diff --git a/.fmf/version b/.fmf/version deleted file mode 100644 index d00491f..0000000 --- a/.fmf/version +++ /dev/null @@ -1 +0,0 @@ -1 diff --git a/.gitignore b/.gitignore index 8b8e7d0..d595043 100644 --- a/.gitignore +++ b/.gitignore @@ -1,120 +1 @@ -/osbuild-composer-8.tar.gz -/osbuild-composer-9.tar.gz -/osbuild-composer-10.tar.gz -/osbuild-composer-11.tar.gz -/osbuild-composer-12.tar.gz -/osbuild-composer-13.tar.gz -/osbuild-composer-14.tar.gz -/osbuild-composer-15.tar.gz -/osbuild-composer-16.tar.gz -/osbuild-composer-17.tar.gz -/osbuild-composer-18.tar.gz -/osbuild-composer-19.tar.gz -/osbuild-composer-20.tar.gz -/osbuild-composer-22.tar.gz -/osbuild-composer-23.tar.gz -/osbuild-composer-24.tar.gz -/osbuild-composer-25.tar.gz -/osbuild-composer-26.tar.gz -/osbuild-composer-27.tar.gz -/osbuild-composer-28.tar.gz -/osbuild-composer-29.tar.gz -/osbuild-composer-30.tar.gz -/osbuild-composer-31.tar.gz -/osbuild-composer-35.tar.gz -/osbuild-composer-36.tar.gz -/osbuild-composer-37.tar.gz -/osbuild-composer-38.tar.gz -/osbuild-composer-39.tar.gz -/osbuild-composer-40.tar.gz -/osbuild-composer-41.tar.gz -/osbuild-composer-42.tar.gz -/osbuild-composer-43.tar.gz -/osbuild-composer-44.tar.gz -/osbuild-composer-45.tar.gz -/osbuild-composer-46.tar.gz -/osbuild-composer-47.tar.gz -/osbuild-composer-48.tar.gz -/osbuild-composer-46.1.tar.gz -/osbuild-composer-46.2.tar.gz -/osbuild-composer-49.tar.gz -/osbuild-composer-50.tar.gz -/osbuild-composer-46.3.tar.gz -/osbuild-composer-51.tar.gz -/osbuild-composer-53.tar.gz -/osbuild-composer-54.tar.gz -/osbuild-composer-55.tar.gz -/osbuild-composer-56.tar.gz -/osbuild-composer-57.tar.gz -/osbuild-composer-58.tar.gz -/osbuild-composer-59.tar.gz -/osbuild-composer-60.tar.gz -/osbuild-composer-61.tar.gz -/osbuild-composer-62.tar.gz -/osbuild-composer-63.tar.gz -/osbuild-composer-63.1.tar.gz -/osbuild-composer-62.1.tar.gz -/osbuild-composer-64.tar.gz -/osbuild-composer-65.tar.gz -/osbuild-composer-66.tar.gz -/osbuild-composer-67.tar.gz -/osbuild-composer-68.tar.gz -/osbuild-composer-69.tar.gz -/osbuild-composer-70.tar.gz -/osbuild-composer-71.tar.gz -/osbuild-composer-72.tar.gz -/osbuild-composer-73.tar.gz -/osbuild-composer-74.tar.gz -/osbuild-composer-75.tar.gz -/osbuild-composer-76.tar.gz -/osbuild-composer-77.tar.gz -/osbuild-composer-78.tar.gz -/osbuild-composer-79.tar.gz -/osbuild-composer-80.tar.gz -/osbuild-composer-82.tar.gz -/osbuild-composer-83.tar.gz -/osbuild-composer-84.tar.gz -/osbuild-composer-85.tar.gz -/osbuild-composer-86.tar.gz -/osbuild-composer-87.tar.gz -/osbuild-composer-88.tar.gz -/osbuild-composer-89.tar.gz -/osbuild-composer-90.tar.gz -/osbuild-composer-91.tar.gz -/osbuild-composer-92.tar.gz -/osbuild-composer-88.2.tar.gz -/osbuild-composer-93.tar.gz -/osbuild-composer-94.tar.gz -/osbuild-composer-95.tar.gz -/osbuild-composer-96.tar.gz -/osbuild-composer-98.tar.gz -/osbuild-composer-99.tar.gz -/osbuild-composer-100.tar.gz -/osbuild-composer-106.tar.gz -/osbuild-composer-108.tar.gz -/osbuild-composer-109.tar.gz -/osbuild-composer-113.tar.gz -/osbuild-composer-114.tar.gz -/osbuild-composer-115.tar.gz -/osbuild-composer-116.tar.gz -/osbuild-composer-117.tar.gz -/osbuild-composer-118.tar.gz -/osbuild-composer-123.tar.gz -/osbuild-composer-124.tar.gz -/osbuild-composer-125.tar.gz -/osbuild-composer-126.tar.gz -/osbuild-composer-127.tar.gz -/osbuild-composer-128.tar.gz -/osbuild-composer-131.tar.gz -/osbuild-composer-132.tar.gz -/osbuild-composer-134.tar.gz -/osbuild-composer-135.tar.gz -/osbuild-composer-136.tar.gz -/osbuild-composer-137.tar.gz -/osbuild-composer-138.tar.gz -/osbuild-composer-139.tar.gz -/osbuild-composer-141.tar.gz -/osbuild-composer-142.tar.gz -/osbuild-composer-143.tar.gz -/osbuild-composer-144.tar.gz osbuild-composer-134.1.tar.gz diff --git a/.packit.yaml b/.packit.yaml deleted file mode 100644 index 02e3d82..0000000 --- a/.packit.yaml +++ /dev/null @@ -1,54 +0,0 @@ -# https://packit.dev/docs/configuration/ - -specfile_path: osbuild-composer.spec - -files_to_sync: - - osbuild-composer.spec - - .packit.yaml - -copy_upstream_release_description: true - -upstream_tag_template: v{version} - -srpm_build_deps: [] -actions: - get-current-version: bash -c "git describe --tags --abbrev=0 | sed 's|v||'" - post-upstream-clone: "./tools/rpm_spec_add_provides_bundle.sh" - -# Handle only releases without a "dot" (e.g. v88.2), since "dot" releases should never be released to Fedora -upstream_tag_include: 'v\d+' - -jobs: -- job: bodhi_update - trigger: commit - dist_git_branches: - - fedora-branched # rawhide updates are created automatically -- job: koji_build - trigger: commit - dist_git_branches: - - fedora-all -- job: propose_downstream - trigger: release - dist_git_branches: - - fedora-all -- job: copr_build - trigger: pull_request - targets: &build_targets - - centos-stream-8-aarch64 - - centos-stream-8-x86_64 - - centos-stream-9-aarch64 - - centos-stream-9-x86_64 - - fedora-all-aarch64 - - fedora-all-s390x - - fedora-all-ppc64le - - fedora-all - - rhel-8-aarch64 - - rhel-8-x86_64 - - rhel-9-aarch64 - - rhel-9-x86_64 -- job: copr_build - trigger: commit - branch: main - owner: "@osbuild" # copr repo namespace - project: osbuild-composer # copr repo name so you can consume the builds - targets: *build_targets diff --git a/fix-unclosed-logrus-logging-pipes.patch b/fix-unclosed-logrus-logging-pipes.patch new file mode 100644 index 0000000..8d04891 --- /dev/null +++ b/fix-unclosed-logrus-logging-pipes.patch @@ -0,0 +1,42 @@ +From bf424e53ba6949c685b0f4593588cec88edfe6f7 Mon Sep 17 00:00:00 2001 +From: Lukas Zapletal +Date: Thu, 11 Sep 2025 08:03:21 +0200 +Subject: [PATCH] common: fix unclosed logrus logging pipes + +This is a backport of 1cde7e3. The original patch was not separated into +individual commits unfortunately, there fore only the relevant line is +being brought in. The original analysis: + +It looks like both CloudAPI and WeldrAPI consume memory, process can go +up to several gigabytes pretty quickly just by running a simple script. + +while sleep 0.001; do + curl --unix-socket /run/weldr/api.socket -XGET http://localhost/api/ + curl --unix-socket /run/cloudapi/api.socket -XGET http://localhost/api/ +done + +There is a logrus logger method called Write and WriteLevel which create +a new logging entry, create a PIPE and spawn a goroutine that is reading +from that PIPE. The caller is expected to close the PIPE writer which +was not done. + +(cherry picked from commit 0f97a1c1668827086dfa335c9fb427cbb28782b2) +--- + internal/common/echo_logrus.go | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/internal/common/echo_logrus.go b/internal/common/echo_logrus.go +index 198ce17310..600cce2d74 100644 +--- a/internal/common/echo_logrus.go ++++ b/internal/common/echo_logrus.go +@@ -178,5 +178,9 @@ func (l *EchoLogrusLogger) Panicj(j lslog.JSON) { + } + + func (l *EchoLogrusLogger) Write(p []byte) (n int, err error) { +- return l.Logger.WithContext(l.Ctx).Writer().Write(p) ++ // Writer() from logrus returns PIPE that needs to be closed ++ w := l.Logger.WithContext(l.Ctx).Writer() ++ defer w.Close() ++ ++ return w.Write(p) + } diff --git a/json-tailoring-conversion.patch b/json-tailoring-conversion.patch new file mode 100644 index 0000000..729619c --- /dev/null +++ b/json-tailoring-conversion.patch @@ -0,0 +1,54 @@ +From 514f82421bb2444fc73efca5898389329fd1e38d Mon Sep 17 00:00:00 2001 +From: Gianluca Zuccarelli +Date: Mon, 8 Sep 2025 14:11:50 +0100 +Subject: [PATCH] internal/blueprint: add JSON tailoring to bp conversion + +The blueprint convert function was missing the json tailoring case. This meant that +if the json tailoring customization was provided in the blueprint, the customization +would get ignored and the tailoring profile would not be applied to the image. +--- + internal/blueprint/blueprint.go | 4 ++++ + internal/blueprint/blueprint_convert_test.go | 8 ++++++++ + 2 files changed, 12 insertions(+) + +diff --git a/internal/blueprint/blueprint.go b/internal/blueprint/blueprint.go +index 63f8aa5b71..c01a2c6a48 100644 +--- a/internal/blueprint/blueprint.go ++++ b/internal/blueprint/blueprint.go +@@ -253,6 +253,10 @@ func Convert(bp Blueprint) iblueprint.Blueprint { + itailoring := iblueprint.OpenSCAPTailoringCustomizations(*tailoring) + ioscap.Tailoring = &itailoring + } ++ if jsonTailoring := oscap.JSONTailoring; jsonTailoring != nil { ++ ijsonTailoring := iblueprint.OpenSCAPJSONTailoringCustomizations(*jsonTailoring) ++ ioscap.JSONTailoring = &ijsonTailoring ++ } + customizations.OpenSCAP = &ioscap + } + if ign := c.Ignition; ign != nil { +diff --git a/internal/blueprint/blueprint_convert_test.go b/internal/blueprint/blueprint_convert_test.go +index 520e18271d..2c652f0658 100644 +--- a/internal/blueprint/blueprint_convert_test.go ++++ b/internal/blueprint/blueprint_convert_test.go +@@ -233,6 +233,10 @@ func TestConvert(t *testing.T) { + Selected: []string{"cloth"}, + Unselected: []string{"leather"}, + }, ++ JSONTailoring: &OpenSCAPJSONTailoringCustomizations{ ++ ProfileID: "tailored_profile", ++ Filepath: "path-to-json-file", ++ }, + }, + Ignition: &IgnitionCustomization{ + Embedded: &EmbeddedIgnitionCustomization{ +@@ -532,6 +536,10 @@ func TestConvert(t *testing.T) { + Selected: []string{"cloth"}, + Unselected: []string{"leather"}, + }, ++ JSONTailoring: &iblueprint.OpenSCAPJSONTailoringCustomizations{ ++ ProfileID: "tailored_profile", ++ Filepath: "path-to-json-file", ++ }, + }, + Ignition: &iblueprint.IgnitionCustomization{ + Embedded: &iblueprint.EmbeddedIgnitionCustomization{ diff --git a/osbuild-composer.spec b/osbuild-composer.spec index 03582c7..5353581 100644 --- a/osbuild-composer.spec +++ b/osbuild-composer.spec @@ -25,7 +25,7 @@ It is compatible with composer-cli and cockpit-composer clients. } Name: osbuild-composer -Release: 2%{?dist}.alma.1 +Release: 3%{?dist}.alma.1 Summary: An image building service based on osbuild # osbuild-composer doesn't have support for building i686 and armv7hl images @@ -36,12 +36,20 @@ License: Apache-2.0 URL: %{gourl} Source0: %{gosource} +# https://github.com/osbuild/osbuild-composer/pull/4857 +Patch0: json-tailoring-conversion.patch + +# https://github.com/osbuild/osbuild-composer/pull/4867 +Patch1: fix-unclosed-logrus-logging-pipes.patch + +# https://github.com/osbuild/osbuild-composer/pull/4841 +Patch2: update-go-jose-dependency.patch + # AlmaLinux Patch Patch1001: 0001-Remove-libreport-rhel-anaconda-bugzilla-from-anacond.patch Patch1002: 0002-Add-AlmaLinux-support.patch Patch1003: 0003-Add-AlmaLinux-Kitten-support.patch - BuildRequires: %{?go_compiler:compiler(go-compiler)}%{!?go_compiler:golang} BuildRequires: systemd BuildRequires: krb5-devel @@ -477,15 +485,27 @@ Integration tests to be run on a pristine-dedicated system to test the osbuild-c %endif %changelog -* Tue Jul 08 2025 Eduard Abdullin - 134.1-2.alma.1 +* Wed Nov 05 2025 Eduard Abdullin - 134.1-3.alma.1 - Add AlmaLinux support patch - Add AlmaLinux-Kitten support patch -* Fri Jun 27 2025 Craig Guiller - 134.1-2 -- Rebuild for CVE-2025-22871 +* Wed Oct 15 2025 Gianluca Zuccarelli - 134.1-3 +- Fix json tailoring blueprint conversion + Resolves: RHEL-115392 +- Fix unclosed logrus logging pipes + Resolves: RHEL-121533 +- Update go-jose dependency + Resolves: RHEL-82957 (CVE-2025-27144) -* Wed Jun 25 2025 Alex Burmashev - 134.1-1 -- Import upstream 134.1 +* Tue Jun 24 2025 Ondřej Budai - 134.1-2 +- Resolves: RHEL-89221 (CVE-2025-22871) + +* Fri Apr 25 2025 Tomáš Hozza - 134.1-1 +- Resolves: RHEL-84629 + +* Mon Feb 24 2025 Tomáš Hozza - 134-1 +- New upstream release +- Resolves: RHEL-80161 * Thu Feb 13 2025 imagebuilder-bot - 132-1 - New upstream release diff --git a/update-go-jose-dependency.patch b/update-go-jose-dependency.patch new file mode 100644 index 0000000..7a34104 --- /dev/null +++ b/update-go-jose-dependency.patch @@ -0,0 +1,179 @@ +From 8d9b6fd1f471eeb919e6bb7049b221127505e841 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ond=C5=99ej=20Budai?= +Date: Tue, 26 Aug 2025 13:39:35 +0200 +Subject: [PATCH 1/2] go.mod: update go-jose v4.0.5 to fix CVE-2025-27144 + +--- + go.mod | 2 +- + go.sum | 4 ++-- + vendor/github.com/go-jose/go-jose/v4/CONTRIBUTING.md | 6 ------ + vendor/github.com/go-jose/go-jose/v4/README.md | 10 +--------- + vendor/github.com/go-jose/go-jose/v4/jwe.go | 5 +++-- + vendor/github.com/go-jose/go-jose/v4/jwk.go | 4 ++-- + vendor/github.com/go-jose/go-jose/v4/jws.go | 5 +++-- + vendor/modules.txt | 2 +- + 8 files changed, 13 insertions(+), 25 deletions(-) + +diff --git a/go.mod b/go.mod +index f32612ffdf..bdb089ef3e 100644 +--- a/go.mod ++++ b/go.mod +@@ -133,7 +133,7 @@ require ( + github.com/envoyproxy/protoc-gen-validate v1.2.1 // indirect + github.com/felixge/httpsnoop v1.0.4 // indirect + github.com/ghodss/yaml v1.0.0 // indirect +- github.com/go-jose/go-jose/v4 v4.0.4 // indirect ++ github.com/go-jose/go-jose/v4 v4.0.5 // indirect + github.com/go-logr/logr v1.4.2 // indirect + github.com/go-logr/stdr v1.2.2 // indirect + github.com/go-openapi/analysis v0.23.0 // indirect +diff --git a/go.sum b/go.sum +index 42ee5ca2d1..d415139ffe 100644 +--- a/go.sum ++++ b/go.sum +@@ -252,8 +252,8 @@ github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeME + github.com/go-chi/chi/v5 v5.0.0/go.mod h1:BBug9lr0cqtdAhsu6R4AAdvufI0/XBzAQSsUqJpoZOs= + github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA= + github.com/go-errors/errors v1.4.2/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og= +-github.com/go-jose/go-jose/v4 v4.0.4 h1:VsjPI33J0SB9vQM6PLmNjoHqMQNGPiZ0rHL7Ni7Q6/E= +-github.com/go-jose/go-jose/v4 v4.0.4/go.mod h1:NKb5HO1EZccyMpiZNbdUw/14tiXNyUJh188dfnMCAfc= ++github.com/go-jose/go-jose/v4 v4.0.5 h1:M6T8+mKZl/+fNNuFHvGIzDz7BTLQPIounk/b9dw3AaE= ++github.com/go-jose/go-jose/v4 v4.0.5/go.mod h1:s3P1lRrkT8igV8D9OjyL4WRyHvjB6a4JSllnOrmmBOA= + github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY= + github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A= + github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= +diff --git a/vendor/github.com/go-jose/go-jose/v4/CONTRIBUTING.md b/vendor/github.com/go-jose/go-jose/v4/CONTRIBUTING.md +index b63e1f8fee..4b4805add6 100644 +--- a/vendor/github.com/go-jose/go-jose/v4/CONTRIBUTING.md ++++ b/vendor/github.com/go-jose/go-jose/v4/CONTRIBUTING.md +@@ -7,9 +7,3 @@ When submitting code, please make every effort to follow existing conventions + and style in order to keep the code as readable as possible. Please also make + sure all tests pass by running `go test`, and format your code with `go fmt`. + We also recommend using `golint` and `errcheck`. +- +-Before your code can be accepted into the project you must also sign the +-Individual Contributor License Agreement. We use [cla-assistant.io][1] and you +-will be prompted to sign once a pull request is opened. +- +-[1]: https://cla-assistant.io/ +diff --git a/vendor/github.com/go-jose/go-jose/v4/README.md b/vendor/github.com/go-jose/go-jose/v4/README.md +index 79a7c5ecc8..02b5749546 100644 +--- a/vendor/github.com/go-jose/go-jose/v4/README.md ++++ b/vendor/github.com/go-jose/go-jose/v4/README.md +@@ -9,14 +9,6 @@ Package jose aims to provide an implementation of the Javascript Object Signing + and Encryption set of standards. This includes support for JSON Web Encryption, + JSON Web Signature, and JSON Web Token standards. + +-**Disclaimer**: This library contains encryption software that is subject to +-the U.S. Export Administration Regulations. You may not export, re-export, +-transfer or download this code or any part of it in violation of any United +-States law, directive or regulation. In particular this software may not be +-exported or re-exported in any form or on any media to Iran, North Sudan, +-Syria, Cuba, or North Korea, or to denied persons or entities mentioned on any +-US maintained blocked list. +- + ## Overview + + The implementation follows the +@@ -109,6 +101,6 @@ allows attaching a key id. + + Examples can be found in the Godoc + reference for this package. The +-[`jose-util`](https://github.com/go-jose/go-jose/tree/v4/jose-util) ++[`jose-util`](https://github.com/go-jose/go-jose/tree/main/jose-util) + subdirectory also contains a small command-line utility which might be useful + as an example as well. +diff --git a/vendor/github.com/go-jose/go-jose/v4/jwe.go b/vendor/github.com/go-jose/go-jose/v4/jwe.go +index 89f03ee3e1..9f1322dccc 100644 +--- a/vendor/github.com/go-jose/go-jose/v4/jwe.go ++++ b/vendor/github.com/go-jose/go-jose/v4/jwe.go +@@ -288,10 +288,11 @@ func ParseEncryptedCompact( + keyAlgorithms []KeyAlgorithm, + contentEncryption []ContentEncryption, + ) (*JSONWebEncryption, error) { +- parts := strings.Split(input, ".") +- if len(parts) != 5 { ++ // Five parts is four separators ++ if strings.Count(input, ".") != 4 { + return nil, fmt.Errorf("go-jose/go-jose: compact JWE format must have five parts") + } ++ parts := strings.SplitN(input, ".", 5) + + rawProtected, err := base64.RawURLEncoding.DecodeString(parts[0]) + if err != nil { +diff --git a/vendor/github.com/go-jose/go-jose/v4/jwk.go b/vendor/github.com/go-jose/go-jose/v4/jwk.go +index 8a52842106..9e57e93ba2 100644 +--- a/vendor/github.com/go-jose/go-jose/v4/jwk.go ++++ b/vendor/github.com/go-jose/go-jose/v4/jwk.go +@@ -239,10 +239,10 @@ func (k *JSONWebKey) UnmarshalJSON(data []byte) (err error) { + keyPub = key + } + } else { +- err = fmt.Errorf("go-jose/go-jose: unknown curve %s'", raw.Crv) ++ return fmt.Errorf("go-jose/go-jose: unknown curve %s'", raw.Crv) + } + default: +- err = fmt.Errorf("go-jose/go-jose: unknown json web key type '%s'", raw.Kty) ++ return fmt.Errorf("go-jose/go-jose: unknown json web key type '%s'", raw.Kty) + } + + if err != nil { +diff --git a/vendor/github.com/go-jose/go-jose/v4/jws.go b/vendor/github.com/go-jose/go-jose/v4/jws.go +index 3a912301af..d09d8ba507 100644 +--- a/vendor/github.com/go-jose/go-jose/v4/jws.go ++++ b/vendor/github.com/go-jose/go-jose/v4/jws.go +@@ -327,10 +327,11 @@ func parseSignedCompact( + payload []byte, + signatureAlgorithms []SignatureAlgorithm, + ) (*JSONWebSignature, error) { +- parts := strings.Split(input, ".") +- if len(parts) != 3 { ++ // Three parts is two separators ++ if strings.Count(input, ".") != 2 { + return nil, fmt.Errorf("go-jose/go-jose: compact JWS format must have three parts") + } ++ parts := strings.SplitN(input, ".", 3) + + if parts[1] != "" && payload != nil { + return nil, fmt.Errorf("go-jose/go-jose: payload is not detached") +diff --git a/vendor/modules.txt b/vendor/modules.txt +index c85cf5570b..a0e70865d4 100644 +--- a/vendor/modules.txt ++++ b/vendor/modules.txt +@@ -693,7 +693,7 @@ github.com/getsentry/sentry-go/logrus + # github.com/ghodss/yaml v1.0.0 + ## explicit + github.com/ghodss/yaml +-# github.com/go-jose/go-jose/v4 v4.0.4 ++# github.com/go-jose/go-jose/v4 v4.0.5 + ## explicit; go 1.21 + github.com/go-jose/go-jose/v4 + github.com/go-jose/go-jose/v4/cipher + +From bab603f74db931475511cd63e6ecf67bd63da728 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ond=C5=99ej=20Budai?= +Date: Tue, 26 Aug 2025 13:46:51 +0200 +Subject: [PATCH 2/2] github: ignore unused functions in shellcheck + +Seems to be a false positive (shellcheck doesn't understand traps). +--- + .github/workflows/tests.yml | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml +index befc48d529..c4e8369960 100644 +--- a/.github/workflows/tests.yml ++++ b/.github/workflows/tests.yml +@@ -212,9 +212,9 @@ jobs: + with: + ignore: vendor # We don't want to fix the code in vendored dependencies + env: +- # don't check /etc/os-release sourcing, allow useless cats to live inside our codebase, and +- # allow seemingly unreachable commands +- SHELLCHECK_OPTS: -e SC1091 -e SC2002 -e SC2317 ++ # don't check /etc/os-release sourcing, allow useless cats to live inside our codebase, ++ # allow seemingly unreachable commands, and allow unused functions ++ SHELLCHECK_OPTS: -e SC1091 -e SC2002 -e SC2317 -e SC2329 + + - name: Do not doube trap signals inside test scripts + run: |