Accepting request 1216680 from devel:microos

Update to version 1.37.5 (forwarded request 1216563 from danishprakash)

OBS-URL: https://build.opensuse.org/request/show/1216680
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/buildah?expand=0&rev=94

0001-Properly-validate-cache-IDs-and-sources.patch

@@ -1,111 +0,0 @@
-From 37d71af79a9c2dbebe56073fa6f4bd7271b1419e Mon Sep 17 00:00:00 2001
-From: Matt Heon <mheon@redhat.com>
-Date: Wed, 9 Oct 2024 15:23:03 -0400
-Subject: [PATCH] Properly validate cache IDs and sources
-
-The `--mount type=cache` argument to the `RUN` instruction in
-Dockerfiles was using `filepath.Join` on user input, allowing
-crafted paths to be used to gain access to paths on the host,
-when the command should normally be limited only to Buildah;s own
-cache and context directories. Switch to `filepath.SecureJoin` to
-resolve the issue.
-
-Fixes CVE-2024-9675
-
-Signed-off-by: Matt Heon <mheon@redhat.com>
-Signed-off-by: Danish Prakash <contact@danishpraka.sh>
----
- internal/volumes/volumes.go | 19 ++++++++++++++-----
- tests/bud.bats              | 34 ++++++++++++++++++++++++++++++++++
- 2 files changed, 48 insertions(+), 5 deletions(-)
-
-diff --git a/internal/volumes/volumes.go b/internal/volumes/volumes.go
-index da6b768fdc21..610e9fcf11b2 100644
---- a/internal/volumes/volumes.go
-+++ b/internal/volumes/volumes.go
-@@ -23,6 +23,7 @@ import (
- 	"github.com/containers/storage/pkg/idtools"
- 	"github.com/containers/storage/pkg/lockfile"
- 	"github.com/containers/storage/pkg/unshare"
-+	digest "github.com/opencontainers/go-digest"
- 	specs "github.com/opencontainers/runtime-spec/specs-go"
- 	selinux "github.com/opencontainers/selinux/go-selinux"
- )
-@@ -374,7 +375,11 @@ func GetCacheMount(args []string, store storage.Store, imageMountLabel string, a
- 			return newMount, nil, fmt.Errorf("no stage found with name %s", fromStage)
- 		}
- 		// path should be /contextDir/specified path
--		newMount.Source = filepath.Join(mountPoint, filepath.Clean(string(filepath.Separator)+newMount.Source))
-+		evaluated, err := copier.Eval(mountPoint, string(filepath.Separator)+newMount.Source, copier.EvalOptions{})
-+		if err != nil {
-+			return newMount, nil, err
-+		}
-+		newMount.Source = evaluated
- 	} else {
- 		// we need to create cache on host if no image is being used
- 
-@@ -391,11 +396,15 @@ func GetCacheMount(args []string, store storage.Store, imageMountLabel string, a
- 		}
- 
- 		if id != "" {
--			newMount.Source = filepath.Join(cacheParent, filepath.Clean(id))
--			buildahLockFilesDir = filepath.Join(BuildahCacheLockfileDir, filepath.Clean(id))
-+			// Don't let the user control where we place the directory.
-+			dirID := digest.FromString(id).Encoded()[:16]
-+			newMount.Source = filepath.Join(cacheParent, dirID)
-+			buildahLockFilesDir = filepath.Join(BuildahCacheLockfileDir, dirID)
- 		} else {
--			newMount.Source = filepath.Join(cacheParent, filepath.Clean(newMount.Destination))
--			buildahLockFilesDir = filepath.Join(BuildahCacheLockfileDir, filepath.Clean(newMount.Destination))
-+			// Don't let the user control where we place the directory.
-+			dirID := digest.FromString(newMount.Destination).Encoded()[:16]
-+			newMount.Source = filepath.Join(cacheParent, dirID)
-+			buildahLockFilesDir = filepath.Join(BuildahCacheLockfileDir, dirID)
- 		}
- 		idPair := idtools.IDPair{
- 			UID: uid,
-diff --git a/tests/bud.bats b/tests/bud.bats
-index b1ed89072ce6..79ca91b2b5e6 100644
---- a/tests/bud.bats
-+++ b/tests/bud.bats
-@@ -6917,3 +6917,37 @@ _EOF
-   run_buildah 125 build $WITH_POLICY_JSON ${TEST_SCRATCH_DIR}
-   expect_output --substring "invalid mount option"
- }
-+
-+@test "build-check-cve-2024-9675" {
-+  _prefetch alpine
-+
-+  touch ${TEST_SCRATCH_DIR}/file.txt
-+
-+  cat > ${TEST_SCRATCH_DIR}/Containerfile <<EOF
-+FROM alpine
-+RUN --mount=type=cache,id=../../../../../../../../../../../$TEST_SCRATCH_DIR,target=/var/tmp \
-+ls -l /var/tmp && cat /var/tmp/file.txt
-+EOF
-+
-+  run_buildah 1 build --no-cache ${TEST_SCRATCH_DIR}
-+  expect_output --substring "cat: can't open '/var/tmp/file.txt': No such file or directory"
-+
-+  cat > ${TEST_SCRATCH_DIR}/Containerfile <<EOF
-+FROM alpine
-+RUN --mount=type=cache,source=../../../../../../../../../../../$TEST_SCRATCH_DIR,target=/var/tmp \
-+ls -l /var/tmp && cat /var/tmp/file.txt
-+EOF
-+
-+  run_buildah 1 build --no-cache ${TEST_SCRATCH_DIR}
-+  expect_output --substring "cat: can't open '/var/tmp/file.txt': No such file or directory"
-+
-+  mkdir ${TEST_SCRATCH_DIR}/cve20249675
-+  cat > ${TEST_SCRATCH_DIR}/cve20249675/Containerfile <<EOF
-+FROM alpine
-+RUN --mount=type=cache,from=testbuild,source=../,target=/var/tmp \
-+ls -l /var/tmp && cat /var/tmp/file.txt
-+EOF
-+
-+  run_buildah 1 build --security-opt label=disable --build-context testbuild=${TEST_SCRATCH_DIR}/cve20249675/ --no-cache ${TEST_SCRATCH_DIR}/cve20249675/
-+  expect_output --substring "cat: can't open '/var/tmp/file.txt': No such file or directory"
-+}
--- 
-2.46.0
-

_service

@@ -5,7 +5,7 @@
     <param name="filename">buildah</param>
     <param name="versionformat">@PARENT_TAG@</param>
     <param name="versionrewrite-pattern">v(.*)</param>
-    <param name="revision">v1.37.4</param>
+    <param name="revision">v1.37.5</param>
     <param name="changesgenerate">enable</param>
 </service>
 <service name="recompress" mode="manual">

_servicedata

@@ -1,4 +1,4 @@
 <servicedata>
 <service name="tar_scm">
                 <param name="url">https://github.com/containers/buildah.git</param>
-              <param name="changesrevision">df9247c59b2d44cb7b698fab124f2efe6a17032d</param></service></servicedata>
+              <param name="changesrevision">5fd40b989860984a00f6fc1539ff53caceca1325</param></service></servicedata>

buildah-1.37.4.tar.xz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:5189a2b518d7249f9f322b9506278c2245e184d50dddb4ae7dac589d4e8ce090
-size 11768780

buildah-1.37.5.tar.xz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:5fbb41b906a26deb5db84eb7850fa61436d77b427d805471f19908e8d048a684
+size 11777240

buildah.changes

@@ -1,3 +1,14 @@
+-------------------------------------------------------------------
+Mon Oct 21 06:45:12 UTC 2024 - danish.prakash@suse.com
+
+- Update to version 1.37.5:
+  * [release-1.37] Bump Buildah to v1.37.5
+  * Bump the containers/storage library to v1.55.1 (CVE-2024-9676, bsc#1231698)
+  * Properly validate cache IDs and sources
+  * Packit: constrain koji job to fedora package to avoid dupes
+- Removed patch:
+  * 0001-Properly-validate-cache-IDs-and-sources.patch (merged upstream)
+
 -------------------------------------------------------------------
 Tue Oct 15 06:48:18 UTC 2024 - Danish Prakash <danish.prakash@suse.com>
 

buildah.spec

@@ -19,7 +19,7 @@
 
 %define project github.com/containers/buildah
 Name:           buildah
-Version:        1.37.4
+Version:        1.37.5
 Release:        0
 Summary:        Tool for building OCI containers
 License:        Apache-2.0
@@ -27,7 +27,6 @@ Group:          System/Management
 URL:            https://%{project}
 Source0:        %{name}-%{version}.tar.xz
 Source1:        %{name}-rpmlintrc
-Patch0:         0001-Properly-validate-cache-IDs-and-sources.patch
 BuildRequires:  bash-completion
 BuildRequires:  device-mapper-devel
 BuildRequires:  fdupes