Weekly portage-stable package updates 2024-05-13

[github-actions]

CI: http://jenkins.infra.kinvolk.io:8080/job/container/job/sdk/1485/cldsv/

Closes flatcar/Flatcar#1454
Closes flatcar/Flatcar#1456

Blocked on flatcar/bootengine#97

--

• app-arch/libarchive: [PROD] [DEV]

  • from 3.7.2-r3 to 3.7.3
  • release notes: https://github.com/libarchive/libarchive/releases/tag/v3.7.3

• app-arch/zstd: [PROD] [DEV]

  • from 1.5.5-r1 to 1.5.6
  • release notes: https://github.com/facebook/zstd/releases/tag/v1.5.6

• app-crypt/gnupg: [PROD] [DEV]

  • from 2.4.4-r1 to 2.4.5
  • release notes: https://lists.gnupg.org/pipermail/gnupg-announce/2024q1/000482.html

• app-crypt/tpm2-tools: [PROD] [DEV]

  • from 5.5 to 5.6.1
  • fixes CVE-2024-29038 and CVE-2024-29039
    • update: tpm2-{tools,tss} Flatcar#1454
  • release notes: https://github.com/tpm2-software/tpm2-tools/releases/tag/5.6.1

• app-crypt/tpm2-tss: [PROD] [DEV]

  • from 4.0.1 to 4.0.2
  • fixes CVE-2024-29040
    • update: tpm2-{tools,tss} Flatcar#1454
  • release notes: https://github.com/tpm2-software/tpm2-tss/releases/tag/4.0.2

• app-emulation/qemu:

  • from 8.1.5 to 8.2.3
  • release notes: https://wiki.qemu.org/ChangeLog/8.2

• app-emulation/qemu-guest-agent: [PROD] [DEV]

  • from 8.0.3 to 8.2.0
  • added keyword for arm64, so added it also for arm64 images
  • release notes: https://wiki.qemu.org/ChangeLog/8.2#Guest_agent

• app-portage/elt-patches:

  • from 20240315 to 20240324
  • release notes: https://gitweb.gentoo.org/proj/elt-patches.git/commit/?id=d3c77e47d0c2ae8806b340aabb53947012c239f5

• app-shells/bash:

  • from 5.2_p26 to 5.2_p26-r3
  • updated accept keywords in overlay profiles
  • split bashrc into bashrc.d files
  • fixed support for eprefix in bashrc.d files

• dev-db/sqlite: [PROD] [DEV]

  • from 3.45.1-r1 to 3.45.3
  • release notes: https://www.sqlite.org/releaselog/3_45_3.html

• dev-lang/perl:

  • from 5.38.2-r2 to 5.38.2-r3
  • replaced debug, ithreads and quadmath IUSE flags with perl_features_* counterparts
    • this is made to work with the new PERL_FEATURES expand variable.
    • not relevant really to us, since we didn't use any of those so far

• dev-lang/python:

  • still at 3.11.9
  • became stable for amd64, so dropped accept keywords from overlay

• dev-libs/cyrus-sasl:

  • still at 2.1.28-r4
  • added a workaround for issues with LTO

• dev-libs/glib: [PROD] [DEV]

  • from 2.78.3 to 2.78.6
  • fixes CVE-2024-34397
    • update: glib Flatcar#1456
  • bumped python compat to 3.10..12
  • added a build dependency on dev-python/packaging
  • release notes: https://gitlab.gnome.org/GNOME/glib/-/releases/2.78.6

• dev-libs/libassuan: [PROD] [DEV]

  • from 2.5.6 to 2.5.7
  • release notes: https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libassuan.git;a=blob;f=NEWS;h=047f12b7c3ee0c8c1718a2da8b5a6bb9dd541fd8;hb=cc2f776904e0b5e56e2b81b2672ca98d7787ed1b

• dev-libs/libdnet:

  • from 1.16.4 to 1.18.0
  • still unstable for arm64, so updated accept keywords in overlay profiles
  • release notes: https://github.com/ofalk/libdnet/releases/tag/libdnet-1.18.0

• dev-libs/libgpg-error: [PROD] [DEV]

  • from 1.47-r1 to 1.48
  • release notes: https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgpg-error.git;a=blob;f=NEWS;h=9295a3544d9cd47f90581061da27d6f12e278513;hb=77b7c5ff6b756870811acaff53df0ebf1e5c2368

• dev-libs/libpcre2: [PROD] [DEV]

  • from 10.42-r2 to 10.43
  • EAPI 8
  • release notes: https://github.com/PCRE2Project/pcre2/blob/pcre2-10.43/NEWS

• dev-libs/libsodium: [PROD] [DEV]

  • from 1.0.19-r2 to 1.0.19_p20240117
  • this is a stable snapshot, possibly to bring a fix in one of the header files

• dev-libs/libusb: [PROD] [DEV]

  • from 1.0.26 to 1.0.27-r1
  • EAPI 8
  • stopped inheriting usr-ldscript, helping us to move closer to removal of the eclass from portage-stable
  • unstable on arm64, so added accept keywords to overlay profiles
  • release notes: https://github.com/libusb/libusb/blob/v1.0.27/ChangeLog

• dev-libs/libxml2: [PROD] [DEV]

  • from 2.12.5 to 2.12.6
  • release notes: https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.6

• dev-python/backports-tarfile:

  • new, at 1.1.1
  • a dependency of dev-python/jaraco-context

• dev-python/cython:

  • still at 3.0.10
  • added python 3.13 to python compat

• dev-python/docutils:

  • from 0.20.1-r1 to 0.21.2
  • added dev-python/pillow to runtime dependencies
  • release notes: https://docutils.sourceforge.io/RELEASE-NOTES.html#release-0-21-2-2024-04-23

• dev-python/editables:

  • still at 0.5
  • bumped python compat to 3.10..13

• dev-python/gpep517:

  • still at 15
  • bumped python compat to 3.10..13

• dev-python/hatchling:

  • from 1.22.5-r1 to 1.24.2
  • added python 3.13 to python compat
  • bumped dev-python/packaging dependency to >=23.3
  • release notes: https://github.com/pypa/hatch/releases/tag/hatchling-v1.24.2

• dev-python/installer:

  • still at 0.7.0
  • bumped python compat to 3.10..13

• dev-python/jaraco-context:

  • from 5.1.0 to 5.3.0
  • bumped python compat to 3.10..13
  • added runtime dependency on dev-python/backports-tarfile
  • release notes: https://github.com/jaraco/jaraco.context/blob/v5.3.0/NEWS.rst

• dev-python/jaraco-functools:

  • from 4.0.0 to 4.0.1
  • bumped python compat to 3.10..13
  • release notes: https://github.com/jaraco/jaraco.functools/blob/v4.0.1/NEWS.rst

• dev-python/jaraco-text:

  • still at 3.12.0
  • bumped python compat to 3.10..13

• dev-python/lxml:

  • still at 5.2.1
  • bumped python compat to 3.10..13

• dev-python/markupsafe:

  • still at 2.1.5
  • bumped python compat to 3.10..13

• dev-python/more-itertools:

  • still at 10.2.0
  • bumped python compat to 3.10..13

• dev-python/ordered-set:

  • still at 4.1.0
  • bumped python compat to 3.10..13

• dev-python/packaging:

  • still at 24.0
  • bumped python compat to 3.10..13

• dev-python/pathspec:

  • still at 0.12.1
  • bumped python compat to 3.10..13

• dev-python/olefile:

  • new, at 0.47
  • dependency of dev-python/pillow

• dev-python/pillow:

  • new, at 10.3.0
  • dependency of dev-python/docutils
  • masked its jpeg USE flag

• dev-python/pluggy:

  • from 1.4.0 to 1.5.0
  • bumped python compat to 3.10..13
  • release notes: https://github.com/pytest-dev/pluggy/blob/1.5.0/CHANGELOG.rst#pluggy-150-2024-04-19

• dev-python/setuptools:

  • from 69.2.0-r1 to 69.5.1-r1
  • added python 3.13 to python compat
  • bumped dev-python/packaging dependency to >=24
  • changed dev-python/tomli dependency to be only for python 3.10
    • this effectively drops the dependency for us
  • release notes: https://github.com/pypa/setuptools/blob/v69.5.1/NEWS.rst

• dev-python/six:

  • still at 1.16.0-r1
  • bumped python compat to 3.10..13

• dev-python/tomli:

  • dropped, unused

• dev-python/trove-classifiers:

  • from 2024.3.25 to 2024.4.10
  • bumped python compat to 3.10..13
  • release notes: https://github.com/pypa/trove-classifiers/releases/tag/2024.4.10

• dev-python/wheel:

  • still at 0.43.0
  • bumped python compat to 3.10..13

• dev-util/bpftool: [PROD] [DEV]

  • from 6.7.6-r1 to 6.8.2
  • unstable, so added keywords to overlay profiles
  • contains a fix for documentation building
    • ideally, we wouldn't build docs anyway, but it can't be disabled for now
  • release notes: https://github.com/libbpf/bpftool/releases/tag/v6.8.0

• dev-util/gdbus-codegen:

  • from 2.78.3 to 2.78.6
  • added a runtime dependency on dev-python/packaging
  • release notes: https://gitlab.gnome.org/GNOME/glib/-/releases/2.78.6

• dev-util/glib-utils:

  • from 2.78.3 to 2.78.6
  • release notes: https://gitlab.gnome.org/GNOME/glib/-/releases/2.78.6

• dev-util/pkgconf: [PROD] [DEV]

  • from 2.1.1 to 2.2.0
  • release notes: https://github.com/pkgconf/pkgconf/blob/pkgconf-2.2.0/NEWS

• eclass/alternatives.eclass:

  • added EAPI 8 to supported EAPIs

• eclass/autotools.eclass:

  • made dependency on sys-devel/gnuconfig optional

• eclass/elisp-common.eclass:

  • silenced some warnings made by Emacs

• eclass/epatch.eclass:

  • marked the eclass as dead

• eclass/eutils.eclass:

  • moved the dead marker to the top of the file

• eclass/flag-o-matic.eclass:

  • added another flags to allowed set

• eclass/gnuconfig.eclass:

  • dropped support for EAPI 5
  • made dependency on sys-devel/gnuconfig optional

• eclass/python-utils-r1.eclass:

  • added support for python 3.13

• eclass/toolchain.eclass:

  • added some fixes for rust and ada

• eclass/xorg-3.eclass:

  • made autotools dependencies optional

• licenses:

  • dropped Code-Synthesis-ODB, bluez-firmware, ipw3945

• net-analyzer/nmap: [PROD] [DEV]

  • from 7.94 to 7.95
  • bumped python compat to 3.10..12
  • replaced dev-libs/libpcre dependency with dev-libs/libpcre2
  • release notes: https://nmap.org/changelog.html#7.95

• net-libs/gnutls: [PROD] [DEV]

  • from 3.8.5 to 3.8.5-r1
  • added a patch to fix wireshark

• net-misc/curl: [PROD] [DEV]

  • from 8.7.1-r3 to 8.7.1-r4
  • became stable, so dropped accept keywords from overlay profiles
  • added a patch to fix git clone

• net-misc/passt:

  • from 2024.03.26 to 2024.05.10
  • synced properly with Gentoo, so it became unstable - added accept keywords to overlay profiles
  • release notes: https://archives.passt.top/passt-user/20240510225714.6aa8e6c0@elisabeth/T/#u

• net-misc/whois: [PROD] [DEV]

  • from 5.5.20 to 5.5.21
  • release notes: https://github.com/rfc1036/whois/blob/v5.5.21/debian/changelog

• profiles:

  • added new python3.13 USE flags (masked for now)
  • masked sys-libs/ncurses-6.5
    • we could consider unmasking it ourselves to test it
  • rewrote a >=5.4.3 mask for app-arch/xz-utils to potentially allow 5.4.7 if it gets released
  • dropped sourceforge 3rd party mirror

• sys-apps/attr:

  • still at 2.5.2-r1
  • added a patch for musl

• sys-apps/file:

  • still at 5.45-r4
  • bumped python compat to 3.10..12

• sys-apps/findutils:

  • still at 4.9.0-r2
  • bumped python compat to 3.10..12

• sys-apps/grep: [PROD] [DEV]

  • from 3.11 to 3.11-r1
  • added a patch fixing grepping over directories with a large amount of files (>100k)

• sys-apps/kexec-tools: [PROD] [DEV]

  • from 2.0.24 to 2.0.28
  • release notes: https://github.com/horms/kexec-tools/commits/v2.0.28/

• sys-apps/kmod: [PROD] [DEV]

  • from 31 to 32-r1
  • dropped python USE flag
    • these were for python bindings, upstream dropped them
  • added split-usr USE flag
    • this is to make /sbin/modprobe a symlink to /usr/bin/kmod
    • we don't need it
  • release notes: https://git.kernel.org/pub/scm/utils/kernel/kmod/kmod.git/tree/NEWS?h=v32

• sys-apps/pcsc-lite:

  • still at 2.0.1
  • bumped python compat to 3.10..12

• sys-apps/portage: [DEV]

  • from 3.0.61-r1 to 3.0.63
  • release notes: https://gitweb.gentoo.org/proj/portage.git/tree/NEWS?h=portage-3.0.63

• sys-apps/usbutils:

  • still at 017
  • bumped python compat to 3.10..12

• sys-block/parted: [PROD] [DEV]

  • from 3.6-r1 to 3.6-r2
  • disabled the use of static analyzer when building

• sys-devel/binutils: [DEV]

  • from 2.41-r5 to 2.42-r1
  • unstable on arm64, so added accept keywords to overlay profiles
  • release notes: https://sourceware.org/pipermail/binutils/2024-January/132213.html

• sys-devel/gcc:

  • still at 13.2.1_p20240210
  • bumped python compat to 3.10..12

• sys-firmware/intel-microcode:

  • still at 20240312_p20240312
  • became stable, so dropped accept keywords from overlay profiles

• sys-fs/multipath-tools: [PROD] [DEV]

  • from 0.9.7-r1 to 0.9.8
  • release notes: https://github.com/opensvc/multipath-tools/blob/0.9.8/NEWS.md

• sys-fs/xfsprogs: [PROD] [DEV]

  • from 6.4.0 to 6.6.0
  • dropped user patches, issues were fixed upstream
  • release notes: https://git.kernel.org/pub/scm/fs/xfs/xfsprogs-dev.git/tree/doc/CHANGES?h=v6.6.0

• sys-fs/zfs:

  • from 2.2.2-r1 to 2.2.3
  • bumped python compat to 3.10..12
  • release notes: https://github.com/openzfs/zfs/releases/tag/zfs-2.2.3

• sys-fs/zfs-kmod:

  • from 2.2.2 to 2.2.3
  • release notes: https://github.com/openzfs/zfs/releases/tag/zfs-2.2.3

• sys-libs/binutils-libs: [PROD] [DEV]

  • from 2.41-r5 to 2.42-r1
  • unstable on arm64, so added accept keywords to overlay profiles
  • release notes: https://sourceware.org/pipermail/binutils/2024-January/132213.html

• sys-libs/cracklib:

  • still at 2.9.11
  • bumped python compat to 3.10..12

• sys-libs/ldb:

  • still at 2.7.2
  • bumped python compat to 3.10..12

• sys-libs/libseccomp:

  • still at 2.5.5-r1
  • added a call to elibtoolize on build to bring in build fixes

• sys-libs/libunwind: [PROD] [DEV]

  • from 1.7.2 to 1.8.1
  • added a call to elibtoolize on build to bring in build fixes
  • release notes: https://github.com/libunwind/libunwind/releases/tag/v1.8.1 https://github.com/libunwind/libunwind/releases/tag/v1.8.0

• sys-libs/ncurses: [PROD] [DEV]

  • from 6.4_p20230527 to 6.4_p20240414
  • became stable, so dropped accept keywords from overlay profiles

• sys-libs/tevent:

  • still at 0.14.1
  • bumped python compat to 3.9..12

• sys-libs/zlib: [PROD] [DEV]

  • from 1.3-r4 to 1.3.1-r1
  • release notes: https://github.com/madler/zlib/releases/tag/v1.3.1

• sys-process/psmisc: [DEV]

  • from 23.6 to 23.7
  • release notes: https://gitlab.com/psmisc/psmisc/-/releases/v23.7

--

• changelog
• image diff

[krnowak]

@flatcar/flatcar-security-team: tpm2 package updates fix CVE-2024-29038, CVE-2024-29039 and CVE-2024-29040. I haven't seen an issue filed about them, so should I assume that these are not affecting us?

[github-actions]

Build action triggered: https://github.com/flatcar/scripts/actions/runs/9795341968

[dongsupark]

@krnowak: Thanks. Created an issue flatcar/Flatcar#1454

[tormath1]

This fail to build in the CI. What I don't get is that in the CI the version 4.9.4 is being built. While we're shipping the version 5.0.2 (http://bincache.flatcar-linux.net/images/amd64/3975.0.0/flatcar-podman_packages.txt).
I think the initial import is not a direct import from Gentoo: c692687#diff-c67bda60496165e7503813906b2e4a513ad7a564a349348986c7358f234b62e4

[krnowak]

It's possible, because net-misc/passt (which is a dependency of podman) also wasn't a pristine copy from Gentoo. I'll investigate.

[krnowak]

Yep, not a pristine import, see commit 7c775f6.

[tormath1]

I think the contributor was not aware of this and we missed it at the review. Same thing for sysext Python (which is not yet merged): #1979 (comment)

[tormath1]

To sort this, I would suggest to do the pristine import and mark podman-5.0.2 as stable (to avoid having a downgrade of the sysext image).

[krnowak]

Yeah, that's what I'm doing at the moment. We got a bunch of packages imported in the podman PR, so I'm cleaning this up.

[krnowak]

Closing in favor of #2070.