Sync from SUSE:SLFO:Main sevctl revision 5d0bd6529ed5635dc2bc8c6cf72341b4

_service

@@ -18,13 +18,9 @@
     <param name="compression">xz</param>
   </service>
 
-  <service name="cargo_audit" mode="disabled">
-    <param name="srcdir">sevctl</param>
-  </service>
-
   <service name="cargo_vendor" mode="disabled">
     <param name="srcdir">sevctl</param>
     <param name="compression">xz</param>
-    <param name="update">false</param>
+    <param name="update">true</param>
   </service>
 </services>

cargo_config

@@ -1,5 +0,0 @@
-[source.crates-io]
-replace-with = "vendored-sources"
-
-[source.vendored-sources]
-directory = "vendor"

sevctl.changes

@@ -1,3 +1,18 @@
+-------------------------------------------------------------------
+Fri Sep 13 05:22:44 UTC 2024 - Caleb Crane <caleb.crane@suse.com>
+
+- Update vendored dependencies and re-enable cargo update obs service (bsc#1229953)
+- Service: Remove deprecated cargo_config and cargo_audit services, both
+are now handled by the cargo_vendor services
+
+-------------------------------------------------------------------
+Wed Jan 24 15:22:20 UTC 2024 - Caleb Crane <caleb.crane@suse.com>
+
+- Fix CVE-2023-50711: vmm-sys-util: out of bounds memory accesses (bsc#1218502, bsc#1218499)
+  - Upgrade vendored dependencies, namely vmm-sys-utils > 0.12.0
+- spec: Switch back to greedy cargo updates of vendored dependencies. This CVE was multiple
+  levels deep in the dependency tree and only fixed with the more agressive cargo update strategy
+
 -------------------------------------------------------------------
 Wed Sep 13 14:42:56 UTC 2023 - Caleb Crane <caleb.crane@suse.com>
 

sevctl.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package sevctl
 #
-# Copyright (c) 2023 SUSE LLC
+# Copyright (c) 2024 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -25,7 +25,6 @@ License:        Apache-2.0
 URL:            https://github.com/virtee/sevctl
 Source0:        %{name}-%{version}.tar.xz
 Source1:        vendor.tar.xz
-Source2:        cargo_config
 BuildRequires:  cargo-packaging
 BuildRequires:  libopenssl-devel
 BuildRequires:  rubygem(asciidoctor)
@@ -40,8 +39,6 @@ Administrative utility for AMD SEV
 
 %prep
 %autosetup -a1
-mkdir .cargo
-cp %{SOURCE2} .cargo/config
 
 %build
 %{cargo_build}