[rpms/apache-ivy] rawhide: update to apache-ivy-2.6.0 fixes rhbz#2500944

[Filipe Rosset <rosset.filipe@gmail.com>]

            A new commit has been pushed.

            Repo   : rpms/apache-ivy
            Branch : rawhide
            Commit : e24df5a61f6e7186b6e06bafa50562869b5f1959
            Author : Filipe Rosset <rosset.filipe@gmail.com>
            Date   : 2026-07-22T21:24:13-03:00
            Stats  : +20/-49 in 4 file(s)
            URL    : https://src.fedoraproject.org/rpms/apache-ivy/c/e24df5a61f6e7186b6e06bafa50562869b5f1959?branch=rawhide

            Log:
            update to apache-ivy-2.6.0 fixes rhbz#2500944

resolve CVE-2026-26032: Apache Ivy: PackagerResolver path traversal vulnerability

Users of Apache Ivy 2.0.0 to 2.5.3 (inclusive) should upgrade to Ivy 2.6.0

Key features of this 2.6.0 release are:
- a new conflict manager handles conflicts the same way Maven does.
- ivy_deliver merges extension XML namespaces now.

Signed-off-by: Filipe Rosset <rosset.filipe@gmail.com>

---
diff --git a/.gitignore b/.gitignore
index 2c09e94..f7086be 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,15 +1,4 @@
 /results_*
 /*.src.rpm
-
-/apache-ivy-2.1.0-src.tar.gz
-/apache-ivy-2.2.0-src.tar.gz
-/apache-ivy-2.3.0-src.tar.gz
-/apache-ivy-2.4.0-src.tar.gz
-/apache-ivy-2.5.0-rc1-src.tar.gz
-/apache-ivy-2.5.0-src.tar.gz
-/apache-ivy-2.5.1-src.tar.gz
-/apache-ivy-2.5.1-src.tar.gz.asc
-/apache-ivy-2.5.2-src.tar.gz
-/apache-ivy-2.5.2-src.tar.gz.asc
-/apache-ivy-2.5.3-src.tar.gz
-/apache-ivy-2.5.3-src.tar.gz.asc
+/apache-ivy-*-src.tar.gz
+/apache-ivy-*-src.tar.gz.asc

diff --git a/01-fix-pack200-java25.patch b/01-fix-pack200-java25.patch
deleted file mode 100644
index 9b98679..0000000
--- a/01-fix-pack200-java25.patch
+++ /dev/null
@@ -1,28 +0,0 @@
---- a/src/java/org/apache/ivy/util/FileUtil.java	2026-06-27 16:27:05.578214435 -0300
-+++ a/src/java/org/apache/ivy/util/FileUtil.java	2026-06-27 16:27:11.045593978 -0300
-@@ -46,8 +46,6 @@
- import java.util.zip.GZIPInputStream;
- import java.util.zip.ZipInputStream;
- 
--import static java.util.jar.Pack200.newUnpacker;
--
- /**
-  * Utility class used to deal with file related operations, like copy, full reading, symlink, ...
-  */
-@@ -709,7 +707,15 @@
- 
-         ByteArrayOutputStream baos = new ByteArrayOutputStream();
-         JarOutputStream jar = new JarOutputStream(baos);
--        newUnpacker().unpack(new UncloseInputStream(in), jar);
-+        try {
-+            Class<?> pack200Class = Class.forName("org.apache.commons.compress.harmony.pack200.Pack200");
-+            Object unpacker = pack200Class.getMethod("newUnpacker").invoke(null);
-+            unpacker.getClass()
-+                    .getMethod("unpack", InputStream.class, JarOutputStream.class)
-+                    .invoke(unpacker, new UncloseInputStream(in), jar);
-+        } catch (Exception e) {
-+            throw new IOException("Failed to unpack Pack200 archive: Apache Commons Compress Pack200 is not available on the classpath", e);
-+        }
-         jar.close();
-         return new ByteArrayInputStream(baos.toByteArray());
-     }

diff --git a/apache-ivy.spec b/apache-ivy.spec
index e5929a9..463e025 100644
--- a/apache-ivy.spec
+++ b/apache-ivy.spec
@@ -2,11 +2,12 @@
 %bcond_without oro
 %bcond_without vfs
 %bcond_without sftp
+%bcond_with pack200
 
 %global jarname ivy
 
 Name:           apache-%{jarname}
-Version:        2.5.3
+Version:        2.6.0
 Release:        %autorelease
 Summary:        Java-based dependency manager
 License:        Apache-2.0
@@ -22,13 +23,11 @@ Source2:        https://archive.apache.org/dist/ant/KEYS
 # settings files Ivy tries to load.  This file will be used only as
 # last resort, when no other setting files exist.
 Patch0:         00-global-settings.patch
-Patch1:         01-fix-pack200-java25.patch
 
-BuildRequires:  gnupg2
-BuildRequires:  mvn(org.apache.commons:commons-compress)
 BuildRequires:  ant-openjdk25
-BuildRequires:  ivy-local
 BuildRequires:  dos2unix
+BuildRequires:  gnupg2
+BuildRequires:  ivy-local
 BuildRequires:  mvn(org.apache.ant:ant)
 BuildRequires:  mvn(org.bouncycastle:bcpg-jdk18on)
 BuildRequires:  mvn(org.bouncycastle:bcprov-jdk18on)
@@ -51,6 +50,10 @@ BuildRequires:  mvn(com.jcraft:jsch.agentproxy.connector-factory)
 BuildRequires:  mvn(com.jcraft:jsch.agentproxy.jsch)
 %endif
 
+%if %{with pack200}
+BuildRequires:  mvn(org.apache.commons:commons-compress)
+%endif
+
 Provides:       ivy = %{version}-%{release}
 
 %description
@@ -67,7 +70,6 @@ reporting and publication.
 %autosetup -N
 dos2unix README.adoc
 dos2unix src/java/org/apache/ivy/ant/IvyAntSettings.java
-dos2unix src/java/org/apache/ivy/util/FileUtil.java
 %autopatch -p1
 
 # Don't hardcode sysconfdir path
@@ -130,6 +132,14 @@ rm src/java/org/apache/ivy/plugins/resolver/AbstractSshBasedResolver.java
 rm src/java/org/apache/ivy/plugins/resolver/SFTPResolver.java
 rm src/java/org/apache/ivy/plugins/resolver/SshResolver.java
 %endif
+# optional dep: pack200
+%if %{without pack200}
+# remove all pack200 related dep(s)
+%pom_remove_dep :commons-compress
+# remove file(s) related to pack200
+rm src/java/org/apache/ivy/plugins/pack/Pack200Packing.java
+rm src/java/org/apache/ivy/plugins/pack/Pack200Util.java
+%endif
 # compatibility
 %mvn_file : %{name}/ivy ivy
 # remove prebuilt documentation

diff --git a/sources b/sources
index e832cf1..7e0552f 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (apache-ivy-2.5.3-src.tar.gz) = 135c9cdbd3b4d291f67849e1b38964e1adef51b879de6b46ea4b72fd1bfa2d337b7468d46c4632b2bf360bdb9a25af874195f1032c61fe9fcd1f39ffa02469be
-SHA512 (apache-ivy-2.5.3-src.tar.gz.asc) = 37c40100426b4e045a738570b5133845e753d3e0ebcd7a91d401be967446fed7d8d9d17275191b4cbd33f2847f042fa36fa5f125eaea305b3eef63ea668f9af3
+SHA512 (apache-ivy-2.6.0-src.tar.gz) = 06f6ac8ab47553f3509f8b7fe442972d25f05b84896a958a23f18ab93bcfacd7d4cf58d86796cd7df9c9c63aed624ede4f564a8d9a20f59162be6f0cf622d858
+SHA512 (apache-ivy-2.6.0-src.tar.gz.asc) = 263d7058cf650515ec663d9cba140f3891f2e6650ed238cb00531aafdf7d0199e5eb44be5847b8321a50be22def65bc89e22b904387b5ffd6b82598a06d23840