From a81e076d388ecb49a65fabf26c67eca22949d46f Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Tue, 20 Oct 2026 18:23:08 +0200 Subject: podman: T9494: upgrade to v5.8.8 5.8.5 * Fixed a bug where Podman Machine VMs on Mac using the libkrun provider could be regularly turned off by a port-scanning process on the host unintentionally commanding the VM to shut down. 5.8.6 * This release addressed CVE-2026-19730 where the podman quadlet install --replace command did not truncate the file being replaced, meaning replacing a longer file with a shorter one would result in content from the original file incorrectly being retained. 5.8.7 * This release addresses (CVE-2025-11395), where importing images containing crafted layer tarballs with the podman load command, or importing volumes containing crafted symlinks with podman volume import, allows overwriting files on the host. * This release also addresses CVE-2026-79699 and CVE-2026-79705, though we do not believe these CVEs are exploitable through the Podman command line. * Updated Buildah to v1.43.4 * Updated Common to v0.67.2 * Updated Image to v5.39.3 * Updated Storage to v1.62.1 5.8.8 * This release addresses CVE-2026-94603, where a podman run on a checkpoint image (any image with the io.podman.annotations.checkpoint.runtime.name annotation) could disable all sandboxing, including sandboxing specified by the user, when the container was created. --- scripts/package-build/podman/package.toml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) (limited to 'scripts') diff --git a/scripts/package-build/podman/package.toml b/scripts/package-build/podman/package.toml index 83a235cb..d70faeda 100644 --- a/scripts/package-build/podman/package.toml +++ b/scripts/package-build/podman/package.toml @@ -171,13 +171,19 @@ sudo ln -sf "$HOME/.cargo/bin/rustup" /usr/local/bin/rustup [[packages]] name = "podman" -commit_id = "v5.8.4" +commit_id = "v5.8.8" scm_url = "https://github.com/containers/podman" #build_cmd = "cd ..; ./build.sh" build_cmd = """ make install.tools -make PREFIX=/usr podman-release +# podman-release installs into the tarball with PREFIX=/usr but compiles with +# the default PREFIX=/usr/local, which ends up hardcoded in the binaries - e.g. +# quadlet generating ExecStart=/usr/local/bin/podman in systemd units (T9129) +# Remove a release tarball left over from a previous build in a re-used source +# tree, make would consider it up-to-date and skip the rebuild +rm -rf podman-release-*.tar.gz podman-v*/ +make podman-release PREFIX=/usr tar xf podman-release-$(dpkg --print-architecture).tar.gz VERSION=$(ls -d podman-v* | cut -c9-) -- cgit v1.2.3