Merge pull request #2826 from flatcar/buildbot/weekly-portage-stable-package-updates-2025-04-14

Weekly portage-stable package updates 2025-04-14

Author: krnowak

changelog/security/2025-04-15-weekly-updates.md

@@ -0,0 +1,2 @@
+- go ([CVE-2025-22871](https://www.cve.org/CVERecord?id=CVE-2025-22871))
+- perl ([CVE-2024-56406](https://www.cve.org/CVERecord?id=CVE-2024-56406))

changelog/updates/2025-04-15-weekly-updates.md

@@ -0,0 +1,8 @@
+- SDK: go ([1.24.2](https://go.dev/doc/devel/release#go1.24.minor))
+- SDK: perl ([5.40.2](https://perldoc.perl.org/perl5402delta) (includes [5.40.1](https://perldoc.perl.org/perl5401delta))
+- SDK: pkgcheck ([0.10.34](https://github.com/pkgcore/pkgcheck/releases/tag/v0.10.34))
+- azure, dev, gce, sysext-python: python ([3.11.12](https://www.python.org/downloads/release/python-31112/))
+- base, dev: sqlite ([3.49.1](https://sqlite.org/releaselog/3_49_1.html) (includes [3.49.0](https://sqlite.org/releaselog/3_49_0.html), [3.48.0](https://sqlite.org/releaselog/3_48_0.html)))
+- dev: bash-completion ([2.16.0](https://github.com/scop/bash-completion/releases/tag/2.16.0))
+- dev: pahole ([1.29](https://git.kernel.org/pub/scm/devel/pahole/pahole.git/tag/?h=v1.29) (includes [1.28](https://git.kernel.org/pub/scm/devel/pahole/pahole.git/tag/?h=v1.28)))
+- sysext-python: setuptools ([78.1.0](https://github.com/pypa/setuptools/blob/v78.1.0/NEWS.rst) (includes [78.0.2](https://github.com/pypa/setuptools/blob/v78.0.2/NEWS.rst), [78.0.1](https://github.com/pypa/setuptools/blob/v78.0.1/NEWS.rst), [78.0.0](https://github.com/pypa/setuptools/blob/v78.0.0/NEWS.rst), [77.0.3](https://github.com/pypa/setuptools/blob/v77.0.3/NEWS.rst), [77.0.2](https://github.com/pypa/setuptools/blob/v77.0.2/NEWS.rst), [77.0.1](https://github.com/pypa/setuptools/blob/v77.0.1/NEWS.rst), [77.0.0](https://github.com/pypa/setuptools/blob/v77.0.0/NEWS.rst), [76.1.0](https://github.com/pypa/setuptools/blob/v76.1.0/NEWS.rst), [76.0.0](https://github.com/pypa/setuptools/blob/v76.0.0/NEWS.rst)))

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-lang/go/0001-cmd-link-stop-forcing-binutils-gold-dependency-on-aa.patch

@@ -30,6 +30,16 @@
 
 # Keep versions on both arches in sync.
 =app-emulation/qemu-guest-agent-9.2.0 ~arm64
+
+# Needed to address CVE-2025-22871 and to bring in a patch disabling
+# gold linker on arm64.
+=dev-lang/go-1.24.2-r1 ~amd64 ~arm64
+
+# Needed to address CVE-2024-56406.
+=dev-lang/perl-5.40.2 ~amd64 ~arm64
+
+# Keep versions on both arches in sync.
+=dev-lang/python-3.11.12 ~amd64
 =dev-lang/yasm-1.3.0-r1 ~arm64
 =dev-libs/ding-libs-0.6.2-r1 ~arm64
 
@@ -42,9 +52,6 @@
 # The only available ebuild (from GURU) has ~amd64 and no keyword for arm64 yet.
 =dev-libs/luksmeta-9-r1 **
 
-# Keep versions on both arches in sync.
-=dev-util/bpftool-7.5.0 ~arm64
-
 # Catalyst 4 is not stable yet, but earlier versions are masked now.
 =dev-util/catalyst-4.0.0 ~amd64 ~arm64
 

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-lang/go/README.md

@@ -1,9 +1,9 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
-inherit meson-multilib usr-ldscript
+inherit meson-multilib
 
 DESCRIPTION="A high-quality data compressor used extensively by Gentoo Linux"
 HOMEPAGE="https://gitlab.com/bzip2/bzip2"
@@ -33,14 +33,6 @@ multilib_src_configure() {
 	meson_src_configure
 }
 
-multilib_src_install() {
-	meson_src_install
-
-	if multilib_is_native_abi ; then
-		gen_usr_ldscript -a bz2
-	fi
-}
-
 multilib_src_install_all() {
 	dodir /bin
 	mv "${ED}"/usr/bin/bzip2 "${ED}"/bin/bzip2-reference || die

sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords

@@ -1,4 +1,4 @@
 DIST gzip-1.13.tar.xz 838248 BLAKE2B f0e3b4c28bafcd3b59b65ac2d71218dc58d81b52c6921c1be038757c99e99184178c5d0e9674caa5099713b8b64e8c85cf061f4abfa20b73b478288f121fb05d SHA512 e3d4d4aa4b2e53fdad980620307257c91dfbbc40bcec9baa8d4e85e8327f55e2ece552c9baf209df7b66a07103ab92d4954ac53c86c57fbde5e1dd461143f94c
 DIST gzip-1.13.tar.xz.sig 833 BLAKE2B 42e38fa7b3a6b6d21a18308cf662844ed84e1a142a945f3f3142db0a14212c0e642de514abb1307ec12ee7bb9644472cc3aed40582d9c266ab24808acbca0215 SHA512 f95e016f61f4a67cb4cec6cede2510af6bb5567d72bbd3d70210a6d5cf3ee5fea8f0cbf8f7b612fa52f2ecfd9dba050d9cd4494075ce5ac4abac7b74eaa7ccbc
-DIST gzip-1.13_p20250405.tar.xz 892960 BLAKE2B a3b52fbc4db6594ebc98d0f49d04f18073036bd2b29ac1aedb77ce124f8ac232e502450763d260d9d836066d21106b4770561f67dbe833bf43ed9b6c12987389 SHA512 8c439fbb15924eb38e421b04919fc2013e5a814445c83b665e4538f34f9b4b8c73dfe1910aba8c38ef98ee4bd57f01082798e6056802a12aa95d0c82e4a08412
-DIST gzip-1.13_p20250405.tar.xz.sig 833 BLAKE2B b47479ee151f093e6fa81abfe9587c887994562bb19631da9b3506a020ec8ccbc34eb79df29f61e4e441b46fb3e7b5e603357d75edf5d13973ca52737967f897 SHA512 162488d2085664514f8893128fbe6227860e8c8e152a979196c311f68706781c058fdada3fe659e41059aaaf281f0539b035f358e5e633d59e9c5634edbefadb
+DIST gzip-1.14.tar.xz 885748 BLAKE2B 32f7241bd9f3b7f73a59905a5bc9abf4e360e787f692cbb00ad28d48abee52744846d10c07ce2f7aaa3e66bc4b6ab9cd4f1b8e98854bb7d1ec010ae0d5146932 SHA512 82aef53188b3e69b51b7ddab5b8c44a11a5b73c0039b22a315a0c7d244694feab0146748add4265901eb1b4c0cee8a9eb69594995f098830d964091af97079c5
+DIST gzip-1.14.tar.xz.sig 833 BLAKE2B a13ade68035fe32d69c24a1b5791ae6d7163cbbbebda396b4c773f2dc82ea6c619a44c39adc53dcd8fff094962a1c2dddfabfc7ec2cf54561202ef9a2be325ae SHA512 a5abd09e3b7bda8d87e5af7d2bd943e6021272cb0b6aa05625ddfeae45838aede1ffd91d7e0cb4e170f7f3078035f735f8441bc15cc115c51d302e0a11be44cf

sdk_container/src/third_party/portage-stable/app-arch/bzip2/bzip2-9999.ebuild

@@ -1,4 +1,2 @@
-DIST libarchive-3.7.8.tar.xz 5493312 BLAKE2B ba058b2fa2afbfe53127d6ffd0a7ab00d9e8faf62340ae2eb8871a0ca232c2de482dbff2c4eedf2c45d944eb555123d765c462818158046bb72951f6421d9ea0 SHA512 a2b6c8c337e75bcce73126c30a3b564dc586df973780d9c7d5a9eed693dbe3779bf762b64c49c47203c2768c92a4a7d2dc8c0445b1dc398eafd2d58b0ba5aae6
-DIST libarchive-3.7.8.tar.xz.asc 659 BLAKE2B 2050214592b0add7cbd758b815c4289a8760bfb2e5b5db581afdbe741d348252b73f99919641cacd908b586cf4f8fc30a591d88b869bd607adc837251d8fbd4e SHA512 3f1d70318f5e2369fa59e94f91bf8473630a448ded11e2ff3502657380221b9e11e849dc98ba0806c3110c7267cee251f7d681db27751e2a45a948f6ad558404
 DIST libarchive-3.7.9.tar.xz 5494688 BLAKE2B 7bcfb3fe8ffd9452f3d71cdc738144069594030278572ebba0bb247ad74fd68ec19822f281364878228ee311976e216614d4764e56c5fb7f98801695ab7aa7f4 SHA512 d8918445e2536eb29c2d6a6c8cd3671a8525be1619009a2e7c3a9c2a821b51939172dfccc25bfd62fec2a17fb01796b4f522b0ba72b31e3de9b9658c44c46345
 DIST libarchive-3.7.9.tar.xz.asc 659 BLAKE2B 1de2d5af2422c8220983d7e5aa76fae1fcf12c008e7a99ec193b82145a03506fddabc7d5b89efce609e3b807511ebf719fce2f81f2150ccc0a57b4248ad3c5cb SHA512 e60bf9b6c8c58a6fd8977df0ccdd375e42db03f99623412897711dfcbfa4fb4a5b8707e8643c30e25e8b2946df58d1367f67c6ef99223a2739dabbce387f83c5