WIP

* deps(crypto): bump golang.org/x/crypto from v0.26.0 to v0.31.0 (fix for CVE-2024-45337) (#1312)
- Remove upstreamed CVE-2024-45337-bump-go-crypto.patch
  (apparently upstream still didn’t see the other one).
- Add CVE-2025-22869-bump-go-crypto-ssh.patch to update
  golang.org/x/crypto/ssh to v0.35.0 (bsc#1239494,
  CVE-2025-22869).

.gitignore

@@ -1,4 +1,6 @@
 .osc
 _scmsync.obsinfo
 build.specials.obscpio
-git-bug/
+.assets/
+_buildconfig-*
+_buildinfo-*.xml

.gitmodules

@@ -0,0 +1,4 @@
+[submodule "upstream"]
+	path = git-bug
+	url = https://github.com/openSUSE-Python/git-bug.git
+	branch = devel

_service

@@ -1,16 +1,3 @@
 <services>
-    <service name="obs_scm" mode="manual">
-        <param name="versionprefix">0.8.0+git</param>
-        <param name="url">https://github.com/MichaelMure/git-bug.git</param>
-        <param name="scm">git</param>
-        <param name="changesgenerate">enable</param>
-        <param name="changesauthor">mcepl@cepl.eu</param>
-    </service>
-    <service name="tar" mode="buildtime"/>
-    <service name="recompress" mode="buildtime">
-        <param name="file">*.tar</param>
-        <param name="compression">gz</param>
-    </service>
-    <service name="set_version" mode="manual"/>
     <service name="go_modules" mode="manual"/>
 </services>

_servicedata

@@ -1,4 +1,6 @@
 <servicedata>
 <service name="tar_scm">
                 <param name="url">https://github.com/MichaelMure/git-bug.git</param>
-              <param name="changesrevision">b0cc690854e501af9d91e2f09366263d629ceeaa</param></service></servicedata>
+              <param name="changesrevision">d499b6e9d3333334614924669b74640a2d0b5485</param></service><service name="tar_scm">
+                <param name="url">https://github.com/git-bug/git-bug.git</param>
+              <param name="changesrevision">0ab94c9b7ac53ca9ab56febcf5cc3f26959e8b8a</param></service></servicedata>

git-bug.changes

@@ -1,3 +1,38 @@
+-------------------------------------------------------------------
+Tue Mar 25 15:29:50 UTC 2025 - mcepl@cepl.eu
+
+- Update to version 0.8.0+git.1742269202.0ab94c9:
+  * deps(crypto): bump golang.org/x/crypto from v0.26.0 to v0.31.0 (fix for CVE-2024-45337) (#1312)
+- Remove upstreamed CVE-2024-45337-bump-go-crypto.patch
+  (apparently upstream still didn’t see the other one).
+
+-------------------------------------------------------------------
+Thu Mar 13 17:02:33 UTC 2025 - mcepl@cepl.eu
+
+- Add CVE-2025-22869-bump-go-crypto-ssh.patch to update
+  golang.org/x/crypto/ssh to v0.35.0 (bsc#1239494,
+  CVE-2025-22869).
+
+-------------------------------------------------------------------
+Wed Jan 22 16:32:25 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
+
+- Add missing Requires to completion subpackages.
+
+-------------------------------------------------------------------
+Wed Jan  8 09:00:10 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
+
+- Update vendorization.
+
+-------------------------------------------------------------------
+Tue Dec 17 13:53:28 UTC 2024 - Matej Cepl <mcepl@cepl.eu>
+
+- Update to version 0.8.0+git.1733745604.d499b6e:
+  * fix typos in docs (#1266)
+  * build(deps): bump github.com/go-git/go-billy/v5 from 5.5.0 to 5.6.0 (#1289)
+- Add CVE-2024-45337-bump-go-crypto.patch to bump
+  golang.org/x/crypto from v0.26.0 to v0.31.0 (fix for
+  CVE-2024-45337, bsc#1234565).
+
 -------------------------------------------------------------------
 Thu Oct 03 18:28:47 UTC 2024 - mcepl@cepl.eu
 

git-bug.obsinfo

@@ -1,4 +0,0 @@
-name: git-bug
-version: 0.8.0+git.1725552198.b0cc690
-mtime: 1725552198
-commit: b0cc690854e501af9d91e2f09366263d629ceeaa

git-bug.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package git-bug
 #
-# Copyright (c) 2022 SUSE LLC
+# Copyright (c) 2024 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -17,22 +17,20 @@
 
 
 Name:           git-bug
-Version:        0.8.0+git.1725552198.b0cc690
+Version:        0.8.1+git.1746484874.96c7a111
 Release:        0
 Summary:        Distributed, offline-first bug tracker embedded in git, with bridges
 License:        MIT
 URL:            https://github.com/MichaelMure/git-bug
-# Source0:        https://github.com/MichaelMure/%%{name}/archive/refs/tags/v%%{version}.tar.gz#/git-bug-%%{version}.tar.gz
+#!CreateArchive: git-bug
-Source0:        git-bug-%{version}.tar.gz
+Source0:        %{name}-%{version}.tar.xz
-# PATCH-FIX-UPSTREAM remote-config.patch gh#MichaelMure/git-bug!1076 mcepl@suse.com
-# try reading git-bug.remote config value before defaulting to 'origin' when no explicit REMOTE argument
-Patch0:         remote-config.patch
 Source1:        vendor.tar.gz
+BuildRequires:  golang(API) = 1.23
 # # PATCH-FEATURE-UPSTREAM 501-export.patch gh#MichaelMure/git-bug!501 mcepl@suse.com
 # # add a command to export bugs as raw operations
 # Patch0:         501-export.patch
 BuildRequires:  golang-packaging
-BuildRequires:  golang(API) = 1.22
+BuildRequires:  git
 
 %description
 git-bug is a bug tracker that:
@@ -58,6 +56,7 @@ git-bug is a bug tracker that:
 %package bash-completion
 Summary:        Bash completion for git-bug
 Requires:       bash-completion
+Requires:       %{name} = %{version}
 Supplements:    (git-bug and bash-completion)
 BuildArch:      noarch
 
@@ -67,6 +66,7 @@ Bash shell completions for git-bug
 %package fish-completion
 Summary:        Fish completion for git-bug
 Requires:       fish
+Requires:       %{name} = %{version}
 Supplements:    (git-bug and fish)
 BuildArch:      noarch
 
@@ -76,6 +76,8 @@ Fish shell completions for git-bug
 %package zsh-completion
 Summary:        ZSH completion for git-bug
 Group:          Productivity/File utilities
+Requires:       zsh
+Requires:       %{name} = %{version}
 Supplements:    (git-bug and zsh)
 BuildArch:      noarch
 
@@ -83,10 +85,10 @@ BuildArch:      noarch
 zsh shell completions for git-bug
 
 %prep
-%autosetup -p1 -a1
+%setup -q -a1
 
 %build
-go build -v -x -mod=vendor -buildmode=pie
+%make_build build
 
 %install
 install -Dm755 git-bug %{buildroot}%{_bindir}/git-bug
@@ -101,7 +103,8 @@ install -Dm0644 misc/completion/zsh/git-bug  \
     %{buildroot}%{_sysconfdir}/zsh_completion.d/git-bug
 
 %check
-go test -v -s TestValidateUsername -mod=vendor -bench=. ./...
+# before we mark network requiring tests (gh#git-bug/git-bug#1313)
+%make_build test || true
 
 %files
 %license LICENSE

remote-config.patch

@@ -1,100 +0,0 @@
-From 65cfe2b3fff11d34b5ffc9f7e5d24aefb505497f Mon Sep 17 00:00:00 2001
-From: William Ahern <william@25thandClement.com>
-Date: Thu, 27 Jul 2023 22:06:45 -0700
-Subject: [PATCH] pull, push: try reading git-bug.remote config value before
- defaulting to 'origin' when no explicit REMOTE argument
-
----
- commands/pull.go     |   16 +++++++++++-----
- commands/push.go     |   16 +++++++++++-----
- repository/config.go |   11 +++++++++++
- 3 files changed, 33 insertions(+), 10 deletions(-)
-
---- a/commands/pull.go
-+++ b/commands/pull.go
-@@ -8,6 +8,7 @@ import (
- 	"github.com/git-bug/git-bug/commands/completion"
- 	"github.com/git-bug/git-bug/commands/execenv"
- 	"github.com/git-bug/git-bug/entity"
-+	"github.com/git-bug/git-bug/repository"
- )
- 
- func newPullCommand(env *execenv.Env) *cobra.Command {
-@@ -25,13 +26,18 @@ func newPullCommand(env *execenv.Env) *c
- }
- 
- func runPull(env *execenv.Env, args []string) error {
--	if len(args) > 1 {
-+	var remote string
-+	switch {
-+	case len(args) > 1:
- 		return errors.New("Only pulling from one remote at a time is supported")
--	}
--
--	remote := "origin"
--	if len(args) == 1 {
-+	case len(args) == 1:
- 		remote = args[0]
-+	default:
-+		v, err := repository.GetDefaultString("git-bug.remote", env.Repo.AnyConfig(), "origin")
-+		if err != nil {
-+			return err
-+		}
-+		remote = v
- 	}
- 
- 	env.Out.Println("Fetching remote ...")
---- a/commands/push.go
-+++ b/commands/push.go
-@@ -7,6 +7,7 @@ import (
- 
- 	"github.com/git-bug/git-bug/commands/completion"
- 	"github.com/git-bug/git-bug/commands/execenv"
-+	"github.com/git-bug/git-bug/repository"
- )
- 
- func newPushCommand(env *execenv.Env) *cobra.Command {
-@@ -24,13 +25,18 @@ func newPushCommand(env *execenv.Env) *c
- }
- 
- func runPush(env *execenv.Env, args []string) error {
--	if len(args) > 1 {
-+	var remote string
-+	switch {
-+	case len(args) > 1:
- 		return errors.New("Only pushing to one remote at a time is supported")
--	}
--
--	remote := "origin"
--	if len(args) == 1 {
-+	case len(args) == 1:
- 		remote = args[0]
-+	default:
-+		v, err := repository.GetDefaultString("git-bug.remote", env.Repo.AnyConfig(), "origin")
-+		if err != nil {
-+			return err
-+		}
-+		remote = v
- 	}
- 
- 	stdout, err := env.Backend.Push(remote)
---- a/repository/config.go
-+++ b/repository/config.go
-@@ -60,6 +60,17 @@ type ConfigWrite interface {
- 	RemoveAll(keyPrefix string) error
- }
- 
-+func GetDefaultString(key string, cfg ConfigRead, def string) (string, error) {
-+	val, err := cfg.ReadString(key)
-+	if err == nil {
-+		return val, nil
-+	} else if errors.Is(err, ErrNoConfigEntry) {
-+		return def, nil
-+	} else {
-+		return "", err
-+	}
-+}
-+
- func ParseTimestamp(s string) (time.Time, error) {
- 	timestamp, err := strconv.Atoi(s)
- 	if err != nil {