All of lore.kernel.org
 help / color / mirror / Atom feed
* [meta-virtualization][PATCH] Update Ankaios to v1.0.3
@ 2026-09-15  9:52 kaloyan.rusev
  2026-09-16 13:59 ` Bruce Ashfield
  0 siblings, 1 reply; 4+ messages in thread
From: kaloyan.rusev @ 2026-09-15  9:52 UTC (permalink / raw)
  To: meta-virtualization; +Cc: Kaloyan Rusev

From: Kaloyan Rusev <kaloyan.rusev@elektrobit.com>

This patch release contains security fixes for the the following CVEs:
* https://www.cve.org/cverecord?id=CVE-2026-84173
* https://www.cve.org/cverecord?id=CVE-2026-85201
* https://www.cve.org/cverecord?id=CVE-2026-86836
---

Hi Bruce,

the patch updates to the newest Ankaios version which addresses 3 recent CVEs.

Thanks a lot for your time and efforts!

Best regards,
Kaloyan

 recipes-containers/ankaios/ankaios-crates.inc | 20 +++++-----------
 recipes-containers/ankaios/ankaios_git.bb     |  6 ++---
 recipes-extended/images/README-ankaios.md     | 23 +++++++++++++++++++
 3 files changed, 32 insertions(+), 17 deletions(-)

diff --git a/recipes-containers/ankaios/ankaios-crates.inc b/recipes-containers/ankaios/ankaios-crates.inc
index cffef0ce..4dbd8c46 100644
--- a/recipes-containers/ankaios/ankaios-crates.inc
+++ b/recipes-containers/ankaios/ankaios-crates.inc
@@ -32,7 +32,7 @@ SRC_URI += " \
     crate://crates.io/cc/1.2.61 \
     crate://crates.io/cfg-if/1.0.4 \
     crate://crates.io/cfg_aliases/0.2.1 \
-    crate://crates.io/chacha20/0.10.0 \
+    crate://crates.io/chacha20/0.10.2 \
     crate://crates.io/chrono/0.4.44 \
     crate://crates.io/clap/4.6.1 \
     crate://crates.io/clap_builder/4.6.0 \
@@ -92,7 +92,7 @@ SRC_URI += " \
     crate://crates.io/getrandom/0.2.17 \
     crate://crates.io/getrandom/0.3.4 \
     crate://crates.io/getrandom/0.4.2 \
-    crate://crates.io/h2/0.4.13 \
+    crate://crates.io/h2/0.4.16 \
     crate://crates.io/handlebars/6.4.0 \
     crate://crates.io/hashbrown/0.15.5 \
     crate://crates.io/hashbrown/0.16.1 \
@@ -186,7 +186,6 @@ SRC_URI += " \
     crate://crates.io/portable-atomic-util/0.2.7 \
     crate://crates.io/potential_utf/0.1.5 \
     crate://crates.io/powerfmt/0.2.0 \
-    crate://crates.io/ppv-lite86/0.2.21 \
     crate://crates.io/predicates/2.1.5 \
     crate://crates.io/predicates-core/1.0.10 \
     crate://crates.io/predicates-tree/1.0.13 \
@@ -203,10 +202,7 @@ SRC_URI += " \
     crate://crates.io/quote/1.0.45 \
     crate://crates.io/r-efi/5.3.0 \
     crate://crates.io/r-efi/6.0.0 \
-    crate://crates.io/rand/0.9.4 \
-    crate://crates.io/rand/0.10.1 \
-    crate://crates.io/rand_chacha/0.9.0 \
-    crate://crates.io/rand_core/0.9.5 \
+    crate://crates.io/rand/0.10.2 \
     crate://crates.io/rand_core/0.10.1 \
     crate://crates.io/redox_syscall/0.5.18 \
     crate://crates.io/ref-cast/1.0.25 \
@@ -401,7 +397,7 @@ SRC_URI[bytes-1.11.1.sha256sum] = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201
 SRC_URI[cc-1.2.61.sha256sum] = "d16d90359e986641506914ba71350897565610e87ce0ad9e6f28569db3dd5c6d"
 SRC_URI[cfg-if-1.0.4.sha256sum] = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 SRC_URI[cfg_aliases-0.2.1.sha256sum] = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
-SRC_URI[chacha20-0.10.0.sha256sum] = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601"
+SRC_URI[chacha20-0.10.2.sha256sum] = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
 SRC_URI[chrono-0.4.44.sha256sum] = "c673075a2e0e5f4a1dde27ce9dee1ea4558c7ffe648f576438a20ca1d2acc4b0"
 SRC_URI[clap-4.6.1.sha256sum] = "1ddb117e43bbf7dacf0a4190fef4d345b9bad68dfc649cb349e7d17d28428e51"
 SRC_URI[clap_builder-4.6.0.sha256sum] = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
@@ -461,7 +457,7 @@ SRC_URI[generic-array-0.14.7.sha256sum] = "85649ca51fd72272d7821adaf274ad91c2882
 SRC_URI[getrandom-0.2.17.sha256sum] = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
 SRC_URI[getrandom-0.3.4.sha256sum] = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
 SRC_URI[getrandom-0.4.2.sha256sum] = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555"
-SRC_URI[h2-0.4.13.sha256sum] = "2f44da3a8150a6703ed5d34e164b875fd14c2cdab9af1252a9a1020bde2bdc54"
+SRC_URI[h2-0.4.16.sha256sum] = "a9f37a958b41b3b19ee2707c06439c0e9e547e847223eb791ecb0cb821c65e27"
 SRC_URI[handlebars-6.4.0.sha256sum] = "9b3f9296c208515b87bd915a2f5d1163d4b3f863ba83337d7713cf478055948e"
 SRC_URI[hashbrown-0.15.5.sha256sum] = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
 SRC_URI[hashbrown-0.16.1.sha256sum] = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
@@ -555,7 +551,6 @@ SRC_URI[portable-atomic-1.13.1.sha256sum] = "c33a9471896f1c69cecef8d20cbe2f7accd
 SRC_URI[portable-atomic-util-0.2.7.sha256sum] = "c2a106d1259c23fac8e543272398ae0e3c0b8d33c88ed73d0cc71b0f1d902618"
 SRC_URI[potential_utf-0.1.5.sha256sum] = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
 SRC_URI[powerfmt-0.2.0.sha256sum] = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
-SRC_URI[ppv-lite86-0.2.21.sha256sum] = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
 SRC_URI[predicates-2.1.5.sha256sum] = "59230a63c37f3e18569bdb90e4a89cbf5bf8b06fea0b84e65ea10cc4df47addd"
 SRC_URI[predicates-core-1.0.10.sha256sum] = "cad38746f3166b4031b1a0d39ad9f954dd291e7854fcc0eed52ee41a0b50d144"
 SRC_URI[predicates-tree-1.0.13.sha256sum] = "d0de1b847b39c8131db0467e9df1ff60e6d0562ab8e9a16e568ad0fdb372e2f2"
@@ -572,10 +567,7 @@ SRC_URI[pulldown-cmark-to-cmark-22.0.0.sha256sum] = "50793def1b900256624a7094394
 SRC_URI[quote-1.0.45.sha256sum] = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
 SRC_URI[r-efi-5.3.0.sha256sum] = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
 SRC_URI[r-efi-6.0.0.sha256sum] = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
-SRC_URI[rand-0.9.4.sha256sum] = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea"
-SRC_URI[rand-0.10.1.sha256sum] = "d2e8e8bcc7961af1fdac401278c6a831614941f6164ee3bf4ce61b7edb162207"
-SRC_URI[rand_chacha-0.9.0.sha256sum] = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
-SRC_URI[rand_core-0.9.5.sha256sum] = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
+SRC_URI[rand-0.10.2.sha256sum] = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
 SRC_URI[rand_core-0.10.1.sha256sum] = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
 SRC_URI[redox_syscall-0.5.18.sha256sum] = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
 SRC_URI[ref-cast-1.0.25.sha256sum] = "f354300ae66f76f1c85c5f84693f0ce81d747e2c3f21a45fef496d89c960bf7d"
diff --git a/recipes-containers/ankaios/ankaios_git.bb b/recipes-containers/ankaios/ankaios_git.bb
index a9fea90b..da172f8d 100644
--- a/recipes-containers/ankaios/ankaios_git.bb
+++ b/recipes-containers/ankaios/ankaios_git.bb
@@ -20,7 +20,7 @@ COMPATIBLE_HOST = "^(?!(qemu)?mips).*"
 # Build dependencies
 DEPENDS += "protobuf-native"
 
-PV = "1.0.1+git"
+PV = "1.0.3+git"
 
 SRC_URI = "\
     git://github.com/eclipse-ankaios/ankaios.git;protocol=https;branch=release-1.0 \
@@ -36,9 +36,9 @@ SRC_URI = "\
     file://ank-agent.default \
 "
 
-# v1.0.1 tag commit
+# v1.0.3 tag commit
 # When bumping SRCREV, re-diff upstream deny.toml and re-check LICENSE against the crate graph.
-SRCREV = "cde70616706b58fd03e4de3f7423addaffa58720"
+SRCREV = "3f7ab7f148e814c57cb7de1e2bb11b9a05b7814b"
 
 # cargo-update-recipe-crates provides the `update_crates` task used to
 # regenerate ankaios-crates.inc after an SRCREV bump.
diff --git a/recipes-extended/images/README-ankaios.md b/recipes-extended/images/README-ankaios.md
index de8a05e6..47776edb 100644
--- a/recipes-extended/images/README-ankaios.md
+++ b/recipes-extended/images/README-ankaios.md
@@ -31,6 +31,29 @@ do not. systemd is required (enforced via `REQUIRED_DISTRO_FEATURES`) because it
 mounts cgroups and configures DNS out of the box; with sysvinit you have to do
 both manually before podman can run a workload.
 
+> **Note: netavark needs the native nftables kernel modules.** podman's default
+> network backend (netavark) builds its firewall ruleset with the native
+> nftables expression modules (`nft_ct`, `nft_nat`, `nft_chain_nat`, `nft_masq`,
+> `nft_reject`, `nft_compat`). The stock `linux-yocto` kernel builds these as
+> loadable modules, which a minimal image does not pull in automatically. Without
+> them the workload never starts and netavark fails at container creation with:
+>
+> ```
+> nft ... Error: Could not process rule: No such file or directory
+> ```
+>
+> Make sure they are present in your image (they live outside this layer), e.g.:
+>
+> ```bitbake
+> IMAGE_INSTALL:append = " \
+>     kernel-module-nft-ct kernel-module-nft-nat kernel-module-nft-chain-nat \
+>     kernel-module-nft-masq kernel-module-nft-reject kernel-module-nft-reject-inet \
+>     kernel-module-nft-compat"
+> ```
+>
+> On a kernel that builds these features in (`=y`) the modules and their
+> `kernel-module-*` packages do not exist, and none of this is needed.
+
 ## Build
 
 ```shell
-- 
2.43.0



^ permalink raw reply related	[flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-09-23 16:10 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-15  9:52 [meta-virtualization][PATCH] Update Ankaios to v1.0.3 kaloyan.rusev
2026-09-16 13:59 ` Bruce Ashfield
2026-09-17 12:57   ` [meta-virtualization][PATCH] ankaios: update to v1.0.4 kaloyan.rusev
2026-09-23 16:10     ` Bruce Ashfield

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.