wolfi-dev · sl1nki · Oct 30, 2024 · Oct 30, 2024 · Oct 30, 2024 · Oct 30, 2024
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
@@ -29,7 +29,7 @@ jobs:
       with:
         repository: wolfi-dev/wolfictl
         path: wolfictl
-    - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
+    - uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
       with:
         go-version-file: 'wolfictl/go.mod'
     - working-directory: wolfictl

diff --git a/Makefile b/Makefile
@@ -59,19 +59,20 @@ PKGLISTCMD ?= $(WOLFICTL) text --dir . --type name --pipeline-dir=./pipelines/
 
 BOOTSTRAP_REPO ?= https://packages.wolfi.dev/bootstrap/stage3
 BOOTSTRAP_KEY ?= https://packages.wolfi.dev/bootstrap/stage3/wolfi-signing.rsa.pub
+WOLFI_REPO ?= https://packages.wolfi.dev/os
+WOLFI_KEY ?= https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
 BOOTSTRAP ?= no
-WOLFI_REPO ?= https://apk.cgr.dev/chainguard
 
 ifeq (${BOOTSTRAP}, yes)
 	MELANGE_OPTS += -k ${BOOTSTRAP_KEY}
 	MELANGE_OPTS += -r ${BOOTSTRAP_REPO}
 	PKGLISTCMD += -k ${BOOTSTRAP_KEY}
 	PKGLISTCMD += -r ${BOOTSTRAP_REPO}
 else
+	MELANGE_OPTS += -k ${WOLFI_KEY}
 	MELANGE_OPTS += -r ${WOLFI_REPO}
-	PKGLISTCMD += -k https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
-	PKGLISTCMD += -r https://packages.wolfi.dev/os
-
+	PKGLISTCMD += -k ${WOLFI_KEY}
+	PKGLISTCMD += -r ${WOLFI_REPO}
 endif
 
 all: ${KEY} .build-packages

diff --git a/acl.yaml b/acl.yaml
@@ -1,7 +1,7 @@
 package:
   name: acl
   version: 2.3.2
-  epoch: 3
+  epoch: 4
   description: "access control list utilities"
   copyright:
     - license: LGPL-2.1-or-later AND GPL-2.0-or-later
@@ -17,6 +17,7 @@ environment:
       - ca-certificates-bundle
       - gettext-dev
       - libtool
+      - openssf-compiler-options
       - wolfi-base
 
 pipeline:

diff --git a/alsa-lib.yaml b/alsa-lib.yaml
@@ -1,7 +1,7 @@
 package:
   name: alsa-lib
   version: 1.2.12
-  epoch: 1
+  epoch: 2
   description: Advanced Linux Sound Architecture (ALSA) library
   copyright:
     - license: LGPL-2.1-or-later
@@ -16,6 +16,7 @@ environment:
       - ca-certificates-bundle
       - libtool
       - linux-headers
+      - openssf-compiler-options
 
 pipeline:
   - uses: git-checkout

diff --git a/amazon-cloudwatch-agent.yaml b/amazon-cloudwatch-agent.yaml
@@ -1,6 +1,6 @@
 package:
   name: amazon-cloudwatch-agent
-  version: 1.300047.0
+  version: 1.300048.1
   epoch: 0
   description: CloudWatch Agent enables you to collect and export host-level metrics and logs on instances running Linux or Windows server.
   copyright:
@@ -19,7 +19,7 @@ pipeline:
     with:
       repository: https://github.com/aws/amazon-cloudwatch-agent
       tag: v${{package.version}}
-      expected-commit: 452c0f7c22fc626581a71682d3795f695a4c4108
+      expected-commit: bde3bd9775ae1d4e4f8a2fdb92d7b6fdd5186fba
 
   - uses: go/bump
     with:

diff --git a/amazon-k8s-cni.yaml b/amazon-k8s-cni.yaml
@@ -1,6 +1,6 @@
 package:
   name: amazon-k8s-cni
-  version: 1.18.5
+  version: 1.18.6
   epoch: 0
   description: Networking plugin repository for pod networking in Kubernetes using Elastic Network Interfaces on AWS
   copyright:
@@ -22,7 +22,7 @@ pipeline:
     with:
       repository: https://github.com/aws/amazon-vpc-cni-k8s
       tag: v${{package.version}}
-      expected-commit: a121a8a80a66d487b5ce65dd778083553a2f8f6b
+      expected-commit: 0d02624a2d97e65ebde0977f608cb129184f9cb5
 
   - name: Copy conflist
     runs: |

diff --git a/apk-tools.yaml b/apk-tools.yaml
@@ -1,7 +1,7 @@
 package:
   name: apk-tools
   version: 2.14.4
-  epoch: 0
+  epoch: 1
   description: "apk-tools (Wolfi package manager)"
   copyright:
     - license: GPL-2.0-only
@@ -18,6 +18,7 @@ environment:
       - lua5.3
       - lua5.3-dev
       - lua5.3-lzlib
+      - openssf-compiler-options
       - openssl-dev
       - scdoc
       - zlib-dev
@@ -54,6 +55,9 @@ subpackages:
     dependencies:
       runtime:
         - apk-tools
+    test:
+      pipeline:
+        - uses: test/pkgconf
 
   - name: "lua5.3-apk"
     description: "Lua module for libapk"

diff --git a/argo-workflows.yaml b/argo-workflows.yaml
@@ -1,6 +1,6 @@
 package:
   name: argo-workflows
-  version: 3.5.11
+  version: 3.5.12
   epoch: 0
   description: Workflow engine for Kubernetes.
   copyright:
@@ -21,7 +21,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 25bbb71cced32b671f9ad35f0ffd1f0ddb8226ee
+      expected-commit: 8fe8de2e16ec39a5477df17586a3d212ec63a4bd
       repository: https://github.com/argoproj/argo-workflows
       tag: v${{package.version}}
 

diff --git a/attr.yaml b/attr.yaml
@@ -1,7 +1,7 @@
 package:
   name: attr
   version: 2.5.2
-  epoch: 3
+  epoch: 4
   description: "utilities for managing filesystem extended attributes"
   copyright:
     - license: GPL-2.0-or-later
@@ -16,6 +16,7 @@ environment:
       - ca-certificates-bundle
       - gettext-dev
       - libtool
+      - openssf-compiler-options
       - wolfi-base
 
 pipeline:

diff --git a/avahi.yaml b/avahi.yaml
@@ -1,7 +1,7 @@
 package:
   name: avahi
   version: 0.9_rc1
-  epoch: 1
+  epoch: 2
   description: A multicast/unicast DNS-SD framework
   copyright:
     - license: LGPL-2.0-or-later
@@ -27,6 +27,7 @@ environment:
       - libdaemon-dev
       - libevent-dev
       - libtool
+      - openssf-compiler-options
       - pkgconf-dev
       - systemd-dev
 
@@ -76,6 +77,9 @@ subpackages:
   - name: avahi-dev
     pipeline:
       - uses: split/dev
+    test:
+      pipeline:
+        - uses: test/pkgconf
 
 update:
   enabled: true

diff --git a/aws-cli-v2.yaml b/aws-cli-v2.yaml
@@ -2,7 +2,7 @@
 #nolint:documentation
 package:
   name: aws-cli-v2
-  version: 2.18.17
+  version: 2.18.18
   epoch: 0
   description: "Universal Command Line Interface for Amazon Web Services (v2)"
   copyright:
@@ -31,7 +31,7 @@ pipeline:
   - uses: git-checkout
     with:
       repository: https://github.com/aws/aws-cli
-      expected-commit: 1cdefd66b62f46e0bb2d08f0768cbd07658a51f0
+      expected-commit: 78b92148ff199c368db0a04882c814ce7ce74648
       tag: ${{package.version}}
 
   - runs: |

diff --git a/aws-eks-pod-identity-agent.yaml b/aws-eks-pod-identity-agent.yaml
@@ -1,7 +1,7 @@
 #nolint:git-checkout-must-use-github-updates,valid-pipeline-git-checkout-tag
 package:
   name: aws-eks-pod-identity-agent
-  version: 0_git20241029
+  version: 0_git20241031
   epoch: 0
   description: EKS Pod Identity is a feature of Amazon EKS that simplifies the process for cluster administrators to configure Kubernetes applications with AWS IAM permissions
   copyright:

diff --git a/aws-network-policy-agent.yaml b/aws-network-policy-agent.yaml
@@ -1,6 +1,6 @@
 package:
   name: aws-network-policy-agent
-  version: 1.1.3
+  version: 1.1.4
   epoch: 0
   description: Amazon EKS Network Policy Agent is a daemonset that is responsible for enforcing configured network policies on the cluster.
   copyright:
@@ -24,7 +24,7 @@ pipeline:
       # get AL2023 kernel image. Maybe we should package dnf tooling
       # in wolfi, to be able to download AL2023 kernel as a build
       # dependency at build-time instead
-      expected-commit: fdb0799bc872bc94622abc3b0d5bcc2e0a575a4f
+      expected-commit: 5e6ae835b987d13710cd467444099486513a29a5
 
   # Make sure that one of the legs of the copy headers is executed.
   - assertions:

diff --git a/azuredisk-csi-1.31.yaml b/azuredisk-csi-1.31.yaml
@@ -1,11 +1,24 @@
 package:
   name: azuredisk-csi-1.31
   version: 1.31.0
-  epoch: 1
+  epoch: 2
   description: Azure Disk CSI Driver
   copyright:
     - license: Apache-2.0
   dependencies:
+    runtime:
+      - blkid
+      - btrfs-progs
+      - ca-certificates-bundle
+      - device-mapper
+      - e2fsprogs
+      - e2fsprogs-extra
+      - lsblk
+      - mount
+      - umount
+      - util-linux
+      - util-linux-misc
+      - xfsprogs
     provides:
       - azuredisk-csi=${{package.full-version}}
 

diff --git a/bash.yaml b/bash.yaml
@@ -80,6 +80,7 @@ subpackages:
         - runs: |
             bashbug --version
             bashbug --help
+        - uses: test/pkgconf
 
   - name: "bash-builtins"
     description: "bash loadable builtins"

diff --git a/bird.yaml b/bird.yaml
@@ -1,7 +1,7 @@
 package:
   name: bird
   version: 2.15.1
-  epoch: 1
+  epoch: 2
   description: BIRD Internet Routing Daemon
   copyright:
     - license: GPL-2.0-or-later
@@ -19,6 +19,7 @@ environment:
       - libssh-dev
       - linux-headers
       - ncurses-dev
+      - openssf-compiler-options
       - readline-dev
 
 pipeline:

diff --git a/bubblewrap.yaml b/bubblewrap.yaml
@@ -1,7 +1,7 @@
 package:
   name: bubblewrap
-  version: 0.10.0
-  epoch: 1
+  version: 0.11.0
+  epoch: 0
   description: "Unprivileged sandboxing tool"
   copyright:
     - license: LGPL-2.0-or-later
@@ -22,7 +22,7 @@ pipeline:
     with:
       repository: https://github.com/containers/bubblewrap
       tag: v${{package.version}}
-      expected-commit: dc63ec667e6546f34e0b6c088cdf8ae7c7dea0f3
+      expected-commit: 9ca3b05ec787acfb4b17bed37db5719fa777834f
 
   - runs: |
       meson --prefix=/usr -Drequire_userns=true . output

diff --git a/buildkitd.yaml b/buildkitd.yaml
@@ -1,8 +1,8 @@
 package:
   name: buildkitd
-  version: 0.16.0
+  version: 0.17.0
   description: "concurrent, cache-efficient, and Dockerfile-agnostic builder toolkit"
-  epoch: 2
+  epoch: 0
   copyright:
     - license: Apache-2.0
   dependencies:
@@ -27,11 +27,7 @@ pipeline:
     with:
       repository: https://github.com/moby/buildkit
       tag: v${{package.version}}
-      expected-commit: 0865fcc9b78559e856e81dc52b3613701e7be28d
-
-  - uses: go/bump
-    with:
-      deps: github.com/Azure/azure-sdk-for-go/sdk/[email protected]
+      expected-commit: fd61877fa73693dcd4ef64c538f894ec216409a3
 
   - runs: |
       PKG=github.com/moby/buildkit

diff --git a/bzip2.yaml b/bzip2.yaml
@@ -1,7 +1,7 @@
 package:
   name: bzip2
   version: 1.0.8
-  epoch: 8
+  epoch: 9
   description: "a library implementing the bzip2 compression algorithms"
   copyright:
     - license: MPL-2.0 AND MIT
@@ -13,6 +13,7 @@ environment:
       - busybox
       - ca-certificates-bundle
       - make
+      - openssf-compiler-options
       - wolfi-baselayout
 
 pipeline:

diff --git a/cadvisor.yaml b/cadvisor.yaml
@@ -1,7 +1,7 @@
 package:
   name: cadvisor
-  version: 0.50.0
-  epoch: 4
+  version: 0.51.0
+  epoch: 0
   description: Analyzes resource usage and performance characteristics of running containers.
   copyright:
     - license: Apache-2.0
@@ -21,7 +21,7 @@ pipeline:
     with:
       repository: https://github.com/google/cadvisor
       tag: v${{package.version}}
-      expected-commit: 256737f329f705a0a8a95578efb9b36a5401d36d
+      expected-commit: 255cff7808a7d23802852e6fd9a12320b1035bf1
 
   - uses: go/bump
     with:

diff --git a/cairo.yaml b/cairo.yaml
@@ -68,6 +68,9 @@ subpackages:
         - pixman-dev
         - xcb-util-dev
     description: cairo dev
+    test:
+      pipeline:
+        - uses: test/pkgconf
 
   - name: cairo-gobject
     # dependencies:

diff --git a/cargo-audit.yaml b/cargo-audit.yaml
@@ -1,7 +1,7 @@
 package:
   name: cargo-audit
   version: 0.21.0
-  epoch: 0
+  epoch: 1
   description: Audit your dependencies for crates with security vulnerabilities reported to the RustSec Advisory Database.
   copyright:
     - license: MIT OR Apache-2.0
@@ -12,6 +12,7 @@ environment:
       - build-base
       - busybox
       - cargo-auditable
+      - openssf-compiler-options
       - rust
 
 pipeline: