From 5e23c428b44026c63672cdb4c80b312ccc4cad2d Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Sep 27 2022 09:30:49 +0000 Subject: import buildah-1.27.0-2.module+el8.7.0+16493+89f82ab8 --- diff --git a/.buildah.metadata b/.buildah.metadata index d2e14b7..97b0de9 100644 --- a/.buildah.metadata +++ b/.buildah.metadata @@ -1 +1 @@ -bfaa7b5c8d8169ed7a175c1edea673bca9dc184c SOURCES/buildah-1.24.2-ce608bc.tar.gz +c8bc997a5ec79fcc363dc8c81dbb5818912e60fb SOURCES/buildah-1.27.0-db8d592.tar.gz diff --git a/.gitignore b/.gitignore index 2caaf69..ebe949a 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -SOURCES/buildah-1.24.2-ce608bc.tar.gz +SOURCES/buildah-1.27.0-db8d592.tar.gz diff --git a/SOURCES/4200.patch b/SOURCES/4200.patch new file mode 100644 index 0000000..011a8bc --- /dev/null +++ b/SOURCES/4200.patch @@ -0,0 +1,90 @@ +From 9934b17365083ce966b44c5ce3c7e052f516e255 Mon Sep 17 00:00:00 2001 +From: Aditya R +Date: Wed, 24 Aug 2022 08:42:23 +0530 +Subject: [PATCH] run: add container gid to additional groups + +When container is created with specific uid and gid also add container +gid to supplementary/additional group. + +Signed-off-by: Aditya R +--- + run_common.go | 1 + + tests/bud.bats | 16 ++++++++++++++++ + tests/bud/supplemental-groups/Dockerfile | 3 +++ + tests/run.bats | 14 ++++++++++++++ + 4 files changed, 34 insertions(+) + create mode 100644 tests/bud/supplemental-groups/Dockerfile + +diff --git a/run_common.go b/run_common.go +index 2054c56527..f5a5ec8505 100644 +--- a/run_common.go ++++ b/run_common.go +@@ -262,6 +262,7 @@ func (b *Builder) configureUIDGID(g *generate.Generator, mountPoint string, opti + } + g.SetProcessUID(user.UID) + g.SetProcessGID(user.GID) ++ g.AddProcessAdditionalGid(user.GID) + for _, gid := range user.AdditionalGids { + g.AddProcessAdditionalGid(gid) + } +diff --git a/tests/bud.bats b/tests/bud.bats +index a37e418b41..07bdf45cac 100644 +--- a/tests/bud.bats ++++ b/tests/bud.bats +@@ -366,6 +366,22 @@ _EOF + expect_output --substring "invalid response status" + } + ++@test "build test has gid in supplemental groups" { ++ _prefetch alpine ++ run_buildah build $WITH_POLICY_JSON -t source -f $BUDFILES/supplemental-groups/Dockerfile ++ # gid 1000 must be in supplemental groups ++ expect_output --substring "Groups: 1000" ++} ++ ++@test "build test if supplemental groups has gid with --isolation chroot" { ++ test -z "${BUILDAH_ISOLATION}" || skip "BUILDAH_ISOLATION=${BUILDAH_ISOLATION} overrides --isolation" ++ ++ _prefetch alpine ++ run_buildah build --isolation chroot $WITH_POLICY_JSON -t source -f $BUDFILES/supplemental-groups/Dockerfile ++ # gid 1000 must be in supplemental groups ++ expect_output --substring "Groups: 1000" ++} ++ + # Test skipping images with FROM + @test "build-test skipping unwanted stages with FROM" { + mkdir -p ${TEST_SCRATCH_DIR}/bud/platform +diff --git a/tests/bud/supplemental-groups/Dockerfile b/tests/bud/supplemental-groups/Dockerfile +new file mode 100644 +index 0000000000..462d9ea7a4 +--- /dev/null ++++ b/tests/bud/supplemental-groups/Dockerfile +@@ -0,0 +1,3 @@ ++FROM alpine ++USER 1000:1000 ++RUN cat /proc/$$/status +diff --git a/tests/run.bats b/tests/run.bats +index 2e8836c470..e34091fcbe 100644 +--- a/tests/run.bats ++++ b/tests/run.bats +@@ -349,6 +349,20 @@ function configure_and_check_user() { + expect_output "888:888" + } + ++@test "run --user and verify gid in supplemental groups" { ++ skip_if_no_runtime ++ ++ # Create the container. ++ _prefetch alpine ++ run_buildah from $WITH_POLICY_JSON alpine ++ ctr="$output" ++ ++ # Run with uid:gid 1000:1000 and verify if gid is present in additional groups ++ run_buildah run --user 1000:1000 "$ctr" cat /proc/self/status ++ # gid 1000 must be in additional/supplemental groups ++ expect_output --substring "Groups: 1000 " ++} ++ + @test "run --workingdir" { + skip_if_no_runtime + diff --git a/SOURCES/fix-bash-syntax.patch b/SOURCES/fix-bash-syntax.patch deleted file mode 100644 index e508848..0000000 --- a/SOURCES/fix-bash-syntax.patch +++ /dev/null @@ -1,45 +0,0 @@ -From eedab4fd872c3be8ab15af767897f92c78a71fde Mon Sep 17 00:00:00 2001 -From: Lokesh Mandvekar -Date: Mon, 21 Feb 2022 14:58:40 -0500 -Subject: [PATCH] helpers.bash: Use correct syntax - -Fixes gating test failure: -``` - /usr/share/buildah/test/system/./helpers.bash: line 474: !is_cgroupsv2: command not found - ``` - -Co-authored-by: Yiqiao Pu - -I'm just the committer. - -Signed-off-by: Lokesh Mandvekar ---- - tests/helpers.bash | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/tests/helpers.bash b/tests/helpers.bash -index bd2794c974..3e72108bec 100644 ---- a/tests/helpers.bash -+++ b/tests/helpers.bash -@@ -433,9 +433,9 @@ function skip_if_rootless() { - ################################## - function skip_if_rootless_and_cgroupv1() { - if test "$BUILDAH_ISOLATION" = "rootless"; then -- if !is_cgroupsv2; then -- skip "${1:-test does not work when \$BUILDAH_ISOLATION = rootless} and not cgroupv2" -- fi -+ if ! is_cgroupsv2; then -+ skip "${1:-test does not work when \$BUILDAH_ISOLATION = rootless} and not cgroupv2" -+ fi - fi - } - -@@ -471,7 +471,7 @@ function skip_if_cgroupsv2() { - # skip_if_cgroupsv1 # Some tests don't work with cgroupsv1 - ####################### - function skip_if_cgroupsv1() { -- if !is_cgroupsv2; then -+ if ! is_cgroupsv2; then - skip "${1:-test does not work with cgroups v1}" - fi - } diff --git a/SPECS/buildah.spec b/SPECS/buildah.spec index ec853ba..ad63ada 100644 --- a/SPECS/buildah.spec +++ b/SPECS/buildah.spec @@ -12,12 +12,12 @@ go build -buildmode pie -compiler gc -tags="rpm_crashtraceback libtrust_openssl %global import_path github.com/containers/buildah #%%global branch main -%global commit0 ce608bcecdeb077daab846c83b026c508cff9688 +%global commit0 db8d5921a770e7536b34c56d062b47795b548d35 %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) Epoch: 1 Name: buildah -Version: 1.24.2 +Version: 1.27.0 Release: 2%{?dist} Summary: A command line tool used for creating OCI Images License: ASL 2.0 @@ -29,14 +29,14 @@ Source0: https://%{import_path}/tarball/%{commit0}/%{branch}-%{shortcommit0}.tar %else Source0: https://%{import_path}/archive/%{commit0}/%{name}-%{version}-%{shortcommit0}.tar.gz %endif -Patch0: fix-bash-syntax.patch -BuildRequires: golang >= 1.16.6 +Patch0: https://patch-diff.githubusercontent.com/raw/containers/buildah/pull/4200.patch +BuildRequires: golang >= 1.17.7 BuildRequires: git BuildRequires: glib2-devel BuildRequires: libseccomp-devel BuildRequires: ostree-devel BuildRequires: glibc-static -BuildRequires: go-md2man +BuildRequires: /usr/bin/go-md2man BuildRequires: gpgme-devel BuildRequires: device-mapper-devel BuildRequires: libassuan-devel @@ -45,6 +45,10 @@ Requires: runc >= 1.0.0-26 Requires: containers-common >= 2:1-2 Recommends: container-selinux Requires: slirp4netns >= 0.3-0 +Requires: containernetworking-plugins >= 0.9.1-1 +Suggests: netavark +Requires: iptables +Requires: nftables %description The %{name} package provides a command line tool which can be used to @@ -99,6 +103,7 @@ rm -f src/github.com/containers/storage/drivers/register/register_btrfs.go %gobuild -o bin/%{name} %{import_path}/cmd/%{name} %gobuild -o imgtype %{import_path}/tests/imgtype %gobuild -o bin/copy %{import_path}/tests/copy +%gobuild -o bin/tutorial %{import_path}/tests/tutorial GOMD2MAN=go-md2man %{__make} -C docs %install @@ -108,6 +113,7 @@ install -d -p %{buildroot}/%{_datadir}/%{name}/test/system cp -pav tests/. %{buildroot}/%{_datadir}/%{name}/test/system cp imgtype %{buildroot}/%{_bindir}/%{name}-imgtype cp bin/copy %{buildroot}/%{_bindir}/%{name}-copy +cp bin/tutorial %{buildroot}/%{_bindir}/%{name}-tutorial make DESTDIR=%{buildroot} PREFIX=%{_prefix} -C docs install #define license tag if not already defined @@ -126,9 +132,58 @@ make DESTDIR=%{buildroot} PREFIX=%{_prefix} -C docs install %license LICENSE %{_bindir}/%{name}-imgtype %{_bindir}/%{name}-copy +%{_bindir}/%{name}-tutorial %{_datadir}/%{name}/test %changelog +* Fri Aug 26 2022 Jindrich Novy - 1:1.27.0-2 +- fix CVE-2022-2990 +- Related: #2061390 + +* Tue Aug 09 2022 Jindrich Novy - 1:1.27.0-1 +- update to https://github.com/containers/buildah/releases/tag/v1.27.0 +- Related: #2061390 + +* Mon Aug 08 2022 Jindrich Novy - 1:1.26.4-3 +- add buildah-tutorial to test subpackage +- Related: #2061390 + +* Thu Aug 04 2022 Jindrich Novy - 1:1.26.4-1 +- update to https://github.com/containers/buildah/releases/tag/v1.26.4 +- Related: #2061390 + +* Wed Aug 03 2022 Jindrich Novy - 1:1.26.3-1 +- update to https://github.com/containers/buildah/releases/tag/v1.26.3 +- Related: #2061390 + +* Thu Jul 07 2022 Jindrich Novy - 1:1.26.2-1 +- update to https://github.com/containers/buildah/releases/tag/v1.26.2 +- Related: #2061390 + +* Wed May 11 2022 Jindrich Novy - 1:1.26.1-2 +- BuildRequires: /usr/bin/go-md2man +- Related: #2061390 + +* Thu May 05 2022 Jindrich Novy - 1:1.26.1-1 +- update to https://github.com/containers/buildah/releases/tag/v1.26.1 +- Related: #2061390 + +* Thu May 05 2022 Jindrich Novy - 1:1.25.1-3 +- add dependencies to network stack +- Related: #2061390 + +* Fri Apr 08 2022 Jindrich Novy - 1:1.25.1-2 +- bump golang BR to 1.17.7 +- Related: #2061390 + +* Thu Mar 31 2022 Jindrich Novy - 1:1.25.1-1 +- update to https://github.com/containers/buildah/releases/tag/v1.25.1 +- Related: #2061390 + +* Wed Mar 30 2022 Jindrich Novy - 1:1.25.0-1 +- update to https://github.com/containers/buildah/releases/tag/v1.25.0 +- Related: #2061390 + * Mon Feb 21 2022 Lokesh Mandvekar - 1:1.24.2-2 - Add patch to fix bash symtax for gating tests - Upstream PR: https://github.com/containers/buildah/pull/3792