* [meta-virtualization][kirkstone][PATCH 1/1] runc-docker: upgrade 1.1.4 -> 1.1.12
@ 2025-01-20 2:25 dchellam
2025-01-30 18:56 ` Bruce Ashfield
0 siblings, 1 reply; 5+ messages in thread
From: dchellam @ 2025-01-20 2:25 UTC (permalink / raw)
To: meta-virtualization
From: Divya Chellam <divya.chellam@windriver.com>
This upgrade fixes a few CVEs:
- CVE-2023-27561
- CVE-2023-25809
- CVE-2023-28642
- CVE-2024-21626 and other bug fixes
Changelog:
==========
https://github.com/opencontainers/runc/blob/v1.1.12/CHANGELOG.md
Adjusted existing patches to align with v1.1.12
Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
---
...-GOBUILDFLAGS-for-runc-and-remove-re.patch | 26 +++++++++-------
...001-runc-Add-console-socket-dev-null.patch | 13 +++++---
.../0001-runc-docker-SIGUSR1-daemonize.patch | 31 ++++++++++---------
recipes-containers/runc/runc-docker_git.bb | 10 +++---
4 files changed, 45 insertions(+), 35 deletions(-)
diff --git a/recipes-containers/runc/files/0001-Makefile-respect-GOBUILDFLAGS-for-runc-and-remove-re.patch b/recipes-containers/runc/files/0001-Makefile-respect-GOBUILDFLAGS-for-runc-and-remove-re.patch
index 4d35e58e..79e63322 100644
--- a/recipes-containers/runc/files/0001-Makefile-respect-GOBUILDFLAGS-for-runc-and-remove-re.patch
+++ b/recipes-containers/runc/files/0001-Makefile-respect-GOBUILDFLAGS-for-runc-and-remove-re.patch
@@ -1,7 +1,7 @@
From 0fe50d2ca4517f5e3070585040f35ace413acd44 Mon Sep 17 00:00:00 2001
From: Bruce Ashfield <bruce.ashfield@gmail.com>
Date: Tue, 24 Aug 2021 11:38:23 -0400
-Subject: [PATCH] Makefile: respect GOBUILDFLAGS for runc and remove recvtty
+Subject: [PATCH] Makefile: respect GOBUILDFLAGS for runc and remove recvtty
from static
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
@@ -11,16 +11,20 @@ Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Makefile | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
-Index: git/src/import/Makefile
-===================================================================
---- git.orig/src/import/Makefile
-+++ git/src/import/Makefile
-@@ -20,7 +20,7 @@
- endif
+diff --git a/Makefile b/Makefile
+index e3af9bc1..f9d6de96 100644
+--- a/Makefile
++++ b/Makefile
+@@ -24,8 +24,7 @@ ifneq (,$(filter $(GOARCH),386 amd64 arm arm64 ppc64le riscv64 s390x))
+ GO_BUILDMODE := "-buildmode=pie"
endif
endif
--GO_BUILD := $(GO) build -trimpath $(GO_BUILDMODE) $(EXTRA_FLAGS) -tags "$(BUILDTAGS)" \
+-GO_BUILD := $(GO) build -trimpath $(GO_BUILDMODE) \
+- $(EXTRA_FLAGS) -tags "$(BUILDTAGS)" \
+GO_BUILD := $(GO) build $(GOBUILDFLAGS) -trimpath $(GO_BUILDMODE) $(EXTRA_FLAGS) -tags "$(BUILDTAGS)" \
- -ldflags "-X main.gitCommit=$(COMMIT) -X main.version=$(VERSION) $(EXTRA_LDFLAGS)"
- GO_BUILD_STATIC := CGO_ENABLED=1 $(GO) build -trimpath $(EXTRA_FLAGS) -tags "$(BUILDTAGS) netgo osusergo" \
- -ldflags "-extldflags -static -X main.gitCommit=$(COMMIT) -X main.version=$(VERSION) $(EXTRA_LDFLAGS)"
+ -ldflags "$(LDFLAGS_COMMON) $(EXTRA_LDFLAGS)"
+
+ GO_BUILDMODE_STATIC :=
+--
+2.40.0
+
diff --git a/recipes-containers/runc/runc-docker/0001-runc-Add-console-socket-dev-null.patch b/recipes-containers/runc/runc-docker/0001-runc-Add-console-socket-dev-null.patch
index bcf4c103..2a24df90 100644
--- a/recipes-containers/runc/runc-docker/0001-runc-Add-console-socket-dev-null.patch
+++ b/recipes-containers/runc/runc-docker/0001-runc-Add-console-socket-dev-null.patch
@@ -12,11 +12,11 @@ Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
utils_linux.go | 5 +++++
1 file changed, 5 insertions(+)
-Index: git/src/import/utils_linux.go
-===================================================================
---- git.orig/src/import/utils_linux.go
-+++ git/src/import/utils_linux.go
-@@ -267,6 +267,11 @@
+diff --git a/utils_linux.go b/utils_linux.go
+index 60d534e8..ddcab62f 100644
+--- a/utils_linux.go
++++ b/utils_linux.go
+@@ -234,6 +234,11 @@ type runner struct {
}
func (r *runner) run(config *specs.Process) (int, error) {
@@ -28,3 +28,6 @@ Index: git/src/import/utils_linux.go
var err error
defer func() {
if err != nil {
+--
+2.40.0
+
diff --git a/recipes-containers/runc/runc-docker/0001-runc-docker-SIGUSR1-daemonize.patch b/recipes-containers/runc/runc-docker/0001-runc-docker-SIGUSR1-daemonize.patch
index 4350c40f..1065f23e 100644
--- a/recipes-containers/runc/runc-docker/0001-runc-docker-SIGUSR1-daemonize.patch
+++ b/recipes-containers/runc/runc-docker/0001-runc-docker-SIGUSR1-daemonize.patch
@@ -25,15 +25,15 @@ is set.
Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
---
- signals.go | 54 ++++++++++++++++++++++++++++++++++++++++++++++++++----
+ signals.go | 56 ++++++++++++++++++++++++++++++++++++++++++++++----
utils_linux.go | 2 +-
- 2 files changed, 51 insertions(+), 5 deletions(-)
+ 2 files changed, 53 insertions(+), 5 deletions(-)
-Index: git/src/import/signals.go
-===================================================================
---- git.orig/src/import/signals.go
-+++ git/src/import/signals.go
-@@ -5,7 +5,9 @@
+diff --git a/signals.go b/signals.go
+index 2555b765..1266ee66 100644
+--- a/signals.go
++++ b/signals.go
+@@ -3,7 +3,9 @@ package main
import (
"os"
"os/signal"
@@ -43,7 +43,7 @@ Index: git/src/import/signals.go
"github.com/opencontainers/runc/libcontainer"
"github.com/opencontainers/runc/libcontainer/system"
"github.com/opencontainers/runc/libcontainer/utils"
-@@ -55,9 +57,6 @@
+@@ -53,9 +55,6 @@ type signalHandler struct {
func (h *signalHandler) forward(process *libcontainer.Process, tty *tty, detach bool) (int, error) {
// make sure we know the pid of our main process so that we can return
// after it dies.
@@ -53,7 +53,7 @@ Index: git/src/import/signals.go
pid1, err := process.Pid()
if err != nil {
-@@ -67,12 +66,61 @@
+@@ -65,12 +64,61 @@ func (h *signalHandler) forward(process *libcontainer.Process, tty *tty, detach
if h.notifySocket != nil {
if detach {
_ = h.notifySocket.run(pid1)
@@ -116,11 +116,11 @@ Index: git/src/import/signals.go
// Perform the initial tty resize. Always ignore errors resizing because
// stdout might have disappeared (due to races with when SIGHUP is sent).
_ = tty.resize()
-Index: git/src/import/utils_linux.go
-===================================================================
---- git.orig/src/import/utils_linux.go
-+++ git/src/import/utils_linux.go
-@@ -345,7 +345,7 @@
+diff --git a/utils_linux.go b/utils_linux.go
+index ddcab62f..280051ea 100644
+--- a/utils_linux.go
++++ b/utils_linux.go
+@@ -315,7 +315,7 @@ func (r *runner) run(config *specs.Process) (int, error) {
if err != nil {
r.terminate(process)
}
@@ -129,3 +129,6 @@ Index: git/src/import/utils_linux.go
return 0, nil
}
if err == nil {
+--
+2.40.0
+
diff --git a/recipes-containers/runc/runc-docker_git.bb b/recipes-containers/runc/runc-docker_git.bb
index 97373a72..afecac67 100644
--- a/recipes-containers/runc/runc-docker_git.bb
+++ b/recipes-containers/runc/runc-docker_git.bb
@@ -2,13 +2,13 @@ include runc.inc
# Note: this rev is before the required protocol field, update when all components
# have been updated to match.
-SRCREV_runc-docker = "974efd2dfca0abec041a3708a2b66bfac6bd2484"
+SRCREV_runc-docker = "a9833ff391a71b30069a6c3f816db113379a4346"
SRC_URI = "git://github.com/opencontainers/runc;branch=release-1.1;name=runc-docker;protocol=https \
- file://0001-runc-Add-console-socket-dev-null.patch \
- file://0001-Makefile-respect-GOBUILDFLAGS-for-runc-and-remove-re.patch \
- file://0001-runc-docker-SIGUSR1-daemonize.patch \
+ file://0001-runc-Add-console-socket-dev-null.patch;patchdir=src/import \
+ file://0001-Makefile-respect-GOBUILDFLAGS-for-runc-and-remove-re.patch;patchdir=src/import \
+ file://0001-runc-docker-SIGUSR1-daemonize.patch;patchdir=src/import \
"
-RUNC_VERSION = "1.1.4"
+RUNC_VERSION = "1.1.12"
CVE_PRODUCT = "runc"
--
2.40.0
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [meta-virtualization][kirkstone][PATCH 1/1] runc-docker: upgrade 1.1.4 -> 1.1.12
2025-01-20 2:25 [meta-virtualization][kirkstone][PATCH 1/1] runc-docker: upgrade 1.1.4 -> 1.1.12 dchellam
@ 2025-01-30 18:56 ` Bruce Ashfield
2025-02-05 5:09 ` [kirkstone][PATCH " Ranjitsinh Rathod
0 siblings, 1 reply; 5+ messages in thread
From: Bruce Ashfield @ 2025-01-30 18:56 UTC (permalink / raw)
To: Divya.Chellam; +Cc: meta-virtualization
merged.
Bruce
In message: [meta-virtualization][kirkstone][PATCH 1/1] runc-docker: upgrade 1.1.4 -> 1.1.12
on 20/01/2025 dchellam via lists.yoctoproject.org wrote:
> From: Divya Chellam <divya.chellam@windriver.com>
>
> This upgrade fixes a few CVEs:
> - CVE-2023-27561
> - CVE-2023-25809
> - CVE-2023-28642
> - CVE-2024-21626 and other bug fixes
>
> Changelog:
> ==========
> https://github.com/opencontainers/runc/blob/v1.1.12/CHANGELOG.md
>
> Adjusted existing patches to align with v1.1.12
>
> Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
> ---
> ...-GOBUILDFLAGS-for-runc-and-remove-re.patch | 26 +++++++++-------
> ...001-runc-Add-console-socket-dev-null.patch | 13 +++++---
> .../0001-runc-docker-SIGUSR1-daemonize.patch | 31 ++++++++++---------
> recipes-containers/runc/runc-docker_git.bb | 10 +++---
> 4 files changed, 45 insertions(+), 35 deletions(-)
>
> diff --git a/recipes-containers/runc/files/0001-Makefile-respect-GOBUILDFLAGS-for-runc-and-remove-re.patch b/recipes-containers/runc/files/0001-Makefile-respect-GOBUILDFLAGS-for-runc-and-remove-re.patch
> index 4d35e58e..79e63322 100644
> --- a/recipes-containers/runc/files/0001-Makefile-respect-GOBUILDFLAGS-for-runc-and-remove-re.patch
> +++ b/recipes-containers/runc/files/0001-Makefile-respect-GOBUILDFLAGS-for-runc-and-remove-re.patch
> @@ -1,7 +1,7 @@
> From 0fe50d2ca4517f5e3070585040f35ace413acd44 Mon Sep 17 00:00:00 2001
> From: Bruce Ashfield <bruce.ashfield@gmail.com>
> Date: Tue, 24 Aug 2021 11:38:23 -0400
> -Subject: [PATCH] Makefile: respect GOBUILDFLAGS for runc and remove recvtty
> +Subject: [PATCH] Makefile: respect GOBUILDFLAGS for runc and remove recvtty
> from static
>
> Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
> @@ -11,16 +11,20 @@ Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
> Makefile | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)
>
> -Index: git/src/import/Makefile
> -===================================================================
> ---- git.orig/src/import/Makefile
> -+++ git/src/import/Makefile
> -@@ -20,7 +20,7 @@
> - endif
> +diff --git a/Makefile b/Makefile
> +index e3af9bc1..f9d6de96 100644
> +--- a/Makefile
> ++++ b/Makefile
> +@@ -24,8 +24,7 @@ ifneq (,$(filter $(GOARCH),386 amd64 arm arm64 ppc64le riscv64 s390x))
> + GO_BUILDMODE := "-buildmode=pie"
> endif
> endif
> --GO_BUILD := $(GO) build -trimpath $(GO_BUILDMODE) $(EXTRA_FLAGS) -tags "$(BUILDTAGS)" \
> +-GO_BUILD := $(GO) build -trimpath $(GO_BUILDMODE) \
> +- $(EXTRA_FLAGS) -tags "$(BUILDTAGS)" \
> +GO_BUILD := $(GO) build $(GOBUILDFLAGS) -trimpath $(GO_BUILDMODE) $(EXTRA_FLAGS) -tags "$(BUILDTAGS)" \
> - -ldflags "-X main.gitCommit=$(COMMIT) -X main.version=$(VERSION) $(EXTRA_LDFLAGS)"
> - GO_BUILD_STATIC := CGO_ENABLED=1 $(GO) build -trimpath $(EXTRA_FLAGS) -tags "$(BUILDTAGS) netgo osusergo" \
> - -ldflags "-extldflags -static -X main.gitCommit=$(COMMIT) -X main.version=$(VERSION) $(EXTRA_LDFLAGS)"
> + -ldflags "$(LDFLAGS_COMMON) $(EXTRA_LDFLAGS)"
> +
> + GO_BUILDMODE_STATIC :=
> +--
> +2.40.0
> +
> diff --git a/recipes-containers/runc/runc-docker/0001-runc-Add-console-socket-dev-null.patch b/recipes-containers/runc/runc-docker/0001-runc-Add-console-socket-dev-null.patch
> index bcf4c103..2a24df90 100644
> --- a/recipes-containers/runc/runc-docker/0001-runc-Add-console-socket-dev-null.patch
> +++ b/recipes-containers/runc/runc-docker/0001-runc-Add-console-socket-dev-null.patch
> @@ -12,11 +12,11 @@ Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
> utils_linux.go | 5 +++++
> 1 file changed, 5 insertions(+)
>
> -Index: git/src/import/utils_linux.go
> -===================================================================
> ---- git.orig/src/import/utils_linux.go
> -+++ git/src/import/utils_linux.go
> -@@ -267,6 +267,11 @@
> +diff --git a/utils_linux.go b/utils_linux.go
> +index 60d534e8..ddcab62f 100644
> +--- a/utils_linux.go
> ++++ b/utils_linux.go
> +@@ -234,6 +234,11 @@ type runner struct {
> }
>
> func (r *runner) run(config *specs.Process) (int, error) {
> @@ -28,3 +28,6 @@ Index: git/src/import/utils_linux.go
> var err error
> defer func() {
> if err != nil {
> +--
> +2.40.0
> +
> diff --git a/recipes-containers/runc/runc-docker/0001-runc-docker-SIGUSR1-daemonize.patch b/recipes-containers/runc/runc-docker/0001-runc-docker-SIGUSR1-daemonize.patch
> index 4350c40f..1065f23e 100644
> --- a/recipes-containers/runc/runc-docker/0001-runc-docker-SIGUSR1-daemonize.patch
> +++ b/recipes-containers/runc/runc-docker/0001-runc-docker-SIGUSR1-daemonize.patch
> @@ -25,15 +25,15 @@ is set.
>
> Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
> ---
> - signals.go | 54 ++++++++++++++++++++++++++++++++++++++++++++++++++----
> + signals.go | 56 ++++++++++++++++++++++++++++++++++++++++++++++----
> utils_linux.go | 2 +-
> - 2 files changed, 51 insertions(+), 5 deletions(-)
> + 2 files changed, 53 insertions(+), 5 deletions(-)
>
> -Index: git/src/import/signals.go
> -===================================================================
> ---- git.orig/src/import/signals.go
> -+++ git/src/import/signals.go
> -@@ -5,7 +5,9 @@
> +diff --git a/signals.go b/signals.go
> +index 2555b765..1266ee66 100644
> +--- a/signals.go
> ++++ b/signals.go
> +@@ -3,7 +3,9 @@ package main
> import (
> "os"
> "os/signal"
> @@ -43,7 +43,7 @@ Index: git/src/import/signals.go
> "github.com/opencontainers/runc/libcontainer"
> "github.com/opencontainers/runc/libcontainer/system"
> "github.com/opencontainers/runc/libcontainer/utils"
> -@@ -55,9 +57,6 @@
> +@@ -53,9 +55,6 @@ type signalHandler struct {
> func (h *signalHandler) forward(process *libcontainer.Process, tty *tty, detach bool) (int, error) {
> // make sure we know the pid of our main process so that we can return
> // after it dies.
> @@ -53,7 +53,7 @@ Index: git/src/import/signals.go
>
> pid1, err := process.Pid()
> if err != nil {
> -@@ -67,12 +66,61 @@
> +@@ -65,12 +64,61 @@ func (h *signalHandler) forward(process *libcontainer.Process, tty *tty, detach
> if h.notifySocket != nil {
> if detach {
> _ = h.notifySocket.run(pid1)
> @@ -116,11 +116,11 @@ Index: git/src/import/signals.go
> // Perform the initial tty resize. Always ignore errors resizing because
> // stdout might have disappeared (due to races with when SIGHUP is sent).
> _ = tty.resize()
> -Index: git/src/import/utils_linux.go
> -===================================================================
> ---- git.orig/src/import/utils_linux.go
> -+++ git/src/import/utils_linux.go
> -@@ -345,7 +345,7 @@
> +diff --git a/utils_linux.go b/utils_linux.go
> +index ddcab62f..280051ea 100644
> +--- a/utils_linux.go
> ++++ b/utils_linux.go
> +@@ -315,7 +315,7 @@ func (r *runner) run(config *specs.Process) (int, error) {
> if err != nil {
> r.terminate(process)
> }
> @@ -129,3 +129,6 @@ Index: git/src/import/utils_linux.go
> return 0, nil
> }
> if err == nil {
> +--
> +2.40.0
> +
> diff --git a/recipes-containers/runc/runc-docker_git.bb b/recipes-containers/runc/runc-docker_git.bb
> index 97373a72..afecac67 100644
> --- a/recipes-containers/runc/runc-docker_git.bb
> +++ b/recipes-containers/runc/runc-docker_git.bb
> @@ -2,13 +2,13 @@ include runc.inc
>
> # Note: this rev is before the required protocol field, update when all components
> # have been updated to match.
> -SRCREV_runc-docker = "974efd2dfca0abec041a3708a2b66bfac6bd2484"
> +SRCREV_runc-docker = "a9833ff391a71b30069a6c3f816db113379a4346"
> SRC_URI = "git://github.com/opencontainers/runc;branch=release-1.1;name=runc-docker;protocol=https \
> - file://0001-runc-Add-console-socket-dev-null.patch \
> - file://0001-Makefile-respect-GOBUILDFLAGS-for-runc-and-remove-re.patch \
> - file://0001-runc-docker-SIGUSR1-daemonize.patch \
> + file://0001-runc-Add-console-socket-dev-null.patch;patchdir=src/import \
> + file://0001-Makefile-respect-GOBUILDFLAGS-for-runc-and-remove-re.patch;patchdir=src/import \
> + file://0001-runc-docker-SIGUSR1-daemonize.patch;patchdir=src/import \
> "
>
> -RUNC_VERSION = "1.1.4"
> +RUNC_VERSION = "1.1.12"
>
> CVE_PRODUCT = "runc"
> --
> 2.40.0
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#9100): https://lists.yoctoproject.org/g/meta-virtualization/message/9100
> Mute This Topic: https://lists.yoctoproject.org/mt/110709071/1050810
> Group Owner: meta-virtualization+owner@lists.yoctoproject.org
> Unsubscribe: https://lists.yoctoproject.org/g/meta-virtualization/unsub [bruce.ashfield@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [kirkstone][PATCH 1/1] runc-docker: upgrade 1.1.4 -> 1.1.12
2025-01-30 18:56 ` Bruce Ashfield
@ 2025-02-05 5:09 ` Ranjitsinh Rathod
2025-02-05 9:36 ` Jonas Gorski
0 siblings, 1 reply; 5+ messages in thread
From: Ranjitsinh Rathod @ 2025-02-05 5:09 UTC (permalink / raw)
To: meta-virtualization
[-- Attachment #1: Type: text/plain, Size: 438 bytes --]
Hello Bruce,
After this merge, 0001-Makefile-respect-GOBUILDFLAGS-for-runc-and-remove-re.patch is getting failed for runc-opencontainers as this recipe also uses this patch and not upgraded to 1.1.12 and still uses 1.1.4.
Is it possible to also upgrade runc-opencontainers to 1.1.12 to fix same CVEs which we fixed for runc-docker, else we may need to maintain two patches for two different versions.
Thanks,
Ranjitsinh Rathod
[-- Attachment #2: Type: text/html, Size: 10894 bytes --]
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [kirkstone][PATCH 1/1] runc-docker: upgrade 1.1.4 -> 1.1.12
2025-02-05 5:09 ` [kirkstone][PATCH " Ranjitsinh Rathod
@ 2025-02-05 9:36 ` Jonas Gorski
2025-02-05 12:24 ` [meta-virtualization] " Bruce Ashfield
0 siblings, 1 reply; 5+ messages in thread
From: Jonas Gorski @ 2025-02-05 9:36 UTC (permalink / raw)
To: meta-virtualization
Hi,
On Wed, Feb 5, 2025 at 06:09 AM, Ranjitsinh Rathod wrote:
> Hello Bruce,
>
> After this merge,
> 0001-Makefile-respect-GOBUILDFLAGS-for-runc-and-remove-re.patch is getting
> failed for runc-opencontainers as this recipe also uses this patch and not
> upgraded to 1.1.12 and still uses 1.1.4.
>
> Is it possible to also upgrade runc-opencontainers to 1.1.12 to fix same CVEs
> which we fixed for runc-docker, else we may need to maintain two patches for
> two different versions.
I want to second that, especially since runc-opencontainers is the default provider for virtual/runc in kirkstone, so this broke it for everyone not explicitly using runc-docker.
Also the change of patch targets via patchdir isn't done in master; they still target git/src/import. I'm not sure it's a good idea to deviate how master is doing things. Makes backporting things harder.
Best regards,
Jonas
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [meta-virtualization] [kirkstone][PATCH 1/1] runc-docker: upgrade 1.1.4 -> 1.1.12
2025-02-05 9:36 ` Jonas Gorski
@ 2025-02-05 12:24 ` Bruce Ashfield
0 siblings, 0 replies; 5+ messages in thread
From: Bruce Ashfield @ 2025-02-05 12:24 UTC (permalink / raw)
To: jonas.gorski; +Cc: meta-virtualization
[-- Attachment #1: Type: text/plain, Size: 2055 bytes --]
On Wed, Feb 5, 2025 at 4:36 AM Jonas Gorski via lists.yoctoproject.org
<jonas.gorski=bisdn.de@lists.yoctoproject.org> wrote:
> Hi,
>
> On Wed, Feb 5, 2025 at 06:09 AM, Ranjitsinh Rathod wrote:
> > Hello Bruce,
> >
> > After this merge,
> > 0001-Makefile-respect-GOBUILDFLAGS-for-runc-and-remove-re.patch is
> getting
> > failed for runc-opencontainers as this recipe also uses this patch and
> not
> > upgraded to 1.1.12 and still uses 1.1.4.
> >
> > Is it possible to also upgrade runc-opencontainers to 1.1.12 to fix same
> CVEs
> > which we fixed for runc-docker, else we may need to maintain two patches
> for
> > two different versions.
>
> I want to second that, especially since runc-opencontainers is the default
> provider for virtual/runc in kirkstone, so this broke it for everyone not
> explicitly using runc-docker.
>
> Also the change of patch targets via patchdir isn't done in master; they
> still target git/src/import. I'm not sure it's a good idea to deviate how
> master is doing things. Makes backporting things harder.
>
>
Indeed, and I keep rejecting patches that unnecessarily use/change
patchdir, I missed this one in my haste.
I also always insist on upgrading both at the same time, and again, somehow
missed it.
My solution is simpler, I'm reverting the change in kirstone and will wait
for a resubmission that upgrades (and tests) both.
Bruce
> Best regards,
> Jonas
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#9119):
> https://lists.yoctoproject.org/g/meta-virtualization/message/9119
> Mute This Topic: https://lists.yoctoproject.org/mt/110709071/1050810
> Group Owner: meta-virtualization+owner@lists.yoctoproject.org
> Unsubscribe: https://lists.yoctoproject.org/g/meta-virtualization/unsub [
> bruce.ashfield@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
>
--
- Thou shalt not follow the NULL pointer, for chaos and madness await thee
at its end
- "Use the force Harry" - Gandalf, Star Trek II
[-- Attachment #2: Type: text/html, Size: 3751 bytes --]
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2025-02-05 12:24 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-01-20 2:25 [meta-virtualization][kirkstone][PATCH 1/1] runc-docker: upgrade 1.1.4 -> 1.1.12 dchellam
2025-01-30 18:56 ` Bruce Ashfield
2025-02-05 5:09 ` [kirkstone][PATCH " Ranjitsinh Rathod
2025-02-05 9:36 ` Jonas Gorski
2025-02-05 12:24 ` [meta-virtualization] " Bruce Ashfield
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.