Compare commits
No commits in common. "a269686e5bc7a64ef3bf9436538b9bd751bc1f8c" and "7c68752dabdf5fd87f750a08d3ee05faaccb8f86" have entirely different histories.
a269686e5b
...
7c68752dab
File diff suppressed because it is too large
Load Diff
@ -1,59 +0,0 @@
|
||||
From 171172b7a8a24104415f1d461da7a839dd9933a3 Mon Sep 17 00:00:00 2001
|
||||
From: bwzhang <zhangbowei@kylinos.cn>
|
||||
Date: Mon, 25 Mar 2024 10:47:11 +0800
|
||||
Subject: [PATCH] fix CVE-2024-24786
|
||||
|
||||
encoding/protojson, internal/encoding/json: handle missing object values
|
||||
|
||||
In internal/encoding/json, report an error when encountering a }
|
||||
when we are expecting an object field value. For example, the input
|
||||
now correctly results in an error at the closing } token.
|
||||
|
||||
In encoding/protojson, check for an unexpected EOF token in
|
||||
skipJSONValue. This is redundant with the check in internal/encoding/json,
|
||||
but adds a bit more defense against any other similar bugs that
|
||||
might exist.
|
||||
|
||||
Fixes CVE-2024-24786
|
||||
|
||||
Change-Id: I03d52512acb5091c8549e31ca74541d57e56c99d
|
||||
Reviewed-on: https://go-review.googlesource.com/c/protobuf/+/569356
|
||||
TryBot-Bypass: Damien Neil <dneil@google.com>
|
||||
Reviewed-by: Roland Shoemaker <roland@golang.org>
|
||||
Commit-Queue: Damien Neil <dneil@google.com>
|
||||
---
|
||||
.../protobuf/encoding/protojson/well_known_types.go | 4 ++++
|
||||
.../protobuf/internal/encoding/json/decode.go | 2 +-
|
||||
2 files changed, 5 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/vendor/google.golang.org/protobuf/encoding/protojson/well_known_types.go b/vendor/google.golang.org/protobuf/encoding/protojson/well_known_types.go
|
||||
index 72924a9..d3825ba 100644
|
||||
--- a/vendor/google.golang.org/protobuf/encoding/protojson/well_known_types.go
|
||||
+++ b/vendor/google.golang.org/protobuf/encoding/protojson/well_known_types.go
|
||||
@@ -328,6 +328,10 @@ func (d decoder) skipJSONValue() error {
|
||||
if err := d.skipJSONValue(); err != nil {
|
||||
return err
|
||||
}
|
||||
+ case json.EOF:
|
||||
+ // This can only happen if there's a bug in Decoder.Read.
|
||||
+ // Avoid an infinite loop if this does happen.
|
||||
+ return errors.New("unexpected EOF")
|
||||
}
|
||||
}
|
||||
|
||||
diff --git a/vendor/google.golang.org/protobuf/internal/encoding/json/decode.go b/vendor/google.golang.org/protobuf/internal/encoding/json/decode.go
|
||||
index b13fd29..b2be4e8 100644
|
||||
--- a/vendor/google.golang.org/protobuf/internal/encoding/json/decode.go
|
||||
+++ b/vendor/google.golang.org/protobuf/internal/encoding/json/decode.go
|
||||
@@ -121,7 +121,7 @@ func (d *Decoder) Read() (Token, error) {
|
||||
|
||||
case ObjectClose:
|
||||
if len(d.openStack) == 0 ||
|
||||
- d.lastToken.kind == comma ||
|
||||
+ d.lastToken.kind&(Name|comma) != 0 ||
|
||||
d.openStack[len(d.openStack)-1] != ObjectOpen {
|
||||
return Token{}, d.newSyntaxError(tok.pos, unexpectedFmt, tok.RawString())
|
||||
}
|
||||
--
|
||||
2.20.1
|
||||
|
||||
@ -1,89 +0,0 @@
|
||||
From d1aef6461e6fff7afce01fa6aa832914cb0f26a8 Mon Sep 17 00:00:00 2001
|
||||
From: bwzhang <zhangbowei@kylinos.cn>
|
||||
Date: Thu, 28 Mar 2024 16:30:28 +0800
|
||||
Subject: [PATCH] fix CVE-2024-28180
|
||||
|
||||
---
|
||||
.../github.com/go-jose/go-jose/v3/crypter.go | 6 ++++++
|
||||
.../github.com/go-jose/go-jose/v3/encoding.go | 21 +++++++++++++++----
|
||||
2 files changed, 23 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/vendor/github.com/go-jose/go-jose/v3/crypter.go b/vendor/github.com/go-jose/go-jose/v3/crypter.go
|
||||
index 6901137..34d4e1f 100644
|
||||
--- a/vendor/github.com/go-jose/go-jose/v3/crypter.go
|
||||
+++ b/vendor/github.com/go-jose/go-jose/v3/crypter.go
|
||||
@@ -406,6 +406,9 @@ func (ctx *genericEncrypter) Options() EncrypterOptions {
|
||||
// Decrypt and validate the object and return the plaintext. Note that this
|
||||
// function does not support multi-recipient, if you desire multi-recipient
|
||||
// decryption use DecryptMulti instead.
|
||||
+//
|
||||
+// Automatically decompresses plaintext, but returns an error if the decompressed
|
||||
+// data would be >250kB or >10x the size of the compressed data, whichever is larger.
|
||||
func (obj JSONWebEncryption) Decrypt(decryptionKey interface{}) ([]byte, error) {
|
||||
headers := obj.mergedHeaders(nil)
|
||||
|
||||
@@ -471,6 +474,9 @@ func (obj JSONWebEncryption) Decrypt(decryptionKey interface{}) ([]byte, error)
|
||||
// with support for multiple recipients. It returns the index of the recipient
|
||||
// for which the decryption was successful, the merged headers for that recipient,
|
||||
// and the plaintext.
|
||||
+//
|
||||
+// Automatically decompresses plaintext, but returns an error if the decompressed
|
||||
+// data would be >250kB or >3x the size of the compressed data, whichever is larger.
|
||||
func (obj JSONWebEncryption) DecryptMulti(decryptionKey interface{}) (int, Header, []byte, error) {
|
||||
globalHeaders := obj.mergedHeaders(nil)
|
||||
|
||||
diff --git a/vendor/github.com/go-jose/go-jose/v3/encoding.go b/vendor/github.com/go-jose/go-jose/v3/encoding.go
|
||||
index 968a424..c378031 100644
|
||||
--- a/vendor/github.com/go-jose/go-jose/v3/encoding.go
|
||||
+++ b/vendor/github.com/go-jose/go-jose/v3/encoding.go
|
||||
@@ -21,6 +21,7 @@ import (
|
||||
"compress/flate"
|
||||
"encoding/base64"
|
||||
"encoding/binary"
|
||||
+ "fmt"
|
||||
"io"
|
||||
"math/big"
|
||||
"strings"
|
||||
@@ -85,7 +86,7 @@ func decompress(algorithm CompressionAlgorithm, input []byte) ([]byte, error) {
|
||||
}
|
||||
}
|
||||
|
||||
-// Compress with DEFLATE
|
||||
+// deflate compresses the input.
|
||||
func deflate(input []byte) ([]byte, error) {
|
||||
output := new(bytes.Buffer)
|
||||
|
||||
@@ -97,15 +98,27 @@ func deflate(input []byte) ([]byte, error) {
|
||||
return output.Bytes(), err
|
||||
}
|
||||
|
||||
-// Decompress with DEFLATE
|
||||
+// inflate decompresses the input.
|
||||
+//
|
||||
+// Errors if the decompressed data would be >250kB or >10x the size of the
|
||||
+// compressed data, whichever is larger
|
||||
func inflate(input []byte) ([]byte, error) {
|
||||
output := new(bytes.Buffer)
|
||||
reader := flate.NewReader(bytes.NewBuffer(input))
|
||||
|
||||
- _, err := io.Copy(output, reader)
|
||||
- if err != nil {
|
||||
+ maxCompressedSize := 10 * int64(len(input))
|
||||
+ if maxCompressedSize < 250000 {
|
||||
+ maxCompressedSize = 250000
|
||||
+ }
|
||||
+
|
||||
+ limit := maxCompressedSize + 1
|
||||
+ n, err := io.CopyN(output, reader, limit)
|
||||
+ if err != nil && err != io.EOF {
|
||||
return nil, err
|
||||
}
|
||||
+ if n == limit {
|
||||
+ return nil, fmt.Errorf("uncompressed data would be too large (>%d bytes)", maxCompressedSize)
|
||||
+ }
|
||||
|
||||
err = reader.Close()
|
||||
return output.Bytes(), err
|
||||
--
|
||||
2.20.1
|
||||
|
||||
69
fix-CVE-2023-24537.patch
Normal file
69
fix-CVE-2023-24537.patch
Normal file
@ -0,0 +1,69 @@
|
||||
From 02f8f73194c075abdebb58d4c41891d400c1c3a0 Mon Sep 17 00:00:00 2001
|
||||
From: Merlin <merlinsun@hust.edu.cn>
|
||||
Date: Thu, 27 Apr 2023 11:10:22 +0800
|
||||
Subject: [PATCH] fix-CVE-2023-24537
|
||||
|
||||
---
|
||||
src/go/parser/parser_test.go | 16 ++++++++++++++++
|
||||
src/go/scanner/scanner.go | 7 +++++--
|
||||
2 files changed, 21 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/src/go/parser/parser_test.go b/src/go/parser/parser_test.go
|
||||
index 153562df75..bf475d690b 100644
|
||||
--- a/src/go/parser/parser_test.go
|
||||
+++ b/src/go/parser/parser_test.go
|
||||
@@ -764,3 +764,19 @@ func TestRangePos(t *testing.T) {
|
||||
})
|
||||
}
|
||||
}
|
||||
+
|
||||
+// TestIssue59180 tests that line number overflow doesn't cause an infinite loop.
|
||||
+func TestIssue59180(t *testing.T) {
|
||||
+ testcases := []string{
|
||||
+ "package p\n//line :9223372036854775806\n\n//",
|
||||
+ "package p\n//line :1:9223372036854775806\n\n//",
|
||||
+ "package p\n//line file:9223372036854775806\n\n//",
|
||||
+ }
|
||||
+
|
||||
+ for _, src := range testcases {
|
||||
+ _, err := ParseFile(token.NewFileSet(), "", src, ParseComments)
|
||||
+ if err == nil {
|
||||
+ t.Errorf("ParseFile(%s) succeeded unexpectedly", src)
|
||||
+ }
|
||||
+ }
|
||||
+}
|
||||
\ No newline at end of file
|
||||
diff --git a/src/go/scanner/scanner.go b/src/go/scanner/scanner.go
|
||||
index 16958d22ce..0cd9f5901d 100644
|
||||
--- a/src/go/scanner/scanner.go
|
||||
+++ b/src/go/scanner/scanner.go
|
||||
@@ -253,13 +253,16 @@ func (s *Scanner) updateLineInfo(next, offs int, text []byte) {
|
||||
return
|
||||
}
|
||||
|
||||
+ // Put a cap on the maximum size of line and column numbers.
|
||||
+ // 30 bits allows for some additional space before wrapping an int32.
|
||||
+ const maxLineCol = 1<<30 - 1
|
||||
var line, col int
|
||||
i2, n2, ok2 := trailingDigits(text[:i-1])
|
||||
if ok2 {
|
||||
//line filename:line:col
|
||||
i, i2 = i2, i
|
||||
line, col = n2, n
|
||||
- if col == 0 {
|
||||
+ if col == 0 || col > maxLineCol {
|
||||
s.error(offs+i2, "invalid column number: "+string(text[i2:]))
|
||||
return
|
||||
}
|
||||
@@ -269,7 +272,7 @@ func (s *Scanner) updateLineInfo(next, offs int, text []byte) {
|
||||
line = n
|
||||
}
|
||||
|
||||
- if line == 0 {
|
||||
+ if line == 0 || line > maxLineCol {
|
||||
s.error(offs+i, "invalid line number: "+string(text[i:]))
|
||||
return
|
||||
}
|
||||
--
|
||||
2.37.1 (Apple Git-137.1)
|
||||
|
||||
907
seccomp.json
Normal file
907
seccomp.json
Normal file
@ -0,0 +1,907 @@
|
||||
{
|
||||
"defaultAction": "SCMP_ACT_ERRNO",
|
||||
"archMap": [
|
||||
{
|
||||
"architecture": "SCMP_ARCH_X86_64",
|
||||
"subArchitectures": [
|
||||
"SCMP_ARCH_X86",
|
||||
"SCMP_ARCH_X32"
|
||||
]
|
||||
},
|
||||
{
|
||||
"architecture": "SCMP_ARCH_AARCH64",
|
||||
"subArchitectures": [
|
||||
"SCMP_ARCH_ARM"
|
||||
]
|
||||
},
|
||||
{
|
||||
"architecture": "SCMP_ARCH_MIPS64",
|
||||
"subArchitectures": [
|
||||
"SCMP_ARCH_MIPS",
|
||||
"SCMP_ARCH_MIPS64N32"
|
||||
]
|
||||
},
|
||||
{
|
||||
"architecture": "SCMP_ARCH_MIPS64N32",
|
||||
"subArchitectures": [
|
||||
"SCMP_ARCH_MIPS",
|
||||
"SCMP_ARCH_MIPS64"
|
||||
]
|
||||
},
|
||||
{
|
||||
"architecture": "SCMP_ARCH_MIPSEL64",
|
||||
"subArchitectures": [
|
||||
"SCMP_ARCH_MIPSEL",
|
||||
"SCMP_ARCH_MIPSEL64N32"
|
||||
]
|
||||
},
|
||||
{
|
||||
"architecture": "SCMP_ARCH_MIPSEL64N32",
|
||||
"subArchitectures": [
|
||||
"SCMP_ARCH_MIPSEL",
|
||||
"SCMP_ARCH_MIPSEL64"
|
||||
]
|
||||
},
|
||||
{
|
||||
"architecture": "SCMP_ARCH_S390X",
|
||||
"subArchitectures": [
|
||||
"SCMP_ARCH_S390"
|
||||
]
|
||||
}
|
||||
],
|
||||
"syscalls": [
|
||||
{
|
||||
"names": [
|
||||
"_llseek",
|
||||
"_newselect",
|
||||
"accept",
|
||||
"accept4",
|
||||
"access",
|
||||
"adjtimex",
|
||||
"alarm",
|
||||
"bind",
|
||||
"brk",
|
||||
"capget",
|
||||
"capset",
|
||||
"chdir",
|
||||
"chmod",
|
||||
"chown",
|
||||
"chown32",
|
||||
"clock_adjtime",
|
||||
"clock_adjtime64",
|
||||
"clock_getres",
|
||||
"clock_getres_time64",
|
||||
"clock_gettime",
|
||||
"clock_gettime64",
|
||||
"clock_nanosleep",
|
||||
"clock_nanosleep_time64",
|
||||
"clone",
|
||||
"close",
|
||||
"close_range",
|
||||
"connect",
|
||||
"copy_file_range",
|
||||
"creat",
|
||||
"dup",
|
||||
"dup2",
|
||||
"dup3",
|
||||
"epoll_create",
|
||||
"epoll_create1",
|
||||
"epoll_ctl",
|
||||
"epoll_ctl_old",
|
||||
"epoll_pwait",
|
||||
"epoll_pwait2",
|
||||
"epoll_wait",
|
||||
"epoll_wait_old",
|
||||
"eventfd",
|
||||
"eventfd2",
|
||||
"execve",
|
||||
"execveat",
|
||||
"exit",
|
||||
"exit_group",
|
||||
"faccessat",
|
||||
"faccessat2",
|
||||
"fadvise64",
|
||||
"fadvise64_64",
|
||||
"fallocate",
|
||||
"fanotify_mark",
|
||||
"fchdir",
|
||||
"fchmod",
|
||||
"fchmodat",
|
||||
"fchown",
|
||||
"fchown32",
|
||||
"fchownat",
|
||||
"fcntl",
|
||||
"fcntl64",
|
||||
"fdatasync",
|
||||
"fgetxattr",
|
||||
"flistxattr",
|
||||
"flock",
|
||||
"fork",
|
||||
"fremovexattr",
|
||||
"fsconfig",
|
||||
"fsetxattr",
|
||||
"fsmount",
|
||||
"fsopen",
|
||||
"fspick",
|
||||
"fstat",
|
||||
"fstat64",
|
||||
"fstatat64",
|
||||
"fstatfs",
|
||||
"fstatfs64",
|
||||
"fsync",
|
||||
"ftruncate",
|
||||
"ftruncate64",
|
||||
"futex",
|
||||
"futimesat",
|
||||
"get_robust_list",
|
||||
"get_thread_area",
|
||||
"getcpu",
|
||||
"getcwd",
|
||||
"getdents",
|
||||
"getdents64",
|
||||
"getegid",
|
||||
"getegid32",
|
||||
"geteuid",
|
||||
"geteuid32",
|
||||
"getgid",
|
||||
"getgid32",
|
||||
"getgroups",
|
||||
"getgroups32",
|
||||
"getitimer",
|
||||
"getpeername",
|
||||
"getpgid",
|
||||
"getpgrp",
|
||||
"getpid",
|
||||
"getppid",
|
||||
"getpriority",
|
||||
"getrandom",
|
||||
"getresgid",
|
||||
"getresgid32",
|
||||
"getresuid",
|
||||
"getresuid32",
|
||||
"getrlimit",
|
||||
"getrusage",
|
||||
"getsid",
|
||||
"getsockname",
|
||||
"getsockopt",
|
||||
"gettid",
|
||||
"gettimeofday",
|
||||
"getuid",
|
||||
"getuid32",
|
||||
"getxattr",
|
||||
"inotify_add_watch",
|
||||
"inotify_init",
|
||||
"inotify_init1",
|
||||
"inotify_rm_watch",
|
||||
"io_cancel",
|
||||
"io_destroy",
|
||||
"io_getevents",
|
||||
"io_setup",
|
||||
"io_submit",
|
||||
"ioctl",
|
||||
"ioprio_get",
|
||||
"ioprio_set",
|
||||
"ipc",
|
||||
"keyctl",
|
||||
"kill",
|
||||
"lchown",
|
||||
"lchown32",
|
||||
"lgetxattr",
|
||||
"link",
|
||||
"linkat",
|
||||
"listen",
|
||||
"listxattr",
|
||||
"llistxattr",
|
||||
"lremovexattr",
|
||||
"lseek",
|
||||
"lsetxattr",
|
||||
"lstat",
|
||||
"lstat64",
|
||||
"madvise",
|
||||
"memfd_create",
|
||||
"mincore",
|
||||
"mkdir",
|
||||
"mkdirat",
|
||||
"mknod",
|
||||
"mknodat",
|
||||
"mlock",
|
||||
"mlock2",
|
||||
"mlockall",
|
||||
"mmap",
|
||||
"mmap2",
|
||||
"mount",
|
||||
"move_mount",
|
||||
"mprotect",
|
||||
"mq_getsetattr",
|
||||
"mq_notify",
|
||||
"mq_open",
|
||||
"mq_timedreceive",
|
||||
"mq_timedsend",
|
||||
"mq_unlink",
|
||||
"mremap",
|
||||
"msgctl",
|
||||
"msgget",
|
||||
"msgrcv",
|
||||
"msgsnd",
|
||||
"msync",
|
||||
"munlock",
|
||||
"munlockall",
|
||||
"munmap",
|
||||
"name_to_handle_at",
|
||||
"nanosleep",
|
||||
"newfstatat",
|
||||
"open",
|
||||
"openat",
|
||||
"openat2",
|
||||
"open_tree",
|
||||
"pause",
|
||||
"pidfd_getfd",
|
||||
"pidfd_open",
|
||||
"pidfd_send_signal",
|
||||
"pipe",
|
||||
"pipe2",
|
||||
"pivot_root",
|
||||
"poll",
|
||||
"ppoll",
|
||||
"ppoll_time64",
|
||||
"prctl",
|
||||
"pread64",
|
||||
"preadv",
|
||||
"preadv2",
|
||||
"prlimit64",
|
||||
"pselect6",
|
||||
"pselect6_time64",
|
||||
"pwrite64",
|
||||
"pwritev",
|
||||
"pwritev2",
|
||||
"read",
|
||||
"readahead",
|
||||
"readlink",
|
||||
"readlinkat",
|
||||
"readv",
|
||||
"reboot",
|
||||
"recv",
|
||||
"recvfrom",
|
||||
"recvmmsg",
|
||||
"recvmsg",
|
||||
"remap_file_pages",
|
||||
"removexattr",
|
||||
"rename",
|
||||
"renameat",
|
||||
"renameat2",
|
||||
"restart_syscall",
|
||||
"rmdir",
|
||||
"rt_sigaction",
|
||||
"rt_sigpending",
|
||||
"rt_sigprocmask",
|
||||
"rt_sigqueueinfo",
|
||||
"rt_sigreturn",
|
||||
"rt_sigsuspend",
|
||||
"rt_sigtimedwait",
|
||||
"rt_tgsigqueueinfo",
|
||||
"sched_get_priority_max",
|
||||
"sched_get_priority_min",
|
||||
"sched_getaffinity",
|
||||
"sched_getattr",
|
||||
"sched_getparam",
|
||||
"sched_getscheduler",
|
||||
"sched_rr_get_interval",
|
||||
"sched_setaffinity",
|
||||
"sched_setattr",
|
||||
"sched_setparam",
|
||||
"sched_setscheduler",
|
||||
"sched_yield",
|
||||
"seccomp",
|
||||
"select",
|
||||
"semctl",
|
||||
"semget",
|
||||
"semop",
|
||||
"semtimedop",
|
||||
"send",
|
||||
"sendfile",
|
||||
"sendfile64",
|
||||
"sendmmsg",
|
||||
"sendmsg",
|
||||
"sendto",
|
||||
"set_robust_list",
|
||||
"set_thread_area",
|
||||
"set_tid_address",
|
||||
"setfsgid",
|
||||
"setfsgid32",
|
||||
"setfsuid",
|
||||
"setfsuid32",
|
||||
"setgid",
|
||||
"setgid32",
|
||||
"setgroups",
|
||||
"setgroups32",
|
||||
"setitimer",
|
||||
"setpgid",
|
||||
"setpriority",
|
||||
"setregid",
|
||||
"setregid32",
|
||||
"setresgid",
|
||||
"setresgid32",
|
||||
"setresuid",
|
||||
"setresuid32",
|
||||
"setreuid",
|
||||
"setreuid32",
|
||||
"setrlimit",
|
||||
"setsid",
|
||||
"setsockopt",
|
||||
"setuid",
|
||||
"setuid32",
|
||||
"setxattr",
|
||||
"shmat",
|
||||
"shmctl",
|
||||
"shmdt",
|
||||
"shmget",
|
||||
"shutdown",
|
||||
"sigaltstack",
|
||||
"signalfd",
|
||||
"signalfd4",
|
||||
"sigreturn",
|
||||
"socket",
|
||||
"socketcall",
|
||||
"socketpair",
|
||||
"splice",
|
||||
"stat",
|
||||
"stat64",
|
||||
"statfs",
|
||||
"statfs64",
|
||||
"statx",
|
||||
"symlink",
|
||||
"symlinkat",
|
||||
"sync",
|
||||
"sync_file_range",
|
||||
"syncfs",
|
||||
"sysinfo",
|
||||
"syslog",
|
||||
"tee",
|
||||
"tgkill",
|
||||
"time",
|
||||
"timer_create",
|
||||
"timer_delete",
|
||||
"timer_getoverrun",
|
||||
"timer_gettime",
|
||||
"timer_gettime64",
|
||||
"timer_settime",
|
||||
"timerfd_create",
|
||||
"timerfd_gettime",
|
||||
"timerfd_gettime64",
|
||||
"timerfd_settime",
|
||||
"timerfd_settime64",
|
||||
"times",
|
||||
"tkill",
|
||||
"truncate",
|
||||
"truncate64",
|
||||
"ugetrlimit",
|
||||
"umask",
|
||||
"umount",
|
||||
"umount2",
|
||||
"uname",
|
||||
"unlink",
|
||||
"unlinkat",
|
||||
"unshare",
|
||||
"utime",
|
||||
"utimensat",
|
||||
"utimensat_time64",
|
||||
"utimes",
|
||||
"vfork",
|
||||
"wait4",
|
||||
"waitid",
|
||||
"waitpid",
|
||||
"write",
|
||||
"writev"
|
||||
],
|
||||
"action": "SCMP_ACT_ALLOW",
|
||||
"args": [],
|
||||
"comment": "",
|
||||
"includes": {},
|
||||
"excludes": {}
|
||||
},
|
||||
{
|
||||
"names": [
|
||||
"personality"
|
||||
],
|
||||
"action": "SCMP_ACT_ALLOW",
|
||||
"args": [
|
||||
{
|
||||
"index": 0,
|
||||
"value": 0,
|
||||
"valueTwo": 0,
|
||||
"op": "SCMP_CMP_EQ"
|
||||
}
|
||||
],
|
||||
"comment": "",
|
||||
"includes": {},
|
||||
"excludes": {}
|
||||
},
|
||||
{
|
||||
"names": [
|
||||
"personality"
|
||||
],
|
||||
"action": "SCMP_ACT_ALLOW",
|
||||
"args": [
|
||||
{
|
||||
"index": 0,
|
||||
"value": 8,
|
||||
"valueTwo": 0,
|
||||
"op": "SCMP_CMP_EQ"
|
||||
}
|
||||
],
|
||||
"comment": "",
|
||||
"includes": {},
|
||||
"excludes": {}
|
||||
},
|
||||
{
|
||||
"names": [
|
||||
"personality"
|
||||
],
|
||||
"action": "SCMP_ACT_ALLOW",
|
||||
"args": [
|
||||
{
|
||||
"index": 0,
|
||||
"value": 131072,
|
||||
"valueTwo": 0,
|
||||
"op": "SCMP_CMP_EQ"
|
||||
}
|
||||
],
|
||||
"comment": "",
|
||||
"includes": {},
|
||||
"excludes": {}
|
||||
},
|
||||
{
|
||||
"names": [
|
||||
"personality"
|
||||
],
|
||||
"action": "SCMP_ACT_ALLOW",
|
||||
"args": [
|
||||
{
|
||||
"index": 0,
|
||||
"value": 131080,
|
||||
"valueTwo": 0,
|
||||
"op": "SCMP_CMP_EQ"
|
||||
}
|
||||
],
|
||||
"comment": "",
|
||||
"includes": {},
|
||||
"excludes": {}
|
||||
},
|
||||
{
|
||||
"names": [
|
||||
"personality"
|
||||
],
|
||||
"action": "SCMP_ACT_ALLOW",
|
||||
"args": [
|
||||
{
|
||||
"index": 0,
|
||||
"value": 4294967295,
|
||||
"valueTwo": 0,
|
||||
"op": "SCMP_CMP_EQ"
|
||||
}
|
||||
],
|
||||
"comment": "",
|
||||
"includes": {},
|
||||
"excludes": {}
|
||||
},
|
||||
{
|
||||
"names": [
|
||||
"sync_file_range2"
|
||||
],
|
||||
"action": "SCMP_ACT_ALLOW",
|
||||
"args": [],
|
||||
"comment": "",
|
||||
"includes": {
|
||||
"arches": [
|
||||
"ppc64le"
|
||||
]
|
||||
},
|
||||
"excludes": {}
|
||||
},
|
||||
{
|
||||
"names": [
|
||||
"arm_fadvise64_64",
|
||||
"arm_sync_file_range",
|
||||
"sync_file_range2",
|
||||
"breakpoint",
|
||||
"cacheflush",
|
||||
"set_tls"
|
||||
],
|
||||
"action": "SCMP_ACT_ALLOW",
|
||||
"args": [],
|
||||
"comment": "",
|
||||
"includes": {
|
||||
"arches": [
|
||||
"arm",
|
||||
"arm64"
|
||||
]
|
||||
},
|
||||
"excludes": {}
|
||||
},
|
||||
{
|
||||
"names": [
|
||||
"arch_prctl"
|
||||
],
|
||||
"action": "SCMP_ACT_ALLOW",
|
||||
"args": [],
|
||||
"comment": "",
|
||||
"includes": {
|
||||
"arches": [
|
||||
"amd64",
|
||||
"x32"
|
||||
]
|
||||
},
|
||||
"excludes": {}
|
||||
},
|
||||
{
|
||||
"names": [
|
||||
"modify_ldt"
|
||||
],
|
||||
"action": "SCMP_ACT_ALLOW",
|
||||
"args": [],
|
||||
"comment": "",
|
||||
"includes": {
|
||||
"arches": [
|
||||
"amd64",
|
||||
"x32",
|
||||
"x86"
|
||||
]
|
||||
},
|
||||
"excludes": {}
|
||||
},
|
||||
{
|
||||
"names": [
|
||||
"s390_pci_mmio_read",
|
||||
"s390_pci_mmio_write",
|
||||
"s390_runtime_instr"
|
||||
],
|
||||
"action": "SCMP_ACT_ALLOW",
|
||||
"args": [],
|
||||
"comment": "",
|
||||
"includes": {
|
||||
"arches": [
|
||||
"s390",
|
||||
"s390x"
|
||||
]
|
||||
},
|
||||
"excludes": {}
|
||||
},
|
||||
{
|
||||
"names": [
|
||||
"open_by_handle_at"
|
||||
],
|
||||
"action": "SCMP_ACT_ALLOW",
|
||||
"args": [],
|
||||
"comment": "",
|
||||
"includes": {
|
||||
"caps": [
|
||||
"CAP_DAC_READ_SEARCH"
|
||||
]
|
||||
},
|
||||
"excludes": {}
|
||||
},
|
||||
{
|
||||
"names": [
|
||||
"bpf",
|
||||
"clone",
|
||||
"fanotify_init",
|
||||
"lookup_dcookie",
|
||||
"mount",
|
||||
"name_to_handle_at",
|
||||
"perf_event_open",
|
||||
"quotactl",
|
||||
"setdomainname",
|
||||
"sethostname",
|
||||
"setns",
|
||||
"umount",
|
||||
"umount2",
|
||||
"unshare"
|
||||
],
|
||||
"action": "SCMP_ACT_ALLOW",
|
||||
"args": [],
|
||||
"comment": "",
|
||||
"includes": {
|
||||
"caps": [
|
||||
"CAP_SYS_ADMIN"
|
||||
]
|
||||
},
|
||||
"excludes": {}
|
||||
},
|
||||
{
|
||||
"names": [
|
||||
"clone"
|
||||
],
|
||||
"action": "SCMP_ACT_ALLOW",
|
||||
"args": [
|
||||
{
|
||||
"index": 0,
|
||||
"value": 2080505856,
|
||||
"valueTwo": 0,
|
||||
"op": "SCMP_CMP_MASKED_EQ"
|
||||
}
|
||||
],
|
||||
"comment": "",
|
||||
"includes": {},
|
||||
"excludes": {
|
||||
"caps": [
|
||||
"CAP_SYS_ADMIN"
|
||||
],
|
||||
"arches": [
|
||||
"s390",
|
||||
"s390x"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"names": [
|
||||
"clone"
|
||||
],
|
||||
"action": "SCMP_ACT_ALLOW",
|
||||
"args": [
|
||||
{
|
||||
"index": 1,
|
||||
"value": 2080505856,
|
||||
"valueTwo": 0,
|
||||
"op": "SCMP_CMP_MASKED_EQ"
|
||||
}
|
||||
],
|
||||
"comment": "s390 parameter ordering for clone is different",
|
||||
"includes": {
|
||||
"arches": [
|
||||
"s390",
|
||||
"s390x"
|
||||
]
|
||||
},
|
||||
"excludes": {
|
||||
"caps": [
|
||||
"CAP_SYS_ADMIN"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"names": [
|
||||
"reboot"
|
||||
],
|
||||
"action": "SCMP_ACT_ALLOW",
|
||||
"args": [],
|
||||
"comment": "",
|
||||
"includes": {
|
||||
"caps": [
|
||||
"CAP_SYS_BOOT"
|
||||
]
|
||||
},
|
||||
"excludes": {}
|
||||
},
|
||||
{
|
||||
"names": [
|
||||
"chroot"
|
||||
],
|
||||
"action": "SCMP_ACT_ALLOW",
|
||||
"args": [],
|
||||
"comment": "",
|
||||
"includes": {
|
||||
"caps": [
|
||||
"CAP_SYS_CHROOT"
|
||||
]
|
||||
},
|
||||
"excludes": {}
|
||||
},
|
||||
{
|
||||
"names": [
|
||||
"delete_module",
|
||||
"init_module",
|
||||
"finit_module",
|
||||
"query_module"
|
||||
],
|
||||
"action": "SCMP_ACT_ALLOW",
|
||||
"args": [],
|
||||
"comment": "",
|
||||
"includes": {
|
||||
"caps": [
|
||||
"CAP_SYS_MODULE"
|
||||
]
|
||||
},
|
||||
"excludes": {}
|
||||
},
|
||||
{
|
||||
"names": [
|
||||
"get_mempolicy",
|
||||
"mbind",
|
||||
"name_to_handle_at",
|
||||
"set_mempolicy"
|
||||
],
|
||||
"action": "SCMP_ACT_ALLOW",
|
||||
"args": [],
|
||||
"comment": "",
|
||||
"includes": {
|
||||
"caps": [
|
||||
"CAP_SYS_NICE"
|
||||
]
|
||||
},
|
||||
"excludes": {}
|
||||
},
|
||||
{
|
||||
"names": [
|
||||
"acct"
|
||||
],
|
||||
"action": "SCMP_ACT_ALLOW",
|
||||
"args": [],
|
||||
"comment": "",
|
||||
"includes": {
|
||||
"caps": [
|
||||
"CAP_SYS_PACCT"
|
||||
]
|
||||
},
|
||||
"excludes": {}
|
||||
},
|
||||
{
|
||||
"names": [
|
||||
"kcmp",
|
||||
"process_madvise",
|
||||
"process_vm_readv",
|
||||
"process_vm_writev",
|
||||
"ptrace"
|
||||
],
|
||||
"action": "SCMP_ACT_ALLOW",
|
||||
"args": [],
|
||||
"comment": "",
|
||||
"includes": {
|
||||
"caps": [
|
||||
"CAP_SYS_PTRACE"
|
||||
]
|
||||
},
|
||||
"excludes": {}
|
||||
},
|
||||
{
|
||||
"names": [
|
||||
"iopl",
|
||||
"ioperm"
|
||||
],
|
||||
"action": "SCMP_ACT_ALLOW",
|
||||
"args": [],
|
||||
"comment": "",
|
||||
"includes": {
|
||||
"caps": [
|
||||
"CAP_SYS_RAWIO"
|
||||
]
|
||||
},
|
||||
"excludes": {}
|
||||
},
|
||||
{
|
||||
"names": [
|
||||
"settimeofday",
|
||||
"stime",
|
||||
"clock_settime",
|
||||
"clock_settime64"
|
||||
],
|
||||
"action": "SCMP_ACT_ALLOW",
|
||||
"args": [],
|
||||
"comment": "",
|
||||
"includes": {
|
||||
"caps": [
|
||||
"CAP_SYS_TIME"
|
||||
]
|
||||
},
|
||||
"excludes": {}
|
||||
},
|
||||
{
|
||||
"names": [
|
||||
"vhangup"
|
||||
],
|
||||
"action": "SCMP_ACT_ALLOW",
|
||||
"args": [],
|
||||
"comment": "",
|
||||
"includes": {
|
||||
"caps": [
|
||||
"CAP_SYS_TTY_CONFIG"
|
||||
]
|
||||
},
|
||||
"excludes": {}
|
||||
},
|
||||
{
|
||||
"names": [
|
||||
"socket"
|
||||
],
|
||||
"action": "SCMP_ACT_ERRNO",
|
||||
"args": [
|
||||
{
|
||||
"index": 0,
|
||||
"value": 16,
|
||||
"valueTwo": 0,
|
||||
"op": "SCMP_CMP_EQ"
|
||||
},
|
||||
{
|
||||
"index": 2,
|
||||
"value": 9,
|
||||
"valueTwo": 0,
|
||||
"op": "SCMP_CMP_EQ"
|
||||
}
|
||||
],
|
||||
"comment": "",
|
||||
"includes": {},
|
||||
"excludes": {
|
||||
"caps": [
|
||||
"CAP_AUDIT_WRITE"
|
||||
]
|
||||
},
|
||||
"errnoRet": 22
|
||||
},
|
||||
{
|
||||
"names": [
|
||||
"socket"
|
||||
],
|
||||
"action": "SCMP_ACT_ALLOW",
|
||||
"args": [
|
||||
{
|
||||
"index": 2,
|
||||
"value": 9,
|
||||
"valueTwo": 0,
|
||||
"op": "SCMP_CMP_NE"
|
||||
}
|
||||
],
|
||||
"comment": "",
|
||||
"includes": {},
|
||||
"excludes": {
|
||||
"caps": [
|
||||
"CAP_AUDIT_WRITE"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"names": [
|
||||
"socket"
|
||||
],
|
||||
"action": "SCMP_ACT_ALLOW",
|
||||
"args": [
|
||||
{
|
||||
"index": 0,
|
||||
"value": 16,
|
||||
"valueTwo": 0,
|
||||
"op": "SCMP_CMP_NE"
|
||||
}
|
||||
],
|
||||
"comment": "",
|
||||
"includes": {},
|
||||
"excludes": {
|
||||
"caps": [
|
||||
"CAP_AUDIT_WRITE"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"names": [
|
||||
"socket"
|
||||
],
|
||||
"action": "SCMP_ACT_ALLOW",
|
||||
"args": [
|
||||
{
|
||||
"index": 2,
|
||||
"value": 9,
|
||||
"valueTwo": 0,
|
||||
"op": "SCMP_CMP_NE"
|
||||
}
|
||||
],
|
||||
"comment": "",
|
||||
"includes": {},
|
||||
"excludes": {
|
||||
"caps": [
|
||||
"CAP_AUDIT_WRITE"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"names": [
|
||||
"socket"
|
||||
],
|
||||
"action": "SCMP_ACT_ALLOW",
|
||||
"args": null,
|
||||
"comment": "",
|
||||
"includes": {
|
||||
"caps": [
|
||||
"CAP_AUDIT_WRITE"
|
||||
]
|
||||
},
|
||||
"excludes": {}
|
||||
}
|
||||
]
|
||||
}
|
||||
375
skopeo.spec
375
skopeo.spec
@ -1,155 +1,324 @@
|
||||
%global with_devel 0
|
||||
%global with_bundled 1
|
||||
%global with_unit_test 0
|
||||
%global with_check 0
|
||||
|
||||
%global with_debug 1
|
||||
|
||||
%if 0%{?with_debug}
|
||||
%global _find_debuginfo_dwz_opts %{nil}
|
||||
%global _dwz_low_mem_die_limit 0
|
||||
%else
|
||||
%global debug_package %{nil}
|
||||
%global debug_package %{nil}
|
||||
%endif
|
||||
|
||||
%global provider github
|
||||
%global provider_tld com
|
||||
%global project containers
|
||||
%global repo skopeo
|
||||
# https://github.com/containers/skopeo
|
||||
%global provider_prefix %{provider}.%{provider_tld}/%{project}/%{repo}
|
||||
%global import_path %{provider_prefix}
|
||||
%global git0 https://%{import_path}
|
||||
|
||||
%global build_version v1.8.0
|
||||
|
||||
%define epoch 1
|
||||
|
||||
ExcludeArch: ppc64
|
||||
|
||||
Name: skopeo
|
||||
Name: %{repo}
|
||||
Epoch: 1
|
||||
Version: 1.14.2
|
||||
Release: 4
|
||||
Version: 1.8.0
|
||||
Release: 1
|
||||
Summary: Work with remote images registries - retrieving information, images, signing content
|
||||
License: Apache-2.0
|
||||
URL: https://github.com/containers/skopeo
|
||||
Source0: https://github.com/containers/skopeo/archive/refs/tags/v1.14.2.tar.gz
|
||||
Source1: https://github.com/cpuguy83/go-md2man/archive/refs/tags/v2.0.3.tar.gz
|
||||
|
||||
Patch0001: 0001-fix-CVE-2024-24786.patch
|
||||
Patch0002: 0002-fix-CVE-2024-28180.patch
|
||||
Patch0003: 0001-add-sw64-support.patch
|
||||
License: ASL 2.0
|
||||
URL: %{git0}
|
||||
Source0: %{git0}/archive/%{build_version}.tar.gz
|
||||
Source1: https://github.com/cpuguy83/go-md2man/archive/v1.0.10.tar.gz
|
||||
|
||||
BuildRequires: go-srpm-macros git-core pkgconfig(devmapper) make
|
||||
BuildRequires: golang >= 1.19
|
||||
BuildRequires: golang >= 1.16.6
|
||||
BuildRequires: gpgme-devel libassuan-devel btrfs-progs-devel ostree-devel glib2-devel
|
||||
Requires: containers-common shadow-subid-devel
|
||||
Requires: containers-common
|
||||
|
||||
Provides: bundled(golang(github.com/beorn7/perks)) = 4c0e84591b9aa9e6dcfdf3e020114cd81f89d5f9
|
||||
Provides: bundled(golang(github.com/BurntSushi/toml)) = master
|
||||
Provides: bundled(golang(github.com/containerd/continuity)) = d8fb8589b0e8e85b8c8bbaa8840226d0dfeb7371
|
||||
Provides: bundled(golang(github.com/containers/image)) = master
|
||||
Provides: bundled(golang(github.com/containers/storage)) = master
|
||||
Provides: bundled(golang(github.com/davecgh/go-spew)) = master
|
||||
Provides: bundled(golang(github.com/docker/distribution)) = master
|
||||
Provides: bundled(golang(github.com/docker/docker-credential-helpers)) = d68f9aeca33f5fd3f08eeae5e9d175edf4e731d1
|
||||
Provides: bundled(golang(github.com/docker/docker)) = da99009bbb1165d1ac5688b5c81d2f589d418341
|
||||
Provides: bundled(golang(github.com/docker/go-connections)) = 7beb39f0b969b075d1325fecb092faf27fd357b6
|
||||
Provides: bundled(golang(github.com/docker/go-metrics)) = 399ea8c73916000c64c2c76e8da00ca82f8387ab
|
||||
Provides: bundled(golang(github.com/docker/go-units)) = 8a7beacffa3009a9ac66bad506b18ffdd110cf97
|
||||
Provides: bundled(golang(github.com/docker/libtrust)) = master
|
||||
Provides: bundled(golang(github.com/ghodss/yaml)) = 73d445a93680fa1a78ae23a5839bad48f32ba1ee
|
||||
Provides: bundled(golang(github.com/go-check/check)) = v1
|
||||
Provides: bundled(golang(github.com/gogo/protobuf)) = fcdc5011193ff531a548e9b0301828d5a5b97fd8
|
||||
Provides: bundled(golang(github.com/golang/glog)) = 44145f04b68cf362d9c4df2182967c2275eaefed
|
||||
Provides: bundled(golang(github.com/golang/protobuf)) = 8d92cf5fc15a4382f8964b08e1f42a75c0591aa3
|
||||
Provides: bundled(golang(github.com/gorilla/context)) = 14f550f51a
|
||||
Provides: bundled(golang(github.com/gorilla/mux)) = e444e69cbd
|
||||
Provides: bundled(golang(github.com/imdario/mergo)) = 6633656539c1639d9d78127b7d47c622b5d7b6dc
|
||||
Provides: bundled(golang(github.com/kr/pretty)) = v0.1.0
|
||||
Provides: bundled(golang(github.com/kr/text)) = v0.1.0
|
||||
Provides: bundled(golang(github.com/matttproud/golang_protobuf_extensions)) = c12348ce28de40eed0136aa2b644d0ee0650e56c
|
||||
Provides: bundled(golang(github.com/mistifyio/go-zfs)) = 22c9b32c84eb0d0c6f4043b6e90fc94073de92fa
|
||||
Provides: bundled(golang(github.com/mtrmac/gpgme)) = master
|
||||
Provides: bundled(golang(github.com/opencontainers/go-digest)) = master
|
||||
Provides: bundled(golang(github.com/opencontainers/image-spec)) = 149252121d044fddff670adcdc67f33148e16226
|
||||
Provides: bundled(golang(github.com/opencontainers/image-tools)) = 6d941547fa1df31900990b3fb47ec2468c9c6469
|
||||
Provides: bundled(golang(github.com/opencontainers/runc)) = master
|
||||
Provides: bundled(golang(github.com/opencontainers/runtime-spec)) = v1.0.0
|
||||
Provides: bundled(golang(github.com/opencontainers/selinux)) = master
|
||||
Provides: bundled(golang(github.com/ostreedev/ostree-go)) = aeb02c6b6aa2889db3ef62f7855650755befd460
|
||||
Provides: bundled(golang(github.com/pborman/uuid)) = v1.0
|
||||
Provides: bundled(golang(github.com/pkg/errors)) = master
|
||||
Provides: bundled(golang(github.com/pmezard/go-difflib)) = master
|
||||
Provides: bundled(golang(github.com/pquerna/ffjson)) = d49c2bc1aa135aad0c6f4fc2056623ec78f5d5ac
|
||||
Provides: bundled(golang(github.com/prometheus/client_golang)) = c332b6f63c0658a65eca15c0e5247ded801cf564
|
||||
Provides: bundled(golang(github.com/prometheus/client_model)) = 99fa1f4be8e564e8a6b613da7fa6f46c9edafc6c
|
||||
Provides: bundled(golang(github.com/prometheus/common)) = 89604d197083d4781071d3c65855d24ecfb0a563
|
||||
Provides: bundled(golang(github.com/prometheus/procfs)) = cb4147076ac75738c9a7d279075a253c0cc5acbd
|
||||
Provides: bundled(golang(github.com/sirupsen/logrus)) = v1.0.0
|
||||
Provides: bundled(golang(github.com/stretchr/testify)) = v1.1.3
|
||||
Provides: bundled(golang(github.com/syndtr/gocapability)) = master
|
||||
Provides: bundled(golang(github.com/tchap/go-patricia)) = v2.2.6
|
||||
Provides: bundled(golang(github.com/ulikunitz/xz)) = v0.5.4
|
||||
Provides: bundled(golang(github.com/urfave/cli)) = v1.17.0
|
||||
Provides: bundled(golang(github.com/vbatts/tar-split)) = v0.10.2
|
||||
Provides: bundled(golang(github.com/xeipuuv/gojsonpointer)) = master
|
||||
Provides: bundled(golang(github.com/xeipuuv/gojsonreference)) = master
|
||||
Provides: bundled(golang(github.com/xeipuuv/gojsonschema)) = master
|
||||
Provides: bundled(golang(go4.org)) = master
|
||||
Provides: bundled(golang(golang.org/x/crypto)) = master
|
||||
Provides: bundled(golang(golang.org/x/net)) = master
|
||||
Provides: bundled(golang(golang.org/x/sys)) = master
|
||||
Provides: bundled(golang(golang.org/x/text)) = master
|
||||
Provides: bundled(golang(gopkg.in/cheggaaa/pb.v1)) = ad4efe000aa550bb54918c06ebbadc0ff17687b9
|
||||
Provides: bundled(golang(gopkg.in/yaml.v2)) = d466437aa4adc35830964cffc5b5f262c63ddcb4
|
||||
Provides: bundled(golang(k8s.io/client-go)) = master
|
||||
|
||||
%description
|
||||
A command line utility that performs various operations on container images and image repositories
|
||||
|
||||
%package tests
|
||||
Summary: Tests for %{name}
|
||||
%if 0%{?with_devel}
|
||||
%package devel
|
||||
Summary: %{summary}
|
||||
BuildArch: noarch
|
||||
|
||||
Requires: %{name} = %{epoch}:%{version}-%{release}
|
||||
Requires: bats
|
||||
Requires: gnupg
|
||||
Requires: jq
|
||||
Requires: golang
|
||||
Requires: podman
|
||||
Requires: crun
|
||||
Requires: httpd-tools
|
||||
Requires: openssl
|
||||
Requires: fakeroot
|
||||
Requires: squashfs-tools
|
||||
%if 0%{?with_check} && ! 0%{?with_bundled}
|
||||
BuildRequires: golang(github.com/Azure/go-ansiterm/winterm)
|
||||
BuildRequires: golang(github.com/Sirupsen/logrus)
|
||||
BuildRequires: golang(github.com/docker/distribution)
|
||||
BuildRequires: golang(github.com/docker/distribution/context)
|
||||
BuildRequires: golang(github.com/docker/distribution/digest)
|
||||
BuildRequires: golang(github.com/docker/distribution/manifest)
|
||||
BuildRequires: golang(github.com/docker/distribution/manifest/manifestlist)
|
||||
BuildRequires: golang(github.com/docker/distribution/manifest/schema1)
|
||||
BuildRequires: golang(github.com/docker/distribution/manifest/schema2)
|
||||
BuildRequires: golang(github.com/docker/distribution/reference)
|
||||
BuildRequires: golang(github.com/docker/distribution/registry/api/errcode)
|
||||
BuildRequires: golang(github.com/docker/distribution/registry/api/v2)
|
||||
BuildRequires: golang(github.com/docker/distribution/registry/client)
|
||||
BuildRequires: golang(github.com/docker/distribution/registry/client/auth)
|
||||
BuildRequires: golang(github.com/docker/distribution/registry/client/transport)
|
||||
BuildRequires: golang(github.com/docker/distribution/registry/storage/cache)
|
||||
BuildRequires: golang(github.com/docker/distribution/registry/storage/cache/memory)
|
||||
BuildRequires: golang(github.com/docker/distribution/uuid)
|
||||
BuildRequires: golang(github.com/docker/docker/api)
|
||||
BuildRequires: golang(github.com/docker/docker/daemon/graphdriver)
|
||||
BuildRequires: golang(github.com/docker/docker/distribution/metadata)
|
||||
BuildRequires: golang(github.com/docker/docker/distribution/xfer)
|
||||
BuildRequires: golang(github.com/docker/docker/dockerversion)
|
||||
BuildRequires: golang(github.com/docker/docker/image)
|
||||
BuildRequires: golang(github.com/docker/docker/image/v1)
|
||||
BuildRequires: golang(github.com/docker/docker/layer)
|
||||
BuildRequires: golang(github.com/docker/docker/opts)
|
||||
BuildRequires: golang(github.com/docker/docker/pkg/archive)
|
||||
BuildRequires: golang(github.com/docker/docker/pkg/chrootarchive)
|
||||
BuildRequires: golang(github.com/docker/docker/pkg/fileutils)
|
||||
BuildRequires: golang(github.com/docker/docker/pkg/homedir)
|
||||
BuildRequires: golang(github.com/docker/docker/pkg/httputils)
|
||||
BuildRequires: golang(github.com/docker/docker/pkg/idtools)
|
||||
BuildRequires: golang(github.com/docker/docker/pkg/ioutils)
|
||||
BuildRequires: golang(github.com/docker/docker/pkg/jsonlog)
|
||||
BuildRequires: golang(github.com/docker/docker/pkg/jsonmessage)
|
||||
BuildRequires: golang(github.com/docker/docker/pkg/longpath)
|
||||
BuildRequires: golang(github.com/docker/docker/pkg/mflag)
|
||||
BuildRequires: golang(github.com/docker/docker/pkg/parsers/kernel)
|
||||
BuildRequires: golang(github.com/docker/docker/pkg/plugins)
|
||||
BuildRequires: golang(github.com/docker/docker/pkg/pools)
|
||||
BuildRequires: golang(github.com/docker/docker/pkg/progress)
|
||||
BuildRequires: golang(github.com/docker/docker/pkg/promise)
|
||||
BuildRequires: golang(github.com/docker/docker/pkg/random)
|
||||
BuildRequires: golang(github.com/docker/docker/pkg/reexec)
|
||||
BuildRequires: golang(github.com/docker/docker/pkg/stringid)
|
||||
BuildRequires: golang(github.com/docker/docker/pkg/system)
|
||||
BuildRequires: golang(github.com/docker/docker/pkg/tarsum)
|
||||
BuildRequires: golang(github.com/docker/docker/pkg/term)
|
||||
BuildRequires: golang(github.com/docker/docker/pkg/term/windows)
|
||||
BuildRequires: golang(github.com/docker/docker/pkg/useragent)
|
||||
BuildRequires: golang(github.com/docker/docker/pkg/version)
|
||||
BuildRequires: golang(github.com/docker/docker/reference)
|
||||
BuildRequires: golang(github.com/docker/docker/registry)
|
||||
BuildRequires: golang(github.com/docker/engine-api/types)
|
||||
BuildRequires: golang(github.com/docker/engine-api/types/blkiodev)
|
||||
BuildRequires: golang(github.com/docker/engine-api/types/container)
|
||||
BuildRequires: golang(github.com/docker/engine-api/types/filters)
|
||||
BuildRequires: golang(github.com/docker/engine-api/types/image)
|
||||
BuildRequires: golang(github.com/docker/engine-api/types/network)
|
||||
BuildRequires: golang(github.com/docker/engine-api/types/registry)
|
||||
BuildRequires: golang(github.com/docker/engine-api/types/strslice)
|
||||
BuildRequires: golang(github.com/docker/go-connections/nat)
|
||||
BuildRequires: golang(github.com/docker/go-connections/tlsconfig)
|
||||
BuildRequires: golang(github.com/docker/go-units)
|
||||
BuildRequires: golang(github.com/docker/libtrust)
|
||||
BuildRequires: golang(github.com/gorilla/context)
|
||||
BuildRequires: golang(github.com/gorilla/mux)
|
||||
BuildRequires: golang(github.com/opencontainers/runc/libcontainer/user)
|
||||
BuildRequires: golang(github.com/vbatts/tar-split/archive/tar)
|
||||
BuildRequires: golang(github.com/vbatts/tar-split/tar/asm)
|
||||
BuildRequires: golang(github.com/vbatts/tar-split/tar/storage)
|
||||
BuildRequires: golang(golang.org/x/net/context)
|
||||
%endif
|
||||
|
||||
%description tests
|
||||
%description devel
|
||||
%{summary}
|
||||
|
||||
This package contains system tests for %{name}
|
||||
This package contains library source intended for
|
||||
building other packages which use import path with
|
||||
%{import_path} prefix.
|
||||
%endif
|
||||
|
||||
%if 0%{?with_unit_test} && 0%{?with_devel}
|
||||
%package unit-test-devel
|
||||
Summary: Unit tests for %{name} package
|
||||
%if 0%{?with_check}
|
||||
#Here comes all BuildRequires: PACKAGE the unit tests
|
||||
#in %%check section need for running
|
||||
%endif
|
||||
|
||||
# test subpackage tests code from devel subpackage
|
||||
Requires: %{name}-devel = %{version}-%{release}
|
||||
|
||||
%description unit-test-devel
|
||||
%{summary}
|
||||
|
||||
This package contains unit tests for project
|
||||
providing packages with %{import_path} prefix.
|
||||
%endif
|
||||
|
||||
%prep
|
||||
%autosetup -Sgit -n %{name}-%{version} -p1
|
||||
# The %%install stage should not rebuild anything but only install what's
|
||||
# built in the %%build stage. So, remove any dependency on build targets.
|
||||
sed -i 's/^install-binary: bin\/%{name}.*/install-binary:/' Makefile
|
||||
sed -i 's/^completions: bin\/%{name}.*/completions:/' Makefile
|
||||
sed -i 's/^install-docs: docs.*/install-docs:/' Makefile
|
||||
|
||||
tar -zxf %SOURCE1
|
||||
|
||||
%ifarch sw_64
|
||||
grep -r "buildmode" | cut -d: -f1 | xargs -I {} sed -i -e 's/buildmode=pie/buildmode=exe/g' -e 's/buildmode pie/buildmode exe/g' {}
|
||||
sed -i -e 's/riscv64 || sh/riscv64 || sh || sw64/' -e 's/riscv64 sh/riscv64 sh sw64/' vendor/golang.org/x/sys/unix/endian_little.go vendor/golang.org/x/sys/cpu/endian_little.go
|
||||
sed -i 's/syscall.Pause()/unix.Pause()/g' vendor/github.com/containers/storage/pkg/idmap/idmapped_utils.go
|
||||
%endif
|
||||
%autosetup -Sgit -n %{name}-%{version}
|
||||
tar -xf %SOURCE1
|
||||
|
||||
%build
|
||||
pushd go-md2man-*
|
||||
go build -mod=vendor -o go-md2man .
|
||||
export GOMD2MAN=$(realpath go-md2man)
|
||||
popd
|
||||
mkdir -p src/github.com/containers
|
||||
ln -s ../../../ src/%{import_path}
|
||||
|
||||
%set_build_flags
|
||||
export CGO_CFLAGS=$CFLAGS
|
||||
mkdir -p vendor/src
|
||||
for v in vendor/*; do
|
||||
if test ${v} = vendor/src; then continue; fi
|
||||
if test -d ${v}; then
|
||||
mv ${v} vendor/src/
|
||||
fi
|
||||
done
|
||||
|
||||
%ifarch x86_64
|
||||
export CGO_CFLAGS="$CGO_CFLAGS -m64 -mtune=generic -fcf-protection=full"
|
||||
%endif
|
||||
|
||||
BASEBUILDTAGS="$(hack/libdm_tag.sh) $(hack/libsubid_tag.sh)"
|
||||
|
||||
export BUILDTAGS="$BASEBUILDTAGS $(hack/btrfs_tag.sh) $(hack/btrfs_installed_tag.sh)"
|
||||
|
||||
# unset LDFLAGS earlier set from set_build_flags
|
||||
LDFLAGS=''
|
||||
export GO111MODULE=on
|
||||
export GOFLAGS=-mod=vendor
|
||||
|
||||
go build \
|
||||
%ifnarch sw_64
|
||||
-buildmode pie \
|
||||
%if ! 0%{?with_bundled}
|
||||
rm -rf vendor/
|
||||
export GOPATH=$(pwd)
|
||||
%else
|
||||
-buildmode exe \
|
||||
export GOPATH=$(pwd):$(pwd)/vendor
|
||||
%endif
|
||||
-compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "${LDFLAGS:-} -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \n') -extldflags '-Wl,-z,relro -Wl,-z,now '" -a -v -x -o bin/%{name} ./cmd/%{name}
|
||||
%{__make} docs
|
||||
|
||||
mkdir -p bin
|
||||
export GO111MODULE=off
|
||||
|
||||
go build -buildmode pie -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "${LDFLAGS:-} -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \n') -extldflags '-Wl,-z,relro -Wl,-z,now '" -a -v -x -o bin/%{name} ./cmd/%{name}
|
||||
%{__make} docs
|
||||
|
||||
%install
|
||||
make \
|
||||
DESTDIR=%{buildroot} \
|
||||
PREFIX=%{_prefix} \
|
||||
install-binary install-docs install-completions
|
||||
PREFIX=%{buildroot}%{_prefix} \
|
||||
install-docs install-completions
|
||||
|
||||
# system tests
|
||||
install -d -p %{buildroot}/%{_datadir}/%{name}/test/system
|
||||
cp -pav systemtest/* %{buildroot}/%{_datadir}/%{name}/test/system/
|
||||
install -m0755 -d -p %{buildroot}%{_bindir}
|
||||
install -m0755 bin/skopeo %{buildroot}%{_bindir}/%{name}
|
||||
|
||||
# source codes for building projects
|
||||
%if 0%{?with_devel}
|
||||
install -d -p %{buildroot}/%{gopath}/src/%{import_path}/
|
||||
echo "%%dir %%{gopath}/src/%%{import_path}/." >> devel.file-list
|
||||
# find all *.go but no *_test.go files and generate devel.file-list
|
||||
for file in $(find . -iname "*.go" \! -iname "*_test.go" | grep -v "./vendor") ; do
|
||||
echo "%%dir %%{gopath}/src/%%{import_path}/$(dirname $file)" >> devel.file-list
|
||||
install -d -p %{buildroot}/%{gopath}/src/%{import_path}/$(dirname $file)
|
||||
cp -pav $file %{buildroot}/%{gopath}/src/%{import_path}/$file
|
||||
echo "%%{gopath}/src/%%{import_path}/$file" >> devel.file-list
|
||||
done
|
||||
%endif
|
||||
|
||||
# testing files for this project
|
||||
%if 0%{?with_unit_test} && 0%{?with_devel}
|
||||
install -d -p %{buildroot}/%{gopath}/src/%{import_path}/
|
||||
# find all *_test.go files and generate unit-test.file-list
|
||||
for file in $(find . -iname "*_test.go" | grep -v "./vendor"); do
|
||||
echo "%%dir %%{gopath}/src/%%{import_path}/$(dirname $file)" >> devel.file-list
|
||||
install -d -p %{buildroot}/%{gopath}/src/%{import_path}/$(dirname $file)
|
||||
cp -pav $file %{buildroot}/%{gopath}/src/%{import_path}/$file
|
||||
echo "%%{gopath}/src/%%{import_path}/$file" >> unit-test-devel.file-list
|
||||
done
|
||||
%endif
|
||||
|
||||
%if 0%{?with_devel}
|
||||
sort -u -o devel.file-list devel.file-list
|
||||
%endif
|
||||
|
||||
%check
|
||||
%if 0%{?with_check} && 0%{?with_unit_test} && 0%{?with_devel}
|
||||
%if ! 0%{?with_bundled}
|
||||
export GOPATH=%{buildroot}/%{gopath}:%{gopath}
|
||||
%else
|
||||
export GOPATH=%{buildroot}/%{gopath}:$(pwd)/vendor:%{gopath}
|
||||
%endif
|
||||
|
||||
%gotest %{import_path}/integration
|
||||
%endif
|
||||
|
||||
#define license tag if not already defined
|
||||
%{!?_licensedir:%global license %doc}
|
||||
|
||||
%if 0%{?with_devel}
|
||||
%files devel -f devel.file-list
|
||||
%license LICENSE
|
||||
%doc README.md
|
||||
%dir %{gopath}/src/%{provider}.%{provider_tld}/%{project}
|
||||
%endif
|
||||
|
||||
%if 0%{?with_unit_test} && 0%{?with_devel}
|
||||
%files unit-test-devel -f unit-test-devel.file-list
|
||||
%license LICENSE
|
||||
%doc README.md
|
||||
%endif
|
||||
|
||||
%files
|
||||
%license LICENSE
|
||||
%doc README.md
|
||||
%{_bindir}/%{name}
|
||||
%{_mandir}/man1/%{name}*
|
||||
%dir %{_datadir}/bash-completion
|
||||
%dir %{_datadir}/bash-completion/completions
|
||||
%{_datadir}/bash-completion/completions/%{name}
|
||||
%dir %{_datadir}/fish/vendor_completions.d
|
||||
%{_datadir}/fish/vendor_completions.d/%{name}.fish
|
||||
%dir %{_datadir}/zsh/site-functions
|
||||
%{_datadir}/zsh/site-functions/_%{name}
|
||||
|
||||
%files tests
|
||||
%license LICENSE
|
||||
%{_datadir}/%{name}/test
|
||||
%{_prefix}/share/man/man1/%{name}*
|
||||
%dir %{_prefix}/share/bash-completion
|
||||
%dir %{_prefix}/share/bash-completion/completions
|
||||
%{_prefix}/share/bash-completion/completions/%{name}
|
||||
|
||||
%changelog
|
||||
* Fri Feb 28 2025 zhangshaoning <zhangshaoning@uniontech.com> - 1:1.14.2-4
|
||||
- Add sw_64 support
|
||||
|
||||
* Fri Apr 12 2024 zhangbowei <zhangbowei@kylinos.cn> - 1:1.14.2-3
|
||||
- Type:bugfix
|
||||
- CVE:NA
|
||||
- SUG:NA
|
||||
- DESC: fix CVE-2024-28180
|
||||
|
||||
* Fri Apr 12 2024 zhangbowei <zhangbowei@kylinos.cn> - 1:1.14.2-2
|
||||
- Type:bugfix
|
||||
- CVE:NA
|
||||
- SUG:NA
|
||||
- DESC: fix CVE-2024-24786
|
||||
|
||||
* Fri Feb 23 2024 lijian <lijian2@kylinos.cn> - 1:1.14.2-1
|
||||
- Upgrade to 1.14.2
|
||||
|
||||
* Tue Oct 17 2023 lijian <lijian2@kylinos.cn> - 1:1.8.0-2
|
||||
- delete unused files
|
||||
|
||||
* Thu Apr 27 2023 Merlin <merlinsun@hust.edu.cn> - 1:1.8.0-1
|
||||
- Type:bugfix
|
||||
- ID:NA
|
||||
|
||||
BIN
v1.0.10.tar.gz
Normal file
BIN
v1.0.10.tar.gz
Normal file
Binary file not shown.
BIN
v1.14.2.tar.gz
BIN
v1.14.2.tar.gz
Binary file not shown.
BIN
v1.8.0.tar.gz
Normal file
BIN
v1.8.0.tar.gz
Normal file
Binary file not shown.
BIN
v2.0.3.tar.gz
BIN
v2.0.3.tar.gz
Binary file not shown.
Loading…
x
Reference in New Issue
Block a user