Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package docker for openSUSE:Factory checked in at 2024-02-16 21:41:33 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/docker (Old) and /work/SRC/openSUSE:Factory/.docker.new.1815 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "docker" Fri Feb 16 21:41:33 2024 rev:142 rq:1146862 version:24.0.7_ce Changes: -------- --- /work/SRC/openSUSE:Factory/docker/docker.changes 2023-11-28 22:19:03.353017994 +0100 +++ /work/SRC/openSUSE:Factory/.docker.new.1815/docker.changes 2024-02-16 21:41:36.348076961 +0100 @@ -1,0 +2,21 @@ +Wed Feb 14 08:40:36 UTC 2024 - Dan Äermák <dcer...@suse.com> + +- Vendor latest buildkit v0.11: + Add patch 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch that + vendors in the latest v0.11 buildkit branch including bugfixes for the following: + * bsc#1219438: CVE-2024-23653 + * bsc#1219268: CVE-2024-23652 + * bsc#1219267: CVE-2024-23651 + +- rebase patches: + * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch + * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch + * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch + * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch + * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch + +- switch from %patchN to %patch -PN syntax +- remove unused rpmlint filters and add filters to silence pointless bash & zsh + completion warnings + +------------------------------------------------------------------- New: ---- 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch BETA DEBUG BEGIN: New:- Vendor latest buildkit v0.11: Add patch 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch that vendors in the latest v0.11 buildkit branch including bugfixes for the following: BETA DEBUG END: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ docker.spec ++++++ --- /var/tmp/diff_new_pack.ewcz6Y/_old 2024-02-16 21:41:38.780164712 +0100 +++ /var/tmp/diff_new_pack.ewcz6Y/_new 2024-02-16 21:41:38.780164712 +0100 @@ -72,6 +72,11 @@ Patch202: 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch # UPSTREAM: Backport of <https://github.com/docker/cli/pull/4228>. Patch900: cli-0001-docs-include-required-tools-in-source-tree.patch +# bugfix for: +# bsc#1219438: CVE-2024-23653 +# bsc#1219268: CVE-2024-23652 +# bsc#1219267: CVE-2024-23651 +Patch901: 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch BuildRequires: audit BuildRequires: bash-completion BuildRequires: ca-certificates @@ -122,7 +127,7 @@ Requires: procps Requires: tar >= 1.26 Requires: xz >= 4.9 -%sysusers_requires +%?sysusers_requires Requires(post): %fillup_prereq Requires(post): udev Requires(post): shadow @@ -198,7 +203,7 @@ %setup -q -T -b 1 -n %{name}-cli-%{version} [ "%{cli_builddir}" = "$PWD" ] # offline manpages -%patch900 -p1 +%patch -P900 -p1 # docker %define docker_builddir %{_builddir}/%{name}-%{version}_%{git_version} @@ -209,17 +214,19 @@ %if 0%{?is_opensuse} == 0 # PATCH-SUSE: Secrets patches. -%patch100 -p1 -%patch101 -p1 +%patch -P100 -p1 +%patch -P101 -p1 %endif %if 0%{?sle_version} == 120000 # Patches to build on SLE-12. -%patch200 -p1 +%patch -P200 -p1 %endif # bsc#1099277 -%patch201 -p1 +%patch -P201 -p1 # Solves apparmor issues on SLE-12, but okay for newer SLE versions too. -%patch202 -p1 +%patch -P202 -p1 +# temporary buildkit bugfixes +%patch -P901 -p1 %build %sysusers_generate_pre %{SOURCE160} %{name} %{name}.conf ++++++ 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch ++++++ --- /var/tmp/diff_new_pack.ewcz6Y/_old 2024-02-16 21:41:38.800165434 +0100 +++ /var/tmp/diff_new_pack.ewcz6Y/_new 2024-02-16 21:41:38.804165578 +0100 @@ -1,7 +1,7 @@ -From abdf99298d04ab089ff084669ea421adc0e43f69 Mon Sep 17 00:00:00 2001 +From 678e0f470c01dcf849d42d4f3f38e97b8d7ba841 Mon Sep 17 00:00:00 2001 From: Aleksa Sarai <asa...@suse.de> Date: Wed, 8 Mar 2017 12:41:54 +1100 -Subject: [PATCH 1/5] SECRETS: daemon: allow directory creation in /run/secrets +Subject: [PATCH 1/6] SECRETS: daemon: allow directory creation in /run/secrets Since FileMode can have the directory bit set, allow a SecretStore implementation to return secrets that are actually directories. This is @@ -14,7 +14,7 @@ 1 file changed, 20 insertions(+), 3 deletions(-) diff --git a/daemon/container_operations_unix.go b/daemon/container_operations_unix.go -index 290ec59a34a7..b7013fb89c83 100644 +index 290ec59a34..b7013fb89c 100644 --- a/daemon/container_operations_unix.go +++ b/daemon/container_operations_unix.go @@ -4,6 +4,7 @@ @@ -69,6 +69,6 @@ return errors.Wrap(err, "error setting ownership for secret") } -- -2.42.0 +2.43.0 ++++++ 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch ++++++ --- /var/tmp/diff_new_pack.ewcz6Y/_old 2024-02-16 21:41:38.812165867 +0100 +++ /var/tmp/diff_new_pack.ewcz6Y/_new 2024-02-16 21:41:38.816166011 +0100 @@ -1,7 +1,7 @@ -From b218415fb0a1da1b39743e61fa39e99cfbda5157 Mon Sep 17 00:00:00 2001 +From 4f2462c67f8aa24d08648c2494a83a10e1578079 Mon Sep 17 00:00:00 2001 From: Aleksa Sarai <asa...@suse.de> Date: Wed, 8 Mar 2017 11:43:29 +1100 -Subject: [PATCH 2/5] SECRETS: SUSE: implement SUSE container secrets +Subject: [PATCH 2/6] SECRETS: SUSE: implement SUSE container secrets This allows for us to pass in host credentials to a container, allowing for SUSEConnect to work with containers. @@ -19,7 +19,7 @@ create mode 100644 daemon/suse_secrets.go diff --git a/daemon/start.go b/daemon/start.go -index 2e0b9e6be847..dca04486888f 100644 +index 2e0b9e6be8..dca0448688 100644 --- a/daemon/start.go +++ b/daemon/start.go @@ -151,6 +151,11 @@ func (daemon *Daemon) containerStart(ctx context.Context, container *container.C @@ -36,7 +36,7 @@ return errdefs.System(err) diff --git a/daemon/suse_secrets.go b/daemon/suse_secrets.go new file mode 100644 -index 000000000000..32b0ece91b59 +index 0000000000..32b0ece91b --- /dev/null +++ b/daemon/suse_secrets.go @@ -0,0 +1,415 @@ @@ -456,6 +456,6 @@ + return nil +} -- -2.42.0 +2.43.0 ++++++ 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch ++++++ --- /var/tmp/diff_new_pack.ewcz6Y/_old 2024-02-16 21:41:38.828166444 +0100 +++ /var/tmp/diff_new_pack.ewcz6Y/_new 2024-02-16 21:41:38.832166588 +0100 @@ -1,7 +1,7 @@ -From bf66581467a0b1faccedb6a4e8a61d5cdb973bdb Mon Sep 17 00:00:00 2001 +From 4b6edb887a878a9637e9b3f434fa3f905543e1d1 Mon Sep 17 00:00:00 2001 From: Aleksa Sarai <asa...@suse.de> Date: Mon, 22 May 2023 15:44:54 +1000 -Subject: [PATCH 3/5] BUILD: SLE12: revert "graphdriver/btrfs: use kernel UAPI +Subject: [PATCH 3/6] BUILD: SLE12: revert "graphdriver/btrfs: use kernel UAPI headers" This reverts commit 3208dcabdc8997340b255f5b880fef4e3f54580d. @@ -16,7 +16,7 @@ 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/daemon/graphdriver/btrfs/btrfs.go b/daemon/graphdriver/btrfs/btrfs.go -index d88efc4be2bb..4e976aa689cd 100644 +index d88efc4be2..4e976aa689 100644 --- a/daemon/graphdriver/btrfs/btrfs.go +++ b/daemon/graphdriver/btrfs/btrfs.go @@ -5,17 +5,12 @@ package btrfs // import "github.com/docker/docker/daemon/graphdriver/btrfs" @@ -42,6 +42,6 @@ static void set_name_btrfs_ioctl_vol_args_v2(struct btrfs_ioctl_vol_args_v2* btrfs_struct, const char* value) { snprintf(btrfs_struct->name, BTRFS_SUBVOL_NAME_MAX, "%s", value); -- -2.42.0 +2.43.0 ++++++ 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch ++++++ --- /var/tmp/diff_new_pack.ewcz6Y/_old 2024-02-16 21:41:38.848167166 +0100 +++ /var/tmp/diff_new_pack.ewcz6Y/_new 2024-02-16 21:41:38.852167310 +0100 @@ -1,7 +1,7 @@ -From ffd675934886f01d557366902c81e0f8076a89c2 Mon Sep 17 00:00:00 2001 +From a309d7e57c351a5f81a0cf9a342205ab790f60ba Mon Sep 17 00:00:00 2001 From: Aleksa Sarai <asa...@suse.de> Date: Fri, 29 Jun 2018 17:59:30 +1000 -Subject: [PATCH 4/5] bsc1073877: apparmor: clobber docker-default profile on +Subject: [PATCH 4/6] bsc1073877: apparmor: clobber docker-default profile on start In the process of making docker-default reloading far less expensive, @@ -22,7 +22,7 @@ 3 files changed, 17 insertions(+), 6 deletions(-) diff --git a/daemon/apparmor_default.go b/daemon/apparmor_default.go -index 6376001613f7..5fde21a4af8a 100644 +index 6376001613..5fde21a4af 100644 --- a/daemon/apparmor_default.go +++ b/daemon/apparmor_default.go @@ -24,6 +24,15 @@ func DefaultApparmorProfile() string { @@ -54,7 +54,7 @@ return nil } diff --git a/daemon/apparmor_default_unsupported.go b/daemon/apparmor_default_unsupported.go -index e3dc18b32b5e..9c7723056268 100644 +index e3dc18b32b..9c77230562 100644 --- a/daemon/apparmor_default_unsupported.go +++ b/daemon/apparmor_default_unsupported.go @@ -3,6 +3,10 @@ @@ -69,7 +69,7 @@ return nil } diff --git a/daemon/daemon.go b/daemon/daemon.go -index 4d76c5798888..15c95b50c4eb 100644 +index 4d76c57988..15c95b50c4 100644 --- a/daemon/daemon.go +++ b/daemon/daemon.go @@ -839,8 +839,9 @@ func NewDaemon(ctx context.Context, config *config.Config, pluginStore *plugin.S @@ -85,6 +85,6 @@ } -- -2.42.0 +2.43.0 ++++++ 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch ++++++ --- /var/tmp/diff_new_pack.ewcz6Y/_old 2024-02-16 21:41:38.860167599 +0100 +++ /var/tmp/diff_new_pack.ewcz6Y/_new 2024-02-16 21:41:38.864167743 +0100 @@ -1,7 +1,7 @@ -From eef724b45a4047b6d3cefb214e330a4b24ccdf2e Mon Sep 17 00:00:00 2001 +From e4c2b3e6b168e815ec7248aea696afe807153cb6 Mon Sep 17 00:00:00 2001 From: Aleksa Sarai <asa...@suse.de> Date: Wed, 11 Oct 2023 21:19:12 +1100 -Subject: [PATCH 5/5] SLE12: revert "apparmor: remove version-conditionals from +Subject: [PATCH 5/6] SLE12: revert "apparmor: remove version-conditionals from template" This reverts the following commits: @@ -25,7 +25,7 @@ 5 files changed, 46 insertions(+), 6 deletions(-) diff --git a/contrib/apparmor/main.go b/contrib/apparmor/main.go -index d67890d265de..f4a2978b86cb 100644 +index d67890d265..f4a2978b86 100644 --- a/contrib/apparmor/main.go +++ b/contrib/apparmor/main.go @@ -6,9 +6,13 @@ import ( @@ -68,7 +68,7 @@ log.Fatalf("executing template failed: %v", err) } diff --git a/contrib/apparmor/template.go b/contrib/apparmor/template.go -index 58afcbe845ee..e6d0b6d37c58 100644 +index 58afcbe845..e6d0b6d37c 100644 --- a/contrib/apparmor/template.go +++ b/contrib/apparmor/template.go @@ -20,9 +20,11 @@ profile /usr/bin/docker (attach_disconnected, complain) { @@ -156,7 +156,7 @@ /lib/** rm, /usr/bin/xz rm, diff --git a/pkg/aaparser/aaparser.go b/pkg/aaparser/aaparser.go -index 3d7c2c5a97b3..2b5a2605f9c1 100644 +index 3d7c2c5a97..2b5a2605f9 100644 --- a/pkg/aaparser/aaparser.go +++ b/pkg/aaparser/aaparser.go @@ -13,8 +13,6 @@ const ( @@ -169,7 +169,7 @@ output, err := cmd("", "--version") if err != nil { diff --git a/profiles/apparmor/apparmor.go b/profiles/apparmor/apparmor.go -index d0f236160506..b3566b2f7354 100644 +index d0f2361605..b3566b2f73 100644 --- a/profiles/apparmor/apparmor.go +++ b/profiles/apparmor/apparmor.go @@ -14,8 +14,10 @@ import ( @@ -208,7 +208,7 @@ } diff --git a/profiles/apparmor/template.go b/profiles/apparmor/template.go -index 9f207e2014a8..626e5f6789a3 100644 +index 9f207e2014..626e5f6789 100644 --- a/profiles/apparmor/template.go +++ b/profiles/apparmor/template.go @@ -24,12 +24,14 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) { @@ -237,6 +237,6 @@ } ` -- -2.42.0 +2.43.0 ++++++ 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch ++++++ ++++ 3138 lines (skipped) ++++++ docker-rpmlintrc ++++++ --- /var/tmp/diff_new_pack.ewcz6Y/_old 2024-02-16 21:41:38.968171495 +0100 +++ /var/tmp/diff_new_pack.ewcz6Y/_new 2024-02-16 21:41:38.972171640 +0100 @@ -1,7 +1,3 @@ -# The #! comes from upstream. -addFilter ("^docker-bash-completion.noarch: W: sourced-script-with-shebang /etc/bash_completion.d/docker bash") -addFilter ("^docker-zsh-completion.noarch: W: sourced-script-with-shebang /etc/zsh_completion.d/docker zsh") - -# -test is something that is used internally and isn't actually shipped -- it's a pseduo-source package. -addFilter ("^docker-test.*") +addFilter("^docker-bash-completion.noarch: (E|W): non-executable-script /usr/share/bash-completion/completions/docker") +addFilter("^docker-zsh-completion.noarch: W: non-conffile-in-etc /etc/zsh_completion.d/_docker")
