- Update to umoci v0.5.1. Upstream changelog is available from
<https://github.com/opencontainers/umoci/releases/tag/v0.5.1>
* For images with an empty index.json, umoci will no longer incorrectly set
the manifests entry to null.
* umoci will now produce an error for images with negative-sized descriptors,
based on recent discussions in the upstream image-spec.
* Use go:embed to fill umoci --version information from VERSION.
* Stop using oci-image-tools for integration tests, instead use some smoke
tests and the docker-library-maintained meta-scripts.
This release is dedicated to our cat Yuki who sadly passed away on Friday.
Most of the code I've written in the past four years was written with him
purring away on my chest, and he was the most loving cat I've ever met. Rest
in peace, little buddy. I hope you enjoyed your time with us, and I'll always
keep you in my heart.
OBS-URL: https://build.opensuse.org/request/show/1303012
OBS-URL: https://build.opensuse.org/package/show/Virtualization:containers/umoci?expand=0&rev=63
- Update to umoci v0.5.0. Upstream changelog is available from
<https://github.com/opencontainers/umoci/releases/tag/v0.5.0> bsc#1243388
A security flaw was found in the OCI image-spec, where it is possible to
cause a blob with one media-type to be interpreted as a different media-type.
As umoci is not a registry nor does it handle signatures, this vulnerability
had no real impact on umoci but for safety we implemented the now-recommended
media-type embedding and verification. CVE-2021-41190
Other changes in this release:
* Several large reworks and API-related changes to the umoci's overlayfs
support. This is only available to Go API users.
* The runtime-spec config.json generated by umoci is updated to be more
modern and work properly with modern runc versions.
* The default gzip compression blocksize has been adjusted to match Docker.
* zstd-compressed images are now fully supported. Users can explcitily
request the compression algorithm for newly-generated layers with the
--compress option.
- Remove upstreamed patches:
- 0001-makefile-fix-bad-build-flags.patch
- Update umoci.keyring from upstream to include new signing keys.
OBS-URL: https://build.opensuse.org/request/show/1278975
OBS-URL: https://build.opensuse.org/package/show/Virtualization:containers/umoci?expand=0&rev=61
- Update to umoci v0.4.6.
umoci has been adopted by the Open Container Initative as a reference
implementation of the OCI Image Specification. This will have little impact
on the roadmap or scope of umoci, but it does further solidify umoci as a
useful piece of "boring container infrastructure" that can be used to build
larger systems.
> **NOTICE**: As part of the adoption procedure, the import path and module
> name of umoci has changed from `github.com/openSUSE/umoci` to
> `github.com/opencontainers/umoci`. This means that users of our (still
> unstable) Go API will have to change their import paths in order to update
> to newer versions of umoci.
>
> The old GitHub project will contain a snapshot of `v0.4.5` with a few
> minor changes to the readme that explain the situation. Go projects which
> import import the archived project will receive build warnings that
> explain the need to update their import paths.
+ umoci now builds on MacOS, and we currently run the unit tests on MacOS to
hopefully catch core regressions (in the future we will get the
integration tests running to catch more possible regressions).
opencontainers/umoci#318
* Suppress repeated xattr warnings on destination filesystems that do not
support xattrs. opencontainers/umoci#311
* Work around a long-standing issue in our command-line parsing library (see
urfave/cli#1152) by disabling argument re-ordering for `umoci config`,
which often takes `-`-prefixed flag arguments. opencontainers/umoci#328
* For details, see CHANGELOG.md in the package.
OBS-URL: https://build.opensuse.org/request/show/816888
OBS-URL: https://build.opensuse.org/package/show/Virtualization:containers/umoci?expand=0&rev=49
- Update to umoci v0.4.0. Upstream changelog:
+ `umoci repack` now supports `--refresh-bundle` which will update the
OCI bundle's metadata (mtree and umoci-specific manifests) after packing
the image tag. This means that the bundle can be used as a base layer for
future diffs without needing to unpack the image again.
openSUSE/umoci#196
+ Added a website, and reworked the documentation to be better structured.
You can visit the website at [`umo.ci`][umo.ci]. openSUSE/umoci#188
+ Added support for the `user.rootlesscontainers` specification, which
allows for persistent on-disk emulation of `chown(2)` inside rootless
containers. This implementation is interoperable with [@AkihiroSuda's
`PRoot` fork][as-proot-fork] (though we do not test its interoperability
at the moment) as both tools use [the same protobuf
specification][rootlesscontainers-proto]. openSUSE/umoci#227
+ `umoci unpack` now has support for opaque whiteouts (whiteouts which
remove all children of a directory in the lower layer), though `umoci
repack` does not currently have support for generating them. While this
is technically a spec requirement, through testing we've never
encountered an actual user of these whiteouts. openSUSE/umoci#224openSUSE/umoci#229
+ `umoci unpack` will now use some rootless tricks inside user namespaces
for operations that are known to fail (such as `mknod(2)`) while other
operations will be carried out as normal (such as `lchown(2)`). It should
be noted that the `/proc/self/uid_map` checking we do can be tricked into
not detecting user namespaces, but you would need to be trying to break
it on purpose. openSUSE/umoci#171openSUSE/umoci#230
* Fix a bug in our "parent directory restore" code, which is responsible
for ensuring that the mtime and other similar properties of a directory
are not modified by extraction inside said directory. The bug would
manifest as xattrs not being restored properly in certain edge-cases
(which we incidentally hit in a test-case). openSUSE/umoci#161openSUSE/umoci#162
* `umoci unpack` will now "clean up" the bundle generated if an error
occurs during unpacking. Previously this didn't happen, which made
cleaning up the responsibility of the caller (which was quite difficult
if you were unprivileged). This is a breaking change, but is in the error
path so it's not critical. openSUSE/umoci#174openSUSE/umoci#187
* `umoci gc` now will no longer remove unknown files and directories that
aren't `flock(2)`ed, thus ensuring that any possible OCI image-spec
extensions or other users of an image being operated on will no longer
break. openSUSE/umoci#198
* `umoci unpack --rootless` will now correctly handle regular file
unpacking when overwriting a file that `umoci` doesn't have write access
to. In addition, the semantics of pre-existing hardlinks to a clobbered
file are clarified (the hard-links will not refer to the new layer's
inode). openSUSE/umoci#222openSUSE/umoci#223
[as-proot-fork]: https://github.com/AkihiroSuda/runrootless
[rootlesscontainers-proto]: https://rootlesscontaine.rs/proto/rootlesscontainers.proto
[umo.ci]: https://umo.ci/
OBS-URL: https://build.opensuse.org/request/show/585262
OBS-URL: https://build.opensuse.org/package/show/Virtualization:containers/umoci?expand=0&rev=30
- Update to umoci v0.3.1. Upstream changelog:
- Fix several minor bugs in `hack/release.sh` that caused the release artefacts
to not match the intended style, as well as making it more generic so other
projects can use it. openSUSE/umoci#155openSUSE/umoci#163
- A recent configuration issue caused `go vet` and `go lint` to not run as part
of our CI jobs. This means that some of the information submitted as part of
[CII best practices badging][cii] was not accurate. This has been corrected,
and after review we concluded that only stylistic issues were discovered by
static analysis. openSUSE/umoci#158
- 32-bit unit test builds were broken in a refactor in [0.3.0]. This has been
fixed, and we've added tests to our CI to ensure that something like this
won't go unnoticed in the future. openSUSE/umoci#157
- `umoci unpack` would not correctly preserve set{uid,gid} bits. While this
would not cause issues when building an image (as we only create a manifest
of the final extracted rootfs), it would cause issues for other users of
`umoci`. openSUSE/umoci#166openSUSE/umoci#169
- Updated to [v0.4.1 of `go-mtree`][gomtree-v0.4.1], which fixes several minor
bugs with manifest generation. openSUSE/umoci#176
- `umoci unpack` would not handle "weird" tar archive layers previously (it
would error out with DiffID errors). While this wouldn't cause issues for
layers generated using Go's `archive/tar` implementation, it would cause
issues for GNU gzip and other such tools.
- `umoci unpack`'s mapping options (`--uid-map` and `--gid-map`) have had an
interface change, to better match the [`user_namespaces(7)`][user_namespaces]
interfaces. Note that this is a **breaking change**, but the workaround is to
switch to the trivially different (but now more consistent) format.
openSUSE/umoci#167
- `umoci unpack` used to create the bundle and rootfs with world
read-and-execute permissions by default. This could potentially result in an
unsafe rootfs (containing dangerous setuid binaries for instance) being
accessible by an unprivileged user. This has been fixed by always setting the
mode of the bundle to `0700`, which requires a user to explicitly work around
this basic protection. This scenario was documented in our security
documentation previously, but has now been fixed. openSUSE/umoci#181openSUSE/umoci#182
[cii]: https://bestpractices.coreinfrastructure.org/projects/1084
[gomtree-v0.4.1]: https://github.com/vbatts/go-mtree/releases/tag/v0.4.1
[user_namespaces]: http://man7.org/linux/man-pages/man7/user_namespaces.7.html
- Remove patch that has been applied upstream.
- i586-0001-fix-mis-usage-of-time.Unix.patch
OBS-URL: https://build.opensuse.org/request/show/531029
OBS-URL: https://build.opensuse.org/package/show/Virtualization:containers/umoci?expand=0&rev=26
- Update to umoci v0.3.0. Upstream changelog:
- `umoci` now passes all of the requirements for the [CII best practices bading
program][cii]. openSUSE/umoci#134
- `umoci` also now has more extensive architecture, quick-start and roadmap
documentation. openSUSE/umoci#134
- `umoci` now supports [`1.0.0` of the OCI image
specification][ispec-v1.0.0] and [`1.0.0` of the OCI runtime
specification][rspec-v1.0.0], which are the first milestone release. Note
that there are still some remaining UX issues with `--image` and other parts
of `umoci` which may be subject to change in future versions. In particular,
this update of the specification now means that images may have ambiguous
tags. `umoci` will warn you if an operation may have an ambiguous result, but
we plan to improve this functionality far more in the future.
openSUSE/umoci#133openSUSE/umoci#142
- `umoci` also now supports more complicated descriptor walk structures, and
also handles mutation of such structures more sanely. At the moment, this
functionality has not been used "in the wild" and `umoci` doesn't have the UX
to create such structures (yet) but these will be implemented in future
versions. openSUSE/umoci#145
- `umoci repack` now supports `--mask-path` to ignore changes in the rootfs
that are in a child of at least one of the provided masks when generating new
layers. openSUSE/umoci#127
- Error messages from `github.com/openSUSE/umoci/oci/cas/drivers/dir` actually
make sense now. openSUSE/umoci#121
- `umoci unpack` now generates `config.json` blobs according to the [still
proposed][ispec-pr492] OCI image specification conversion document.
openSUSE/umoci#120
- `umoci repack` also now automatically adding `Config.Volumes` from the image
configuration to the set of masked paths. This matches recently added
[recommendations by the spec][ispec-pr694], but is a backwards-incompatible
change because the new default is that `Config.Volumes` **will** be masked.
If you wish to retain the old semantics, use `--no-mask-volumes` (though make
sure to be aware of the reasoning behind `Config.Volume` masking).
openSUSE/umoci#127
- `umoci` now uses [`SecureJoin`][securejoin] rather than a patched version of
`FollowSymlinkInScope`. The two implementations are roughly equivalent, but
`SecureJoin` has a nicer API and is maintained as a separate project.
- Switched to using `golang.org/x/sys/unix` over `syscall` where possible,
which makes the codebase significantly cleaner. openSUSE/umoci#141
[cii]: https://bestpractices.coreinfrastructure.org/projects/1084
[rspec-v1.0.0]: https://github.com/opencontainers/runtime-spec/releases/tag/v1.0.0
[ispec-v1.0.0]: https://github.com/opencontainers/image-spec/releases/tag/v1.0.0
[ispec-pr492]: https://github.com/opencontainers/image-spec/pull/492
[ispec-pr694]: https://github.com/opencontainers/image-spec/pull/694
[securejoin]: https://github.com/cyphar/filepath-securejoin
OBS-URL: https://build.opensuse.org/request/show/512069
OBS-URL: https://build.opensuse.org/package/show/Virtualization:containers/umoci?expand=0&rev=23
