Trivy: why was trivy 0.12.0 re-released?

[06kellyjac]

I updated trivy from 0.11.0 to 0.12.0 in nixpkgs 8 days ago https://github.com/NixOS/nixpkgs/pull/100421

Now there's been a new release of 0.12.0 within the last 4 hours

The sha256 nix generated seems to still be the same: 0vgir7sc14lb0wqwr786sq77pda6rw7svwr6hxklckkn20d9z7z0

https://github.com/NixOS/nixpkgs/blob/master/pkgs/tools/admin/trivy/default.nix#L11

Just wondering what if anything has changed.

[knqyf263]

Oh, sorry about that. We had a problem with Debian stretch (see https://github.com/aquasecurity/trivy/issues/689) and needed to release v0.12.0 again. It just modified the Debian release script, so no changes to Trivy itself.

[06kellyjac]

Ah awesome. Just to clarify there weren't any changes to the files in this repo?

[knqyf263]

No changes in Trivy repository. I just updated trivy-repo manually, but it was difficult to update only Debian repo.
https://github.com/aquasecurity/trivy-repo/commit/c111ae2c2ac0fa8fda9ee0df35cd01c114e6395e

Also, I'm fixing the script to address the issue.
https://github.com/aquasecurity/trivy/pull/706

I'll take NixOS into consideration next time. Sorry for the inconvenience.

[06kellyjac]

No problem at all. As long as the re-release is on the same commit everything's all good for nix.
If the re-release uses a different commit e.g. a release had a secret so you want to force push and re-release to get rid of it, ideally the new one would have an incremented version number. Worst case where you have to re-release and keep the version number that's still ok, I can just update the sha256 line and things should still rebuild correctly.

[knqyf263]

As long as the re-release is on the same commit everything's all good for nix.

I'm relieved to hear that.

If the re-release uses a different commit

I believe it will never happen.

ideally the new one would have an incremented version number.

I got it.

Thanks for your confirmation!