56 releases 109 tags

RSS feed

• v0.48.0 01e511e6e6

  Compare

  v0.48.0 Stable

  rider released this 2026-08-06 21:16:58 +03:00 | 192 commits to master since this release

  Signed by rider

  GPG key ID: 7742B90A090F291E

  zoryn 0.48.0

  This release opens up devenv networking — published ports on the host loopback and filtered LAN access for the sealed podman container, both contributed by Danil Shein — and teaches task batch to build on several builders at once, so one run checks a whole batch on several architectures. Underneath sits a round of security hardening and a long list of fixes across submit, version checking and devenv.

  devenv: ports on the loopback

  With [devenv] ports in the machine config, a dev server running inside the sealed container is finally reachable from the host: "8080" maps the same port on both sides, "18080:8080" maps a host port to a guest port, and everything binds 127.0.0.1 only. Ports are arbitrated between environments of the same project — starting one environment stops (not removes) another one still holding the port, so a routine config change no longer needs a manual devenv clean --all, and a taken host port fails fast with a clear message before the cached container is touched. Contributed by Danil Shein (#136).

  devenv: filtered LAN access

  The new [devenv.lan] config sub-table (interface + allow) grants the podman container access to exactly the LAN prefixes you list — a pasta sidecar attaches a second network interface to the container and routes only the allow-listed prefixes to the LAN; everything else keeps the default route through the tunnel. The policy is validated up front, route changes are reconciled into the running container without recreating it, and zoryn devenv inspect shows the live routes. Contributed by Danil Shein (#137).

  task batch on several builders

  task batch -b now accepts a pattern or a comma-separated list matching several builders and builds every package on all of them in parallel, with one log per builder in .gear/. This exists to check a batch on different architectures, not to speed it up: packages are still processed one after another, and each is built on every builder — the batch is deliberately not split, because packages inside it depend on earlier ones through the builder's own hasher repo. While the builds run, each package shows the same live status table as zoryn build, one column per builder.

  Alongside it, the new --skip-built flag (with --test) skips packages whose exact src.rpm is already on the builder and whose git repo has not changed since that build — resuming a long batch no longer rebuilds what already succeeded.

  task test-rebuild --mkrepo

  task test-rebuild --mkrepo builds a merged task repository (as task mkrepo does) for all resolved builders and runs every rebuild against it. This fixes false negatives when a task renames a package that dependents pull in via a virtual Provides. The command refuses configurations that would silently test against the wrong repository — a build command without {apt_tmpdir}, or a hasher config with unchecked_initroot_cache. Contributed by Aleksandr A. Voyt (#135).

  Security hardening

  • Repo-declared upstream URLs (.gear/upstream/remotes, spec Vcs:/Url:) are checked against a scheme allowlist before reaching git ls-remote — a malicious repo could declare an ext::sh -c ... URL and have git execute the command.
  • Package names and versions coming from the RDB task API are validated at the parse boundary — path traversal in a field can no longer steer download, clone or log paths outside the intended directory.
  • Hook sandboxes run with --new-session, closing TIOCSTI keystroke injection from sandboxed code into your shell.
  • The spec: path from .gear/rules is kept inside the repository — absolute paths, .. traversal and symlinked specs no longer point spec reads and rewrites outside the checkout.

  Also in this release

  • [devenv] dns, dns_search and dns_option keys with matching --dns/--dns-search/--dns-option flags — resolver settings for both the image build and the container. Contributed by Ajrat Makhmutov (#130).
  • zoryn devenv --timezone ZONE and [devenv] timezone set the container's timezone via podman run --tz, with IANA zone completion — handy for debugging timezone-sensitive code.
  • zoryn gitery manage: repositories fully merged into the official gears repos get a green in gears badge; v toggles a full git log-style commit view; the actions menu on the repo detail screen now acts on the selected branch or tag (view log/tree, set default branch, delete branch/tag) — repository-wide actions stay on the repo list, so a stray keypress can no longer delete the whole repository.
  • zoryn gitery: when [gitery] login is unset, the login falls back to the local part of an @altlinux.org git user.email.
  • zoryn task new defaults to the sisyphus repository when REPO is omitted, like ssh gyle task new (#129).

  Fixed

  submit

  • The gear tag name now comes from git config gear.create-tag.name, exactly as gear-create-tag builds it (#131).
  • --replace=TASK_ID:N honours the explicit subtask number unconditionally, in every mode; a :N naming a nonexistent subtask is an error instead of a silent mismatch.
  • Creating the package repository on gitery no longer fails for packages removed from sisyphus or last built from an srpm — the source path is resolved through the RDB clone_url API, with a fallback to init-db plus a full push (#133).
  • Squashing a duplicate release commit now works for release subjects containing the letter t (e.g. 1.0.beta-alt1).

  Version checking

  • zoryn check version and the no-watch-file git-tags fallback of zoryn up honour the [version] pattern/template from .gear/version-up — no more picking a generically "latest" non-release tag.
  • Failures are reported as failures: an unreachable remote, a pattern matching no tag, or a broken [version] config now produce an error and exit 1 instead of "Already up to date!".
  • A broken or empty watch file no longer suppresses the git-tags check when the spec also carries a git URL.

  Builds

  • SRPM lookup accepts versions starting with a letter (lshw B.02.20, gnustep r36614 — ~95 sources in p11), so task rebuild, task test-rebuild and task batch in rebuild mode find them again. Contributed by Aleksandr A. Voyt (#134).
  • A builder whose builders.d file has no [commands] build now builds with the same command every other part of zoryn reports for it — the private fallback that silently dropped --apt-config is gone.

  devenv

  • Operates on the git repository root when run from a subdirectory (e.g. .gear/).
  • pids_limit now also raises podman's low nproc ulimit, so parallel builds no longer die with posix_spawnp: Resource temporarily unavailable.
  • Re-entering a stopped cached environment no longer re-resolves BuildRequires every time (and no longer fails offline).
  • Installing a kernel as a build dependency skips initrd generation, making kernel-heavy dependency sets noticeably faster to install.