From e96ec3c7a5ffcf609bd9f107a9f1d55e320c4897 Mon Sep 17 00:00:00 2001 From: wolfi-bot <121097084+wolfi-bot@users.noreply.github.com> Date: Fri, 30 Jun 2023 23:07:32 +0000 Subject: [PATCH 1/2] melange/0.4.0 package update --- melange.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/melange.yaml b/melange.yaml index e1b87b079f35..65009b21dcbf 100644 --- a/melange.yaml +++ b/melange.yaml @@ -1,8 +1,8 @@ package: name: melange # When bumping the version check if the CVE/GHSA mitigations below can be removed. - version: 0.3.2 - epoch: 3 + version: 0.4.0 + epoch: 0 description: build APKs from source code copyright: - license: Apache-2.0 @@ -24,7 +24,7 @@ pipeline: with: repository: https://github.com/chainguard-dev/melange tag: v${{package.version}} - expected-commit: 4ed1d07ef6955379e936cf237f8dfec382454f47 + expected-commit: 784821d3ac46eef8d7b3a329f1e8c25488e62635 destination: melange - runs: | From 2c2ed634d0d76d2646cc55fe0a8fde66c674ec86 Mon Sep 17 00:00:00 2001 From: Ajay Kemparaj Date: Fri, 30 Jun 2023 18:58:18 -0700 Subject: [PATCH 2/2] Update melange.yaml remove cve fixes for melange as its addressed in upstream now Signed-off-by: Ajay Kemparaj --- melange.yaml | 6 ------ 1 file changed, 6 deletions(-) diff --git a/melange.yaml b/melange.yaml index 65009b21dcbf..bcf2ff744a04 100644 --- a/melange.yaml +++ b/melange.yaml @@ -29,12 +29,6 @@ pipeline: - runs: | cd melange - - # Mitigate GHSA-232p-vwff-86mp - # Mitigate GHSA-33pg-m6jh-5237 - # Mitigate GHSA-6wrf-mxfj-pf5p - go get github.com/docker/docker@v23.0.3+incompatible - make melange install -m755 -D ./melange "${{targets.destdir}}"/usr/bin/melange