From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Fri, 13 Nov 2026 09:40:47 +0100 Received: from metis.whiteo.stw.pengutronix.de ([2a0a:edc0:2:b01:1d::104]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1xRmpy-00AMO8-1v for lore@lore.pengutronix.de; Fri, 13 Nov 2026 09:40:47 +0100 Received: from [127.0.0.1] (helo=metis.whiteo.stw.pengutronix.de) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1xRmpx-0003Wd-E5; Fri, 13 Nov 2026 09:40:45 +0100 Received: from mx1.white.stw.pengutronix.de ([2a0a:edc0:0:b01:1d::107]) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1xRmoZ-0005YK-0W for ptxdist@pengutronix.de; Fri, 13 Nov 2026 09:39:19 +0100 Received: from dude05.red.stw.pengutronix.de (dude05.red.stw.4.pengutronix.de [10.17.1.19]) (Authenticated sender: relay-from-dude05.red.stw.pengutronix.de) by mx1.white.stw.pengutronix.de (Postfix) with ESMTPSA id ED79F2059D0; Fri, 13 Nov 2026 09:39:18 +0100 (CET) ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=pengutronix.de; s=20260414; t=1794559158; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=00Pn0ZT3Yy6ythZ52AFhYTKOl9zr5bmqsKed2ZVe0Vg=; b=BPI53dHqSARctbtVJLwZ3WEog2N516PQswVv6otZWmAWKWa5npUw6x8nU8v7xvDkPl3vo1 dOnC8wN24+EQSEAFgeRjiOUHYxCCHIHKN+hah0jou5Ym5cWsHitoNwJW1RLi4PHvoOim0o hEvb3+8DsOls4z34UEidKMVh+Ij78o21m2zhrYx7eTYcDHS68KG9YEaZfvJhUCqPKkkQHw UzF3MJyGE6df+mB41TQcnGR9YLvQLmuvPbZo5GGvQm5syP1q3L5uzHLhsJ1cdDqEvxciJs vay8M83CxbHaLHx3yKwN71qET4EEqFX4d04v3zRndjbgp1qqgYinaXWbUzVVAg== ARC-Seal: i=1; s=20260414; d=pengutronix.de; t=1794559158; a=rsa-sha256; cv=none; b=DG/rL3QkSKX3A71wF6Biv0TxNhG7cbl4Gv+kjJcygv4Fa4rDWoN0j3O2v2zpOgCuoHQcy5 +U3B2syTVk08OwBi9uJKaFSttwWXYtNcra8Qm2nfeSCi1n28V/fVXwMmYywVxNv46jchBV qgMTDCMwUiurhbIjS0aETlycg7dsxwxXwA1ErjJJ9B6V7OMJ2IVQGVPBXhTShHJBA6VW21 4YaSRrocSe3byNESji6SByS6Q9uhHcw+JWR2ZZBabd1Q/Sb+V+HkKnv92PPVfE9ZJKFWYc ErS6TPsMaUldrYLrbwcwJpB7lfvZPNZ45BFPEpQR/i60YlXtrSsRGLuVL3As9g== ARC-Authentication-Results: i=1; ORIGINATING; auth=pass smtp.auth=relay-from-dude05.red.stw.pengutronix.de smtp.mailfrom=mol@pengutronix.de Received: by dude05.red.stw.pengutronix.de (Postfix, from userid 1014) id DFCB8743103; Fri, 13 Nov 2026 09:39:18 +0100 (CET) From: Michael Olbrich To: ptxdist@pengutronix.de Date: Fri, 13 Nov 2026 09:39:18 +0100 Message-ID: <20261113083918.1380124-1-m.olbrich@pengutronix.de> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20261027155654.4114660-1-s.pueschel@pengutronix.de> References: <20261027155654.4114660-1-s.pueschel@pengutronix.de> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Subject: Re: [ptxdist] [APPLIED] bubblewrap: version bump 0.11.2 -> 0.13.1 X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Cc: =?UTF-8?q?Sven=20P=C3=BCschel?= Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.whiteo.stw.pengutronix.de); SAEximRunCond expanded to false Thanks, applied as 4cbc0b12897e96707adfbf68b4fd5f48a3780ca4. Michael [sent from post-receive hook] On Fri, 13 Nov 2026 09:39:18 +0100, Sven Püschel wrote: > 0.12 fixes a potential sandbox escape (CVE-2026-87766) during setup: > > https://github.com/containers/bubblewrap/releases/tag/v0.12.0 > https://github.com/containers/bubblewrap/releases/tag/v0.13.0 > https://github.com/containers/bubblewrap/releases/tag/v0.13.1 > > Also 0.12 changes the license from LGPL-2.0-or-later to > LGPL-2.1-or-later due to the safe_openat/chroot_realpath functions > copied from crun [1][2]. As bubblewrap.c hasn't been updated and > still references LGPL-2.0-or-later, switch the source file to hash to > the chroot_realpath.c file. > > Furthermore the setuid support is now removed and a new debug looging > flag is disabled. There is also a new flag to assume a given kernel > version to remove potential fallback code. It's not being used due to > the necessity to add the kernel as a dependency to properly rebuild > bubblewrap when the kernel version changes. > > [1] https://github.com/containers/bubblewrap/commit/67d4be103b18706b5b4e3f495daa35e89e47b163 > [2] https://github.com/containers/bubblewrap/commit/f74c7745a7c2ff95eca04d9e5927c01faf537a6e > > Signed-off-by: Sven Püschel > Message-Id: <20261027155654.4114660-1-s.pueschel@pengutronix.de> > Signed-off-by: Michael Olbrich > > diff --git a/rules/bubblewrap.make b/rules/bubblewrap.make > index 4443866070e2..9a9ccdc2876d 100644 > --- a/rules/bubblewrap.make > +++ b/rules/bubblewrap.make > @@ -14,17 +14,17 @@ PACKAGES-$(PTXCONF_BUBBLEWRAP) += bubblewrap > # > # Paths and names > # > -BUBBLEWRAP_VERSION := 0.11.2 > -BUBBLEWRAP_SHA256 := 69abc30005d2186baf7737feacd8da35633b93cf5af38838ecff17c5f8e924f6 > +BUBBLEWRAP_VERSION := 0.13.1 > +BUBBLEWRAP_SHA256 := 0e85c8702248b8dd64144f594147553650cdd0e4c951690345faace79c217c4d > BUBBLEWRAP := bubblewrap-$(BUBBLEWRAP_VERSION) > BUBBLEWRAP_SUFFIX := tar.xz > BUBBLEWRAP_URL := https://github.com/containers/bubblewrap/releases/download/v$(BUBBLEWRAP_VERSION)/$(BUBBLEWRAP).$(BUBBLEWRAP_SUFFIX) > BUBBLEWRAP_SOURCE := $(SRCDIR)/$(BUBBLEWRAP).$(BUBBLEWRAP_SUFFIX) > BUBBLEWRAP_DIR := $(BUILDDIR)/$(BUBBLEWRAP) > -BUBBLEWRAP_LICENSE := LGPL-2.0-or-later > +BUBBLEWRAP_LICENSE := LGPL-2.1-or-later > BUBBLEWRAP_LICENSE_FILES := \ > - file://COPYING;md5=5f30f0716dfdd0d91eb439ebec522ec2 \ > - file://bubblewrap.c;startline=3;endline=16;md5=7632ecc0582c89a5ec336efd45feeade > + file://COPYING;md5=4fbd65380cdd255951079008b364516c \ > + file://chroot_realpath.c;startline=3;endline=18;md5=71ca6c0528821c23695654d8a1032f53 > > # ---------------------------------------------------------------------------- > # Prepare > @@ -37,9 +37,9 @@ BUBBLEWRAP_CONF_TOOL := meson > BUBBLEWRAP_CONF_OPT := \ > $(CROSS_MESON_USR) \ > -Dbash_completion=disabled \ > + -Ddebug_logging=false \ > -Dman=disabled \ > -Dselinux=disabled \ > - -Dsupport_setuid=false \ > -Dtests=false \ > -Dzsh_completion=disabled >