import buildah-1.27.0-2.module+el8.7.0+16493+89f82ab8

.buildah.metadata

@@ -1 +1 @@
-bfaa7b5c8d8169ed7a175c1edea673bca9dc184c SOURCES/buildah-1.24.2-ce608bc.tar.gz
+c8bc997a5ec79fcc363dc8c81dbb5818912e60fb SOURCES/buildah-1.27.0-db8d592.tar.gz

.gitignore

@@ -1 +1 @@
-SOURCES/buildah-1.24.2-ce608bc.tar.gz
+SOURCES/buildah-1.27.0-db8d592.tar.gz

SOURCES/4200.patch

@@ -0,0 +1,90 @@
+From 9934b17365083ce966b44c5ce3c7e052f516e255 Mon Sep 17 00:00:00 2001
+From: Aditya R <arajan@redhat.com>
+Date: Wed, 24 Aug 2022 08:42:23 +0530
+Subject: [PATCH] run: add container gid to additional groups
+
+When container is created with specific uid and gid also add container
+gid to supplementary/additional group.
+
+Signed-off-by: Aditya R <arajan@redhat.com>
+---
+ run_common.go                            |  1 +
+ tests/bud.bats                           | 16 ++++++++++++++++
+ tests/bud/supplemental-groups/Dockerfile |  3 +++
+ tests/run.bats                           | 14 ++++++++++++++
+ 4 files changed, 34 insertions(+)
+ create mode 100644 tests/bud/supplemental-groups/Dockerfile
+
+diff --git a/run_common.go b/run_common.go
+index 2054c56527..f5a5ec8505 100644
+--- a/run_common.go
++++ b/run_common.go
+@@ -262,6 +262,7 @@ func (b *Builder) configureUIDGID(g *generate.Generator, mountPoint string, opti
+ 	}
+ 	g.SetProcessUID(user.UID)
+ 	g.SetProcessGID(user.GID)
++	g.AddProcessAdditionalGid(user.GID)
+ 	for _, gid := range user.AdditionalGids {
+ 		g.AddProcessAdditionalGid(gid)
+ 	}
+diff --git a/tests/bud.bats b/tests/bud.bats
+index a37e418b41..07bdf45cac 100644
+--- a/tests/bud.bats
++++ b/tests/bud.bats
+@@ -366,6 +366,22 @@ _EOF
+   expect_output --substring "invalid response status"
+ }
+ 
++@test "build test has gid in supplemental groups" {
++  _prefetch alpine
++  run_buildah build $WITH_POLICY_JSON -t source -f $BUDFILES/supplemental-groups/Dockerfile
++  # gid 1000 must be in supplemental groups
++  expect_output --substring "Groups:	1000"
++}
++
++@test "build test if supplemental groups has gid with --isolation chroot" {
++  test -z "${BUILDAH_ISOLATION}" || skip "BUILDAH_ISOLATION=${BUILDAH_ISOLATION} overrides --isolation"
++
++  _prefetch alpine
++  run_buildah build --isolation chroot $WITH_POLICY_JSON -t source -f $BUDFILES/supplemental-groups/Dockerfile
++  # gid 1000 must be in supplemental groups
++  expect_output --substring "Groups:	1000"
++}
++
+ # Test skipping images with FROM
+ @test "build-test skipping unwanted stages with FROM" {
+   mkdir -p ${TEST_SCRATCH_DIR}/bud/platform
+diff --git a/tests/bud/supplemental-groups/Dockerfile b/tests/bud/supplemental-groups/Dockerfile
+new file mode 100644
+index 0000000000..462d9ea7a4
+--- /dev/null
++++ b/tests/bud/supplemental-groups/Dockerfile
+@@ -0,0 +1,3 @@
++FROM alpine
++USER 1000:1000
++RUN cat /proc/$$/status
+diff --git a/tests/run.bats b/tests/run.bats
+index 2e8836c470..e34091fcbe 100644
+--- a/tests/run.bats
++++ b/tests/run.bats
+@@ -349,6 +349,20 @@ function configure_and_check_user() {
+   expect_output "888:888"
+ }
+ 
++@test "run --user and verify gid in supplemental groups" {
++  skip_if_no_runtime
++
++  # Create the container.
++  _prefetch alpine
++  run_buildah from $WITH_POLICY_JSON alpine
++  ctr="$output"
++
++  # Run with uid:gid 1000:1000 and verify if gid is present in additional groups
++  run_buildah run --user 1000:1000 "$ctr" cat /proc/self/status
++  # gid 1000 must be in additional/supplemental groups
++  expect_output --substring "Groups:	1000 "
++}
++
+ @test "run --workingdir" {
+ 	skip_if_no_runtime
+ 

SOURCES/fix-bash-syntax.patch

@@ -1,45 +0,0 @@
-From eedab4fd872c3be8ab15af767897f92c78a71fde Mon Sep 17 00:00:00 2001
-From: Lokesh Mandvekar <lsm5@fedoraproject.org>
-Date: Mon, 21 Feb 2022 14:58:40 -0500
-Subject: [PATCH] helpers.bash: Use correct syntax
-
-Fixes gating test failure:
-```
- /usr/share/buildah/test/system/./helpers.bash: line 474: !is_cgroupsv2: command not found
- ```
-
-Co-authored-by: Yiqiao Pu <ypu@redhat.com>
-
-I'm just the committer.
-
-Signed-off-by: Lokesh Mandvekar <lsm5@fedoraproject.org>
----
- tests/helpers.bash | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/tests/helpers.bash b/tests/helpers.bash
-index bd2794c974..3e72108bec 100644
---- a/tests/helpers.bash
-+++ b/tests/helpers.bash
-@@ -433,9 +433,9 @@ function skip_if_rootless() {
- ##################################
- function skip_if_rootless_and_cgroupv1() {
-     if test "$BUILDAH_ISOLATION" = "rootless"; then
--	if !is_cgroupsv2; then
--		skip "${1:-test does not work when \$BUILDAH_ISOLATION = rootless} and not cgroupv2"
--	fi
-+        if ! is_cgroupsv2; then
-+            skip "${1:-test does not work when \$BUILDAH_ISOLATION = rootless} and not cgroupv2"
-+        fi
-     fi
- }
- 
-@@ -471,7 +471,7 @@ function skip_if_cgroupsv2() {
- #  skip_if_cgroupsv1  #  Some tests don't work with cgroupsv1
- #######################
- function skip_if_cgroupsv1() {
--    if !is_cgroupsv2; then
-+    if ! is_cgroupsv2; then
-         skip "${1:-test does not work with cgroups v1}"
-     fi
- }

SPECS/buildah.spec

@@ -12,12 +12,12 @@ go build -buildmode pie -compiler gc -tags="rpm_crashtraceback libtrust_openssl
 
 %global import_path github.com/containers/buildah
 #%%global branch main
-%global commit0 ce608bcecdeb077daab846c83b026c508cff9688
+%global commit0 db8d5921a770e7536b34c56d062b47795b548d35
 %global shortcommit0 %(c=%{commit0}; echo ${c:0:7})
 
 Epoch: 1
 Name: buildah
-Version: 1.24.2
+Version: 1.27.0
 Release: 2%{?dist}
 Summary: A command line tool used for creating OCI Images
 License: ASL 2.0
@@ -29,14 +29,14 @@ Source0: https://%{import_path}/tarball/%{commit0}/%{branch}-%{shortcommit0}.tar
 %else
 Source0: https://%{import_path}/archive/%{commit0}/%{name}-%{version}-%{shortcommit0}.tar.gz
 %endif
-Patch0: fix-bash-syntax.patch
+Patch0: https://patch-diff.githubusercontent.com/raw/containers/buildah/pull/4200.patch
-BuildRequires: golang >= 1.16.6
+BuildRequires: golang >= 1.17.7
 BuildRequires: git
 BuildRequires: glib2-devel
 BuildRequires: libseccomp-devel
 BuildRequires: ostree-devel
 BuildRequires: glibc-static
-BuildRequires: go-md2man
+BuildRequires: /usr/bin/go-md2man
 BuildRequires: gpgme-devel
 BuildRequires: device-mapper-devel
 BuildRequires: libassuan-devel
@@ -45,6 +45,10 @@ Requires: runc >= 1.0.0-26
 Requires: containers-common >= 2:1-2
 Recommends: container-selinux
 Requires: slirp4netns >= 0.3-0
+Requires: containernetworking-plugins >= 0.9.1-1
+Suggests: netavark
+Requires: iptables
+Requires: nftables
 
 %description
 The %{name} package provides a command line tool which can be used to
@@ -99,6 +103,7 @@ rm -f src/github.com/containers/storage/drivers/register/register_btrfs.go
 %gobuild -o bin/%{name} %{import_path}/cmd/%{name}
 %gobuild -o imgtype %{import_path}/tests/imgtype
 %gobuild -o bin/copy %{import_path}/tests/copy
+%gobuild -o bin/tutorial %{import_path}/tests/tutorial
 GOMD2MAN=go-md2man %{__make} -C docs
 
 %install
@@ -108,6 +113,7 @@ install -d -p %{buildroot}/%{_datadir}/%{name}/test/system
 cp -pav tests/. %{buildroot}/%{_datadir}/%{name}/test/system
 cp imgtype %{buildroot}/%{_bindir}/%{name}-imgtype
 cp bin/copy %{buildroot}/%{_bindir}/%{name}-copy
+cp bin/tutorial %{buildroot}/%{_bindir}/%{name}-tutorial
 make DESTDIR=%{buildroot} PREFIX=%{_prefix} -C docs install
 
 #define license tag if not already defined
@@ -126,9 +132,58 @@ make DESTDIR=%{buildroot} PREFIX=%{_prefix} -C docs install
 %license LICENSE
 %{_bindir}/%{name}-imgtype
 %{_bindir}/%{name}-copy
+%{_bindir}/%{name}-tutorial
 %{_datadir}/%{name}/test
 
 %changelog
+* Fri Aug 26 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.27.0-2
+- fix CVE-2022-2990
+- Related: #2061390
+
+* Tue Aug 09 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.27.0-1
+- update to https://github.com/containers/buildah/releases/tag/v1.27.0
+- Related: #2061390
+
+* Mon Aug 08 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.26.4-3
+- add buildah-tutorial to test subpackage
+- Related: #2061390
+
+* Thu Aug 04 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.26.4-1
+- update to https://github.com/containers/buildah/releases/tag/v1.26.4
+- Related: #2061390
+
+* Wed Aug 03 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.26.3-1
+- update to https://github.com/containers/buildah/releases/tag/v1.26.3
+- Related: #2061390
+
+* Thu Jul 07 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.26.2-1
+- update to https://github.com/containers/buildah/releases/tag/v1.26.2
+- Related: #2061390
+
+* Wed May 11 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.26.1-2
+- BuildRequires: /usr/bin/go-md2man
+- Related: #2061390
+
+* Thu May 05 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.26.1-1
+- update to https://github.com/containers/buildah/releases/tag/v1.26.1
+- Related: #2061390
+
+* Thu May 05 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.25.1-3
+- add dependencies to network stack
+- Related: #2061390
+
+* Fri Apr 08 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.25.1-2
+- bump golang BR to 1.17.7
+- Related: #2061390
+
+* Thu Mar 31 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.25.1-1
+- update to https://github.com/containers/buildah/releases/tag/v1.25.1
+- Related: #2061390
+
+* Wed Mar 30 2022 Jindrich Novy <jnovy@redhat.com> - 1:1.25.0-1
+- update to https://github.com/containers/buildah/releases/tag/v1.25.0
+- Related: #2061390
+
 * Mon Feb 21 2022 Lokesh Mandvekar <lsm5@redhat.com> - 1:1.24.2-2
 - Add patch to fix bash symtax for gating tests
 - Upstream PR: https://github.com/containers/buildah/pull/3792