diff options
| author | Christian Breunig <christian@breunig.cc> | 2026-10-20 18:23:08 +0200 |
|---|---|---|
| committer | Christian Breunig <christian@breunig.cc> | 2026-10-20 18:23:08 +0200 |
| commit | a81e076d388ecb49a65fabf26c67eca22949d46f (patch) | |
| tree | a73478be344e4b5e2aec25d1b25a58f02f028874 /scripts | |
| parent | 94192fd1290ed0146e824c4d009bc2b29d3d176e (diff) | |
| download | vyos-build-a81e076d388ecb49a65fabf26c67eca22949d46f.tar.gz vyos-build-a81e076d388ecb49a65fabf26c67eca22949d46f.zip | |
podman: T9494: upgrade to v5.8.8
5.8.5
* Fixed a bug where Podman Machine VMs on Mac using the libkrun provider could
be regularly turned off by a port-scanning process on the host unintentionally
commanding the VM to shut down.
5.8.6
* This release addressed CVE-2026-19730 where the podman quadlet install
--replace command did not truncate the file being replaced, meaning replacing
a longer file with a shorter one would result in content from the original
file incorrectly being retained.
5.8.7
* This release addresses (CVE-2025-11395), where importing images containing
crafted layer tarballs with the podman load command, or importing volumes
containing crafted symlinks with podman volume import, allows overwriting
files on the host.
* This release also addresses CVE-2026-79699 and CVE-2026-79705, though we do
not believe these CVEs are exploitable through the Podman command line.
* Updated Buildah to v1.43.4
* Updated Common to v0.67.2
* Updated Image to v5.39.3
* Updated Storage to v1.62.1
5.8.8
* This release addresses CVE-2026-94603, where a podman run on a checkpoint
image (any image with the io.podman.annotations.checkpoint.runtime.name
annotation) could disable all sandboxing, including sandboxing specified by
the user, when the container was created.
Diffstat (limited to 'scripts')
| -rw-r--r-- | scripts/package-build/podman/package.toml | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/scripts/package-build/podman/package.toml b/scripts/package-build/podman/package.toml index 83a235cb..d70faeda 100644 --- a/scripts/package-build/podman/package.toml +++ b/scripts/package-build/podman/package.toml @@ -171,13 +171,19 @@ sudo ln -sf "$HOME/.cargo/bin/rustup" /usr/local/bin/rustup [[packages]] name = "podman" -commit_id = "v5.8.4" +commit_id = "v5.8.8" scm_url = "https://github.com/containers/podman" #build_cmd = "cd ..; ./build.sh" build_cmd = """ make install.tools -make PREFIX=/usr podman-release +# podman-release installs into the tarball with PREFIX=/usr but compiles with +# the default PREFIX=/usr/local, which ends up hardcoded in the binaries - e.g. +# quadlet generating ExecStart=/usr/local/bin/podman in systemd units (T9129) +# Remove a release tarball left over from a previous build in a re-used source +# tree, make would consider it up-to-date and skip the rebuild +rm -rf podman-release-*.tar.gz podman-v*/ +make podman-release PREFIX=/usr tar xf podman-release-$(dpkg --print-architecture).tar.gz VERSION=$(ls -d podman-v* | cut -c9-) |