Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package gitsign for openSUSE:Factory checked in at 2026-09-17 15:18:30 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/gitsign (Old) and /work/SRC/openSUSE:Factory/.gitsign.new.383539 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "gitsign" Thu Sep 17 15:18:30 2026 rev:16 rq:1378249 version:0.17.1 Changes: -------- --- /work/SRC/openSUSE:Factory/gitsign/gitsign.changes 2026-07-31 16:07:38.041110766 +0200 +++ /work/SRC/openSUSE:Factory/.gitsign.new.383539/gitsign.changes 2026-09-17 15:20:04.286621003 +0200 @@ -1,0 +2,6 @@ +Sun Sep 13 08:15:47 UTC 2026 - Martin Pluskal <[email protected]> + +- Update to version 0.17.1: + * Print "Generating ephemeral keys..." during keyless identity flow (#852) + +------------------------------------------------------------------- Old: ---- gitsign-0.17.0.obscpio New: ---- gitsign-0.17.1.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ gitsign.spec ++++++ --- /var/tmp/diff_new_pack.OcNoEq/_old 2026-09-17 15:20:06.019693688 +0200 +++ /var/tmp/diff_new_pack.OcNoEq/_new 2026-09-17 15:20:06.024693897 +0200 @@ -17,7 +17,7 @@ Name: gitsign -Version: 0.17.0 +Version: 0.17.1 Release: 0 Summary: Keyless Git signing using Sigstore License: Apache-2.0 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.OcNoEq/_old 2026-09-17 15:20:06.065695617 +0200 +++ /var/tmp/diff_new_pack.OcNoEq/_new 2026-09-17 15:20:06.072695910 +0200 @@ -3,7 +3,7 @@ <param name="url">https://github.com/sigstore/gitsign.git</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">refs/tags/v0.17.0</param> + <param name="revision">refs/tags/v0.17.1</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> <param name="changesgenerate">enable</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.OcNoEq/_old 2026-09-17 15:20:06.105697294 +0200 +++ /var/tmp/diff_new_pack.OcNoEq/_new 2026-09-17 15:20:06.109697462 +0200 @@ -3,6 +3,6 @@ <param name="url">https://github.com/sigstore/gitsign</param> <param name="changesrevision">d5e8a584d0551218fc96b5c89c0db910788b432a</param></service><service name="tar_scm"> <param name="url">https://github.com/sigstore/gitsign.git</param> - <param name="changesrevision">7de6b7bf5a05c607c8cbce8d03d7114562553811</param></service></servicedata> + <param name="changesrevision">44f5e17fac6944fdde71c94d2e77ab075c9dca9f</param></service></servicedata> (No newline at EOF) ++++++ gitsign-0.17.0.obscpio -> gitsign-0.17.1.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/gitsign-0.17.0/.github/ISSUE_TEMPLATE/bug.md new/gitsign-0.17.1/.github/ISSUE_TEMPLATE/bug.md --- old/gitsign-0.17.0/.github/ISSUE_TEMPLATE/bug.md 1970-01-01 01:00:00.000000000 +0100 +++ new/gitsign-0.17.1/.github/ISSUE_TEMPLATE/bug.md 2026-07-29 22:57:55.000000000 +0200 @@ -0,0 +1,19 @@ +--- +name: Bug +about: Something wrong with the project? Report it here! +labels: 'bug' +assignees: '' + +--- + +**Description** + +<!-- +Tell us about the bug. What went wrong? How can we reproduce it? What should the correct behavior be? +--> + +**Version** + +<!-- +What version are you using? e.g. `gitsign --version`... +--> \ No newline at end of file diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/gitsign-0.17.0/.github/dependabot.yml new/gitsign-0.17.1/.github/dependabot.yml --- old/gitsign-0.17.0/.github/dependabot.yml 1970-01-01 01:00:00.000000000 +0100 +++ new/gitsign-0.17.1/.github/dependabot.yml 2026-07-29 22:57:55.000000000 +0200 @@ -0,0 +1,24 @@ +--- +version: 2 +updates: + + - package-ecosystem: gomod + directory: "/" + schedule: + interval: weekly + open-pull-requests-limit: 10 + groups: + gomod: + update-types: + - "patch" + + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: weekly + open-pull-requests-limit: 10 + groups: + actions: + update-types: + - "minor" + - "patch" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/gitsign-0.17.0/.github/workflows/ci.yaml new/gitsign-0.17.1/.github/workflows/ci.yaml --- old/gitsign-0.17.0/.github/workflows/ci.yaml 1970-01-01 01:00:00.000000000 +0100 +++ new/gitsign-0.17.1/.github/workflows/ci.yaml 2026-07-29 22:57:55.000000000 +0200 @@ -0,0 +1,34 @@ +name: CI + +on: + pull_request: + branches: + - "main" + workflow_dispatch: + +permissions: {} + +jobs: + ci: + runs-on: ubuntu-latest + + permissions: + contents: read + + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + - name: Set up Go + uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 + with: + go-version-file: 'go.mod' + check-latest: true + cache: 'false' + + - name: Build + run: make build-all + + - name: Unit Tests + run: make unit-test diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/gitsign-0.17.0/.github/workflows/e2e.yaml new/gitsign-0.17.1/.github/workflows/e2e.yaml --- old/gitsign-0.17.0/.github/workflows/e2e.yaml 1970-01-01 01:00:00.000000000 +0100 +++ new/gitsign-0.17.1/.github/workflows/e2e.yaml 2026-07-29 22:57:55.000000000 +0200 @@ -0,0 +1,109 @@ +name: E2E + +on: + push: + branches: + - "main" + pull_request: + branches: + - "main" + workflow_dispatch: + +permissions: {} + +jobs: + e2e: + runs-on: ubuntu-latest + + permissions: + contents: read + + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + - name: Set up Go + uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 + with: + go-version-file: 'go.mod' + check-latest: true + cache: 'false' + + - name: Install Gitsign + run: | + set -e + + make build-gitsign + sudo mv ./gitsign /usr/local/bin/gitsign + + echo "PATH=${PATH}" + whereis gitsign + mkdir /tmp/git + cd /tmp/git + + git init -b main . + git config --global user.email "[email protected]" + git config --global user.name "gitsign" + git config --global gpg.x509.program gitsign + git config --global gpg.format x509 + git config --global commit.gpgsign true + + # Verify tool is on our path + gitsign -h + + - name: Get test OIDC token + run: | + SIGSTORE_ID_TOKEN=$(curl -sSfL https://storage.googleapis.com/sigstore-conformance-testing-token/untrusted-testing-token.txt) + echo "SIGSTORE_ID_TOKEN=$SIGSTORE_ID_TOKEN" >> "$GITHUB_ENV" + + - name: e2e unit tests + run: | + set -e + make e2e-test + + - name: Test Sign and Verify commit + run: | + set -e + cd /tmp/git + + # Sign commit + git commit --allow-empty -S --message="Signed commit" + + # Verify commit + echo "========== git verify-commit ==========" + git verify-commit HEAD + + echo "========== gitsign verify ==========" + gitsign verify \ + --certificate-oidc-issuer="https://accounts.google.com"; \ + --certificate-identity="[email protected]" + + # Extra debug info + git cat-file commit HEAD | sed -n '/-BEGIN/, /-END/p' | sed 's/^ //g' | sed 's/gpgsig //g' | sed 's/SIGNED MESSAGE/PKCS7/g' | openssl pkcs7 -print -print_certs -text + + - name: Test Sign and Verify commit - offline verification + env: + GITSIGN_REKOR_MODE: "offline" + run: | + set -e + cd /tmp/git + + # Sign commit + git commit --allow-empty -S --message="Signed commit" + + # Verify commit + echo "========== git verify-commit ==========" + git verify-commit HEAD + + echo "========== gitsign verify ==========" + gitsign verify \ + --certificate-oidc-issuer="https://accounts.google.com"; \ + --certificate-identity="[email protected]" + + # Extra debug info + git cat-file commit HEAD | sed -n '/-BEGIN/, /-END/p' | sed 's/^ //g' | sed 's/gpgsig //g' | sed 's/SIGNED MESSAGE/PKCS7/g' | openssl pkcs7 -print -print_certs -text + + - name: Debug log + if: failure() + run: cat "${GITSIGN_LOG}" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/gitsign-0.17.0/.github/workflows/release.yml new/gitsign-0.17.1/.github/workflows/release.yml --- old/gitsign-0.17.0/.github/workflows/release.yml 1970-01-01 01:00:00.000000000 +0100 +++ new/gitsign-0.17.1/.github/workflows/release.yml 2026-07-29 22:57:55.000000000 +0200 @@ -0,0 +1,74 @@ +name: release + +# run only on tags +on: + push: + tags: + - 'v*' + +permissions: {} + +jobs: + release: + runs-on: ubuntu-latest + + permissions: + contents: write # needed to write releases + id-token: write # needed for keyless signing + packages: write # needed for push images + attestations: write + + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + fetch-depth: 0 # this is important, otherwise it won't checkout the full tree (i.e. no previous tags) + + - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 + with: + go-version-file: 'go.mod' + check-latest: true + cache: 'false' + + - uses: imjasonh/setup-crane@feee3b6bb0d4c68370f256a4502498c9227e5c6b # v0.7 + + - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 + + - uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0 + + - name: Set env + run: echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> "$GITHUB_ENV" + + - name: Login to GitHub Containers + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 + with: + registry: ghcr.io + username: ${{ github.repository_owner }} + password: ${{ secrets.GITHUB_TOKEN }} + + - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3 + with: + version: latest + args: release --clean + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + KO_DOCKER_REPO: ghcr.io/sigstore/gitsign + + - name: get the digest + id: digest + run: | + digest=$(crane digest ghcr.io/sigstore/gitsign:${RELEASE_VERSION}) + echo "digest=${digest}" >> "$GITHUB_OUTPUT" + + - name: sign image + run: | + cosign sign "ghcr.io/sigstore/gitsign@${DIGEST_TO_SIGN}" + env: + DIGEST_TO_SIGN: ${{ steps.digest.outputs.digest }} + COSIGN_YES: true + + - name: Generate build provenance attestation + uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 + with: + subject-name: ghcr.io/sigstore/gitsign + subject-digest: ${{ steps.digest.outputs.digest }} + push-to-registry: true diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/gitsign-0.17.0/.github/workflows/validate-release.yml new/gitsign-0.17.1/.github/workflows/validate-release.yml --- old/gitsign-0.17.0/.github/workflows/validate-release.yml 1970-01-01 01:00:00.000000000 +0100 +++ new/gitsign-0.17.1/.github/workflows/validate-release.yml 2026-07-29 22:57:55.000000000 +0200 @@ -0,0 +1,56 @@ +name: validate-release + +on: + pull_request: + branches: + - "main" + workflow_dispatch: + +permissions: {} + +jobs: + validate-release: + runs-on: ubuntu-latest + + permissions: + contents: read + + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 + with: + go-version-file: 'go.mod' + check-latest: true + cache: 'false' + + - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 + with: + path: ~/go/pkg/mod + key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }} + restore-keys: | + ${{ runner.os }}-go- + + # This job only validates that the release config still works end to end, + # so there is no value in cross-compiling every os/arch pair. Trim the + # matrix to a single target to keep the job fast. `goreleaser release` + # has no --single-target flag, and templates are not supported in + # builds.targets, so patch the config in place instead. + - name: Reduce build matrix to linux/amd64 + run: | + yq -i ' + .builds[].goos = ["linux"] | + .builds[].goarch = ["amd64"] | + .kos[].platforms = ["linux/amd64"] + ' .goreleaser.yaml + + - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 + - uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0 + - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3 + with: + version: latest + args: release --clean --snapshot --skip=sign + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/gitsign-0.17.0/.github/workflows/verify.yml new/gitsign-0.17.1/.github/workflows/verify.yml --- old/gitsign-0.17.0/.github/workflows/verify.yml 1970-01-01 01:00:00.000000000 +0100 +++ new/gitsign-0.17.1/.github/workflows/verify.yml 2026-07-29 22:57:55.000000000 +0200 @@ -0,0 +1,82 @@ +name: Verify + +on: + pull_request: + branches: + - "main" + +permissions: {} + +jobs: + license-check: + name: license boilerplate check + runs-on: ubuntu-latest + + permissions: + contents: read + + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 + with: + go-version-file: 'go.mod' + check-latest: true + cache: 'false' + + - name: Install addlicense + run: go install github.com/google/[email protected] + + - name: Check license headers + run: | + set -e + addlicense -l apache -c 'The Sigstore Authors' -v \ + -ignore "*.yml" \ + -ignore "*.yaml" \ + -ignore "internal/fork/**" \ + * + git diff --exit-code + + golangci: + name: lint + runs-on: ubuntu-latest + + permissions: + contents: read + + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 + with: + go-version-file: 'go.mod' + check-latest: true + cache: 'false' + + - name: golangci-lint + uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0 + + generate-docs: + name: generate-docs + runs-on: ubuntu-latest + + permissions: + contents: read + + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 + with: + go-version-file: 'go.mod' + check-latest: true + cache: 'false' + + - name: Check CLI docs are up to date + run: ./hack/presubmit.sh diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/gitsign-0.17.0/.gitignore new/gitsign-0.17.1/.gitignore --- old/gitsign-0.17.0/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/gitsign-0.17.1/.gitignore 2026-07-29 22:57:55.000000000 +0200 @@ -0,0 +1,8 @@ +# Vim swap files +*.swp +dist/* +.vscode/* +/gitsign +/gitsign-credential-cache +!/cmd/gitsign-credential-cache +vendor diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/gitsign-0.17.0/internal/fulcio/identity.go new/gitsign-0.17.1/internal/fulcio/identity.go --- old/gitsign-0.17.0/internal/fulcio/identity.go 2026-07-29 21:24:30.000000000 +0200 +++ new/gitsign-0.17.1/internal/fulcio/identity.go 2026-07-29 22:57:55.000000000 +0200 @@ -278,6 +278,7 @@ authFlow = &oauthflow.StaticTokenGetter{RawToken: idToken} } + fmt.Fprintln(f.out, "Generating ephemeral keys...") // nolint:errcheck priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader) if err != nil { return nil, fmt.Errorf("generating private key: %w", err) ++++++ gitsign.obsinfo ++++++ --- /var/tmp/diff_new_pack.OcNoEq/_old 2026-09-17 15:20:06.373708535 +0200 +++ /var/tmp/diff_new_pack.OcNoEq/_new 2026-09-17 15:20:06.378708744 +0200 @@ -1,5 +1,5 @@ name: gitsign -version: 0.17.0 -mtime: 1785353070 -commit: 7de6b7bf5a05c607c8cbce8d03d7114562553811 +version: 0.17.1 +mtime: 1785358675 +commit: 44f5e17fac6944fdde71c94d2e77ab075c9dca9f ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/gitsign/vendor.tar.gz /work/SRC/openSUSE:Factory/.gitsign.new.383539/vendor.tar.gz differ: char 5, line 1
