Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package apko for openSUSE:Factory checked in at 2026-10-20 12:37:36 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/apko (Old) and /work/SRC/openSUSE:Factory/.apko.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "apko" Tue Oct 20 12:37:36 2026 rev:143 rq:1386143 version:1.4.12 Changes: -------- --- /work/SRC/openSUSE:Factory/apko/apko.changes 2026-10-12 22:06:18.900050174 +0200 +++ /work/SRC/openSUSE:Factory/.apko.new.3698736/apko.changes 2026-10-20 12:38:28.777920082 +0200 @@ -1,0 +2,27 @@ +Mon Oct 19 04:57:33 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 1.4.12: + * build(deps): bump github.com/klauspost/compress from 1.20.1 to + 1.20.3 (#2582) + * build(deps): bump google.golang.org/api from 0.301.0 to 0.302.0 + (#2584) + * build(deps): bump chainguard.dev/sdk from 0.1.371 to 0.1.373 + (#2585) + * build(deps): bump google.golang.org/api from 0.300.0 to 0.301.0 + (#2568) + * build(deps): bump golang.org/x/term from 0.46.0 to 0.47.0 + (#2570) + * build(deps): bump the codeql group across 1 directory with 2 + updates (#2574) + * build(deps): bump github.com/github/go-spdx/v2 from 2.7.0 to + 2.7.1 (#2571) + * build(deps): bump chainguard.dev/sdk from 0.1.337 to 0.1.371 + (#2581) + * build(deps): bump github.com/prometheus/client_golang from + 1.24.1 to 1.25.0 (#2573) + * build(deps): bump golang.org/x/sync from 0.23.0 to 0.24.0 + (#2563) + * build(deps): bump chainguard.dev/sdk from 0.1.331 to 0.1.337 + (#2564) + +------------------------------------------------------------------- Old: ---- apko-1.4.11.obscpio New: ---- apko-1.4.12.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ apko.spec ++++++ --- /var/tmp/diff_new_pack.oPaQZM/_old 2026-10-20 12:38:30.312983023 +0200 +++ /var/tmp/diff_new_pack.oPaQZM/_new 2026-10-20 12:38:30.314983105 +0200 @@ -17,7 +17,7 @@ Name: apko -Version: 1.4.11 +Version: 1.4.12 Release: 0 Summary: Build OCI images from APK packages directly without Dockerfile License: Apache-2.0 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.oPaQZM/_old 2026-10-20 12:38:30.344984335 +0200 +++ /var/tmp/diff_new_pack.oPaQZM/_new 2026-10-20 12:38:30.347984458 +0200 @@ -3,7 +3,7 @@ <param name="url">https://github.com/chainguard-dev/apko.git</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">refs/tags/v1.4.11</param> + <param name="revision">refs/tags/v1.4.12</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> <param name="changesgenerate">enable</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.oPaQZM/_old 2026-10-20 12:38:30.367985279 +0200 +++ /var/tmp/diff_new_pack.oPaQZM/_new 2026-10-20 12:38:30.370985402 +0200 @@ -3,6 +3,6 @@ <param name="url">https://github.com/chainguard-dev/apko</param> <param name="changesrevision">861f83f69e6fa9114405a2f7bb5cf6585ad00421</param></service><service name="tar_scm"> <param name="url">https://github.com/chainguard-dev/apko.git</param> - <param name="changesrevision">5b3c3182430465dd2212a656411267f150034255</param></service></servicedata> + <param name="changesrevision">0c659afba7f7842a3b18cdd5108675455339912b</param></service></servicedata> (No newline at EOF) ++++++ apko-1.4.11.obscpio -> apko-1.4.12.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/apko-1.4.11/.chainguard/ci/env/default.yaml new/apko-1.4.12/.chainguard/ci/env/default.yaml --- old/apko-1.4.11/.chainguard/ci/env/default.yaml 1970-01-01 01:00:00.000000000 +0100 +++ new/apko-1.4.12/.chainguard/ci/env/default.yaml 2026-10-16 16:50:56.000000000 +0200 @@ -0,0 +1,8 @@ +# Copyright 2026 Chainguard, Inc. +# SPDX-License-Identifier: Apache-2.0 + +# Every check file declares its own environment, so this empty default +# changes none of them. +version: 1 + +environment: {} diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/apko-1.4.11/.chainguard/ci/env/examples-docker.yaml new/apko-1.4.12/.chainguard/ci/env/examples-docker.yaml --- old/apko-1.4.11/.chainguard/ci/env/examples-docker.yaml 1970-01-01 01:00:00.000000000 +0100 +++ new/apko-1.4.12/.chainguard/ci/env/examples-docker.yaml 2026-10-16 16:50:56.000000000 +0200 @@ -0,0 +1,24 @@ +# Copyright 2026 Chainguard, Inc. +# SPDX-License-Identifier: Apache-2.0 + +# env/examples.yaml plus a Docker daemon, for checks that docker load and +# docker run the images apko built. +version: 1 + +environment: + packages: + - go-1.27~1.27 + - bash + - coreutils + - findutils + - git + - grep + - jq + - make + - crane~0.22 + - openssl # hack/test-certificates.sh fingerprints the bundles + - sed + services: [docker] + vars: + GOTOOLCHAIN: local + GOTMPDIR: /var/tmp diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/apko-1.4.11/.chainguard/ci/env/examples.yaml new/apko-1.4.12/.chainguard/ci/env/examples.yaml --- old/apko-1.4.11/.chainguard/ci/env/examples.yaml 1970-01-01 01:00:00.000000000 +0100 +++ new/apko-1.4.12/.chainguard/ci/env/examples.yaml 2026-10-16 16:50:56.000000000 +0200 @@ -0,0 +1,20 @@ +# Copyright 2026 Chainguard, Inc. +# SPDX-License-Identifier: Apache-2.0 + +# Builds apko from the tree (make apko) and runs it against examples/. +version: 1 + +environment: + packages: + - go-1.27~1.27 # go.mod's go directive; GOTOOLCHAIN=local refuses an older one + - bash + - coreutils + - findutils + - git + - grep + - jq + - make + - crane~0.22 + vars: + GOTOOLCHAIN: local + GOTMPDIR: /var/tmp diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/apko-1.4.11/.chainguard/ci/env/registry.yaml new/apko-1.4.12/.chainguard/ci/env/registry.yaml --- old/apko-1.4.11/.chainguard/ci/env/registry.yaml 1970-01-01 01:00:00.000000000 +0100 +++ new/apko-1.4.12/.chainguard/ci/env/registry.yaml 2026-10-16 16:50:56.000000000 +0200 @@ -0,0 +1,20 @@ +# Copyright 2026 Chainguard, Inc. +# SPDX-License-Identifier: Apache-2.0 + +# env/examples.yaml plus a registry on localhost:5000 for apko publish. +version: 1 + +environment: + packages: + - go-1.27~1.27 + - bash + - coreutils + - git + - grep + - jq + - make + - crane~0.22 + services: [registry] + vars: + GOTOOLCHAIN: local + GOTMPDIR: /var/tmp diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/apko-1.4.11/.chainguard/ci/go.yaml new/apko-1.4.12/.chainguard/ci/go.yaml --- old/apko-1.4.11/.chainguard/ci/go.yaml 1970-01-01 01:00:00.000000000 +0100 +++ new/apko-1.4.12/.chainguard/ci/go.yaml 2026-10-16 16:50:56.000000000 +0200 @@ -0,0 +1,129 @@ +# Copyright 2026 Chainguard, Inc. +# SPDX-License-Identifier: Apache-2.0 + +# Unit tests, lint, and the build with its hack/ci end-to-end scripts. +version: 1 + +checks: + test: + description: >- + Runs make test (go test -race ./...) with erofs-utils installed, so the + EROFS writer tests get fsck.erofs as a second opinion instead of + degrading to a t.Log. + environment: + packages: + - go-1.27~1.27 # go.mod's go directive; GOTOOLCHAIN=local refuses an older one + - bash + - build-base # cgo for -race + - git + - make + - erofs-utils~1.9 + vars: + GOTOOLCHAIN: local + GOTMPDIR: /var/tmp + trigger: [presubmit, postsubmit] + resources: medium-amd64 + timeout: 30m + network: + egress: + - proxy.golang.org + - sum.golang.org + - storage.googleapis.com + - packages.wolfi.dev + - apk.cgr.dev + - alpinelinux.org + - dl-cdn.alpinelinux.org + - files.example.com + steps: + - name: fsck.erofs on PATH + # The tests skip the fsck.erofs cross-check when it is missing, so a + # silent install failure would look like a pass. + cmd: [sh, -c, "command -v fsck.erofs"] + - name: test + shell: bash + # The golden fixtures expect SOURCE_DATE_EPOCH=0 and set it + # themselves; a random value here catches a test that reads the + # ambient one instead. + script: | + SOURCE_DATE_EPOCH=$(awk 'BEGIN { now = systime(); srand(now); print 1 + int(rand() * now) }') + export SOURCE_DATE_EPOCH + make test + + lint: + description: >- + golangci-lint over the module, then make generate and go mod tidy, + failing if either leaves the tree dirty. + environment: + packages: + - go-1.27~1.27 + - bash + - build-base + - git + - make + # Wolfi's 2.13 builds predate Go 1.27 and cannot read its export data. + # The Makefile's golangci-lint target reads this pin. + - golangci-lint~2.14 + vars: + GOTOOLCHAIN: local + GOTMPDIR: /var/tmp + trigger: [presubmit, postsubmit] + resources: medium + timeout: 15m + network: + egress: + - proxy.golang.org + - sum.golang.org + - storage.googleapis.com + steps: + - name: golangci-lint + cmd: golangci-lint run + - name: generate and tidy + script: | + make generate + go mod tidy + git diff --exit-code + + build: + description: >- + Builds apko, runs the hack/ci end-to-end scripts (build and publish + wolfi-base for amd64 and arm64, run it under Docker, and read the + per-arch layers back with crane), then builds an unsigned goreleaser + snapshot. + environment: + packages: + - go-1.27~1.27 + - bash + - git + - make + - crane~0.22 + - goreleaser~2.18 + - grep + - sed + services: [docker] + vars: + GOTOOLCHAIN: local + GOTMPDIR: /var/tmp + trigger: [presubmit, postsubmit] + resources: medium-amd64 + timeout: 45m + network: + egress: + - proxy.golang.org + - sum.golang.org + - storage.googleapis.com + - packages.wolfi.dev + - apk.cgr.dev + # hack/ci/01-publish.sh runs index.docker.io/library/registry:2.8.1. + # Docker Hub serves layers from a different CDN from one pull to the + # next: its own *.docker.com names, an S3 bucket, or an R2 bucket. + - "*.docker.io" + - "*.docker.com" + - docker-images-prod.s3.dualstack.us-east-1.amazonaws.com + - docker-images-prod.6aa30f8b08e16409b46e0173d6de2f56.r2.cloudflarestorage.com + steps: + - name: build + cmd: [sh, -c, "make apko && ./apko version"] + - name: hack/ci + cmd: make ci + - name: snapshot + cmd: [sh, -c, "make snapshot && ./dist/apko-build_linux_amd64_v1/apko version"] diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/apko-1.4.11/.chainguard/ci/identities.yaml new/apko-1.4.12/.chainguard/ci/identities.yaml --- old/apko-1.4.11/.chainguard/ci/identities.yaml 1970-01-01 01:00:00.000000000 +0100 +++ new/apko-1.4.12/.chainguard/ci/identities.yaml 2026-10-16 16:50:56.000000000 +0200 @@ -0,0 +1,40 @@ +# Copyright 2026 Chainguard, Inc. +# SPDX-License-Identifier: Apache-2.0 + +version: 1 +# apko is public: a pull request reaches subring `member` only when a +# chainguard-dev member or dependabot opened it, so a fork's pull request +# from anyone else never holds an identity. +trust: + groups: + members: {github: {org: chainguard-dev}} + bots: + github: + app: + dependabot: 49699333 + subrings: + member: {authors: [members, bots]} + github_token: 1.member +identities: + # Pulls cgr.dev/chainguard-private/distribution, the registry go/build's + # hack/ci tests run under Docker. The Chainguard identity is + # chainguard-dev/mono env/chainguard-images/iac/sandbox-apko-registry-pull.tf: + # registry.pull on chainguard-private. + registry-pull: + ring: 1.member + checks: + - go.checks.build + audiences: + - urn:chainguard:apko:registry-pull + chainguard: + cgr.dev: + identity: ce2d1984a010471142503340d670612d63ffb9f6/1f42412170e21a5e + exchange_audience: urn:chainguard:apko:registry-pull + role: registry.pull + scopes: + - ce2d1984a010471142503340d670612d63ffb9f6 + allow: + - run: presubmit + target_ref: refs/heads/main + - run: postsubmit + ref: refs/heads/main diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/apko-1.4.11/.chainguard/ci/samples.yaml new/apko-1.4.12/.chainguard/ci/samples.yaml --- old/apko-1.4.11/.chainguard/ci/samples.yaml 1970-01-01 01:00:00.000000000 +0100 +++ new/apko-1.4.12/.chainguard/ci/samples.yaml 2026-10-16 16:50:56.000000000 +0200 @@ -0,0 +1,218 @@ +# Copyright 2026 Chainguard, Inc. +# SPDX-License-Identifier: Apache-2.0 + +# End-to-end checks of apko against examples/. Each check builds apko from +# the tree with make apko. +version: 1 + +environment: examples + +checks: + nginx: + description: >- + Builds examples/nginx.yaml for each arch and validates every SBOM it + writes with spdx-tools-java. apko installs packages without running + them, so the aarch64 build needs no emulation. + environment: + packages: + - go-1.27~1.27 + - bash + - make + - spdx-tools-java~2.0 + vars: + GOTOOLCHAIN: local + GOTMPDIR: /var/tmp + trigger: [presubmit, postsubmit] + timeout: 15m + foreach: + - vars: {ARCH: x86_64} + - vars: {ARCH: aarch64} + network: + egress: &egress + - proxy.golang.org + - sum.golang.org + - storage.googleapis.com + - packages.wolfi.dev + - apk.cgr.dev + - cgr.dev + - 9236a389bd48b984df91adc1bc924620.r2.cloudflarestorage.com + - dl-cdn.alpinelinux.org + - alpinelinux.org + - spdx.org + script: | + make apko + ./apko build ./examples/nginx.yaml nginx:build "/tmp/nginx-${ARCH}.tar" --arch "${ARCH}" + ls ./*.spdx.json + for f in ./*.spdx.json; do + tools-java Verify "$f" + done + + all-examples: + description: >- + Builds every examples/**/*.yaml for the host arch, online and then + --offline from the cache the first build filled; an example with a + build.sh beside it runs that instead. The GitHub workflow also ran this + on macos-latest, which Checks has no guest for. + trigger: [presubmit, postsubmit] + timeout: 30m + vars: + # /tmp is a tmpfs sized from guest RAM, which the larger examples fill. + TMPDIR: /var/tmp + network: + egress: *egress + shell: bash + script: | + set -eu + make apko + while IFS= read -r cfg; do + name=$(basename "${cfg}" .yaml) + echo "Building ${name}..." + build_script=$(dirname "${cfg}")/build.sh + if [ -f "${build_script}" ]; then + "${build_script}" ./apko + else + ./apko build "${cfg}" "${name}:build" /var/tmp/"${name}".tar + ./apko build --offline "${cfg}" "${name}:build" /var/tmp/"${name}".tar + fi + done < <(find ./examples/ -name '*.yaml') + + reproducible: + description: >- + Publishes examples/wolfi-base.yaml for x86_64 and aarch64 ten times to a + local registry and fails if any digest differs: once with + SOURCE_DATE_EPOCH=0, and once without it, where the image timestamp is + the newest build date among the resolved APKs. + environment: registry + trigger: [presubmit, postsubmit] + timeout: 20m + foreach: + - name: source-date-epoch + vars: {SOURCE_DATE_EPOCH: "0"} + - name: build-date-epoch + network: + egress: *egress + shell: bash + script: | + set -eu + make apko + FIRST=$(./apko publish ./examples/wolfi-base.yaml localhost:5000/wolfi --arch x86_64,aarch64 2> /dev/null) + for idx in {2..10}; do + NEXT=$(./apko publish ./examples/wolfi-base.yaml localhost:5000/wolfi --arch x86_64,aarch64 2> /dev/null) + if [ "${FIRST}" = "${NEXT}" ]; then + echo "Build ${idx} matches." + else + echo "Build ${idx} differs: ${FIRST} and ${NEXT}" + exit 1 + fi + done + + annotations: + description: >- + Publishes examples/nginx.yaml to a local registry and checks its + annotations on the index and the arm64 manifest, and its labels in the + arm64 config. + environment: registry + trigger: [presubmit, postsubmit] + timeout: 15m + network: + egress: *egress + script: | + set -eu + make apko + ref=$(./apko publish ./examples/nginx.yaml localhost:5000/nginx --arch x86_64,aarch64) + crane manifest "$ref" | jq -r '.annotations.foo' | grep bar + crane manifest --platform=linux/arm64 "$ref" | jq -r '.annotations.foo' | grep bar + crane config --platform=linux/arm64 "$ref" | jq -r '.config.Labels' | grep bar + + certificates: + description: >- + Builds examples/certificates.yaml and examples/package-certificates.yaml + and runs each image under Docker to check the CA bundle and the Java + trust store hold the expected certificates, before and after + update-ca-certificates. + environment: examples-docker + trigger: [presubmit, postsubmit] + resources: medium-amd64 # the images are built --arch amd64 and run here + timeout: 20m + foreach: + - name: certificates + vars: + YAML: ./examples/certificates.yaml + FINGERPRINTS: >- + E7:05:70:A9:89:F8:56:5A:AB:DF:7C:AE:27:AB:D1:62:18:72:D6:A3:F8:11:E3:FE:F2:7E:3D:BA:02:91:21:98 + 9B:2A:33:9F:E6:A3:E8:55:85:C4:CD:75:53:6C:B8:C1:CF:7C:D6:03:B9:A6:4B:EC:25:21:85:8A:E4:8D:A8:5D + - name: package-certificates + vars: + YAML: ./examples/package-certificates.yaml + FINGERPRINTS: >- + E7:05:70:A9:89:F8:56:5A:AB:DF:7C:AE:27:AB:D1:62:18:72:D6:A3:F8:11:E3:FE:F2:7E:3D:BA:02:91:21:98 + 9B:2A:33:9F:E6:A3:E8:55:85:C4:CD:75:53:6C:B8:C1:CF:7C:D6:03:B9:A6:4B:EC:25:21:85:8A:E4:8D:A8:5D + 34:75:37:AF:7A:09:D4:03:F1:9F:58:F8:3C:35:68:91:2A:F2:4B:7C:12:E7:45:F1:D5:55:70:79:70:8C:91:AD + 12:AE:34:99:9A:A6:4D:CD:1A:69:47:E8:38:A5:3A:AB:AB:FC:FA:CA:45:AB:CA:8D:C0:CB:B8:DC:B7:BD:06:3C + network: + egress: *egress + # FINGERPRINTS is split on whitespace into the script's arguments. + script: | + # shellcheck disable=SC2086 + ./hack/test-certificates.sh "${YAML}" ${FINGERPRINTS} + + on-top-of-base: + description: >- + Builds examples/on_top_of_base on cgr.dev/chainguard/busybox, whose + /lib is a symlink to /usr/lib, and runs /bin/sh and /bin/busybox from + the result under Docker on a guest of each arch, which fails if apko + broke the usr-merge symlink. + environment: examples-docker + trigger: [presubmit, postsubmit] + timeout: 20m + foreach: + - name: x86_64 + vars: {ARCH: x86_64, IMAGE_TAG: "base_image:latest-amd64"} + resources: medium-amd64 + - name: aarch64 + vars: {ARCH: aarch64, IMAGE_TAG: "base_image:latest-arm64"} + resources: medium-arm64 + network: + egress: *egress + script: | + set -eu + make apko + ./examples/on_top_of_base/build.sh ./apko cgr.dev/chainguard/busybox:latest "test-output-${ARCH}.tar" "${ARCH}" + docker load -i "test-output-${ARCH}.tar" + docker run --rm --entrypoint /bin/sh "${IMAGE_TAG}" -c "echo 'Shell works on ${ARCH}'" | grep -q "Shell works" + docker run --rm --entrypoint /bin/busybox "${IMAGE_TAG}" echo "Busybox works" | grep -q "Busybox works" + + erofs-mount: + description: >- + The one place an apko-built EROFS layer meets the kernel driver and + erofs-utils: hack/test-erofs.sh builds examples/wolfi-base.yaml as + EROFS, fscks it, mounts it single and layered, read-only and --rw, and + compares the trees with apko erofs ls and a tar build. + environment: + packages: + - go-1.27~1.27 + - bash + - coreutils + - erofs-utils~1.9 + - findutils + - jq + - make + - mount + - umount + - util-linux-misc # mountpoint + vars: + GOTOOLCHAIN: local + GOTMPDIR: /var/tmp + trigger: [presubmit, postsubmit] + timeout: 15m + vars: + # The --rw section's overlay upperdir cannot live on the overlay that + # /var/tmp is part of; tmpfs takes it. + TMPDIR: /tmp + network: + egress: *egress + script: | + set -eu + grep -qw erofs /proc/filesystems + make apko + ./hack/test-erofs.sh ./examples/wolfi-base.yaml diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/apko-1.4.11/.chainguard/ci/services/docker/docker.sh new/apko-1.4.12/.chainguard/ci/services/docker/docker.sh --- old/apko-1.4.11/.chainguard/ci/services/docker/docker.sh 1970-01-01 01:00:00.000000000 +0100 +++ new/apko-1.4.12/.chainguard/ci/services/docker/docker.sh 2026-10-16 16:50:56.000000000 +0200 @@ -0,0 +1,32 @@ +#!/bin/sh + +# Copyright 2026 Chainguard, Inc. +# SPDX-License-Identifier: Apache-2.0 + +set -eu +if [ "$(id -u)" != 0 ]; then + echo "docker service requires a root job" >&2 + exit 1 +fi +# Guest init binds this path to scratch: Docker's overlay store cannot use +# the erofs guest root's overlay as its upper filesystem. +set -- dockerd --host=unix:///var/run/docker.sock \ + --data-root=/var/lib/chainguard-microvm/docker --storage-driver=overlay2 +for ca in /usr/local/share/ca-certificates/microvm-guest-ca-*.crt; do + [ -f "$ca" ] || continue + set -- "$@" --add-runtime=cg-trust=/usr/local/bin/cg-runc-trust --default-runtime=cg-trust + break +done +"$@" & +daemon=$! +trap 'kill "$daemon" 2>/dev/null || true' EXIT +trap 'exit 1' HUP INT TERM +until docker --host=unix:///var/run/docker.sock info >/dev/null 2>&1; do + kill -0 "$daemon" 2>/dev/null || exit 1 + sleep 0.1 +done +printf '\n::service-ready::\n' +# With set -e, a nonzero daemon exit becomes the wrapper's exit status. +wait "$daemon" +# Even a clean daemon exit is unexpected while the job still needs it. +exit 1 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/apko-1.4.11/.chainguard/ci/services/docker/docker.yaml new/apko-1.4.12/.chainguard/ci/services/docker/docker.yaml --- old/apko-1.4.11/.chainguard/ci/services/docker/docker.yaml 1970-01-01 01:00:00.000000000 +0100 +++ new/apko-1.4.12/.chainguard/ci/services/docker/docker.yaml 2026-10-16 16:50:56.000000000 +0200 @@ -0,0 +1,10 @@ +# Copyright 2026 Chainguard, Inc. +# SPDX-License-Identifier: Apache-2.0 + +version: 1 +name: docker +packages: [busybox, docker, iptables] +cmd: [sh, ./docker.sh] +timeout: 5m +exports: + DOCKER_HOST: unix:///var/run/docker.sock diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/apko-1.4.11/.chainguard/ci/services/registry/registry.sh new/apko-1.4.12/.chainguard/ci/services/registry/registry.sh --- old/apko-1.4.11/.chainguard/ci/services/registry/registry.sh 1970-01-01 01:00:00.000000000 +0100 +++ new/apko-1.4.12/.chainguard/ci/services/registry/registry.sh 2026-10-16 16:50:56.000000000 +0200 @@ -0,0 +1,17 @@ +#!/bin/sh + +# Copyright 2026 Chainguard, Inc. +# SPDX-License-Identifier: Apache-2.0 + +set -eu +crane registry serve --address "127.0.0.1:${REGISTRY_PORT}" & +daemon=$! +trap 'kill "$daemon" 2>/dev/null || true' EXIT +trap 'exit 1' HUP INT TERM +until crane catalog --insecure "localhost:${REGISTRY_PORT}" >/dev/null 2>&1; do + kill -0 "$daemon" 2>/dev/null || exit 1 + sleep 0.1 +done +printf '\n::service-ready::\n' +wait "$daemon" +exit 1 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/apko-1.4.11/.chainguard/ci/services/registry/registry.yaml new/apko-1.4.12/.chainguard/ci/services/registry/registry.yaml --- old/apko-1.4.11/.chainguard/ci/services/registry/registry.yaml 1970-01-01 01:00:00.000000000 +0100 +++ new/apko-1.4.12/.chainguard/ci/services/registry/registry.yaml 2026-10-16 16:50:56.000000000 +0200 @@ -0,0 +1,15 @@ +# Copyright 2026 Chainguard, Inc. +# SPDX-License-Identifier: Apache-2.0 + +# An in-memory OCI registry on localhost, in place of the +# chainguard-dev/actions/setup-registry action the workflows used. +version: 1 +name: registry +packages: [busybox, crane] +cmd: [sh, ./registry.sh] +timeout: 30s +inputs: + port: + type: integer + default: "5000" + env: REGISTRY_PORT diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/apko-1.4.11/.chainguard/ci/workflows.yaml new/apko-1.4.12/.chainguard/ci/workflows.yaml --- old/apko-1.4.11/.chainguard/ci/workflows.yaml 1970-01-01 01:00:00.000000000 +0100 +++ new/apko-1.4.12/.chainguard/ci/workflows.yaml 2026-10-16 16:50:56.000000000 +0200 @@ -0,0 +1,46 @@ +# Copyright 2026 Chainguard, Inc. +# SPDX-License-Identifier: Apache-2.0 + +# Lints the GitHub Actions workflows that remain (codeql, release). +version: 1 + +environment: + packages: [actionlint~1.7, shellcheck~0.11, zizmor~1.30, bash, findutils, grep] + +checks: + actionlint: + when: + changed: + - ".github/workflows/**" + - ".github/actions/**" + - ".chainguard/ci/workflows.yaml" + description: >- + Runs actionlint, with shellcheck on, over every workflow under + .github/workflows. + trigger: [presubmit, postsubmit] + timeout: 5m + vars: + SHELLCHECK_OPTS: --exclude=SC2129 + shell: bash + script: | + set -eu + mapfile -t yamls < <(find .github/workflows -name "*.y*ml" | grep -v dependabot.) + actionlint "${yamls[@]}" + + zizmor: + when: + changed: + - ".github/workflows/**" + - ".github/actions/**" + - ".github/dependabot.yml" + - ".github/zizmor.yml" + - ".chainguard/ci/workflows.yaml" + description: >- + Runs zizmor with the pedantic persona over .github, failing on any + finding. The GitHub workflow uploaded SARIF to Code Scanning instead; + a check has no token that can. It runs offline, so the audits that + query GitHub (impostor commits, known-vulnerable actions, stale pins) + are skipped. + trigger: [presubmit, postsubmit] + timeout: 5m + cmd: zizmor --persona pedantic --offline .github diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/apko-1.4.11/Makefile new/apko-1.4.12/Makefile --- old/apko-1.4.11/Makefile 2026-10-10 20:07:53.000000000 +0200 +++ new/apko-1.4.12/Makefile 2026-10-16 16:50:56.000000000 +0200 @@ -110,11 +110,11 @@ GOLANGCI_LINT_DIR = $(shell pwd)/bin GOLANGCI_LINT_BIN = $(GOLANGCI_LINT_DIR)/golangci-lint -LINT_WORKFLOW = .github/workflows/verify.yaml -# Read the version out of the workflow rather than pinning it again here, so -# `make lint` cannot drift from CI. go install takes "v2.11" as a prefix query -# and picks the highest v2.11.x, which is what golangci-lint-action does too. -GOLANGCI_LINT_VERSION = $(shell sed -n '/golangci-lint-action/,/version:/s/^[[:space:]]*version:[[:space:]]*//p' $(LINT_WORKFLOW)) +LINT_WORKFLOW = .chainguard/ci/go.yaml +# Read the version out of the lint check's package pin (golangci-lint~2.14) +# rather than pinning it again here, so `make lint` cannot drift from CI. go +# install takes "v2.14" as a prefix query and picks the highest v2.14.x. +GOLANGCI_LINT_VERSION = $(shell sed -n 's/^[[:space:]]*-[[:space:]]*golangci-lint~\([0-9.]*\).*/v\1/p' $(LINT_WORKFLOW)) .PHONY: golangci-lint golangci-lint: diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/apko-1.4.11/go.mod new/apko-1.4.12/go.mod --- old/apko-1.4.11/go.mod 2026-10-10 20:07:53.000000000 +0200 +++ new/apko-1.4.12/go.mod 2026-10-16 16:50:56.000000000 +0200 @@ -3,11 +3,11 @@ go 1.27.0 require ( - chainguard.dev/sdk v0.1.331 + chainguard.dev/sdk v0.1.373 github.com/chainguard-dev/clog v1.8.1 github.com/charmbracelet/log v1.0.0 github.com/erofs/go-erofs v0.3.2-0.20260804074615-52cc42c5291c - github.com/github/go-spdx/v2 v2.7.0 + github.com/github/go-spdx/v2 v2.7.1 github.com/go-git/go-git/v5 v5.19.3 github.com/google/go-cmp v0.7.0 github.com/google/go-containerregistry v0.22.1 @@ -16,12 +16,12 @@ github.com/hashicorp/go-retryablehttp v0.7.8 github.com/hashicorp/golang-lru/v2 v2.0.7 github.com/invopop/jsonschema v0.14.0 - github.com/klauspost/compress v1.20.1 + github.com/klauspost/compress v1.20.3 github.com/klauspost/pgzip v1.2.7 github.com/package-url/packageurl-go v0.1.7 github.com/pavlo-v-chernykh/keystore-go/v4 v4.5.0 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c - github.com/prometheus/client_golang v1.24.1 + github.com/prometheus/client_golang v1.25.0 github.com/spf13/cobra v1.10.2 github.com/stretchr/testify v1.12.1 github.com/tmc/dot v0.2.0 @@ -31,11 +31,11 @@ go.opentelemetry.io/otel/trace v1.47.0 go.step.sm/crypto v0.91.0 golang.org/x/oauth2 v0.37.0 - golang.org/x/sync v0.23.0 - golang.org/x/sys v0.48.0 - golang.org/x/term v0.46.0 + golang.org/x/sync v0.24.0 + golang.org/x/sys v0.49.0 + golang.org/x/term v0.47.0 golang.org/x/time v0.16.0 - google.golang.org/api v0.300.0 + google.golang.org/api v0.302.0 gopkg.in/ini.v1 v1.67.3 gopkg.in/yaml.v3 v3.0.1 k8s.io/apimachinery v0.37.1 @@ -44,7 +44,7 @@ require ( chainguard.dev/go-grpc-kit v0.20.0 // indirect - cloud.google.com/go/auth v0.24.0 // indirect + cloud.google.com/go/auth v0.24.1-0.20261001053825-dbc26066f70a // indirect cloud.google.com/go/auth/oauth2adapt v0.3.0 // indirect cloud.google.com/go/compute/metadata v0.10.0 // indirect dario.cat/mergo v1.0.2 // indirect @@ -84,9 +84,9 @@ github.com/go-logr/logr v1.4.4 // indirect github.com/go-logr/stdr v1.2.2 // indirect github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect - github.com/google/s2a-go v0.1.10 // indirect + github.com/google/s2a-go v0.1.11 // indirect github.com/google/uuid v1.6.0 // indirect - github.com/googleapis/enterprise-certificate-proxy v0.3.22 // indirect + github.com/googleapis/enterprise-certificate-proxy v0.3.23 // indirect github.com/googleapis/gax-go/v2 v2.26.2 // indirect github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.1.0 // indirect github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.4 // indirect @@ -110,8 +110,8 @@ github.com/pjbgf/sha1cd v0.7.0 // indirect github.com/pkg/errors v0.9.1 // indirect github.com/prometheus/client_model v0.6.3 // indirect - github.com/prometheus/common v0.70.1 // indirect - github.com/prometheus/procfs v0.21.1 // indirect + github.com/prometheus/common v0.72.0 // indirect + github.com/prometheus/procfs v0.22.0 // indirect github.com/rivo/uniseg v0.4.7 // indirect github.com/sergi/go-diff v1.4.0 // indirect github.com/sirupsen/logrus v1.10.2 // indirect @@ -131,12 +131,12 @@ go.opentelemetry.io/proto/otlp v1.11.0 // indirect go.yaml.in/yaml/v3 v3.0.5 // indirect go.yaml.in/yaml/v4 v4.0.0-rc.6 // indirect - golang.org/x/crypto v0.57.0 // indirect + golang.org/x/crypto v0.58.0 // indirect golang.org/x/exp v0.0.0-20260727155853-b88d891fe743 // indirect - golang.org/x/net v0.59.0 // indirect - golang.org/x/text v0.42.0 // indirect + golang.org/x/net v0.61.0 // indirect + golang.org/x/text v0.43.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20260921155816-b14227669459 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20261005182115-fad411399dd8 // indirect google.golang.org/grpc v1.84.0 // indirect google.golang.org/protobuf v1.36.12 // indirect gopkg.in/warnings.v0 v0.1.2 // indirect diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/apko-1.4.11/go.sum new/apko-1.4.12/go.sum --- old/apko-1.4.11/go.sum 2026-10-10 20:07:53.000000000 +0200 +++ new/apko-1.4.12/go.sum 2026-10-16 16:50:56.000000000 +0200 @@ -1,9 +1,9 @@ chainguard.dev/go-grpc-kit v0.20.0 h1:MDwZtTlUlMSMEPcoi9m8tnu4g+M88T1toUZ3Th/+0Gc= chainguard.dev/go-grpc-kit v0.20.0/go.mod h1:ocuwyRX9tqRRvJkS3/ZkDYGMnl+6FLC4bvF0cm6DGsk= -chainguard.dev/sdk v0.1.331 h1:CXQ5r/Xjveu+9+kkp4d8aDlWMauJKZCODiAZ/+vhUvU= -chainguard.dev/sdk v0.1.331/go.mod h1:E+WggSGnjgNwO2FbWQoJ15SooAvgHlCF+GNf2FrIb2c= -cloud.google.com/go/auth v0.24.0 h1:UYMbF8otPZnLAkNJ5/LYQYOq0ARcJS1P4JqTeMKbCYU= -cloud.google.com/go/auth v0.24.0/go.mod h1:IFG/AMA1VWfuTrdbieEsB2GcpJyJV/phGAvogkOoPR4= +chainguard.dev/sdk v0.1.373 h1:RBZUvUYCdM7eCKJfsRg8se5o9Af8dBmCOE89SSo/TEE= +chainguard.dev/sdk v0.1.373/go.mod h1:EhyK8jxoiqdsFK7ZwdCXCy8R9zHs20Su6L9rk5ceilA= +cloud.google.com/go/auth v0.24.1-0.20261001053825-dbc26066f70a h1:jW1ZLFy9oa5ai8LOI40z6s+DL1cO/L1KSm9hVGnibn8= +cloud.google.com/go/auth v0.24.1-0.20261001053825-dbc26066f70a/go.mod h1:1dmBXa9xfBvBr39ZnDUDkaaA91ccq9CcqENDgJA4d7c= cloud.google.com/go/auth/oauth2adapt v0.3.0 h1:FY8oSZpCYoUNv6QxVODuMjQz4IlSOVeiQtZ08vLPz88= cloud.google.com/go/auth/oauth2adapt v0.3.0/go.mod h1:7+2uCm7++XFO+/lN06c2HXpDXb/NMNn2/UwyBPbTnkk= cloud.google.com/go/compute/metadata v0.10.0 h1:pyKMUQSwchgkIBBJGdILqQbs/BNJXqwSA7Ej6LAvvtY= @@ -86,8 +86,8 @@ github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE= github.com/felixge/httpsnoop v1.1.0 h1:3YtUj32ZZkqZtt3sZZsClsymw/QDuVfpNhoA31zeORc= github.com/felixge/httpsnoop v1.1.0/go.mod h1:Zqxgdd+1Rkcz8euOqdr7lqgCRJztwr5hp9vDSi5UZCE= -github.com/github/go-spdx/v2 v2.7.0 h1:GzfXx4wFdlilARxmFRXW/mgUy3A4vSqZocCMFV6XFdQ= -github.com/github/go-spdx/v2 v2.7.0/go.mod h1:Ftc45YYG1WzpzwEPKRVm9Jv8vDqOrN4gWoCkK+bHer0= +github.com/github/go-spdx/v2 v2.7.1 h1:+siV9wnsncI5pg4otH/sKvqGL8UkcLdPh16TSJYY1V4= +github.com/github/go-spdx/v2 v2.7.1/go.mod h1:Ftc45YYG1WzpzwEPKRVm9Jv8vDqOrN4gWoCkK+bHer0= github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c= github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU= github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI= @@ -117,14 +117,14 @@ github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/google/go-containerregistry v0.22.1 h1:RZuuSYhTvlDvtsK+NkutoCZ//C0X2ebLK8X8l3ULs84= github.com/google/go-containerregistry v0.22.1/go.mod h1:bJR35SK8XgisYmhg/FMQ/5RK0S/XrOAqLBV5/LR2XE0= -github.com/google/s2a-go v0.1.10 h1:EMp+aOuXN6l8cE/gjF5Bt+vyZxsUuyCWe9chDWR/+uU= -github.com/google/s2a-go v0.1.10/go.mod h1:pz4tyvwXvJLLbyrkh6FW1eS2zPUXMaTmyNhYtyP2tNw= +github.com/google/s2a-go v0.1.11 h1:7v1V1TraNGP63WptsAkNqr2w8jgm4vM6A6qx6Lsw9iM= +github.com/google/s2a-go v0.1.11/go.mod h1:pz4tyvwXvJLLbyrkh6FW1eS2zPUXMaTmyNhYtyP2tNw= github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4= github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= -github.com/googleapis/enterprise-certificate-proxy v0.3.22 h1:NU4XpII6jD+Dxcot94fqjE+AfJoE/lQP9q3faYGzC/c= -github.com/googleapis/enterprise-certificate-proxy v0.3.22/go.mod h1:L3D/IQExI6LqEjBdXcZQ1WluSgigQmSwBboFstVPM4w= +github.com/googleapis/enterprise-certificate-proxy v0.3.23 h1:J+VGF1wjAM2dU2kKUXZxJdDppRLReWP7KWcclfngQhc= +github.com/googleapis/enterprise-certificate-proxy v0.3.23/go.mod h1:Y8NO/15GNLkrXI3OR5xOFmeU3XLX1sLSdtlXgJ0zmIw= github.com/googleapis/gax-go/v2 v2.26.2 h1:ydkmNXxj7bEmmeK5AihkKnWxyOyBR9TDebvp5L5izk8= github.com/googleapis/gax-go/v2 v2.26.2/go.mod h1:sMKqnMesnKH+3wiRJROcttA+cJoZoGbZl1vDQ8XYtGk= github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.1.0 h1:QGLs/O40yoNK9vmy4rhUGBVyMf1lISBGtXRpsu/Qu/o= @@ -151,8 +151,8 @@ github.com/kelseyhightower/envconfig v1.4.0/go.mod h1:cccZRl6mQpaq41TPp5QxidR+Sa3axMbJDNb//FQX6Gg= github.com/kevinburke/ssh_config v1.6.0 h1:J1FBfmuVosPHf5GRdltRLhPJtJpTlMdKTBjRgTaQBFY= github.com/kevinburke/ssh_config v1.6.0/go.mod h1:q2RIzfka+BXARoNexmF9gkxEX7DmvbW9P4hIVx2Kg4M= -github.com/klauspost/compress v1.20.1 h1:T7kKElXUMXrUJ2E9QhQhxFtcK5rPyLdsGZvdbLMPdiQ= -github.com/klauspost/compress v1.20.1/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI= +github.com/klauspost/compress v1.20.3 h1:zWNoFqq/lSuYQRim3dUXlXeA0IqwuZGicdG5ZTfY5j4= +github.com/klauspost/compress v1.20.3/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI= github.com/klauspost/pgzip v1.2.7 h1:02QB3Ttao6zOWDnSsv3bIvjN24bX0eGjWniQ8vuBfkA= github.com/klauspost/pgzip v1.2.7/go.mod h1:g7E6NrOKHOzah4QwK6Ue1tNCJs8IDiNOfjiXTr85U2E= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= @@ -203,14 +203,14 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= -github.com/prometheus/client_golang v1.24.1 h1:JnJkREXzWxUdCuPFpIWZiPispT9xVV59uiuyR2bPlnU= -github.com/prometheus/client_golang v1.24.1/go.mod h1:F+oSRECHg4sse5ucfYpYDeIv/hu68Zo0uoHKetWnzcE= +github.com/prometheus/client_golang v1.25.0 h1:cDtW1TcFsMi1RJc8khwCKB4VhzwV04aKqbYtNOXuiK0= +github.com/prometheus/client_golang v1.25.0/go.mod h1:j2X/4/kaQHLPnmyEU8zjmkndo1T317VpCIQEml8LTKk= github.com/prometheus/client_model v0.6.3 h1:O0jaTVAYNxTHYInEPFJt5I3+sN8zqBtVMPTB1qyxiEo= github.com/prometheus/client_model v0.6.3/go.mod h1:gpN5P9S7Rr6Yr92PiQ+Ixvhf6JZEkF1dnxsYL2aPBEM= -github.com/prometheus/common v0.70.1 h1:1HvjP4D5oL3t8RsPlwxA9onvvStjtIHYE5XuuwOi/PY= -github.com/prometheus/common v0.70.1/go.mod h1:VdFUQDMZK3VLkurFUVhia6uys/0suUp86TJz5qbJRhc= -github.com/prometheus/procfs v0.21.1 h1:GljZCt+zSTS+NZq88cyQ1LjZ+RCHp3uVuabBWA5+OJI= -github.com/prometheus/procfs v0.21.1/go.mod h1:aB55Cww9pdSJVHk0hUf0inxWyyjPogFIjmHKYgMKmtY= +github.com/prometheus/common v0.72.0 h1:tAYsE+sPJxIncDAobm4H5aQjmox9ZxEIIqPbiffa8G4= +github.com/prometheus/common v0.72.0/go.mod h1:77NWqAQ2tXT7BIK40qjJdw5Acrsrg1TlHAnsQi3i6mk= +github.com/prometheus/procfs v0.22.0 h1:6q9+/JL9IKAPbCmBrv9n5O5Ty3NKnciV5X7YGw0oics= +github.com/prometheus/procfs v0.22.0/go.mod h1:CvmFr/GVhIjIvWJZW3tgkODBQMRIf0EyWMQLHCHab58= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= github.com/rogpeppe/go-internal v1.16.0 h1:O9DK+vNMDVGLr2BeZqmpLeMjiMNkuXfcqntWbZV6S5g= @@ -293,29 +293,29 @@ golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU= -golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M= -golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA= +golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54= +golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w= golang.org/x/exp v0.0.0-20260727155853-b88d891fe743 h1:ex206bKw+v3K0dm3andkrIF+ijyQKJG1pLgwQ2PYdQM= golang.org/x/exp v0.0.0-20260727155853-b88d891fe743/go.mod h1:EdfpwwqSu+0Li0mzskwHU6FWDV3t9Q+RZDo3QMUtL3Q= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= -golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c= -golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o= +golang.org/x/mod v0.42.0 h1:ICeL3t2L30ljSPHHxDnR4fqVcBt/zR2zJAb9juavmQg= +golang.org/x/mod v0.42.0/go.mod h1:u5fzIrRInkL8MaO1cbRkUHT64v303YIT5KEqpNr7jRs= golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg= -golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues= -golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= +golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw= +golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI= golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98= golang.org/x/oauth2 v0.37.0/go.mod h1:IxwZNxUULJmpBFf9K/9NTMSIfZZuvuTy1gGxhigP/58= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk= -golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0= +golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA= +golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= @@ -329,15 +329,15 @@ golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= -golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= -golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= +golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA= +golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo= golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk= -golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE= -golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc= +golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM= +golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= @@ -345,27 +345,27 @@ golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= -golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI= -golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E= +golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc= +golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s= golang.org/x/time v0.16.0 h1:vMb6ptszcQMkcwiRTAuNNU50gom6++Q/6gY2hDM6VDE= golang.org/x/time v0.16.0/go.mod h1:rVKOqvZeKvrDKTQiAHJ7wmwP0RzleSphoEA9RcdLA0s= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= -golang.org/x/tools v0.50.0 h1:c2ifzfcuY7L90lZ2aKd8S4K2NpASF08SZx9ZuJkHmSU= -golang.org/x/tools v0.50.0/go.mod h1:7ulVMw3831Mwi5EZD6RomGyffr4VFjuNYXf2BbCEAV0= +golang.org/x/tools v0.51.0 h1:k4Xc/1Om9jwkBJBo4NVLMSARBoWtK10mx+W5BnXCeAI= +golang.org/x/tools v0.51.0/go.mod h1:9eEncMayCV6zRMGhR5eZEC2iBx98qWcF1HZ9Z7wJOoA= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= -google.golang.org/api v0.300.0 h1:2rvPV2bqnPuHOaF4gGOBiT1IIc6JVXYyHCkZeqdzjNk= -google.golang.org/api v0.300.0/go.mod h1:tKfTSDfK+0FlOVl8N30VL5fU5TuaEkJjvdyTIKNwzPg= +google.golang.org/api v0.302.0 h1:/eENsEv3+GE0QiEmXjdaLI84Mt76LNjGz4vp4E7sRVw= +google.golang.org/api v0.302.0/go.mod h1:dcjRWAy1QdjGb3Z67Qu0gdBWH2gL8Qoy/RI2ZVuvdeE= google.golang.org/genproto v0.0.0-20260715232425-e75dac1f907d h1:C9v1o0/4quuhOAfmRXA2j+we0PqZIp8traLdeogF3Ms= google.golang.org/genproto v0.0.0-20260715232425-e75dac1f907d/go.mod h1:Wz2wFJntZFmLGo7pLDXZ3wYk5hyc0Mb+SkHhDDXT+lU= google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d h1:FarXi840EJWSHYTN3ERkADbPWjl307+FGrA22KAVjjc= google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d/go.mod h1:K/+WGbmBY7aNW1HDw1fJnKYo10i0DkAX6pows00dLig= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260921155816-b14227669459 h1:b0xCahf3FK2m2Cv0p4vTozGPWncCvLfwV86UNg8xWU8= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260921155816-b14227669459/go.mod h1:OaIUM3+LpYcK2GXM4FTmhWoIq371Owdr+Cc7/BsYHHc= +google.golang.org/genproto/googleapis/rpc v0.0.0-20261005182115-fad411399dd8 h1:0SXBqli5dnuCKMjI/X3FM226zEaEa0GUcSCJtN1vL2o= +google.golang.org/genproto/googleapis/rpc v0.0.0-20261005182115-fad411399dd8/go.mod h1:OaIUM3+LpYcK2GXM4FTmhWoIq371Owdr+Cc7/BsYHHc= google.golang.org/grpc v1.84.0 h1:soMyaPJ8pAak5PIQ0DGBUir0XRo2fRoMqhNWMLlLxO0= google.golang.org/grpc v1.84.0/go.mod h1:ljCht0DrxQrXBDRTZp52Qxh3Ffk8CdYm2sj4O2QN2C0= google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc= ++++++ apko.obsinfo ++++++ --- /var/tmp/diff_new_pack.oPaQZM/_old 2026-10-20 12:38:30.820003812 +0200 +++ /var/tmp/diff_new_pack.oPaQZM/_new 2026-10-20 12:38:30.825004017 +0200 @@ -1,5 +1,5 @@ name: apko -version: 1.4.11 -mtime: 1791655673 -commit: 5b3c3182430465dd2212a656411267f150034255 +version: 1.4.12 +mtime: 1792162256 +commit: 0c659afba7f7842a3b18cdd5108675455339912b ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/apko/vendor.tar.gz /work/SRC/openSUSE:Factory/.apko.new.3698736/vendor.tar.gz differ: char 84, line 2
