mirror of
https://github.com/goreleaser/nfpm
synced 2026-10-16 09:13:53 +02:00
Dj GilcreaseandClaude Opus 5.5
ae346b54a3
* fix(rpm): emit ISA-qualified self provide (#1140) rpmbuild gives every arch-specific package a `%{name}%{?_isa}` provide beside its plain self provide, e.g. `gmp(aarch-64) = 1:6.3.0-2`, and Red Hat software certification fails packages without it. nfpm's RPMs only carried `name = version-release`, and that dropped the epoch. Bump go.digitalxero.dev/rpm to v0.3.0, which now emits both provides the way rpmbuild does: foo = [epoch:]version-release foo(<isa>) = [epoch:]version-release The ISA is derived from the final RPM arch, so `rpm.arch` overrides are honoured. noarch, source RPMs and arches rpm defines no ISA for get no ISA provide. Add unit tests covering each arch mapping, epoch handling, prerelease versions, `rpm.arch` overrides and SRPMs. Add an `isaprovide` acceptance test that checks against the container's own `%{_isa}`, and document the behaviour. Closes #1140 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: Clarify RPM ISA self-provide conditions Limit automatic ISA-qualified self-provides to binary RPMs with a known ISA, and explicitly document noarch, source, and unknown architectures. See #1140 * ci: Use patched Go for vulnerability scanning Pin govulncheck to Go 1.27.2 while the Actions version manifest lags the official release. This fixes the standard-library findings that trigger duplicate SARIF stacks without suppressing scanner results. See #1141 --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>