- fix shebang in demos/flatpak-run.sh
OBS-URL: https://build.opensuse.org/package/show/Virtualization:containers/bubblewrap?expand=0&rev=43
This commit is contained in:
Sebastian Wagner
Git OBS Bridge
commit
1d7e0431da
23
.gitattributes
vendored
Normal file
23
.gitattributes
vendored
Normal file
@ -0,0 +1,23 @@
|
|||||||
|
## Default LFS
|
||||||
|
*.7z filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.bsp filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.bz2 filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.gem filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.gz filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.jar filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.lz filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.lzma filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.obscpio filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.oxt filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.pdf filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.png filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.rpm filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.tbz filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.tbz2 filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.tgz filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.ttf filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.txz filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.whl filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.xz filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.zip filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.zst filter=lfs diff=lfs merge=lfs -text
|
||||||
1
.gitignore
vendored
Normal file
1
.gitignore
vendored
Normal file
@ -0,0 +1 @@
|
|||||||
|
.osc
|
||||||
BIN
bubblewrap-0.10.0.tar.xz
(Stored with Git LFS)
Normal file
BIN
bubblewrap-0.10.0.tar.xz
(Stored with Git LFS)
Normal file
Binary file not shown.
3
bubblewrap-0.11.0.tar.xz
Normal file
3
bubblewrap-0.11.0.tar.xz
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
version https://git-lfs.github.com/spec/v1
|
||||||
|
oid sha256:988fd6b232dafa04b8b8198723efeaccdb3c6aa9c1c7936219d5791a8b7a8646
|
||||||
|
size 115228
|
||||||
16
bubblewrap-0.11.0.tar.xz.asc
Normal file
16
bubblewrap-0.11.0.tar.xz.asc
Normal file
@ -0,0 +1,16 @@
|
|||||||
|
-----BEGIN PGP SIGNATURE-----
|
||||||
|
|
||||||
|
iQIzBAABCAAdFiEEegc60a5pT6Jb/2LlI1wJnT6zMHYFAmciWjEACgkQI1wJnT6z
|
||||||
|
MHZhDg//YtlNR8PsIWqrY2nOj1H9IQJeTptbzB+BtyoiIl/fv0/0DWZVgZF9E0jr
|
||||||
|
VW1ju2B0oTxGSc+S71cg31r1Jj9hdj7HRVuHKfnmjHIHHuOhHfT1YDZT+KoYWl4c
|
||||||
|
iwN6x46psYABEaek79a5Ukmj+bX2pvtkqFps/zj504tBtuYHnSd4nyGFdqFr7XSx
|
||||||
|
Ioa8hVxhFjHOuMsteHrFl1a8BQbjGHwBxNVrBzs/0EEciJbwhzknhJMPXqK8LnoK
|
||||||
|
iL/BfXT7os1+aNB90MtJ3ryTt6kUXNtSoZt95qA/I4VV+/c7JK4pvqYXuRk/2OL4
|
||||||
|
nDQRFUQMquvgFutZ0hmdVAeLKhhc4y3abr3PKBrt01ymRyJwb+ahkwrMR1lqkNPz
|
||||||
|
jZhryJoQ+KkoWqG/+UcXfILJ2KiSheFwbp/vnc2JGZyirDVCE+mr5CC/Vqgh7WeF
|
||||||
|
hA9Wx2YhBoQmVwgtf5JLghYrf6eoXu13h0AD9aQrWkejgQheg4+BVnXj8VXDISkw
|
||||||
|
MtZwfGGwOR9X6O4cKq/D8/LrDPqQ+UQNMAV+xB8zSDNQGfP83MLmHxVfqzAE72Hs
|
||||||
|
aLwqrCcXvw1iISTPi5szoAnb1xDVuUtNQIRwZAXUuoXwxJQWmmKBpphXR/VRVkW1
|
||||||
|
KEQ3Ke8FMmAAYQc7tWagwTIVv7U8DOlNutmFMOu2nb9Ccme6ask=
|
||||||
|
=H36P
|
||||||
|
-----END PGP SIGNATURE-----
|
||||||
3
bubblewrap-0.9.0.tar.xz
Normal file
3
bubblewrap-0.9.0.tar.xz
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
version https://git-lfs.github.com/spec/v1
|
||||||
|
oid sha256:c6347eaced49ac0141996f46bba3b089e5e6ea4408bc1c43bab9f2d05dd094e1
|
||||||
|
size 118984
|
||||||
463
bubblewrap.changes
Normal file
463
bubblewrap.changes
Normal file
@ -0,0 +1,463 @@
|
|||||||
|
-------------------------------------------------------------------
|
||||||
|
Sun Nov 17 13:53:07 UTC 2024 - Sebastian Wagner <sebix@sebix.at>
|
||||||
|
|
||||||
|
- fix shebang in demos/flatpak-run.sh
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Fri Nov 1 18:56:54 UTC 2024 - Andreas Stieger <andreas.stieger@gmx.de>
|
||||||
|
|
||||||
|
- update to 0.11.0:
|
||||||
|
* New --overlay, --tmp-overlay, --ro-overlay and --overlay-src
|
||||||
|
options allow creation of overlay mounts. This feature is not
|
||||||
|
available when bubblewrap is installed setuid.
|
||||||
|
* New --level-prefix option produces output that can be parsed
|
||||||
|
by tools like logger --prio-prefix and
|
||||||
|
systemd-cat --level-prefix=1
|
||||||
|
* bug fixes and developer visible changes
|
||||||
|
- add upstream signing key and validate source signature
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Wed Aug 14 17:02:31 UTC 2024 - Bjørn Lie <bjorn.lie@gmail.com>
|
||||||
|
|
||||||
|
- Update to version v0.10.0:
|
||||||
|
* New features: Add the --[ro-]bind-fd option, which can be used
|
||||||
|
to mount a filesystem represented by a file descriptor without
|
||||||
|
time-of-check/time-of-use attacks. This is needed when
|
||||||
|
resolving security issue in Flatpak.
|
||||||
|
(CVE-2024-42472, bsc#1229157)
|
||||||
|
* Other changes: Fix some confusing syntax in SetupOpFlag (no
|
||||||
|
functional change).
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Tue Apr 2 12:14:33 UTC 2024 - Wolfgang Frisch <wolfgang.frisch@suse.com>
|
||||||
|
|
||||||
|
- update to v0.9.0:
|
||||||
|
* Build system changed to Meson from Autotools
|
||||||
|
* Add --argv0
|
||||||
|
https://github.com/containers/bubblewrap/issues/91
|
||||||
|
* --symlink is now idempotent, meaning it succeeds if the symlink already
|
||||||
|
exists and already has the desired target
|
||||||
|
* Clarify security considerations in documentation
|
||||||
|
* Clarify documentation for --cap-add
|
||||||
|
* Report a better error message if mount(2) fails with ENOSPC
|
||||||
|
* Fix a double-close on error reading from --args, --seccomp or
|
||||||
|
--add-seccomp-fd argument
|
||||||
|
* Improve memory allocation behaviour
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Mon Mar 27 16:39:05 UTC 2023 - Andreas Stieger <andreas.stieger@gmx.de>
|
||||||
|
|
||||||
|
- update to v0.8.0:
|
||||||
|
* Add --disable-userns option to prevent the sandbox from
|
||||||
|
creating its own nested user namespace
|
||||||
|
* Add --assert-userns-disabled option to check that an existing
|
||||||
|
userns was created with --disable-userns
|
||||||
|
* Give a clearer error message if the kernel doesn't have
|
||||||
|
CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Wed Dec 7 21:50:27 UTC 2022 - Dirk Müller <dmueller@suse.com>
|
||||||
|
|
||||||
|
- update to v0.7.0:
|
||||||
|
* --size option controls the size of a subsequent --tmpfs (#509)
|
||||||
|
* Better error messages if a mount operation fails (#472)
|
||||||
|
* Better error message if creating the new user namespace fails with
|
||||||
|
ENOSPC (#487)
|
||||||
|
* When building as a Meson subproject, a RUNPATH can be set on the
|
||||||
|
executable to make it easier to bundle its libcap dependency
|
||||||
|
* Fix test failures when running as uid 0 but with limited capabilities
|
||||||
|
(#510)
|
||||||
|
* Use POSIX command -v in preference to non-standard which (#527)
|
||||||
|
* Fix a copy/paste error in --help (#531)
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Wed May 18 12:43:26 UTC 2022 - Dominique Leuenberger <dimstar@opensuse.org>
|
||||||
|
|
||||||
|
- Update to version 0.6.2:
|
||||||
|
+ New features in Meson build:
|
||||||
|
- Auto-detect whether the man page can be generated.
|
||||||
|
- -Dbwrapdir=... changes the installation directory (useful
|
||||||
|
when being used as a subproject).
|
||||||
|
- -Dtests=false disables unit tests.
|
||||||
|
+ Bug fixes:
|
||||||
|
- Add --add-seccomp-fd to shell completions
|
||||||
|
- Document --add-seccomp-fd, --json-status-fd and --share-net
|
||||||
|
in the man page
|
||||||
|
- Add attributes to silence various compiler warnings
|
||||||
|
- Allow compilation of tests with musl on mips architectures
|
||||||
|
- Allow compilation with older glibc
|
||||||
|
- Disable sanitizers for a test helper whose seccomp profile
|
||||||
|
breaks the instrumentation
|
||||||
|
- Disable AddressSanitizer leak detection where it interferes
|
||||||
|
with unit testing
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Fri Mar 4 18:13:15 UTC 2022 - Sebastian Wagner <sebix+novell.com@sebix.at>
|
||||||
|
|
||||||
|
- Update to 0.6.1:
|
||||||
|
- Add a release checklist
|
||||||
|
- completions: Make zsh completion non-executable
|
||||||
|
The Autotools build system installed it with 0644 permissions because
|
||||||
|
it's listed as DATA, but the Meson build system installs executable
|
||||||
|
files as executable by default.
|
||||||
|
zsh completions don't need to be executable to work, and this one doesn't
|
||||||
|
have the `#!` marker that should start an executable script.
|
||||||
|
- update to 0.6.0:
|
||||||
|
- meson: Improve compatibility with Meson 0.49
|
||||||
|
That version doesn't allow more than two arguments for define_variable.
|
||||||
|
- Disable test-specifying-pidns.sh under 'meson dist' while I investigate
|
||||||
|
This test is hanging when run under 'meson dist' for some reason, but
|
||||||
|
not when run under 'meson test', and not locally, only in the Github
|
||||||
|
Workflow-based CI. Disable it for now.
|
||||||
|
- meson: Actually build and run the tests
|
||||||
|
- tests: Fix compiler warnings for unused arguments
|
||||||
|
- meson: Run test scripts from $srcdir
|
||||||
|
- meson: Make G_TEST_SRCDIR, G_TEST_BUILDDIR match Autotools
|
||||||
|
- meson: Run the Python test script with Python, not bash
|
||||||
|
The python build option can be used to swap to a different interpreter,
|
||||||
|
for environments like the Steam Runtime where the python3 executable in
|
||||||
|
the PATH is extremely old but there is a better interpreter available.
|
||||||
|
This is treated as non-optional, because Meson is written in Python,
|
||||||
|
so the situation where there is no Python interpreter at build-time
|
||||||
|
shouldn't arise.
|
||||||
|
- meson: Build the try-syscall helper
|
||||||
|
- meson: Build tests with equivalent of -I$(top_srcdir) -I$(top_builddir)
|
||||||
|
- meson.build: Remove unnecessary check for sh
|
||||||
|
- Add a Meson build system
|
||||||
|
This allows bwrap to be built as a subproject in larger Meson projects.
|
||||||
|
When built as a subproject, we install into the --libexecdir and
|
||||||
|
require a program prefix to be specified: for example, Flatpak would use
|
||||||
|
program_prefix=flatpak- to get /usr/libexec/flatpak-bwrap. Verified to
|
||||||
|
be backwards-compatible as far as Meson 0.49.0 (Debian 9 backports).
|
||||||
|
Loosely based on previous work by Jussi Pakkanen (see #133).
|
||||||
|
Differences between the Autotools and Meson builds:
|
||||||
|
The Meson build requires a version of libcap that has pkg-config
|
||||||
|
metadata (introduced in libcap 2.23, in 2013).
|
||||||
|
The Meson build has no equivalent of --with-priv-mode=setuid. On
|
||||||
|
distributions like Debian <= 10 and RHEL <= 7 that require a setuid bwrap
|
||||||
|
executable, the sysadmin or distribution packaging will need to set the
|
||||||
|
correct permissions on the bwrap executable; Debian already did this via
|
||||||
|
packaging rather than the upstream build system.
|
||||||
|
The Meson build supports being used as a subproject, and there is CI
|
||||||
|
for this. It automatically disables shell completions and man pages,
|
||||||
|
moves the bubblewrap executable to ${libexecdir}, and renames the
|
||||||
|
bubblewrap executable according to a program_prefix option that the
|
||||||
|
caller must specify (for example, Flatpak would use
|
||||||
|
-Dprogram_prefix=flatpak- to get /usr/libexec/flatpak-bwrap). See the
|
||||||
|
tests/use-as-subproject/ directory for an example.
|
||||||
|
- Use HEAD to refer to other projects' default branches in documentation
|
||||||
|
This makes the URL independent of the name they have chosen for their
|
||||||
|
default branches.
|
||||||
|
- workflows: Update for rename of default branch to main
|
||||||
|
- tests: Exercise seccomp filters
|
||||||
|
- Allow loading more than one seccomp program
|
||||||
|
This will allow Flatpak to combine an allow-list (default-deny) of
|
||||||
|
known system calls with a deny-list (default-allow) of system calls
|
||||||
|
that are undesired.
|
||||||
|
Resolves: https://github.com/containers/bubblewrap/issues/453
|
||||||
|
- Generalize linked lists of LockFile and SetupOp
|
||||||
|
I'm about to add a third linked list, for seccomp programs, which would
|
||||||
|
seem like too much duplication.
|
||||||
|
- Handle argc == 0 better
|
||||||
|
Unfortunately it's possible for argc to be 0, so error out pretty early
|
||||||
|
on in that case. I don't think this is a security issue in this case.
|
||||||
|
- Fix typo
|
||||||
|
- Remove trailing whitespace
|
||||||
|
- Fix spelling
|
||||||
|
- bash: Fix shellcheck warnings
|
||||||
|
- bash: Invoke bash using /usr/bin/env
|
||||||
|
- bubblewrap: Avoid a -Wjump-misses-init false-positive
|
||||||
|
When building with -Wjump-misses-init as part of a larger project, gcc
|
||||||
|
reports that we jump past initialization of cover_proc_dirs. This is
|
||||||
|
technically true, but we only use this variable in the case where it's
|
||||||
|
initialized, so that's harmless.
|
||||||
|
However, we can avoid this altogether by making the array static and
|
||||||
|
constant, which allows it to be moved from initialized data to read-only
|
||||||
|
data.
|
||||||
|
- bind-mount: Be more const-correct
|
||||||
|
When compiled with -Wwrite-strings as part of a larger project, gcc and
|
||||||
|
clang both warn that we're assigning a string constant to a mutable
|
||||||
|
struct member. There's actually no reason why it should be mutable, so
|
||||||
|
make it const.
|
||||||
|
- die_with_error: Save errno sooner
|
||||||
|
We need to save errno immediately, otherwise it could be overwritten
|
||||||
|
by a failing library call somewhere in the implementation of fprintf.
|
||||||
|
- main: Warn when non-repeatable options are repeated
|
||||||
|
A user might reasonably expect that `bwrap --seccomp 3 --seccomp 4 ...`
|
||||||
|
would load seccomp programs from both fds 3 and 4, but in fact it only
|
||||||
|
loads the program from fd 4.
|
||||||
|
Helps: https://github.com/containers/bubblewrap/issues/453
|
||||||
|
Resolves: https://github.com/containers/bubblewrap/issues/454
|
||||||
|
- utils: Add warn()
|
||||||
|
- Add SPDX-License-Identifier for files that already specify license
|
||||||
|
This is a step towards REUSE compliance. Third-party files that we do
|
||||||
|
not otherwise edit (git.mk, m4/attributes.m4) are excluded here.
|
||||||
|
- tests: Use preferred spelling for SPDX license identifiers
|
||||||
|
- Remove obsolete .travis.yml
|
||||||
|
We no longer use Travis-CI.
|
||||||
|
- Remove obsolete papr CI
|
||||||
|
We no longer use this.
|
||||||
|
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Mon Sep 20 18:52:20 UTC 2021 - Bjørn Lie <bjorn.lie@gmail.com>
|
||||||
|
|
||||||
|
- Update to version 0.5.0:
|
||||||
|
+ New features:
|
||||||
|
- --chmod changes permissions
|
||||||
|
- --clearenv unsets every environment variable (except PWD)
|
||||||
|
- --perms sets permissions for one subsequent --bind-data,
|
||||||
|
--dir, --file, --ro-bind-data or --tmpfs
|
||||||
|
+ Other enhancements:
|
||||||
|
- Better diagnostics when a --bind or other bind-mount fails
|
||||||
|
- zsh tab-completion
|
||||||
|
- Better test coverage
|
||||||
|
+ Bug fixes:
|
||||||
|
- Use Python 3 for tests and examples
|
||||||
|
- Mount points for non-directories are created with permissions
|
||||||
|
-r--r--r-- instead of -rw-rw-rw-
|
||||||
|
- Don't remount items in /proc read-only if already EROFS,
|
||||||
|
required to run under Docker
|
||||||
|
- Allow mounting an non-directory over an existing
|
||||||
|
non-directory, e.g. --bind "$XDG_RUNTIME_DIR/my-log-socket"
|
||||||
|
/dev/log
|
||||||
|
- Silence kernel messages for our bind-mounts
|
||||||
|
- Make sure pkg-config is checked for, regardless of build
|
||||||
|
options
|
||||||
|
- Improve ability to bind-mount directories on case-insensitive
|
||||||
|
filesystems
|
||||||
|
- Fix -Wshadow warnings
|
||||||
|
- Fix deprecation warnings with newer SELinux
|
||||||
|
- Add new subpackage bubblewrap-zsh-completion
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Wed Apr 1 10:03:39 UTC 2020 - Sebastian Wagner <sebix+novell.com@sebix.at>
|
||||||
|
|
||||||
|
- Update to version 0.4.1:
|
||||||
|
* retcode: fix return code with syncfd and no event_fd
|
||||||
|
* Ensure we're always clearing the cap bounding set
|
||||||
|
* tests: Update output patterns for libcap >= 2.29
|
||||||
|
* Don't rely on geteuid() to know when to switch back from setuid root
|
||||||
|
* Don't support --userns2 in setuid mode
|
||||||
|
* fixes CVE-2020-5291
|
||||||
|
* fixes bsc#1168291
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Fri Dec 20 22:59:52 UTC 2019 - Bjørn Lie <bjorn.lie@gmail.com>
|
||||||
|
|
||||||
|
- Update to version 0.4.0:
|
||||||
|
+ The biggest feature in this release is the support for joining
|
||||||
|
existing user and pid namespaces. This doesn't work in the
|
||||||
|
setuid mode (at the moment).
|
||||||
|
+ Other changes:
|
||||||
|
- Stores namespace info in status json.
|
||||||
|
- In setuid mode pid 1 is now marked dumpable.
|
||||||
|
- Now builds with musl libc.
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Fri Jun 7 14:38:21 UTC 2019 - Antonio Larrosa <alarrosa@suse.com>
|
||||||
|
|
||||||
|
- Use /bin/bash instead of /usr/bin/bash in SLE12
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Sat Jun 1 15:08:49 UTC 2019 - Sebastian Wagner <sebix+novell.com@sebix.at>
|
||||||
|
|
||||||
|
- Update to version 0.3.3:
|
||||||
|
- This release is the same as 0.3.2 but the version number in configure.ac
|
||||||
|
was accidentally still set to 0.3.1
|
||||||
|
- Update to version 0.3.2:
|
||||||
|
- fixes boo#1136958 / CVE-2019-12439
|
||||||
|
This release fixes a mostly theoretical security issue in unusual/broken
|
||||||
|
setups where `$XDG_RUNTIME_DIR` is unset.
|
||||||
|
There are some other smaller fixes, as well as an addition to the JSON
|
||||||
|
API that allows reading the inner process exit code, separately from
|
||||||
|
the `bwrap` exit code.
|
||||||
|
- Print "Out of memory" on stderr, not stdout
|
||||||
|
- bwrap: add option json-status-fd to show child exit code
|
||||||
|
- bwrap: Report COMMAND exit code in json-status-fd
|
||||||
|
- man page: Describe --chdir, not nonexistent --cwd
|
||||||
|
- Don't create our own temporary mount point for pivot_root
|
||||||
|
- Make lockdata long enough on 32-bit with 64-bit file pointers.
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Thu Oct 11 16:41:12 UTC 2018 - Antonio Larrosa <alarrosa@suse.com> - 0.3.1
|
||||||
|
|
||||||
|
- update to version 0.3.1:
|
||||||
|
* New feature in this release is --bind-try (as well as --dev-bind-try
|
||||||
|
and --ro-bind-try) which works like the regular versions if the source
|
||||||
|
exists, but does nothing if it doesn't exist.
|
||||||
|
|
||||||
|
* The mount type for the root tmpfs was also changed to "tmpfs" instead
|
||||||
|
of being empty, as the later could cause problems with some programs
|
||||||
|
when parsing the mountinfo files in /proc.
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Sat Jul 14 20:06:50 UTC 2018 - sebix+novell.com@sebix.at
|
||||||
|
|
||||||
|
- update to version 0.3.0:
|
||||||
|
* The biggest feature from this release is that bwrap
|
||||||
|
now supports being invoked recursively (from other container
|
||||||
|
runtimes such as Docker/podman/runc as well as bwrap itself)
|
||||||
|
when user namespaces are enabled, and the outer container manager
|
||||||
|
allows it (Docker's default seccomp policy doesn't).
|
||||||
|
|
||||||
|
* This is useful for testing scenarios; for example a project
|
||||||
|
uses Kubernetes for its CI, but inside build the project wants to run
|
||||||
|
each unit test in their own pid namespace, without going out
|
||||||
|
and creating a new pod for every single unit test.
|
||||||
|
|
||||||
|
* Similarly, rpm-ostree compose tree uses bwrap internally for scripts,
|
||||||
|
and we want to support running rpm-ostree inside a container as well.
|
||||||
|
|
||||||
|
* Another feature is bwrap now supports -- to terminate argument
|
||||||
|
parsing. To detect availablity of this, you could parse bwrap --version.
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Tue May 1 21:02:33 UTC 2018 - sebix+novell.com@sebix.at
|
||||||
|
|
||||||
|
- update to version 0.2.1:
|
||||||
|
* All the demos are included
|
||||||
|
* bugfixes for the demo files
|
||||||
|
* There was an issue with mkdir when running bubblewrap on an NFS
|
||||||
|
filesystem that has been fixed, so flatpak now works on NFS shares.
|
||||||
|
* Some leaks have been fixed, including a file descriptor leak.
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Mon Oct 9 17:53:37 UTC 2017 - sebix+novell.com@sebix.at
|
||||||
|
|
||||||
|
- update to version 0.2.0
|
||||||
|
- bwrap now automatically detects the new
|
||||||
|
user namespace restrictions in Red Hat Enterprise Linux 7.4:
|
||||||
|
bubblewrap: check for max_user_namespaces == 0.
|
||||||
|
- The most notable features are new arguments --as-pid1, and
|
||||||
|
--cap-add/--cap-drop. These were added for running systemd (or in general a
|
||||||
|
"full" init system) inside bubblewrap. But the capability options are also
|
||||||
|
useful for unprivileged callers to potentially retain capbilities inside the
|
||||||
|
sandbox (for example CAP_NET_ADMIN), when user namespaces are enabled.
|
||||||
|
Conversely, privileged callers (uid 0) can conversely drop capabilities (without
|
||||||
|
user namespaces). Contributed by Giuseppe Scrivano.
|
||||||
|
- With --dev, add /dev/fd and /dev/core symlinks
|
||||||
|
which should improve compatibility with older software.
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Mon Sep 18 12:39:54 UTC 2017 - sebix+novell.com@sebix.at
|
||||||
|
|
||||||
|
- add group
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Fri Jul 7 09:40:27 UTC 2017 - sebix+novell.com@sebix.at
|
||||||
|
|
||||||
|
- fix build macro with rpm < 4.12 (non-Factory currently)
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Thu May 25 21:15:49 UTC 2017 - sebix+novell.com@sebix.at
|
||||||
|
|
||||||
|
- update to version 0.1.8
|
||||||
|
- New --die-with-parent which is based on the Linux prctl(PR_SET_PDEATHSIG) API.
|
||||||
|
- smaller bugfixes
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Thu Mar 2 09:08:58 UTC 2017 - sebix+novell.com@sebix.at
|
||||||
|
|
||||||
|
- upgrade to upstream version 0.1.7
|
||||||
|
- note that this package was *never* affected by CVE-2017-5226
|
||||||
|
as it was introduced in version 0.1.6
|
||||||
|
- upstream changelog of version 0.1.7:
|
||||||
|
This release backs out the change in 0.1.6 which unconditionally
|
||||||
|
called setsid() in order to fix a security issue with TIOCSTI, aka
|
||||||
|
CVE-2017-522. That change caused some behavioural issues that are
|
||||||
|
hard to work with in some cases. For instance, it makes shell job
|
||||||
|
control not work for the bwrap command.
|
||||||
|
Instead there is now a new option --new-session which works like
|
||||||
|
0.1.6. It is recommended that you use this if possible, but if not we
|
||||||
|
recommended that you neutralize this some other way, for instance
|
||||||
|
using SECCOMP, which is what flatpak does:
|
||||||
|
https://github.com/flatpak/flatpak/commit/902fb713990a8f968ea4350c7c2a27ff46f1a6c4
|
||||||
|
In order to make it easy to create maximally safe sandboxes we have
|
||||||
|
also added a new commandline switch called --unshare-all. It unshares
|
||||||
|
all possible namespaces and is currently equivalent with:
|
||||||
|
--unshare-user-try --unshare-ipc --unshare-pid --unshare-net
|
||||||
|
--unshare-uts --unshare-cgroup-try
|
||||||
|
However, the intent is that as new namespaces are added to the kernel they will
|
||||||
|
be added to this list. Additionally, if --share-net is specified the network
|
||||||
|
namespace is not unshared.
|
||||||
|
This release also has some bugfixes:
|
||||||
|
bwrap reaps (unexpected) children that are inherited from the
|
||||||
|
parent, something which can happen if bwrap is part of a shell
|
||||||
|
pipeline.
|
||||||
|
bwrap clears the capability bounding set. The permitted
|
||||||
|
capabilities was already empty, and use of PR_NO_NEW_PRIVS should
|
||||||
|
make it impossible to increase the capabilities, but more
|
||||||
|
layers of protection is better.
|
||||||
|
The seccomp filter is now installed at the very end of bwrap, which
|
||||||
|
means the requirement of the filter is minimal. Any bwrap seccomp
|
||||||
|
filter must at least allow: execve, waitpid and write
|
||||||
|
Alexander Larsson (7):
|
||||||
|
Handle inherited children dying
|
||||||
|
Clear capability bounding set
|
||||||
|
Make the call to setsid() optional, with --new-session
|
||||||
|
demos/bubblewrap-shell.sh: Unshare all namespaces
|
||||||
|
Call setsid() and setexeccon() befor forking the init monitor
|
||||||
|
Install seccomp filter at the very end
|
||||||
|
Bump version to 0.1.7
|
||||||
|
Colin Walters (6):
|
||||||
|
Release 0.1.6
|
||||||
|
man: Correct namespace user -> mount
|
||||||
|
demo/shell: Add /var/tmp compat symlink, tweak PS1, add more docs
|
||||||
|
Release 0.1.6
|
||||||
|
ci: Combine ASAN and UBSAN
|
||||||
|
Add --unshare-all and --share-net
|
||||||
|
- upstream changelog for 0.1.6:
|
||||||
|
This fixes a security issue with TIOCSTI, aka CVE-2017-522. Note bubblewrap is
|
||||||
|
far from the only program that has this issue, and I think the best fix is
|
||||||
|
probably in the kernel to support disabling this ioctl.
|
||||||
|
|
||||||
|
Programs can also work around this by calling setsid() on their own in an exec
|
||||||
|
handler before doing an exevp("bwrap").
|
||||||
|
- upstream changelog for 0.1.5:
|
||||||
|
This is a bugfix release, here are the major changes:
|
||||||
|
Running bubblewrap as root now works again
|
||||||
|
Various fixes for the testsuite
|
||||||
|
Use same default compiler warnings as ostree
|
||||||
|
Handle errors resolving symlinks during bind mounts
|
||||||
|
Alexander Larsson (2):
|
||||||
|
bind-mount: Check for errors in realpath()
|
||||||
|
Bump version to 0.1.5
|
||||||
|
Colin Walters (6):
|
||||||
|
Don't call capset() unless we need to
|
||||||
|
Only --unshare-user automatically if we're not root
|
||||||
|
ci: Modernize a bit, add f25-ubsan
|
||||||
|
README.md: Update with better one liner and more information
|
||||||
|
utils: Add __attribute__((printf)) to die()
|
||||||
|
build: Sync default warning -> error set from ostree
|
||||||
|
Simon McVittie (4):
|
||||||
|
test-run: be a bash script
|
||||||
|
test-run: don't assume we are uid 1000
|
||||||
|
Adapt tests so they can be run against installed binaries
|
||||||
|
Fix incorrect nesting of backticks when finding a FUSE mount
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Fri Dec 16 10:14:32 UTC 2016 - sebix+novell.com@sebix.at
|
||||||
|
|
||||||
|
- upgrade to upstream version 0.1.4
|
||||||
|
- Build also for Leap 42.2
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Fri Oct 14 2016 Colin Walters <walters@verbum.org> - 0.1.3-2
|
||||||
|
|
||||||
|
- New upstream version
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Mon Sep 12 2016 Kalev Lember <klember@redhat.com> - 0.1.2-1
|
||||||
|
|
||||||
|
- Update to 0.1.2
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Tue Jul 12 2016 Igor Gnatenko <ignatenko@redhat.com> - 0.1.1-2
|
||||||
|
|
||||||
|
- Trivial fixes in packaging
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Fri Jul 08 2016 Colin Walters <walters@verbum.org> - 0.1.1
|
||||||
|
|
||||||
|
- Initial package
|
||||||
208
bubblewrap.keyring
Normal file
208
bubblewrap.keyring
Normal file
@ -0,0 +1,208 @@
|
|||||||
|
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||||||
|
|
||||||
|
mQINBEoEbMcBEACg2ByFTN0inbeNg5aBs2H49AtW/eGqbiWMML3RwlfPqu+I2MGC
|
||||||
|
PeOHBWjtSWyPDixrL1DGDA4Cs0uoxk98sRZE8peAhGpFEdiAcGuQU/JcJ0gDTsfj
|
||||||
|
1WKMcWi6yI5eu8NinkW2pJuMgLpxNtD2j8wfegoBttB4omXinOpCHuz7lGYenbZk
|
||||||
|
6/DCgzVeq+ssOdfjPLSJJPIyIIwhdDorXX0pvzAou168LFlDJaWx7OytYfKz1zV/
|
||||||
|
f+bwnzbMRriAClJYgNl+UT+XnHO3zMIy1mSk4uffaDXeRPPO/R6lM/u7a5w9wHi/
|
||||||
|
oKIPHJ9BmsgA5vBImuNNRa2pnOHwpBnphnpvqLm/98JAJJfMkoefy2Oc2J6PxJla
|
||||||
|
pP090sXzt6T7YpR9epwZCO5+OU6sIbK/vjy1pi0hxx847H4hrKzW67kr9o5btjxm
|
||||||
|
FybqLTT+o01n7x9/A6SBE/vVAfZ1OYm0/DoSNdKpaQtvNeQ1h5gw7gY/uT8VCQB+
|
||||||
|
ZQVRQkInAqYSzO4oYPS9ynud5d3qNllpZs77EaEN5yVKZk/36QUGoRdbmpZoMTjB
|
||||||
|
aaM6G0MUO+1FikvBT+aDmomgD+JkDOZf1bIJaSg/QtIIjq5ALExbk1XDkL++XVDJ
|
||||||
|
9Ag7U467kinjcKWuVIr2aOMMSlXFuDFlsZbeJGCqkdkc2Ucdy1p0fZPWWQARAQAB
|
||||||
|
tChTaW1vbiBNY1ZpdHRpZSA8c21jdkBwc2V1ZG9yYW5kb20uY28udWs+iQJXBBMB
|
||||||
|
CgBBAhsDAh4BAheAAhkBBQsJCAcDBRUKCQgLBRYCAwEAFiEE2pjyXAhxxJpZ6v8s
|
||||||
|
Tej/KmPHzJAFAmOfkucFCSxnKSAACgkQTej/KmPHzJCj6w//fX/1/Z8yOEy4LnlT
|
||||||
|
d+xeA1Z/HzJAykzsqbdfS2wKhglhswPD16T/Rhb8PbmyFEU1n9H/AxX/xsKcOl9X
|
||||||
|
JPTsziKg8N2HY8EcTTM79KhH6boCwZmmGtRVupAnAa7mK0FyySxRmExQhBNN++oJ
|
||||||
|
gSn+D6FWTzR21wvD4gR2U+x3uchINs6fG4f5JEnIrr7aGZPdsCsDSPfm9Jvz/MHG
|
||||||
|
E/cFi6dxZAPAVcKtY85XGSVWxI+wqOYfpVI+hs8FcXrIJ9UXEJhX9FVZ9XybrzyD
|
||||||
|
O4zfNL2LBPayQf3zgcNffA42J/sQDZwEec1bcQd7uQlGFvCRwL7egksBMSH5G0Ff
|
||||||
|
ybuxHF6uydOsZY2ZSA1a/PDRtoQ9PMN0mZO7Euk/gXA0GPi4OwuAkcyuGvu5YQFF
|
||||||
|
bmXZu1Mz6bYjdhoaeSC8wqV6x5Zw1THlRvyKKuq7bFqJksNzxaiBt7fRZDMsOvQ6
|
||||||
|
XHU7ELeDPVCvExhUPXYjVwsBvmsCnLprSwAWIlKhRnAdhUMnbyO2Kjw2KkSrJPgt
|
||||||
|
wESG2LMSdgyqPpSWMoccYRG/zn/W6vqFUZ4SpVy43HSsegNjuS7NUxartr/28CpL
|
||||||
|
f1xFIzwieBmqF047cMQiuvo2U7dQwP+WcG+hWcdvgX3k5MwhXXFOg9A+xt1bPqe0
|
||||||
|
/Vcvc3gqIbxULXlU72BUwVuSXVi0IFNpbW9uIE1jVml0dGllIDxzbWN2QGRlYmlh
|
||||||
|
bi5vcmc+iQJUBBMBCgA+AhsDAh4BAheABQsJCAcDBRUKCQgLBRYCAwEAFiEE2pjy
|
||||||
|
XAhxxJpZ6v8sTej/KmPHzJAFAmOfkwQFCSxnKSAACgkQTej/KmPHzJD1bRAAizrB
|
||||||
|
7z9KFjr+9t3iIEBplYr5/fzK9qEBIVt6pxTZrnJlx2BWf0HPaPc6BpmM8dUWEI7c
|
||||||
|
dXzjM26BFjnU8/HDpBDTmvA31MFMc9kruOn6DlVQGCNGy154isShGh5O8Ytv7VMN
|
||||||
|
r58FUPSMgP8bxyteDEZB9AzxpN7wduFgonS9jn0WuVTKxBGwQQdSfY30dUuMBfed
|
||||||
|
A+bFNAIxVGrmq6H5dyjm92mK5oqo9/b4ZzzJMl2Ii/LTw+XYiCAvwhAwK73272sF
|
||||||
|
oPcSQnBUxA8hzp6fA9/AkUhtCmkvmvckVo6pZgbduVQAGLBUwf7J5Czm8Oe02El1
|
||||||
|
01P9MetJf4NehKGkMgp3B87DkJyUZc2dWlWt9a2KaTm+8ILbj8Bx6AmLCyXJp+jO
|
||||||
|
E26sx5rnwPAZPoDz1wmYfwiKx2aUADOXR/xHgEWb+VPKKB47bbJMcGzUB7t38Ov7
|
||||||
|
Hl7ldnF0vFLlSfxlj2VUHL2+hHs0jw+KyEkC7BN0umfIhiN7JbuurUcqPZzNHIk4
|
||||||
|
SDYLggflkYS6JI8PHxIidVrVHDU/ef94Jq+6hJuH3sRu/l6B2R+mTnXKuzHUXyXu
|
||||||
|
+82R/u9D5NlJYdCUUxVDp0uAMki9jwgRguLwdiG1Xzrdt2DZXaXQ+1gjiCO2YR0W
|
||||||
|
RG80RmG6/DJ7PgnQ52pgLnOEghA8NDMmKh0Xcvq0JlNpbW9uIEphbWVzIE1jVml0
|
||||||
|
dGllIChib3JuIDE5ODMtMDgtMjUpiQJUBBMBCgA+AhsDAh4BAheABQsJCAcDBRUK
|
||||||
|
CQgLBRYCAwEAFiEE2pjyXAhxxJpZ6v8sTej/KmPHzJAFAmOfkvYFCSxnKSAACgkQ
|
||||||
|
Tej/KmPHzJC06w/8COGhjTvLzRozZ2f34C11f5urTNcCDxN1DJNurv/AUdNN8rHq
|
||||||
|
8qUkAxsC6c+MzVrb5brfD0YY496q2HPFdmZX02izTGyo2vp8n4RC4Z+u6gcmuhkU
|
||||||
|
bN+76T35kRO0+k59S/mXWnvErLcyWxgx7fjf6/ZskWNoq779siB0GJ5Ly0ZXGugb
|
||||||
|
GhO+QiZzMprJ9rXzsJJAwcQNRLTclm2hSUAtFd+3lQQVWy9XbMuk8Lng8NC8ReDt
|
||||||
|
es/8ZI/jnwmUz1oR3pewJjwhfl2jKrhplitWI3wcf2PueHN5/qbJq+M9xBCMaYj4
|
||||||
|
LrQ7jSmEMi6WENRtj3BiZsYtGwkX7yc2EImojZZ3iAgpG/hVdxKosmRnvcEjNtOa
|
||||||
|
BrNfjupYhH+7t4eJasHwQNZXJn73/qH95rOtF4STFvlDfpCJa/foOisPc2DF+nhh
|
||||||
|
Xtt7Uvyw5c1rvrNd67crvJSfsgV+WbaDM735oGboM8KmkRQSPcoMj8op8ER8E/oI
|
||||||
|
vKeVJHNEq+cBiql3AYcmzStdFXM+VMeNUhCSW5cUT0mLuxDuRKyRq0bvpjfSUs+j
|
||||||
|
NP/ETzD2f7jCQQ2uWdJ/WvLxwEwcoevSBp6SH2IP1QISmxXeohuKV6yb+UrzL6eB
|
||||||
|
nh6cl9Y32OUayA+eLBXmOcpgk+qsVMkb9iDxy8Igk9bYpYSUv4fNsKh5Wvy0L1Np
|
||||||
|
bW9uIE1jVml0dGllIDxzaW1vbi5tY3ZpdHRpZUBjb2xsYWJvcmEuY28udWs+iQJs
|
||||||
|
BDABCgBWFiEE2pjyXAhxxJpZ6v8sTej/KmPHzJAFAljO8AI4HQBzdXBlcnNlZGVk
|
||||||
|
IGJ5IDNDODY3MkEwRjQ5NjM3RkUwNjRBQzMwRjUyQTQzQTFFNEI3N0IwNTkACgkQ
|
||||||
|
Tej/KmPHzJClKw/+J/7A5uvxfAbJ5Lz/mg4K3owJw79Az67E+J+onM1vYBS+hJxw
|
||||||
|
6cxgzx6LjWVMp+Qnj3lolJ9Xb8X6a3HVSc/sN52FxDqI7M1UrhsvbreRu2quE8im
|
||||||
|
o9EhtKP6GqrLlVDuq/59WGgUmwN5DZOGkJ0DQ5Sv1H92RvcGKJkVabIAKUadehg4
|
||||||
|
9hAyrn2OhCqo99a/I2vujAsudOJC8Z7JG+xy1eOZccmb9AEmim9hs9CigR2GwbIy
|
||||||
|
PrRHMmehbxGVFqot1rkOZh8ztrYskuHQdZvlO/CvIh3oFW3TwUiJss4eGbl8CLiP
|
||||||
|
54Rh7IRggMKlmtWr6BmCSGRsxRQ/ccvjn/NUFynlGxIRh/7UzatMNriuo+j12VQ0
|
||||||
|
QGsHmut6GKfi9ih6nCXEEtGCUDKaQ1llD8zZIuq6+ITIojrc0tRidATYitU68H2Y
|
||||||
|
SEIgEGGqFPrjmj0Kife12hDT0tLq2GrxO7K3UAWi8F43o+Rs/RkOnBVAuW5oEUX9
|
||||||
|
1Vom7WaSyoBnYFiGMjtFl1tiTUN3Gj0nDOaHJl4eGvO25Tq/y+mTp55EdIKUJUW1
|
||||||
|
vsqJneXU92vziw45Od5T9EfW2XlfUn7TiKgLvCq2twMF7vdfc4B4TkNJUZKIOf7/
|
||||||
|
7A+uG2Jmv1aSioqIWG4KZlx7r46C3Zh4aasvqvZqFeRTgaIYwpam4sLiy2G5Ag0E
|
||||||
|
SgRt1wEQAMSwM5piHmJxjWe4SaekBldmZ7kbq7b03mtqGOL0SsSr1AE4DDzqWEeo
|
||||||
|
6DQhQJvkKLmAnSchmjVvNQ4zID5VP3pGTR5D2akPt1ouX1SyBoCfDdu9SNzYvWnr
|
||||||
|
gAc1MfVN4Su1lG7yi3RU+m7dAwITcN+BUE4JNWXudees9yfNq/18TC24z3xZbfYp
|
||||||
|
w1oCWeey03hl5U1PrPl7Dw9xrBnjaqWm215lUhOcjUTHQdf6C0xePH3oS+696A+j
|
||||||
|
Si8VPCG7z6AJNlmCJvaV3aeFjvNtiWpl1ZL3vVzhIKxulOy+p7bK/ZF9OPhT5f6s
|
||||||
|
XS2e/ZRuGt+62s5q+n1r7X28BuoYTgJ/5wCs/oU4IX9zmtK/v8lO2/pMpE9iCwd3
|
||||||
|
hFt1tPAckD81uVycinxZ+qn+mT6OBH/5G9YEw7BUyaNy/aq14H4cZ1TsZ0nAlwNa
|
||||||
|
bvyyQIo1NcG825A4uZ+ZLztvXE8obbOOLDWSFbWB4NUQBqAtxIKloIvMUFE0WIqC
|
||||||
|
gIs/zIIcoUJRn8vk02jm/zaO82myoGzRvivZdztZlCGtsJjsLdbm4dzP0oywdOXe
|
||||||
|
S0YqWjiDuNNLbye0I9fVRvKojr0ban/vx42cUy91CloBtjoNuCWqpmqzTdFB7xc7
|
||||||
|
PWMNxQ6VpSjcsKH83O7pw5/pLLXdY4sl/SdRHFUHjhS+uGfceL4jABEBAAGJAjwE
|
||||||
|
GAEKACYCGwwWIQTamPJcCHHEmlnq/yxN6P8qY8fMkAUCZh+xewUJH92qpAAKCRBN
|
||||||
|
6P8qY8fMkFBaD/9HOqzLmcna/46w8HY6tzrUWoIMTleUBkFpWsewJalipJoRjfI+
|
||||||
|
rJh9KYnOdZKnFy5F7iz00FM3MBcVif3BsfkjgkbbJ6WPajRSZg7llnPDOgxT/iyU
|
||||||
|
xb3+qgX9HGh4HmYW7w1YlYzhjrQ/wxB5AziyZac9HBbuZStcb+olC2c/V+YlBNO3
|
||||||
|
QQQ/Pb60vsMmVZeox5RPfBtjyZP8uciEB5w9vv3/t1YliwJx5GlJM194XOiqzImH
|
||||||
|
9Vo4h2L7YOVtaa+KChb24GShBzc/VsDFeljH6SCIaWzq3TGH7hpEC0fP59xQ+MFZ
|
||||||
|
58CqQ98WnTJIRXInfqa5o2gk7SNEnPNmPuiVUSjByWmSv1haxjhMciGhik69m+82
|
||||||
|
1i+4Z6PCU2MypryTQLuzwTRTsX/Y4120172ppQEexV8jhATKTM6/62X8u9HvRctK
|
||||||
|
Nl/+bpQp0/FK+o2BSmYAuvSOQKcLr7IxlqVSJoFMjnUQENSeBUg+n0XewiilN6cL
|
||||||
|
2ifK6qOxqbOynffFbWpO9FqjVZHKM/3oO/CmKQJ46FHjqKAnhnRpG5j/5Kj9BBJw
|
||||||
|
Y+9xetfa8n1ES80NwCQZcEaa7xD08kqq8aWHCExDGnWohF3/PYEdO+cqTN9RUN6H
|
||||||
|
YWHi24Xs/S7D0my+ubkpnfXawhPbeSx0Eq2iQJ/685QE/G+kKikbed887bkCDQRm
|
||||||
|
H7ERARAAunxdA+AKJdY8BUNyuxD52lg5lzS27OVmrfkcSVpp01homz1XjJxBYfY2
|
||||||
|
akIhze0R1+2e34u/L3rqsD9m5rxi7OlArpsfszgz3cCqk/4IFhoo71SMrjrpsmIw
|
||||||
|
MRoheBwQGXFOtB96I1gnzZ6/Ya10PNIrWs4bQjpIf4PzaV2Q0SMZZWzq9wgSnIpY
|
||||||
|
Bqk3LHnmGMY/2/JJLsaNrmc0phcBEBrUdbvAjj0zblW6873DI0aqFvkwZQPDXh3a
|
||||||
|
HcQmw8bcDsuv1XPq2Ik2+NXiWFZ6pZWqCjwW+QeUurCDVP2lq2dNvrZBBnaOnXYZ
|
||||||
|
jE8iT3zg2orGXdRgaQ/qnQH+vvF9zZkCBoi/wca2Zi6wWitb0Hk7M8igALGHaxwh
|
||||||
|
CMUVlpNIFO0lx4V5dOZI3vUBdGR7KwMkFXcY1X33cB64dci8cjKpBjvUcTWwaFsl
|
||||||
|
QdtxX48CaX3cf8x2b5qBhDv1j2Jh62P8lK4NyTbwz3EwAvliySLGf2HYOpq4nU8W
|
||||||
|
j3D1Lb1LwvEQ7ulXFIcML059SLA8amILLqkqs711TPka7NmMrfFUeYaYQ/ddJ7rn
|
||||||
|
ngDa4HEPGEgzw3oQioQkDHuE80PkGoxpclEpkY40+ZOY2CgkbBHul1Fx4w8icg5Y
|
||||||
|
WUPXUqGPze61NZ+TxrPfrWZfApcAErjszYDeRHa4PD2tIFWJgS0AEQEAAYkCPAQY
|
||||||
|
AQoAJhYhBNqY8lwIccSaWer/LE3o/ypjx8yQBQJmH7ERAhsgBQkDwmcAAAoJEE3o
|
||||||
|
/ypjx8yQyTQP/29LTZR0640S+7GdukXXPpkFrNF/NQwbgSCPpSnnuHMR+kPCaSmf
|
||||||
|
1yethqWcAYKenWaCi0f634HFbn6GpkgTd4w8dk0438NikKZOQ1PrEfcS1Q/lOiW9
|
||||||
|
p2aO8qer2EPSar/m6gyNTx6DX4qNb6DJXVdBsGTZPa8j9amLLoGnVA7qjt0S8btX
|
||||||
|
V4xSsTGLLJ1MMAoe86tr9Z43RD/HmRC6yZNI/zKA7TGvgz/YK4lMutcFfLwyM/CI
|
||||||
|
WCIJ8AIvV2hCQVAdEP/sQSS1OXDm7bzc6II+tq/2oNqeV1BLzh5714X/+XtizsRa
|
||||||
|
RrqdrZad8cFcTsvbQuWirxGTKPuEs2VK+yz4XX4HHSgIqSBU+Y54HGpyMMECqK+f
|
||||||
|
xclFiVTTBIEgDUeCfBpyKJ/+O9/dMpkYzhqjF9bzHXqesO9WK8b1AFVVDdU1pJxb
|
||||||
|
TsT0BAGFA5yZmxBkXnGgNsciJhADV15IDsft1vXp+stU/TmqoGRzxb0JBLscTSwp
|
||||||
|
zsqdCRbgcG7+cSrYGBXFtrTTYPXLfJFdS6Zj1Z5/XLmixLYg6fGIh3+zGO4WP4Lj
|
||||||
|
ywrc0VR7dnQteRkA8IWaDl+IEZFE7455F/G9D0XHmBRy52Y7++Y1+zTIjJLIP8F8
|
||||||
|
IeZHNdYxZVF7s8sGk+n0mvHmtigpb9vc7bz1KQpojEDi4uwFb1Bl5BkkuQINBGYf
|
||||||
|
sPYBEADMmaLRAvcX9Z7orMRamv7VPeCBn1Y6/qjZDIcx1RedvzkcLXaIjcfqIPmA
|
||||||
|
78JtMJ8CmSExc/TqIFeD/gwHAyhUDh9AExtlvzo7fXMBgi97REFwPk4YZJwRiIkH
|
||||||
|
CRBQpYK42AbOnfr5WXB6R4MH9dWusvyevRgtsYqnhXFXpNUeD3XV1hbNJZTNmSJ/
|
||||||
|
6mFn6APfPjciBSPDMLLiLmzsIsaRq6YBrcs/d266oFQhZ+usKKqoVg+bXKxm4LpX
|
||||||
|
igZ62SqwwzCFDtzttYHQLF9XLHL0zy8aFmVWRU2WQjlTQmr6JC/iOl44GMSwTIhJ
|
||||||
|
J3yTD6DS0iLOy+PVyZjspoET2iemExe+bne0PUNCV753/aEf9Jqx9IuNBb5XcFva
|
||||||
|
3oWNiWJsHcCa5gPCE1XpkRt/vBibSOhm4/yHWgH+mt15JrfAohUtPBSzfSRwLPXK
|
||||||
|
ko+XpqdUighuqEZYqitHHSiiwfrbjh12O0XTJ8DDYRay6YMrbvCNo5QBKWj/UHNn
|
||||||
|
tgy8esqAi22MqzrYzLqTD5+9vBxHVuY8GCAm1ULNxltA8hWPkgDWogdh5QfY00/j
|
||||||
|
tYzkoPcf0SlZwTe5a4bIP+mVYlab7wq4qNkRlOYAHNbZZHnI7sRY4eVzsyMO9Y83
|
||||||
|
Sw1PcJPZ09NYrtkAyynmwPYKporojp5kb3jOrI4Pi2jb+E2i5QARAQABiQRyBBgB
|
||||||
|
CgAmFiEE2pjyXAhxxJpZ6v8sTej/KmPHzJAFAmYfsPYCGwIFCQPCZwACQAkQTej/
|
||||||
|
KmPHzJDBdCAEGQEKAB0WIQR6BzrRrmlPolv/YuUjXAmdPrMwdgUCZh+w9gAKCRAj
|
||||||
|
XAmdPrMwdjW5EAC+a3xPNamOonKe0WOhSbPdTzfSenb0tmLmK5NKm0PCDNT/O3Qh
|
||||||
|
7++MEA69NJRIF4TUsZv6eyDN/nulOoFID8gxK9CPG6gCW0QGE39rzrFcZGzIa6ql
|
||||||
|
70YK8tSsuDQcwbP0wwUynIpkgqeyNj6jrRi5ggGLGVj8GfV/d2MZJOeOBPqPuFaA
|
||||||
|
3kqoubOXK4tV37coTsycfmMZfMWClGVHba4HfPtBSw+ocTrRfPtC09WdE46ggkm5
|
||||||
|
ITIVOgG56k4Z10GT+gAmSIRIXOdlR4ZUEv/0BojLsVrtaSCCDJEYkL9ricpWFxFG
|
||||||
|
I9IjVHBKcsl4Yi/19QgRhqyc7JQpawu44l9FKV/9eTPBIwOW35RJ/7aOIeaxOb6N
|
||||||
|
ix5kr7CJ4RmX3fz4JDY0HybyTwkfKevsDlz21G/IJp67AxtlaKDxtfmfYcv2quyC
|
||||||
|
00ges7aW4ik/TkWGqEPkrq7PAxcUVKHEzUQCGvCS6UvuFpy3F6VzyAlGuqCng2Ry
|
||||||
|
O3Pw8/flEAZQ7bb80R6fwnq1XC/V9kuDhSM1xY2K5X9lMMovmykOKqVjgzyfGkai
|
||||||
|
nQlsSVGCtcun4eiPVpzoZJJ795fcNe0dKzquse4EGjx21qIlBZyTr/3BxFpDL7HV
|
||||||
|
w8CnNP+Xgp57oc/RPiwgSFgec4XkwUH2dA+6vTIi0IJn6UXPeITh5PscFxU7EACL
|
||||||
|
vaBwq74XZfnnpwl58ddt1miAkdR8cRKEfdXctajFgTuF8xagrVOlBpasvyQjrE4H
|
||||||
|
n+BWedApHS1xKnOzt1fNxgjHO5oQ7xW+zfu9QGl9Jo7tqAZuQfZWnzF4Jijtz8Aq
|
||||||
|
S8f0IgFw1obLrFhOAVgtnhQTEiKSkBLGb/AzcjBMmmzyHQXnFS5AM5ARAXOxJ1hm
|
||||||
|
k9/UDZhzjKsgmtmyLFGeL7+4031IEAe2rrgRMcDXdd08e54bH4be+KADDYnnrXQC
|
||||||
|
/oey9+IuZE3Wa9LsfbLkFPbc9/Ec2M4Sll525uWaGR9tdOESECKXPXskF/Z/U+nh
|
||||||
|
R+hQ5UP7ZA+b7y70TmsRIhsmO8Ysvcs0WABv8radHqCflMPcaRw34APz6SDt7JyG
|
||||||
|
viD+PoTN1HMQT5IccD4u1D4y8YO+ge5y1RhciXtzJrIhzhFInyhqGPJmD719K/fq
|
||||||
|
ooDGO7SMUL9XYcz3TwW1JoXfhhHpztkF004gdE9CEJmWuu9T0SIzBKEOctmil1B9
|
||||||
|
YqKtxyUb8sj/l4xxH7zMlSh+0t40ytIDt2uragDDVbdV+4A3OSlNTu8adPbAc5Vz
|
||||||
|
qUyLH8bmaN+Trgek0U8HGIWdc9TE4p/ussaRgB6C7edDp9Ru9gTYUuKmSHs0TXhV
|
||||||
|
N0m9J0v6rnnJ8G6qPmCTRmiTd2KDK+AlIQF7jrp3l7kCDQRZV7yuARAAs2t1cYyI
|
||||||
|
MO+WhEqKqK2M6JzBFBP6hiUzy+LOfCK4zQ2kBRM8RE2th2f0wZtQjsh29hFJ2Y/Q
|
||||||
|
HEcGqPFtI0uC7fAB1G9zcEIdlprr+PEgGg3i+dufewNIYTPmCQ3ckOnhxueUYwdg
|
||||||
|
SDL0em15UTN2RfQSBsDa7QhhzA1qa3bCqWMHelxarwVAyZLQ18NUx8W4WmETuoqP
|
||||||
|
n+4X/KeoSbBhDbvxbbcnE1rvXUavr/nTG9K7FSqipI3474aMZa+8ABXc6Hvp6GAX
|
||||||
|
vOf8fdM+E2fRyAWEBX33ttIMnzCQZ0LXu0TlM94o0o6NgsHRC0+gw8xdYluxjdv6
|
||||||
|
sXS2Z/aMbI67ZG9eERXFRnclYYCCHLmHXcZSgg2GQpi+EHW2WtperDb6CCnmaGuM
|
||||||
|
P9iWhtST4p5jst8AsansHyRmCqmuqzaj1Tf9/ThRtm4JNFfgSmqBAejoK0wUPNOR
|
||||||
|
pPYq7N7JF0BT8Y22+QxqJYykdfIEBj5fthzTZaHxxVwuWd8ZkyAD+T0Q81riZ/UR
|
||||||
|
uBZ3BvcbiPnhbpZjyR6Y5C4bfdWhPFW7yuHNsGIw+8BYpMfzSPyY16mo0gwyCp5F
|
||||||
|
GyQWImIqA+CHlTRZcJyVOTs5zTFZSsdfzlxDYO4lIFq8N33na/O1GfFDaH4SShMw
|
||||||
|
Aqc1a4AJD3LOTlZuu4pFt5PMvswyyqyXw0cAEQEAAYkCPAQYAQoAJgIbIBYhBNqY
|
||||||
|
8lwIccSaWer/LE3o/ypjx8yQBQJjn5N2BQkOCj2uAAoJEE3o/ypjx8yQ4lcP/3w1
|
||||||
|
1MtMf/5IlF+xBtYENcu5E3YWT2gdMe1QNYTrttjEzfCR0uHTtfX9a/EJ8Fp4MJBJ
|
||||||
|
9xBTz8qgXG/bEAc1Kd8onSaTznEpjKml0MJBF2BQDdAXWCMw/6mACH2KWGA7gQYd
|
||||||
|
rJFoCZTj8lTS/qBDTJMXZ9Xj72PHKI15J3pS54Is2Jj4ZLGxlrgMUPVFKq1XRAiV
|
||||||
|
32dcxDDvKyiOCVeSAk4uV+1gyWw1Z45dip3bsBE+Xiy06BCP7NB4x/xkWPzc9L9h
|
||||||
|
/cV5WGRUqWYQgRnPAir0hMkfdZXwjE5xs4a/TK0hU3YpbVcAo7ZOiuHbbVJ7v6Li
|
||||||
|
7jqGZthUGgwcHuRAb4qfK9QIQ9MkBoHilxewrUMMsioDsLXmpRot+N1ZP9vrh3SS
|
||||||
|
ynVX5G/iJLEqzbEfXang+UWA4AHgGeggp4NZcyWpliHlEkAy2iU/ffkxaKnUyGon
|
||||||
|
/iB7Ag/BiCtKuD119Vme8jipjOZYOqHdqxxaVNDGQNF/O5mLO2n5C6OQkvoix8Im
|
||||||
|
MuMnhlc1mEErmwc14qplwFTCyoSvSSptFnzTw4Onbfl7FEsjTyoh7qxzZgqe1WVi
|
||||||
|
teuieUQ5/saufp4wbv7aNk/scfCuRytXrd0UQLIAjpPSQVWg2gud+0Tg4aBzcf/q
|
||||||
|
lhShsXE+DS/ewdqFJ2yJQ6wnV9O/Ge51sFI5g6H/uQINBFlXt+8BEAC5XfTqbrAi
|
||||||
|
+uYWuKAGBYQwxgbstCE9sU6PhzyLPT+HzoC3tJrKfZrk9VwcHpy2H7rk8++6wfJd
|
||||||
|
fdXgVEi6gwYP2XA+DyjQKRBjEg2PeCDVOfKFIz5b0G+luSNkOaPy/CQuMY3slGGx
|
||||||
|
EldymrAF2xaVPRs1htzoW6YjxrTb72NUs3DrFtcFNfRkkqBtRY9mIjt9TJh52rZM
|
||||||
|
TR8fOryj5o15nakiMIlK/G5Jzh4oo2MA0FIrv6ysH6GorRdoAFCXE1PwGegZwDmr
|
||||||
|
BBzyr8bdaHqfCR0Bi1QRIcO+V60o42tir3amuv4PXqJWYrFkvIPZ3EA+4TG4I/CB
|
||||||
|
DR69SAk5JYWy1VEtawvo8ptV/RXBxKPcPF72qZwEc6LvG5XxCvFNjttqmBijTiWA
|
||||||
|
ok7h03UK0WeHquOaDVLjalnUSMBZD3LScyNh/xJpA7Y3a04sg/dV/I/zy9vqGiSK
|
||||||
|
/1JQVabbF8zXuJQ+PX2jaH21yTRsKvlHKbdr5tXogXESpKt5rDFnwPFNgFX7GYnl
|
||||||
|
G9Zg21P39crB+ZivTvciCrtxPJ8zn2soVhAREjCwcOjExZ3RFG0Zoegfz636FS42
|
||||||
|
P5Vte14dZNIMBcRlcWCcxQnEjxvu8+B62yL3lvMMjj7OrdWirQreqrVKmItXD3bp
|
||||||
|
Q4lNxTmMlqycCCR+WpMW9wJvksJ+gGKiYQARAQABiQRyBBgBCgAmAhsCFiEE2pjy
|
||||||
|
XAhxxJpZ6v8sTej/KmPHzJAFAmOfk2oFCQ4KQm0CQMF0IAQZAQoAHRYhBDbsWmRI
|
||||||
|
pPXveb7+mOBa4UePgUxPBQJZV7fvAAoJEOBa4UePgUxPXsIP/0snY8VlwDpgD2Zi
|
||||||
|
mCI9sBDtNYo80J0whOn6ls8Ha1u1D8T9JPRBLhhPMP/Ftu5cVhnBvjFHhMBinbjB
|
||||||
|
dWnHQuda9MMxfb3SGK4S/gJ8CbIC/fqP0GC0kXvPslFkYLR1hef2nlj4qDd0otCV
|
||||||
|
SNOB1dmeeJ6VhPOcfpfyOvr/bDCvRYKI2XM4aLqU1YUjFZu4XvUkv/zHi5ohC7ka
|
||||||
|
M0WyEwUh5RXZhxMYDbonocdMnHkIAt0SFWBeUSpcQYQg70Fw15+xSFKYAhpjO3r8
|
||||||
|
FoFaR7Lp3yFgHZf4kVla2XDqfN203nROYUf9V8lOwkaaOZrxFUFvXGA3EkQpn9mX
|
||||||
|
ou56vq6PoHISPOROFE+eSrCJXlQkpxBGO4jQpub45eyWHItV4fIe4zOFwjEx0pVi
|
||||||
|
MJgt1Iib05iDP7cSithdllC77OVRzgNmYGed5DkEp/YjQmUr3ohCuSCZIz6Cz6+j
|
||||||
|
vtLLG4/RWggkZ6ktK43ED293B/YxceeQr4gflvnrdnGK1D4MrXE6D21+CaIFqb00
|
||||||
|
tuMGGCJ7CBx2uvM7GAche6hv6SvCmx1Q6WtefJsU9PQQxu/SWkHKkPJlgZCgZvUq
|
||||||
|
GI9xukqG0DgSUR/SXIyAcjaGq9UE2zKuekeAihGWsduwr4cCTe18sP3HGEYHEL0D
|
||||||
|
5hX0KR78ryCGt7NR7x6QWrFwElK+CRBN6P8qY8fMkMWTD/0UCzVWU7G+rWSO7FB5
|
||||||
|
ieryleNJm7PN7/a7mhZ02te26pK2M4hB7II0hJGGPi8IwxENvoEpzmzLHHSyFrly
|
||||||
|
il2meimCophIHhWnRxLQfAQ8RZzdNbLcj4L2JNMMxPZmkeqMcvEjikWePm9usFvi
|
||||||
|
7tgwsGFaC6hLRqBBiHSLXj3cYDreCUMCbEGk279HPEqFlVYgNpTxK1rPJAVHv9Uy
|
||||||
|
D2BoAX2vI6ioMsJzoSMvOA89Jmz3xp52Y1DmCBXHKV7Q37oPa+ofIQAaRV4bh8mT
|
||||||
|
SqHu9Um47qij1Uwb3JR4dgMdiuMvfQYsL4/Tu0oJa2Kw+QYhRhXCJMYHYKG7n3pP
|
||||||
|
tt7rvA6407FZXnHcmsCurQxXu03+3nhfPoxhSFou1s+mDHl/mft5p9E+Pmxbg4W+
|
||||||
|
ElqXpkmKyN4ckHCtLzId6Cgw4zHbC9nzgTRw4uKY+bxukvcdv54G720Rl5UJkILz
|
||||||
|
e+ObWzuZsILibop2tDSY/3b4a0y8HiVxsIBHqoI8KCce9xLebo/mdj79mZmfdAkK
|
||||||
|
axGeAcqchtvCFAju0xTl+v68Xeeh0Psb50HLa2X57v3Ay1wIaiCy+HuGQfN9XgFb
|
||||||
|
KzVkYwaV7WNlx4Vr+XYTHxNBcJH+TXSatVSToCb6vNrdfj8lmST6Yhnr3iVlUdSN
|
||||||
|
pVbHWbZSGkUptYFdg5psy9Tniw==
|
||||||
|
=861B
|
||||||
|
-----END PGP PUBLIC KEY BLOCK-----
|
||||||
89
bubblewrap.spec
Normal file
89
bubblewrap.spec
Normal file
@ -0,0 +1,89 @@
|
|||||||
|
#
|
||||||
|
# spec file for package bubblewrap
|
||||||
|
#
|
||||||
|
# Copyright (c) 2024 SUSE LLC
|
||||||
|
# Copyright (c) 2024 Andreas Stieger <Andreas.Stieger@gmx.de>
|
||||||
|
#
|
||||||
|
# All modifications and additions to the file contributed by third parties
|
||||||
|
# remain the property of their copyright owners, unless otherwise agreed
|
||||||
|
# upon. The license for this file, and modifications and additions to the
|
||||||
|
# file, is the same license as for the pristine package itself (unless the
|
||||||
|
# license for the pristine package is not an Open Source License, in which
|
||||||
|
# case the license is the MIT License). An "Open Source License" is a
|
||||||
|
# license that conforms to the Open Source Definition (Version 1.9)
|
||||||
|
# published by the Open Source Initiative.
|
||||||
|
|
||||||
|
# Please submit bugfixes or comments via https://bugs.opensuse.org/
|
||||||
|
#
|
||||||
|
|
||||||
|
|
||||||
|
Name: bubblewrap
|
||||||
|
Version: 0.11.0
|
||||||
|
Release: 0
|
||||||
|
Summary: Core execution tool for unprivileged containers
|
||||||
|
License: LGPL-2.0-or-later
|
||||||
|
Group: Productivity/Security
|
||||||
|
URL: https://github.com/containers/bubblewrap
|
||||||
|
Source0: %{url}/releases/download/v%{version}/%{name}-%{version}.tar.xz
|
||||||
|
Source1: %{url}/releases/download/v%{version}/%{name}-%{version}.tar.xz.asc
|
||||||
|
# https://www.pseudorandom.co.uk/2003/contact/
|
||||||
|
# 0x4DE8FF2A63C7CC90, fingerprint: DA98 F25C 0871 C49A 59EA FF2C 4DE8 FF2A 63C7 CC90
|
||||||
|
Source2: %{name}.keyring
|
||||||
|
BuildRequires: docbook-xsl-stylesheets
|
||||||
|
BuildRequires: gcc
|
||||||
|
BuildRequires: git
|
||||||
|
BuildRequires: libcap-devel
|
||||||
|
BuildRequires: libtool
|
||||||
|
BuildRequires: libxslt
|
||||||
|
BuildRequires: meson >= 0.49.0
|
||||||
|
BuildRequires: pkgconfig
|
||||||
|
BuildRequires: pkgconfig(libselinux)
|
||||||
|
|
||||||
|
%description
|
||||||
|
Bubblewrap (%{_bindir}/bwrap) is a core execution engine for unprivileged
|
||||||
|
containers that works as a setuid binary on kernels without
|
||||||
|
user namespaces.
|
||||||
|
|
||||||
|
%package zsh-completion
|
||||||
|
Summary: Zsh tab-completion for bubblewrap
|
||||||
|
Group: System/Shells
|
||||||
|
Supplements: (%{name} and zsh)
|
||||||
|
|
||||||
|
%description zsh-completion
|
||||||
|
This package provides zsh tab-completion for bubblewrap.
|
||||||
|
|
||||||
|
%prep
|
||||||
|
%autosetup -p1 -n %{name}-%{version}
|
||||||
|
sed -i '1d' completions/bash/bwrap
|
||||||
|
%if 0%{?suse_version} < 1500
|
||||||
|
sed -i '1s,%{_bindir}/env bash,/bin/bash,' demos/bubblewrap-shell.sh
|
||||||
|
sed -i '1s/env //' demos/userns-block-fd.py
|
||||||
|
%else
|
||||||
|
sed -i '1s/env //' demos/bubblewrap-shell.sh demos/userns-block-fd.py
|
||||||
|
%endif
|
||||||
|
sed -i '1s/env //' demos/flatpak-run.sh
|
||||||
|
|
||||||
|
%build
|
||||||
|
%meson
|
||||||
|
%meson_build
|
||||||
|
|
||||||
|
%install
|
||||||
|
%meson_install
|
||||||
|
find %{buildroot} -type f -name "*.la" -delete -print
|
||||||
|
|
||||||
|
%files
|
||||||
|
%license COPYING
|
||||||
|
%doc README.md demos
|
||||||
|
%dir %{_datadir}/bash-completion
|
||||||
|
%dir %{_datadir}/bash-completion/completions
|
||||||
|
%{_datadir}/bash-completion/completions/bwrap
|
||||||
|
%{_bindir}/bwrap
|
||||||
|
%{_mandir}/man1/*
|
||||||
|
|
||||||
|
%files zsh-completion
|
||||||
|
%license COPYING
|
||||||
|
%dir %{_datadir}/zsh
|
||||||
|
%dir %{_datadir}/zsh/site-functions
|
||||||
|
%{_datadir}/zsh/site-functions/_bwrap
|
||||||
|
|
||||||
|
%changelog
|
||||||
Loading…
Reference in New Issue
Block a user