Accepting request 792297 from GNOME:Factory

OBS-URL: https://build.opensuse.org/request/show/792297
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/flatpak?expand=0&rev=43

_service

@@ -4,7 +4,7 @@
     <param name="url">https://github.com/flatpak/flatpak.git</param>
     <param name="scm">git</param>
     <param name="versionformat">@PARENT_TAG@</param>
-    <param name="revision">refs/tags/1.6.2</param>
+    <param name="revision">refs/tags/1.6.3</param>
   </service>
   <service name="recompress" mode="disabled">
     <param name="file">*.tar</param>

flatpak-1.6.2.tar.xz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:fe43896823f57af6e0c66c7d7006a4ff96443e169cdd791713fb5168dc96c15d
-size 990260

flatpak-1.6.3.tar.xz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:4757a3d7cdb938d5bf9ad04b662dd7d0915abbedf75cbaff5a1a34654ab01503
+size 991932

flatpak.changes

@@ -1,3 +1,24 @@
+-------------------------------------------------------------------
+Mon Apr  6 14:31:20 UTC 2020 - Antonio Larrosa <alarrosa@suse.com>
+
+- Require bubblewrap 0.4.1
+
+-------------------------------------------------------------------
+Mon Apr  6 09:32:31 UTC 2020 - Antonio Larrosa <alarrosa@suse.com>
+
+- Update to version 1.6.3:
+  + The main change in this version is a fix for a regression in
+    the progress calculation for applications using extra-data.
+    Additionally the bundled version of bubblewrap is updated to
+    0.4.1 which fixes a security issue in some cases. See
+    GHSA-j2qp-rvxj-43vj for details.
+  + Don't break if users primary gid is not in the nsswitch
+    database
+  + Fix crash in flatpak repair if no remotes are configured
+  + Some updates to the oci authenticator
+  + Retry downloads of extra data
+  + Updated translations.
+
 -------------------------------------------------------------------
 Sun Feb 16 17:22:44 UTC 2020 - Bjørn Lie <bjorn.lie@gmail.com>
 
@@ -7,17 +28,20 @@ Sun Feb 16 17:22:44 UTC 2020 - Bjørn Lie <bjorn.lie@gmail.com>
 Thu Feb 13 15:57:51 UTC 2020 - Antonio Larrosa <alarrosa@suse.com>
 
 - Update to version 1.6.2:
-  + Due to a combination of some behaviour in flatpak and recent versions of
+  + Due to a combination of some behaviour in flatpak and recent
-    ostree we at some point lost the use of deltas for the initial install
+    versions of ostree we at some point lost the use of deltas for
-    case, instead always falling back to a full ostree operation which is
+    the initial install case, instead always falling back to a full
-    a lot less efficient for pulls with many small files like a runtime. This
+    ostree operation which is a lot less efficient for pulls with
-    caused some very slow installs from e.g. flathub, so it's recommended to
+    many small files like a runtime. This caused some very slow
-    update to this version to get better install performance.
+    installs from e.g. flathub, so it's recommended to update to
-  + We now correctly handle TMPDIR env var overrides when bwrap is setuid
+    this version to get better install performance.
-  + Disallow running "flatpak run" under sudo (as it doesn't work and causes issues)
+  + We now correctly handle TMPDIR env var overrides when bwrap is
+    setuid
+  + Disallow running "flatpak run" under sudo (as it doesn't work
+    and causes issues)
   + Fix build with older versions of glib
   + Minor documentation updates
-  + Updated translations
+  + Updated translations.
 
 -------------------------------------------------------------------
 Thu Jan 30 16:56:01 UTC 2020 - Antonio Larrosa <alarrosa@suse.com>

flatpak.spec

@@ -32,7 +32,7 @@
 
 %define libname libflatpak0
 Name:           flatpak
-Version:        1.6.2
+Version:        1.6.3
 Release:        0
 Summary:        OSTree based application bundles management
 License:        LGPL-2.1-or-later
@@ -42,7 +42,7 @@ Source0:        %{name}-%{version}.tar.xz
 Source1:        system-user-flatpak.conf
 Patch0:         polkit_rules_usability.patch
 BuildRequires:  bison
-BuildRequires:  bubblewrap >= 0.4.0
+BuildRequires:  bubblewrap >= 0.4.1
 BuildRequires:  docbook-xsl-stylesheets
 BuildRequires:  gtk-doc
 BuildRequires:  intltool >= 0.35.0
@@ -73,7 +73,7 @@ BuildRequires:  pkgconfig(polkit-gobject-1)
 BuildRequires:  pkgconfig(systemd)
 BuildRequires:  pkgconfig(xau)
 Requires:       %{libname} = %{version}
-Requires:       bubblewrap >= 0.4.0
+Requires:       bubblewrap >= 0.4.1
 Requires:       ostree >= 2018.9
 Requires:       xdg-dbus-proxy >= 0.1.0
 Requires:       xdg-desktop-portal >= 0.10