quine-global-labs/mirror-coreos-chunkah
1
0
Fork 0
mirror of https://github.com/coreos/chunkah.git synced 2026-11-03 21:49:44 -09:00
Code Issues Projects Releases Packages Wiki Activity
233 commits 2 branches 11 tags 3.1 MiB
Commit graph

233 commits

This branch
This branch
All branches
Author SHA1 Message Date
dependabot[bot]
42e615c1a5 ci: bump zizmorcore/zizmor-action
Some checks failed
CI / unit-tests (push) Has been cancelled
Zizmor / Scan GHA workflows (push) Has been cancelled
CI / e2e-tests (fedora, amd64) (push) Has been cancelled
CI / e2e-tests (fedora, arm64) (push) Has been cancelled
CI / e2e-tests (ubi10) (push) Has been cancelled
CI / e2e-tests (ubi9) (push) Has been cancelled
CI / manifest (push) Has been cancelled
CI / release (push) Has been cancelled
Bumps the actions group with 1 update: [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action).


Updates `zizmorcore/zizmor-action` from 0.7.1 to 0.8.0
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](85b2b9fb8e...53290badfa)

---
updated-dependencies:
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-11-02 13:42:54 +00:00
dependabot[bot]
696cf10d82 ci: bump zizmorcore/zizmor-action 
Bumps the actions group with 1 update: [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action).


Updates `zizmorcore/zizmor-action` from 0.6.4 to 0.7.1
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](cc914d7f37...85b2b9fb8e)

---
updated-dependencies:
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-26 13:44:39 +00:00
dependabot[bot]
2a6d47eaed ci: bump actions/upload-artifact 
Bumps the actions group with 1 update: [actions/upload-artifact](https://github.com/actions/upload-artifact).


Updates `actions/upload-artifact` from 7.0.1 to 7.0.2
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](043fb46d1a...cf430e030d)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-19 13:43:36 +00:00
dependabot[bot]
68ba9b4a5e deps: bump serde_json from 1.0.151 to 1.0.154 in the rust-deps group 
Bumps the rust-deps group with 1 update: [serde_json](https://github.com/serde-rs/json).


Updates `serde_json` from 1.0.151 to 1.0.154
- [Release notes](https://github.com/serde-rs/json/releases)
- [Commits](https://github.com/serde-rs/json/compare/v1.0.151...v1.0.154)

---
updated-dependencies:
- dependency-name: serde_json
  dependency-version: 1.0.154
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-19 13:43:11 +00:00
Jonathan Lebon
780bcd2b4d Cargo.toml: bump version to v0.7.1 2026-10-05 17:45:02 -04:00
Jonathan Lebon
d861f167d3 clamp: fix clamp handling for xattr/bigfiles repos 
Commit 2869ce7 made xattr and bigfiles components clamp their mtimes to
file mtimes instead of the resolved created epoch, which fixed the
reproducibility of ancestor directories when file mtimes are canonical
(i.e. were explicitly set to a meaningful, fixed, value) but an epoch
wasn't explicitly set.

However, this breaks the case where an epoch _is_ explicitly passed. The
problem is that the file mtime may be arbitrary (e.g. if it's just
created with the current time at image build time, like the rpmdb),
which thus renders the image non-reproducible (even though
SOURCE_DATE_EPOCH has been passed!).

I think what we want is actually the `min()` of the file mtime and the
resolved epoch. That way, (1) if an SDE is passed in, and no mtime is
explicitly set on a file created at build time, it's reasonable to
expect it to be more recent than SDE and thus gets capped, but (2) if no
SDE is passed, then it defaults to $now, and it's reasonable to expect
any explicit mtime set on a bigfiles for reproducibility reasons to be
before $now, and thus the file mtime wins. In both cases, we're
basically picking the timestamp most likely to be stable.

This was actually part of an earlier version of PR #161, but I
mistakenly in review claimed that we could drop it:

https://github.com/coreos/chunkah/pull/161#discussion_r4037740157

Fixes: #176
Assisted-by: AI
 2026-10-01 12:00:04 -04:00
Jonathan Lebon
a98ed2c657 Cargo.toml: bump version to v0.7.0 2026-09-28 12:38:37 -04:00
dependabot[bot]
cd7e67b2de deps: bump the rust-deps group with 2 updates 
Bumps the rust-deps group with 2 updates: [camino](https://github.com/camino-rs/camino) and [clap](https://github.com/clap-rs/clap).


Updates `camino` from 1.2.5 to 1.2.6
- [Release notes](https://github.com/camino-rs/camino/releases)
- [Changelog](https://github.com/camino-rs/camino/blob/main/CHANGELOG.md)
- [Commits](https://github.com/camino-rs/camino/compare/camino-1.2.5...camino-1.2.6)

Updates `clap` from 4.6.6 to 4.6.7
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/main/CHANGELOG.md)
- [Commits](https://github.com/clap-rs/clap/compare/clap_complete-v4.6.6...clap_complete-v4.6.7)

---
updated-dependencies:
- dependency-name: camino
  dependency-version: 1.2.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-deps
- dependency-name: clap
  dependency-version: 4.6.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-28 13:44:48 +00:00
Jonathan Lebon
e7d7ff045b .packit.yaml: test on all Fedora versions 
I think the current list dates from when chunkah was just released and
only living in Rawhide and the latest stable. Nowadays it's in all
active releases.

This also catches unreleased branched Fedora releases (e.g. Fedora 45
right now), which we really should be testing.

Ref: https://packit.dev/docs/configuration#aliases
 2026-09-22 10:37:19 -04:00
Jonathan Lebon
b4e2036ba3 tree: delete CLAUDE.md compat symlink 
AGENTS.md is natively supported by Claude Code now:

https://code.claude.com/docs/en/changelog#2-1-277
 2026-09-22 10:23:16 -04:00
Daniel Hast
2869ce754b feat: clamp xattr and bigfiles mtimes to most recent file mtime 
This solves a reproducibility issue with `bigfiles` and `xattr`
components, which don't automatically have reproducible timestamps: Even
if all the files in the component are given fixed modification
timestamps, the timestamps of ancestor directories aren't clamped to
match the files, which makes the layers non-reproducible unless
`SOURCE_DATE_EPOCH` is set.

To fix this, we clamp `bigfiles` components to the modification time of
the single file, and clamp `xattr` components to the most recent
modification time of a file with that xattr label.
 2026-09-21 13:40:12 -04:00
dependabot[bot]
25d8d07790 ci: bump zizmorcore/zizmor-action in the actions group 
Bumps the actions group with 1 update: [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action).


Updates `zizmorcore/zizmor-action` from 0.6.3 to 0.6.4
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](70fb788f84...cc914d7f37)

---
updated-dependencies:
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.6.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-21 13:43:31 +00:00
dependabot[bot]
7c436d5da5 deps: bump indexmap from 2.14.1 to 2.14.2 in the rust-deps group 
Bumps the rust-deps group with 1 update: [indexmap](https://github.com/indexmap-rs/indexmap).


Updates `indexmap` from 2.14.1 to 2.14.2
- [Changelog](https://github.com/indexmap-rs/indexmap/blob/main/RELEASES.md)
- [Commits](https://github.com/indexmap-rs/indexmap/compare/2.14.1...2.14.2)

---
updated-dependencies:
- dependency-name: indexmap
  dependency-version: 2.14.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-14 13:42:10 +00:00
dependabot[bot]
9e74a34b05 deps: bump the rust-deps group with 2 updates 
Bumps the rust-deps group with 2 updates: [flate2](https://github.com/rust-lang/flate2-rs) and [indexmap](https://github.com/indexmap-rs/indexmap).


Updates `flate2` from 1.1.9 to 1.1.10
- [Release notes](https://github.com/rust-lang/flate2-rs/releases)
- [Commits](https://github.com/rust-lang/flate2-rs/compare/1.1.9...1.1.10)

Updates `indexmap` from 2.14.0 to 2.14.1
- [Changelog](https://github.com/indexmap-rs/indexmap/blob/main/RELEASES.md)
- [Commits](https://github.com/indexmap-rs/indexmap/compare/2.14.0...2.14.1)

---
updated-dependencies:
- dependency-name: flate2
  dependency-version: 1.1.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-deps
- dependency-name: indexmap
  dependency-version: 2.14.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-07 13:43:28 +00:00
dependabot[bot]
3c4918c81e ci: bump zizmorcore/zizmor-action in the actions group 
Bumps the actions group with 1 update: [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action).


Updates `zizmorcore/zizmor-action` from 0.6.2 to 0.6.3
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](3dc1ecc9bc...70fb788f84)

---
updated-dependencies:
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.6.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-07 13:42:58 +00:00
dependabot[bot]
e50031b124 deps: bump clap from 4.6.5 to 4.6.6 in the rust-deps group 
Bumps the rust-deps group with 1 update: [clap](https://github.com/clap-rs/clap).


Updates `clap` from 4.6.5 to 4.6.6
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md)
- [Commits](https://github.com/clap-rs/clap/compare/clap_complete-v4.6.5...clap_complete-v4.6.6)

---
updated-dependencies:
- dependency-name: clap
  dependency-version: 4.6.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-21 14:47:42 +00:00
dependabot[bot]
dbf38ccb32 ci: bump zizmorcore/zizmor-action in the actions group 
Bumps the actions group with 1 update: [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action).


Updates `zizmorcore/zizmor-action` from 0.6.1 to 0.6.2
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](6fc4b00623...3dc1ecc9bc)

---
updated-dependencies:
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-12 15:57:40 +00:00
dependabot[bot]
c458a92f3f deps: bump the rust-deps group with 2 updates 
Bumps the rust-deps group with 2 updates: [camino](https://github.com/camino-rs/camino) and [clap](https://github.com/clap-rs/clap).


Updates `camino` from 1.2.4 to 1.2.5
- [Release notes](https://github.com/camino-rs/camino/releases)
- [Changelog](https://github.com/camino-rs/camino/blob/main/CHANGELOG.md)
- [Commits](https://github.com/camino-rs/camino/compare/camino-1.2.4...camino-1.2.5)

Updates `clap` from 4.6.4 to 4.6.5
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md)
- [Commits](https://github.com/clap-rs/clap/compare/clap_complete-v4.6.4...clap_complete-v4.6.5)

---
updated-dependencies:
- dependency-name: camino
  dependency-version: 1.2.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-deps
- dependency-name: clap
  dependency-version: 4.6.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-10 13:43:54 +00:00
dependabot[bot]
4c8abc389c ci: bump zizmorcore/zizmor-action in the actions group 
Bumps the actions group with 1 update: [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action).


Updates `zizmorcore/zizmor-action` from 0.6.0 to 0.6.1
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](6599ee8b7a...6fc4b00623)

---
updated-dependencies:
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-03 13:43:54 +00:00
dependabot[bot]
e640495f4e deps: bump clap from 4.6.2 to 4.6.4 in the rust-deps group 
Bumps the rust-deps group with 1 update: [clap](https://github.com/clap-rs/clap).


Updates `clap` from 4.6.2 to 4.6.4
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md)
- [Commits](https://github.com/clap-rs/clap/compare/clap_complete-v4.6.2...clap_complete-v4.6.4)

---
updated-dependencies:
- dependency-name: clap
  dependency-version: 4.6.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-03 13:43:02 +00:00
dependabot[bot]
b86c68a2c0 deps: bump the rust-deps group with 4 updates 
Bumps the rust-deps group with 4 updates: [anyhow](https://github.com/dtolnay/anyhow), [clap](https://github.com/clap-rs/clap), [serde](https://github.com/serde-rs/serde) and [serde_json](https://github.com/serde-rs/json).


Updates `anyhow` from 1.0.103 to 1.0.104
- [Release notes](https://github.com/dtolnay/anyhow/releases)
- [Commits](https://github.com/dtolnay/anyhow/compare/1.0.103...1.0.104)

Updates `clap` from 4.6.1 to 4.6.2
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md)
- [Commits](https://github.com/clap-rs/clap/compare/clap_complete-v4.6.1...clap_complete-v4.6.2)

Updates `serde` from 1.0.228 to 1.0.229
- [Release notes](https://github.com/serde-rs/serde/releases)
- [Commits](https://github.com/serde-rs/serde/compare/v1.0.228...v1.0.229)

Updates `serde_json` from 1.0.150 to 1.0.151
- [Release notes](https://github.com/serde-rs/json/releases)
- [Commits](https://github.com/serde-rs/json/compare/v1.0.150...v1.0.151)

---
updated-dependencies:
- dependency-name: anyhow
  dependency-version: 1.0.104
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-deps
- dependency-name: clap
  dependency-version: 4.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-deps
- dependency-name: serde
  dependency-version: 1.0.229
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-deps
- dependency-name: serde_json
  dependency-version: 1.0.151
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-27 13:44:12 +00:00
dependabot[bot]
cc4806c177 ci: bump the actions group with 2 updates 
Bumps the actions group with 2 updates: [actions/checkout](https://github.com/actions/checkout) and [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action).


Updates `actions/checkout` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](9c091bb21b...3d3c42e5aa)

Updates `zizmorcore/zizmor-action` from 0.5.7 to 0.6.0
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](192e21d79a...6599ee8b7a)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-27 13:42:41 +00:00
Jonathan Lebon
f536bda6b8 alpm: drop redundant references in format arguments 
Clippy 1.97+ flags these as useless_borrows_in_formatting.

Assisted-by: Pi (Claude Opus 4.6)
 2026-07-23 14:28:29 -04:00
Jonathan Lebon
8df3cb454b README: mention ALPM/pacman support 
Update the Highlights and Understanding components sections to reflect
that pacman (ALPM) is now a supported component repo alongside RPM.

Assisted-by: Pi (Claude Opus 4.6)
 2026-07-23 14:28:29 -04:00
Jonathan Lebon
e9ea343de3 tree: adapt to ocidir 0.8 OciRead trait extraction 
ocidir 0.8 moved read_blob, read_index, read_json_blob, and other
read-only methods from inherent methods on OciDir to a new OciRead
trait. Import OciRead in test modules that call these methods.

Assisted-by: Pi (Claude Opus 4.6)
 2026-07-13 19:24:59 +00:00
dependabot[bot]
7d318954d1 deps: bump ocidir from 0.7.2 to 0.8.0 
Bumps [ocidir](https://github.com/containers/ocidir-rs) from 0.7.2 to 0.8.0.
- [Release notes](https://github.com/containers/ocidir-rs/releases)
- [Commits](https://github.com/containers/ocidir-rs/compare/v0.7.2...v0.8.0)

---
updated-dependencies:
- dependency-name: ocidir
  dependency-version: 0.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-13 19:24:59 +00:00
dependabot[bot]
3c6ca029e8 deps: bump the rust-deps group with 2 updates 
Bumps the rust-deps group with 2 updates: [anyhow](https://github.com/dtolnay/anyhow) and [camino](https://github.com/camino-rs/camino).


Updates `anyhow` from 1.0.102 to 1.0.103
- [Release notes](https://github.com/dtolnay/anyhow/releases)
- [Commits](https://github.com/dtolnay/anyhow/compare/1.0.102...1.0.103)

Updates `camino` from 1.2.3 to 1.2.4
- [Release notes](https://github.com/camino-rs/camino/releases)
- [Changelog](https://github.com/camino-rs/camino/blob/main/CHANGELOG.md)
- [Commits](https://github.com/camino-rs/camino/compare/camino-1.2.3...camino-1.2.4)

---
updated-dependencies:
- dependency-name: anyhow
  dependency-version: 1.0.103
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-deps
- dependency-name: camino
  dependency-version: 1.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-06 13:44:27 +00:00
dependabot[bot]
7d6f2178c8 ci: bump the actions group with 2 updates 
Bumps the actions group with 2 updates: [actions/checkout](https://github.com/actions/checkout) and [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action).


Updates `actions/checkout` from 6.0.3 to 7.0.0
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](df4cb1c069...9c091bb21b)

Updates `zizmorcore/zizmor-action` from 0.5.6 to 0.5.7
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](5f14fd08f7...192e21d79a)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.5.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-30 12:30:15 -04:00
dependabot[bot]
2ea1b3f2f5 deps: bump camino from 1.2.2 to 1.2.3 in the rust-deps group 
Bumps the rust-deps group with 1 update: [camino](https://github.com/camino-rs/camino).


Updates `camino` from 1.2.2 to 1.2.3
- [Release notes](https://github.com/camino-rs/camino/releases)
- [Changelog](https://github.com/camino-rs/camino/blob/main/CHANGELOG.md)
- [Commits](https://github.com/camino-rs/camino/compare/camino-1.2.2...camino-1.2.3)

---
updated-dependencies:
- dependency-name: camino
  dependency-version: 1.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-29 13:44:08 +00:00
dependabot[bot]
b9632a0474 deps: bump openssl from 0.10.80 to 0.10.81 in the rust-deps group 
Bumps the rust-deps group with 1 update: [openssl](https://github.com/rust-openssl/rust-openssl).


Updates `openssl` from 0.10.80 to 0.10.81
- [Release notes](https://github.com/rust-openssl/rust-openssl/releases)
- [Commits](https://github.com/rust-openssl/rust-openssl/compare/openssl-v0.10.80...openssl-v0.10.81)

---
updated-dependencies:
- dependency-name: openssl
  dependency-version: 0.10.81
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-22 13:44:03 +00:00
dependabot[bot]
e8a96fa588 ci: bump actions/checkout from 6.0.2 to 6.0.3 in the actions group 
Bumps the actions group with 1 update: [actions/checkout](https://github.com/actions/checkout).


Updates `actions/checkout` from 6.0.2 to 6.0.3
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](de0fac2e45...df4cb1c069)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-15 13:48:29 +00:00
dependabot[bot]
4846573b59 deps: bump chrono from 0.4.44 to 0.4.45 in the rust-deps group 
Bumps the rust-deps group with 1 update: [chrono](https://github.com/chronotope/chrono).


Updates `chrono` from 0.4.44 to 0.4.45
- [Release notes](https://github.com/chronotope/chrono/releases)
- [Changelog](https://github.com/chronotope/chrono/blob/main/CHANGELOG.md)
- [Commits](https://github.com/chronotope/chrono/compare/v0.4.44...v0.4.45)

---
updated-dependencies:
- dependency-name: chrono
  dependency-version: 0.4.45
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-15 13:47:22 +00:00
Daniel Hast
da527a4f39 feat: bin changelog entries by day in stability calculation 
If a package has multiple changelog entries within a day, those are
likely either duplicates or reflect some sort of short-term packaging
problem, rather than indicating a higher frequency of releases.
Therefore, it more accurately reflects package stability to treat these
as a single release for the purpose of stability calculation.

Such duplicate changelog entries can cause stability to be significantly
underestimated for some packages; for example, the `systemd` package
currently has stability score around 0.260 without this change, and
0.416 with this change.
 2026-06-08 15:25:01 -04:00
Jonathan Lebon
fbfb347688 Cargo.toml: bump version to v0.6.0 2026-06-08 10:38:52 -04:00
dependabot[bot]
26dfa02508 deps: bump serde_json from 1.0.149 to 1.0.150 in the rust-deps group 
Bumps the rust-deps group with 1 update: [serde_json](https://github.com/serde-rs/json).


Updates `serde_json` from 1.0.149 to 1.0.150
- [Release notes](https://github.com/serde-rs/json/releases)
- [Commits](https://github.com/serde-rs/json/compare/v1.0.149...v1.0.150)

---
updated-dependencies:
- dependency-name: serde_json
  dependency-version: 1.0.150
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-02 16:58:01 +00:00
Jonathan Lebon
852c69f402 tree: convert polish-notes OpenCode command to agent skill 
Move from .opencode/commands/ to .agents/skills/ so this works across
agent harnesses, not just OpenCode.

Assisted-by: Pi (Claude Opus 4.6)
 2026-06-01 21:45:03 -04:00
Jonathan Lebon
7a809e5739 Containerfile: bump Fedora base image to 44 
Unfortunately Dependabot can't handle this because it's on a build arg
and not a `FROM`.

Assisted-by: Pi (Claude Opus 4.6)
 2026-05-27 21:40:17 -04:00
Jonathan Lebon
1cf18ed2fd Containerfile: verify CentOS rpm-sequoia with CentOS GPG key 
Ironically, we weren't actually verifying signatures on the rpm-sequoia
rpm we got from the CentOS repo...

Let's make sure to do that.

Assisted-by: Pi (Claude Opus 4.6)
 2026-05-27 21:40:17 -04:00
Jonathan Lebon
497884553b build: support oci: transport prefix on --output 
It's silly right now how chunkah tars up an ocidir, but the primary
way this is consumed is by the containers stack, which will immediately
untar it back to consume it.

We can't avoid this in the `podman run | podman load` flow, but we can
in the Containerfile flow by simply leaving the output as an ocidir, and
then using `FROM oci:` instead of `FROM oci-archive:`.

To expose this, add support for transport prefixes on the argument
passed to `--output`; `oci:PATH` writes the OCI directory layout
directly to disk, while `oci-archive:PATH` or `PATH` preserves the
existing behavior.

Update `Containerfile.splitter` and docs to use the new format. And of
course, update the chunkah image build itself to use this!

Anyone using chunkah from a Containerfile is encouraged to switch over
to this. The efficiency gains are non-trivial. E.g. for the fedora-bootc
image, this roughly cuts in half the "handover time" from chunkah to
buildah.

Closes: #103

Assisted-by: Pi (Claude Opus 4.6)
 2026-05-27 21:27:04 -04:00
dependabot[bot]
09d94d7088 deps: bump the rust-deps group with 2 updates 
Bumps the rust-deps group with 2 updates: [openssl](https://github.com/rust-openssl/rust-openssl) and [tar](https://github.com/composefs/tar-rs).


Updates `openssl` from 0.10.79 to 0.10.80
- [Release notes](https://github.com/rust-openssl/rust-openssl/releases)
- [Commits](https://github.com/rust-openssl/rust-openssl/compare/openssl-v0.10.79...openssl-v0.10.80)

Updates `tar` from 0.4.45 to 0.4.46
- [Release notes](https://github.com/composefs/tar-rs/releases)
- [Commits](https://github.com/composefs/tar-rs/compare/0.4.45...0.4.46)

---
updated-dependencies:
- dependency-name: openssl
  dependency-version: 0.10.80
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-deps
- dependency-name: tar
  dependency-version: 0.4.46
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-25 19:56:25 +00:00
dependabot[bot]
3739b1eafc ci: bump zizmorcore/zizmor-action in the actions group 
Bumps the actions group with 1 update: [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action).


Updates `zizmorcore/zizmor-action` from 0.5.3 to 0.5.6
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](b1d7e1fb5d...5f14fd08f7)

---
updated-dependencies:
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.5.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-25 19:56:23 +00:00
Jonathan Lebon
776ac8a25e Cargo.toml: bump rust-version to 1.92.0 
RHEL 9 now ships Rust 1.92.0.
Bump the minimum supported Rust version accordingly.
 2026-05-25 15:34:22 -04:00
dependabot[bot]
627c8c0739 ci: bump sigstore/cosign-installer in the actions group 
Bumps the actions group with 1 update: [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer).


Updates `sigstore/cosign-installer` from 4.1.1 to 4.1.2
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](cad07c2e89...6f9f177880)

---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
  dependency-version: 4.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-18 23:37:25 +00:00
Dusty Mabe
18f913ed47 README: add note on required minimum bootc version 
For bootable containers let's add a note about minimum versions
of bootc required to use chunkah chunked images. The versions are
v1.1.3, which contains [1] for images <= 128 layers, and v1.9.0,
which contains [2], for images with > 128 layers.

[1] c49ccec505
[2] 207b7f0abf
 2026-05-12 17:07:44 -04:00
Daniel Hast
56b05e45af ci: add Zizmor workflow 
Zizmor is a widely used static analysis tool for GitHub Actions that can
identify many common security issues in workflows. For reference, see:
https://docs.zizmor.sh/

Also explicitly ignore Zizmor warning for unpinned uses of Fedora
container, as tests are intentionally run against the lateset image.
 2026-05-06 12:24:57 -04:00
Daniel Hast
292fd666fd ci: eliminate template expansions in code contexts 
Template expansions in code contexts can be a source of code injection
vulnerabilities: https://docs.zizmor.sh/audits/#template-injection
Instead, use environment variables to pass the results of template
expansions to shell commands in a way that's aware of shell syntax.
 2026-05-06 12:24:57 -04:00
Daniel Hast
179141e1ef ci: fix spoofable bot condition 
github.actor can be spoofed and shouldn't be used to check whether the
PR author is a trusted bot. For more info, see:
https://docs.zizmor.sh/audits/#bot-conditions
 2026-05-06 12:24:57 -04:00
Daniel Hast
21bcb0ed8a ci: don't persist credentials with actions/checkout 
This mitigates the risk of accidental credentials leakage (e.g. through
artifacts). See https://docs.zizmor.sh/audits/#artipacked
 2026-05-06 12:24:57 -04:00
Daniel Hast
019c3626de ci: pin action dependencies to commit hashes 
Unpinned actions pose a security risk as they can be changed by the
upstream repo at any time: https://docs.zizmor.sh/audits/#unpinned-uses
 2026-05-06 12:24:57 -04:00
Daniel Hast
871c1ee0c7 ci: drop unnecessary workflow permissions 
Add top-level empty permissions block in all CI workflows, and provide
explanatory comments for all write permissions. The only actual
permissions change is to `unit-tests`, which was previously given overly
broad default permissions but only needs to be able to read repo
contents.

See https://docs.zizmor.sh/audits/#excessive-permissions for more info
on how the default permissions are overly broad.
 2026-05-06 12:24:57 -04:00