wolfi-dev · octo-sts · Dec 29, 2025 · Dec 29, 2025
diff --git a/kuma-2.13.yaml b/kuma-2.13.yaml
@@ -0,0 +1,179 @@
+package:
+  name: kuma-2.13
+  version: "v2.13.0"
+  epoch: 0 # GHSA-jv3w-x3r3-g6rm
+  description: A multi-zone service mesh for containers, Kubernetes and VMs.
+  copyright:
+    - license: Apache-2.0
+  dependencies:
+    provides:
+      - kuma=${{package.full-version}}
+
+var-transforms:
+  - from: ${{package.version}}
+    match: ^(\d+\.\d+)\.\d+$
+    replace: "$1"
+    to: major-minor-version
+
+pipeline:
+  - uses: git-checkout
+    with:
+      repository: https://github.com/kumahq/kuma
+      tag: ${{package.version}}
+      expected-commit: 99bb946e09bcdf7f7e6c1275c8bf14206db77274
+
+  - uses: patch
+    with:
+      patches: remove_envoy_version_check.patch
+
+subpackages:
+  - name: kumactl-${{vars.major-minor-version}}
+    description: Kuma control plane command-line utility
+    dependencies:
+      provides:
+        - kumactl=${{package.full-version}}
+    pipeline:
+      - uses: go/build
+        with:
+          packages: ./app/kumactl
+          output: kumactl
+          ldflags: |
+            -X github.com/kumahq/kuma/pkg/version.version=${{package.version}}
+            -X github.com/kumahq/kuma/pkg/version.gitTag=$(git name-rev --tags --name-only $(git rev-parse HEAD))
+            -X github.com/kumahq/kuma/pkg/version.gitCommit=$(git rev-parse HEAD)
+            -X github.com/kumahq/kuma/pkg/version.buildDate=$(date ${SOURCE_DATE_EPOCH:+ -d@${SOURCE_DATE_EPOCH}} "+%Y-%m-%dT%H:%M:%SZ")
+            -X github.com/kumahq/kuma/pkg/version.Envoy=$(cat ./mk/dev.mk | grep "ENVOY_VERSION ?= " | sed "s/ENVOY_VERSION ?= //g")
+    test:
+      pipeline:
+        - name: Test kumactl
+          runs: |
+            kumactl help
+            kumactl version | grep ${{package.version}}
+
+  - name: kuma-cp-${{vars.major-minor-version}}
+    description: Kuma control plane
+    dependencies:
+      provides:
+        - kuma-cp=${{package.full-version}}
+    pipeline:
+      - uses: go/build
+        with:
+          packages: ./app/kuma-cp
+          output: kuma-cp
+          ldflags: |
+            -X github.com/kumahq/kuma/pkg/version.version=${{package.version}}
+            -X github.com/kumahq/kuma/pkg/version.gitTag=$(git name-rev --tags --name-only $(git rev-parse HEAD))
+            -X github.com/kumahq/kuma/pkg/version.gitCommit=$(git rev-parse HEAD)
+            -X github.com/kumahq/kuma/pkg/version.buildDate=$(date ${SOURCE_DATE_EPOCH:+ -d@${SOURCE_DATE_EPOCH}} "+%Y-%m-%dT%H:%M:%SZ")
+            -X github.com/kumahq/kuma/pkg/version.Envoy=$(cat ./mk/dev.mk | grep "ENVOY_VERSION ?= " | sed "s/ENVOY_VERSION ?= //g")
+    test:
+      pipeline:
+        - name: Test kuma control plane
+          runs: |
+            kuma-cp help
+            kuma-cp version | grep ${{package.version}}
+
+  - name: kuma-dp-${{vars.major-minor-version}}
+    description: Kuma data plane
+    dependencies:
+      provides:
+        - kuma-dp=${{package.full-version}}
+    pipeline:
+      - uses: go/build
+        with:
+          packages: ./app/kuma-dp
+          output: kuma-dp
+          ldflags: |
+            -X github.com/kumahq/kuma/pkg/version.version=${{package.version}}
+            -X github.com/kumahq/kuma/pkg/version.gitTag=$(git name-rev --tags --name-only $(git rev-parse HEAD))
+            -X github.com/kumahq/kuma/pkg/version.gitCommit=$(git rev-parse HEAD)
+            -X github.com/kumahq/kuma/pkg/version.buildDate=$(date ${SOURCE_DATE_EPOCH:+ -d@${SOURCE_DATE_EPOCH}} "+%Y-%m-%dT%H:%M:%SZ")
+            -X github.com/kumahq/kuma/pkg/version.Envoy=$(cat ./mk/dev.mk | grep "ENVOY_VERSION ?= " | sed "s/ENVOY_VERSION ?= //g")
+    test:
+      pipeline:
+        - name: Test kuma data plane
+          runs: |
+            kuma-dp help
+            kuma-dp version | grep ${{package.version}}
+
+  - name: kuma-cni-${{vars.major-minor-version}}
+    description: Kuma CNI plugin
+    dependencies:
+      provides:
+        - kuma-cni=${{package.full-version}}
+    pipeline:
+      - uses: go/build
+        with:
+          packages: ./app/cni/cmd/kuma-cni
+          output: kuma-cni
+          ldflags: |
+            -X github.com/kumahq/kuma/pkg/version.version=${{package.version}}
+            -X github.com/kumahq/kuma/pkg/version.gitTag=$(git name-rev --tags --name-only $(git rev-parse HEAD))
+            -X github.com/kumahq/kuma/pkg/version.gitCommit=$(git rev-parse HEAD)
+            -X github.com/kumahq/kuma/pkg/version.buildDate=$(date ${SOURCE_DATE_EPOCH:+ -d@${SOURCE_DATE_EPOCH}} "+%Y-%m-%dT%H:%M:%SZ")
+            -X github.com/kumahq/kuma/pkg/version.Envoy=$(cat ./mk/dev.mk | grep "ENVOY_VERSION ?= " | sed "s/ENVOY_VERSION ?= //g")
+    test:
+      pipeline:
+        - name: Test kuma cni
+          runs: |
+            kuma-cni help
+            kuma-cni version
+
+  - name: kuma-install-cni-${{vars.major-minor-version}}
+    description: Kuma CNI installer
+    dependencies:
+      provides:
+        - kuma-install-cni=${{package.full-version}}
+    pipeline:
+      - uses: go/build
+        with:
+          packages: ./app/cni/cmd/install
+          output: install-cni
+          ldflags: |
+            -X github.com/kumahq/kuma/pkg/version.version=${{package.version}}
+            -X github.com/kumahq/kuma/pkg/version.gitTag=$(git name-rev --tags --name-only $(git rev-parse HEAD))
+            -X github.com/kumahq/kuma/pkg/version.gitCommit=$(git rev-parse HEAD)
+            -X github.com/kumahq/kuma/pkg/version.buildDate=$(date ${SOURCE_DATE_EPOCH:+ -d@${SOURCE_DATE_EPOCH}} "+%Y-%m-%dT%H:%M:%SZ")
+            -X github.com/kumahq/kuma/pkg/version.Envoy=$(cat ./mk/dev.mk | grep "ENVOY_VERSION ?= " | sed "s/ENVOY_VERSION ?= //g")
+    test:
+      pipeline:
+        - uses: test/virtualpackage
+          with:
+            virtual-pkg-name: kuma-install-cni
+            real-pkg-name: ${{subpkg.name}}
+
+  - name: kuma-cni-compat-${{vars.major-minor-version}}
+    description: Kuma CNI compat
+    dependencies:
+      provides:
+        - kuma-cni-compat=${{package.full-version}}
+    pipeline:
+      - runs: |
+          mkdir -p ${{targets.contextdir}}/opt/cni/bin
+          ln -sf /usr/bin/kuma-cni ${{targets.contextdir}}/opt/cni/bin/kuma-cni
+          ln -sf /usr/bin/install-cni ${{targets.contextdir}}/install-cni
+    test:
+      environment:
+        contents:
+          packages:
+            - kuma-cni
+            - kuma-install-cni
+      pipeline:
+        - name: Test kuma cni compat
+          runs: |
+            test -x /install-cni
+            test -x /opt/cni/bin/kuma-cni
+            /opt/cni/bin/kuma-cni help
+            /opt/cni/bin/kuma-cni version
+
+update:
+  enabled: true
+  github:
+    identifier: kumahq/kuma
+    tag-filter: "2.13"
+    use-tag: true
+
+# Based on package size if was determined that this origin package is empty apart from its own SBOM and this test was added to confirm it is empty and will fail if the package is not longer empty (contains more than an SBOM)
+test:
+  pipeline:
+    - uses: test/emptypackage
diff --git a/kuma-2.13/remove_envoy_version_check.patch b/kuma-2.13/remove_envoy_version_check.patch
@@ -0,0 +1,51 @@
+diff --git a/app/kuma-dp/pkg/dataplane/envoy/compatibility.go b/app/kuma-dp/pkg/dataplane/envoy/compatibility.go
+index 9bd891d70..861df2c4f 100644
+--- a/app/kuma-dp/pkg/dataplane/envoy/compatibility.go
++++ b/app/kuma-dp/pkg/dataplane/envoy/compatibility.go
+@@ -1,27 +1,32 @@
+ package envoy
+
++/*
+ import (
+ 	"github.com/Masterminds/semver/v3"
+ 	"github.com/pkg/errors"
+ )
++*/
+
+ // VersionCompatible returns true if the given version of
+ // envoy is compatible with this DP, false otherwise, expectedVersion is in Masterminds/semver/v3 format.
+ func VersionCompatible(expectedVersion string, envoyVersion string) (bool, error) {
+-	if expectedVersion == envoyVersion {
+-		return true, nil
+-	}
+-	expectedVersion = "~" + expectedVersion
+-	ver, err := semver.NewVersion(envoyVersion)
+-	if err != nil {
+-		return false, errors.Wrapf(err, "unable to parse envoy version %s", envoyVersion)
+-	}
++	/*
++		if expectedVersion == envoyVersion {
++			return true, nil
++		}
++		expectedVersion = "~" + expectedVersion
++		ver, err := semver.NewVersion(envoyVersion)
++		if err != nil {
++			return false, errors.Wrapf(err, "unable to parse envoy version %s", envoyVersion)
++		}
+
+-	constraint, err := semver.NewConstraint(expectedVersion)
+-	if err != nil {
+-		// Programmer error
+-		return false, errors.Wrapf(err, "Invalid envoy compatibility constraint %s", expectedVersion)
+-	}
++		constraint, err := semver.NewConstraint(expectedVersion)
++		if err != nil {
++			// Programmer error
++			return false, errors.Wrapf(err, "Invalid envoy compatibility constraint %s", expectedVersion)
++		}
+
+-	return constraint.Check(ver), nil
++		return constraint.Check(ver), nil
++	*/
++	return true, nil
+ }