From e5cd73f3fb65336b0768f76e9208457987db777d Mon Sep 17 00:00:00 2001 From: eabdullin Date: Thu, 13 Nov 2025 20:07:11 +0000 Subject: [PATCH] import CS osbuild-composer-149-1.el10 --- .gitignore | 2 +- fix-unclosed-logrus-logging-pipes.patch | 42 ------ json-tailoring-conversion.patch | 54 ------- osbuild-composer.spec | 87 ++++++------ sources | 2 +- update-go-jose-dependency.patch | 179 ------------------------ 6 files changed, 44 insertions(+), 322 deletions(-) delete mode 100644 fix-unclosed-logrus-logging-pipes.patch delete mode 100644 json-tailoring-conversion.patch delete mode 100644 update-go-jose-dependency.patch diff --git a/.gitignore b/.gitignore index d595043..74d580f 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -osbuild-composer-134.1.tar.gz +osbuild-composer-149.tar.gz diff --git a/fix-unclosed-logrus-logging-pipes.patch b/fix-unclosed-logrus-logging-pipes.patch deleted file mode 100644 index 8d04891..0000000 --- a/fix-unclosed-logrus-logging-pipes.patch +++ /dev/null @@ -1,42 +0,0 @@ -From bf424e53ba6949c685b0f4593588cec88edfe6f7 Mon Sep 17 00:00:00 2001 -From: Lukas Zapletal -Date: Thu, 11 Sep 2025 08:03:21 +0200 -Subject: [PATCH] common: fix unclosed logrus logging pipes - -This is a backport of 1cde7e3. The original patch was not separated into -individual commits unfortunately, there fore only the relevant line is -being brought in. The original analysis: - -It looks like both CloudAPI and WeldrAPI consume memory, process can go -up to several gigabytes pretty quickly just by running a simple script. - -while sleep 0.001; do - curl --unix-socket /run/weldr/api.socket -XGET http://localhost/api/ - curl --unix-socket /run/cloudapi/api.socket -XGET http://localhost/api/ -done - -There is a logrus logger method called Write and WriteLevel which create -a new logging entry, create a PIPE and spawn a goroutine that is reading -from that PIPE. The caller is expected to close the PIPE writer which -was not done. - -(cherry picked from commit 0f97a1c1668827086dfa335c9fb427cbb28782b2) ---- - internal/common/echo_logrus.go | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -diff --git a/internal/common/echo_logrus.go b/internal/common/echo_logrus.go -index 198ce17310..600cce2d74 100644 ---- a/internal/common/echo_logrus.go -+++ b/internal/common/echo_logrus.go -@@ -178,5 +178,9 @@ func (l *EchoLogrusLogger) Panicj(j lslog.JSON) { - } - - func (l *EchoLogrusLogger) Write(p []byte) (n int, err error) { -- return l.Logger.WithContext(l.Ctx).Writer().Write(p) -+ // Writer() from logrus returns PIPE that needs to be closed -+ w := l.Logger.WithContext(l.Ctx).Writer() -+ defer w.Close() -+ -+ return w.Write(p) - } diff --git a/json-tailoring-conversion.patch b/json-tailoring-conversion.patch deleted file mode 100644 index 729619c..0000000 --- a/json-tailoring-conversion.patch +++ /dev/null @@ -1,54 +0,0 @@ -From 514f82421bb2444fc73efca5898389329fd1e38d Mon Sep 17 00:00:00 2001 -From: Gianluca Zuccarelli -Date: Mon, 8 Sep 2025 14:11:50 +0100 -Subject: [PATCH] internal/blueprint: add JSON tailoring to bp conversion - -The blueprint convert function was missing the json tailoring case. This meant that -if the json tailoring customization was provided in the blueprint, the customization -would get ignored and the tailoring profile would not be applied to the image. ---- - internal/blueprint/blueprint.go | 4 ++++ - internal/blueprint/blueprint_convert_test.go | 8 ++++++++ - 2 files changed, 12 insertions(+) - -diff --git a/internal/blueprint/blueprint.go b/internal/blueprint/blueprint.go -index 63f8aa5b71..c01a2c6a48 100644 ---- a/internal/blueprint/blueprint.go -+++ b/internal/blueprint/blueprint.go -@@ -253,6 +253,10 @@ func Convert(bp Blueprint) iblueprint.Blueprint { - itailoring := iblueprint.OpenSCAPTailoringCustomizations(*tailoring) - ioscap.Tailoring = &itailoring - } -+ if jsonTailoring := oscap.JSONTailoring; jsonTailoring != nil { -+ ijsonTailoring := iblueprint.OpenSCAPJSONTailoringCustomizations(*jsonTailoring) -+ ioscap.JSONTailoring = &ijsonTailoring -+ } - customizations.OpenSCAP = &ioscap - } - if ign := c.Ignition; ign != nil { -diff --git a/internal/blueprint/blueprint_convert_test.go b/internal/blueprint/blueprint_convert_test.go -index 520e18271d..2c652f0658 100644 ---- a/internal/blueprint/blueprint_convert_test.go -+++ b/internal/blueprint/blueprint_convert_test.go -@@ -233,6 +233,10 @@ func TestConvert(t *testing.T) { - Selected: []string{"cloth"}, - Unselected: []string{"leather"}, - }, -+ JSONTailoring: &OpenSCAPJSONTailoringCustomizations{ -+ ProfileID: "tailored_profile", -+ Filepath: "path-to-json-file", -+ }, - }, - Ignition: &IgnitionCustomization{ - Embedded: &EmbeddedIgnitionCustomization{ -@@ -532,6 +536,10 @@ func TestConvert(t *testing.T) { - Selected: []string{"cloth"}, - Unselected: []string{"leather"}, - }, -+ JSONTailoring: &iblueprint.OpenSCAPJSONTailoringCustomizations{ -+ ProfileID: "tailored_profile", -+ Filepath: "path-to-json-file", -+ }, - }, - Ignition: &iblueprint.IgnitionCustomization{ - Embedded: &iblueprint.EmbeddedIgnitionCustomization{ diff --git a/osbuild-composer.spec b/osbuild-composer.spec index ae78dc9..02f2695 100644 --- a/osbuild-composer.spec +++ b/osbuild-composer.spec @@ -8,11 +8,11 @@ %bcond_with relax_requires # The minimum required osbuild version -%global min_osbuild_version 139 +%global min_osbuild_version 157 %global goipath github.com/osbuild/osbuild-composer -Version: 134.1 +Version: 149 %gometa @@ -25,7 +25,7 @@ It is compatible with composer-cli and cockpit-composer clients. } Name: osbuild-composer -Release: 3%{?dist} +Release: 1%{?dist} Summary: An image building service based on osbuild # osbuild-composer doesn't have support for building i686 and armv7hl images @@ -36,14 +36,6 @@ License: Apache-2.0 URL: %{gourl} Source0: %{gosource} -# https://github.com/osbuild/osbuild-composer/pull/4857 -Patch0: json-tailoring-conversion.patch - -# https://github.com/osbuild/osbuild-composer/pull/4867 -Patch1: fix-unclosed-logrus-logging-pipes.patch - -# https://github.com/osbuild/osbuild-composer/pull/4841 -Patch2: update-go-jose-dependency.patch BuildRequires: %{?go_compiler:compiler(go-compiler)}%{!?go_compiler:golang} BuildRequires: systemd @@ -114,8 +106,6 @@ export LDFLAGS="${LDFLAGS} -X 'github.com/osbuild/osbuild-composer/internal/comm %gobuild ${GOTAGS:+-tags=$GOTAGS} -o _bin/osbuild-composer %{goipath}/cmd/osbuild-composer %gobuild ${GOTAGS:+-tags=$GOTAGS} -o _bin/osbuild-worker %{goipath}/cmd/osbuild-worker %gobuild ${GOTAGS:+-tags=$GOTAGS} -o _bin/osbuild-worker-executor %{goipath}/cmd/osbuild-worker-executor -%gobuild ${GOTAGS:+-tags=$GOTAGS} -o _bin/osbuild-jobsite-manager %{goipath}/cmd/osbuild-jobsite-manager -%gobuild ${GOTAGS:+-tags=$GOTAGS} -o _bin/osbuild-jobsite-builder %{goipath}/cmd/osbuild-jobsite-builder make man @@ -124,13 +114,6 @@ make man # Build test binaries with `go test -c`, so that they can take advantage of # golang's testing package. The golang rpm macros don't support building them # directly. Thus, do it manually, taking care to also include a build id. -# -# On Fedora, also turn off go modules and set the path to the one into which -# the golang-* packages install source code. -%if 0%{?fedora} -export GO111MODULE=off -export GOPATH=%{gobuilddir}:%{gopath} -%endif TEST_LDFLAGS="${LDFLAGS:-} -B 0x$(od -N 20 -An -tx1 -w100 /dev/urandom | tr -d ' ')" @@ -141,7 +124,6 @@ GOTAGS="${GOTAGS:+$GOTAGS,}rhel%{rhel}" go test -c -tags="integration${GOTAGS:+,$GOTAGS}" -ldflags="${TEST_LDFLAGS}" -o _bin/osbuild-composer-cli-tests %{goipath}/cmd/osbuild-composer-cli-tests go test -c -tags="integration${GOTAGS:+,$GOTAGS}" -ldflags="${TEST_LDFLAGS}" -o _bin/osbuild-dnf-json-tests %{goipath}/cmd/osbuild-dnf-json-tests go test -c -tags="integration${GOTAGS:+,$GOTAGS}" -ldflags="${TEST_LDFLAGS}" -o _bin/osbuild-weldr-tests %{goipath}/internal/client/ -go test -c -tags="integration${GOTAGS:+,$GOTAGS}" -ldflags="${TEST_LDFLAGS}" -o _bin/osbuild-image-tests %{goipath}/cmd/osbuild-image-tests go test -c -tags="integration${GOTAGS:+,$GOTAGS}" -ldflags="${TEST_LDFLAGS}" -o _bin/osbuild-auth-tests %{goipath}/cmd/osbuild-auth-tests go test -c -tags="integration${GOTAGS:+,$GOTAGS}" -ldflags="${TEST_LDFLAGS}" -o _bin/osbuild-koji-tests %{goipath}/cmd/osbuild-koji-tests go test -c -tags="integration${GOTAGS:+,$GOTAGS}" -ldflags="${TEST_LDFLAGS}" -o _bin/osbuild-composer-dbjobqueue-tests %{goipath}/cmd/osbuild-composer-dbjobqueue-tests @@ -155,8 +137,6 @@ install -m 0755 -vd %{buildroot}% install -m 0755 -vp _bin/osbuild-composer %{buildroot}%{_libexecdir}/osbuild-composer/ install -m 0755 -vp _bin/osbuild-worker %{buildroot}%{_libexecdir}/osbuild-composer/ install -m 0755 -vp _bin/osbuild-worker-executor %{buildroot}%{_libexecdir}/osbuild-composer/ -install -m 0755 -vp _bin/osbuild-jobsite-manager %{buildroot}%{_libexecdir}/osbuild-composer/ -install -m 0755 -vp _bin/osbuild-jobsite-builder %{buildroot}%{_libexecdir}/osbuild-composer/ # Only include repositories for the distribution and release install -m 0755 -vd %{buildroot}%{_datadir}/osbuild-composer/repositories @@ -228,7 +208,6 @@ install -m 0755 -vd %{buildroot}% install -m 0755 -vp _bin/osbuild-composer-cli-tests %{buildroot}%{_libexecdir}/osbuild-composer-test/ install -m 0755 -vp _bin/osbuild-weldr-tests %{buildroot}%{_libexecdir}/osbuild-composer-test/ install -m 0755 -vp _bin/osbuild-dnf-json-tests %{buildroot}%{_libexecdir}/osbuild-composer-test/ -install -m 0755 -vp _bin/osbuild-image-tests %{buildroot}%{_libexecdir}/osbuild-composer-test/ install -m 0755 -vp _bin/osbuild-auth-tests %{buildroot}%{_libexecdir}/osbuild-composer-test/ install -m 0755 -vp _bin/osbuild-koji-tests %{buildroot}%{_libexecdir}/osbuild-composer-test/ install -m 0755 -vp _bin/osbuild-composer-dbjobqueue-tests %{buildroot}%{_libexecdir}/osbuild-composer-test/ @@ -261,9 +240,6 @@ install -m 0644 -vp test/data/ansible/* %{buildroot}% install -m 0755 -vd %{buildroot}%{_datadir}/tests/osbuild-composer/azure install -m 0644 -vp test/data/azure/* %{buildroot}%{_datadir}/tests/osbuild-composer/azure/ -install -m 0755 -vd %{buildroot}%{_datadir}/tests/osbuild-composer/manifests -install -m 0644 -vp test/data/manifests/* %{buildroot}%{_datadir}/tests/osbuild-composer/manifests/ - install -m 0755 -vd %{buildroot}%{_datadir}/tests/osbuild-composer/cloud-init install -m 0644 -vp test/data/cloud-init/* %{buildroot}%{_datadir}/tests/osbuild-composer/cloud-init/ @@ -300,14 +276,12 @@ install -m 0644 -vp test/data/rhel-upgrade/* %{buildroot}% %check export GOFLAGS="-buildmode=pie" %if 0%{?rhel} -export GOFLAGS+=" -mod=vendor -tags=exclude_graphdriver_btrfs" +export GOFLAGS+=" -tags=exclude_graphdriver_btrfs" +%endif + export GOPATH=$PWD/_build:%{gopath} # cd inside GOPATH, otherwise go with GO111MODULE=off ignores vendor directory cd $PWD/_build/src/%{goipath} -%gotest ./... -%else -%gocheck -%endif %post %systemd_post osbuild-composer.service osbuild-composer.socket osbuild-composer-api.socket osbuild-composer-prometheus.socket osbuild-remote-worker.socket @@ -364,8 +338,6 @@ The worker for osbuild-composer %files worker %{_libexecdir}/osbuild-composer/osbuild-worker %{_libexecdir}/osbuild-composer/osbuild-worker-executor -%{_libexecdir}/osbuild-composer/osbuild-jobsite-manager -%{_libexecdir}/osbuild-composer/osbuild-jobsite-builder %{_unitdir}/osbuild-worker@.service %{_unitdir}/osbuild-remote-worker@.service @@ -462,19 +434,44 @@ Integration tests to be run on a pristine-dedicated system to test the osbuild-c %endif %changelog -* Wed Oct 15 2025 Gianluca Zuccarelli - 134.1-3 -- Fix json tailoring blueprint conversion - Resolves: RHEL-115392 -- Fix unclosed logrus logging pipes - Resolves: RHEL-121533 -- Update go-jose dependency - Resolves: RHEL-82957 (CVE-2025-27144) +* Thu Aug 21 2025 imagebuilder-bot - 149-1 +- New upstream release -* Tue Jun 24 2025 Ondřej Budai - 134.1-2 -- Resolves: RHEL-89221 (CVE-2025-22871) +* Wed Aug 06 2025 imagebuilder-bot - 147-1 +- New upstream release -* Fri Apr 25 2025 Tomáš Hozza - 134.1-1 -- Resolves: RHEL-84629 +* Wed Jul 23 2025 imagebuilder-bot - 146-1 +- New upstream release + +* Sat Jul 12 2025 imagebuilder-bot - 145-1 +- New upstream release + +* Wed Jun 25 2025 imagebuilder-bot - 144-1 +- New upstream release + +* Wed Jun 11 2025 imagebuilder-bot - 143-1 +- New upstream release + +* Thu Jun 05 2025 imagebuilder-bot - 142-1 +- New upstream release + +* Mon May 19 2025 imagebuilder-bot - 141-1 +- New upstream release + +* Wed Apr 23 2025 imagebuilder-bot - 139-1 +- New upstream release + +* Wed Apr 16 2025 imagebuilder-bot - 138-1 +- New upstream release + +* Thu Apr 03 2025 imagebuilder-bot - 137-1 +- New upstream release + +* Mon Mar 31 2025 imagebuilder-bot - 136-1 +- New upstream release + +* Wed Mar 05 2025 imagebuilder-bot - 135-1 +- New upstream release * Mon Feb 24 2025 Tomáš Hozza - 134-1 - New upstream release diff --git a/sources b/sources index e270772..fd3fd0c 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (osbuild-composer-134.1.tar.gz) = ffb5041664b448a54184a87240621f5d4862695779fe28fd41dceef3af4eaeb5ed84299195ce7b6ce424f4e86bf5ce44070e468dfc49b0260a0e8c02097d539f +SHA512 (osbuild-composer-149.tar.gz) = b7071faeb915c982c51fe0a95823b25e5da929e29539d941af6670598abca3668f99e2ece362c0e34a33cf5d058b62cc7a7b07f9ec1d1825c2a64ea7230b0bcc diff --git a/update-go-jose-dependency.patch b/update-go-jose-dependency.patch deleted file mode 100644 index 7a34104..0000000 --- a/update-go-jose-dependency.patch +++ /dev/null @@ -1,179 +0,0 @@ -From 8d9b6fd1f471eeb919e6bb7049b221127505e841 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Ond=C5=99ej=20Budai?= -Date: Tue, 26 Aug 2025 13:39:35 +0200 -Subject: [PATCH 1/2] go.mod: update go-jose v4.0.5 to fix CVE-2025-27144 - ---- - go.mod | 2 +- - go.sum | 4 ++-- - vendor/github.com/go-jose/go-jose/v4/CONTRIBUTING.md | 6 ------ - vendor/github.com/go-jose/go-jose/v4/README.md | 10 +--------- - vendor/github.com/go-jose/go-jose/v4/jwe.go | 5 +++-- - vendor/github.com/go-jose/go-jose/v4/jwk.go | 4 ++-- - vendor/github.com/go-jose/go-jose/v4/jws.go | 5 +++-- - vendor/modules.txt | 2 +- - 8 files changed, 13 insertions(+), 25 deletions(-) - -diff --git a/go.mod b/go.mod -index f32612ffdf..bdb089ef3e 100644 ---- a/go.mod -+++ b/go.mod -@@ -133,7 +133,7 @@ require ( - github.com/envoyproxy/protoc-gen-validate v1.2.1 // indirect - github.com/felixge/httpsnoop v1.0.4 // indirect - github.com/ghodss/yaml v1.0.0 // indirect -- github.com/go-jose/go-jose/v4 v4.0.4 // indirect -+ github.com/go-jose/go-jose/v4 v4.0.5 // indirect - github.com/go-logr/logr v1.4.2 // indirect - github.com/go-logr/stdr v1.2.2 // indirect - github.com/go-openapi/analysis v0.23.0 // indirect -diff --git a/go.sum b/go.sum -index 42ee5ca2d1..d415139ffe 100644 ---- a/go.sum -+++ b/go.sum -@@ -252,8 +252,8 @@ github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeME - github.com/go-chi/chi/v5 v5.0.0/go.mod h1:BBug9lr0cqtdAhsu6R4AAdvufI0/XBzAQSsUqJpoZOs= - github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA= - github.com/go-errors/errors v1.4.2/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og= --github.com/go-jose/go-jose/v4 v4.0.4 h1:VsjPI33J0SB9vQM6PLmNjoHqMQNGPiZ0rHL7Ni7Q6/E= --github.com/go-jose/go-jose/v4 v4.0.4/go.mod h1:NKb5HO1EZccyMpiZNbdUw/14tiXNyUJh188dfnMCAfc= -+github.com/go-jose/go-jose/v4 v4.0.5 h1:M6T8+mKZl/+fNNuFHvGIzDz7BTLQPIounk/b9dw3AaE= -+github.com/go-jose/go-jose/v4 v4.0.5/go.mod h1:s3P1lRrkT8igV8D9OjyL4WRyHvjB6a4JSllnOrmmBOA= - github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY= - github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A= - github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= -diff --git a/vendor/github.com/go-jose/go-jose/v4/CONTRIBUTING.md b/vendor/github.com/go-jose/go-jose/v4/CONTRIBUTING.md -index b63e1f8fee..4b4805add6 100644 ---- a/vendor/github.com/go-jose/go-jose/v4/CONTRIBUTING.md -+++ b/vendor/github.com/go-jose/go-jose/v4/CONTRIBUTING.md -@@ -7,9 +7,3 @@ When submitting code, please make every effort to follow existing conventions - and style in order to keep the code as readable as possible. Please also make - sure all tests pass by running `go test`, and format your code with `go fmt`. - We also recommend using `golint` and `errcheck`. -- --Before your code can be accepted into the project you must also sign the --Individual Contributor License Agreement. We use [cla-assistant.io][1] and you --will be prompted to sign once a pull request is opened. -- --[1]: https://cla-assistant.io/ -diff --git a/vendor/github.com/go-jose/go-jose/v4/README.md b/vendor/github.com/go-jose/go-jose/v4/README.md -index 79a7c5ecc8..02b5749546 100644 ---- a/vendor/github.com/go-jose/go-jose/v4/README.md -+++ b/vendor/github.com/go-jose/go-jose/v4/README.md -@@ -9,14 +9,6 @@ Package jose aims to provide an implementation of the Javascript Object Signing - and Encryption set of standards. This includes support for JSON Web Encryption, - JSON Web Signature, and JSON Web Token standards. - --**Disclaimer**: This library contains encryption software that is subject to --the U.S. Export Administration Regulations. You may not export, re-export, --transfer or download this code or any part of it in violation of any United --States law, directive or regulation. In particular this software may not be --exported or re-exported in any form or on any media to Iran, North Sudan, --Syria, Cuba, or North Korea, or to denied persons or entities mentioned on any --US maintained blocked list. -- - ## Overview - - The implementation follows the -@@ -109,6 +101,6 @@ allows attaching a key id. - - Examples can be found in the Godoc - reference for this package. The --[`jose-util`](https://github.com/go-jose/go-jose/tree/v4/jose-util) -+[`jose-util`](https://github.com/go-jose/go-jose/tree/main/jose-util) - subdirectory also contains a small command-line utility which might be useful - as an example as well. -diff --git a/vendor/github.com/go-jose/go-jose/v4/jwe.go b/vendor/github.com/go-jose/go-jose/v4/jwe.go -index 89f03ee3e1..9f1322dccc 100644 ---- a/vendor/github.com/go-jose/go-jose/v4/jwe.go -+++ b/vendor/github.com/go-jose/go-jose/v4/jwe.go -@@ -288,10 +288,11 @@ func ParseEncryptedCompact( - keyAlgorithms []KeyAlgorithm, - contentEncryption []ContentEncryption, - ) (*JSONWebEncryption, error) { -- parts := strings.Split(input, ".") -- if len(parts) != 5 { -+ // Five parts is four separators -+ if strings.Count(input, ".") != 4 { - return nil, fmt.Errorf("go-jose/go-jose: compact JWE format must have five parts") - } -+ parts := strings.SplitN(input, ".", 5) - - rawProtected, err := base64.RawURLEncoding.DecodeString(parts[0]) - if err != nil { -diff --git a/vendor/github.com/go-jose/go-jose/v4/jwk.go b/vendor/github.com/go-jose/go-jose/v4/jwk.go -index 8a52842106..9e57e93ba2 100644 ---- a/vendor/github.com/go-jose/go-jose/v4/jwk.go -+++ b/vendor/github.com/go-jose/go-jose/v4/jwk.go -@@ -239,10 +239,10 @@ func (k *JSONWebKey) UnmarshalJSON(data []byte) (err error) { - keyPub = key - } - } else { -- err = fmt.Errorf("go-jose/go-jose: unknown curve %s'", raw.Crv) -+ return fmt.Errorf("go-jose/go-jose: unknown curve %s'", raw.Crv) - } - default: -- err = fmt.Errorf("go-jose/go-jose: unknown json web key type '%s'", raw.Kty) -+ return fmt.Errorf("go-jose/go-jose: unknown json web key type '%s'", raw.Kty) - } - - if err != nil { -diff --git a/vendor/github.com/go-jose/go-jose/v4/jws.go b/vendor/github.com/go-jose/go-jose/v4/jws.go -index 3a912301af..d09d8ba507 100644 ---- a/vendor/github.com/go-jose/go-jose/v4/jws.go -+++ b/vendor/github.com/go-jose/go-jose/v4/jws.go -@@ -327,10 +327,11 @@ func parseSignedCompact( - payload []byte, - signatureAlgorithms []SignatureAlgorithm, - ) (*JSONWebSignature, error) { -- parts := strings.Split(input, ".") -- if len(parts) != 3 { -+ // Three parts is two separators -+ if strings.Count(input, ".") != 2 { - return nil, fmt.Errorf("go-jose/go-jose: compact JWS format must have three parts") - } -+ parts := strings.SplitN(input, ".", 3) - - if parts[1] != "" && payload != nil { - return nil, fmt.Errorf("go-jose/go-jose: payload is not detached") -diff --git a/vendor/modules.txt b/vendor/modules.txt -index c85cf5570b..a0e70865d4 100644 ---- a/vendor/modules.txt -+++ b/vendor/modules.txt -@@ -693,7 +693,7 @@ github.com/getsentry/sentry-go/logrus - # github.com/ghodss/yaml v1.0.0 - ## explicit - github.com/ghodss/yaml --# github.com/go-jose/go-jose/v4 v4.0.4 -+# github.com/go-jose/go-jose/v4 v4.0.5 - ## explicit; go 1.21 - github.com/go-jose/go-jose/v4 - github.com/go-jose/go-jose/v4/cipher - -From bab603f74db931475511cd63e6ecf67bd63da728 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Ond=C5=99ej=20Budai?= -Date: Tue, 26 Aug 2025 13:46:51 +0200 -Subject: [PATCH 2/2] github: ignore unused functions in shellcheck - -Seems to be a false positive (shellcheck doesn't understand traps). ---- - .github/workflows/tests.yml | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml -index befc48d529..c4e8369960 100644 ---- a/.github/workflows/tests.yml -+++ b/.github/workflows/tests.yml -@@ -212,9 +212,9 @@ jobs: - with: - ignore: vendor # We don't want to fix the code in vendored dependencies - env: -- # don't check /etc/os-release sourcing, allow useless cats to live inside our codebase, and -- # allow seemingly unreachable commands -- SHELLCHECK_OPTS: -e SC1091 -e SC2002 -e SC2317 -+ # don't check /etc/os-release sourcing, allow useless cats to live inside our codebase, -+ # allow seemingly unreachable commands, and allow unused functions -+ SHELLCHECK_OPTS: -e SC1091 -e SC2002 -e SC2317 -e SC2329 - - - name: Do not doube trap signals inside test scripts - run: |