Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package pdfcraft for openSUSE:Factory checked in at 2026-10-30 18:11:57 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/pdfcraft (Old) and /work/SRC/openSUSE:Factory/.pdfcraft.new.1255 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "pdfcraft" Fri Oct 30 18:11:57 2026 rev:2 rq:1393743 version:0.15.0 Changes: -------- --- /work/SRC/openSUSE:Factory/pdfcraft/pdfcraft.changes 2026-10-28 21:10:28.682928510 +0100 +++ /work/SRC/openSUSE:Factory/.pdfcraft.new.1255/pdfcraft.changes 2026-10-30 18:19:50.847223644 +0100 @@ -1,0 +2,41 @@ +Thu Oct 29 16:50:22 UTC 2026 - Martin Pluskal <[email protected]> + +- Update to 0.15.0 (upstream tags v0.14.0, 2026-10-25 and v0.15.0, + 2026-10-28): + * 0.14.0: hostile-file work bounding across the parser, renderer, + forms, XFA and redaction paths; ctutils 0.4.2 -> 0.4.5 + (RUSTSEC-2026-0385) and crypto-bigint 0.7.5 -> 0.7.6 + (RUSTSEC-2026-0387), both constant-time hardening with no CVE + ids; hayro-postscript 0.1.0 vendored as a path patch (CMap + stack overflow fixed); redaction follows nested forms and drops + the AcroForm on hidden-field redaction; typed XFA password + values cleared from datasets on save. + * 0.15.0: redaction drops confidential vector paths behind + clipping and unlinks unused Type 3 glyphs and fonts; XFA, + FormCalc and XFDF parsing fixes; egui 0.37; Persian interface + translation; page-image export on worker threads; searchable + All-tools view. + * Security hardening (no CVE ids): the two RUSTSEC fixes above; + bugzilla holds no open pdfcraft bugs. + * Re-vendored (update=false kept for --locked): in the shipped + graph ctutils 0.4.2 -> 0.4.5, crypto-bigint 0.7.5 -> 0.7.6 and + aws-lc-rs 1.18.1 -> 1.18.2 changed; new crates are all MIT, + Apache-2.0 or Unicode-3.0, plus path-patched hayro-postscript + 0.1.0 (Apache-2.0 OR MIT). License tag unchanged, MSRV still + 1.95, no new system deps; cargo_vendor and cargo_audit clean. +- Rebase pdfcraft-no-brand-assets.patch onto 0.15.0 (same hunk, + moved 46 lines; still the three docs/brand include_bytes! + embeds, no new docs/brand references in the shipped crates). +- Add pdfcraft-no-startup-update-check.patch: new in 0.15.0, the + desktop app checks upstream releases at startup and offers + in-place self-update; the package manager owns updates, so only + the automatic check is off, manual Help ▸ Check for updates + stays. +- Extend pdfcraft-no-startup-update-check.patch: also gate the + self-update install prompt (UPDATE-AND-RESTART over RPM-owned + files); the manual Help ▸ Check for updates outcome dialog + stays. +- Add pdfcraft-drop-unused-egui-patches.patch: + drop unused [patch.crates-io] pins the vendor omits + +------------------------------------------------------------------- Old: ---- pdfcraft-0.13.0.tar.zst New: ---- pdfcraft-0.15.0.tar.zst pdfcraft-drop-unused-egui-patches.patch pdfcraft-no-startup-update-check.patch ----------(New B)---------- New: stays. - Add pdfcraft-drop-unused-egui-patches.patch: drop unused [patch.crates-io] pins the vendor omits New: embeds, no new docs/brand references in the shipped crates). - Add pdfcraft-no-startup-update-check.patch: new in 0.15.0, the desktop app checks upstream releases at startup and offers ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ pdfcraft.spec ++++++ --- /var/tmp/diff_new_pack.lpZs2d/_old 2026-10-30 18:19:55.807431290 +0100 +++ /var/tmp/diff_new_pack.lpZs2d/_new 2026-10-30 18:19:55.809431373 +0100 @@ -17,14 +17,15 @@ Name: pdfcraft -Version: 0.13.0 +Version: 0.15.0 Release: 0 Summary: Open-source PDF workbench # Legal-Review-Notice: scope is the offline vendor build of the two -# shipped targets (-p pdfcraft -p pdfcraft-cli, 498 crates via cargo +# shipped targets (-p pdfcraft -p pdfcraft-cli, 501 crates via cargo # tree -e normal). Upstream code is MIT OR Apache-2.0. Patched vendor # crates (vendor/): hayro 0.7.1, hayro-interpret 0.7.0, hayro-syntax -# 0.7.2, hayro-jbig2 0.3.0, hayro-cmap 0.1.0, vello_common 0.0.8 (all +# 0.7.2, hayro-jbig2 0.3.0, hayro-cmap 0.1.0, hayro-postscript 0.1.0 +# (new path patch in 0.14.0, stack-overflow fix), vello_common 0.0.8 (all # Apache-2.0 OR MIT), lopdf 0.45.0 (MIT), winit 0.30.13 (Apache-2.0), # egui-wgpu 0.36.2 (MIT OR Apache-2.0); licence files unchanged. # Embedded hayro assets: Foxit standard-14 fonts (BSD-3-Clause), Adobe @@ -53,6 +54,20 @@ # with the open-source PdfCraft tile; permanent downstream carry, not # upstreamable (upstream ships the marks intentionally). Patch0: pdfcraft-no-brand-assets.patch +# PATCH-FIX-OPENSUSE pdfcraft-no-startup-update-check.patch -- distro builds +# must not phone home at startup nor ever install an upstream release +# (UPDATE-AND-RESTART) over RPM-owned files; Help ▸ Check for updates stays +# as an explicit manual action with its outcome dialog. New upstream +# behaviour in 0.15.0, not upstreamable (upstream ships the check and the +# self-update intentionally for its own builds). +Patch1: pdfcraft-no-startup-update-check.patch +# PATCH-FIX-OPENSUSE pdfcraft-drop-unused-egui-patches.patch -- drop the +# three unused [patch.crates-io] egui pins (egui_demo_lib, +# egui_inspection, egui_system_font_provider, all under +# [[patch.unused]]) so the --offline/--locked vendor build resolves; +# egui_extras stays, crates/ui-egui uses it. Downstream build fix, not +# upstreamable. +Patch2: pdfcraft-drop-unused-egui-patches.patch BuildRequires: appstream-glib BuildRequires: cargo-packaging # aws-lc-sys via pdfcraft-sign -> aws-lc-rs compiles C sources with cmake. ++++++ _service ++++++ --- /var/tmp/diff_new_pack.lpZs2d/_old 2026-10-30 18:19:55.961437736 +0100 +++ /var/tmp/diff_new_pack.lpZs2d/_new 2026-10-30 18:19:55.972438197 +0100 @@ -2,7 +2,7 @@ <service name="tar_scm" mode="manual"> <param name="url">https://github.com/storytold/pdfcraft.git</param> <param name="scm">git</param> - <param name="revision">v0.13.0</param> + <param name="revision">v0.15.0</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> <param name="exclude">.git</param> ++++++ pdfcraft-0.13.0.tar.zst -> pdfcraft-0.15.0.tar.zst ++++++ /work/SRC/openSUSE:Factory/pdfcraft/pdfcraft-0.13.0.tar.zst /work/SRC/openSUSE:Factory/.pdfcraft.new.1255/pdfcraft-0.15.0.tar.zst differ: char 7, line 1 ++++++ pdfcraft-drop-unused-egui-patches.patch ++++++ From: openSUSE Publishing <[email protected]> Subject: [PATCH] Drop unused egui patch pins so the offline vendor build resolves Bug: none (downstream build fix, not upstreamable) Upstream pins three egui crates (egui_demo_lib, egui_inspection, egui_system_font_provider) in [patch.crates-io] that nothing in the workspace uses (Cargo.lock lists all three under [[patch.unused]]). cargo_vendor therefore omits them from vendor-cratesio.tar.zst, and any --offline/--locked resolve against the vendor directory fails with "patch location ... does not contain packages matching egui_demo_lib". Drop the three unused pins (plus their [[patch.unused]] lock stanzas, so --locked stays satisfied); the [[package]] set is unchanged (egui_extras stays: crates/ui-egui uses it, so its pin is retained, unlike in filmcraft where it was unused too). --- a/Cargo.toml +++ b/Cargo.toml @@ -143,8 +143,5 @@ egui_glow = { git = "https://github.com/storytold/egui.git";, rev = "6d518fc799681571963842f95b55a6b68431b15a" } egui_extras = { git = "https://github.com/storytold/egui.git";, rev = "6d518fc799681571963842f95b55a6b68431b15a" } egui_kittest = { git = "https://github.com/storytold/egui.git";, rev = "6d518fc799681571963842f95b55a6b68431b15a" } -egui_system_font_provider = { git = "https://github.com/storytold/egui.git";, rev = "6d518fc799681571963842f95b55a6b68431b15a" } eframe = { git = "https://github.com/storytold/egui.git";, rev = "6d518fc799681571963842f95b55a6b68431b15a" } -egui_demo_lib = { git = "https://github.com/storytold/egui.git";, rev = "6d518fc799681571963842f95b55a6b68431b15a" } -egui_inspection = { git = "https://github.com/storytold/egui.git";, rev = "6d518fc799681571963842f95b55a6b68431b15a" } winit = { git = "https://github.com/storytold/winit.git";, rev = "a517b3846ee8457d84ee4975110bfda6797c44dc" } --- a/Cargo.lock +++ b/Cargo.lock @@ -8690,17 +8690,3 @@ "winnow", ] -[[patch.unused]] -name = "egui_demo_lib" -version = "0.37.0" -source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"; - -[[patch.unused]] -name = "egui_inspection" -version = "0.37.0" -source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"; - -[[patch.unused]] -name = "egui_system_font_provider" -version = "0.37.0" -source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"; ++++++ pdfcraft-no-startup-update-check.patch ++++++ From: openSUSE Publishing <[email protected]> Subject: [PATCH] No self-update in distro builds: no startup check, no install prompt Bug: none (downstream distribution policy, not upstreamable) The package manager owns updates on a distro install: do not phone home to the releases page on every start, and never offer to install an upstream release (UPDATE-AND-RESTART) over RPM-owned files. Upstream ships this machinery intentionally for its own builds. Help ▸ Check for updates stays as an explicit manual action reporting through its outcome dialog; only the automatic startup check and the self-update install prompt are turned off. --- a/apps/pdfcraft/src/main.rs +++ b/apps/pdfcraft/src/main.rs @@ -424,7 +424,10 @@ { app.motion.source = Some(motion::source()); } - app.set_startup_update_check(true); + // Downstream (openSUSE): the package manager owns updates, so the + // desktop app must not check for (and offer to install) upstream + // releases on its own at startup. Manual Help ▸ Check stays. + app.set_startup_update_check(false); app.printer_source = Some(pdfcraft_ui_egui::system_printers()); app.os_key_store_ids = cfg!(any(target_os = "macos", target_os = "windows")); #[cfg(target_os = "macos")] --- a/crates/ui-egui/src/platform/updates.rs +++ b/crates/ui-egui/src/platform/updates.rs @@ -2,7 +2,7 @@ //! `Updater`; this module supplies the suite, the quit path and the status dialog. #[cfg(not(target_arch = "wasm32"))] -use craft_update::updater::{Action, CheckSource, Status, Updater}; +use craft_update::updater::{CheckSource, Status, Updater}; use egui::{Align, Layout}; use crate::{PdfCraftApp, theme, widgets}; @@ -86,16 +86,10 @@ pub(crate) fn dialog(app: &mut PdfCraftApp, ctx: &egui::Context) { #[cfg(not(target_arch = "wasm32"))] { - // The restart helper is scheduled before the app closes, so no update starts over unsaved work. - let clean = app.first_dirty().is_none(); - match app.updates.updater.show_if(ctx, clean) { - Action::None => {} - Action::OpenUrl(url) => app.open_url(&url), - Action::Close => { - app.request_quit(ctx); - } - } - // A requested check that found a release is answered by the prompt, not by this dialog. + // Downstream (openSUSE): never draw the self-update prompt, so no + // upstream release is ever installed over RPM-owned files (neither + // at startup nor after a manual check). The manual Check for Updates + // outcome dialog below stays. if app.updates.open && !app.updates.check_requested && matches!(app.updates.updater.status(), Status::Idle) { app.updates.open = false; } ++++++ vendor-cratesio.tar.zst ++++++ /work/SRC/openSUSE:Factory/pdfcraft/vendor-cratesio.tar.zst /work/SRC/openSUSE:Factory/.pdfcraft.new.1255/vendor-cratesio.tar.zst differ: char 7, line 1
