Merge pull request #2750 from flatcar/buildbot/weekly-portage-stable-package-updates-2025-03-17

Weekly portage-stable package updates 2025-03-17

Author: krnowak

build_library/toolchain_util.sh

@@ -284,7 +284,11 @@ _configure_sysroot() {
 
     "${sudo[@]}" mkdir -p "${ROOT}/etc/portage/"{profile,repos.conf}
     "${sudo[@]}" cp /etc/portage/repos.conf/* "${ROOT}/etc/portage/repos.conf/"
-    "${sudo[@]}" eselect profile set --force "$profile"
+    # set PORTAGE_CONFIGROOT to tell eselect to modify the profile
+    # inside /build/<arch>-usr, but set ROOT to /, so eselect will
+    # actually find the profile which is outside /build/<arch>-usr,
+    # set SYSROOT to / as well, because it must match ROOT
+    "${sudo[@]}" PORTAGE_CONFIGROOT=${ROOT} SYSROOT=/ ROOT=/ eselect profile set --force "$profile"
 
     local coreos_path
     coreos_path=$(portageq get_repo_path "${ROOT}" coreos-overlay)

changelog/security/2025-03-20-weekly-updates.md

@@ -0,0 +1,2 @@
+- expat ([CVE-2024-8176](https://nvd.nist.gov/vuln/detail/CVE-2024-8176))
+- libxml2 ([CVE-2024-56171](https://nvd.nist.gov/vuln/detail/CVE-2024-56171), [CVE-2025-24928](https://nvd.nist.gov/vuln/detail/CVE-2025-24928), [CVE-2025-27113](https://nvd.nist.gov/vuln/detail/CVE-2025-27113))

changelog/updates/2025-03-20-weekly-updates.md

@@ -0,0 +1,27 @@
+- SDK: go ([1.24.1](https://go.dev/doc/go1.24))
+- base, dev: expat ([2.7.0](https://github.com/libexpat/libexpat/blob/R_2_7_0/expat/Changes#L40))
+- base, dev: git ([2.48.1](https://github.com/git/git/blob/v2.48.1/Documentation/RelNotes/2.48.1.txt) (includes [2.48.0](https://github.com/git/git/blob/v2.48.0/Documentation/RelNotes/2.48.0.txt), [2.47.2](https://github.com/git/git/blob/v2.47.2/Documentation/RelNotes/2.47.2.txt), [2.47.1](https://github.com/git/git/blob/v2.47.1/Documentation/RelNotes/2.47.1.txt), [2.47.0](https://github.com/git/git/blob/v2.47.0/Documentation/RelNotes/2.47.0.txt), [2.46.3](https://github.com/git/git/blob/v2.46.3/Documentation/RelNotes/2.46.3.txt), [2.46.2](https://github.com/git/git/blob/v2.46.2/Documentation/RelNotes/2.46.2.txt), [2.46.1](https://github.com/git/git/blob/v2.46.1/Documentation/RelNotes/2.46.1.txt), [2.46.0](https://github.com/git/git/blob/v2.46.0/Documentation/RelNotes/2.46.0.txt)))
+- base, dev: glib ([2.82.5](https://gitlab.gnome.org/GNOME/glib/-/releases/2.82.5))
+- base, dev: iproute2 ([6.13.0](https://lore.kernel.org/all/[email protected]/))
+- base, dev: libpcre2 ([10.45](https://github.com/PCRE2Project/pcre2/blob/pcre2-10.45/NEWS))
+- base, dev: libseccomp ([2.6.0](https://github.com/seccomp/libseccomp/releases/tag/v2.6.0) (includes [2.5.6](https://github.com/seccomp/libseccomp/releases/tag/v2.5.6)))
+- base, dev: libuv ([1.50.0](https://github.com/libuv/libuv/releases/tag/v1.50.0))
+- base, dev: libxml2 ([2.12.10](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.10))
+- base, dev: ncurses ([6.5_p20250125](https://invisible-island.net/ncurses/announce-6.5.html))
+- base, dev: oniguruma ([6.9.10](https://github.com/kkos/oniguruma/releases/tag/v6.9.10))
+- base, dev: qemu-guest-agent ([9.2.0](https://wiki.qemu.org/ChangeLog/9.2#Guest_agent) (includes [9.1](https://wiki.qemu.org/ChangeLog/9.1#Guest_agent), [9.0](https://wiki.qemu.org/ChangeLog/9.0#Guest_agent)))
+- base, dev: userspace-rcu ([0.15.1](https://lore.kernel.org/lkml/[email protected]/T/) (includes [0.15.0](https://lore.kernel.org/all/[email protected]/)))
+- base, dev: which ([2.23](https://git.savannah.gnu.org/cgit/which.git/tree/NEWS?id=3e2c8f8acc3a333b66b06de234bc9324c6fe5500))
+- base, dev: xfsprogs ([6.12.0](https://web.git.kernel.org/pub/scm/fs/xfs/xfsprogs-dev.git/tree/doc/CHANGES?h=v6.12.0))
+- base, dev: xz-utils ([5.6.4](https://github.com/tukaani-project/xz/releases/tag/v5.6.4))
+- base, dev: zstd ([1.5.7](https://github.com/facebook/zstd/releases/tag/v1.5.7))
+- containerd: containerd ([2.0.2](https://github.com/containerd/containerd/releases/tag/v2.0.2))
+- dev: eselect ([1.4.29](https://gitweb.gentoo.org/proj/eselect.git/tree/NEWS?h=eselect-1.4.29))
+- dev: getuto ([1.15](https://github.com/projg2/getuto/commits/getuto-1.15/))
+- dev: man-pages ([6.10](https://lkml.org/lkml/2025/1/22/1229))
+- dev: portage ([3.0.67](https://github.com/gentoo/portage/blob/portage-3.0.67/NEWS))
+- docker: docker ([28.0.1](https://github.com/moby/moby/releases/tag/v28.0.1) (includes [28.0.0](https://github.com/moby/moby/releases/tag/v28.0.0)))
+- sysext-podman: crun ([1.19.1](https://github.com/containers/crun/releases/tag/1.19.1) (includes [1.19](https://github.com/containers/crun/releases/tag/1.19), [1.18.2](https://github.com/containers/crun/releases/tag/1.18.2), [1.18.1](https://github.com/containers/crun/releases/tag/1.18.1), [1.18](https://github.com/containers/crun/releases/tag/1.18)))
+- sysext-python: setuptools ([75.8.2](https://github.com/pypa/setuptools/blob/v75.8.2/NEWS.rst) (includes [75.8.1](https://github.com/pypa/setuptools/blob/v75.8.1/NEWS.rst)))
+- sysext-python: setuptools-scm ([8.2.0](https://github.com/pypa/setuptools-scm/blob/v8.2.0/CHANGELOG.md))
+- sysext-python: trove-classifiers ([2025.3.3.18](https://github.com/pypa/trove-classifiers/releases/tag/2025.3.3.18))

sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/selinux/config

@@ -130,9 +130,6 @@ src_install() {
         fi
     done
 
-    insinto '/etc/selinux/'
-    doins "${FILESDIR}/selinux/config"
-
     insinto '/etc/bash/bashrc.d'
     doins "${FILESDIR}/bash/99-flatcar-bcc"
 

…s-base/misc-files/misc-files-0-r6.ebuild …s-base/misc-files/misc-files-0-r7.ebuildsdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/misc-files-0-r6.ebuild renamed to sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/misc-files-0-r7.ebuild sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/misc-files-0-r6.ebuild renamed to sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/misc-files-0-r7.ebuild

@@ -29,20 +29,13 @@
 =app-emulation/open-vmdk-1.0 *
 
 # Keep versions on both arches in sync.
-=app-emulation/qemu-guest-agent-8.2.0 ~arm64
-=dev-build/meson-1.6.1 ~arm64
+=app-emulation/qemu-guest-agent-9.2.0 ~arm64
 =dev-lang/yasm-1.3.0-r1 ~arm64
 =dev-libs/ding-libs-0.6.2-r1 ~arm64
 
-# Needed to address CVE-2024-52533
-=dev-libs/glib-2.82.4-r1 ~amd64 ~arm64
-
 # The only available ebuild (from GURU) has ~amd64 and no keyword for arm64 yet.
 =dev-libs/jose-12 **
 
-# Needed to address CVE-2024-12133.
-=dev-libs/libtasn1-4.20.0 ~amd64 ~arm64
-
 # The only available ebuild (from GURU) has ~amd64 and no keyword for arm64 yet.
 =dev-libs/luksmeta-9-r1 **
 
@@ -52,10 +45,6 @@
 # Catalyst 4 is not stable yet, but earlier versions are masked now.
 =dev-util/catalyst-4.0.0 ~amd64 ~arm64
 
-# Needed to address CVE-2024-52533
-=dev-util/gdbus-codegen-2.82.4 ~amd64 ~arm64
-=dev-util/glib-utils-2.82.4 ~amd64 ~arm64
-
 # Keep versions on both arches in sync.
 =net-firewall/conntrack-tools-1.4.8-r1 ~arm64
 
@@ -90,11 +79,7 @@
 # Enable ipvsadm for arm64.
 =sys-cluster/ipvsadm-1.31-r1 ~arm64
 
-# Needed to address CVE-2024-53589, CVE-2025-1176, CVE-2025-1178,
-# CVE-2025-1179, CVE-2025-1180, CVE-2025-1181, CVE-2025-1182.
-=sys-devel/binutils-2.44 ~amd64 ~arm64
-=sys-libs/binutils-libs-2.44 ~amd64 ~arm64
-
 # Keep versions on both arches in sync.
 =sys-libs/libsemanage-3.7 ~arm64
+=sys-libs/ncurses-6.5_p20250125 ~arm64
 =sys-process/audit-4.0.2-r1 ~arm64

sdk_container/src/third_party/coreos-overlay/coreos/config/env/sec-policy/selinux-base

@@ -1,3 +1,2 @@
 DIST eselect-1.4.27.tar.xz 184464 BLAKE2B 718874f4d0651194f361ca3202e5140982812bf486c8efe82354944d55206b0113fa135992203e8baa00019c3fd773a90ddaf67157c16f4ac2d69965d9822fbd SHA512 f534785fc1f79869840f420b4ab2b2bf35593c504cce878a6d3d07f75012cf32288009ea9ac2a5607dba216a794110a64c5f2c54d5d8a3c641328489cecc024b
-DIST eselect-1.4.28.tar.xz 184692 BLAKE2B 86d1bbc0cb618f6edf49753c9f2be0f67670590ae55b8d2a8824940a5efa8462e395e1ee7f42379bd4ea64ea74f775a78e0a3a23ed565c67c3485f7e4e2d7a83 SHA512 26ac77465e2d6ab5193083c350cfd027d73ecd6d2702fc5f3db90373e92bf3722aead99c9b00b540c7972761620a485941c897854fe110454a4c6897f3f92868
 DIST eselect-1.4.29.tar.xz 185948 BLAKE2B bb387a14c81d5ff5bf2e6e703465b24140b047f1464dee3c7fc0a125c9d94544a9afd801b42d2902dd6dee1af705f7dcfad854286d7e243a0f654cec35ab8eea SHA512 0466be2634f9d632d628cb11793d604002d989c222758ed33259c6b1dede80765d80f782242b22704e890bde84b2e1e3b3fb3d31574812cc803aad64ba8e7cf6

sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords

@@ -16,7 +16,7 @@ SRC_URI="https://dev.gentoo.org/~ulm/eselect/${P}.tar.xz"
 
 LICENSE="GPL-2+ || ( GPL-2+ CC-BY-SA-4.0 )"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="doc emacs vim-syntax"
 
 # coreutils for realpath