mirror of
https://github.com/goreleaser/nfpm
synced 2026-11-01 15:50:14 +01:00
Dj GilcreaseandClaude Opus 5.5
ae346b54a3
* fix(rpm): emit ISA-qualified self provide (#1140) rpmbuild gives every arch-specific package a `%{name}%{?_isa}` provide beside its plain self provide, e.g. `gmp(aarch-64) = 1:6.3.0-2`, and Red Hat software certification fails packages without it. nfpm's RPMs only carried `name = version-release`, and that dropped the epoch. Bump go.digitalxero.dev/rpm to v0.3.0, which now emits both provides the way rpmbuild does: foo = [epoch:]version-release foo(<isa>) = [epoch:]version-release The ISA is derived from the final RPM arch, so `rpm.arch` overrides are honoured. noarch, source RPMs and arches rpm defines no ISA for get no ISA provide. Add unit tests covering each arch mapping, epoch handling, prerelease versions, `rpm.arch` overrides and SRPMs. Add an `isaprovide` acceptance test that checks against the container's own `%{_isa}`, and document the behaviour. Closes #1140 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: Clarify RPM ISA self-provide conditions Limit automatic ISA-qualified self-provides to binary RPMs with a known ISA, and explicitly document noarch, source, and unknown architectures. See #1140 * ci: Use patched Go for vulnerability scanning Pin govulncheck to Go 1.27.2 while the Actions version manifest lags the official release. This fixes the standard-library findings that trigger duplicate SARIF stacks without suppressing scanner results. See #1141 --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
17 lines
277 B
YAML
17 lines
277 B
YAML
name: "foo"
|
|
arch: "${BUILD_ARCH}"
|
|
platform: "linux"
|
|
version: "v1.2.3"
|
|
epoch: "1"
|
|
maintainer: "Foo Bar"
|
|
release: "4"
|
|
description: |
|
|
Foo bar
|
|
Multiple lines
|
|
vendor: "foobar"
|
|
homepage: "https://foobar.org"
|
|
license: "MIT"
|
|
contents:
|
|
- src: ./testdata/fake
|
|
dst: /usr/bin/fake
|