.buildah.metadata

@@ -1 +1 @@
-c8bc997a5ec79fcc363dc8c81dbb5818912e60fb SOURCES/buildah-1.27.0-db8d592.tar.gz
+d3fcf1950a92f35210dc390cde164f6e428826d1 SOURCES/buildah-e94b4f9.tar.gz

.gitignore

@@ -1 +1 @@
-SOURCES/buildah-1.27.0-db8d592.tar.gz
+SOURCES/buildah-e94b4f9.tar.gz

SOURCES/4200.patch

@@ -1,90 +0,0 @@
-From 9934b17365083ce966b44c5ce3c7e052f516e255 Mon Sep 17 00:00:00 2001
-From: Aditya R <arajan@redhat.com>
-Date: Wed, 24 Aug 2022 08:42:23 +0530
-Subject: [PATCH] run: add container gid to additional groups
-
-When container is created with specific uid and gid also add container
-gid to supplementary/additional group.
-
-Signed-off-by: Aditya R <arajan@redhat.com>
----
- run_common.go                            |  1 +
- tests/bud.bats                           | 16 ++++++++++++++++
- tests/bud/supplemental-groups/Dockerfile |  3 +++
- tests/run.bats                           | 14 ++++++++++++++
- 4 files changed, 34 insertions(+)
- create mode 100644 tests/bud/supplemental-groups/Dockerfile
-
-diff --git a/run_common.go b/run_common.go
-index 2054c56527..f5a5ec8505 100644
---- a/run_common.go
-+++ b/run_common.go
-@@ -262,6 +262,7 @@ func (b *Builder) configureUIDGID(g *generate.Generator, mountPoint string, opti
- 	}
- 	g.SetProcessUID(user.UID)
- 	g.SetProcessGID(user.GID)
-+	g.AddProcessAdditionalGid(user.GID)
- 	for _, gid := range user.AdditionalGids {
- 		g.AddProcessAdditionalGid(gid)
- 	}
-diff --git a/tests/bud.bats b/tests/bud.bats
-index a37e418b41..07bdf45cac 100644
---- a/tests/bud.bats
-+++ b/tests/bud.bats
-@@ -366,6 +366,22 @@ _EOF
-   expect_output --substring "invalid response status"
- }
- 
-+@test "build test has gid in supplemental groups" {
-+  _prefetch alpine
-+  run_buildah build $WITH_POLICY_JSON -t source -f $BUDFILES/supplemental-groups/Dockerfile
-+  # gid 1000 must be in supplemental groups
-+  expect_output --substring "Groups:	1000"
-+}
-+
-+@test "build test if supplemental groups has gid with --isolation chroot" {
-+  test -z "${BUILDAH_ISOLATION}" || skip "BUILDAH_ISOLATION=${BUILDAH_ISOLATION} overrides --isolation"
-+
-+  _prefetch alpine
-+  run_buildah build --isolation chroot $WITH_POLICY_JSON -t source -f $BUDFILES/supplemental-groups/Dockerfile
-+  # gid 1000 must be in supplemental groups
-+  expect_output --substring "Groups:	1000"
-+}
-+
- # Test skipping images with FROM
- @test "build-test skipping unwanted stages with FROM" {
-   mkdir -p ${TEST_SCRATCH_DIR}/bud/platform
-diff --git a/tests/bud/supplemental-groups/Dockerfile b/tests/bud/supplemental-groups/Dockerfile
-new file mode 100644
-index 0000000000..462d9ea7a4
---- /dev/null
-+++ b/tests/bud/supplemental-groups/Dockerfile
-@@ -0,0 +1,3 @@
-+FROM alpine
-+USER 1000:1000
-+RUN cat /proc/$$/status
-diff --git a/tests/run.bats b/tests/run.bats
-index 2e8836c470..e34091fcbe 100644
---- a/tests/run.bats
-+++ b/tests/run.bats
-@@ -349,6 +349,20 @@ function configure_and_check_user() {
-   expect_output "888:888"
- }
- 
-+@test "run --user and verify gid in supplemental groups" {
-+  skip_if_no_runtime
-+
-+  # Create the container.
-+  _prefetch alpine
-+  run_buildah from $WITH_POLICY_JSON alpine
-+  ctr="$output"
-+
-+  # Run with uid:gid 1000:1000 and verify if gid is present in additional groups
-+  run_buildah run --user 1000:1000 "$ctr" cat /proc/self/status
-+  # gid 1000 must be in additional/supplemental groups
-+  expect_output --substring "Groups:	1000 "
-+}
-+
- @test "run --workingdir" {
- 	skip_if_no_runtime
- 

SOURCES/buildah-CVE-2020-10696.patch

@@ -0,0 +1,48 @@
+From 840e7dad513b86f454573ad415701c0199f78d30 Mon Sep 17 00:00:00 2001
+From: TomSweeneyRedHat <tsweeney@redhat.com>
+Date: Tue, 24 Mar 2020 20:10:22 -0400
+Subject: [PATCH] Fix potential CVE in tarfile w/ symlink
+
+Stealing @nalind 's workaround to avoid refetching
+content after a file read failure.  Under the right
+circumstances that could be a symlink to a file meant
+to overwrite a good file with bad data.
+
+Testing:
+```
+goodstuff
+
+[1] 14901
+
+127.0.0.1 - - [24/Mar/2020 20:15:50] "GET / HTTP/1.1" 200 -
+127.0.0.1 - - [24/Mar/2020 20:15:50] "GET / HTTP/1.1" 200 -
+no FROM statement found
+
+goodstuff
+```
+
+Signed-off-by: TomSweeneyRedHat <tsweeney@redhat.com>
+---
+ imagebuildah/util.go | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff -up a/imagebuildah/util.go.CVE-2020-10696 b/imagebuildah/util.go
+--- a/imagebuildah/util.go.CVE-2020-10696
++++ b/imagebuildah/util.go
+@@ -12,6 +12,7 @@ import (
+ 
+ 	"github.com/containers/buildah"
+ 	"github.com/containers/storage/pkg/chrootarchive"
++	"github.com/containers/storage/pkg/ioutils"
+ 	"github.com/pkg/errors"
+ 	"github.com/sirupsen/logrus"
+ )
+@@ -47,7 +48,7 @@ func downloadToDirectory(url, dir string
+ 		}
+ 		dockerfile := filepath.Join(dir, "Dockerfile")
+ 		// Assume this is a Dockerfile
+-		if err := ioutil.WriteFile(dockerfile, body, 0600); err != nil {
++		if err := ioutils.AtomicWriteFile(dockerfile, body, 0600); err != nil {
+ 			return errors.Wrapf(err, "Failed to write %q to %q", url, dockerfile)
+ 		}
+ 	}