dependabot[bot]
cd7e67b2de
deps: bump the rust-deps group with 2 updates
...
Bumps the rust-deps group with 2 updates: [camino](https://github.com/camino-rs/camino ) and [clap](https://github.com/clap-rs/clap ).
Updates `camino` from 1.2.5 to 1.2.6
- [Release notes](https://github.com/camino-rs/camino/releases )
- [Changelog](https://github.com/camino-rs/camino/blob/main/CHANGELOG.md )
- [Commits](https://github.com/camino-rs/camino/compare/camino-1.2.5...camino-1.2.6 )
Updates `clap` from 4.6.6 to 4.6.7
- [Release notes](https://github.com/clap-rs/clap/releases )
- [Changelog](https://github.com/clap-rs/clap/blob/main/CHANGELOG.md )
- [Commits](https://github.com/clap-rs/clap/compare/clap_complete-v4.6.6...clap_complete-v4.6.7 )
---
updated-dependencies:
- dependency-name: camino
dependency-version: 1.2.6
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: rust-deps
- dependency-name: clap
dependency-version: 4.6.7
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: rust-deps
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-09-28 13:44:48 +00:00
Jonathan Lebon
e7d7ff045b
.packit.yaml: test on all Fedora versions
...
I think the current list dates from when chunkah was just released and
only living in Rawhide and the latest stable. Nowadays it's in all
active releases.
This also catches unreleased branched Fedora releases (e.g. Fedora 45
right now), which we really should be testing.
Ref: https://packit.dev/docs/configuration#aliases
2026-09-22 10:37:19 -04:00
Jonathan Lebon
b4e2036ba3
tree: delete CLAUDE.md compat symlink
...
AGENTS.md is natively supported by Claude Code now:
https://code.claude.com/docs/en/changelog#2-1-277
2026-09-22 10:23:16 -04:00
Daniel Hast
2869ce754b
feat: clamp xattr and bigfiles mtimes to most recent file mtime
...
This solves a reproducibility issue with `bigfiles` and `xattr`
components, which don't automatically have reproducible timestamps: Even
if all the files in the component are given fixed modification
timestamps, the timestamps of ancestor directories aren't clamped to
match the files, which makes the layers non-reproducible unless
`SOURCE_DATE_EPOCH` is set.
To fix this, we clamp `bigfiles` components to the modification time of
the single file, and clamp `xattr` components to the most recent
modification time of a file with that xattr label.
2026-09-21 13:40:12 -04:00
dependabot[bot]
25d8d07790
ci: bump zizmorcore/zizmor-action in the actions group
...
Bumps the actions group with 1 update: [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action ).
Updates `zizmorcore/zizmor-action` from 0.6.3 to 0.6.4
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases )
- [Commits](70fb788f84...cc914d7f37
2026-09-21 13:43:31 +00:00
dependabot[bot]
7c436d5da5
deps: bump indexmap from 2.14.1 to 2.14.2 in the rust-deps group
...
Bumps the rust-deps group with 1 update: [indexmap](https://github.com/indexmap-rs/indexmap ).
Updates `indexmap` from 2.14.1 to 2.14.2
- [Changelog](https://github.com/indexmap-rs/indexmap/blob/main/RELEASES.md )
- [Commits](https://github.com/indexmap-rs/indexmap/compare/2.14.1...2.14.2 )
---
updated-dependencies:
- dependency-name: indexmap
dependency-version: 2.14.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: rust-deps
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-09-14 13:42:10 +00:00
dependabot[bot]
9e74a34b05
deps: bump the rust-deps group with 2 updates
...
Bumps the rust-deps group with 2 updates: [flate2](https://github.com/rust-lang/flate2-rs ) and [indexmap](https://github.com/indexmap-rs/indexmap ).
Updates `flate2` from 1.1.9 to 1.1.10
- [Release notes](https://github.com/rust-lang/flate2-rs/releases )
- [Commits](https://github.com/rust-lang/flate2-rs/compare/1.1.9...1.1.10 )
Updates `indexmap` from 2.14.0 to 2.14.1
- [Changelog](https://github.com/indexmap-rs/indexmap/blob/main/RELEASES.md )
- [Commits](https://github.com/indexmap-rs/indexmap/compare/2.14.0...2.14.1 )
---
updated-dependencies:
- dependency-name: flate2
dependency-version: 1.1.10
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: rust-deps
- dependency-name: indexmap
dependency-version: 2.14.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: rust-deps
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-09-07 13:43:28 +00:00
dependabot[bot]
3c4918c81e
ci: bump zizmorcore/zizmor-action in the actions group
...
Bumps the actions group with 1 update: [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action ).
Updates `zizmorcore/zizmor-action` from 0.6.2 to 0.6.3
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases )
- [Commits](3dc1ecc9bc...70fb788f84
2026-09-07 13:42:58 +00:00
dependabot[bot]
e50031b124
deps: bump clap from 4.6.5 to 4.6.6 in the rust-deps group
...
Bumps the rust-deps group with 1 update: [clap](https://github.com/clap-rs/clap ).
Updates `clap` from 4.6.5 to 4.6.6
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md )
- [Commits](https://github.com/clap-rs/clap/compare/clap_complete-v4.6.5...clap_complete-v4.6.6 )
---
updated-dependencies:
- dependency-name: clap
dependency-version: 4.6.6
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: rust-deps
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-08-21 14:47:42 +00:00
dependabot[bot]
dbf38ccb32
ci: bump zizmorcore/zizmor-action in the actions group
...
Bumps the actions group with 1 update: [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action ).
Updates `zizmorcore/zizmor-action` from 0.6.1 to 0.6.2
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases )
- [Commits](6fc4b00623...3dc1ecc9bc
2026-08-12 15:57:40 +00:00
dependabot[bot]
c458a92f3f
deps: bump the rust-deps group with 2 updates
...
Bumps the rust-deps group with 2 updates: [camino](https://github.com/camino-rs/camino ) and [clap](https://github.com/clap-rs/clap ).
Updates `camino` from 1.2.4 to 1.2.5
- [Release notes](https://github.com/camino-rs/camino/releases )
- [Changelog](https://github.com/camino-rs/camino/blob/main/CHANGELOG.md )
- [Commits](https://github.com/camino-rs/camino/compare/camino-1.2.4...camino-1.2.5 )
Updates `clap` from 4.6.4 to 4.6.5
- [Release notes](https://github.com/clap-rs/clap/releases )
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md )
- [Commits](https://github.com/clap-rs/clap/compare/clap_complete-v4.6.4...clap_complete-v4.6.5 )
---
updated-dependencies:
- dependency-name: camino
dependency-version: 1.2.5
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: rust-deps
- dependency-name: clap
dependency-version: 4.6.5
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: rust-deps
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-08-10 13:43:54 +00:00
dependabot[bot]
4c8abc389c
ci: bump zizmorcore/zizmor-action in the actions group
...
Bumps the actions group with 1 update: [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action ).
Updates `zizmorcore/zizmor-action` from 0.6.0 to 0.6.1
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases )
- [Commits](6599ee8b7a...6fc4b00623
2026-08-03 13:43:54 +00:00
dependabot[bot]
e640495f4e
deps: bump clap from 4.6.2 to 4.6.4 in the rust-deps group
...
Bumps the rust-deps group with 1 update: [clap](https://github.com/clap-rs/clap ).
Updates `clap` from 4.6.2 to 4.6.4
- [Release notes](https://github.com/clap-rs/clap/releases )
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md )
- [Commits](https://github.com/clap-rs/clap/compare/clap_complete-v4.6.2...clap_complete-v4.6.4 )
---
updated-dependencies:
- dependency-name: clap
dependency-version: 4.6.4
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: rust-deps
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-08-03 13:43:02 +00:00
dependabot[bot]
b86c68a2c0
deps: bump the rust-deps group with 4 updates
...
Bumps the rust-deps group with 4 updates: [anyhow](https://github.com/dtolnay/anyhow ), [clap](https://github.com/clap-rs/clap ), [serde](https://github.com/serde-rs/serde ) and [serde_json](https://github.com/serde-rs/json ).
Updates `anyhow` from 1.0.103 to 1.0.104
- [Release notes](https://github.com/dtolnay/anyhow/releases )
- [Commits](https://github.com/dtolnay/anyhow/compare/1.0.103...1.0.104 )
Updates `clap` from 4.6.1 to 4.6.2
- [Release notes](https://github.com/clap-rs/clap/releases )
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md )
- [Commits](https://github.com/clap-rs/clap/compare/clap_complete-v4.6.1...clap_complete-v4.6.2 )
Updates `serde` from 1.0.228 to 1.0.229
- [Release notes](https://github.com/serde-rs/serde/releases )
- [Commits](https://github.com/serde-rs/serde/compare/v1.0.228...v1.0.229 )
Updates `serde_json` from 1.0.150 to 1.0.151
- [Release notes](https://github.com/serde-rs/json/releases )
- [Commits](https://github.com/serde-rs/json/compare/v1.0.150...v1.0.151 )
---
updated-dependencies:
- dependency-name: anyhow
dependency-version: 1.0.104
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: rust-deps
- dependency-name: clap
dependency-version: 4.6.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: rust-deps
- dependency-name: serde
dependency-version: 1.0.229
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: rust-deps
- dependency-name: serde_json
dependency-version: 1.0.151
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: rust-deps
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-07-27 13:44:12 +00:00
dependabot[bot]
cc4806c177
ci: bump the actions group with 2 updates
...
Bumps the actions group with 2 updates: [actions/checkout](https://github.com/actions/checkout ) and [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action ).
Updates `actions/checkout` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](9c091bb21b...3d3c42e5aahttps://github.com/zizmorcore/zizmor-action/releases )
- [Commits](192e21d79a...6599ee8b7a
2026-07-27 13:42:41 +00:00
Jonathan Lebon
f536bda6b8
alpm: drop redundant references in format arguments
...
Clippy 1.97+ flags these as useless_borrows_in_formatting.
Assisted-by: Pi (Claude Opus 4.6)
2026-07-23 14:28:29 -04:00
Jonathan Lebon
8df3cb454b
README: mention ALPM/pacman support
...
Update the Highlights and Understanding components sections to reflect
that pacman (ALPM) is now a supported component repo alongside RPM.
Assisted-by: Pi (Claude Opus 4.6)
2026-07-23 14:28:29 -04:00
Jonathan Lebon
e9ea343de3
tree: adapt to ocidir 0.8 OciRead trait extraction
...
ocidir 0.8 moved read_blob, read_index, read_json_blob, and other
read-only methods from inherent methods on OciDir to a new OciRead
trait. Import OciRead in test modules that call these methods.
Assisted-by: Pi (Claude Opus 4.6)
2026-07-13 19:24:59 +00:00
dependabot[bot]
7d318954d1
deps: bump ocidir from 0.7.2 to 0.8.0
...
Bumps [ocidir](https://github.com/containers/ocidir-rs ) from 0.7.2 to 0.8.0.
- [Release notes](https://github.com/containers/ocidir-rs/releases )
- [Commits](https://github.com/containers/ocidir-rs/compare/v0.7.2...v0.8.0 )
---
updated-dependencies:
- dependency-name: ocidir
dependency-version: 0.8.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-07-13 19:24:59 +00:00
dependabot[bot]
3c6ca029e8
deps: bump the rust-deps group with 2 updates
...
Bumps the rust-deps group with 2 updates: [anyhow](https://github.com/dtolnay/anyhow ) and [camino](https://github.com/camino-rs/camino ).
Updates `anyhow` from 1.0.102 to 1.0.103
- [Release notes](https://github.com/dtolnay/anyhow/releases )
- [Commits](https://github.com/dtolnay/anyhow/compare/1.0.102...1.0.103 )
Updates `camino` from 1.2.3 to 1.2.4
- [Release notes](https://github.com/camino-rs/camino/releases )
- [Changelog](https://github.com/camino-rs/camino/blob/main/CHANGELOG.md )
- [Commits](https://github.com/camino-rs/camino/compare/camino-1.2.3...camino-1.2.4 )
---
updated-dependencies:
- dependency-name: anyhow
dependency-version: 1.0.103
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: rust-deps
- dependency-name: camino
dependency-version: 1.2.4
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: rust-deps
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-07-06 13:44:27 +00:00
dependabot[bot]
7d6f2178c8
ci: bump the actions group with 2 updates
...
Bumps the actions group with 2 updates: [actions/checkout](https://github.com/actions/checkout ) and [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action ).
Updates `actions/checkout` from 6.0.3 to 7.0.0
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](df4cb1c069...9c091bb21bhttps://github.com/zizmorcore/zizmor-action/releases )
- [Commits](5f14fd08f7...192e21d79a
2026-06-30 12:30:15 -04:00
dependabot[bot]
2ea1b3f2f5
deps: bump camino from 1.2.2 to 1.2.3 in the rust-deps group
...
Bumps the rust-deps group with 1 update: [camino](https://github.com/camino-rs/camino ).
Updates `camino` from 1.2.2 to 1.2.3
- [Release notes](https://github.com/camino-rs/camino/releases )
- [Changelog](https://github.com/camino-rs/camino/blob/main/CHANGELOG.md )
- [Commits](https://github.com/camino-rs/camino/compare/camino-1.2.2...camino-1.2.3 )
---
updated-dependencies:
- dependency-name: camino
dependency-version: 1.2.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: rust-deps
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-06-29 13:44:08 +00:00
dependabot[bot]
b9632a0474
deps: bump openssl from 0.10.80 to 0.10.81 in the rust-deps group
...
Bumps the rust-deps group with 1 update: [openssl](https://github.com/rust-openssl/rust-openssl ).
Updates `openssl` from 0.10.80 to 0.10.81
- [Release notes](https://github.com/rust-openssl/rust-openssl/releases )
- [Commits](https://github.com/rust-openssl/rust-openssl/compare/openssl-v0.10.80...openssl-v0.10.81 )
---
updated-dependencies:
- dependency-name: openssl
dependency-version: 0.10.81
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: rust-deps
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-06-22 13:44:03 +00:00
dependabot[bot]
e8a96fa588
ci: bump actions/checkout from 6.0.2 to 6.0.3 in the actions group
...
Bumps the actions group with 1 update: [actions/checkout](https://github.com/actions/checkout ).
Updates `actions/checkout` from 6.0.2 to 6.0.3
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](de0fac2e45...df4cb1c069
2026-06-15 13:48:29 +00:00
dependabot[bot]
4846573b59
deps: bump chrono from 0.4.44 to 0.4.45 in the rust-deps group
...
Bumps the rust-deps group with 1 update: [chrono](https://github.com/chronotope/chrono ).
Updates `chrono` from 0.4.44 to 0.4.45
- [Release notes](https://github.com/chronotope/chrono/releases )
- [Changelog](https://github.com/chronotope/chrono/blob/main/CHANGELOG.md )
- [Commits](https://github.com/chronotope/chrono/compare/v0.4.44...v0.4.45 )
---
updated-dependencies:
- dependency-name: chrono
dependency-version: 0.4.45
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: rust-deps
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-06-15 13:47:22 +00:00
Daniel Hast
da527a4f39
feat: bin changelog entries by day in stability calculation
...
If a package has multiple changelog entries within a day, those are
likely either duplicates or reflect some sort of short-term packaging
problem, rather than indicating a higher frequency of releases.
Therefore, it more accurately reflects package stability to treat these
as a single release for the purpose of stability calculation.
Such duplicate changelog entries can cause stability to be significantly
underestimated for some packages; for example, the `systemd` package
currently has stability score around 0.260 without this change, and
0.416 with this change.
2026-06-08 15:25:01 -04:00
Jonathan Lebon
fbfb347688
Cargo.toml: bump version to v0.6.0
2026-06-08 10:38:52 -04:00
dependabot[bot]
26dfa02508
deps: bump serde_json from 1.0.149 to 1.0.150 in the rust-deps group
...
Bumps the rust-deps group with 1 update: [serde_json](https://github.com/serde-rs/json ).
Updates `serde_json` from 1.0.149 to 1.0.150
- [Release notes](https://github.com/serde-rs/json/releases )
- [Commits](https://github.com/serde-rs/json/compare/v1.0.149...v1.0.150 )
---
updated-dependencies:
- dependency-name: serde_json
dependency-version: 1.0.150
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: rust-deps
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-06-02 16:58:01 +00:00
Jonathan Lebon
852c69f402
tree: convert polish-notes OpenCode command to agent skill
...
Move from .opencode/commands/ to .agents/skills/ so this works across
agent harnesses, not just OpenCode.
Assisted-by: Pi (Claude Opus 4.6)
2026-06-01 21:45:03 -04:00
Jonathan Lebon
7a809e5739
Containerfile: bump Fedora base image to 44
...
Unfortunately Dependabot can't handle this because it's on a build arg
and not a `FROM`.
Assisted-by: Pi (Claude Opus 4.6)
2026-05-27 21:40:17 -04:00
Jonathan Lebon
1cf18ed2fd
Containerfile: verify CentOS rpm-sequoia with CentOS GPG key
...
Ironically, we weren't actually verifying signatures on the rpm-sequoia
rpm we got from the CentOS repo...
Let's make sure to do that.
Assisted-by: Pi (Claude Opus 4.6)
2026-05-27 21:40:17 -04:00
Jonathan Lebon
497884553b
build: support oci: transport prefix on --output
...
It's silly right now how chunkah tars up an ocidir, but the primary
way this is consumed is by the containers stack, which will immediately
untar it back to consume it.
We can't avoid this in the `podman run | podman load` flow, but we can
in the Containerfile flow by simply leaving the output as an ocidir, and
then using `FROM oci:` instead of `FROM oci-archive:`.
To expose this, add support for transport prefixes on the argument
passed to `--output`; `oci:PATH` writes the OCI directory layout
directly to disk, while `oci-archive:PATH` or `PATH` preserves the
existing behavior.
Update `Containerfile.splitter` and docs to use the new format. And of
course, update the chunkah image build itself to use this!
Anyone using chunkah from a Containerfile is encouraged to switch over
to this. The efficiency gains are non-trivial. E.g. for the fedora-bootc
image, this roughly cuts in half the "handover time" from chunkah to
buildah.
Closes : #103
Assisted-by: Pi (Claude Opus 4.6)
2026-05-27 21:27:04 -04:00
dependabot[bot]
09d94d7088
deps: bump the rust-deps group with 2 updates
...
Bumps the rust-deps group with 2 updates: [openssl](https://github.com/rust-openssl/rust-openssl ) and [tar](https://github.com/composefs/tar-rs ).
Updates `openssl` from 0.10.79 to 0.10.80
- [Release notes](https://github.com/rust-openssl/rust-openssl/releases )
- [Commits](https://github.com/rust-openssl/rust-openssl/compare/openssl-v0.10.79...openssl-v0.10.80 )
Updates `tar` from 0.4.45 to 0.4.46
- [Release notes](https://github.com/composefs/tar-rs/releases )
- [Commits](https://github.com/composefs/tar-rs/compare/0.4.45...0.4.46 )
---
updated-dependencies:
- dependency-name: openssl
dependency-version: 0.10.80
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: rust-deps
- dependency-name: tar
dependency-version: 0.4.46
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: rust-deps
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-05-25 19:56:25 +00:00
dependabot[bot]
3739b1eafc
ci: bump zizmorcore/zizmor-action in the actions group
...
Bumps the actions group with 1 update: [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action ).
Updates `zizmorcore/zizmor-action` from 0.5.3 to 0.5.6
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases )
- [Commits](b1d7e1fb5d...5f14fd08f7
2026-05-25 19:56:23 +00:00
Jonathan Lebon
776ac8a25e
Cargo.toml: bump rust-version to 1.92.0
...
RHEL 9 now ships Rust 1.92.0.
Bump the minimum supported Rust version accordingly.
2026-05-25 15:34:22 -04:00
dependabot[bot]
627c8c0739
ci: bump sigstore/cosign-installer in the actions group
...
Bumps the actions group with 1 update: [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer ).
Updates `sigstore/cosign-installer` from 4.1.1 to 4.1.2
- [Release notes](https://github.com/sigstore/cosign-installer/releases )
- [Commits](cad07c2e89...6f9f177880
2026-05-18 23:37:25 +00:00
Dusty Mabe
18f913ed47
README: add note on required minimum bootc version
...
For bootable containers let's add a note about minimum versions
of bootc required to use chunkah chunked images. The versions are
v1.1.3, which contains [1] for images <= 128 layers, and v1.9.0,
which contains [2], for images with > 128 layers.
[1] c49ccec505207b7f0abf
2026-05-12 17:07:44 -04:00
Daniel Hast
56b05e45af
ci: add Zizmor workflow
...
Zizmor is a widely used static analysis tool for GitHub Actions that can
identify many common security issues in workflows. For reference, see:
https://docs.zizmor.sh/
Also explicitly ignore Zizmor warning for unpinned uses of Fedora
container, as tests are intentionally run against the lateset image.
2026-05-06 12:24:57 -04:00
Daniel Hast
292fd666fd
ci: eliminate template expansions in code contexts
...
Template expansions in code contexts can be a source of code injection
vulnerabilities: https://docs.zizmor.sh/audits/#template-injection
Instead, use environment variables to pass the results of template
expansions to shell commands in a way that's aware of shell syntax.
2026-05-06 12:24:57 -04:00
Daniel Hast
179141e1ef
ci: fix spoofable bot condition
...
github.actor can be spoofed and shouldn't be used to check whether the
PR author is a trusted bot. For more info, see:
https://docs.zizmor.sh/audits/#bot-conditions
2026-05-06 12:24:57 -04:00
Daniel Hast
21bcb0ed8a
ci: don't persist credentials with actions/checkout
...
This mitigates the risk of accidental credentials leakage (e.g. through
artifacts). See https://docs.zizmor.sh/audits/#artipacked
2026-05-06 12:24:57 -04:00
Daniel Hast
019c3626de
ci: pin action dependencies to commit hashes
...
Unpinned actions pose a security risk as they can be changed by the
upstream repo at any time: https://docs.zizmor.sh/audits/#unpinned-uses
2026-05-06 12:24:57 -04:00
Daniel Hast
871c1ee0c7
ci: drop unnecessary workflow permissions
...
Add top-level empty permissions block in all CI workflows, and provide
explanatory comments for all write permissions. The only actual
permissions change is to `unit-tests`, which was previously given overly
broad default permissions but only needs to be able to read repo
contents.
See https://docs.zizmor.sh/audits/#excessive-permissions for more info
on how the default permissions are overly broad.
2026-05-06 12:24:57 -04:00
Daniel Hast
6c9cfd420b
ci: add dependabot cooldown
...
Adding a cooldown timer for dependabot updates is beneficial for
stability and supply-chain security. For reference:
https://docs.zizmor.sh/audits/#dependabot-cooldown
2026-05-06 12:24:57 -04:00
Dusty Mabe
dbc4abd0ab
tools/analyze-layer-reuse: show all components with text wrapping
...
Instead of truncating the changed/unchanged component lists to 5
entries, show the full list using textwrap.fill() to wrap at 80
columns with proper indentation.
Assisted-By: <anthropic/claude-opus-4.6>
2026-05-05 14:59:57 -04:00
Dusty Mabe
6b164da9ac
tools/chunk-image-series: filter results of images query
...
This is needed to workaround the current podman bug that will
output more matches than we think it should:
https://github.com/containers/podman/issues/28643
Assisted-By: <anthropic/claude-opus-4.6>
2026-05-05 14:59:57 -04:00
Dusty Mabe
f1312d128c
tools/chunk-image-series: quiet podman load
...
Will prevent a ton of output to the terminal on every run.
2026-05-05 14:59:57 -04:00
dependabot[bot]
904cf2ac01
deps: bump the rust-deps group with 2 updates
...
Bumps the rust-deps group with 2 updates: [ocidir](https://github.com/containers/ocidir-rs ) and [openssl](https://github.com/rust-openssl/rust-openssl ).
Updates `ocidir` from 0.7.1 to 0.7.2
- [Release notes](https://github.com/containers/ocidir-rs/releases )
- [Commits](https://github.com/containers/ocidir-rs/compare/v0.7.1...v0.7.2 )
Updates `openssl` from 0.10.78 to 0.10.79
- [Release notes](https://github.com/rust-openssl/rust-openssl/releases )
- [Commits](https://github.com/rust-openssl/rust-openssl/compare/openssl-v0.10.78...openssl-v0.10.79 )
---
updated-dependencies:
- dependency-name: ocidir
dependency-version: 0.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: rust-deps
- dependency-name: openssl
dependency-version: 0.10.79
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: rust-deps
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-05-04 17:42:58 +00:00
Jonathan Lebon
b990a777d7
Cargo.toml: bump version to v0.5.0
2026-05-04 07:11:46 -04:00
Jonathan Lebon
b2f049a3f1
README-dev.md: anchor cosign verify identity regexp
...
I don't think not having this is really exploitable, but just to be safe
so we don't even have to think about it.
2026-05-04 07:11:46 -04:00
