Re: [ptxdist] [APPLIED] bubblewrap: version bump 0.11.2 -> 0.13.1

[Michael Olbrich <m.olbrich@pengutronix.de>]

Thanks, applied as 4cbc0b12897e96707adfbf68b4fd5f48a3780ca4.

Michael

[sent from post-receive hook]

On Fri, 13 Nov 2026 09:39:18 +0100, Sven Püschel <s.pueschel@pengutronix.de> wrote:
> 0.12 fixes a potential sandbox escape (CVE-2026-87766) during setup:
> 
> https://github.com/containers/bubblewrap/releases/tag/v0.12.0
> https://github.com/containers/bubblewrap/releases/tag/v0.13.0
> https://github.com/containers/bubblewrap/releases/tag/v0.13.1
> 
> Also 0.12 changes the license from LGPL-2.0-or-later to
> LGPL-2.1-or-later due to the safe_openat/chroot_realpath functions
> copied from crun [1][2]. As bubblewrap.c hasn't been updated and
> still references LGPL-2.0-or-later, switch the source file to hash to
> the chroot_realpath.c file.
> 
> Furthermore the setuid support is now removed and a new debug looging
> flag is disabled. There is also a new flag to assume a given kernel
> version to remove potential fallback code. It's not being used due to
> the necessity to add the kernel as a dependency to properly rebuild
> bubblewrap when the kernel version changes.
> 
> [1] https://github.com/containers/bubblewrap/commit/67d4be103b18706b5b4e3f495daa35e89e47b163
> [2] https://github.com/containers/bubblewrap/commit/f74c7745a7c2ff95eca04d9e5927c01faf537a6e
> 
> Signed-off-by: Sven Püschel <s.pueschel@pengutronix.de>
> Message-Id: <20261027155654.4114660-1-s.pueschel@pengutronix.de>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/rules/bubblewrap.make b/rules/bubblewrap.make
> index 4443866070e2..9a9ccdc2876d 100644
> --- a/rules/bubblewrap.make
> +++ b/rules/bubblewrap.make
> @@ -14,17 +14,17 @@ PACKAGES-$(PTXCONF_BUBBLEWRAP) += bubblewrap
>  #
>  # Paths and names
>  #
> -BUBBLEWRAP_VERSION	:= 0.11.2
> -BUBBLEWRAP_SHA256	:= 69abc30005d2186baf7737feacd8da35633b93cf5af38838ecff17c5f8e924f6
> +BUBBLEWRAP_VERSION	:= 0.13.1
> +BUBBLEWRAP_SHA256	:= 0e85c8702248b8dd64144f594147553650cdd0e4c951690345faace79c217c4d
>  BUBBLEWRAP		:= bubblewrap-$(BUBBLEWRAP_VERSION)
>  BUBBLEWRAP_SUFFIX	:= tar.xz
>  BUBBLEWRAP_URL		:= https://github.com/containers/bubblewrap/releases/download/v$(BUBBLEWRAP_VERSION)/$(BUBBLEWRAP).$(BUBBLEWRAP_SUFFIX)
>  BUBBLEWRAP_SOURCE	:= $(SRCDIR)/$(BUBBLEWRAP).$(BUBBLEWRAP_SUFFIX)
>  BUBBLEWRAP_DIR		:= $(BUILDDIR)/$(BUBBLEWRAP)
> -BUBBLEWRAP_LICENSE	:= LGPL-2.0-or-later
> +BUBBLEWRAP_LICENSE	:= LGPL-2.1-or-later
>  BUBBLEWRAP_LICENSE_FILES := \
> -	file://COPYING;md5=5f30f0716dfdd0d91eb439ebec522ec2 \
> -	file://bubblewrap.c;startline=3;endline=16;md5=7632ecc0582c89a5ec336efd45feeade
> +	file://COPYING;md5=4fbd65380cdd255951079008b364516c \
> +	file://chroot_realpath.c;startline=3;endline=18;md5=71ca6c0528821c23695654d8a1032f53
>  
>  # ----------------------------------------------------------------------------
>  # Prepare
> @@ -37,9 +37,9 @@ BUBBLEWRAP_CONF_TOOL := meson
>  BUBBLEWRAP_CONF_OPT := \
>  	$(CROSS_MESON_USR) \
>  	-Dbash_completion=disabled \
> +	-Ddebug_logging=false \
>  	-Dman=disabled \
>  	-Dselinux=disabled \
> -	-Dsupport_setuid=false \
>  	-Dtests=false \
>  	-Dzsh_completion=disabled
>