From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Tue, 27 Oct 2026 16:57:07 +0100 Received: from metis.whiteo.stw.pengutronix.de ([2a0a:edc0:2:b01:1d::104]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1xLjXv-003yOj-0J for lore@lore.pengutronix.de; Tue, 27 Oct 2026 16:57:07 +0100 Received: from [127.0.0.1] (helo=metis.whiteo.stw.pengutronix.de) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1xLjXu-0007yh-Ht; Tue, 27 Oct 2026 16:57:06 +0100 Received: from dude04.red.stw.pengutronix.de ([2a0a:edc0:0:1101:1d::ac]) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1xLjXk-0007yR-CA; Tue, 27 Oct 2026 16:56:56 +0100 From: =?UTF-8?q?Sven=20P=C3=BCschel?= To: ptxdist@pengutronix.de Date: Tue, 27 Oct 2026 16:56:38 +0100 Message-ID: <20261027155654.4114660-1-s.pueschel@pengutronix.de> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Subject: [ptxdist] [PATCH] bubblewrap: version bump 0.11.2 -> 0.13.1 X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Cc: =?UTF-8?q?Sven=20P=C3=BCschel?= Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.whiteo.stw.pengutronix.de); SAEximRunCond expanded to false 0.12 fixes a potential sandbox escape (CVE-2026-87766) during setup: https://github.com/containers/bubblewrap/releases/tag/v0.12.0 https://github.com/containers/bubblewrap/releases/tag/v0.13.0 https://github.com/containers/bubblewrap/releases/tag/v0.13.1 Also 0.12 changes the license from LGPL-2.0-or-later to LGPL-2.1-or-later due to the safe_openat/chroot_realpath functions copied from crun [1][2]. As bubblewrap.c hasn't been updated and still references LGPL-2.0-or-later, switch the source file to hash to the chroot_realpath.c file. Furthermore the setuid support is now removed and a new debug looging flag is disabled. There is also a new flag to assume a given kernel version to remove potential fallback code. It's not being used due to the necessity to add the kernel as a dependency to properly rebuild bubblewrap when the kernel version changes. [1] https://github.com/containers/bubblewrap/commit/67d4be103b18706b5b4e3f495daa35e89e47b163 [2] https://github.com/containers/bubblewrap/commit/f74c7745a7c2ff95eca04d9e5927c01faf537a6e Signed-off-by: Sven Püschel --- rules/bubblewrap.make | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/rules/bubblewrap.make b/rules/bubblewrap.make index 444386607..9a9ccdc28 100644 --- a/rules/bubblewrap.make +++ b/rules/bubblewrap.make @@ -14,17 +14,17 @@ PACKAGES-$(PTXCONF_BUBBLEWRAP) += bubblewrap # # Paths and names # -BUBBLEWRAP_VERSION := 0.11.2 -BUBBLEWRAP_SHA256 := 69abc30005d2186baf7737feacd8da35633b93cf5af38838ecff17c5f8e924f6 +BUBBLEWRAP_VERSION := 0.13.1 +BUBBLEWRAP_SHA256 := 0e85c8702248b8dd64144f594147553650cdd0e4c951690345faace79c217c4d BUBBLEWRAP := bubblewrap-$(BUBBLEWRAP_VERSION) BUBBLEWRAP_SUFFIX := tar.xz BUBBLEWRAP_URL := https://github.com/containers/bubblewrap/releases/download/v$(BUBBLEWRAP_VERSION)/$(BUBBLEWRAP).$(BUBBLEWRAP_SUFFIX) BUBBLEWRAP_SOURCE := $(SRCDIR)/$(BUBBLEWRAP).$(BUBBLEWRAP_SUFFIX) BUBBLEWRAP_DIR := $(BUILDDIR)/$(BUBBLEWRAP) -BUBBLEWRAP_LICENSE := LGPL-2.0-or-later +BUBBLEWRAP_LICENSE := LGPL-2.1-or-later BUBBLEWRAP_LICENSE_FILES := \ - file://COPYING;md5=5f30f0716dfdd0d91eb439ebec522ec2 \ - file://bubblewrap.c;startline=3;endline=16;md5=7632ecc0582c89a5ec336efd45feeade + file://COPYING;md5=4fbd65380cdd255951079008b364516c \ + file://chroot_realpath.c;startline=3;endline=18;md5=71ca6c0528821c23695654d8a1032f53 # ---------------------------------------------------------------------------- # Prepare @@ -37,9 +37,9 @@ BUBBLEWRAP_CONF_TOOL := meson BUBBLEWRAP_CONF_OPT := \ $(CROSS_MESON_USR) \ -Dbash_completion=disabled \ + -Ddebug_logging=false \ -Dman=disabled \ -Dselinux=disabled \ - -Dsupport_setuid=false \ -Dtests=false \ -Dzsh_completion=disabled -- 2.47.3