forked from microsoft/azurelinux
-
-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #1 from microsoft/2.0
Stock control supervisors
- Loading branch information
Showing
7 changed files
with
113 additions
and
7 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -88,7 +88,7 @@ popd | |
mkdir -p %{buildroot}%{_bindir} | ||
mkdir -p %{buildroot}%{goroot} | ||
|
||
cp -R api bin doc lib pkg src misc VERSION %{buildroot}%{goroot} | ||
cp -R api bin doc lib pkg src misc VERSION go.env %{buildroot}%{goroot} | ||
|
||
# remove the unnecessary zoneinfo file (Go will always use the system one first) | ||
rm -rfv %{buildroot}%{goroot}/lib/time | ||
|
@@ -143,6 +143,7 @@ fi | |
%changelog | ||
* Fri Feb 02 2024 Muhammad Falak <[email protected]> - 1.21.6-1 | ||
- Bump version to 1.21.6 | ||
- Include go.env in GOROOT | ||
|
||
* Mon Oct 16 2023 Nan Liu <[email protected]> - 1.20.10-1 | ||
- Bump version to 1.20.10 to address CVE-2023-29409, CVE-2023-39318, CVE-2023-39319, CVE-2023-39323, CVE-2023-39533, CVE-2023-29406, CVE-2023-39325, CVE-2023-44487 | ||
|
47 changes: 47 additions & 0 deletions
47
SPECS/moby-containerd-cc/fix_cc_tests_for_golang1.21.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,47 @@ | ||
Backported from upstream 5d9bf7d1398f645882e5c2becc7815daa1770c26 | ||
|
||
Signed-off-by: Akihiro Suda <[email protected]> | ||
Signed-off-by: Henry Beberman <[email protected]> | ||
|
||
diff -Naur a/contrib/apparmor/apparmor.go b/contrib/apparmor/apparmor.go | ||
--- a/contrib/apparmor/apparmor.go 2024-02-09 13:19:03.000000000 +0000 | ||
+++ b/contrib/apparmor/apparmor.go 2024-02-22 00:22:43.993021818 +0000 | ||
@@ -39,6 +39,11 @@ | ||
|
||
// WithDefaultProfile will generate a default apparmor profile under the provided name | ||
// for the container. It is only generated if a profile under that name does not exist. | ||
+// | ||
+// FIXME: pkg/cri/[sb]server/container_create_linux_test.go depends on go:noinline | ||
+// since Go 1.21. | ||
+// | ||
+//go:noinline | ||
func WithDefaultProfile(name string) oci.SpecOpts { | ||
return func(_ context.Context, _ oci.Client, _ *containers.Container, s *specs.Spec) error { | ||
if err := LoadDefaultProfile(name); err != nil { | ||
diff -Naur a/contrib/seccomp/seccomp.go b/contrib/seccomp/seccomp.go | ||
--- a/contrib/seccomp/seccomp.go 2024-02-09 13:19:03.000000000 +0000 | ||
+++ b/contrib/seccomp/seccomp.go 2024-02-22 00:49:25.471844786 +0000 | ||
@@ -30,6 +30,11 @@ | ||
// WithProfile receives the name of a file stored on disk comprising a json | ||
// formatted seccomp profile, as specified by the opencontainers/runtime-spec. | ||
// The profile is read from the file, unmarshaled, and set to the spec. | ||
+// | ||
+// FIXME: pkg/cri/[sb]server/container_create_linux_test.go depends on go:noinline | ||
+// since Go 1.21. | ||
+// | ||
+//go:noinline | ||
func WithProfile(profile string) oci.SpecOpts { | ||
return func(_ context.Context, _ oci.Client, _ *containers.Container, s *specs.Spec) error { | ||
s.Linux.Seccomp = &specs.LinuxSeccomp{} | ||
@@ -46,6 +51,11 @@ | ||
|
||
// WithDefaultProfile sets the default seccomp profile to the spec. | ||
// Note: must follow the setting of process capabilities | ||
+// | ||
+// FIXME: pkg/cri/[sb]server/container_create_linux_test.go depends on go:noinline | ||
+// since Go 1.21. | ||
+// | ||
+//go:noinline | ||
func WithDefaultProfile() oci.SpecOpts { | ||
return func(_ context.Context, _ oci.Client, _ *containers.Container, s *specs.Spec) error { | ||
s.Linux.Seccomp = DefaultProfile(s) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -5,8 +5,8 @@ | |
|
||
Summary: Industry-standard container runtime for confidential containers | ||
Name: moby-%{upstream_name} | ||
Version: 1.7.2 | ||
Release: 4%{?dist} | ||
Version: 1.7.7 | ||
Release: 2%{?dist} | ||
License: ASL 2.0 | ||
Group: Tools/Container | ||
URL: https://www.containerd.io | ||
|
@@ -18,6 +18,7 @@ Source1: containerd.service | |
Source2: containerd.toml | ||
Patch0: CVE-2023-47108.patch | ||
Patch1: CVE-2023-44487.patch | ||
Patch2: fix_cc_tests_for_golang1.21.patch | ||
|
||
%{?systemd_requires} | ||
|
||
|
@@ -79,6 +80,12 @@ fi | |
%config(noreplace) %{_sysconfdir}/containerd/config.toml | ||
|
||
%changelog | ||
* Wed Feb 21 2024 Henry Beberman <[email protected]> - 1.7.7-2 | ||
- Backport upstream patch for no-inlining seccomp and apparmor functions to fix tests. | ||
|
||
* Tue Feb 20 2024 Mitch Zhu <[email protected]> - 1.7.7-1 | ||
- Upgrade to upstream containerd v1.7.7. | ||
|
||
* Fri Feb 02 2024 Daniel McIlvaney <[email protected]> - 1.7.2-4 | ||
- Address CVE-2023-44487 by patching vendored golang.org/x/net | ||
|
||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,47 @@ | ||
Backported from upstream 5d9bf7d1398f645882e5c2becc7815daa1770c26 | ||
|
||
Signed-off-by: Akihiro Suda <[email protected]> | ||
Signed-off-by: Henry Beberman <[email protected]> | ||
|
||
diff -Naur a/contrib/apparmor/apparmor.go b/contrib/apparmor/apparmor.go | ||
--- a/contrib/apparmor/apparmor.go 2023-12-08 23:30:22.000000000 +0000 | ||
+++ b/contrib/apparmor/apparmor.go 2024-02-21 23:33:58.302514996 +0000 | ||
@@ -40,6 +40,11 @@ | ||
|
||
// WithDefaultProfile will generate a default apparmor profile under the provided name | ||
// for the container. It is only generated if a profile under that name does not exist. | ||
+// | ||
+// FIXME: pkg/cri/[sb]server/container_create_linux_test.go depends on go:noinline | ||
+// since Go 1.21. | ||
+// | ||
+//go:noinline | ||
func WithDefaultProfile(name string) oci.SpecOpts { | ||
return func(_ context.Context, _ oci.Client, _ *containers.Container, s *specs.Spec) error { | ||
if err := LoadDefaultProfile(name); err != nil { | ||
diff -Naur a/contrib/seccomp/seccomp.go b/contrib/seccomp/seccomp.go | ||
--- a/contrib/seccomp/seccomp.go 2023-12-08 23:30:22.000000000 +0000 | ||
+++ b/contrib/seccomp/seccomp.go 2024-02-21 23:34:20.362648277 +0000 | ||
@@ -30,6 +30,11 @@ | ||
// WithProfile receives the name of a file stored on disk comprising a json | ||
// formatted seccomp profile, as specified by the opencontainers/runtime-spec. | ||
// The profile is read from the file, unmarshaled, and set to the spec. | ||
+// | ||
+// FIXME: pkg/cri/[sb]server/container_create_linux_test.go depends on go:noinline | ||
+// since Go 1.21. | ||
+// | ||
+//go:noinline | ||
func WithProfile(profile string) oci.SpecOpts { | ||
return func(_ context.Context, _ oci.Client, _ *containers.Container, s *specs.Spec) error { | ||
s.Linux.Seccomp = &specs.LinuxSeccomp{} | ||
@@ -46,6 +51,11 @@ | ||
|
||
// WithDefaultProfile sets the default seccomp profile to the spec. | ||
// Note: must follow the setting of process capabilities | ||
+// | ||
+// FIXME: pkg/cri/[sb]server/container_create_linux_test.go depends on go:noinline | ||
+// since Go 1.21. | ||
+// | ||
+//go:noinline | ||
func WithDefaultProfile() oci.SpecOpts { | ||
return func(_ context.Context, _ oci.Client, _ *containers.Container, s *specs.Spec) error { | ||
s.Linux.Seccomp = DefaultProfile(s) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -5,7 +5,7 @@ | |
Summary: Industry-standard container runtime | ||
Name: moby-%{upstream_name} | ||
Version: 1.6.26 | ||
Release: 3%{?dist} | ||
Release: 4%{?dist} | ||
License: ASL 2.0 | ||
Group: Tools/Container | ||
URL: https://www.containerd.io | ||
|
@@ -17,6 +17,7 @@ Source1: containerd.service | |
Source2: containerd.toml | ||
Patch0: Makefile.patch | ||
Patch1: add_ptrace_readby_tracedby_to_apparmor.patch | ||
Patch2: fix_tests_for_golang1.21.patch | ||
|
||
%{?systemd_requires} | ||
|
||
|
@@ -90,6 +91,9 @@ fi | |
%dir /opt/containerd/lib | ||
|
||
%changelog | ||
* Wed Feb 21 2024 Henry Beberman <[email protected]> - 1.6.26-4 | ||
- Backport upstream patch for no-inlining seccomp and apparmor functions to fix tests. | ||
|
||
* Fri Feb 02 2024 CBL-Mariner Servicing Account <[email protected]> - 1.6.26-3 | ||
- Bump release to rebuild with go 1.21.6 | ||
|
||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters