Merge pull request #3025 from flatcar/buildbot/weekly-portage-stable-package-updates-2025-06-16

Weekly portage-stable package updates 2025-06-16

Author: krnowak

.github/workflows/portage-stable-packages-list

@@ -304,6 +304,7 @@ dev-python/colorama
 dev-python/crcmod
 dev-python/cryptography
 dev-python/cython
+dev-python/dependency-groups
 dev-python/distlib
 dev-python/distro
 dev-python/docutils
@@ -357,6 +358,7 @@ dev-python/setuptools-scm
 dev-python/six
 dev-python/snakeoil
 dev-python/tomli
+dev-python/tomli-w
 dev-python/tree-sitter
 dev-python/trove-classifiers
 dev-python/truststore
@@ -398,6 +400,7 @@ eclass/db-use.eclass
 eclass/desktop.eclass
 eclass/dist-kernel-utils.eclass
 eclass/distutils-r1.eclass
+eclass/dot-a.eclass
 eclass/eapi8-dosym.eclass
 eclass/eapi9-pipestatus.eclass
 eclass/eapi9-ver.eclass
@@ -473,6 +476,7 @@ eclass/shell-completion.eclass
 eclass/ssl-cert.eclass
 eclass/strip-linguas.eclass
 eclass/subversion.eclass
+eclass/sysroot.eclass
 eclass/systemd.eclass
 eclass/tmpfiles.eclass
 eclass/toolchain-autoconf.eclass

changelog/security/2025-06-23-weekly-updates.md

@@ -0,0 +1,9 @@
+- bind ([CVE-2024-11187](https://www.cve.org/CVERecord?id=CVE-2024-11187), [CVE-2024-12705](https://www.cve.org/CVERecord?id=CVE-2024-12705))
+- containerd ([CVE-2025-47291](https://www.cve.org/CVERecord?id=CVE-2025-47291))
+- glib ([CVE-2025-4373](https://www.cve.org/CVERecord?id=CVE-2025-4373))
+- go ([CVE-2025-22873](https://www.cve.org/CVERecord?id=CVE-2025-22873), [CVE-2025-4673](https://www.cve.org/CVERecord?id=CVE-2025-4673), [CVE-2025-0913](https://www.cve.org/CVERecord?id=CVE-2025-0913), [CVE-2025-22874](https://www.cve.org/CVERecord?id=CVE-2025-22874))
+- jq ([CVE-2024-23337](https://www.cve.org/CVERecord?id=CVE-2024-23337), [CVE-2024-53427](https://www.cve.org/CVERecord?id=CVE-2024-53427), [CVE-2025-48060](https://www.cve.org/CVERecord?id=CVE-2025-48060))
+- libxml2 ([CVE-2025-32414](https://www.cve.org/CVERecord?id=CVE-2025-32414), [CVE-2025-32415](https://www.cve.org/CVERecord?id=CVE-2025-32415))
+- python ([CVE-2025-4516](https://www.cve.org/CVERecord?id=CVE-2025-4516), [CVE-2024-12718](https://www.cve.org/CVERecord?id=CVE-2024-12718), [CVE-2025-4138](https://www.cve.org/CVERecord?id=CVE-2025-4138), [CVE-2025-4330](https://www.cve.org/CVERecord?id=CVE-2025-4330), [CVE-2025-4517](https://www.cve.org/CVERecord?id=CVE-2025-4517))
+- requests ([CVE-2024-47081](https://www.cve.org/CVERecord?id=CVE-2024-47081))
+- vim ([CVE-2025-1215](https://www.cve.org/CVERecord?id=CVE-2025-1215), [CVE-2025-22134](https://www.cve.org/CVERecord?id=CVE-2025-22134), [CVE-2025-24014](https://www.cve.org/CVERecord?id=CVE-2025-24014), [GHSA-63p5-mwg2-787v](https://github.com/vim/vim/security/advisories/GHSA-63p5-mwg2-787v), [CVE-2025-27423](https://www.cve.org/CVERecord?id=CVE-2025-27423), [CVE-2025-29768](https://www.cve.org/CVERecord?id=CVE-2025-29768))

changelog/updates/2025-06-23-weekly-updates.md

@@ -0,0 +1,55 @@
+- SDK: cmake ([3.31.7](https://cmake.org/cmake/help/v3.31/release/3.31.html#id1))
+- SDK: go ([1.24.4](https://go.dev/doc/devel/release#go1.24.minor))
+- SDK: meson ([1.7.2](https://github.com/mesonbuild/meson/commits/1.7.2/))
+- SDK: qemu ([9.2.3](https://wiki.qemu.org/ChangeLog/9.2))
+- SDK: rust ([1.87.0](https://releases.rs/docs/1.87.0/) (includes [1.86.0](https://releases.rs/docs/1.86.0/)))
+- azure, dev, gce, sysext-python: mpdecimal ([4.0.1](https://www.bytereef.org/mpdecimal/changelog.html#version-4-0-1xs))
+- base, dev: bind ([9.18.37](https://bind9.readthedocs.io/en/v9.18.37/notes.html#notes-for-bind-9-18-37) (includes [9.18.36](https://bind9.readthedocs.io/en/v9.18.36/notes.html#notes-for-bind-9-18-36), [9.18.35](https://bind9.readthedocs.io/en/v9.18.35/notes.html#notes-for-bind-9-18-35), [9.18.34](https://bind9.readthedocs.io/en/v9.18.34/notes.html#notes-for-bind-9-18-34), [9.18.33](https://bind9.readthedocs.io/en/v9.18.33/notes.html#notes-for-bind-9-18-33), [9.18.32](https://bind9.readthedocs.io/en/v9.18.32/notes.html#notes-for-bind-9-18-32)))
+- base, dev: checkpolicy ([3.8.1](https://github.com/SELinuxProject/selinux/releases/tag/3.8.1) (includes [3.8](https://github.com/SELinuxProject/selinux/releases/tag/3.8)))
+- base, dev: gawk ([5.3.2](https://lists.gnu.org/archive/html/info-gnu/2025-04/msg00003.html))
+- base, dev: gcc ([14.3.0](https://lists.gnu.org/archive/html/info-gnu/2025-05/msg00004.html))
+- base, dev: glib ([2.84.3](https://gitlab.gnome.org/GNOME/glib/-/releases/2.84.3) (includes [2.84.2](https://gitlab.gnome.org/GNOME/glib/-/releases/2.84.2), [2.84.1](https://gitlab.gnome.org/GNOME/glib/-/releases/2.84.1), [2.84.0](https://gitlab.gnome.org/GNOME/glib/-/releases/2.84.0), [2.83.5](https://gitlab.gnome.org/GNOME/glib/-/releases/2.83.5), [2.83.4](https://gitlab.gnome.org/GNOME/glib/-/releases/2.83.4), [2.83.3](https://gitlab.gnome.org/GNOME/glib/-/releases/2.83.3), [2.83.2](https://gitlab.gnome.org/GNOME/glib/-/releases/2.83.2), [2.83.1](https://gitlab.gnome.org/GNOME/glib/-/releases/2.83.1), [2.83.0](https://gitlab.gnome.org/GNOME/glib/-/releases/2.83.0)))
+- base, dev: grep ([3.12](https://lists.gnu.org/archive/html/info-gnu/2025-04/msg00008.html))
+- base, dev: gzip ([1.14](https://lists.gnu.org/archive/html/info-gnu/2025-04/msg00007.html))
+- base, dev: inih ([59](https://github.com/benhoyt/inih/releases/tag/r59))
+- base, dev: iputils ([20250605](https://github.com/iputils/iputils/releases/tag/20250605) (includes [20250602](https://github.com/iputils/iputils/releases/tag/20250602)))
+- base, dev: jq ([1.8.0](https://github.com/jqlang/jq/releases/tag/jq-1.8.0))
+- base, dev: kexec-tools ([2.0.31](https://github.com/horms/kexec-tools/commits/v2.0.31/))
+- base, dev: libffi ([3.4.8](https://github.com/libffi/libffi/releases/tag/v3.4.8) (includes [3.4.7](https://github.com/libffi/libffi/releases/tag/v3.4.7)))
+- base, dev: libgpg-error ([1.53](https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgpg-error.git;a=blob;f=NEWS;h=66b2256de2f59c38b9cd35fb4a1b1971a6c9f3f1;hb=f9e98ed8315eaf0468870149d22c5dcf992288ec) (includes [1.52](https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgpg-error.git;a=blob;f=NEWS;h=4f6a114d81fb5b2f73bb65a1f1cc3c21fe64fa0c;hb=be471d158e4951f4b17335b0fc9ae2387a786b5b)))
+- base, dev: libselinux ([3.8.1](https://github.com/SELinuxProject/selinux/releases/tag/3.8.1) (includes [3.8](https://github.com/SELinuxProject/selinux/releases/tag/3.8)))
+- base, dev: libsepol ([3.8.1](https://github.com/SELinuxProject/selinux/releases/tag/3.8.1) (includes [3.8](https://github.com/SELinuxProject/selinux/releases/tag/3.8)))
+- base, dev: liburing ([2.9](https://github.com/axboe/liburing/releases/tag/liburing-2.9) (includes [2.8](https://github.com/axboe/liburing/releases/tag/liburing-2.8)))
+- base, dev: libusb ([1.0.28](https://github.com/libusb/libusb/blob/v1.0.28/ChangeLog))
+- base, dev: libuv ([1.51.0](https://github.com/libuv/libuv/releases/tag/v1.51.0))
+- base, dev: libxml2 ([2.13.8](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.8))
+- base, dev: openssh ([10.0_p1](https://www.openssh.com/releasenotes.html#10.0p1))
+- base, dev: quota ([4.10](https://sourceforge.net/p/linuxquota/news/2025/04/quota-tools-410-released/))
+- base, dev: semodule-utils ([3.8.1](https://github.com/SELinuxProject/selinux/releases/tag/3.8.1) (includes [3.8](https://github.com/SELinuxProject/selinux/releases/tag/3.8)))
+- base, dev: sqlite ([3.49.2](https://sqlite.org/releaselog/3_49_2.html))
+- base, dev: userspace-rcu ([0.15.2](https://lwn.net/Articles/1017443/))
+- base, dev: vim ([9.1.1436](https://github.com/vim/vim/commits/v9.1.1436/))
+- base, dev: xz-utils ([5.8.1](https://github.com/tukaani-project/xz/releases/tag/v5.8.1) (includes [5.8.0](https://github.com/tukaani-project/xz/releases/tag/v5.8.0)))
+- dev: file ([5.46](https://github.com/file/file/blob/FILE5_46/ChangeLog))
+- dev: gdb ([16.2](https://lists.gnu.org/archive/html/info-gnu/2025-02/msg00000.html) (includes [16.1](https://lists.gnu.org/archive/html/info-gnu/2025-01/msg00009.html)))
+- dev: man-db ([2.13.1](https://gitlab.com/man-db/man-db/-/releases/2.13.1))
+- dev: sandbox ([2.46](https://gitweb.gentoo.org/proj/sandbox.git/log/?h=v2.46))
+- dev: smartmontools ([7.5](https://github.com/smartmontools/smartmontools/releases/tag/RELEASE_7_5))
+- sysext-containerd: containerd ([2.0.5](https://github.com/containerd/containerd/releases/tag/v2.0.5))
+- sysext-containerd: runc ([1.2.6](https://github.com/opencontainers/runc/releases/tag/v1.2.6))
+- sysext-incus: cowsql ([1.15.8](https://github.com/cowsql/cowsql/commits/v1.15.8/))
+- sysext-incus: incus ([6.0.4](https://discuss.linuxcontainers.org/t/incus-6-0-4-lts-has-been-released/23391))
+- sysext-incus: lxc ([6.0.4](https://discuss.linuxcontainers.org/t/lxc-6-0-4-lts-has-been-released/23390))
+- sysext-incus: lxcfs ([6.0.4](https://discuss.linuxcontainers.org/t/lxcfs-6-0-4-lts-has-been-released/23389))
+- sysext-podman: gpgme ([1.24.3](https://dev.gnupg.org/T7659))
+- sysext-python: cachecontrol ([0.14.3](https://github.com/psf/cachecontrol/releases/tag/v0.14.3) (includes [0.14.2](https://github.com/psf/cachecontrol/releases/tag/v0.14.2)))
+- sysext-python: charset-normalizer ([3.4.2](https://github.com/jawah/charset_normalizer/releases/tag/3.4.2))
+- sysext-python: more-itertools ([10.7.0](https://github.com/more-itertools/more-itertools/blob/v10.7.0/docs/versions.rst))
+- sysext-python: packaging ([25.0](https://github.com/pypa/packaging/releases/tag/25.0))
+- sysext-python: pip ([25.1.1](https://github.com/pypa/pip/blob/25.1.1/NEWS.rst) (includes [25.1](https://github.com/pypa/pip/blob/25.1/NEWS.rst)))
+- sysext-python: platformdirs ([4.3.8](https://github.com/tox-dev/platformdirs/releases/tag/4.3.8))
+- sysext-python: requests ([2.32.4](https://github.com/psf/requests/releases/tag/v2.32.4) (includes [2.32.3](https://github.com/psf/requests/releases/tag/v2.32.3)))
+- sysext-python: setuptools ([80.9.0](https://github.com/pypa/setuptools/releases/tag/v80.9.0) (includes [80.8.0](https://github.com/pypa/setuptools/releases/tag/v80.8.0), [80.7.0](https://github.com/pypa/setuptools/releases/tag/v80.7.0), [80.6.0](https://github.com/pypa/setuptools/releases/tag/v80.6.0), [80.4.0](https://github.com/pypa/setuptools/releases/tag/v80.4.0), [80.3.0](https://github.com/pypa/setuptools/releases/tag/v80.3.0), [80.2.0](https://github.com/pypa/setuptools/releases/tag/v80.2.0), [80.1.0](https://github.com/pypa/setuptools/releases/tag/v80.1.0), [80.0.0](https://github.com/pypa/setuptools/releases/tag/v80.0.0), [79.0.0](https://github.com/pypa/setuptools/releases/tag/v79.0.0)))
+- sysext-python: setuptools-scm ([8.3.1](https://github.com/pypa/setuptools-scm/releases/tag/v8.3.1) (includes [8.3.0](https://github.com/pypa/setuptools-scm/releases/tag/v8.3.0)))
+- sysext-python: trove-classifiers ([2025.5.9.12](https://github.com/pypa/trove-classifiers/releases/tag/2025.5.9.12) (includes [2025.5.8.15](https://github.com/pypa/trove-classifiers/releases/tag/2025.5.8.15), [2025.5.8.13](https://github.com/pypa/trove-classifiers/releases/tag/2025.5.8.13), [2025.5.7.19](https://github.com/pypa/trove-classifiers/releases/tag/2025.5.7.19), [2025.5.1.12](https://github.com/pypa/trove-classifiers/releases/tag/2025.5.1.12), [2025.4.28.22](https://github.com/pypa/trove-classifiers/releases/tag/2025.4.28.22)))
+- sysext-zfs: zfs ([2.3.2](https://github.com/openzfs/zfs/releases/tag/zfs-2.3.2))

sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/files/0001-flatcar-changes.patch

@@ -1,20 +1,21 @@
-From 948c6075656fde25703ba402f8cd94715feaa774 Mon Sep 17 00:00:00 2001
+From 0ed36d7646036e609ab8fba059436f90c4984bbe Mon Sep 17 00:00:00 2001
 From: Krzesimir Nowak <knowak@microsoft.com>
-Date: Mon, 27 Feb 2023 15:59:21 +0100
-Subject: [PATCH] flatcar changes
+Date: Wed, 25 Jun 2025 11:12:00 +0200
+Subject: [PATCH 1/2] flatcar changes
 
 Signed-off-by: Jeremi Piotrowski <jpiotrowski@microsoft.com>
+Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
 ---
  azurelinuxagent/common/osutil/coreos.py       |  40 +-----
  azurelinuxagent/common/osutil/coreoscommon.py |  59 +++++++++
  azurelinuxagent/common/osutil/factory.py      |   3 +
  azurelinuxagent/common/osutil/flatcar.py      |  78 +++++++++++
- .../common/persist_firewall_rules.py          |   1 +
+ azurelinuxagent/ga/persist_firewall_rules.py  |   2 +-
  config/flatcar/waagent.conf                   | 122 ++++++++++++++++++
  init/flatcar/10-waagent-sysext.conf           |   2 +
  init/flatcar/waagent.service                  |  31 +++++
  setup.py                                      |  20 ++-
- 9 files changed, 313 insertions(+), 43 deletions(-)
+ 9 files changed, 313 insertions(+), 44 deletions(-)
  create mode 100644 azurelinuxagent/common/osutil/coreoscommon.py
  create mode 100644 azurelinuxagent/common/osutil/flatcar.py
  create mode 100644 config/flatcar/waagent.conf
@@ -147,26 +148,26 @@ index 00000000..9008ff20
 +            ["systemctl", "show", "-p", "MainPID", "systemd-networkd"],
 +            transform_command_output=lambda o: o.replace("MainPID=", ""))
 diff --git a/azurelinuxagent/common/osutil/factory.py b/azurelinuxagent/common/osutil/factory.py
-index 83123e3f..b9257a9b 100644
+index fd66fbb0..2c9d2149 100644
 --- a/azurelinuxagent/common/osutil/factory.py
 +++ b/azurelinuxagent/common/osutil/factory.py
-@@ -28,6 +28,7 @@ from .coreos import CoreOSUtil
+@@ -27,6 +27,7 @@ from .coreos import CoreOSUtil
  from .debian import DebianOSBaseUtil, DebianOSModernUtil
  from .default import DefaultOSUtil
  from .devuan import DevuanOSUtil
 +from .flatcar import FlatcarUtil
  from .freebsd import FreeBSDOSUtil
  from .gaia import GaiaOSUtil
  from .iosxe import IosxeOSUtil
-@@ -88,6 +89,8 @@ def _get_osutil(distro_name, distro_code_name, distro_version, distro_full_name)
+@@ -86,6 +87,8 @@ def _get_osutil(distro_name, distro_code_name, distro_version, distro_full_name)
          return DebianOSBaseUtil()
 
      if distro_name in ("flatcar", "coreos") or distro_code_name in ("flatcar", "coreos"):
 +        if DistroVersion(distro_version) >= DistroVersion("3550"):
 +            return FlatcarUtil()
          return CoreOSUtil()
 
-     if distro_name in ("suse", "sle_hpc", "sles", "opensuse"):
+     if distro_name in ("suse", "sle-micro", "sle_hpc", "sles", "opensuse"):
 diff --git a/azurelinuxagent/common/osutil/flatcar.py b/azurelinuxagent/common/osutil/flatcar.py
 new file mode 100644
 index 00000000..eeaf25ce
@@ -252,7 +253,7 @@ index 00000000..eeaf25ce
 +            else:
 +                logger.warn("exceeded restart retries")
 diff --git a/azurelinuxagent/ga/persist_firewall_rules.py b/azurelinuxagent/ga/persist_firewall_rules.py
-index 74b878ce..22562c96 100644
+index e7c8373e..d93c984f 100644
 --- a/azurelinuxagent/ga/persist_firewall_rules.py
 +++ b/azurelinuxagent/ga/persist_firewall_rules.py
 @@ -35,7 +35,7 @@ class PersistFirewallRulesHandler(object):
@@ -438,7 +439,7 @@ index 00000000..8d2c1f09
 +[Install]
 +WantedBy=multi-user.target
 diff --git a/setup.py b/setup.py
-index 8f5d92b4..35400e09 100755
+index e83f5989..a94e163c 100755
 --- a/setup.py
 +++ b/setup.py
 @@ -135,12 +135,22 @@ def get_data_files(name, version, fullname):  # pylint: disable=R0912
@@ -470,5 +471,5 @@ index 8f5d92b4..35400e09 100755
          set_bin_files(data_files, dest=agent_bin_path)
          set_conf_files(data_files, dest="/usr/share/defaults/waagent",
 -- 
-2.45.0
+2.49.0
 

sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/files/0002-prevent-ssh-public-key-override.patch

@@ -1,18 +1,17 @@
-From 0c8db73c3567039e50ffa7447bb093ca812dedf6 Mon Sep 17 00:00:00 2001
-Message-Id: <0c8db73c3567039e50ffa7447bb093ca812dedf6.1740577844.git.dpark@linux.microsoft.com>
+From 29e2080e75586df18045e84d02853816cb2f943d Mon Sep 17 00:00:00 2001
 From: Peyton Robertson <93797227+peytonr18@users.noreply.github.com>
 Date: Tue, 28 Jan 2025 14:17:43 -0800
-Subject: [PATCH] Applying patch to prevent ssh public key override (#3309)
+Subject: [PATCH 2/2] Applying patch to prevent ssh public key override (#3309)
 
 ---
  azurelinuxagent/common/osutil/default.py | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/azurelinuxagent/common/osutil/default.py b/azurelinuxagent/common/osutil/default.py
-index 584515dc..746c4363 100644
+index 0a0fd0e1..994edff7 100644
 --- a/azurelinuxagent/common/osutil/default.py
 +++ b/azurelinuxagent/common/osutil/default.py
-@@ -346,7 +346,7 @@ GEN2_DEVICE_ID = 'f8b3781a-1e82-4818-a1c3-63d806ec15bb'
+@@ -557,7 +557,7 @@ class DefaultOSUtil(object):
                  raise OSUtilError("Bad public key: {0}".format(value))
              if not value.endswith("\n"):
                  value += "\n"
@@ -22,5 +21,5 @@ index 584515dc..746c4363 100644
              lib_dir = conf.get_lib_dir()
              crt_path = os.path.join(lib_dir, thumbprint + '.crt')
 -- 
-2.39.5
+2.49.0
 

sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/wa-linux-agent-2.12.0.4-r1.ebuild

@@ -0,0 +1,42 @@
+# Copyright (c) 2014 CoreOS, Inc.. All rights reserved.
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{11..13} )
+DISTUTILS_USE_PEP517=setuptools
+
+inherit distutils-r1
+
+DESCRIPTION="Windows Azure Linux Agent"
+HOMEPAGE="https://github.com/Azure/WALinuxAgent"
+SRC_URI="${HOMEPAGE}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+KEYWORDS="amd64 arm64"
+SLOT="0"
+IUSE=""
+RESTRICT=""
+
+BDEPEND="
+	dev-python/distro
+"
+RDEPEND="${BDEPEND}
+"
+
+S="${WORKDIR}/WALinuxAgent-${PV}"
+
+PATCHES=(
+	"${FILESDIR}/0001-flatcar-changes.patch"
+	"${FILESDIR}/0002-prevent-ssh-public-key-override.patch"
+)
+
+# All the stuff is installed inside the site-packages directory, even executables that ought to be in /sbin or config that ought to be in /etc. Move them.
+python_install() {
+	distutils-r1_python_install
+	local d
+	for d in /etc /usr; do
+		cp -a "${ED}$(python_get_sitedir)${d}" "${ED}" || die
+		rm -rf "${ED}$(python_get_sitedir)${d}" || die
+	done
+}