[ptxdist] [PATCH] bubblewrap: version bump 0.11.2 -> 0.13.1

[ptxdist] [PATCH] bubblewrap: version bump 0.11.2 -> 0.13.1

[Sven Püschel]

0.12 fixes a potential sandbox escape (CVE-2026-87766) during setup:

https://github.com/containers/bubblewrap/releases/tag/v0.12.0
https://github.com/containers/bubblewrap/releases/tag/v0.13.0
https://github.com/containers/bubblewrap/releases/tag/v0.13.1

Also 0.12 changes the license from LGPL-2.0-or-later to
LGPL-2.1-or-later due to the safe_openat/chroot_realpath functions
copied from crun [1][2]. As bubblewrap.c hasn't been updated and
still references LGPL-2.0-or-later, switch the source file to hash to
the chroot_realpath.c file.

Furthermore the setuid support is now removed and a new debug looging
flag is disabled. There is also a new flag to assume a given kernel
version to remove potential fallback code. It's not being used due to
the necessity to add the kernel as a dependency to properly rebuild
bubblewrap when the kernel version changes.

[1] https://github.com/containers/bubblewrap/commit/67d4be103b18706b5b4e3f495daa35e89e47b163
[2] https://github.com/containers/bubblewrap/commit/f74c7745a7c2ff95eca04d9e5927c01faf537a6e

Signed-off-by: Sven Püschel <s.pueschel@pengutronix.de>
---
 rules/bubblewrap.make | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/rules/bubblewrap.make b/rules/bubblewrap.make
index 444386607..9a9ccdc28 100644
--- a/rules/bubblewrap.make
+++ b/rules/bubblewrap.make
@@ -14,17 +14,17 @@ PACKAGES-$(PTXCONF_BUBBLEWRAP) += bubblewrap
 #
 # Paths and names
 #
-BUBBLEWRAP_VERSION	:= 0.11.2
-BUBBLEWRAP_SHA256	:= 69abc30005d2186baf7737feacd8da35633b93cf5af38838ecff17c5f8e924f6
+BUBBLEWRAP_VERSION	:= 0.13.1
+BUBBLEWRAP_SHA256	:= 0e85c8702248b8dd64144f594147553650cdd0e4c951690345faace79c217c4d
 BUBBLEWRAP		:= bubblewrap-$(BUBBLEWRAP_VERSION)
 BUBBLEWRAP_SUFFIX	:= tar.xz
 BUBBLEWRAP_URL		:= https://github.com/containers/bubblewrap/releases/download/v$(BUBBLEWRAP_VERSION)/$(BUBBLEWRAP).$(BUBBLEWRAP_SUFFIX)
 BUBBLEWRAP_SOURCE	:= $(SRCDIR)/$(BUBBLEWRAP).$(BUBBLEWRAP_SUFFIX)
 BUBBLEWRAP_DIR		:= $(BUILDDIR)/$(BUBBLEWRAP)
-BUBBLEWRAP_LICENSE	:= LGPL-2.0-or-later
+BUBBLEWRAP_LICENSE	:= LGPL-2.1-or-later
 BUBBLEWRAP_LICENSE_FILES := \
-	file://COPYING;md5=5f30f0716dfdd0d91eb439ebec522ec2 \
-	file://bubblewrap.c;startline=3;endline=16;md5=7632ecc0582c89a5ec336efd45feeade
+	file://COPYING;md5=4fbd65380cdd255951079008b364516c \
+	file://chroot_realpath.c;startline=3;endline=18;md5=71ca6c0528821c23695654d8a1032f53
 
 # ----------------------------------------------------------------------------
 # Prepare
@@ -37,9 +37,9 @@ BUBBLEWRAP_CONF_TOOL := meson
 BUBBLEWRAP_CONF_OPT := \
 	$(CROSS_MESON_USR) \
 	-Dbash_completion=disabled \
+	-Ddebug_logging=false \
 	-Dman=disabled \
 	-Dselinux=disabled \
-	-Dsupport_setuid=false \
 	-Dtests=false \
 	-Dzsh_completion=disabled
 
-- 
2.47.3

Re: [ptxdist] [APPLIED] bubblewrap: version bump 0.11.2 -> 0.13.1

[Michael Olbrich]

Thanks, applied as 4cbc0b12897e96707adfbf68b4fd5f48a3780ca4.

Michael

[sent from post-receive hook]

On Fri, 13 Nov 2026 09:39:18 +0100, Sven Püschel <s.pueschel@pengutronix.de> wrote:
> 0.12 fixes a potential sandbox escape (CVE-2026-87766) during setup:
> 
> https://github.com/containers/bubblewrap/releases/tag/v0.12.0
> https://github.com/containers/bubblewrap/releases/tag/v0.13.0
> https://github.com/containers/bubblewrap/releases/tag/v0.13.1
> 
> Also 0.12 changes the license from LGPL-2.0-or-later to
> LGPL-2.1-or-later due to the safe_openat/chroot_realpath functions
> copied from crun [1][2]. As bubblewrap.c hasn't been updated and
> still references LGPL-2.0-or-later, switch the source file to hash to
> the chroot_realpath.c file.
> 
> Furthermore the setuid support is now removed and a new debug looging
> flag is disabled. There is also a new flag to assume a given kernel
> version to remove potential fallback code. It's not being used due to
> the necessity to add the kernel as a dependency to properly rebuild
> bubblewrap when the kernel version changes.
> 
> [1] https://github.com/containers/bubblewrap/commit/67d4be103b18706b5b4e3f495daa35e89e47b163
> [2] https://github.com/containers/bubblewrap/commit/f74c7745a7c2ff95eca04d9e5927c01faf537a6e
> 
> Signed-off-by: Sven Püschel <s.pueschel@pengutronix.de>
> Message-Id: <20261027155654.4114660-1-s.pueschel@pengutronix.de>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/rules/bubblewrap.make b/rules/bubblewrap.make
> index 4443866070e2..9a9ccdc2876d 100644
> --- a/rules/bubblewrap.make
> +++ b/rules/bubblewrap.make
> @@ -14,17 +14,17 @@ PACKAGES-$(PTXCONF_BUBBLEWRAP) += bubblewrap
>  #
>  # Paths and names
>  #
> -BUBBLEWRAP_VERSION	:= 0.11.2
> -BUBBLEWRAP_SHA256	:= 69abc30005d2186baf7737feacd8da35633b93cf5af38838ecff17c5f8e924f6
> +BUBBLEWRAP_VERSION	:= 0.13.1
> +BUBBLEWRAP_SHA256	:= 0e85c8702248b8dd64144f594147553650cdd0e4c951690345faace79c217c4d
>  BUBBLEWRAP		:= bubblewrap-$(BUBBLEWRAP_VERSION)
>  BUBBLEWRAP_SUFFIX	:= tar.xz
>  BUBBLEWRAP_URL		:= https://github.com/containers/bubblewrap/releases/download/v$(BUBBLEWRAP_VERSION)/$(BUBBLEWRAP).$(BUBBLEWRAP_SUFFIX)
>  BUBBLEWRAP_SOURCE	:= $(SRCDIR)/$(BUBBLEWRAP).$(BUBBLEWRAP_SUFFIX)
>  BUBBLEWRAP_DIR		:= $(BUILDDIR)/$(BUBBLEWRAP)
> -BUBBLEWRAP_LICENSE	:= LGPL-2.0-or-later
> +BUBBLEWRAP_LICENSE	:= LGPL-2.1-or-later
>  BUBBLEWRAP_LICENSE_FILES := \
> -	file://COPYING;md5=5f30f0716dfdd0d91eb439ebec522ec2 \
> -	file://bubblewrap.c;startline=3;endline=16;md5=7632ecc0582c89a5ec336efd45feeade
> +	file://COPYING;md5=4fbd65380cdd255951079008b364516c \
> +	file://chroot_realpath.c;startline=3;endline=18;md5=71ca6c0528821c23695654d8a1032f53
>  
>  # ----------------------------------------------------------------------------
>  # Prepare
> @@ -37,9 +37,9 @@ BUBBLEWRAP_CONF_TOOL := meson
>  BUBBLEWRAP_CONF_OPT := \
>  	$(CROSS_MESON_USR) \
>  	-Dbash_completion=disabled \
> +	-Ddebug_logging=false \
>  	-Dman=disabled \
>  	-Dselinux=disabled \
> -	-Dsupport_setuid=false \
>  	-Dtests=false \
>  	-Dzsh_completion=disabled
>