spire-server/1.10.2 package update

[octo-sts]

[github-actions]

Package spire-server: Click to expand/collapse

Package spire-server:
Modified: /usr/bin/spire-server

Package spire-agent: Click to expand/collapse

Package spire-agent:
Modified: /usr/bin/spire-agent

Package spire-oidc-discovery-provider: Click to expand/collapse

Package spire-oidc-discovery-provider:
Modified: /usr/bin/oidc-discovery-provider

bincapz found differences: Click to expand/collapse

Deleted: spire-agent/var/lib/db/sbom/spire-agent-1.10.1-r0.spdx.json [⚠️ MEDIUM]

RISK	KEY	DESCRIPTION	EVIDENCE
-MEDIUM	net/download	download files	downloadLocation
-MEDIUM	ref/words/agent	references an 'agent'	agent
-LOW	ref/site/url	contains embedded HTTPS URLs	https://spdx.org/spdxdocs/chainguard/melange/fdadb449d9fc02b7e37880b860e1

Deleted: spire-oidc-discovery-provider/var/lib/db/sbom/spire-oidc-discovery-provider-1.10.1-r0.spdx.json [⚠️ MEDIUM]

RISK	KEY	DESCRIPTION	EVIDENCE
-MEDIUM	net/download	download files	downloadLocation
-LOW	ref/site/url	contains embedded HTTPS URLs	https://spdx.org/spdxdocs/chainguard/melange/8a3a17252b7965f4801f3d215ae2

Added: spire-agent/var/lib/db/sbom/spire-agent-1.10.2-r0.spdx.json [⚠️ MEDIUM]

RISK	KEY	DESCRIPTION	EVIDENCE
+MEDIUM	net/download	download files	downloadLocation
+MEDIUM	ref/words/agent	references an 'agent'	agent
+LOW	ref/site/url	contains embedded HTTPS URLs	https://spdx.org/spdxdocs/chainguard/melange/21cb9a1e2fed5d9f6b7e090ec9e6

Added: spire-oidc-discovery-provider/var/lib/db/sbom/spire-oidc-discovery-provider-1.10.2-r0.spdx.json [⚠️ MEDIUM]

RISK	KEY	DESCRIPTION	EVIDENCE
+MEDIUM	net/download	download files	downloadLocation
+LOW	ref/site/url	contains embedded HTTPS URLs	https://spdx.org/spdxdocs/chainguard/melange/baf3875cc9a44bb03c02f147ce16

Moved: spire-server/var/lib/db/sbom/spire-server-1.10.1-r0.spdx.json -> /tmp/wolfictl-apk-1106133937/spire-server/var/lib/db/sbom/spire-server-1.10.2-r0.spdx.json (similarity: 0.99)

[philroche]

Changes summay:
Total files changed: 292

Total changes: 13621
Total additions: 7739
Total deletions: 5882

Total commits: 51

• Bump docker/setup-qemu-action from 3.1.0 to 3.2.0 (feat: upgrade version of perl-libwww #5321)

  dependabot[bot] (49699333+dependabot[bot]@users.noreply.github.com) @ 2024-07-29T13:15:42Z

• Bump github.com/go-jose/go-jose/v4 from 4.0.2 to 4.0.4 (Fix lua-rest-ipmatcher package. #5336)

  dependabot[bot] (49699333+dependabot[bot]@users.noreply.github.com) @ 2024-07-29T13:57:45Z

• Bump msys2/setup-msys2 from 2.23.0 to 2.24.0 (Run strip for modsecurity #5337)

  dependabot[bot] (49699333+dependabot[bot]@users.noreply.github.com) @ 2024-07-29T14:33:23Z

• Bump github.com/aws/aws-sdk-go-v2/service/ec2 in the aws-sdk group (eslint/8.49.0 package update #5333)

  dependabot[bot] (49699333+dependabot[bot]@users.noreply.github.com) @ 2024-07-30T13:33:37Z

• [aws_iid] tolerate network interfaces not being ordered by device index (Add pgbouncer package. #5300)

  James Ribe (manbeardo@gmail.com) @ 2024-07-30T18:00:00Z

• Bump SPIRE v1.10.2 (remove empty runtime dependencies - batch 2 #5347)

  Marcos Yacob (marcos.yacob@hpe.com) @ 2024-08-03T13:39:32Z

• Update ITs to use docker v2 (py3-python-lsp-jsonrpc/1.1.1 package update #5353)

  Marcos Yacob (marcos.yacob@hpe.com) @ 2024-08-04T04:00:57Z

• added AccuKnox as adopter (Fixing epoch bump #5326)

  Rahul Jadhav (nyrahul@gmail.com) @ 2024-08-04T04:36:49Z

• Bump google.golang.org/api from 0.189.0 to 0.190.0 (remove empty runtimes - batch 4 #5350)

  dependabot[bot] (49699333+dependabot[bot]@users.noreply.github.com) @ 2024-08-04T11:45:30Z

• Bump github.com/open-policy-agent/opa from 0.66.0 to 0.67.0 (libmcrypt-2.5.8: Add new package #5334)

  dependabot[bot] (49699333+dependabot[bot]@users.noreply.github.com) @ 2024-08-04T12:14:16Z

• Bump github.com/lestrrat-go/jwx/v2 from 2.1.0 to 2.1.1 (zarf/0.29.2 package update #5338)

  dependabot[bot] (49699333+dependabot[bot]@users.noreply.github.com) @ 2024-08-04T12:54:56Z

• Bump github.com/aws/aws-sdk-go-v2/service/rolesanywhere (ruby3.2-activesupport/7.0.8 package update #5344)

  dependabot[bot] (49699333+dependabot[bot]@users.noreply.github.com) @ 2024-08-04T13:48:26Z

• Propogate SQLTransactionTimeout (Clean up obsolete / unnecesary github actions #5345)

  Faisal Memon (fymemon@yahoo.com) @ 2024-08-04T14:15:08Z

• Bump docker/setup-buildx-action from 3.5.0 to 3.6.1 (vim/9.0.1888 package update #5339)

  dependabot[bot] (49699333+dependabot[bot]@users.noreply.github.com) @ 2024-08-04T21:45:45Z

• add SVID check to agent health check (jenkins/2.422 package update #5298)

  James Ribe (manbeardo@gmail.com) @ 2024-08-05T01:01:24Z

• Add http node attestor (Install missing package conda-package-handling. #4909)

  kfox1111 (Kevin.Fox@pnnl.gov) @ 2024-08-06T03:37:45Z

• Bump golang:1.22.3-alpine3.18 to golang:1.22.4-alpine3.20 (Split the stunnel docs further to reduce size. #5361)

  y1nhui (44086018+zzy2210@users.noreply.github.com) @ 2024-08-07T02:30:58Z

• Upgrade to go1.22.6 (Add dev package to datadog-cpp #5362)

  Andrew Harding (azdagron@gmail.com) @ 2024-08-07T11:59:37Z

• Bump github.com/sigstore/cosign/v2 from 2.2.4 to 2.4.0 (timoni/0.13.1 package update #5364)

  dependabot[bot] (49699333+dependabot[bot]@users.noreply.github.com) @ 2024-08-07T13:59:28Z

• Bump github.com/google/go-containerregistry from 0.20.1 to 0.20.2 (wolfi-bot/py3-asynctest #5365)

  dependabot[bot] (49699333+dependabot[bot]@users.noreply.github.com) @ 2024-08-08T19:46:20Z

• Bump golang.org/x/sys from 0.22.0 to 0.24.0 (wolfictl/0.3.0 package update #5369)

  dependabot[bot] (49699333+dependabot[bot]@users.noreply.github.com) @ 2024-08-09T12:59:52Z

• Bump github.com/open-policy-agent/opa from 0.67.0 to 0.67.1 (vulkan-headers/1.3.264 package update #5357)

  dependabot[bot] (49699333+dependabot[bot]@users.noreply.github.com) @ 2024-08-10T12:36:38Z

• Bump golang.org/x/time from 0.5.0 to 0.6.0 (fix runtime deps #5358)

  dependabot[bot] (49699333+dependabot[bot]@users.noreply.github.com) @ 2024-08-10T13:19:29Z

• Bump msys2/setup-msys2 from 2.24.0 to 2.24.1 (Update images digests #5355)

  dependabot[bot] (49699333+dependabot[bot]@users.noreply.github.com) @ 2024-08-10T14:37:23Z

• Bump actions/upload-artifact from 4.3.4 to 4.3.6 (vim/9.0.1893 package update #5363)

  dependabot[bot] (49699333+dependabot[bot]@users.noreply.github.com) @ 2024-08-10T15:21:17Z

• Bump golang.org/x/net from 0.27.0 to 0.28.0 (vim/9.0.1894 package update #5366)

  dependabot[bot] (49699333+dependabot[bot]@users.noreply.github.com) @ 2024-08-10T21:42:21Z

• Bump github.com/aws/aws-sdk-go-v2/service/ec2 in the aws-sdk group (Add php-8.1-pecl-mongodb, and php-8.1-pecl-mongodb v1.16.2 #5373)

  dependabot[bot] (49699333+dependabot[bot]@users.noreply.github.com) @ 2024-08-10T22:52:43Z

• Bump github.com/Azure/azure-sdk-for-go/sdk/azcore in the azure-sdk group (remove unused CI workflows #5374)

  dependabot[bot] (49699333+dependabot[bot]@users.noreply.github.com) @ 2024-08-11T04:49:28Z

• Bump sigstore/cosign-installer from 3.5.0 to 3.6.0 (fix cve GHSA-jm77-qphf-c4w8 #5367)

  dependabot[bot] (49699333+dependabot[bot]@users.noreply.github.com) @ 2024-08-11T12:31:48Z

• SVID count update (ingress-nginx-controller/1.8.2 package update #5352)

  Federico Nahuel Quijada (63385953+FedeNQ@users.noreply.github.com) @ 2024-08-12T20:59:00Z

• Allow DelegatedIdentity API clients to subscribe by PID (jq: migrate to jqlang/jq and update to 1.7 #5272)

  Ben Leggett (854255+bleggett@users.noreply.github.com) @ 2024-08-14T14:20:32Z

• unix attestor: fix discover_workload_path on mac os (kots/1.102.1 package update #5324)

  Sorin Dumitru (sdumitru@bloomberg.net) @ 2024-08-15T12:23:35Z

• Bump google.golang.org/api from 0.190.0 to 0.192.0 (add initial batch of neovim dependencies #5385)

  dependabot[bot] (49699333+dependabot[bot]@users.noreply.github.com) @ 2024-08-15T14:01:01Z

• Upgrade to go1.23 (docker-credential-gcr/2.1.16 package update #5384)

  Andrew Harding (azdagron@gmail.com) @ 2024-08-15T20:31:59Z

• Add taint upstream authority (py3-botocore/1.31.44 package update #5340)

  Marcos Yacob (marcos.yacob@hpe.com) @ 2024-08-16T14:28:38Z

• Address flake in spire-server-cli CI (ruff/0.0.288 package update #5396)

  amoore877 (11066940+amoore877@users.noreply.github.com) @ 2024-08-18T03:04:49Z

• Bump github.com/gofrs/uuid/v5 from 5.2.0 to 5.3.0 (Update cosign.yaml #5376)

  dependabot[bot] (49699333+dependabot[bot]@users.noreply.github.com) @ 2024-08-18T04:06:43Z

• Bump github.com/aws/smithy-go from 1.20.3 to 1.20.4 (sqlite/3.43.1 new package update #5391)

  dependabot[bot] (49699333+dependabot[bot]@users.noreply.github.com) @ 2024-08-18T12:09:32Z

• Bump github.com/docker/docker ([Wolfi Package Request]: neovim #5381)

  dependabot[bot] (49699333+dependabot[bot]@users.noreply.github.com) @ 2024-08-18T13:55:07Z

• Bump the aws-sdk group across 1 directory with 3 updates (wolfi-bot/libxft #5392)

  dependabot[bot] (49699333+dependabot[bot]@users.noreply.github.com) @ 2024-08-18T15:00:34Z

• Document some missing configuration items (wolfi-bot/ipvsadm #5393)

  Sorin Dumitru (sdumitru@bloomberg.net) @ 2024-08-19T12:07:02Z

• Bump github.com/envoyproxy/go-control-plane from 0.12.0 to 0.13.0 (vulkan-loader/1.3.264 package update #5406)

  dependabot[bot] (49699333+dependabot[bot]@users.noreply.github.com) @ 2024-08-20T13:05:54Z

• Refactor and Enhance Sigstore Attestor (jaeger-agent/1.49.0 package update #5255)

  Max Lambrecht (maxlambrecht@gmail.com) @ 2024-08-20T13:28:23Z

• Add comments to events based cache code (harfbuzz/8.2.0 package update #5327)

  Faisal Memon (fymemon@yahoo.com) @ 2024-08-20T13:57:54Z

• Remove list of CI (Add Python xmlsec wheel (py3-xmlsec) #5388)

  amoore877 (11066940+amoore877@users.noreply.github.com) @ 2024-08-20T14:37:47Z

• Allow enabling the LocalAuthority API through the forced_rotation fflag (remove packages.log #5399)

  Agustín Martínez Fayó (amartinezfayo@gmail.com) @ 2024-08-20T16:55:25Z

• Introduce support to localauthority CLI - x509 show (Remove packages.log. #5400)

  Agustín Martínez Fayó (amartinezfayo@gmail.com) @ 2024-08-21T14:56:56Z

• Clean up httpchallenge agent config (ruby3.2-async-io/1.36.0 package update #5413)

  Andrew Harding (azdagron@gmail.com) @ 2024-08-21T21:21:38Z

• Add localauthority jwt show command to the server (new package: pstack 2.4 #5412)

  Agustín Martínez Fayó (amartinezfayo@gmail.com) @ 2024-08-22T22:44:06Z

• Add gauge metrics to track missedEvents and cache sizes (adds gsl package #5411)

  Steven Dang (77849329+stevend-uber@users.noreply.github.com) @ 2024-08-27T19:37:03Z

• Add CHANGELOG for 1.10.2 (terragrunt/0.50.15 package update #5449)

  Marcos Yacob (marcos.yacob@hpe.com) @ 2024-09-03T13:09:47Z

GitHub compare URL: spiffe/spire@a38f056...6ba4d56

[philroche]

This is a patch version bump.

All checks pass.