Add AlmaLinux support patch

Add AlmaLinux-Kitten support patch
2025-11-05 09:04:13 +00:00 · 2025-11-05 09:04:13 +00:00 · 5d36d2f90d
commit 5d36d2f90d
parent 0f874ea3f8 64e33de76f
7 changed files with 302 additions and 181 deletions
--- a/.fmf/version
+++ b/.fmf/version
@ -1 +0,0 @@
-1
--- a/.gitignore
+++ b/.gitignore
@ -1,120 +1 @@
-/osbuild-composer-8.tar.gz
-/osbuild-composer-9.tar.gz
-/osbuild-composer-10.tar.gz
-/osbuild-composer-11.tar.gz
-/osbuild-composer-12.tar.gz
-/osbuild-composer-13.tar.gz
-/osbuild-composer-14.tar.gz
-/osbuild-composer-15.tar.gz
-/osbuild-composer-16.tar.gz
-/osbuild-composer-17.tar.gz
-/osbuild-composer-18.tar.gz
-/osbuild-composer-19.tar.gz
-/osbuild-composer-20.tar.gz
-/osbuild-composer-22.tar.gz
-/osbuild-composer-23.tar.gz
-/osbuild-composer-24.tar.gz
-/osbuild-composer-25.tar.gz
-/osbuild-composer-26.tar.gz
-/osbuild-composer-27.tar.gz
-/osbuild-composer-28.tar.gz
-/osbuild-composer-29.tar.gz
-/osbuild-composer-30.tar.gz
-/osbuild-composer-31.tar.gz
-/osbuild-composer-35.tar.gz
-/osbuild-composer-36.tar.gz
-/osbuild-composer-37.tar.gz
-/osbuild-composer-38.tar.gz
-/osbuild-composer-39.tar.gz
-/osbuild-composer-40.tar.gz
-/osbuild-composer-41.tar.gz
-/osbuild-composer-42.tar.gz
-/osbuild-composer-43.tar.gz
-/osbuild-composer-44.tar.gz
-/osbuild-composer-45.tar.gz
-/osbuild-composer-46.tar.gz
-/osbuild-composer-47.tar.gz
-/osbuild-composer-48.tar.gz
-/osbuild-composer-46.1.tar.gz
-/osbuild-composer-46.2.tar.gz
-/osbuild-composer-49.tar.gz
-/osbuild-composer-50.tar.gz
-/osbuild-composer-46.3.tar.gz
-/osbuild-composer-51.tar.gz
-/osbuild-composer-53.tar.gz
-/osbuild-composer-54.tar.gz
-/osbuild-composer-55.tar.gz
-/osbuild-composer-56.tar.gz
-/osbuild-composer-57.tar.gz
-/osbuild-composer-58.tar.gz
-/osbuild-composer-59.tar.gz
-/osbuild-composer-60.tar.gz
-/osbuild-composer-61.tar.gz
-/osbuild-composer-62.tar.gz
-/osbuild-composer-63.tar.gz
-/osbuild-composer-63.1.tar.gz
-/osbuild-composer-62.1.tar.gz
-/osbuild-composer-64.tar.gz
-/osbuild-composer-65.tar.gz
-/osbuild-composer-66.tar.gz
-/osbuild-composer-67.tar.gz
-/osbuild-composer-68.tar.gz
-/osbuild-composer-69.tar.gz
-/osbuild-composer-70.tar.gz
-/osbuild-composer-71.tar.gz
-/osbuild-composer-72.tar.gz
-/osbuild-composer-73.tar.gz
-/osbuild-composer-74.tar.gz
-/osbuild-composer-75.tar.gz
-/osbuild-composer-76.tar.gz
-/osbuild-composer-77.tar.gz
-/osbuild-composer-78.tar.gz
-/osbuild-composer-79.tar.gz
-/osbuild-composer-80.tar.gz
-/osbuild-composer-82.tar.gz
-/osbuild-composer-83.tar.gz
-/osbuild-composer-84.tar.gz
-/osbuild-composer-85.tar.gz
-/osbuild-composer-86.tar.gz
-/osbuild-composer-87.tar.gz
-/osbuild-composer-88.tar.gz
-/osbuild-composer-89.tar.gz
-/osbuild-composer-90.tar.gz
-/osbuild-composer-91.tar.gz
-/osbuild-composer-92.tar.gz
-/osbuild-composer-88.2.tar.gz
-/osbuild-composer-93.tar.gz
-/osbuild-composer-94.tar.gz
-/osbuild-composer-95.tar.gz
-/osbuild-composer-96.tar.gz
-/osbuild-composer-98.tar.gz
-/osbuild-composer-99.tar.gz
-/osbuild-composer-100.tar.gz
-/osbuild-composer-106.tar.gz
-/osbuild-composer-108.tar.gz
-/osbuild-composer-109.tar.gz
-/osbuild-composer-113.tar.gz
-/osbuild-composer-114.tar.gz
-/osbuild-composer-115.tar.gz
-/osbuild-composer-116.tar.gz
-/osbuild-composer-117.tar.gz
-/osbuild-composer-118.tar.gz
-/osbuild-composer-123.tar.gz
-/osbuild-composer-124.tar.gz
-/osbuild-composer-125.tar.gz
-/osbuild-composer-126.tar.gz
-/osbuild-composer-127.tar.gz
-/osbuild-composer-128.tar.gz
-/osbuild-composer-131.tar.gz
-/osbuild-composer-132.tar.gz
-/osbuild-composer-134.tar.gz
-/osbuild-composer-135.tar.gz
-/osbuild-composer-136.tar.gz
-/osbuild-composer-137.tar.gz
-/osbuild-composer-138.tar.gz
-/osbuild-composer-139.tar.gz
-/osbuild-composer-141.tar.gz
-/osbuild-composer-142.tar.gz
-/osbuild-composer-143.tar.gz
-/osbuild-composer-144.tar.gz
 osbuild-composer-134.1.tar.gz
--- a/.packit.yaml
+++ b/.packit.yaml
@ -1,54 +0,0 @@
-# https://packit.dev/docs/configuration/
-
-specfile_path: osbuild-composer.spec
-
-files_to_sync:
-    - osbuild-composer.spec
-    - .packit.yaml
-
-copy_upstream_release_description: true
-
-upstream_tag_template: v{version}
-
-srpm_build_deps: []
-actions:
-  get-current-version: bash -c "git describe --tags --abbrev=0 | sed 's|v||'"
-  post-upstream-clone: "./tools/rpm_spec_add_provides_bundle.sh"
-
-# Handle only releases without a "dot" (e.g. v88.2), since "dot" releases should never be released to Fedora
-upstream_tag_include: 'v\d+'
-
-jobs:
- job: bodhi_update
-  trigger: commit
-  dist_git_branches:
-    - fedora-branched # rawhide updates are created automatically
- job: koji_build
-  trigger: commit
-  dist_git_branches:
-    - fedora-all
- job: propose_downstream
-  trigger: release
-  dist_git_branches:
-    - fedora-all
- job: copr_build
-  trigger: pull_request
-  targets: &build_targets
-    - centos-stream-8-aarch64
-    - centos-stream-8-x86_64
-    - centos-stream-9-aarch64
-    - centos-stream-9-x86_64
-    - fedora-all-aarch64
-    - fedora-all-s390x
-    - fedora-all-ppc64le
-    - fedora-all
-    - rhel-8-aarch64
-    - rhel-8-x86_64
-    - rhel-9-aarch64
-    - rhel-9-x86_64
- job: copr_build
-  trigger: commit
-  branch: main
-  owner: "@osbuild" # copr repo namespace
-  project: osbuild-composer  # copr repo name so you can consume the builds
-  targets: *build_targets
--- a/fix-unclosed-logrus-logging-pipes.patch
+++ b/fix-unclosed-logrus-logging-pipes.patch
@ -0,0 +1,42 @@
+From bf424e53ba6949c685b0f4593588cec88edfe6f7 Mon Sep 17 00:00:00 2001
+From: Lukas Zapletal <lzap+git@redhat.com>
+Date: Thu, 11 Sep 2025 08:03:21 +0200
+Subject: [PATCH] common: fix unclosed logrus logging pipes
+
+This is a backport of 1cde7e3. The original patch was not separated into
+individual commits unfortunately, there fore only the relevant line is
+being brought in. The original analysis:
+
+It looks like both CloudAPI and WeldrAPI consume memory, process can go
+up to several gigabytes pretty quickly just by running a simple script.
+
+while sleep 0.001; do
+    curl --unix-socket /run/weldr/api.socket -XGET http://localhost/api/
+    curl --unix-socket /run/cloudapi/api.socket -XGET http://localhost/api/
+done
+
+There is a logrus logger method called Write and WriteLevel which create
+a new logging entry, create a PIPE and spawn a goroutine that is reading
+from that PIPE. The caller is expected to close the PIPE writer which
+was not done.
+
+(cherry picked from commit 0f97a1c1668827086dfa335c9fb427cbb28782b2)
+---
+ internal/common/echo_logrus.go | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/internal/common/echo_logrus.go b/internal/common/echo_logrus.go
+index 198ce17310..600cce2d74 100644
+--- a/internal/common/echo_logrus.go
+++ b/internal/common/echo_logrus.go
+@@ -178,5 +178,9 @@ func (l *EchoLogrusLogger) Panicj(j lslog.JSON) {
+ }
+
+ func (l *EchoLogrusLogger) Write(p []byte) (n int, err error) {
+-	return l.Logger.WithContext(l.Ctx).Writer().Write(p)
+	// Writer() from logrus returns PIPE that needs to be closed
+	w := l.Logger.WithContext(l.Ctx).Writer()
+	defer w.Close()
+
+	return w.Write(p)
+ }
--- a/json-tailoring-conversion.patch
+++ b/json-tailoring-conversion.patch
@ -0,0 +1,54 @@
+From 514f82421bb2444fc73efca5898389329fd1e38d Mon Sep 17 00:00:00 2001
+From: Gianluca Zuccarelli <gianlucazuccarelli@gmail.com>
+Date: Mon, 8 Sep 2025 14:11:50 +0100
+Subject: [PATCH] internal/blueprint: add JSON tailoring to bp conversion
+
+The blueprint convert function was missing the json tailoring case. This meant that
+if the json tailoring customization was provided in the blueprint, the customization
+would get ignored and the tailoring profile would not be applied to the image.
+---
+ internal/blueprint/blueprint.go              | 4 ++++
+ internal/blueprint/blueprint_convert_test.go | 8 ++++++++
+ 2 files changed, 12 insertions(+)
+
+diff --git a/internal/blueprint/blueprint.go b/internal/blueprint/blueprint.go
+index 63f8aa5b71..c01a2c6a48 100644
+--- a/internal/blueprint/blueprint.go
+++ b/internal/blueprint/blueprint.go
+@@ -253,6 +253,10 @@ func Convert(bp Blueprint) iblueprint.Blueprint {
+ 				itailoring := iblueprint.OpenSCAPTailoringCustomizations(*tailoring)
+ 				ioscap.Tailoring = &itailoring
+ 			}
+			if jsonTailoring := oscap.JSONTailoring; jsonTailoring != nil {
+				ijsonTailoring := iblueprint.OpenSCAPJSONTailoringCustomizations(*jsonTailoring)
+				ioscap.JSONTailoring = &ijsonTailoring
+			}
+ 			customizations.OpenSCAP = &ioscap
+ 		}
+ 		if ign := c.Ignition; ign != nil {
+diff --git a/internal/blueprint/blueprint_convert_test.go b/internal/blueprint/blueprint_convert_test.go
+index 520e18271d..2c652f0658 100644
+--- a/internal/blueprint/blueprint_convert_test.go
+++ b/internal/blueprint/blueprint_convert_test.go
+@@ -233,6 +233,10 @@ func TestConvert(t *testing.T) {
+ 							Selected:   []string{"cloth"},
+ 							Unselected: []string{"leather"},
+ 						},
+						JSONTailoring: &OpenSCAPJSONTailoringCustomizations{
+							ProfileID: "tailored_profile",
+							Filepath:  "path-to-json-file",
+						},
+ 					},
+ 					Ignition: &IgnitionCustomization{
+ 						Embedded: &EmbeddedIgnitionCustomization{
+@@ -532,6 +536,10 @@ func TestConvert(t *testing.T) {
+ 							Selected:   []string{"cloth"},
+ 							Unselected: []string{"leather"},
+ 						},
+						JSONTailoring: &iblueprint.OpenSCAPJSONTailoringCustomizations{
+							ProfileID: "tailored_profile",
+							Filepath:  "path-to-json-file",
+						},
+ 					},
+ 					Ignition: &iblueprint.IgnitionCustomization{
+ 						Embedded: &iblueprint.EmbeddedIgnitionCustomization{
--- a/osbuild-composer.spec
+++ b/osbuild-composer.spec
@ -25,7 +25,7 @@ It is compatible with composer-cli and cockpit-composer clients.
 }

 Name:           osbuild-composer
-Release:        2%{?dist}.alma.1
+Release:        3%{?dist}.alma.1
 Summary:        An image building service based on osbuild

 # osbuild-composer doesn't have support for building i686 and armv7hl images
@ -36,12 +36,20 @@ License:        Apache-2.0
 URL:            %{gourl}
 Source0:        %{gosource}

+# https://github.com/osbuild/osbuild-composer/pull/4857
+Patch0: json-tailoring-conversion.patch
+
+# https://github.com/osbuild/osbuild-composer/pull/4867
+Patch1: fix-unclosed-logrus-logging-pipes.patch
+
+# https://github.com/osbuild/osbuild-composer/pull/4841
+Patch2: update-go-jose-dependency.patch
+
 # AlmaLinux Patch
 Patch1001: 0001-Remove-libreport-rhel-anaconda-bugzilla-from-anacond.patch
 Patch1002: 0002-Add-AlmaLinux-support.patch
 Patch1003: 0003-Add-AlmaLinux-Kitten-support.patch

-
 BuildRequires:  %{?go_compiler:compiler(go-compiler)}%{!?go_compiler:golang}
 BuildRequires:  systemd
 BuildRequires:  krb5-devel
@ -477,15 +485,27 @@ Integration tests to be run on a pristine-dedicated system to test the osbuild-c
 %endif

 %changelog
-* Tue Jul 08 2025 Eduard Abdullin <eabdullin@almalinux.org> - 134.1-2.alma.1
+* Wed Nov 05 2025 Eduard Abdullin <eabdullin@almalinux.org> - 134.1-3.alma.1
 - Add AlmaLinux support patch
 - Add AlmaLinux-Kitten support patch

-* Fri Jun 27 2025 Craig Guiller <craig.guiller@oracle.com> - 134.1-2
- Rebuild for CVE-2025-22871
+* Wed Oct 15 2025 Gianluca Zuccarelli <gzuccare@redhat.com> - 134.1-3
+- Fix json tailoring blueprint conversion
+  Resolves: RHEL-115392
+- Fix unclosed logrus logging pipes
+  Resolves: RHEL-121533
+- Update go-jose dependency
+  Resolves: RHEL-82957 (CVE-2025-27144)

-* Wed Jun 25 2025 Alex Burmashev <alexander.burmashev@oracle.com> - 134.1-1
- Import upstream 134.1
+* Tue Jun 24 2025 Ondřej Budai <obudai@redhat.com> - 134.1-2
+- Resolves: RHEL-89221 (CVE-2025-22871)
+
+* Fri Apr 25 2025 Tomáš Hozza <thozza@redhat.com> - 134.1-1
+- Resolves: RHEL-84629
+
+* Mon Feb 24 2025 Tomáš Hozza <thozza@redhat.com> - 134-1
+- New upstream release
+- Resolves: RHEL-80161

 * Thu Feb 13 2025 imagebuilder-bot <imagebuilder-bots+imagebuilder-bot@redhat.com> - 132-1
 - New upstream release
--- a/update-go-jose-dependency.patch
+++ b/update-go-jose-dependency.patch
@ -0,0 +1,179 @@
+From 8d9b6fd1f471eeb919e6bb7049b221127505e841 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Budai?= <ondrej@budai.cz>
+Date: Tue, 26 Aug 2025 13:39:35 +0200
+Subject: [PATCH 1/2] go.mod: update go-jose v4.0.5 to fix CVE-2025-27144
+
+---
+ go.mod                                               |  2 +-
+ go.sum                                               |  4 ++--
+ vendor/github.com/go-jose/go-jose/v4/CONTRIBUTING.md |  6 ------
+ vendor/github.com/go-jose/go-jose/v4/README.md       | 10 +---------
+ vendor/github.com/go-jose/go-jose/v4/jwe.go          |  5 +++--
+ vendor/github.com/go-jose/go-jose/v4/jwk.go          |  4 ++--
+ vendor/github.com/go-jose/go-jose/v4/jws.go          |  5 +++--
+ vendor/modules.txt                                   |  2 +-
+ 8 files changed, 13 insertions(+), 25 deletions(-)
+
+diff --git a/go.mod b/go.mod
+index f32612ffdf..bdb089ef3e 100644
+--- a/go.mod
+++ b/go.mod
+@@ -133,7 +133,7 @@ require (
+ 	github.com/envoyproxy/protoc-gen-validate v1.2.1 // indirect
+ 	github.com/felixge/httpsnoop v1.0.4 // indirect
+ 	github.com/ghodss/yaml v1.0.0 // indirect
+-	github.com/go-jose/go-jose/v4 v4.0.4 // indirect
+	github.com/go-jose/go-jose/v4 v4.0.5 // indirect
+ 	github.com/go-logr/logr v1.4.2 // indirect
+ 	github.com/go-logr/stdr v1.2.2 // indirect
+ 	github.com/go-openapi/analysis v0.23.0 // indirect
+diff --git a/go.sum b/go.sum
+index 42ee5ca2d1..d415139ffe 100644
+--- a/go.sum
+++ b/go.sum
+@@ -252,8 +252,8 @@ github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeME
+ github.com/go-chi/chi/v5 v5.0.0/go.mod h1:BBug9lr0cqtdAhsu6R4AAdvufI0/XBzAQSsUqJpoZOs=
+ github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA=
+ github.com/go-errors/errors v1.4.2/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
+-github.com/go-jose/go-jose/v4 v4.0.4 h1:VsjPI33J0SB9vQM6PLmNjoHqMQNGPiZ0rHL7Ni7Q6/E=
+-github.com/go-jose/go-jose/v4 v4.0.4/go.mod h1:NKb5HO1EZccyMpiZNbdUw/14tiXNyUJh188dfnMCAfc=
+github.com/go-jose/go-jose/v4 v4.0.5 h1:M6T8+mKZl/+fNNuFHvGIzDz7BTLQPIounk/b9dw3AaE=
+github.com/go-jose/go-jose/v4 v4.0.5/go.mod h1:s3P1lRrkT8igV8D9OjyL4WRyHvjB6a4JSllnOrmmBOA=
+ github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
+ github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
+ github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+diff --git a/vendor/github.com/go-jose/go-jose/v4/CONTRIBUTING.md b/vendor/github.com/go-jose/go-jose/v4/CONTRIBUTING.md
+index b63e1f8fee..4b4805add6 100644
+--- a/vendor/github.com/go-jose/go-jose/v4/CONTRIBUTING.md
+++ b/vendor/github.com/go-jose/go-jose/v4/CONTRIBUTING.md
+@@ -7,9 +7,3 @@ When submitting code, please make every effort to follow existing conventions
+ and style in order to keep the code as readable as possible. Please also make
+ sure all tests pass by running `go test`, and format your code with `go fmt`.
+ We also recommend using `golint` and `errcheck`.
+-
+-Before your code can be accepted into the project you must also sign the
+-Individual Contributor License Agreement.  We use [cla-assistant.io][1] and you
+-will be prompted to sign once a pull request is opened.
+-
+-[1]: https://cla-assistant.io/
+diff --git a/vendor/github.com/go-jose/go-jose/v4/README.md b/vendor/github.com/go-jose/go-jose/v4/README.md
+index 79a7c5ecc8..02b5749546 100644
+--- a/vendor/github.com/go-jose/go-jose/v4/README.md
+++ b/vendor/github.com/go-jose/go-jose/v4/README.md
+@@ -9,14 +9,6 @@ Package jose aims to provide an implementation of the Javascript Object Signing
+ and Encryption set of standards. This includes support for JSON Web Encryption,
+ JSON Web Signature, and JSON Web Token standards.
+
+-**Disclaimer**: This library contains encryption software that is subject to
+-the U.S. Export Administration Regulations. You may not export, re-export,
+-transfer or download this code or any part of it in violation of any United
+-States law, directive or regulation. In particular this software may not be
+-exported or re-exported in any form or on any media to Iran, North Sudan,
+-Syria, Cuba, or North Korea, or to denied persons or entities mentioned on any
+-US maintained blocked list.
+-
+ ## Overview
+
+ The implementation follows the
+@@ -109,6 +101,6 @@ allows attaching a key id.
+
+ Examples can be found in the Godoc
+ reference for this package. The
+-[`jose-util`](https://github.com/go-jose/go-jose/tree/v4/jose-util)
+[`jose-util`](https://github.com/go-jose/go-jose/tree/main/jose-util)
+ subdirectory also contains a small command-line utility which might be useful
+ as an example as well.
+diff --git a/vendor/github.com/go-jose/go-jose/v4/jwe.go b/vendor/github.com/go-jose/go-jose/v4/jwe.go
+index 89f03ee3e1..9f1322dccc 100644
+--- a/vendor/github.com/go-jose/go-jose/v4/jwe.go
+++ b/vendor/github.com/go-jose/go-jose/v4/jwe.go
+@@ -288,10 +288,11 @@ func ParseEncryptedCompact(
+ 	keyAlgorithms []KeyAlgorithm,
+ 	contentEncryption []ContentEncryption,
+ ) (*JSONWebEncryption, error) {
+-	parts := strings.Split(input, ".")
+-	if len(parts) != 5 {
+	// Five parts is four separators
+	if strings.Count(input, ".") != 4 {
+ 		return nil, fmt.Errorf("go-jose/go-jose: compact JWE format must have five parts")
+ 	}
+	parts := strings.SplitN(input, ".", 5)
+
+ 	rawProtected, err := base64.RawURLEncoding.DecodeString(parts[0])
+ 	if err != nil {
+diff --git a/vendor/github.com/go-jose/go-jose/v4/jwk.go b/vendor/github.com/go-jose/go-jose/v4/jwk.go
+index 8a52842106..9e57e93ba2 100644
+--- a/vendor/github.com/go-jose/go-jose/v4/jwk.go
+++ b/vendor/github.com/go-jose/go-jose/v4/jwk.go
+@@ -239,10 +239,10 @@ func (k *JSONWebKey) UnmarshalJSON(data []byte) (err error) {
+ 				keyPub = key
+ 			}
+ 		} else {
+-			err = fmt.Errorf("go-jose/go-jose: unknown curve %s'", raw.Crv)
+			return fmt.Errorf("go-jose/go-jose: unknown curve %s'", raw.Crv)
+ 		}
+ 	default:
+-		err = fmt.Errorf("go-jose/go-jose: unknown json web key type '%s'", raw.Kty)
+		return fmt.Errorf("go-jose/go-jose: unknown json web key type '%s'", raw.Kty)
+ 	}
+
+ 	if err != nil {
+diff --git a/vendor/github.com/go-jose/go-jose/v4/jws.go b/vendor/github.com/go-jose/go-jose/v4/jws.go
+index 3a912301af..d09d8ba507 100644
+--- a/vendor/github.com/go-jose/go-jose/v4/jws.go
+++ b/vendor/github.com/go-jose/go-jose/v4/jws.go
+@@ -327,10 +327,11 @@ func parseSignedCompact(
+ 	payload []byte,
+ 	signatureAlgorithms []SignatureAlgorithm,
+ ) (*JSONWebSignature, error) {
+-	parts := strings.Split(input, ".")
+-	if len(parts) != 3 {
+	// Three parts is two separators
+	if strings.Count(input, ".") != 2 {
+ 		return nil, fmt.Errorf("go-jose/go-jose: compact JWS format must have three parts")
+ 	}
+	parts := strings.SplitN(input, ".", 3)
+
+ 	if parts[1] != "" && payload != nil {
+ 		return nil, fmt.Errorf("go-jose/go-jose: payload is not detached")
+diff --git a/vendor/modules.txt b/vendor/modules.txt
+index c85cf5570b..a0e70865d4 100644
+--- a/vendor/modules.txt
+++ b/vendor/modules.txt
+@@ -693,7 +693,7 @@ github.com/getsentry/sentry-go/logrus
+ # github.com/ghodss/yaml v1.0.0
+ ## explicit
+ github.com/ghodss/yaml
+-# github.com/go-jose/go-jose/v4 v4.0.4
+# github.com/go-jose/go-jose/v4 v4.0.5
+ ## explicit; go 1.21
+ github.com/go-jose/go-jose/v4
+ github.com/go-jose/go-jose/v4/cipher
+
+From bab603f74db931475511cd63e6ecf67bd63da728 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Budai?= <ondrej@budai.cz>
+Date: Tue, 26 Aug 2025 13:46:51 +0200
+Subject: [PATCH 2/2] github: ignore unused functions in shellcheck
+
+Seems to be a false positive (shellcheck doesn't understand traps).
+---
+ .github/workflows/tests.yml | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
+index befc48d529..c4e8369960 100644
+--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
+@@ -212,9 +212,9 @@ jobs:
+       with:
+         ignore: vendor # We don't want to fix the code in vendored dependencies
+       env:
+-        # don't check /etc/os-release sourcing, allow useless cats to live inside our codebase, and
+-        # allow seemingly unreachable commands
+-        SHELLCHECK_OPTS: -e SC1091 -e SC2002 -e SC2317
+        # don't check /etc/os-release sourcing, allow useless cats to live inside our codebase,
+        # allow seemingly unreachable commands, and allow unused functions
+        SHELLCHECK_OPTS: -e SC1091 -e SC2002 -e SC2317 -e SC2329
+
+     - name: Do not doube trap signals inside test scripts
+       run: |