Repository navigation
Follow moved/renamed GitHub repos: podman, skopeo, libkrun, libkrunfw, biff - #847
Conversation
containers/podman was transferred (GitHub redirects it). Advisories are now filed under pkg:github/podman-container-tools/podman (23 today), which the old provenance never queried. The v6.1.3 archive is byte-identical under both names (sha256 unchanged). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configuration
📒 Files selected for processing (4)
Included review availability: This review used your included allowance. 1 included review remains after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour. 📝 WalkthroughWalkthroughFive package build configurations update source archive URLs or provenance fields to identify different GitHub repositories. Other build settings are unchanged where specified. ChangesPackage source references
Priority: ⬇️ Low Estimated code review effort: 1 (Trivial) | ~5 minutes Change: Bug fix Suggested reviewers: Merge Risk: ⚪ Minimal · up to No actionable merge-blocking issue was established in the reviewed source-reference changes. The remaining uncertainty concerns remote tag and mirror contents. Pre-merge checks |
 |
| Check name | Status | Explanation |
|---|---|---|
| Docstring Coverage |  |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
| Description Check | |
Check skipped - CodeRabbit’s high-level summary is enabled. |
| Title check | |
The title clearly and concisely describes the main change: updating references for moved or renamed GitHub repositories, including all affected packages. |
✨ Finishing Touches
🧪 Generate unit tests (beta)
- Commit to this branch
- Create a new PR
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
Fleet check of all 334 GithubRepo provenances against GitHub's resolved
name found 4 more moves: containers/{libkrun,libkrunfw} -> libkrun/*,
containers/skopeo -> podman-container-tools/skopeo, BurntSushi/biff ->
BurntSushi/bttf. libkrun/libkrunfw archives are byte-identical under the
new names (sha256 unchanged); skopeo/biff source from gs:// (unchanged).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Extended: I checked all 334
|
There was a problem hiding this comment.
Checked that each old repo redirects to the new location (podman-container-tools/podman and skopeo, libkrun/libkrun and libkrunfw, BurntSushi/bttf), that none of them is a fork, and that the hashes are unchanged and the build is green.
Why:
containers/podmanwas transferred topodman-container-tools/podman(gh api repos/containers/podmanreturnsfull_name: podman-container-tools/podman). Advisory feeds now file podman underpkg:github/podman-container-tools/podman: 23 advisories, none of which our scan or lifecycle ever evaluated, because they query the provenance purl.Impact at 6.1.3 today: none hidden. I checked the three recent ones (CVE-2026-57231 HIGH, CVE-2026-55686, CVE-2026-33414). Each has a fix commit that is an ancestor of v6.1.3 (
compare <fix>...v6.1.3= ahead, behind 0), so 6.1.3 is fixed. The fix is about future advisories, which would be filed under the new identity and silently missed.Change:
source_provenance→podman-container-tools/podman;The v6.1.3 archive is byte-identical under both names (sha256
6253aee1…unchanged), so the source doesn't change; only the spec does.Found by the alias/identity triage (pkgmgr-rs #737 / #625 / minimal-supply-chain#442): a GitHub-to-GitHub org move is the third kind of identity split, alongside Go-module and npm spellings.
🤖 Generated with Claude Code
Summary by CodeRabbit