Third-party package updates #2464

arnaldo2792 · 2022-09-29T02:09:52Z

Issue number:

Description of changes:
libnvidia-container added support for some experimental features gated behind the WITH_NVCGO flag. For the time being, we are not using those features since that will require a huge fundamental change to how we use the library.

open-vm-tools added support for a plugin to list containers running in either docker or kubernetes. For this update, I skipped the support for the plugin, but we should turn this on as a fast-follow PR.

There are a few packages that added security fixes:

open-vm-tools
libexpat
libdbus
docker-engine

The following packages were skipped:

bash
wicked
readline

There isn't any security fix for any of them, but we need to spend some time figuring out why they aren't happy with the provided arguments.

The following package requires more testing:

systemd

And lastly, the following packages will be updated in a different PR:

kernel-5_10
kernel-5_15
microcode

*  packages: update util-linux
*  packages: update strace
*  packages: update open-vm-tools
*  packages: update nvidia-k8s-device-plugin
*  packages: update nvidia-container-toolkit
*  packages: update libtirpc
*  packages: update libnvidia-container
*  packages: update libnl
*  packages: update libnftnl
*  packages: update liblzma
*  packages: update libglib
*  packages: update libffi
*  packages: update libexpat
*  packages: update libdbus
*  packages: update libcap
*  packages: update libaudit
*  packages: update kubernetes 1.21
*  packages: update kexec-tools
*  packages: update iproute
*  packages: update grub
*  packages: update grep
*  packages: update ecs-agent and amazon-vpc-cni-plugins
*  packages: update docker-proxy
*  packages: update docker-engine
*  packages: update docker-cli
*  packages: update containerd
*  packages: update chrony
*  packages: update acpid

Testing done:

cargo make test for aws-k8s-1.22
cargo make test for aws-k8s-1.21
Make sure vmware images booted as expected, and that the UI reports the usage of open-vm-tools
Run smoke test for aws-k8s-1.22-nvidia
Validate grub output in aws x86_64/aarch64
Validate grub output in VMware x86_64
Validate grub output in Metal x86_64 EFI/BIOS
Run a few tasks with aws-ecs-1 and aws-ecs-1-nvidia
Make sure chronyd runs for at least 1hr

bash-5.1# chronyd --version
chronyd (chrony) version 4.3 (+CMDMON +NTP +REFCLOCK +RTC +PRIVDROP +SCFILTER -SIGND +ASYNCDNS -NTS -SECHASH +IPV6 -DEBUG)
bash-5.1# systemctl status chronyd.service
● chronyd.service - A versatile implementation of the Network Time Protocol
     Loaded: loaded (/x86_64-bottlerocket-linux-gnu/sys-root/usr/lib/systemd/system/chronyd.service; enabled; vendor preset: enabled)
     Active: active (running) since Fri 2022-09-30 20:51:02 UTC; 1h 46min ago
       Docs: https://chrony.tuxfamily.org

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

packages/chrony/Cargo.toml

packages/kexec-tools/kexec-tools.spec

bcressey · 2022-09-29T04:56:31Z

packages/libglib/libglib.spec

 BuildRequires: meson
 BuildRequires: %{_cross_os}glibc-devel
 BuildRequires: %{_cross_os}libffi-devel
 BuildRequires: %{_cross_os}libmount-devel
+BuildRequires: %{_cross_os}libpcre-devel


This switch from PCRE1 to PCRE2 is fantastic!

Since we moved to pcre2, do we need to change the License field for this package? as we as the comment above:

# pcre is BSD-3-Clause

packages/libglib/libglib.spec

packages/libnftnl/Cargo.toml

packages/grub/grub.spec

bcressey · 2022-09-29T05:10:25Z

packages/util-linux/util-linux.spec

@@ -116,8 +110,6 @@ Requires: %{_cross_os}libuuid
 cp Documentation/licenses/COPYING.* .

 %build
-# We have patches that touch the build system, so we need to regenerate


packages/ecs-agent/Cargo.toml

Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

arnaldo2792 · 2022-09-29T17:38:20Z

The last two forced pushes include:

Mention the new binary excluded in libglib in commit message
Fix sources urls and use https in:
- acpid
- iproute
- libnftnl

jpculp · 2022-09-29T22:43:14Z

I built and booted a bottlerocket-vmware-k8s-1.21 ova and VMware Tools is showing Version 12320 (12.1.0).

arnaldo2792 · 2022-09-30T22:57:55Z

Forced push includes:

Move back amazon-vpc-cni-plugins to the default commit used by the ECS agent

arnaldo2792 · 2022-10-03T23:54:37Z

(Forced push fixes the referenced file in Cargo.toml for libnvidia-container and nvidia-container-toolkit)

arnaldo2792 · 2022-10-04T00:44:09Z

(Forced push fixes the upstream URL for libnvidia-container)

bcressey · 2022-10-04T13:53:09Z

Can you open issues for what you'd like to see happen with libnvidia-container and open-vm-tools?

bcressey · 2022-10-04T14:02:53Z

packages/nvidia-container-toolkit/nvidia-container-toolkit.spec


 %install
 install -d %{buildroot}%{_cross_bindir}
 install -d %{buildroot}%{_cross_tmpfilesdir}
 install -d %{buildroot}%{_cross_templatedir}
 install -d %{buildroot}%{_cross_datadir}/nvidia-container-toolkit
 install -d %{buildroot}%{_cross_factorydir}/etc/nvidia-container-runtime
-install -p -m 0755 nvidia-container-toolkit %{buildroot}%{_cross_bindir}/nvidia-container-runtime-hook
+install -p -m 0755 nvidia-container-runtime-hook %{buildroot}%{_cross_bindir}/


extremely minor nit: I try to avoid trailing slashes for directories like this since, if done habitually, it tends to lead to double slashes (//) in path names in build output, which is harmless but annoying.

Not worth fixing here, it's mostly about asking the question of whether a slash is needed after a given macro when you're writing spec files.

arnaldo2792 · 2022-10-04T17:37:49Z

Can you open issues for what you'd like to see happen with libnvidia-container and open-vm-tools?

Sure @bcressey! I need to spend some time reading in detail how each of the features in the packages work

This also drops the 0001-sys_linux patch since that's been included in 4.3. Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

Fixes CVE-2022-36109 Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

This regenerates the 0005 patch since it longer cleanly applies. Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

Fixes CVE-2020-35512. The libdbus developers don't distribute gzipped files anymore. Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

Fixes CVE-2022-40674 Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

arnaldo2792 · 2022-10-04T18:21:00Z

(Nothing functional changed in last forced push, I only added missing Signed-off-by markers to a few commits)

In newer versions of the library, the `gio-launch-desktop` desktop helper binary was added. There isn't a meson option to avoid building the helper binary, thus it is excluded in the RPM recipe. Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

libnvidia-container added support to configure cgroups through a go library, which is currently "experimental". In order to use the stable behavior, this package has to be compiled with `WITH_NVCGO=n`. This also updates the upstream URL to use a more specific file name instead of only the version of the package used. Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

This also updates the upstream URL to use a more specific file name instead of only the version of the package used. Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

Fixes CVE-2022-31676 In ed84c0a175c0122555a6a7cc947590569d28becb, support to list docker and kubernetes containers was added to open-vm-tools. We should consider enabling this feature in the future. Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

This also drops 1000-libmount-kernel-compat.patch, since the patch was required for kernels < 5.8, and we no longer have the sources for the 5.4 kernel. Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

arnaldo2792 · 2022-10-05T21:07:47Z

(Forced push removes note about license in libglib)

jpculp

🚀

arnaldo2792 requested review from bcressey and jpculp September 29, 2022 02:10

bcressey reviewed Sep 29, 2022

View reviewed changes

arnaldo2792 force-pushed the 3ppackageupdates branch from 27593f8 to a357547 Compare September 29, 2022 17:21

packages: update acpid

5a6e1a9

Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

arnaldo2792 force-pushed the 3ppackageupdates branch from a357547 to 1457b08 Compare September 29, 2022 17:35

arnaldo2792 force-pushed the 3ppackageupdates branch from 1457b08 to b2a708d Compare September 30, 2022 22:56

arnaldo2792 marked this pull request as ready for review October 3, 2022 21:04

arnaldo2792 force-pushed the 3ppackageupdates branch from b2a708d to de69cfc Compare October 3, 2022 23:53

arnaldo2792 force-pushed the 3ppackageupdates branch from de69cfc to 160967d Compare October 4, 2022 00:38

arnaldo2792 requested a review from bcressey October 4, 2022 01:43

bcressey approved these changes Oct 4, 2022

View reviewed changes

jpculp approved these changes Oct 4, 2022

View reviewed changes

etungsten and others added 10 commits October 4, 2022 18:12

packages: update chrony

bc1de04

This also drops the 0001-sys_linux patch since that's been included in 4.3. Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

packages: update containerd

bf1fdbe

Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

packages: update docker-cli

f8b36c2

Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

packages: update docker-engine

ebb4831

Fixes CVE-2022-36109 Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

packages: update docker-proxy

62b452c

Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

packages: update ecs-agent

a2a9cf3

This regenerates the 0005 patch since it longer cleanly applies. Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

packages: update grep

f4d166b

Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

packages: update grub

752c1f3

Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

packages: update iproute

859827e

Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

packages: update kexec-tools

f36932d

Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

arnaldo2792 added 6 commits October 4, 2022 18:14

packages: update kubernetes 1.21

1fe4de0

Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

packages: update libaudit

d7ae718

Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

packages: update libcap

480abd1

Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

packages: update libdbus

ba68687

Fixes CVE-2020-35512. The libdbus developers don't distribute gzipped files anymore. Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

packages: update libexpat

448918e

Fixes CVE-2022-40674 Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

packages: update libffi

ec37d45

Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

arnaldo2792 force-pushed the 3ppackageupdates branch from 160967d to 17044dd Compare October 4, 2022 18:20

jpculp approved these changes Oct 5, 2022

View reviewed changes

arnaldo2792 added 11 commits October 5, 2022 21:06

packages: update libglib

4aee868

In newer versions of the library, the `gio-launch-desktop` desktop helper binary was added. There isn't a meson option to avoid building the helper binary, thus it is excluded in the RPM recipe. Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

packages: update liblzma

98a4f98

Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

packages: update libnftnl

d06dd7d

Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

packages: update libnl

cc9c917

Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

packages: update libtirpc

4a700b3

Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

packages: update nvidia-container-toolkit

a0827d7

This also updates the upstream URL to use a more specific file name instead of only the version of the package used. Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

packages: update nvidia-k8s-device-plugin

190ffce

Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

packages: update strace

d61b8b0

Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

packages: update util-linux

004b8e7

This also drops 1000-libmount-kernel-compat.patch, since the patch was required for kernels < 5.8, and we no longer have the sources for the 5.4 kernel. Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

arnaldo2792 force-pushed the 3ppackageupdates branch from 17044dd to 004b8e7 Compare October 5, 2022 21:06

arnaldo2792 requested review from bcressey and jpculp October 5, 2022 21:08

jpculp approved these changes Oct 5, 2022

View reviewed changes

bcressey approved these changes Oct 5, 2022

View reviewed changes

arnaldo2792 merged commit 7734f24 into bottlerocket-os:develop Oct 5, 2022

arnaldo2792 mentioned this pull request Oct 18, 2022

grub: update to grub-2.06-42.amzn2022 #2503

Merged

21 tasks

arnaldo2792 deleted the 3ppackageupdates branch October 26, 2022 18:43

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Third-party package updates #2464

Third-party package updates #2464

arnaldo2792 commented Sep 29, 2022 •

edited

bcressey Sep 29, 2022

arnaldo2792 Sep 29, 2022

bcressey Sep 29, 2022 •

edited

arnaldo2792 commented Sep 29, 2022

jpculp commented Sep 29, 2022

arnaldo2792 commented Sep 30, 2022

arnaldo2792 commented Oct 3, 2022

arnaldo2792 commented Oct 4, 2022

bcressey commented Oct 4, 2022

bcressey Oct 4, 2022

arnaldo2792 commented Oct 4, 2022

arnaldo2792 commented Oct 4, 2022

arnaldo2792 commented Oct 5, 2022

jpculp left a comment

Third-party package updates #2464

Third-party package updates #2464

Conversation

arnaldo2792 commented Sep 29, 2022 • edited

bcressey Sep 29, 2022

Choose a reason for hiding this comment

arnaldo2792 Sep 29, 2022

Choose a reason for hiding this comment

bcressey Sep 29, 2022 • edited

Choose a reason for hiding this comment

arnaldo2792 commented Sep 29, 2022

jpculp commented Sep 29, 2022

arnaldo2792 commented Sep 30, 2022

arnaldo2792 commented Oct 3, 2022

arnaldo2792 commented Oct 4, 2022

bcressey commented Oct 4, 2022

bcressey Oct 4, 2022

Choose a reason for hiding this comment

arnaldo2792 commented Oct 4, 2022

arnaldo2792 commented Oct 4, 2022

arnaldo2792 commented Oct 5, 2022

jpculp left a comment

Choose a reason for hiding this comment

arnaldo2792 commented Sep 29, 2022 •

edited

bcressey Sep 29, 2022 •

edited