diff --git a/.buildah.metadata b/.buildah.metadata
index a72fe67..97b0de9 100644
--- a/.buildah.metadata
+++ b/.buildah.metadata
@@ -1 +1 @@
-aba5b2eba2e548797e63b6f70c8472ce17b7b9a4 SOURCES/buildah-1.26.2-1915998.tar.gz
+c8bc997a5ec79fcc363dc8c81dbb5818912e60fb SOURCES/buildah-1.27.0-db8d592.tar.gz
diff --git a/.gitignore b/.gitignore
index b1ba61a..ebe949a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1 @@
-SOURCES/buildah-1.26.2-1915998.tar.gz
+SOURCES/buildah-1.27.0-db8d592.tar.gz
diff --git a/SOURCES/4200.patch b/SOURCES/4200.patch
new file mode 100644
index 0000000..011a8bc
--- /dev/null
+++ b/SOURCES/4200.patch
@@ -0,0 +1,90 @@
+From 9934b17365083ce966b44c5ce3c7e052f516e255 Mon Sep 17 00:00:00 2001
+From: Aditya R <arajan@redhat.com>
+Date: Wed, 24 Aug 2022 08:42:23 +0530
+Subject: [PATCH] run: add container gid to additional groups
+
+When container is created with specific uid and gid also add container
+gid to supplementary/additional group.
+
+Signed-off-by: Aditya R <arajan@redhat.com>
+---
+ run_common.go | 1 +
+ tests/bud.bats | 16 ++++++++++++++++
+ tests/bud/supplemental-groups/Dockerfile | 3 +++
+ tests/run.bats | 14 ++++++++++++++
+ 4 files changed, 34 insertions(+)
+ create mode 100644 tests/bud/supplemental-groups/Dockerfile
+
+diff --git a/run_common.go b/run_common.go
+index 2054c56527..f5a5ec8505 100644
+--- a/run_common.go
++++ b/run_common.go
+@@ -262,6 +262,7 @@ func (b *Builder) configureUIDGID(g *generate.Generator, mountPoint string, opti
+ }
+ g.SetProcessUID(user.UID)
+ g.SetProcessGID(user.GID)
++ g.AddProcessAdditionalGid(user.GID)
+ for _, gid := range user.AdditionalGids {
+ g.AddProcessAdditionalGid(gid)
+ }
+diff --git a/tests/bud.bats b/tests/bud.bats
+index a37e418b41..07bdf45cac 100644
+--- a/tests/bud.bats
++++ b/tests/bud.bats
+@@ -366,6 +366,22 @@ _EOF
+ expect_output --substring "invalid response status"
+ }
+
++@test "build test has gid in supplemental groups" {
++ _prefetch alpine
++ run_buildah build $WITH_POLICY_JSON -t source -f $BUDFILES/supplemental-groups/Dockerfile
++ # gid 1000 must be in supplemental groups
++ expect_output --substring "Groups: 1000"
++}
++
++@test "build test if supplemental groups has gid with --isolation chroot" {
++ test -z "${BUILDAH_ISOLATION}" || skip "BUILDAH_ISOLATION=${BUILDAH_ISOLATION} overrides --isolation"
++
++ _prefetch alpine
++ run_buildah build --isolation chroot $WITH_POLICY_JSON -t source -f $BUDFILES/supplemental-groups/Dockerfile
++ # gid 1000 must be in supplemental groups
++ expect_output --substring "Groups: 1000"
++}
++
+ # Test skipping images with FROM
+ @test "build-test skipping unwanted stages with FROM" {
+ mkdir -p ${TEST_SCRATCH_DIR}/bud/platform
+diff --git a/tests/bud/supplemental-groups/Dockerfile b/tests/bud/supplemental-groups/Dockerfile
+new file mode 100644
+index 0000000000..462d9ea7a4
+--- /dev/null
++++ b/tests/bud/supplemental-groups/Dockerfile
+@@ -0,0 +1,3 @@
++FROM alpine
++USER 1000:1000
++RUN cat /proc/$$/status
+diff --git a/tests/run.bats b/tests/run.bats
+index 2e8836c470..e34091fcbe 100644
+--- a/tests/run.bats
++++ b/tests/run.bats
+@@ -349,6 +349,20 @@ function configure_and_check_user() {
+ expect_output "888:888"
+ }
+
++@test "run --user and verify gid in supplemental groups" {
++ skip_if_no_runtime
++
++ # Create the container.
++ _prefetch alpine
++ run_buildah from $WITH_POLICY_JSON alpine
++ ctr="$output"
++
++ # Run with uid:gid 1000:1000 and verify if gid is present in additional groups
++ run_buildah run --user 1000:1000 "$ctr" cat /proc/self/status
++ # gid 1000 must be in additional/supplemental groups
++ expect_output --substring "Groups: 1000 "
++}
++
+ @test "run --workingdir" {
+ skip_if_no_runtime
+
diff --git a/SPECS/buildah.spec b/SPECS/buildah.spec
index 4b05c78..9891437 100644
--- a/SPECS/buildah.spec
+++ b/SPECS/buildah.spec
@@ -9,13 +9,13 @@ go build -buildmode pie -compiler gc -tags="rpm_crashtraceback libtrust_openssl
%global import_path github.com/containers/buildah
#%%global branch main
-%global commit0 19159983d3ecdb16df97eb4c887902363066b474
+%global commit0 db8d5921a770e7536b34c56d062b47795b548d35
%global shortcommit0 %(c=%{commit0}; echo ${c:0:7})
Epoch: 1
Name: buildah
-Version: 1.26.2
-Release: 1%{?dist}
+Version: 1.27.0
+Release: 2%{?dist}
Summary: A command line tool used for creating OCI Images
License: ASL 2.0
URL: https://%{name}.io
@@ -26,7 +26,8 @@ Source0: https://%{import_path}/tarball/%{commit0}/%{branch}-%{shortcommit0}.tar
%else
Source0: https://%{import_path}/archive/%{commit0}/%{name}-%{version}-%{shortcommit0}.tar.gz
%endif
-BuildRequires: golang >= 1.17.7
+Patch0: https://patch-diff.githubusercontent.com/raw/containers/buildah/pull/4200.patch
+BuildRequires: golang >= 1.16.6
BuildRequires: git
BuildRequires: glib2-devel
BuildRequires: libseccomp-devel
@@ -99,6 +100,7 @@ rm -f src/github.com/containers/storage/drivers/register/register_btrfs.go
%gobuild -o bin/%{name} %{import_path}/cmd/%{name}
%gobuild -o imgtype %{import_path}/tests/imgtype
%gobuild -o bin/copy %{import_path}/tests/copy
+%gobuild -o bin/tutorial %{import_path}/tests/tutorial
GOMD2MAN=go-md2man %{__make} -C docs
%install
@@ -108,6 +110,7 @@ install -d -p %{buildroot}/%{_datadir}/%{name}/test/system
cp -pav tests/. %{buildroot}/%{_datadir}/%{name}/test/system
cp imgtype %{buildroot}/%{_bindir}/%{name}-imgtype
cp bin/copy %{buildroot}/%{_bindir}/%{name}-copy
+cp bin/tutorial %{buildroot}/%{_bindir}/%{name}-tutorial
make DESTDIR=%{buildroot} PREFIX=%{_prefix} -C docs install
#define license tag if not already defined
@@ -126,12 +129,33 @@ make DESTDIR=%{buildroot} PREFIX=%{_prefix} -C docs install
%license LICENSE
%{_bindir}/%{name}-imgtype
%{_bindir}/%{name}-copy
+%{_bindir}/%{name}-tutorial
%{_datadir}/%{name}/test
%changelog
-* Wed Jul 27 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.26.2-1
+* Fri Aug 26 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.27.0-2
+- fix CVE-2022-2990
+- Related: #2061316
+
+* Tue Aug 09 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.27.0-1
+- update to https://github.com/containers/buildah/releases/tag/v1.27.0
+- Related: #2061316
+
+* Mon Aug 08 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.26.4-2
+- add buildah-tutorial to test subpackage
+- Related: #2061316
+
+* Thu Aug 04 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.26.4-1
+- update to https://github.com/containers/buildah/releases/tag/v1.26.4
+- Related: #2061316
+
+* Wed Aug 03 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.26.3-1
+- update to https://github.com/containers/buildah/releases/tag/v1.26.3
+- Related: #2061316
+
+* Thu Jul 07 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.26.2-1
- update to https://github.com/containers/buildah/releases/tag/v1.26.2
-- Related: #2061390
+- Related: #2061316
* Fri May 13 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.26.1-4
- Re-enable LTO and debuginfo