Merge branch 'leap-16.0' into PR_lutris#1

PR: products/PackageHub!183

.gitea/workflows/patchinfo_numberator.yaml

@@ -1,37 +1,35 @@
 # Use this as .gitea/workflows/patchinfo_numberator.yaml in all products/* repos
-name: Patchinfo ID numberator
-run-name: ${{ gitea.actor }} is setting patchinfo numbers
-on: [push]
+name: Patchinfo incident numbering
+
+on:
+  push:
+  workflow_dispatch:
+
+env:
+  REPO_PATH: /workspace/${{ gitea.repository }}
+  REPO_URL: https://gitea-actions-autobuild:${{ secrets.REPO_WRITE }}@$RUNNER_GITEA_DOMAIN/${{ gitea.repository }}.git
 
 jobs:
   use-go-action:
-    runs-on: tumbleweed
+    runs-on: tumbleweed_autobuild
     steps:
-      # Install packages if not provided by image
-      - run: |
-          rpm -q go && exit 0
-          zypper ref
-          zypper in -y go
-      # Generic action from GitHub to clone the product git repo
+
       - name: Checkout product
-        uses: https://gitea-actions-autobuild:${{ secrets.REPO_READ }}@src.opensuse.org/actions/github-actions-checkout@v4
-        with:
-          token: ${{ secrets.REPO_WRITE }}
-          repo-sha256: true
+        run: |
+          test -n "${{ env.REPO_PATH }}" && rm -rfv "${{ env.REPO_PATH }}"/*
+          git config --global --add safe.directory ${{ env.REPO_PATH }}
+          git clone ${{ env.REPO_URL }} ${{ env.REPO_PATH }}
 
       - name: Update all new _patchinfo files
-        uses: https://gitea-actions-autobuild:${{ secrets.REPO_READ }}@src.opensuse.org/actions/patchinfo-numbering-action@v0
-      - name: Get last commit author
-        id: last-commit
-        run: |
-          echo "author=$(git log -1 --pretty='%an <%ae>')" >> $GITHUB_OUTPUT
-      - name: Commit changes back
-        uses: https://gitea-actions-autobuild:${{ secrets.REPO_READ }}@src.opensuse.org/actions/stefanzweifel-git-auto-commit-action@v5
+        uses: https://src.opensuse.org/actions/patchinfo-numbering-action@v0
+        with:
+          prefix: packagehub-
+
+      - name: Commit changes
+        uses: https://src.opensuse.org/actions/stefanzweifel-git-auto-commit-action@v5
         with:
           commit_user_name: gitea-actions-autobuild
-          commit_user_email: autobuild+gitea@opensuse.org
-          commit_author: ${{ steps.last-commit.outputs.author }}
-          commit_message: "Update incident numbers [skip actions]"
+          commit_author: Patchinfo incident numbering <gitea-actions-autobuild@noreply.src.opensuse.org> 
+          commit_message: "Update patchinfo incident numbers [skip actions]"
           commit_options: '--no-edit'
           skip_fetch: true
-

0Backports/Backports.changes

@@ -1,3 +1,54 @@
+-------------------------------------------------------------------
+Fri Oct 10 07:19:41 UTC 2025 - Wolfgang Engel <wolfgang.engel@suse.com>
+
+- Backports.productcompose:
+  + add to backports_unneeded, not needed 
+    micro patterns that are coming from SLES
+      patterns-micro-alt_onlyDVD                               
+      patterns-micro-cloud                                     
+      patterns-micro-defaults                                  
+      patterns-micro-fips                                      
+      patterns-micro-hardware                                  
+      patterns-micro-ima-evm                                   
+      patterns-micro-kvm_host                                  
+      patterns-micro-onlyDVD                                   
+      patterns-micro-ra-agent                                  
+      patterns-micro-ra-verifier                               
+      patterns-micro-salt_minion                               
+      patterns-micro-sssd-ldap            
+
+-------------------------------------------------------------------
+Mon Oct  6 14:49:27 UTC 2025 - Wolfgang Engel <wolfgang.engel@suse.com>
+
+- Backports.productcompose:
+  + add to backports_unneeded, remove more uninstallables
+      aws-cli
+      NetworkManager-branding-upstream
+      sdbootutil-tukit
+      toolbox-branding-SLE-16.0 
+
+-------------------------------------------------------------------
+Mon Oct  6 13:24:32 UTC 2025 - Wolfgang Engel <wolfgang.engel@suse.com>
+
+- Backports.productcompose:
+  + add to backports_unneeded, cleanup more unneeded 32bit packages
+      at-spi2-core-devel-32bit
+      libcups2-32bit
+      libcurl-devel-32bit
+      libdns_sd-32bit
+      libpcap-devel-32bit
+      libraptor2-0-32bit
+      libtss2-fapi1-32bit
+
+-------------------------------------------------------------------
+Thu Oct  2 15:07:44 UTC 2025 - Wolfgang Engel <wolfgang.engel@suse.com>
+
+- Backports.productcompose:
+  + add to backports_unneeded since not needed patterns
+      patterns-base-transactional_base
+      patterns-micro-elemental_client
+      patterns-sap-bone
+
 -------------------------------------------------------------------
 Fri Sep 26 16:48:57 UTC 2025 - Nathan Cutler <ncutler@suse.com>
 

0Backports/Backports.productcompose

@@ -14,7 +14,7 @@ scc:
 
 build_options:
 ### For maintenance, otherwise only "the best" version of each package is picked:
-# - take_all_available_versions
+- take_all_available_versions
 - hide_flavor_in_product_directory_name
 
 ### Since the Backports product build is not self-contained in a single repository,
@@ -32,8 +32,8 @@ debug: split
 repodata: all
 
 # has only an effect during maintenance:
-set_updateinfo_from: maint-coord@suse.de
-# set_updateinfo_id_prefix: openSUSE-Leap-16.0-
+set_updateinfo_from: maintenance@opensuse.org
+set_updateinfo_id_prefix: SUSE-PackageHub-16.0-
 
 flavors:
   backports_aarch64:
@@ -58,6 +58,9 @@ packagesets:
   - ALP
   - ALP-dummy-release
   - MozillaFirefox-branding-upstream
+  - NetworkManager-branding-upstream
+  - at-spi2-core-devel-32bit
+  - aws-cli
   - bash-legacybin
   - busybox-adduser
   - busybox-attr
@@ -155,12 +158,14 @@ packagesets:
   - libatk-bridge-2_0-0-32bit
   - libatspi0-32bit
   - libavahi-client3-32bit
-#  - libcups2-32bit
+  - libcups2-32bit
   - libcurl-mini4
   - libcurl4-32bit
+  - libcurl-devel-32bit
   - libdbus-1-3-32bit
   - libdbus-glib-1-2-32bit
   - libdc1394-26-32bit
+  - libdns_sd-32bit
   - libdebuginfod-dummy-devel
   - libdebuginfod1-dummy
   - libdvbv5-0-32bit
@@ -170,16 +175,19 @@ packagesets:
   - liblirc_driver0-32bit
   - libmanette-0_2-0-32bit
   - libpcap1-32bit
+  - libpcap-devel-32bit
   - libpolkit-agent-1-0-32bit
   - libpolkit-gobject-1-0-32bit
   - libpq5-32bit
   - libpxbackend-1_0-mini
+  - libraptor2-0-32bit
   - libressl
   - libressl-devel
   - libressl-devel-doc
 #  - libsybdb5-32bit
   - libsystemd0-mini
 #  - libtdsodbc0-32bit
+  - libtss2-fapi1-32bit
   - libudev-mini1
   - libunbound-devel-mini
   - libusb-1_0-0-32bit
@@ -195,6 +203,22 @@ packagesets:
   - openssl_tpm2
   - pam-extra-32bit
   - patterns-base-kernel_livepatching
+  - patterns-base-transactional_base
+  - patterns-micro-alt_onlyDVD
+  - patterns-micro-cloud
+  - patterns-micro-defaults
+  - patterns-micro-elemental_client
+  - patterns-micro-defaults
+  - patterns-micro-fips
+  - patterns-micro-hardware
+  - patterns-micro-ima-evm
+  - patterns-micro-kvm_host
+  - patterns-micro-onlyDVD
+  - patterns-micro-ra-agent
+  - patterns-micro-ra-verifier
+  - patterns-micro-salt_minion
+  - patterns-micro-sssd-ldap
+  - patterns-sap-bone
   - patterns-base-update_test
   - plymouth-branding-upstream
   - postgresql17-devel-mini
@@ -222,6 +246,7 @@ packagesets:
   - reproducible-faketools-tar
   - reproducible-faketools-verbose
   - reproducible-faketools-zip
+  - sdbootutil-tukit
   - sddm-branding-openSUSE
   - sddm-qt6-branding-openSUSE
   - systemd-default-settings-branding-openSUSE
@@ -233,6 +258,7 @@ packagesets:
   - systemd-mini-container
   - systemd-mini-devel
   - this-is-only-for-build-envs
+  - toolbox-branding-SLE-16.0
   - udev-mini
   - update-test-32bit-pkg
   - update-test-affects-package-manager

_config

@@ -143,7 +143,7 @@ Substitute: wallpaper-branding-openSUSE wallpaper-branding-SLE
 %define is_opensuse  1
 %define is_backports 1
 
-%if "%_project" == "openSUSE:Backports:SLE-16.0" || "%_project" == "openSUSE:Backports:SLE-16.0:git"
+%if 0%{?_is_in_project}
 Macros:
 %vendor openSUSE
 %distribution SUSE Linux Enterprise 16
@@ -164,7 +164,7 @@ Macros:
 
 # Leap specific package list, the same list with excludebuild must add to Backports project
 # Most of package should be built in Backports
-%if "%_project" == "openSUSE:Backports:SLE-16.0" || "%_project" == "openSUSE:Backports:SLE-16.0:git"
+%if "%_project" == "openSUSE:Backports:SLE-16.0"
 # we build ffado:ffado-mixer for openSUSE, the main one is built in SLFO
 BuildFlags: excludebuild:ffado
 # build gpgme:qt flavor for qt5 support

_maintainership.json

@@ -1,3 +1,3 @@
 {
-    "": ["packagehub-review"]
+    "": ["maintenance-release-review"]
 }

patchinfo.20251010110535882810.90520734224245/_patchinfo

@@ -0,0 +1,66 @@
+<patchinfo incident="packagehub-1">
+  <issue tracker="bnc" id="1251334">VUL-0: chromium: release 141.0.7390.65</issue>
+  <issue tracker="cve" id="2025-11213">VUL-0: chromium: release 141.0.7390.54</issue>
+  <issue tracker="cve" id="2025-11216">VUL-0: chromium: release 141.0.7390.54</issue>
+  <issue tracker="cve" id="2025-11207">VUL-0: chromium: release 141.0.7390.54</issue>
+  <issue tracker="cve" id="2025-11211">VUL-0: chromium: release 141.0.7390.54</issue>
+  <issue tracker="cve" id="2025-11212">VUL-0: chromium: release 141.0.7390.54</issue>
+  <issue tracker="cve" id="2025-11210">VUL-0: chromium: release 141.0.7390.54</issue>
+  <issue tracker="bnc" id="1250780">VUL-0: chromium: release 141.0.7390.54</issue>
+  <issue tracker="cve" id="2025-11208">VUL-0: chromium: release 141.0.7390.54</issue>
+  <issue tracker="cve" id="2025-10890">VUL-0: chromium: release 140.0.7339.207</issue>
+  <issue tracker="cve" id="2025-11206">VUL-0: chromium: release 141.0.7390.54</issue>
+  <issue tracker="cve" id="2025-11460">VUL-0: chromium: release 141.0.7390.65</issue>
+  <issue tracker="cve" id="2025-11219">VUL-0: chromium: release 141.0.7390.54</issue>
+  <issue tracker="bnc" id="1250472">VUL-0: chromium: release 140.0.7339.207</issue>
+  <issue tracker="cve" id="2025-11205">VUL-0: chromium: release 141.0.7390.54</issue>
+  <issue tracker="cve" id="2025-10891">VUL-0: chromium: release 140.0.7339.207</issue>
+  <issue tracker="cve" id="2025-11458"/>
+  <issue tracker="cve" id="2025-11215">VUL-0: chromium: release 141.0.7390.54</issue>
+  <issue tracker="cve" id="2025-11209">VUL-0: chromium: release 141.0.7390.54</issue>
+  <issue tracker="cve" id="2025-10892">VUL-0: chromium: release 140.0.7339.207</issue>
+  <packager>AndreasStieger</packager>
+  <rating>critical</rating>
+  <category>security</category>
+  <summary>Security update for chromium</summary>
+  <description>This update for chromium fixes the following issues:
+
+Chromium 141.0.7390.76:
+
+  * Do not send URLs as AIM input. This is to resolve a privacy
+    concern, around passing urls to AI Mode.
+
+Chromium 141.0.7390.65 (boo#1251334):
+
+  * CVE-2025-11458: Heap buffer overflow in Sync
+  * CVE-2025-11460: Use after free in Storage
+  * CVE-2025-11211: Out of bounds read in WebCodecs
+
+Chromium 141.0.7390.54 (stable released 2025-09-30) (boo#1250780)
+
+  * CVE-2025-11205: Heap buffer overflow in WebGPU
+  * CVE-2025-11206: Heap buffer overflow in Video
+  * CVE-2025-11207: Side-channel information leakage in Storage
+  * CVE-2025-11208: Inappropriate implementation in Media
+  * CVE-2025-11209: Inappropriate implementation in Omnibox
+  * CVE-2025-11210: Side-channel information leakage in Tab
+  * CVE-2025-11211: Out of bounds read in Media
+  * CVE-2025-11212: Inappropriate implementation in Media
+  * CVE-2025-11213: Inappropriate implementation in Omnibox
+  * CVE-2025-11215: Off by one error in V8
+  * CVE-2025-11216: Inappropriate implementation in Storage
+  * CVE-2025-11219: Use after free in V8
+  * Various fixes from internal audits, fuzzing and other initiatives
+
+Chromium 141.0.7390.37 (beta released 2025-09-24)
+
+Chromium 140.0.7339.207 (boo#1250472)
+
+  * CVE-2025-10890: Side-channel information leakage in V8
+  * CVE-2025-10891: Integer overflow in V8
+  * CVE-2025-10892: Integer overflow in V8
+
+</description>
+  <package>chromium</package>
+  <seperate_build_arch/>
+</patchinfo>

patchinfo.20251015125625066283.90520734224245/_patchinfo

@@ -0,0 +1,17 @@
+<patchinfo>
+  <issue tracker="bnc" id="1252013">VUL-0: CVE-2025-11756: chromium: Use after free in Safe Browsing</issue>
+  <issue tracker="cve" id="2025-11756"/>
+  <packager>AndreasStieger</packager>
+  <rating>moderate</rating>
+  <category>security</category>
+  <summary>Security update for chromium</summary>
+  <description>This update for chromium fixes the following issues:
+
+Chromium 141.0.7390.107:
+
+* CVE-2025-11756: Use after free in Safe Browsing (boo#1252013)
+
+</description>
+  <package>chromium</package>
+  <seperate_build_arch/>
+</patchinfo>

patchinfo.20251020125830692820.93181000773252/_patchinfo

@@ -0,0 +1,55 @@
+<patchinfo>
+  <issue tracker="bnc" id="1206292">[SELinux] Wine/Proton not working reliably with default SELinux configuration</issue>
+  <packager>regularhunter</packager>
+  <rating>moderate</rating>
+  <category>recommended</category>
+  <summary>Recommended update for lutris</summary>
+  <description>This update for lutris fixes the following issues:
+
+- Move selinux dependency
+
+- Fix gaming under selinux (bsc#1206292)
+
+- Fix wrong placement of lang_package macro in spec file
+
+- Update to 0.5.19:
+  * Fix Proton integration bugs so Proton-fixes are applied
+  * Do not offer DXVK, VKD3D, D3D Extras or DDXVK-NVAPI on Proton versions;
+    Proton will handle these.
+  * The "Enable Esync" and "Enable Fsync" settings are now passed on to Proton
+  * DXVK's integrated D8VK will be enabled in Proton
+  * Emulator BIOS file location (used by libretro) may be set in Preferences
+  * Obtain the release year from GOG and Itch.io.
+  * MAME Machine setting uses a searchable entry for its enourmous list
+  * Support for importing Commodore 64 ROMs
+
+- Add BuildRequires apparmor-abstractions, apparmor-rpm-macros for
+  Leap, fix for build error: directories not owned by a package:
+  /etc/apparmor.d
+
+- update to 0.5.18:
+  * Lutris downloads the latest GE-Proton build for Wine if any Wine version is installed
+  * Use dark theme by default
+  * Display cover-art rather than banners by default
+  * Add 'Uncategorized' view to sidebar
+  * Preference options that do not work on Wayland will be hidden when on Wayland
+  * Game searches can now use fancy tags like 'installed:yes' or 'source:gog', with explanatory tool-tip
+  * A new filter button on the search box can build many of these fancy tags for you
+  * Runner searches can use 'installed:yes' as well, but no other fancy searches or anything
+  * Updated the Flathub and Amazon source to new APIs, restoring integration
+  * Itch.io source integration will load a collection named 'Lutris' if present
+  * GOG and Itch.io sources can now offer Linux and Windows installers for the same game
+  * Added support for the 'foot' terminal
+  * Support for DirectX 8 in DXVK v2.4
+  * Support for Ayatana Application Indicators
+  * Additional options for Ruffle runner
+  * Updated download links for the Atari800 and MicroM8 runners
+  * No longer re-download cached installation files even when some are missing
+  * Lutris log is included in the 'System' tab of the Preferences window
+  * Improved error reporting, with the Lutris log included in the error details
+  * Add AppArmor profile for Ubuntu versions &gt;= 23.10
+  * Add Duckstation runner
+</description>
+  <package>lutris</package>
+  <seperate_build_arch/>
+</patchinfo>

workflow.config

@@ -1,23 +1,74 @@
 {
-        "Workflows": ["pr"],
-        "GitProjectName": "products/PackageHub#leap-16.0",
-        "Organization": "pool",
-        "Branch": "leap-16.0",
-        "ManualMergeProject": true,
-        "Reviewers": [
-                       "+legaldb",
-                       "-autogits_obs_staging_bot",
-                       "*packagehub-review"
-                     ],
-        "ReviewGroups": [
-                          {
-                             "Name": "packagehub-review",
-                             "Reviewers": [
-                                            "bigironman",
-                                            "lkocman-factory",
-                                            "maxlin_factory",
-                                            "smithfarm"
-                                          ]
-                          }
-                        ]
+  "Workflows": ["pr"],
+  "GitProjectName": "products/PackageHub#leap-16.0",
+  "Organization": "pool",
+  "Branch": "leap-16.0",
+  "ManualMergeProject": true,
+  "NoProjectGitPR": true,
+  "Reviewers": [
+    "-maintenance-release-review",
+    "*opensuse-review",
+    "+legaldb",
+    "-autogits_obs_staging_bot",
+    "-qam-openqa-review"
+  ],
+  "ReviewGroups": [
+    {
+      "Name": "maintenance-release-review",
+      "Reviewers": [
+        "abergmann",
+        "amattiazzo",
+        "bfilho",
+        "cmatos",
+        "crazybyte",
+        "emanuelecappello",
+        "gsonnu",
+        "maintenance-robot",
+        "mauriziogalli",
+        "mbozicevic",
+        "mimi_vx",
+        "mschnitzer",
+        "msmeissn",
+        "pluskalm",
+        "rfrohl",
+        "slemke"
+        ],
+      "Silent": true
+    },
+    {
+      "Name": "opensuse-review",
+      "Reviewers": [
+        "alarrosa",
+        "anag",
+        "atartamo",
+        "bigironman",
+        "darix",
+        "dimstar",
+        "dmach",
+        "eroca",
+        "jdsn",
+        "jengelh",
+        "mcalabkova",
+        "mstrigl",
+        "nkrapp",
+        "oertel",
+        "RBrownSUSE",
+        "simotek",
+        "smithfarm"
+      ],
+      "Silent": true
+    },
+    {
+      "Name": "qam-openqa-review",
+      "Reviewers": [
+        "mimi_vx",
+        "mschnitzer",
+        "msmeissn",
+        "openqa-maintenance",
+        "foursixnine-openqa",
+        "szarate"
+        ],
+      "Silent": true
+    }
+  ]
 }