Script 'mail_helper' called by obssrc
Hello community,

here is the log from the commit of package melange for openSUSE:Factory checked 
in at 2024-01-07 21:40:47
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/melange (Old)
 and      /work/SRC/openSUSE:Factory/.melange.new.28375 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Package is "melange"

Sun Jan  7 21:40:47 2024 rev:7 rq:1137400 version:0.5.5

Changes:
--------
--- /work/SRC/openSUSE:Factory/melange/melange.changes  2023-12-05 
17:03:28.361714829 +0100
+++ /work/SRC/openSUSE:Factory/.melange.new.28375/melange.changes       
2024-01-07 21:41:02.705640264 +0100
@@ -1,0 +2,25 @@
+Sun Jan 07 18:08:16 UTC 2024 - opensuse_buildserv...@ojkastl.de
+
+- Update to version 0.5.5:
+  * build(deps): bump github.com/google/go-containerregistry
+  * bump upload/download github actions
+  * build(deps): bump google.golang.org/api from 0.152.0 to 0.154.0
+  * build(deps): bump github.com/lima-vm/lima from 0.18.0 to 0.19.1
+  * build(deps): bump github.com/containerd/containerd from 1.7.7
+    to 1.7.11
+  * build(deps): bump github.com/go-git/go-git/v5 from 5.10.0 to
+    5.11.0
+  * build(deps): bump golang.org/x/crypto from 0.15.0 to 0.17.0
+  * build(deps): bump cloud.google.com/go/storage from 1.35.1 to
+    1.36.0
+  * convert: sort packages alphabetically
+  * build(deps): bump sigstore/cosign-installer from 3.2.0 to 3.3.0
+  * build(deps): bump actions/setup-go from 4 to 5
+  * build(deps): bump github.com/kubescape/go-git-url from 0.0.25
+    to 0.0.26
+  * Set a default env var for GOMODCACHE.
+  * Pull in `go-apk` with `provider_priority` `ini` fix.
+  * Mark update.manual as an optional field.
+  * update release to add some clarification regarding the homebrew
+
+-------------------------------------------------------------------

Old:
----
  melange-0.5.4.obscpio

New:
----
  melange-0.5.5.obscpio

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Other differences:
------------------
++++++ melange.spec ++++++
--- /var/tmp/diff_new_pack.HIVZQv/_old  2024-01-07 21:41:03.693676204 +0100
+++ /var/tmp/diff_new_pack.HIVZQv/_new  2024-01-07 21:41:03.697676349 +0100
@@ -1,7 +1,7 @@
 #
 # spec file for package melange
 #
-# Copyright (c) 2023 SUSE LLC
+# Copyright (c) 2024 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -19,7 +19,7 @@
 %define __arch_install_post export NO_BRP_STRIP_DEBUG=true
 
 Name:           melange
-Version:        0.5.4
+Version:        0.5.5
 Release:        0
 Summary:        Build APKs from source code
 License:        Apache-2.0

++++++ _service ++++++
--- /var/tmp/diff_new_pack.HIVZQv/_old  2024-01-07 21:41:03.725677368 +0100
+++ /var/tmp/diff_new_pack.HIVZQv/_new  2024-01-07 21:41:03.725677368 +0100
@@ -3,7 +3,7 @@
     <param name="url">https://github.com/chainguard-dev/melange</param>
     <param name="scm">git</param>
     <param name="exclude">.git</param>
-    <param name="revision">v0.5.4</param>
+    <param name="revision">v0.5.5</param>
     <param name="versionformat">@PARENT_TAG@</param>
     <param name="changesgenerate">enable</param>
     <param name="versionrewrite-pattern">v(.*)</param>

++++++ _servicedata ++++++
--- /var/tmp/diff_new_pack.HIVZQv/_old  2024-01-07 21:41:03.745678095 +0100
+++ /var/tmp/diff_new_pack.HIVZQv/_new  2024-01-07 21:41:03.745678095 +0100
@@ -1,6 +1,6 @@
 <servicedata>
 <service name="tar_scm">
                 <param 
name="url">https://github.com/chainguard-dev/melange</param>
-              <param 
name="changesrevision">bc76a3708fdc91882817652237cbe73bcc5f4591</param></service></servicedata>
+              <param 
name="changesrevision">3a7d2fcf7c05beee78d2e1315eaa441b879f129d</param></service></servicedata>
 (No newline at EOF)
 

++++++ melange-0.5.4.obscpio -> melange-0.5.5.obscpio ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/melange-0.5.4/.github/workflows/build.yaml 
new/melange-0.5.5/.github/workflows/build.yaml
--- old/melange-0.5.4/.github/workflows/build.yaml      2023-12-04 
21:28:36.000000000 +0100
+++ new/melange-0.5.5/.github/workflows/build.yaml      2023-12-21 
13:21:18.000000000 +0100
@@ -14,7 +14,7 @@
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # 
v4.1.1
 
-      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # 
v4.1.0
+      - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # 
v5.0.0
         with:
           go-version: '1.21'
           check-latest: true
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/melange-0.5.4/.github/workflows/e2e.yaml 
new/melange-0.5.5/.github/workflows/e2e.yaml
--- old/melange-0.5.4/.github/workflows/e2e.yaml        2023-12-04 
21:28:36.000000000 +0100
+++ new/melange-0.5.5/.github/workflows/e2e.yaml        2023-12-21 
13:21:18.000000000 +0100
@@ -26,7 +26,7 @@
 
     steps:
     - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-    - uses: actions/setup-go@v4
+    - uses: actions/setup-go@v5
       with:
         go-version-file: 'go.mod'
     - name: Build package
@@ -56,7 +56,7 @@
     steps:
     - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
-    - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
+    - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
       with:
         go-version: '1.21'
         check-latest: true
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/melange-0.5.4/.github/workflows/go-tests.yaml 
new/melange-0.5.5/.github/workflows/go-tests.yaml
--- old/melange-0.5.4/.github/workflows/go-tests.yaml   2023-12-04 
21:28:36.000000000 +0100
+++ new/melange-0.5.5/.github/workflows/go-tests.yaml   2023-12-21 
13:21:18.000000000 +0100
@@ -10,7 +10,7 @@
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # 
v4.1.0
+      - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # 
v5.0.0
         with:
           go-version: '1.21'
           check-latest: true
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' 
old/melange-0.5.4/.github/workflows/melange-test-pipelines.yaml 
new/melange-0.5.5/.github/workflows/melange-test-pipelines.yaml
--- old/melange-0.5.4/.github/workflows/melange-test-pipelines.yaml     
2023-12-04 21:28:36.000000000 +0100
+++ new/melange-0.5.5/.github/workflows/melange-test-pipelines.yaml     
2023-12-21 13:21:18.000000000 +0100
@@ -14,7 +14,7 @@
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # 
v4.1.1
 
-      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # 
v4.1.0
+      - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # 
v5.0.0
         with:
           go-version: '1.21'
           check-latest: true
@@ -23,10 +23,10 @@
         run: |
           make melange
 
-      - uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 
# v3.1.3
+      - uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392 
# v4.0.0
         with:
-          name: melange-${{github.run_id}}
-          path: ${{github.workspace}}/melange
+          name: melange-${{ github.run_id }}
+          path: ${{ github.workspace }}/melange
           retention-days: 1
 
   test-packages:
@@ -50,13 +50,14 @@
 
     steps:
       # Grab the melange we uploaded above, and install it.
-      - uses: 
actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
+      - uses: 
actions/download-artifact@f44cd7b40bfd40b6aa1cc1b9b5b7bf03d3c67110 # v4.1.0
         with:
-          name: melange-${{github.run_id}}
-          path: ${{github.workspace}}/.melange-dir
+          name: melange-${{ github.run_id }}
+          path: ${{ github.workspace }}/.melange-dir
+          run-id: ${{ github.run_id }}
 
       - run: |
-          sudo mv ${{github.workspace}}/.melange-dir/melange /usr/bin/melange
+          sudo mv ${{ github.workspace }}/.melange-dir/melange /usr/bin/melange
           sudo chmod a+x /usr/bin/melange
           melange version
 
@@ -67,7 +68,7 @@
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # 
v4.1.1
 
       - run: |
-          testfile="${{matrix.package}}-test.yaml"
+          testfile="${{ matrix.package }}-test.yaml"
           echo "Testing $testfile"
 
-          melange test --arch x86_64 --source-dir ./e2e-tests/test-fixtures 
./e2e-tests/$testfile ${{matrix.package}} --repository-append 
https://packages.wolfi.dev/os --keyring-append 
https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
+          melange test --arch x86_64 --source-dir ./e2e-tests/test-fixtures 
./e2e-tests/$testfile ${{ matrix.package }} --repository-append 
https://packages.wolfi.dev/os --keyring-append 
https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/melange-0.5.4/.github/workflows/release.yaml 
new/melange-0.5.5/.github/workflows/release.yaml
--- old/melange-0.5.4/.github/workflows/release.yaml    2023-12-04 
21:28:36.000000000 +0100
+++ new/melange-0.5.5/.github/workflows/release.yaml    2023-12-21 
13:21:18.000000000 +0100
@@ -16,14 +16,14 @@
       contents: write
 
     steps:
-      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # 
v4.1.0
+      - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # 
v5.0.0
         with:
           go-version: '1.21'
           check-latest: true
 
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # 
v4.1.1
 
-      - uses: 
sigstore/cosign-installer@1fc5bd396d372bee37d608f955b336615edf79c8 # v3.2.0
+      - uses: 
sigstore/cosign-installer@9614fae9e5c5eddabb09f90a270fcb487c9f7149 # v3.3.0
 
       - uses: 
goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # # v5.0.0
         with:
@@ -53,14 +53,14 @@
       COSIGN_YES: "true"
 
     steps:
-      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # 
v4.1.0
+      - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # 
v5.0.0
         with:
           go-version: '1.21'
           check-latest: true
 
       - uses: ko-build/setup-ko@ace48d793556083a76f1e3e6068850c1f4a369aa # v0.6
 
-      - uses: 
sigstore/cosign-installer@1fc5bd396d372bee37d608f955b336615edf79c8 # v3.2.0
+      - uses: 
sigstore/cosign-installer@9614fae9e5c5eddabb09f90a270fcb487c9f7149 # v3.3.0
 
       - uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # 
v3.0.0
         with:
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/melange-0.5.4/.github/workflows/verify.yaml 
new/melange-0.5.5/.github/workflows/verify.yaml
--- old/melange-0.5.4/.github/workflows/verify.yaml     2023-12-04 
21:28:36.000000000 +0100
+++ new/melange-0.5.5/.github/workflows/verify.yaml     2023-12-21 
13:21:18.000000000 +0100
@@ -14,7 +14,7 @@
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # 
v4.1.1
 
-      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # 
v4.1.0
+      - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # 
v5.0.0
         with:
           go-version: "1.21"
           check-latest: true
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/melange-0.5.4/.github/workflows/wolfi-presubmit.yaml 
new/melange-0.5.5/.github/workflows/wolfi-presubmit.yaml
--- old/melange-0.5.4/.github/workflows/wolfi-presubmit.yaml    2023-12-04 
21:28:36.000000000 +0100
+++ new/melange-0.5.5/.github/workflows/wolfi-presubmit.yaml    2023-12-21 
13:21:18.000000000 +0100
@@ -14,7 +14,7 @@
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # 
v4.1.1
 
-      - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # 
v4.1.0
+      - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # 
v5.0.0
         with:
           go-version: '1.21'
           check-latest: true
@@ -23,10 +23,10 @@
         run: |
           make melange
 
-      - uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 
# v3.1.3
+      - uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392 
# v4.0.0
         with:
-          name: melange-${{github.run_id}}
-          path: ${{github.workspace}}/melange
+          name: melange-${{ github.run_id }}
+          path: ${{ github.workspace }}/melange
           retention-days: 1
 
   build-packages:
@@ -64,13 +64,14 @@
         with:
           repository: wolfi-dev/os
 
-      - uses: 
actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
+      - uses: 
actions/download-artifact@f44cd7b40bfd40b6aa1cc1b9b5b7bf03d3c67110 # v4.1.0
         with:
-          name: melange-${{github.run_id}}
-          path: ${{github.workspace}}/.melange-dir
+          name: melange-${{ github.run_id }}
+          path: ${{ github.workspace }}/.melange-dir
+          run-id: ${{ github.run_id }}
 
       - run: |
-          sudo mv ${{github.workspace}}/.melange-dir/melange /usr/bin/melange
+          sudo mv ${{ github.workspace }}/.melange-dir/melange /usr/bin/melange
           sudo chmod a+x /usr/bin/melange
           melange version
 
@@ -78,4 +79,4 @@
           sudo apt-get -y install bubblewrap
 
       - run: |
-          make MELANGE="sudo melange" BUILDWORLD="no" 
package/${{matrix.package}}
+          make MELANGE="sudo melange" BUILDWORLD="no" package/${{ 
matrix.package }}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/melange-0.5.4/go.mod new/melange-0.5.5/go.mod
--- old/melange-0.5.4/go.mod    2023-12-04 21:28:36.000000000 +0100
+++ new/melange-0.5.5/go.mod    2023-12-21 13:21:18.000000000 +0100
@@ -6,17 +6,17 @@
 
 require (
        chainguard.dev/apko v0.12.0
-       cloud.google.com/go/storage v1.35.1
-       github.com/chainguard-dev/go-apk v0.0.0-20231120201550-7b08e8f3b0fc
+       cloud.google.com/go/storage v1.36.0
+       github.com/chainguard-dev/go-apk v0.0.0-20231206041704-bec618e956a2
        github.com/chainguard-dev/go-pkgconfig 
v0.0.0-20230818193557-bee0072057ce
        github.com/chainguard-dev/kontext v0.1.0
        github.com/chainguard-dev/yam v0.0.0-20230807153807-4de7c531f3e1
        github.com/docker/docker v24.0.7+incompatible
        github.com/dprotaso/go-yit v0.0.0-20220510233725-9ba8df137936
        github.com/dustin/go-humanize v1.0.1
-       github.com/go-git/go-git/v5 v5.10.0
+       github.com/go-git/go-git/v5 v5.11.0
        github.com/google/go-cmp v0.6.0
-       github.com/google/go-containerregistry v0.16.1
+       github.com/google/go-containerregistry v0.17.0
        github.com/google/go-github/v54 v54.0.0
        github.com/ijt/goparsify v0.0.0-20221203142333-3a5276334b8d
        github.com/imdario/mergo v0.3.16
@@ -26,8 +26,8 @@
        github.com/klauspost/compress v1.17.4
        github.com/klauspost/pgzip v1.2.6
        github.com/korovkin/limiter v0.0.0-20230307205149-3d4b2b34c99d
-       github.com/kubescape/go-git-url v0.0.25
-       github.com/lima-vm/lima v0.18.0
+       github.com/kubescape/go-git-url v0.0.26
+       github.com/lima-vm/lima v0.19.1
        github.com/opencontainers/image-spec v1.1.0-rc5
        github.com/package-url/packageurl-go v0.1.2
        github.com/pkg/errors v0.9.1
@@ -44,7 +44,7 @@
        golang.org/x/sys v0.15.0
        golang.org/x/text v0.14.0
        golang.org/x/time v0.5.0
-       google.golang.org/api v0.152.0
+       google.golang.org/api v0.154.0
        gopkg.in/ini.v1 v1.67.0
        gopkg.in/yaml.v3 v3.0.1
        k8s.io/api v0.28.4
@@ -65,14 +65,15 @@
        github.com/MakeNowJust/heredoc/v2 v2.0.1 // indirect
        github.com/Microsoft/go-winio v0.6.1 // indirect
        github.com/ProtonMail/go-crypto v0.0.0-20230923063757-afb1ddc0824c // 
indirect
-       github.com/acomagu/bufpipe v1.0.4 // indirect
        github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // 
indirect
        github.com/bahlo/generic-list-go v0.2.0 // indirect
        github.com/buger/jsonparser v1.1.1 // indirect
+       github.com/chainguard-dev/git-urls v1.0.2 // indirect
        github.com/cloudflare/circl v1.3.6 // indirect
        github.com/common-nighthawk/go-figure 
v0.0.0-20210622060536-734e95fb86be // indirect
-       github.com/containerd/containerd v1.7.7 // indirect
+       github.com/containerd/containerd v1.7.11 // indirect
        github.com/containerd/stargz-snapshotter/estargz v0.15.1 // indirect
+       github.com/coreos/go-semver v0.3.1 // indirect
        github.com/cpuguy83/go-md2man/v2 v2.0.3 // indirect
        github.com/cyphar/filepath-securejoin v0.2.4 // indirect
        github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // 
indirect
@@ -87,6 +88,7 @@
        github.com/emirpasic/gods v1.18.1 // indirect
        github.com/evanphx/json-patch v5.6.0+incompatible // indirect
        github.com/fatih/color v1.15.0 // indirect
+       github.com/felixge/httpsnoop v1.0.4 // indirect
        github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
        github.com/go-git/go-billy/v5 v5.5.0 // indirect
        github.com/go-logr/logr v1.3.0 // indirect
@@ -127,9 +129,7 @@
        github.com/lima-vm/go-qcow2reader v0.1.1 // indirect
        github.com/mailru/easyjson v0.7.7 // indirect
        github.com/mattn/go-colorable v0.1.13 // indirect
-       github.com/mattn/go-isatty v0.0.19 // indirect
-       github.com/mdlayher/socket v0.4.1 // indirect
-       github.com/mdlayher/vsock v1.2.1 // indirect
+       github.com/mattn/go-isatty v0.0.20 // indirect
        github.com/mitchellh/go-homedir v1.1.0 // indirect
        github.com/mitchellh/mapstructure v1.5.0 // indirect
        github.com/moby/spdystream v0.2.0 // indirect
@@ -154,27 +154,27 @@
        github.com/spf13/pflag v1.0.5 // indirect
        github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 // 
indirect
        github.com/vbatts/tar-split v0.11.5 // indirect
-       github.com/whilp/git-urls v1.0.0 // indirect
        github.com/wk8/go-ordered-map/v2 v2.1.8 // indirect
        github.com/xanzy/ssh-agent v0.3.3 // indirect
-       github.com/xorcare/pointer v1.2.2 // indirect
        go.lsp.dev/uri v0.3.0 // indirect
        go.mongodb.org/mongo-driver v1.12.1 // indirect
        go.opencensus.io v0.24.0 // indirect
+       
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc 
v0.46.1 // indirect
+       go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1 
// indirect
        go.opentelemetry.io/otel/metric v1.21.0 // indirect
        go.opentelemetry.io/otel/trace v1.21.0 // indirect
        golang.org/x/build v0.0.0-20231103135814-9e006d99e682 // indirect
-       golang.org/x/crypto v0.15.0 // indirect
+       golang.org/x/crypto v0.17.0 // indirect
        golang.org/x/mod v0.14.0 // indirect
-       golang.org/x/net v0.18.0 // indirect
-       golang.org/x/oauth2 v0.14.0 // indirect
-       golang.org/x/term v0.14.0 // indirect
+       golang.org/x/net v0.19.0 // indirect
+       golang.org/x/oauth2 v0.15.0 // indirect
+       golang.org/x/term v0.15.0 // indirect
        golang.org/x/tools v0.14.0 // indirect
        golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
        google.golang.org/appengine v1.6.8 // indirect
-       google.golang.org/genproto v0.0.0-20231106174013-bbf56f31fb17 // 
indirect
-       google.golang.org/genproto/googleapis/api 
v0.0.0-20231106174013-bbf56f31fb17 // indirect
-       google.golang.org/genproto/googleapis/rpc 
v0.0.0-20231120223509-83a465c0220f // indirect
+       google.golang.org/genproto v0.0.0-20231120223509-83a465c0220f // 
indirect
+       google.golang.org/genproto/googleapis/api 
v0.0.0-20231120223509-83a465c0220f // indirect
+       google.golang.org/genproto/googleapis/rpc 
v0.0.0-20231127180814-3a041ad873d4 // indirect
        google.golang.org/grpc v1.59.0 // indirect
        google.golang.org/protobuf v1.31.0 // indirect
        gopkg.in/go-jose/go-jose.v2 v2.6.1 // indirect
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/melange-0.5.4/go.sum new/melange-0.5.5/go.sum
--- old/melange-0.5.4/go.sum    2023-12-04 21:28:36.000000000 +0100
+++ new/melange-0.5.5/go.sum    2023-12-21 13:21:18.000000000 +0100
@@ -45,8 +45,8 @@
 cloud.google.com/go/storage v1.8.0/go.mod 
h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
 cloud.google.com/go/storage v1.10.0/go.mod 
h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
 cloud.google.com/go/storage v1.14.0/go.mod 
h1:GrKmX003DSIwi9o29oFT7YDnHYwZoctc3fOKtUw0Xmo=
-cloud.google.com/go/storage v1.35.1 
h1:B59ahL//eDfx2IIKFBeT5Atm9wnNmj3+8xG/W4WB//w=
-cloud.google.com/go/storage v1.35.1/go.mod 
h1:M6M/3V/D3KpzMTJyPOR/HU6n2Si5QdaXYEsng2xgOs8=
+cloud.google.com/go/storage v1.36.0 
h1:P0mOkAcaJxhCTvAkMhxMfrTKiNcub4YmmPBtlhAyTr8=
+cloud.google.com/go/storage v1.36.0/go.mod 
h1:M6M/3V/D3KpzMTJyPOR/HU6n2Si5QdaXYEsng2xgOs8=
 dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk=
 dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod 
h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
@@ -63,8 +63,6 @@
 github.com/ProtonMail/go-crypto v0.0.0-20230923063757-afb1ddc0824c/go.mod 
h1:EjAoLdwvbIOoOQr3ihjnSoLZRtE8azugULFRteWMNc0=
 github.com/PuerkitoBio/purell v1.1.1/go.mod 
h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
 github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod 
h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
-github.com/acomagu/bufpipe v1.0.4 
h1:e3H4WUzM3npvo5uv95QuJM3cQspFNtFBzvJ2oNjKIDQ=
-github.com/acomagu/bufpipe v1.0.4/go.mod 
h1:mxdxdup/WdsKVreO5GpW4+M/1CE2sMG4jeGJ2sYmHc4=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be 
h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod 
h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 
h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
@@ -82,8 +80,10 @@
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod 
h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash/v2 v2.2.0 
h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
 github.com/cespare/xxhash/v2 v2.2.0/go.mod 
h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/chainguard-dev/go-apk v0.0.0-20231120201550-7b08e8f3b0fc 
h1:Car7PYrE9RD5qBN7ScGuTnDyzg6s6HFFDeUf8cFHlVI=
-github.com/chainguard-dev/go-apk v0.0.0-20231120201550-7b08e8f3b0fc/go.mod 
h1:y0BbOQALsoi1T2Lt5KmFNn92G+fRFSUuogQI2171HS8=
+github.com/chainguard-dev/git-urls v1.0.2 
h1:pSpT7ifrpc5X55n4aTTm7FFUE+ZQHKiqpiwNkJrVcKQ=
+github.com/chainguard-dev/git-urls v1.0.2/go.mod 
h1:rbGgj10OS7UgZlbzdUQIQpT0k/D4+An04HJY7Ol+Y/o=
+github.com/chainguard-dev/go-apk v0.0.0-20231206041704-bec618e956a2 
h1:DtH4kLTbUOnkHJyE7c5l1MY9xWkOAIaZ5JZAwiI9+SY=
+github.com/chainguard-dev/go-apk v0.0.0-20231206041704-bec618e956a2/go.mod 
h1:y0BbOQALsoi1T2Lt5KmFNn92G+fRFSUuogQI2171HS8=
 github.com/chainguard-dev/go-pkgconfig v0.0.0-20230818193557-bee0072057ce 
h1:v3SY2sW8rUIxG9wXMxXlMN7sd9VNUSdZ+FnVqOrm2nI=
 github.com/chainguard-dev/go-pkgconfig 
v0.0.0-20230818193557-bee0072057ce/go.mod 
h1:obzGv2cx3tkRgkLQADSPaRl3OEsYmyfSv7t2Wu60tZw=
 github.com/chainguard-dev/kontext v0.1.0 
h1:GFnDRZiqa+anUi7tzZMECXr0nwt4Eo/zMzTQPLRXUIs=
@@ -100,12 +100,16 @@
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod 
h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod 
h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod 
h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
+github.com/cncf/xds/go v0.0.0-20230607035331-e9ce68804cb4 
h1:/inchEIKaYC1Akx+H+gqO04wryn5h75LSazbRlnya1k=
+github.com/cncf/xds/go v0.0.0-20230607035331-e9ce68804cb4/go.mod 
h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be 
h1:J5BL2kskAlV9ckgEsNQXscjIaLiOYiZ75d4e94E6dcQ=
 github.com/common-nighthawk/go-figure 
v0.0.0-20210622060536-734e95fb86be/go.mod 
h1:mk5IQ+Y0ZeO87b858TlA645sVcEcbiX6YqP98kt+7+w=
-github.com/containerd/containerd v1.7.7 
h1:QOC2K4A42RQpcrZyptP6z9EJZnlHfHJUfZrAAHe15q4=
-github.com/containerd/containerd v1.7.7/go.mod 
h1:3c4XZv6VeT9qgf9GMTxNTMFxGJrGpI2vz1yk4ye+YY8=
+github.com/containerd/containerd v1.7.11 
h1:lfGKw3eU35sjV0aG2eYZTiwFEY1pCzxdzicHP3SZILw=
+github.com/containerd/containerd v1.7.11/go.mod 
h1:5UluHxHTX2rdvYuZ5OJTC5m/KJNs0Zs9wVoJm9zf5ZE=
 github.com/containerd/stargz-snapshotter/estargz v0.15.1 
h1:eXJjw9RbkLFgioVaTG+G/ZW/0kEe2oEKCdS/ZxIyoCU=
 github.com/containerd/stargz-snapshotter/estargz v0.15.1/go.mod 
h1:gr2RNwukQ/S9Nv33Lt6UC7xEx58C+LHRdoqbEKjz1Kk=
+github.com/coreos/go-semver v0.3.1 
h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4=
+github.com/coreos/go-semver v0.3.1/go.mod 
h1:irMmmIw/7yzSRPWryHsK7EYSg09caPQL03VsM8rvUec=
 github.com/cpuguy83/go-md2man/v2 v2.0.3 
h1:qMCsGGgs+MAzDFyp9LpAe1Lqy/fY/qCovCm0qnXZOBM=
 github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod 
h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/creack/pty v1.1.9/go.mod 
h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
@@ -149,10 +153,14 @@
 github.com/envoyproxy/go-control-plane v0.9.7/go.mod 
h1:cwu0lG7PUMfa9snN8LXBig5ynNVH9qI8YYLbd1fK2po=
 github.com/envoyproxy/go-control-plane 
v0.9.9-0.20201210154907-fd9021fe5dad/go.mod 
h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod 
h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
+github.com/envoyproxy/protoc-gen-validate v1.0.2 
h1:QkIBuU5k+x7/QXPvPPnWXWlCdaBFApVqftFV6k087DA=
+github.com/envoyproxy/protoc-gen-validate v1.0.2/go.mod 
h1:GpiZQP3dDbg4JouG/NNS7QWXpgx6x8QiMKdmN72jogE=
 github.com/evanphx/json-patch v5.6.0+incompatible 
h1:jBYDEEiFBPxA0v50tFdvOzQQTCvpL6mnFh5mB2/l16U=
 github.com/evanphx/json-patch v5.6.0+incompatible/go.mod 
h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
 github.com/fatih/color v1.15.0 h1:kOqh6YHBtK8aywxGerMG2Eq3H6Qgoqeo13Bk2Mv/nBs=
 github.com/fatih/color v1.15.0/go.mod 
h1:0h5ZqXfHYED7Bhv2ZJamyIOUej9KtShiJESRwBDUSsw=
+github.com/felixge/httpsnoop v1.0.4 
h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
+github.com/felixge/httpsnoop v1.0.4/go.mod 
h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/frankban/quicktest v1.14.5 
h1:dfYrrRyLtiqT9GyKXgdh+k4inNeTvmGbuSgZ3lx3GhA=
 github.com/frankban/quicktest v1.14.5/go.mod 
h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
 github.com/fsnotify/fsnotify v1.4.7/go.mod 
h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
@@ -169,8 +177,8 @@
 github.com/go-git/go-billy/v5 v5.5.0/go.mod 
h1:hmexnoNsr2SJU1Ju67OaNz5ASJY3+sHgFRpCtpDCKow=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 
h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
 github.com/go-git/go-git-fixtures/v4 
v4.3.2-0.20231010084843-55a94097c399/go.mod 
h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
-github.com/go-git/go-git/v5 v5.10.0 
h1:F0x3xXrAWmhwtzoCokU4IMPcBdncG+HAAqi9FcOOjbQ=
-github.com/go-git/go-git/v5 v5.10.0/go.mod 
h1:1FOZ/pQnqw24ghP2n7cunVl0ON55BsjPYvhWHvZGhoo=
+github.com/go-git/go-git/v5 v5.11.0 
h1:XIZc1p+8YzypNr34itUfSvYJcv+eYdTnTvOZ2vD3cA4=
+github.com/go-git/go-git/v5 v5.11.0/go.mod 
h1:6GFcX2P3NM7FPBfpePbpLd21XxsgdAt+lKqXmCUiUCY=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod 
h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod 
h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod 
h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
@@ -307,8 +315,8 @@
 github.com/google/go-cmp v0.5.9/go.mod 
h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod 
h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-containerregistry v0.16.1 
h1:rUEt426sR6nyrL3gt+18ibRcvYpKYdpsa5ZW7MA08dQ=
-github.com/google/go-containerregistry v0.16.1/go.mod 
h1:u0qB2l7mvtWVR5kNcbFIhFY1hLbf8eeGapA+vbFDCtQ=
+github.com/google/go-containerregistry v0.17.0 
h1:5p+zYs/R4VGHkhyvgWurWrpJ2hW4Vv9fQI+GzdcwXLk=
+github.com/google/go-containerregistry v0.17.0/go.mod 
h1:u0qB2l7mvtWVR5kNcbFIhFY1hLbf8eeGapA+vbFDCtQ=
 github.com/google/go-github/v54 v54.0.0 
h1:OZdXwow4EAD5jEo5qg+dGFH2DpkyZvVsAehjvJuUL/c=
 github.com/google/go-github/v54 v54.0.0/go.mod 
h1:Sw1LXWHhXRZtzJ9LI5fyJg9wbQzYvFhW8W5P2yaAQ7s=
 github.com/google/go-querystring v1.1.0 
h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=
@@ -418,16 +426,16 @@
 github.com/kr/text v0.1.0/go.mod 
h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod 
h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/kubescape/go-git-url v0.0.25 
h1:i7SSSC1+1m/Dg+4LV3erp0YklnWj1Z0cVlRxCT3Zy/0=
-github.com/kubescape/go-git-url v0.0.25/go.mod 
h1:IbVT7Wsxlghsa+YxI5KOx4k9VQJaa3z0kTaQz5D3nKM=
+github.com/kubescape/go-git-url v0.0.26 
h1:etiKGO//3fivSfCoc5RyvMrS977P9NqOGb8LzeHOJEU=
+github.com/kubescape/go-git-url v0.0.26/go.mod 
h1:3ddc1HEflms1vMhD9owt/3FBES070UaYTUarcjx8jDk=
 github.com/leodido/go-urn v1.2.4 
h1:XlAE/cm/ms7TE/VMVoduSpNBoyc2dOxHs5MZSwAN63Q=
 github.com/leodido/go-urn v1.2.4/go.mod 
h1:7ZrI8mTSeBSHl/UaRyKQW1qZeMgak41ANeCNaVckg+4=
 github.com/letsencrypt/boulder v0.0.0-20231103135357-6d8e6e74f818 
h1:3KAItcBZS9abipHoUx0ANzBp57VBXR+aTLDrQy+HY5I=
 github.com/letsencrypt/boulder v0.0.0-20231103135357-6d8e6e74f818/go.mod 
h1:yMWB6x4w67wRFIWxTO8ic0131ROnE4dB9VJcwhP4M1Y=
 github.com/lima-vm/go-qcow2reader v0.1.1 
h1:UegxTAU4usoSzKLDqhbaNmmV4Ec4qhQO11QYeLLy7Jc=
 github.com/lima-vm/go-qcow2reader v0.1.1/go.mod 
h1:e3p29BzLT8hNh4jbLezdFAHU4eBijf0bm5GilStCRKE=
-github.com/lima-vm/lima v0.18.0 h1:zcTLZ8DKpjsjRwsELmKdg5Mu6t7+MJpI1kErUuBq1Ns=
-github.com/lima-vm/lima v0.18.0/go.mod 
h1:uUZjARIvZIVPWVVaJQDlkEBhpFCddIJcCCmC03mxiYs=
+github.com/lima-vm/lima v0.19.1 h1:fxFZfr3wB68xyVoDynSPaPCirQgp16fGZZ+M7upFoJ4=
+github.com/lima-vm/lima v0.19.1/go.mod 
h1:qvaE8fNfqOm/U+LExQHAqpaBQybiVNYpCRk8Rf3AHTU=
 github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod 
h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod 
h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.7.6/go.mod 
h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
@@ -435,20 +443,14 @@
 github.com/mailru/easyjson v0.7.7/go.mod 
h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/markbates/oncer v0.0.0-20181203154359-bf2de49a0be2/go.mod 
h1:Ld9puTsIW75CHf65OeIOkyKbteujpZVXDpWK6YGZbxE=
 github.com/markbates/safe v1.0.1/go.mod 
h1:nAqgmRi7cY2nqMc92/bSEeQA+R4OheNU2T1kNSCBdG0=
-github.com/matryer/is v1.2.0 h1:92UTHpy8CDwaJ08GqLDzhhuixiBUUD1p3AU6PHddz4A=
-github.com/matryer/is v1.2.0/go.mod 
h1:2fLPjFQM9rhQ15aVEtbuwhJinnOqrmgXPNdZsdwlWXA=
 github.com/mattn/go-colorable v0.1.13 
h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
 github.com/mattn/go-colorable v0.1.13/go.mod 
h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
 github.com/mattn/go-isatty v0.0.16/go.mod 
h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
-github.com/mattn/go-isatty v0.0.19 
h1:JITubQf0MOLdlGRuRq+jtsDlekdYPia9ZFsB8h/APPA=
-github.com/mattn/go-isatty v0.0.19/go.mod 
h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.20 
h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod 
h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/matttproud/golang_protobuf_extensions v1.0.4 
h1:mmDVorXM7PCGKw94cs5zkfA9PSy5pEvNWRP0ET0TIVo=
 github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 
h1:jWpvCLoY8Z/e3VKvlsiIGKtc+UG6U5vzxaoagmhXfyg=
 github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0/go.mod 
h1:QUyp042oQthUoa9bqDv0ER0wrtXnBruoNd7aNjkbP+k=
-github.com/mdlayher/socket v0.4.1 
h1:eM9y2/jlbs1M615oshPQOHZzj6R6wMT7bX5NPiQvn2U=
-github.com/mdlayher/socket v0.4.1/go.mod 
h1:cAqeGjoufqdxWkD7DkpyS+wcefOtmu5OQ8KuoJGIReA=
-github.com/mdlayher/vsock v1.2.1 
h1:pC1mTJTvjo1r9n9fbm7S1j04rCgCzhCOS5DY0zqHlnQ=
-github.com/mdlayher/vsock v1.2.1/go.mod 
h1:NRfCibel++DgeMD8z/hP+PPTjlNJsdPOmxcnENvE+SE=
 github.com/mitchellh/go-homedir v1.1.0 
h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod 
h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/mapstructure v1.3.3/go.mod 
h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
@@ -574,8 +576,6 @@
 github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399/go.mod 
h1:LdwHTNJT99C5fTAzDz0ud328OgXz+gierycbcIx2fRs=
 github.com/vbatts/tar-split v0.11.5 
h1:3bHCTIheBm1qFTcgh9oPu+nNBtX+XJIupG/vacinCts=
 github.com/vbatts/tar-split v0.11.5/go.mod 
h1:yZbwRsSeGjusneWgA781EKej9HF8vme8okylkAeNKLk=
-github.com/whilp/git-urls v1.0.0 
h1:95f6UMWN5FKW71ECsXRUd3FVYiXdrE7aX4NZKcPmIjU=
-github.com/whilp/git-urls v1.0.0/go.mod 
h1:J16SAmobsqc3Qcy98brfl5f5+e0clUvg1krgwk/qCfE=
 github.com/wk8/go-ordered-map/v2 v2.1.8 
h1:5h/BUHu93oj4gIdvHHHGsScSTMijfx5PeYkE/fJgbpc=
 github.com/wk8/go-ordered-map/v2 v2.1.8/go.mod 
h1:5nJHM5DyteebpVlHnWMV0rPz6Zp7+xBAnxjb1X5vnTw=
 github.com/xanzy/ssh-agent v0.3.3 
h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM=
@@ -587,8 +587,6 @@
 github.com/xdg-go/stringprep v1.0.2/go.mod 
h1:8F9zXuvzgwmyT5DUm4GUfZGDdT3W+LCvS6+da4O5kxM=
 github.com/xdg-go/stringprep v1.0.3/go.mod 
h1:W3f5j4i+9rC0kuIEJL0ky1VpHXQU3ocBgklLGvcBnW8=
 github.com/xdg-go/stringprep v1.0.4/go.mod 
h1:mPGuuIYwz7CmR2bT9j4GbQqutWS1zV24gijq1dTyGkM=
-github.com/xorcare/pointer v1.2.2 
h1:zjD77b5DTehClND4MK+9dDE0DcpFIZisAJ/+yVJvKYA=
-github.com/xorcare/pointer v1.2.2/go.mod 
h1:azsKh7oVwYB7C1o8P284fG8MvtErX/F5/dqXiaj71ak=
 github.com/yookoala/realpath v1.0.0 
h1:7OA9pj4FZd+oZDsyvXWQvjn5oBdcHRTV44PpdMSuImQ=
 github.com/yookoala/realpath v1.0.0/go.mod 
h1:gJJMA9wuX7AcqLy1+ffPatSCySA1FQ2S8Ya9AIoYBpE=
 github.com/youmark/pkcs8 v0.0.0-20181117223130-1be2e3e5546d/go.mod 
h1:rHwXgn7JulP+udvsHwJoVG1YGAP6VLg4y9I5dyZdqmA=
@@ -616,6 +614,10 @@
 go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk=
 go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc 
v0.46.1 h1:SpGay3w+nEwMpfVnbqOLH5gY52/foP8RE8UzTZ1pdSE=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc 
v0.46.1/go.mod h1:4UoMYEZOC0yN/sPGH76KPkkU7zgiEWYWL9vwmbnTJPE=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1 
h1:aFJWCqJMNjENlcleuuOkGAPH82y0yULBScfXcIEdS24=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1/go.mod 
h1:sEGXWArGqc3tVa+ekntsN65DmVbVeW+7lTKTjZF3/Fo=
 go.opentelemetry.io/otel v1.21.0 
h1:hzLeKBZEL7Okw2mGzZ0cc4k/A7Fta0uoPgaJCr8fsFc=
 go.opentelemetry.io/otel v1.21.0/go.mod 
h1:QZzNPQPm1zLX4gZK4cMi+71eaorMSGT3A4znnUvNNEo=
 go.opentelemetry.io/otel/metric v1.21.0 
h1:tlYWfeo+Bocx5kLEloTjbcDwBuELRrIFxwdQ36PlJu4=
@@ -638,8 +640,8 @@
 golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod 
h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod 
h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
 golang.org/x/crypto v0.7.0/go.mod 
h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
-golang.org/x/crypto v0.15.0 h1:frVn1TEaCEaZcn3Tmd7Y2b5KKPaZ+I32Q2OA3kYp5TA=
-golang.org/x/crypto v0.15.0/go.mod 
h1:4ChreQoLWfG3xLDer1WdlH5NdlQ3+mwnQq1YTKY+72g=
+golang.org/x/crypto v0.17.0 h1:r8bRNjWL3GshPW3gkd+RpvzWrZAwPS49OmTGZ/uhM4k=
+golang.org/x/crypto v0.17.0/go.mod 
h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod 
h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod 
h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod 
h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -721,8 +723,8 @@
 golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
-golang.org/x/net v0.18.0 h1:mIYleuAkSbHh0tCv7RvjL3F6ZVbLjq4+R7zbOn3Kokg=
-golang.org/x/net v0.18.0/go.mod h1:/czyP5RqHAH4odGYxBJ1qz0+CE5WZ+2j1YgoEo8F2jQ=
+golang.org/x/net v0.19.0 h1:zTwKpTd2XuCqf8huc7Fo2iSy+4RHPd10s4KzeTnVr1c=
+golang.org/x/net v0.19.0/go.mod h1:CfAk/cbD4CthTvqiEl8NpboMuiuOYsAr/7NOjZJtv1U=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod 
h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod 
h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod 
h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -732,8 +734,8 @@
 golang.org/x/oauth2 v0.0.0-20201109201403-9fd604954f58/go.mod 
h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20201208152858-08078c50e5b5/go.mod 
h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210218202405-ba52d332ba99/go.mod 
h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.14.0 h1:P0Vrf/2538nmC0H+pEQ3MNFRRnVR7RlqyVw+bvm26z0=
-golang.org/x/oauth2 v0.14.0/go.mod 
h1:lAtNWgaWfL4cm7j2OV8TxGi9Qb7ECORx8DktCY74OwM=
+golang.org/x/oauth2 v0.15.0 h1:s8pnnxNVzjWyrvYdFUQq5llS1PX2zhPXmccZv99h7uQ=
+golang.org/x/oauth2 v0.15.0/go.mod 
h1:q48ptWNTY5XWf+JNten23lcvHpLJ0ZSxF5ttTHKVCAM=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod 
h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod 
h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod 
h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -814,8 +816,8 @@
 golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
-golang.org/x/term v0.14.0 h1:LGK9IlZ8T9jvdy6cTdfKUCltatMFOehAQo9SRC46UQ8=
-golang.org/x/term v0.14.0/go.mod 
h1:TySc+nGkYR6qt8km8wUhuFRTVSMIX3XPR58y2lC8vww=
+golang.org/x/term v0.15.0 h1:y/Oo/a/q3IXu26lQgl04j/gjuBDOBlx7X6Om1j2CPW4=
+golang.org/x/term v0.15.0/go.mod 
h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod 
h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod 
h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -919,8 +921,8 @@
 google.golang.org/api v0.35.0/go.mod 
h1:/XrVsuzM0rZmrsbjJutiuftIzeuTQcEeaYcSk/mQ1dg=
 google.golang.org/api v0.36.0/go.mod 
h1:+z5ficQTmoYpPn8LCUNVpK5I7hwkpjbcgqA7I34qYtE=
 google.golang.org/api v0.40.0/go.mod 
h1:fYKFpnQN0DsDSKRVRcQSDQNtqWPfM9i+zNPxepjRCQ8=
-google.golang.org/api v0.152.0 h1:t0r1vPnfMc260S2Ci+en7kfCZaLOPs5KI0sVV/6jZrY=
-google.golang.org/api v0.152.0/go.mod 
h1:3qNJX5eOmhiWYc67jRA/3GsDw97UFb5ivv7Y2PrriAY=
+google.golang.org/api v0.154.0 h1:X7QkVKZBskztmpPKWQXgjJRPA2dJYrL6r+sYPRLj050=
+google.golang.org/api v0.154.0/go.mod 
h1:qhSMkM85hgqiokIYsrRyKxrjfBeIhgl4Z2JmeRkYylc=
 google.golang.org/appengine v1.1.0/go.mod 
h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod 
h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.5.0/go.mod 
h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -966,12 +968,12 @@
 google.golang.org/genproto v0.0.0-20201214200347-8c77b98c765d/go.mod 
h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20210108203827-ffc7fda8c3d7/go.mod 
h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20210226172003-ab064af71705/go.mod 
h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20231106174013-bbf56f31fb17 
h1:wpZ8pe2x1Q3f2KyT5f8oP/fa9rHAKgFPr/HZdNuS+PQ=
-google.golang.org/genproto v0.0.0-20231106174013-bbf56f31fb17/go.mod 
h1:J7XzRzVy1+IPwWHZUzoD0IccYZIrXILAQpc+Qy9CMhY=
-google.golang.org/genproto/googleapis/api v0.0.0-20231106174013-bbf56f31fb17 
h1:JpwMPBpFN3uKhdaekDpiNlImDdkUAyiJ6ez/uxGaUSo=
-google.golang.org/genproto/googleapis/api 
v0.0.0-20231106174013-bbf56f31fb17/go.mod 
h1:0xJLfVdJqpAPl8tDg1ujOCGzx6LFLttXT5NhllGOXY4=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20231120223509-83a465c0220f 
h1:ultW7fxlIvee4HYrtnaRPon9HpEgFk5zYpmfMgtKB5I=
-google.golang.org/genproto/googleapis/rpc 
v0.0.0-20231120223509-83a465c0220f/go.mod 
h1:L9KNLi232K1/xB6f7AlSX692koaRnKaWSR0stBki0Yc=
+google.golang.org/genproto v0.0.0-20231120223509-83a465c0220f 
h1:Vn+VyHU5guc9KjB5KrjI2q0wCOWEOIh0OEsleqakHJg=
+google.golang.org/genproto v0.0.0-20231120223509-83a465c0220f/go.mod 
h1:nWSwAFPb+qfNJXsoeO3Io7zf4tMSfN8EA8RlDA04GhY=
+google.golang.org/genproto/googleapis/api v0.0.0-20231120223509-83a465c0220f 
h1:2yNACc1O40tTnrsbk9Cv6oxiW8pxI/pXj0wRtdlYmgY=
+google.golang.org/genproto/googleapis/api 
v0.0.0-20231120223509-83a465c0220f/go.mod 
h1:Uy9bTZJqmfrw2rIBxgGLnamc78euZULUBrLZ9XTITKI=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20231127180814-3a041ad873d4 
h1:DC7wcm+i+P1rN3Ff07vL+OndGg5OhNddHyTA+ocPqYE=
+google.golang.org/genproto/googleapis/rpc 
v0.0.0-20231127180814-3a041ad873d4/go.mod 
h1:eJVxU6o+4G1PSczBr85xmyvSNYAKvAYgkub40YGomFM=
 google.golang.org/grpc v1.19.0/go.mod 
h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod 
h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.1/go.mod 
h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/melange-0.5.4/pkg/build/build_test.go 
new/melange-0.5.5/pkg/build/build_test.go
--- old/melange-0.5.4/pkg/build/build_test.go   2023-12-04 21:28:36.000000000 
+0100
+++ new/melange-0.5.5/pkg/build/build_test.go   2023-12-21 13:21:18.000000000 
+0100
@@ -193,8 +193,9 @@
                                },
                                Environment: apko_types.ImageConfiguration{
                                        Environment: map[string]string{
-                                               "HOME":   
"/home/build/special-case",
-                                               "GOPATH": 
"/var/cache/melange/go",
+                                               "GOMODCACHE": 
"/var/cache/melange/gomodcache",
+                                               "HOME":       
"/home/build/special-case",
+                                               "GOPATH":     
"/var/cache/melange/go",
                                        },
                                        Accounts: apko_types.ImageAccounts{
                                                Users:  
[]apko_types.User{{UserName: "build", UID: 1000, GID: 1000}},
@@ -282,8 +283,9 @@
                Members:   []string{"build"},
        }}
        expected.Environment.Environment = map[string]string{
-               "HOME":   "/home/build",
-               "GOPATH": "/home/build/.cache/go",
+               "HOME":       "/home/build",
+               "GOPATH":     "/home/build/.cache/go",
+               "GOMODCACHE": "/var/cache/melange/gomodcache",
        }
 
        f := filepath.Join(t.TempDir(), "config")
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/melange-0.5.4/pkg/build/pipelines/go/build.yaml 
new/melange-0.5.5/pkg/build/pipelines/go/build.yaml
--- old/melange-0.5.4/pkg/build/pipelines/go/build.yaml 2023-12-04 
21:28:36.000000000 +0100
+++ new/melange-0.5.5/pkg/build/pipelines/go/build.yaml 2023-12-21 
13:21:18.000000000 +0100
@@ -79,6 +79,9 @@
 
       BASE_PATH="${{inputs.prefix}}/${{inputs.install-dir}}/${{inputs.output}}"
 
+      # Take advantage of melange's buid cache for downloaded modules
+      export GOMODCACHE=/var/cache/melange/gomodcache
+
       cd "${{inputs.modroot}}"
 
       # Install any specified dependencies
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/melange-0.5.4/pkg/config/config.go 
new/melange-0.5.5/pkg/config/config.go
--- old/melange-0.5.4/pkg/config/config.go      2023-12-04 21:28:36.000000000 
+0100
+++ new/melange-0.5.5/pkg/config/config.go      2023-12-21 13:21:18.000000000 
+0100
@@ -417,7 +417,7 @@
        Enabled bool `json:"enabled" yaml:"enabled"`
        // Indicates that this package should be manually updated, usually 
taking
        // care over special version numbers
-       Manual bool `json:"manual" yaml:"manual"`
+       Manual bool `json:"manual,omitempty" yaml:"manual"`
        // Indicate that an update to this package requires an epoch bump of
        // downstream dependencies, e.g. golang, java
        Shared bool `json:"shared,omitempty" yaml:"shared,omitempty"`
@@ -841,17 +841,21 @@
        }
 
        const (
-               defaultEnvVarHOME   = "/home/build"
-               defaultEnvVarGOPATH = "/home/build/.cache/go"
+               defaultEnvVarHOME       = "/home/build"
+               defaultEnvVarGOPATH     = "/home/build/.cache/go"
+               defaultEnvVarGOMODCACHE = "/var/cache/melange/gomodcache"
        )
 
-       if cfg.Environment.Environment["HOME"] == "" {
-               cfg.Environment.Environment["HOME"] = defaultEnvVarHOME
-       }
-       if cfg.Environment.Environment["GOPATH"] == "" {
-               cfg.Environment.Environment["GOPATH"] = defaultEnvVarGOPATH
+       var setIfEmpty = func(key, value string) {
+               if cfg.Environment.Environment[key] == "" {
+                       cfg.Environment.Environment[key] = value
+               }
        }
 
+       setIfEmpty("HOME", defaultEnvVarHOME)
+       setIfEmpty("GOPATH", defaultEnvVarGOPATH)
+       setIfEmpty("GOMODCACHE", defaultEnvVarGOMODCACHE)
+
        // If a variables file was defined, merge it into the variables block.
        if varsFile := options.varsFilePath; varsFile != "" {
                f, err := os.Open(varsFile)
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/melange-0.5.4/pkg/config/schema.json 
new/melange-0.5.5/pkg/config/schema.json
--- old/melange-0.5.4/pkg/config/schema.json    2023-12-04 21:28:36.000000000 
+0100
+++ new/melange-0.5.5/pkg/config/schema.json    2023-12-21 13:21:18.000000000 
+0100
@@ -894,8 +894,7 @@
       "additionalProperties": false,
       "type": "object",
       "required": [
-        "enabled",
-        "manual"
+        "enabled"
       ],
       "description": "Update provides information used to describe how to keep 
the package up to date"
     },
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/melange-0.5.4/pkg/convert/apkbuild/apkbuild.go 
new/melange-0.5.5/pkg/convert/apkbuild/apkbuild.go
--- old/melange-0.5.4/pkg/convert/apkbuild/apkbuild.go  2023-12-04 
21:28:36.000000000 +0100
+++ new/melange-0.5.5/pkg/convert/apkbuild/apkbuild.go  2023-12-21 
13:21:18.000000000 +0100
@@ -424,11 +424,11 @@
        env := apkotypes.ImageConfiguration{
                Contents: apkotypes.ImageContents{
                        Packages: []string{
+                               "autoconf",
+                               "automake",
+                               "build-base",
                                "busybox",
                                "ca-certificates-bundle",
-                               "build-base",
-                               "automake",
-                               "autoconf",
                        },
                },
        }
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/melange-0.5.4/pkg/convert/gem/gem.go 
new/melange-0.5.5/pkg/convert/gem/gem.go
--- old/melange-0.5.4/pkg/convert/gem/gem.go    2023-12-04 21:28:36.000000000 
+0100
+++ new/melange-0.5.5/pkg/convert/gem/gem.go    2023-12-21 13:21:18.000000000 
+0100
@@ -283,12 +283,12 @@
        env := apkotypes.ImageConfiguration{
                Contents: apkotypes.ImageContents{
                        Packages: []string{
-                               "ca-certificates-bundle",
-                               fmt.Sprintf("ruby-%s", c.RubyVersion),
-                               fmt.Sprintf("ruby-%s-dev", c.RubyVersion),
                                "build-base",
                                "busybox",
+                               "ca-certificates-bundle",
                                "git",
+                               fmt.Sprintf("ruby-%s", c.RubyVersion),
+                               fmt.Sprintf("ruby-%s-dev", c.RubyVersion),
                        },
                },
        }
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/melange-0.5.4/pkg/convert/gem/gem_test.go 
new/melange-0.5.5/pkg/convert/gem/gem_test.go
--- old/melange-0.5.4/pkg/convert/gem/gem_test.go       2023-12-04 
21:28:36.000000000 +0100
+++ new/melange-0.5.5/pkg/convert/gem/gem_test.go       2023-12-21 
13:21:18.000000000 +0100
@@ -163,12 +163,12 @@
        assert.Equal(t, []string{"https://packages.wolfi.dev/os"}, 
got.Environment.Contents.Repositories)
        assert.Equal(t, 
[]string{"https://packages.wolfi.dev/os/wolfi-signing.rsa.pub"}, 
got.Environment.Contents.Keyring)
        assert.Equal(t, []string{
-               "ca-certificates-bundle",
-               fmt.Sprintf("ruby-%s", DefaultRubyVersion),
-               fmt.Sprintf("ruby-%s-dev", DefaultRubyVersion),
                "build-base",
                "busybox",
+               "ca-certificates-bundle",
                "git",
+               fmt.Sprintf("ruby-%s", DefaultRubyVersion),
+               fmt.Sprintf("ruby-%s-dev", DefaultRubyVersion),
        }, got.Environment.Contents.Packages)
 
        // Check Pipeline
@@ -250,12 +250,12 @@
                        Repositories: []string{"https://packages.wolfi.dev/os";, 
"local /github/workspace/packages"},
                        Keyring:      
[]string{"https://packages.wolfi.dev/os/wolfi-signing.rsa.pub";, 
"melange.rsa.pub"},
                        Packages: []string{
-                               "ca-certificates-bundle",
-                               fmt.Sprintf("ruby-%s", DefaultRubyVersion),
-                               fmt.Sprintf("ruby-%s-dev", DefaultRubyVersion),
                                "build-base",
                                "busybox",
+                               "ca-certificates-bundle",
                                "git",
+                               fmt.Sprintf("ruby-%s", DefaultRubyVersion),
+                               fmt.Sprintf("ruby-%s-dev", DefaultRubyVersion),
                        },
                },
        }
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/melange-0.5.4/pkg/convert/python/python.go 
new/melange-0.5.5/pkg/convert/python/python.go
--- old/melange-0.5.4/pkg/convert/python/python.go      2023-12-04 
21:28:36.000000000 +0100
+++ new/melange-0.5.5/pkg/convert/python/python.go      2023-12-21 
13:21:18.000000000 +0100
@@ -344,10 +344,10 @@
 func (c *PythonContext) generateEnvironment(pack Package) 
apkotypes.ImageConfiguration {
        c.Logger.Printf("[%s] Generate Environment", pack.Info.Name)
        pythonStandard := []string{
+               "build-base",
+               "busybox",
                "ca-certificates-bundle",
                "wolfi-base",
-               "busybox",
-               "build-base",
        }
 
        env := apkotypes.ImageConfiguration{
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/melange-0.5.4/pkg/convert/python/python_test.go 
new/melange-0.5.5/pkg/convert/python/python_test.go
--- old/melange-0.5.4/pkg/convert/python/python_test.go 2023-12-04 
21:28:36.000000000 +0100
+++ new/melange-0.5.5/pkg/convert/python/python_test.go 2023-12-21 
13:21:18.000000000 +0100
@@ -160,10 +160,10 @@
 
                // Check Environment
                assert.Equal(t, got.Environment.Contents.Packages, []string{
+                       "build-base",
+                       "busybox",
                        "ca-certificates-bundle",
                        "wolfi-base",
-                       "busybox",
-                       "build-base",
                })
 
                // Check Pipeline
@@ -312,10 +312,10 @@
        expected310 := apkotypes.ImageConfiguration{
                Contents: apkotypes.ImageContents{
                        Packages: []string{
+                               "build-base",
+                               "busybox",
                                "ca-certificates-bundle",
                                "wolfi-base",
-                               "busybox",
-                               "build-base",
                        },
                },
        }
@@ -335,10 +335,10 @@
        expected311 := apkotypes.ImageConfiguration{
                Contents: apkotypes.ImageContents{
                        Packages: []string{
+                               "build-base",
+                               "busybox",
                                "ca-certificates-bundle",
                                "wolfi-base",
-                               "busybox",
-                               "build-base",
                        },
                },
        }
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/melange-0.5.4/release.md new/melange-0.5.5/release.md
--- old/melange-0.5.4/release.md        2023-12-04 21:28:36.000000000 +0100
+++ new/melange-0.5.5/release.md        2023-12-21 13:21:18.000000000 +0100
@@ -37,3 +37,9 @@
 The process for cutting a release is exactly the same as above, except that 
you should pick a new minor version.
 
 For example, if the latest version is `v0.5.5`, create a minor release 
`v0.6.0`.
+
+## Homebrew
+
+Our release pipeline automate the process to update our [homebrew 
tap](https://github.com/chainguard-dev/homebrew-tap/blob/main/Formula/melange.rb),
+but it does not update the [Homebrew-core upstream 
repository](https://github.com/Homebrew/homebrew-core/blob/master/Formula/m/melange.rb)
 for that one
+we need to open a manual Pull Request.

++++++ melange.obsinfo ++++++
--- /var/tmp/diff_new_pack.HIVZQv/_old  2024-01-07 21:41:04.033688572 +0100
+++ /var/tmp/diff_new_pack.HIVZQv/_new  2024-01-07 21:41:04.037688718 +0100
@@ -1,5 +1,5 @@
 name: melange
-version: 0.5.4
-mtime: 1701721716
-commit: bc76a3708fdc91882817652237cbe73bcc5f4591
+version: 0.5.5
+mtime: 1703161278
+commit: 3a7d2fcf7c05beee78d2e1315eaa441b879f129d
 

++++++ vendor.tar.gz ++++++
/work/SRC/openSUSE:Factory/melange/vendor.tar.gz 
/work/SRC/openSUSE:Factory/.melange.new.28375/vendor.tar.gz differ: char 5, 
line 1

Reply via email to