Merge branch 'main' into cve-kserve-modelmesh-0cddae655cfc1161a944783…

…ff221d658
wolfi-dev · Jan 9, 2025 · 6591b88 · 6591b88
2 parents 2edeca5 + d414463
commit 6591b88
Show file tree

Hide file tree

Showing 896 changed files with 5,646 additions and 2,271 deletions.
diff --git a/.github/actions/docker-run/action.yaml b/.github/actions/docker-run/action.yaml
@@ -6,7 +6,7 @@ inputs:
     required: true
   image:
     description: "The image to use"
-    default: "ghcr.io/wolfi-dev/sdk:latest@sha256:6d49f779092c0bfacb2296654376aac5607dd946a5cd077f06e05e89a2341495"
+    default: "ghcr.io/wolfi-dev/sdk:latest@sha256:42fed66d23feba228f2575750647aa4a9c55d62c17f213d446ab0bdfa8ccb0fa"
     required: false
   workdir:
     description: "The images working directory"

diff --git a/.gitignore b/.gitignore
@@ -9,6 +9,7 @@ dag.svg
 .melange.k8s.yaml
 packages.log
 *.iml
+*.apk
 APKINDEX.tar.gz
 
 # macOS

diff --git a/7zip.yaml b/7zip.yaml
@@ -12,7 +12,6 @@ environment:
       - build-base
       - busybox
       - ca-certificates-bundle
-      - openssf-compiler-options
 
 pipeline:
   - uses: fetch

diff --git a/CODEOWNERS b/CODEOWNERS
@@ -3,3 +3,4 @@ CODEOWNERS @wolfi-dev/wolfi-owners
 
 # These packages require approval from the Foundations squad.
 openssh.yaml @wolfi-dev/foundations-squad
+ca-certificates.yaml @wolfi-dev/foundations-squad
diff --git a/Catch2.yaml b/Catch2.yaml
@@ -1,7 +1,7 @@
 package:
   name: Catch2
-  version: 3.7.1
-  epoch: 1
+  version: 3.8.0
+  epoch: 0
   description: "A modern, C++-native, test framework"
   copyright:
     - license: 'BSL-1.0'
@@ -11,14 +11,13 @@ environment:
     packages:
       - build-base
       - busybox
-      - openssf-compiler-options
 
 pipeline:
   - uses: git-checkout
     with:
       repository: https://github.com/catchorg/Catch2
       tag: v${{package.version}}
-      expected-commit: fa43b77429ba76c462b1898d6cd2f2d7a9416b14
+      expected-commit: 914aeecfe23b1e16af6ea675a4fb5dbd5a5b8d0a
 
   - uses: cmake/configure
 

diff --git a/Makefile b/Makefile
@@ -141,7 +141,7 @@ dev-container:
 	    -v "${PWD}:${PWD}" \
 	    -w "${PWD}" \
 	    -e SOURCE_DATE_EPOCH=0 \
-	    ghcr.io/wolfi-dev/sdk:latest@sha256:6d49f779092c0bfacb2296654376aac5607dd946a5cd077f06e05e89a2341495
+	    ghcr.io/wolfi-dev/sdk:latest@sha256:42fed66d23feba228f2575750647aa4a9c55d62c17f213d446ab0bdfa8ccb0fa
 
 PACKAGES_CONTAINER_FOLDER ?= /work/packages
 # This target spins up a docker container that is helpful for testing local
@@ -209,7 +209,7 @@ dev-container-wolfi:
 		--mount type=bind,source="${PWD}/local-melange.rsa.pub",destination="/etc/apk/keys/local-melange.rsa.pub",readonly \
 		--mount type=bind,source="$(TMP_REPOS_FILE)",destination="/etc/apk/repositories",readonly \
 		-w "$(PACKAGES_CONTAINER_FOLDER)" \
-		ghcr.io/wolfi-dev/sdk:latest@sha256:6d49f779092c0bfacb2296654376aac5607dd946a5cd077f06e05e89a2341495
+		ghcr.io/wolfi-dev/sdk:latest@sha256:42fed66d23feba228f2575750647aa4a9c55d62c17f213d446ab0bdfa8ccb0fa
 	@rm "$(TMP_REPOS_FILE)"
 	@rmdir "$(TMP_REPOS_DIR)"
 

diff --git a/R-classInt.yaml b/R-classInt.yaml
@@ -1,6 +1,6 @@
 package:
   name: R-classInt
-  version: 0.4.10
+  version: 0.4.11
   epoch: 0
   description: Choose Univariate Class Intervals
   copyright:
@@ -29,7 +29,7 @@ pipeline:
     with:
       repository: https://github.com/cran/classInt
       tag: ${{vars.mangled-package-version}}
-      expected-commit: ce973878e5f1d689a2ff6ffcdf8b6cc55d6165e0
+      expected-commit: 2a32e081c52b28deae75158884cc9a7bc817145d
 
   - uses: R/build
     with:

diff --git a/R-e1071.yaml b/R-e1071.yaml
@@ -17,7 +17,6 @@ environment:
       - R-dev
       - R-proxy
       - busybox
-      - openssf-compiler-options
 
 var-transforms:
   - from: ${{package.version}}

diff --git a/R-s2.yaml b/R-s2.yaml
@@ -20,7 +20,6 @@ environment:
       - R-wk
       - Rcpp
       - busybox
-      - openssf-compiler-options
       - openssl-dev
 
 pipeline:

diff --git a/R-sf.yaml b/R-sf.yaml
@@ -32,7 +32,6 @@ environment:
       - busybox
       - gdal-dev
       - geos-dev
-      - openssf-compiler-options
       - pkgconf
       - proj-dev
       - sqlite-dev

diff --git a/R-wk.yaml b/R-wk.yaml
@@ -15,7 +15,6 @@ environment:
       - R
       - R-dev
       - busybox
-      - openssf-compiler-options
 
 pipeline:
   - uses: git-checkout

diff --git a/R.yaml b/R.yaml
@@ -67,7 +67,6 @@ environment:
       - openblas-dev
       - openjdk-17
       - openjdk-17-default-jvm
-      - openssf-compiler-options
       - pango-dev
       - pcre2-dev
       - perl

diff --git a/Rcpp.yaml b/Rcpp.yaml
@@ -15,7 +15,6 @@ environment:
       - R
       - R-dev
       - busybox
-      - openssf-compiler-options
 
 pipeline:
   - uses: git-checkout

diff --git a/abseil-cpp.yaml b/abseil-cpp.yaml
@@ -1,6 +1,12 @@
+# BEFORE UPDATING: Adding a new build of abseil-cpp into the archive at this
+# time may cause installs of packages that depend on abseil-cpp packages to
+# time out:
+#   https://github.com/chainguard-dev/melange/issues/1651
+# Until this issue is resolved, please request a PR approval for changes
+# to this file from the OS team.
 package:
   name: abseil-cpp
-  version: "20240722.0"
+  version: "20240722.0" # On update, please check if -fdelete-null-pointer-checks is still required
   epoch: 0
   description: Abseil Common Libraries (C++)
   copyright:
@@ -16,7 +22,11 @@ environment:
       - ca-certificates-bundle
       - cmake
       - gtest-dev
+      - openssf-compiler-options
       - samurai
+  environment:
+    # https://github.com/wolfi-dev/os/issues/34075
+    CMAKE_CXX_FLAGS: -fdelete-null-pointer-checks
 
 pipeline:
   - uses: git-checkout
@@ -27,6 +37,7 @@ pipeline:
 
   - runs: |
       cmake -B build -G Ninja \
+      -DCMAKE_CXX_FLAGS="$CMAKE_CXX_FLAGS" \
       -DCMAKE_CXX_STANDARD=17 \
       -DCMAKE_BUILD_TYPE=MinSizeRel \
       -DCMAKE_INSTALL_PREFIX=/usr \

diff --git a/ack.yaml b/ack.yaml
@@ -1,6 +1,6 @@
 package:
   name: ack
-  version: 3.8.0
+  version: 3.8.1
   epoch: 0
   description: A Perl-powered replacement for grep
   copyright:
@@ -21,7 +21,7 @@ environment:
 pipeline:
   - uses: fetch
     with:
-      expected-sha256: 640b1a1b36ca15a4d1d1792f2a44e69aeae58391cf0d21fa8a29665a8895f718
+      expected-sha256: 1c03ab46f4922a0bd2462f4cf7eeb3cb4b4e6d43cebd3cfcf3a2e132319eb88e
       uri: https://cpan.metacpan.org/authors/id/P/PE/PETDANCE/ack-v${{package.version}}.tar.gz
 
   - runs: PERL_MM_USE_DEFAULT=1 perl Makefile.PL INSTALLDIRS=vendor

diff --git a/acl.yaml b/acl.yaml
@@ -17,7 +17,6 @@ environment:
       - ca-certificates-bundle
       - gettext-dev
       - libtool
-      - openssf-compiler-options
       - wolfi-base
 
 pipeline:

diff --git a/aerospike-7.yaml b/aerospike-7.yaml
@@ -1,6 +1,6 @@
 package:
   name: aerospike-7
-  version: 7.2.0.4
+  version: 7.2.0.6
   epoch: 0
   description: Aerospike Database Server - flash-optimized, in-memory, nosql database
   copyright:
@@ -27,9 +27,9 @@ pipeline:
     with:
       repository: https://github.com/aerospike/aerospike-server
       tag: ${{package.version}}
-      expected-commit: c77b2417c8c112cdbb0d74341329fcfe328104e2
+      expected-commit: b4783b5bbd6f53dfcb768169c210e2103b6a0657
 
-  - runs: git submodule update --init
+  - runs: git submodule update --force --recursive --init --remote
 
   - runs: |
       # There's some OS detection that doesn't know about wolfi and gets the wrong path

diff --git a/aerospike.yaml b/aerospike.yaml
@@ -1,6 +1,6 @@
 package:
   name: aerospike
-  version: 6.4.0.27
+  version: 6.4.0.28
   epoch: 0
   description: Aerospike Database Server - flash-optimized, in-memory, nosql database
   copyright:
@@ -19,7 +19,6 @@ environment:
       - coreutils
       - gmp-dev
       - libtool
-      - openssf-compiler-options
       - openssl-dev
       - zlib-dev
 
@@ -28,7 +27,7 @@ pipeline:
     with:
       repository: https://github.com/aerospike/aerospike-server
       tag: ${{package.version}}
-      expected-commit: cd6c78afb8960a357039921429886b90c095675d
+      expected-commit: 57a70b0aaae44d9a95f0514b030b82c41424a3bd
 
   - runs: git submodule update --init
 

diff --git a/airflow.yaml b/airflow.yaml
@@ -1,7 +1,7 @@
 package:
   name: airflow
   version: 2.10.4
-  epoch: 1
+  epoch: 2
   description: Platform to programmatically author, schedule, and monitor workflows
   options:
     #  There is a dependency on libarrow.so although it
@@ -23,7 +23,6 @@ environment:
       - mariadb-connector-c-dev
       - mariadb-dev
       - nodejs
-      - openssf-compiler-options
       - pkgconf-dev
       - postgresql-dev
       - py3-pip

diff --git a/alsa-lib.yaml b/alsa-lib.yaml
@@ -16,7 +16,6 @@ environment:
       - ca-certificates-bundle
       - libtool
       - linux-headers
-      - openssf-compiler-options
 
 pipeline:
   - uses: git-checkout

diff --git a/amazon-k8s-cni.yaml b/amazon-k8s-cni.yaml
@@ -1,7 +1,7 @@
 package:
   name: amazon-k8s-cni
-  version: 1.19.0
-  epoch: 1
+  version: 1.19.2
+  epoch: 0
   description: Networking plugin repository for pod networking in Kubernetes using Elastic Network Interfaces on AWS
   copyright:
     - license: Apache-2.0
@@ -22,7 +22,7 @@ pipeline:
     with:
       repository: https://github.com/aws/amazon-vpc-cni-k8s
       tag: v${{package.version}}
-      expected-commit: edf5738a1b3db4e554e38d43090421cd0c60d353
+      expected-commit: 847372a017457306cf7d14c65094c1cdc70f8971
 
   - name: Copy conflist
     runs: |

diff --git a/aom.yaml b/aom.yaml
@@ -21,7 +21,6 @@ environment:
       - cmake
       # gcc-14 hits ICE on arm64
       - gcc~13
-      - openssf-compiler-options
       - perl
       - samurai
       - tree

diff --git a/apache-arrow.yaml b/apache-arrow.yaml
@@ -41,7 +41,6 @@ environment:
       - libprotoc
       - libzstd1
       - lz4-dev
-      - openssf-compiler-options
       - openssl-dev
       - protobuf
       - protobuf-dev

diff --git a/apache-nifi.yaml b/apache-nifi.yaml
@@ -1,7 +1,7 @@
 package:
   name: apache-nifi
   version: 2.1.0
-  epoch: 0
+  epoch: 1
   description: Apache NiFi is an easy to use, powerful, and reliable system to process and distribute data.
   copyright:
     - license: Apache-2.0
@@ -30,7 +30,6 @@ environment:
       - nodejs-20
       - npm
       - openjdk-21-default-jdk
-      - openssf-compiler-options
       - openssl-dev
       - rsync
   environment:

diff --git a/apache-nifi/pombump-deps.yaml b/apache-nifi/pombump-deps.yaml
@@ -5,3 +5,6 @@ patches:
     - groupId: spring-ldap-core
       artifactId: spring-ldap-core
       version: 3.2.8
+    - groupId: org.apache.mina
+      artifactId: mina-core
+      version: 2.2.4
diff --git a/apache-orc.yaml b/apache-orc.yaml
@@ -12,7 +12,6 @@ environment:
       - build-base
       - cmake
       - lz4-dev
-      - openssf-compiler-options
       - protobuf-dev
       - samurai
       - snappy-dev

diff --git a/apache-tika-3.0.yaml b/apache-tika-3.0.yaml
@@ -1,13 +1,14 @@
 package:
   name: apache-tika-3.0
   version: 3.0.0
-  epoch: 1
+  epoch: 3
   description: The Apache Tika toolkit detects and extracts metadata and text from over a thousand different file types (such as PPT, XLS, and PDF).
   copyright:
     - license: Apache-2.0
   dependencies:
     runtime:
-      - openjdk-17-jre
+      - dash-binsh
+      - openjdk-17-default-jvm
     provides:
       - apache-tika=${{package.full-version}}
 
@@ -33,11 +34,6 @@ pipeline:
       tag: ${{package.version}}
       expected-commit: 9bcb38d6734ed9d5dcff617f316c535e844c68d1
 
-  - uses: maven/pombump
-    with:
-      patch-file: patches.yaml
-      pom: tika-parent/pom.xml
-
   - runs: |
       mvn clean install -am -DskipTests -Dossindex.skip
       mkdir -p "${{targets.contextdir}}"/usr/share/java/
@@ -49,7 +45,7 @@ subpackages:
     pipeline:
       - runs: |
           mkdir -p "${{targets.subpkgdir}}"
-          ln -sf /usr/share/java/tika-server-standard-${{package.version}}.jar ${{targets.subpkgdir}}/tika-server-standard-${{package.version}}.jar
+          ln -sf /usr/share/java/tika-server-standard-${{package.version}}.jar ${{targets.subpkgdir}}/tika-server-standard.jar
 
 update:
   enabled: true
@@ -64,12 +60,12 @@ test:
       packages:
         - curl
         - ${{package.name}}-compat
+        - openjdk-17-default-jvm
   pipeline:
     - name: "start server and verify endpoint"
       runs: |
-        TIKA_JAR=$(ls /tika-server-standard-*.jar 2>/dev/null | head -n 1)
         (
-          java -jar /tika-server-standard-3.0.0.jar &
+        java -jar /tika-server-standard.jar &
         ) && \
         sleep 2 && \
         curl -s http://localhost:9998/ | \
-Original file line number
+Diff line change
@@ Expand Up / @@ -9,6 +9,7 @@ dag.svg @@
     .melange.k8s.yaml
     packages.log
     *.iml
+    *.apk
     APKINDEX.tar.gz
     # macOS
@@ Expand Down @@
Original file line number	Diff line number	Diff line change
Expand Up		@@ -3,3 +3,4 @@ CODEOWNERS @wolfi-dev/wolfi-owners

		# These packages require approval from the Foundations squad.
		openssh.yaml @wolfi-dev/foundations-squad
		ca-certificates.yaml @wolfi-dev/foundations-squad