Merge branch 'main' into llvm/llvm-20

Author: javacruft

.github/workflows/backfill.yaml

@@ -24,7 +24,7 @@ jobs:
         with:
           project_id: "prod-images-c6e5"
 
-      - uses: chainguard-dev/setup-chainctl@8d93dcbef466d3cf3533f67084f52eb74ef9d262 # v0.2.4
+      - uses: chainguard-dev/setup-chainctl@272698817627c158bbd813cb783b62a4b9bbbc67 # v0.3.1
         with:
             # Managed here:
             # https://github.com/chainguard-dev/mono/blob/main/env/chainguard-images/iac/wolfi-os-pusher.tf
@@ -33,12 +33,6 @@ jobs:
       - name: 'Backfill packages to apk.cgr.dev'
         run: |
           set -e
-          # Populate the token here, since chainctl auth token
-          # doesn't support all of the options we need.
-          chainctl auth login --audience apk.cgr.dev \
-            --identity "720909c9f5279097d847ad02a2f24ba8f59de36a/6a26f2970f880c31"
-          echo "::add-mask::$(chainctl auth token --audience apk.cgr.dev)"
-
           for arch in "aarch64" "x86_64"; do
             echo "Processing ${arch}"
             while IFS= read -r pkg; do

.github/workflows/withdraw-packages.yaml

@@ -115,7 +115,7 @@ jobs:
           done
 
       # use public chainguard provider.
-      - uses: chainguard-dev/setup-chainctl@8d93dcbef466d3cf3533f67084f52eb74ef9d262 # v0.2.4
+      - uses: chainguard-dev/setup-chainctl@272698817627c158bbd813cb783b62a4b9bbbc67 # v0.3.1
         with:
           # Managed here:
           # https://github.com/chainguard-dev/mono/blob/main/env/chainguard-images/iac/wolfi-os-pusher.tf
@@ -124,12 +124,6 @@ jobs:
       - name: 'Withdraw packages from apk.cgr.dev'
         run: |
           set -e
-          # Populate the token here, since chainctl auth token
-          # doesn't support all of the options we need.
-          chainctl auth login --audience apk.cgr.dev \
-            --identity "720909c9f5279097d847ad02a2f24ba8f59de36a/6a26f2970f880c31"
-          echo "::add-mask::$(chainctl auth token --audience apk.cgr.dev)"
-
           for arch in "aarch64" "x86_64"; do
             while IFS= read -r pkg; do
               curl -X DELETE \

.pre-commit-config.yaml

@@ -13,7 +13,7 @@ repos:
       - id: detect-private-key
         exclude: ^ruby-3\.0/0001-ruby-3\.0\.6-openssl-patch\.patch$
   - repo: https://github.com/chainguard-dev/yam
-    rev: 498642e77997ba79709f43a7ee2c84b12b2145bb # v0.2.12
+    rev: fdb5b8c7c09513ca1ed6a88dba5951e4e52be1a7
     hooks:
       - id: yam
         files: ^[^/]+\.yaml$

Makefile

@@ -116,12 +116,6 @@ fetch-kernel:
 
 kernel/%/APKINDEX.tar.gz:
 	@$(call authget,apk.cgr.dev,$@,$(QEMU_KERNEL_REPO)/$(ARCH)/APKINDEX.tar.gz)
-	# Retry in case of failure
-	@if grep -q "UNAUTHORIZED" kernel/$(ARCH)/APKINDEX.tar.gz; then \
-		echo "Auth failed, retrying"; \
-		rm -rf kernel/$(ARCH); \
-		make kernel/$(ARCH)/APKINDEX.tar.gz; \
-	fi
 
 kernel/%/APKINDEX: kernel/%/APKINDEX.tar.gz
 	tar -x -C kernel --to-stdout -f $< APKINDEX > $@.tmp.$$$$ && mv $@.tmp.$$$$ $@
@@ -290,5 +284,5 @@ authget = tok=$$(chainctl auth token --audience=$(1)) || \
   { echo "failed token from $(1) for target $@"; exit 1; }; \
   mkdir -p $$(dirname $(2)) && \
   echo "auth-download[$(1)] to $(2) from $(3)" && \
-  curl -LS --silent -o $(2).tmp --user "user:$$tok" $(3) && \
+  curl --fail -LS --silent -o $(2).tmp --user "user:$$tok" $(3) && \
 	mv "$(2).tmp" "$(2)"

R-s2.yaml

@@ -1,6 +1,6 @@
 package:
   name: R-s2
-  version: "1.1.8"
+  version: "1.1.9"
   epoch: 0
   description: Spherical Geometry Operators Using the S2 Geometry Library
   copyright:
@@ -29,7 +29,7 @@ pipeline:
     with:
       repository: https://github.com/cran/s2
       tag: ${{package.version}}
-      expected-commit: eca2335e8df9ed2fd5c3a94bec59aedd5e3d985d
+      expected-commit: 2ac29d895c56b3944fe6cb3876823dd290ca5639
 
   - runs: |
       # https://github.com/wolfi-dev/os/issues/34075

abseil-cpp.yaml

@@ -1,7 +1,7 @@
 package:
   name: abseil-cpp
   version: "20250127.1" # On update, please check if -fdelete-null-pointer-checks is still required
-  epoch: 1
+  epoch: 2
   description: Abseil Common Libraries (C++)
   copyright:
     - license: Apache-2.0

aerospike-7.yaml

@@ -1,6 +1,6 @@
 package:
   name: aerospike-7
-  version: "7.2.0.10"
+  version: "7.2.0.11"
   epoch: 0
   description: Aerospike Database Server - flash-optimized, in-memory, nosql database
   copyright:
@@ -27,7 +27,7 @@ pipeline:
     with:
       repository: https://github.com/aerospike/aerospike-server
       tag: ${{package.version}}
-      expected-commit: 3fa686b58cfd57a4d962020dc3ad8109143c93ba
+      expected-commit: c88987ed424647b07a0be3535c37363ba5b91a2a
       recurse-submodules: true
 
   - runs: |

aerospike.yaml

@@ -1,6 +1,6 @@
 package:
   name: aerospike
-  version: "6.4.0.32"
+  version: "6.4.0.33"
   epoch: 0
   description: Aerospike Database Server - flash-optimized, in-memory, nosql database
   copyright:
@@ -27,7 +27,7 @@ pipeline:
     with:
       repository: https://github.com/aerospike/aerospike-server
       tag: ${{package.version}}
-      expected-commit: 5bb6e776b4d7aca4f8c76165c4c92e82277458a4
+      expected-commit: dcc34ae9c103e8315b9d68e93780967bd5a154ff
 
   - runs: git submodule update --init
 

alsa-lib.yaml

@@ -1,7 +1,7 @@
 package:
   name: alsa-lib
   version: "1.2.14"
-  epoch: 0
+  epoch: 1
   description: Advanced Linux Sound Architecture (ALSA) library
   copyright:
     - license: LGPL-2.1-or-later

amazon-cloudwatch-agent-operator.yaml

@@ -1,6 +1,6 @@
 package:
   name: amazon-cloudwatch-agent-operator
-  version: "3.0.0"
+  version: "3.0.1"
   epoch: 0
   description: Software developed to manage the CloudWatch Agent on kubernetes.
   copyright:
@@ -9,7 +9,7 @@ package:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: e35509cf952428ea2c6c939e13a5b477d68bcae7
+      expected-commit: 7e1557aa893413e8655dd9d383982eae94c815bf
       repository: https://github.com/aws/amazon-cloudwatch-agent-operator
       tag: v${{package.version}}