Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package rpmcrab for openSUSE:Factory checked in at 2026-11-04 19:47:51 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/rpmcrab (Old) and /work/SRC/openSUSE:Factory/.rpmcrab.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "rpmcrab" Wed Nov 4 19:47:51 2026 rev:4 rq:1394930 version:0.4.1 Changes: -------- --- /work/SRC/openSUSE:Factory/rpmcrab/rpmcrab.changes 2026-10-26 10:05:45.630201258 +0100 +++ /work/SRC/openSUSE:Factory/.rpmcrab.new.3759290/rpmcrab.changes 2026-11-04 19:51:23.113272461 +0100 @@ -1,0 +2,27 @@ +Tue Nov 3 18:35:13 UTC 2026 - Martin Pluskal <[email protected]> + +- Update to version 0.4.1: + * New defect-pattern check class reporting legacy crypto (MD5, + DES, RC4), weak PRNG, unbounded string copy/format, shell + execution and legacy network API calls in binaries + * New checks: corrupt/truncated Java class headers, bidi controls + in source archives, fillup-template without fillup call, + optflags-not-applied hardening absence, VCS metadata and + git-lfs pointers in source archives + * SpecCheck flags subpackages without files, unescaped macros in + comments and unfailable %check commands; TagsCheck enforces + epoch-tag and reports file-declared licences missing from the + License tag + * Refresh vendored distro configs to upstream 2026-11-01 and SPDX + IDs to 8791eda; bump zip to 9.2.0 (ZipArchive blow-up on + crafted archives), zstd 0.14.3/zstd-safe 8.2.0/zstd-sys 2.1.2 + (RUSTSEC-2026-0391/0398/0403/0410), base64 0.23.1, + fancy-regex 0.20.0 + * Many precision fixes cutting false positives across Files, + Binaries, Tags, Post, Spec and Systemd checks +- Require /usr/bin/appstream-util instead of appstream-glib + (only the binary is consumed, as a subprocess) and capitalize + the rpmlint-compat summary: silences two rpmlint errors the + current linter reports on the unchanged lines + +------------------------------------------------------------------- Old: ---- rpmcrab-0.4.0.tar.gz New: ---- rpmcrab-0.4.1.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ rpmcrab.spec ++++++ --- /var/tmp/diff_new_pack.MWDM9G/_old 2026-11-04 19:51:24.746340560 +0100 +++ /var/tmp/diff_new_pack.MWDM9G/_new 2026-11-04 19:51:24.750340727 +0100 @@ -14,13 +14,22 @@ # Name: rpmcrab -Version: 0.4.0 +Version: 0.4.1 Release: 0 Summary: Rust rewrite of rpmlint License: GPL-2.0-or-later URL: https://github.com/plusky/rpmcrab Source: https://github.com/plusky/rpmcrab/archive/refs/tags/v%{version}.tar.gz#/%{name}-%{version}.tar.gz +# Re-vendor per bump with plain `cargo vendor vendor` (unversioned dirs), +# then strip the Windows-only import libraries no Linux target reads: +# python3 <skill>/scripts/vendor-strip.py vendor.tar.zst -o vendor.tar.zst 'winapi-i686-pc-windows-gnu/lib/**' 'winapi-x86_64-pc-windows-gnu/lib/**' Source1: vendor.tar.zst +# Test corpus the suite reads as data, never executed or linked: +# Source-Binary-Exception: rpmcrab-*.tar.gz:*/tests/parity/* -- test-data: parity-test corpus RPMs the checks lint as input, never executed +# Source-Binary-Exception: rpmcrab-*.tar.gz:*/tests/fixtures/* -- test-data: fixture RPMs the tests read as lint input, never executed +# Source-Binary-Exception: vendor.tar.zst:vendor/rpm/tests/* -- test-data: rpm crate testsuite assets, never built or run for the Linux target +# Source-Binary-Exception: vendor.tar.zst:vendor/librpm/testdata/* -- test-data: librpm testsuite distro-RPM fixtures, read only by its own tests +# Source-Binary-Exception: vendor.tar.zst:vendor/libloading/tests/* -- test-data: fixtures loaded only by libloading's Windows-only tests, never on Linux # Shells own the completion dirs installed below (cf. helm) BuildRequires: bash-completion BuildRequires: cargo @@ -33,7 +42,8 @@ BuildRequires: zstd BuildRequires: pkgconfig(rpm) # - AppDataCheck: invalid-appdata-file/invalid-metainfo-file via appstream-util -Requires: appstream-glib +# (file dependency: only the binary is consumed, as a subprocess) +Requires: %{_bindir}/appstream-util # - PostCheck: scriptlet syntax check via /bin/sh and /bin/bash -n Requires: bash # - BinariesCheck: binary analysis via strings and ar (binutils) @@ -95,7 +105,7 @@ Fish command line completion support for rpmcrab. %package rpmlint-compat -Summary: rpmlint compatibility symlinks for rpmcrab +Summary: Rpmlint compatibility symlinks for rpmcrab Requires: %{name} = %{version}-%{release} # PolkitCheck reads the standard profile from the installed # polkit-default-privs data, mirrored from rpmlint-mini @@ -126,7 +136,7 @@ EOF %build -%{cargo_build} --package rpmcrab +%cargo_build -- --package rpmcrab %install %{cargo_install -p crates/rpmcrab} @@ -140,7 +150,7 @@ ln -sf %{_mandir}/man1/rpmcrab.1%{?ext_man} %{buildroot}%{_mandir}/man1/rpmlint.1%{?ext_man} %check -%{cargo_test} +%cargo_test %files %license LICENSE ++++++ rpmcrab-0.4.0.tar.gz -> rpmcrab-0.4.1.tar.gz ++++++ ++++ 101716 lines of diff (skipped) ++++++ vendor.tar.zst ++++++ /work/SRC/openSUSE:Factory/rpmcrab/vendor.tar.zst /work/SRC/openSUSE:Factory/.rpmcrab.new.3759290/vendor.tar.zst differ: char 7, line 1
