bin/bash BASEME=${0##*/} ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-07-26 07:40:55.000000000 +0200 @@ -0,0 +1,8 @@ +*.obscpio +*.osc +_build.* +.pbuild +*.obscpio +*.osc +_build.* +.pbuild ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/apptainer/vendor.tar.gz /work/SRC/openSUSE:Factory/.apptainer.new.2004/vendor.tar.gz differ: char 14, line 1
