Merge branch 'main' into fluentd-daemonset

Makefile

@@ -25,6 +25,7 @@ MELANGE_OPTS += ${MELANGE_EXTRA_OPTS}
 
 # Enter interactive mode on failure for debug
 MELANGE_DEBUG_OPTS += --interactive
+MELANGE_DEBUG_OPTS += --debug
 MELANGE_DEBUG_OPTS += --package-append apk-tools
 MELANGE_DEBUG_OPTS += ${MELANGE_OPTS}
 

age.yaml

@@ -1,7 +1,7 @@
 package:
   name: age
   version: 1.2.0
-  epoch: 2
+  epoch: 3
   description: A simple, modern and secure encryption tool (and Go library) with small explicit keys, no config options, and UNIX-style composability.
   copyright:
     - license: BSD-3-Clause
@@ -13,6 +13,10 @@ pipeline:
       tag: v${{package.version}}
       expected-commit: bbe6ce5eeb1bb70cfc705d0961c943f0dd637ffd
 
+  - uses: go/bump
+    with:
+      deps: golang.org/x/crypto@v0.31.0
+
   - uses: go/build
     with:
       packages: ./cmd/age/

airflow.yaml

@@ -1,7 +1,7 @@
 package:
   name: airflow
   version: 2.10.3
-  epoch: 0
+  epoch: 1
   description: Platform to programmatically author, schedule, and monitor workflows
   options:
     #  There is a dependency on libarrow.so although it
@@ -75,6 +75,10 @@ pipeline:
       # The tldr; For that case it is not needed in runtime.
       ./venv/bin/pip uninstall --yes setuptools
 
+      #GHSA-8w49-h785-mj3c/GHSA-8495-4g3g-x7pr/GHSA-27mf-ghqm-j3j8 fixes
+      ./venv/bin/pip install aiohttp==3.10.11
+      ./venv/bin/pip install tornado==6.4.2
+
   - working-directory: venv/lib/python3.12/site-packages/airflow/www
     runs: |
       # front-end build

apicurio-registry.yaml

@@ -1,6 +1,6 @@
 package:
   name: apicurio-registry
-  version: 3.0.5
+  version: 3.0.6
   epoch: 0
   description: An API/Schema registry - stores APIs and Schemas
   copyright:
@@ -32,7 +32,7 @@ pipeline:
     with:
       repository: https://github.com/Apicurio/apicurio-registry
       tag: v${{package.version}}
-      expected-commit: c17f6e85d4d3839db515294eeeb12b10b2ea2304
+      expected-commit: 779f0994a1de5ebd48f617f476f3e3b7c5a36e48
 
   - uses: patch
     with:

apko.yaml

@@ -1,7 +1,7 @@
 package:
   name: apko
-  version: 0.21.0
-  epoch: 1
+  version: 0.22.2
+  epoch: 0
   description: Build OCI images using APK directly without Dockerfile
   copyright:
     - license: Apache-2.0
@@ -22,11 +22,7 @@ pipeline:
     with:
       repository: https://github.com/chainguard-dev/apko
       tag: v${{package.version}}
-      expected-commit: d45b6da444f211f49e25d25d26cc0241023d22c8
-
-  - uses: go/bump
-    with:
-      deps: golang.org/x/crypto@v0.31.0
+      expected-commit: 559534fa1a0f3e719335aa06a9aa1dbd6609fa25
 
   - runs: |
       make apko

argo-rollouts.yaml

@@ -1,7 +1,7 @@
 package:
   name: argo-rollouts
   version: 1.7.2
-  epoch: 1
+  epoch: 2
   description: Progressive Delivery for Kubernetes
   copyright:
     - license: Apache-2.0
@@ -15,7 +15,7 @@ pipeline:
 
   - uses: go/bump
     with:
-      deps: golang.org/x/net@v0.23.0 github.com/cloudflare/circl@v1.3.7 github.com/hashicorp/go-retryablehttp@v0.7.7 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@v0.46.0 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.46.0 go.opentelemetry.io/otel/sdk@v1.21.0 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.21.0 k8s.io/apiserver@v0.29.4 k8s.io/kubernetes@v1.29.7 github.com/golang-jwt/jwt/v4@v4.5.1
+      deps: golang.org/x/net@v0.23.0 github.com/cloudflare/circl@v1.3.7 github.com/hashicorp/go-retryablehttp@v0.7.7 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@v0.46.0 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.46.0 go.opentelemetry.io/otel/sdk@v1.21.0 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.21.0 k8s.io/apiserver@v0.29.4 k8s.io/kubernetes@v1.29.7 github.com/golang-jwt/jwt/v4@v4.5.1 golang.org/x/crypto@v0.31.0
       replaces: github.com/whilp/git-urls=github.com/chainguard-dev/git-urls@v1.0.2
 
   - uses: go/build
@@ -33,7 +33,7 @@ subpackages:
     pipeline:
       - uses: go/bump
         with:
-          deps: golang.org/x/net@v0.23.0 github.com/cloudflare/circl@v1.3.7 github.com/hashicorp/go-retryablehttp@v0.7.7 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@v0.46.0 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.46.0 go.opentelemetry.io/otel/sdk@v1.21.0 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.21.0 k8s.io/apiserver@v0.29.4 k8s.io/kubernetes@v1.29.7
+          deps: github.com/cloudflare/circl@v1.3.7 github.com/hashicorp/go-retryablehttp@v0.7.7 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@v0.46.0 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.46.0 go.opentelemetry.io/otel/sdk@v1.21.0 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.21.0 k8s.io/apiserver@v0.29.4 k8s.io/kubernetes@v1.29.7
           replaces: github.com/whilp/git-urls=github.com/chainguard-dev/git-urls@v1.0.2
       - uses: go/build
         with:

argo-workflows.yaml

@@ -1,7 +1,7 @@
 package:
   name: argo-workflows
   version: 3.6.2
-  epoch: 0
+  epoch: 1
   description: Workflow engine for Kubernetes.
   copyright:
     - license: Apache-2.0
@@ -40,6 +40,10 @@ pipeline:
       # Pack yarn UI into go binary
       /home/build/.cache/go/bin/staticfiles -o server/static/files.go ui/dist/app
 
+  - uses: go/bump
+    with:
+      deps: golang.org/x/crypto@v0.31.0
+
   - uses: go/build
     with:
       packages: ./cmd/argo

atlantis.yaml

@@ -1,7 +1,7 @@
 package:
   name: atlantis
   version: 0.31.0
-  epoch: 0
+  epoch: 1
   description: Terraform Pull Request Automation
   copyright:
     - license: Apache-2.0
@@ -26,6 +26,11 @@ pipeline:
       tag: v${{package.version}}
       expected-commit: 245044c17fe85f7330c0a1cca919e7bf3bd52c4d
 
+  - uses: go/bump
+    with:
+      deps: golang.org/x/crypto@v0.31.0
+      modroot: .
+
   - uses: go/build
     with:
       modroot: .

authservice.yaml

@@ -1,7 +1,7 @@
 package:
   name: authservice
   version: 1.0.3
-  epoch: 0
+  epoch: 1
   description: Move OIDC token acquisition out of your app code and into the Istio mesh
   copyright:
     - license: Apache-2.0
@@ -17,6 +17,10 @@ pipeline:
       repository: https://github.com/istio-ecosystem/authservice
       tag: v${{package.version}}
 
+  - uses: go/bump
+    with:
+      deps: golang.org/x/crypto@v0.31.0
+
   - uses: go/build
     with:
       packages: ./cmd

aws-c-auth.yaml

@@ -1,7 +1,7 @@
 package:
   name: aws-c-auth
   version: 0.8.0
-  epoch: 0
+  epoch: 1
   description: "C99 library implementation of AWS client-side authentication: standard credentials providers and signing"
   copyright:
     - license: Apache-2.0
@@ -64,14 +64,10 @@ subpackages:
     description: aws-c-auth dev
 
 test:
-  environment:
-    contents:
-      packages:
-        - posix-libc-utils
   pipeline:
-    - name: "Verify shared library dependencies"
-      runs: |
-        ldd /usr/lib/libaws-c-auth.so.1.0.0
+    - uses: test/ldd-check
+      with:
+        files: /usr/lib/libaws-c-auth.so.1.0.0
 
 update:
   enabled: true

aws-c-cal.yaml

@@ -1,7 +1,7 @@
 package:
   name: aws-c-cal
   version: 0.8.1
-  epoch: 0
+  epoch: 1
   description: "AWS Crypto Abstraction Layer: Cross-Platform, C99 wrapper for cryptography primitives"
   copyright:
     - license: Apache-2.0
@@ -58,14 +58,10 @@ subpackages:
     description: aws-c-cal dev
 
 test:
-  environment:
-    contents:
-      packages:
-        - posix-libc-utils
   pipeline:
-    - name: "Verify shared library dependencies"
-      runs: |
-        ldd /usr/lib/libaws-c-cal.so.1.0.0
+    - uses: test/ldd-check
+      with:
+        files: /usr/lib/libaws-c-cal.so.1.0.0
 
 update:
   enabled: true

aws-c-common.yaml

@@ -1,7 +1,7 @@
 package:
   name: aws-c-common
   version: 0.10.6
-  epoch: 0
+  epoch: 1
   description: Core c99 package for AWS SDK for C including cross-platform primitives, configuration, data structures, and error handling
   copyright:
     - license: Apache-2.0
@@ -57,14 +57,10 @@ subpackages:
     description: aws-c-common dev
 
 test:
-  environment:
-    contents:
-      packages:
-        - posix-libc-utils
   pipeline:
-    - name: "Verify shared library dependencies"
-      runs: |
-        ldd /usr/lib/libaws-c-common.so.1.0.0
+    - uses: test/ldd-check
+      with:
+        files: /usr/lib/libaws-c-common.so.1.0.0
 
 update:
   enabled: true

aws-c-compression.yaml

@@ -1,7 +1,7 @@
 package:
   name: aws-c-compression
   version: 0.3.0
-  epoch: 0
+  epoch: 1
   description: C99 implementation of huffman encoding/decoding
   copyright:
     - license: Apache-2.0
@@ -54,14 +54,10 @@ subpackages:
     description: aws-c-compression dev
 
 test:
-  environment:
-    contents:
-      packages:
-        - posix-libc-utils
   pipeline:
-    - name: "Verify shared library dependencies"
-      runs: |
-        ldd /usr/lib/libaws-c-compression.so.1.0.0
+    - uses: test/ldd-check
+      with:
+        files: /usr/lib/libaws-c-compression.so.1.0.0
 
 update:
   enabled: true

aws-c-event-stream.yaml

@@ -1,7 +1,7 @@
 package:
   name: aws-c-event-stream
   version: 0.5.0
-  epoch: 0
+  epoch: 1
   description: "AWS C99 implementation of the vnd.amazon.eventstream content-type"
   copyright:
     - license: Apache-2.0
@@ -62,14 +62,10 @@ subpackages:
     description: aws-c-event-stream dev
 
 test:
-  environment:
-    contents:
-      packages:
-        - posix-libc-utils
   pipeline:
-    - name: "Verify shared library dependencies"
-      runs: |
-        ldd /usr/lib/libaws-c-event-stream.so.1.0.0
+    - uses: test/ldd-check
+      with:
+        files: /usr/lib/libaws-c-event-stream.so.1.0.0
 
 update:
   enabled: true

aws-c-http.yaml

@@ -1,7 +1,7 @@
 package:
   name: aws-c-http
   version: 0.9.2
-  epoch: 0
+  epoch: 1
   description: AWS C99 implementation of the HTTP/1.1 and HTTP/2 specifications
   copyright:
     - license: Apache-2.0
@@ -61,14 +61,10 @@ subpackages:
     description: aws-c-http dev
 
 test:
-  environment:
-    contents:
-      packages:
-        - posix-libc-utils
   pipeline:
-    - name: "Verify shared library dependencies"
-      runs: |
-        ldd /usr/lib/libaws-c-http.so.1.0.0
+    - uses: test/ldd-check
+      with:
+        files: /usr/lib/libaws-c-http.so.1.0.0
 
 update:
   enabled: true

aws-c-mqtt.yaml

@@ -1,7 +1,7 @@
 package:
   name: aws-c-mqtt
   version: 0.11.0
-  epoch: 0
+  epoch: 1
   description: AWS C99 implementation of the MQTT 3.1.1 specification
   copyright:
     - license: Apache-2.0
@@ -79,12 +79,11 @@ test:
         - aws-c-io-dev
         - build-base
         - gcc
-        - posix-libc-utils
         - aws-c-mqtt-dev
   pipeline:
-    - name: "Verify shared library dependencies"
-      runs: |
-        ldd /usr/lib/libaws-c-mqtt.so.1.0.0
+    - uses: test/ldd-check
+      with:
+        files: /usr/lib/libaws-c-mqtt.so.1.0.0
     - name: "Compile simple MQTT test program"
       runs: |
         cat << 'EOF' > test.c

aws-c-s3.yaml

@@ -74,14 +74,10 @@ subpackages:
     description: aws-c-s3 dev
 
 test:
-  environment:
-    contents:
-      packages:
-        - posix-libc-utils
   pipeline:
-    - name: "Verify shared library dependencies"
-      runs: |
-        ldd /usr/lib/libaws-c-s3.so.1.0.0
+    - uses: test/ldd-check
+      with:
+        files: /usr/lib/libaws-c-s3.so.1.0.0
 
 update:
   enabled: true

aws-c-sdkutils.yaml

@@ -57,14 +57,10 @@ subpackages:
     description: aws-c-sdkutils dev
 
 test:
-  environment:
-    contents:
-      packages:
-        - posix-libc-utils
   pipeline:
-    - name: "Verify shared library dependencies"
-      runs: |
-        ldd /usr/lib/libaws-c-sdkutils.so.1.0.0
+    - uses: test/ldd-check
+      with:
+        files: /usr/lib/libaws-c-sdkutils.so.1.0.0
 
 update:
   enabled: true