Accepting request 1144201 from Virtualization:containers

OBS-URL: https://build.opensuse.org/request/show/1144201
OBS-URL: https://build.opensuse.org/package/show/devel:microos/buildkit?expand=0&rev=7

_service

@@ -1,20 +1,20 @@
 <services>
-  <service name="download_files" mode="disabled" />
-  <service name="tar_scm" mode="disabled">
+  <service name="download_files" mode="manual" />
+  <service name="tar_scm" mode="manual">
     <param name="url">https://github.com/moby/buildkit.git</param>
     <param name="scm">git</param>
     <param name="exclude">.git</param>
-    <param name="revision">v0.12.4</param>
+    <param name="revision">v0.12.5</param>
     <param name="versionformat">@PARENT_TAG@</param>
     <param name="changesgenerate">enable</param>
     <param name="versionrewrite-pattern">v(.*)</param>
   </service>
-  <service name="set_version" mode="disabled" />
-  <service name="recompress" mode="disabled">
+  <service name="set_version" mode="manual" />
+  <service name="recompress" mode="manual">
     <param name="file">*.tar</param>
     <param name="compression">zst</param>
   </service>
-  <service name="go_modules" mode="disabled">
+  <service name="go_modules" mode="manual">
     <param name="compression">zst</param>
   </service>
 </services>

_servicedata

@@ -1,6 +1,6 @@
 <servicedata>
   <service name="tar_scm">
     <param name="url">https://github.com/moby/buildkit.git</param>
-    <param name="changesrevision">833949d0f7908608b00ab6b93b8f92bdb147fcca</param>
+    <param name="changesrevision">bac3f2b673f3f9d33e79046008e7a38e856b3dc6</param>
   </service>
-</servicedata>
+</servicedata>

buildkit-0.12.4.tar.zst

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:2461a23f704b5b0bc4f7ca9f78ff1024b970f3b47bc8e9312fea73b977c26454
-size 7253926

buildkit.changes

@@ -1,3 +1,25 @@
+-------------------------------------------------------------------
+Thu Feb 01 16:36:18 UTC 2024 - dcermak@suse.com
+
+- Update to version 0.12.5:
+  * update runc to v1.1.12
+  * exec: add extra validation for submount sources (fixes CVE-2024-23651, bsc#1219267)
+  * oci: fix error handling on submount calls
+  * executor: recheck mount stub path within root after container run (fixes CVE-2024-23652, bsc#1219268)
+  * llbsolver: make sure interactive container API validates entitlements
+  * gateway: pass executor with build and not access worker directly
+  * pb: add extra validation to protobuf types
+  * sourcepolicy: add validations for nil values
+  * exporter: add validation for platforms key value
+  * exporter: add validation for invalid platorm
+  * exporter: validate null config metadata from gateway
+  * ci: disable push if not upstream repo
+  * hack: use git context only for upstream repo
+  * hack/test: allow ALPINE_VERSION to be set from env
+  * hack: align syntax
+  * vendor: github.com/cyphar/filepath-securejoin v0.2.4
+  * tracing: allow the `Resource` to be set externally
+
 -------------------------------------------------------------------
 Mon Dec 04 13:14:41 UTC 2023 - fredrik.lonnegren@suse.com
 

buildkit.spec

@@ -23,7 +23,7 @@
 %global provider_prefix %{provider}.%{provider_tld}/%{project}/%{repo}
 %global import_path     %{provider_prefix}
 Name:           buildkit
-Version:        0.12.4
+Version:        0.12.5
 Release:        0
 Summary:        Toolkit for converting source code to build artifacts
 License:        Apache-2.0