diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index e7db20a6d7e..48f559d85ee 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -21,7 +21,6 @@ /SPECS/kernel-headers/* @microsoft/cbl-mariner-kernel /SPECS/kernel-mshv/* @microsoft/cbl-mariner-kata-containers /SPECS/kernel-uvm/* @microsoft/cbl-mariner-kata-containers -/SPECS/kernel-uvm-cvm/* @microsoft/cbl-mariner-kata-containers /SPECS-SIGNED/kernel-signed/* @microsoft/cbl-mariner-kernel /SPECS-SIGNED/kernel-hci-signed/* @microsoft/cbl-mariner-kernel /SPECS-SIGNED/kernel-azure-signed/* @microsoft/cbl-mariner-kernel diff --git a/SPECS-EXTENDED/buildah/buildah.spec b/SPECS-EXTENDED/buildah/buildah.spec index 8fc32238151..eec03341d5f 100644 --- a/SPECS-EXTENDED/buildah/buildah.spec +++ b/SPECS-EXTENDED/buildah/buildah.spec @@ -21,7 +21,7 @@ Summary: A command line tool used for creating OCI Images Name: buildah Version: 1.18.0 -Release: 21%{?dist} +Release: 22%{?dist} License: ASL 2.0 Vendor: Microsoft Corporation Distribution: Mariner @@ -123,6 +123,9 @@ cp imgtype %{buildroot}/%{_bindir}/%{name}-imgtype %{_datadir}/%{name}/test %changelog +* Fri Feb 02 2024 CBL-Mariner Servicing Account - 1.18.0-22 +- Bump release to rebuild with go 1.21.6 + * Wed Oct 18 2023 Minghe Ren - 1.18.0-21 - Bump release to rebuild against glibc 2.35-6 diff --git a/SPECS-EXTENDED/containernetworking-plugins/containernetworking-plugins.spec b/SPECS-EXTENDED/containernetworking-plugins/containernetworking-plugins.spec index 22b07318739..b26b05e666b 100644 --- a/SPECS-EXTENDED/containernetworking-plugins/containernetworking-plugins.spec +++ b/SPECS-EXTENDED/containernetworking-plugins/containernetworking-plugins.spec @@ -24,7 +24,7 @@ Name: %{project}-%{repo} Version: 1.1.1 -Release: 13%{?dist} +Release: 14%{?dist} Summary: Libraries for writing CNI plugin License: ASL 2.0 and BSD and MIT Vendor: Microsoft Corporation @@ -129,6 +129,9 @@ install -p plugins/ipam/dhcp/systemd/cni-dhcp.socket %{buildroot}%{_unitdir} %{_unitdir}/cni-dhcp.socket %changelog +* Fri Feb 02 2024 CBL-Mariner Servicing Account - 1.1.1-14 +- Bump release to rebuild with go 1.21.6 + * Mon Oct 16 2023 CBL-Mariner Servicing Account - 1.1.1-13 - Bump release to rebuild with go 1.20.9 diff --git a/SPECS-EXTENDED/delve/delve.spec b/SPECS-EXTENDED/delve/delve.spec index b237eb36bcb..de3acde0430 100644 --- a/SPECS-EXTENDED/delve/delve.spec +++ b/SPECS-EXTENDED/delve/delve.spec @@ -2,7 +2,7 @@ Vendor: Microsoft Corporation Distribution: Mariner Name: delve Version: 1.5.0 -Release: 16%{?dist} +Release: 17%{?dist} Summary: A debugger for the Go programming language License: MIT @@ -72,6 +72,9 @@ done %changelog +* Fri Feb 02 2024 CBL-Mariner Servicing Account - 1.5.0-17 +- Bump release to rebuild with go 1.21.6 + * Mon Oct 16 2023 CBL-Mariner Servicing Account - 1.5.0-16 - Bump release to rebuild with go 1.20.9 diff --git a/SPECS-EXTENDED/nss-mdns/nss-mdns-local-heuristic-unit.patch b/SPECS-EXTENDED/nss-mdns/nss-mdns-local-heuristic-unit.patch new file mode 100644 index 00000000000..4b702b168e0 --- /dev/null +++ b/SPECS-EXTENDED/nss-mdns/nss-mdns-local-heuristic-unit.patch @@ -0,0 +1,112 @@ +From 6ff47454ff413e3033a77d4d9c09b914c78ab3a0 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= +Date: Wed, 7 Dec 2022 22:56:47 +0100 +Subject: [PATCH] Add unit test parts for new autodetection + +Use new enum to specify forced present or missing .local SOA record. Use +from production code auto value, but use forced values from unit test. +Add few different results to unit test. +--- + src/nss.c | 3 ++- + src/util.c | 7 +++++-- + src/util.h | 9 ++++++++- + tests/check_util.c | 18 ++++++++++++++++++ + 4 files changed, 33 insertions(+), 4 deletions(-) + +diff --git a/src/nss.c b/src/nss.c +index 7f9230e..2e1a90b 100644 +--- a/src/nss.c ++++ b/src/nss.c +@@ -118,7 +118,8 @@ enum nss_status _nss_mdns_gethostbyname_impl(const char* name, int af, + #ifndef MDNS_MINIMAL + mdns_allow_file = fopen(MDNS_ALLOW_FILE, "r"); + #endif +- result = verify_name_allowed_with_soa(name, mdns_allow_file); ++ result = verify_name_allowed_with_soa(name, mdns_allow_file, ++ TEST_LOCAL_SOA_AUTO); + #ifndef MDNS_MINIMAL + if (mdns_allow_file) + fclose(mdns_allow_file); +diff --git a/src/util.c b/src/util.c +index 4eacf07..0a1c28a 100644 +--- a/src/util.c ++++ b/src/util.c +@@ -55,14 +55,17 @@ int ends_with(const char* name, const char* suffix) { + return strcasecmp(name + ln - ls, suffix) == 0; + } + +-use_name_result_t verify_name_allowed_with_soa(const char* name, FILE* mdns_allow_file) { ++use_name_result_t verify_name_allowed_with_soa(const char* name, ++ FILE* mdns_allow_file, ++ test_local_soa_t test) { + switch (verify_name_allowed(name, mdns_allow_file)) { + case VERIFY_NAME_RESULT_NOT_ALLOWED: + return USE_NAME_RESULT_SKIP; + case VERIFY_NAME_RESULT_ALLOWED: + return USE_NAME_RESULT_AUTHORITATIVE; + case VERIFY_NAME_RESULT_ALLOWED_IF_NO_LOCAL_SOA: +- if (local_soa()) ++ if (test == TEST_LOCAL_SOA_YES || ++ (test == TEST_LOCAL_SOA_AUTO && local_soa()) ) + /* Make multicast resolution not authoritative for .local zone. + * Allow continuing to unicast resolution after multicast had not worked. */ + return USE_NAME_RESULT_OPTIONAL; +diff --git a/src/util.h b/src/util.h +index 76809d4..80527e3 100644 +--- a/src/util.h ++++ b/src/util.h +@@ -67,6 +67,12 @@ typedef enum { + USE_NAME_RESULT_OPTIONAL, + } use_name_result_t; + ++typedef enum { ++ TEST_LOCAL_SOA_NO, ++ TEST_LOCAL_SOA_YES, ++ TEST_LOCAL_SOA_AUTO, ++} test_local_soa_t; ++ + // Returns true if we should try to resolve the name with mDNS. + // + // If mdns_allow_file is NULL, then this implements the "local" SOA +@@ -78,7 +84,8 @@ typedef enum { + // The two heuristics described above are disabled if mdns_allow_file + // is not NULL. + use_name_result_t verify_name_allowed_with_soa(const char* name, +- FILE* mdns_allow_file); ++ FILE* mdns_allow_file, ++ test_local_soa_t test); + + typedef enum { + VERIFY_NAME_RESULT_NOT_ALLOWED, +diff --git a/tests/check_util.c b/tests/check_util.c +index d600a2e..36f1008 100644 +--- a/tests/check_util.c ++++ b/tests/check_util.c +@@ -50,6 +50,24 @@ START_TEST(test_verify_name_allowed_minimal) { + VERIFY_NAME_RESULT_NOT_ALLOWED); + ck_assert_int_eq(verify_name_allowed(".", NULL), + VERIFY_NAME_RESULT_NOT_ALLOWED); ++ ++ ck_assert_int_eq(verify_name_allowed_with_soa(".", NULL, TEST_LOCAL_SOA_YES), ++ USE_NAME_RESULT_SKIP); ++ ck_assert_int_eq(verify_name_allowed_with_soa(".", NULL, TEST_LOCAL_SOA_NO), ++ USE_NAME_RESULT_SKIP); ++ ck_assert_int_eq(verify_name_allowed_with_soa(".", NULL, TEST_LOCAL_SOA_AUTO), ++ USE_NAME_RESULT_SKIP); ++ ck_assert_int_eq(verify_name_allowed_with_soa("example3.sub.local", ++ NULL, TEST_LOCAL_SOA_YES), USE_NAME_RESULT_SKIP); ++ ck_assert_int_eq(verify_name_allowed_with_soa("example4.sub.local", ++ NULL, TEST_LOCAL_SOA_NO), USE_NAME_RESULT_SKIP); ++ ck_assert_int_eq(verify_name_allowed_with_soa("example4.sub.local", ++ NULL, TEST_LOCAL_SOA_AUTO), USE_NAME_RESULT_SKIP); ++ ck_assert_int_eq(verify_name_allowed_with_soa("example1.local", ++ NULL, TEST_LOCAL_SOA_YES), USE_NAME_RESULT_OPTIONAL); ++ ck_assert_int_eq(verify_name_allowed_with_soa("example2.local", ++ NULL, TEST_LOCAL_SOA_NO), USE_NAME_RESULT_AUTHORITATIVE); ++ /* TEST_LOCAL_SOA_AUTO would test actual DNS on host, skip that. */ + } + END_TEST + +-- +2.38.1 + diff --git a/SPECS-EXTENDED/nss-mdns/nss-mdns-local-heuristic.patch b/SPECS-EXTENDED/nss-mdns/nss-mdns-local-heuristic.patch new file mode 100644 index 00000000000..07eb43fa849 --- /dev/null +++ b/SPECS-EXTENDED/nss-mdns/nss-mdns-local-heuristic.patch @@ -0,0 +1,119 @@ +From 0cbe3ff2a64cdddbfb3884ccbe28be9f08077614 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= +Date: Tue, 6 Dec 2022 20:39:27 +0100 +Subject: [PATCH] Change .local domain heuristic + +Previous way skipped all multicast queries when unicast DNS contains +local. SOA record. Change that behaviour and always request multicast +name. But if local SOA is present, then make missing multicast optional +and continue to DNS plugin. That would make names ending with .local to +take longer resolve on unicast DNS, but should still deliver the answer. +--- + src/nss.c | 11 ++++++++--- + src/util.c | 15 ++++++++++----- + src/util.h | 9 ++++++++- + 3 files changed, 26 insertions(+), 9 deletions(-) + +diff --git a/src/nss.c b/src/nss.c +index 93d140a..7f9230e 100644 +--- a/src/nss.c ++++ b/src/nss.c +@@ -85,8 +85,8 @@ enum nss_status _nss_mdns_gethostbyname_impl(const char* name, int af, + userdata_t* u, int* errnop, + int* h_errnop) { + +- int name_allowed; + FILE* mdns_allow_file = NULL; ++ use_name_result_t result; + + #ifdef NSS_IPV4_ONLY + if (af == AF_UNSPEC) { +@@ -118,13 +118,13 @@ enum nss_status _nss_mdns_gethostbyname_impl(const char* name, int af, + #ifndef MDNS_MINIMAL + mdns_allow_file = fopen(MDNS_ALLOW_FILE, "r"); + #endif +- name_allowed = verify_name_allowed_with_soa(name, mdns_allow_file); ++ result = verify_name_allowed_with_soa(name, mdns_allow_file); + #ifndef MDNS_MINIMAL + if (mdns_allow_file) + fclose(mdns_allow_file); + #endif + +- if (!name_allowed) { ++ if (result == USE_NAME_RESULT_SKIP) { + *errnop = EINVAL; + *h_errnop = NO_RECOVERY; + return NSS_STATUS_UNAVAIL; +@@ -137,6 +137,11 @@ enum nss_status _nss_mdns_gethostbyname_impl(const char* name, int af, + case AVAHI_RESOLVE_RESULT_HOST_NOT_FOUND: + *errnop = ETIMEDOUT; + *h_errnop = HOST_NOT_FOUND; ++ if (result == USE_NAME_RESULT_OPTIONAL) { ++ /* continue to dns plugin if DNS .local zone is detected. */ ++ *h_errnop = TRY_AGAIN; ++ return NSS_STATUS_UNAVAIL; ++ } + return NSS_STATUS_NOTFOUND; + + case AVAHI_RESOLVE_RESULT_UNAVAIL: +diff --git a/src/util.c b/src/util.c +index d5e0290..4eacf07 100644 +--- a/src/util.c ++++ b/src/util.c +@@ -55,16 +55,21 @@ int ends_with(const char* name, const char* suffix) { + return strcasecmp(name + ln - ls, suffix) == 0; + } + +-int verify_name_allowed_with_soa(const char* name, FILE* mdns_allow_file) { ++use_name_result_t verify_name_allowed_with_soa(const char* name, FILE* mdns_allow_file) { + switch (verify_name_allowed(name, mdns_allow_file)) { + case VERIFY_NAME_RESULT_NOT_ALLOWED: +- return 0; ++ return USE_NAME_RESULT_SKIP; + case VERIFY_NAME_RESULT_ALLOWED: +- return 1; ++ return USE_NAME_RESULT_AUTHORITATIVE; + case VERIFY_NAME_RESULT_ALLOWED_IF_NO_LOCAL_SOA: +- return !local_soa(); ++ if (local_soa()) ++ /* Make multicast resolution not authoritative for .local zone. ++ * Allow continuing to unicast resolution after multicast had not worked. */ ++ return USE_NAME_RESULT_OPTIONAL; ++ else ++ return USE_NAME_RESULT_AUTHORITATIVE; + default: +- return 0; ++ return USE_NAME_RESULT_SKIP; + } + } + +diff --git a/src/util.h b/src/util.h +index 218c094..76809d4 100644 +--- a/src/util.h ++++ b/src/util.h +@@ -61,6 +61,12 @@ char* buffer_strdup(buffer_t* buf, const char* str); + int set_cloexec(int fd); + int ends_with(const char* name, const char* suffix); + ++typedef enum { ++ USE_NAME_RESULT_SKIP, ++ USE_NAME_RESULT_AUTHORITATIVE, ++ USE_NAME_RESULT_OPTIONAL, ++} use_name_result_t; ++ + // Returns true if we should try to resolve the name with mDNS. + // + // If mdns_allow_file is NULL, then this implements the "local" SOA +@@ -71,7 +77,8 @@ int ends_with(const char* name, const char* suffix); + // + // The two heuristics described above are disabled if mdns_allow_file + // is not NULL. +-int verify_name_allowed_with_soa(const char* name, FILE* mdns_allow_file); ++use_name_result_t verify_name_allowed_with_soa(const char* name, ++ FILE* mdns_allow_file); + + typedef enum { + VERIFY_NAME_RESULT_NOT_ALLOWED, +-- +2.38.1 + diff --git a/SPECS-EXTENDED/nss-mdns/nss-mdns.signatures.json b/SPECS-EXTENDED/nss-mdns/nss-mdns.signatures.json new file mode 100644 index 00000000000..13cf9047c32 --- /dev/null +++ b/SPECS-EXTENDED/nss-mdns/nss-mdns.signatures.json @@ -0,0 +1,5 @@ +{ + "Signatures": { + "nss-mdns-0.15.1.tar.gz": "ddf71453d7a7cdc5921fe53ef387b24fd0c3c49f4dcf94a2a437498596761a21" + } +} \ No newline at end of file diff --git a/SPECS-EXTENDED/nss-mdns/nss-mdns.spec b/SPECS-EXTENDED/nss-mdns/nss-mdns.spec new file mode 100644 index 00000000000..975d0aa3ac4 --- /dev/null +++ b/SPECS-EXTENDED/nss-mdns/nss-mdns.spec @@ -0,0 +1,229 @@ +Vendor: Microsoft Corporation +Distribution: Mariner + +Name: nss-mdns +Version: 0.15.1 +Release: 11%{?dist} +Summary: glibc plugin for .local name resolution + +License: LGPLv2+ +URL: https://github.com/lathiat/nss-mdns +Source0: https://github.com/lathiat/nss-mdns/releases/download/v%{version}/nss-mdns-%{version}.tar.gz + +# https://github.com/lathiat/nss-mdns/pull/84 +Patch1: nss-mdns-local-heuristic.patch +Patch2: nss-mdns-local-heuristic-unit.patch + +BuildRequires: make +BuildRequires: gcc +BuildRequires: pkgconfig(check) +Requires: avahi +Requires: authselect + +%description +nss-mdns is a plugin for the GNU Name Service Switch (NSS) functionality of +the GNU C Library (glibc) providing host name resolution via Multicast DNS +(aka Zeroconf, aka Apple Rendezvous, aka Apple Bonjour), effectively allowing +name resolution by common Unix/Linux programs in the ad-hoc mDNS domain .local. + +nss-mdns provides client functionality only, which means that you have to +run a mDNS responder daemon separately from nss-mdns if you want to register +the local host name via mDNS (e.g. Avahi). + + +%prep +%autosetup -p1 + +%build +%configure --libdir=/%{_lib} +%make_build + +%check +make check || (cat ./test-suite.log; false) + +%install +rm -rf $RPM_BUILD_ROOT +%make_install + + +%post +%{?ldconfig} + +%posttrans +authselect enable-feature with-mdns4 &> /dev/null || : + +%preun +authselect disable-feature with-mdns4 &> /dev/null || : + +%ldconfig_postun + + +%files +%license LICENSE +%doc README.md NEWS.md ACKNOWLEDGEMENTS.md +/%{_lib}/*.so.* + + +%changelog +* Mon Jan 22 2024 Alexander Dobrzhansky - 0.15.1-11 +- Initial CBL-Mariner import from Fedora 40 (license: MIT). +- License verified + +* Sun Jan 21 2024 Fedora Release Engineering - 0.15.1-10 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Thu Jul 20 2023 Fedora Release Engineering - 0.15.1-9 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Thu Jan 19 2023 Fedora Release Engineering - 0.15.1-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Tue Dec 06 2022 Petr Menšík - 0.15.1-7 +- Attempt to solve local heuristic (#2148500) + +* Fri Jul 22 2022 Fedora Release Engineering - 0.15.1-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Wed Feb 16 2022 Pavel Březina - 0.15.1-5 +- Require authselect since it is used in scriptlets to auto-enable nss-mdns + +* Thu Jan 20 2022 Fedora Release Engineering - 0.15.1-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Tue Nov 16 2021 Pavel Březina - 0.15.1-3 +- Rely only on authselect for nsswitch.conf changes (#2023745) + +* Thu Jul 22 2021 Fedora Release Engineering - 0.15.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Sat Jun 12 2021 Adam Goode - 0.15.1-1 +- New upstream release, fixes broken 0.15 release + +* Tue May 11 2021 Adam Goode - 0.15-1 +- New upstream release + +* Fri Mar 26 2021 Zbigniew Jędrzejewski-Szmek - 0.14.1-11 +- Move 'myhostname' before 'mdns4_minimal' (#1943199) + +* Tue Jan 26 2021 Fedora Release Engineering - 0.14.1-10 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Wed Sep 2 2020 Zbigniew Jędrzejewski-Szmek - 0.14.1-9 +- Place 'mdns4_minimal' in /etc/nsswitch.conf after 'files' in /etc/nsswitch.conf, + so that it ends up before 'resolve' (#1867830) + +* Tue Jul 28 2020 Fedora Release Engineering - 0.14.1-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Tue Mar 17 2020 Pavel Březina - 0.14.1-7 +- Do not remove mdns from nsswitch.conf during upgrade + +* Wed Jan 29 2020 Fedora Release Engineering - 0.14.1-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Sun Jan 19 2020 Adam Goode - 0.14.1-5 +- Properly work with or without authselect (BZ #1577243) + +* Thu Jul 25 2019 Fedora Release Engineering - 0.14.1-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Fri Feb 01 2019 Fedora Release Engineering - 0.14.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Fri Jul 13 2018 Fedora Release Engineering - 0.14.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Sun Mar 18 2018 Adam Goode - 0.14.1-1 +- New upstream release +- Modernize the spec file + +* Thu Feb 08 2018 Fedora Release Engineering - 0.10-21 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + +* Thu Aug 03 2017 Fedora Release Engineering - 0.10-20 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild + +* Thu Jul 27 2017 Fedora Release Engineering - 0.10-19 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + +* Sat Feb 11 2017 Fedora Release Engineering - 0.10-18 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild + +* Thu Feb 04 2016 Fedora Release Engineering - 0.10-17 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild + +* Wed Jun 17 2015 Fedora Release Engineering - 0.10-16 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild + +* Sun Aug 17 2014 Fedora Release Engineering - 0.10-15 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild + +* Sat Jun 07 2014 Fedora Release Engineering - 0.10-14 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild + +* Sat Aug 03 2013 Fedora Release Engineering - 0.10-13 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild + +* Thu Feb 14 2013 Fedora Release Engineering - 0.10-12 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild + +* Fri Jul 20 2012 Fedora Release Engineering - 0.10-11 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild + +* Fri Jan 13 2012 Fedora Release Engineering - 0.10-10 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild + +* Tue Feb 08 2011 Fedora Release Engineering - 0.10-9 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild + +* Sat Jul 25 2009 Fedora Release Engineering - 0.10-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild + +* Wed Feb 25 2009 Fedora Release Engineering - 0.10-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild + +* Tue Sep 30 2008 Stepan Kasal - 0.10-6 +- use sed instead of perl in %%post and %%preun (#462996), + fixing two bugs in the scriptlets: + 1) the backup file shall be nsswitch.conf.bak, not nsswitch.confbak + 2) the first element after host: shall be subject to removal, too +- consequently, removed the Requires(..): perl +- removed the reqires for things that are granted +- a better BuildRoot + +* Mon Aug 11 2008 Tom "spot" Callaway - 0.10-5 +- fix license tag + +* Tue Feb 19 2008 Fedora Release Engineering - 0.10-4 +- Autorebuild for GCC 4.3 + +* Wed Aug 29 2007 Fedora Release Engineering - 0.10-3 +- Rebuild for selinux ppc32 issue. + +* Fri Jun 22 2007 - Lennart Poettering - 0.10-2 +- Fix up post/preun/postun dependencies, add "avahi" to the dependencies, + include dist tag in Release field, use _lib directory instead of literal /lib. + +* Fri Jun 22 2007 - Lennart Poettering - 0.10-1 +- Update to 0.10, replace perl script by simpler and more robust versions, + stolen from the Debian package + +* Thu Jul 13 2006 - Bastien Nocera - 0.8-2 +- Make use of Ezio's perl scripts to enable and disable mdns4 lookups + automatically, patch from Pancrazio `Ezio' de Mauro + +* Tue May 02 2006 - Bastien Nocera - 0.8-1 +- Update to 0.8, disable legacy lookups so that all lookups are made through + the Avahi daemon + +* Mon Apr 24 2006 - Bastien Nocera - 0.7-2 +- Fix building on 64-bit platforms + +* Tue Dec 13 2005 - Bastien Nocera - 0.7-1 +- Update to 0.7, fix some rpmlint errors + +* Thu Nov 10 2005 - Bastien Nocera - 0.6-1 +- Update to 0.6 + +* Tue Dec 07 2004 - Bastien Nocera 0.1-1 +- Initial package, automatically adds and remove mdns4 as a hosts service diff --git a/SPECS-EXTENDED/podman/podman.signatures.json b/SPECS-EXTENDED/podman/podman.signatures.json index 10bb45ecb83..ed3421ba8cf 100644 --- a/SPECS-EXTENDED/podman/podman.signatures.json +++ b/SPECS-EXTENDED/podman/podman.signatures.json @@ -1,7 +1,7 @@ { "Signatures": { "dnsname-18822f9.tar.gz": "c78995a745981fc62a6af579ba416304538e3cba7267d6c06b926a9f4bcd8db9", - "gvisor-tap-vsock-aab0ac9.tar.gz": "e833d0a4506a02c8462ebfe34c48542e8142ddce0ab00277252450e6f42271ae", + "gvisor-tap-vsock-012bc90.tar.gz": "c9b9c43ca4972fb49e2c098cbbe28aa26bb6fc10d5b642032dcc40005f06a26c", "podman-4.1.1.tar.gz": "27bf32e9b1afee94cb08ebd59389104788d687f402a541f3631f94c7916b10a5" } } \ No newline at end of file diff --git a/SPECS-EXTENDED/podman/podman.spec b/SPECS-EXTENDED/podman/podman.spec index cd274d189a8..2a416c4b710 100644 --- a/SPECS-EXTENDED/podman/podman.spec +++ b/SPECS-EXTENDED/podman/podman.spec @@ -29,14 +29,14 @@ # https://github.com/containers/gvisor-tap-vsock %global import_path_gvproxy %%{provider}.%{provider_tld}/%{project}/%{repo_gvproxy} %global git_gvproxy https://%{import_path_gvproxy} -%global commit_gvproxy aab0ac9367fc5142f5857c36ac2352bcb3c60ab7 +%global commit_gvproxy 012bc90eed47444b08986d56ffd65b0f68cfff20 %global shortcommit_gvproxy %(c=%{commit_gvproxy}; echo ${c:0:7}) %global built_tag v4.1.1 Name: podman Version: 4.1.1 -Release: 18%{?dist} +Release: 19%{?dist} License: ASL 2.0 and BSD and ISC and MIT and MPLv2.0 Summary: Manage Pods, Containers and Container Images Vendor: Microsoft Corporation @@ -387,6 +387,10 @@ cp -pav test/system %{buildroot}/%{_datadir}/%{name}/test/ # rhcontainerbot account currently managed by lsm5 %changelog +* Fri Feb 02 2024 Muhammad Falak - 4.1.1-19 +- Bump release to rebuild with go 1.21.6 +- Bump version of gvproxy to enable build with go1.21 + * Wed Oct 18 2023 Minghe Ren - 4.1.1-18 - Bump release to rebuild against glibc 2.35-6 diff --git a/SPECS-EXTENDED/umoci/umoci.spec b/SPECS-EXTENDED/umoci/umoci.spec index d26a76e926a..c7c3036c8cc 100644 --- a/SPECS-EXTENDED/umoci/umoci.spec +++ b/SPECS-EXTENDED/umoci/umoci.spec @@ -1,7 +1,7 @@ Summary: Open Container Image manipulation tool Name: umoci Version: 0.4.7 -Release: 13%{?dist} +Release: 14%{?dist} License: Apache-2.0 Vendor: Microsoft Corporation Distribution: Mariner @@ -39,6 +39,9 @@ go test -mod=vendor %{_bindir}/umoci %changelog +* Fri Feb 02 2024 CBL-Mariner Servicing Account - 0.4.7-14 +- Bump release to rebuild with go 1.21.6 + * Mon Oct 16 2023 CBL-Mariner Servicing Account - 0.4.7-13 - Bump release to rebuild with go 1.20.9 diff --git a/SPECS-SIGNED/kernel-azure-signed/kernel-azure-signed.spec b/SPECS-SIGNED/kernel-azure-signed/kernel-azure-signed.spec index 7e24566a363..747a59a6534 100644 --- a/SPECS-SIGNED/kernel-azure-signed/kernel-azure-signed.spec +++ b/SPECS-SIGNED/kernel-azure-signed/kernel-azure-signed.spec @@ -9,7 +9,7 @@ %define uname_r %{version}-%{release} Summary: Signed Linux Kernel for Azure Name: kernel-azure-signed-%{buildarch} -Version: 5.15.148.1 +Version: 5.15.148.2 Release: 1%{?dist} License: GPLv2 Vendor: Microsoft Corporation @@ -153,6 +153,9 @@ ln -sf linux-%{uname_r}.cfg /boot/mariner.cfg %exclude /module_info.ld %changelog +* Thu Feb 08 2024 CBL-Mariner Servicing Account - 5.15.148.2-1 +- Auto-upgrade to 5.15.148.2 + * Tue Jan 30 2024 CBL-Mariner Servicing Account - 5.15.148.1-1 - Auto-upgrade to 5.15.148.1 diff --git a/SPECS-SIGNED/kernel-hci-signed/kernel-hci-signed.spec b/SPECS-SIGNED/kernel-hci-signed/kernel-hci-signed.spec index 3acb15c61b7..a4b8f133eec 100644 --- a/SPECS-SIGNED/kernel-hci-signed/kernel-hci-signed.spec +++ b/SPECS-SIGNED/kernel-hci-signed/kernel-hci-signed.spec @@ -4,7 +4,7 @@ %define uname_r %{version}-%{release} Summary: Signed Linux Kernel for HCI Name: kernel-hci-signed-%{buildarch} -Version: 5.15.148.1 +Version: 5.15.148.2 Release: 1%{?dist} License: GPLv2 Vendor: Microsoft Corporation @@ -149,6 +149,9 @@ ln -sf linux-%{uname_r}.cfg /boot/mariner.cfg %exclude /module_info.ld %changelog +* Thu Feb 08 2024 CBL-Mariner Servicing Account - 5.15.148.2-1 +- Auto-upgrade to 5.15.148.2 + * Tue Jan 30 2024 CBL-Mariner Servicing Account - 5.15.148.1-1 - Auto-upgrade to 5.15.148.1 diff --git a/SPECS-SIGNED/kernel-mos-signed/kernel-mos-signed.spec b/SPECS-SIGNED/kernel-mos-signed/kernel-mos-signed.spec index a34947f29ec..c6395468c3d 100644 --- a/SPECS-SIGNED/kernel-mos-signed/kernel-mos-signed.spec +++ b/SPECS-SIGNED/kernel-mos-signed/kernel-mos-signed.spec @@ -4,7 +4,7 @@ %define uname_r %{version}-%{release} Summary: Signed Linux Kernel for MOS systems Name: kernel-mos-signed-%{buildarch} -Version: 5.15.148.1 +Version: 5.15.148.2 Release: 1%{?dist} License: GPLv2 Vendor: Microsoft Corporation @@ -150,6 +150,9 @@ ln -sf linux-%{uname_r}.cfg /boot/mariner.cfg %exclude /module_info.ld %changelog +* Thu Feb 08 2024 Rachel Menge - 5.15.148.2-1 +- Upgrade to 5.15.148.2 + * Wed Jan 31 2024 Gary Swalling - 5.15.148.1-1 - Update to 5.15.148.1 diff --git a/SPECS-SIGNED/kernel-signed/kernel-signed.spec b/SPECS-SIGNED/kernel-signed/kernel-signed.spec index 794702223f9..0bd52df99f6 100644 --- a/SPECS-SIGNED/kernel-signed/kernel-signed.spec +++ b/SPECS-SIGNED/kernel-signed/kernel-signed.spec @@ -9,7 +9,7 @@ %define uname_r %{version}-%{release} Summary: Signed Linux Kernel for %{buildarch} systems Name: kernel-signed-%{buildarch} -Version: 5.15.148.1 +Version: 5.15.148.2 Release: 1%{?dist} License: GPLv2 Vendor: Microsoft Corporation @@ -153,6 +153,9 @@ ln -sf linux-%{uname_r}.cfg /boot/mariner.cfg %exclude /module_info.ld %changelog +* Thu Feb 08 2024 CBL-Mariner Servicing Account - 5.15.148.2-1 +- Auto-upgrade to 5.15.148.2 + * Tue Jan 30 2024 CBL-Mariner Servicing Account - 5.15.148.1-1 - Auto-upgrade to 5.15.148.1 diff --git a/SPECS/KeysInUse-OpenSSL/KeysInUse-OpenSSL.spec b/SPECS/KeysInUse-OpenSSL/KeysInUse-OpenSSL.spec index a9412893207..931e5c39712 100644 --- a/SPECS/KeysInUse-OpenSSL/KeysInUse-OpenSSL.spec +++ b/SPECS/KeysInUse-OpenSSL/KeysInUse-OpenSSL.spec @@ -1,7 +1,7 @@ Summary: The KeysInUse Engine for OpenSSL allows the logging of private key usage through OpenSSL Name: KeysInUse-OpenSSL Version: 0.3.4 -Release: 3%{?dist} +Release: 4%{?dist} License: MIT Vendor: Microsoft Corporation Distribution: Mariner @@ -74,6 +74,9 @@ if [ -x %{_bindir}/keysinuseutil ]; then fi %changelog +* Fri Feb 02 2024 CBL-Mariner Servicing Account - 0.3.4-4 +- Bump release to rebuild with go 1.21.6 + * Mon Oct 16 2023 CBL-Mariner Servicing Account - 0.3.4-3 - Bump release to rebuild with go 1.20.9 diff --git a/SPECS/LICENSES-AND-NOTICES/LICENSES-MAP.md b/SPECS/LICENSES-AND-NOTICES/LICENSES-MAP.md index 1e2332fb457..505933a6be7 100644 --- a/SPECS/LICENSES-AND-NOTICES/LICENSES-MAP.md +++ b/SPECS/LICENSES-AND-NOTICES/LICENSES-MAP.md @@ -5,7 +5,7 @@ The CBL-Mariner SPEC files originated from a variety of sources with varying lic | CentOS | [MIT](https://www.centos.org/legal/#licensing-policy) | crash-ptdump-command
delve
fstrm
nodejs-nodemon
rhnlib
rt-setup
rt-tests
rtctl
tuned | | Ceph source | [LGPL2.1](https://github.com/ceph/ceph/blob/master/COPYING-LGPL2.1) | ceph | | Debian | [MIT](https://opensource.org/licenses/MIT) | prometheus-process-exporter | -| Fedora | [Fedora MIT License Declaration](https://fedoraproject.org/wiki/Licensing:Main?rd=Licensing#License_of_Fedora_SPEC_Files) | a52dec
abseil-cpp
accountsservice
acpica-tools
acpid
adcli
adobe-mappings-cmap
adobe-mappings-pdf
advancecomp
adwaita-icon-theme
afflib
aide
alsa-firmware
alsa-plugins
amtk
amtterm
annobin
ansible-freeipa
archivemount
argparse-manpage
arptables
arpwatch
asio
aspell
aspell-en
at
at-spi2-atk
at-spi2-core
atf
atk
atop
attr
audiofile
augeas
authbind
authd
authselect
autoconf213
avahi
babeltrace
babeltrace2
babl
baekmuk-ttf-fonts
bats
bcache-tools
biosdevname
blosc
bluez
bmake
bogofilter
bolt
boom-boot
booth
botan2
breezy
brotli
buildah
busybox
bwidget
byacc
ca-certificates
cachefilesd
cairomm
calamares
capstone
catatonit
catch
catch1
cdrdao
celt051
cereal
certmonger
cfitsio
cgdcbxd
chan
CharLS
checkpolicy
checksec
chrony
cim-schema
cjkuni-uming-fonts
cjose
cldr-emoji-annotation
clucene
clutter
clutter-gst3
clutter-gtk
cmocka
cogl
collectd
colm
color-filesystem
colord
colorize
compat-lua
compiler-rt
conda
conmon
conntrack-tools
console-setup
container-exception-logger
containernetworking-plugins
convmv
corosync
corosync-qdevice
cpp-hocon
cppcheck
cpprest
cpptest
cpuid
criu
crypto-policies
cryptsetup
cscope
ctags
CUnit
cups
custodia
Cython
dbus-c++
dbus-python
dbxtool
dconf
dcraw
debootstrap
deltarpm
desktop-file-utils
device-mapper-persistent-data
dietlibc
diffstat
ding-libs
discount
distribution-gpg-keys
dleyna-connector-dbus
dleyna-core
dmraid
dnf
dnf-plugins-core
docbook-dtds
docbook-simple
docbook-slides
docbook-style-dsssl
docbook-utils
docbook2X
docbook5-schemas
docbook5-style-xsl
dogtail
dos2unix
dotconf
double-conversion
dovecot
dpdk
dpkg
driverctl
dropwatch
drpm
dumpet
dvd+rw-tools
dwarves
dwz
dyninst
ebtables
edac-utils
edk2
efax
efi-rpm-macros
egl-wayland
eglexternalplatform
elinks
enca
enchant
enchant2
enscript
environment-modules
evemu
execstack
exempi
exiv2
extra-cmake-modules
fabtests
facter
fakechroot
fakeroot
fapolicyd
fdk-aac-free
fdupes
fence-virt
fetchmail
fftw
filebench
fio
fipscheck
firewalld
fish
flac
flatbuffers
flite
fltk
fmt
fontawesome-fonts
fontpackages
fonts-rpm-macros
foomatic-db
freeglut
freeipmi
freeradius
freetds
freexl
fribidi
fros
frr
fsverity-utils
fuse-overlayfs
fuse-sshfs
fuse-zip
fuse3
future
fxload
gavl
gconf-editor
GConf2
gcovr
gcr
gdal
gdisk
gdk-pixbuf2
generic-logos
genwqe-tools
geoclue2
GeoIP
GeoIP-GeoLite-data
geolite2
geos
gfs2-utils
ghc-srpm-macros
giflib
gl-manpages
glew
glm
glog
glusterfs
gnome-desktop-testing
gnome-doc-utils
gnome-icon-theme
gnome-keyring
gnu-efi
go-rpm-macros
gom
google-api-python-client
google-crosextra-caladea-fonts
google-crosextra-carlito-fonts
google-guice
google-noto-cjk-fonts
google-noto-emoji-fonts
google-roboto-slab-fonts
gphoto2
gpm
gpsbabel
graphene
graphite2
graphviz
grubby
gsettings-desktop-schemas
gsl
gsm
gspell
gssdp
gssntlmssp
gstreamer1
gstreamer1-plugins-base
gtk-vnc
gtk2
gtk3
gtkspell
gupnp
gupnp-av
gupnp-dlna
gupnp-igd
hardening-check
hdf
hdf5
heimdal
help2man
hexedit
hicolor-icon-theme
hiera
highlight
hivex
hostname
hping3
hsakmt
htop
hunspell
hunspell-af
hunspell-ar
hunspell-as
hunspell-ast
hunspell-az
hunspell-be
hunspell-bg
hunspell-bn
hunspell-br
hunspell-ca
hunspell-cop
hunspell-csb
hunspell-cv
hunspell-cy
hunspell-da
hunspell-de
hunspell-dsb
hunspell-el
hunspell-en
hunspell-eo
hunspell-es
hunspell-et
hunspell-eu
hunspell-fa
hunspell-fj
hunspell-fo
hunspell-fr
hunspell-fur
hunspell-fy
hunspell-ga
hunspell-gd
hunspell-gl
hunspell-grc
hunspell-gu
hunspell-gv
hunspell-haw
hunspell-hi
hunspell-hil
hunspell-hr
hunspell-hsb
hunspell-ht
hunspell-hu
hunspell-hy
hunspell-ia
hunspell-id
hunspell-is
hunspell-it
hunspell-kk
hunspell-km
hunspell-kn
hunspell-ko
hunspell-ku
hunspell-ky
hunspell-la
hunspell-lb
hunspell-ln
hunspell-mai
hunspell-mg
hunspell-mi
hunspell-mk
hunspell-ml
hunspell-mn
hunspell-mos
hunspell-mr
hunspell-ms
hunspell-mt
hunspell-nds
hunspell-ne
hunspell-nl
hunspell-no
hunspell-nr
hunspell-nso
hunspell-ny
hunspell-om
hunspell-or
hunspell-pa
hunspell-pl
hunspell-pt
hunspell-quh
hunspell-ro
hunspell-ru
hunspell-rw
hunspell-se
hunspell-shs
hunspell-si
hunspell-sk
hunspell-sl
hunspell-smj
hunspell-so
hunspell-sq
hunspell-sr
hunspell-sv
hunspell-sw
hunspell-ta
hunspell-te
hunspell-tet
hunspell-th
hunspell-tk
hunspell-tl
hunspell-tn
hunspell-tpi
hunspell-ts
hunspell-uk
hunspell-uz
hunspell-ve
hunspell-vi
hunspell-wa
hunspell-xh
hunspell-yi
hwdata
hwloc
hyperscan
hyperv-daemons
hyphen
hyphen-as
hyphen-bg
hyphen-bn
hyphen-ca
hyphen-da
hyphen-de
hyphen-el
hyphen-es
hyphen-fa
hyphen-fo
hyphen-fr
hyphen-ga
hyphen-gl
hyphen-grc
hyphen-gu
hyphen-hi
hyphen-hsb
hyphen-hu
hyphen-ia
hyphen-id
hyphen-is
hyphen-it
hyphen-kn
hyphen-ku
hyphen-lt
hyphen-mi
hyphen-ml
hyphen-mn
hyphen-mr
hyphen-nl
hyphen-or
hyphen-pa
hyphen-pl
hyphen-pt
hyphen-ro
hyphen-ru
hyphen-sa
hyphen-sk
hyphen-sl
hyphen-sv
hyphen-ta
hyphen-te
hyphen-tk
hyphen-uk
ibus
ibus-chewing
ibus-hangul
ibus-kkc
ibus-libzhuyin
ibus-m17n
ibus-rawcode
ibus-sayura
ibus-table
ibus-table-chinese
icc-profiles-openicc
icon-naming-utils
icoutils
iftop
iio-sensor-proxy
ilmbase
im-chooser
imaptest
imsettings
indent
infinipath-psm
inih
iniparser
intel-cmt-cat
intel-ipsec-mb
ioping
IP2Location
ipa-pgothic-fonts
ipcalc
ipmitool
iprutils
iptraf-ng
iptstate
irssi
iscsi-initiator-utils
isns-utils
iso-codes
isomd5sum
iw
iwd
jabberpy
jasper
javapackages-bootstrap
javapackages-tools
jbigkit
jdom2
jemalloc
jfsutils
jimtcl
jose
js-jquery
jsoncpp
Judy
kata-containers
kde-filesystem
kde-settings
kexec-tools
keybinder3
keycloak-httpd-client-install
kf5
kf5-kconfig
kf5-kcoreaddons
kf5-ki18n
kf5-kwidgetsaddons
kpmcore
kronosnet
ksh
kyotocabinet
kyua
ladspa
lame
langtable
lapack
lasso
latencytop
lato-fonts
lcms2
lcov
ldns
leatherman
ledmon
lensfun
leveldb
lftp
libabw
libaec
libao
libappstream-glib
libart_lgpl
libasyncns
libatasmart
libavc1394
libblockdev
libbpf
libbsd
libburn
libbytesize
libcacard
libcanberra
libcdio
libcdio-paranoia
libcdr
libcgroup
libchewing
libcli
libcmis
libcmpiutil
libcomps
libcroco
libdaemon
libdap
libdatrie
libdazzle
libdbi
libdbi-drivers
libdbusmenu
libdc1394
libdeflate
libdmx
libdnf
libdrm
libdvdnav
libdvdread
libdwarf
libeasyfc
libecap
libecb
libell
libEMF
libeot
libepoxy
libepubgen
libesmtp
libetonyek
libev
libevdev
libewf
libexif
libexttextcat
libfabric
libfontenc
libfreehand
libftdi
libgadu
libgdither
libgee
libgee06
libgeotiff
libgexiv2
libgit2
libgit2-glib
libglade2
libglvnd
libgovirt
libgphoto2
libgsf
libgta
libguestfs
libgusb
libgxim
libgxps
libhangul
libhugetlbfs
libibcommon
libical
libICE
libicns
libid3tag
libIDL
libidn2
libiec61883
libieee1284
libimobiledevice
libindicator
libinput
libiodbc
libipt
libiptcdata
libiscsi
libisoburn
libisofs
libjcat
libkcapi
libkeepalive
libkkc
libkkc-data
libkml
liblangtag
libldb
libldm
liblerc
liblockfile
liblognorm
liblouis
liblqr-1
liblzf
libmad
libmediaart
libmicrohttpd
libmikmod
libmodman
libmodplug
libmodulemd1
libmpcdec
libmspub
libmtp
libmusicbrainz5
libmwaw
libnbd
libnet
libnetfilter_log
libnfs
libnotify
libntlm
libnumbertext
liboauth
libodfgen
libofa
libogg
liboggz
liboil
libomxil-bellagio
libopenraw
liboping
libosinfo
libotf
libotr
libpagemaker
libpaper
libpciaccess
libpeas
libpfm
libpinyin
libplist
libpmemobj-cpp
libpng12
libpng15
libproxy
libpsm2
libpwquality
libqb
libqxp
libraqm
LibRaw
libraw1394
libreport
libreswan
librevenge
librsvg2
librx
libsamplerate
libsass
libsecret
libsemanage
libsigc++20
libsigsegv
libslirp
libSM
libsmbios
libsmi
libsndfile
libsodium
libspiro
libsrtp
libssh
libstaroffice
libstemmer
libstoragemgmt
libtdb
libteam
libtevent
libthai
libtnc
libtomcrypt
libtommath
libtraceevent
libtranslit
libucil
libunicap
libuninameslist
liburing
libusbmuxd
libuser
libutempter
libvarlink
libverto
libvirt-dbus
libvirt-glib
libvirt-java
libvirt-python
libvisio
libvisual
libvoikko
libvorbis
libvpx
libwacom
libwnck3
libwpd
libwpe
libwpg
libwps
libwvstreams
libX11
libXau
libXaw
libxcb
libXcomposite
libxcrypt
libXcursor
libXdamage
libXdmcp
libXext
libxfce4util
libXfixes
libXfont2
libXft
libXi
libXinerama
libxkbcommon
libxkbfile
libxklavier
libxmlb
libXmu
libXpm
libXrandr
libXrender
libXres
libXScrnSaver
libxshmfence
libXt
libXtst
libXv
libXxf86vm
libyami
libyang
libyubikey
libzip
libzmf
lilv
linuxconsoletools
linuxptp
lksctp-tools
lldpd
lockdev
logwatch
lpsolve
lrzsz
lua
lua-expat
lua-filesystem
lua-json
lua-lpeg
lua-lunit
lua-rpm-macros
lua-term
luajit
luksmeta
lutok
lv2
lzip
lzop
m17n-db
m17n-lib
mac-robber
mailcap
mailx
malaga
malaga-suomi-voikko
mallard-rng
man-pages-cs
man-pages-es
man-pages-it
man-pages-ja
man-pages-ko
man-pages-pl
man-pages-ru
man-pages-zh-CN
mariadb-connector-c
mariadb-connector-odbc
marisa
maven-compiler-plugin
maven-jar-plugin
maven-resolver
maven-resources-plugin
maven-surefire
maven-wagon
mcelog
mcpp
mcstrans
mdadm
mdds
meanwhile
mecab
mecab-ipadic
media-player-info
memcached
memkind
mesa
mesa-libGLU
metis
microcode_ctl
microdnf
minicom
minizip
mksh
mobile-broadband-provider-info
mock
mock-core-configs
mod_auth_gssapi
mod_auth_mellon
mod_auth_openidc
mod_authnz_pam
mod_fcgid
mod_http2
mod_intercept_form_submit
mod_lookup_identity
mod_md
mod_security
mod_security_crs
mod_wsgi
mokutil
moreutils
mpage
mrtg
mstflint
mt-st
mtdev
mtools
mtr
mtx
multilib-rpm-config
munge
mutt
mythes
mythes-bg
mythes-ca
mythes-cs
mythes-da
mythes-de
mythes-el
mythes-en
mythes-eo
mythes-es
mythes-fr
mythes-ga
mythes-hu
mythes-mi
mythes-ne
mythes-nl
mythes-pl
mythes-pt
mythes-ro
mythes-ru
mythes-sk
mythes-sl
mythes-sv
mythes-uk
nbd
nbdkit
neon
netavark
netcdf
netcf
netlabel_tools
netpbm
netsniff-ng
nfs4-acl-tools
nftables
nilfs-utils
nkf
nload
nlopt
nodejs-packaging
nss-pam-ldapd
nss_nis
nss_wrapper
ntfs-3g
ntfs-3g-system-compression
numad
numatop
numpy
nvmetcli
nvml
oath-toolkit
ocaml
ocaml-alcotest
ocaml-astring
ocaml-base
ocaml-bigarray-compat
ocaml-bisect-ppx
ocaml-calendar
ocaml-camlp5
ocaml-camomile
ocaml-cinaps
ocaml-cmdliner
ocaml-compiler-libs-janestreet
ocaml-cppo
ocaml-csexp
ocaml-csv
ocaml-ctypes
ocaml-curses
ocaml-dune
ocaml-extlib
ocaml-fileutils
ocaml-findlib
ocaml-fmt
ocaml-fpath
ocaml-gettext
ocaml-integers
ocaml-libvirt
ocaml-luv
ocaml-lwt
ocaml-markup
ocaml-migrate-parsetree
ocaml-mmap
ocaml-num
ocaml-ocamlbuild
ocaml-ocplib-endian
ocaml-ounit
ocaml-parsexp
ocaml-ppx-derivers
ocaml-ppxlib
ocaml-re
ocaml-react
ocaml-result
ocaml-seq
ocaml-sexplib
ocaml-sexplib0
ocaml-stdio
ocaml-topkg
ocaml-tyxml
ocaml-uuidm
ocaml-uutf
ocaml-xml-light
ocaml-zarith
ocl-icd
oddjob
ogdi
omping
opa
opal
open-vm-tools
openblas
opencc
opencl-filesystem
opencl-headers
opencryptoki
opencsd
opendnssec
OpenEXR
openjade
openjpeg2
openmpi
openobex
openoffice-lv
openrdate
opensc
openslp
opensm
opensp
openssl
openssl-ibmpkcs11
openssl-pkcs11
openwsman
optipng
opus
opusfile
orangefs
ORBit2
orc
os-prober
osinfo-db
osinfo-db-tools
overpass-fonts
p11-kit
p7zip
pacemaker
pacrunner
pakchois
pam_krb5
pam_wrapper
papi
paps
parallel
patchelf
patchutils
pbzip2
pcp
pcsc-lite
pcsc-lite-ccid
PEGTL
perl
perl-Algorithm-C3
perl-Algorithm-Diff
perl-Alien-Build
perl-Alien-pkgconf
perl-AnyEvent
perl-AnyEvent-AIO
perl-AnyEvent-BDB
perl-App-cpanminus
perl-App-FatPacker
perl-AppConfig
perl-Archive-Extract
perl-Archive-Zip
perl-Authen-SASL
perl-B-Debug
perl-B-Hooks-EndOfScope
perl-B-Hooks-OP-Check
perl-B-Keywords
perl-B-Lint
perl-bareword-filehandles
perl-BDB
perl-Bit-Vector
perl-boolean
perl-Browser-Open
perl-BSD-Resource
perl-Business-ISBN
perl-Business-ISBN-Data
perl-Bytes-Random-Secure
perl-Capture-Tiny
perl-Carp-Clan
perl-CBOR-XS
perl-Class-Accessor
perl-Class-C3
perl-Class-C3-XS
perl-Class-Data-Inheritable
perl-Class-Factory-Util
perl-Class-Inspector
perl-Class-ISA
perl-Class-Load
perl-Class-Load-XS
perl-Class-Method-Modifiers
perl-Class-Singleton
perl-Class-Tiny
perl-Class-XSAccessor
perl-Clone
perl-Color-ANSI-Util
perl-Color-RGB-Util
perl-ColorThemeBase-Static
perl-ColorThemeRole-ANSI
perl-ColorThemes-Standard
perl-ColorThemeUtil-ANSI
perl-Compress-Bzip2
perl-Compress-LZF
perl-Compress-Raw-Lzma
perl-Config-AutoConf
perl-Config-INI
perl-Config-INI-Reader-Multiline
perl-Config-IniFiles
perl-Config-Simple
perl-Config-Tiny
perl-Const-Fast
perl-Convert-ASN1
perl-Convert-Bencode
perl-Coro
perl-Coro-Multicore
perl-CPAN-Changes
perl-CPAN-DistnameInfo
perl-CPAN-Meta-Check
perl-Cpanel-JSON-XS
perl-Crypt-CBC
perl-Crypt-DES
perl-Crypt-IDEA
perl-Crypt-OpenSSL-Bignum
perl-Crypt-OpenSSL-Guess
perl-Crypt-OpenSSL-Random
perl-Crypt-OpenSSL-RSA
perl-Crypt-PasswdMD5
perl-Crypt-Random-Seed
perl-CSS-Tiny
perl-Data-Dump
perl-Data-Munge
perl-Data-OptList
perl-Data-Peek
perl-Data-Section
perl-Data-UUID
perl-Date-Calc
perl-Date-ISO8601
perl-Date-Manip
perl-DateTime
perl-DateTime-Format-Builder
perl-DateTime-Format-DateParse
perl-DateTime-Format-HTTP
perl-DateTime-Format-IBeat
perl-DateTime-Format-ISO8601
perl-DateTime-Format-Mail
perl-DateTime-Format-Strptime
perl-DateTime-Locale
perl-DateTime-TimeZone
perl-DateTime-TimeZone-SystemV
perl-DateTime-TimeZone-Tzfile
perl-DBD-MySQL
perl-Devel-CallChecker
perl-Devel-Caller
perl-Devel-CheckBin
perl-Devel-CheckLib
perl-Devel-Cycle
perl-Devel-EnforceEncapsulation
perl-Devel-GlobalDestruction
perl-Devel-GlobalDestruction-XS
perl-Devel-Hide
perl-Devel-Leak
perl-Devel-LexAlias
perl-Devel-Size
perl-Devel-StackTrace
perl-Devel-Symdump
perl-Digest-BubbleBabble
perl-Digest-CRC
perl-Digest-HMAC
perl-Digest-SHA1
perl-Dist-CheckConflicts
perl-DynaLoader-Functions
perl-Email-Address
perl-Email-Date-Format
perl-Encode-Detect
perl-Encode-EUCJPASCII
perl-Encode-IMAPUTF7
perl-Encode-Locale
perl-Env-ShellWords
perl-Error
perl-EV
perl-Eval-Closure
perl-Event
perl-Exception-Class
perl-Expect
perl-ExtUtils-Config
perl-ExtUtils-Depends
perl-ExtUtils-Helpers
perl-ExtUtils-InstallPaths
perl-ExtUtils-PkgConfig
perl-FCGI
perl-Fedora-VSP
perl-FFI-CheckLib
perl-File-BaseDir
perl-File-BOM
perl-File-chdir
perl-File-CheckTree
perl-File-Copy-Recursive
perl-File-DesktopEntry
perl-File-Find-Object
perl-File-Find-Object-Rule
perl-File-Find-Rule
perl-File-Find-Rule-Perl
perl-File-Inplace
perl-File-Listing
perl-File-MimeInfo
perl-File-pushd
perl-File-ReadBackwards
perl-File-Remove
perl-File-ShareDir
perl-File-ShareDir-Install
perl-File-Slurp
perl-File-Slurp-Tiny
perl-File-Slurper
perl-File-Type
perl-Font-TTF
perl-FreezeThaw
perl-GD
perl-GD-Barcode
perl-generators
perl-Getopt-ArgvFile
perl-gettext
perl-Graphics-ColorNamesLite-WWW
perl-GSSAPI
perl-Guard
perl-Hook-LexWrap
perl-HTML-Parser
perl-HTML-Tagset
perl-HTML-Tree
perl-HTTP-Cookies
perl-HTTP-Daemon
perl-HTTP-Date
perl-HTTP-Message
perl-HTTP-Negotiate
perl-Image-Base
perl-Image-Info
perl-Image-Xbm
perl-Image-Xpm
perl-Import-Into
perl-Importer
perl-inc-latest
perl-indirect
perl-Inline-Files
perl-IO-AIO
perl-IO-All
perl-IO-CaptureOutput
perl-IO-Compress-Lzma
perl-IO-HTML
perl-IO-Multiplex
perl-IO-SessionData
perl-IO-Socket-INET6
perl-IO-String
perl-IO-stringy
perl-IO-Tty
perl-IPC-Run
perl-IPC-Run3
perl-IPC-System-Simple
perl-JSON
perl-JSON-Color
perl-JSON-MaybeXS
perl-LDAP
perl-libnet
perl-libwww-perl
perl-libxml-perl
perl-Lingua-EN-Inflect
perl-List-MoreUtils-XS
perl-local-lib
perl-Locale-Codes
perl-Locale-Maketext-Gettext
perl-Locale-Msgfmt
perl-Locale-PO
perl-Log-Message
perl-Log-Message-Simple
perl-LWP-MediaTypes
perl-LWP-Protocol-https
perl-Mail-AuthenticationResults
perl-Mail-DKIM
perl-Mail-IMAPTalk
perl-Mail-SPF
perl-MailTools
perl-Math-Int64
perl-Math-Random-ISAAC
perl-MIME-Charset
perl-MIME-Lite
perl-MIME-Types
perl-Mixin-Linewise
perl-MLDBM
perl-Mock-Config
perl-Module-Build-Tiny
perl-Module-CPANfile
perl-Module-Implementation
perl-Module-Install-AuthorRequires
perl-Module-Install-AuthorTests
perl-Module-Install-AutoLicense
perl-Module-Install-GithubMeta
perl-Module-Install-ManifestSkip
perl-Module-Install-ReadmeFromPod
perl-Module-Install-ReadmeMarkdownFromPod
perl-Module-Install-Repository
perl-Module-Install-TestBase
perl-Module-Load-Util
perl-Module-Manifest
perl-Module-Manifest-Skip
perl-Module-Package
perl-Module-Package-Au
perl-Module-Pluggable
perl-Module-Runtime
perl-Module-Signature
perl-Mojolicious
perl-Moo
perl-Mozilla-CA
perl-Mozilla-LDAP
perl-MRO-Compat
perl-multidimensional
perl-namespace-autoclean
perl-namespace-clean
perl-Net-CIDR-Lite
perl-Net-Daemon
perl-Net-DNS
perl-Net-DNS-Resolver-Mock
perl-Net-DNS-Resolver-Programmable
perl-Net-HTTP
perl-Net-IMAP-Simple
perl-Net-IMAP-Simple-SSL
perl-Net-IP
perl-Net-LibIDN2
perl-Net-Patricia
perl-Net-SMTP-SSL
perl-Net-SNMP
perl-Net-Telnet
perl-Newt
perl-NNTPClient
perl-NTLM
perl-Number-Compare
perl-Object-Deadly
perl-Object-HashBase
perl-Package-Anon
perl-Package-Constants
perl-Package-DeprecationManager
perl-Package-Generator
perl-Package-Stash
perl-Package-Stash-XS
perl-PadWalker
perl-Paper-Specs
perl-PAR-Dist
perl-Parallel-Iterator
perl-Params-Classify
perl-Params-Util
perl-Params-Validate
perl-Params-ValidationCompiler
perl-Parse-PMFile
perl-Parse-RecDescent
perl-Parse-Yapp
perl-Path-Tiny
perl-Perl-Critic
perl-Perl-Critic-More
perl-Perl-Destruct-Level
perl-Perl-MinimumVersion
perl-Perl4-CoreLibs
perl-PerlIO-gzip
perl-PerlIO-utf8_strict
perl-PkgConfig-LibPkgConf
perl-Pod-Coverage
perl-Pod-Coverage-TrustPod
perl-Pod-Escapes
perl-Pod-Eventual
perl-Pod-LaTeX
perl-Pod-Markdown
perl-Pod-Parser
perl-Pod-Plainer
perl-Pod-POM
perl-Pod-Spell
perl-PPI
perl-PPI-HTML
perl-PPIx-QuoteLike
perl-PPIx-Regexp
perl-PPIx-Utilities
perl-prefork
perl-Probe-Perl
perl-Razor-Agent
perl-Readonly
perl-Readonly-XS
perl-Ref-Util
perl-Ref-Util-XS
perl-Regexp-Pattern-Perl
perl-Return-MultiLevel
perl-Role-Tiny
perl-Scope-Guard
perl-Scope-Upper
perl-SGMLSpm
perl-SNMP_Session
perl-Socket6
perl-Software-License
perl-Sort-Versions
perl-Specio
perl-Spiffy
perl-strictures
perl-String-CRC32
perl-String-Format
perl-String-ShellQuote
perl-String-Similarity
perl-Sub-Exporter
perl-Sub-Exporter-Progressive
perl-Sub-Identify
perl-Sub-Info
perl-Sub-Install
perl-Sub-Name
perl-Sub-Quote
perl-Sub-Uplevel
perl-SUPER
perl-Switch
perl-Syntax-Highlight-Engine-Kate
perl-Sys-CPU
perl-Sys-MemInfo
perl-Sys-Virt
perl-Taint-Runtime
perl-Task-Weaken
perl-Term-Size-Any
perl-Term-Size-Perl
perl-Term-Table
perl-Term-UI
perl-TermReadKey
perl-Test-Base
perl-Test-ClassAPI
perl-Test-CPAN-Meta
perl-Test-CPAN-Meta-JSON
perl-Test-Deep
perl-Test-Differences
perl-Test-DistManifest
perl-Test-Distribution
perl-Test-EOL
perl-Test-Exception
perl-Test-Exit
perl-Test-FailWarnings
perl-Test-Fatal
perl-Test-File
perl-Test-File-ShareDir
perl-Test-Harness
perl-Test-HasVersion
perl-Test-InDistDir
perl-Test-Inter
perl-Test-LeakTrace
perl-Test-LongString
perl-Test-Manifest
perl-Test-Memory-Cycle
perl-Test-MinimumVersion
perl-Test-MockObject
perl-Test-MockRandom
perl-Test-Needs
perl-Test-NoTabs
perl-Test-NoWarnings
perl-Test-Object
perl-Test-Output
perl-Test-Pod
perl-Test-Pod-Coverage
perl-Test-Portability-Files
perl-Test-Requires
perl-Test-RequiresInternet
perl-Test-Script
perl-Test-Simple
perl-Test-SubCalls
perl-Test-Synopsis
perl-Test-Taint
perl-Test-TrailingSpace
perl-Test-utf8
perl-Test-Vars
perl-Test-Warn
perl-Test-Without-Module
perl-Test2-Plugin-NoWarnings
perl-Test2-Suite
perl-Test2-Tools-Explain
perl-Text-CharWidth
perl-Text-CSV_XS
perl-Text-Diff
perl-Text-Glob
perl-Text-Iconv
perl-Text-Soundex
perl-Text-Unidecode
perl-Text-WrapI18N
perl-Tie-IxHash
perl-Time-Duration
perl-TimeDate
perl-Tree-DAG_Node
perl-Unicode-EastAsianWidth
perl-Unicode-LineBreak
perl-Unicode-Map8
perl-Unicode-String
perl-Unicode-UTF8
perl-UNIVERSAL-can
perl-UNIVERSAL-isa
perl-Unix-Syslog
perl-URI
perl-Variable-Magic
perl-Version-Requirements
perl-WWW-RobotRules
perl-XML-Catalog
perl-XML-DOM
perl-XML-Dumper
perl-XML-Filter-BufferText
perl-XML-Generator
perl-XML-Grove
perl-XML-Handler-YAWriter
perl-XML-LibXML
perl-XML-LibXSLT
perl-XML-NamespaceSupport
perl-XML-Parser-Lite
perl-XML-RegExp
perl-XML-SAX
perl-XML-SAX-Base
perl-XML-SAX-Writer
perl-XML-Simple
perl-XML-TokeParser
perl-XML-TreeBuilder
perl-XML-Twig
perl-XML-Writer
perl-XML-XPath
perl-XML-XPathEngine
perl-XString
perl-YAML-LibYAML
perl-YAML-PP
perl-YAML-Syck
perltidy
pesign
phodav
php
php-pear
php-pecl-zip
physfs
picosat
pinfo
pipewire
pixman
pkcs11-helper
pkgconf
plexus-cipher
plexus-containers
plexus-sec-dispatcher
plotutils
pmdk-convert
pmix
pngcrush
pngnq
po4a
podman
poetry
policycoreutils
polkit-pkla-compat
portreserve
postfix
potrace
powertop
ppp
pps-tools
pptp
priv_wrapper
procmail
prometheus
prometheus-node-exporter
ps_mem
psacct
psutils
ptlib
publicsuffix-list
pugixml
pulseaudio
puppet
pwgen
pyatspi
pybind11
pycairo
pyelftools
pyflakes
pygobject3
PyGreSQL
pykickstart
pylint
pyparted
pyproject-rpm-macros
pyserial
python-absl-py
python-aiodns
python-aiohttp
python-alsa
python-argcomplete
python-astroid
python-astunparse
python-async-generator
python-augeas
python-azure-sdk
python-beautifulsoup4
python-betamax
python-blinker
python-blivet
python-cached_property
python-charset-normalizer
python-cheetah
python-click
python-cmd2
python-colorama
python-CommonMark
python-conda-package-handling
python-configshell
python-cpuinfo
python-cups
python-curio
python-cytoolz
python-d2to1
python-dbus-client-gen
python-dbus-python-client-gen
python-dbus-signature-pyparsing
python-dbusmock
python-ddt
python-debtcollector
python-decorator
python-distlib
python-dmidecode
python-dns
python-dtopt
python-dulwich
python-enchant
python-entrypoints
python-ethtool
python-evdev
python-extras
python-faker
python-fasteners
python-fields
python-filelock
python-fixtures
python-flake8
python-flask
python-flit
python-flit-core
python-fluidity-sm
python-frozendict
python-funcsigs
python-gast
python-genshi
python-google-auth
python-google-auth-oauthlib
python-greenlet
python-gssapi
python-h5py
python-hs-dbus-signature
python-html5lib
python-httplib2
python-humanize
python-hwdata
python-importlib-metadata
python-inotify
python-into-dbus-python
python-IPy
python-iso8601
python-isodate
python-isort
python-itsdangerous
python-junit-xml
python-justbases
python-justbytes
python-jwcrypto
python-jwt
python-kdcproxy
python-kerberos
python-kmod
python-kubernetes
python-lazy-object-proxy
python-ldap
python-linux-procfs
python-lit
python-markdown
python-mccabe
python-memcached
python-mimeparse
python-mock
python-monotonic
python-more-itertools
python-mpmath
python-msal
python-msrestazure
python-mutagen
python-networkx
python-nose2
python-ntlm-auth
python-oauth2client
python-openpyxl
python-openstackdocstheme
python-oslo-i18n
python-oslo-sphinx
python-paramiko
python-pefile
python-pexpect
python-pkgconfig
python-platformdirs
python-pluggy
python-podman-api
python-process-tests
python-productmd
python-ptyprocess
python-pycares
python-pycosat
python-pydbus
python-pymongo
python-PyMySQL
python-pyperclip
python-pyroute2
python-pyrsistent
python-pysocks
python-pytest-benchmark
python-pytest-cov
python-pytest-expect
python-pytest-flake8
python-pytest-forked
python-pytest-mock
python-pytest-relaxed
python-pytest-runner
python-pytest-subtests
python-pytest-timeout
python-pytest-xdist
python-pytoml
python-pyudev
python-pywbem
python-qrcode
python-rdflib
python-recommonmark
python-redis
python-requests-file
python-requests-ftp
python-requests-kerberos
python-requests-mock
python-requests-oauthlib
python-requests-toolbelt
python-requests_ntlm
python-responses
python-retrying
python-rfc3986
python-rpm-generators
python-rpmfluff
python-rtslib
python-ruamel-yaml
python-ruamel-yaml-clib
python-s3transfer
python-schedutils
python-semantic_version
python-should_dsl
python-simpleline
python-slip
python-sniffio
python-soupsieve
python-sphinx
python-sphinx-epytext
python-sphinx-theme-py3doc-enhanced
python-sphinx_rtd_theme
python-sphinxcontrib-apidoc
python-sphinxcontrib-applehelp
python-sphinxcontrib-devhelp
python-sphinxcontrib-htmlhelp
python-sphinxcontrib-httpdomain
python-sphinxcontrib-jsmath
python-sphinxcontrib-qthelp
python-sphinxcontrib-serializinghtml
python-sqlalchemy
python-suds
python-systemd
python-tempita
python-templated-dictionary
python-termcolor
python-testpath
python-testresources
python-testscenarios
python-testtools
python-tidy
python-toml
python-tomli
python-toolz
python-tornado
python-tox
python-tox-current-env
python-tqdm
python-trio
python-typing-extensions
python-uamqp
python-unittest2
python-uritemplate
python-urwid
python-varlink
python-virt-firmware
python-voluptuous
python-waitress
python-webencodings
python-webtest
python-wheel
python-whoosh
python-winrm
python-wrapt
python-xmltodict
python-yubico
python-zipp
python-zmq
python3-mallard-ducktype
python3-pytest-asyncio
python3-typed_ast
pyusb
pywbem
pyxattr
qemu
qhull
qpdf
qperf
qr-code-generator
qt5-qtbase
qt5-qtconnectivity
qt5-qtdeclarative
qt5-qtsensors
qt5-qtserialport
qt5-qtsvg
qt5-qttools
qt5-rpm-macros
quagga
quota
quotatool
radvd
ragel
raptor2
rarian
rasdaemon
rasqal
rcs
rdist
rdma-core
re2
re2c
realmd
rear
recode
redland
resource-agents
rest
rhash
rlwrap
rp-pppoe
rpm-mpi-hooks
rpmdevtools
rpmlint
rtkit
rtl-sdr
ruby-augeas
rubygem-bson
rubygem-coderay
rubygem-diff-lcs
rubygem-flexmock
rubygem-hpricot
rubygem-introspection
rubygem-liquid
rubygem-maruku
rubygem-metaclass
rubygem-mongo
rubygem-mustache
rubygem-mysql2
rubygem-pkg-config
rubygem-rake
rubygem-rake-compiler
rubygem-ronn
rubygem-rouge
rubygem-rspec
rubygem-rspec-expectations
rubygem-rspec-mocks
rubygem-rspec-support
rubygem-thread_order
rusers
rust-cbindgen
samba
sanlock
sassist
satyr
sbc
sblim-cim-client2
sblim-cmpi-base
sblim-cmpi-devel
sblim-cmpi-fsvol
sblim-cmpi-network
sblim-cmpi-nfsv3
sblim-cmpi-nfsv4
sblim-cmpi-params
sblim-cmpi-sysfs
sblim-cmpi-syslog
sblim-indication_helper
sblim-sfcb
sblim-sfcc
sblim-sfcCommon
sblim-testsuite
sblim-wbemcli
scl-utils
scotch
screen
scrub
SDL
SDL2
SDL_sound
sdparm
seabios
secilc
selinux-policy
sendmail
serd
setools
setserial
setuptool
sgabios
sgml-common
sgpio
shared-mime-info
sharutils
sip
sisu
skkdic
sleuthkit
slirp4netns
smartmontools
smc-tools
socket_wrapper
softhsm
sombok
sord
sos
sound-theme-freedesktop
soundtouch
sox
soxr
sparsehash
spausedd
speex
speexdsp
spice-protocol
spice-vdagent
spirv-headers
spirv-tools
splix
squashfs-tools
squid
sratom
sscg
star
startup-notification
stunnel
subscription-manager
suitesparse
SuperLU
supermin
switcheroo-control
symlinks
sympy
sysfsutils
systemd-bootchart
t1lib
t1utils
taglib
tang
targetcli
tbb
tcl-pgtcl
tclx
teckit
telnet
tidy
time
tini
tinycdb
tix
tk
tlog
tmpwatch
tn5250
tofrodos
tokyocabinet
tpm-quote-tools
tpm-tools
tss2
ttembed
ttmkfdir
tuna
twolame
uchardet
uclibc-ng
ucpp
ucs-miscfixed-fonts
ucx
udftools
udica
udisks2
uglify-js
uid_wrapper
unicode-emoji
unicode-ucd
unique3
units
upower
uriparser
urlview
usb_modeswitch
usb_modeswitch-data
usbguard
usbip
usbmuxd
usbredir
usermode
ustr
uthash
uuid
uw-imap
v4l-utils
vhostmd
vino
virglrenderer
virt-p2v
virt-top
virt-what
virt-who
virtiofsd
vitess
vmem
volume_key
vorbis-tools
vte291
vulkan-headers
vulkan-loader
watchdog
wavpack
wayland
wayland-protocols
web-assets
webrtc-audio-processing
websocketpp
whois
wireguard-tools
wireless-regdb
wireshark
woff2
wordnet
words
wpebackend-fdo
wsmancli
wvdial
x3270
xapian-core
Xaw3d
xcb-proto
xcb-util
xcb-util-image
xcb-util-keysyms
xcb-util-renderutil
xcb-util-wm
xdelta
xdg-dbus-proxy
xdg-utils
xerces-c
xfconf
xfsdump
xhtml1-dtds
xkeyboard-config
xmlstarlet
xmltoman
xmvn
xorg-x11-apps
xorg-x11-drv-libinput
xorg-x11-font-utils
xorg-x11-fonts
xorg-x11-proto-devel
xorg-x11-server
xorg-x11-server-utils
xorg-x11-util-macros
xorg-x11-utils
xorg-x11-xauth
xorg-x11-xbitmaps
xorg-x11-xinit
xorg-x11-xkb-utils
xorg-x11-xtrans-devel
xrestop
xterm
xxhash
yajl
yaml-cpp
yasm
yelp-tools
yelp-xsl
ykclient
yp-tools
ypbind
ypserv
z3
zenity
zerofree
zfs-fuse
zipper
zopfli
zziplib | +| Fedora | [Fedora MIT License Declaration](https://fedoraproject.org/wiki/Licensing:Main?rd=Licensing#License_of_Fedora_SPEC_Files) | a52dec
abseil-cpp
accountsservice
acpica-tools
acpid
adcli
adobe-mappings-cmap
adobe-mappings-pdf
advancecomp
adwaita-icon-theme
afflib
aide
alsa-firmware
alsa-plugins
amtk
amtterm
annobin
ansible-freeipa
archivemount
argparse-manpage
arptables
arpwatch
asio
aspell
aspell-en
at
at-spi2-atk
at-spi2-core
atf
atk
atop
attr
audiofile
augeas
authbind
authd
authselect
autoconf213
avahi
babeltrace
babeltrace2
babl
baekmuk-ttf-fonts
bats
bcache-tools
biosdevname
blosc
bluez
bmake
bogofilter
bolt
boom-boot
booth
botan2
breezy
brotli
buildah
busybox
bwidget
byacc
ca-certificates
cachefilesd
cairomm
calamares
capstone
catatonit
catch
catch1
cdrdao
celt051
cereal
certmonger
cfitsio
cgdcbxd
chan
CharLS
checkpolicy
checksec
chrony
cim-schema
cjkuni-uming-fonts
cjose
cldr-emoji-annotation
clucene
clutter
clutter-gst3
clutter-gtk
cmocka
cogl
collectd
colm
color-filesystem
colord
colorize
compat-lua
compiler-rt
conda
conmon
conntrack-tools
console-setup
container-exception-logger
containernetworking-plugins
convmv
corosync
corosync-qdevice
cpp-hocon
cppcheck
cpprest
cpptest
cpuid
criu
crypto-policies
cryptsetup
cscope
ctags
CUnit
cups
custodia
Cython
dbus-c++
dbus-python
dbxtool
dconf
dcraw
debootstrap
deltarpm
desktop-file-utils
device-mapper-persistent-data
dietlibc
diffstat
ding-libs
discount
distribution-gpg-keys
dleyna-connector-dbus
dleyna-core
dmraid
dnf
dnf-plugins-core
docbook-dtds
docbook-simple
docbook-slides
docbook-style-dsssl
docbook-utils
docbook2X
docbook5-schemas
docbook5-style-xsl
dogtail
dos2unix
dotconf
double-conversion
dovecot
dpdk
dpkg
driverctl
dropwatch
drpm
dumpet
dvd+rw-tools
dwarves
dwz
dyninst
ebtables
edac-utils
edk2
efax
efi-rpm-macros
egl-wayland
eglexternalplatform
elinks
enca
enchant
enchant2
enscript
environment-modules
evemu
execstack
exempi
exiv2
extra-cmake-modules
fabtests
facter
fakechroot
fakeroot
fapolicyd
fdk-aac-free
fdupes
fence-virt
fetchmail
fftw
filebench
fio
fipscheck
firewalld
fish
flac
flatbuffers
flite
fltk
fmt
fontawesome-fonts
fontpackages
fonts-rpm-macros
foomatic-db
freeglut
freeipmi
freeradius
freetds
freexl
fribidi
fros
frr
fsverity-utils
fuse-overlayfs
fuse-sshfs
fuse-zip
fuse3
future
fxload
gavl
gconf-editor
GConf2
gcovr
gcr
gdal
gdisk
gdk-pixbuf2
generic-logos
genwqe-tools
geoclue2
GeoIP
GeoIP-GeoLite-data
geolite2
geos
gfs2-utils
ghc-srpm-macros
giflib
gl-manpages
glew
glm
glog
glusterfs
gnome-desktop-testing
gnome-doc-utils
gnome-icon-theme
gnome-keyring
gnu-efi
go-rpm-macros
gom
google-api-python-client
google-crosextra-caladea-fonts
google-crosextra-carlito-fonts
google-guice
google-noto-cjk-fonts
google-noto-emoji-fonts
google-roboto-slab-fonts
gphoto2
gpm
gpsbabel
graphene
graphite2
graphviz
grubby
gsettings-desktop-schemas
gsl
gsm
gspell
gssdp
gssntlmssp
gstreamer1
gstreamer1-plugins-base
gtk-vnc
gtk2
gtk3
gtkspell
gupnp
gupnp-av
gupnp-dlna
gupnp-igd
hardening-check
hdf
hdf5
heimdal
help2man
hexedit
hicolor-icon-theme
hiera
highlight
hivex
hostname
hping3
hsakmt
htop
hunspell
hunspell-af
hunspell-ar
hunspell-as
hunspell-ast
hunspell-az
hunspell-be
hunspell-bg
hunspell-bn
hunspell-br
hunspell-ca
hunspell-cop
hunspell-csb
hunspell-cv
hunspell-cy
hunspell-da
hunspell-de
hunspell-dsb
hunspell-el
hunspell-en
hunspell-eo
hunspell-es
hunspell-et
hunspell-eu
hunspell-fa
hunspell-fj
hunspell-fo
hunspell-fr
hunspell-fur
hunspell-fy
hunspell-ga
hunspell-gd
hunspell-gl
hunspell-grc
hunspell-gu
hunspell-gv
hunspell-haw
hunspell-hi
hunspell-hil
hunspell-hr
hunspell-hsb
hunspell-ht
hunspell-hu
hunspell-hy
hunspell-ia
hunspell-id
hunspell-is
hunspell-it
hunspell-kk
hunspell-km
hunspell-kn
hunspell-ko
hunspell-ku
hunspell-ky
hunspell-la
hunspell-lb
hunspell-ln
hunspell-mai
hunspell-mg
hunspell-mi
hunspell-mk
hunspell-ml
hunspell-mn
hunspell-mos
hunspell-mr
hunspell-ms
hunspell-mt
hunspell-nds
hunspell-ne
hunspell-nl
hunspell-no
hunspell-nr
hunspell-nso
hunspell-ny
hunspell-om
hunspell-or
hunspell-pa
hunspell-pl
hunspell-pt
hunspell-quh
hunspell-ro
hunspell-ru
hunspell-rw
hunspell-se
hunspell-shs
hunspell-si
hunspell-sk
hunspell-sl
hunspell-smj
hunspell-so
hunspell-sq
hunspell-sr
hunspell-sv
hunspell-sw
hunspell-ta
hunspell-te
hunspell-tet
hunspell-th
hunspell-tk
hunspell-tl
hunspell-tn
hunspell-tpi
hunspell-ts
hunspell-uk
hunspell-uz
hunspell-ve
hunspell-vi
hunspell-wa
hunspell-xh
hunspell-yi
hwdata
hwloc
hyperscan
hyperv-daemons
hyphen
hyphen-as
hyphen-bg
hyphen-bn
hyphen-ca
hyphen-da
hyphen-de
hyphen-el
hyphen-es
hyphen-fa
hyphen-fo
hyphen-fr
hyphen-ga
hyphen-gl
hyphen-grc
hyphen-gu
hyphen-hi
hyphen-hsb
hyphen-hu
hyphen-ia
hyphen-id
hyphen-is
hyphen-it
hyphen-kn
hyphen-ku
hyphen-lt
hyphen-mi
hyphen-ml
hyphen-mn
hyphen-mr
hyphen-nl
hyphen-or
hyphen-pa
hyphen-pl
hyphen-pt
hyphen-ro
hyphen-ru
hyphen-sa
hyphen-sk
hyphen-sl
hyphen-sv
hyphen-ta
hyphen-te
hyphen-tk
hyphen-uk
ibus
ibus-chewing
ibus-hangul
ibus-kkc
ibus-libzhuyin
ibus-m17n
ibus-rawcode
ibus-sayura
ibus-table
ibus-table-chinese
icc-profiles-openicc
icon-naming-utils
icoutils
iftop
iio-sensor-proxy
ilmbase
im-chooser
imaptest
imsettings
indent
infinipath-psm
inih
iniparser
intel-cmt-cat
intel-ipsec-mb
ioping
IP2Location
ipa-pgothic-fonts
ipcalc
ipmitool
iprutils
iptraf-ng
iptstate
irssi
iscsi-initiator-utils
isns-utils
iso-codes
isomd5sum
iw
iwd
jabberpy
jasper
javapackages-bootstrap
javapackages-tools
jbigkit
jdom2
jemalloc
jfsutils
jimtcl
jose
js-jquery
jsoncpp
Judy
kata-containers
kde-filesystem
kde-settings
kexec-tools
keybinder3
keycloak-httpd-client-install
kf5
kf5-kconfig
kf5-kcoreaddons
kf5-ki18n
kf5-kwidgetsaddons
kpmcore
kronosnet
ksh
kyotocabinet
kyua
ladspa
lame
langtable
lapack
lasso
latencytop
lato-fonts
lcms2
lcov
ldns
leatherman
ledmon
lensfun
leveldb
lftp
libabw
libaec
libao
libappstream-glib
libart_lgpl
libasyncns
libatasmart
libavc1394
libblockdev
libbpf
libbsd
libburn
libbytesize
libcacard
libcanberra
libcdio
libcdio-paranoia
libcdr
libcgroup
libchewing
libcli
libcmis
libcmpiutil
libcomps
libcroco
libdaemon
libdap
libdatrie
libdazzle
libdbi
libdbi-drivers
libdbusmenu
libdc1394
libdeflate
libdmx
libdnf
libdrm
libdvdnav
libdvdread
libdwarf
libeasyfc
libecap
libecb
libell
libEMF
libeot
libepoxy
libepubgen
libesmtp
libetonyek
libev
libevdev
libewf
libexif
libexttextcat
libfabric
libfontenc
libfreehand
libftdi
libgadu
libgdither
libgee
libgee06
libgeotiff
libgexiv2
libgit2
libgit2-glib
libglade2
libglvnd
libgovirt
libgphoto2
libgsf
libgta
libguestfs
libgusb
libgxim
libgxps
libhangul
libhugetlbfs
libibcommon
libical
libICE
libicns
libid3tag
libIDL
libidn2
libiec61883
libieee1284
libimobiledevice
libindicator
libinput
libiodbc
libipt
libiptcdata
libiscsi
libisoburn
libisofs
libjcat
libkcapi
libkeepalive
libkkc
libkkc-data
libkml
liblangtag
libldb
libldm
liblerc
liblockfile
liblognorm
liblouis
liblqr-1
liblzf
libmad
libmediaart
libmicrohttpd
libmikmod
libmodman
libmodplug
libmodulemd1
libmpcdec
libmspub
libmtp
libmusicbrainz5
libmwaw
libnbd
libnet
libnetfilter_log
libnfs
libnotify
libntlm
libnumbertext
liboauth
libodfgen
libofa
libogg
liboggz
liboil
libomxil-bellagio
libopenraw
liboping
libosinfo
libotf
libotr
libpagemaker
libpaper
libpciaccess
libpeas
libpfm
libpinyin
libplist
libpmemobj-cpp
libpng12
libpng15
libproxy
libpsm2
libpwquality
libqb
libqxp
libraqm
LibRaw
libraw1394
libreport
libreswan
librevenge
librsvg2
librx
libsamplerate
libsass
libsecret
libsemanage
libsigc++20
libsigsegv
libslirp
libSM
libsmbios
libsmi
libsndfile
libsodium
libspiro
libsrtp
libssh
libstaroffice
libstemmer
libstoragemgmt
libtdb
libteam
libtevent
libthai
libtnc
libtomcrypt
libtommath
libtraceevent
libtranslit
libucil
libunicap
libuninameslist
liburing
libusbmuxd
libuser
libutempter
libvarlink
libverto
libvirt-dbus
libvirt-glib
libvirt-java
libvirt-python
libvisio
libvisual
libvoikko
libvorbis
libvpx
libwacom
libwnck3
libwpd
libwpe
libwpg
libwps
libwvstreams
libX11
libXau
libXaw
libxcb
libXcomposite
libxcrypt
libXcursor
libXdamage
libXdmcp
libXext
libxfce4util
libXfixes
libXfont2
libXft
libXi
libXinerama
libxkbcommon
libxkbfile
libxklavier
libxmlb
libXmu
libXpm
libXrandr
libXrender
libXres
libXScrnSaver
libxshmfence
libXt
libXtst
libXv
libXxf86vm
libyami
libyang
libyubikey
libzip
libzmf
lilv
linuxconsoletools
linuxptp
lksctp-tools
lldpd
lockdev
logwatch
lpsolve
lrzsz
lua
lua-expat
lua-filesystem
lua-json
lua-lpeg
lua-lunit
lua-rpm-macros
lua-term
luajit
luksmeta
lutok
lv2
lzip
lzop
m17n-db
m17n-lib
mac-robber
mailcap
mailx
malaga
malaga-suomi-voikko
mallard-rng
man-pages-cs
man-pages-es
man-pages-it
man-pages-ja
man-pages-ko
man-pages-pl
man-pages-ru
man-pages-zh-CN
mariadb-connector-c
mariadb-connector-odbc
marisa
maven-compiler-plugin
maven-jar-plugin
maven-resolver
maven-resources-plugin
maven-surefire
maven-wagon
mcelog
mcpp
mcstrans
mdadm
mdds
meanwhile
mecab
mecab-ipadic
media-player-info
memcached
memkind
mesa
mesa-libGLU
metis
microcode_ctl
microdnf
minicom
minizip
mksh
mobile-broadband-provider-info
mock
mock-core-configs
mod_auth_gssapi
mod_auth_mellon
mod_auth_openidc
mod_authnz_pam
mod_fcgid
mod_http2
mod_intercept_form_submit
mod_lookup_identity
mod_md
mod_security
mod_security_crs
mod_wsgi
mokutil
moreutils
mpage
mrtg
mstflint
mt-st
mtdev
mtools
mtr
mtx
multilib-rpm-config
munge
mutt
mythes
mythes-bg
mythes-ca
mythes-cs
mythes-da
mythes-de
mythes-el
mythes-en
mythes-eo
mythes-es
mythes-fr
mythes-ga
mythes-hu
mythes-mi
mythes-ne
mythes-nl
mythes-pl
mythes-pt
mythes-ro
mythes-ru
mythes-sk
mythes-sl
mythes-sv
mythes-uk
nbd
nbdkit
neon
netavark
netcdf
netcf
netlabel_tools
netpbm
netsniff-ng
nfs4-acl-tools
nftables
nilfs-utils
nkf
nload
nlopt
nodejs-packaging
nss-mdns
nss-pam-ldapd
nss_nis
nss_wrapper
ntfs-3g
ntfs-3g-system-compression
numad
numatop
numpy
nvmetcli
nvml
oath-toolkit
ocaml
ocaml-alcotest
ocaml-astring
ocaml-base
ocaml-bigarray-compat
ocaml-bisect-ppx
ocaml-calendar
ocaml-camlp5
ocaml-camomile
ocaml-cinaps
ocaml-cmdliner
ocaml-compiler-libs-janestreet
ocaml-cppo
ocaml-csexp
ocaml-csv
ocaml-ctypes
ocaml-curses
ocaml-dune
ocaml-extlib
ocaml-fileutils
ocaml-findlib
ocaml-fmt
ocaml-fpath
ocaml-gettext
ocaml-integers
ocaml-libvirt
ocaml-luv
ocaml-lwt
ocaml-markup
ocaml-migrate-parsetree
ocaml-mmap
ocaml-num
ocaml-ocamlbuild
ocaml-ocplib-endian
ocaml-ounit
ocaml-parsexp
ocaml-ppx-derivers
ocaml-ppxlib
ocaml-re
ocaml-react
ocaml-result
ocaml-seq
ocaml-sexplib
ocaml-sexplib0
ocaml-stdio
ocaml-topkg
ocaml-tyxml
ocaml-uuidm
ocaml-uutf
ocaml-xml-light
ocaml-zarith
ocl-icd
oddjob
ogdi
omping
opa
opal
open-vm-tools
openblas
opencc
opencl-filesystem
opencl-headers
opencryptoki
opencsd
opendnssec
OpenEXR
openjade
openjpeg2
openmpi
openobex
openoffice-lv
openrdate
opensc
openslp
opensm
opensp
openssl
openssl-ibmpkcs11
openssl-pkcs11
openwsman
optipng
opus
opusfile
orangefs
ORBit2
orc
os-prober
osinfo-db
osinfo-db-tools
overpass-fonts
p11-kit
p7zip
pacemaker
pacrunner
pakchois
pam_krb5
pam_wrapper
papi
paps
parallel
patchelf
patchutils
pbzip2
pcp
pcsc-lite
pcsc-lite-ccid
PEGTL
perl
perl-Algorithm-C3
perl-Algorithm-Diff
perl-Alien-Build
perl-Alien-pkgconf
perl-AnyEvent
perl-AnyEvent-AIO
perl-AnyEvent-BDB
perl-App-cpanminus
perl-App-FatPacker
perl-AppConfig
perl-Archive-Extract
perl-Archive-Zip
perl-Authen-SASL
perl-B-Debug
perl-B-Hooks-EndOfScope
perl-B-Hooks-OP-Check
perl-B-Keywords
perl-B-Lint
perl-bareword-filehandles
perl-BDB
perl-Bit-Vector
perl-boolean
perl-Browser-Open
perl-BSD-Resource
perl-Business-ISBN
perl-Business-ISBN-Data
perl-Bytes-Random-Secure
perl-Capture-Tiny
perl-Carp-Clan
perl-CBOR-XS
perl-Class-Accessor
perl-Class-C3
perl-Class-C3-XS
perl-Class-Data-Inheritable
perl-Class-Factory-Util
perl-Class-Inspector
perl-Class-ISA
perl-Class-Load
perl-Class-Load-XS
perl-Class-Method-Modifiers
perl-Class-Singleton
perl-Class-Tiny
perl-Class-XSAccessor
perl-Clone
perl-Color-ANSI-Util
perl-Color-RGB-Util
perl-ColorThemeBase-Static
perl-ColorThemeRole-ANSI
perl-ColorThemes-Standard
perl-ColorThemeUtil-ANSI
perl-Compress-Bzip2
perl-Compress-LZF
perl-Compress-Raw-Lzma
perl-Config-AutoConf
perl-Config-INI
perl-Config-INI-Reader-Multiline
perl-Config-IniFiles
perl-Config-Simple
perl-Config-Tiny
perl-Const-Fast
perl-Convert-ASN1
perl-Convert-Bencode
perl-Coro
perl-Coro-Multicore
perl-CPAN-Changes
perl-CPAN-DistnameInfo
perl-CPAN-Meta-Check
perl-Cpanel-JSON-XS
perl-Crypt-CBC
perl-Crypt-DES
perl-Crypt-IDEA
perl-Crypt-OpenSSL-Bignum
perl-Crypt-OpenSSL-Guess
perl-Crypt-OpenSSL-Random
perl-Crypt-OpenSSL-RSA
perl-Crypt-PasswdMD5
perl-Crypt-Random-Seed
perl-CSS-Tiny
perl-Data-Dump
perl-Data-Munge
perl-Data-OptList
perl-Data-Peek
perl-Data-Section
perl-Data-UUID
perl-Date-Calc
perl-Date-ISO8601
perl-Date-Manip
perl-DateTime
perl-DateTime-Format-Builder
perl-DateTime-Format-DateParse
perl-DateTime-Format-HTTP
perl-DateTime-Format-IBeat
perl-DateTime-Format-ISO8601
perl-DateTime-Format-Mail
perl-DateTime-Format-Strptime
perl-DateTime-Locale
perl-DateTime-TimeZone
perl-DateTime-TimeZone-SystemV
perl-DateTime-TimeZone-Tzfile
perl-DBD-MySQL
perl-Devel-CallChecker
perl-Devel-Caller
perl-Devel-CheckBin
perl-Devel-CheckLib
perl-Devel-Cycle
perl-Devel-EnforceEncapsulation
perl-Devel-GlobalDestruction
perl-Devel-GlobalDestruction-XS
perl-Devel-Hide
perl-Devel-Leak
perl-Devel-LexAlias
perl-Devel-Size
perl-Devel-StackTrace
perl-Devel-Symdump
perl-Digest-BubbleBabble
perl-Digest-CRC
perl-Digest-HMAC
perl-Digest-SHA1
perl-Dist-CheckConflicts
perl-DynaLoader-Functions
perl-Email-Address
perl-Email-Date-Format
perl-Encode-Detect
perl-Encode-EUCJPASCII
perl-Encode-IMAPUTF7
perl-Encode-Locale
perl-Env-ShellWords
perl-Error
perl-EV
perl-Eval-Closure
perl-Event
perl-Exception-Class
perl-Expect
perl-ExtUtils-Config
perl-ExtUtils-Depends
perl-ExtUtils-Helpers
perl-ExtUtils-InstallPaths
perl-ExtUtils-PkgConfig
perl-FCGI
perl-Fedora-VSP
perl-FFI-CheckLib
perl-File-BaseDir
perl-File-BOM
perl-File-chdir
perl-File-CheckTree
perl-File-Copy-Recursive
perl-File-DesktopEntry
perl-File-Find-Object
perl-File-Find-Object-Rule
perl-File-Find-Rule
perl-File-Find-Rule-Perl
perl-File-Inplace
perl-File-Listing
perl-File-MimeInfo
perl-File-pushd
perl-File-ReadBackwards
perl-File-Remove
perl-File-ShareDir
perl-File-ShareDir-Install
perl-File-Slurp
perl-File-Slurp-Tiny
perl-File-Slurper
perl-File-Type
perl-Font-TTF
perl-FreezeThaw
perl-GD
perl-GD-Barcode
perl-generators
perl-Getopt-ArgvFile
perl-gettext
perl-Graphics-ColorNamesLite-WWW
perl-GSSAPI
perl-Guard
perl-Hook-LexWrap
perl-HTML-Parser
perl-HTML-Tagset
perl-HTML-Tree
perl-HTTP-Cookies
perl-HTTP-Daemon
perl-HTTP-Date
perl-HTTP-Message
perl-HTTP-Negotiate
perl-Image-Base
perl-Image-Info
perl-Image-Xbm
perl-Image-Xpm
perl-Import-Into
perl-Importer
perl-inc-latest
perl-indirect
perl-Inline-Files
perl-IO-AIO
perl-IO-All
perl-IO-CaptureOutput
perl-IO-Compress-Lzma
perl-IO-HTML
perl-IO-Multiplex
perl-IO-SessionData
perl-IO-Socket-INET6
perl-IO-String
perl-IO-stringy
perl-IO-Tty
perl-IPC-Run
perl-IPC-Run3
perl-IPC-System-Simple
perl-JSON
perl-JSON-Color
perl-JSON-MaybeXS
perl-LDAP
perl-libnet
perl-libwww-perl
perl-libxml-perl
perl-Lingua-EN-Inflect
perl-List-MoreUtils-XS
perl-local-lib
perl-Locale-Codes
perl-Locale-Maketext-Gettext
perl-Locale-Msgfmt
perl-Locale-PO
perl-Log-Message
perl-Log-Message-Simple
perl-LWP-MediaTypes
perl-LWP-Protocol-https
perl-Mail-AuthenticationResults
perl-Mail-DKIM
perl-Mail-IMAPTalk
perl-Mail-SPF
perl-MailTools
perl-Math-Int64
perl-Math-Random-ISAAC
perl-MIME-Charset
perl-MIME-Lite
perl-MIME-Types
perl-Mixin-Linewise
perl-MLDBM
perl-Mock-Config
perl-Module-Build-Tiny
perl-Module-CPANfile
perl-Module-Implementation
perl-Module-Install-AuthorRequires
perl-Module-Install-AuthorTests
perl-Module-Install-AutoLicense
perl-Module-Install-GithubMeta
perl-Module-Install-ManifestSkip
perl-Module-Install-ReadmeFromPod
perl-Module-Install-ReadmeMarkdownFromPod
perl-Module-Install-Repository
perl-Module-Install-TestBase
perl-Module-Load-Util
perl-Module-Manifest
perl-Module-Manifest-Skip
perl-Module-Package
perl-Module-Package-Au
perl-Module-Pluggable
perl-Module-Runtime
perl-Module-Signature
perl-Mojolicious
perl-Moo
perl-Mozilla-CA
perl-Mozilla-LDAP
perl-MRO-Compat
perl-multidimensional
perl-namespace-autoclean
perl-namespace-clean
perl-Net-CIDR-Lite
perl-Net-Daemon
perl-Net-DNS
perl-Net-DNS-Resolver-Mock
perl-Net-DNS-Resolver-Programmable
perl-Net-HTTP
perl-Net-IMAP-Simple
perl-Net-IMAP-Simple-SSL
perl-Net-IP
perl-Net-LibIDN2
perl-Net-Patricia
perl-Net-SMTP-SSL
perl-Net-SNMP
perl-Net-Telnet
perl-Newt
perl-NNTPClient
perl-NTLM
perl-Number-Compare
perl-Object-Deadly
perl-Object-HashBase
perl-Package-Anon
perl-Package-Constants
perl-Package-DeprecationManager
perl-Package-Generator
perl-Package-Stash
perl-Package-Stash-XS
perl-PadWalker
perl-Paper-Specs
perl-PAR-Dist
perl-Parallel-Iterator
perl-Params-Classify
perl-Params-Util
perl-Params-Validate
perl-Params-ValidationCompiler
perl-Parse-PMFile
perl-Parse-RecDescent
perl-Parse-Yapp
perl-Path-Tiny
perl-Perl-Critic
perl-Perl-Critic-More
perl-Perl-Destruct-Level
perl-Perl-MinimumVersion
perl-Perl4-CoreLibs
perl-PerlIO-gzip
perl-PerlIO-utf8_strict
perl-PkgConfig-LibPkgConf
perl-Pod-Coverage
perl-Pod-Coverage-TrustPod
perl-Pod-Escapes
perl-Pod-Eventual
perl-Pod-LaTeX
perl-Pod-Markdown
perl-Pod-Parser
perl-Pod-Plainer
perl-Pod-POM
perl-Pod-Spell
perl-PPI
perl-PPI-HTML
perl-PPIx-QuoteLike
perl-PPIx-Regexp
perl-PPIx-Utilities
perl-prefork
perl-Probe-Perl
perl-Razor-Agent
perl-Readonly
perl-Readonly-XS
perl-Ref-Util
perl-Ref-Util-XS
perl-Regexp-Pattern-Perl
perl-Return-MultiLevel
perl-Role-Tiny
perl-Scope-Guard
perl-Scope-Upper
perl-SGMLSpm
perl-SNMP_Session
perl-Socket6
perl-Software-License
perl-Sort-Versions
perl-Specio
perl-Spiffy
perl-strictures
perl-String-CRC32
perl-String-Format
perl-String-ShellQuote
perl-String-Similarity
perl-Sub-Exporter
perl-Sub-Exporter-Progressive
perl-Sub-Identify
perl-Sub-Info
perl-Sub-Install
perl-Sub-Name
perl-Sub-Quote
perl-Sub-Uplevel
perl-SUPER
perl-Switch
perl-Syntax-Highlight-Engine-Kate
perl-Sys-CPU
perl-Sys-MemInfo
perl-Sys-Virt
perl-Taint-Runtime
perl-Task-Weaken
perl-Term-Size-Any
perl-Term-Size-Perl
perl-Term-Table
perl-Term-UI
perl-TermReadKey
perl-Test-Base
perl-Test-ClassAPI
perl-Test-CPAN-Meta
perl-Test-CPAN-Meta-JSON
perl-Test-Deep
perl-Test-Differences
perl-Test-DistManifest
perl-Test-Distribution
perl-Test-EOL
perl-Test-Exception
perl-Test-Exit
perl-Test-FailWarnings
perl-Test-Fatal
perl-Test-File
perl-Test-File-ShareDir
perl-Test-Harness
perl-Test-HasVersion
perl-Test-InDistDir
perl-Test-Inter
perl-Test-LeakTrace
perl-Test-LongString
perl-Test-Manifest
perl-Test-Memory-Cycle
perl-Test-MinimumVersion
perl-Test-MockObject
perl-Test-MockRandom
perl-Test-Needs
perl-Test-NoTabs
perl-Test-NoWarnings
perl-Test-Object
perl-Test-Output
perl-Test-Pod
perl-Test-Pod-Coverage
perl-Test-Portability-Files
perl-Test-Requires
perl-Test-RequiresInternet
perl-Test-Script
perl-Test-Simple
perl-Test-SubCalls
perl-Test-Synopsis
perl-Test-Taint
perl-Test-TrailingSpace
perl-Test-utf8
perl-Test-Vars
perl-Test-Warn
perl-Test-Without-Module
perl-Test2-Plugin-NoWarnings
perl-Test2-Suite
perl-Test2-Tools-Explain
perl-Text-CharWidth
perl-Text-CSV_XS
perl-Text-Diff
perl-Text-Glob
perl-Text-Iconv
perl-Text-Soundex
perl-Text-Unidecode
perl-Text-WrapI18N
perl-Tie-IxHash
perl-Time-Duration
perl-TimeDate
perl-Tree-DAG_Node
perl-Unicode-EastAsianWidth
perl-Unicode-LineBreak
perl-Unicode-Map8
perl-Unicode-String
perl-Unicode-UTF8
perl-UNIVERSAL-can
perl-UNIVERSAL-isa
perl-Unix-Syslog
perl-URI
perl-Variable-Magic
perl-Version-Requirements
perl-WWW-RobotRules
perl-XML-Catalog
perl-XML-DOM
perl-XML-Dumper
perl-XML-Filter-BufferText
perl-XML-Generator
perl-XML-Grove
perl-XML-Handler-YAWriter
perl-XML-LibXML
perl-XML-LibXSLT
perl-XML-NamespaceSupport
perl-XML-Parser-Lite
perl-XML-RegExp
perl-XML-SAX
perl-XML-SAX-Base
perl-XML-SAX-Writer
perl-XML-Simple
perl-XML-TokeParser
perl-XML-TreeBuilder
perl-XML-Twig
perl-XML-Writer
perl-XML-XPath
perl-XML-XPathEngine
perl-XString
perl-YAML-LibYAML
perl-YAML-PP
perl-YAML-Syck
perltidy
pesign
phodav
php
php-pear
php-pecl-zip
physfs
picosat
pinfo
pipewire
pixman
pkcs11-helper
pkgconf
plexus-cipher
plexus-containers
plexus-sec-dispatcher
plotutils
pmdk-convert
pmix
pngcrush
pngnq
po4a
podman
poetry
policycoreutils
polkit-pkla-compat
portreserve
postfix
potrace
powertop
ppp
pps-tools
pptp
priv_wrapper
procmail
prometheus
prometheus-node-exporter
ps_mem
psacct
psutils
ptlib
publicsuffix-list
pugixml
pulseaudio
puppet
pwgen
pyatspi
pybind11
pycairo
pyelftools
pyflakes
pygobject3
PyGreSQL
pykickstart
pylint
pyparted
pyproject-rpm-macros
pyserial
python-absl-py
python-aiodns
python-aiohttp
python-alsa
python-argcomplete
python-astroid
python-astunparse
python-async-generator
python-augeas
python-azure-sdk
python-beautifulsoup4
python-betamax
python-blinker
python-blivet
python-cached_property
python-charset-normalizer
python-cheetah
python-click
python-cmd2
python-colorama
python-CommonMark
python-conda-package-handling
python-configshell
python-cpuinfo
python-cups
python-curio
python-cytoolz
python-d2to1
python-dbus-client-gen
python-dbus-python-client-gen
python-dbus-signature-pyparsing
python-dbusmock
python-ddt
python-debtcollector
python-decorator
python-distlib
python-dmidecode
python-dns
python-dtopt
python-dulwich
python-enchant
python-entrypoints
python-ethtool
python-evdev
python-extras
python-faker
python-fasteners
python-fields
python-filelock
python-fixtures
python-flake8
python-flask
python-flit
python-flit-core
python-fluidity-sm
python-frozendict
python-funcsigs
python-gast
python-genshi
python-google-auth
python-google-auth-oauthlib
python-greenlet
python-gssapi
python-h5py
python-hs-dbus-signature
python-html5lib
python-httplib2
python-humanize
python-hwdata
python-importlib-metadata
python-inotify
python-into-dbus-python
python-IPy
python-iso8601
python-isodate
python-isort
python-itsdangerous
python-junit-xml
python-justbases
python-justbytes
python-jwcrypto
python-jwt
python-kdcproxy
python-kerberos
python-kmod
python-kubernetes
python-lazy-object-proxy
python-ldap
python-linux-procfs
python-lit
python-markdown
python-mccabe
python-memcached
python-mimeparse
python-mock
python-monotonic
python-more-itertools
python-mpmath
python-msal
python-msrestazure
python-mutagen
python-networkx
python-nose2
python-ntlm-auth
python-oauth2client
python-openpyxl
python-openstackdocstheme
python-oslo-i18n
python-oslo-sphinx
python-paramiko
python-pefile
python-pexpect
python-pkgconfig
python-platformdirs
python-pluggy
python-podman-api
python-process-tests
python-productmd
python-ptyprocess
python-pycares
python-pycosat
python-pydbus
python-pymongo
python-PyMySQL
python-pyperclip
python-pyroute2
python-pyrsistent
python-pysocks
python-pytest-benchmark
python-pytest-cov
python-pytest-expect
python-pytest-flake8
python-pytest-forked
python-pytest-mock
python-pytest-relaxed
python-pytest-runner
python-pytest-subtests
python-pytest-timeout
python-pytest-xdist
python-pytoml
python-pyudev
python-pywbem
python-qrcode
python-rdflib
python-recommonmark
python-redis
python-requests-file
python-requests-ftp
python-requests-kerberos
python-requests-mock
python-requests-oauthlib
python-requests-toolbelt
python-requests_ntlm
python-responses
python-retrying
python-rfc3986
python-rpm-generators
python-rpmfluff
python-rtslib
python-ruamel-yaml
python-ruamel-yaml-clib
python-s3transfer
python-schedutils
python-semantic_version
python-should_dsl
python-simpleline
python-slip
python-sniffio
python-soupsieve
python-sphinx
python-sphinx-epytext
python-sphinx-theme-py3doc-enhanced
python-sphinx_rtd_theme
python-sphinxcontrib-apidoc
python-sphinxcontrib-applehelp
python-sphinxcontrib-devhelp
python-sphinxcontrib-htmlhelp
python-sphinxcontrib-httpdomain
python-sphinxcontrib-jsmath
python-sphinxcontrib-qthelp
python-sphinxcontrib-serializinghtml
python-sqlalchemy
python-suds
python-systemd
python-tempita
python-templated-dictionary
python-termcolor
python-testpath
python-testresources
python-testscenarios
python-testtools
python-tidy
python-toml
python-tomli
python-toolz
python-tornado
python-tox
python-tox-current-env
python-tqdm
python-trio
python-typing-extensions
python-uamqp
python-unittest2
python-uritemplate
python-urwid
python-varlink
python-virt-firmware
python-voluptuous
python-waitress
python-webencodings
python-webtest
python-wheel
python-whoosh
python-winrm
python-wrapt
python-xmltodict
python-yubico
python-zipp
python-zmq
python3-mallard-ducktype
python3-pytest-asyncio
python3-typed_ast
pyusb
pywbem
pyxattr
qemu
qhull
qpdf
qperf
qr-code-generator
qt5-qtbase
qt5-qtconnectivity
qt5-qtdeclarative
qt5-qtsensors
qt5-qtserialport
qt5-qtsvg
qt5-qttools
qt5-rpm-macros
quagga
quota
quotatool
radvd
ragel
raptor2
rarian
rasdaemon
rasqal
rcs
rdist
rdma-core
re2
re2c
realmd
rear
recode
redland
resource-agents
rest
rhash
rlwrap
rp-pppoe
rpm-mpi-hooks
rpmdevtools
rpmlint
rtkit
rtl-sdr
ruby-augeas
rubygem-bson
rubygem-coderay
rubygem-diff-lcs
rubygem-flexmock
rubygem-hpricot
rubygem-introspection
rubygem-liquid
rubygem-maruku
rubygem-metaclass
rubygem-mongo
rubygem-mustache
rubygem-mysql2
rubygem-pkg-config
rubygem-rake
rubygem-rake-compiler
rubygem-ronn
rubygem-rouge
rubygem-rspec
rubygem-rspec-expectations
rubygem-rspec-mocks
rubygem-rspec-support
rubygem-thread_order
rusers
rust-cbindgen
samba
sanlock
sassist
satyr
sbc
sblim-cim-client2
sblim-cmpi-base
sblim-cmpi-devel
sblim-cmpi-fsvol
sblim-cmpi-network
sblim-cmpi-nfsv3
sblim-cmpi-nfsv4
sblim-cmpi-params
sblim-cmpi-sysfs
sblim-cmpi-syslog
sblim-indication_helper
sblim-sfcb
sblim-sfcc
sblim-sfcCommon
sblim-testsuite
sblim-wbemcli
scl-utils
scotch
screen
scrub
SDL
SDL2
SDL_sound
sdparm
seabios
secilc
selinux-policy
sendmail
serd
setools
setserial
setuptool
sgabios
sgml-common
sgpio
shared-mime-info
sharutils
sip
sisu
skkdic
sleuthkit
slirp4netns
smartmontools
smc-tools
socket_wrapper
softhsm
sombok
sord
sos
sound-theme-freedesktop
soundtouch
sox
soxr
sparsehash
spausedd
speex
speexdsp
spice-protocol
spice-vdagent
spirv-headers
spirv-tools
splix
squashfs-tools
squid
sratom
sscg
star
startup-notification
stunnel
subscription-manager
suitesparse
SuperLU
supermin
switcheroo-control
symlinks
sympy
sysfsutils
systemd-bootchart
t1lib
t1utils
taglib
tang
targetcli
tbb
tcl-pgtcl
tclx
teckit
telnet
tidy
time
tini
tinycdb
tix
tk
tlog
tmpwatch
tn5250
tofrodos
tokyocabinet
tpm-quote-tools
tpm-tools
tss2
ttembed
ttmkfdir
tuna
twolame
uchardet
uclibc-ng
ucpp
ucs-miscfixed-fonts
ucx
udftools
udica
udisks2
uglify-js
uid_wrapper
unicode-emoji
unicode-ucd
unique3
units
upower
uriparser
urlview
usb_modeswitch
usb_modeswitch-data
usbguard
usbip
usbmuxd
usbredir
usermode
ustr
uthash
uuid
uw-imap
v4l-utils
vhostmd
vino
virglrenderer
virt-p2v
virt-top
virt-what
virt-who
virtiofsd
vitess
vmem
volume_key
vorbis-tools
vte291
vulkan-headers
vulkan-loader
watchdog
wavpack
wayland
wayland-protocols
web-assets
webrtc-audio-processing
websocketpp
whois
wireguard-tools
wireless-regdb
wireshark
woff2
wordnet
words
wpebackend-fdo
wsmancli
wvdial
x3270
xapian-core
Xaw3d
xcb-proto
xcb-util
xcb-util-image
xcb-util-keysyms
xcb-util-renderutil
xcb-util-wm
xdelta
xdg-dbus-proxy
xdg-utils
xerces-c
xfconf
xfsdump
xhtml1-dtds
xkeyboard-config
xmlstarlet
xmltoman
xmvn
xorg-x11-apps
xorg-x11-drv-libinput
xorg-x11-font-utils
xorg-x11-fonts
xorg-x11-proto-devel
xorg-x11-server
xorg-x11-server-utils
xorg-x11-util-macros
xorg-x11-utils
xorg-x11-xauth
xorg-x11-xbitmaps
xorg-x11-xinit
xorg-x11-xkb-utils
xorg-x11-xtrans-devel
xrestop
xterm
xxhash
yajl
yaml-cpp
yasm
yelp-tools
yelp-xsl
ykclient
yp-tools
ypbind
ypserv
z3
zenity
zerofree
zfs-fuse
zipper
zopfli
zziplib | | Fedora (Copyright Remi Collet) | [CC-BY-SA 4.0](https://creativecommons.org/licenses/by-sa/4.0/legalcode) | libmemcached-awesome
librabbitmq | | Fedora (ISC) | [ISC License](https://github.com/sarugaku/resolvelib/blob/main/LICENSE) | python-resolvelib | | Magnus Edenhill Open Source | [Magnus Edenhill Open Source BSD License](https://github.com/jemalloc/jemalloc/blob/dev/COPYING) | librdkafka | @@ -16,6 +16,6 @@ The CBL-Mariner SPEC files originated from a variety of sources with varying lic | OpenEuler | [BSD-3 License](https://github.com/pytorch/pytorch/blob/master/LICENSE) | pytorch | | OpenMamba | [Openmamba GPLv2 License](https://www.gnu.org/licenses/old-licenses/gpl-2.0.txt) | bash-completion | | OpenSUSE | Following [openSUSE guidelines](https://en.opensuse.org/openSUSE:Specfile_guidelines#Specfile_Licensing) | ant
ant-junit
antlr
aopalliance
apache-commons-beanutils
apache-commons-cli
apache-commons-codec
apache-commons-collections
apache-commons-collections4
apache-commons-compress
apache-commons-daemon
apache-commons-dbcp
apache-commons-digester
apache-commons-httpclient
apache-commons-io
apache-commons-jexl
apache-commons-lang
apache-commons-lang3
apache-commons-logging
apache-commons-net
apache-commons-pool
apache-commons-pool2
apache-commons-validator
apache-commons-vfs2
apache-parent
args4j
atinject
base64coder
bazel-workspaces
bcel
bea-stax
beust-jcommander
bsf
byaccj
cal10n
cdparanoia
cglib
cni
containerized-data-importer
cpulimit
cri-o
ecj
fillup
flux
gd
geronimo-specs
glassfish-annotation-api
glassfish-servlet-api
gnu-getopt
gnu-regexp
golang-packaging
guava
guava20
hamcrest
hawtjni-runtime
httpcomponents-core
influx-cli
influxdb
isorelax
jakarta-taglibs-standard
jansi
jarjar
java-cup
java-cup-bootstrap
javacc
javacc-bootstrap
javassist
jboss-interceptors-1.2-api
jdepend
jflex
jflex-bootstrap
jlex
jline
jna
jsch
jsoup
jsr-305
jtidy
junit
junitperf
jzlib
kubevirt
kured
libcontainers-common
libtheora
libva
libvdpau
lynx
maven-parent
multus
objectweb-anttask
objectweb-asm
objenesis
oro
osgi-annotation
osgi-compendium
osgi-core
patterns-ceph-containers
plexus-classworlds
plexus-interpolation
plexus-pom
plexus-utils
proj
psl-make-dafsa
publicsuffix
qdox
regexp
relaxngDatatype
rhino
ripgrep
rook
servletapi4
servletapi5
shapelib
slf4j
trilead-ssh2
xalan-j2
xbean
xcursor-themes
xerces-j2
xml-commons-apis
xml-commons-resolver
xmldb-api
xmlrpc-c
xmlunit
xpp2
xpp3
xz-java | -| Photon | [Photon License](LICENSE-PHOTON.md) and [Photon Notice](NOTICE.APACHE2).
Also see [LICENSE-EXCEPTIONS.PHOTON](LICENSE-EXCEPTIONS.PHOTON). | acl
alsa-lib
alsa-utils
ansible
apparmor
apr
apr-util
asciidoc
atftp
audit
autoconf
autoconf-archive
autofs
autogen
automake
babel
bash
bc
bcc
bind
binutils
bison
blktrace
boost
bridge-utils
btrfs-progs
bubblewrap
build-essential
bzip2
c-ares
cairo
cassandra
cdrkit
check
chkconfig
chrpath
cifs-utils
clang
clang16
cloud-init
cloud-utils-growpart
cmake
cni-plugins
core-packages
coreutils
cpio
cppunit
cracklib
crash
crash-gcore-command
createrepo_c
cri-tools
cronie
curl
cyrus-sasl
cyrus-sasl-bootstrap
dbus
dbus-glib
dejagnu
device-mapper-multipath
dhcp
dialog
diffutils
dkms
dmidecode
dnsmasq
docbook-dtd-xml
docbook-style-xsl
dosfstools
dracut
dstat
e2fsprogs
ed
efibootmgr
efivar
elfutils
emacs
erlang
etcd
ethtool
expat
expect
fcgi
file
filesystem
findutils
finger
flex
fontconfig
fping
freetype
fuse
gawk
gc
gcc
gdb
gdbm
gettext
git
git-lfs
glib
glib-networking
glibc
glibmm
glide
gmp
gnome-common
gnupg2
gnuplot
gnutls
gobject-introspection
golang
golang-1.17
golang-1.18
gperf
gperftools
gpgme
gptfdisk
grep
groff
grub2
gtest
gtk-doc
guile
gzip
haproxy
harfbuzz
haveged
hdparm
http-parser
httpd
i2c-tools
iana-etc
icu
initramfs
initscripts
inotify-tools
intltool
iotop
iperf3
iproute
ipset
iptables
iputils
ipvsadm
ipxe
irqbalance
itstool
jansson
jq
json-c
json-glib
kbd
keepalived
kernel
kernel-azure
kernel-hci
kernel-headers
kernel-mos
kernel-mshv
kernel-rt
kernel-uvm
kernel-uvm-cvm
keyutils
kmod
krb5
less
libaio
libarchive
libassuan
libatomic_ops
libcap
libcap-ng
libconfig
libdb
libdnet
libedit
libestr
libevent
libfastjson
libffi
libgcrypt
libgpg-error
libgssglue
libgsystem
libgudev
libjpeg-turbo
libksba
liblogging
libmbim
libmnl
libmodulemd
libmpc
libmspack
libndp
libnetfilter_conntrack
libnetfilter_cthelper
libnetfilter_cttimeout
libnetfilter_queue
libnfnetlink
libnftnl
libnl3
libnsl2
libpcap
libpipeline
libpng
libpsl
libqmi
librelp
librepo
librsync
libseccomp
libselinux
libsepol
libserf
libsigc++30
libsolv
libsoup
libssh2
libtalloc
libtar
libtasn1
libtiff
libtirpc
libtool
libunistring
libunwind
libusb
libvirt
libwebp
libxml2
libxslt
libyaml
linux-firmware
lldb
lldpad
llvm
llvm16
lm-sensors
lmdb
log4cpp
logrotate
lshw
lsof
lsscsi
ltrace
lttng-tools
lttng-ust
lvm2
lz4
lzo
m2crypto
m4
make
man-db
man-pages
mariadb
maven
mc
mercurial
meson
mlocate
ModemManager
mozjs
mpfr
msft-golang
msr-tools
mysql
nano
nasm
ncurses
ndctl
net-snmp
net-tools
nettle
newt
nfs-utils
nghttp2
nginx
ninja-build
nodejs
nodejs18
npth
nspr
nss
nss-altfiles
ntp
numactl
nvme-cli
oniguruma
OpenIPMI
openldap
openscap
openssh
openvswitch
ostree
pam
pango
parted
patch
pciutils
pcre
perl-Canary-Stability
perl-CGI
perl-common-sense
perl-Crypt-SSLeay
perl-DBD-SQLite
perl-DBI
perl-DBIx-Simple
perl-Exporter-Tiny
perl-File-HomeDir
perl-File-Which
perl-IO-Socket-SSL
perl-JSON-Any
perl-JSON-XS
perl-libintl-perl
perl-List-MoreUtils
perl-Module-Build
perl-Module-Install
perl-Module-ScanDeps
perl-Net-SSLeay
perl-NetAddr-IP
perl-Object-Accessor
perl-Path-Class
perl-Try-Tiny
perl-Types-Serialiser
perl-WWW-Curl
perl-XML-Parser
perl-YAML
perl-YAML-Tiny
pgbouncer
pinentry
polkit
popt
postgresql
procps-ng
protobuf
protobuf-c
psmisc
pth
pyasn1-modules
pyOpenSSL
PyPAM
pyparsing
pytest
python-appdirs
python-asn1crypto
python-atomicwrites
python-attrs
python-bcrypt
python-certifi
python-cffi
python-chardet
python-configobj
python-constantly
python-coverage
python-cryptography
python-daemon
python-dateutil
python-defusedxml
python-distro
python-docopt
python-docutils
python-ecdsa
python-gevent
python-hyperlink
python-hypothesis
python-idna
python-imagesize
python-incremental
python-iniparse
python-ipaddr
python-jinja2
python-jmespath
python-jsonpatch
python-jsonpointer
python-jsonschema
python-lockfile
python-lxml
python-m2r
python-mako
python-markupsafe
python-mistune
python-msgpack
python-netaddr
python-netifaces
python-ntplib
python-oauthlib
python-packaging
python-pam
python-pbr
python-ply
python-prettytable
python-psutil
python-psycopg2
python-py
python-pyasn1
python-pycodestyle
python-pycparser
python-pycurl
python-pygments
python-pynacl
python-requests
python-setuptools_scm
python-simplejson
python-six
python-snowballstemmer
python-sphinx-theme-alabaster
python-twisted
python-urllib3
python-vcversioner
python-virtualenv
python-wcwidth
python-webob
python-websocket-client
python-werkzeug
python-zope-interface
python3
pytz
PyYAML
rapidjson
readline
redis
rng-tools
rpcbind
rpcsvc-proto
rpm
rpm-ostree
rrdtool
rsync
rsyslog
ruby
rust
scons
sed
sg3_utils
shadow-utils
slang
snappy
socat
sqlite
sshpass
strace
strongswan
subversion
sudo
swig
syslinux
syslog-ng
sysstat
systemd
systemd-bootstrap
systemtap
tar
tboot
tcl
tcpdump
tcsh
tdnf
telegraf
texinfo
tmux
tpm2-abrmd
tpm2-tools
tpm2-tss
traceroute
tree
trousers
tzdata
unbound
unixODBC
unzip
usbutils
userspace-rcu
utf8proc
util-linux
valgrind
vim
vsftpd
WALinuxAgent
wget
which
wpa_supplicant
xfsprogs
xinetd
xmlsec1
xmlto
xz
zchunk
zeromq
zip
zlib
zsh | +| Photon | [Photon License](LICENSE-PHOTON.md) and [Photon Notice](NOTICE.APACHE2).
Also see [LICENSE-EXCEPTIONS.PHOTON](LICENSE-EXCEPTIONS.PHOTON). | acl
alsa-lib
alsa-utils
ansible
apparmor
apr
apr-util
asciidoc
atftp
audit
autoconf
autoconf-archive
autofs
autogen
automake
babel
bash
bc
bcc
bind
binutils
bison
blktrace
boost
bridge-utils
btrfs-progs
bubblewrap
build-essential
bzip2
c-ares
cairo
cassandra
cdrkit
check
chkconfig
chrpath
cifs-utils
clang
clang16
cloud-init
cloud-utils-growpart
cmake
cni-plugins
core-packages
coreutils
cpio
cppunit
cracklib
crash
crash-gcore-command
createrepo_c
cri-tools
cronie
curl
cyrus-sasl
cyrus-sasl-bootstrap
dbus
dbus-glib
dejagnu
device-mapper-multipath
dhcp
dialog
diffutils
dkms
dmidecode
dnsmasq
docbook-dtd-xml
docbook-style-xsl
dosfstools
dracut
dstat
e2fsprogs
ed
efibootmgr
efivar
elfutils
emacs
erlang
etcd
ethtool
expat
expect
fcgi
file
filesystem
findutils
finger
flex
fontconfig
fping
freetype
fuse
gawk
gc
gcc
gdb
gdbm
gettext
git
git-lfs
glib
glib-networking
glibc
glibmm
glide
gmp
gnome-common
gnupg2
gnuplot
gnutls
gobject-introspection
golang
golang-1.17
golang-1.18
gperf
gperftools
gpgme
gptfdisk
grep
groff
grub2
gtest
gtk-doc
guile
gzip
haproxy
harfbuzz
haveged
hdparm
http-parser
httpd
i2c-tools
iana-etc
icu
initramfs
initscripts
inotify-tools
intltool
iotop
iperf3
iproute
ipset
iptables
iputils
ipvsadm
ipxe
irqbalance
itstool
jansson
jq
json-c
json-glib
kbd
keepalived
kernel
kernel-azure
kernel-hci
kernel-headers
kernel-mos
kernel-mshv
kernel-rt
kernel-uvm
keyutils
kmod
krb5
less
libaio
libarchive
libassuan
libatomic_ops
libcap
libcap-ng
libconfig
libdb
libdnet
libedit
libestr
libevent
libfastjson
libffi
libgcrypt
libgpg-error
libgssglue
libgsystem
libgudev
libjpeg-turbo
libksba
liblogging
libmbim
libmnl
libmodulemd
libmpc
libmspack
libndp
libnetfilter_conntrack
libnetfilter_cthelper
libnetfilter_cttimeout
libnetfilter_queue
libnfnetlink
libnftnl
libnl3
libnsl2
libpcap
libpipeline
libpng
libpsl
libqmi
librelp
librepo
librsync
libseccomp
libselinux
libsepol
libserf
libsigc++30
libsolv
libsoup
libssh2
libtalloc
libtar
libtasn1
libtiff
libtirpc
libtool
libunistring
libunwind
libusb
libvirt
libwebp
libxml2
libxslt
libyaml
linux-firmware
lldb
lldpad
llvm
llvm16
lm-sensors
lmdb
log4cpp
logrotate
lshw
lsof
lsscsi
ltrace
lttng-tools
lttng-ust
lvm2
lz4
lzo
m2crypto
m4
make
man-db
man-pages
mariadb
maven
mc
mercurial
meson
mlocate
ModemManager
mozjs
mpfr
msft-golang
msr-tools
mysql
nano
nasm
ncurses
ndctl
net-snmp
net-tools
nettle
newt
nfs-utils
nghttp2
nginx
ninja-build
nodejs
nodejs18
npth
nspr
nss
nss-altfiles
ntp
numactl
nvme-cli
oniguruma
OpenIPMI
openldap
openscap
openssh
openvswitch
ostree
pam
pango
parted
patch
pciutils
pcre
perl-Canary-Stability
perl-CGI
perl-common-sense
perl-Crypt-SSLeay
perl-DBD-SQLite
perl-DBI
perl-DBIx-Simple
perl-Exporter-Tiny
perl-File-HomeDir
perl-File-Which
perl-IO-Socket-SSL
perl-JSON-Any
perl-JSON-XS
perl-libintl-perl
perl-List-MoreUtils
perl-Module-Build
perl-Module-Install
perl-Module-ScanDeps
perl-Net-SSLeay
perl-NetAddr-IP
perl-Object-Accessor
perl-Path-Class
perl-Try-Tiny
perl-Types-Serialiser
perl-WWW-Curl
perl-XML-Parser
perl-YAML
perl-YAML-Tiny
pgbouncer
pinentry
polkit
popt
postgresql
procps-ng
protobuf
protobuf-c
psmisc
pth
pyasn1-modules
pyOpenSSL
PyPAM
pyparsing
pytest
python-appdirs
python-asn1crypto
python-atomicwrites
python-attrs
python-bcrypt
python-certifi
python-cffi
python-chardet
python-configobj
python-constantly
python-coverage
python-cryptography
python-daemon
python-dateutil
python-defusedxml
python-distro
python-docopt
python-docutils
python-ecdsa
python-gevent
python-hyperlink
python-hypothesis
python-idna
python-imagesize
python-incremental
python-iniparse
python-ipaddr
python-jinja2
python-jmespath
python-jsonpatch
python-jsonpointer
python-jsonschema
python-lockfile
python-lxml
python-m2r
python-mako
python-markupsafe
python-mistune
python-msgpack
python-netaddr
python-netifaces
python-ntplib
python-oauthlib
python-packaging
python-pam
python-pbr
python-ply
python-prettytable
python-psutil
python-psycopg2
python-py
python-pyasn1
python-pycodestyle
python-pycparser
python-pycurl
python-pygments
python-pynacl
python-requests
python-setuptools_scm
python-simplejson
python-six
python-snowballstemmer
python-sphinx-theme-alabaster
python-twisted
python-urllib3
python-vcversioner
python-virtualenv
python-wcwidth
python-webob
python-websocket-client
python-werkzeug
python-zope-interface
python3
pytz
PyYAML
rapidjson
readline
redis
rng-tools
rpcbind
rpcsvc-proto
rpm
rpm-ostree
rrdtool
rsync
rsyslog
ruby
rust
scons
sed
sg3_utils
shadow-utils
slang
snappy
socat
sqlite
sshpass
strace
strongswan
subversion
sudo
swig
syslinux
syslog-ng
sysstat
systemd
systemd-bootstrap
systemtap
tar
tboot
tcl
tcpdump
tcsh
tdnf
telegraf
texinfo
tmux
tpm2-abrmd
tpm2-tools
tpm2-tss
traceroute
tree
trousers
tzdata
unbound
unixODBC
unzip
usbutils
userspace-rcu
utf8proc
util-linux
valgrind
vim
vsftpd
WALinuxAgent
wget
which
wpa_supplicant
xfsprogs
xinetd
xmlsec1
xmlto
xz
zchunk
zeromq
zip
zlib
zsh | | RPM software management source | [GPLv2+ License](https://github.com/rpm-software-management/dnf5/blob/main/COPYING.md) | dnf5 | | Sysbench source | [GPLv2+ License](https://github.com/akopytov/sysbench/blob/master/COPYING) | sysbench | diff --git a/SPECS/LICENSES-AND-NOTICES/data/licenses.json b/SPECS/LICENSES-AND-NOTICES/data/licenses.json index f89e5508bec..32717e2e353 100644 --- a/SPECS/LICENSES-AND-NOTICES/data/licenses.json +++ b/SPECS/LICENSES-AND-NOTICES/data/licenses.json @@ -959,6 +959,7 @@ "nload", "nlopt", "nodejs-packaging", + "nss-mdns", "nss-pam-ldapd", "nss_nis", "nss_wrapper", @@ -2756,7 +2757,6 @@ "kernel-mshv", "kernel-rt", "kernel-uvm", - "kernel-uvm-cvm", "keyutils", "kmod", "krb5", diff --git a/SPECS/application-gateway-kubernetes-ingress/CVE-2021-44716.patch b/SPECS/application-gateway-kubernetes-ingress/CVE-2021-44716.patch new file mode 100644 index 00000000000..dc3adbff678 --- /dev/null +++ b/SPECS/application-gateway-kubernetes-ingress/CVE-2021-44716.patch @@ -0,0 +1,51 @@ +Parent: db4efeb8 (http2: deflake TestTransportGroupsPendingDials) +Author: Damien Neil +AuthorDate: 2021-12-06 14:31:43 -0800 +Commit: Filippo Valsorda +CommitDate: 2021-12-09 12:49:13 +0000 + +http2: cap the size of the server's canonical header cache + +The HTTP/2 server keeps a per-connection cache mapping header keys +to their canonicalized form (e.g., "foo-bar" => "Foo-Bar"). Cap the +maximum size of this cache to prevent a peer sending many unique +header keys from causing unbounded memory growth. + +Cap chosen arbitrarily at 32 entries. Since this cache does not +include common headers (e.g., "content-type"), 32 seems like more +than enough for almost all normal uses. + +Fixes #50058 +Fixes CVE-2021-44716 + +Change-Id: Ia83696dc23253c12af8f26d502557c2cc9841105 +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1290827 +Reviewed-by: Roland Shoemaker +Reviewed-on: https://go-review.googlesource.com/c/net/+/369794 +Trust: Filippo Valsorda +Run-TryBot: Filippo Valsorda +Trust: Damien Neil +Reviewed-by: Russ Cox +Reviewed-by: Filippo Valsorda +TryBot-Result: Gopher Robot + +diff -ru cli-20.10.27-orig/vendor/golang.org/x/net/http2/server.go cli-20.10.27/vendor/golang.org/x/net/http2/server.go +--- cli-20.10.27-orig/vendor/golang.org/x/net/http2/server.go 2024-02-05 08:53:30.802532951 -0800 ++++ cli-20.10.27/vendor/golang.org/x/net/http2/server.go 2024-02-05 09:19:08.473430121 -0800 +@@ -720,7 +720,15 @@ + sc.canonHeader = make(map[string]string) + } + cv = http.CanonicalHeaderKey(v) +- sc.canonHeader[v] = cv ++ // maxCachedCanonicalHeaders is an arbitrarily-chosen limit on the number of ++ // entries in the canonHeader cache. This should be larger than the number ++ // of unique, uncommon header keys likely to be sent by the peer, while not ++ // so high as to permit unreaasonable memory usage if the peer sends an unbounded ++ // number of unique header keys. ++ const maxCachedCanonicalHeaders = 32 ++ if len(sc.canonHeader) < maxCachedCanonicalHeaders { ++ sc.canonHeader[v] = cv ++ } + return cv + } + \ No newline at end of file diff --git a/SPECS/application-gateway-kubernetes-ingress/CVE-2022-21698.patch b/SPECS/application-gateway-kubernetes-ingress/CVE-2022-21698.patch index d182f16619a..2945e7c9cb2 100644 --- a/SPECS/application-gateway-kubernetes-ingress/CVE-2022-21698.patch +++ b/SPECS/application-gateway-kubernetes-ingress/CVE-2022-21698.patch @@ -9,6 +9,9 @@ Differences: - Removed some comments that don't merge - Line numbers and such +Modified to apply to vendored code by: Daniel McIlvaney + - Adjusted paths to work for vendored version + Based on: From 9075cdf61646b5adf54d3ba77a0e4f6c65cb4fd7 Mon Sep 17 00:00:00 2001 @@ -37,16 +40,16 @@ Signed-off-by: Kemal Akkoyun Signed-off-by: Kemal Akkoyun --- - prometheus/promhttp/instrument_client.go | 28 ++++++-- - prometheus/promhttp/instrument_server.go | 82 ++++++++++++++++++------ - prometheus/promhttp/option.go | 31 +++++++++ + vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go | 28 ++++++-- + vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go | 82 ++++++++++++++++++------ + vendor/github.com/prometheus/client_golang/prometheus/promhttp/option.go | 31 +++++++++ 3 files changed, 116 insertions(+), 25 deletions(-) - create mode 100644 prometheus/promhttp/option.go + create mode 100644 vendor/github.com/prometheus/client_golang/prometheus/promhttp/option.go -diff --git a/prometheus/promhttp/instrument_client.go b/prometheus/promhttp/instrument_client.go +diff --git a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go index 83c49b6..861b4d2 100644 ---- a/prometheus/promhttp/instrument_client.go -+++ b/prometheus/promhttp/instrument_client.go +--- a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go ++++ b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go @@ -49,7 +49,10 @@ func InstrumentRoundTripperInFlight(gauge prometheus.Gauge, next http.RoundTripp // http.RoundTripper to observe the request result with the provided CounterVec. // The CounterVec must have zero, one, or two non-const non-curried labels. For @@ -114,10 +117,10 @@ index 83c49b6..861b4d2 100644 } return resp, err }) -diff --git a/prometheus/promhttp/instrument_server.go b/prometheus/promhttp/instrument_server.go +diff --git a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go index 9db2438..91802f8 100644 ---- a/prometheus/promhttp/instrument_server.go -+++ b/prometheus/promhttp/instrument_server.go +--- a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go ++++ b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go @@ -58,7 +58,12 @@ func InstrumentHandlerInFlight(g prometheus.Gauge, next http.Handler) http.Handl // // Note that this method is only guaranteed to never observe negative durations @@ -322,11 +325,11 @@ index 9db2438..91802f8 100644 + return "unknown" } } -diff --git a/prometheus/promhttp/option.go b/prometheus/promhttp/option.go +diff --git a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/option.go b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/option.go new file mode 100644 index 0000000..35e41bd --- /dev/null -+++ b/prometheus/promhttp/option.go ++++ b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/option.go @@ -0,0 +1,31 @@ +// Copyright 2022 The Prometheus Authors +// Licensed under the Apache License, Version 2.0 (the "License"); diff --git a/SPECS/application-gateway-kubernetes-ingress/CVE-2023-44487.patch b/SPECS/application-gateway-kubernetes-ingress/CVE-2023-44487.patch new file mode 100644 index 00000000000..3a6538f9098 --- /dev/null +++ b/SPECS/application-gateway-kubernetes-ingress/CVE-2023-44487.patch @@ -0,0 +1,143 @@ +From 6e577d297aa8b47651c1a5c3ebfbf3f2d769be96 Mon Sep 17 00:00:00 2001 +From: Damien Neil +Date: Fri, 6 Oct 2023 09:51:19 -0700 +Subject: [PATCH] http2: limit maximum handler goroutines to + MaxConcurrentStreams + +When the peer opens a new stream while we have MaxConcurrentStreams +handler goroutines running, defer starting a handler until one +of the existing handlers exits. + +Fixes golang/go#63417 +Fixes CVE-2023-39325 + +Change-Id: If0531e177b125700f3e24c5ebd24b1023098fa6d +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2045854 +TryBot-Result: Security TryBots +Reviewed-by: Ian Cottrell +Reviewed-by: Tatiana Bradley +Run-TryBot: Damien Neil +Reviewed-on: https://go-review.googlesource.com/c/net/+/534215 +Reviewed-by: Michael Pratt +Reviewed-by: Dmitri Shuralyov +LUCI-TryBot-Result: Go LUCI +Auto-Submit: Dmitri Shuralyov +Reviewed-by: Damien Neil + +Modified to apply to vendored code by: Daniel McIlvaney + - Adjusted paths + - Removed reference to server_test.go + - Removed reference to upgradeRequest() which is not in old versions of the vendored code + - Removed reference to countError() which is not in old versions of the vendored code +--- + vendor/golang.org/x/net/http2/server.go | 62 ++++++++++++++++++++++++- + 1 file changed, 60 insertions(+), 2 deletions(-) + +diff --git a/vendor/golang.org/x/net/http2/server.go b/vendor/golang.org/x/net/http2/server.go +index de31d72..daa01a7 100644 +--- a/vendor/golang.org/x/net/http2/server.go ++++ b/vendor/golang.org/x/net/http2/server.go +@@ -521,9 +521,11 @@ type serverConn struct { + advMaxStreams uint32 // our SETTINGS_MAX_CONCURRENT_STREAMS advertised the client + curClientStreams uint32 // number of open streams initiated by the client + curPushedStreams uint32 // number of open streams initiated by server push ++ curHandlers uint32 // number of running handler goroutines + maxClientStreamID uint32 // max ever seen from client (odd), or 0 if there have been no client requests + maxPushPromiseID uint32 // ID of the last push promise (even), or 0 if there have been no pushes + streams map[uint32]*stream ++ unstartedHandlers []unstartedHandler + initialStreamSendWindowSize int32 + maxFrameSize int32 + headerTableSize uint32 +@@ -895,6 +897,8 @@ func (sc *serverConn) serve() { + return + case gracefulShutdownMsg: + sc.startGracefulShutdownInternal() ++ case handlerDoneMsg: ++ sc.handlerDone() + default: + panic("unknown timer") + } +@@ -940,6 +944,7 @@ var ( + idleTimerMsg = new(serverMessage) + shutdownTimerMsg = new(serverMessage) + gracefulShutdownMsg = new(serverMessage) ++ handlerDoneMsg = new(serverMessage) + ) + + func (sc *serverConn) onSettingsTimer() { sc.sendServeMsg(settingsTimerMsg) } +@@ -1880,8 +1885,7 @@ func (sc *serverConn) processHeaders(f *MetaHeadersFrame) error { + sc.conn.SetReadDeadline(time.Time{}) + } + +- go sc.runHandler(rw, req, handler) +- return nil ++ return sc.scheduleHandler(id, rw, req, handler) + } + + func (st *stream) processTrailerHeaders(f *MetaHeadersFrame) error { +@@ -2124,8 +2128,62 @@ func (sc *serverConn) newWriterAndRequestNoBody(st *stream, rp requestParam) (*r + return rw, req, nil + } + ++type unstartedHandler struct { ++ streamID uint32 ++ rw *responseWriter ++ req *http.Request ++ handler func(http.ResponseWriter, *http.Request) ++} ++ ++// scheduleHandler starts a handler goroutine, ++// or schedules one to start as soon as an existing handler finishes. ++func (sc *serverConn) scheduleHandler(streamID uint32, rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) error { ++ sc.serveG.check() ++ maxHandlers := sc.advMaxStreams ++ if sc.curHandlers < maxHandlers { ++ sc.curHandlers++ ++ go sc.runHandler(rw, req, handler) ++ return nil ++ } ++ if len(sc.unstartedHandlers) > int(4*sc.advMaxStreams) { ++ return ConnectionError(ErrCodeEnhanceYourCalm) ++ } ++ sc.unstartedHandlers = append(sc.unstartedHandlers, unstartedHandler{ ++ streamID: streamID, ++ rw: rw, ++ req: req, ++ handler: handler, ++ }) ++ return nil ++} ++ ++func (sc *serverConn) handlerDone() { ++ sc.serveG.check() ++ sc.curHandlers-- ++ i := 0 ++ maxHandlers := sc.advMaxStreams ++ for ; i < len(sc.unstartedHandlers); i++ { ++ u := sc.unstartedHandlers[i] ++ if sc.streams[u.streamID] == nil { ++ // This stream was reset before its goroutine had a chance to start. ++ continue ++ } ++ if sc.curHandlers >= maxHandlers { ++ break ++ } ++ sc.curHandlers++ ++ go sc.runHandler(u.rw, u.req, u.handler) ++ sc.unstartedHandlers[i] = unstartedHandler{} // don't retain references ++ } ++ sc.unstartedHandlers = sc.unstartedHandlers[i:] ++ if len(sc.unstartedHandlers) == 0 { ++ sc.unstartedHandlers = nil ++ } ++} ++ + // Run on its own goroutine. + func (sc *serverConn) runHandler(rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) { ++ defer sc.sendServeMsg(handlerDoneMsg) + didPanic := true + defer func() { + rw.rws.stream.cancelCtx() +-- +2.33.8 diff --git a/SPECS/application-gateway-kubernetes-ingress/application-gateway-kubernetes-ingress.spec b/SPECS/application-gateway-kubernetes-ingress/application-gateway-kubernetes-ingress.spec index b7af118bd4d..9f82447d5a7 100644 --- a/SPECS/application-gateway-kubernetes-ingress/application-gateway-kubernetes-ingress.spec +++ b/SPECS/application-gateway-kubernetes-ingress/application-gateway-kubernetes-ingress.spec @@ -2,7 +2,7 @@ Summary: Application Gateway Ingress Controller Name: application-gateway-kubernetes-ingress Version: 1.4.0 -Release: 17%{?dist} +Release: 19%{?dist} License: MIT Vendor: Microsoft Corporation Distribution: Mariner @@ -24,19 +24,27 @@ Source0: %{name}-%{version}.tar.gz # -cf %%{name}-%%{version}-vendor.tar.gz vendor # Source1: %{name}-%{version}-vendor.tar.gz + +# patches for vendored code >= 1000 # If upstream ever upgrades client_goland to 1.11.1, we can get rid of this patch. -Patch0: CVE-2022-21698.patch +Patch1000: CVE-2022-21698.patch +Patch1001: CVE-2023-44487.patch +Patch1002: CVE-2021-44716.patch + BuildRequires: golang >= 1.13 +%if %{with_check} +BuildRequires: helm +%endif %description -This is an ingress controller that can be run on Azure Kubernetes Service (AKS) to allow an Azure Application Gateway -to act as the ingress for an AKS cluster. +This is an ingress controller that can be run on Azure Kubernetes Service (AKS) to allow an Azure Application Gateway +to act as the ingress for an AKS cluster. %prep %autosetup -N rm -rf vendor tar -xf %{SOURCE1} --no-same-owner -%patch 0 -p1 -d vendor/github.com/prometheus/client_golang +%autopatch -p1 %build export VERSION=%{version} @@ -44,17 +52,29 @@ export VERSION_PATH=github.com/Azure/application-gateway-kubernetes-ingress/pkg/ go build -ldflags "-s -X $VERSION_PATH.Version=$VERSION" -mod=vendor -v -o appgw-ingress ./cmd/appgw-ingress +%check +export VERSION=%{version} +export VERSION_PATH=github.com/Azure/application-gateway-kubernetes-ingress/pkg/version +# Helm chart generation is slightly off, skip these tests +go test -ldflags "-s -X $VERSION_PATH.Version=$VERSION" -mod=vendor -v -tags unittest -skip 'TestChart' ./... + %install mkdir -p %{buildroot}%{_bindir} cp appgw-ingress %{buildroot}%{_bindir}/ - %files %defattr(-,root,root) %license LICENSE %{_bindir}/appgw-ingress %changelog +* Mon Feb 05 2024 Nicolas Guibourge - 1.4.0-19 +- Patch CVE-2021-44716 + +* Thu Feb 01 2024 Daniel McIlvaney - 1.4.0-18 +- Address CVE-2023-44487 by patching vendored golang.org/x/net +- Add check section + * Mon Jan 01 2024 Tobias Brick - 1.4.0-17 - Patch for CVE-2022-21698 - Moved vendored tarball extraction into %prep and changed from %autosetup to %setup diff --git a/SPECS/azcopy/CVE-2023-44487.patch b/SPECS/azcopy/CVE-2023-44487.patch new file mode 100644 index 00000000000..f8c3056651b --- /dev/null +++ b/SPECS/azcopy/CVE-2023-44487.patch @@ -0,0 +1,142 @@ +From 01f18342b6c8146391dfdf13e189e51ea4a2c7bd Mon Sep 17 00:00:00 2001 +From: Damien Neil +Date: Fri, 6 Oct 2023 09:51:19 -0700 +Subject: [PATCH] http2: limit maximum handler goroutines to + MaxConcurrentStreams + +When the peer opens a new stream while we have MaxConcurrentStreams +handler goroutines running, defer starting a handler until one +of the existing handlers exits. + +Fixes golang/go#63417 +Fixes CVE-2023-39325 + +Change-Id: If0531e177b125700f3e24c5ebd24b1023098fa6d +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2045854 +TryBot-Result: Security TryBots +Reviewed-by: Ian Cottrell +Reviewed-by: Tatiana Bradley +Run-TryBot: Damien Neil +Reviewed-on: https://go-review.googlesource.com/c/net/+/534215 +Reviewed-by: Michael Pratt +Reviewed-by: Dmitri Shuralyov +LUCI-TryBot-Result: Go LUCI +Auto-Submit: Dmitri Shuralyov +Reviewed-by: Damien Neil + +Modified to apply to vendored code by: Daniel McIlvaney + - Adjusted paths + - Removed reference to server_test.go + - Removed reference to upgradeRequest() which is not in old versions of the vendored code +--- + vendor/golang.org/x/net/http2/server.go | 62 ++++++++++++++++++++++++- + 1 file changed, 60 insertions(+), 2 deletions(-) + +diff --git a/vendor/golang.org/x/net/http2/server.go b/vendor/golang.org/x/net/http2/server.go +index e644d9b..f56dbe9 100644 +--- a/vendor/golang.org/x/net/http2/server.go ++++ b/vendor/golang.org/x/net/http2/server.go +@@ -520,9 +520,11 @@ type serverConn struct { + advMaxStreams uint32 // our SETTINGS_MAX_CONCURRENT_STREAMS advertised the client + curClientStreams uint32 // number of open streams initiated by the client + curPushedStreams uint32 // number of open streams initiated by server push ++ curHandlers uint32 // number of running handler goroutines + maxClientStreamID uint32 // max ever seen from client (odd), or 0 if there have been no client requests + maxPushPromiseID uint32 // ID of the last push promise (even), or 0 if there have been no pushes + streams map[uint32]*stream ++ unstartedHandlers []unstartedHandler + initialStreamSendWindowSize int32 + maxFrameSize int32 + headerTableSize uint32 +@@ -909,6 +911,8 @@ func (sc *serverConn) serve() { + return + case gracefulShutdownMsg: + sc.startGracefulShutdownInternal() ++ case handlerDoneMsg: ++ sc.handlerDone() + default: + panic("unknown timer") + } +@@ -954,6 +958,7 @@ var ( + idleTimerMsg = new(serverMessage) + shutdownTimerMsg = new(serverMessage) + gracefulShutdownMsg = new(serverMessage) ++ handlerDoneMsg = new(serverMessage) + ) + + func (sc *serverConn) onSettingsTimer() { sc.sendServeMsg(settingsTimerMsg) } +@@ -1911,8 +1916,7 @@ func (sc *serverConn) processHeaders(f *MetaHeadersFrame) error { + sc.conn.SetReadDeadline(time.Time{}) + } + +- go sc.runHandler(rw, req, handler) +- return nil ++ return sc.scheduleHandler(id, rw, req, handler) + } + + func (st *stream) processTrailerHeaders(f *MetaHeadersFrame) error { +@@ -2159,8 +2163,62 @@ func (sc *serverConn) newWriterAndRequestNoBody(st *stream, rp requestParam) (*r + return rw, req, nil + } + ++type unstartedHandler struct { ++ streamID uint32 ++ rw *responseWriter ++ req *http.Request ++ handler func(http.ResponseWriter, *http.Request) ++} ++ ++// scheduleHandler starts a handler goroutine, ++// or schedules one to start as soon as an existing handler finishes. ++func (sc *serverConn) scheduleHandler(streamID uint32, rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) error { ++ sc.serveG.check() ++ maxHandlers := sc.advMaxStreams ++ if sc.curHandlers < maxHandlers { ++ sc.curHandlers++ ++ go sc.runHandler(rw, req, handler) ++ return nil ++ } ++ if len(sc.unstartedHandlers) > int(4*sc.advMaxStreams) { ++ return sc.countError("too_many_early_resets", ConnectionError(ErrCodeEnhanceYourCalm)) ++ } ++ sc.unstartedHandlers = append(sc.unstartedHandlers, unstartedHandler{ ++ streamID: streamID, ++ rw: rw, ++ req: req, ++ handler: handler, ++ }) ++ return nil ++} ++ ++func (sc *serverConn) handlerDone() { ++ sc.serveG.check() ++ sc.curHandlers-- ++ i := 0 ++ maxHandlers := sc.advMaxStreams ++ for ; i < len(sc.unstartedHandlers); i++ { ++ u := sc.unstartedHandlers[i] ++ if sc.streams[u.streamID] == nil { ++ // This stream was reset before its goroutine had a chance to start. ++ continue ++ } ++ if sc.curHandlers >= maxHandlers { ++ break ++ } ++ sc.curHandlers++ ++ go sc.runHandler(u.rw, u.req, u.handler) ++ sc.unstartedHandlers[i] = unstartedHandler{} // don't retain references ++ } ++ sc.unstartedHandlers = sc.unstartedHandlers[i:] ++ if len(sc.unstartedHandlers) == 0 { ++ sc.unstartedHandlers = nil ++ } ++} ++ + // Run on its own goroutine. + func (sc *serverConn) runHandler(rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) { ++ defer sc.sendServeMsg(handlerDoneMsg) + didPanic := true + defer func() { + rw.rws.stream.cancelCtx() +-- +2.33.8 diff --git a/SPECS/azcopy/azcopy.spec b/SPECS/azcopy/azcopy.spec index 0d40e9cf227..44f0d367f0e 100644 --- a/SPECS/azcopy/azcopy.spec +++ b/SPECS/azcopy/azcopy.spec @@ -1,7 +1,7 @@ Summary: The new Azure Storage data transfer utility - AzCopy v10 Name: azcopy Version: 10.15.0 -Release: 14%{?dist} +Release: 15%{?dist} License: MIT Vendor: Microsoft Corporation Distribution: Mariner @@ -27,6 +27,7 @@ Source0: https://github.com/Azure/azure-storage-azcopy/archive/refs/tags/ # See: https://reproducible-builds.org/docs/archives/ # - For the value of "--mtime" use the date "2021-04-26 00:00Z" to simplify future updates. Source1: azure-storage-%{name}-%{version}-vendor.tar.gz +Patch0: CVE-2023-44487.patch BuildRequires: golang >= 1.17.9 BuildRequires: git @@ -40,10 +41,12 @@ AzCopy V10 presents easy-to-use commands that are optimized for high performance and throughput. %prep -%setup -q -n azure-storage-%{name}-%{version} +%autosetup -N -n azure-storage-%{name}-%{version} +# Apply vendor before patching +tar --no-same-owner -xf %{SOURCE1} +%autopatch -p1 %build -tar --no-same-owner -xf %{SOURCE1} export GOPATH=%{our_gopath} go build -buildmode=pie -mod=vendor @@ -61,6 +64,9 @@ go test -mod=vendor %{_bindir}/azcopy %changelog +* Thu Feb 01 2024 Daniel McIlvaney - 10.15.0-15 +- Address CVE-2023-44487 by patching vendored golang.org/x/net + * Mon Oct 16 2023 CBL-Mariner Servicing Account - 10.15.0-14 - Bump release to rebuild with go 1.20.9 diff --git a/SPECS/blobfuse/blobfuse.spec b/SPECS/blobfuse/blobfuse.spec index 5315c277d99..f9ec3a96309 100644 --- a/SPECS/blobfuse/blobfuse.spec +++ b/SPECS/blobfuse/blobfuse.spec @@ -1,7 +1,7 @@ Summary: FUSE adapter - Azure Storage Blobs Name: blobfuse Version: 1.4.5 -Release: 13%{?dist} +Release: 14%{?dist} License: MIT Vendor: Microsoft Corporation Distribution: Mariner @@ -46,6 +46,9 @@ install -p -m 755 build/blobfuse %{buildroot}%{_bindir}/ %{_bindir}/blobfuse %changelog +* Fri Feb 02 2024 CBL-Mariner Servicing Account - 1.4.5-14 +- Bump release to rebuild with go 1.21.6 + * Mon Oct 16 2023 CBL-Mariner Servicing Account - 1.4.5-13 - Bump release to rebuild with go 1.20.9 diff --git a/SPECS/blobfuse2/blobfuse2.spec b/SPECS/blobfuse2/blobfuse2.spec index 557b7f029bc..f23a77ee669 100644 --- a/SPECS/blobfuse2/blobfuse2.spec +++ b/SPECS/blobfuse2/blobfuse2.spec @@ -7,7 +7,7 @@ Summary: FUSE adapter - Azure Storage Name: blobfuse2 Version: %{blobfuse2_version} -Release: 1%{?dist} +Release: 2%{?dist} License: MIT Vendor: Microsoft Corporation Distribution: Mariner @@ -80,6 +80,9 @@ install -D -m 0644 ./setup/blobfuse2-logrotate %{buildroot}%{_sysconfdir}/logrot %{_sysconfdir}/logrotate.d/blobfuse2 %changelog +* Fri Feb 02 2024 CBL-Mariner Servicing Account - 2.1.2-2 +- Bump release to rebuild with go 1.21.6 + * Fri Nov 17 2023 Anubhuti Shruti - 2.1.2-1 - Bump version to 2.1.2 diff --git a/SPECS/cert-manager/cert-manager.spec b/SPECS/cert-manager/cert-manager.spec index 75eeaacf7fb..429f73c03b2 100644 --- a/SPECS/cert-manager/cert-manager.spec +++ b/SPECS/cert-manager/cert-manager.spec @@ -1,7 +1,7 @@ Summary: Automatically provision and manage TLS certificates in Kubernetes Name: cert-manager Version: 1.11.2 -Release: 7%{?dist} +Release: 8%{?dist} License: ASL 2.0 Vendor: Microsoft Corporation Distribution: Mariner @@ -112,6 +112,9 @@ install -D -m0755 bin/webhook %{buildroot}%{_bindir}/ %{_bindir}/webhook %changelog +* Fri Feb 02 2024 CBL-Mariner Servicing Account - 1.11.2-8 +- Bump release to rebuild with go 1.21.6 + * Fri Jan 18 2024 Tobias Brick - 1.11.2-7 - Patch for CVE-2023-48795 diff --git a/SPECS/cf-cli/CVE-2021-44716.patch b/SPECS/cf-cli/CVE-2021-44716.patch new file mode 100644 index 00000000000..dc3adbff678 --- /dev/null +++ b/SPECS/cf-cli/CVE-2021-44716.patch @@ -0,0 +1,51 @@ +Parent: db4efeb8 (http2: deflake TestTransportGroupsPendingDials) +Author: Damien Neil +AuthorDate: 2021-12-06 14:31:43 -0800 +Commit: Filippo Valsorda +CommitDate: 2021-12-09 12:49:13 +0000 + +http2: cap the size of the server's canonical header cache + +The HTTP/2 server keeps a per-connection cache mapping header keys +to their canonicalized form (e.g., "foo-bar" => "Foo-Bar"). Cap the +maximum size of this cache to prevent a peer sending many unique +header keys from causing unbounded memory growth. + +Cap chosen arbitrarily at 32 entries. Since this cache does not +include common headers (e.g., "content-type"), 32 seems like more +than enough for almost all normal uses. + +Fixes #50058 +Fixes CVE-2021-44716 + +Change-Id: Ia83696dc23253c12af8f26d502557c2cc9841105 +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1290827 +Reviewed-by: Roland Shoemaker +Reviewed-on: https://go-review.googlesource.com/c/net/+/369794 +Trust: Filippo Valsorda +Run-TryBot: Filippo Valsorda +Trust: Damien Neil +Reviewed-by: Russ Cox +Reviewed-by: Filippo Valsorda +TryBot-Result: Gopher Robot + +diff -ru cli-20.10.27-orig/vendor/golang.org/x/net/http2/server.go cli-20.10.27/vendor/golang.org/x/net/http2/server.go +--- cli-20.10.27-orig/vendor/golang.org/x/net/http2/server.go 2024-02-05 08:53:30.802532951 -0800 ++++ cli-20.10.27/vendor/golang.org/x/net/http2/server.go 2024-02-05 09:19:08.473430121 -0800 +@@ -720,7 +720,15 @@ + sc.canonHeader = make(map[string]string) + } + cv = http.CanonicalHeaderKey(v) +- sc.canonHeader[v] = cv ++ // maxCachedCanonicalHeaders is an arbitrarily-chosen limit on the number of ++ // entries in the canonHeader cache. This should be larger than the number ++ // of unique, uncommon header keys likely to be sent by the peer, while not ++ // so high as to permit unreaasonable memory usage if the peer sends an unbounded ++ // number of unique header keys. ++ const maxCachedCanonicalHeaders = 32 ++ if len(sc.canonHeader) < maxCachedCanonicalHeaders { ++ sc.canonHeader[v] = cv ++ } + return cv + } + \ No newline at end of file diff --git a/SPECS/cf-cli/CVE-2023-44487.patch b/SPECS/cf-cli/CVE-2023-44487.patch new file mode 100644 index 00000000000..aec84cb4945 --- /dev/null +++ b/SPECS/cf-cli/CVE-2023-44487.patch @@ -0,0 +1,142 @@ +From da2ab23db5f9fe2a57a42c6882e5fb7791ad9de4 Mon Sep 17 00:00:00 2001 +From: Damien Neil +Date: Fri, 6 Oct 2023 09:51:19 -0700 +Subject: [PATCH] http2: limit maximum handler goroutines to + MaxConcurrentStreams + +When the peer opens a new stream while we have MaxConcurrentStreams +handler goroutines running, defer starting a handler until one +of the existing handlers exits. + +Fixes golang/go#63417 +Fixes CVE-2023-39325 + +Change-Id: If0531e177b125700f3e24c5ebd24b1023098fa6d +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2045854 +TryBot-Result: Security TryBots +Reviewed-by: Ian Cottrell +Reviewed-by: Tatiana Bradley +Run-TryBot: Damien Neil +Reviewed-on: https://go-review.googlesource.com/c/net/+/534215 +Reviewed-by: Michael Pratt +Reviewed-by: Dmitri Shuralyov +LUCI-TryBot-Result: Go LUCI +Auto-Submit: Dmitri Shuralyov +Reviewed-by: Damien Neil + +Modified to apply to vendored code by: Daniel McIlvaney + - Adjusted paths + - Removed reference to server_test.go + - Removed reference to upgradeRequest() which is not in old versions of the vendored code +--- + vendor/golang.org/x/net/http2/server.go | 62 ++++++++++++++++++++++++- + 1 file changed, 60 insertions(+), 2 deletions(-) + +diff --git a/vendor/golang.org/x/net/http2/server.go b/vendor/golang.org/x/net/http2/server.go +index c67e9b7..9636fc0 100644 +--- a/vendor/golang.org/x/net/http2/server.go ++++ b/vendor/golang.org/x/net/http2/server.go +@@ -520,9 +520,11 @@ type serverConn struct { + advMaxStreams uint32 // our SETTINGS_MAX_CONCURRENT_STREAMS advertised the client + curClientStreams uint32 // number of open streams initiated by the client + curPushedStreams uint32 // number of open streams initiated by server push ++ curHandlers uint32 // number of running handler goroutines + maxClientStreamID uint32 // max ever seen from client (odd), or 0 if there have been no client requests + maxPushPromiseID uint32 // ID of the last push promise (even), or 0 if there have been no pushes + streams map[uint32]*stream ++ unstartedHandlers []unstartedHandler + initialStreamSendWindowSize int32 + maxFrameSize int32 + headerTableSize uint32 +@@ -901,6 +903,8 @@ func (sc *serverConn) serve() { + return + case gracefulShutdownMsg: + sc.startGracefulShutdownInternal() ++ case handlerDoneMsg: ++ sc.handlerDone() + default: + panic("unknown timer") + } +@@ -946,6 +950,7 @@ var ( + idleTimerMsg = new(serverMessage) + shutdownTimerMsg = new(serverMessage) + gracefulShutdownMsg = new(serverMessage) ++ handlerDoneMsg = new(serverMessage) + ) + + func (sc *serverConn) onSettingsTimer() { sc.sendServeMsg(settingsTimerMsg) } +@@ -1903,8 +1908,7 @@ func (sc *serverConn) processHeaders(f *MetaHeadersFrame) error { + sc.conn.SetReadDeadline(time.Time{}) + } + +- go sc.runHandler(rw, req, handler) +- return nil ++ return sc.scheduleHandler(id, rw, req, handler) + } + + func (st *stream) processTrailerHeaders(f *MetaHeadersFrame) error { +@@ -2151,8 +2155,62 @@ func (sc *serverConn) newWriterAndRequestNoBody(st *stream, rp requestParam) (*r + return rw, req, nil + } + ++type unstartedHandler struct { ++ streamID uint32 ++ rw *responseWriter ++ req *http.Request ++ handler func(http.ResponseWriter, *http.Request) ++} ++ ++// scheduleHandler starts a handler goroutine, ++// or schedules one to start as soon as an existing handler finishes. ++func (sc *serverConn) scheduleHandler(streamID uint32, rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) error { ++ sc.serveG.check() ++ maxHandlers := sc.advMaxStreams ++ if sc.curHandlers < maxHandlers { ++ sc.curHandlers++ ++ go sc.runHandler(rw, req, handler) ++ return nil ++ } ++ if len(sc.unstartedHandlers) > int(4*sc.advMaxStreams) { ++ return sc.countError("too_many_early_resets", ConnectionError(ErrCodeEnhanceYourCalm)) ++ } ++ sc.unstartedHandlers = append(sc.unstartedHandlers, unstartedHandler{ ++ streamID: streamID, ++ rw: rw, ++ req: req, ++ handler: handler, ++ }) ++ return nil ++} ++ ++func (sc *serverConn) handlerDone() { ++ sc.serveG.check() ++ sc.curHandlers-- ++ i := 0 ++ maxHandlers := sc.advMaxStreams ++ for ; i < len(sc.unstartedHandlers); i++ { ++ u := sc.unstartedHandlers[i] ++ if sc.streams[u.streamID] == nil { ++ // This stream was reset before its goroutine had a chance to start. ++ continue ++ } ++ if sc.curHandlers >= maxHandlers { ++ break ++ } ++ sc.curHandlers++ ++ go sc.runHandler(u.rw, u.req, u.handler) ++ sc.unstartedHandlers[i] = unstartedHandler{} // don't retain references ++ } ++ sc.unstartedHandlers = sc.unstartedHandlers[i:] ++ if len(sc.unstartedHandlers) == 0 { ++ sc.unstartedHandlers = nil ++ } ++} ++ + // Run on its own goroutine. + func (sc *serverConn) runHandler(rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) { ++ defer sc.sendServeMsg(handlerDoneMsg) + didPanic := true + defer func() { + rw.rws.stream.cancelCtx() +-- +2.33.8 diff --git a/SPECS/cf-cli/cf-cli.spec b/SPECS/cf-cli/cf-cli.spec index 1c30573bfa9..1b3da2855d4 100644 --- a/SPECS/cf-cli/cf-cli.spec +++ b/SPECS/cf-cli/cf-cli.spec @@ -1,7 +1,7 @@ Summary: The official command line client for Cloud Foundry. Name: cf-cli Version: 8.4.0 -Release: 14%{?dist} +Release: 16%{?dist} License: Apache-2.0 Vendor: Microsoft Corporation Distribution: Mariner @@ -28,6 +28,10 @@ Source0: https://github.com/cloudfoundry/cli/archive/refs/tags/v%{version # - For the value of "--mtime" use the date "2021-04-26 00:00Z" to simplify future updates. Source1: cli-%{version}-vendor.tar.gz +# patches for vendored code >= 1000 +Patch1000: CVE-2023-44487.patch +Patch1001: CVE-2021-44716.patch + BuildRequires: golang >= 1.18.3 %global debug_package %{nil} %define our_gopath %{_topdir}/.gopath @@ -36,10 +40,12 @@ BuildRequires: golang >= 1.18.3 The official command line client for Cloud Foundry. %prep -%setup -q -n cli-%{version} +%autosetup -N -n cli-%{version} +# Apply vendor before patching +tar --no-same-owner -xf %{SOURCE1} +%autopatch -p1 %build -tar --no-same-owner -xf %{SOURCE1} export GOPATH=%{our_gopath} # No mod download use vednor cache locally sed -i 's/GOFLAGS := -mod=mod/GOFLAGS := -mod=vendor/' ./Makefile @@ -59,6 +65,12 @@ install -p -m 755 -t %{buildroot}%{_bindir} ./out/cf %{_bindir}/cf %changelog +* Mon Feb 05 2024 Nicolas Guibourge - 8.4.0-16 +- Patch CVE-2021-44716 + +* Thu Feb 01 2024 Daniel McIlvaney - 8.4.0-15 +- Address CVE-2023-44487 by patching vendored golang.org/x/net + * Mon Oct 16 2023 CBL-Mariner Servicing Account - 8.4.0-14 - Bump release to rebuild with go 1.20.9 diff --git a/SPECS/cni-plugins/cni-plugins.spec b/SPECS/cni-plugins/cni-plugins.spec index 257d2982eec..8733f80ebfb 100644 --- a/SPECS/cni-plugins/cni-plugins.spec +++ b/SPECS/cni-plugins/cni-plugins.spec @@ -1,7 +1,7 @@ Summary: Container Network Interface (CNI) plugins Name: cni-plugins Version: 1.3.0 -Release: 1%{?dist} +Release: 2%{?dist} License: ASL 2.0 Vendor: Microsoft Corporation Distribution: Mariner @@ -39,6 +39,9 @@ make -k check |& tee %{_specdir}/%{name}-check-log || %{nocheck} %{_default_cni_plugins_dir}/* %changelog +* Fri Feb 02 2024 CBL-Mariner Servicing Account - 1.3.0-2 +- Bump release to rebuild with go 1.21.6 + * Wed Oct 18 2023 Mateusz Gozdek - 1.3.0-1 - Make plugin binaries correctly print version - Upgrade to version 1.3.0 diff --git a/SPECS/cni/cni.spec b/SPECS/cni/cni.spec index 878f7520a79..f3e7539e943 100644 --- a/SPECS/cni/cni.spec +++ b/SPECS/cni/cni.spec @@ -24,7 +24,7 @@ Summary: Container Network Interface - networking for Linux containers Name: cni Version: 1.0.1 -Release: 15%{?dist} +Release: 16%{?dist} License: Apache-2.0 Vendor: Microsoft Corporation Distribution: Mariner @@ -113,6 +113,9 @@ install -m 755 -d "%{buildroot}%{cni_doc_dir}" %{_sbindir}/cnitool %changelog +* Fri Feb 02 2024 CBL-Mariner Servicing Account - 1.0.1-16 +- Bump release to rebuild with go 1.21.6 + * Mon Oct 16 2023 CBL-Mariner Servicing Account - 1.0.1-15 - Bump release to rebuild with go 1.20.9 diff --git a/SPECS/containerized-data-importer/CVE-2023-44487.patch b/SPECS/containerized-data-importer/CVE-2023-44487.patch new file mode 100644 index 00000000000..77e6b7c55e8 --- /dev/null +++ b/SPECS/containerized-data-importer/CVE-2023-44487.patch @@ -0,0 +1,144 @@ +From 3e8ce1c39cf6d172525355eafebaaef98417f1da Mon Sep 17 00:00:00 2001 +From: Damien Neil +Date: Fri, 6 Oct 2023 09:51:19 -0700 +Subject: [PATCH] http2: limit maximum handler goroutines to + MaxConcurrentStreams + +When the peer opens a new stream while we have MaxConcurrentStreams +handler goroutines running, defer starting a handler until one +of the existing handlers exits. + +Fixes golang/go#63417 +Fixes CVE-2023-39325 + +Change-Id: If0531e177b125700f3e24c5ebd24b1023098fa6d +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2045854 +TryBot-Result: Security TryBots +Reviewed-by: Ian Cottrell +Reviewed-by: Tatiana Bradley +Run-TryBot: Damien Neil +Reviewed-on: https://go-review.googlesource.com/c/net/+/534215 +Reviewed-by: Michael Pratt +Reviewed-by: Dmitri Shuralyov +LUCI-TryBot-Result: Go LUCI +Auto-Submit: Dmitri Shuralyov +Reviewed-by: Damien Neil + +Modified to apply to vendored code by: Daniel McIlvaney + - Adjusted paths + - Removed reference to server_test.go + - Removed reference to upgradeRequest() which is not in old versions of the vendored code +--- + .../vendor/golang.org/x/net/http2/server.go | 62 +- + .../golang.org/x/net/http2/server.go.orig | 3032 +++++++++++++++++ + 2 files changed, 3092 insertions(+), 2 deletions(-) + create mode 100644 containerized-data-importer-1.55.0/vendor/golang.org/x/net/http2/server.go.orig + +diff --git a/vendor/golang.org/x/net/http2/server.go b/vendor/golang.org/x/net/http2/server.go +index e644d9b..f56dbe9 100644 +--- a/vendor/golang.org/x/net/http2/server.go ++++ b/vendor/golang.org/x/net/http2/server.go +@@ -520,9 +520,11 @@ type serverConn struct { + advMaxStreams uint32 // our SETTINGS_MAX_CONCURRENT_STREAMS advertised the client + curClientStreams uint32 // number of open streams initiated by the client + curPushedStreams uint32 // number of open streams initiated by server push ++ curHandlers uint32 // number of running handler goroutines + maxClientStreamID uint32 // max ever seen from client (odd), or 0 if there have been no client requests + maxPushPromiseID uint32 // ID of the last push promise (even), or 0 if there have been no pushes + streams map[uint32]*stream ++ unstartedHandlers []unstartedHandler + initialStreamSendWindowSize int32 + maxFrameSize int32 + headerTableSize uint32 +@@ -909,6 +911,8 @@ func (sc *serverConn) serve() { + return + case gracefulShutdownMsg: + sc.startGracefulShutdownInternal() ++ case handlerDoneMsg: ++ sc.handlerDone() + default: + panic("unknown timer") + } +@@ -954,6 +958,7 @@ var ( + idleTimerMsg = new(serverMessage) + shutdownTimerMsg = new(serverMessage) + gracefulShutdownMsg = new(serverMessage) ++ handlerDoneMsg = new(serverMessage) + ) + + func (sc *serverConn) onSettingsTimer() { sc.sendServeMsg(settingsTimerMsg) } +@@ -1911,8 +1916,7 @@ func (sc *serverConn) processHeaders(f *MetaHeadersFrame) error { + sc.conn.SetReadDeadline(time.Time{}) + } + +- go sc.runHandler(rw, req, handler) +- return nil ++ return sc.scheduleHandler(id, rw, req, handler) + } + + func (st *stream) processTrailerHeaders(f *MetaHeadersFrame) error { +@@ -2159,8 +2163,62 @@ func (sc *serverConn) newWriterAndRequestNoBody(st *stream, rp requestParam) (*r + return rw, req, nil + } + ++type unstartedHandler struct { ++ streamID uint32 ++ rw *responseWriter ++ req *http.Request ++ handler func(http.ResponseWriter, *http.Request) ++} ++ ++// scheduleHandler starts a handler goroutine, ++// or schedules one to start as soon as an existing handler finishes. ++func (sc *serverConn) scheduleHandler(streamID uint32, rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) error { ++ sc.serveG.check() ++ maxHandlers := sc.advMaxStreams ++ if sc.curHandlers < maxHandlers { ++ sc.curHandlers++ ++ go sc.runHandler(rw, req, handler) ++ return nil ++ } ++ if len(sc.unstartedHandlers) > int(4*sc.advMaxStreams) { ++ return sc.countError("too_many_early_resets", ConnectionError(ErrCodeEnhanceYourCalm)) ++ } ++ sc.unstartedHandlers = append(sc.unstartedHandlers, unstartedHandler{ ++ streamID: streamID, ++ rw: rw, ++ req: req, ++ handler: handler, ++ }) ++ return nil ++} ++ ++func (sc *serverConn) handlerDone() { ++ sc.serveG.check() ++ sc.curHandlers-- ++ i := 0 ++ maxHandlers := sc.advMaxStreams ++ for ; i < len(sc.unstartedHandlers); i++ { ++ u := sc.unstartedHandlers[i] ++ if sc.streams[u.streamID] == nil { ++ // This stream was reset before its goroutine had a chance to start. ++ continue ++ } ++ if sc.curHandlers >= maxHandlers { ++ break ++ } ++ sc.curHandlers++ ++ go sc.runHandler(u.rw, u.req, u.handler) ++ sc.unstartedHandlers[i] = unstartedHandler{} // don't retain references ++ } ++ sc.unstartedHandlers = sc.unstartedHandlers[i:] ++ if len(sc.unstartedHandlers) == 0 { ++ sc.unstartedHandlers = nil ++ } ++} ++ + // Run on its own goroutine. + func (sc *serverConn) runHandler(rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) { ++ defer sc.sendServeMsg(handlerDoneMsg) + didPanic := true + defer func() { + rw.rws.stream.cancelCtx() +-- +2.33.8 diff --git a/SPECS/containerized-data-importer/containerized-data-importer.spec b/SPECS/containerized-data-importer/containerized-data-importer.spec index 50daaca9830..22fc9f6421a 100644 --- a/SPECS/containerized-data-importer/containerized-data-importer.spec +++ b/SPECS/containerized-data-importer/containerized-data-importer.spec @@ -18,7 +18,7 @@ Summary: Container native virtualization Name: containerized-data-importer Version: 1.55.0 -Release: 16%{?dist} +Release: 17%{?dist} License: ASL 2.0 Vendor: Microsoft Corporation Distribution: Mariner @@ -33,6 +33,7 @@ BuildRequires: rsync BuildRequires: sed Provides: cdi = %{version}-%{release} ExclusiveArch: x86_64 aarch64 +Patch0: CVE-2023-44487.patch %description Containerized-Data-Importer (CDI) is a persistent storage management add-on for Kubernetes @@ -106,8 +107,10 @@ kubernetes installation with kubectl apply. # Note: having bar symlink'ed to DIR/src/foo/bar does not seem to work. Looks # like symlinks in go path are not resolved correctly. Hence the sources need # to be 'physically' placed into the proper location. -%setup -q -n go/src/kubevirt.io/%{name} -c -T +%autosetup -N -n go/src/kubevirt.io/%{name} -c -T +# Apply vendor before patching tar --strip-components=1 -xf %{SOURCE0} +%autopatch -p1 %build @@ -198,6 +201,9 @@ install -m 0644 _out/manifests/release/cdi-cr.yaml %{buildroot}%{_datadir}/cdi/m %{_datadir}/cdi/manifests %changelog +* Thu Feb 01 2024 Daniel McIlvaney - 1.55.0-17 +- Address CVE-2023-44487 by patching vendored golang.org/x/net + * Mon Oct 16 2023 CBL-Mariner Servicing Account - 1.55.0-16 - Bump release to rebuild with go 1.20.9 diff --git a/SPECS/coredns/CVE-2023-44487.patch b/SPECS/coredns/CVE-2023-44487.patch index e8c1d327535..30f0d80197e 100644 --- a/SPECS/coredns/CVE-2023-44487.patch +++ b/SPECS/coredns/CVE-2023-44487.patch @@ -1,4 +1,3 @@ -From b225e7ca6dde1ef5a5ae5ce922861bda011cfabd Mon Sep 17 00:00:00 2001 From: Damien Neil Date: Fri, 6 Oct 2023 09:51:19 -0700 Subject: [PATCH] http2: limit maximum handler goroutines to @@ -28,13 +27,11 @@ Modified to apply to vendored code by: Daniel McIlvaney - Adjusted paths - Removed reference to server_test.go --- - - vendor/golang.org/x/net/http2/server.go | 66 ++++++++++++++++++++++++- - vendor/golang.org/x/net/http2/server_test.go | 113 +++++++++++++++++++++++++++++++++++++++++++ - 2 files changed, 177 insertions(+), 2 deletions(-) + vendor/golang.org/x/net/http2/server.go | 66 ++++++++++++++++++++++++- + 1 file changed, 64 insertions(+), 2 deletions(-) diff --git a/vendor/golang.org/x/net/http2/server.go b/vendor/golang.org/x/net/http2/server.go -index de60fa88f..02c88b6b3 100644 +index 033b6e6..4561e3c 100644 --- a/vendor/golang.org/x/net/http2/server.go +++ b/vendor/golang.org/x/net/http2/server.go @@ -581,9 +581,11 @@ type serverConn struct { @@ -58,28 +55,28 @@ index de60fa88f..02c88b6b3 100644 default: panic("unknown timer") } -@@ -1020,6 +1024,7 @@ var ( +@@ -1028,6 +1032,7 @@ var ( idleTimerMsg = new(serverMessage) shutdownTimerMsg = new(serverMessage) gracefulShutdownMsg = new(serverMessage) + handlerDoneMsg = new(serverMessage) ) - + func (sc *serverConn) onSettingsTimer() { sc.sendServeMsg(settingsTimerMsg) } -@@ -2017,8 +2022,7 @@ func (sc *serverConn) processHeaders(f *MetaHeadersFrame) error { - st.readDeadline = time.AfterFunc(sc.hs.ReadTimeout, st.onReadTimeout) +@@ -2025,8 +2030,7 @@ func (sc *serverConn) processHeaders(f *MetaHeadersFrame) error { + } } - + - go sc.runHandler(rw, req, handler) - return nil + return sc.scheduleHandler(id, rw, req, handler) } - + func (sc *serverConn) upgradeRequest(req *http.Request) { -@@ -2038,6 +2042,10 @@ func (sc *serverConn) upgradeRequest(req *http.Request) { +@@ -2046,6 +2050,10 @@ func (sc *serverConn) upgradeRequest(req *http.Request) { sc.conn.SetReadDeadline(time.Time{}) } - + + // This is the first request on the connection, + // so start the handler directly rather than going + // through scheduleHandler. @@ -87,10 +84,10 @@ index de60fa88f..02c88b6b3 100644 go sc.runHandler(rw, req, sc.handler.ServeHTTP) } -@@ -2278,8 +2286,62 @@ func (sc *serverConn) newResponseWriter(st *stream, req *http.Request) *response +@@ -2286,8 +2294,62 @@ func (sc *serverConn) newResponseWriter(st *stream, req *http.Request) *response return &responseWriter{rws: rws} } - + +type unstartedHandler struct { + streamID uint32 + rw *responseWriter @@ -150,3 +147,5 @@ index de60fa88f..02c88b6b3 100644 didPanic := true defer func() { rw.rws.stream.cancelCtx() +-- +2.33.8 diff --git a/SPECS/coredns/CVE-2023-49295.patch b/SPECS/coredns/CVE-2023-49295.patch new file mode 100644 index 00000000000..2264812562b --- /dev/null +++ b/SPECS/coredns/CVE-2023-49295.patch @@ -0,0 +1,88 @@ +From d7aa627ebde91cf799ada2a07443faa9b1e5abb8 Mon Sep 17 00:00:00 2001 +From: Marten Seemann +Date: Wed, 13 Dec 2023 09:47:09 +0530 +Subject: [PATCH] limit the number of queued PATH_RESPONSE frames to 256 + (#4199) + +--- + framer.go | 37 +++++++++++++++++++++++++++++------ + framer_test.go | 52 +++++++++++++++++++++++++++++++++++++++++++++++++- + 2 files changed, 82 insertions(+), 7 deletions(-) + +diff --git a/vendor/github.com/quic-go/quic-go/framer.go b/vendor/github.com/quic-go/framer.go +index 9409af4c2e..d5c61bcf73 100644 +--- a/vendor/github.com/quic-go/quic-go/framer.go ++++ b/vendor/github.com/quic-go/quic-go/framer.go +@@ -23,6 +23,8 @@ type framer interface { + Handle0RTTRejection() error + } + ++const maxPathResponses = 256 ++ + type framerI struct { + mutex sync.Mutex + +@@ -33,6 +35,7 @@ type framerI struct { + + controlFrameMutex sync.Mutex + controlFrames []wire.Frame ++ pathResponses []*wire.PathResponseFrame + } + + var _ framer = &framerI{} +@@ -52,20 +55,43 @@ func (f *framerI) HasData() bool { + return true + } + f.controlFrameMutex.Lock() +- hasData = len(f.controlFrames) > 0 +- f.controlFrameMutex.Unlock() +- return hasData ++ defer f.controlFrameMutex.Unlock() ++ return len(f.controlFrames) > 0 || len(f.pathResponses) > 0 + } + + func (f *framerI) QueueControlFrame(frame wire.Frame) { + f.controlFrameMutex.Lock() ++ defer f.controlFrameMutex.Unlock() ++ ++ if pr, ok := frame.(*wire.PathResponseFrame); ok { ++ // Only queue up to maxPathResponses PATH_RESPONSE frames. ++ // This limit should be high enough to never be hit in practice, ++ // unless the peer is doing something malicious. ++ if len(f.pathResponses) >= maxPathResponses { ++ return ++ } ++ f.pathResponses = append(f.pathResponses, pr) ++ return ++ } + f.controlFrames = append(f.controlFrames, frame) +- f.controlFrameMutex.Unlock() + } + + func (f *framerI) AppendControlFrames(frames []ackhandler.Frame, maxLen protocol.ByteCount, v protocol.VersionNumber) ([]ackhandler.Frame, protocol.ByteCount) { +- var length protocol.ByteCount + f.controlFrameMutex.Lock() ++ defer f.controlFrameMutex.Unlock() ++ ++ var length protocol.ByteCount ++ // add a PATH_RESPONSE first, but only pack a single PATH_RESPONSE per packet ++ if len(f.pathResponses) > 0 { ++ frame := f.pathResponses[0] ++ frameLen := frame.Length(v) ++ if frameLen <= maxLen { ++ frames = append(frames, ackhandler.Frame{Frame: frame}) ++ length += frameLen ++ f.pathResponses = f.pathResponses[1:] ++ } ++ } ++ + for len(f.controlFrames) > 0 { + frame := f.controlFrames[len(f.controlFrames)-1] + frameLen := frame.Length(v) +@@ -76,7 +102,6 @@ func (f *framerI) AppendControlFrames(frames []ackhandler.Frame, maxLen protocol + length += frameLen + f.controlFrames = f.controlFrames[:len(f.controlFrames)-1] + } +- f.controlFrameMutex.Unlock() + return frames, length + } diff --git a/SPECS/coredns/coredns.spec b/SPECS/coredns/coredns.spec index 45551362bec..075c2857952 100644 --- a/SPECS/coredns/coredns.spec +++ b/SPECS/coredns/coredns.spec @@ -3,7 +3,7 @@ Summary: Fast and flexible DNS server Name: coredns Version: 1.11.1 -Release: 2%{?dist} +Release: 5%{?dist} License: Apache License 2.0 Vendor: Microsoft Corporation Distribution: Mariner @@ -31,9 +31,8 @@ Source0: %{name}-%{version}.tar.gz # - For the value of "--mtime" use the date "2021-04-26 00:00Z" to simplify future updates. Source1: %{name}-%{version}-vendor.tar.gz Patch0: makefile-buildoption-commitnb.patch - -# Patch for old x/net/http2 vendored code, apply after vendored code is extracted. -Patch1000: CVE-2023-44487.patch +Patch1: CVE-2023-44487.patch +Patch2: CVE-2023-49295.patch BuildRequires: golang >= 1.12 @@ -42,12 +41,11 @@ CoreDNS is a fast and flexible DNS server. %prep %autosetup -N -%autopatch -p1 -M 999 +# Apply vendor before patching +tar --no-same-owner -xf %{SOURCE1} +%autopatch -p1 %build -# create vendor folder from the vendor tarball and set vendor mode -tar -xf %{SOURCE1} --no-same-owner -patch -p1 < %{PATCH1000} export BUILDOPTS="-mod=vendor -v" # set commit number that correspond to the github tag for that version export GITCOMMIT="ae2bbc29be1aaae0b3ded5d188968a6c97bb3144" @@ -56,11 +54,11 @@ make %check # From go.test.yml go install github.com/fatih/faillint@latest && \ -(cd request && go test -v -race ./...) && \ -(cd core && go test -v -race ./...) && \ -(cd coremain && go test -v -race ./...) && \ -(cd plugin && go test -v -race ./...) && \ -(cd test && go test -v -race ./...) && \ +(cd request && go test -v -mod=vendor -race ./...) && \ +(cd core && go test -v -mod=vendor -race ./...) && \ +(cd coremain && go test -v -mod=vendor -race ./...) && \ +(cd plugin && go test -v -mod=vendor -race ./...) && \ +(cd test && go test -v -mod=vendor -race ./...) && \ ./coredns -version %install @@ -73,6 +71,16 @@ install -p -m 755 -t %{buildroot}%{_bindir} %{name} %{_bindir}/%{name} %changelog +* Fri Feb 10 2024 Mykhailo Bykhovtsev - 1.11.1-5 +- patched vendored quic-go package to address CVE-2023-49295 + +* Thu Feb 08 2024 Muhammad Falak - 1.11.1-4 +- Bump release to rebuild with go 1.21.6 + +* Mon Feb 05 2024 Daniel McIlvaney - 1.11.1-3 +- Refactor vendor patch application +- Force vendored components during test + * Mon Jan 29 2024 Daniel McIlvaney - 1.11.1-2 - Address CVE-2023-44487 by patching vendored golang.org/x/net diff --git a/SPECS/cri-o/cri-o.spec b/SPECS/cri-o/cri-o.spec index da4842f8a4c..4d61faab2e7 100644 --- a/SPECS/cri-o/cri-o.spec +++ b/SPECS/cri-o/cri-o.spec @@ -26,7 +26,7 @@ Summary: OCI-based implementation of Kubernetes Container Runtime Interfa # Define macros for further referenced sources Name: cri-o Version: 1.21.2 -Release: 18%{?dist} +Release: 19%{?dist} License: ASL 2.0 Vendor: Microsoft Corporation Distribution: Mariner @@ -203,6 +203,9 @@ mkdir -p /opt/cni/bin %{_fillupdir}/sysconfig.kubelet %changelog +* Fri Feb 02 2024 CBL-Mariner Servicing Account - 1.21.2-19 +- Bump release to rebuild with go 1.21.6 + * Mon Oct 16 2023 CBL-Mariner Servicing Account - 1.21.2-18 - Bump release to rebuild with go 1.20.9 diff --git a/SPECS/cri-tools/cri-tools.spec b/SPECS/cri-tools/cri-tools.spec index 544992fd313..88b670f1a29 100644 --- a/SPECS/cri-tools/cri-tools.spec +++ b/SPECS/cri-tools/cri-tools.spec @@ -7,7 +7,7 @@ Summary: CRI tools Name: cri-tools Version: 1.28.0 -Release: 3%{?dist} +Release: 4%{?dist} License: Apache-2.0 Vendor: Microsoft Corporation Distribution: Mariner @@ -44,6 +44,9 @@ install -p -m 755 -t %{buildroot}%{_bindir} "${BUILD_FOLDER}/critest" %{_bindir}/critest %changelog +* Fri Feb 02 2024 CBL-Mariner Servicing Account - 1.28.0-4 +- Bump release to rebuild with go 1.21.6 + * Mon Oct 16 2023 CBL-Mariner Servicing Account - 1.28.0-3 - Bump release to rebuild with go 1.20.9 diff --git a/SPECS/csi-driver-lvm/CVE-2021-44716.patch b/SPECS/csi-driver-lvm/CVE-2021-44716.patch new file mode 100644 index 00000000000..dc3adbff678 --- /dev/null +++ b/SPECS/csi-driver-lvm/CVE-2021-44716.patch @@ -0,0 +1,51 @@ +Parent: db4efeb8 (http2: deflake TestTransportGroupsPendingDials) +Author: Damien Neil +AuthorDate: 2021-12-06 14:31:43 -0800 +Commit: Filippo Valsorda +CommitDate: 2021-12-09 12:49:13 +0000 + +http2: cap the size of the server's canonical header cache + +The HTTP/2 server keeps a per-connection cache mapping header keys +to their canonicalized form (e.g., "foo-bar" => "Foo-Bar"). Cap the +maximum size of this cache to prevent a peer sending many unique +header keys from causing unbounded memory growth. + +Cap chosen arbitrarily at 32 entries. Since this cache does not +include common headers (e.g., "content-type"), 32 seems like more +than enough for almost all normal uses. + +Fixes #50058 +Fixes CVE-2021-44716 + +Change-Id: Ia83696dc23253c12af8f26d502557c2cc9841105 +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1290827 +Reviewed-by: Roland Shoemaker +Reviewed-on: https://go-review.googlesource.com/c/net/+/369794 +Trust: Filippo Valsorda +Run-TryBot: Filippo Valsorda +Trust: Damien Neil +Reviewed-by: Russ Cox +Reviewed-by: Filippo Valsorda +TryBot-Result: Gopher Robot + +diff -ru cli-20.10.27-orig/vendor/golang.org/x/net/http2/server.go cli-20.10.27/vendor/golang.org/x/net/http2/server.go +--- cli-20.10.27-orig/vendor/golang.org/x/net/http2/server.go 2024-02-05 08:53:30.802532951 -0800 ++++ cli-20.10.27/vendor/golang.org/x/net/http2/server.go 2024-02-05 09:19:08.473430121 -0800 +@@ -720,7 +720,15 @@ + sc.canonHeader = make(map[string]string) + } + cv = http.CanonicalHeaderKey(v) +- sc.canonHeader[v] = cv ++ // maxCachedCanonicalHeaders is an arbitrarily-chosen limit on the number of ++ // entries in the canonHeader cache. This should be larger than the number ++ // of unique, uncommon header keys likely to be sent by the peer, while not ++ // so high as to permit unreaasonable memory usage if the peer sends an unbounded ++ // number of unique header keys. ++ const maxCachedCanonicalHeaders = 32 ++ if len(sc.canonHeader) < maxCachedCanonicalHeaders { ++ sc.canonHeader[v] = cv ++ } + return cv + } + \ No newline at end of file diff --git a/SPECS/csi-driver-lvm/csi-driver-lvm.spec b/SPECS/csi-driver-lvm/csi-driver-lvm.spec index b8553b7f306..649343c3a62 100644 --- a/SPECS/csi-driver-lvm/csi-driver-lvm.spec +++ b/SPECS/csi-driver-lvm/csi-driver-lvm.spec @@ -1,7 +1,7 @@ Summary: Container storage interface for logical volume management Name: csi-driver-lvm Version: 0.4.1 -Release: 14%{?dist} +Release: 15%{?dist} License: MIT Vendor: Microsoft Corporation Distribution: Mariner @@ -19,6 +19,10 @@ Source0: https://github.com/metal-stack/%{name}/archive/refs/tags/v%{vers # --pax-option=exthdr.name=%d/PaxHeaders/%f,delete=atime,delete=ctime \ # -cf %%{name}-%%{version}-govendor.tar.gz vendor Source1: %{name}-%{version}-govendor.tar.gz + +# patches for vendored code >= 1000 +Patch1000: CVE-2021-44716.patch + BuildRequires: golang Requires: %{name}-csi-lvmplugin-provisioner Requires: %{name}-lvmplugin @@ -39,8 +43,12 @@ Summary: csi-driver-lvm's lvmplugin binary lvmplugin collects the size of logical volumes (LV) and free space inside a volume group (VG) from Linux' Logical Volume Manager (LVM). %prep -%autosetup -%setup -q -T -D -a 1 +%autosetup -N + +# Apply vendor before patching +tar --no-same-owner -xf %{SOURCE1} + +%autopatch -p1 %build %make_build @@ -63,6 +71,9 @@ install -D -m0755 bin/lvmplugin %{buildroot}%{_bindir}/ %{_bindir}/lvmplugin %changelog +* Mon Feb 05 2024 Nicolas Guibourge - 0.4.1-15 +- Patch CVE-2021-44716 + * Mon Oct 16 2023 CBL-Mariner Servicing Account - 0.4.1-14 - Bump release to rebuild with go 1.20.9 diff --git a/SPECS/dcos-cli/dcos-cli.spec b/SPECS/dcos-cli/dcos-cli.spec index d0e6feae547..4fa4446a1c6 100644 --- a/SPECS/dcos-cli/dcos-cli.spec +++ b/SPECS/dcos-cli/dcos-cli.spec @@ -1,7 +1,7 @@ Summary: The command line for DC/OS Name: dcos-cli Version: 1.2.0 -Release: 14%{?dist} +Release: 15%{?dist} License: Apache-2.0 Vendor: Microsoft Corporation Distribution: Mariner @@ -45,6 +45,9 @@ go test -mod=vendor %{_bindir}/dcos %changelog +* Fri Feb 02 2024 CBL-Mariner Servicing Account - 1.2.0-15 +- Bump release to rebuild with go 1.21.6 + * Mon Oct 16 2023 CBL-Mariner Servicing Account - 1.2.0-14 - Bump release to rebuild with go 1.20.9 diff --git a/SPECS/etcd/etcd.spec b/SPECS/etcd/etcd.spec index 618131be03b..1d719c5533a 100644 --- a/SPECS/etcd/etcd.spec +++ b/SPECS/etcd/etcd.spec @@ -3,7 +3,7 @@ Summary: A highly-available key value store for shared configuration Name: etcd Version: 3.5.9 -Release: 1%{?dist} +Release: 2%{?dist} License: ASL 2.0 Vendor: Microsoft Corporation Distribution: Mariner @@ -145,6 +145,9 @@ install -vdm755 %{buildroot}%{_sharedstatedir}/etcd /%{_docdir}/%{name}-%{version}-tools/* %changelog +* Fri Feb 02 2024 CBL-Mariner Servicing Account - 3.5.9-2 +- Bump release to rebuild with go 1.21.6 + * Tue Oct 18 2023 Nicolas Guibourge - 3.5.9-1 - Upgrade to 3.5.9 to match version required by kubernetes diff --git a/SPECS/flannel/CVE-2021-44716.patch b/SPECS/flannel/CVE-2021-44716.patch new file mode 100644 index 00000000000..5c871692014 --- /dev/null +++ b/SPECS/flannel/CVE-2021-44716.patch @@ -0,0 +1,50 @@ +Parent: db4efeb8 (http2: deflake TestTransportGroupsPendingDials) +Author: Damien Neil +AuthorDate: 2021-12-06 14:31:43 -0800 +Commit: Filippo Valsorda +CommitDate: 2021-12-09 12:49:13 +0000 + +http2: cap the size of the server's canonical header cache + +The HTTP/2 server keeps a per-connection cache mapping header keys +to their canonicalized form (e.g., "foo-bar" => "Foo-Bar"). Cap the +maximum size of this cache to prevent a peer sending many unique +header keys from causing unbounded memory growth. + +Cap chosen arbitrarily at 32 entries. Since this cache does not +include common headers (e.g., "content-type"), 32 seems like more +than enough for almost all normal uses. + +Fixes #50058 +Fixes CVE-2021-44716 + +Change-Id: Ia83696dc23253c12af8f26d502557c2cc9841105 +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1290827 +Reviewed-by: Roland Shoemaker +Reviewed-on: https://go-review.googlesource.com/c/net/+/369794 +Trust: Filippo Valsorda +Run-TryBot: Filippo Valsorda +Trust: Damien Neil +Reviewed-by: Russ Cox +Reviewed-by: Filippo Valsorda +TryBot-Result: Gopher Robot + +diff -ru cli-20.10.27-orig/vendor/golang.org/x/net/http2/server.go cli-20.10.27/vendor/golang.org/x/net/http2/server.go +--- cli-20.10.27-orig/vendor/golang.org/x/net/http2/server.go 2024-02-05 08:53:30.802532951 -0800 ++++ cli-20.10.27/vendor/golang.org/x/net/http2/server.go 2024-02-05 09:19:08.473430121 -0800 +@@ -720,7 +720,15 @@ + sc.canonHeader = make(map[string]string) + } + cv = http.CanonicalHeaderKey(v) +- sc.canonHeader[v] = cv ++ // maxCachedCanonicalHeaders is an arbitrarily-chosen limit on the number of ++ // entries in the canonHeader cache. This should be larger than the number ++ // of unique, uncommon header keys likely to be sent by the peer, while not ++ // so high as to permit unreaasonable memory usage if the peer sends an unbounded ++ // number of unique header keys. ++ const maxCachedCanonicalHeaders = 32 ++ if len(sc.canonHeader) < maxCachedCanonicalHeaders { ++ sc.canonHeader[v] = cv ++ } + return cv + } diff --git a/SPECS/flannel/flannel.spec b/SPECS/flannel/flannel.spec index e2239921e12..62540610585 100644 --- a/SPECS/flannel/flannel.spec +++ b/SPECS/flannel/flannel.spec @@ -4,7 +4,7 @@ Summary: Simple and easy way to configure a layer 3 network fabric designed for Kubernetes Name: flannel Version: 0.14.0 -Release: 20%{?dist} +Release: 21%{?dist} License: ASL 2.0 Vendor: Microsoft Corporation Distribution: Mariner @@ -12,6 +12,7 @@ Group: System Environment/Libraries URL: https://github.com/flannel-io/flannel #Source0: https://github.com/flannel-io/flannel/archive/refs/tags/v0.14.0.tar.gz Source0: %{name}-%{version}.tar.gz +Patch0: CVE-2021-44716.patch BuildRequires: gcc BuildRequires: glibc-devel @@ -48,6 +49,9 @@ install -p -m 755 -t %{buildroot}%{_bindir} ./dist/flanneld %{_bindir}/flanneld %changelog +* Mon Feb 05 2024 Osama Esmail - 0.14.0-21 +- Patching CVE-2021-44716 + * Wed Oct 18 2023 Minghe Ren - 0.14.0-20 - Bump release to rebuild against glibc 2.35-6 diff --git a/SPECS/gh/gh.spec b/SPECS/gh/gh.spec index 757dec924ec..25c6915001b 100644 --- a/SPECS/gh/gh.spec +++ b/SPECS/gh/gh.spec @@ -1,7 +1,7 @@ Summary: GitHub official command line tool Name: gh Version: 2.13.0 -Release: 16%{?dist} +Release: 17%{?dist} License: MIT Vendor: Microsoft Corporation Distribution: Mariner @@ -72,6 +72,9 @@ make test %{_datadir}/zsh/site-functions/_gh %changelog +* Fri Feb 02 2024 CBL-Mariner Servicing Account - 2.13.0-17 +- Bump release to rebuild with go 1.21.6 + * Mon Oct 16 2023 CBL-Mariner Servicing Account - 2.13.0-16 - Bump release to rebuild with go 1.20.9 diff --git a/SPECS/git-lfs/CVE-2021-44716.patch b/SPECS/git-lfs/CVE-2021-44716.patch new file mode 100644 index 00000000000..dc3adbff678 --- /dev/null +++ b/SPECS/git-lfs/CVE-2021-44716.patch @@ -0,0 +1,51 @@ +Parent: db4efeb8 (http2: deflake TestTransportGroupsPendingDials) +Author: Damien Neil +AuthorDate: 2021-12-06 14:31:43 -0800 +Commit: Filippo Valsorda +CommitDate: 2021-12-09 12:49:13 +0000 + +http2: cap the size of the server's canonical header cache + +The HTTP/2 server keeps a per-connection cache mapping header keys +to their canonicalized form (e.g., "foo-bar" => "Foo-Bar"). Cap the +maximum size of this cache to prevent a peer sending many unique +header keys from causing unbounded memory growth. + +Cap chosen arbitrarily at 32 entries. Since this cache does not +include common headers (e.g., "content-type"), 32 seems like more +than enough for almost all normal uses. + +Fixes #50058 +Fixes CVE-2021-44716 + +Change-Id: Ia83696dc23253c12af8f26d502557c2cc9841105 +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1290827 +Reviewed-by: Roland Shoemaker +Reviewed-on: https://go-review.googlesource.com/c/net/+/369794 +Trust: Filippo Valsorda +Run-TryBot: Filippo Valsorda +Trust: Damien Neil +Reviewed-by: Russ Cox +Reviewed-by: Filippo Valsorda +TryBot-Result: Gopher Robot + +diff -ru cli-20.10.27-orig/vendor/golang.org/x/net/http2/server.go cli-20.10.27/vendor/golang.org/x/net/http2/server.go +--- cli-20.10.27-orig/vendor/golang.org/x/net/http2/server.go 2024-02-05 08:53:30.802532951 -0800 ++++ cli-20.10.27/vendor/golang.org/x/net/http2/server.go 2024-02-05 09:19:08.473430121 -0800 +@@ -720,7 +720,15 @@ + sc.canonHeader = make(map[string]string) + } + cv = http.CanonicalHeaderKey(v) +- sc.canonHeader[v] = cv ++ // maxCachedCanonicalHeaders is an arbitrarily-chosen limit on the number of ++ // entries in the canonHeader cache. This should be larger than the number ++ // of unique, uncommon header keys likely to be sent by the peer, while not ++ // so high as to permit unreaasonable memory usage if the peer sends an unbounded ++ // number of unique header keys. ++ const maxCachedCanonicalHeaders = 32 ++ if len(sc.canonHeader) < maxCachedCanonicalHeaders { ++ sc.canonHeader[v] = cv ++ } + return cv + } + \ No newline at end of file diff --git a/SPECS/git-lfs/CVE-2023-44487.patch b/SPECS/git-lfs/CVE-2023-44487.patch new file mode 100644 index 00000000000..23d385d8358 --- /dev/null +++ b/SPECS/git-lfs/CVE-2023-44487.patch @@ -0,0 +1,143 @@ +From ed07cf0825f6a369c58df6b728caa9f12ad029dd Mon Sep 17 00:00:00 2001 +From: Damien Neil +Date: Fri, 6 Oct 2023 09:51:19 -0700 +Subject: [PATCH] http2: limit maximum handler goroutines to + MaxConcurrentStreams + +When the peer opens a new stream while we have MaxConcurrentStreams +handler goroutines running, defer starting a handler until one +of the existing handlers exits. + +Fixes golang/go#63417 +Fixes CVE-2023-39325 + +Change-Id: If0531e177b125700f3e24c5ebd24b1023098fa6d +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2045854 +TryBot-Result: Security TryBots +Reviewed-by: Ian Cottrell +Reviewed-by: Tatiana Bradley +Run-TryBot: Damien Neil +Reviewed-on: https://go-review.googlesource.com/c/net/+/534215 +Reviewed-by: Michael Pratt +Reviewed-by: Dmitri Shuralyov +LUCI-TryBot-Result: Go LUCI +Auto-Submit: Dmitri Shuralyov +Reviewed-by: Damien Neil + +Modified to apply to vendored code by: Daniel McIlvaney + - Adjusted paths + - Removed reference to server_test.go + - Removed reference to upgradeRequest() which is not in old versions of the vendored code + - Removed reference to countError() which is not in old versions of the vendored code +--- + vendor/golang.org/x/net/http2/server.go | 62 ++++++++++++++++++++++++- + 1 file changed, 60 insertions(+), 2 deletions(-) + +diff --git a/vendor/golang.org/x/net/http2/server.go b/vendor/golang.org/x/net/http2/server.go +index e125bbd..0844864 100644 +--- a/vendor/golang.org/x/net/http2/server.go ++++ b/vendor/golang.org/x/net/http2/server.go +@@ -521,9 +521,11 @@ type serverConn struct { + advMaxStreams uint32 // our SETTINGS_MAX_CONCURRENT_STREAMS advertised the client + curClientStreams uint32 // number of open streams initiated by the client + curPushedStreams uint32 // number of open streams initiated by server push ++ curHandlers uint32 // number of running handler goroutines + maxClientStreamID uint32 // max ever seen from client (odd), or 0 if there have been no client requests + maxPushPromiseID uint32 // ID of the last push promise (even), or 0 if there have been no pushes + streams map[uint32]*stream ++ unstartedHandlers []unstartedHandler + initialStreamSendWindowSize int32 + maxFrameSize int32 + headerTableSize uint32 +@@ -893,6 +895,8 @@ func (sc *serverConn) serve() { + return + case gracefulShutdownMsg: + sc.startGracefulShutdownInternal() ++ case handlerDoneMsg: ++ sc.handlerDone() + default: + panic("unknown timer") + } +@@ -938,6 +942,7 @@ var ( + idleTimerMsg = new(serverMessage) + shutdownTimerMsg = new(serverMessage) + gracefulShutdownMsg = new(serverMessage) ++ handlerDoneMsg = new(serverMessage) + ) + + func (sc *serverConn) onSettingsTimer() { sc.sendServeMsg(settingsTimerMsg) } +@@ -1895,8 +1900,7 @@ func (sc *serverConn) processHeaders(f *MetaHeadersFrame) error { + sc.conn.SetReadDeadline(time.Time{}) + } + +- go sc.runHandler(rw, req, handler) +- return nil ++ return sc.scheduleHandler(id, rw, req, handler) + } + + func (st *stream) processTrailerHeaders(f *MetaHeadersFrame) error { +@@ -2143,8 +2147,62 @@ func (sc *serverConn) newWriterAndRequestNoBody(st *stream, rp requestParam) (*r + return rw, req, nil + } + ++type unstartedHandler struct { ++ streamID uint32 ++ rw *responseWriter ++ req *http.Request ++ handler func(http.ResponseWriter, *http.Request) ++} ++ ++// scheduleHandler starts a handler goroutine, ++// or schedules one to start as soon as an existing handler finishes. ++func (sc *serverConn) scheduleHandler(streamID uint32, rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) error { ++ sc.serveG.check() ++ maxHandlers := sc.advMaxStreams ++ if sc.curHandlers < maxHandlers { ++ sc.curHandlers++ ++ go sc.runHandler(rw, req, handler) ++ return nil ++ } ++ if len(sc.unstartedHandlers) > int(4*sc.advMaxStreams) { ++ return ConnectionError(ErrCodeEnhanceYourCalm) ++ } ++ sc.unstartedHandlers = append(sc.unstartedHandlers, unstartedHandler{ ++ streamID: streamID, ++ rw: rw, ++ req: req, ++ handler: handler, ++ }) ++ return nil ++} ++ ++func (sc *serverConn) handlerDone() { ++ sc.serveG.check() ++ sc.curHandlers-- ++ i := 0 ++ maxHandlers := sc.advMaxStreams ++ for ; i < len(sc.unstartedHandlers); i++ { ++ u := sc.unstartedHandlers[i] ++ if sc.streams[u.streamID] == nil { ++ // This stream was reset before its goroutine had a chance to start. ++ continue ++ } ++ if sc.curHandlers >= maxHandlers { ++ break ++ } ++ sc.curHandlers++ ++ go sc.runHandler(u.rw, u.req, u.handler) ++ sc.unstartedHandlers[i] = unstartedHandler{} // don't retain references ++ } ++ sc.unstartedHandlers = sc.unstartedHandlers[i:] ++ if len(sc.unstartedHandlers) == 0 { ++ sc.unstartedHandlers = nil ++ } ++} ++ + // Run on its own goroutine. + func (sc *serverConn) runHandler(rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) { ++ defer sc.sendServeMsg(handlerDoneMsg) + didPanic := true + defer func() { + rw.rws.stream.cancelCtx() +-- +2.33.8 diff --git a/SPECS/git-lfs/git-lfs.spec b/SPECS/git-lfs/git-lfs.spec index 9207737410f..ba8295fbb68 100644 --- a/SPECS/git-lfs/git-lfs.spec +++ b/SPECS/git-lfs/git-lfs.spec @@ -2,7 +2,7 @@ Summary: Git extension for versioning large files Name: git-lfs Version: 3.1.4 -Release: 15%{?dist} +Release: 17%{?dist} Group: System Environment/Programming Vendor: Microsoft Corporation Distribution: Mariner @@ -29,6 +29,10 @@ Source0: https://github.com/git-lfs/git-lfs/archive/v%{version}.tar.gz#/%{ # - For the value of "--mtime" use the date "2021-04-26 00:00Z" to simplify future updates. Source1: %{name}-%{version}-vendor.tar.gz +# patches for vendored code >= 1000 +Patch1000: CVE-2023-44487.patch +Patch1001: CVE-2021-44716.patch + BuildRequires: golang BuildRequires: which BuildRequires: rubygem-ronn @@ -41,10 +45,12 @@ Requires: git Git LFS is a command line extension and specification for managing large files with Git %prep -%autosetup +%autosetup -N +# Apply vendor before patching +tar --no-same-owner -xf %{SOURCE1} +%autopatch -p1 %build -tar --no-same-owner -xf %{SOURCE1} export GOPATH=%{our_gopath} export GOFLAGS="-buildmode=pie -trimpath -mod=vendor -modcacherw -ldflags=-linkmode=external" go generate ./commands @@ -77,6 +83,12 @@ git lfs uninstall %{_mandir}/man5/* %changelog +* Mon Feb 05 2024 Nicolas Guibourge - 3.1.4-17 +- Patch CVE-2021-44716 + +* Thu Feb 01 2024 Daniel McIlvaney - 3.1.4-16 +- Address CVE-2023-44487 by patching vendored golang.org/x/net + * Mon Oct 16 2023 CBL-Mariner Servicing Account - 3.1.4-15 - Bump release to rebuild with go 1.20.9 diff --git a/SPECS/glide/glide.spec b/SPECS/glide/glide.spec index a2f02463d95..2dd94665759 100644 --- a/SPECS/glide/glide.spec +++ b/SPECS/glide/glide.spec @@ -1,7 +1,7 @@ Summary: Vendor Package Management for Golang Name: glide Version: 0.13.3 -Release: 24%{?dist} +Release: 25%{?dist} License: MIT URL: https://github.com/Masterminds/glide # Source0: https://github.com/Masterminds/%{name}/archive/v%{version}.tar.gz @@ -53,6 +53,9 @@ popd %{_bindir}/glide %changelog +* Fri Feb 02 2024 CBL-Mariner Servicing Account - 0.13.3-25 +- Bump release to rebuild with go 1.21.6 + * Mon Oct 16 2023 CBL-Mariner Servicing Account - 0.13.3-24 - Bump release to rebuild with go 1.20.9 diff --git a/SPECS/go-md2man/go-md2man.spec b/SPECS/go-md2man/go-md2man.spec index 88adf9a19ea..ea98eb45ed9 100644 --- a/SPECS/go-md2man/go-md2man.spec +++ b/SPECS/go-md2man/go-md2man.spec @@ -1,7 +1,7 @@ Summary: Converts markdown into roff (man pages) Name: go-md2man Version: 2.0.1 -Release: 21%{?dist} +Release: 22%{?dist} License: MIT Vendor: Microsoft Corporation Distribution: Mariner @@ -48,6 +48,9 @@ cp go-md2man-%{version}/LICENSE.md %{buildroot}%{_docdir}/%{name}-%{version}/LIC %{_bindir}/go-md2man %changelog +* Fri Feb 02 2024 CBL-Mariner Servicing Account - 2.0.1-22 +- Bump release to rebuild with go 1.21.6 + * Mon Oct 16 2023 CBL-Mariner Servicing Account - 2.0.1-21 - Bump release to rebuild with go 1.20.9 diff --git a/SPECS/gobject-introspection/gobject-introspection.spec b/SPECS/gobject-introspection/gobject-introspection.spec index 47cda0e9137..d4565709401 100644 --- a/SPECS/gobject-introspection/gobject-introspection.spec +++ b/SPECS/gobject-introspection/gobject-introspection.spec @@ -2,7 +2,7 @@ Summary: Introspection system for GObject-based libraries Name: gobject-introspection Version: %{BaseVersion}.0 -Release: 16%{?dist} +Release: 17%{?dist} License: GPLv2+ AND LGPLv2+ AND MIT Vendor: Microsoft Corporation Distribution: Mariner @@ -98,6 +98,9 @@ find %{buildroot} -type f -name "*.la" -delete -print %{_mandir}/man1/*.gz %changelog +* Fri Feb 02 2024 CBL-Mariner Servicing Account - 1.71.0-17 +- Bump release to rebuild with go 1.21.6 + * Mon Oct 16 2023 CBL-Mariner Servicing Account - 1.71.0-16 - Bump release to rebuild with go 1.20.9 diff --git a/SPECS/golang/golang.signatures.json b/SPECS/golang/golang.signatures.json index aff557711cf..9d61d3da1af 100644 --- a/SPECS/golang/golang.signatures.json +++ b/SPECS/golang/golang.signatures.json @@ -2,6 +2,6 @@ "Signatures": { "go1.19.12.src.tar.gz": "ee5d50e0a7fd74ba1b137cb879609aaaef9880bf72b5d1742100e38ae72bb557", "go1.4-bootstrap-20171003.tar.gz": "f4ff5b5eb3a3cae1c993723f3eab519c5bae18866b5e5f96fe1102f0cb5c3e52", - "go1.20.10.src.tar.gz": "72d2f51805c47150066c103754c75fddb2c19d48c9219fa33d1e46696c841dbb" + "go1.21.6.src.tar.gz": "124926a62e45f78daabbaedb9c011d97633186a33c238ffc1e25320c02046248" } } \ No newline at end of file diff --git a/SPECS/golang/golang.spec b/SPECS/golang/golang.spec index 0b799be1f36..80ed8bafa3e 100644 --- a/SPECS/golang/golang.spec +++ b/SPECS/golang/golang.spec @@ -13,7 +13,7 @@ %define __find_requires %{nil} Summary: Go Name: golang -Version: 1.20.10 +Version: 1.21.6 Release: 1%{?dist} License: BSD-3-Clause Vendor: Microsoft Corporation @@ -141,6 +141,9 @@ fi %{_bindir}/* %changelog +* Fri Feb 02 2024 Muhammad Falak - 1.21.6-1 +- Bump version to 1.21.6 + * Mon Oct 16 2023 Nan Liu - 1.20.10-1 - Bump version to 1.20.10 to address CVE-2023-29409, CVE-2023-39318, CVE-2023-39319, CVE-2023-39323, CVE-2023-39533, CVE-2023-29406, CVE-2023-39325, CVE-2023-44487 - Remove patches that no longer apply diff --git a/SPECS/helm/helm.spec b/SPECS/helm/helm.spec index 240e4627de7..f8ab46950ac 100644 --- a/SPECS/helm/helm.spec +++ b/SPECS/helm/helm.spec @@ -2,7 +2,7 @@ Name: helm Version: 3.14.0 -Release: 1%{?dist} +Release: 2%{?dist} Summary: The Kubernetes Package Manager Group: Applications/Networking License: Apache 2.0 @@ -55,6 +55,9 @@ install -m 755 ./helm %{buildroot}%{_bindir} go test -v ./cmd/helm %changelog +* Fri Feb 02 2024 CBL-Mariner Servicing Account - 3.14.0-2 +- Bump release to rebuild with go 1.21.6 + * Fri Jan 19 2024 Muhammad Falak - 3.14.0-1 - Bump version to address CVE-2023-44487 diff --git a/SPECS/hyperv-daemons/hyperv-daemons.signatures.json b/SPECS/hyperv-daemons/hyperv-daemons.signatures.json index 6c7e28e715c..264b69837c2 100644 --- a/SPECS/hyperv-daemons/hyperv-daemons.signatures.json +++ b/SPECS/hyperv-daemons/hyperv-daemons.signatures.json @@ -7,6 +7,6 @@ "hypervkvpd.service": "c1bb207cf9f388f8f3cf5b649abbf8cfe4c4fcf74538612946e68f350d1f265f", "hypervvss.rules": "94cead44245ef6553ab79c0bbac8419e3ff4b241f01bcec66e6f508098cbedd1", "hypervvssd.service": "22270d9f0f23af4ea7905f19c1d5d5495e40c1f782cbb87a99f8aec5a011078d", - "kernel-5.15.148.1.tar.gz": "e77c297fe3e3f0d9fd403c52f1e959389fa33e6642be9ddd12d4ea7f8927e5d6" + "kernel-5.15.148.2.tar.gz": "58488cf131b8a1c77dcac651fbad10e105e9a8d2f48b7bb8b2d08ac63483a129" } } diff --git a/SPECS/hyperv-daemons/hyperv-daemons.spec b/SPECS/hyperv-daemons/hyperv-daemons.spec index 15165480288..c5b142706e7 100644 --- a/SPECS/hyperv-daemons/hyperv-daemons.spec +++ b/SPECS/hyperv-daemons/hyperv-daemons.spec @@ -8,7 +8,7 @@ %global udev_prefix 70 Summary: Hyper-V daemons suite Name: hyperv-daemons -Version: 5.15.148.1 +Version: 5.15.148.2 Release: 1%{?dist} License: GPLv2+ Vendor: Microsoft Corporation @@ -219,6 +219,9 @@ fi %{_sbindir}/lsvmbus %changelog +* Thu Feb 08 2024 CBL-Mariner Servicing Account - 5.15.148.2-1 +- Auto-upgrade to 5.15.148.2 + * Tue Jan 30 2024 CBL-Mariner Servicing Account - 5.15.148.1-1 - Auto-upgrade to 5.15.148.1 diff --git a/SPECS/influx-cli/influx-cli.spec b/SPECS/influx-cli/influx-cli.spec index e7dc3bd8444..d633247d832 100644 --- a/SPECS/influx-cli/influx-cli.spec +++ b/SPECS/influx-cli/influx-cli.spec @@ -18,7 +18,7 @@ Summary: CLI for managing resources in InfluxDB Name: influx-cli Version: 2.6.1 -Release: 13%{?dist} +Release: 14%{?dist} License: MIT Vendor: Microsoft Corporation Distribution: Mariner @@ -81,6 +81,9 @@ bin/influx completion zsh > %{buildroot}/%{_datadir}/zsh/site-functions/_influx %{_datadir}/zsh %changelog +* Fri Feb 02 2024 CBL-Mariner Servicing Account - 2.6.1-14 +- Bump release to rebuild with go 1.21.6 + * Mon Oct 16 2023 CBL-Mariner Servicing Account - 2.6.1-13 - Bump release to rebuild with go 1.20.9 diff --git a/SPECS/influxdb/influxdb.spec b/SPECS/influxdb/influxdb.spec index 0ad4aa3d867..6935c5c9154 100644 --- a/SPECS/influxdb/influxdb.spec +++ b/SPECS/influxdb/influxdb.spec @@ -18,7 +18,7 @@ Summary: Scalable datastore for metrics, events, and real-time analytics Name: influxdb Version: 2.6.1 -Release: 12%{?dist} +Release: 13%{?dist} License: MIT Vendor: Microsoft Corporation Distribution: Mariner @@ -144,6 +144,9 @@ go test ./... %{_tmpfilesdir}/influxdb.conf %changelog +* Fri Feb 02 2024 CBL-Mariner Servicing Account - 2.6.1-13 +- Bump release to rebuild with go 1.21.6 + * Mon Oct 16 2023 CBL-Mariner Servicing Account - 2.6.1-12 - Bump release to rebuild with go 1.20.9 diff --git a/SPECS/jx/CVE-2021-44716.patch b/SPECS/jx/CVE-2021-44716.patch new file mode 100644 index 00000000000..dc3adbff678 --- /dev/null +++ b/SPECS/jx/CVE-2021-44716.patch @@ -0,0 +1,51 @@ +Parent: db4efeb8 (http2: deflake TestTransportGroupsPendingDials) +Author: Damien Neil +AuthorDate: 2021-12-06 14:31:43 -0800 +Commit: Filippo Valsorda +CommitDate: 2021-12-09 12:49:13 +0000 + +http2: cap the size of the server's canonical header cache + +The HTTP/2 server keeps a per-connection cache mapping header keys +to their canonicalized form (e.g., "foo-bar" => "Foo-Bar"). Cap the +maximum size of this cache to prevent a peer sending many unique +header keys from causing unbounded memory growth. + +Cap chosen arbitrarily at 32 entries. Since this cache does not +include common headers (e.g., "content-type"), 32 seems like more +than enough for almost all normal uses. + +Fixes #50058 +Fixes CVE-2021-44716 + +Change-Id: Ia83696dc23253c12af8f26d502557c2cc9841105 +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1290827 +Reviewed-by: Roland Shoemaker +Reviewed-on: https://go-review.googlesource.com/c/net/+/369794 +Trust: Filippo Valsorda +Run-TryBot: Filippo Valsorda +Trust: Damien Neil +Reviewed-by: Russ Cox +Reviewed-by: Filippo Valsorda +TryBot-Result: Gopher Robot + +diff -ru cli-20.10.27-orig/vendor/golang.org/x/net/http2/server.go cli-20.10.27/vendor/golang.org/x/net/http2/server.go +--- cli-20.10.27-orig/vendor/golang.org/x/net/http2/server.go 2024-02-05 08:53:30.802532951 -0800 ++++ cli-20.10.27/vendor/golang.org/x/net/http2/server.go 2024-02-05 09:19:08.473430121 -0800 +@@ -720,7 +720,15 @@ + sc.canonHeader = make(map[string]string) + } + cv = http.CanonicalHeaderKey(v) +- sc.canonHeader[v] = cv ++ // maxCachedCanonicalHeaders is an arbitrarily-chosen limit on the number of ++ // entries in the canonHeader cache. This should be larger than the number ++ // of unique, uncommon header keys likely to be sent by the peer, while not ++ // so high as to permit unreaasonable memory usage if the peer sends an unbounded ++ // number of unique header keys. ++ const maxCachedCanonicalHeaders = 32 ++ if len(sc.canonHeader) < maxCachedCanonicalHeaders { ++ sc.canonHeader[v] = cv ++ } + return cv + } + \ No newline at end of file diff --git a/SPECS/jx/CVE-2023-44487.patch b/SPECS/jx/CVE-2023-44487.patch new file mode 100644 index 00000000000..23d385d8358 --- /dev/null +++ b/SPECS/jx/CVE-2023-44487.patch @@ -0,0 +1,143 @@ +From ed07cf0825f6a369c58df6b728caa9f12ad029dd Mon Sep 17 00:00:00 2001 +From: Damien Neil +Date: Fri, 6 Oct 2023 09:51:19 -0700 +Subject: [PATCH] http2: limit maximum handler goroutines to + MaxConcurrentStreams + +When the peer opens a new stream while we have MaxConcurrentStreams +handler goroutines running, defer starting a handler until one +of the existing handlers exits. + +Fixes golang/go#63417 +Fixes CVE-2023-39325 + +Change-Id: If0531e177b125700f3e24c5ebd24b1023098fa6d +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2045854 +TryBot-Result: Security TryBots +Reviewed-by: Ian Cottrell +Reviewed-by: Tatiana Bradley +Run-TryBot: Damien Neil +Reviewed-on: https://go-review.googlesource.com/c/net/+/534215 +Reviewed-by: Michael Pratt +Reviewed-by: Dmitri Shuralyov +LUCI-TryBot-Result: Go LUCI +Auto-Submit: Dmitri Shuralyov +Reviewed-by: Damien Neil + +Modified to apply to vendored code by: Daniel McIlvaney + - Adjusted paths + - Removed reference to server_test.go + - Removed reference to upgradeRequest() which is not in old versions of the vendored code + - Removed reference to countError() which is not in old versions of the vendored code +--- + vendor/golang.org/x/net/http2/server.go | 62 ++++++++++++++++++++++++- + 1 file changed, 60 insertions(+), 2 deletions(-) + +diff --git a/vendor/golang.org/x/net/http2/server.go b/vendor/golang.org/x/net/http2/server.go +index e125bbd..0844864 100644 +--- a/vendor/golang.org/x/net/http2/server.go ++++ b/vendor/golang.org/x/net/http2/server.go +@@ -521,9 +521,11 @@ type serverConn struct { + advMaxStreams uint32 // our SETTINGS_MAX_CONCURRENT_STREAMS advertised the client + curClientStreams uint32 // number of open streams initiated by the client + curPushedStreams uint32 // number of open streams initiated by server push ++ curHandlers uint32 // number of running handler goroutines + maxClientStreamID uint32 // max ever seen from client (odd), or 0 if there have been no client requests + maxPushPromiseID uint32 // ID of the last push promise (even), or 0 if there have been no pushes + streams map[uint32]*stream ++ unstartedHandlers []unstartedHandler + initialStreamSendWindowSize int32 + maxFrameSize int32 + headerTableSize uint32 +@@ -893,6 +895,8 @@ func (sc *serverConn) serve() { + return + case gracefulShutdownMsg: + sc.startGracefulShutdownInternal() ++ case handlerDoneMsg: ++ sc.handlerDone() + default: + panic("unknown timer") + } +@@ -938,6 +942,7 @@ var ( + idleTimerMsg = new(serverMessage) + shutdownTimerMsg = new(serverMessage) + gracefulShutdownMsg = new(serverMessage) ++ handlerDoneMsg = new(serverMessage) + ) + + func (sc *serverConn) onSettingsTimer() { sc.sendServeMsg(settingsTimerMsg) } +@@ -1895,8 +1900,7 @@ func (sc *serverConn) processHeaders(f *MetaHeadersFrame) error { + sc.conn.SetReadDeadline(time.Time{}) + } + +- go sc.runHandler(rw, req, handler) +- return nil ++ return sc.scheduleHandler(id, rw, req, handler) + } + + func (st *stream) processTrailerHeaders(f *MetaHeadersFrame) error { +@@ -2143,8 +2147,62 @@ func (sc *serverConn) newWriterAndRequestNoBody(st *stream, rp requestParam) (*r + return rw, req, nil + } + ++type unstartedHandler struct { ++ streamID uint32 ++ rw *responseWriter ++ req *http.Request ++ handler func(http.ResponseWriter, *http.Request) ++} ++ ++// scheduleHandler starts a handler goroutine, ++// or schedules one to start as soon as an existing handler finishes. ++func (sc *serverConn) scheduleHandler(streamID uint32, rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) error { ++ sc.serveG.check() ++ maxHandlers := sc.advMaxStreams ++ if sc.curHandlers < maxHandlers { ++ sc.curHandlers++ ++ go sc.runHandler(rw, req, handler) ++ return nil ++ } ++ if len(sc.unstartedHandlers) > int(4*sc.advMaxStreams) { ++ return ConnectionError(ErrCodeEnhanceYourCalm) ++ } ++ sc.unstartedHandlers = append(sc.unstartedHandlers, unstartedHandler{ ++ streamID: streamID, ++ rw: rw, ++ req: req, ++ handler: handler, ++ }) ++ return nil ++} ++ ++func (sc *serverConn) handlerDone() { ++ sc.serveG.check() ++ sc.curHandlers-- ++ i := 0 ++ maxHandlers := sc.advMaxStreams ++ for ; i < len(sc.unstartedHandlers); i++ { ++ u := sc.unstartedHandlers[i] ++ if sc.streams[u.streamID] == nil { ++ // This stream was reset before its goroutine had a chance to start. ++ continue ++ } ++ if sc.curHandlers >= maxHandlers { ++ break ++ } ++ sc.curHandlers++ ++ go sc.runHandler(u.rw, u.req, u.handler) ++ sc.unstartedHandlers[i] = unstartedHandler{} // don't retain references ++ } ++ sc.unstartedHandlers = sc.unstartedHandlers[i:] ++ if len(sc.unstartedHandlers) == 0 { ++ sc.unstartedHandlers = nil ++ } ++} ++ + // Run on its own goroutine. + func (sc *serverConn) runHandler(rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) { ++ defer sc.sendServeMsg(handlerDoneMsg) + didPanic := true + defer func() { + rw.rws.stream.cancelCtx() +-- +2.33.8 diff --git a/SPECS/jx/jx.spec b/SPECS/jx/jx.spec index 9d4336c4801..94d837cf236 100644 --- a/SPECS/jx/jx.spec +++ b/SPECS/jx/jx.spec @@ -1,7 +1,7 @@ Summary: Command line tool for working with Jenkins X. Name: jx Version: 3.2.236 -Release: 14%{?dist} +Release: 16%{?dist} License: Apache-2.0 Vendor: Microsoft Corporation Distribution: Mariner @@ -28,6 +28,10 @@ Source0: https://github.com/jenkins-x/jx/archive/v%{version}.tar.gz#/%{na # - For the value of "--mtime" use the date "2021-04-26 00:00Z" to simplify future updates. Source1: %{name}-%{version}-vendor.tar.gz +# patches for vendored code >= 1000 +Patch1000: CVE-2023-44487.patch +Patch1001: CVE-2021-44716.patch + BuildRequires: golang >= 1.17.1 %global debug_package %{nil} %define our_gopath %{_topdir}/.gopath @@ -36,10 +40,12 @@ BuildRequires: golang >= 1.17.1 Command line tool for working with Jenkins X. %prep -%autosetup -p1 +%autosetup -N +# Apply vendor before patching +tar --no-same-owner -xf %{SOURCE1} +%autopatch -p1 %build -tar --no-same-owner -xf %{SOURCE1} export GOPATH=%{our_gopath} # No download use vednor cache locally sed -i 's/go mod download/# go mod download/' ./Makefile @@ -51,7 +57,14 @@ install -m 755 -d %{buildroot}%{_bindir} install -p -m 755 -t %{buildroot}%{_bindir} ./build/jx %check +# jenkins is not available for aarch64, can only run unit tests for x86_64. +%ifarch x86_64 +sed -i 's/TEST_BUILDFLAGS := -ldflags "$(BUILD_TIME_CONFIG_FLAGS)"/TEST_BUILDFLAGS := -mod=vendor -ldflags "$(BUILD_TIME_CONFIG_FLAGS)"/' ./Makefile +make test && \ ./build/jx --help +%else +./build/jx --help +%endif %files %defattr(-,root,root) @@ -60,6 +73,13 @@ install -p -m 755 -t %{buildroot}%{_bindir} ./build/jx %{_bindir}/jx %changelog +* Mon Feb 05 2024 Nicolas Guibourge - 3.2.236-16 +- Patch CVE-2021-44716 + +* Thu Feb 01 2024 Daniel McIlvaney -3.2.236-15 +- Address CVE-2023-44487 by patching vendored golang.org/x/net +- Add unit tests to check section + * Mon Oct 16 2023 CBL-Mariner Servicing Account - 3.2.236-14 - Bump release to rebuild with go 1.20.9 diff --git a/SPECS/kata-containers-cc/kata-containers-cc.spec b/SPECS/kata-containers-cc/kata-containers-cc.spec index 587cbb14ebe..90688a18430 100644 --- a/SPECS/kata-containers-cc/kata-containers-cc.spec +++ b/SPECS/kata-containers-cc/kata-containers-cc.spec @@ -10,7 +10,7 @@ Name: kata-containers-cc Version: 0.6.3 -Release: 3%{?dist} +Release: 4%{?dist} Summary: Kata Confidential Containers package developed for Confidential Containers on AKS License: ASL 2.0 Vendor: Microsoft Corporation @@ -275,6 +275,9 @@ install -D -m 0755 %{_builddir}/%{name}-%{version}/tools/osbuilder/image-builder %exclude %{osbuilder}/tools/osbuilder/rootfs-builder/ubuntu %changelog +* Fri Feb 02 2024 CBL-Mariner Servicing Account - 0.6.3-4 +- Bump release to rebuild with go 1.21.6 + * Tue Jan 30 2024 Archana Choudhary - 0.6.3-3 - Remove kernel-uvm-cvm(-devel) dependency - Remove kernel-uvm-cvm modules/sources/files diff --git a/SPECS/kata-containers/kata-containers.spec b/SPECS/kata-containers/kata-containers.spec index 757d95a5bd0..8ac721cfc0f 100644 --- a/SPECS/kata-containers/kata-containers.spec +++ b/SPECS/kata-containers/kata-containers.spec @@ -44,7 +44,7 @@ Summary: Kata Containers version 2.x repository Name: kata-containers Version: 3.1.0 -Release: 10%{?dist} +Release: 11%{?dist} License: ASL 2.0 Vendor: Microsoft Corporation URL: https://github.com/%{name}/%{name} @@ -229,6 +229,9 @@ ln -sf %{_bindir}/kata-runtime %{buildroot}%{_prefix}/local/bin/kata-runtime %exclude %{kataosbuilderdir}/rootfs-builder/ubuntu %changelog +* Fri Feb 02 2024 CBL-Mariner Servicing Account - 3.1.0-11 +- Bump release to rebuild with go 1.21.6 + * Tue Dec 05 2023 Archana Choudhary - 3.1.0-10 - Drop qemu-kvm-core dependency - Define explicit dependency on qemu-virtiofsd diff --git a/SPECS/kata-packages-uvm/kata-packages-uvm.spec b/SPECS/kata-packages-uvm/kata-packages-uvm.spec index 092f9444042..44003f5a3ec 100644 --- a/SPECS/kata-packages-uvm/kata-packages-uvm.spec +++ b/SPECS/kata-packages-uvm/kata-packages-uvm.spec @@ -1,7 +1,7 @@ Summary: Metapackage for Kata UVM components Name: kata-packages-uvm Version: 1.0.0 -Release: 1%{?dist} +Release: 2%{?dist} License: MIT Vendor: Microsoft Corporation Distribution: Mariner @@ -53,7 +53,6 @@ Requires: clang Requires: kata-containers-tools Requires: kata-containers-cc-tools Requires: kernel-uvm -Requires: kernel-uvm-cvm # Uncomment and remove duplicates once msigvm is available #Requires: msigvm # Python dependencies for non-packaged IGVM tool @@ -96,6 +95,9 @@ Requires: golang %files coco-sign %changelog +* Tue Feb 06 2024 Archana Choudhary - 1.0.0-2 +- Remove dependency on kernel-uvm-cvm + * Tue Dec 19 2023 Mitch Zhu - 1.0.0-1 - Introduce kata meta-package for the UVM components. - License verified diff --git a/SPECS/keda/CVE-2021-44716.patch b/SPECS/keda/CVE-2021-44716.patch new file mode 100644 index 00000000000..dc3adbff678 --- /dev/null +++ b/SPECS/keda/CVE-2021-44716.patch @@ -0,0 +1,51 @@ +Parent: db4efeb8 (http2: deflake TestTransportGroupsPendingDials) +Author: Damien Neil +AuthorDate: 2021-12-06 14:31:43 -0800 +Commit: Filippo Valsorda +CommitDate: 2021-12-09 12:49:13 +0000 + +http2: cap the size of the server's canonical header cache + +The HTTP/2 server keeps a per-connection cache mapping header keys +to their canonicalized form (e.g., "foo-bar" => "Foo-Bar"). Cap the +maximum size of this cache to prevent a peer sending many unique +header keys from causing unbounded memory growth. + +Cap chosen arbitrarily at 32 entries. Since this cache does not +include common headers (e.g., "content-type"), 32 seems like more +than enough for almost all normal uses. + +Fixes #50058 +Fixes CVE-2021-44716 + +Change-Id: Ia83696dc23253c12af8f26d502557c2cc9841105 +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1290827 +Reviewed-by: Roland Shoemaker +Reviewed-on: https://go-review.googlesource.com/c/net/+/369794 +Trust: Filippo Valsorda +Run-TryBot: Filippo Valsorda +Trust: Damien Neil +Reviewed-by: Russ Cox +Reviewed-by: Filippo Valsorda +TryBot-Result: Gopher Robot + +diff -ru cli-20.10.27-orig/vendor/golang.org/x/net/http2/server.go cli-20.10.27/vendor/golang.org/x/net/http2/server.go +--- cli-20.10.27-orig/vendor/golang.org/x/net/http2/server.go 2024-02-05 08:53:30.802532951 -0800 ++++ cli-20.10.27/vendor/golang.org/x/net/http2/server.go 2024-02-05 09:19:08.473430121 -0800 +@@ -720,7 +720,15 @@ + sc.canonHeader = make(map[string]string) + } + cv = http.CanonicalHeaderKey(v) +- sc.canonHeader[v] = cv ++ // maxCachedCanonicalHeaders is an arbitrarily-chosen limit on the number of ++ // entries in the canonHeader cache. This should be larger than the number ++ // of unique, uncommon header keys likely to be sent by the peer, while not ++ // so high as to permit unreaasonable memory usage if the peer sends an unbounded ++ // number of unique header keys. ++ const maxCachedCanonicalHeaders = 32 ++ if len(sc.canonHeader) < maxCachedCanonicalHeaders { ++ sc.canonHeader[v] = cv ++ } + return cv + } + \ No newline at end of file diff --git a/SPECS/keda/CVE-2023-44487.patch b/SPECS/keda/CVE-2023-44487.patch new file mode 100644 index 00000000000..23d385d8358 --- /dev/null +++ b/SPECS/keda/CVE-2023-44487.patch @@ -0,0 +1,143 @@ +From ed07cf0825f6a369c58df6b728caa9f12ad029dd Mon Sep 17 00:00:00 2001 +From: Damien Neil +Date: Fri, 6 Oct 2023 09:51:19 -0700 +Subject: [PATCH] http2: limit maximum handler goroutines to + MaxConcurrentStreams + +When the peer opens a new stream while we have MaxConcurrentStreams +handler goroutines running, defer starting a handler until one +of the existing handlers exits. + +Fixes golang/go#63417 +Fixes CVE-2023-39325 + +Change-Id: If0531e177b125700f3e24c5ebd24b1023098fa6d +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2045854 +TryBot-Result: Security TryBots +Reviewed-by: Ian Cottrell +Reviewed-by: Tatiana Bradley +Run-TryBot: Damien Neil +Reviewed-on: https://go-review.googlesource.com/c/net/+/534215 +Reviewed-by: Michael Pratt +Reviewed-by: Dmitri Shuralyov +LUCI-TryBot-Result: Go LUCI +Auto-Submit: Dmitri Shuralyov +Reviewed-by: Damien Neil + +Modified to apply to vendored code by: Daniel McIlvaney + - Adjusted paths + - Removed reference to server_test.go + - Removed reference to upgradeRequest() which is not in old versions of the vendored code + - Removed reference to countError() which is not in old versions of the vendored code +--- + vendor/golang.org/x/net/http2/server.go | 62 ++++++++++++++++++++++++- + 1 file changed, 60 insertions(+), 2 deletions(-) + +diff --git a/vendor/golang.org/x/net/http2/server.go b/vendor/golang.org/x/net/http2/server.go +index e125bbd..0844864 100644 +--- a/vendor/golang.org/x/net/http2/server.go ++++ b/vendor/golang.org/x/net/http2/server.go +@@ -521,9 +521,11 @@ type serverConn struct { + advMaxStreams uint32 // our SETTINGS_MAX_CONCURRENT_STREAMS advertised the client + curClientStreams uint32 // number of open streams initiated by the client + curPushedStreams uint32 // number of open streams initiated by server push ++ curHandlers uint32 // number of running handler goroutines + maxClientStreamID uint32 // max ever seen from client (odd), or 0 if there have been no client requests + maxPushPromiseID uint32 // ID of the last push promise (even), or 0 if there have been no pushes + streams map[uint32]*stream ++ unstartedHandlers []unstartedHandler + initialStreamSendWindowSize int32 + maxFrameSize int32 + headerTableSize uint32 +@@ -893,6 +895,8 @@ func (sc *serverConn) serve() { + return + case gracefulShutdownMsg: + sc.startGracefulShutdownInternal() ++ case handlerDoneMsg: ++ sc.handlerDone() + default: + panic("unknown timer") + } +@@ -938,6 +942,7 @@ var ( + idleTimerMsg = new(serverMessage) + shutdownTimerMsg = new(serverMessage) + gracefulShutdownMsg = new(serverMessage) ++ handlerDoneMsg = new(serverMessage) + ) + + func (sc *serverConn) onSettingsTimer() { sc.sendServeMsg(settingsTimerMsg) } +@@ -1895,8 +1900,7 @@ func (sc *serverConn) processHeaders(f *MetaHeadersFrame) error { + sc.conn.SetReadDeadline(time.Time{}) + } + +- go sc.runHandler(rw, req, handler) +- return nil ++ return sc.scheduleHandler(id, rw, req, handler) + } + + func (st *stream) processTrailerHeaders(f *MetaHeadersFrame) error { +@@ -2143,8 +2147,62 @@ func (sc *serverConn) newWriterAndRequestNoBody(st *stream, rp requestParam) (*r + return rw, req, nil + } + ++type unstartedHandler struct { ++ streamID uint32 ++ rw *responseWriter ++ req *http.Request ++ handler func(http.ResponseWriter, *http.Request) ++} ++ ++// scheduleHandler starts a handler goroutine, ++// or schedules one to start as soon as an existing handler finishes. ++func (sc *serverConn) scheduleHandler(streamID uint32, rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) error { ++ sc.serveG.check() ++ maxHandlers := sc.advMaxStreams ++ if sc.curHandlers < maxHandlers { ++ sc.curHandlers++ ++ go sc.runHandler(rw, req, handler) ++ return nil ++ } ++ if len(sc.unstartedHandlers) > int(4*sc.advMaxStreams) { ++ return ConnectionError(ErrCodeEnhanceYourCalm) ++ } ++ sc.unstartedHandlers = append(sc.unstartedHandlers, unstartedHandler{ ++ streamID: streamID, ++ rw: rw, ++ req: req, ++ handler: handler, ++ }) ++ return nil ++} ++ ++func (sc *serverConn) handlerDone() { ++ sc.serveG.check() ++ sc.curHandlers-- ++ i := 0 ++ maxHandlers := sc.advMaxStreams ++ for ; i < len(sc.unstartedHandlers); i++ { ++ u := sc.unstartedHandlers[i] ++ if sc.streams[u.streamID] == nil { ++ // This stream was reset before its goroutine had a chance to start. ++ continue ++ } ++ if sc.curHandlers >= maxHandlers { ++ break ++ } ++ sc.curHandlers++ ++ go sc.runHandler(u.rw, u.req, u.handler) ++ sc.unstartedHandlers[i] = unstartedHandler{} // don't retain references ++ } ++ sc.unstartedHandlers = sc.unstartedHandlers[i:] ++ if len(sc.unstartedHandlers) == 0 { ++ sc.unstartedHandlers = nil ++ } ++} ++ + // Run on its own goroutine. + func (sc *serverConn) runHandler(rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) { ++ defer sc.sendServeMsg(handlerDoneMsg) + didPanic := true + defer func() { + rw.rws.stream.cancelCtx() +-- +2.33.8 diff --git a/SPECS/keda/keda.spec b/SPECS/keda/keda.spec index 0e5e35bcf28..1a635450afa 100644 --- a/SPECS/keda/keda.spec +++ b/SPECS/keda/keda.spec @@ -1,7 +1,7 @@ Summary: Kubernetes-based Event Driven Autoscaling Name: keda Version: 2.4.0 -Release: 16%{?dist} +Release: 19%{?dist} License: ASL 2.0 Vendor: Microsoft Corporation Distribution: Mariner @@ -29,16 +29,22 @@ Source1: %{name}-%{version}-vendor-v2.tar.gz # Patches the version of client_golang used in the vendored source. Should be applied before creating the vendored tarball. # Can be removed if we upgrade keda to 2.6.0 or later. Patch0: CVE-2022-21698.patch + +# patches for vendored code >= 1000 +Patch1000: CVE-2023-44487.patch +Patch1001: CVE-2021-44716.patch + BuildRequires: golang >= 1.15 %description -KEDA is a Kubernetes-based Event Driven Autoscaling component. -It provides event driven scale for any container running in Kubernetes +KEDA is a Kubernetes-based Event Driven Autoscaling component. +It provides event driven scale for any container running in Kubernetes %prep -%autosetup -p1 +%autosetup -N # create vendor folder from the vendor tarball and set vendor mode tar -xf %{SOURCE1} --no-same-owner +%autopatch -p1 %build export LDFLAGS="-X=github.com/kedacore/keda/v2/version.GitCommit= -X=github.com/kedacore/keda/v2/version.Version=main" @@ -62,6 +68,15 @@ cp ./bin/keda-adapter %{buildroot}%{_bindir} %{_bindir}/%{name}-adapter %changelog +* Fri Feb 09 2024 Pawel Winogrodzki - 2.4.0-19 +- Bump release to rebuild with go 1.21.6. + +* Mon Feb 05 2024 Nicolas Guibourge - 2.4.0-18 +- Patch CVE-2021-44716 + +* Mon Feb 05 2024 Daniel McIlvaney - 2.4.0-17 +- Address CVE-2023-44487 by patching vendored golang.org/x/net/http2 + * Tue Jan 01 2024 Tobias Brick - 2.4.0-16 - Patch CVE-2022-21698 - Update vendored tarball diff --git a/SPECS/kernel-azure/config b/SPECS/kernel-azure/config index 53fb0b095ab..06ee9c47ba8 100644 --- a/SPECS/kernel-azure/config +++ b/SPECS/kernel-azure/config @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86_64 5.15.148.1 Kernel Configuration +# Linux/x86_64 5.15.148.2 Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (GCC) 11.2.0" CONFIG_CC_IS_GCC=y diff --git a/SPECS/kernel-azure/config_aarch64 b/SPECS/kernel-azure/config_aarch64 index 9c765514f08..71b31872a76 100644 --- a/SPECS/kernel-azure/config_aarch64 +++ b/SPECS/kernel-azure/config_aarch64 @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm64 5.15.148.1 Kernel Configuration +# Linux/arm64 5.15.148.2 Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (GCC) 11.2.0" CONFIG_CC_IS_GCC=y diff --git a/SPECS/kernel-azure/kernel-azure.signatures.json b/SPECS/kernel-azure/kernel-azure.signatures.json index fb8d7ddccfd..a69df2b9c68 100644 --- a/SPECS/kernel-azure/kernel-azure.signatures.json +++ b/SPECS/kernel-azure/kernel-azure.signatures.json @@ -1,9 +1,9 @@ { "Signatures": { "cbl-mariner-ca-20211013.pem": "5ef124b0924cb1047c111a0ecff1ae11e6ad7cac8d1d9b40f98f99334121f0b0", - "config": "f018f5a46e75d71fea20d42831f306159b1a3b4297a32c697398ebe915ba6055", - "config_aarch64": "c68fbd5b74a295a1fe2d4e27418129b6e7b276bd00fb92f9defc1174f18604a2", + "config": "e3688ef50b9b7c5647078b8734837a275a5bf18fe1851d65c579cb09de0f5e8a", + "config_aarch64": "5728bf4ce22f5265e55e3d4c4267db3eaae9271efcde7851c3d5153c17ef08ed", "sha512hmac-openssl.sh": "02ab91329c4be09ee66d759e4d23ac875037c3b56e5a598e32fd1206da06a27f", - "kernel-5.15.148.1.tar.gz": "e77c297fe3e3f0d9fd403c52f1e959389fa33e6642be9ddd12d4ea7f8927e5d6" + "kernel-5.15.148.2.tar.gz": "58488cf131b8a1c77dcac651fbad10e105e9a8d2f48b7bb8b2d08ac63483a129" } } diff --git a/SPECS/kernel-azure/kernel-azure.spec b/SPECS/kernel-azure/kernel-azure.spec index 7c80ea44ef2..221c7e61b48 100644 --- a/SPECS/kernel-azure/kernel-azure.spec +++ b/SPECS/kernel-azure/kernel-azure.spec @@ -27,7 +27,7 @@ Summary: Linux Kernel Name: kernel-azure -Version: 5.15.148.1 +Version: 5.15.148.2 Release: 1%{?dist} License: GPLv2 Vendor: Microsoft Corporation @@ -420,6 +420,9 @@ ln -sf linux-%{uname_r}.cfg /boot/mariner.cfg %{_sysconfdir}/bash_completion.d/bpftool %changelog +* Thu Feb 08 2024 CBL-Mariner Servicing Account - 5.15.148.2-1 +- Auto-upgrade to 5.15.148.2 + * Tue Jan 30 2024 CBL-Mariner Servicing Account - 5.15.148.1-1 - Auto-upgrade to 5.15.148.1 diff --git a/SPECS/kernel-hci/config b/SPECS/kernel-hci/config index 727b2cb9320..3fdf0c2ddd3 100644 --- a/SPECS/kernel-hci/config +++ b/SPECS/kernel-hci/config @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86_64 5.15.148.1 Kernel Configuration +# Linux/x86_64 5.15.148.2 Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (GCC) 11.2.0" CONFIG_CC_IS_GCC=y diff --git a/SPECS/kernel-hci/kernel-hci.signatures.json b/SPECS/kernel-hci/kernel-hci.signatures.json index eeaf23585a7..a0244d91958 100644 --- a/SPECS/kernel-hci/kernel-hci.signatures.json +++ b/SPECS/kernel-hci/kernel-hci.signatures.json @@ -1,7 +1,7 @@ { "Signatures": { "cbl-mariner-ca-20211013.pem": "5ef124b0924cb1047c111a0ecff1ae11e6ad7cac8d1d9b40f98f99334121f0b0", - "config": "bf4cb3afab12b14653e3fff9901ac4b3925b356fc588ee4e10336d3c58cc0d90", - "kernel-5.15.148.1.tar.gz": "e77c297fe3e3f0d9fd403c52f1e959389fa33e6642be9ddd12d4ea7f8927e5d6" + "config": "e9d3ec6622cc04bfea00daf207a33ed52c981e064f74cb8a244e8d0827430a2f", + "kernel-5.15.148.2.tar.gz": "58488cf131b8a1c77dcac651fbad10e105e9a8d2f48b7bb8b2d08ac63483a129" } } \ No newline at end of file diff --git a/SPECS/kernel-hci/kernel-hci.spec b/SPECS/kernel-hci/kernel-hci.spec index e44037c26ce..1e4c504eea1 100644 --- a/SPECS/kernel-hci/kernel-hci.spec +++ b/SPECS/kernel-hci/kernel-hci.spec @@ -17,7 +17,7 @@ %define config_source %{SOURCE1} Summary: Linux Kernel for HCI Name: kernel-hci -Version: 5.15.148.1 +Version: 5.15.148.2 Release: 1%{?dist} License: GPLv2 Vendor: Microsoft Corporation @@ -551,6 +551,9 @@ ln -sf linux-%{uname_r}.cfg /boot/mariner.cfg %{_sysconfdir}/bash_completion.d/bpftool %changelog +* Thu Feb 08 2024 CBL-Mariner Servicing Account - 5.15.148.2-1 +- Auto-upgrade to 5.15.148.2 + * Tue Jan 30 2024 CBL-Mariner Servicing Account - 5.15.148.1-1 - Auto-upgrade to 5.15.148.1 diff --git a/SPECS/kernel-headers/kernel-headers.signatures.json b/SPECS/kernel-headers/kernel-headers.signatures.json index 59666933649..2b665565404 100644 --- a/SPECS/kernel-headers/kernel-headers.signatures.json +++ b/SPECS/kernel-headers/kernel-headers.signatures.json @@ -1,5 +1,5 @@ { "Signatures": { - "kernel-5.15.148.1.tar.gz": "e77c297fe3e3f0d9fd403c52f1e959389fa33e6642be9ddd12d4ea7f8927e5d6" + "kernel-5.15.148.2.tar.gz": "58488cf131b8a1c77dcac651fbad10e105e9a8d2f48b7bb8b2d08ac63483a129" } } diff --git a/SPECS/kernel-headers/kernel-headers.spec b/SPECS/kernel-headers/kernel-headers.spec index d03ece82335..b75a1cbde26 100644 --- a/SPECS/kernel-headers/kernel-headers.spec +++ b/SPECS/kernel-headers/kernel-headers.spec @@ -11,7 +11,7 @@ Summary: Linux API header files Name: kernel-headers -Version: 5.15.148.1 +Version: 5.15.148.2 Release: 1%{?dist} License: GPLv2 Vendor: Microsoft Corporation @@ -73,6 +73,9 @@ done %endif %changelog +* Thu Feb 08 2024 CBL-Mariner Servicing Account - 5.15.148.2-1 +- Auto-upgrade to 5.15.148.2 + * Tue Jan 30 2024 CBL-Mariner Servicing Account - 5.15.148.1-1 - Auto-upgrade to 5.15.148.1 diff --git a/SPECS/kernel-mos/config b/SPECS/kernel-mos/config index f99e01c27de..029a6b96b6b 100644 --- a/SPECS/kernel-mos/config +++ b/SPECS/kernel-mos/config @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86_64 5.15.148.1 Kernel Configuration +# Linux/x86_64 5.15.148.2 Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (GCC) 11.2.0" CONFIG_CC_IS_GCC=y diff --git a/SPECS/kernel-mos/kernel-mos.signatures.json b/SPECS/kernel-mos/kernel-mos.signatures.json index e915674eee3..e68be2629f1 100644 --- a/SPECS/kernel-mos/kernel-mos.signatures.json +++ b/SPECS/kernel-mos/kernel-mos.signatures.json @@ -1,8 +1,8 @@ { "Signatures": { "cbl-mariner-ca-20211013.pem": "5ef124b0924cb1047c111a0ecff1ae11e6ad7cac8d1d9b40f98f99334121f0b0", - "config": "5e3be1a1f889d4b5725b1a1b357297069bbecfcfb94196924f01fc2b9a2fd94c", + "config": "4c6f89eba5e600738f60f4da3b45bcdc451ac7670a34c24baf4afe67958b67fb", "sha512hmac-openssl.sh": "02ab91329c4be09ee66d759e4d23ac875037c3b56e5a598e32fd1206da06a27f", - "kernel-mos-5.15.148.1.tar.gz": "534b949ce6973b76c9c342696faf459305ca90b18f2e95a5f1ef676a696e0e0d" + "kernel-mos-5.15.148.2.tar.gz": "d6404b0b86fdade281748c20e0d861797a6bf4802e024ae2681231abc94ff3d0" } } diff --git a/SPECS/kernel-mos/kernel-mos.spec b/SPECS/kernel-mos/kernel-mos.spec index 868b23d87d9..e7590f993bc 100644 --- a/SPECS/kernel-mos/kernel-mos.spec +++ b/SPECS/kernel-mos/kernel-mos.spec @@ -18,7 +18,7 @@ %define config_source %{SOURCE1} Summary: Linux Kernel for MOS Name: kernel-mos -Version: 5.15.148.1 +Version: 5.15.148.2 Release: 1%{?dist} License: GPLv2 Vendor: Microsoft Corporation @@ -377,6 +377,9 @@ ln -sf linux-%{uname_r}.cfg /boot/mariner.cfg %{_sysconfdir}/bash_completion.d/bpftool %changelog +* Thu Feb 08 2024 Rachel Menge - 5.15.148.2-1 +- Upgrade to 5.15.148.2 + * Wed Jan 31 2024 Gary Swalling - 5.15.148.1-1 - Update to 5.15.148.1 diff --git a/SPECS/kernel-uvm-cvm/config b/SPECS/kernel-uvm-cvm/config deleted file mode 100644 index c1ed34424b7..00000000000 --- a/SPECS/kernel-uvm-cvm/config +++ /dev/null @@ -1,3259 +0,0 @@ -# -# Automatically generated file; DO NOT EDIT. -# Linux/x86_64 6.1.0.mshv14 Kernel Configuration -# -CONFIG_CC_VERSION_TEXT="gcc (GCC) 11.2.0" -CONFIG_CC_IS_GCC=y -CONFIG_GCC_VERSION=110200 -CONFIG_CLANG_VERSION=0 -CONFIG_AS_IS_GNU=y -CONFIG_AS_VERSION=23700 -CONFIG_LD_IS_BFD=y -CONFIG_LD_VERSION=23700 -CONFIG_LLD_VERSION=0 -CONFIG_CC_CAN_LINK=y -CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y -CONFIG_CC_HAS_ASM_GOTO_TIED_OUTPUT=y -CONFIG_CC_HAS_ASM_INLINE=y -CONFIG_CC_HAS_NO_PROFILE_FN_ATTR=y -CONFIG_PAHOLE_VERSION=121 -CONFIG_IRQ_WORK=y -CONFIG_BUILDTIME_TABLE_SORT=y -CONFIG_THREAD_INFO_IN_TASK=y - -# -# General setup -# -CONFIG_INIT_ENV_ARG_LIMIT=32 -# CONFIG_COMPILE_TEST is not set -# CONFIG_WERROR is not set -CONFIG_LOCALVERSION="" -# CONFIG_LOCALVERSION_AUTO is not set -CONFIG_BUILD_SALT="" -CONFIG_HAVE_KERNEL_GZIP=y -CONFIG_HAVE_KERNEL_BZIP2=y -CONFIG_HAVE_KERNEL_LZMA=y -CONFIG_HAVE_KERNEL_XZ=y -CONFIG_HAVE_KERNEL_LZO=y -CONFIG_HAVE_KERNEL_LZ4=y -CONFIG_HAVE_KERNEL_ZSTD=y -CONFIG_KERNEL_GZIP=y -# CONFIG_KERNEL_BZIP2 is not set -# CONFIG_KERNEL_LZMA is not set -# CONFIG_KERNEL_XZ is not set -# CONFIG_KERNEL_LZO is not set -# CONFIG_KERNEL_LZ4 is not set -# CONFIG_KERNEL_ZSTD is not set -CONFIG_DEFAULT_INIT="" -CONFIG_DEFAULT_HOSTNAME="(none)" -CONFIG_SYSVIPC=y -CONFIG_SYSVIPC_SYSCTL=y -CONFIG_POSIX_MQUEUE=y -CONFIG_POSIX_MQUEUE_SYSCTL=y -# CONFIG_WATCH_QUEUE is not set -# CONFIG_CROSS_MEMORY_ATTACH is not set -# CONFIG_USELIB is not set -# CONFIG_AUDIT is not set -CONFIG_HAVE_ARCH_AUDITSYSCALL=y - -# -# IRQ subsystem -# -CONFIG_GENERIC_IRQ_PROBE=y -CONFIG_GENERIC_IRQ_SHOW=y -CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y -CONFIG_GENERIC_PENDING_IRQ=y -CONFIG_GENERIC_IRQ_MIGRATION=y -CONFIG_HARDIRQS_SW_RESEND=y -CONFIG_IRQ_DOMAIN=y -CONFIG_IRQ_DOMAIN_HIERARCHY=y -CONFIG_GENERIC_MSI_IRQ=y -CONFIG_GENERIC_MSI_IRQ_DOMAIN=y -CONFIG_IRQ_MSI_IOMMU=y -CONFIG_GENERIC_IRQ_MATRIX_ALLOCATOR=y -CONFIG_GENERIC_IRQ_RESERVATION_MODE=y -CONFIG_IRQ_FORCED_THREADING=y -CONFIG_SPARSE_IRQ=y -# end of IRQ subsystem - -CONFIG_CLOCKSOURCE_WATCHDOG=y -CONFIG_ARCH_CLOCKSOURCE_INIT=y -CONFIG_CLOCKSOURCE_VALIDATE_LAST_CYCLE=y -CONFIG_GENERIC_TIME_VSYSCALL=y -CONFIG_GENERIC_CLOCKEVENTS=y -CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y -CONFIG_GENERIC_CLOCKEVENTS_MIN_ADJUST=y -CONFIG_GENERIC_CMOS_UPDATE=y -CONFIG_HAVE_POSIX_CPU_TIMERS_TASK_WORK=y -CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y -CONFIG_CONTEXT_TRACKING=y -CONFIG_CONTEXT_TRACKING_IDLE=y - -# -# Timers subsystem -# -CONFIG_TICK_ONESHOT=y -CONFIG_NO_HZ_COMMON=y -# CONFIG_HZ_PERIODIC is not set -# CONFIG_NO_HZ_IDLE is not set -CONFIG_NO_HZ_FULL=y -CONFIG_CONTEXT_TRACKING_USER=y -# CONFIG_CONTEXT_TRACKING_USER_FORCE is not set -CONFIG_NO_HZ=y -CONFIG_HIGH_RES_TIMERS=y -CONFIG_CLOCKSOURCE_WATCHDOG_MAX_SKEW_US=100 -# end of Timers subsystem - -CONFIG_BPF=y -CONFIG_HAVE_EBPF_JIT=y -CONFIG_ARCH_WANT_DEFAULT_BPF_JIT=y - -# -# BPF subsystem -# -CONFIG_BPF_SYSCALL=y -# CONFIG_BPF_JIT is not set -# CONFIG_BPF_UNPRIV_DEFAULT_OFF is not set -# CONFIG_BPF_PRELOAD is not set -# end of BPF subsystem - -CONFIG_PREEMPT_VOLUNTARY_BUILD=y -# CONFIG_PREEMPT_NONE is not set -CONFIG_PREEMPT_VOLUNTARY=y -# CONFIG_PREEMPT is not set -# CONFIG_PREEMPT_DYNAMIC is not set -# CONFIG_SCHED_CORE is not set - -# -# CPU/Task time and stats accounting -# -CONFIG_VIRT_CPU_ACCOUNTING=y -CONFIG_VIRT_CPU_ACCOUNTING_GEN=y -# CONFIG_IRQ_TIME_ACCOUNTING is not set -# CONFIG_BSD_PROCESS_ACCT is not set -# CONFIG_TASKSTATS is not set -# CONFIG_PSI is not set -# end of CPU/Task time and stats accounting - -CONFIG_CPU_ISOLATION=y - -# -# RCU Subsystem -# -CONFIG_TREE_RCU=y -# CONFIG_RCU_EXPERT is not set -CONFIG_SRCU=y -CONFIG_TREE_SRCU=y -CONFIG_TASKS_RCU_GENERIC=y -CONFIG_TASKS_TRACE_RCU=y -CONFIG_RCU_STALL_COMMON=y -CONFIG_RCU_NEED_SEGCBLIST=y -CONFIG_RCU_NOCB_CPU=y -# CONFIG_RCU_NOCB_CPU_DEFAULT_ALL is not set -# end of RCU Subsystem - -CONFIG_IKCONFIG=y -CONFIG_IKCONFIG_PROC=y -# CONFIG_IKHEADERS is not set -CONFIG_LOG_BUF_SHIFT=17 -CONFIG_LOG_CPU_MAX_BUF_SHIFT=12 -CONFIG_PRINTK_SAFE_LOG_BUF_SHIFT=13 -CONFIG_HAVE_UNSTABLE_SCHED_CLOCK=y - -# -# Scheduler features -# -# CONFIG_UCLAMP_TASK is not set -# end of Scheduler features - -CONFIG_ARCH_SUPPORTS_NUMA_BALANCING=y -CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH=y -CONFIG_CC_HAS_INT128=y -CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5" -CONFIG_GCC12_NO_ARRAY_BOUNDS=y -CONFIG_ARCH_SUPPORTS_INT128=y -# CONFIG_NUMA_BALANCING is not set -CONFIG_CGROUPS=y -CONFIG_PAGE_COUNTER=y -# CONFIG_CGROUP_FAVOR_DYNMODS is not set -CONFIG_MEMCG=y -CONFIG_MEMCG_KMEM=y -CONFIG_BLK_CGROUP=y -CONFIG_CGROUP_WRITEBACK=y -CONFIG_CGROUP_SCHED=y -CONFIG_FAIR_GROUP_SCHED=y -CONFIG_CFS_BANDWIDTH=y -# CONFIG_RT_GROUP_SCHED is not set -CONFIG_CGROUP_PIDS=y -# CONFIG_CGROUP_RDMA is not set -CONFIG_CGROUP_FREEZER=y -# CONFIG_CGROUP_HUGETLB is not set -CONFIG_CPUSETS=y -# CONFIG_PROC_PID_CPUSET is not set -CONFIG_CGROUP_DEVICE=y -CONFIG_CGROUP_CPUACCT=y -CONFIG_CGROUP_PERF=y -CONFIG_CGROUP_BPF=y -# CONFIG_CGROUP_MISC is not set -# CONFIG_CGROUP_DEBUG is not set -CONFIG_SOCK_CGROUP_DATA=y -CONFIG_NAMESPACES=y -CONFIG_UTS_NS=y -# CONFIG_TIME_NS is not set -CONFIG_IPC_NS=y -CONFIG_USER_NS=y -CONFIG_PID_NS=y -CONFIG_NET_NS=y -# CONFIG_CHECKPOINT_RESTORE is not set -# CONFIG_SCHED_AUTOGROUP is not set -# CONFIG_SYSFS_DEPRECATED is not set -# CONFIG_RELAY is not set -CONFIG_BLK_DEV_INITRD=y -CONFIG_INITRAMFS_SOURCE="" -CONFIG_RD_GZIP=y -# CONFIG_RD_BZIP2 is not set -# CONFIG_RD_LZMA is not set -# CONFIG_RD_XZ is not set -# CONFIG_RD_LZO is not set -# CONFIG_RD_LZ4 is not set -# CONFIG_RD_ZSTD is not set -# CONFIG_BOOT_CONFIG is not set -CONFIG_INITRAMFS_PRESERVE_MTIME=y -CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE=y -# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set -CONFIG_LD_ORPHAN_WARN=y -CONFIG_SYSCTL=y -CONFIG_SYSCTL_EXCEPTION_TRACE=y -CONFIG_HAVE_PCSPKR_PLATFORM=y -# CONFIG_EXPERT is not set -CONFIG_MULTIUSER=y -CONFIG_SGETMASK_SYSCALL=y -CONFIG_SYSFS_SYSCALL=y -CONFIG_FHANDLE=y -CONFIG_POSIX_TIMERS=y -CONFIG_PRINTK=y -CONFIG_BUG=y -CONFIG_ELF_CORE=y -CONFIG_PCSPKR_PLATFORM=y -CONFIG_BASE_FULL=y -CONFIG_FUTEX=y -CONFIG_FUTEX_PI=y -CONFIG_EPOLL=y -CONFIG_SIGNALFD=y -CONFIG_TIMERFD=y -CONFIG_EVENTFD=y -CONFIG_SHMEM=y -CONFIG_AIO=y -CONFIG_IO_URING=y -CONFIG_ADVISE_SYSCALLS=y -CONFIG_MEMBARRIER=y -CONFIG_KALLSYMS=y -# CONFIG_KALLSYMS_ALL is not set -CONFIG_KALLSYMS_ABSOLUTE_PERCPU=y -CONFIG_KALLSYMS_BASE_RELATIVE=y -CONFIG_ARCH_HAS_MEMBARRIER_SYNC_CORE=y -CONFIG_RSEQ=y -# CONFIG_EMBEDDED is not set -CONFIG_HAVE_PERF_EVENTS=y - -# -# Kernel Performance Events And Counters -# -CONFIG_PERF_EVENTS=y -# CONFIG_DEBUG_PERF_USE_VMALLOC is not set -# end of Kernel Performance Events And Counters - -# CONFIG_PROFILING is not set -# end of General setup - -CONFIG_64BIT=y -CONFIG_X86_64=y -CONFIG_X86=y -CONFIG_INSTRUCTION_DECODER=y -CONFIG_OUTPUT_FORMAT="elf64-x86-64" -CONFIG_LOCKDEP_SUPPORT=y -CONFIG_STACKTRACE_SUPPORT=y -CONFIG_MMU=y -CONFIG_ARCH_MMAP_RND_BITS_MIN=28 -CONFIG_ARCH_MMAP_RND_BITS_MAX=32 -CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=8 -CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=16 -CONFIG_GENERIC_ISA_DMA=y -CONFIG_GENERIC_BUG=y -CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y -CONFIG_ARCH_MAY_HAVE_PC_FDC=y -CONFIG_GENERIC_CALIBRATE_DELAY=y -CONFIG_ARCH_HAS_CPU_RELAX=y -CONFIG_ARCH_HIBERNATION_POSSIBLE=y -CONFIG_ARCH_NR_GPIO=1024 -CONFIG_ARCH_SUSPEND_POSSIBLE=y -CONFIG_AUDIT_ARCH=y -CONFIG_HAVE_INTEL_TXT=y -CONFIG_X86_64_SMP=y -CONFIG_ARCH_SUPPORTS_UPROBES=y -CONFIG_FIX_EARLYCON_MEM=y -CONFIG_DYNAMIC_PHYSICAL_MASK=y -CONFIG_PGTABLE_LEVELS=4 -CONFIG_CC_HAS_SANE_STACKPROTECTOR=y - -# -# Processor type and features -# -CONFIG_SMP=y -CONFIG_X86_FEATURE_NAMES=y -CONFIG_X86_X2APIC=y -CONFIG_X86_MPPARSE=y -# CONFIG_GOLDFISH is not set -# CONFIG_X86_CPU_RESCTRL is not set -# CONFIG_X86_EXTENDED_PLATFORM is not set -# CONFIG_X86_INTEL_LPSS is not set -# CONFIG_X86_AMD_PLATFORM_DEVICE is not set -# CONFIG_IOSF_MBI is not set -# CONFIG_SCHED_OMIT_FRAME_POINTER is not set -CONFIG_HYPERVISOR_GUEST=y -CONFIG_PARAVIRT=y -# CONFIG_PARAVIRT_DEBUG is not set -CONFIG_PARAVIRT_SPINLOCKS=y -CONFIG_X86_HV_CALLBACK_VECTOR=y -# CONFIG_XEN is not set -CONFIG_KVM_GUEST=y -CONFIG_ARCH_CPUIDLE_HALTPOLL=y -CONFIG_PVH=y -# CONFIG_PARAVIRT_TIME_ACCOUNTING is not set -CONFIG_PARAVIRT_CLOCK=y -# CONFIG_JAILHOUSE_GUEST is not set -# CONFIG_ACRN_GUEST is not set -# CONFIG_INTEL_TDX_GUEST is not set -# CONFIG_MK8 is not set -# CONFIG_MPSC is not set -# CONFIG_MCORE2 is not set -# CONFIG_MATOM is not set -CONFIG_GENERIC_CPU=y -CONFIG_X86_INTERNODE_CACHE_SHIFT=6 -CONFIG_X86_L1_CACHE_SHIFT=6 -CONFIG_X86_TSC=y -CONFIG_X86_CMPXCHG64=y -CONFIG_X86_CMOV=y -CONFIG_X86_MINIMUM_CPU_FAMILY=64 -CONFIG_X86_DEBUGCTLMSR=y -CONFIG_IA32_FEAT_CTL=y -CONFIG_X86_VMX_FEATURE_NAMES=y -CONFIG_CPU_SUP_INTEL=y -CONFIG_CPU_SUP_AMD=y -CONFIG_CPU_SUP_HYGON=y -CONFIG_CPU_SUP_CENTAUR=y -CONFIG_CPU_SUP_ZHAOXIN=y -CONFIG_HPET_TIMER=y -CONFIG_DMI=y -CONFIG_GART_IOMMU=y -CONFIG_MAXSMP=y -CONFIG_NR_CPUS_RANGE_BEGIN=8192 -CONFIG_NR_CPUS_RANGE_END=8192 -CONFIG_NR_CPUS_DEFAULT=8192 -CONFIG_NR_CPUS=8192 -# CONFIG_SCHED_CLUSTER is not set -CONFIG_SCHED_SMT=y -CONFIG_SCHED_MC=y -CONFIG_SCHED_MC_PRIO=y -CONFIG_X86_LOCAL_APIC=y -CONFIG_X86_IO_APIC=y -# CONFIG_X86_REROUTE_FOR_BROKEN_BOOT_IRQS is not set -# CONFIG_X86_MCE is not set - -# -# Performance monitoring -# -# CONFIG_PERF_EVENTS_INTEL_UNCORE is not set -# CONFIG_PERF_EVENTS_INTEL_RAPL is not set -# CONFIG_PERF_EVENTS_INTEL_CSTATE is not set -# CONFIG_PERF_EVENTS_AMD_POWER is not set -CONFIG_PERF_EVENTS_AMD_UNCORE=y -# CONFIG_PERF_EVENTS_AMD_BRS is not set -# end of Performance monitoring - -CONFIG_X86_16BIT=y -CONFIG_X86_ESPFIX64=y -CONFIG_X86_VSYSCALL_EMULATION=y -# CONFIG_X86_IOPL_IOPERM is not set -# CONFIG_MICROCODE is not set -CONFIG_X86_MSR=y -CONFIG_X86_CPUID=y -# CONFIG_X86_5LEVEL is not set -CONFIG_X86_DIRECT_GBPAGES=y -CONFIG_X86_MEM_ENCRYPT=y -CONFIG_AMD_MEM_ENCRYPT=y -CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT=y -CONFIG_NUMA=y -CONFIG_AMD_NUMA=y -CONFIG_X86_64_ACPI_NUMA=y -# CONFIG_NUMA_EMU is not set -CONFIG_NODES_SHIFT=10 -CONFIG_ARCH_SPARSEMEM_ENABLE=y -CONFIG_ARCH_SPARSEMEM_DEFAULT=y -# CONFIG_ARCH_MEMORY_PROBE is not set -CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000 -# CONFIG_X86_PMEM_LEGACY is not set -# CONFIG_X86_CHECK_BIOS_CORRUPTION is not set -CONFIG_MTRR=y -CONFIG_MTRR_SANITIZER=y -CONFIG_MTRR_SANITIZER_ENABLE_DEFAULT=0 -CONFIG_MTRR_SANITIZER_SPARE_REG_NR_DEFAULT=1 -CONFIG_X86_PAT=y -CONFIG_ARCH_USES_PG_UNCACHED=y -CONFIG_X86_UMIP=y -CONFIG_CC_HAS_IBT=y -# CONFIG_X86_KERNEL_IBT is not set -# CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS is not set -CONFIG_X86_INTEL_TSX_MODE_OFF=y -# CONFIG_X86_INTEL_TSX_MODE_ON is not set -# CONFIG_X86_INTEL_TSX_MODE_AUTO is not set -CONFIG_X86_SGX=y -# CONFIG_EFI is not set -# CONFIG_HZ_100 is not set -CONFIG_HZ_250=y -# CONFIG_HZ_300 is not set -# CONFIG_HZ_1000 is not set -CONFIG_HZ=250 -CONFIG_SCHED_HRTICK=y -# CONFIG_KEXEC is not set -# CONFIG_KEXEC_FILE is not set -# CONFIG_CRASH_DUMP is not set -CONFIG_PHYSICAL_START=0x1000000 -# CONFIG_RELOCATABLE is not set -CONFIG_PHYSICAL_ALIGN=0x200000 -CONFIG_HOTPLUG_CPU=y -# CONFIG_BOOTPARAM_HOTPLUG_CPU0 is not set -# CONFIG_DEBUG_HOTPLUG_CPU0 is not set -CONFIG_LEGACY_VSYSCALL_XONLY=y -# CONFIG_LEGACY_VSYSCALL_NONE is not set -# CONFIG_CMDLINE_BOOL is not set -CONFIG_MODIFY_LDT_SYSCALL=y -# CONFIG_STRICT_SIGALTSTACK_SIZE is not set -CONFIG_HAVE_LIVEPATCH=y -# end of Processor type and features - -CONFIG_CC_HAS_RETURN_THUNK=y -CONFIG_SPECULATION_MITIGATIONS=y -CONFIG_PAGE_TABLE_ISOLATION=y -CONFIG_RETPOLINE=y -CONFIG_RETHUNK=y -CONFIG_CPU_UNRET_ENTRY=y -CONFIG_CPU_IBPB_ENTRY=y -CONFIG_CPU_IBRS_ENTRY=y -CONFIG_ARCH_HAS_ADD_PAGES=y -CONFIG_ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE=y - -# -# Power management and ACPI options -# -# CONFIG_SUSPEND is not set -# CONFIG_HIBERNATION is not set -# CONFIG_PM is not set -# CONFIG_ENERGY_MODEL is not set -CONFIG_ARCH_SUPPORTS_ACPI=y -CONFIG_ACPI=y -CONFIG_ACPI_LEGACY_TABLES_LOOKUP=y -CONFIG_ARCH_MIGHT_HAVE_ACPI_PDC=y -CONFIG_ACPI_SYSTEM_POWER_STATES_SUPPORT=y -# CONFIG_ACPI_DEBUGGER is not set -# CONFIG_ACPI_SPCR_TABLE is not set -# CONFIG_ACPI_FPDT is not set -CONFIG_ACPI_LPIT=y -# CONFIG_ACPI_REV_OVERRIDE_POSSIBLE is not set -# CONFIG_ACPI_EC_DEBUGFS is not set -# CONFIG_ACPI_AC is not set -# CONFIG_ACPI_BATTERY is not set -CONFIG_ACPI_BUTTON=y -# CONFIG_ACPI_FAN is not set -# CONFIG_ACPI_DOCK is not set -CONFIG_ACPI_CPU_FREQ_PSS=y -CONFIG_ACPI_PROCESSOR_CSTATE=y -CONFIG_ACPI_PROCESSOR_IDLE=y -CONFIG_ACPI_CPPC_LIB=y -CONFIG_ACPI_PROCESSOR=y -CONFIG_ACPI_HOTPLUG_CPU=y -# CONFIG_ACPI_PROCESSOR_AGGREGATOR is not set -CONFIG_ACPI_THERMAL=y -CONFIG_ACPI_CUSTOM_DSDT_FILE="" -CONFIG_ARCH_HAS_ACPI_TABLE_UPGRADE=y -CONFIG_ACPI_TABLE_UPGRADE=y -# CONFIG_ACPI_DEBUG is not set -CONFIG_ACPI_PCI_SLOT=y -CONFIG_ACPI_CONTAINER=y -CONFIG_ACPI_HOTPLUG_MEMORY=y -CONFIG_ACPI_HOTPLUG_IOAPIC=y -# CONFIG_ACPI_SBS is not set -# CONFIG_ACPI_HED is not set -CONFIG_ACPI_NFIT=y -# CONFIG_NFIT_SECURITY_DEBUG is not set -CONFIG_ACPI_NUMA=y -# CONFIG_ACPI_HMAT is not set -CONFIG_HAVE_ACPI_APEI=y -CONFIG_HAVE_ACPI_APEI_NMI=y -# CONFIG_ACPI_APEI is not set -# CONFIG_ACPI_DPTF is not set -# CONFIG_ACPI_CONFIGFS is not set -# CONFIG_ACPI_PFRUT is not set -CONFIG_ACPI_PCC=y -# CONFIG_PMIC_OPREGION is not set -CONFIG_ACPI_VIOT=y -CONFIG_X86_PM_TIMER=y - -# -# CPU Frequency scaling -# -CONFIG_CPU_FREQ=y -CONFIG_CPU_FREQ_GOV_ATTR_SET=y -# CONFIG_CPU_FREQ_STAT is not set -CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y -# CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE is not set -# CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE is not set -# CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL is not set -CONFIG_CPU_FREQ_GOV_PERFORMANCE=y -# CONFIG_CPU_FREQ_GOV_POWERSAVE is not set -# CONFIG_CPU_FREQ_GOV_USERSPACE is not set -# CONFIG_CPU_FREQ_GOV_ONDEMAND is not set -# CONFIG_CPU_FREQ_GOV_CONSERVATIVE is not set -CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y - -# -# CPU frequency scaling drivers -# -CONFIG_X86_INTEL_PSTATE=y -# CONFIG_X86_PCC_CPUFREQ is not set -# CONFIG_X86_AMD_PSTATE is not set -# CONFIG_X86_AMD_PSTATE_UT is not set -# CONFIG_X86_ACPI_CPUFREQ is not set -# CONFIG_X86_SPEEDSTEP_CENTRINO is not set -# CONFIG_X86_P4_CLOCKMOD is not set - -# -# shared options -# -# end of CPU Frequency scaling - -# -# CPU Idle -# -CONFIG_CPU_IDLE=y -# CONFIG_CPU_IDLE_GOV_LADDER is not set -CONFIG_CPU_IDLE_GOV_MENU=y -# CONFIG_CPU_IDLE_GOV_TEO is not set -# CONFIG_CPU_IDLE_GOV_HALTPOLL is not set -# CONFIG_HALTPOLL_CPUIDLE is not set -# end of CPU Idle - -# CONFIG_INTEL_IDLE is not set -# end of Power management and ACPI options - -# -# Bus options (PCI etc.) -# -CONFIG_PCI_DIRECT=y -CONFIG_PCI_MMCONFIG=y -CONFIG_MMCONF_FAM10H=y -CONFIG_ISA_DMA_API=y -CONFIG_AMD_NB=y -# end of Bus options (PCI etc.) - -# -# Binary Emulations -# -# CONFIG_IA32_EMULATION is not set -# CONFIG_X86_X32_ABI is not set -# end of Binary Emulations - -CONFIG_HAVE_KVM=y -# CONFIG_VIRTUALIZATION is not set -CONFIG_AS_AVX512=y -CONFIG_AS_SHA1_NI=y -CONFIG_AS_SHA256_NI=y -CONFIG_AS_TPAUSE=y - -# -# General architecture-dependent options -# -CONFIG_HOTPLUG_SMT=y -CONFIG_GENERIC_ENTRY=y -# CONFIG_KPROBES is not set -# CONFIG_JUMP_LABEL is not set -# CONFIG_STATIC_CALL_SELFTEST is not set -CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y -CONFIG_ARCH_USE_BUILTIN_BSWAP=y -CONFIG_HAVE_IOREMAP_PROT=y -CONFIG_HAVE_KPROBES=y -CONFIG_HAVE_KRETPROBES=y -CONFIG_HAVE_OPTPROBES=y -CONFIG_HAVE_KPROBES_ON_FTRACE=y -CONFIG_ARCH_CORRECT_STACKTRACE_ON_KRETPROBE=y -CONFIG_HAVE_FUNCTION_ERROR_INJECTION=y -CONFIG_HAVE_NMI=y -CONFIG_TRACE_IRQFLAGS_SUPPORT=y -CONFIG_TRACE_IRQFLAGS_NMI_SUPPORT=y -CONFIG_HAVE_ARCH_TRACEHOOK=y -CONFIG_HAVE_DMA_CONTIGUOUS=y -CONFIG_GENERIC_SMP_IDLE_THREAD=y -CONFIG_ARCH_HAS_FORTIFY_SOURCE=y -CONFIG_ARCH_HAS_SET_MEMORY=y -CONFIG_ARCH_HAS_SET_DIRECT_MAP=y -CONFIG_HAVE_ARCH_THREAD_STRUCT_WHITELIST=y -CONFIG_ARCH_WANTS_DYNAMIC_TASK_STRUCT=y -CONFIG_ARCH_WANTS_NO_INSTR=y -CONFIG_HAVE_ASM_MODVERSIONS=y -CONFIG_HAVE_REGS_AND_STACK_ACCESS_API=y -CONFIG_HAVE_RSEQ=y -CONFIG_HAVE_RUST=y -CONFIG_HAVE_FUNCTION_ARG_ACCESS_API=y -CONFIG_HAVE_HW_BREAKPOINT=y -CONFIG_HAVE_MIXED_BREAKPOINTS_REGS=y -CONFIG_HAVE_USER_RETURN_NOTIFIER=y -CONFIG_HAVE_PERF_EVENTS_NMI=y -CONFIG_HAVE_HARDLOCKUP_DETECTOR_PERF=y -CONFIG_HAVE_PERF_REGS=y -CONFIG_HAVE_PERF_USER_STACK_DUMP=y -CONFIG_HAVE_ARCH_JUMP_LABEL=y -CONFIG_HAVE_ARCH_JUMP_LABEL_RELATIVE=y -CONFIG_MMU_GATHER_TABLE_FREE=y -CONFIG_MMU_GATHER_RCU_TABLE_FREE=y -CONFIG_MMU_GATHER_MERGE_VMAS=y -CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG=y -CONFIG_HAVE_ALIGNED_STRUCT_PAGE=y -CONFIG_HAVE_CMPXCHG_LOCAL=y -CONFIG_HAVE_CMPXCHG_DOUBLE=y -CONFIG_HAVE_ARCH_SECCOMP=y -CONFIG_HAVE_ARCH_SECCOMP_FILTER=y -CONFIG_SECCOMP=y -CONFIG_SECCOMP_FILTER=y -# CONFIG_SECCOMP_CACHE_DEBUG is not set -CONFIG_HAVE_ARCH_STACKLEAK=y -CONFIG_HAVE_STACKPROTECTOR=y -CONFIG_STACKPROTECTOR=y -CONFIG_STACKPROTECTOR_STRONG=y -CONFIG_ARCH_SUPPORTS_LTO_CLANG=y -CONFIG_ARCH_SUPPORTS_LTO_CLANG_THIN=y -CONFIG_LTO_NONE=y -CONFIG_ARCH_SUPPORTS_CFI_CLANG=y -CONFIG_HAVE_ARCH_WITHIN_STACK_FRAMES=y -CONFIG_HAVE_CONTEXT_TRACKING_USER=y -CONFIG_HAVE_CONTEXT_TRACKING_USER_OFFSTACK=y -CONFIG_HAVE_VIRT_CPU_ACCOUNTING_GEN=y -CONFIG_HAVE_IRQ_TIME_ACCOUNTING=y -CONFIG_HAVE_MOVE_PUD=y -CONFIG_HAVE_MOVE_PMD=y -CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE=y -CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD=y -CONFIG_HAVE_ARCH_HUGE_VMAP=y -CONFIG_HAVE_ARCH_HUGE_VMALLOC=y -CONFIG_ARCH_WANT_HUGE_PMD_SHARE=y -CONFIG_HAVE_ARCH_SOFT_DIRTY=y -CONFIG_HAVE_MOD_ARCH_SPECIFIC=y -CONFIG_MODULES_USE_ELF_RELA=y -CONFIG_HAVE_IRQ_EXIT_ON_IRQ_STACK=y -CONFIG_HAVE_SOFTIRQ_ON_OWN_STACK=y -CONFIG_SOFTIRQ_ON_OWN_STACK=y -CONFIG_ARCH_HAS_ELF_RANDOMIZE=y -CONFIG_HAVE_ARCH_MMAP_RND_BITS=y -CONFIG_HAVE_EXIT_THREAD=y -CONFIG_ARCH_MMAP_RND_BITS=28 -CONFIG_PAGE_SIZE_LESS_THAN_64KB=y -CONFIG_PAGE_SIZE_LESS_THAN_256KB=y -CONFIG_HAVE_OBJTOOL=y -CONFIG_HAVE_JUMP_LABEL_HACK=y -CONFIG_HAVE_NOINSTR_HACK=y -CONFIG_HAVE_NOINSTR_VALIDATION=y -CONFIG_HAVE_UACCESS_VALIDATION=y -CONFIG_HAVE_STACK_VALIDATION=y -CONFIG_HAVE_RELIABLE_STACKTRACE=y -# CONFIG_COMPAT_32BIT_TIME is not set -CONFIG_HAVE_ARCH_VMAP_STACK=y -CONFIG_VMAP_STACK=y -CONFIG_HAVE_ARCH_RANDOMIZE_KSTACK_OFFSET=y -CONFIG_RANDOMIZE_KSTACK_OFFSET=y -# CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT is not set -CONFIG_ARCH_HAS_STRICT_KERNEL_RWX=y -CONFIG_STRICT_KERNEL_RWX=y -CONFIG_ARCH_HAS_STRICT_MODULE_RWX=y -CONFIG_STRICT_MODULE_RWX=y -CONFIG_HAVE_ARCH_PREL32_RELOCATIONS=y -CONFIG_ARCH_USE_MEMREMAP_PROT=y -CONFIG_ARCH_HAS_MEM_ENCRYPT=y -CONFIG_ARCH_HAS_CC_PLATFORM=y -CONFIG_HAVE_STATIC_CALL=y -CONFIG_HAVE_STATIC_CALL_INLINE=y -CONFIG_HAVE_PREEMPT_DYNAMIC=y -CONFIG_HAVE_PREEMPT_DYNAMIC_CALL=y -CONFIG_ARCH_WANT_LD_ORPHAN_WARN=y -CONFIG_ARCH_SUPPORTS_DEBUG_PAGEALLOC=y -CONFIG_ARCH_SUPPORTS_PAGE_TABLE_CHECK=y -CONFIG_ARCH_HAS_ELFCORE_COMPAT=y -CONFIG_ARCH_HAS_PARANOID_L1D_FLUSH=y -CONFIG_DYNAMIC_SIGFRAME=y -CONFIG_HAVE_ARCH_NODE_DEV_GROUP=y -CONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG=y - -# -# GCOV-based kernel profiling -# -CONFIG_ARCH_HAS_GCOV_PROFILE_ALL=y -# end of GCOV-based kernel profiling - -CONFIG_HAVE_GCC_PLUGINS=y -CONFIG_GCC_PLUGINS=y -# CONFIG_GCC_PLUGIN_LATENT_ENTROPY is not set -# end of General architecture-dependent options - -CONFIG_RT_MUTEXES=y -CONFIG_BASE_SMALL=0 -CONFIG_MODULES=y -# CONFIG_MODULE_FORCE_LOAD is not set -# CONFIG_MODULE_UNLOAD is not set -# CONFIG_MODVERSIONS is not set -# CONFIG_MODULE_SRCVERSION_ALL is not set -# CONFIG_MODULE_SIG is not set -CONFIG_MODULE_COMPRESS_NONE=y -# CONFIG_MODULE_COMPRESS_GZIP is not set -# CONFIG_MODULE_COMPRESS_XZ is not set -# CONFIG_MODULE_COMPRESS_ZSTD is not set -# CONFIG_MODULE_ALLOW_MISSING_NAMESPACE_IMPORTS is not set -CONFIG_MODPROBE_PATH="/sbin/modprobe" -CONFIG_MODULES_TREE_LOOKUP=y -CONFIG_BLOCK=y -CONFIG_BLOCK_LEGACY_AUTOLOAD=y -CONFIG_BLK_CGROUP_RWSTAT=y -CONFIG_BLK_DEV_BSG_COMMON=y -CONFIG_BLK_DEV_BSGLIB=y -CONFIG_BLK_DEV_INTEGRITY=y -CONFIG_BLK_DEV_INTEGRITY_T10=y -# CONFIG_BLK_DEV_ZONED is not set -CONFIG_BLK_DEV_THROTTLING=y -# CONFIG_BLK_DEV_THROTTLING_LOW is not set -# CONFIG_BLK_WBT is not set -# CONFIG_BLK_CGROUP_IOLATENCY is not set -# CONFIG_BLK_CGROUP_IOCOST is not set -# CONFIG_BLK_CGROUP_IOPRIO is not set -# CONFIG_BLK_SED_OPAL is not set -# CONFIG_BLK_INLINE_ENCRYPTION is not set - -# -# Partition Types -# -# CONFIG_PARTITION_ADVANCED is not set -CONFIG_MSDOS_PARTITION=y -CONFIG_EFI_PARTITION=y -# end of Partition Types - -CONFIG_BLK_MQ_PCI=y -CONFIG_BLK_MQ_VIRTIO=y -CONFIG_BLOCK_HOLDER_DEPRECATED=y -CONFIG_BLK_MQ_STACKING=y - -# -# IO Schedulers -# -# CONFIG_MQ_IOSCHED_DEADLINE is not set -# CONFIG_MQ_IOSCHED_KYBER is not set -# CONFIG_IOSCHED_BFQ is not set -# end of IO Schedulers - -CONFIG_ASN1=y -CONFIG_INLINE_SPIN_UNLOCK_IRQ=y -CONFIG_INLINE_READ_UNLOCK=y -CONFIG_INLINE_READ_UNLOCK_IRQ=y -CONFIG_INLINE_WRITE_UNLOCK=y -CONFIG_INLINE_WRITE_UNLOCK_IRQ=y -CONFIG_ARCH_SUPPORTS_ATOMIC_RMW=y -CONFIG_MUTEX_SPIN_ON_OWNER=y -CONFIG_RWSEM_SPIN_ON_OWNER=y -CONFIG_LOCK_SPIN_ON_OWNER=y -CONFIG_ARCH_USE_QUEUED_SPINLOCKS=y -CONFIG_QUEUED_SPINLOCKS=y -CONFIG_ARCH_USE_QUEUED_RWLOCKS=y -CONFIG_QUEUED_RWLOCKS=y -CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE=y -CONFIG_ARCH_HAS_SYNC_CORE_BEFORE_USERMODE=y -CONFIG_ARCH_HAS_SYSCALL_WRAPPER=y -CONFIG_FREEZER=y - -# -# Executable file formats -# -CONFIG_BINFMT_ELF=y -CONFIG_ELFCORE=y -CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS=y -CONFIG_BINFMT_SCRIPT=y -CONFIG_BINFMT_MISC=y -CONFIG_COREDUMP=y -# end of Executable file formats - -# -# Memory Management options -# -CONFIG_SWAP=y -# CONFIG_ZSWAP is not set - -# -# SLAB allocator options -# -# CONFIG_SLAB is not set -CONFIG_SLUB=y -# CONFIG_SLAB_MERGE_DEFAULT is not set -# CONFIG_SLAB_FREELIST_RANDOM is not set -# CONFIG_SLAB_FREELIST_HARDENED is not set -# CONFIG_SLUB_STATS is not set -CONFIG_SLUB_CPU_PARTIAL=y -# end of SLAB allocator options - -# CONFIG_SHUFFLE_PAGE_ALLOCATOR is not set -# CONFIG_COMPAT_BRK is not set -CONFIG_SPARSEMEM=y -CONFIG_SPARSEMEM_EXTREME=y -CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y -CONFIG_SPARSEMEM_VMEMMAP=y -CONFIG_HAVE_FAST_GUP=y -CONFIG_NUMA_KEEP_MEMINFO=y -CONFIG_MEMORY_ISOLATION=y -CONFIG_EXCLUSIVE_SYSTEM_RAM=y -CONFIG_HAVE_BOOTMEM_INFO_NODE=y -CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y -CONFIG_ARCH_ENABLE_MEMORY_HOTREMOVE=y -CONFIG_MEMORY_HOTPLUG=y -CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE=y -CONFIG_MEMORY_HOTREMOVE=y -CONFIG_MHP_MEMMAP_ON_MEMORY=y -CONFIG_SPLIT_PTLOCK_CPUS=4 -CONFIG_ARCH_ENABLE_SPLIT_PMD_PTLOCK=y -CONFIG_MEMORY_BALLOON=y -CONFIG_BALLOON_COMPACTION=y -CONFIG_COMPACTION=y -CONFIG_COMPACT_UNEVICTABLE_DEFAULT=1 -CONFIG_PAGE_REPORTING=y -CONFIG_MIGRATION=y -CONFIG_DEVICE_MIGRATION=y -CONFIG_ARCH_ENABLE_HUGEPAGE_MIGRATION=y -CONFIG_ARCH_ENABLE_THP_MIGRATION=y -CONFIG_CONTIG_ALLOC=y -CONFIG_PHYS_ADDR_T_64BIT=y -CONFIG_MMU_NOTIFIER=y -CONFIG_KSM=y -CONFIG_DEFAULT_MMAP_MIN_ADDR=4096 -CONFIG_ARCH_WANT_GENERAL_HUGETLB=y -CONFIG_ARCH_WANTS_THP_SWAP=y -CONFIG_TRANSPARENT_HUGEPAGE=y -# CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS is not set -CONFIG_TRANSPARENT_HUGEPAGE_MADVISE=y -CONFIG_THP_SWAP=y -# CONFIG_READ_ONLY_THP_FOR_FS is not set -CONFIG_NEED_PER_CPU_EMBED_FIRST_CHUNK=y -CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK=y -CONFIG_USE_PERCPU_NUMA_NODE_ID=y -CONFIG_HAVE_SETUP_PER_CPU_AREA=y -# CONFIG_CMA is not set -CONFIG_GENERIC_EARLY_IOREMAP=y -# CONFIG_DEFERRED_STRUCT_PAGE_INIT is not set -# CONFIG_IDLE_PAGE_TRACKING is not set -CONFIG_ARCH_HAS_CACHE_LINE_SIZE=y -CONFIG_ARCH_HAS_CURRENT_STACK_POINTER=y -CONFIG_ARCH_HAS_PTE_DEVMAP=y -CONFIG_ZONE_DMA=y -CONFIG_ZONE_DMA32=y -CONFIG_ZONE_DEVICE=y -# CONFIG_DEVICE_PRIVATE is not set -CONFIG_VMAP_PFN=y -CONFIG_VM_EVENT_COUNTERS=y -# CONFIG_PERCPU_STATS is not set - -# -# GUP_TEST needs to have DEBUG_FS enabled -# -CONFIG_ARCH_HAS_PTE_SPECIAL=y -CONFIG_SECRETMEM=y -# CONFIG_ANON_VMA_NAME is not set -# CONFIG_USERFAULTFD is not set -# CONFIG_LRU_GEN is not set - -# -# Data Access Monitoring -# -# CONFIG_DAMON is not set -# end of Data Access Monitoring -# end of Memory Management options - -CONFIG_NET=y -CONFIG_NET_INGRESS=y -CONFIG_NET_EGRESS=y -CONFIG_SKB_EXTENSIONS=y - -# -# Networking options -# -CONFIG_PACKET=y -CONFIG_PACKET_DIAG=y -CONFIG_UNIX=y -CONFIG_UNIX_SCM=y -CONFIG_AF_UNIX_OOB=y -# CONFIG_UNIX_DIAG is not set -# CONFIG_TLS is not set -CONFIG_XFRM=y -CONFIG_XFRM_ALGO=y -CONFIG_XFRM_USER=y -# CONFIG_XFRM_INTERFACE is not set -CONFIG_XFRM_SUB_POLICY=y -# CONFIG_XFRM_MIGRATE is not set -# CONFIG_XFRM_STATISTICS is not set -# CONFIG_NET_KEY is not set -# CONFIG_XDP_SOCKETS is not set -CONFIG_INET=y -CONFIG_IP_MULTICAST=y -# CONFIG_IP_ADVANCED_ROUTER is not set -CONFIG_IP_ROUTE_CLASSID=y -CONFIG_IP_PNP=y -CONFIG_IP_PNP_DHCP=y -# CONFIG_IP_PNP_BOOTP is not set -# CONFIG_IP_PNP_RARP is not set -# CONFIG_NET_IPIP is not set -# CONFIG_NET_IPGRE_DEMUX is not set -# CONFIG_IP_MROUTE is not set -CONFIG_SYN_COOKIES=y -# CONFIG_NET_IPVTI is not set -# CONFIG_NET_FOU is not set -# CONFIG_INET_AH is not set -# CONFIG_INET_ESP is not set -# CONFIG_INET_IPCOMP is not set -# CONFIG_INET_DIAG is not set -CONFIG_TCP_CONG_ADVANCED=y -# CONFIG_TCP_CONG_BIC is not set -# CONFIG_TCP_CONG_CUBIC is not set -# CONFIG_TCP_CONG_WESTWOOD is not set -# CONFIG_TCP_CONG_HTCP is not set -# CONFIG_TCP_CONG_HSTCP is not set -# CONFIG_TCP_CONG_HYBLA is not set -# CONFIG_TCP_CONG_VEGAS is not set -# CONFIG_TCP_CONG_NV is not set -# CONFIG_TCP_CONG_SCALABLE is not set -# CONFIG_TCP_CONG_LP is not set -# CONFIG_TCP_CONG_VENO is not set -# CONFIG_TCP_CONG_YEAH is not set -# CONFIG_TCP_CONG_ILLINOIS is not set -# CONFIG_TCP_CONG_DCTCP is not set -# CONFIG_TCP_CONG_CDG is not set -CONFIG_TCP_CONG_BBR=y -CONFIG_DEFAULT_BBR=y -# CONFIG_DEFAULT_RENO is not set -CONFIG_DEFAULT_TCP_CONG="bbr" -CONFIG_TCP_MD5SIG=y -CONFIG_IPV6=y -# CONFIG_IPV6_ROUTER_PREF is not set -# CONFIG_IPV6_OPTIMISTIC_DAD is not set -# CONFIG_INET6_AH is not set -# CONFIG_INET6_ESP is not set -# CONFIG_INET6_IPCOMP is not set -# CONFIG_IPV6_MIP6 is not set -# CONFIG_IPV6_ILA is not set -# CONFIG_IPV6_VTI is not set -# CONFIG_IPV6_SIT is not set -# CONFIG_IPV6_TUNNEL is not set -CONFIG_IPV6_MULTIPLE_TABLES=y -# CONFIG_IPV6_SUBTREES is not set -# CONFIG_IPV6_MROUTE is not set -# CONFIG_IPV6_SEG6_LWTUNNEL is not set -# CONFIG_IPV6_SEG6_HMAC is not set -# CONFIG_IPV6_RPL_LWTUNNEL is not set -# CONFIG_IPV6_IOAM6_LWTUNNEL is not set -# CONFIG_NETLABEL is not set -# CONFIG_MPTCP is not set -# CONFIG_NETWORK_SECMARK is not set -CONFIG_NET_PTP_CLASSIFY=y -# CONFIG_NETWORK_PHY_TIMESTAMPING is not set -CONFIG_NETFILTER=y -CONFIG_NETFILTER_ADVANCED=y -# CONFIG_BRIDGE_NETFILTER is not set - -# -# Core Netfilter Configuration -# -CONFIG_NETFILTER_INGRESS=y -CONFIG_NETFILTER_EGRESS=y -CONFIG_NETFILTER_NETLINK=y -CONFIG_NETFILTER_FAMILY_ARP=y -CONFIG_NETFILTER_NETLINK_ACCT=y -CONFIG_NETFILTER_NETLINK_QUEUE=y -CONFIG_NETFILTER_NETLINK_LOG=y -CONFIG_NETFILTER_NETLINK_OSF=y -CONFIG_NF_CONNTRACK=y -CONFIG_NF_LOG_SYSLOG=y -CONFIG_NETFILTER_CONNCOUNT=y -CONFIG_NF_CONNTRACK_MARK=y -CONFIG_NF_CONNTRACK_ZONES=y -# CONFIG_NF_CONNTRACK_PROCFS is not set -CONFIG_NF_CONNTRACK_EVENTS=y -CONFIG_NF_CONNTRACK_TIMEOUT=y -CONFIG_NF_CONNTRACK_TIMESTAMP=y -CONFIG_NF_CONNTRACK_LABELS=y -CONFIG_NF_CT_PROTO_DCCP=y -CONFIG_NF_CT_PROTO_GRE=y -CONFIG_NF_CT_PROTO_SCTP=y -CONFIG_NF_CT_PROTO_UDPLITE=y -CONFIG_NF_CONNTRACK_AMANDA=y -CONFIG_NF_CONNTRACK_FTP=y -CONFIG_NF_CONNTRACK_H323=y -CONFIG_NF_CONNTRACK_IRC=y -CONFIG_NF_CONNTRACK_BROADCAST=y -CONFIG_NF_CONNTRACK_NETBIOS_NS=y -CONFIG_NF_CONNTRACK_SNMP=y -CONFIG_NF_CONNTRACK_PPTP=y -CONFIG_NF_CONNTRACK_SANE=y -CONFIG_NF_CONNTRACK_SIP=y -CONFIG_NF_CONNTRACK_TFTP=y -CONFIG_NF_CT_NETLINK=y -CONFIG_NF_CT_NETLINK_TIMEOUT=y -CONFIG_NF_CT_NETLINK_HELPER=y -CONFIG_NETFILTER_NETLINK_GLUE_CT=y -CONFIG_NF_NAT=y -CONFIG_NF_NAT_AMANDA=y -CONFIG_NF_NAT_FTP=y -CONFIG_NF_NAT_IRC=y -CONFIG_NF_NAT_SIP=y -CONFIG_NF_NAT_TFTP=y -CONFIG_NF_NAT_REDIRECT=y -CONFIG_NF_NAT_MASQUERADE=y -CONFIG_NETFILTER_SYNPROXY=y -# CONFIG_NF_TABLES is not set -CONFIG_NETFILTER_XTABLES=y - -# -# Xtables combined modules -# -CONFIG_NETFILTER_XT_MARK=y -CONFIG_NETFILTER_XT_CONNMARK=y -CONFIG_NETFILTER_XT_SET=y - -# -# Xtables targets -# -CONFIG_NETFILTER_XT_TARGET_CHECKSUM=y -CONFIG_NETFILTER_XT_TARGET_CLASSIFY=y -CONFIG_NETFILTER_XT_TARGET_CONNMARK=y -CONFIG_NETFILTER_XT_TARGET_CT=y -CONFIG_NETFILTER_XT_TARGET_DSCP=y -CONFIG_NETFILTER_XT_TARGET_HL=y -CONFIG_NETFILTER_XT_TARGET_HMARK=y -CONFIG_NETFILTER_XT_TARGET_IDLETIMER=y -CONFIG_NETFILTER_XT_TARGET_LOG=y -CONFIG_NETFILTER_XT_TARGET_MARK=y -CONFIG_NETFILTER_XT_NAT=y -CONFIG_NETFILTER_XT_TARGET_NETMAP=y -CONFIG_NETFILTER_XT_TARGET_NFLOG=y -CONFIG_NETFILTER_XT_TARGET_NFQUEUE=y -# CONFIG_NETFILTER_XT_TARGET_NOTRACK is not set -CONFIG_NETFILTER_XT_TARGET_RATEEST=y -CONFIG_NETFILTER_XT_TARGET_REDIRECT=y -CONFIG_NETFILTER_XT_TARGET_MASQUERADE=y -CONFIG_NETFILTER_XT_TARGET_TEE=y -CONFIG_NETFILTER_XT_TARGET_TPROXY=y -CONFIG_NETFILTER_XT_TARGET_TRACE=y -CONFIG_NETFILTER_XT_TARGET_TCPMSS=y -CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=y - -# -# Xtables matches -# -CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=y -CONFIG_NETFILTER_XT_MATCH_BPF=y -CONFIG_NETFILTER_XT_MATCH_CGROUP=y -CONFIG_NETFILTER_XT_MATCH_CLUSTER=y -CONFIG_NETFILTER_XT_MATCH_COMMENT=y -CONFIG_NETFILTER_XT_MATCH_CONNBYTES=y -CONFIG_NETFILTER_XT_MATCH_CONNLABEL=y -CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=y -CONFIG_NETFILTER_XT_MATCH_CONNMARK=y -CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y -CONFIG_NETFILTER_XT_MATCH_CPU=y -CONFIG_NETFILTER_XT_MATCH_DCCP=y -CONFIG_NETFILTER_XT_MATCH_DEVGROUP=y -CONFIG_NETFILTER_XT_MATCH_DSCP=y -CONFIG_NETFILTER_XT_MATCH_ECN=y -CONFIG_NETFILTER_XT_MATCH_ESP=y -CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=y -CONFIG_NETFILTER_XT_MATCH_HELPER=y -CONFIG_NETFILTER_XT_MATCH_HL=y -CONFIG_NETFILTER_XT_MATCH_IPCOMP=y -CONFIG_NETFILTER_XT_MATCH_IPRANGE=y -CONFIG_NETFILTER_XT_MATCH_IPVS=y -CONFIG_NETFILTER_XT_MATCH_L2TP=y -CONFIG_NETFILTER_XT_MATCH_LENGTH=y -CONFIG_NETFILTER_XT_MATCH_LIMIT=y -CONFIG_NETFILTER_XT_MATCH_MAC=y -CONFIG_NETFILTER_XT_MATCH_MARK=y -CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y -CONFIG_NETFILTER_XT_MATCH_NFACCT=y -CONFIG_NETFILTER_XT_MATCH_OSF=y -CONFIG_NETFILTER_XT_MATCH_OWNER=y -CONFIG_NETFILTER_XT_MATCH_POLICY=y -CONFIG_NETFILTER_XT_MATCH_PKTTYPE=y -CONFIG_NETFILTER_XT_MATCH_QUOTA=y -CONFIG_NETFILTER_XT_MATCH_RATEEST=y -CONFIG_NETFILTER_XT_MATCH_REALM=y -CONFIG_NETFILTER_XT_MATCH_RECENT=y -CONFIG_NETFILTER_XT_MATCH_SCTP=y -# CONFIG_NETFILTER_XT_MATCH_SOCKET is not set -CONFIG_NETFILTER_XT_MATCH_STATE=y -CONFIG_NETFILTER_XT_MATCH_STATISTIC=y -CONFIG_NETFILTER_XT_MATCH_STRING=y -CONFIG_NETFILTER_XT_MATCH_TCPMSS=y -CONFIG_NETFILTER_XT_MATCH_TIME=y -CONFIG_NETFILTER_XT_MATCH_U32=y -# end of Core Netfilter Configuration - -CONFIG_IP_SET=y -CONFIG_IP_SET_MAX=256 -CONFIG_IP_SET_BITMAP_IP=y -CONFIG_IP_SET_BITMAP_IPMAC=y -CONFIG_IP_SET_BITMAP_PORT=y -CONFIG_IP_SET_HASH_IP=y -CONFIG_IP_SET_HASH_IPMARK=y -CONFIG_IP_SET_HASH_IPPORT=y -CONFIG_IP_SET_HASH_IPPORTIP=y -CONFIG_IP_SET_HASH_IPPORTNET=y -# CONFIG_IP_SET_HASH_IPMAC is not set -CONFIG_IP_SET_HASH_MAC=y -CONFIG_IP_SET_HASH_NETPORTNET=y -CONFIG_IP_SET_HASH_NET=y -CONFIG_IP_SET_HASH_NETNET=y -CONFIG_IP_SET_HASH_NETPORT=y -CONFIG_IP_SET_HASH_NETIFACE=y -CONFIG_IP_SET_LIST_SET=y -CONFIG_IP_VS=y -# CONFIG_IP_VS_IPV6 is not set -# CONFIG_IP_VS_DEBUG is not set -CONFIG_IP_VS_TAB_BITS=12 - -# -# IPVS transport protocol load balancing support -# -CONFIG_IP_VS_PROTO_TCP=y -CONFIG_IP_VS_PROTO_UDP=y -CONFIG_IP_VS_PROTO_AH_ESP=y -CONFIG_IP_VS_PROTO_ESP=y -CONFIG_IP_VS_PROTO_AH=y -CONFIG_IP_VS_PROTO_SCTP=y - -# -# IPVS scheduler -# -CONFIG_IP_VS_RR=y -CONFIG_IP_VS_WRR=y -CONFIG_IP_VS_LC=y -CONFIG_IP_VS_WLC=y -CONFIG_IP_VS_FO=y -CONFIG_IP_VS_OVF=y -CONFIG_IP_VS_LBLC=y -CONFIG_IP_VS_LBLCR=y -CONFIG_IP_VS_DH=y -CONFIG_IP_VS_SH=y -# CONFIG_IP_VS_MH is not set -CONFIG_IP_VS_SED=y -CONFIG_IP_VS_NQ=y -# CONFIG_IP_VS_TWOS is not set - -# -# IPVS SH scheduler -# -CONFIG_IP_VS_SH_TAB_BITS=8 - -# -# IPVS MH scheduler -# -CONFIG_IP_VS_MH_TAB_INDEX=12 - -# -# IPVS application helper -# -CONFIG_IP_VS_FTP=y -CONFIG_IP_VS_NFCT=y -CONFIG_IP_VS_PE_SIP=y - -# -# IP: Netfilter Configuration -# -CONFIG_NF_DEFRAG_IPV4=y -# CONFIG_NF_SOCKET_IPV4 is not set -CONFIG_NF_TPROXY_IPV4=y -CONFIG_NF_DUP_IPV4=y -# CONFIG_NF_LOG_ARP is not set -CONFIG_NF_LOG_IPV4=y -CONFIG_NF_REJECT_IPV4=y -CONFIG_NF_NAT_SNMP_BASIC=y -CONFIG_NF_NAT_PPTP=y -CONFIG_NF_NAT_H323=y -CONFIG_IP_NF_IPTABLES=y -CONFIG_IP_NF_MATCH_AH=y -CONFIG_IP_NF_MATCH_ECN=y -CONFIG_IP_NF_MATCH_RPFILTER=y -CONFIG_IP_NF_MATCH_TTL=y -CONFIG_IP_NF_FILTER=y -CONFIG_IP_NF_TARGET_REJECT=y -CONFIG_IP_NF_TARGET_SYNPROXY=y -CONFIG_IP_NF_NAT=y -CONFIG_IP_NF_TARGET_MASQUERADE=y -CONFIG_IP_NF_TARGET_NETMAP=y -CONFIG_IP_NF_TARGET_REDIRECT=y -CONFIG_IP_NF_MANGLE=y -CONFIG_IP_NF_TARGET_CLUSTERIP=y -CONFIG_IP_NF_TARGET_ECN=y -CONFIG_IP_NF_TARGET_TTL=y -CONFIG_IP_NF_RAW=y -CONFIG_IP_NF_SECURITY=y -CONFIG_IP_NF_ARPTABLES=y -CONFIG_IP_NF_ARPFILTER=y -CONFIG_IP_NF_ARP_MANGLE=y -# end of IP: Netfilter Configuration - -# -# IPv6: Netfilter Configuration -# -# CONFIG_NF_SOCKET_IPV6 is not set -# CONFIG_NF_TPROXY_IPV6 is not set -CONFIG_NF_DUP_IPV6=y -# CONFIG_NF_REJECT_IPV6 is not set -CONFIG_NF_LOG_IPV6=y -# CONFIG_IP6_NF_IPTABLES is not set -# end of IPv6: Netfilter Configuration - -CONFIG_NF_DEFRAG_IPV6=y -# CONFIG_NF_CONNTRACK_BRIDGE is not set -# CONFIG_BRIDGE_NF_EBTABLES is not set -# CONFIG_BPFILTER is not set -# CONFIG_IP_DCCP is not set -# CONFIG_IP_SCTP is not set -# CONFIG_RDS is not set -# CONFIG_TIPC is not set -# CONFIG_ATM is not set -# CONFIG_L2TP is not set -CONFIG_STP=y -CONFIG_BRIDGE=y -CONFIG_BRIDGE_IGMP_SNOOPING=y -# CONFIG_BRIDGE_MRP is not set -# CONFIG_BRIDGE_CFM is not set -# CONFIG_NET_DSA is not set -# CONFIG_VLAN_8021Q is not set -CONFIG_LLC=y -# CONFIG_LLC2 is not set -# CONFIG_ATALK is not set -# CONFIG_X25 is not set -# CONFIG_LAPB is not set -# CONFIG_PHONET is not set -# CONFIG_6LOWPAN is not set -# CONFIG_IEEE802154 is not set -CONFIG_NET_SCHED=y - -# -# Queueing/Scheduling -# -CONFIG_NET_SCH_CBQ=y -# CONFIG_NET_SCH_HTB is not set -# CONFIG_NET_SCH_HFSC is not set -# CONFIG_NET_SCH_PRIO is not set -CONFIG_NET_SCH_MULTIQ=y -# CONFIG_NET_SCH_RED is not set -# CONFIG_NET_SCH_SFB is not set -# CONFIG_NET_SCH_SFQ is not set -# CONFIG_NET_SCH_TEQL is not set -# CONFIG_NET_SCH_TBF is not set -# CONFIG_NET_SCH_CBS is not set -# CONFIG_NET_SCH_ETF is not set -# CONFIG_NET_SCH_TAPRIO is not set -# CONFIG_NET_SCH_GRED is not set -# CONFIG_NET_SCH_DSMARK is not set -# CONFIG_NET_SCH_NETEM is not set -# CONFIG_NET_SCH_DRR is not set -# CONFIG_NET_SCH_MQPRIO is not set -# CONFIG_NET_SCH_SKBPRIO is not set -# CONFIG_NET_SCH_CHOKE is not set -# CONFIG_NET_SCH_QFQ is not set -# CONFIG_NET_SCH_CODEL is not set -CONFIG_NET_SCH_FQ_CODEL=y -# CONFIG_NET_SCH_CAKE is not set -CONFIG_NET_SCH_FQ=y -# CONFIG_NET_SCH_HHF is not set -# CONFIG_NET_SCH_PIE is not set -# CONFIG_NET_SCH_PLUG is not set -# CONFIG_NET_SCH_ETS is not set -# CONFIG_NET_SCH_DEFAULT is not set - -# -# Classification -# -CONFIG_NET_CLS=y -# CONFIG_NET_CLS_BASIC is not set -# CONFIG_NET_CLS_TCINDEX is not set -# CONFIG_NET_CLS_ROUTE4 is not set -# CONFIG_NET_CLS_FW is not set -# CONFIG_NET_CLS_U32 is not set -# CONFIG_NET_CLS_RSVP is not set -# CONFIG_NET_CLS_RSVP6 is not set -# CONFIG_NET_CLS_FLOW is not set -CONFIG_NET_CLS_CGROUP=y -# CONFIG_NET_CLS_BPF is not set -# CONFIG_NET_CLS_FLOWER is not set -# CONFIG_NET_CLS_MATCHALL is not set -CONFIG_NET_EMATCH=y -CONFIG_NET_EMATCH_STACK=32 -# CONFIG_NET_EMATCH_CMP is not set -# CONFIG_NET_EMATCH_NBYTE is not set -# CONFIG_NET_EMATCH_U32 is not set -# CONFIG_NET_EMATCH_META is not set -# CONFIG_NET_EMATCH_TEXT is not set -# CONFIG_NET_EMATCH_IPSET is not set -# CONFIG_NET_EMATCH_IPT is not set -# CONFIG_NET_CLS_ACT is not set -CONFIG_NET_SCH_FIFO=y -# CONFIG_DCB is not set -# CONFIG_BATMAN_ADV is not set -# CONFIG_OPENVSWITCH is not set -CONFIG_VSOCKETS=y -# CONFIG_VSOCKETS_DIAG is not set -# CONFIG_VSOCKETS_LOOPBACK is not set -CONFIG_VIRTIO_VSOCKETS=y -CONFIG_VIRTIO_VSOCKETS_COMMON=y -# CONFIG_HYPERV_VSOCKETS is not set -# CONFIG_NETLINK_DIAG is not set -# CONFIG_MPLS is not set -# CONFIG_NET_NSH is not set -# CONFIG_HSR is not set -CONFIG_NET_SWITCHDEV=y -# CONFIG_NET_L3_MASTER_DEV is not set -# CONFIG_QRTR is not set -# CONFIG_NET_NCSI is not set -# CONFIG_PCPU_DEV_REFCNT is not set -CONFIG_RPS=y -CONFIG_RFS_ACCEL=y -CONFIG_SOCK_RX_QUEUE_MAPPING=y -CONFIG_XPS=y -CONFIG_CGROUP_NET_PRIO=y -CONFIG_CGROUP_NET_CLASSID=y -CONFIG_NET_RX_BUSY_POLL=y -CONFIG_BQL=y -# CONFIG_BPF_STREAM_PARSER is not set -CONFIG_NET_FLOW_LIMIT=y - -# -# Network testing -# -# CONFIG_NET_PKTGEN is not set -# end of Network testing -# end of Networking options - -# CONFIG_HAMRADIO is not set -# CONFIG_CAN is not set -# CONFIG_BT is not set -# CONFIG_AF_RXRPC is not set -# CONFIG_AF_KCM is not set -# CONFIG_MCTP is not set -CONFIG_FIB_RULES=y -# CONFIG_WIRELESS is not set -# CONFIG_RFKILL is not set -CONFIG_NET_9P=y -CONFIG_NET_9P_FD=y -CONFIG_NET_9P_VIRTIO=y -# CONFIG_NET_9P_DEBUG is not set -# CONFIG_CAIF is not set -# CONFIG_CEPH_LIB is not set -# CONFIG_NFC is not set -# CONFIG_PSAMPLE is not set -# CONFIG_NET_IFE is not set -# CONFIG_LWTUNNEL is not set -CONFIG_GRO_CELLS=y -CONFIG_NET_SOCK_MSG=y -CONFIG_PAGE_POOL=y -# CONFIG_PAGE_POOL_STATS is not set -CONFIG_FAILOVER=y -# CONFIG_ETHTOOL_NETLINK is not set - -# -# Device Drivers -# -CONFIG_HAVE_EISA=y -# CONFIG_EISA is not set -CONFIG_HAVE_PCI=y -CONFIG_PCI=y -CONFIG_PCI_DOMAINS=y -CONFIG_PCIEPORTBUS=y -CONFIG_HOTPLUG_PCI_PCIE=y -# CONFIG_PCIEAER is not set -CONFIG_PCIEASPM=y -CONFIG_PCIEASPM_DEFAULT=y -# CONFIG_PCIEASPM_POWERSAVE is not set -# CONFIG_PCIEASPM_POWER_SUPERSAVE is not set -# CONFIG_PCIEASPM_PERFORMANCE is not set -# CONFIG_PCIE_PTM is not set -CONFIG_PCI_MSI=y -CONFIG_PCI_MSI_IRQ_DOMAIN=y -CONFIG_PCI_QUIRKS=y -# CONFIG_PCI_DEBUG is not set -# CONFIG_PCI_STUB is not set -CONFIG_PCI_ATS=y -CONFIG_PCI_LOCKLESS_CONFIG=y -# CONFIG_PCI_IOV is not set -CONFIG_PCI_PRI=y -CONFIG_PCI_PASID=y -# CONFIG_PCI_P2PDMA is not set -CONFIG_PCI_LABEL=y -# CONFIG_PCI_HYPERV is not set -CONFIG_VGA_ARB=y -CONFIG_VGA_ARB_MAX_GPUS=16 -CONFIG_HOTPLUG_PCI=y -CONFIG_HOTPLUG_PCI_ACPI=y -# CONFIG_HOTPLUG_PCI_ACPI_IBM is not set -# CONFIG_HOTPLUG_PCI_CPCI is not set -CONFIG_HOTPLUG_PCI_SHPC=y - -# -# PCI controller drivers -# -# CONFIG_VMD is not set -# CONFIG_PCI_HYPERV_INTERFACE is not set - -# -# DesignWare PCI Core Support -# -# CONFIG_PCIE_DW_PLAT_HOST is not set -# CONFIG_PCI_MESON is not set -# end of DesignWare PCI Core Support - -# -# Mobiveil PCIe Core Support -# -# end of Mobiveil PCIe Core Support - -# -# Cadence PCIe controllers support -# -# end of Cadence PCIe controllers support -# end of PCI controller drivers - -# -# PCI Endpoint -# -# CONFIG_PCI_ENDPOINT is not set -# end of PCI Endpoint - -# -# PCI switch controller drivers -# -# CONFIG_PCI_SW_SWITCHTEC is not set -# end of PCI switch controller drivers - -# CONFIG_CXL_BUS is not set -# CONFIG_PCCARD is not set -# CONFIG_RAPIDIO is not set - -# -# Generic Driver Options -# -# CONFIG_UEVENT_HELPER is not set -CONFIG_DEVTMPFS=y -CONFIG_DEVTMPFS_MOUNT=y -# CONFIG_DEVTMPFS_SAFE is not set -# CONFIG_STANDALONE is not set -# CONFIG_PREVENT_FIRMWARE_BUILD is not set - -# -# Firmware loader -# -CONFIG_FW_LOADER=y -CONFIG_EXTRA_FIRMWARE="" -# CONFIG_FW_LOADER_USER_HELPER is not set -# CONFIG_FW_LOADER_COMPRESS is not set -# CONFIG_FW_UPLOAD is not set -# end of Firmware loader - -CONFIG_ALLOW_DEV_COREDUMP=y -# CONFIG_DEBUG_DRIVER is not set -# CONFIG_DEBUG_DEVRES is not set -# CONFIG_DEBUG_TEST_DRIVER_REMOVE is not set -# CONFIG_TEST_ASYNC_DRIVER_PROBE is not set -CONFIG_GENERIC_CPU_AUTOPROBE=y -CONFIG_GENERIC_CPU_VULNERABILITIES=y -# end of Generic Driver Options - -# -# Bus devices -# -# CONFIG_MHI_BUS is not set -# CONFIG_MHI_BUS_EP is not set -# end of Bus devices - -# CONFIG_CONNECTOR is not set - -# -# Firmware Drivers -# - -# -# ARM System Control and Management Interface Protocol -# -# end of ARM System Control and Management Interface Protocol - -# CONFIG_EDD is not set -CONFIG_FIRMWARE_MEMMAP=y -CONFIG_DMIID=y -CONFIG_DMI_SYSFS=y -CONFIG_DMI_SCAN_MACHINE_NON_EFI_FALLBACK=y -# CONFIG_ISCSI_IBFT is not set -# CONFIG_FW_CFG_SYSFS is not set -# CONFIG_SYSFB_SIMPLEFB is not set -# CONFIG_GOOGLE_FIRMWARE is not set - -# -# Tegra firmware driver -# -# end of Tegra firmware driver -# end of Firmware Drivers - -# CONFIG_GNSS is not set -# CONFIG_MTD is not set -# CONFIG_OF is not set -CONFIG_ARCH_MIGHT_HAVE_PC_PARPORT=y -# CONFIG_PARPORT is not set -CONFIG_PNP=y -# CONFIG_PNP_DEBUG_MESSAGES is not set - -# -# Protocols -# -CONFIG_PNPACPI=y -CONFIG_BLK_DEV=y -# CONFIG_BLK_DEV_NULL_BLK is not set -# CONFIG_BLK_DEV_FD is not set -# CONFIG_BLK_DEV_PCIESSD_MTIP32XX is not set -CONFIG_BLK_DEV_LOOP=y -CONFIG_BLK_DEV_LOOP_MIN_COUNT=8 -# CONFIG_BLK_DEV_DRBD is not set -# CONFIG_BLK_DEV_NBD is not set -CONFIG_BLK_DEV_RAM=y -CONFIG_BLK_DEV_RAM_COUNT=16 -CONFIG_BLK_DEV_RAM_SIZE=16384 -# CONFIG_CDROM_PKTCDVD is not set -# CONFIG_ATA_OVER_ETH is not set -CONFIG_VIRTIO_BLK=y -# CONFIG_BLK_DEV_RBD is not set -# CONFIG_BLK_DEV_UBLK is not set - -# -# NVME Support -# -# CONFIG_BLK_DEV_NVME is not set -# CONFIG_NVME_FC is not set -# CONFIG_NVME_TCP is not set -# end of NVME Support - -# -# Misc devices -# -# CONFIG_DUMMY_IRQ is not set -# CONFIG_IBM_ASM is not set -# CONFIG_PHANTOM is not set -# CONFIG_TIFM_CORE is not set -# CONFIG_ENCLOSURE_SERVICES is not set -# CONFIG_HP_ILO is not set -# CONFIG_SRAM is not set -# CONFIG_DW_XDATA_PCIE is not set -# CONFIG_PCI_ENDPOINT_TEST is not set -# CONFIG_XILINX_SDFEC is not set -# CONFIG_C2PORT is not set - -# -# EEPROM support -# -# CONFIG_EEPROM_93CX6 is not set -# end of EEPROM support - -# CONFIG_CB710_CORE is not set - -# -# Texas Instruments shared transport line discipline -# -# end of Texas Instruments shared transport line discipline - -# -# Altera FPGA firmware download module (requires I2C) -# -# CONFIG_INTEL_MEI is not set -# CONFIG_INTEL_MEI_ME is not set -# CONFIG_INTEL_MEI_TXE is not set -# CONFIG_VMWARE_VMCI is not set -# CONFIG_GENWQE is not set -# CONFIG_ECHO is not set -# CONFIG_BCM_VK is not set -# CONFIG_MISC_ALCOR_PCI is not set -# CONFIG_MISC_RTSX_PCI is not set -# CONFIG_HABANA_AI is not set -# CONFIG_UACCE is not set -# CONFIG_PVPANIC is not set -# end of Misc devices - -# -# SCSI device support -# -CONFIG_SCSI_MOD=y -# CONFIG_RAID_ATTRS is not set -CONFIG_SCSI_COMMON=y -CONFIG_SCSI=y -CONFIG_SCSI_DMA=y -# CONFIG_SCSI_PROC_FS is not set - -# -# SCSI support type (disk, tape, CD-ROM) -# -CONFIG_BLK_DEV_SD=y -# CONFIG_CHR_DEV_ST is not set -# CONFIG_BLK_DEV_SR is not set -# CONFIG_CHR_DEV_SG is not set -CONFIG_BLK_DEV_BSG=y -# CONFIG_CHR_DEV_SCH is not set -# CONFIG_SCSI_CONSTANTS is not set -# CONFIG_SCSI_LOGGING is not set -# CONFIG_SCSI_SCAN_ASYNC is not set - -# -# SCSI Transports -# -# CONFIG_SCSI_SPI_ATTRS is not set -# CONFIG_SCSI_FC_ATTRS is not set -# CONFIG_SCSI_ISCSI_ATTRS is not set -# CONFIG_SCSI_SAS_ATTRS is not set -# CONFIG_SCSI_SAS_LIBSAS is not set -# CONFIG_SCSI_SRP_ATTRS is not set -# end of SCSI Transports - -CONFIG_SCSI_LOWLEVEL=y -# CONFIG_ISCSI_TCP is not set -# CONFIG_ISCSI_BOOT_SYSFS is not set -# CONFIG_SCSI_CXGB3_ISCSI is not set -# CONFIG_SCSI_CXGB4_ISCSI is not set -# CONFIG_SCSI_BNX2_ISCSI is not set -# CONFIG_BE2ISCSI is not set -# CONFIG_BLK_DEV_3W_XXXX_RAID is not set -# CONFIG_SCSI_HPSA is not set -# CONFIG_SCSI_3W_9XXX is not set -# CONFIG_SCSI_3W_SAS is not set -# CONFIG_SCSI_ACARD is not set -# CONFIG_SCSI_AACRAID is not set -# CONFIG_SCSI_AIC7XXX is not set -# CONFIG_SCSI_AIC79XX is not set -# CONFIG_SCSI_AIC94XX is not set -# CONFIG_SCSI_MVSAS is not set -# CONFIG_SCSI_MVUMI is not set -# CONFIG_SCSI_ADVANSYS is not set -# CONFIG_SCSI_ARCMSR is not set -# CONFIG_SCSI_ESAS2R is not set -# CONFIG_MEGARAID_NEWGEN is not set -# CONFIG_MEGARAID_LEGACY is not set -# CONFIG_MEGARAID_SAS is not set -# CONFIG_SCSI_MPT3SAS is not set -# CONFIG_SCSI_MPT2SAS is not set -# CONFIG_SCSI_MPI3MR is not set -# CONFIG_SCSI_SMARTPQI is not set -# CONFIG_SCSI_HPTIOP is not set -# CONFIG_SCSI_BUSLOGIC is not set -# CONFIG_SCSI_MYRB is not set -# CONFIG_SCSI_MYRS is not set -# CONFIG_VMWARE_PVSCSI is not set -# CONFIG_HYPERV_STORAGE is not set -# CONFIG_SCSI_SNIC is not set -# CONFIG_SCSI_DMX3191D is not set -# CONFIG_SCSI_FDOMAIN_PCI is not set -# CONFIG_SCSI_ISCI is not set -# CONFIG_SCSI_IPS is not set -# CONFIG_SCSI_INITIO is not set -# CONFIG_SCSI_INIA100 is not set -# CONFIG_SCSI_STEX is not set -# CONFIG_SCSI_SYM53C8XX_2 is not set -# CONFIG_SCSI_QLOGIC_1280 is not set -# CONFIG_SCSI_QLA_ISCSI is not set -# CONFIG_SCSI_DC395x is not set -# CONFIG_SCSI_AM53C974 is not set -# CONFIG_SCSI_WD719X is not set -# CONFIG_SCSI_DEBUG is not set -# CONFIG_SCSI_PMCRAID is not set -# CONFIG_SCSI_PM8001 is not set -CONFIG_SCSI_VIRTIO=y -# CONFIG_SCSI_DH is not set -# end of SCSI device support - -# CONFIG_ATA is not set -CONFIG_MD=y -# CONFIG_BLK_DEV_MD is not set -# CONFIG_BCACHE is not set -CONFIG_BLK_DEV_DM_BUILTIN=y -CONFIG_BLK_DEV_DM=y -# CONFIG_DM_DEBUG is not set -CONFIG_DM_BUFIO=y -# CONFIG_DM_DEBUG_BLOCK_MANAGER_LOCKING is not set -# CONFIG_DM_UNSTRIPED is not set -CONFIG_DM_CRYPT=y -# CONFIG_DM_SNAPSHOT is not set -# CONFIG_DM_THIN_PROVISIONING is not set -# CONFIG_DM_CACHE is not set -# CONFIG_DM_WRITECACHE is not set -# CONFIG_DM_EBS is not set -# CONFIG_DM_ERA is not set -# CONFIG_DM_CLONE is not set -# CONFIG_DM_MIRROR is not set -# CONFIG_DM_RAID is not set -# CONFIG_DM_ZERO is not set -# CONFIG_DM_MULTIPATH is not set -# CONFIG_DM_DELAY is not set -# CONFIG_DM_DUST is not set -CONFIG_DM_INIT=y -# CONFIG_DM_UEVENT is not set -# CONFIG_DM_FLAKEY is not set -CONFIG_DM_VERITY=y -# CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG is not set -# CONFIG_DM_VERITY_FEC is not set -# CONFIG_DM_SWITCH is not set -# CONFIG_DM_LOG_WRITES is not set -CONFIG_DM_INTEGRITY=y -# CONFIG_TARGET_CORE is not set -# CONFIG_FUSION is not set - -# -# IEEE 1394 (FireWire) support -# -# CONFIG_FIREWIRE is not set -# CONFIG_FIREWIRE_NOSY is not set -# end of IEEE 1394 (FireWire) support - -# CONFIG_MACINTOSH_DRIVERS is not set -CONFIG_NETDEVICES=y -CONFIG_NET_CORE=y -# CONFIG_BONDING is not set -# CONFIG_DUMMY is not set -# CONFIG_WIREGUARD is not set -# CONFIG_EQUALIZER is not set -# CONFIG_NET_FC is not set -# CONFIG_NET_TEAM is not set -# CONFIG_MACVLAN is not set -# CONFIG_IPVLAN is not set -# CONFIG_VXLAN is not set -# CONFIG_GENEVE is not set -# CONFIG_BAREUDP is not set -# CONFIG_GTP is not set -# CONFIG_AMT is not set -# CONFIG_MACSEC is not set -# CONFIG_NETCONSOLE is not set -# CONFIG_TUN is not set -# CONFIG_TUN_VNET_CROSS_LE is not set -CONFIG_VETH=y -CONFIG_VIRTIO_NET=y -# CONFIG_NLMON is not set -# CONFIG_ARCNET is not set -CONFIG_ETHERNET=y -# CONFIG_NET_VENDOR_3COM is not set -# CONFIG_NET_VENDOR_ADAPTEC is not set -# CONFIG_NET_VENDOR_AGERE is not set -# CONFIG_NET_VENDOR_ALACRITECH is not set -# CONFIG_NET_VENDOR_ALTEON is not set -# CONFIG_ALTERA_TSE is not set -# CONFIG_NET_VENDOR_AMAZON is not set -# CONFIG_NET_VENDOR_AMD is not set -# CONFIG_NET_VENDOR_AQUANTIA is not set -# CONFIG_NET_VENDOR_ARC is not set -CONFIG_NET_VENDOR_ASIX=y -# CONFIG_NET_VENDOR_ATHEROS is not set -# CONFIG_CX_ECAT is not set -# CONFIG_NET_VENDOR_BROADCOM is not set -# CONFIG_NET_VENDOR_CADENCE is not set -# CONFIG_NET_VENDOR_CAVIUM is not set -# CONFIG_NET_VENDOR_CHELSIO is not set -# CONFIG_NET_VENDOR_CISCO is not set -# CONFIG_NET_VENDOR_CORTINA is not set -CONFIG_NET_VENDOR_DAVICOM=y -# CONFIG_DNET is not set -# CONFIG_NET_VENDOR_DEC is not set -# CONFIG_NET_VENDOR_DLINK is not set -# CONFIG_NET_VENDOR_EMULEX is not set -CONFIG_NET_VENDOR_ENGLEDER=y -# CONFIG_TSNEP is not set -# CONFIG_NET_VENDOR_EZCHIP is not set -CONFIG_NET_VENDOR_FUNGIBLE=y -# CONFIG_FUN_ETH is not set -# CONFIG_NET_VENDOR_GOOGLE is not set -# CONFIG_NET_VENDOR_HUAWEI is not set -# CONFIG_NET_VENDOR_I825XX is not set -CONFIG_NET_VENDOR_INTEL=y -# CONFIG_E100 is not set -# CONFIG_E1000 is not set -# CONFIG_E1000E is not set -# CONFIG_IGB is not set -# CONFIG_IGBVF is not set -# CONFIG_IXGB is not set -# CONFIG_IXGBE is not set -# CONFIG_IXGBEVF is not set -# CONFIG_I40E is not set -# CONFIG_I40EVF is not set -# CONFIG_ICE is not set -# CONFIG_FM10K is not set -# CONFIG_IGC is not set -CONFIG_NET_VENDOR_WANGXUN=y -# CONFIG_NGBE is not set -# CONFIG_TXGBE is not set -# CONFIG_JME is not set -# CONFIG_NET_VENDOR_LITEX is not set -# CONFIG_NET_VENDOR_MARVELL is not set -# CONFIG_NET_VENDOR_MELLANOX is not set -# CONFIG_NET_VENDOR_MICREL is not set -# CONFIG_NET_VENDOR_MICROCHIP is not set -# CONFIG_NET_VENDOR_MICROSEMI is not set -# CONFIG_NET_VENDOR_MICROSOFT is not set -# CONFIG_NET_VENDOR_MYRI is not set -# CONFIG_FEALNX is not set -# CONFIG_NET_VENDOR_NI is not set -# CONFIG_NET_VENDOR_NATSEMI is not set -# CONFIG_NET_VENDOR_NETERION is not set -# CONFIG_NET_VENDOR_NETRONOME is not set -# CONFIG_NET_VENDOR_NVIDIA is not set -# CONFIG_NET_VENDOR_OKI is not set -# CONFIG_ETHOC is not set -# CONFIG_NET_VENDOR_PACKET_ENGINES is not set -# CONFIG_NET_VENDOR_PENSANDO is not set -# CONFIG_NET_VENDOR_QLOGIC is not set -# CONFIG_NET_VENDOR_BROCADE is not set -# CONFIG_NET_VENDOR_QUALCOMM is not set -# CONFIG_NET_VENDOR_RDC is not set -# CONFIG_NET_VENDOR_REALTEK is not set -# CONFIG_NET_VENDOR_RENESAS is not set -# CONFIG_NET_VENDOR_ROCKER is not set -# CONFIG_NET_VENDOR_SAMSUNG is not set -# CONFIG_NET_VENDOR_SEEQ is not set -# CONFIG_NET_VENDOR_SILAN is not set -# CONFIG_NET_VENDOR_SIS is not set -# CONFIG_NET_VENDOR_SOLARFLARE is not set -# CONFIG_NET_VENDOR_SMSC is not set -# CONFIG_NET_VENDOR_SOCIONEXT is not set -# CONFIG_NET_VENDOR_STMICRO is not set -# CONFIG_NET_VENDOR_SUN is not set -# CONFIG_NET_VENDOR_SYNOPSYS is not set -# CONFIG_NET_VENDOR_TEHUTI is not set -# CONFIG_NET_VENDOR_TI is not set -CONFIG_NET_VENDOR_VERTEXCOM=y -# CONFIG_NET_VENDOR_VIA is not set -# CONFIG_NET_VENDOR_WIZNET is not set -# CONFIG_NET_VENDOR_XILINX is not set -# CONFIG_FDDI is not set -# CONFIG_HIPPI is not set -# CONFIG_NET_SB1000 is not set -# CONFIG_PHYLIB is not set -# CONFIG_PSE_CONTROLLER is not set -# CONFIG_MDIO_DEVICE is not set - -# -# PCS device drivers -# -# end of PCS device drivers - -# CONFIG_PPP is not set -# CONFIG_SLIP is not set - -# -# Host-side USB support is needed for USB Network Adapter support -# -# CONFIG_WLAN is not set -# CONFIG_WAN is not set - -# -# Wireless WAN -# -# CONFIG_WWAN is not set -# end of Wireless WAN - -# CONFIG_VMXNET3 is not set -# CONFIG_FUJITSU_ES is not set -# CONFIG_HYPERV_NET is not set -CONFIG_NET_FAILOVER=y -# CONFIG_ISDN is not set - -# -# Input device support -# -CONFIG_INPUT=y -# CONFIG_INPUT_FF_MEMLESS is not set -# CONFIG_INPUT_SPARSEKMAP is not set -# CONFIG_INPUT_MATRIXKMAP is not set - -# -# Userland interfaces -# -# CONFIG_INPUT_MOUSEDEV is not set -# CONFIG_INPUT_JOYDEV is not set -# CONFIG_INPUT_EVDEV is not set -# CONFIG_INPUT_EVBUG is not set - -# -# Input Device Drivers -# -# CONFIG_INPUT_KEYBOARD is not set -# CONFIG_INPUT_MOUSE is not set -# CONFIG_INPUT_JOYSTICK is not set -# CONFIG_INPUT_TABLET is not set -# CONFIG_INPUT_TOUCHSCREEN is not set -# CONFIG_INPUT_MISC is not set -# CONFIG_RMI4_CORE is not set - -# -# Hardware I/O ports -# -# CONFIG_SERIO is not set -CONFIG_ARCH_MIGHT_HAVE_PC_SERIO=y -# CONFIG_GAMEPORT is not set -# end of Hardware I/O ports -# end of Input device support - -# -# Character devices -# -CONFIG_TTY=y -CONFIG_VT=y -CONFIG_CONSOLE_TRANSLATIONS=y -CONFIG_VT_CONSOLE=y -CONFIG_HW_CONSOLE=y -# CONFIG_VT_HW_CONSOLE_BINDING is not set -CONFIG_UNIX98_PTYS=y -# CONFIG_LEGACY_PTYS is not set -# CONFIG_LDISC_AUTOLOAD is not set - -# -# Serial drivers -# -CONFIG_SERIAL_EARLYCON=y -CONFIG_SERIAL_8250=y -# CONFIG_SERIAL_8250_DEPRECATED_OPTIONS is not set -CONFIG_SERIAL_8250_PNP=y -# CONFIG_SERIAL_8250_16550A_VARIANTS is not set -# CONFIG_SERIAL_8250_FINTEK is not set -CONFIG_SERIAL_8250_CONSOLE=y -CONFIG_SERIAL_8250_PCI=y -# CONFIG_SERIAL_8250_EXAR is not set -CONFIG_SERIAL_8250_NR_UARTS=4 -CONFIG_SERIAL_8250_RUNTIME_UARTS=4 -# CONFIG_SERIAL_8250_EXTENDED is not set -# CONFIG_SERIAL_8250_DW is not set -# CONFIG_SERIAL_8250_RT288X is not set -# CONFIG_SERIAL_8250_LPSS is not set -# CONFIG_SERIAL_8250_MID is not set -CONFIG_SERIAL_8250_PERICOM=y - -# -# Non-8250 serial port support -# -# CONFIG_SERIAL_UARTLITE is not set -CONFIG_SERIAL_CORE=y -CONFIG_SERIAL_CORE_CONSOLE=y -# CONFIG_SERIAL_JSM is not set -# CONFIG_SERIAL_LANTIQ is not set -# CONFIG_SERIAL_SCCNXP is not set -# CONFIG_SERIAL_ALTERA_JTAGUART is not set -# CONFIG_SERIAL_ALTERA_UART is not set -# CONFIG_SERIAL_ARC is not set -# CONFIG_SERIAL_RP2 is not set -# CONFIG_SERIAL_FSL_LPUART is not set -# CONFIG_SERIAL_FSL_LINFLEXUART is not set -# CONFIG_SERIAL_SPRD is not set -# end of Serial drivers - -# CONFIG_SERIAL_NONSTANDARD is not set -# CONFIG_N_GSM is not set -# CONFIG_NOZOMI is not set -# CONFIG_NULL_TTY is not set -CONFIG_HVC_DRIVER=y -# CONFIG_SERIAL_DEV_BUS is not set -CONFIG_VIRTIO_CONSOLE=y -# CONFIG_IPMI_HANDLER is not set -CONFIG_HW_RANDOM=y -# CONFIG_HW_RANDOM_TIMERIOMEM is not set -# CONFIG_HW_RANDOM_INTEL is not set -# CONFIG_HW_RANDOM_AMD is not set -# CONFIG_HW_RANDOM_BA431 is not set -# CONFIG_HW_RANDOM_VIA is not set -CONFIG_HW_RANDOM_VIRTIO=y -# CONFIG_HW_RANDOM_XIPHERA is not set -# CONFIG_APPLICOM is not set -# CONFIG_MWAVE is not set -# CONFIG_DEVMEM is not set -# CONFIG_NVRAM is not set -# CONFIG_DEVPORT is not set -# CONFIG_HPET is not set -# CONFIG_HANGCHECK_TIMER is not set -# CONFIG_TCG_TPM is not set -# CONFIG_TELCLOCK is not set -# CONFIG_XILLYBUS is not set -# CONFIG_RANDOM_TRUST_CPU is not set -# CONFIG_RANDOM_TRUST_BOOTLOADER is not set -# end of Character devices - -# -# I2C support -# -# CONFIG_I2C is not set -# end of I2C support - -# CONFIG_I3C is not set -# CONFIG_SPI is not set -# CONFIG_SPMI is not set -# CONFIG_HSI is not set -CONFIG_PPS=y -# CONFIG_PPS_DEBUG is not set - -# -# PPS clients support -# -# CONFIG_PPS_CLIENT_KTIMER is not set -# CONFIG_PPS_CLIENT_LDISC is not set -# CONFIG_PPS_CLIENT_GPIO is not set - -# -# PPS generators support -# - -# -# PTP clock support -# -CONFIG_PTP_1588_CLOCK=y -CONFIG_PTP_1588_CLOCK_OPTIONAL=y - -# -# Enable PHYLIB and NETWORK_PHY_TIMESTAMPING to see the additional clocks. -# -CONFIG_PTP_1588_CLOCK_KVM=y -# CONFIG_PTP_1588_CLOCK_VMW is not set -# end of PTP clock support - -# CONFIG_PINCTRL is not set -# CONFIG_GPIOLIB is not set -# CONFIG_W1 is not set -# CONFIG_POWER_RESET is not set -# CONFIG_POWER_SUPPLY is not set -# CONFIG_HWMON is not set -CONFIG_THERMAL=y -# CONFIG_THERMAL_NETLINK is not set -# CONFIG_THERMAL_STATISTICS is not set -CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS=0 -# CONFIG_THERMAL_WRITABLE_TRIPS is not set -CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE=y -# CONFIG_THERMAL_DEFAULT_GOV_FAIR_SHARE is not set -# CONFIG_THERMAL_DEFAULT_GOV_USER_SPACE is not set -# CONFIG_THERMAL_GOV_FAIR_SHARE is not set -CONFIG_THERMAL_GOV_STEP_WISE=y -# CONFIG_THERMAL_GOV_BANG_BANG is not set -# CONFIG_THERMAL_GOV_USER_SPACE is not set -# CONFIG_THERMAL_EMULATION is not set - -# -# Intel thermal drivers -# -# CONFIG_INTEL_POWERCLAMP is not set -CONFIG_X86_THERMAL_VECTOR=y -# CONFIG_X86_PKG_TEMP_THERMAL is not set -# CONFIG_INTEL_SOC_DTS_THERMAL is not set - -# -# ACPI INT340X thermal drivers -# -# CONFIG_INT340X_THERMAL is not set -# end of ACPI INT340X thermal drivers - -# CONFIG_INTEL_PCH_THERMAL is not set -# CONFIG_INTEL_TCC_COOLING is not set -# CONFIG_INTEL_MENLOW is not set -# CONFIG_INTEL_HFI_THERMAL is not set -# end of Intel thermal drivers - -CONFIG_WATCHDOG=y -CONFIG_WATCHDOG_CORE=y -# CONFIG_WATCHDOG_NOWAYOUT is not set -CONFIG_WATCHDOG_HANDLE_BOOT_ENABLED=y -CONFIG_WATCHDOG_OPEN_TIMEOUT=0 -# CONFIG_WATCHDOG_SYSFS is not set -# CONFIG_WATCHDOG_HRTIMER_PRETIMEOUT is not set - -# -# Watchdog Pretimeout Governors -# -# CONFIG_WATCHDOG_PRETIMEOUT_GOV is not set - -# -# Watchdog Device Drivers -# -# CONFIG_SOFT_WATCHDOG is not set -# CONFIG_WDAT_WDT is not set -# CONFIG_XILINX_WATCHDOG is not set -# CONFIG_CADENCE_WATCHDOG is not set -# CONFIG_DW_WATCHDOG is not set -# CONFIG_MAX63XX_WATCHDOG is not set -# CONFIG_ACQUIRE_WDT is not set -# CONFIG_ADVANTECH_WDT is not set -# CONFIG_ALIM1535_WDT is not set -# CONFIG_ALIM7101_WDT is not set -# CONFIG_EBC_C384_WDT is not set -# CONFIG_EXAR_WDT is not set -# CONFIG_F71808E_WDT is not set -# CONFIG_SP5100_TCO is not set -# CONFIG_SBC_FITPC2_WATCHDOG is not set -# CONFIG_EUROTECH_WDT is not set -# CONFIG_IB700_WDT is not set -# CONFIG_IBMASR is not set -# CONFIG_WAFER_WDT is not set -# CONFIG_I6300ESB_WDT is not set -# CONFIG_IE6XX_WDT is not set -# CONFIG_ITCO_WDT is not set -# CONFIG_IT8712F_WDT is not set -# CONFIG_IT87_WDT is not set -# CONFIG_HP_WATCHDOG is not set -# CONFIG_SC1200_WDT is not set -# CONFIG_PC87413_WDT is not set -# CONFIG_NV_TCO is not set -# CONFIG_60XX_WDT is not set -# CONFIG_CPU5_WDT is not set -# CONFIG_SMSC_SCH311X_WDT is not set -# CONFIG_SMSC37B787_WDT is not set -# CONFIG_TQMX86_WDT is not set -# CONFIG_VIA_WDT is not set -# CONFIG_W83627HF_WDT is not set -# CONFIG_W83877F_WDT is not set -# CONFIG_W83977F_WDT is not set -# CONFIG_MACHZ_WDT is not set -# CONFIG_SBC_EPX_C3_WATCHDOG is not set -# CONFIG_NI903X_WDT is not set -# CONFIG_NIC7018_WDT is not set - -# -# PCI-based Watchdog Cards -# -# CONFIG_PCIPCWATCHDOG is not set -# CONFIG_WDTPCI is not set -CONFIG_SSB_POSSIBLE=y -# CONFIG_SSB is not set -CONFIG_BCMA_POSSIBLE=y -# CONFIG_BCMA is not set - -# -# Multifunction device drivers -# -# CONFIG_MFD_MADERA is not set -# CONFIG_HTC_PASIC3 is not set -# CONFIG_MFD_INTEL_QUARK_I2C_GPIO is not set -# CONFIG_LPC_ICH is not set -# CONFIG_LPC_SCH is not set -# CONFIG_MFD_INTEL_LPSS_ACPI is not set -# CONFIG_MFD_INTEL_LPSS_PCI is not set -# CONFIG_MFD_JANZ_CMODIO is not set -# CONFIG_MFD_KEMPLD is not set -# CONFIG_MFD_MT6397 is not set -# CONFIG_MFD_RDC321X is not set -# CONFIG_MFD_SM501 is not set -# CONFIG_MFD_SYSCON is not set -# CONFIG_MFD_TI_AM335X_TSCADC is not set -# CONFIG_MFD_TQMX86 is not set -# CONFIG_MFD_VX855 is not set -# end of Multifunction device drivers - -# CONFIG_REGULATOR is not set -# CONFIG_RC_CORE is not set - -# -# CEC support -# -# CONFIG_MEDIA_CEC_SUPPORT is not set -# end of CEC support - -# CONFIG_MEDIA_SUPPORT is not set - -# -# Graphics support -# -CONFIG_APERTURE_HELPERS=y -# CONFIG_AGP is not set -# CONFIG_VGA_SWITCHEROO is not set -# CONFIG_DRM is not set - -# -# ARM devices -# -# end of ARM devices - -# -# Frame buffer Devices -# -# CONFIG_FB is not set -# end of Frame buffer Devices - -# -# Backlight & LCD device support -# -# CONFIG_LCD_CLASS_DEVICE is not set -# CONFIG_BACKLIGHT_CLASS_DEVICE is not set -# end of Backlight & LCD device support - -# -# Console display driver support -# -CONFIG_VGA_CONSOLE=y -CONFIG_DUMMY_CONSOLE=y -CONFIG_DUMMY_CONSOLE_COLUMNS=80 -CONFIG_DUMMY_CONSOLE_ROWS=25 -# end of Console display driver support -# end of Graphics support - -# CONFIG_SOUND is not set - -# -# HID support -# -# CONFIG_HID is not set - -# -# Intel ISH HID support -# -# CONFIG_INTEL_ISH_HID is not set -# end of Intel ISH HID support -# end of HID support - -CONFIG_USB_OHCI_LITTLE_ENDIAN=y -# CONFIG_USB_SUPPORT is not set -# CONFIG_MMC is not set -# CONFIG_SCSI_UFSHCD is not set -# CONFIG_MEMSTICK is not set -# CONFIG_NEW_LEDS is not set -# CONFIG_ACCESSIBILITY is not set -# CONFIG_INFINIBAND is not set -CONFIG_EDAC_ATOMIC_SCRUB=y -CONFIG_EDAC_SUPPORT=y -CONFIG_RTC_LIB=y -CONFIG_RTC_MC146818_LIB=y -# CONFIG_RTC_CLASS is not set -# CONFIG_DMADEVICES is not set - -# -# DMABUF options -# -# CONFIG_SYNC_FILE is not set -# CONFIG_DMABUF_HEAPS is not set -# end of DMABUF options - -# CONFIG_AUXDISPLAY is not set -# CONFIG_UIO is not set -CONFIG_VFIO=y -CONFIG_VFIO_IOMMU_TYPE1=y -CONFIG_VFIO_VIRQFD=y -# CONFIG_VFIO_NOIOMMU is not set -CONFIG_VFIO_PCI_CORE=y -CONFIG_VFIO_PCI_MMAP=y -CONFIG_VFIO_PCI_INTX=y -CONFIG_VFIO_PCI=y -# CONFIG_VFIO_PCI_VGA is not set -# CONFIG_VFIO_PCI_IGD is not set -# CONFIG_VFIO_MDEV is not set -CONFIG_IRQ_BYPASS_MANAGER=y -CONFIG_VIRT_DRIVERS=y -CONFIG_VMGENID=y -# CONFIG_VBOXGUEST is not set -# CONFIG_NITRO_ENCLAVES is not set -CONFIG_SEV_GUEST=y -CONFIG_VIRTIO_ANCHOR=y -CONFIG_VIRTIO=y -CONFIG_VIRTIO_PCI_LIB=y -CONFIG_VIRTIO_PCI_LIB_LEGACY=y -CONFIG_VIRTIO_MENU=y -CONFIG_VIRTIO_PCI=y -CONFIG_VIRTIO_PCI_LEGACY=y -CONFIG_VIRTIO_PMEM=y -CONFIG_VIRTIO_BALLOON=y -CONFIG_VIRTIO_MEM=y -# CONFIG_VIRTIO_INPUT is not set -CONFIG_VIRTIO_MMIO=y -CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES=y -# CONFIG_VDPA is not set -# CONFIG_VHOST_MENU is not set - -# -# Microsoft Hyper-V guest support -# -CONFIG_HYPERV=y -CONFIG_HYPERV_TIMER=y -# CONFIG_HYPERV_BALLOON is not set -# end of Microsoft Hyper-V guest support - -# CONFIG_GREYBUS is not set -# CONFIG_COMEDI is not set -# CONFIG_STAGING is not set -# CONFIG_CHROME_PLATFORMS is not set -# CONFIG_MELLANOX_PLATFORM is not set -# CONFIG_SURFACE_PLATFORMS is not set -# CONFIG_X86_PLATFORM_DEVICES is not set -# CONFIG_P2SB is not set -CONFIG_HAVE_CLK=y -CONFIG_HAVE_CLK_PREPARE=y -CONFIG_COMMON_CLK=y -# CONFIG_XILINX_VCU is not set -# CONFIG_HWSPINLOCK is not set - -# -# Clock Source drivers -# -CONFIG_CLKEVT_I8253=y -CONFIG_I8253_LOCK=y -CONFIG_CLKBLD_I8253=y -# end of Clock Source drivers - -CONFIG_MAILBOX=y -CONFIG_PCC=y -# CONFIG_ALTERA_MBOX is not set -CONFIG_IOMMU_IOVA=y -CONFIG_IOASID=y -CONFIG_IOMMU_API=y -CONFIG_IOMMU_SUPPORT=y - -# -# Generic IOMMU Pagetable Support -# -CONFIG_IOMMU_IO_PGTABLE=y -# end of Generic IOMMU Pagetable Support - -# CONFIG_IOMMU_DEFAULT_DMA_STRICT is not set -CONFIG_IOMMU_DEFAULT_DMA_LAZY=y -# CONFIG_IOMMU_DEFAULT_PASSTHROUGH is not set -CONFIG_IOMMU_DMA=y -CONFIG_AMD_IOMMU=y -CONFIG_AMD_IOMMU_V2=y -CONFIG_DMAR_TABLE=y -CONFIG_INTEL_IOMMU=y -# CONFIG_INTEL_IOMMU_SVM is not set -# CONFIG_INTEL_IOMMU_DEFAULT_ON is not set -CONFIG_INTEL_IOMMU_FLOPPY_WA=y -# CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON is not set -CONFIG_IRQ_REMAP=y -CONFIG_HYPERV_IOMMU=y -CONFIG_VIRTIO_IOMMU=y - -# -# Remoteproc drivers -# -# CONFIG_REMOTEPROC is not set -# end of Remoteproc drivers - -# -# Rpmsg drivers -# -# CONFIG_RPMSG_QCOM_GLINK_RPM is not set -# CONFIG_RPMSG_VIRTIO is not set -# end of Rpmsg drivers - -# CONFIG_SOUNDWIRE is not set - -# -# SOC (System On Chip) specific Drivers -# - -# -# Amlogic SoC drivers -# -# end of Amlogic SoC drivers - -# -# Broadcom SoC drivers -# -# end of Broadcom SoC drivers - -# -# NXP/Freescale QorIQ SoC drivers -# -# end of NXP/Freescale QorIQ SoC drivers - -# -# fujitsu SoC drivers -# -# end of fujitsu SoC drivers - -# -# i.MX SoC drivers -# -# end of i.MX SoC drivers - -# -# Enable LiteX SoC Builder specific drivers -# -# end of Enable LiteX SoC Builder specific drivers - -# -# Qualcomm SoC drivers -# -# end of Qualcomm SoC drivers - -# CONFIG_SOC_TI is not set - -# -# Xilinx SoC drivers -# -# end of Xilinx SoC drivers -# end of SOC (System On Chip) specific Drivers - -# CONFIG_PM_DEVFREQ is not set -# CONFIG_EXTCON is not set -# CONFIG_MEMORY is not set -# CONFIG_IIO is not set -# CONFIG_NTB is not set -# CONFIG_PWM is not set - -# -# IRQ chip support -# -# end of IRQ chip support - -# CONFIG_IPACK_BUS is not set -# CONFIG_RESET_CONTROLLER is not set - -# -# PHY Subsystem -# -# CONFIG_GENERIC_PHY is not set -# CONFIG_PHY_CAN_TRANSCEIVER is not set - -# -# PHY drivers for Broadcom platforms -# -# CONFIG_BCM_KONA_USB2_PHY is not set -# end of PHY drivers for Broadcom platforms - -# CONFIG_PHY_PXA_28NM_HSIC is not set -# CONFIG_PHY_PXA_28NM_USB2 is not set -# CONFIG_PHY_INTEL_LGM_EMMC is not set -# end of PHY Subsystem - -# CONFIG_POWERCAP is not set -# CONFIG_MCB is not set - -# -# Performance monitor support -# -# end of Performance monitor support - -# CONFIG_RAS is not set -# CONFIG_USB4 is not set - -# -# Android -# -# CONFIG_ANDROID_BINDER_IPC is not set -# end of Android - -CONFIG_LIBNVDIMM=y -CONFIG_BLK_DEV_PMEM=y -CONFIG_ND_CLAIM=y -CONFIG_ND_BTT=y -CONFIG_BTT=y -CONFIG_ND_PFN=y -CONFIG_NVDIMM_PFN=y -CONFIG_NVDIMM_DAX=y -CONFIG_DAX=y -# CONFIG_DEV_DAX is not set -CONFIG_NVMEM=y -# CONFIG_NVMEM_SYSFS is not set -# CONFIG_NVMEM_RMEM is not set - -# -# HW tracing support -# -# CONFIG_STM is not set -# CONFIG_INTEL_TH is not set -# end of HW tracing support - -# CONFIG_FPGA is not set -# CONFIG_TEE is not set -# CONFIG_SIOX is not set -# CONFIG_SLIMBUS is not set -# CONFIG_INTERCONNECT is not set -# CONFIG_COUNTER is not set -# CONFIG_PECI is not set -# CONFIG_HTE is not set -# end of Device Drivers - -# -# File systems -# -CONFIG_DCACHE_WORD_ACCESS=y -# CONFIG_VALIDATE_FS_PARSER is not set -CONFIG_FS_IOMAP=y -# CONFIG_EXT2_FS is not set -# CONFIG_EXT3_FS is not set -CONFIG_EXT4_FS=y -CONFIG_EXT4_USE_FOR_EXT2=y -CONFIG_EXT4_FS_POSIX_ACL=y -CONFIG_EXT4_FS_SECURITY=y -# CONFIG_EXT4_DEBUG is not set -CONFIG_JBD2=y -# CONFIG_JBD2_DEBUG is not set -CONFIG_FS_MBCACHE=y -# CONFIG_REISERFS_FS is not set -# CONFIG_JFS_FS is not set -CONFIG_XFS_FS=y -# CONFIG_XFS_SUPPORT_V4 is not set -# CONFIG_XFS_QUOTA is not set -# CONFIG_XFS_POSIX_ACL is not set -# CONFIG_XFS_RT is not set -# CONFIG_XFS_ONLINE_SCRUB is not set -# CONFIG_XFS_WARN is not set -# CONFIG_XFS_DEBUG is not set -# CONFIG_GFS2_FS is not set -# CONFIG_BTRFS_FS is not set -# CONFIG_NILFS2_FS is not set -# CONFIG_F2FS_FS is not set -CONFIG_FS_DAX=y -CONFIG_FS_DAX_PMD=y -CONFIG_FS_POSIX_ACL=y -CONFIG_EXPORTFS=y -CONFIG_EXPORTFS_BLOCK_OPS=y -CONFIG_FILE_LOCKING=y -# CONFIG_FS_ENCRYPTION is not set -# CONFIG_FS_VERITY is not set -CONFIG_FSNOTIFY=y -CONFIG_DNOTIFY=y -CONFIG_INOTIFY_USER=y -CONFIG_FANOTIFY=y -# CONFIG_FANOTIFY_ACCESS_PERMISSIONS is not set -# CONFIG_QUOTA is not set -CONFIG_AUTOFS4_FS=y -CONFIG_AUTOFS_FS=y -CONFIG_FUSE_FS=y -# CONFIG_CUSE is not set -CONFIG_VIRTIO_FS=y -CONFIG_FUSE_DAX=y -CONFIG_OVERLAY_FS=y -CONFIG_OVERLAY_FS_REDIRECT_DIR=y -# CONFIG_OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW is not set -CONFIG_OVERLAY_FS_INDEX=y -CONFIG_OVERLAY_FS_XINO_AUTO=y -CONFIG_OVERLAY_FS_METACOPY=y - -# -# Caches -# -CONFIG_NETFS_SUPPORT=y -# CONFIG_NETFS_STATS is not set -# CONFIG_FSCACHE is not set -# end of Caches - -# -# CD-ROM/DVD Filesystems -# -CONFIG_ISO9660_FS=y -CONFIG_JOLIET=y -CONFIG_ZISOFS=y -# CONFIG_UDF_FS is not set -# end of CD-ROM/DVD Filesystems - -# -# DOS/FAT/EXFAT/NT Filesystems -# -CONFIG_FAT_FS=y -CONFIG_MSDOS_FS=y -CONFIG_VFAT_FS=y -CONFIG_FAT_DEFAULT_CODEPAGE=437 -CONFIG_FAT_DEFAULT_IOCHARSET="iso8859-1" -# CONFIG_FAT_DEFAULT_UTF8 is not set -# CONFIG_EXFAT_FS is not set -# CONFIG_NTFS_FS is not set -# CONFIG_NTFS3_FS is not set -# end of DOS/FAT/EXFAT/NT Filesystems - -# -# Pseudo filesystems -# -CONFIG_PROC_FS=y -# CONFIG_PROC_KCORE is not set -CONFIG_PROC_SYSCTL=y -CONFIG_PROC_PAGE_MONITOR=y -# CONFIG_PROC_CHILDREN is not set -CONFIG_PROC_PID_ARCH_STATUS=y -CONFIG_KERNFS=y -CONFIG_SYSFS=y -CONFIG_TMPFS=y -# CONFIG_TMPFS_POSIX_ACL is not set -CONFIG_TMPFS_XATTR=y -# CONFIG_TMPFS_INODE64 is not set -CONFIG_HUGETLBFS=y -CONFIG_HUGETLB_PAGE=y -CONFIG_ARCH_WANT_HUGETLB_PAGE_OPTIMIZE_VMEMMAP=y -CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP=y -# CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP_DEFAULT_ON is not set -CONFIG_MEMFD_CREATE=y -CONFIG_ARCH_HAS_GIGANTIC_PAGE=y -# CONFIG_CONFIGFS_FS is not set -# end of Pseudo filesystems - -# CONFIG_MISC_FILESYSTEMS is not set -CONFIG_NETWORK_FILESYSTEMS=y -# CONFIG_NFS_FS is not set -# CONFIG_NFSD is not set -# CONFIG_CEPH_FS is not set -# CONFIG_CIFS is not set -# CONFIG_SMB_SERVER is not set -# CONFIG_CODA_FS is not set -# CONFIG_AFS_FS is not set -CONFIG_9P_FS=y -CONFIG_9P_FS_POSIX_ACL=y -CONFIG_9P_FS_SECURITY=y -CONFIG_NLS=y -CONFIG_NLS_DEFAULT="utf8" -CONFIG_NLS_CODEPAGE_437=y -CONFIG_NLS_CODEPAGE_737=y -CONFIG_NLS_CODEPAGE_775=y -CONFIG_NLS_CODEPAGE_850=y -CONFIG_NLS_CODEPAGE_852=y -CONFIG_NLS_CODEPAGE_855=y -CONFIG_NLS_CODEPAGE_857=y -CONFIG_NLS_CODEPAGE_860=y -CONFIG_NLS_CODEPAGE_861=y -CONFIG_NLS_CODEPAGE_862=y -CONFIG_NLS_CODEPAGE_863=y -CONFIG_NLS_CODEPAGE_864=y -CONFIG_NLS_CODEPAGE_865=y -CONFIG_NLS_CODEPAGE_866=y -CONFIG_NLS_CODEPAGE_869=y -CONFIG_NLS_CODEPAGE_936=y -CONFIG_NLS_CODEPAGE_950=y -CONFIG_NLS_CODEPAGE_932=y -CONFIG_NLS_CODEPAGE_949=y -CONFIG_NLS_CODEPAGE_874=y -CONFIG_NLS_ISO8859_8=y -CONFIG_NLS_CODEPAGE_1250=y -CONFIG_NLS_CODEPAGE_1251=y -CONFIG_NLS_ASCII=y -CONFIG_NLS_ISO8859_1=y -CONFIG_NLS_ISO8859_2=y -CONFIG_NLS_ISO8859_3=y -CONFIG_NLS_ISO8859_4=y -CONFIG_NLS_ISO8859_5=y -CONFIG_NLS_ISO8859_6=y -CONFIG_NLS_ISO8859_7=y -CONFIG_NLS_ISO8859_9=y -CONFIG_NLS_ISO8859_13=y -CONFIG_NLS_ISO8859_14=y -CONFIG_NLS_ISO8859_15=y -CONFIG_NLS_KOI8_R=y -CONFIG_NLS_KOI8_U=y -CONFIG_NLS_MAC_ROMAN=y -CONFIG_NLS_MAC_CELTIC=y -CONFIG_NLS_MAC_CENTEURO=y -CONFIG_NLS_MAC_CROATIAN=y -CONFIG_NLS_MAC_CYRILLIC=y -CONFIG_NLS_MAC_GAELIC=y -CONFIG_NLS_MAC_GREEK=y -CONFIG_NLS_MAC_ICELAND=y -CONFIG_NLS_MAC_INUIT=y -CONFIG_NLS_MAC_ROMANIAN=y -CONFIG_NLS_MAC_TURKISH=y -CONFIG_NLS_UTF8=y -# CONFIG_UNICODE is not set -CONFIG_IO_WQ=y -# end of File systems - -# -# Security options -# -# CONFIG_KEYS is not set -# CONFIG_SECURITY_DMESG_RESTRICT is not set -CONFIG_SECURITY=y -# CONFIG_SECURITYFS is not set -# CONFIG_SECURITY_NETWORK is not set -# CONFIG_SECURITY_PATH is not set -# CONFIG_INTEL_TXT is not set -CONFIG_HAVE_HARDENED_USERCOPY_ALLOCATOR=y -# CONFIG_HARDENED_USERCOPY is not set -# CONFIG_FORTIFY_SOURCE is not set -# CONFIG_STATIC_USERMODEHELPER is not set -# CONFIG_SECURITY_SMACK is not set -# CONFIG_SECURITY_TOMOYO is not set -# CONFIG_SECURITY_APPARMOR is not set -# CONFIG_SECURITY_LOADPIN is not set -# CONFIG_SECURITY_YAMA is not set -# CONFIG_SECURITY_SAFESETID is not set -# CONFIG_SECURITY_LOCKDOWN_LSM is not set -# CONFIG_SECURITY_LANDLOCK is not set -# CONFIG_INTEGRITY is not set -CONFIG_DEFAULT_SECURITY_DAC=y -CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,bpf" - -# -# Kernel hardening options -# - -# -# Memory initialization -# -CONFIG_INIT_STACK_NONE=y -# CONFIG_GCC_PLUGIN_STRUCTLEAK_USER is not set -# CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF is not set -# CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL is not set -# CONFIG_GCC_PLUGIN_STACKLEAK is not set -# CONFIG_INIT_ON_ALLOC_DEFAULT_ON is not set -# CONFIG_INIT_ON_FREE_DEFAULT_ON is not set -CONFIG_CC_HAS_ZERO_CALL_USED_REGS=y -# CONFIG_ZERO_CALL_USED_REGS is not set -# end of Memory initialization - -CONFIG_RANDSTRUCT_NONE=y -# CONFIG_RANDSTRUCT_FULL is not set -# CONFIG_RANDSTRUCT_PERFORMANCE is not set -# end of Kernel hardening options -# end of Security options - -CONFIG_XOR_BLOCKS=y -CONFIG_ASYNC_CORE=y -CONFIG_ASYNC_XOR=y -CONFIG_CRYPTO=y - -# -# Crypto core or helper -# -CONFIG_CRYPTO_ALGAPI=y -CONFIG_CRYPTO_ALGAPI2=y -CONFIG_CRYPTO_AEAD=y -CONFIG_CRYPTO_AEAD2=y -CONFIG_CRYPTO_SKCIPHER=y -CONFIG_CRYPTO_SKCIPHER2=y -CONFIG_CRYPTO_HASH=y -CONFIG_CRYPTO_HASH2=y -CONFIG_CRYPTO_RNG=y -CONFIG_CRYPTO_RNG2=y -CONFIG_CRYPTO_AKCIPHER2=y -CONFIG_CRYPTO_KPP2=y -CONFIG_CRYPTO_ACOMP2=y -CONFIG_CRYPTO_MANAGER=y -CONFIG_CRYPTO_MANAGER2=y -CONFIG_CRYPTO_USER=y -# CONFIG_CRYPTO_MANAGER_DISABLE_TESTS is not set -# CONFIG_CRYPTO_MANAGER_EXTRA_TESTS is not set -CONFIG_CRYPTO_GF128MUL=y -CONFIG_CRYPTO_NULL=y -CONFIG_CRYPTO_NULL2=y -# CONFIG_CRYPTO_PCRYPT is not set -# CONFIG_CRYPTO_CRYPTD is not set -CONFIG_CRYPTO_AUTHENC=y -# CONFIG_CRYPTO_TEST is not set -# end of Crypto core or helper - -# -# Public-key cryptography -# -# CONFIG_CRYPTO_RSA is not set -# CONFIG_CRYPTO_DH is not set -# CONFIG_CRYPTO_ECDH is not set -# CONFIG_CRYPTO_ECDSA is not set -# CONFIG_CRYPTO_ECRDSA is not set -# CONFIG_CRYPTO_SM2 is not set -# CONFIG_CRYPTO_CURVE25519 is not set -# end of Public-key cryptography - -# -# Block ciphers -# -CONFIG_CRYPTO_AES=y -# CONFIG_CRYPTO_AES_TI is not set -# CONFIG_CRYPTO_ARIA is not set -# CONFIG_CRYPTO_BLOWFISH is not set -# CONFIG_CRYPTO_CAMELLIA is not set -# CONFIG_CRYPTO_CAST5 is not set -# CONFIG_CRYPTO_CAST6 is not set -# CONFIG_CRYPTO_DES is not set -# CONFIG_CRYPTO_FCRYPT is not set -# CONFIG_CRYPTO_SERPENT is not set -# CONFIG_CRYPTO_SM4_GENERIC is not set -# CONFIG_CRYPTO_TWOFISH is not set -# end of Block ciphers - -# -# Length-preserving ciphers and modes -# -# CONFIG_CRYPTO_ADIANTUM is not set -# CONFIG_CRYPTO_CHACHA20 is not set -CONFIG_CRYPTO_CBC=y -# CONFIG_CRYPTO_CFB is not set -CONFIG_CRYPTO_CTR=y -# CONFIG_CRYPTO_CTS is not set -CONFIG_CRYPTO_ECB=y -# CONFIG_CRYPTO_HCTR2 is not set -# CONFIG_CRYPTO_KEYWRAP is not set -# CONFIG_CRYPTO_LRW is not set -# CONFIG_CRYPTO_OFB is not set -# CONFIG_CRYPTO_PCBC is not set -CONFIG_CRYPTO_XTS=y -# end of Length-preserving ciphers and modes - -# -# AEAD (authenticated encryption with associated data) ciphers -# -# CONFIG_CRYPTO_AEGIS128 is not set -# CONFIG_CRYPTO_CHACHA20POLY1305 is not set -# CONFIG_CRYPTO_CCM is not set -CONFIG_CRYPTO_GCM=y -# CONFIG_CRYPTO_SEQIV is not set -# CONFIG_CRYPTO_ECHAINIV is not set -CONFIG_CRYPTO_ESSIV=y -# end of AEAD (authenticated encryption with associated data) ciphers - -# -# Hashes, digests, and MACs -# -# CONFIG_CRYPTO_BLAKE2B is not set -# CONFIG_CRYPTO_CMAC is not set -CONFIG_CRYPTO_GHASH=y -# CONFIG_CRYPTO_HMAC is not set -# CONFIG_CRYPTO_MD4 is not set -CONFIG_CRYPTO_MD5=y -# CONFIG_CRYPTO_MICHAEL_MIC is not set -# CONFIG_CRYPTO_POLY1305 is not set -# CONFIG_CRYPTO_RMD160 is not set -# CONFIG_CRYPTO_SHA1 is not set -CONFIG_CRYPTO_SHA256=y -# CONFIG_CRYPTO_SHA512 is not set -# CONFIG_CRYPTO_SHA3 is not set -# CONFIG_CRYPTO_SM3_GENERIC is not set -# CONFIG_CRYPTO_STREEBOG is not set -# CONFIG_CRYPTO_VMAC is not set -# CONFIG_CRYPTO_WP512 is not set -# CONFIG_CRYPTO_XCBC is not set -# CONFIG_CRYPTO_XXHASH is not set -# end of Hashes, digests, and MACs - -# -# CRCs (cyclic redundancy checks) -# -CONFIG_CRYPTO_CRC32C=y -# CONFIG_CRYPTO_CRC32 is not set -CONFIG_CRYPTO_CRCT10DIF=y -CONFIG_CRYPTO_CRC64_ROCKSOFT=y -# end of CRCs (cyclic redundancy checks) - -# -# Compression -# -CONFIG_CRYPTO_DEFLATE=y -# CONFIG_CRYPTO_LZO is not set -# CONFIG_CRYPTO_842 is not set -# CONFIG_CRYPTO_LZ4 is not set -# CONFIG_CRYPTO_LZ4HC is not set -# CONFIG_CRYPTO_ZSTD is not set -# end of Compression - -# -# Random number generation -# -CONFIG_CRYPTO_ANSI_CPRNG=y -# CONFIG_CRYPTO_DRBG_MENU is not set -# CONFIG_CRYPTO_JITTERENTROPY is not set -# end of Random number generation - -# -# Userspace interface -# -CONFIG_CRYPTO_USER_API=y -CONFIG_CRYPTO_USER_API_HASH=y -CONFIG_CRYPTO_USER_API_SKCIPHER=y -# CONFIG_CRYPTO_USER_API_RNG is not set -# CONFIG_CRYPTO_USER_API_AEAD is not set -# CONFIG_CRYPTO_USER_API_ENABLE_OBSOLETE is not set -# CONFIG_CRYPTO_STATS is not set -# end of Userspace interface - -# -# Accelerated Cryptographic Algorithms for CPU (x86) -# -# CONFIG_CRYPTO_CURVE25519_X86 is not set -# CONFIG_CRYPTO_AES_NI_INTEL is not set -# CONFIG_CRYPTO_BLOWFISH_X86_64 is not set -# CONFIG_CRYPTO_CAMELLIA_X86_64 is not set -# CONFIG_CRYPTO_CAMELLIA_AESNI_AVX_X86_64 is not set -# CONFIG_CRYPTO_CAMELLIA_AESNI_AVX2_X86_64 is not set -# CONFIG_CRYPTO_CAST5_AVX_X86_64 is not set -# CONFIG_CRYPTO_CAST6_AVX_X86_64 is not set -# CONFIG_CRYPTO_DES3_EDE_X86_64 is not set -# CONFIG_CRYPTO_SERPENT_SSE2_X86_64 is not set -# CONFIG_CRYPTO_SERPENT_AVX_X86_64 is not set -# CONFIG_CRYPTO_SERPENT_AVX2_X86_64 is not set -# CONFIG_CRYPTO_SM4_AESNI_AVX_X86_64 is not set -# CONFIG_CRYPTO_SM4_AESNI_AVX2_X86_64 is not set -# CONFIG_CRYPTO_TWOFISH_X86_64 is not set -# CONFIG_CRYPTO_TWOFISH_X86_64_3WAY is not set -# CONFIG_CRYPTO_TWOFISH_AVX_X86_64 is not set -# CONFIG_CRYPTO_ARIA_AESNI_AVX_X86_64 is not set -# CONFIG_CRYPTO_CHACHA20_X86_64 is not set -# CONFIG_CRYPTO_AEGIS128_AESNI_SSE2 is not set -# CONFIG_CRYPTO_NHPOLY1305_SSE2 is not set -# CONFIG_CRYPTO_NHPOLY1305_AVX2 is not set -# CONFIG_CRYPTO_BLAKE2S_X86 is not set -# CONFIG_CRYPTO_POLYVAL_CLMUL_NI is not set -# CONFIG_CRYPTO_POLY1305_X86_64 is not set -# CONFIG_CRYPTO_SHA1_SSSE3 is not set -# CONFIG_CRYPTO_SHA256_SSSE3 is not set -# CONFIG_CRYPTO_SHA512_SSSE3 is not set -# CONFIG_CRYPTO_SM3_AVX_X86_64 is not set -# CONFIG_CRYPTO_GHASH_CLMUL_NI_INTEL is not set -# CONFIG_CRYPTO_CRC32C_INTEL is not set -# CONFIG_CRYPTO_CRC32_PCLMUL is not set -# CONFIG_CRYPTO_CRCT10DIF_PCLMUL is not set -# end of Accelerated Cryptographic Algorithms for CPU (x86) - -# CONFIG_CRYPTO_HW is not set - -# -# Certificates for signature checking -# -# end of Certificates for signature checking - -CONFIG_BINARY_PRINTF=y - -# -# Library routines -# -# CONFIG_PACKING is not set -CONFIG_BITREVERSE=y -CONFIG_GENERIC_STRNCPY_FROM_USER=y -CONFIG_GENERIC_STRNLEN_USER=y -CONFIG_GENERIC_NET_UTILS=y -# CONFIG_CORDIC is not set -# CONFIG_PRIME_NUMBERS is not set -CONFIG_RATIONAL=y -CONFIG_GENERIC_PCI_IOMAP=y -CONFIG_GENERIC_IOMAP=y -CONFIG_ARCH_USE_CMPXCHG_LOCKREF=y -CONFIG_ARCH_HAS_FAST_MULTIPLIER=y -CONFIG_ARCH_USE_SYM_ANNOTATIONS=y - -# -# Crypto library routines -# -CONFIG_CRYPTO_LIB_UTILS=y -CONFIG_CRYPTO_LIB_AES=y -CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y -# CONFIG_CRYPTO_LIB_CHACHA is not set -# CONFIG_CRYPTO_LIB_CURVE25519 is not set -CONFIG_CRYPTO_LIB_POLY1305_RSIZE=11 -# CONFIG_CRYPTO_LIB_POLY1305 is not set -# CONFIG_CRYPTO_LIB_CHACHA20POLY1305 is not set -CONFIG_CRYPTO_LIB_SHA1=y -CONFIG_CRYPTO_LIB_SHA256=y -# end of Crypto library routines - -# CONFIG_CRC_CCITT is not set -CONFIG_CRC16=y -CONFIG_CRC_T10DIF=y -CONFIG_CRC64_ROCKSOFT=y -# CONFIG_CRC_ITU_T is not set -CONFIG_CRC32=y -# CONFIG_CRC32_SELFTEST is not set -CONFIG_CRC32_SLICEBY8=y -# CONFIG_CRC32_SLICEBY4 is not set -# CONFIG_CRC32_SARWATE is not set -# CONFIG_CRC32_BIT is not set -CONFIG_CRC64=y -# CONFIG_CRC4 is not set -# CONFIG_CRC7 is not set -CONFIG_LIBCRC32C=y -# CONFIG_CRC8 is not set -CONFIG_XXHASH=y -# CONFIG_RANDOM32_SELFTEST is not set -CONFIG_ZLIB_INFLATE=y -CONFIG_ZLIB_DEFLATE=y -CONFIG_XZ_DEC=y -CONFIG_XZ_DEC_X86=y -CONFIG_XZ_DEC_POWERPC=y -CONFIG_XZ_DEC_IA64=y -CONFIG_XZ_DEC_ARM=y -CONFIG_XZ_DEC_ARMTHUMB=y -CONFIG_XZ_DEC_SPARC=y -# CONFIG_XZ_DEC_MICROLZMA is not set -CONFIG_XZ_DEC_BCJ=y -# CONFIG_XZ_DEC_TEST is not set -CONFIG_DECOMPRESS_GZIP=y -CONFIG_GENERIC_ALLOCATOR=y -CONFIG_TEXTSEARCH=y -CONFIG_TEXTSEARCH_KMP=y -CONFIG_TEXTSEARCH_BM=y -CONFIG_TEXTSEARCH_FSM=y -CONFIG_INTERVAL_TREE=y -CONFIG_XARRAY_MULTI=y -CONFIG_HAS_IOMEM=y -CONFIG_HAS_IOPORT_MAP=y -CONFIG_HAS_DMA=y -CONFIG_DMA_OPS=y -CONFIG_NEED_SG_DMA_LENGTH=y -CONFIG_NEED_DMA_MAP_STATE=y -CONFIG_ARCH_DMA_ADDR_T_64BIT=y -CONFIG_ARCH_HAS_FORCE_DMA_UNENCRYPTED=y -CONFIG_SWIOTLB=y -CONFIG_DMA_COHERENT_POOL=y -# CONFIG_DMA_API_DEBUG is not set -CONFIG_SGL_ALLOC=y -CONFIG_IOMMU_HELPER=y -CONFIG_CPUMASK_OFFSTACK=y -# CONFIG_FORCE_NR_CPUS is not set -CONFIG_CPU_RMAP=y -CONFIG_DQL=y -CONFIG_NLATTR=y -# CONFIG_IRQ_POLL is not set -CONFIG_HAVE_GENERIC_VDSO=y -CONFIG_GENERIC_GETTIMEOFDAY=y -CONFIG_GENERIC_VDSO_TIME_NS=y -CONFIG_SG_POOL=y -CONFIG_ARCH_HAS_PMEM_API=y -CONFIG_MEMREGION=y -CONFIG_ARCH_HAS_UACCESS_FLUSHCACHE=y -CONFIG_ARCH_HAS_COPY_MC=y -CONFIG_ARCH_STACKWALK=y -CONFIG_STACKDEPOT=y -CONFIG_SBITMAP=y -# end of Library routines - -# -# Kernel hacking -# - -# -# printk and dmesg options -# -CONFIG_PRINTK_TIME=y -# CONFIG_PRINTK_CALLER is not set -# CONFIG_STACKTRACE_BUILD_ID is not set -CONFIG_CONSOLE_LOGLEVEL_DEFAULT=7 -CONFIG_CONSOLE_LOGLEVEL_QUIET=4 -CONFIG_MESSAGE_LOGLEVEL_DEFAULT=4 -# CONFIG_BOOT_PRINTK_DELAY is not set -# CONFIG_DYNAMIC_DEBUG is not set -# CONFIG_DYNAMIC_DEBUG_CORE is not set -# CONFIG_SYMBOLIC_ERRNAME is not set -CONFIG_DEBUG_BUGVERBOSE=y -# end of printk and dmesg options - -CONFIG_DEBUG_KERNEL=y -CONFIG_DEBUG_MISC=y - -# -# Compile-time checks and compiler options -# -CONFIG_AS_HAS_NON_CONST_LEB128=y -CONFIG_DEBUG_INFO_NONE=y -# CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT is not set -# CONFIG_DEBUG_INFO_DWARF4 is not set -# CONFIG_DEBUG_INFO_DWARF5 is not set -CONFIG_FRAME_WARN=2048 -# CONFIG_STRIP_ASM_SYMS is not set -# CONFIG_READABLE_ASM is not set -# CONFIG_HEADERS_INSTALL is not set -# CONFIG_DEBUG_SECTION_MISMATCH is not set -CONFIG_SECTION_MISMATCH_WARN_ONLY=y -CONFIG_OBJTOOL=y -# CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set -# end of Compile-time checks and compiler options - -# -# Generic Kernel Debugging Instruments -# -# CONFIG_MAGIC_SYSRQ is not set -# CONFIG_DEBUG_FS is not set -CONFIG_HAVE_ARCH_KGDB=y -# CONFIG_KGDB is not set -CONFIG_ARCH_HAS_UBSAN_SANITIZE_ALL=y -# CONFIG_UBSAN is not set -CONFIG_HAVE_ARCH_KCSAN=y -CONFIG_HAVE_KCSAN_COMPILER=y -# CONFIG_KCSAN is not set -# end of Generic Kernel Debugging Instruments - -# -# Networking Debugging -# -# CONFIG_NET_DEV_REFCNT_TRACKER is not set -# CONFIG_NET_NS_REFCNT_TRACKER is not set -# CONFIG_DEBUG_NET is not set -# end of Networking Debugging - -# -# Memory Debugging -# -# CONFIG_PAGE_EXTENSION is not set -# CONFIG_DEBUG_PAGEALLOC is not set -CONFIG_SLUB_DEBUG=y -# CONFIG_SLUB_DEBUG_ON is not set -# CONFIG_PAGE_OWNER is not set -# CONFIG_PAGE_TABLE_CHECK is not set -# CONFIG_PAGE_POISONING is not set -# CONFIG_DEBUG_RODATA_TEST is not set -CONFIG_ARCH_HAS_DEBUG_WX=y -# CONFIG_DEBUG_WX is not set -CONFIG_GENERIC_PTDUMP=y -# CONFIG_DEBUG_OBJECTS is not set -CONFIG_HAVE_DEBUG_KMEMLEAK=y -# CONFIG_DEBUG_KMEMLEAK is not set -# CONFIG_DEBUG_STACK_USAGE is not set -# CONFIG_SCHED_STACK_END_CHECK is not set -CONFIG_ARCH_HAS_DEBUG_VM_PGTABLE=y -# CONFIG_DEBUG_VM is not set -# CONFIG_DEBUG_VM_PGTABLE is not set -CONFIG_ARCH_HAS_DEBUG_VIRTUAL=y -# CONFIG_DEBUG_VIRTUAL is not set -CONFIG_DEBUG_MEMORY_INIT=y -# CONFIG_DEBUG_PER_CPU_MAPS is not set -CONFIG_HAVE_ARCH_KASAN=y -CONFIG_HAVE_ARCH_KASAN_VMALLOC=y -CONFIG_CC_HAS_KASAN_GENERIC=y -CONFIG_CC_HAS_WORKING_NOSANITIZE_ADDRESS=y -# CONFIG_KASAN is not set -CONFIG_HAVE_ARCH_KFENCE=y -# CONFIG_KFENCE is not set -CONFIG_HAVE_ARCH_KMSAN=y -# end of Memory Debugging - -# CONFIG_DEBUG_SHIRQ is not set - -# -# Debug Oops, Lockups and Hangs -# -# CONFIG_PANIC_ON_OOPS is not set -CONFIG_PANIC_ON_OOPS_VALUE=0 -CONFIG_PANIC_TIMEOUT=0 -# CONFIG_SOFTLOCKUP_DETECTOR is not set -CONFIG_HARDLOCKUP_CHECK_TIMESTAMP=y -# CONFIG_HARDLOCKUP_DETECTOR is not set -# CONFIG_DETECT_HUNG_TASK is not set -# CONFIG_WQ_WATCHDOG is not set -# CONFIG_TEST_LOCKUP is not set -# end of Debug Oops, Lockups and Hangs - -# -# Scheduler Debugging -# -CONFIG_SCHED_DEBUG=y -# CONFIG_SCHEDSTATS is not set -# end of Scheduler Debugging - -# CONFIG_DEBUG_TIMEKEEPING is not set - -# -# Lock Debugging (spinlocks, mutexes, etc...) -# -CONFIG_LOCK_DEBUGGING_SUPPORT=y -# CONFIG_PROVE_LOCKING is not set -# CONFIG_LOCK_STAT is not set -# CONFIG_DEBUG_RT_MUTEXES is not set -# CONFIG_DEBUG_SPINLOCK is not set -# CONFIG_DEBUG_MUTEXES is not set -# CONFIG_DEBUG_WW_MUTEX_SLOWPATH is not set -# CONFIG_DEBUG_RWSEMS is not set -# CONFIG_DEBUG_LOCK_ALLOC is not set -# CONFIG_DEBUG_ATOMIC_SLEEP is not set -# CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set -# CONFIG_LOCK_TORTURE_TEST is not set -# CONFIG_WW_MUTEX_SELFTEST is not set -# CONFIG_SCF_TORTURE_TEST is not set -# CONFIG_CSD_LOCK_WAIT_DEBUG is not set -# end of Lock Debugging (spinlocks, mutexes, etc...) - -# CONFIG_DEBUG_IRQFLAGS is not set -CONFIG_STACKTRACE=y -# CONFIG_WARN_ALL_UNSEEDED_RANDOM is not set -# CONFIG_DEBUG_KOBJECT is not set - -# -# Debug kernel data structures -# -# CONFIG_DEBUG_LIST is not set -# CONFIG_DEBUG_PLIST is not set -# CONFIG_DEBUG_SG is not set -# CONFIG_DEBUG_NOTIFIERS is not set -# CONFIG_BUG_ON_DATA_CORRUPTION is not set -# CONFIG_DEBUG_MAPLE_TREE is not set -# end of Debug kernel data structures - -# CONFIG_DEBUG_CREDENTIALS is not set - -# -# RCU Debugging -# -# CONFIG_RCU_SCALE_TEST is not set -# CONFIG_RCU_TORTURE_TEST is not set -# CONFIG_RCU_REF_SCALE_TEST is not set -CONFIG_RCU_CPU_STALL_TIMEOUT=21 -CONFIG_RCU_EXP_CPU_STALL_TIMEOUT=0 -CONFIG_RCU_TRACE=y -# CONFIG_RCU_EQS_DEBUG is not set -# end of RCU Debugging - -# CONFIG_DEBUG_WQ_FORCE_RR_CPU is not set -# CONFIG_CPU_HOTPLUG_STATE_CONTROL is not set -# CONFIG_LATENCYTOP is not set -CONFIG_USER_STACKTRACE_SUPPORT=y -CONFIG_HAVE_RETHOOK=y -CONFIG_HAVE_FUNCTION_TRACER=y -CONFIG_HAVE_DYNAMIC_FTRACE=y -CONFIG_HAVE_DYNAMIC_FTRACE_WITH_REGS=y -CONFIG_HAVE_DYNAMIC_FTRACE_WITH_DIRECT_CALLS=y -CONFIG_HAVE_DYNAMIC_FTRACE_WITH_ARGS=y -CONFIG_HAVE_DYNAMIC_FTRACE_NO_PATCHABLE=y -CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y -CONFIG_HAVE_SYSCALL_TRACEPOINTS=y -CONFIG_HAVE_FENTRY=y -CONFIG_HAVE_OBJTOOL_MCOUNT=y -CONFIG_HAVE_C_RECORDMCOUNT=y -CONFIG_HAVE_BUILDTIME_MCOUNT_SORT=y -CONFIG_TRACE_CLOCK=y -CONFIG_TRACING_SUPPORT=y -# CONFIG_FTRACE is not set -# CONFIG_PROVIDE_OHCI1394_DMA_INIT is not set -# CONFIG_SAMPLES is not set -CONFIG_HAVE_SAMPLE_FTRACE_DIRECT=y -CONFIG_HAVE_SAMPLE_FTRACE_DIRECT_MULTI=y -CONFIG_ARCH_HAS_DEVMEM_IS_ALLOWED=y - -# -# x86 Debugging -# -CONFIG_X86_VERBOSE_BOOTUP=y -CONFIG_EARLY_PRINTK=y -# CONFIG_EARLY_PRINTK_DBGP is not set -# CONFIG_EARLY_PRINTK_USB_XDBC is not set -# CONFIG_DEBUG_TLBFLUSH is not set -# CONFIG_IOMMU_DEBUG is not set -CONFIG_HAVE_MMIOTRACE_SUPPORT=y -# CONFIG_X86_DECODER_SELFTEST is not set -CONFIG_IO_DELAY_0X80=y -# CONFIG_IO_DELAY_0XED is not set -# CONFIG_IO_DELAY_UDELAY is not set -# CONFIG_IO_DELAY_NONE is not set -# CONFIG_CPA_DEBUG is not set -# CONFIG_DEBUG_ENTRY is not set -# CONFIG_DEBUG_NMI_SELFTEST is not set -CONFIG_X86_DEBUG_FPU=y -# CONFIG_PUNIT_ATOM_DEBUG is not set -CONFIG_UNWINDER_ORC=y -# CONFIG_UNWINDER_FRAME_POINTER is not set -# end of x86 Debugging - -# -# Kernel Testing and Coverage -# -# CONFIG_KUNIT is not set -# CONFIG_NOTIFIER_ERROR_INJECTION is not set -# CONFIG_FAULT_INJECTION is not set -CONFIG_ARCH_HAS_KCOV=y -CONFIG_CC_HAS_SANCOV_TRACE_PC=y -# CONFIG_KCOV is not set -# CONFIG_RUNTIME_TESTING_MENU is not set -CONFIG_ARCH_USE_MEMTEST=y -# CONFIG_MEMTEST is not set -# end of Kernel Testing and Coverage - -# -# Rust hacking -# -# end of Rust hacking -# end of Kernel hacking diff --git a/SPECS/kernel-uvm-cvm/kernel-uvm-cvm.signatures.json b/SPECS/kernel-uvm-cvm/kernel-uvm-cvm.signatures.json deleted file mode 100644 index 7e89093cdce..00000000000 --- a/SPECS/kernel-uvm-cvm/kernel-uvm-cvm.signatures.json +++ /dev/null @@ -1,6 +0,0 @@ -{ - "Signatures": { - "config": "559ba5969e8ad60fc68edb101533fa211dd04608281d7cd5fdd3d117d29b8a65", - "kernel-uvm-6.1.0.mshv14.tar.gz": "e4ab8637a532fd731b5c2aa2edfb719bbff8c9870282af0794c15c90b0c52097" - } -} diff --git a/SPECS/kernel-uvm-cvm/kernel-uvm-cvm.spec b/SPECS/kernel-uvm-cvm/kernel-uvm-cvm.spec deleted file mode 100644 index 94ae1ad496d..00000000000 --- a/SPECS/kernel-uvm-cvm/kernel-uvm-cvm.spec +++ /dev/null @@ -1,1215 +0,0 @@ -%global security_hardening none -%global debug_package %{nil} -%define uname_r %{version}-%{release}-cvm - -%ifarch x86_64 -%define arch x86_64 -%define archdir x86 -%define config_source %{SOURCE1} -%endif - -Summary: Linux Kernel for SEV SNP enabled Kata UVMs -Name: kernel-uvm-cvm -Version: 6.1.0.mshv14 -Release: 3%{?dist} -License: GPLv2 -Vendor: Microsoft Corporation -Distribution: Mariner -Group: System Environment/Kernel -Source0: %{_mariner_sources_url}/kernel-uvm-%{version}.tar.gz -Source1: config -BuildRequires: audit-devel -BuildRequires: bash -BuildRequires: bc -BuildRequires: cpio -BuildRequires: diffutils -BuildRequires: dwarves -BuildRequires: elfutils-libelf-devel -BuildRequires: glib-devel -BuildRequires: kbd -BuildRequires: kmod-devel -BuildRequires: libdnet-devel -BuildRequires: libmspack-devel -BuildRequires: openssl -BuildRequires: openssl-devel -BuildRequires: pam-devel -BuildRequires: procps-ng-devel -BuildRequires: python3-devel -BuildRequires: sed -Requires: filesystem -Requires: kmod -Requires(post): coreutils -Requires(postun): coreutils -ExclusiveArch: x86_64 - -# Config file is only an inmutable copy from default config in lsg dom0 sources (arch/x86/configs/mshv_default_config) -# to make permanent changes to config, make a PR for mshv_default_config in https://microsoft.visualstudio.com/DefaultCollection/LSG/_git/linux-dom0 - -# To make temporary changes: -# When updating the config files it is important to sanitize them. -# Steps for updating a config file: -# 1. Extract the linux sources into a folder -# 2. Add the current config file to the folder -# 3. Run `make menuconfig` to edit the file (Manually editing is not recommended) -# * You might have to install the following dependencies: libncurses5-dev flex -# 4. Save the config file -# 5. Copy the config file back into the kernel spec folder -# 6. Revert any undesired changes (GCC related changes, etc) -# 8. Build the kernel package -# 9. Apply the changes listed in the log file (if any) to the config file -# 10. Verify the rest of the config file looks ok -# If there are significant changes to the config file, disable the config check and build the -# kernel rpm. The final config file is included in /boot in the rpm. - -%ifarch x86_64 -%define image_fname vmlinux.bin -%define image arch/x86/boot/compressed/%{image_fname} -%if 0%{?centos_version} && 0%{?centos_version} < 900 -%define kcflags %{nil} -%else -%define kcflags -Wa,-mx86-used-note=no -%endif -%define arch x86_64 -%endif - -%description -The kernel UVM CVM package contains the Linux kernel for SEV SNP enabled UVMs. - -%package devel -Summary: Lightweight kernel Devel package -Group: System Environment/Kernel -Requires: %{name} = %{version}-%{release} - -%description devel -This package contains the kernel UVM CVM devel files - -%prep -tar xf %{SOURCE0} --strip-components=1 - -make mrproper - -cp %{config_source} .config -cp .config current_config -make LC_ALL= ARCH=%{arch} oldconfig - -# Verify the config files match -cp .config new_config -sed -i 's/CONFIG_LOCALVERSION=".*"/CONFIG_LOCALVERSION=""/' new_config -diff --unified new_config current_config > config_diff || true -if [ -s config_diff ]; then - printf "\n\n\n\n\n\n\n\n" - cat config_diff - printf "\n\n\n\n\n\n\n\n" - echo "Config file has unexpected changes" - echo "Update config file to set changed values explicitly" - -# (DISABLE THIS IF INTENTIONALLY UPDATING THE CONFIG FILE) - # exit 1 -fi - -%build -%ifarch x86_64 -KCFLAGS="%{kcflags}" make VERBOSE=1 KBUILD_BUILD_VERSION="1" KBUILD_BUILD_HOST="CBL-Mariner" ARCH=%{arch} %{?_smp_mflags} -%endif - -%install -install -vdm 755 %{buildroot}%{_prefix}/src/linux-headers-%{uname_r} -install -vdm 755 %{buildroot}/lib/modules/%{uname_r} - -D=%{buildroot}%{_datadir}/cloud-hypervisor-cvm -install -D -m 644 %{image} $D/%{image_fname} -install -D -m 644 arch/%{arch}/boot/bzImage $D/bzImage -%ifarch x86_64 -mkdir -p %{buildroot}/lib/modules/%{name} -ln -s %{_datadir}/cloud-hypervisor-cvm/%{image_fname} %{buildroot}/lib/modules/%{name}/vmlinux -%endif - -find . -name Makefile* -o -name Kconfig* -o -name *.pl | xargs sh -c 'cp --parents "$@" %{buildroot}%{_prefix}/src/linux-headers-%{uname_r}' copy -find arch/%{archdir}/include include scripts -type f | xargs sh -c 'cp --parents "$@" %{buildroot}%{_prefix}/src/linux-headers-%{uname_r}' copy -find $(find arch/%{archdir} -name include -o -name scripts -type d) -type f | xargs sh -c 'cp --parents "$@" %{buildroot}%{_prefix}/src/linux-headers-%{uname_r}' copy -find arch/%{archdir}/include Module.symvers include scripts -type f | xargs sh -c 'cp --parents "$@" %{buildroot}%{_prefix}/src/linux-headers-%{uname_r}' copy -%ifarch x86_64 -# CONFIG_STACK_VALIDATION=y requires objtool to build external modules -install -vsm 755 tools/objtool/objtool %{buildroot}%{_prefix}/src/linux-headers-%{uname_r}/tools/objtool/ -install -vsm 755 tools/objtool/fixdep %{buildroot}%{_prefix}/src/linux-headers-%{uname_r}/tools/objtool/ -%endif - -cp .config %{buildroot}%{_prefix}/src/linux-headers-%{uname_r} # copy .config manually to be where it's expected to be -ln -sf "%{_prefix}/src/linux-headers-%{uname_r}" "%{buildroot}/lib/modules/%{uname_r}/build" -find %{buildroot}/lib/modules -name '*.ko' -exec chmod u+x {} + - -%files -%defattr(-,root,root) -%license COPYING -%{_datadir}/cloud-hypervisor-cvm/%{image_fname} -%{_datadir}/cloud-hypervisor-cvm/bzImage -%dir %{_datadir}/cloud-hypervisor-cvm -%ifarch x86_64 -/lib/modules/%{name}/vmlinux -%endif - -%files devel -%defattr(-,root,root) -/lib/modules/%{uname_r}/build -%{_prefix}/src/linux-headers-%{uname_r} - -%changelog -* Wed Nov 29 2023 Manuel Huber - 6.1.0.mshv14-3 -- Enable tmpfs xattr for supporting use of extended attributes when container - rootfs is an overlayfs with tmps as upper dir as with tardev-snapshotter - -* Mon Nov 20 2023 Rachel Menge - 6.1.0.mshv14-2 -- Add cpio as BuildRequires - -* Mon Nov 6 2023 Dallas Delaney - 6.1.0.mshv14-1 -- Update to v6.1.0.mshv14 - -* Fri Oct 06 2023 Manuel Huber - 6.1.0.mshv11-2 -- Enable dm-crypt and dm-integrity for encfs sidecar functionality - -* Thu Sep 15 2023 Saul Paredes - 6.1.0.mshv11-1 -- Update to v6.1.0.mshv11 - -* Fri Sep 15 2023 Saul Paredes - 6.1.0.mshv10-1 -- Update to v6.1.0.mshv10 - -* Mon Aug 28 2023 Saul Paredes - 6.1.0.mshv8-1 -- Update to v6.1.0.mshv8 - -* Wed Aug 18 2023 Dallas Delaney - 5.15.110.mshv2-5 -- Add back debug logs for config change warning - -* Wed Aug 18 2023 Dallas Delaney - 5.15.110.mshv2-4 -- Align config with UVM from LSG - -* Wed May 31 2023 Dallas Delaney - 5.15.110.mshv2-2 -- Enable dm-verity - -* Fri May 12 2023 Saul Paredes - 5.15.110.mshv2-1 -- Update to v5.15.110.mshv2 - -* Mon May 1 2023 Dallas Delaney - 5.15.98.mshv1-4 -- Install the bzImage - -* Thu Apr 6 2023 Chris Co - 5.15.98.mshv1-3 -- Generate devel subpackage and enable loadable kernel module support - -* Thu Apr 6 2023 Saul Paredes 5.15.98.mshv1-2 -- Remove aarch64 build instructions - -* Fri Mar 24 2023 Saul Paredes 5.15.98.mshv1-1 -- Consume source and config from dom0 - -* Thu Feb 23 2023 Aurélien Bombo - 5.15.48.1-9 -- Enable Hyper-V enlightenments. - -* Mon Sep 12 2022 Neha Agarwal - 5.15.48.1-8 -- Create modules folder and copy vmlinux - -* Tue Aug 30 2022 Chris Co - 5.15.48.1-7 -- Trim spec to only necessary components for UVM - -* Fri Aug 26 2022 Max Brodeur-Urbas - 5.15.48.1-6 -- Creating kernel configuration specifically for kata uvm purposes - -* Fri Jul 08 2022 Francis Laniel - 5.15.48.1-5 -- Add back CONFIG_FTRACE_SYSCALLS to enable eBPF CO-RE syscalls tracers. -- Add CONFIG_IKHEADERS=m to enable eBPF standard tracers. - -* Mon Jun 27 2022 Neha Agarwal - 5.15.48.1-4 -- Remove 'quiet' from commandline to enable verbose log - -* Mon Jun 27 2022 Henry Beberman - 5.15.48.1-3 -- Enable CONFIG_VIRTIO_FS=m and CONFIG_FUSE_DAX=y -- Symlink /lib/modules/uname/vmlinuz to /boot/vmlinuz-uname to improve compat with scripts seeking the kernel. - -* Wed Jun 22 2022 Max Brodeur-Urbas - 5.15.48.1-2 -- Enabling Vgem driver in config. - -* Fri Jun 17 2022 Neha Agarwal - 5.15.48.1-1 -- Update source to 5.15.48.1 - -* Tue Jun 14 2022 Pawel Winogrodzki - 5.15.45.1-2 -- Moving ".config" update and check steps into the %%prep section. - -* Thu Jun 09 2022 Cameron Baird - 5.15.45.1-1 -- Update source to 5.15.45.1 -- Address CVE-2022-32250 with a nopatch - -* Mon Jun 06 2022 Max Brodeur-Urbas - 5.15.41.1-4 -- Compiling ptp_kvm driver as a module - -* Wed Jun 01 2022 Pawel Winogrodzki - 5.15.41.1-3 -- Enabling "LIVEPATCH" config option. - -* Thu May 26 2022 Minghe Ren - 5.15.41.1-2 -- Disable SMACK kernel configuration - -* Tue May 24 2022 Cameron Baird - 5.15.41.1-1 -- Update source to 5.15.41.1 -- Nopatch CVE-2020-35501, CVE-2022-28893, CVE-2022-29581 - -* Mon May 23 2022 Neha Agarwal - 5.15.37.1-3 -- Fix configs to bring down initrd boot time - -* Mon May 16 2022 Neha Agarwal - 5.15.37.1-2 -- Fix cdrom, hyperv-mouse, kexec and crash-on-demand config in aarch64 - -* Mon May 09 2022 Neha Agarwal - 5.15.37.1-1 -- Update source to 5.15.37.1 -- Nopatch CVE-2021-4095, CVE-2022-0500, CVE-2022-0998, CVE-2022-28796, CVE-2022-29582, - CVE-2022-1048, CVE-2022-1195, CVE-2022-1353, CVE-2022-29968, CVE-2022-1015 -- Enable IFB config - -* Tue Apr 19 2022 Cameron Baird - 5.15.34.1-1 -- Update source to 5.15.34.1 -- Clean up nopatches in Patch list, no longer needed for CVE automation -- Nopatch CVE-2022-28390, CVE-2022-28389, CVE-2022-28388, CVE-2022-28356, CVE-2022-0435, - CVE-2021-4202, CVE-2022-27950, CVE-2022-0433, CVE-2022-0494, CVE-2022-0330, CVE-2022-0854, - CVE-2021-4197, CVE-2022-29156 - -* Tue Apr 19 2022 Max Brodeur-Urbas - 5.15.32.1-3 -- Remove kernel lockdown config from grub envblock - -* Tue Apr 12 2022 Andrew Phelps - 5.15.32.1-2 -- Remove trace symlink from _bindir -- Exclude files and directories under the debug folder from kernel and kernel-tools packages -- Remove BR for xerces-c-devel - -* Fri Apr 08 2022 Neha Agarwal - 5.15.32.1-1 -- Update source to 5.15.32.1 -- Address CVES: 2022-0516, 2022-26878, 2022-27223, 2022-24958, 2022-0742, - 2022-1011, 2022-26490, 2021-4002 -- Enable MANA driver config -- Address CVEs 2022-0995, 2022-1055, 2022-27666 - -* Tue Apr 05 2022 Henry Li - 5.15.26.1-4 -- Add Dell devices support - -* Mon Mar 28 2022 Rachel Menge - 5.15.26.1-3 -- Remove hardcoded mariner.pem from configs and instead insert during - the build phase - -* Mon Mar 14 2022 Vince Perri - 5.15.26.1-2 -- Add support for compressed firmware - -* Tue Mar 08 2022 cameronbaird - 5.15.26.1-1 -- Update source to 5.15.26.1 -- Address CVES: 2022-0617, 2022-25375, 2022-25258, 2021-4090, 2022-25265, - 2021-45402, 2022-0382, 2022-0185, 2021-44879, 2022-24959, 2022-0264, - 2022-24448, 2022-24122, 2021-20194, 2022-0847, 1999-0524, 2008-4609, - 2010-0298, 2010-4563, 2011-0640, 2022-0492, 2021-3743, 2022-26966 - -* Mon Mar 07 2022 George Mileka - 5.15.18.1-5 -- Enabled vfio noiommu. - -* Fri Feb 25 2022 Henry Li - 5.15.18.1-4 -- Enable CONFIG_DEVMEM, CONFIG_STRICT_DEVMEM and CONFIG_IO_STRICT_DEVMEM - -* Thu Feb 24 2022 Cameron Baird - 5.15.18.1-3 -- CONFIG_BPF_UNPRIV_DEFAULT_OFF=y - -* Thu Feb 24 2022 Suresh Babu Chalamalasetty - 5.15.18.1-2 -- Add usbip required kernel configs CONFIG_USBIP_CORE CONFIG_USBIP_VHCI_HCD - -* Mon Feb 07 2022 Cameron Baird - 5.15.18.1-1 -- Update source to 5.15.18.1 -- Address CVE-2010-0309, CVE-2018-1000026, CVE-2018-16880, CVE-2019-3016, - CVE-2019-3819, CVE-2019-3887, CVE-2020-25672, CVE-2021-3564, CVE-2021-45095, - CVE-2021-45469, CVE-2021-45480 - -* Thu Feb 03 2022 Henry Li - 5.15.2.1-5 -- Enable CONFIG_X86_SGX and CONFIG_X86_SGX_KVM - -* Wed Feb 02 2022 Rachel Menge - 5.15.2.1-4 -- Add libperf-jvmti.so to tools package - -* Thu Jan 27 2022 Daniel Mihai - 5.15.2.1-3 -- Enable kdb frontend for kgdb - -* Sun Jan 23 2022 Chris Co - 5.15.2.1-2 -- Rotate Mariner cert - -* Thu Jan 06 2022 Rachel Menge - 5.15.2.1-1 -- Update source to 5.15.2.1 - -* Tue Jan 04 2022 Suresh Babu Chalamalasetty - 5.10.78.1-3 -- Add provides exclude for debug build-id for aarch64 to generate debuginfo rpm -- Fix missing brackets for __os_install_post. - -* Tue Dec 28 2021 Suresh Babu Chalamalasetty - 5.10.78.1-2 -- Enable CONFIG_COMPAT kernel configs - -* Tue Nov 23 2021 Rachel Menge - 5.10.78.1-1 -- Update source to 5.10.78.1 -- Address CVE-2021-43267, CVE-2021-42739, CVE-2021-42327, CVE-2021-43389 -- Add patch to fix SPDX-License-Identifier in headers - -* Mon Nov 15 2021 Thomas Crain - 5.10.74.1-4 -- Add python3-perf subpackage and add python3-devel to build-time requirements -- Exclude accessibility modules from main package to avoid subpackage conflict -- Remove redundant License tag from bpftool subpackage - -* Thu Nov 04 2021 Andrew Phelps - 5.10.74.1-3 -- Update configs for gcc 11.2.0 and binutils 2.37 updates - -* Tue Oct 26 2021 Rachel Menge - 5.10.74.1-2 -- Update configs for eBPF support -- Add dwarves Build-requires - -* Tue Oct 19 2021 Rachel Menge - 5.10.74.1-1 -- Update source to 5.10.74.1 -- Address CVE-2021-41864, CVE-2021-42252 -- License verified - -* Thu Oct 07 2021 Rachel Menge - 5.10.69.1-1 -- Update source to 5.10.69.1 -- Address CVE-2021-38300, CVE-2021-41073, CVE-2021-3653, CVE-2021-42008 - -* Wed Sep 22 2021 Rachel Menge - 5.10.64.1-2 -- Enable CONFIG_NET_VRF -- Add vrf to drivers argument for dracut - -* Mon Sep 20 2021 Rachel Menge - 5.10.64.1-1 -- Update source to 5.10.64.1 - -* Fri Sep 17 2021 Rachel Menge - 5.10.60.1-1 -- Remove cn from dracut drivers argument -- Update source to 5.10.60.1 -- Address CVE-2021-38166, CVE-2021-38205, CVE-2021-3573 - CVE-2021-37576, CVE-2021-34556, CVE-2021-35477, CVE-2021-28691, - CVE-2021-3564, CVE-2020-25639, CVE-2021-29657, CVE-2021-38199, - CVE-2021-38201, CVE-2021-38202, CVE-2021-38207, CVE-2021-38204, - CVE-2021-38206, CVE-2021-38208, CVE-2021-38200, CVE-2021-38203, - CVE-2021-38160, CVE-2021-3679, CVE-2021-38198, CVE-2021-38209, - CVE-2021-3655 -- Add patch to fix VDSO in HyperV - -* Thu Sep 09 2021 Muhammad Falak - 5.10.52.1-2 -- Export `bpftool` subpackage - -* Tue Jul 20 2021 Rachel Menge - 5.10.52.1-1 -- Update source to 5.10.52.1 -- Address CVE-2021-35039, CVE-2021-33909 - -* Mon Jul 19 2021 Chris Co - 5.10.47.1-2 -- Enable CONFIG_CONNECTOR and CONFIG_PROC_EVENTS - -* Tue Jul 06 2021 Rachel Menge - 5.10.47.1-1 -- Update source to 5.10.47.1 -- Address CVE-2021-34693, CVE-2021-33624 - -* Wed Jun 30 2021 Chris Co - 5.10.42.1-4 -- Enable legacy mcelog config - -* Tue Jun 22 2021 Suresh Babu Chalamalasetty - 5.10.42.1-3 -- Enable CONFIG_IOSCHED_BFQ and CONFIG_BFQ_GROUP_IOSCHED configs - -* Wed Jun 16 2021 Chris Co - 5.10.42.1-2 -- Enable CONFIG_CROSS_MEMORY_ATTACH - -* Tue Jun 08 2021 Rachel Menge - 5.10.42.1-1 -- Update source to 5.10.42.1 -- Address CVE-2021-33200 - -* Thu Jun 03 2021 Rachel Menge - 5.10.37.1-2 -- Address CVE-2020-25672 - -* Fri May 28 2021 Rachel Menge - 5.10.37.1-1 -- Update source to 5.10.37.1 -- Address CVE-2021-23134, CVE-2021-29155, CVE-2021-31829, CVE-2021-31916, - CVE-2021-32399, CVE-2021-33033, CVE-2021-33034, CVE-2021-3483 - CVE-2021-3501, CVE-2021-3506 - -* Thu May 27 2021 Chris Co - 5.10.32.1-7 -- Set lockdown=integrity by default - -* Wed May 26 2021 Chris Co - 5.10.32.1-6 -- Add Mariner cert into the trusted kernel keyring - -* Tue May 25 2021 Daniel Mihai - 5.10.32.1-5 -- Enable kernel debugger - -* Thu May 20 2021 Nicolas Ontiveros - 5.10.32.1-4 -- Bump release number to match kernel-signed update - -* Mon May 17 2021 Andrew Phelps - 5.10.32.1-3 -- Update CONFIG_LD_VERSION for binutils 2.36.1 -- Remove build-id match check - -* Thu May 13 2021 Rachel Menge - 5.10.32.1-2 -- Add CONFIG_AS_HAS_LSE_ATOMICS=y - -* Mon May 03 2021 Rachel Menge - 5.10.32.1-1 -- Update source to 5.10.32.1 -- Address CVE-2021-23133, CVE-2021-29154, CVE-2021-30178 - -* Thu Apr 22 2021 Chris Co - 5.10.28.1-4 -- Disable CONFIG_EFI_DISABLE_PCI_DMA. It can cause boot issues on some hardware. - -* Mon Apr 19 2021 Chris Co - 5.10.28.1-3 -- Bump release number to match kernel-signed update - -* Thu Apr 15 2021 Rachel Menge - 5.10.28.1-2 -- Address CVE-2021-29648 - -* Thu Apr 08 2021 Chris Co - 5.10.28.1-1 -- Update source to 5.10.28.1 -- Update uname_r define to match the new value derived from the source -- Address CVE-2020-27170, CVE-2020-27171, CVE-2021-28375, CVE-2021-28660, - CVE-2021-28950, CVE-2021-28951, CVE-2021-28952, CVE-2021-28971, - CVE-2021-28972, CVE-2021-29266, CVE-2021-28964, CVE-2020-35508, - CVE-2020-16120, CVE-2021-29264, CVE-2021-29265, CVE-2021-29646, - CVE-2021-29647, CVE-2021-29649, CVE-2021-29650, CVE-2021-30002 - -* Fri Mar 26 2021 Daniel Mihai - 5.10.21.1-4 -- Enable CONFIG_CRYPTO_DRBG_HASH, CONFIG_CRYPTO_DRBG_CTR - -* Thu Mar 18 2021 Chris Co - 5.10.21.1-3 -- Address CVE-2021-27365, CVE-2021-27364, CVE-2021-27363 -- Enable CONFIG_FANOTIFY_ACCESS_PERMISSIONS - -* Wed Mar 17 2021 Nicolas Ontiveros - 5.10.21.1-2 -- Disable QAT kernel configs - -* Thu Mar 11 2021 Chris Co - 5.10.21.1-1 -- Update source to 5.10.21.1 -- Add virtio drivers to be installed into initrd -- Address CVE-2021-26930, CVE-2020-35499, CVE-2021-26931, CVE-2021-26932 - -* Fri Mar 05 2021 Chris Co - 5.10.13.1-4 -- Enable kernel lockdown config - -* Thu Mar 04 2021 Suresh Babu Chalamalasetty - 5.10.13.1-3 -- Add configs for CONFIG_BNXT bnxt_en and MSR drivers - -* Mon Feb 22 2021 Thomas Crain - 5.10.13.1-2 -- Add configs for speakup and uinput drivers -- Add kernel-drivers-accessibility subpackage - -* Thu Feb 18 2021 Chris Co - 5.10.13.1-1 -- Update source to 5.10.13.1 -- Remove patch to publish efi tpm event log on ARM. Present in updated source. -- Remove patch for arm64 hyperv support. Present in updated source. -- Account for new module.lds location on aarch64 -- Remove CONFIG_GCC_PLUGIN_RANDSTRUCT -- Add CONFIG_SCSI_SMARTPQI=y - -* Thu Feb 11 2021 Nicolas Ontiveros - 5.4.91-5 -- Add configs to enable tcrypt in FIPS mode - -* Tue Feb 09 2021 Nicolas Ontiveros - 5.4.91-4 -- Use OpenSSL to perform HMAC calc - -* Thu Jan 28 2021 Nicolas Ontiveros - 5.4.91-3 -- Add configs for userspace crypto support -- HMAC calc the kernel for FIPS - -* Wed Jan 27 2021 Daniel McIlvaney - 5.4.91-2 -- Enable dm-verity boot support with FEC - -* Wed Jan 20 2021 Chris Co - 5.4.91-1 -- Update source to 5.4.91 -- Address CVE-2020-29569, CVE-2020-28374, CVE-2020-36158 -- Remove patch to fix GUI installer crash. Fixed in updated source. - -* Tue Jan 12 2021 Rachel Menge - 5.4.83-4 -- Add imx8mq support - -* Sat Jan 09 2021 Andrew Phelps - 5.4.83-3 -- Add patch to fix GUI installer crash - -* Mon Dec 28 2020 Nicolas Ontiveros - 5.4.83-2 -- Address CVE-2020-27777 - -* Tue Dec 15 2020 Henry Beberman - 5.4.83-1 -- Update source to 5.4.83 -- Address CVE-2020-14351, CVE-2020-14381, CVE-2020-25656, CVE-2020-25704, - CVE-2020-29534, CVE-2020-29660, CVE-2020-29661 - -* Fri Dec 04 2020 Chris Co - 5.4.81-1 -- Update source to 5.4.81 -- Remove patch for kexec in HyperV. Integrated in 5.4.81. -- Address CVE-2020-25705, CVE-2020-15436, CVE-2020-28974, CVE-2020-29368, - CVE-2020-29369, CVE-2020-29370, CVE-2020-29374, CVE-2020-29373, CVE-2020-28915, - CVE-2020-28941, CVE-2020-27675, CVE-2020-15437, CVE-2020-29371, CVE-2020-29372, - CVE-2020-27194, CVE-2020-27152 - -* Wed Nov 25 2020 Chris Co - 5.4.72-5 -- Add patch to publish efi tpm event log on ARM - -* Mon Nov 23 2020 Chris Co - 5.4.72-4 -- Apply patch to fix kexec in HyperV - -* Mon Nov 16 2020 Suresh Babu Chalamalasetty - 5.4.72-3 -- Disable kernel config SLUB_DEBUG_ON due to tcp throughput perf impact - -* Tue Nov 10 2020 Suresh Babu Chalamalasetty - 5.4.72-2 -- Enable kernel configs for Arm64 HyperV, Ampere and Cavium SoCs support - -* Mon Oct 26 2020 Chris Co - 5.4.72-1 -- Update source to 5.4.72 -- Remove patch to support CometLake e1000e ethernet. Integrated in 5.4.72. -- Add license file -- Lint spec -- Address CVE-2018-1000026, CVE-2018-16880, CVE-2020-12464, CVE-2020-12465, - CVE-2020-12659, CVE-2020-15780, CVE-2020-14356, CVE-2020-14386, CVE-2020-25645, - CVE-2020-25643, CVE-2020-25211, CVE-2020-25212, CVE-2008-4609, CVE-2020-14331, - CVE-2010-0298, CVE-2020-10690, CVE-2020-25285, CVE-2020-10711, CVE-2019-3887, - CVE-2020-14390, CVE-2019-19338, CVE-2019-20810, CVE-2020-10766, CVE-2020-10767, - CVE-2020-10768, CVE-2020-10781, CVE-2020-12768, CVE-2020-14314, CVE-2020-14385, - CVE-2020-25641, CVE-2020-26088, CVE-2020-10942, CVE-2020-12826, CVE-2019-3016, - CVE-2019-3819, CVE-2020-16166, CVE-2020-11608, CVE-2020-11609, CVE-2020-25284, - CVE-2020-12888, CVE-2017-8244, CVE-2017-8245, CVE-2017-8246, CVE-2009-4484, - CVE-2015-5738, CVE-2007-4998, CVE-2010-0309, CVE-2011-0640, CVE-2020-12656, - CVE-2011-2519, CVE-1999-0656, CVE-2010-4563, CVE-2019-20794, CVE-1999-0524 - -* Fri Oct 16 2020 Suresh Babu Chalamalasetty - 5.4.51-11 -- Enable QAT kernel configs - -* Fri Oct 02 2020 Chris Co - 5.4.51-10 -- Address CVE-2020-10757, CVE-2020-12653, CVE-2020-12657, CVE-2010-3865, - CVE-2020-11668, CVE-2020-12654, CVE-2020-24394, CVE-2020-8428 - -* Fri Oct 02 2020 Chris Co - 5.4.51-9 -- Fix aarch64 build error - -* Wed Sep 30 2020 Emre Girgin - 5.4.51-8 -- Update postun script to deal with removal in case of another installed kernel. - -* Fri Sep 25 2020 Suresh Babu Chalamalasetty - 5.4.51-7 -- Enable Mellanox kernel configs - -* Wed Sep 23 2020 Daniel McIlvaney - 5.4.51-6 -- Enable CONFIG_IMA (measurement only) and associated configs - -* Thu Sep 03 2020 Daniel McIlvaney - 5.4.51-5 -- Add code to check for missing config flags in the checked in configs - -* Thu Sep 03 2020 Chris Co - 5.4.51-4 -- Apply additional kernel hardening configs - -* Thu Sep 03 2020 Chris Co - 5.4.51-3 -- Bump release number due to kernel-signed- package update -- Minor aarch64 config and changelog cleanup - -* Tue Sep 01 2020 Chris Co - 5.4.51-2 -- Update source hash - -* Wed Aug 19 2020 Chris Co - 5.4.51-1 -- Update source to 5.4.51 -- Enable DXGKRNL config -- Address CVE-2020-11494, CVE-2020-11565, CVE-2020-12655, CVE-2020-12771, - CVE-2020-13974, CVE-2020-15393, CVE-2020-8647, CVE-2020-8648, CVE-2020-8649, - CVE-2020-9383, CVE-2020-11725 - -* Wed Aug 19 2020 Chris Co - 5.4.42-12 -- Remove the signed package depends - -* Tue Aug 18 2020 Chris Co - 5.4.42-11 -- Remove signed subpackage - -* Mon Aug 17 2020 Chris Co - 5.4.42-10 -- Enable BPF, PC104, userfaultfd, SLUB sysfs, SMC, XDP sockets monitoring configs - -* Fri Aug 07 2020 Mateusz Malisz - 5.4.42-9 -- Add crashkernel=128M to the kernel cmdline -- Update config to support kexec and kexec_file_load - -* Tue Aug 04 2020 Pawel Winogrodzki - 5.4.42-8 -- Updating "KBUILD_BUILD_VERSION" and "KBUILD_BUILD_HOST" with correct - distribution name. - -* Wed Jul 22 2020 Chris Co - 5.4.42-7 -- Address CVE-2020-8992, CVE-2020-12770, CVE-2020-13143, CVE-2020-11884 - -* Fri Jul 17 2020 Suresh Babu Chalamalasetty - 5.4.42-6 -- Enable CONFIG_MLX5_CORE_IPOIB and CONFIG_INFINIBAND_IPOIB config flags - -* Fri Jul 17 2020 Suresh Babu Chalamalasetty - 5.4.42-5 -- Adding XDP config flag - -* Thu Jul 09 2020 Anand Muthurajan - 5.4.42-4 -- Enable CONFIG_QED, CONFIG_QEDE, CONFIG_QED_SRIOV and CONFIG_QEDE_VXLAN flags - -* Wed Jun 24 2020 Chris Co - 5.4.42-3 -- Regenerate input config files - -* Fri Jun 19 2020 Chris Co - 5.4.42-2 -- Add kernel-secure subpackage and macros for adding offline signed kernels - -* Fri Jun 12 2020 Chris Co - 5.4.42-1 -- Update source to 5.4.42 - -* Thu Jun 11 2020 Chris Co - 5.4.23-17 -- Enable PAGE_POISONING configs -- Disable PROC_KCORE config -- Enable RANDOM_TRUST_CPU config for x86_64 - -* Fri Jun 05 2020 Suresh Babu Chalamalasetty - 5.4.23-16 -- Adding BPF config flags - -* Thu Jun 04 2020 Chris Co - 5.4.23-15 -- Add config support for USB video class devices - -* Wed Jun 03 2020 Nicolas Ontiveros - 5.4.23-14 -- Add CONFIG_CRYPTO_XTS=y to config. - -* Wed Jun 03 2020 Chris Co - 5.4.23-13 -- Add patch to support CometLake e1000e ethernet -- Remove drivers-gpu subpackage -- Inline the initramfs trigger and postun source files -- Remove rpi3 dtb and ls1012 dtb subpackages - -* Wed May 27 2020 Chris Co - 5.4.23-12 -- Update arm64 security configs -- Disable devmem in x86_64 config - -* Tue May 26 2020 Daniel Mihai - 5.4.23-11 -- Disabled Reliable Datagram Sockets protocol (CONFIG_RDS). - -* Fri May 22 2020 Emre Girgin - 5.4.23-10 -- Change /boot directory permissions to 600. - -* Thu May 21 2020 Chris Co - 5.4.23-9 -- Update x86_64 security configs - -* Wed May 20 2020 Suresh Babu Chalamalasetty - 5.4.23-8 -- Adding InfiniBand config flags - -* Mon May 11 2020 Anand Muthurajan - 5.4.23-7 -- Adding PPP config flags - -* Tue Apr 28 2020 Emre Girgin - 5.4.23-6 -- Renaming Linux-PAM to pam - -* Tue Apr 28 2020 Emre Girgin - 5.4.23-5 -- Renaming linux to kernel - -* Tue Apr 14 2020 Emre Girgin - 5.4.23-4 -- Remove linux-aws and linux-esx references. -- Remove kat_build usage. -- Remove ENA module. - -* Fri Apr 10 2020 Emre Girgin - 5.4.23-3 -- Remove xml-security-c dependency. - -* Wed Apr 08 2020 Nicolas Ontiveros - 5.4.23-2 -- Remove toybox and only use coreutils for requires. - -* Tue Dec 10 2019 Chris Co - 5.4.23-1 -- Update to Microsoft Linux Kernel 5.4.23 -- Remove patches -- Update ENA module to 2.1.2 to work with Linux 5.4.23 -- Remove xr module -- Remove Xen tmem module from dracut module list to fix initramfs creation -- Add patch to fix missing trans_pgd header in aarch64 build - -* Fri Oct 11 2019 Henry Beberman - 4.19.52-8 -- Enable Hyper-V TPM in config - -* Tue Sep 03 2019 Mateusz Malisz - 4.19.52-7 -- Initial CBL-Mariner import from Photon (license: Apache2). - -* Thu Jul 25 2019 Keerthana K - 4.19.52-6 -- Fix postun scriplet. - -* Thu Jul 11 2019 Keerthana K - 4.19.52-5 -- Enable kernel configs necessary for BPF Compiler Collection (BCC). - -* Wed Jul 10 2019 Srivatsa S. Bhat (VMware) 4.19.52-4 -- Deprecate linux-aws-tools in favor of linux-tools. - -* Tue Jul 02 2019 Alexey Makhalov - 4.19.52-3 -- Fix 9p vsock 16bit port issue. - -* Thu Jun 20 2019 Tapas Kundu - 4.19.52-2 -- Enabled CONFIG_I2C_CHARDEV to support lm-sensors - -* Mon Jun 17 2019 Srivatsa S. Bhat (VMware) 4.19.52-1 -- Update to version 4.19.52 -- Fix CVE-2019-12456, CVE-2019-12379, CVE-2019-12380, CVE-2019-12381, -- CVE-2019-12382, CVE-2019-12378, CVE-2019-12455 - -* Tue May 28 2019 Srivatsa S. Bhat (VMware) 4.19.40-3 -- Change default I/O scheduler to 'deadline' to fix performance issue. - -* Tue May 14 2019 Keerthana K - 4.19.40-2 -- Fix to parse through /boot folder and update symlink (/boot/photon.cfg) if -- mulitple kernels are installed and current linux kernel is removed. - -* Tue May 07 2019 Ajay Kaher - 4.19.40-1 -- Update to version 4.19.40 - -* Thu Apr 11 2019 Srivatsa S. Bhat (VMware) 4.19.32-3 -- Update config_aarch64 to fix ARM64 build. - -* Fri Mar 29 2019 Srivatsa S. Bhat (VMware) 4.19.32-2 -- Fix CVE-2019-10125 - -* Wed Mar 27 2019 Srivatsa S. Bhat (VMware) 4.19.32-1 -- Update to version 4.19.32 - -* Thu Mar 14 2019 Srivatsa S. Bhat (VMware) 4.19.29-1 -- Update to version 4.19.29 - -* Tue Mar 05 2019 Ajay Kaher - 4.19.26-1 -- Update to version 4.19.26 - -* Thu Feb 21 2019 Him Kalyan Bordoloi - 4.19.15-3 -- Fix CVE-2019-8912 - -* Thu Jan 24 2019 Alexey Makhalov - 4.19.15-2 -- Add WiFi (ath10k), sensors (i2c,spi), usb support for NXP LS1012A board. - -* Tue Jan 15 2019 Srivatsa S. Bhat (VMware) 4.19.15-1 -- Update to version 4.19.15 - -* Fri Jan 11 2019 Srinidhi Rao - 4.19.6-7 -- Add Network support for NXP LS1012A board. - -* Wed Jan 09 2019 Ankit Jain - 4.19.6-6 -- Enable following for x86_64 and aarch64: -- Enable Kernel Address Space Layout Randomization. -- Enable CONFIG_SECURITY_NETWORK_XFRM - -* Fri Jan 04 2019 Srivatsa S. Bhat (VMware) 4.19.6-5 -- Enable AppArmor by default. - -* Wed Jan 02 2019 Alexey Makhalov - 4.19.6-4 -- .config: added Compulab fitlet2 device drivers -- .config_aarch64: added gpio sysfs support -- renamed -sound to -drivers-sound - -* Tue Jan 01 2019 Ajay Kaher - 4.19.6-3 -- .config: Enable CONFIG_PCI_HYPERV driver - -* Wed Dec 19 2018 Srinidhi Rao - 4.19.6-2 -- Add NXP LS1012A support. - -* Mon Dec 10 2018 Srivatsa S. Bhat (VMware) 4.19.6-1 -- Update to version 4.19.6 - -* Fri Dec 07 2018 Alexey Makhalov - 4.19.1-3 -- .config: added qmi wwan module - -* Mon Nov 12 2018 Ajay Kaher - 4.19.1-2 -- Fix config_aarch64 for 4.19.1 - -* Mon Nov 05 2018 Srivatsa S. Bhat (VMware) 4.19.1-1 -- Update to version 4.19.1 - -* Tue Oct 16 2018 Him Kalyan Bordoloi - 4.18.9-5 -- Change in config to enable drivers for zigbee and GPS - -* Fri Oct 12 2018 Ajay Kaher - 4.18.9-4 -- Enable LAN78xx for aarch64 rpi3 - -* Fri Oct 5 2018 Ajay Kaher - 4.18.9-3 -- Fix config_aarch64 for 4.18.9 -- Add module.lds for aarch64 - -* Wed Oct 03 2018 Srivatsa S. Bhat 4.18.9-2 -- Use updated steal time accounting patch. -- .config: Enable CONFIG_CPU_ISOLATION and a few networking options -- that got accidentally dropped in the last update. - -* Mon Oct 1 2018 Srivatsa S. Bhat 4.18.9-1 -- Update to version 4.18.9 - -* Tue Sep 25 2018 Ajay Kaher - 4.14.67-2 -- Build hang (at make oldconfig) fix in config_aarch64 - -* Wed Sep 19 2018 Srivatsa S. Bhat 4.14.67-1 -- Update to version 4.14.67 - -* Tue Sep 18 2018 Srivatsa S. Bhat 4.14.54-7 -- Add rdrand-based RNG driver to enhance kernel entropy. - -* Sun Sep 02 2018 Srivatsa S. Bhat 4.14.54-6 -- Add full retpoline support by building with retpoline-enabled gcc. - -* Thu Aug 30 2018 Srivatsa S. Bhat 4.14.54-5 -- Apply out-of-tree patches needed for AppArmor. - -* Wed Aug 22 2018 Alexey Makhalov - 4.14.54-4 -- Fix overflow kernel panic in rsi driver. -- .config: enable BT stack, enable GPIO sysfs. -- Add Exar USB serial driver. - -* Fri Aug 17 2018 Ajay Kaher - 4.14.54-3 -- Enabled USB PCI in config_aarch64 -- Build hang (at make oldconfig) fix in config_aarch64 - -* Thu Jul 19 2018 Alexey Makhalov - 4.14.54-2 -- .config: usb_serial_pl2303=m,wlan=y,can=m,gpio=y,pinctrl=y,iio=m - -* Mon Jul 09 2018 Him Kalyan Bordoloi - 4.14.54-1 -- Update to version 4.14.54 - -* Fri Jan 26 2018 Alexey Makhalov - 4.14.8-2 -- Added vchiq entry to rpi3 dts -- Added dtb-rpi3 subpackage - -* Fri Dec 22 2017 Alexey Makhalov - 4.14.8-1 -- Version update - -* Wed Dec 13 2017 Alexey Makhalov - 4.9.66-4 -- KAT build support - -* Thu Dec 07 2017 Alexey Makhalov - 4.9.66-3 -- Aarch64 support - -* Tue Dec 05 2017 Alexey Makhalov - 4.9.66-2 -- Sign and compress modules after stripping. fips=1 requires signed modules - -* Mon Dec 04 2017 Srivatsa S. Bhat 4.9.66-1 -- Version update - -* Tue Nov 21 2017 Srivatsa S. Bhat 4.9.64-1 -- Version update - -* Mon Nov 06 2017 Srivatsa S. Bhat 4.9.60-1 -- Version update - -* Wed Oct 11 2017 Srivatsa S. Bhat 4.9.53-3 -- Add patch "KVM: Don't accept obviously wrong gsi values via - KVM_IRQFD" to fix CVE-2017-1000252. - -* Tue Oct 10 2017 Alexey Makhalov - 4.9.53-2 -- Build hang (at make oldconfig) fix. - -* Thu Oct 05 2017 Srivatsa S. Bhat 4.9.53-1 -- Version update - -* Mon Oct 02 2017 Srivatsa S. Bhat 4.9.52-3 -- Allow privileged CLONE_NEWUSER from nested user namespaces. - -* Mon Oct 02 2017 Srivatsa S. Bhat 4.9.52-2 -- Fix CVE-2017-11472 (ACPICA: Namespace: fix operand cache leak) - -* Mon Oct 02 2017 Srivatsa S. Bhat 4.9.52-1 -- Version update - -* Mon Sep 18 2017 Alexey Makhalov - 4.9.47-2 -- Requires coreutils or toybox - -* Mon Sep 04 2017 Alexey Makhalov - 4.9.47-1 -- Fix CVE-2017-11600 - -* Tue Aug 22 2017 Anish Swaminathan - 4.9.43-2 -- Add missing xen block drivers - -* Mon Aug 14 2017 Alexey Makhalov - 4.9.43-1 -- Version update -- [feature] new sysctl option unprivileged_userns_clone - -* Wed Aug 09 2017 Alexey Makhalov - 4.9.41-2 -- Fix CVE-2017-7542 -- [bugfix] Added ccm,gcm,ghash,lzo crypto modules to avoid - panic on modprobe tcrypt - -* Mon Aug 07 2017 Alexey Makhalov - 4.9.41-1 -- Version update - -* Fri Aug 04 2017 Bo Gan - 4.9.38-6 -- Fix initramfs triggers - -* Tue Aug 01 2017 Anish Swaminathan - 4.9.38-5 -- Allow some algorithms in FIPS mode -- Reverts 284a0f6e87b0721e1be8bca419893902d9cf577a and backports -- bcf741cb779283081db47853264cc94854e7ad83 in the kernel tree -- Enable additional NF features - -* Fri Jul 21 2017 Anish Swaminathan - 4.9.38-4 -- Add patches in Hyperv codebase - -* Fri Jul 21 2017 Anish Swaminathan - 4.9.38-3 -- Add missing hyperv drivers - -* Thu Jul 20 2017 Alexey Makhalov - 4.9.38-2 -- Disable scheduler beef up patch - -* Tue Jul 18 2017 Alexey Makhalov - 4.9.38-1 -- Fix CVE-2017-11176 and CVE-2017-10911 - -* Mon Jul 03 2017 Xiaolin Li - 4.9.34-3 -- Add libdnet-devel, kmod-devel and libmspack-devel to BuildRequires - -* Thu Jun 29 2017 Divya Thaluru - 4.9.34-2 -- Added obsolete for deprecated linux-dev package - -* Wed Jun 28 2017 Alexey Makhalov - 4.9.34-1 -- [feature] 9P FS security support -- [feature] DM Delay target support -- Fix CVE-2017-1000364 ("stack clash") and CVE-2017-9605 - -* Thu Jun 8 2017 Alexey Makhalov - 4.9.31-1 -- Fix CVE-2017-8890, CVE-2017-9074, CVE-2017-9075, CVE-2017-9076 - CVE-2017-9077 and CVE-2017-9242 -- [feature] IPV6 netfilter NAT table support - -* Fri May 26 2017 Alexey Makhalov - 4.9.30-1 -- Added ENA driver for AMI -- Fix CVE-2017-7487 and CVE-2017-9059 - -* Wed May 17 2017 Vinay Kulkarni - 4.9.28-2 -- Enable IPVLAN module. - -* Tue May 16 2017 Alexey Makhalov - 4.9.28-1 -- Version update - -* Wed May 10 2017 Alexey Makhalov - 4.9.27-1 -- Version update - -* Sun May 7 2017 Alexey Makhalov - 4.9.26-1 -- Version update -- Removed version suffix from config file name - -* Thu Apr 27 2017 Bo Gan - 4.9.24-2 -- Support dynamic initrd generation - -* Tue Apr 25 2017 Alexey Makhalov - 4.9.24-1 -- Fix CVE-2017-6874 and CVE-2017-7618. -- Fix audit-devel BuildRequires. -- .config: build nvme and nvme-core in kernel. - -* Mon Mar 6 2017 Alexey Makhalov - 4.9.13-2 -- .config: NSX requirements for crypto and netfilter - -* Tue Feb 28 2017 Alexey Makhalov - 4.9.13-1 -- Update to linux-4.9.13 to fix CVE-2017-5986 and CVE-2017-6074 - -* Thu Feb 09 2017 Alexey Makhalov - 4.9.9-1 -- Update to linux-4.9.9 to fix CVE-2016-10153, CVE-2017-5546, - CVE-2017-5547, CVE-2017-5548 and CVE-2017-5576. -- .config: added CRYPTO_FIPS support. - -* Tue Jan 10 2017 Alexey Makhalov - 4.9.2-1 -- Update to linux-4.9.2 to fix CVE-2016-10088 -- Move linux-tools.spec to linux.spec as -tools subpackage - -* Mon Dec 19 2016 Xiaolin Li - 4.9.0-2 -- BuildRequires Linux-PAM-devel - -* Mon Dec 12 2016 Alexey Makhalov - 4.9.0-1 -- Update to linux-4.9.0 -- Add paravirt stolen time accounting feature (from linux-esx), - but disable it by default (no-vmw-sta cmdline parameter) - -* Thu Dec 8 2016 Alexey Makhalov - 4.4.35-3 -- net-packet-fix-race-condition-in-packet_set_ring.patch - to fix CVE-2016-8655 - -* Wed Nov 30 2016 Alexey Makhalov - 4.4.35-2 -- Expand `uname -r` with release number -- Check for build-id matching -- Added syscalls tracing support -- Compress modules - -* Mon Nov 28 2016 Alexey Makhalov - 4.4.35-1 -- Update to linux-4.4.35 -- vfio-pci-fix-integer-overflows-bitmask-check.patch - to fix CVE-2016-9083 - -* Tue Nov 22 2016 Alexey Makhalov - 4.4.31-4 -- net-9p-vsock.patch - -* Thu Nov 17 2016 Alexey Makhalov - 4.4.31-3 -- tty-prevent-ldisc-drivers-from-re-using-stale-tty-fields.patch - to fix CVE-2015-8964 - -* Tue Nov 15 2016 Alexey Makhalov - 4.4.31-2 -- .config: add cgrup_hugetlb support -- .config: add netfilter_xt_{set,target_ct} support -- .config: add netfilter_xt_match_{cgroup,ipvs} support - -* Thu Nov 10 2016 Alexey Makhalov - 4.4.31-1 -- Update to linux-4.4.31 - -* Fri Oct 21 2016 Alexey Makhalov - 4.4.26-1 -- Update to linux-4.4.26 - -* Wed Oct 19 2016 Alexey Makhalov - 4.4.20-6 -- net-add-recursion-limit-to-GRO.patch -- scsi-arcmsr-buffer-overflow-in-arcmsr_iop_message_xfer.patch - -* Tue Oct 18 2016 Alexey Makhalov - 4.4.20-5 -- ipip-properly-mark-ipip-GRO-packets-as-encapsulated.patch -- tunnels-dont-apply-GRO-to-multiple-layers-of-encapsulation.patch - -* Mon Oct 3 2016 Alexey Makhalov - 4.4.20-4 -- Package vmlinux with PROGBITS sections in -debuginfo subpackage - -* Tue Sep 27 2016 Alexey Makhalov - 4.4.20-3 -- .config: CONFIG_IP_SET_HASH_{IPMARK,MAC}=m - -* Tue Sep 20 2016 Alexey Makhalov - 4.4.20-2 -- Add -release number for /boot/* files -- Use initrd.img with version and release number -- Rename -dev subpackage to -devel - -* Wed Sep 7 2016 Alexey Makhalov - 4.4.20-1 -- Update to linux-4.4.20 -- apparmor-fix-oops-validate-buffer-size-in-apparmor_setprocattr.patch -- keys-fix-asn.1-indefinite-length-object-parsing.patch - -* Thu Aug 25 2016 Alexey Makhalov - 4.4.8-11 -- vmxnet3 patches to bumpup a version to 1.4.8.0 - -* Wed Aug 10 2016 Alexey Makhalov - 4.4.8-10 -- Added VSOCK-Detach-QP-check-should-filter-out-non-matching-QPs.patch -- .config: pmem hotplug + ACPI NFIT support -- .config: enable EXPERT mode, disable UID16 syscalls - -* Thu Jul 07 2016 Alexey Makhalov - 4.4.8-9 -- .config: pmem + fs_dax support - -* Fri Jun 17 2016 Alexey Makhalov - 4.4.8-8 -- patch: e1000e-prevent-div-by-zero-if-TIMINCA-is-zero.patch -- .config: disable rt group scheduling - not supported by systemd - -* Wed Jun 15 2016 Harish Udaiya Kumar - 4.4.8-7 -- fixed the capitalization for - System.map - -* Thu May 26 2016 Alexey Makhalov - 4.4.8-6 -- patch: REVERT-sched-fair-Beef-up-wake_wide.patch - -* Tue May 24 2016 Priyesh Padmavilasom - 4.4.8-5 -- GA - Bump release of all rpms - -* Mon May 23 2016 Harish Udaiya Kumar - 4.4.8-4 -- Fixed generation of debug symbols for kernel modules & vmlinux. - -* Mon May 23 2016 Divya Thaluru - 4.4.8-3 -- Added patches to fix CVE-2016-3134, CVE-2016-3135 - -* Wed May 18 2016 Harish Udaiya Kumar - 4.4.8-2 -- Enabled CONFIG_UPROBES in config as needed by ktap - -* Wed May 04 2016 Alexey Makhalov - 4.4.8-1 -- Update to linux-4.4.8 -- Added net-Drivers-Vmxnet3-set-... patch - -* Tue May 03 2016 Vinay Kulkarni - 4.2.0-27 -- Compile Intel GigE and VMXNET3 as part of kernel. - -* Thu Apr 28 2016 Nick Shi - 4.2.0-26 -- Compile cramfs.ko to allow mounting cramfs image - -* Tue Apr 12 2016 Vinay Kulkarni - 4.2.0-25 -- Revert network interface renaming disable in kernel. - -* Tue Mar 29 2016 Alexey Makhalov - 4.2.0-24 -- Support kmsg dumping to vmware.log on panic -- sunrpc: xs_bind uses ip_local_reserved_ports - -* Mon Mar 28 2016 Harish Udaiya Kumar - 4.2.0-23 -- Enabled Regular stack protection in Linux kernel in config - -* Thu Mar 17 2016 Harish Udaiya Kumar - 4.2.0-22 -- Restrict the permissions of the /boot/System.map-X file - -* Fri Mar 04 2016 Alexey Makhalov - 4.2.0-21 -- Patch: SUNRPC: Do not reuse srcport for TIME_WAIT socket. - -* Wed Mar 02 2016 Alexey Makhalov - 4.2.0-20 -- Patch: SUNRPC: Ensure that we wait for connections to complete - before retrying - -* Fri Feb 26 2016 Alexey Makhalov - 4.2.0-19 -- Disable watchdog under VMware hypervisor. - -* Thu Feb 25 2016 Alexey Makhalov - 4.2.0-18 -- Added rpcsec_gss_krb5 and nfs_fscache - -* Mon Feb 22 2016 Alexey Makhalov - 4.2.0-17 -- Added sysctl param to control weighted_cpuload() behavior - -* Thu Feb 18 2016 Divya Thaluru - 4.2.0-16 -- Disabling network renaming - -* Sun Feb 14 2016 Alexey Makhalov - 4.2.0-15 -- veth patch: don’t modify ip_summed - -* Thu Feb 11 2016 Alexey Makhalov - 4.2.0-14 -- Full tickless -> idle tickless + simple CPU time accounting -- SLUB -> SLAB -- Disable NUMA balancing -- Disable stack protector -- No build_forced no-CBs CPUs -- Disable Expert configuration mode -- Disable most of debug features from 'Kernel hacking' - -* Mon Feb 08 2016 Alexey Makhalov - 4.2.0-13 -- Double tcp_mem limits, patch is added. - -* Wed Feb 03 2016 Anish Swaminathan - 4.2.0-12 -- Fixes for CVE-2015-7990/6937 and CVE-2015-8660. - -* Tue Jan 26 2016 Anish Swaminathan - 4.2.0-11 -- Revert CONFIG_HZ=250 - -* Fri Jan 22 2016 Alexey Makhalov - 4.2.0-10 -- Fix for CVE-2016-0728 - -* Wed Jan 13 2016 Alexey Makhalov - 4.2.0-9 -- CONFIG_HZ=250 - -* Tue Jan 12 2016 Mahmoud Bassiouny - 4.2.0-8 -- Remove rootfstype from the kernel parameter. - -* Mon Jan 04 2016 Harish Udaiya Kumar - 4.2.0-7 -- Disabled all the tracing options in kernel config. -- Disabled preempt. -- Disabled sched autogroup. - -* Thu Dec 17 2015 Harish Udaiya Kumar - 4.2.0-6 -- Enabled kprobe for systemtap & disabled dynamic function tracing in config - -* Fri Dec 11 2015 Harish Udaiya Kumar - 4.2.0-5 -- Added oprofile kernel driver sub-package. - -* Fri Nov 13 2015 Mahmoud Bassiouny - 4.2.0-4 -- Change the linux image directory. - -* Wed Nov 11 2015 Harish Udaiya Kumar - 4.2.0-3 -- Added the build essential files in the dev sub-package. - -* Mon Nov 09 2015 Vinay Kulkarni - 4.2.0-2 -- Enable Geneve module support for generic kernel. - -* Fri Oct 23 2015 Harish Udaiya Kumar - 4.2.0-1 -- Upgraded the generic linux kernel to version 4.2.0 & and updated timer handling to full tickless mode. - -* Tue Sep 22 2015 Harish Udaiya Kumar - 4.0.9-5 -- Added driver support for frame buffer devices and ACPI - -* Wed Sep 2 2015 Alexey Makhalov - 4.0.9-4 -- Added mouse ps/2 module. - -* Fri Aug 14 2015 Alexey Makhalov - 4.0.9-3 -- Use photon.cfg as a symlink. - -* Thu Aug 13 2015 Alexey Makhalov - 4.0.9-2 -- Added environment file(photon.cfg) for grub. - -* Wed Aug 12 2015 Sharath George - 4.0.9-1 -- Upgrading kernel version. - -* Wed Aug 12 2015 Alexey Makhalov - 3.19.2-5 -- Updated OVT to version 10.0.0. -- Rename -gpu-drivers to -drivers-gpu in accordance to directory structure. -- Added -sound package/ - -* Tue Aug 11 2015 Anish Swaminathan - 3.19.2-4 -- Removed Requires dependencies. - -* Fri Jul 24 2015 Harish Udaiya Kumar - 3.19.2-3 -- Updated the config file to include graphics drivers. - -* Mon May 18 2015 Touseef Liaqat - 3.13.3-2 -- Update according to UsrMove. - -* Wed Nov 5 2014 Divya Thaluru - 3.13.3-1 -- Initial build. First version diff --git a/SPECS/kernel/config b/SPECS/kernel/config index 5917b508c23..ffea82b9b49 100644 --- a/SPECS/kernel/config +++ b/SPECS/kernel/config @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86_64 5.15.148.1 Kernel Configuration +# Linux/x86_64 5.15.148.2 Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (GCC) 11.2.0" CONFIG_CC_IS_GCC=y diff --git a/SPECS/kernel/config_aarch64 b/SPECS/kernel/config_aarch64 index 31c59a811bc..acd46d7b168 100644 --- a/SPECS/kernel/config_aarch64 +++ b/SPECS/kernel/config_aarch64 @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm64 5.15.148.1 Kernel Configuration +# Linux/arm64 5.15.148.2 Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (GCC) 11.2.0" CONFIG_CC_IS_GCC=y diff --git a/SPECS/kernel/kernel.signatures.json b/SPECS/kernel/kernel.signatures.json index 13de1f1a8c1..1041caeaf0b 100644 --- a/SPECS/kernel/kernel.signatures.json +++ b/SPECS/kernel/kernel.signatures.json @@ -1,9 +1,9 @@ { "Signatures": { "cbl-mariner-ca-20211013.pem": "5ef124b0924cb1047c111a0ecff1ae11e6ad7cac8d1d9b40f98f99334121f0b0", - "config": "280ab4bb65434dfe985c8e3d485b3112da6084529384173b19685e4f8c916da5", - "config_aarch64": "3546a62db64a7a0a0114c5f71511ce0d434eed967296907549ceb99fa94e5258", + "config": "32361dee210fc2894f564975951f7c424d7fcea012232e2a059a9254746da134", + "config_aarch64": "1bdd3093e94d089985dd3af1ede1905c9d4e8237aa46728e489c5b94edaddf2d", "sha512hmac-openssl.sh": "02ab91329c4be09ee66d759e4d23ac875037c3b56e5a598e32fd1206da06a27f", - "kernel-5.15.148.1.tar.gz": "e77c297fe3e3f0d9fd403c52f1e959389fa33e6642be9ddd12d4ea7f8927e5d6" + "kernel-5.15.148.2.tar.gz": "58488cf131b8a1c77dcac651fbad10e105e9a8d2f48b7bb8b2d08ac63483a129" } } diff --git a/SPECS/kernel/kernel.spec b/SPECS/kernel/kernel.spec index 50d3ad71b48..6c9fdc0f76d 100644 --- a/SPECS/kernel/kernel.spec +++ b/SPECS/kernel/kernel.spec @@ -27,7 +27,7 @@ Summary: Linux Kernel Name: kernel -Version: 5.15.148.1 +Version: 5.15.148.2 Release: 1%{?dist} License: GPLv2 Vendor: Microsoft Corporation @@ -426,6 +426,9 @@ ln -sf linux-%{uname_r}.cfg /boot/mariner.cfg %{_sysconfdir}/bash_completion.d/bpftool %changelog +* Thu Feb 08 2024 CBL-Mariner Servicing Account - 5.15.148.2-1 +- Auto-upgrade to 5.15.148.2 + * Tue Jan 30 2024 CBL-Mariner Servicing Account - 5.15.148.1-1 - Auto-upgrade to 5.15.148.1 diff --git a/SPECS/kube-vip-cloud-provider/CVE-2021-44716.patch b/SPECS/kube-vip-cloud-provider/CVE-2021-44716.patch new file mode 100644 index 00000000000..dc3adbff678 --- /dev/null +++ b/SPECS/kube-vip-cloud-provider/CVE-2021-44716.patch @@ -0,0 +1,51 @@ +Parent: db4efeb8 (http2: deflake TestTransportGroupsPendingDials) +Author: Damien Neil +AuthorDate: 2021-12-06 14:31:43 -0800 +Commit: Filippo Valsorda +CommitDate: 2021-12-09 12:49:13 +0000 + +http2: cap the size of the server's canonical header cache + +The HTTP/2 server keeps a per-connection cache mapping header keys +to their canonicalized form (e.g., "foo-bar" => "Foo-Bar"). Cap the +maximum size of this cache to prevent a peer sending many unique +header keys from causing unbounded memory growth. + +Cap chosen arbitrarily at 32 entries. Since this cache does not +include common headers (e.g., "content-type"), 32 seems like more +than enough for almost all normal uses. + +Fixes #50058 +Fixes CVE-2021-44716 + +Change-Id: Ia83696dc23253c12af8f26d502557c2cc9841105 +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1290827 +Reviewed-by: Roland Shoemaker +Reviewed-on: https://go-review.googlesource.com/c/net/+/369794 +Trust: Filippo Valsorda +Run-TryBot: Filippo Valsorda +Trust: Damien Neil +Reviewed-by: Russ Cox +Reviewed-by: Filippo Valsorda +TryBot-Result: Gopher Robot + +diff -ru cli-20.10.27-orig/vendor/golang.org/x/net/http2/server.go cli-20.10.27/vendor/golang.org/x/net/http2/server.go +--- cli-20.10.27-orig/vendor/golang.org/x/net/http2/server.go 2024-02-05 08:53:30.802532951 -0800 ++++ cli-20.10.27/vendor/golang.org/x/net/http2/server.go 2024-02-05 09:19:08.473430121 -0800 +@@ -720,7 +720,15 @@ + sc.canonHeader = make(map[string]string) + } + cv = http.CanonicalHeaderKey(v) +- sc.canonHeader[v] = cv ++ // maxCachedCanonicalHeaders is an arbitrarily-chosen limit on the number of ++ // entries in the canonHeader cache. This should be larger than the number ++ // of unique, uncommon header keys likely to be sent by the peer, while not ++ // so high as to permit unreaasonable memory usage if the peer sends an unbounded ++ // number of unique header keys. ++ const maxCachedCanonicalHeaders = 32 ++ if len(sc.canonHeader) < maxCachedCanonicalHeaders { ++ sc.canonHeader[v] = cv ++ } + return cv + } + \ No newline at end of file diff --git a/SPECS/kube-vip-cloud-provider/CVE-2022-21698.patch b/SPECS/kube-vip-cloud-provider/CVE-2022-21698.patch index d182f16619a..917c6d0f138 100644 --- a/SPECS/kube-vip-cloud-provider/CVE-2022-21698.patch +++ b/SPECS/kube-vip-cloud-provider/CVE-2022-21698.patch @@ -9,6 +9,8 @@ Differences: - Removed some comments that don't merge - Line numbers and such +Modified to apply to vendored code by: Daniel McIlvaney + - Adjusted paths to work for vendored version Based on: From 9075cdf61646b5adf54d3ba77a0e4f6c65cb4fd7 Mon Sep 17 00:00:00 2001 @@ -37,16 +39,16 @@ Signed-off-by: Kemal Akkoyun Signed-off-by: Kemal Akkoyun --- - prometheus/promhttp/instrument_client.go | 28 ++++++-- - prometheus/promhttp/instrument_server.go | 82 ++++++++++++++++++------ - prometheus/promhttp/option.go | 31 +++++++++ + vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go | 28 ++++++-- + vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go | 82 ++++++++++++++++++------ + vendor/github.com/prometheus/client_golang/prometheus/promhttp/option.go | 31 +++++++++ 3 files changed, 116 insertions(+), 25 deletions(-) - create mode 100644 prometheus/promhttp/option.go + create mode 100644 vendor/github.com/prometheus/client_golang/prometheus/promhttp/option.go -diff --git a/prometheus/promhttp/instrument_client.go b/prometheus/promhttp/instrument_client.go +diff --git a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go index 83c49b6..861b4d2 100644 ---- a/prometheus/promhttp/instrument_client.go -+++ b/prometheus/promhttp/instrument_client.go +--- a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go ++++ b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go @@ -49,7 +49,10 @@ func InstrumentRoundTripperInFlight(gauge prometheus.Gauge, next http.RoundTripp // http.RoundTripper to observe the request result with the provided CounterVec. // The CounterVec must have zero, one, or two non-const non-curried labels. For @@ -114,10 +116,10 @@ index 83c49b6..861b4d2 100644 } return resp, err }) -diff --git a/prometheus/promhttp/instrument_server.go b/prometheus/promhttp/instrument_server.go +diff --git a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go index 9db2438..91802f8 100644 ---- a/prometheus/promhttp/instrument_server.go -+++ b/prometheus/promhttp/instrument_server.go +--- a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go ++++ b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go @@ -58,7 +58,12 @@ func InstrumentHandlerInFlight(g prometheus.Gauge, next http.Handler) http.Handl // // Note that this method is only guaranteed to never observe negative durations @@ -322,11 +324,11 @@ index 9db2438..91802f8 100644 + return "unknown" } } -diff --git a/prometheus/promhttp/option.go b/prometheus/promhttp/option.go +diff --git a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/option.go b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/option.go new file mode 100644 index 0000000..35e41bd --- /dev/null -+++ b/prometheus/promhttp/option.go ++++ b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/option.go @@ -0,0 +1,31 @@ +// Copyright 2022 The Prometheus Authors +// Licensed under the Apache License, Version 2.0 (the "License"); diff --git a/SPECS/kube-vip-cloud-provider/CVE-2023-44487.patch b/SPECS/kube-vip-cloud-provider/CVE-2023-44487.patch new file mode 100644 index 00000000000..23d385d8358 --- /dev/null +++ b/SPECS/kube-vip-cloud-provider/CVE-2023-44487.patch @@ -0,0 +1,143 @@ +From ed07cf0825f6a369c58df6b728caa9f12ad029dd Mon Sep 17 00:00:00 2001 +From: Damien Neil +Date: Fri, 6 Oct 2023 09:51:19 -0700 +Subject: [PATCH] http2: limit maximum handler goroutines to + MaxConcurrentStreams + +When the peer opens a new stream while we have MaxConcurrentStreams +handler goroutines running, defer starting a handler until one +of the existing handlers exits. + +Fixes golang/go#63417 +Fixes CVE-2023-39325 + +Change-Id: If0531e177b125700f3e24c5ebd24b1023098fa6d +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2045854 +TryBot-Result: Security TryBots +Reviewed-by: Ian Cottrell +Reviewed-by: Tatiana Bradley +Run-TryBot: Damien Neil +Reviewed-on: https://go-review.googlesource.com/c/net/+/534215 +Reviewed-by: Michael Pratt +Reviewed-by: Dmitri Shuralyov +LUCI-TryBot-Result: Go LUCI +Auto-Submit: Dmitri Shuralyov +Reviewed-by: Damien Neil + +Modified to apply to vendored code by: Daniel McIlvaney + - Adjusted paths + - Removed reference to server_test.go + - Removed reference to upgradeRequest() which is not in old versions of the vendored code + - Removed reference to countError() which is not in old versions of the vendored code +--- + vendor/golang.org/x/net/http2/server.go | 62 ++++++++++++++++++++++++- + 1 file changed, 60 insertions(+), 2 deletions(-) + +diff --git a/vendor/golang.org/x/net/http2/server.go b/vendor/golang.org/x/net/http2/server.go +index e125bbd..0844864 100644 +--- a/vendor/golang.org/x/net/http2/server.go ++++ b/vendor/golang.org/x/net/http2/server.go +@@ -521,9 +521,11 @@ type serverConn struct { + advMaxStreams uint32 // our SETTINGS_MAX_CONCURRENT_STREAMS advertised the client + curClientStreams uint32 // number of open streams initiated by the client + curPushedStreams uint32 // number of open streams initiated by server push ++ curHandlers uint32 // number of running handler goroutines + maxClientStreamID uint32 // max ever seen from client (odd), or 0 if there have been no client requests + maxPushPromiseID uint32 // ID of the last push promise (even), or 0 if there have been no pushes + streams map[uint32]*stream ++ unstartedHandlers []unstartedHandler + initialStreamSendWindowSize int32 + maxFrameSize int32 + headerTableSize uint32 +@@ -893,6 +895,8 @@ func (sc *serverConn) serve() { + return + case gracefulShutdownMsg: + sc.startGracefulShutdownInternal() ++ case handlerDoneMsg: ++ sc.handlerDone() + default: + panic("unknown timer") + } +@@ -938,6 +942,7 @@ var ( + idleTimerMsg = new(serverMessage) + shutdownTimerMsg = new(serverMessage) + gracefulShutdownMsg = new(serverMessage) ++ handlerDoneMsg = new(serverMessage) + ) + + func (sc *serverConn) onSettingsTimer() { sc.sendServeMsg(settingsTimerMsg) } +@@ -1895,8 +1900,7 @@ func (sc *serverConn) processHeaders(f *MetaHeadersFrame) error { + sc.conn.SetReadDeadline(time.Time{}) + } + +- go sc.runHandler(rw, req, handler) +- return nil ++ return sc.scheduleHandler(id, rw, req, handler) + } + + func (st *stream) processTrailerHeaders(f *MetaHeadersFrame) error { +@@ -2143,8 +2147,62 @@ func (sc *serverConn) newWriterAndRequestNoBody(st *stream, rp requestParam) (*r + return rw, req, nil + } + ++type unstartedHandler struct { ++ streamID uint32 ++ rw *responseWriter ++ req *http.Request ++ handler func(http.ResponseWriter, *http.Request) ++} ++ ++// scheduleHandler starts a handler goroutine, ++// or schedules one to start as soon as an existing handler finishes. ++func (sc *serverConn) scheduleHandler(streamID uint32, rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) error { ++ sc.serveG.check() ++ maxHandlers := sc.advMaxStreams ++ if sc.curHandlers < maxHandlers { ++ sc.curHandlers++ ++ go sc.runHandler(rw, req, handler) ++ return nil ++ } ++ if len(sc.unstartedHandlers) > int(4*sc.advMaxStreams) { ++ return ConnectionError(ErrCodeEnhanceYourCalm) ++ } ++ sc.unstartedHandlers = append(sc.unstartedHandlers, unstartedHandler{ ++ streamID: streamID, ++ rw: rw, ++ req: req, ++ handler: handler, ++ }) ++ return nil ++} ++ ++func (sc *serverConn) handlerDone() { ++ sc.serveG.check() ++ sc.curHandlers-- ++ i := 0 ++ maxHandlers := sc.advMaxStreams ++ for ; i < len(sc.unstartedHandlers); i++ { ++ u := sc.unstartedHandlers[i] ++ if sc.streams[u.streamID] == nil { ++ // This stream was reset before its goroutine had a chance to start. ++ continue ++ } ++ if sc.curHandlers >= maxHandlers { ++ break ++ } ++ sc.curHandlers++ ++ go sc.runHandler(u.rw, u.req, u.handler) ++ sc.unstartedHandlers[i] = unstartedHandler{} // don't retain references ++ } ++ sc.unstartedHandlers = sc.unstartedHandlers[i:] ++ if len(sc.unstartedHandlers) == 0 { ++ sc.unstartedHandlers = nil ++ } ++} ++ + // Run on its own goroutine. + func (sc *serverConn) runHandler(rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) { ++ defer sc.sendServeMsg(handlerDoneMsg) + didPanic := true + defer func() { + rw.rws.stream.cancelCtx() +-- +2.33.8 diff --git a/SPECS/kube-vip-cloud-provider/kube-vip-cloud-provider.spec b/SPECS/kube-vip-cloud-provider/kube-vip-cloud-provider.spec index 00c758675da..323f539c255 100644 --- a/SPECS/kube-vip-cloud-provider/kube-vip-cloud-provider.spec +++ b/SPECS/kube-vip-cloud-provider/kube-vip-cloud-provider.spec @@ -1,7 +1,7 @@ Summary: The Kube-Vip cloud provider functions as a general-purpose cloud provider for on-premises bare-metal or virtualized setups Name: kube-vip-cloud-provider Version: 0.0.2 -Release: 14%{?dist} +Release: 16%{?dist} License: ASL 2.0 URL: https://github.com/kube-vip/kube-vip-cloud-provider Group: Applications/Text @@ -22,27 +22,41 @@ Source0: https://github.com/kube-vip/%{name}/archive/refs/tags/v%{version Source1: %{name}-%{version}-vendor.tar.gz Patch0: CVE-2022-21698.patch +Patch1: CVE-2021-44716.patch +Patch2: CVE-2023-44487.patch BuildRequires: golang %description -The Kube-Vip cloud provider functions as a general-purpose cloud provider for on-premises bare-metal or virtualized setups. +The Kube-Vip cloud provider functions as a general-purpose cloud provider for on-premises bare-metal or virtualized setups. %prep %autosetup -N +# Apply vendor before patching tar -xvf %{SOURCE1} -%patch 0 -p1 -d vendor/github.com/prometheus/client_golang +%autopatch -p1 -%build +%build go build -mod=vendor %install install -d %{buildroot}%{_bindir} install kube-vip-cloud-provider %{buildroot}%{_bindir}/kube-vip-cloud-provider +%check +go test -mod=vendor ./... + %files %{_bindir}/kube-vip-cloud-provider %changelog +* Wed Feb 07 2024 Daniel McIlvaney - 0.0.2-16 +- Address CVE-2023-44487 by patching vendored golang.org/x/net +- Rework CVE-2023-21698.patch to apply without directory change +- Add check section + +* Mon Feb 05 2024 Osama Esmail - 0.0.2-15 +- Fix CVE-2021-44716 + * Tue Jan 31 2024 Tobias Brick - 0.0.2-14 - Fix CVE-2022-21698 diff --git a/SPECS/kubernetes/kubernetes.spec b/SPECS/kubernetes/kubernetes.spec index 0c0ba1c58aa..b21fdcbba88 100644 --- a/SPECS/kubernetes/kubernetes.spec +++ b/SPECS/kubernetes/kubernetes.spec @@ -10,7 +10,7 @@ Summary: Microsoft Kubernetes Name: kubernetes Version: 1.28.4 -Release: 1%{?dist} +Release: 2%{?dist} License: ASL 2.0 Vendor: Microsoft Corporation Distribution: Mariner @@ -263,6 +263,9 @@ fi %{_exec_prefix}/local/bin/pause %changelog +* Fri Feb 02 2024 CBL-Mariner Servicing Account - 1.28.4-2 +- Bump release to rebuild with go 1.21.6 + * Tue Dec 5 2023 Aadhar Agarwal - 1.28.4-1 - Upgrade to 1.28.4 to fix CVE-2023-5528 diff --git a/SPECS/kubevirt/CVE-2023-44487.patch b/SPECS/kubevirt/CVE-2023-44487.patch new file mode 100644 index 00000000000..3fef9284e2b --- /dev/null +++ b/SPECS/kubevirt/CVE-2023-44487.patch @@ -0,0 +1,152 @@ +From 59641361d4922b9a4b77ad1aea98f168720818d3 Mon Sep 17 00:00:00 2001 +From: Damien Neil +Date: Fri, 6 Oct 2023 09:51:19 -0700 +Subject: [PATCH] http2: limit maximum handler goroutines to + MaxConcurrentStreams + +When the peer opens a new stream while we have MaxConcurrentStreams +handler goroutines running, defer starting a handler until one +of the existing handlers exits. + +Fixes golang/go#63417 +Fixes CVE-2023-39325 + +Change-Id: If0531e177b125700f3e24c5ebd24b1023098fa6d +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2045854 +TryBot-Result: Security TryBots +Reviewed-by: Ian Cottrell +Reviewed-by: Tatiana Bradley +Run-TryBot: Damien Neil +Reviewed-on: https://go-review.googlesource.com/c/net/+/534215 +Reviewed-by: Michael Pratt +Reviewed-by: Dmitri Shuralyov +LUCI-TryBot-Result: Go LUCI +Auto-Submit: Dmitri Shuralyov +Reviewed-by: Damien Neil + +Modified to apply to vendored code by: Daniel McIlvaney + - Adjusted paths + - Removed reference to server_test.go +--- + .../vendor/golang.org/x/net/http2/server.go | 66 ++++++++++++++++++- + 1 file changed, 64 insertions(+), 2 deletions(-) + +diff --git a/vendor/golang.org/x/net/http2/server.go b/vendor/golang.org/x/net/http2/server.go +index fd873b9..bfb06c6 100644 +--- a/vendor/golang.org/x/net/http2/server.go ++++ b/vendor/golang.org/x/net/http2/server.go +@@ -554,9 +554,11 @@ type serverConn struct { + advMaxStreams uint32 // our SETTINGS_MAX_CONCURRENT_STREAMS advertised the client + curClientStreams uint32 // number of open streams initiated by the client + curPushedStreams uint32 // number of open streams initiated by server push ++ curHandlers uint32 // number of running handler goroutines + maxClientStreamID uint32 // max ever seen from client (odd), or 0 if there have been no client requests + maxPushPromiseID uint32 // ID of the last push promise (even), or 0 if there have been no pushes + streams map[uint32]*stream ++ unstartedHandlers []unstartedHandler + initialStreamSendWindowSize int32 + maxFrameSize int32 + headerTableSize uint32 +@@ -943,6 +945,8 @@ func (sc *serverConn) serve() { + return + case gracefulShutdownMsg: + sc.startGracefulShutdownInternal() ++ case handlerDoneMsg: ++ sc.handlerDone() + default: + panic("unknown timer") + } +@@ -988,6 +992,7 @@ var ( + idleTimerMsg = new(serverMessage) + shutdownTimerMsg = new(serverMessage) + gracefulShutdownMsg = new(serverMessage) ++ handlerDoneMsg = new(serverMessage) + ) + + func (sc *serverConn) onSettingsTimer() { sc.sendServeMsg(settingsTimerMsg) } +@@ -1957,8 +1962,7 @@ func (sc *serverConn) processHeaders(f *MetaHeadersFrame) error { + sc.conn.SetReadDeadline(time.Time{}) + } + +- go sc.runHandler(rw, req, handler) +- return nil ++ return sc.scheduleHandler(id, rw, req, handler) + } + + func (sc *serverConn) upgradeRequest(req *http.Request) { +@@ -1978,6 +1982,10 @@ func (sc *serverConn) upgradeRequest(req *http.Request) { + sc.conn.SetReadDeadline(time.Time{}) + } + ++ // This is the first request on the connection, ++ // so start the handler directly rather than going ++ // through scheduleHandler. ++ sc.curHandlers++ + go sc.runHandler(rw, req, sc.handler.ServeHTTP) + } + +@@ -2227,8 +2235,62 @@ func (sc *serverConn) newResponseWriter(st *stream, req *http.Request) *response + return &responseWriter{rws: rws} + } + ++type unstartedHandler struct { ++ streamID uint32 ++ rw *responseWriter ++ req *http.Request ++ handler func(http.ResponseWriter, *http.Request) ++} ++ ++// scheduleHandler starts a handler goroutine, ++// or schedules one to start as soon as an existing handler finishes. ++func (sc *serverConn) scheduleHandler(streamID uint32, rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) error { ++ sc.serveG.check() ++ maxHandlers := sc.advMaxStreams ++ if sc.curHandlers < maxHandlers { ++ sc.curHandlers++ ++ go sc.runHandler(rw, req, handler) ++ return nil ++ } ++ if len(sc.unstartedHandlers) > int(4*sc.advMaxStreams) { ++ return sc.countError("too_many_early_resets", ConnectionError(ErrCodeEnhanceYourCalm)) ++ } ++ sc.unstartedHandlers = append(sc.unstartedHandlers, unstartedHandler{ ++ streamID: streamID, ++ rw: rw, ++ req: req, ++ handler: handler, ++ }) ++ return nil ++} ++ ++func (sc *serverConn) handlerDone() { ++ sc.serveG.check() ++ sc.curHandlers-- ++ i := 0 ++ maxHandlers := sc.advMaxStreams ++ for ; i < len(sc.unstartedHandlers); i++ { ++ u := sc.unstartedHandlers[i] ++ if sc.streams[u.streamID] == nil { ++ // This stream was reset before its goroutine had a chance to start. ++ continue ++ } ++ if sc.curHandlers >= maxHandlers { ++ break ++ } ++ sc.curHandlers++ ++ go sc.runHandler(u.rw, u.req, u.handler) ++ sc.unstartedHandlers[i] = unstartedHandler{} // don't retain references ++ } ++ sc.unstartedHandlers = sc.unstartedHandlers[i:] ++ if len(sc.unstartedHandlers) == 0 { ++ sc.unstartedHandlers = nil ++ } ++} ++ + // Run on its own goroutine. + func (sc *serverConn) runHandler(rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) { ++ defer sc.sendServeMsg(handlerDoneMsg) + didPanic := true + defer func() { + rw.rws.stream.cancelCtx() +-- +2.33.8 diff --git a/SPECS/kubevirt/Hp-volume-pod-should-respect-blockdevices.patch b/SPECS/kubevirt/Hp-volume-pod-should-respect-blockdevices.patch new file mode 100644 index 00000000000..f6a8ead9cef --- /dev/null +++ b/SPECS/kubevirt/Hp-volume-pod-should-respect-blockdevices.patch @@ -0,0 +1,91 @@ +From af25759a3205ac3cdf42254923e3e20cf336a4a0 Mon Sep 17 00:00:00 2001 +From: Vicente Cheng +Date: Fri, 17 Feb 2023 17:23:06 +0800 +Subject: [PATCH] virt-controller: render hp-volume- pod should respect + blockdevices + + We found that the VolumeDevices does not generate as the first + time we render on hp-volume- pod. That would cause the global path + not to be generated by kubelet again when the hp-volume- is + dead, then render again. + + We should respect the VolumeDevics on the Spec. That would make + kubelet behavior is the same as the first time when the hp-volume- + pod is killed. + +Signed-off-by: Vicente Cheng +--- + pkg/virt-controller/services/template.go | 41 +++++++++++------------- + 1 file changed, 19 insertions(+), 22 deletions(-) + +diff --git a/pkg/virt-controller/services/template.go b/pkg/virt-controller/services/template.go +index 4fe5fdcd0374..d4f1fbae7840 100644 +--- a/pkg/virt-controller/services/template.go ++++ b/pkg/virt-controller/services/template.go +@@ -25,19 +25,14 @@ import ( + "strconv" + "strings" + +- "kubevirt.io/kubevirt/pkg/virt-controller/watch/topology" +- +- "k8s.io/kubectl/pkg/cmd/util/podcmd" +- "k8s.io/utils/pointer" +- ++ networkv1 "github.com/k8snetworkplumbingwg/network-attachment-definition-client/pkg/apis/k8s.cni.cncf.io/v1" + k8sv1 "k8s.io/api/core/v1" + "k8s.io/apimachinery/pkg/api/resource" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/runtime/schema" + "k8s.io/client-go/tools/cache" +- +- networkv1 "github.com/k8snetworkplumbingwg/network-attachment-definition-client/pkg/apis/k8s.cni.cncf.io/v1" +- ++ "k8s.io/kubectl/pkg/cmd/util/podcmd" ++ "k8s.io/utils/pointer" + v1 "kubevirt.io/api/core/v1" + exportv1 "kubevirt.io/api/export/v1alpha1" + "kubevirt.io/client-go/kubecli" +@@ -52,6 +47,7 @@ import ( + "kubevirt.io/kubevirt/pkg/util" + "kubevirt.io/kubevirt/pkg/util/net/dns" + virtconfig "kubevirt.io/kubevirt/pkg/virt-config" ++ "kubevirt.io/kubevirt/pkg/virt-controller/watch/topology" + "kubevirt.io/kubevirt/pkg/virt-launcher/virtwrap/api" + ) + +@@ -845,20 +841,21 @@ func (t *templateService) RenderHotplugAttachmentPodTemplate(volumes []*v1.Volum + }, + }, + }) +- if !skipMount { +- pvc := claimMap[volume.Name] +- if pvc != nil { +- if types.IsPVCBlock(pvc.Spec.VolumeMode) { +- pod.Spec.Containers[0].VolumeDevices = append(pod.Spec.Containers[0].VolumeDevices, k8sv1.VolumeDevice{ +- Name: volume.Name, +- DevicePath: fmt.Sprintf("/path/%s/%s", volume.Name, pvc.GetUID()), +- }) +- } else { +- pod.Spec.Containers[0].VolumeMounts = append(pod.Spec.Containers[0].VolumeMounts, k8sv1.VolumeMount{ +- Name: volume.Name, +- MountPath: fmt.Sprintf("/%s", volume.Name), +- }) +- } ++ pvc := claimMap[volume.Name] ++ if pvc == nil { ++ continue ++ } ++ if types.IsPVCBlock(pvc.Spec.VolumeMode) { ++ pod.Spec.Containers[0].VolumeDevices = append(pod.Spec.Containers[0].VolumeDevices, k8sv1.VolumeDevice{ ++ Name: volume.Name, ++ DevicePath: fmt.Sprintf("/path/%s/%s", volume.Name, pvc.GetUID()), ++ }) ++ } else { ++ if !skipMount { ++ pod.Spec.Containers[0].VolumeMounts = append(pod.Spec.Containers[0].VolumeMounts, k8sv1.VolumeMount{ ++ Name: volume.Name, ++ MountPath: fmt.Sprintf("/%s", volume.Name), ++ }) + } + } + } diff --git a/SPECS/kubevirt/kubevirt.spec b/SPECS/kubevirt/kubevirt.spec index c3b938fe3e9..d0c6cd9dd63 100644 --- a/SPECS/kubevirt/kubevirt.spec +++ b/SPECS/kubevirt/kubevirt.spec @@ -19,7 +19,7 @@ Summary: Container native virtualization Name: kubevirt Version: 0.59.0 -Release: 11%{?dist} +Release: 12%{?dist} License: ASL 2.0 Vendor: Microsoft Corporation Distribution: Mariner @@ -32,6 +32,8 @@ Source1: disks-images-provider.yaml Patch0: Cleanup-housekeeping-cgroup-on-vm-del.patch Patch1: Allocate-2-cpu-for-the-emulator-thread.patch Patch2: Hotplug_detach_grace_period.patch +Patch3: CVE-2023-44487.patch +Patch4: Hp-volume-pod-should-respect-blockdevices.patch %global debug_package %{nil} BuildRequires: glibc-devel BuildRequires: glibc-static >= 2.35-6%{?dist} @@ -211,6 +213,12 @@ install -p -m 0644 cmd/virt-handler/nsswitch.conf %{buildroot}%{_datadir}/kube-v %{_bindir}/virt-tests %changelog +* Thu Feb 8 2024 Sharath Srikanth Chellappa - 0.59.0-12 +- Add patch for render hp-volume- pod to respect blockdevices (IcM 467224770) + +* Thu Feb 01 2024 Daniel McIlvaney - 0.59.0-12 +- Address CVE-2023-44487 by patching vendored golang.org/x/net + * Wed Oct 18 2023 Minghe Ren - 0.59.0-11 - Bump release to rebuild against glibc 2.35-6 @@ -239,10 +247,10 @@ install -p -m 0644 cmd/virt-handler/nsswitch.conf %{buildroot}%{_datadir}/kube-v - Bump release to rebuild with go 1.19.10 * Fri May 12 2023 Kanika Nema - 0.59.0-2 -- Patch 0.59.0 with Operator Nexus patches +- Patch 0.59.0 with Operator Nexus patches * Fri May 05 2023 Kanika Nema - 0.59.0-1 -- Upgrade to v0.59.0 +- Upgrade to v0.59.0 * Wed Apr 05 2023 CBL-Mariner Servicing Account - 0.58.0-7 - Bump release to rebuild with go 1.19.8 diff --git a/SPECS/kured/kured.spec b/SPECS/kured/kured.spec index 3f1be554a72..4ef0364a049 100644 --- a/SPECS/kured/kured.spec +++ b/SPECS/kured/kured.spec @@ -25,7 +25,7 @@ Summary: Kubernetes daemonset to perform safe automatic node reboots Name: kured Version: 1.14.2 -Release: 1%{?dist} +Release: 2%{?dist} License: Apache-2.0 Vendor: Microsoft Corporation Distribution: Mariner @@ -122,6 +122,9 @@ sed -i -e 's|image: .*|image: registry.opensuse.org/kubic/kured:%{version}|g' %{ %{_datarootdir}/k8s-yaml/kured/kured.yaml %changelog +* Fri Feb 02 2024 CBL-Mariner Servicing Account - 1.14.2-2 +- Bump release to rebuild with go 1.21.6 + * Tue Jan 16 2024 Mandeep Plaha - 1.14.2-1 - Upgrade to 1.14.2 for vendored go CVE-2023-39325 diff --git a/SPECS/libcontainers-common/CVE-2021-44716.patch b/SPECS/libcontainers-common/CVE-2021-44716.patch new file mode 100644 index 00000000000..5c871692014 --- /dev/null +++ b/SPECS/libcontainers-common/CVE-2021-44716.patch @@ -0,0 +1,50 @@ +Parent: db4efeb8 (http2: deflake TestTransportGroupsPendingDials) +Author: Damien Neil +AuthorDate: 2021-12-06 14:31:43 -0800 +Commit: Filippo Valsorda +CommitDate: 2021-12-09 12:49:13 +0000 + +http2: cap the size of the server's canonical header cache + +The HTTP/2 server keeps a per-connection cache mapping header keys +to their canonicalized form (e.g., "foo-bar" => "Foo-Bar"). Cap the +maximum size of this cache to prevent a peer sending many unique +header keys from causing unbounded memory growth. + +Cap chosen arbitrarily at 32 entries. Since this cache does not +include common headers (e.g., "content-type"), 32 seems like more +than enough for almost all normal uses. + +Fixes #50058 +Fixes CVE-2021-44716 + +Change-Id: Ia83696dc23253c12af8f26d502557c2cc9841105 +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1290827 +Reviewed-by: Roland Shoemaker +Reviewed-on: https://go-review.googlesource.com/c/net/+/369794 +Trust: Filippo Valsorda +Run-TryBot: Filippo Valsorda +Trust: Damien Neil +Reviewed-by: Russ Cox +Reviewed-by: Filippo Valsorda +TryBot-Result: Gopher Robot + +diff -ru cli-20.10.27-orig/vendor/golang.org/x/net/http2/server.go cli-20.10.27/vendor/golang.org/x/net/http2/server.go +--- cli-20.10.27-orig/vendor/golang.org/x/net/http2/server.go 2024-02-05 08:53:30.802532951 -0800 ++++ cli-20.10.27/vendor/golang.org/x/net/http2/server.go 2024-02-05 09:19:08.473430121 -0800 +@@ -720,7 +720,15 @@ + sc.canonHeader = make(map[string]string) + } + cv = http.CanonicalHeaderKey(v) +- sc.canonHeader[v] = cv ++ // maxCachedCanonicalHeaders is an arbitrarily-chosen limit on the number of ++ // entries in the canonHeader cache. This should be larger than the number ++ // of unique, uncommon header keys likely to be sent by the peer, while not ++ // so high as to permit unreaasonable memory usage if the peer sends an unbounded ++ // number of unique header keys. ++ const maxCachedCanonicalHeaders = 32 ++ if len(sc.canonHeader) < maxCachedCanonicalHeaders { ++ sc.canonHeader[v] = cv ++ } + return cv + } diff --git a/SPECS/libcontainers-common/libcontainers-common.spec b/SPECS/libcontainers-common/libcontainers-common.spec index 36dfab2a662..94f8790f0ac 100644 --- a/SPECS/libcontainers-common/libcontainers-common.spec +++ b/SPECS/libcontainers-common/libcontainers-common.spec @@ -26,7 +26,7 @@ Summary: Configuration files common to github.com/containers Name: libcontainers-common Version: 20210626 -Release: 2%{?dist} +Release: 3%{?dist} License: ASL 2.0 AND GPLv3 Vendor: Microsoft Corporation Distribution: Mariner @@ -47,6 +47,7 @@ Source8: default.yaml #Source9: https://github.com/containers/common/archive/refs/tags/v0.44.0.tar.gz Source9: %{name}-common-%{commonver}.tar.gz Source10: containers.conf +Patch0: CVE-2021-44716.patch BuildRequires: go-go-md2man Requires(post): grep Requires(post): util-linux @@ -63,6 +64,7 @@ github.com/containers libraries, such as Buildah, CRI-O, Podman and Skopeo. %setup -q -T -D -b 1 -n storage-%{storagever} %setup -q -T -D -b 7 -n podman-%{podmanver} %setup -q -T -D -b 9 -n common-%{commonver} +%patch 0 -p1 # copy the LICENSE file in the build root cd .. cp %{SOURCE2} . @@ -158,6 +160,9 @@ fi %license LICENSE %changelog +* Mon Feb 05 2024 Osama Esmail - 20210526-3 +- Patching CVE-2021-44716 + * Thu Oct 19 2023 Dan Streetman - 20210626-2 - Bump release to rebuild with updated version of Go. diff --git a/SPECS/libnvidia-container/libnvidia-container.spec b/SPECS/libnvidia-container/libnvidia-container.spec index fb5bad6a065..7f7930d43f2 100644 --- a/SPECS/libnvidia-container/libnvidia-container.spec +++ b/SPECS/libnvidia-container/libnvidia-container.spec @@ -4,7 +4,7 @@ Summary: NVIDIA container runtime library Name: libnvidia-container Version: 1.13.5 -Release: 4%{?dist} +Release: 5%{?dist} License: BSD AND ASL2.0 AND GPLv3+ AND LGPLv3+ AND MIT AND GPLv2 Vendor: Microsoft Corporation Distribution: Mariner @@ -132,6 +132,9 @@ This package contains command-line tools that facilitate using the library. %{_bindir}/* %changelog +* Fri Feb 02 2024 CBL-Mariner Servicing Account - 1.13.5-5 +- Bump release to rebuild with go 1.21.6 + * Mon Oct 16 2023 CBL-Mariner Servicing Account - 1.13.5-4 - Bump release to rebuild with go 1.20.9 diff --git a/SPECS/local-path-provisioner/CVE-2021-44716.patch b/SPECS/local-path-provisioner/CVE-2021-44716.patch new file mode 100644 index 00000000000..5c871692014 --- /dev/null +++ b/SPECS/local-path-provisioner/CVE-2021-44716.patch @@ -0,0 +1,50 @@ +Parent: db4efeb8 (http2: deflake TestTransportGroupsPendingDials) +Author: Damien Neil +AuthorDate: 2021-12-06 14:31:43 -0800 +Commit: Filippo Valsorda +CommitDate: 2021-12-09 12:49:13 +0000 + +http2: cap the size of the server's canonical header cache + +The HTTP/2 server keeps a per-connection cache mapping header keys +to their canonicalized form (e.g., "foo-bar" => "Foo-Bar"). Cap the +maximum size of this cache to prevent a peer sending many unique +header keys from causing unbounded memory growth. + +Cap chosen arbitrarily at 32 entries. Since this cache does not +include common headers (e.g., "content-type"), 32 seems like more +than enough for almost all normal uses. + +Fixes #50058 +Fixes CVE-2021-44716 + +Change-Id: Ia83696dc23253c12af8f26d502557c2cc9841105 +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1290827 +Reviewed-by: Roland Shoemaker +Reviewed-on: https://go-review.googlesource.com/c/net/+/369794 +Trust: Filippo Valsorda +Run-TryBot: Filippo Valsorda +Trust: Damien Neil +Reviewed-by: Russ Cox +Reviewed-by: Filippo Valsorda +TryBot-Result: Gopher Robot + +diff -ru cli-20.10.27-orig/vendor/golang.org/x/net/http2/server.go cli-20.10.27/vendor/golang.org/x/net/http2/server.go +--- cli-20.10.27-orig/vendor/golang.org/x/net/http2/server.go 2024-02-05 08:53:30.802532951 -0800 ++++ cli-20.10.27/vendor/golang.org/x/net/http2/server.go 2024-02-05 09:19:08.473430121 -0800 +@@ -720,7 +720,15 @@ + sc.canonHeader = make(map[string]string) + } + cv = http.CanonicalHeaderKey(v) +- sc.canonHeader[v] = cv ++ // maxCachedCanonicalHeaders is an arbitrarily-chosen limit on the number of ++ // entries in the canonHeader cache. This should be larger than the number ++ // of unique, uncommon header keys likely to be sent by the peer, while not ++ // so high as to permit unreaasonable memory usage if the peer sends an unbounded ++ // number of unique header keys. ++ const maxCachedCanonicalHeaders = 32 ++ if len(sc.canonHeader) < maxCachedCanonicalHeaders { ++ sc.canonHeader[v] = cv ++ } + return cv + } diff --git a/SPECS/local-path-provisioner/CVE-2022-21698.patch b/SPECS/local-path-provisioner/CVE-2022-21698.patch index d182f16619a..d57405ed3bf 100644 --- a/SPECS/local-path-provisioner/CVE-2022-21698.patch +++ b/SPECS/local-path-provisioner/CVE-2022-21698.patch @@ -43,10 +43,10 @@ Signed-off-by: Kemal Akkoyun 3 files changed, 116 insertions(+), 25 deletions(-) create mode 100644 prometheus/promhttp/option.go -diff --git a/prometheus/promhttp/instrument_client.go b/prometheus/promhttp/instrument_client.go +diff --git a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go index 83c49b6..861b4d2 100644 ---- a/prometheus/promhttp/instrument_client.go -+++ b/prometheus/promhttp/instrument_client.go +--- a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go ++++ b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go @@ -49,7 +49,10 @@ func InstrumentRoundTripperInFlight(gauge prometheus.Gauge, next http.RoundTripp // http.RoundTripper to observe the request result with the provided CounterVec. // The CounterVec must have zero, one, or two non-const non-curried labels. For @@ -114,10 +114,10 @@ index 83c49b6..861b4d2 100644 } return resp, err }) -diff --git a/prometheus/promhttp/instrument_server.go b/prometheus/promhttp/instrument_server.go +diff --git a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go index 9db2438..91802f8 100644 ---- a/prometheus/promhttp/instrument_server.go -+++ b/prometheus/promhttp/instrument_server.go +--- a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go ++++ b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go @@ -58,7 +58,12 @@ func InstrumentHandlerInFlight(g prometheus.Gauge, next http.Handler) http.Handl // // Note that this method is only guaranteed to never observe negative durations @@ -322,11 +322,11 @@ index 9db2438..91802f8 100644 + return "unknown" } } -diff --git a/prometheus/promhttp/option.go b/prometheus/promhttp/option.go +diff --git a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/option.go b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/option.go new file mode 100644 index 0000000..35e41bd --- /dev/null -+++ b/prometheus/promhttp/option.go ++++ b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/option.go @@ -0,0 +1,31 @@ +// Copyright 2022 The Prometheus Authors +// Licensed under the Apache License, Version 2.0 (the "License"); diff --git a/SPECS/local-path-provisioner/CVE-2023-44487.patch b/SPECS/local-path-provisioner/CVE-2023-44487.patch new file mode 100644 index 00000000000..dd5656aade4 --- /dev/null +++ b/SPECS/local-path-provisioner/CVE-2023-44487.patch @@ -0,0 +1,143 @@ +From f894329282d8fd3b34e62190266fce58c8e3a60f Mon Sep 17 00:00:00 2001 +From: Damien Neil +Date: Fri, 6 Oct 2023 09:51:19 -0700 +Subject: [PATCH] http2: limit maximum handler goroutines to + MaxConcurrentStreams + +When the peer opens a new stream while we have MaxConcurrentStreams +handler goroutines running, defer starting a handler until one +of the existing handlers exits. + +Fixes golang/go#63417 +Fixes CVE-2023-39325 + +Change-Id: If0531e177b125700f3e24c5ebd24b1023098fa6d +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2045854 +TryBot-Result: Security TryBots +Reviewed-by: Ian Cottrell +Reviewed-by: Tatiana Bradley +Run-TryBot: Damien Neil +Reviewed-on: https://go-review.googlesource.com/c/net/+/534215 +Reviewed-by: Michael Pratt +Reviewed-by: Dmitri Shuralyov +LUCI-TryBot-Result: Go LUCI +Auto-Submit: Dmitri Shuralyov +Reviewed-by: Damien Neil + +Modified to apply to vendored code by: Daniel McIlvaney + - Adjusted paths + - Removed reference to server_test.go + - Removed reference to upgradeRequest() which is not in old versions of the vendored code + - Removed reference to countError() which is not in old versions of the vendored code +--- + .../vendor/golang.org/x/net/http2/server.go | 62 ++++++++++++++++++- + 1 file changed, 60 insertions(+), 2 deletions(-) + +diff --git a/vendor/golang.org/x/net/http2/server.go b/vendor/golang.org/x/net/http2/server.go +index 2aa859f..126a9e2 100644 +--- a/vendor/golang.org/x/net/http2/server.go ++++ b/vendor/golang.org/x/net/http2/server.go +@@ -521,9 +521,11 @@ type serverConn struct { + advMaxStreams uint32 // our SETTINGS_MAX_CONCURRENT_STREAMS advertised the client + curClientStreams uint32 // number of open streams initiated by the client + curPushedStreams uint32 // number of open streams initiated by server push ++ curHandlers uint32 // number of running handler goroutines + maxClientStreamID uint32 // max ever seen from client (odd), or 0 if there have been no client requests + maxPushPromiseID uint32 // ID of the last push promise (even), or 0 if there have been no pushes + streams map[uint32]*stream ++ unstartedHandlers []unstartedHandler + initialStreamSendWindowSize int32 + maxFrameSize int32 + headerTableSize uint32 +@@ -893,6 +895,8 @@ func (sc *serverConn) serve() { + return + case gracefulShutdownMsg: + sc.startGracefulShutdownInternal() ++ case handlerDoneMsg: ++ sc.handlerDone() + default: + panic("unknown timer") + } +@@ -938,6 +942,7 @@ var ( + idleTimerMsg = new(serverMessage) + shutdownTimerMsg = new(serverMessage) + gracefulShutdownMsg = new(serverMessage) ++ handlerDoneMsg = new(serverMessage) + ) + + func (sc *serverConn) onSettingsTimer() { sc.sendServeMsg(settingsTimerMsg) } +@@ -1879,8 +1884,7 @@ func (sc *serverConn) processHeaders(f *MetaHeadersFrame) error { + sc.conn.SetReadDeadline(time.Time{}) + } + +- go sc.runHandler(rw, req, handler) +- return nil ++ return sc.scheduleHandler(id, rw, req, handler) + } + + func (st *stream) processTrailerHeaders(f *MetaHeadersFrame) error { +@@ -2127,8 +2131,62 @@ func (sc *serverConn) newWriterAndRequestNoBody(st *stream, rp requestParam) (*r + return rw, req, nil + } + ++type unstartedHandler struct { ++ streamID uint32 ++ rw *responseWriter ++ req *http.Request ++ handler func(http.ResponseWriter, *http.Request) ++} ++ ++// scheduleHandler starts a handler goroutine, ++// or schedules one to start as soon as an existing handler finishes. ++func (sc *serverConn) scheduleHandler(streamID uint32, rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) error { ++ sc.serveG.check() ++ maxHandlers := sc.advMaxStreams ++ if sc.curHandlers < maxHandlers { ++ sc.curHandlers++ ++ go sc.runHandler(rw, req, handler) ++ return nil ++ } ++ if len(sc.unstartedHandlers) > int(4*sc.advMaxStreams) { ++ return ConnectionError(ErrCodeEnhanceYourCalm) ++ } ++ sc.unstartedHandlers = append(sc.unstartedHandlers, unstartedHandler{ ++ streamID: streamID, ++ rw: rw, ++ req: req, ++ handler: handler, ++ }) ++ return nil ++} ++ ++func (sc *serverConn) handlerDone() { ++ sc.serveG.check() ++ sc.curHandlers-- ++ i := 0 ++ maxHandlers := sc.advMaxStreams ++ for ; i < len(sc.unstartedHandlers); i++ { ++ u := sc.unstartedHandlers[i] ++ if sc.streams[u.streamID] == nil { ++ // This stream was reset before its goroutine had a chance to start. ++ continue ++ } ++ if sc.curHandlers >= maxHandlers { ++ break ++ } ++ sc.curHandlers++ ++ go sc.runHandler(u.rw, u.req, u.handler) ++ sc.unstartedHandlers[i] = unstartedHandler{} // don't retain references ++ } ++ sc.unstartedHandlers = sc.unstartedHandlers[i:] ++ if len(sc.unstartedHandlers) == 0 { ++ sc.unstartedHandlers = nil ++ } ++} ++ + // Run on its own goroutine. + func (sc *serverConn) runHandler(rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) { ++ defer sc.sendServeMsg(handlerDoneMsg) + didPanic := true + defer func() { + rw.rws.stream.cancelCtx() +-- +2.33.8 diff --git a/SPECS/local-path-provisioner/local-path-provisioner.spec b/SPECS/local-path-provisioner/local-path-provisioner.spec index 8b59d743caf..d382f2007fb 100644 --- a/SPECS/local-path-provisioner/local-path-provisioner.spec +++ b/SPECS/local-path-provisioner/local-path-provisioner.spec @@ -1,7 +1,7 @@ Summary: Provides a way for the Kubernetes users to utilize the local storage in each node Name: local-path-provisioner Version: 0.0.21 -Release: 14%{?dist} +Release: 16%{?dist} License: ASL 2.0 URL: https://github.com/rancher/local-path-provisioner Group: Applications/Text @@ -11,19 +11,20 @@ Source0: https://github.com/rancher/%{name}/archive/refs/tags/v%{version} #Note that the source file should be renamed to the format {name}-%{version}.tar.gz # Fixed in upstream 0.0.24, so we can remove this patch when we upgrade to that version Patch0: CVE-2022-21698.patch +Patch1: CVE-2021-44716.patch +Patch2: CVE-2023-44487.patch BuildRequires: golang %description -Provides a way for the Kubernetes users to utilize the local storage in each node. +Provides a way for the Kubernetes users to utilize the local storage in each node. %prep -%setup -q -%patch 0 -p1 -d vendor/github.com/prometheus/client_golang +%autosetup -p1 %build export CGO_ENABLED=0 -go build -mod=vendor +go build -mod=vendor %install install -d %{buildroot}%{_bindir} @@ -33,6 +34,12 @@ install local-path-provisioner %{buildroot}%{_bindir}/local-path-provisioner %{_bindir}/local-path-provisioner %changelog +* Wed Feb 07 2024 Daniel McIlvaney - 0.0.21-16 +- Address CVE-2023-44487 by patching vendored golang.org/x/net + +* Tue Feb 06 2024 Osama Esmail - 0.0.21-15 +- Fix CVE-2021-44716 + * Wed Jan 31 2024 Tobias Brick - 0.0.21-14 - Fix CVE-2022-21698 diff --git a/SPECS/lz4/lz4.signatures.json b/SPECS/lz4/lz4.signatures.json index 62fcddfdbb6..feb792d607f 100644 --- a/SPECS/lz4/lz4.signatures.json +++ b/SPECS/lz4/lz4.signatures.json @@ -1,5 +1,5 @@ { "Signatures": { - "lz4-1.9.3.tar.gz": "030644df4611007ff7dc962d981f390361e6c97a34e5cbc393ddfbe019ffe2c1" + "lz4-1.9.4.tar.gz": "0b0e3aa07c8c063ddf40b082bdf7e37a1562bda40a0ff5272957f3e987e0e54b" } } \ No newline at end of file diff --git a/SPECS/lz4/lz4.spec b/SPECS/lz4/lz4.spec index d3caa96a8e0..a277791caaa 100644 --- a/SPECS/lz4/lz4.spec +++ b/SPECS/lz4/lz4.spec @@ -1,6 +1,6 @@ Summary: Extremely fast compression. Name: lz4 -Version: 1.9.3 +Version: 1.9.4 Release: 1%{?dist} License: BSD 2-Clause and GPLv2 Vendor: Microsoft Corporation @@ -56,6 +56,9 @@ make install DESTDIR=%{buildroot} LIBDIR=%{_libdir} PREFIX=%{_prefix} %{_includedir}/* %changelog +* Mon Feb 05 2024 Rohit Rawat - 1.9.4-1 +- Upgrade to 1.9.4-1 to fix CVE-2021-3520 + * Thu Feb 17 2022 Max Brodeur-Urbas - 1.9.3-1 - Update to version 1.9.3 - License verified. diff --git a/SPECS/moby-buildx/CVE-2022-21698.patch b/SPECS/moby-buildx/CVE-2022-21698.patch index d703e4b707e..0964671cd95 100644 --- a/SPECS/moby-buildx/CVE-2022-21698.patch +++ b/SPECS/moby-buildx/CVE-2022-21698.patch @@ -43,10 +43,10 @@ Co-authored-by: Kemal Akkoyun 3 files changed, 138 insertions(+), 32 deletions(-) create mode 100644 prometheus/promhttp/option.go -diff --git a/prometheus/promhttp/instrument_client.go b/prometheus/promhttp/instrument_client.go +diff --git a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go index 83c49b6..861b4d2 100644 ---- a/prometheus/promhttp/instrument_client.go -+++ b/prometheus/promhttp/instrument_client.go +--- a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go ++++ b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go @@ -49,7 +49,10 @@ func InstrumentRoundTripperInFlight(gauge prometheus.Gauge, next http.RoundTripp // http.RoundTripper to observe the request result with the provided CounterVec. // The CounterVec must have zero, one, or two non-const non-curried labels. For @@ -114,10 +114,10 @@ index 83c49b6..861b4d2 100644 } return resp, err }) -diff --git a/prometheus/promhttp/instrument_server.go b/prometheus/promhttp/instrument_server.go +diff --git a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go index ab037db..a23f0ed 100644 ---- a/prometheus/promhttp/instrument_server.go -+++ b/prometheus/promhttp/instrument_server.go +--- a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go ++++ b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go @@ -45,7 +45,10 @@ func InstrumentHandlerInFlight(g prometheus.Gauge, next http.Handler) http.Handl // http.Handler to observe the request duration with the provided ObserverVec. // The ObserverVec must have valid metric and label names and must have zero, @@ -386,11 +386,11 @@ index ab037db..a23f0ed 100644 + return "unknown" } } -diff --git a/prometheus/promhttp/option.go b/prometheus/promhttp/option.go +diff --git a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/option.go b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/option.go new file mode 100644 index 0000000..35e41bd --- /dev/null -+++ b/prometheus/promhttp/option.go ++++ b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/option.go @@ -0,0 +1,31 @@ +// Copyright 2022 The Prometheus Authors +// Licensed under the Apache License, Version 2.0 (the "License"); diff --git a/SPECS/moby-buildx/CVE-2023-44487.patch b/SPECS/moby-buildx/CVE-2023-44487.patch new file mode 100644 index 00000000000..b979779a031 --- /dev/null +++ b/SPECS/moby-buildx/CVE-2023-44487.patch @@ -0,0 +1,143 @@ +From e5d2d20ca92b7868ca601b41b0109326f59d9198 Mon Sep 17 00:00:00 2001 +From: Damien Neil +Date: Fri, 6 Oct 2023 09:51:19 -0700 +Subject: [PATCH] http2: limit maximum handler goroutines to + MaxConcurrentStreams + +When the peer opens a new stream while we have MaxConcurrentStreams +handler goroutines running, defer starting a handler until one +of the existing handlers exits. + +Fixes golang/go#63417 +Fixes CVE-2023-39325 + +Change-Id: If0531e177b125700f3e24c5ebd24b1023098fa6d +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2045854 +TryBot-Result: Security TryBots +Reviewed-by: Ian Cottrell +Reviewed-by: Tatiana Bradley +Run-TryBot: Damien Neil +Reviewed-on: https://go-review.googlesource.com/c/net/+/534215 +Reviewed-by: Michael Pratt +Reviewed-by: Dmitri Shuralyov +LUCI-TryBot-Result: Go LUCI +Auto-Submit: Dmitri Shuralyov +Reviewed-by: Damien Neil + +Modified to apply to vendored code by: Daniel McIlvaney + - Adjusted paths + - Removed reference to server_test.go + - Removed reference to upgradeRequest() which is not in old versions of the vendored code + - Removed reference to countError() which is not in old versions of the vendored code +--- + .../vendor/golang.org/x/net/http2/server.go | 62 ++++++++++++++++++- + 1 file changed, 60 insertions(+), 2 deletions(-) + +diff --git a/vendor/golang.org/x/net/http2/server.go b/vendor/golang.org/x/net/http2/server.go +index 09bc705..390243f 100644 +--- a/vendor/golang.org/x/net/http2/server.go ++++ b/vendor/golang.org/x/net/http2/server.go +@@ -515,9 +515,11 @@ type serverConn struct { + advMaxStreams uint32 // our SETTINGS_MAX_CONCURRENT_STREAMS advertised the client + curClientStreams uint32 // number of open streams initiated by the client + curPushedStreams uint32 // number of open streams initiated by server push ++ curHandlers uint32 // number of running handler goroutines + maxClientStreamID uint32 // max ever seen from client (odd), or 0 if there have been no client requests + maxPushPromiseID uint32 // ID of the last push promise (even), or 0 if there have been no pushes + streams map[uint32]*stream ++ unstartedHandlers []unstartedHandler + initialStreamSendWindowSize int32 + maxFrameSize int32 + headerTableSize uint32 +@@ -887,6 +889,8 @@ func (sc *serverConn) serve() { + return + case gracefulShutdownMsg: + sc.startGracefulShutdownInternal() ++ case handlerDoneMsg: ++ sc.handlerDone() + default: + panic("unknown timer") + } +@@ -932,6 +936,7 @@ var ( + idleTimerMsg = new(serverMessage) + shutdownTimerMsg = new(serverMessage) + gracefulShutdownMsg = new(serverMessage) ++ handlerDoneMsg = new(serverMessage) + ) + + func (sc *serverConn) onSettingsTimer() { sc.sendServeMsg(settingsTimerMsg) } +@@ -1889,8 +1894,7 @@ func (sc *serverConn) processHeaders(f *MetaHeadersFrame) error { + sc.conn.SetReadDeadline(time.Time{}) + } + +- go sc.runHandler(rw, req, handler) +- return nil ++ return sc.scheduleHandler(id, rw, req, handler) + } + + func (st *stream) processTrailerHeaders(f *MetaHeadersFrame) error { +@@ -2137,8 +2141,62 @@ func (sc *serverConn) newWriterAndRequestNoBody(st *stream, rp requestParam) (*r + return rw, req, nil + } + ++type unstartedHandler struct { ++ streamID uint32 ++ rw *responseWriter ++ req *http.Request ++ handler func(http.ResponseWriter, *http.Request) ++} ++ ++// scheduleHandler starts a handler goroutine, ++// or schedules one to start as soon as an existing handler finishes. ++func (sc *serverConn) scheduleHandler(streamID uint32, rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) error { ++ sc.serveG.check() ++ maxHandlers := sc.advMaxStreams ++ if sc.curHandlers < maxHandlers { ++ sc.curHandlers++ ++ go sc.runHandler(rw, req, handler) ++ return nil ++ } ++ if len(sc.unstartedHandlers) > int(4*sc.advMaxStreams) { ++ return ConnectionError(ErrCodeEnhanceYourCalm) ++ } ++ sc.unstartedHandlers = append(sc.unstartedHandlers, unstartedHandler{ ++ streamID: streamID, ++ rw: rw, ++ req: req, ++ handler: handler, ++ }) ++ return nil ++} ++ ++func (sc *serverConn) handlerDone() { ++ sc.serveG.check() ++ sc.curHandlers-- ++ i := 0 ++ maxHandlers := sc.advMaxStreams ++ for ; i < len(sc.unstartedHandlers); i++ { ++ u := sc.unstartedHandlers[i] ++ if sc.streams[u.streamID] == nil { ++ // This stream was reset before its goroutine had a chance to start. ++ continue ++ } ++ if sc.curHandlers >= maxHandlers { ++ break ++ } ++ sc.curHandlers++ ++ go sc.runHandler(u.rw, u.req, u.handler) ++ sc.unstartedHandlers[i] = unstartedHandler{} // don't retain references ++ } ++ sc.unstartedHandlers = sc.unstartedHandlers[i:] ++ if len(sc.unstartedHandlers) == 0 { ++ sc.unstartedHandlers = nil ++ } ++} ++ + // Run on its own goroutine. + func (sc *serverConn) runHandler(rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) { ++ defer sc.sendServeMsg(handlerDoneMsg) + didPanic := true + defer func() { + rw.rws.stream.cancelCtx() +-- +2.33.8 diff --git a/SPECS/moby-buildx/moby-buildx.spec b/SPECS/moby-buildx/moby-buildx.spec index 105f7748887..f96968bd476 100644 --- a/SPECS/moby-buildx/moby-buildx.spec +++ b/SPECS/moby-buildx/moby-buildx.spec @@ -5,7 +5,7 @@ Summary: A Docker CLI plugin for extended build capabilities with BuildKi Name: moby-%{upstream_name} # update "commit_hash" above when upgrading version Version: 0.7.1 -Release: 16%{?dist} +Release: 17%{?dist} License: ASL 2.0 Group: Tools/Container Vendor: Microsoft Corporation @@ -14,6 +14,7 @@ URL: https://www.github.com/docker/buildx Source0: https://github.com/docker/buildx/archive/refs/tags/v%{version}.tar.gz#/%{name}-%{version}.tar.gz # Fixed in upstream v0.8.0. Can remove when we upgrade to that version. Patch0: CVE-2022-21698.patch +Patch1: CVE-2023-44487.patch BuildRequires: bash BuildRequires: golang >= 1.17 @@ -26,8 +27,7 @@ Conflicts: docker-ee A Docker CLI plugin for extended build capabilities with BuildKit %prep -%setup -q -n %{upstream_name}-%{version} -%patch 0 -p1 -d vendor/github.com/prometheus/client_golang +%autosetup -p1 -n %{upstream_name}-%{version} %build export CGO_ENABLED=0 @@ -45,6 +45,9 @@ cp -aT buildx "%{buildroot}/%{_libexecdir}/docker/cli-plugins/docker-buildx" %{_libexecdir}/docker/cli-plugins/docker-buildx %changelog +* Wed Feb 07 2024 Daniel McIlvaney - 0.7.1-17 +- Address CVE-2023-44487 by patching vendored golang.org/x/net + * Thu Feb 01 2024 Tobias Brick - 0.7.1-16 - Fix CVE-2022-21698 diff --git a/SPECS/moby-cli/CVE-2021-44716.patch b/SPECS/moby-cli/CVE-2021-44716.patch new file mode 100644 index 00000000000..dc3adbff678 --- /dev/null +++ b/SPECS/moby-cli/CVE-2021-44716.patch @@ -0,0 +1,51 @@ +Parent: db4efeb8 (http2: deflake TestTransportGroupsPendingDials) +Author: Damien Neil +AuthorDate: 2021-12-06 14:31:43 -0800 +Commit: Filippo Valsorda +CommitDate: 2021-12-09 12:49:13 +0000 + +http2: cap the size of the server's canonical header cache + +The HTTP/2 server keeps a per-connection cache mapping header keys +to their canonicalized form (e.g., "foo-bar" => "Foo-Bar"). Cap the +maximum size of this cache to prevent a peer sending many unique +header keys from causing unbounded memory growth. + +Cap chosen arbitrarily at 32 entries. Since this cache does not +include common headers (e.g., "content-type"), 32 seems like more +than enough for almost all normal uses. + +Fixes #50058 +Fixes CVE-2021-44716 + +Change-Id: Ia83696dc23253c12af8f26d502557c2cc9841105 +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1290827 +Reviewed-by: Roland Shoemaker +Reviewed-on: https://go-review.googlesource.com/c/net/+/369794 +Trust: Filippo Valsorda +Run-TryBot: Filippo Valsorda +Trust: Damien Neil +Reviewed-by: Russ Cox +Reviewed-by: Filippo Valsorda +TryBot-Result: Gopher Robot + +diff -ru cli-20.10.27-orig/vendor/golang.org/x/net/http2/server.go cli-20.10.27/vendor/golang.org/x/net/http2/server.go +--- cli-20.10.27-orig/vendor/golang.org/x/net/http2/server.go 2024-02-05 08:53:30.802532951 -0800 ++++ cli-20.10.27/vendor/golang.org/x/net/http2/server.go 2024-02-05 09:19:08.473430121 -0800 +@@ -720,7 +720,15 @@ + sc.canonHeader = make(map[string]string) + } + cv = http.CanonicalHeaderKey(v) +- sc.canonHeader[v] = cv ++ // maxCachedCanonicalHeaders is an arbitrarily-chosen limit on the number of ++ // entries in the canonHeader cache. This should be larger than the number ++ // of unique, uncommon header keys likely to be sent by the peer, while not ++ // so high as to permit unreaasonable memory usage if the peer sends an unbounded ++ // number of unique header keys. ++ const maxCachedCanonicalHeaders = 32 ++ if len(sc.canonHeader) < maxCachedCanonicalHeaders { ++ sc.canonHeader[v] = cv ++ } + return cv + } + \ No newline at end of file diff --git a/SPECS/moby-cli/CVE-2022-21698.patch b/SPECS/moby-cli/CVE-2022-21698.patch new file mode 100644 index 00000000000..b2c866f6bf5 --- /dev/null +++ b/SPECS/moby-cli/CVE-2022-21698.patch @@ -0,0 +1,364 @@ +From 253029f7ffbade99588df59a8b89a35d99197fe0 Mon Sep 17 00:00:00 2001 +From: Tobias Brick +Date: Tue, 18 Jan 2022 10:19:28 +0100 +Subject: [PATCH] Port upstream patch + https://github.com/prometheus/client_golang/commit/9075cdf61646b5adf54d3ba77a0e4f6c65cb4fd7 + +Differences: +- Removed tests +- Removed some comments that don't merge +- Line numbers and such + +Based on: + +From 9075cdf61646b5adf54d3ba77a0e4f6c65cb4fd7 Mon Sep 17 00:00:00 2001 +From: Kemal Akkoyun +Date: Tue, 18 Jan 2022 10:19:28 +0100 +Subject: [PATCH] promhttp: Check validity of method and code label values + (#962) + +* Check validity of method and code label values + +Signed-off-by: Kemal Akkoyun + +* Use more flexibly functional option pattern for configuration + +Signed-off-by: Kemal Akkoyun + +* Update documentation + +Signed-off-by: Kemal Akkoyun + +* Simplify + +Signed-off-by: Kemal Akkoyun + +* Fix inconsistent method naming + +Signed-off-by: Kemal Akkoyun +--- +vendor/github.com/prometheus/client_golang/prometheuspromhttp/instrument_client.go | 28 ++++++-- +vendor/github.com/prometheus/client_golang/prometheuspromhttp/instrument_server.go | 82 ++++++++++++++++++------ +vendor/github.com/prometheus/client_golang/prometheuspromhttp/option.go | 31 +++++++++ + 3 files changed, 116 insertions(+), 25 deletions(-) + create mode 100644vendor/github.com/prometheus/client_golang/prometheuspromhttp/option.go + +diff --git a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go +index 83c49b6..861b4d2 100644 +--- a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go ++++ b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go +@@ -49,7 +49,10 @@ func InstrumentRoundTripperInFlight(gauge prometheus.Gauge, next http.RoundTripp + // http.RoundTripper to observe the request result with the provided CounterVec. + // The CounterVec must have zero, one, or two non-const non-curried labels. For + // those, the only allowed label names are "code" and "method". The function +-// panics otherwise. Partitioning of the CounterVec happens by HTTP status code ++// panics otherwise. For the "method" label a predefined default label value set ++// is used to filter given values. Values besides predefined values will count ++// as `unknown` method.`WithExtraMethods` can be used to add more ++// methods to the set. Partitioning of the CounterVec happens by HTTP status code + // and/or HTTP method if the respective instance label names are present in the + // CounterVec. For unpartitioned counting, use a CounterVec with zero labels. + // +@@ -57,13 +60,18 @@ func InstrumentRoundTripperInFlight(gauge prometheus.Gauge, next http.RoundTripp + // is not incremented. + // + // See the example for ExampleInstrumentRoundTripperDuration for example usage. +-func InstrumentRoundTripperCounter(counter *prometheus.CounterVec, next http.RoundTripper) RoundTripperFunc { ++func InstrumentRoundTripperCounter(counter *prometheus.CounterVec, next http.RoundTripper, opts ...Option) RoundTripperFunc { ++ rtOpts := &option{} ++ for _, o := range opts { ++ o(rtOpts) ++ } ++ + code, method := checkLabels(counter) + + return RoundTripperFunc(func(r *http.Request) (*http.Response, error) { + resp, err := next.RoundTrip(r) + if err == nil { +- counter.With(labels(code, method, r.Method, resp.StatusCode)).Inc() ++ counter.With(labels(code, method, r.Method, resp.StatusCode, rtOpts.extraMethods...)).Inc() + } + return resp, err + }) +@@ -73,7 +81,10 @@ func InstrumentRoundTripperCounter(counter *prometheus.CounterVec, next http.Rou + // http.RoundTripper to observe the request duration with the provided + // ObserverVec. The ObserverVec must have zero, one, or two non-const + // non-curried labels. For those, the only allowed label names are "code" and +-// "method". The function panics otherwise. The Observe method of the Observer ++// "method". The function panics otherwise. For the "method" label a predefined ++// default label value set is used to filter given values. Values besides ++// predefined values will count as `unknown` method. `WithExtraMethods` ++// can be used to add more methods to the set. The Observe method of the Observer + // in the ObserverVec is called with the request duration in + // seconds. Partitioning happens by HTTP status code and/or HTTP method if the + // respective instance label names are present in the ObserverVec. For +@@ -85,14 +96,19 @@ func InstrumentRoundTripperCounter(counter *prometheus.CounterVec, next http.Rou + // + // Note that this method is only guaranteed to never observe negative durations + // if used with Go1.9+. +-func InstrumentRoundTripperDuration(obs prometheus.ObserverVec, next http.RoundTripper) RoundTripperFunc { ++func InstrumentRoundTripperDuration(obs prometheus.ObserverVec, next http.RoundTripper, opts ...Option) RoundTripperFunc { ++ rtOpts := &option{} ++ for _, o := range opts { ++ o(rtOpts) ++ } ++ + code, method := checkLabels(obs) + + return RoundTripperFunc(func(r *http.Request) (*http.Response, error) { + start := time.Now() + resp, err := next.RoundTrip(r) + if err == nil { +- obs.With(labels(code, method, r.Method, resp.StatusCode)).Observe(time.Since(start).Seconds()) ++ obs.With(labels(code, method, r.Method, resp.StatusCode, rtOpts.extraMethods...)).Observe(time.Since(start).Seconds()) + } + return resp, err + }) +diff --git a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go +index 9db2438..91802f8 100644 +--- a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go ++++ b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go +@@ -58,7 +58,12 @@ func InstrumentHandlerInFlight(g prometheus.Gauge, next http.Handler) http.Handl + // + // Note that this method is only guaranteed to never observe negative durations + // if used with Go1.9+. +-func InstrumentHandlerDuration(obs prometheus.ObserverVec, next http.Handler) http.HandlerFunc { ++func InstrumentHandlerDuration(obs prometheus.ObserverVec, next http.Handler, opts ...Option) http.HandlerFunc { ++ mwOpts := &option{} ++ for _, o := range opts { ++ o(mwOpts) ++ } ++ + code, method := checkLabels(obs) + + if code { +@@ -67,14 +72,14 @@ func InstrumentHandlerDuration(obs prometheus.ObserverVec, next http.Handler) ht + d := newDelegator(w, nil) + next.ServeHTTP(d, r) + +- obs.With(labels(code, method, r.Method, d.Status())).Observe(time.Since(now).Seconds()) ++ obs.With(labels(code, method, r.Method, d.Status(), mwOpts.extraMethods...)).Observe(time.Since(now).Seconds()) + }) + } + + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + now := time.Now() + next.ServeHTTP(w, r) +- obs.With(labels(code, method, r.Method, 0)).Observe(time.Since(now).Seconds()) ++ obs.With(labels(code, method, r.Method, 0, mwOpts.extraMethods...)).Observe(time.Since(now).Seconds()) + }) + } + +@@ -91,20 +96,25 @@ func InstrumentHandlerDuration(obs prometheus.ObserverVec, next http.Handler) ht + // If the wrapped Handler panics, the Counter is not incremented. + // + // See the example for InstrumentHandlerDuration for example usage. +-func InstrumentHandlerCounter(counter *prometheus.CounterVec, next http.Handler) http.HandlerFunc { ++func InstrumentHandlerCounter(counter *prometheus.CounterVec, next http.Handler, opts ...Option) http.HandlerFunc { ++ mwOpts := &option{} ++ for _, o := range opts { ++ o(mwOpts) ++ } ++ + code, method := checkLabels(counter) + + if code { + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + d := newDelegator(w, nil) + next.ServeHTTP(d, r) +- counter.With(labels(code, method, r.Method, d.Status())).Inc() ++ counter.With(labels(code, method, r.Method, d.Status(), mwOpts.extraMethods...)).Inc() + }) + } + + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + next.ServeHTTP(w, r) +- counter.With(labels(code, method, r.Method, 0)).Inc() ++ counter.With(labels(code, method, r.Method, 0, mwOpts.extraMethods...)).Inc() + }) + } + +@@ -126,13 +136,18 @@ func InstrumentHandlerCounter(counter *prometheus.CounterVec, next http.Handler) + // if used with Go1.9+. + // + // See the example for InstrumentHandlerDuration for example usage. +-func InstrumentHandlerTimeToWriteHeader(obs prometheus.ObserverVec, next http.Handler) http.HandlerFunc { ++func InstrumentHandlerTimeToWriteHeader(obs prometheus.ObserverVec, next http.Handler, opts ...Option) http.HandlerFunc { ++ mwOpts := &option{} ++ for _, o := range opts { ++ o(mwOpts) ++ } ++ + code, method := checkLabels(obs) + + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + now := time.Now() + d := newDelegator(w, func(status int) { +- obs.With(labels(code, method, r.Method, status)).Observe(time.Since(now).Seconds()) ++ obs.With(labels(code, method, r.Method, status, mwOpts.extraMethods...)).Observe(time.Since(now).Seconds()) + }) + next.ServeHTTP(d, r) + }) +@@ -154,7 +169,12 @@ func InstrumentHandlerTimeToWriteHeader(obs prometheus.ObserverVec, next http.Ha + // If the wrapped Handler panics, no values are reported. + // + // See the example for InstrumentHandlerDuration for example usage. +-func InstrumentHandlerRequestSize(obs prometheus.ObserverVec, next http.Handler) http.HandlerFunc { ++func InstrumentHandlerRequestSize(obs prometheus.ObserverVec, next http.Handler, opts ...Option) http.HandlerFunc { ++ mwOpts := &option{} ++ for _, o := range opts { ++ o(mwOpts) ++ } ++ + code, method := checkLabels(obs) + + if code { +@@ -162,14 +182,14 @@ func InstrumentHandlerRequestSize(obs prometheus.ObserverVec, next http.Handler) + d := newDelegator(w, nil) + next.ServeHTTP(d, r) + size := computeApproximateRequestSize(r) +- obs.With(labels(code, method, r.Method, d.Status())).Observe(float64(size)) ++ obs.With(labels(code, method, r.Method, d.Status(), mwOpts.extraMethods...)).Observe(float64(size)) + }) + } + + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + next.ServeHTTP(w, r) + size := computeApproximateRequestSize(r) +- obs.With(labels(code, method, r.Method, 0)).Observe(float64(size)) ++ obs.With(labels(code, method, r.Method, 0, mwOpts.extraMethods...)).Observe(float64(size)) + }) + } + +@@ -189,12 +209,18 @@ func InstrumentHandlerRequestSize(obs prometheus.ObserverVec, next http.Handler) + // If the wrapped Handler panics, no values are reported. + // + // See the example for InstrumentHandlerDuration for example usage. +-func InstrumentHandlerResponseSize(obs prometheus.ObserverVec, next http.Handler) http.Handler { ++func InstrumentHandlerResponseSize(obs prometheus.ObserverVec, next http.Handler, opts ...Option) http.Handler { ++ mwOpts := &option{} ++ for _, o := range opts { ++ o(mwOpts) ++ } ++ + code, method := checkLabels(obs) ++ + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + d := newDelegator(w, nil) + next.ServeHTTP(d, r) +- obs.With(labels(code, method, r.Method, d.Status())).Observe(float64(d.Written())) ++ obs.With(labels(code, method, r.Method, d.Status(), mwOpts.extraMethods...)).Observe(float64(d.Written())) + }) + } + +@@ -279,7 +305,7 @@ func isLabelCurried(c prometheus.Collector, label string) bool { + // unnecessary allocations on each request. + var emptyLabels = prometheus.Labels{} + +-func labels(code, method bool, reqMethod string, status int) prometheus.Labels { ++func labels(code, method bool, reqMethod string, status int, extraMethods ...string) prometheus.Labels { + if !(code || method) { + return emptyLabels + } +@@ -289,7 +315,7 @@ func labels(code, method bool, reqMethod string, status int) prometheus.Labels { + labels["code"] = sanitizeCode(status) + } + if method { +- labels["method"] = sanitizeMethod(reqMethod) ++ labels["method"] = sanitizeMethod(reqMethod, extraMethods...) + } + + return labels +@@ -319,7 +345,12 @@ func computeApproximateRequestSize(r *http.Request) int { + return s + } + +-func sanitizeMethod(m string) string { ++// If the wrapped http.Handler has a known method, it will be sanitized and returned. ++// Otherwise, "unknown" will be returned. The known method list can be extended ++// as needed by using extraMethods parameter. ++func sanitizeMethod(m string, extraMethods ...string) string { ++ // See https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods for ++ // the methods chosen as default. + switch m { + case "GET", "get": + return "get" +@@ -337,15 +368,25 @@ func sanitizeMethod(m string) string { + return "options" + case "NOTIFY", "notify": + return "notify" ++ case "TRACE", "trace": ++ return "trace" ++ case "PATCH", "patch": ++ return "patch" + default: +- return strings.ToLower(m) ++ for _, method := range extraMethods { ++ if strings.EqualFold(m, method) { ++ return strings.ToLower(m) ++ } ++ } ++ return "unknown" + } + } + + // If the wrapped http.Handler has not set a status code, i.e. the value is +-// currently 0, santizeCode will return 200, for consistency with behavior in ++// currently 0, sanitizeCode will return 200, for consistency with behavior in + // the stdlib. + func sanitizeCode(s int) string { ++ // See for accepted codes https://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml + switch s { + case 100: + return "100" +@@ -442,6 +483,9 @@ func sanitizeCode(s int) string { + return "511" + + default: +- return strconv.Itoa(s) ++ if s >= 100 && s <= 599 { ++ return strconv.Itoa(s) ++ } ++ return "unknown" + } + } +diff --git a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/option.go b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/option.go +new file mode 100644 +index 0000000..35e41bd +--- /dev/null ++++ b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/option.go +@@ -0,0 +1,31 @@ ++// Copyright 2022 The Prometheus Authors ++// Licensed under the Apache License, Version 2.0 (the "License"); ++// you may not use this file except in compliance with the License. ++// You may obtain a copy of the License at ++// ++// http://www.apache.org/licenses/LICENSE-2.0 ++// ++// Unless required by applicable law or agreed to in writing, software ++// distributed under the License is distributed on an "AS IS" BASIS, ++// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. ++// See the License for the specific language governing permissions and ++// limitations under the License. ++ ++package promhttp ++ ++// Option are used to configure a middleware or round tripper.. ++type Option func(*option) ++ ++type option struct { ++ extraMethods []string ++} ++ ++// WithExtraMethods adds additional HTTP methods to the list of allowed methods. ++// See https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods for the default list. ++// ++// See the example for ExampleInstrumentHandlerWithExtraMethods for example usage. ++func WithExtraMethods(methods ...string) Option { ++ return func(o *option) { ++ o.extraMethods = methods ++ } ++} +-- +2.33.8 + diff --git a/SPECS/moby-cli/moby-cli.spec b/SPECS/moby-cli/moby-cli.spec index 0432bc86f86..f989bae6763 100644 --- a/SPECS/moby-cli/moby-cli.spec +++ b/SPECS/moby-cli/moby-cli.spec @@ -4,7 +4,7 @@ Summary: The open-source application container engine client. Name: moby-%{upstream_name} Version: 20.10.27 -Release: 2%{?dist} +Release: 5%{?dist} License: ASL 2.0 Group: Tools/Container URL: https://github.com/docker/cli @@ -13,6 +13,8 @@ Distribution: Mariner Source0: https://github.com/docker/cli/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz Patch0: CVE-2023-48795.patch +Patch1: CVE-2022-21698.patch +Patch2: CVE-2021-44716.patch BuildRequires: golang >= 1.16.12 BuildRequires: make @@ -81,6 +83,15 @@ install -p -m 644 contrib/completion/fish/docker.fish %{buildroot}%{_datadir}/fi %{_datadir}/fish/vendor_completions.d/docker.fish %changelog +* Thu Feb 08 2024 Muhammad Falak - 20.10.27-5 +- Bump release to rebuild with go 1.21.6 + +* Mon Feb 05 2024 Nicolas Guibourge - 20.10.27-4 +- Patch CVE-2021-44716 + +* Fri Feb 02 2024 Tobias Brick - 20.10.27-3 +- Patch CVE-2022-21698 + * Tue Jan 9 2024 corvus-callidus <108946721+corvus-callidus@users.noreply.github.com> - 20.10.27-2 - Patch CVE-2023-48795 diff --git a/SPECS/moby-compose/CVE-2023-44487.patch b/SPECS/moby-compose/CVE-2023-44487.patch new file mode 100644 index 00000000000..8dd774b9204 --- /dev/null +++ b/SPECS/moby-compose/CVE-2023-44487.patch @@ -0,0 +1,152 @@ +From d46e08c00adc5db733c22f71656fab007662bca7 Mon Sep 17 00:00:00 2001 +From: Damien Neil +Date: Fri, 6 Oct 2023 09:51:19 -0700 +Subject: [PATCH] http2: limit maximum handler goroutines to + MaxConcurrentStreams + +When the peer opens a new stream while we have MaxConcurrentStreams +handler goroutines running, defer starting a handler until one +of the existing handlers exits. + +Fixes golang/go#63417 +Fixes CVE-2023-39325 + +Change-Id: If0531e177b125700f3e24c5ebd24b1023098fa6d +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2045854 +TryBot-Result: Security TryBots +Reviewed-by: Ian Cottrell +Reviewed-by: Tatiana Bradley +Run-TryBot: Damien Neil +Reviewed-on: https://go-review.googlesource.com/c/net/+/534215 +Reviewed-by: Michael Pratt +Reviewed-by: Dmitri Shuralyov +LUCI-TryBot-Result: Go LUCI +Auto-Submit: Dmitri Shuralyov +Reviewed-by: Damien Neil + +Modified to apply to vendored code by: Daniel McIlvaney + - Adjusted paths + - Removed reference to server_test.go +--- + vendor/golang.org/x/net/http2/server.go | 66 ++++++++++++++++++++++++- + 1 file changed, 64 insertions(+), 2 deletions(-) + +diff --git a/vendor/golang.org/x/net/http2/server.go b/vendor/golang.org/x/net/http2/server.go +index 8cb14f3..6000140 100644 +--- a/vendor/golang.org/x/net/http2/server.go ++++ b/vendor/golang.org/x/net/http2/server.go +@@ -581,9 +581,11 @@ type serverConn struct { + advMaxStreams uint32 // our SETTINGS_MAX_CONCURRENT_STREAMS advertised the client + curClientStreams uint32 // number of open streams initiated by the client + curPushedStreams uint32 // number of open streams initiated by server push ++ curHandlers uint32 // number of running handler goroutines + maxClientStreamID uint32 // max ever seen from client (odd), or 0 if there have been no client requests + maxPushPromiseID uint32 // ID of the last push promise (even), or 0 if there have been no pushes + streams map[uint32]*stream ++ unstartedHandlers []unstartedHandler + initialStreamSendWindowSize int32 + maxFrameSize int32 + peerMaxHeaderListSize uint32 // zero means unknown (default) +@@ -981,6 +983,8 @@ func (sc *serverConn) serve() { + return + case gracefulShutdownMsg: + sc.startGracefulShutdownInternal() ++ case handlerDoneMsg: ++ sc.handlerDone() + default: + panic("unknown timer") + } +@@ -1028,6 +1032,7 @@ var ( + idleTimerMsg = new(serverMessage) + shutdownTimerMsg = new(serverMessage) + gracefulShutdownMsg = new(serverMessage) ++ handlerDoneMsg = new(serverMessage) + ) + + func (sc *serverConn) onSettingsTimer() { sc.sendServeMsg(settingsTimerMsg) } +@@ -2022,8 +2027,7 @@ func (sc *serverConn) processHeaders(f *MetaHeadersFrame) error { + } + } + +- go sc.runHandler(rw, req, handler) +- return nil ++ return sc.scheduleHandler(id, rw, req, handler) + } + + func (sc *serverConn) upgradeRequest(req *http.Request) { +@@ -2043,6 +2047,10 @@ func (sc *serverConn) upgradeRequest(req *http.Request) { + sc.conn.SetReadDeadline(time.Time{}) + } + ++ // This is the first request on the connection, ++ // so start the handler directly rather than going ++ // through scheduleHandler. ++ sc.curHandlers++ + go sc.runHandler(rw, req, sc.handler.ServeHTTP) + } + +@@ -2283,8 +2291,62 @@ func (sc *serverConn) newResponseWriter(st *stream, req *http.Request) *response + return &responseWriter{rws: rws} + } + ++type unstartedHandler struct { ++ streamID uint32 ++ rw *responseWriter ++ req *http.Request ++ handler func(http.ResponseWriter, *http.Request) ++} ++ ++// scheduleHandler starts a handler goroutine, ++// or schedules one to start as soon as an existing handler finishes. ++func (sc *serverConn) scheduleHandler(streamID uint32, rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) error { ++ sc.serveG.check() ++ maxHandlers := sc.advMaxStreams ++ if sc.curHandlers < maxHandlers { ++ sc.curHandlers++ ++ go sc.runHandler(rw, req, handler) ++ return nil ++ } ++ if len(sc.unstartedHandlers) > int(4*sc.advMaxStreams) { ++ return sc.countError("too_many_early_resets", ConnectionError(ErrCodeEnhanceYourCalm)) ++ } ++ sc.unstartedHandlers = append(sc.unstartedHandlers, unstartedHandler{ ++ streamID: streamID, ++ rw: rw, ++ req: req, ++ handler: handler, ++ }) ++ return nil ++} ++ ++func (sc *serverConn) handlerDone() { ++ sc.serveG.check() ++ sc.curHandlers-- ++ i := 0 ++ maxHandlers := sc.advMaxStreams ++ for ; i < len(sc.unstartedHandlers); i++ { ++ u := sc.unstartedHandlers[i] ++ if sc.streams[u.streamID] == nil { ++ // This stream was reset before its goroutine had a chance to start. ++ continue ++ } ++ if sc.curHandlers >= maxHandlers { ++ break ++ } ++ sc.curHandlers++ ++ go sc.runHandler(u.rw, u.req, u.handler) ++ sc.unstartedHandlers[i] = unstartedHandler{} // don't retain references ++ } ++ sc.unstartedHandlers = sc.unstartedHandlers[i:] ++ if len(sc.unstartedHandlers) == 0 { ++ sc.unstartedHandlers = nil ++ } ++} ++ + // Run on its own goroutine. + func (sc *serverConn) runHandler(rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) { ++ defer sc.sendServeMsg(handlerDoneMsg) + didPanic := true + defer func() { + rw.rws.stream.cancelCtx() +-- +2.33.8 diff --git a/SPECS/moby-compose/moby-compose.spec b/SPECS/moby-compose/moby-compose.spec index 21ff35240e3..042f757e56b 100644 --- a/SPECS/moby-compose/moby-compose.spec +++ b/SPECS/moby-compose/moby-compose.spec @@ -1,13 +1,14 @@ Summary: Define and run multi-container applications with Docker Name: moby-compose Version: 2.17.2 -Release: 6%{?dist} +Release: 7%{?dist} License: MIT Vendor: Microsoft Corporation Distribution: Mariner Group: Tools/Container URL: https://github.com/docker/compose Source0: https://github.com/docker/compose/archive/refs/tags/v%{version}.tar.gz#/%{name}-%{version}.tar.gz +Patch0: CVE-2023-44487.patch # Leverage the `generate_source_tarball.sh` to create the vendor sources # NOTE: govendor-v1 format is for inplace CVE updates so that we do not have to overwrite in the blob-store. @@ -24,8 +25,10 @@ Then, with a single command, you create and start all the services from your configuration. %prep -%autosetup -n compose-%{version} +%autosetup -N -n compose-%{version} +# Apply vendor before patching %setup -q -n compose-%{version} -T -D -a 1 +%autopatch -p1 %build go build \ @@ -44,6 +47,9 @@ install -D -m0755 bin/build/docker-compose %{buildroot}/%{_libexecdir}/docker/cl %{_libexecdir}/docker/cli-plugins/docker-compose %changelog +* Fri Feb 02 2024 Daniel McIlvaney - 2.17.2-7 +- Address CVE-2023-44487 by patching vendored golang.org/x/net + * Mon Oct 16 2023 CBL-Mariner Servicing Account - 2.17.2-6 - Bump release to rebuild with go 1.20.9 diff --git a/SPECS/moby-containerd-cc/CVE-2023-44487.patch b/SPECS/moby-containerd-cc/CVE-2023-44487.patch new file mode 100644 index 00000000000..d311a2499cf --- /dev/null +++ b/SPECS/moby-containerd-cc/CVE-2023-44487.patch @@ -0,0 +1,152 @@ +From 84b30b3380727ea94e05c438ab695ea24e38fb0c Mon Sep 17 00:00:00 2001 +From: Damien Neil +Date: Fri, 6 Oct 2023 09:51:19 -0700 +Subject: [PATCH] http2: limit maximum handler goroutines to + MaxConcurrentStreams + +When the peer opens a new stream while we have MaxConcurrentStreams +handler goroutines running, defer starting a handler until one +of the existing handlers exits. + +Fixes golang/go#63417 +Fixes CVE-2023-39325 + +Change-Id: If0531e177b125700f3e24c5ebd24b1023098fa6d +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2045854 +TryBot-Result: Security TryBots +Reviewed-by: Ian Cottrell +Reviewed-by: Tatiana Bradley +Run-TryBot: Damien Neil +Reviewed-on: https://go-review.googlesource.com/c/net/+/534215 +Reviewed-by: Michael Pratt +Reviewed-by: Dmitri Shuralyov +LUCI-TryBot-Result: Go LUCI +Auto-Submit: Dmitri Shuralyov +Reviewed-by: Damien Neil + +Modified to apply to vendored code by: Daniel McIlvaney + - Adjusted paths + - Removed reference to server_test.go +--- + .../vendor/golang.org/x/net/http2/server.go | 66 ++++++++++++++++++- + 1 file changed, 64 insertions(+), 2 deletions(-) + +diff --git a/vendor/golang.org/x/net/http2/server.go b/vendor/golang.org/x/net/http2/server.go +index 8cb14f3..6000140 100644 +--- a/vendor/golang.org/x/net/http2/server.go ++++ b/vendor/golang.org/x/net/http2/server.go +@@ -581,9 +581,11 @@ type serverConn struct { + advMaxStreams uint32 // our SETTINGS_MAX_CONCURRENT_STREAMS advertised the client + curClientStreams uint32 // number of open streams initiated by the client + curPushedStreams uint32 // number of open streams initiated by server push ++ curHandlers uint32 // number of running handler goroutines + maxClientStreamID uint32 // max ever seen from client (odd), or 0 if there have been no client requests + maxPushPromiseID uint32 // ID of the last push promise (even), or 0 if there have been no pushes + streams map[uint32]*stream ++ unstartedHandlers []unstartedHandler + initialStreamSendWindowSize int32 + maxFrameSize int32 + peerMaxHeaderListSize uint32 // zero means unknown (default) +@@ -981,6 +983,8 @@ func (sc *serverConn) serve() { + return + case gracefulShutdownMsg: + sc.startGracefulShutdownInternal() ++ case handlerDoneMsg: ++ sc.handlerDone() + default: + panic("unknown timer") + } +@@ -1028,6 +1032,7 @@ var ( + idleTimerMsg = new(serverMessage) + shutdownTimerMsg = new(serverMessage) + gracefulShutdownMsg = new(serverMessage) ++ handlerDoneMsg = new(serverMessage) + ) + + func (sc *serverConn) onSettingsTimer() { sc.sendServeMsg(settingsTimerMsg) } +@@ -2022,8 +2027,7 @@ func (sc *serverConn) processHeaders(f *MetaHeadersFrame) error { + } + } + +- go sc.runHandler(rw, req, handler) +- return nil ++ return sc.scheduleHandler(id, rw, req, handler) + } + + func (sc *serverConn) upgradeRequest(req *http.Request) { +@@ -2043,6 +2047,10 @@ func (sc *serverConn) upgradeRequest(req *http.Request) { + sc.conn.SetReadDeadline(time.Time{}) + } + ++ // This is the first request on the connection, ++ // so start the handler directly rather than going ++ // through scheduleHandler. ++ sc.curHandlers++ + go sc.runHandler(rw, req, sc.handler.ServeHTTP) + } + +@@ -2283,8 +2291,62 @@ func (sc *serverConn) newResponseWriter(st *stream, req *http.Request) *response + return &responseWriter{rws: rws} + } + ++type unstartedHandler struct { ++ streamID uint32 ++ rw *responseWriter ++ req *http.Request ++ handler func(http.ResponseWriter, *http.Request) ++} ++ ++// scheduleHandler starts a handler goroutine, ++// or schedules one to start as soon as an existing handler finishes. ++func (sc *serverConn) scheduleHandler(streamID uint32, rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) error { ++ sc.serveG.check() ++ maxHandlers := sc.advMaxStreams ++ if sc.curHandlers < maxHandlers { ++ sc.curHandlers++ ++ go sc.runHandler(rw, req, handler) ++ return nil ++ } ++ if len(sc.unstartedHandlers) > int(4*sc.advMaxStreams) { ++ return sc.countError("too_many_early_resets", ConnectionError(ErrCodeEnhanceYourCalm)) ++ } ++ sc.unstartedHandlers = append(sc.unstartedHandlers, unstartedHandler{ ++ streamID: streamID, ++ rw: rw, ++ req: req, ++ handler: handler, ++ }) ++ return nil ++} ++ ++func (sc *serverConn) handlerDone() { ++ sc.serveG.check() ++ sc.curHandlers-- ++ i := 0 ++ maxHandlers := sc.advMaxStreams ++ for ; i < len(sc.unstartedHandlers); i++ { ++ u := sc.unstartedHandlers[i] ++ if sc.streams[u.streamID] == nil { ++ // This stream was reset before its goroutine had a chance to start. ++ continue ++ } ++ if sc.curHandlers >= maxHandlers { ++ break ++ } ++ sc.curHandlers++ ++ go sc.runHandler(u.rw, u.req, u.handler) ++ sc.unstartedHandlers[i] = unstartedHandler{} // don't retain references ++ } ++ sc.unstartedHandlers = sc.unstartedHandlers[i:] ++ if len(sc.unstartedHandlers) == 0 { ++ sc.unstartedHandlers = nil ++ } ++} ++ + // Run on its own goroutine. + func (sc *serverConn) runHandler(rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) { ++ defer sc.sendServeMsg(handlerDoneMsg) + didPanic := true + defer func() { + rw.rws.stream.cancelCtx() +-- +2.33.8 diff --git a/SPECS/moby-containerd-cc/moby-containerd-cc.spec b/SPECS/moby-containerd-cc/moby-containerd-cc.spec index a71f6a2ff9c..7536b250dff 100644 --- a/SPECS/moby-containerd-cc/moby-containerd-cc.spec +++ b/SPECS/moby-containerd-cc/moby-containerd-cc.spec @@ -6,7 +6,7 @@ Summary: Industry-standard container runtime for confidential containers Name: moby-%{upstream_name} Version: 1.7.2 -Release: 3%{?dist} +Release: 4%{?dist} License: ASL 2.0 Group: Tools/Container URL: https://www.containerd.io @@ -17,6 +17,7 @@ Source0: https://github.com/microsoft/confidential-containers-containerd/archiv Source1: containerd.service Source2: containerd.toml Patch0: CVE-2023-47108.patch +Patch1: CVE-2023-44487.patch %{?systemd_requires} @@ -78,6 +79,9 @@ fi %config(noreplace) %{_sysconfdir}/containerd/config.toml %changelog +* Fri Feb 02 2024 Daniel McIlvaney - 1.7.2-4 +- Address CVE-2023-44487 by patching vendored golang.org/x/net + * Wed Dec 20 2023 Manuel Huber - 1.7.2-3 - Set oom_score_adj of containerd to -999 diff --git a/SPECS/moby-containerd/moby-containerd.spec b/SPECS/moby-containerd/moby-containerd.spec index 3b5b285dbf1..4083bc5d059 100644 --- a/SPECS/moby-containerd/moby-containerd.spec +++ b/SPECS/moby-containerd/moby-containerd.spec @@ -5,7 +5,7 @@ Summary: Industry-standard container runtime Name: moby-%{upstream_name} Version: 1.6.26 -Release: 2%{?dist} +Release: 3%{?dist} License: ASL 2.0 Group: Tools/Container URL: https://www.containerd.io @@ -90,6 +90,9 @@ fi %dir /opt/containerd/lib %changelog +* Fri Feb 02 2024 CBL-Mariner Servicing Account - 1.6.26-3 +- Bump release to rebuild with go 1.21.6 + * Wed Dec 20 2023 Ravi Prakash Pandey - 1.6.26-2 - Set oom_score_adj of containerd to -999 and bump the release version to 2 diff --git a/SPECS/moby-engine/CVE-2022-21698.patch b/SPECS/moby-engine/CVE-2022-21698.patch new file mode 100644 index 00000000000..b2c866f6bf5 --- /dev/null +++ b/SPECS/moby-engine/CVE-2022-21698.patch @@ -0,0 +1,364 @@ +From 253029f7ffbade99588df59a8b89a35d99197fe0 Mon Sep 17 00:00:00 2001 +From: Tobias Brick +Date: Tue, 18 Jan 2022 10:19:28 +0100 +Subject: [PATCH] Port upstream patch + https://github.com/prometheus/client_golang/commit/9075cdf61646b5adf54d3ba77a0e4f6c65cb4fd7 + +Differences: +- Removed tests +- Removed some comments that don't merge +- Line numbers and such + +Based on: + +From 9075cdf61646b5adf54d3ba77a0e4f6c65cb4fd7 Mon Sep 17 00:00:00 2001 +From: Kemal Akkoyun +Date: Tue, 18 Jan 2022 10:19:28 +0100 +Subject: [PATCH] promhttp: Check validity of method and code label values + (#962) + +* Check validity of method and code label values + +Signed-off-by: Kemal Akkoyun + +* Use more flexibly functional option pattern for configuration + +Signed-off-by: Kemal Akkoyun + +* Update documentation + +Signed-off-by: Kemal Akkoyun + +* Simplify + +Signed-off-by: Kemal Akkoyun + +* Fix inconsistent method naming + +Signed-off-by: Kemal Akkoyun +--- +vendor/github.com/prometheus/client_golang/prometheuspromhttp/instrument_client.go | 28 ++++++-- +vendor/github.com/prometheus/client_golang/prometheuspromhttp/instrument_server.go | 82 ++++++++++++++++++------ +vendor/github.com/prometheus/client_golang/prometheuspromhttp/option.go | 31 +++++++++ + 3 files changed, 116 insertions(+), 25 deletions(-) + create mode 100644vendor/github.com/prometheus/client_golang/prometheuspromhttp/option.go + +diff --git a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go +index 83c49b6..861b4d2 100644 +--- a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go ++++ b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go +@@ -49,7 +49,10 @@ func InstrumentRoundTripperInFlight(gauge prometheus.Gauge, next http.RoundTripp + // http.RoundTripper to observe the request result with the provided CounterVec. + // The CounterVec must have zero, one, or two non-const non-curried labels. For + // those, the only allowed label names are "code" and "method". The function +-// panics otherwise. Partitioning of the CounterVec happens by HTTP status code ++// panics otherwise. For the "method" label a predefined default label value set ++// is used to filter given values. Values besides predefined values will count ++// as `unknown` method.`WithExtraMethods` can be used to add more ++// methods to the set. Partitioning of the CounterVec happens by HTTP status code + // and/or HTTP method if the respective instance label names are present in the + // CounterVec. For unpartitioned counting, use a CounterVec with zero labels. + // +@@ -57,13 +60,18 @@ func InstrumentRoundTripperInFlight(gauge prometheus.Gauge, next http.RoundTripp + // is not incremented. + // + // See the example for ExampleInstrumentRoundTripperDuration for example usage. +-func InstrumentRoundTripperCounter(counter *prometheus.CounterVec, next http.RoundTripper) RoundTripperFunc { ++func InstrumentRoundTripperCounter(counter *prometheus.CounterVec, next http.RoundTripper, opts ...Option) RoundTripperFunc { ++ rtOpts := &option{} ++ for _, o := range opts { ++ o(rtOpts) ++ } ++ + code, method := checkLabels(counter) + + return RoundTripperFunc(func(r *http.Request) (*http.Response, error) { + resp, err := next.RoundTrip(r) + if err == nil { +- counter.With(labels(code, method, r.Method, resp.StatusCode)).Inc() ++ counter.With(labels(code, method, r.Method, resp.StatusCode, rtOpts.extraMethods...)).Inc() + } + return resp, err + }) +@@ -73,7 +81,10 @@ func InstrumentRoundTripperCounter(counter *prometheus.CounterVec, next http.Rou + // http.RoundTripper to observe the request duration with the provided + // ObserverVec. The ObserverVec must have zero, one, or two non-const + // non-curried labels. For those, the only allowed label names are "code" and +-// "method". The function panics otherwise. The Observe method of the Observer ++// "method". The function panics otherwise. For the "method" label a predefined ++// default label value set is used to filter given values. Values besides ++// predefined values will count as `unknown` method. `WithExtraMethods` ++// can be used to add more methods to the set. The Observe method of the Observer + // in the ObserverVec is called with the request duration in + // seconds. Partitioning happens by HTTP status code and/or HTTP method if the + // respective instance label names are present in the ObserverVec. For +@@ -85,14 +96,19 @@ func InstrumentRoundTripperCounter(counter *prometheus.CounterVec, next http.Rou + // + // Note that this method is only guaranteed to never observe negative durations + // if used with Go1.9+. +-func InstrumentRoundTripperDuration(obs prometheus.ObserverVec, next http.RoundTripper) RoundTripperFunc { ++func InstrumentRoundTripperDuration(obs prometheus.ObserverVec, next http.RoundTripper, opts ...Option) RoundTripperFunc { ++ rtOpts := &option{} ++ for _, o := range opts { ++ o(rtOpts) ++ } ++ + code, method := checkLabels(obs) + + return RoundTripperFunc(func(r *http.Request) (*http.Response, error) { + start := time.Now() + resp, err := next.RoundTrip(r) + if err == nil { +- obs.With(labels(code, method, r.Method, resp.StatusCode)).Observe(time.Since(start).Seconds()) ++ obs.With(labels(code, method, r.Method, resp.StatusCode, rtOpts.extraMethods...)).Observe(time.Since(start).Seconds()) + } + return resp, err + }) +diff --git a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go +index 9db2438..91802f8 100644 +--- a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go ++++ b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go +@@ -58,7 +58,12 @@ func InstrumentHandlerInFlight(g prometheus.Gauge, next http.Handler) http.Handl + // + // Note that this method is only guaranteed to never observe negative durations + // if used with Go1.9+. +-func InstrumentHandlerDuration(obs prometheus.ObserverVec, next http.Handler) http.HandlerFunc { ++func InstrumentHandlerDuration(obs prometheus.ObserverVec, next http.Handler, opts ...Option) http.HandlerFunc { ++ mwOpts := &option{} ++ for _, o := range opts { ++ o(mwOpts) ++ } ++ + code, method := checkLabels(obs) + + if code { +@@ -67,14 +72,14 @@ func InstrumentHandlerDuration(obs prometheus.ObserverVec, next http.Handler) ht + d := newDelegator(w, nil) + next.ServeHTTP(d, r) + +- obs.With(labels(code, method, r.Method, d.Status())).Observe(time.Since(now).Seconds()) ++ obs.With(labels(code, method, r.Method, d.Status(), mwOpts.extraMethods...)).Observe(time.Since(now).Seconds()) + }) + } + + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + now := time.Now() + next.ServeHTTP(w, r) +- obs.With(labels(code, method, r.Method, 0)).Observe(time.Since(now).Seconds()) ++ obs.With(labels(code, method, r.Method, 0, mwOpts.extraMethods...)).Observe(time.Since(now).Seconds()) + }) + } + +@@ -91,20 +96,25 @@ func InstrumentHandlerDuration(obs prometheus.ObserverVec, next http.Handler) ht + // If the wrapped Handler panics, the Counter is not incremented. + // + // See the example for InstrumentHandlerDuration for example usage. +-func InstrumentHandlerCounter(counter *prometheus.CounterVec, next http.Handler) http.HandlerFunc { ++func InstrumentHandlerCounter(counter *prometheus.CounterVec, next http.Handler, opts ...Option) http.HandlerFunc { ++ mwOpts := &option{} ++ for _, o := range opts { ++ o(mwOpts) ++ } ++ + code, method := checkLabels(counter) + + if code { + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + d := newDelegator(w, nil) + next.ServeHTTP(d, r) +- counter.With(labels(code, method, r.Method, d.Status())).Inc() ++ counter.With(labels(code, method, r.Method, d.Status(), mwOpts.extraMethods...)).Inc() + }) + } + + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + next.ServeHTTP(w, r) +- counter.With(labels(code, method, r.Method, 0)).Inc() ++ counter.With(labels(code, method, r.Method, 0, mwOpts.extraMethods...)).Inc() + }) + } + +@@ -126,13 +136,18 @@ func InstrumentHandlerCounter(counter *prometheus.CounterVec, next http.Handler) + // if used with Go1.9+. + // + // See the example for InstrumentHandlerDuration for example usage. +-func InstrumentHandlerTimeToWriteHeader(obs prometheus.ObserverVec, next http.Handler) http.HandlerFunc { ++func InstrumentHandlerTimeToWriteHeader(obs prometheus.ObserverVec, next http.Handler, opts ...Option) http.HandlerFunc { ++ mwOpts := &option{} ++ for _, o := range opts { ++ o(mwOpts) ++ } ++ + code, method := checkLabels(obs) + + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + now := time.Now() + d := newDelegator(w, func(status int) { +- obs.With(labels(code, method, r.Method, status)).Observe(time.Since(now).Seconds()) ++ obs.With(labels(code, method, r.Method, status, mwOpts.extraMethods...)).Observe(time.Since(now).Seconds()) + }) + next.ServeHTTP(d, r) + }) +@@ -154,7 +169,12 @@ func InstrumentHandlerTimeToWriteHeader(obs prometheus.ObserverVec, next http.Ha + // If the wrapped Handler panics, no values are reported. + // + // See the example for InstrumentHandlerDuration for example usage. +-func InstrumentHandlerRequestSize(obs prometheus.ObserverVec, next http.Handler) http.HandlerFunc { ++func InstrumentHandlerRequestSize(obs prometheus.ObserverVec, next http.Handler, opts ...Option) http.HandlerFunc { ++ mwOpts := &option{} ++ for _, o := range opts { ++ o(mwOpts) ++ } ++ + code, method := checkLabels(obs) + + if code { +@@ -162,14 +182,14 @@ func InstrumentHandlerRequestSize(obs prometheus.ObserverVec, next http.Handler) + d := newDelegator(w, nil) + next.ServeHTTP(d, r) + size := computeApproximateRequestSize(r) +- obs.With(labels(code, method, r.Method, d.Status())).Observe(float64(size)) ++ obs.With(labels(code, method, r.Method, d.Status(), mwOpts.extraMethods...)).Observe(float64(size)) + }) + } + + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + next.ServeHTTP(w, r) + size := computeApproximateRequestSize(r) +- obs.With(labels(code, method, r.Method, 0)).Observe(float64(size)) ++ obs.With(labels(code, method, r.Method, 0, mwOpts.extraMethods...)).Observe(float64(size)) + }) + } + +@@ -189,12 +209,18 @@ func InstrumentHandlerRequestSize(obs prometheus.ObserverVec, next http.Handler) + // If the wrapped Handler panics, no values are reported. + // + // See the example for InstrumentHandlerDuration for example usage. +-func InstrumentHandlerResponseSize(obs prometheus.ObserverVec, next http.Handler) http.Handler { ++func InstrumentHandlerResponseSize(obs prometheus.ObserverVec, next http.Handler, opts ...Option) http.Handler { ++ mwOpts := &option{} ++ for _, o := range opts { ++ o(mwOpts) ++ } ++ + code, method := checkLabels(obs) ++ + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + d := newDelegator(w, nil) + next.ServeHTTP(d, r) +- obs.With(labels(code, method, r.Method, d.Status())).Observe(float64(d.Written())) ++ obs.With(labels(code, method, r.Method, d.Status(), mwOpts.extraMethods...)).Observe(float64(d.Written())) + }) + } + +@@ -279,7 +305,7 @@ func isLabelCurried(c prometheus.Collector, label string) bool { + // unnecessary allocations on each request. + var emptyLabels = prometheus.Labels{} + +-func labels(code, method bool, reqMethod string, status int) prometheus.Labels { ++func labels(code, method bool, reqMethod string, status int, extraMethods ...string) prometheus.Labels { + if !(code || method) { + return emptyLabels + } +@@ -289,7 +315,7 @@ func labels(code, method bool, reqMethod string, status int) prometheus.Labels { + labels["code"] = sanitizeCode(status) + } + if method { +- labels["method"] = sanitizeMethod(reqMethod) ++ labels["method"] = sanitizeMethod(reqMethod, extraMethods...) + } + + return labels +@@ -319,7 +345,12 @@ func computeApproximateRequestSize(r *http.Request) int { + return s + } + +-func sanitizeMethod(m string) string { ++// If the wrapped http.Handler has a known method, it will be sanitized and returned. ++// Otherwise, "unknown" will be returned. The known method list can be extended ++// as needed by using extraMethods parameter. ++func sanitizeMethod(m string, extraMethods ...string) string { ++ // See https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods for ++ // the methods chosen as default. + switch m { + case "GET", "get": + return "get" +@@ -337,15 +368,25 @@ func sanitizeMethod(m string) string { + return "options" + case "NOTIFY", "notify": + return "notify" ++ case "TRACE", "trace": ++ return "trace" ++ case "PATCH", "patch": ++ return "patch" + default: +- return strings.ToLower(m) ++ for _, method := range extraMethods { ++ if strings.EqualFold(m, method) { ++ return strings.ToLower(m) ++ } ++ } ++ return "unknown" + } + } + + // If the wrapped http.Handler has not set a status code, i.e. the value is +-// currently 0, santizeCode will return 200, for consistency with behavior in ++// currently 0, sanitizeCode will return 200, for consistency with behavior in + // the stdlib. + func sanitizeCode(s int) string { ++ // See for accepted codes https://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml + switch s { + case 100: + return "100" +@@ -442,6 +483,9 @@ func sanitizeCode(s int) string { + return "511" + + default: +- return strconv.Itoa(s) ++ if s >= 100 && s <= 599 { ++ return strconv.Itoa(s) ++ } ++ return "unknown" + } + } +diff --git a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/option.go b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/option.go +new file mode 100644 +index 0000000..35e41bd +--- /dev/null ++++ b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/option.go +@@ -0,0 +1,31 @@ ++// Copyright 2022 The Prometheus Authors ++// Licensed under the Apache License, Version 2.0 (the "License"); ++// you may not use this file except in compliance with the License. ++// You may obtain a copy of the License at ++// ++// http://www.apache.org/licenses/LICENSE-2.0 ++// ++// Unless required by applicable law or agreed to in writing, software ++// distributed under the License is distributed on an "AS IS" BASIS, ++// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. ++// See the License for the specific language governing permissions and ++// limitations under the License. ++ ++package promhttp ++ ++// Option are used to configure a middleware or round tripper.. ++type Option func(*option) ++ ++type option struct { ++ extraMethods []string ++} ++ ++// WithExtraMethods adds additional HTTP methods to the list of allowed methods. ++// See https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods for the default list. ++// ++// See the example for ExampleInstrumentHandlerWithExtraMethods for example usage. ++func WithExtraMethods(methods ...string) Option { ++ return func(o *option) { ++ o.extraMethods = methods ++ } ++} +-- +2.33.8 + diff --git a/SPECS/moby-engine/moby-engine.spec b/SPECS/moby-engine/moby-engine.spec index be2aec02300..685bba23eae 100644 --- a/SPECS/moby-engine/moby-engine.spec +++ b/SPECS/moby-engine/moby-engine.spec @@ -4,7 +4,7 @@ Summary: The open-source application container engine Name: %{upstream_name}-engine Version: 20.10.27 -Release: 1%{?dist} +Release: 3%{?dist} License: ASL 2.0 Group: Tools/Container URL: https://mobyproject.org @@ -20,6 +20,7 @@ Source1: https://github.com/moby/libnetwork/archive/master.tar.gz/#/%{upstream_n Source3: docker.service Source4: docker.socket Patch0: CVE-2023-25153.patch +Patch1: CVE-2022-21698.patch %{?systemd_requires} @@ -68,6 +69,7 @@ Moby is an open-source project created by Docker to enable and accelerate softwa %prep %autosetup -p1 -n %{upstream_name}-%{version} + tar xf %{SOURCE1} --no-same-owner mkdir -p %{OUR_GOPATH}/src/github.com/docker @@ -126,6 +128,12 @@ fi %{_unitdir}/* %changelog +* Thu Feb 08 2024 Muhammad Falak - 20.10.27-3 +- Bump release to rebuild with go 1.21.6 + +* Fri Feb 02 2024 Tobias Brick - 20.10.27-2 +- Patch CVE-2022-21698 + * Fri Dec 15 2023 Rohit Rawat - 20.10.27-1 - Upgrade version to fix CVE-2020-8694, CVE-2020-8695 and CVE-2020-12912 diff --git a/SPECS/moby-runc/moby-runc.spec b/SPECS/moby-runc/moby-runc.spec index 3722e943803..55573a45f2f 100644 --- a/SPECS/moby-runc/moby-runc.spec +++ b/SPECS/moby-runc/moby-runc.spec @@ -5,7 +5,7 @@ Summary: CLI tool for spawning and running containers per OCI spec. Name: moby-%{upstream_name} # update "commit_hash" above when upgrading version Version: 1.1.9 -Release: 4%{?dist} +Release: 5%{?dist} License: ASL 2.0 URL: https://github.com/opencontainers/runc Group: Virtualization/Libraries @@ -58,6 +58,9 @@ make install-man DESTDIR="%{buildroot}" PREFIX="%{_prefix}" %{_mandir}/* %changelog +* Fri Feb 02 2024 CBL-Mariner Servicing Account - 1.1.9-5 +- Bump release to rebuild with go 1.21.6 + * Tue Jan 23 2024 Muhammad Falak - 1.1.9-4 - Address CVE-2024-21626 - Switch to autosetup diff --git a/SPECS/msft-golang/msft-golang.signatures.json b/SPECS/msft-golang/msft-golang.signatures.json index aa5b3bc111a..0774280ff89 100644 --- a/SPECS/msft-golang/msft-golang.signatures.json +++ b/SPECS/msft-golang/msft-golang.signatures.json @@ -1,7 +1,7 @@ { "Signatures": { "go.20230802.5.src.tar.gz": "56b9e0e0c3c13ca95d5efa6de4e7d49a9d190eca77919beff99d33cd3fa74e95", - "go.20231107.4.src.tar.gz": "91f65dd825d40f7da7fb53e8713c4f25545feb49eb66f4e491bf5540bcec7287", + "go.20240111.3.src.tar.gz": "45bb84358f15783271835c97c9034fcc2e0da60d1d854683e6300703a5b6770b", "go1.4-bootstrap-20171003.tar.gz": "f4ff5b5eb3a3cae1c993723f3eab519c5bae18866b5e5f96fe1102f0cb5c3e52" } } \ No newline at end of file diff --git a/SPECS/msft-golang/msft-golang.spec b/SPECS/msft-golang/msft-golang.spec index da89aee2aeb..d00ec6710c7 100644 --- a/SPECS/msft-golang/msft-golang.spec +++ b/SPECS/msft-golang/msft-golang.spec @@ -13,14 +13,14 @@ %define __find_requires %{nil} Summary: Go Name: msft-golang -Version: 1.20.11 +Version: 1.21.6 Release: 1%{?dist} License: BSD Vendor: Microsoft Corporation Distribution: Mariner Group: System Environment/Security URL: https://github.com/microsoft/go -Source0: https://github.com/microsoft/go/releases/download/v1.20.11-1/go.20231107.4.src.tar.gz +Source0: https://github.com/microsoft/go/releases/download/v1.21.6-1/go.20240111.3.src.tar.gz Source1: https://dl.google.com/go/go1.4-bootstrap-20171003.tar.gz Source2: https://github.com/microsoft/go/releases/download/v1.19.12-1/go.%{bootstrap_compiler_version}.src.tar.gz Patch0: go14_bootstrap_aarch64.patch @@ -137,6 +137,9 @@ fi %{_bindir}/* %changelog +* Mon Jan 29 2024 Muhammad Falak - 1.21.6-1 +- Bump version to 1.21.6 + * Wed Nov 22 2023 Andrew Phelps - 1.20.11-1 - Upgrade to 1.20.11 - Keep go 1.19.12 source to provide additional go boostrap diff --git a/SPECS/multus/multus.spec b/SPECS/multus/multus.spec index 125dfeb1f80..9efc4ae320e 100644 --- a/SPECS/multus/multus.spec +++ b/SPECS/multus/multus.spec @@ -19,7 +19,7 @@ Summary: CNI plugin providing multiple interfaces in containers Name: multus Version: 4.0.2 -Release: 1%{?dist} +Release: 2%{?dist} License: ASL 2.0 Vendor: Microsoft Corporation Distribution: Mariner @@ -72,6 +72,9 @@ install -D -m0644 deployments/multus-daemonset.yml %{buildroot}%{_datadir}/k8s-y %{_datarootdir}/k8s-yaml/multus/multus.yaml %changelog +* Fri Feb 02 2024 CBL-Mariner Servicing Account - 4.0.2-2 +- Bump release to rebuild with go 1.21.6 + * Thu Sep 28 2023 Aditya Dubey - 4.0.2-1 - Upgrade to v4.0.2 diff --git a/SPECS/nfs-utils/nfs-utils.spec b/SPECS/nfs-utils/nfs-utils.spec index cfa682fdc4c..bc6bf63b62c 100755 --- a/SPECS/nfs-utils/nfs-utils.spec +++ b/SPECS/nfs-utils/nfs-utils.spec @@ -1,7 +1,7 @@ Summary: NFS client utils Name: nfs-utils Version: 2.5.4 -Release: 3%{?dist} +Release: 4%{?dist} License: MIT and GPLv2 and GPLv2+ and BSD URL: https://linux-nfs.org/ Group: Applications/Nfs-utils-client @@ -125,10 +125,10 @@ make check %pre if ! getent group nobody >/dev/null; then - groupadd -r nobody + groupadd -r -g 65534 nobody fi if ! getent passwd nobody >/dev/null; then - useradd -g named -s /bin/false -M -r nobody + useradd -g named -u 65534 -s /bin/false -M -r nobody fi %post @@ -167,6 +167,9 @@ fi %{_libdir}/libnfsidmap.so %changelog +* Wed Nov 01 2023 Andy Zaugg - 2.5.4-4 +- Fix post-install script to create nobody user instead of named user + * Wed Sep 20 2023 Jon Slobodzian - 2.5.4-3 - Recompile with stack-protection fixed gcc version (CVE-2023-4039) diff --git a/SPECS/nmi/nmi.signatures.json b/SPECS/nmi/nmi.signatures.json index 4917af7c4ab..51a0eee9793 100644 --- a/SPECS/nmi/nmi.signatures.json +++ b/SPECS/nmi/nmi.signatures.json @@ -1,6 +1,6 @@ { "Signatures": { - "nmi-1.8.7-vendor.tar.gz": "988259ffbfbf44452e951c0728de4f23db297face908a2c6c8429ac4be21fbad", - "nmi-1.8.7.tar.gz": "37a249105e1e3c6fca6ab6abc64a1af568bc1cf020a0e49bcba2fb485c11346f" + "nmi-1.8.11-vendor-v2.tar.gz": "d8bb79dd73d69ef52a3b0022e27c79b756dd3e31686df409ecd762abe3aebf7b", + "nmi-1.8.11.tar.gz": "0eb3810ff088d9c9252466da4e6df8da9d43d9588e7b9d445c30c0497d3197fa" } } \ No newline at end of file diff --git a/SPECS/nmi/nmi.spec b/SPECS/nmi/nmi.spec index 3be7886aac5..b9f46853dfa 100644 --- a/SPECS/nmi/nmi.spec +++ b/SPECS/nmi/nmi.spec @@ -1,8 +1,8 @@ %global debug_package %{nil} Summary: Node Managed Identity Name: nmi -Version: 1.8.7 -Release: 15%{?dist} +Version: 1.8.11 +Release: 2%{?dist} License: MIT Vendor: Microsoft Corporation Distribution: Mariner @@ -12,7 +12,7 @@ URL: https://github.com/Azure/aad-pod-identity Source0: %{name}-%{version}.tar.gz # Below is a manually created tarball, no download link. # We're using pre-populated Go modules from this tarball, since network is disabled during build time. -# How to re-build this file: +# How to re-build this file (note the version number will be -v2, etc): # 1. wget https://github.com/Azure/aad-pod-identity/archive/refs/tags/v%%{version}.tar.gz -O aad-pod-identity-%%{version}.tar.gz # 2. tar -xf aad-pod-identity-%%{version}.tar.gz # 3. cd aad-pod-identity-%%{version} @@ -23,7 +23,7 @@ Source0: %{name}-%{version}.tar.gz # --pax-option=exthdr.name=%d/PaxHeaders/%f,delete=atime,delete=ctime \ # -cf %%{name}-%%{version}-vendor.tar.gz vendor # -Source1: %{name}-%{version}-vendor.tar.gz +Source1: %{name}-%{version}-vendor-v2.tar.gz Patch0: modify-go-build-option.patch BuildRequires: golang >= 1.15 @@ -34,14 +34,12 @@ NMI is the resource that is used when your pods look to use their identity. %autosetup -c -N -n %{name}-%{version} pushd aad-pod-identity-%{version} %patch0 -p1 +# create vendor folder from the vendor tarball and set vendor mode +tar -xf %{SOURCE1} --no-same-owner popd %build pushd aad-pod-identity-%{version} - -# create vendor folder from the vendor tarball and set vendor mode -tar -xf %{SOURCE1} --no-same-owner - make build-nmi popd @@ -63,6 +61,12 @@ popd %{_bindir}/%{name} %changelog +* Fri Feb 09 2024 Muhammad Falak - 1.8.11-2 +- Bump release to rebuild with go 1.21.6 + +* Fri Feb 06 2024 Tobias Brick - 1.8.11-1 +- Upgrade to version 1.8.11 to CVE-2022-21698 + * Mon Oct 16 2023 CBL-Mariner Servicing Account - 1.8.7-15 - Bump release to rebuild with go 1.20.9 @@ -111,4 +115,4 @@ popd - License Verified * Thu Jun 24 2021 Henry Li - 1.7.0-1 -- Original version for CBL-Mariner \ No newline at end of file +- Original version for CBL-Mariner diff --git a/SPECS/node-problem-detector/CVE-2022-21698.patch b/SPECS/node-problem-detector/CVE-2022-21698.patch new file mode 100644 index 00000000000..b2c866f6bf5 --- /dev/null +++ b/SPECS/node-problem-detector/CVE-2022-21698.patch @@ -0,0 +1,364 @@ +From 253029f7ffbade99588df59a8b89a35d99197fe0 Mon Sep 17 00:00:00 2001 +From: Tobias Brick +Date: Tue, 18 Jan 2022 10:19:28 +0100 +Subject: [PATCH] Port upstream patch + https://github.com/prometheus/client_golang/commit/9075cdf61646b5adf54d3ba77a0e4f6c65cb4fd7 + +Differences: +- Removed tests +- Removed some comments that don't merge +- Line numbers and such + +Based on: + +From 9075cdf61646b5adf54d3ba77a0e4f6c65cb4fd7 Mon Sep 17 00:00:00 2001 +From: Kemal Akkoyun +Date: Tue, 18 Jan 2022 10:19:28 +0100 +Subject: [PATCH] promhttp: Check validity of method and code label values + (#962) + +* Check validity of method and code label values + +Signed-off-by: Kemal Akkoyun + +* Use more flexibly functional option pattern for configuration + +Signed-off-by: Kemal Akkoyun + +* Update documentation + +Signed-off-by: Kemal Akkoyun + +* Simplify + +Signed-off-by: Kemal Akkoyun + +* Fix inconsistent method naming + +Signed-off-by: Kemal Akkoyun +--- +vendor/github.com/prometheus/client_golang/prometheuspromhttp/instrument_client.go | 28 ++++++-- +vendor/github.com/prometheus/client_golang/prometheuspromhttp/instrument_server.go | 82 ++++++++++++++++++------ +vendor/github.com/prometheus/client_golang/prometheuspromhttp/option.go | 31 +++++++++ + 3 files changed, 116 insertions(+), 25 deletions(-) + create mode 100644vendor/github.com/prometheus/client_golang/prometheuspromhttp/option.go + +diff --git a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go +index 83c49b6..861b4d2 100644 +--- a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go ++++ b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go +@@ -49,7 +49,10 @@ func InstrumentRoundTripperInFlight(gauge prometheus.Gauge, next http.RoundTripp + // http.RoundTripper to observe the request result with the provided CounterVec. + // The CounterVec must have zero, one, or two non-const non-curried labels. For + // those, the only allowed label names are "code" and "method". The function +-// panics otherwise. Partitioning of the CounterVec happens by HTTP status code ++// panics otherwise. For the "method" label a predefined default label value set ++// is used to filter given values. Values besides predefined values will count ++// as `unknown` method.`WithExtraMethods` can be used to add more ++// methods to the set. Partitioning of the CounterVec happens by HTTP status code + // and/or HTTP method if the respective instance label names are present in the + // CounterVec. For unpartitioned counting, use a CounterVec with zero labels. + // +@@ -57,13 +60,18 @@ func InstrumentRoundTripperInFlight(gauge prometheus.Gauge, next http.RoundTripp + // is not incremented. + // + // See the example for ExampleInstrumentRoundTripperDuration for example usage. +-func InstrumentRoundTripperCounter(counter *prometheus.CounterVec, next http.RoundTripper) RoundTripperFunc { ++func InstrumentRoundTripperCounter(counter *prometheus.CounterVec, next http.RoundTripper, opts ...Option) RoundTripperFunc { ++ rtOpts := &option{} ++ for _, o := range opts { ++ o(rtOpts) ++ } ++ + code, method := checkLabels(counter) + + return RoundTripperFunc(func(r *http.Request) (*http.Response, error) { + resp, err := next.RoundTrip(r) + if err == nil { +- counter.With(labels(code, method, r.Method, resp.StatusCode)).Inc() ++ counter.With(labels(code, method, r.Method, resp.StatusCode, rtOpts.extraMethods...)).Inc() + } + return resp, err + }) +@@ -73,7 +81,10 @@ func InstrumentRoundTripperCounter(counter *prometheus.CounterVec, next http.Rou + // http.RoundTripper to observe the request duration with the provided + // ObserverVec. The ObserverVec must have zero, one, or two non-const + // non-curried labels. For those, the only allowed label names are "code" and +-// "method". The function panics otherwise. The Observe method of the Observer ++// "method". The function panics otherwise. For the "method" label a predefined ++// default label value set is used to filter given values. Values besides ++// predefined values will count as `unknown` method. `WithExtraMethods` ++// can be used to add more methods to the set. The Observe method of the Observer + // in the ObserverVec is called with the request duration in + // seconds. Partitioning happens by HTTP status code and/or HTTP method if the + // respective instance label names are present in the ObserverVec. For +@@ -85,14 +96,19 @@ func InstrumentRoundTripperCounter(counter *prometheus.CounterVec, next http.Rou + // + // Note that this method is only guaranteed to never observe negative durations + // if used with Go1.9+. +-func InstrumentRoundTripperDuration(obs prometheus.ObserverVec, next http.RoundTripper) RoundTripperFunc { ++func InstrumentRoundTripperDuration(obs prometheus.ObserverVec, next http.RoundTripper, opts ...Option) RoundTripperFunc { ++ rtOpts := &option{} ++ for _, o := range opts { ++ o(rtOpts) ++ } ++ + code, method := checkLabels(obs) + + return RoundTripperFunc(func(r *http.Request) (*http.Response, error) { + start := time.Now() + resp, err := next.RoundTrip(r) + if err == nil { +- obs.With(labels(code, method, r.Method, resp.StatusCode)).Observe(time.Since(start).Seconds()) ++ obs.With(labels(code, method, r.Method, resp.StatusCode, rtOpts.extraMethods...)).Observe(time.Since(start).Seconds()) + } + return resp, err + }) +diff --git a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go +index 9db2438..91802f8 100644 +--- a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go ++++ b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go +@@ -58,7 +58,12 @@ func InstrumentHandlerInFlight(g prometheus.Gauge, next http.Handler) http.Handl + // + // Note that this method is only guaranteed to never observe negative durations + // if used with Go1.9+. +-func InstrumentHandlerDuration(obs prometheus.ObserverVec, next http.Handler) http.HandlerFunc { ++func InstrumentHandlerDuration(obs prometheus.ObserverVec, next http.Handler, opts ...Option) http.HandlerFunc { ++ mwOpts := &option{} ++ for _, o := range opts { ++ o(mwOpts) ++ } ++ + code, method := checkLabels(obs) + + if code { +@@ -67,14 +72,14 @@ func InstrumentHandlerDuration(obs prometheus.ObserverVec, next http.Handler) ht + d := newDelegator(w, nil) + next.ServeHTTP(d, r) + +- obs.With(labels(code, method, r.Method, d.Status())).Observe(time.Since(now).Seconds()) ++ obs.With(labels(code, method, r.Method, d.Status(), mwOpts.extraMethods...)).Observe(time.Since(now).Seconds()) + }) + } + + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + now := time.Now() + next.ServeHTTP(w, r) +- obs.With(labels(code, method, r.Method, 0)).Observe(time.Since(now).Seconds()) ++ obs.With(labels(code, method, r.Method, 0, mwOpts.extraMethods...)).Observe(time.Since(now).Seconds()) + }) + } + +@@ -91,20 +96,25 @@ func InstrumentHandlerDuration(obs prometheus.ObserverVec, next http.Handler) ht + // If the wrapped Handler panics, the Counter is not incremented. + // + // See the example for InstrumentHandlerDuration for example usage. +-func InstrumentHandlerCounter(counter *prometheus.CounterVec, next http.Handler) http.HandlerFunc { ++func InstrumentHandlerCounter(counter *prometheus.CounterVec, next http.Handler, opts ...Option) http.HandlerFunc { ++ mwOpts := &option{} ++ for _, o := range opts { ++ o(mwOpts) ++ } ++ + code, method := checkLabels(counter) + + if code { + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + d := newDelegator(w, nil) + next.ServeHTTP(d, r) +- counter.With(labels(code, method, r.Method, d.Status())).Inc() ++ counter.With(labels(code, method, r.Method, d.Status(), mwOpts.extraMethods...)).Inc() + }) + } + + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + next.ServeHTTP(w, r) +- counter.With(labels(code, method, r.Method, 0)).Inc() ++ counter.With(labels(code, method, r.Method, 0, mwOpts.extraMethods...)).Inc() + }) + } + +@@ -126,13 +136,18 @@ func InstrumentHandlerCounter(counter *prometheus.CounterVec, next http.Handler) + // if used with Go1.9+. + // + // See the example for InstrumentHandlerDuration for example usage. +-func InstrumentHandlerTimeToWriteHeader(obs prometheus.ObserverVec, next http.Handler) http.HandlerFunc { ++func InstrumentHandlerTimeToWriteHeader(obs prometheus.ObserverVec, next http.Handler, opts ...Option) http.HandlerFunc { ++ mwOpts := &option{} ++ for _, o := range opts { ++ o(mwOpts) ++ } ++ + code, method := checkLabels(obs) + + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + now := time.Now() + d := newDelegator(w, func(status int) { +- obs.With(labels(code, method, r.Method, status)).Observe(time.Since(now).Seconds()) ++ obs.With(labels(code, method, r.Method, status, mwOpts.extraMethods...)).Observe(time.Since(now).Seconds()) + }) + next.ServeHTTP(d, r) + }) +@@ -154,7 +169,12 @@ func InstrumentHandlerTimeToWriteHeader(obs prometheus.ObserverVec, next http.Ha + // If the wrapped Handler panics, no values are reported. + // + // See the example for InstrumentHandlerDuration for example usage. +-func InstrumentHandlerRequestSize(obs prometheus.ObserverVec, next http.Handler) http.HandlerFunc { ++func InstrumentHandlerRequestSize(obs prometheus.ObserverVec, next http.Handler, opts ...Option) http.HandlerFunc { ++ mwOpts := &option{} ++ for _, o := range opts { ++ o(mwOpts) ++ } ++ + code, method := checkLabels(obs) + + if code { +@@ -162,14 +182,14 @@ func InstrumentHandlerRequestSize(obs prometheus.ObserverVec, next http.Handler) + d := newDelegator(w, nil) + next.ServeHTTP(d, r) + size := computeApproximateRequestSize(r) +- obs.With(labels(code, method, r.Method, d.Status())).Observe(float64(size)) ++ obs.With(labels(code, method, r.Method, d.Status(), mwOpts.extraMethods...)).Observe(float64(size)) + }) + } + + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + next.ServeHTTP(w, r) + size := computeApproximateRequestSize(r) +- obs.With(labels(code, method, r.Method, 0)).Observe(float64(size)) ++ obs.With(labels(code, method, r.Method, 0, mwOpts.extraMethods...)).Observe(float64(size)) + }) + } + +@@ -189,12 +209,18 @@ func InstrumentHandlerRequestSize(obs prometheus.ObserverVec, next http.Handler) + // If the wrapped Handler panics, no values are reported. + // + // See the example for InstrumentHandlerDuration for example usage. +-func InstrumentHandlerResponseSize(obs prometheus.ObserverVec, next http.Handler) http.Handler { ++func InstrumentHandlerResponseSize(obs prometheus.ObserverVec, next http.Handler, opts ...Option) http.Handler { ++ mwOpts := &option{} ++ for _, o := range opts { ++ o(mwOpts) ++ } ++ + code, method := checkLabels(obs) ++ + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + d := newDelegator(w, nil) + next.ServeHTTP(d, r) +- obs.With(labels(code, method, r.Method, d.Status())).Observe(float64(d.Written())) ++ obs.With(labels(code, method, r.Method, d.Status(), mwOpts.extraMethods...)).Observe(float64(d.Written())) + }) + } + +@@ -279,7 +305,7 @@ func isLabelCurried(c prometheus.Collector, label string) bool { + // unnecessary allocations on each request. + var emptyLabels = prometheus.Labels{} + +-func labels(code, method bool, reqMethod string, status int) prometheus.Labels { ++func labels(code, method bool, reqMethod string, status int, extraMethods ...string) prometheus.Labels { + if !(code || method) { + return emptyLabels + } +@@ -289,7 +315,7 @@ func labels(code, method bool, reqMethod string, status int) prometheus.Labels { + labels["code"] = sanitizeCode(status) + } + if method { +- labels["method"] = sanitizeMethod(reqMethod) ++ labels["method"] = sanitizeMethod(reqMethod, extraMethods...) + } + + return labels +@@ -319,7 +345,12 @@ func computeApproximateRequestSize(r *http.Request) int { + return s + } + +-func sanitizeMethod(m string) string { ++// If the wrapped http.Handler has a known method, it will be sanitized and returned. ++// Otherwise, "unknown" will be returned. The known method list can be extended ++// as needed by using extraMethods parameter. ++func sanitizeMethod(m string, extraMethods ...string) string { ++ // See https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods for ++ // the methods chosen as default. + switch m { + case "GET", "get": + return "get" +@@ -337,15 +368,25 @@ func sanitizeMethod(m string) string { + return "options" + case "NOTIFY", "notify": + return "notify" ++ case "TRACE", "trace": ++ return "trace" ++ case "PATCH", "patch": ++ return "patch" + default: +- return strings.ToLower(m) ++ for _, method := range extraMethods { ++ if strings.EqualFold(m, method) { ++ return strings.ToLower(m) ++ } ++ } ++ return "unknown" + } + } + + // If the wrapped http.Handler has not set a status code, i.e. the value is +-// currently 0, santizeCode will return 200, for consistency with behavior in ++// currently 0, sanitizeCode will return 200, for consistency with behavior in + // the stdlib. + func sanitizeCode(s int) string { ++ // See for accepted codes https://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml + switch s { + case 100: + return "100" +@@ -442,6 +483,9 @@ func sanitizeCode(s int) string { + return "511" + + default: +- return strconv.Itoa(s) ++ if s >= 100 && s <= 599 { ++ return strconv.Itoa(s) ++ } ++ return "unknown" + } + } +diff --git a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/option.go b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/option.go +new file mode 100644 +index 0000000..35e41bd +--- /dev/null ++++ b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/option.go +@@ -0,0 +1,31 @@ ++// Copyright 2022 The Prometheus Authors ++// Licensed under the Apache License, Version 2.0 (the "License"); ++// you may not use this file except in compliance with the License. ++// You may obtain a copy of the License at ++// ++// http://www.apache.org/licenses/LICENSE-2.0 ++// ++// Unless required by applicable law or agreed to in writing, software ++// distributed under the License is distributed on an "AS IS" BASIS, ++// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. ++// See the License for the specific language governing permissions and ++// limitations under the License. ++ ++package promhttp ++ ++// Option are used to configure a middleware or round tripper.. ++type Option func(*option) ++ ++type option struct { ++ extraMethods []string ++} ++ ++// WithExtraMethods adds additional HTTP methods to the list of allowed methods. ++// See https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods for the default list. ++// ++// See the example for ExampleInstrumentHandlerWithExtraMethods for example usage. ++func WithExtraMethods(methods ...string) Option { ++ return func(o *option) { ++ o.extraMethods = methods ++ } ++} +-- +2.33.8 + diff --git a/SPECS/node-problem-detector/node-problem-detector.spec b/SPECS/node-problem-detector/node-problem-detector.spec index d1b277ca80b..b8521ba0443 100644 --- a/SPECS/node-problem-detector/node-problem-detector.spec +++ b/SPECS/node-problem-detector/node-problem-detector.spec @@ -1,7 +1,7 @@ Summary: Kubernetes daemon to detect and report node issues Name: node-problem-detector Version: 0.8.10 -Release: 17%{?dist} +Release: 19%{?dist} License: ASL 2.0 Vendor: Microsoft Corporation Distribution: Mariner @@ -10,6 +10,7 @@ URL: https://github.com/kubernetes/node-problem-detector Source0: https://github.com/kubernetes/%{name}/archive/refs/tags/v%{version}.tar.gz#/%{name}-%{version}.tar.gz Patch0: 001-remove_arch_specific_makefile_logic.patch Patch1: 002-add_mariner_OSVersion.patch +Patch2: CVE-2022-21698.patch BuildRequires: golang BuildRequires: systemd-devel Requires: mariner-release @@ -64,6 +65,12 @@ make test %config(noreplace) %{_sysconfdir}/node-problem-detector.d/* %changelog +* Fri Feb 09 2024 Muhammad Falak - 0.8.10-19 +- Bump release to rebuild with go 1.21.6 + +* Mon Feb 05 2024 Tobias Brick - 0.8.10-18 +- Patch CVE-2022-21698 + * Mon Oct 16 2023 CBL-Mariner Servicing Account - 0.8.10-17 - Bump release to rebuild with go 1.20.9 diff --git a/SPECS/nvidia-container-toolkit/nvidia-container-toolkit.spec b/SPECS/nvidia-container-toolkit/nvidia-container-toolkit.spec index bbbf3415fcd..0ecd1e0742e 100644 --- a/SPECS/nvidia-container-toolkit/nvidia-container-toolkit.spec +++ b/SPECS/nvidia-container-toolkit/nvidia-container-toolkit.spec @@ -2,7 +2,7 @@ Summary: NVIDIA container runtime hook Name: nvidia-container-toolkit Version: 1.13.5 -Release: 3%{?dist} +Release: 4%{?dist} License: ALS2.0 Vendor: Microsoft Corporation Distribution: Mariner @@ -94,6 +94,9 @@ rm -f %{_bindir}/nvidia-container-toolkit %{_bindir}/nvidia-ctk %changelog +* Fri Feb 02 2024 CBL-Mariner Servicing Account - 1.13.5-4 +- Bump release to rebuild with go 1.21.6 + * Mon Oct 16 2023 CBL-Mariner Servicing Account - 1.13.5-3 - Bump release to rebuild with go 1.20.9 diff --git a/SPECS/opa/opa.spec b/SPECS/opa/opa.spec index 727b2c96dd1..73fc88dea16 100644 --- a/SPECS/opa/opa.spec +++ b/SPECS/opa/opa.spec @@ -5,7 +5,7 @@ Summary: Open source, general-purpose policy engine Name: opa Version: 0.50.2 -Release: 7%{?dist} +Release: 8%{?dist} # Upstream license specification: MIT and Apache-2.0 # Main package: ASL 2.0 # internal/jwx: MIT @@ -53,6 +53,9 @@ install -D -p -m 0644 man/* %{buildroot}%{_mandir}/man1/ %{_bindir}/* %changelog +* Fri Feb 02 2024 CBL-Mariner Servicing Account - 0.50.2-8 +- Bump release to rebuild with go 1.21.6 + * Mon Oct 16 2023 CBL-Mariner Servicing Account - 0.50.2-7 - Bump release to rebuild with go 1.20.9 diff --git a/SPECS/packer/CVE-2023-44487.patch b/SPECS/packer/CVE-2023-44487.patch new file mode 100644 index 00000000000..268ddb95168 --- /dev/null +++ b/SPECS/packer/CVE-2023-44487.patch @@ -0,0 +1,152 @@ +From 14055cd02653bb8f90f99f24c889e44ff8899890 Mon Sep 17 00:00:00 2001 +From: Damien Neil +Date: Fri, 6 Oct 2023 09:51:19 -0700 +Subject: [PATCH] http2: limit maximum handler goroutines to + MaxConcurrentStreams + +When the peer opens a new stream while we have MaxConcurrentStreams +handler goroutines running, defer starting a handler until one +of the existing handlers exits. + +Fixes golang/go#63417 +Fixes CVE-2023-39325 + +Change-Id: If0531e177b125700f3e24c5ebd24b1023098fa6d +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2045854 +TryBot-Result: Security TryBots +Reviewed-by: Ian Cottrell +Reviewed-by: Tatiana Bradley +Run-TryBot: Damien Neil +Reviewed-on: https://go-review.googlesource.com/c/net/+/534215 +Reviewed-by: Michael Pratt +Reviewed-by: Dmitri Shuralyov +LUCI-TryBot-Result: Go LUCI +Auto-Submit: Dmitri Shuralyov +Reviewed-by: Damien Neil + +Modified to apply to vendored code by: Daniel McIlvaney + - Adjusted paths + - Removed reference to server_test.go +--- + vendor/golang.org/x/net/http2/server.go | 66 ++++++++++++++++++++++++- + 1 file changed, 64 insertions(+), 2 deletions(-) + +diff --git a/vendor/golang.org/x/net/http2/server.go b/vendor/golang.org/x/net/http2/server.go +index 8cb14f3..6000140 100644 +--- a/vendor/golang.org/x/net/http2/server.go ++++ b/vendor/golang.org/x/net/http2/server.go +@@ -581,9 +581,11 @@ type serverConn struct { + advMaxStreams uint32 // our SETTINGS_MAX_CONCURRENT_STREAMS advertised the client + curClientStreams uint32 // number of open streams initiated by the client + curPushedStreams uint32 // number of open streams initiated by server push ++ curHandlers uint32 // number of running handler goroutines + maxClientStreamID uint32 // max ever seen from client (odd), or 0 if there have been no client requests + maxPushPromiseID uint32 // ID of the last push promise (even), or 0 if there have been no pushes + streams map[uint32]*stream ++ unstartedHandlers []unstartedHandler + initialStreamSendWindowSize int32 + maxFrameSize int32 + peerMaxHeaderListSize uint32 // zero means unknown (default) +@@ -981,6 +983,8 @@ func (sc *serverConn) serve() { + return + case gracefulShutdownMsg: + sc.startGracefulShutdownInternal() ++ case handlerDoneMsg: ++ sc.handlerDone() + default: + panic("unknown timer") + } +@@ -1028,6 +1032,7 @@ var ( + idleTimerMsg = new(serverMessage) + shutdownTimerMsg = new(serverMessage) + gracefulShutdownMsg = new(serverMessage) ++ handlerDoneMsg = new(serverMessage) + ) + + func (sc *serverConn) onSettingsTimer() { sc.sendServeMsg(settingsTimerMsg) } +@@ -2022,8 +2027,7 @@ func (sc *serverConn) processHeaders(f *MetaHeadersFrame) error { + } + } + +- go sc.runHandler(rw, req, handler) +- return nil ++ return sc.scheduleHandler(id, rw, req, handler) + } + + func (sc *serverConn) upgradeRequest(req *http.Request) { +@@ -2043,6 +2047,10 @@ func (sc *serverConn) upgradeRequest(req *http.Request) { + sc.conn.SetReadDeadline(time.Time{}) + } + ++ // This is the first request on the connection, ++ // so start the handler directly rather than going ++ // through scheduleHandler. ++ sc.curHandlers++ + go sc.runHandler(rw, req, sc.handler.ServeHTTP) + } + +@@ -2283,8 +2291,62 @@ func (sc *serverConn) newResponseWriter(st *stream, req *http.Request) *response + return &responseWriter{rws: rws} + } + ++type unstartedHandler struct { ++ streamID uint32 ++ rw *responseWriter ++ req *http.Request ++ handler func(http.ResponseWriter, *http.Request) ++} ++ ++// scheduleHandler starts a handler goroutine, ++// or schedules one to start as soon as an existing handler finishes. ++func (sc *serverConn) scheduleHandler(streamID uint32, rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) error { ++ sc.serveG.check() ++ maxHandlers := sc.advMaxStreams ++ if sc.curHandlers < maxHandlers { ++ sc.curHandlers++ ++ go sc.runHandler(rw, req, handler) ++ return nil ++ } ++ if len(sc.unstartedHandlers) > int(4*sc.advMaxStreams) { ++ return sc.countError("too_many_early_resets", ConnectionError(ErrCodeEnhanceYourCalm)) ++ } ++ sc.unstartedHandlers = append(sc.unstartedHandlers, unstartedHandler{ ++ streamID: streamID, ++ rw: rw, ++ req: req, ++ handler: handler, ++ }) ++ return nil ++} ++ ++func (sc *serverConn) handlerDone() { ++ sc.serveG.check() ++ sc.curHandlers-- ++ i := 0 ++ maxHandlers := sc.advMaxStreams ++ for ; i < len(sc.unstartedHandlers); i++ { ++ u := sc.unstartedHandlers[i] ++ if sc.streams[u.streamID] == nil { ++ // This stream was reset before its goroutine had a chance to start. ++ continue ++ } ++ if sc.curHandlers >= maxHandlers { ++ break ++ } ++ sc.curHandlers++ ++ go sc.runHandler(u.rw, u.req, u.handler) ++ sc.unstartedHandlers[i] = unstartedHandler{} // don't retain references ++ } ++ sc.unstartedHandlers = sc.unstartedHandlers[i:] ++ if len(sc.unstartedHandlers) == 0 { ++ sc.unstartedHandlers = nil ++ } ++} ++ + // Run on its own goroutine. + func (sc *serverConn) runHandler(rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) { ++ defer sc.sendServeMsg(handlerDoneMsg) + didPanic := true + defer func() { + rw.rws.stream.cancelCtx() +-- +2.33.8 diff --git a/SPECS/packer/packer.spec b/SPECS/packer/packer.spec index 919ea41541e..58af7dca5cf 100644 --- a/SPECS/packer/packer.spec +++ b/SPECS/packer/packer.spec @@ -1,7 +1,7 @@ Summary: Tool for creating identical machine images for multiple platforms from a single source configuration. Name: packer Version: 1.8.7 -Release: 1%{?dist} +Release: 2%{?dist} License: MPLv2.0 Vendor: Microsoft Corporation Distribution: Mariner @@ -27,6 +27,7 @@ Source0: https://github.com/hashicorp/packer/archive/v%{version}.tar.gz#/ # See: https://reproducible-builds.org/docs/archives/ # - For the value of "--mtime" use the date "2021-04-26 00:00Z" to simplify future updates. Source1: %{name}-%{version}-vendor.tar.gz +Patch0: CVE-2023-44487.patch BuildRequires: golang >= 1.17.1 BuildRequires: kernel-headers @@ -38,10 +39,12 @@ BuildRequires: glibc-devel Packer is a tool for building identical machine images for multiple platforms from a single source configuration. %prep -%autosetup -p1 +%autosetup -N +# Apply vendor before patching +tar --no-same-owner -xf %{SOURCE1} +%autopatch -p1 %build -tar --no-same-owner -xf %{SOURCE1} export GOPATH=%{our_gopath} LD_FLAGS="-X github.com/hashicorp/packer/version.Version=%{version} -X github.com/hashicorp/packer/version.VersionPrerelease=" go build -mod=vendor -v -a -o packer -ldflags="$LD_FLAGS" @@ -61,6 +64,9 @@ go test -mod=vendor %{_bindir}/packer %changelog +* Fri Feb 02 2024 Daniel McIlvaney - 1.8.7-2 +- Address CVE-2023-44487 by patching vendored golang.org/x/net + * Wed Dec 20 2023 CBL-Mariner Servicing Account - 1.8.7-1 - Auto-upgrade to 1.8.7 - CVE-2023-45286 diff --git a/SPECS/prometheus-adapter/prometheus-adapter.spec b/SPECS/prometheus-adapter/prometheus-adapter.spec index 2d67974b475..0774f3ec9f2 100644 --- a/SPECS/prometheus-adapter/prometheus-adapter.spec +++ b/SPECS/prometheus-adapter/prometheus-adapter.spec @@ -1,7 +1,7 @@ Summary: Kubernetes Custom, Resource, and External Metric APIs implemented to work with Prometheus. Name: prometheus-adapter Version: 0.10.0 -Release: 10%{?dist} +Release: 11%{?dist} License: Apache-2.0 Vendor: Microsoft Corporation Distribution: Mariner @@ -41,6 +41,9 @@ make test %doc README.md RELEASE.md %changelog +* Fri Feb 02 2024 CBL-Mariner Servicing Account - 0.10.0-11 +- Bump release to rebuild with go 1.21.6 + * Mon Oct 16 2023 CBL-Mariner Servicing Account - 0.10.0-10 - Bump release to rebuild with go 1.20.9 diff --git a/SPECS/prometheus-node-exporter/CVE-2022-21698.patch b/SPECS/prometheus-node-exporter/CVE-2022-21698.patch new file mode 100644 index 00000000000..9cde3922fe1 --- /dev/null +++ b/SPECS/prometheus-node-exporter/CVE-2022-21698.patch @@ -0,0 +1,428 @@ +From f74cc87520fb81bb034cb2731ee5609d830499d6 Mon Sep 17 00:00:00 2001 +From: Tobias Brick +Date: Tue, 15 Feb 2022 11:38:19 +0100 +Subject: [PATCH] Port upstream patch + https://github.com/prometheus/client_golang/commit/9075cdf61646b5adf54d3ba77a0e4f6c65cb4fd7 + +Differences: +- Removed tests + +Based On: + +From 989baa30fe956631907493ccee1f8e7708660d96 Mon Sep 17 00:00:00 2001 +From: Bartlomiej Plotka +Date: Tue, 15 Feb 2022 11:38:19 +0100 +Subject: [PATCH] promhttp: Check validity of method and code label values + (#962) (#987) + +* Check validity of method and code label values + +Signed-off-by: Kemal Akkoyun + +* Use more flexibly functional option pattern for configuration + +Signed-off-by: Kemal Akkoyun + +* Update documentation + +Signed-off-by: Kemal Akkoyun + +* Simplify + +Signed-off-by: Kemal Akkoyun + +* Fix inconsistent method naming + +Signed-off-by: Kemal Akkoyun + +Co-authored-by: Kemal Akkoyun +--- + vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go | 28 ++++-- + vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go | 111 +++++++++++++++++------ + vendor/github.com/prometheus/client_golang/prometheus/promhttp/option.go | 31 +++++++ + 3 files changed, 138 insertions(+), 32 deletions(-) + create mode 100644 vendor/github.com/prometheus/client_golang/prometheus/promhttp/option.go + +diff --git a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go +index 83c49b6..861b4d2 100644 +--- a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go ++++ b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go +@@ -49,7 +49,10 @@ func InstrumentRoundTripperInFlight(gauge prometheus.Gauge, next http.RoundTripp + // http.RoundTripper to observe the request result with the provided CounterVec. + // The CounterVec must have zero, one, or two non-const non-curried labels. For + // those, the only allowed label names are "code" and "method". The function +-// panics otherwise. Partitioning of the CounterVec happens by HTTP status code ++// panics otherwise. For the "method" label a predefined default label value set ++// is used to filter given values. Values besides predefined values will count ++// as `unknown` method.`WithExtraMethods` can be used to add more ++// methods to the set. Partitioning of the CounterVec happens by HTTP status code + // and/or HTTP method if the respective instance label names are present in the + // CounterVec. For unpartitioned counting, use a CounterVec with zero labels. + // +@@ -57,13 +60,18 @@ func InstrumentRoundTripperInFlight(gauge prometheus.Gauge, next http.RoundTripp + // is not incremented. + // + // See the example for ExampleInstrumentRoundTripperDuration for example usage. +-func InstrumentRoundTripperCounter(counter *prometheus.CounterVec, next http.RoundTripper) RoundTripperFunc { ++func InstrumentRoundTripperCounter(counter *prometheus.CounterVec, next http.RoundTripper, opts ...Option) RoundTripperFunc { ++ rtOpts := &option{} ++ for _, o := range opts { ++ o(rtOpts) ++ } ++ + code, method := checkLabels(counter) + + return RoundTripperFunc(func(r *http.Request) (*http.Response, error) { + resp, err := next.RoundTrip(r) + if err == nil { +- counter.With(labels(code, method, r.Method, resp.StatusCode)).Inc() ++ counter.With(labels(code, method, r.Method, resp.StatusCode, rtOpts.extraMethods...)).Inc() + } + return resp, err + }) +@@ -73,7 +81,10 @@ func InstrumentRoundTripperCounter(counter *prometheus.CounterVec, next http.Rou + // http.RoundTripper to observe the request duration with the provided + // ObserverVec. The ObserverVec must have zero, one, or two non-const + // non-curried labels. For those, the only allowed label names are "code" and +-// "method". The function panics otherwise. The Observe method of the Observer ++// "method". The function panics otherwise. For the "method" label a predefined ++// default label value set is used to filter given values. Values besides ++// predefined values will count as `unknown` method. `WithExtraMethods` ++// can be used to add more methods to the set. The Observe method of the Observer + // in the ObserverVec is called with the request duration in + // seconds. Partitioning happens by HTTP status code and/or HTTP method if the + // respective instance label names are present in the ObserverVec. For +@@ -85,14 +96,19 @@ func InstrumentRoundTripperCounter(counter *prometheus.CounterVec, next http.Rou + // + // Note that this method is only guaranteed to never observe negative durations + // if used with Go1.9+. +-func InstrumentRoundTripperDuration(obs prometheus.ObserverVec, next http.RoundTripper) RoundTripperFunc { ++func InstrumentRoundTripperDuration(obs prometheus.ObserverVec, next http.RoundTripper, opts ...Option) RoundTripperFunc { ++ rtOpts := &option{} ++ for _, o := range opts { ++ o(rtOpts) ++ } ++ + code, method := checkLabels(obs) + + return RoundTripperFunc(func(r *http.Request) (*http.Response, error) { + start := time.Now() + resp, err := next.RoundTrip(r) + if err == nil { +- obs.With(labels(code, method, r.Method, resp.StatusCode)).Observe(time.Since(start).Seconds()) ++ obs.With(labels(code, method, r.Method, resp.StatusCode, rtOpts.extraMethods...)).Observe(time.Since(start).Seconds()) + } + return resp, err + }) +diff --git a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go +index ab037db..a23f0ed 100644 +--- a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go ++++ b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go +@@ -45,7 +45,10 @@ func InstrumentHandlerInFlight(g prometheus.Gauge, next http.Handler) http.Handl + // http.Handler to observe the request duration with the provided ObserverVec. + // The ObserverVec must have valid metric and label names and must have zero, + // one, or two non-const non-curried labels. For those, the only allowed label +-// names are "code" and "method". The function panics otherwise. The Observe ++// names are "code" and "method". The function panics otherwise. For the "method" ++// label a predefined default label value set is used to filter given values. ++// Values besides predefined values will count as `unknown` method. ++//`WithExtraMethods` can be used to add more methods to the set. The Observe + // method of the Observer in the ObserverVec is called with the request duration + // in seconds. Partitioning happens by HTTP status code and/or HTTP method if + // the respective instance label names are present in the ObserverVec. For +@@ -58,7 +61,12 @@ func InstrumentHandlerInFlight(g prometheus.Gauge, next http.Handler) http.Handl + // + // Note that this method is only guaranteed to never observe negative durations + // if used with Go1.9+. +-func InstrumentHandlerDuration(obs prometheus.ObserverVec, next http.Handler) http.HandlerFunc { ++func InstrumentHandlerDuration(obs prometheus.ObserverVec, next http.Handler, opts ...Option) http.HandlerFunc { ++ mwOpts := &option{} ++ for _, o := range opts { ++ o(mwOpts) ++ } ++ + code, method := checkLabels(obs) + + if code { +@@ -67,14 +75,14 @@ func InstrumentHandlerDuration(obs prometheus.ObserverVec, next http.Handler) ht + d := newDelegator(w, nil) + next.ServeHTTP(d, r) + +- obs.With(labels(code, method, r.Method, d.Status())).Observe(time.Since(now).Seconds()) ++ obs.With(labels(code, method, r.Method, d.Status(), mwOpts.extraMethods...)).Observe(time.Since(now).Seconds()) + }) + } + + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + now := time.Now() + next.ServeHTTP(w, r) +- obs.With(labels(code, method, r.Method, 0)).Observe(time.Since(now).Seconds()) ++ obs.With(labels(code, method, r.Method, 0, mwOpts.extraMethods...)).Observe(time.Since(now).Seconds()) + }) + } + +@@ -82,7 +90,10 @@ func InstrumentHandlerDuration(obs prometheus.ObserverVec, next http.Handler) ht + // to observe the request result with the provided CounterVec. The CounterVec + // must have valid metric and label names and must have zero, one, or two + // non-const non-curried labels. For those, the only allowed label names are +-// "code" and "method". The function panics otherwise. Partitioning of the ++// "code" and "method". The function panics otherwise. For the "method" ++// label a predefined default label value set is used to filter given values. ++// Values besides predefined values will count as `unknown` method. ++// `WithExtraMethods` can be used to add more methods to the set. Partitioning of the + // CounterVec happens by HTTP status code and/or HTTP method if the respective + // instance label names are present in the CounterVec. For unpartitioned + // counting, use a CounterVec with zero labels. +@@ -92,20 +103,25 @@ func InstrumentHandlerDuration(obs prometheus.ObserverVec, next http.Handler) ht + // If the wrapped Handler panics, the Counter is not incremented. + // + // See the example for InstrumentHandlerDuration for example usage. +-func InstrumentHandlerCounter(counter *prometheus.CounterVec, next http.Handler) http.HandlerFunc { ++func InstrumentHandlerCounter(counter *prometheus.CounterVec, next http.Handler, opts ...Option) http.HandlerFunc { ++ mwOpts := &option{} ++ for _, o := range opts { ++ o(mwOpts) ++ } ++ + code, method := checkLabels(counter) + + if code { + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + d := newDelegator(w, nil) + next.ServeHTTP(d, r) +- counter.With(labels(code, method, r.Method, d.Status())).Inc() ++ counter.With(labels(code, method, r.Method, d.Status(), mwOpts.extraMethods...)).Inc() + }) + } + + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + next.ServeHTTP(w, r) +- counter.With(labels(code, method, r.Method, 0)).Inc() ++ counter.With(labels(code, method, r.Method, 0, mwOpts.extraMethods...)).Inc() + }) + } + +@@ -114,7 +130,10 @@ func InstrumentHandlerCounter(counter *prometheus.CounterVec, next http.Handler) + // until the response headers are written. The ObserverVec must have valid + // metric and label names and must have zero, one, or two non-const non-curried + // labels. For those, the only allowed label names are "code" and "method". The +-// function panics otherwise. The Observe method of the Observer in the ++// function panics otherwise. For the "method" label a predefined default label ++// value set is used to filter given values. Values besides predefined values ++// will count as `unknown` method.`WithExtraMethods` can be used to add more ++// methods to the set. The Observe method of the Observer in the + // ObserverVec is called with the request duration in seconds. Partitioning + // happens by HTTP status code and/or HTTP method if the respective instance + // label names are present in the ObserverVec. For unpartitioned observations, +@@ -128,13 +147,18 @@ func InstrumentHandlerCounter(counter *prometheus.CounterVec, next http.Handler) + // if used with Go1.9+. + // + // See the example for InstrumentHandlerDuration for example usage. +-func InstrumentHandlerTimeToWriteHeader(obs prometheus.ObserverVec, next http.Handler) http.HandlerFunc { ++func InstrumentHandlerTimeToWriteHeader(obs prometheus.ObserverVec, next http.Handler, opts ...Option) http.HandlerFunc { ++ mwOpts := &option{} ++ for _, o := range opts { ++ o(mwOpts) ++ } ++ + code, method := checkLabels(obs) + + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + now := time.Now() + d := newDelegator(w, func(status int) { +- obs.With(labels(code, method, r.Method, status)).Observe(time.Since(now).Seconds()) ++ obs.With(labels(code, method, r.Method, status, mwOpts.extraMethods...)).Observe(time.Since(now).Seconds()) + }) + next.ServeHTTP(d, r) + }) +@@ -144,8 +168,11 @@ func InstrumentHandlerTimeToWriteHeader(obs prometheus.ObserverVec, next http.Ha + // http.Handler to observe the request size with the provided ObserverVec. The + // ObserverVec must have valid metric and label names and must have zero, one, + // or two non-const non-curried labels. For those, the only allowed label names +-// are "code" and "method". The function panics otherwise. The Observe method of +-// the Observer in the ObserverVec is called with the request size in ++// are "code" and "method". The function panics otherwise. For the "method" ++// label a predefined default label value set is used to filter given values. ++// Values besides predefined values will count as `unknown` method. ++// `WithExtraMethods` can be used to add more methods to the set. The Observe ++// method of the Observer in the ObserverVec is called with the request size in + // bytes. Partitioning happens by HTTP status code and/or HTTP method if the + // respective instance label names are present in the ObserverVec. For + // unpartitioned observations, use an ObserverVec with zero labels. Note that +@@ -156,7 +183,12 @@ func InstrumentHandlerTimeToWriteHeader(obs prometheus.ObserverVec, next http.Ha + // If the wrapped Handler panics, no values are reported. + // + // See the example for InstrumentHandlerDuration for example usage. +-func InstrumentHandlerRequestSize(obs prometheus.ObserverVec, next http.Handler) http.HandlerFunc { ++func InstrumentHandlerRequestSize(obs prometheus.ObserverVec, next http.Handler, opts ...Option) http.HandlerFunc { ++ mwOpts := &option{} ++ for _, o := range opts { ++ o(mwOpts) ++ } ++ + code, method := checkLabels(obs) + + if code { +@@ -164,14 +196,14 @@ func InstrumentHandlerRequestSize(obs prometheus.ObserverVec, next http.Handler) + d := newDelegator(w, nil) + next.ServeHTTP(d, r) + size := computeApproximateRequestSize(r) +- obs.With(labels(code, method, r.Method, d.Status())).Observe(float64(size)) ++ obs.With(labels(code, method, r.Method, d.Status(), mwOpts.extraMethods...)).Observe(float64(size)) + }) + } + + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + next.ServeHTTP(w, r) + size := computeApproximateRequestSize(r) +- obs.With(labels(code, method, r.Method, 0)).Observe(float64(size)) ++ obs.With(labels(code, method, r.Method, 0, mwOpts.extraMethods...)).Observe(float64(size)) + }) + } + +@@ -179,8 +211,11 @@ func InstrumentHandlerRequestSize(obs prometheus.ObserverVec, next http.Handler) + // http.Handler to observe the response size with the provided ObserverVec. The + // ObserverVec must have valid metric and label names and must have zero, one, + // or two non-const non-curried labels. For those, the only allowed label names +-// are "code" and "method". The function panics otherwise. The Observe method of +-// the Observer in the ObserverVec is called with the response size in ++// are "code" and "method". The function panics otherwise. For the "method" ++// label a predefined default label value set is used to filter given values. ++// Values besides predefined values will count as `unknown` method. ++// `WithExtraMethods` can be used to add more methods to the set. The Observe ++// method of the Observer in the ObserverVec is called with the response size in + // bytes. Partitioning happens by HTTP status code and/or HTTP method if the + // respective instance label names are present in the ObserverVec. For + // unpartitioned observations, use an ObserverVec with zero labels. Note that +@@ -191,12 +226,18 @@ func InstrumentHandlerRequestSize(obs prometheus.ObserverVec, next http.Handler) + // If the wrapped Handler panics, no values are reported. + // + // See the example for InstrumentHandlerDuration for example usage. +-func InstrumentHandlerResponseSize(obs prometheus.ObserverVec, next http.Handler) http.Handler { ++func InstrumentHandlerResponseSize(obs prometheus.ObserverVec, next http.Handler, opts ...Option) http.Handler { ++ mwOpts := &option{} ++ for _, o := range opts { ++ o(mwOpts) ++ } ++ + code, method := checkLabels(obs) ++ + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + d := newDelegator(w, nil) + next.ServeHTTP(d, r) +- obs.With(labels(code, method, r.Method, d.Status())).Observe(float64(d.Written())) ++ obs.With(labels(code, method, r.Method, d.Status(), mwOpts.extraMethods...)).Observe(float64(d.Written())) + }) + } + +@@ -290,7 +331,7 @@ func isLabelCurried(c prometheus.Collector, label string) bool { + // unnecessary allocations on each request. + var emptyLabels = prometheus.Labels{} + +-func labels(code, method bool, reqMethod string, status int) prometheus.Labels { ++func labels(code, method bool, reqMethod string, status int, extraMethods ...string) prometheus.Labels { + if !(code || method) { + return emptyLabels + } +@@ -300,7 +341,7 @@ func labels(code, method bool, reqMethod string, status int) prometheus.Labels { + labels["code"] = sanitizeCode(status) + } + if method { +- labels["method"] = sanitizeMethod(reqMethod) ++ labels["method"] = sanitizeMethod(reqMethod, extraMethods...) + } + + return labels +@@ -330,7 +371,12 @@ func computeApproximateRequestSize(r *http.Request) int { + return s + } + +-func sanitizeMethod(m string) string { ++// If the wrapped http.Handler has a known method, it will be sanitized and returned. ++// Otherwise, "unknown" will be returned. The known method list can be extended ++// as needed by using extraMethods parameter. ++func sanitizeMethod(m string, extraMethods ...string) string { ++ // See https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods for ++ // the methods chosen as default. + switch m { + case "GET", "get": + return "get" +@@ -348,15 +394,25 @@ func sanitizeMethod(m string) string { + return "options" + case "NOTIFY", "notify": + return "notify" ++ case "TRACE", "trace": ++ return "trace" ++ case "PATCH", "patch": ++ return "patch" + default: +- return strings.ToLower(m) ++ for _, method := range extraMethods { ++ if strings.EqualFold(m, method) { ++ return strings.ToLower(m) ++ } ++ } ++ return "unknown" + } + } + + // If the wrapped http.Handler has not set a status code, i.e. the value is +-// currently 0, santizeCode will return 200, for consistency with behavior in ++// currently 0, sanitizeCode will return 200, for consistency with behavior in + // the stdlib. + func sanitizeCode(s int) string { ++ // See for accepted codes https://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml + switch s { + case 100: + return "100" +@@ -453,6 +509,9 @@ func sanitizeCode(s int) string { + return "511" + + default: +- return strconv.Itoa(s) ++ if s >= 100 && s <= 599 { ++ return strconv.Itoa(s) ++ } ++ return "unknown" + } + } +diff --git a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/option.go b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/option.go +new file mode 100644 +index 0000000..35e41bd +--- /dev/null ++++ b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/option.go +@@ -0,0 +1,31 @@ ++// Copyright 2022 The Prometheus Authors ++// Licensed under the Apache License, Version 2.0 (the "License"); ++// you may not use this file except in compliance with the License. ++// You may obtain a copy of the License at ++// ++// http://www.apache.org/licenses/LICENSE-2.0 ++// ++// Unless required by applicable law or agreed to in writing, software ++// distributed under the License is distributed on an "AS IS" BASIS, ++// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. ++// See the License for the specific language governing permissions and ++// limitations under the License. ++ ++package promhttp ++ ++// Option are used to configure a middleware or round tripper.. ++type Option func(*option) ++ ++type option struct { ++ extraMethods []string ++} ++ ++// WithExtraMethods adds additional HTTP methods to the list of allowed methods. ++// See https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods for the default list. ++// ++// See the example for ExampleInstrumentHandlerWithExtraMethods for example usage. ++func WithExtraMethods(methods ...string) Option { ++ return func(o *option) { ++ o.extraMethods = methods ++ } ++} +-- +2.33.8 + diff --git a/SPECS/prometheus-node-exporter/CVE-2023-44487.patch b/SPECS/prometheus-node-exporter/CVE-2023-44487.patch new file mode 100644 index 00000000000..1e70a1becec --- /dev/null +++ b/SPECS/prometheus-node-exporter/CVE-2023-44487.patch @@ -0,0 +1,143 @@ +From 09521d1d12e9adf1ecd318a034c33b36f9e56eb2 Mon Sep 17 00:00:00 2001 +From: Damien Neil +Date: Fri, 6 Oct 2023 09:51:19 -0700 +Subject: [PATCH] http2: limit maximum handler goroutines to + MaxConcurrentStreams + +When the peer opens a new stream while we have MaxConcurrentStreams +handler goroutines running, defer starting a handler until one +of the existing handlers exits. + +Fixes golang/go#63417 +Fixes CVE-2023-39325 + +Change-Id: If0531e177b125700f3e24c5ebd24b1023098fa6d +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2045854 +TryBot-Result: Security TryBots +Reviewed-by: Ian Cottrell +Reviewed-by: Tatiana Bradley +Run-TryBot: Damien Neil +Reviewed-on: https://go-review.googlesource.com/c/net/+/534215 +Reviewed-by: Michael Pratt +Reviewed-by: Dmitri Shuralyov +LUCI-TryBot-Result: Go LUCI +Auto-Submit: Dmitri Shuralyov +Reviewed-by: Damien Neil + +Modified to apply to vendored code by: Daniel McIlvaney + - Adjusted paths + - Removed reference to server_test.go + - Removed reference to upgradeRequest() which is not in old versions of the vendored code + - Removed reference to countError() which is not in old versions of the vendored code +--- + vendor/golang.org/x/net/http2/server.go | 62 ++++++++++++++++++++++++- + 1 file changed, 60 insertions(+), 2 deletions(-) + +diff --git a/vendor/golang.org/x/net/http2/server.go b/vendor/golang.org/x/net/http2/server.go +index 09bc705..390243f 100644 +--- a/vendor/golang.org/x/net/http2/server.go ++++ b/vendor/golang.org/x/net/http2/server.go +@@ -515,9 +515,11 @@ type serverConn struct { + advMaxStreams uint32 // our SETTINGS_MAX_CONCURRENT_STREAMS advertised the client + curClientStreams uint32 // number of open streams initiated by the client + curPushedStreams uint32 // number of open streams initiated by server push ++ curHandlers uint32 // number of running handler goroutines + maxClientStreamID uint32 // max ever seen from client (odd), or 0 if there have been no client requests + maxPushPromiseID uint32 // ID of the last push promise (even), or 0 if there have been no pushes + streams map[uint32]*stream ++ unstartedHandlers []unstartedHandler + initialStreamSendWindowSize int32 + maxFrameSize int32 + headerTableSize uint32 +@@ -887,6 +889,8 @@ func (sc *serverConn) serve() { + return + case gracefulShutdownMsg: + sc.startGracefulShutdownInternal() ++ case handlerDoneMsg: ++ sc.handlerDone() + default: + panic("unknown timer") + } +@@ -932,6 +936,7 @@ var ( + idleTimerMsg = new(serverMessage) + shutdownTimerMsg = new(serverMessage) + gracefulShutdownMsg = new(serverMessage) ++ handlerDoneMsg = new(serverMessage) + ) + + func (sc *serverConn) onSettingsTimer() { sc.sendServeMsg(settingsTimerMsg) } +@@ -1889,8 +1894,7 @@ func (sc *serverConn) processHeaders(f *MetaHeadersFrame) error { + sc.conn.SetReadDeadline(time.Time{}) + } + +- go sc.runHandler(rw, req, handler) +- return nil ++ return sc.scheduleHandler(id, rw, req, handler) + } + + func (st *stream) processTrailerHeaders(f *MetaHeadersFrame) error { +@@ -2137,8 +2141,62 @@ func (sc *serverConn) newWriterAndRequestNoBody(st *stream, rp requestParam) (*r + return rw, req, nil + } + ++type unstartedHandler struct { ++ streamID uint32 ++ rw *responseWriter ++ req *http.Request ++ handler func(http.ResponseWriter, *http.Request) ++} ++ ++// scheduleHandler starts a handler goroutine, ++// or schedules one to start as soon as an existing handler finishes. ++func (sc *serverConn) scheduleHandler(streamID uint32, rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) error { ++ sc.serveG.check() ++ maxHandlers := sc.advMaxStreams ++ if sc.curHandlers < maxHandlers { ++ sc.curHandlers++ ++ go sc.runHandler(rw, req, handler) ++ return nil ++ } ++ if len(sc.unstartedHandlers) > int(4*sc.advMaxStreams) { ++ return ConnectionError(ErrCodeEnhanceYourCalm) ++ } ++ sc.unstartedHandlers = append(sc.unstartedHandlers, unstartedHandler{ ++ streamID: streamID, ++ rw: rw, ++ req: req, ++ handler: handler, ++ }) ++ return nil ++} ++ ++func (sc *serverConn) handlerDone() { ++ sc.serveG.check() ++ sc.curHandlers-- ++ i := 0 ++ maxHandlers := sc.advMaxStreams ++ for ; i < len(sc.unstartedHandlers); i++ { ++ u := sc.unstartedHandlers[i] ++ if sc.streams[u.streamID] == nil { ++ // This stream was reset before its goroutine had a chance to start. ++ continue ++ } ++ if sc.curHandlers >= maxHandlers { ++ break ++ } ++ sc.curHandlers++ ++ go sc.runHandler(u.rw, u.req, u.handler) ++ sc.unstartedHandlers[i] = unstartedHandler{} // don't retain references ++ } ++ sc.unstartedHandlers = sc.unstartedHandlers[i:] ++ if len(sc.unstartedHandlers) == 0 { ++ sc.unstartedHandlers = nil ++ } ++} ++ + // Run on its own goroutine. + func (sc *serverConn) runHandler(rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) { ++ defer sc.sendServeMsg(handlerDoneMsg) + didPanic := true + defer func() { + rw.rws.stream.cancelCtx() +-- +2.33.8 diff --git a/SPECS/prometheus-node-exporter/prometheus-node-exporter.spec b/SPECS/prometheus-node-exporter/prometheus-node-exporter.spec index b1c4c64baf2..ef2d05160c3 100644 --- a/SPECS/prometheus-node-exporter/prometheus-node-exporter.spec +++ b/SPECS/prometheus-node-exporter/prometheus-node-exporter.spec @@ -5,7 +5,7 @@ Summary: Exporter for machine metrics Name: prometheus-node-exporter Version: 1.3.1 -Release: 21%{?dist} +Release: 23%{?dist} # Upstream license specification: Apache-2.0 License: ASL 2.0 AND MIT Vendor: Microsoft Corporation @@ -35,6 +35,10 @@ Source5: %{name}.logrotate Patch0: defaults-paths.patch # https://github.com/prometheus/node_exporter/pull/2190 Patch1: 0001-Refactor-perf-collector.patch +# Patches the vendered source tarball; must be applied after untarring that tarball. +# Can be removed if we upgrade to prometheus-node-exporter 1.4.0 or later. +Patch2: CVE-2022-21698.patch +Patch3: CVE-2023-44487.patch BuildRequires: golang BuildRequires: systemd-rpm-macros @@ -46,10 +50,11 @@ Prometheus exporter for hardware and OS metrics exposed by *NIX kernels, written in Go with pluggable metric collectors. %prep -%autosetup -p1 -n node_exporter-%{version} - +%autosetup -N -n node_exporter-%{version} +# Apply vendor before patching rm -rf vendor tar -xf %{SOURCE1} --no-same-owner +%autopatch -p1 %build export BUILDTAGS="netgo osusergo static_build" @@ -107,6 +112,12 @@ getent passwd 'prometheus' >/dev/null || useradd -r -g 'prometheus' -d '%{_share %dir %attr(0755,prometheus,prometheus) %{_sharedstatedir}/prometheus/node-exporter %changelog +* Thu Feb 08 2024 Daniel McIlvaney - 1.3.1-23 +- Address CVE-2023-44487 by patching vendored golang.org/x/net + +* Wed Feb 07 2024 Tobias Brick - 1.3.1-22 +- Patch CVE-2022-21698 + * Mon Oct 16 2023 CBL-Mariner Servicing Account - 1.3.1-21 - Bump release to rebuild with go 1.20.9 diff --git a/SPECS/prometheus-process-exporter/CVE-2022-21698.patch b/SPECS/prometheus-process-exporter/CVE-2022-21698.patch new file mode 100644 index 00000000000..9cde3922fe1 --- /dev/null +++ b/SPECS/prometheus-process-exporter/CVE-2022-21698.patch @@ -0,0 +1,428 @@ +From f74cc87520fb81bb034cb2731ee5609d830499d6 Mon Sep 17 00:00:00 2001 +From: Tobias Brick +Date: Tue, 15 Feb 2022 11:38:19 +0100 +Subject: [PATCH] Port upstream patch + https://github.com/prometheus/client_golang/commit/9075cdf61646b5adf54d3ba77a0e4f6c65cb4fd7 + +Differences: +- Removed tests + +Based On: + +From 989baa30fe956631907493ccee1f8e7708660d96 Mon Sep 17 00:00:00 2001 +From: Bartlomiej Plotka +Date: Tue, 15 Feb 2022 11:38:19 +0100 +Subject: [PATCH] promhttp: Check validity of method and code label values + (#962) (#987) + +* Check validity of method and code label values + +Signed-off-by: Kemal Akkoyun + +* Use more flexibly functional option pattern for configuration + +Signed-off-by: Kemal Akkoyun + +* Update documentation + +Signed-off-by: Kemal Akkoyun + +* Simplify + +Signed-off-by: Kemal Akkoyun + +* Fix inconsistent method naming + +Signed-off-by: Kemal Akkoyun + +Co-authored-by: Kemal Akkoyun +--- + vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go | 28 ++++-- + vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go | 111 +++++++++++++++++------ + vendor/github.com/prometheus/client_golang/prometheus/promhttp/option.go | 31 +++++++ + 3 files changed, 138 insertions(+), 32 deletions(-) + create mode 100644 vendor/github.com/prometheus/client_golang/prometheus/promhttp/option.go + +diff --git a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go +index 83c49b6..861b4d2 100644 +--- a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go ++++ b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go +@@ -49,7 +49,10 @@ func InstrumentRoundTripperInFlight(gauge prometheus.Gauge, next http.RoundTripp + // http.RoundTripper to observe the request result with the provided CounterVec. + // The CounterVec must have zero, one, or two non-const non-curried labels. For + // those, the only allowed label names are "code" and "method". The function +-// panics otherwise. Partitioning of the CounterVec happens by HTTP status code ++// panics otherwise. For the "method" label a predefined default label value set ++// is used to filter given values. Values besides predefined values will count ++// as `unknown` method.`WithExtraMethods` can be used to add more ++// methods to the set. Partitioning of the CounterVec happens by HTTP status code + // and/or HTTP method if the respective instance label names are present in the + // CounterVec. For unpartitioned counting, use a CounterVec with zero labels. + // +@@ -57,13 +60,18 @@ func InstrumentRoundTripperInFlight(gauge prometheus.Gauge, next http.RoundTripp + // is not incremented. + // + // See the example for ExampleInstrumentRoundTripperDuration for example usage. +-func InstrumentRoundTripperCounter(counter *prometheus.CounterVec, next http.RoundTripper) RoundTripperFunc { ++func InstrumentRoundTripperCounter(counter *prometheus.CounterVec, next http.RoundTripper, opts ...Option) RoundTripperFunc { ++ rtOpts := &option{} ++ for _, o := range opts { ++ o(rtOpts) ++ } ++ + code, method := checkLabels(counter) + + return RoundTripperFunc(func(r *http.Request) (*http.Response, error) { + resp, err := next.RoundTrip(r) + if err == nil { +- counter.With(labels(code, method, r.Method, resp.StatusCode)).Inc() ++ counter.With(labels(code, method, r.Method, resp.StatusCode, rtOpts.extraMethods...)).Inc() + } + return resp, err + }) +@@ -73,7 +81,10 @@ func InstrumentRoundTripperCounter(counter *prometheus.CounterVec, next http.Rou + // http.RoundTripper to observe the request duration with the provided + // ObserverVec. The ObserverVec must have zero, one, or two non-const + // non-curried labels. For those, the only allowed label names are "code" and +-// "method". The function panics otherwise. The Observe method of the Observer ++// "method". The function panics otherwise. For the "method" label a predefined ++// default label value set is used to filter given values. Values besides ++// predefined values will count as `unknown` method. `WithExtraMethods` ++// can be used to add more methods to the set. The Observe method of the Observer + // in the ObserverVec is called with the request duration in + // seconds. Partitioning happens by HTTP status code and/or HTTP method if the + // respective instance label names are present in the ObserverVec. For +@@ -85,14 +96,19 @@ func InstrumentRoundTripperCounter(counter *prometheus.CounterVec, next http.Rou + // + // Note that this method is only guaranteed to never observe negative durations + // if used with Go1.9+. +-func InstrumentRoundTripperDuration(obs prometheus.ObserverVec, next http.RoundTripper) RoundTripperFunc { ++func InstrumentRoundTripperDuration(obs prometheus.ObserverVec, next http.RoundTripper, opts ...Option) RoundTripperFunc { ++ rtOpts := &option{} ++ for _, o := range opts { ++ o(rtOpts) ++ } ++ + code, method := checkLabels(obs) + + return RoundTripperFunc(func(r *http.Request) (*http.Response, error) { + start := time.Now() + resp, err := next.RoundTrip(r) + if err == nil { +- obs.With(labels(code, method, r.Method, resp.StatusCode)).Observe(time.Since(start).Seconds()) ++ obs.With(labels(code, method, r.Method, resp.StatusCode, rtOpts.extraMethods...)).Observe(time.Since(start).Seconds()) + } + return resp, err + }) +diff --git a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go +index ab037db..a23f0ed 100644 +--- a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go ++++ b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go +@@ -45,7 +45,10 @@ func InstrumentHandlerInFlight(g prometheus.Gauge, next http.Handler) http.Handl + // http.Handler to observe the request duration with the provided ObserverVec. + // The ObserverVec must have valid metric and label names and must have zero, + // one, or two non-const non-curried labels. For those, the only allowed label +-// names are "code" and "method". The function panics otherwise. The Observe ++// names are "code" and "method". The function panics otherwise. For the "method" ++// label a predefined default label value set is used to filter given values. ++// Values besides predefined values will count as `unknown` method. ++//`WithExtraMethods` can be used to add more methods to the set. The Observe + // method of the Observer in the ObserverVec is called with the request duration + // in seconds. Partitioning happens by HTTP status code and/or HTTP method if + // the respective instance label names are present in the ObserverVec. For +@@ -58,7 +61,12 @@ func InstrumentHandlerInFlight(g prometheus.Gauge, next http.Handler) http.Handl + // + // Note that this method is only guaranteed to never observe negative durations + // if used with Go1.9+. +-func InstrumentHandlerDuration(obs prometheus.ObserverVec, next http.Handler) http.HandlerFunc { ++func InstrumentHandlerDuration(obs prometheus.ObserverVec, next http.Handler, opts ...Option) http.HandlerFunc { ++ mwOpts := &option{} ++ for _, o := range opts { ++ o(mwOpts) ++ } ++ + code, method := checkLabels(obs) + + if code { +@@ -67,14 +75,14 @@ func InstrumentHandlerDuration(obs prometheus.ObserverVec, next http.Handler) ht + d := newDelegator(w, nil) + next.ServeHTTP(d, r) + +- obs.With(labels(code, method, r.Method, d.Status())).Observe(time.Since(now).Seconds()) ++ obs.With(labels(code, method, r.Method, d.Status(), mwOpts.extraMethods...)).Observe(time.Since(now).Seconds()) + }) + } + + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + now := time.Now() + next.ServeHTTP(w, r) +- obs.With(labels(code, method, r.Method, 0)).Observe(time.Since(now).Seconds()) ++ obs.With(labels(code, method, r.Method, 0, mwOpts.extraMethods...)).Observe(time.Since(now).Seconds()) + }) + } + +@@ -82,7 +90,10 @@ func InstrumentHandlerDuration(obs prometheus.ObserverVec, next http.Handler) ht + // to observe the request result with the provided CounterVec. The CounterVec + // must have valid metric and label names and must have zero, one, or two + // non-const non-curried labels. For those, the only allowed label names are +-// "code" and "method". The function panics otherwise. Partitioning of the ++// "code" and "method". The function panics otherwise. For the "method" ++// label a predefined default label value set is used to filter given values. ++// Values besides predefined values will count as `unknown` method. ++// `WithExtraMethods` can be used to add more methods to the set. Partitioning of the + // CounterVec happens by HTTP status code and/or HTTP method if the respective + // instance label names are present in the CounterVec. For unpartitioned + // counting, use a CounterVec with zero labels. +@@ -92,20 +103,25 @@ func InstrumentHandlerDuration(obs prometheus.ObserverVec, next http.Handler) ht + // If the wrapped Handler panics, the Counter is not incremented. + // + // See the example for InstrumentHandlerDuration for example usage. +-func InstrumentHandlerCounter(counter *prometheus.CounterVec, next http.Handler) http.HandlerFunc { ++func InstrumentHandlerCounter(counter *prometheus.CounterVec, next http.Handler, opts ...Option) http.HandlerFunc { ++ mwOpts := &option{} ++ for _, o := range opts { ++ o(mwOpts) ++ } ++ + code, method := checkLabels(counter) + + if code { + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + d := newDelegator(w, nil) + next.ServeHTTP(d, r) +- counter.With(labels(code, method, r.Method, d.Status())).Inc() ++ counter.With(labels(code, method, r.Method, d.Status(), mwOpts.extraMethods...)).Inc() + }) + } + + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + next.ServeHTTP(w, r) +- counter.With(labels(code, method, r.Method, 0)).Inc() ++ counter.With(labels(code, method, r.Method, 0, mwOpts.extraMethods...)).Inc() + }) + } + +@@ -114,7 +130,10 @@ func InstrumentHandlerCounter(counter *prometheus.CounterVec, next http.Handler) + // until the response headers are written. The ObserverVec must have valid + // metric and label names and must have zero, one, or two non-const non-curried + // labels. For those, the only allowed label names are "code" and "method". The +-// function panics otherwise. The Observe method of the Observer in the ++// function panics otherwise. For the "method" label a predefined default label ++// value set is used to filter given values. Values besides predefined values ++// will count as `unknown` method.`WithExtraMethods` can be used to add more ++// methods to the set. The Observe method of the Observer in the + // ObserverVec is called with the request duration in seconds. Partitioning + // happens by HTTP status code and/or HTTP method if the respective instance + // label names are present in the ObserverVec. For unpartitioned observations, +@@ -128,13 +147,18 @@ func InstrumentHandlerCounter(counter *prometheus.CounterVec, next http.Handler) + // if used with Go1.9+. + // + // See the example for InstrumentHandlerDuration for example usage. +-func InstrumentHandlerTimeToWriteHeader(obs prometheus.ObserverVec, next http.Handler) http.HandlerFunc { ++func InstrumentHandlerTimeToWriteHeader(obs prometheus.ObserverVec, next http.Handler, opts ...Option) http.HandlerFunc { ++ mwOpts := &option{} ++ for _, o := range opts { ++ o(mwOpts) ++ } ++ + code, method := checkLabels(obs) + + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + now := time.Now() + d := newDelegator(w, func(status int) { +- obs.With(labels(code, method, r.Method, status)).Observe(time.Since(now).Seconds()) ++ obs.With(labels(code, method, r.Method, status, mwOpts.extraMethods...)).Observe(time.Since(now).Seconds()) + }) + next.ServeHTTP(d, r) + }) +@@ -144,8 +168,11 @@ func InstrumentHandlerTimeToWriteHeader(obs prometheus.ObserverVec, next http.Ha + // http.Handler to observe the request size with the provided ObserverVec. The + // ObserverVec must have valid metric and label names and must have zero, one, + // or two non-const non-curried labels. For those, the only allowed label names +-// are "code" and "method". The function panics otherwise. The Observe method of +-// the Observer in the ObserverVec is called with the request size in ++// are "code" and "method". The function panics otherwise. For the "method" ++// label a predefined default label value set is used to filter given values. ++// Values besides predefined values will count as `unknown` method. ++// `WithExtraMethods` can be used to add more methods to the set. The Observe ++// method of the Observer in the ObserverVec is called with the request size in + // bytes. Partitioning happens by HTTP status code and/or HTTP method if the + // respective instance label names are present in the ObserverVec. For + // unpartitioned observations, use an ObserverVec with zero labels. Note that +@@ -156,7 +183,12 @@ func InstrumentHandlerTimeToWriteHeader(obs prometheus.ObserverVec, next http.Ha + // If the wrapped Handler panics, no values are reported. + // + // See the example for InstrumentHandlerDuration for example usage. +-func InstrumentHandlerRequestSize(obs prometheus.ObserverVec, next http.Handler) http.HandlerFunc { ++func InstrumentHandlerRequestSize(obs prometheus.ObserverVec, next http.Handler, opts ...Option) http.HandlerFunc { ++ mwOpts := &option{} ++ for _, o := range opts { ++ o(mwOpts) ++ } ++ + code, method := checkLabels(obs) + + if code { +@@ -164,14 +196,14 @@ func InstrumentHandlerRequestSize(obs prometheus.ObserverVec, next http.Handler) + d := newDelegator(w, nil) + next.ServeHTTP(d, r) + size := computeApproximateRequestSize(r) +- obs.With(labels(code, method, r.Method, d.Status())).Observe(float64(size)) ++ obs.With(labels(code, method, r.Method, d.Status(), mwOpts.extraMethods...)).Observe(float64(size)) + }) + } + + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + next.ServeHTTP(w, r) + size := computeApproximateRequestSize(r) +- obs.With(labels(code, method, r.Method, 0)).Observe(float64(size)) ++ obs.With(labels(code, method, r.Method, 0, mwOpts.extraMethods...)).Observe(float64(size)) + }) + } + +@@ -179,8 +211,11 @@ func InstrumentHandlerRequestSize(obs prometheus.ObserverVec, next http.Handler) + // http.Handler to observe the response size with the provided ObserverVec. The + // ObserverVec must have valid metric and label names and must have zero, one, + // or two non-const non-curried labels. For those, the only allowed label names +-// are "code" and "method". The function panics otherwise. The Observe method of +-// the Observer in the ObserverVec is called with the response size in ++// are "code" and "method". The function panics otherwise. For the "method" ++// label a predefined default label value set is used to filter given values. ++// Values besides predefined values will count as `unknown` method. ++// `WithExtraMethods` can be used to add more methods to the set. The Observe ++// method of the Observer in the ObserverVec is called with the response size in + // bytes. Partitioning happens by HTTP status code and/or HTTP method if the + // respective instance label names are present in the ObserverVec. For + // unpartitioned observations, use an ObserverVec with zero labels. Note that +@@ -191,12 +226,18 @@ func InstrumentHandlerRequestSize(obs prometheus.ObserverVec, next http.Handler) + // If the wrapped Handler panics, no values are reported. + // + // See the example for InstrumentHandlerDuration for example usage. +-func InstrumentHandlerResponseSize(obs prometheus.ObserverVec, next http.Handler) http.Handler { ++func InstrumentHandlerResponseSize(obs prometheus.ObserverVec, next http.Handler, opts ...Option) http.Handler { ++ mwOpts := &option{} ++ for _, o := range opts { ++ o(mwOpts) ++ } ++ + code, method := checkLabels(obs) ++ + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + d := newDelegator(w, nil) + next.ServeHTTP(d, r) +- obs.With(labels(code, method, r.Method, d.Status())).Observe(float64(d.Written())) ++ obs.With(labels(code, method, r.Method, d.Status(), mwOpts.extraMethods...)).Observe(float64(d.Written())) + }) + } + +@@ -290,7 +331,7 @@ func isLabelCurried(c prometheus.Collector, label string) bool { + // unnecessary allocations on each request. + var emptyLabels = prometheus.Labels{} + +-func labels(code, method bool, reqMethod string, status int) prometheus.Labels { ++func labels(code, method bool, reqMethod string, status int, extraMethods ...string) prometheus.Labels { + if !(code || method) { + return emptyLabels + } +@@ -300,7 +341,7 @@ func labels(code, method bool, reqMethod string, status int) prometheus.Labels { + labels["code"] = sanitizeCode(status) + } + if method { +- labels["method"] = sanitizeMethod(reqMethod) ++ labels["method"] = sanitizeMethod(reqMethod, extraMethods...) + } + + return labels +@@ -330,7 +371,12 @@ func computeApproximateRequestSize(r *http.Request) int { + return s + } + +-func sanitizeMethod(m string) string { ++// If the wrapped http.Handler has a known method, it will be sanitized and returned. ++// Otherwise, "unknown" will be returned. The known method list can be extended ++// as needed by using extraMethods parameter. ++func sanitizeMethod(m string, extraMethods ...string) string { ++ // See https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods for ++ // the methods chosen as default. + switch m { + case "GET", "get": + return "get" +@@ -348,15 +394,25 @@ func sanitizeMethod(m string) string { + return "options" + case "NOTIFY", "notify": + return "notify" ++ case "TRACE", "trace": ++ return "trace" ++ case "PATCH", "patch": ++ return "patch" + default: +- return strings.ToLower(m) ++ for _, method := range extraMethods { ++ if strings.EqualFold(m, method) { ++ return strings.ToLower(m) ++ } ++ } ++ return "unknown" + } + } + + // If the wrapped http.Handler has not set a status code, i.e. the value is +-// currently 0, santizeCode will return 200, for consistency with behavior in ++// currently 0, sanitizeCode will return 200, for consistency with behavior in + // the stdlib. + func sanitizeCode(s int) string { ++ // See for accepted codes https://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml + switch s { + case 100: + return "100" +@@ -453,6 +509,9 @@ func sanitizeCode(s int) string { + return "511" + + default: +- return strconv.Itoa(s) ++ if s >= 100 && s <= 599 { ++ return strconv.Itoa(s) ++ } ++ return "unknown" + } + } +diff --git a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/option.go b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/option.go +new file mode 100644 +index 0000000..35e41bd +--- /dev/null ++++ b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/option.go +@@ -0,0 +1,31 @@ ++// Copyright 2022 The Prometheus Authors ++// Licensed under the Apache License, Version 2.0 (the "License"); ++// you may not use this file except in compliance with the License. ++// You may obtain a copy of the License at ++// ++// http://www.apache.org/licenses/LICENSE-2.0 ++// ++// Unless required by applicable law or agreed to in writing, software ++// distributed under the License is distributed on an "AS IS" BASIS, ++// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. ++// See the License for the specific language governing permissions and ++// limitations under the License. ++ ++package promhttp ++ ++// Option are used to configure a middleware or round tripper.. ++type Option func(*option) ++ ++type option struct { ++ extraMethods []string ++} ++ ++// WithExtraMethods adds additional HTTP methods to the list of allowed methods. ++// See https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods for the default list. ++// ++// See the example for ExampleInstrumentHandlerWithExtraMethods for example usage. ++func WithExtraMethods(methods ...string) Option { ++ return func(o *option) { ++ o.extraMethods = methods ++ } ++} +-- +2.33.8 + diff --git a/SPECS/prometheus-process-exporter/CVE-2023-44487.patch b/SPECS/prometheus-process-exporter/CVE-2023-44487.patch new file mode 100644 index 00000000000..1e70a1becec --- /dev/null +++ b/SPECS/prometheus-process-exporter/CVE-2023-44487.patch @@ -0,0 +1,143 @@ +From 09521d1d12e9adf1ecd318a034c33b36f9e56eb2 Mon Sep 17 00:00:00 2001 +From: Damien Neil +Date: Fri, 6 Oct 2023 09:51:19 -0700 +Subject: [PATCH] http2: limit maximum handler goroutines to + MaxConcurrentStreams + +When the peer opens a new stream while we have MaxConcurrentStreams +handler goroutines running, defer starting a handler until one +of the existing handlers exits. + +Fixes golang/go#63417 +Fixes CVE-2023-39325 + +Change-Id: If0531e177b125700f3e24c5ebd24b1023098fa6d +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2045854 +TryBot-Result: Security TryBots +Reviewed-by: Ian Cottrell +Reviewed-by: Tatiana Bradley +Run-TryBot: Damien Neil +Reviewed-on: https://go-review.googlesource.com/c/net/+/534215 +Reviewed-by: Michael Pratt +Reviewed-by: Dmitri Shuralyov +LUCI-TryBot-Result: Go LUCI +Auto-Submit: Dmitri Shuralyov +Reviewed-by: Damien Neil + +Modified to apply to vendored code by: Daniel McIlvaney + - Adjusted paths + - Removed reference to server_test.go + - Removed reference to upgradeRequest() which is not in old versions of the vendored code + - Removed reference to countError() which is not in old versions of the vendored code +--- + vendor/golang.org/x/net/http2/server.go | 62 ++++++++++++++++++++++++- + 1 file changed, 60 insertions(+), 2 deletions(-) + +diff --git a/vendor/golang.org/x/net/http2/server.go b/vendor/golang.org/x/net/http2/server.go +index 09bc705..390243f 100644 +--- a/vendor/golang.org/x/net/http2/server.go ++++ b/vendor/golang.org/x/net/http2/server.go +@@ -515,9 +515,11 @@ type serverConn struct { + advMaxStreams uint32 // our SETTINGS_MAX_CONCURRENT_STREAMS advertised the client + curClientStreams uint32 // number of open streams initiated by the client + curPushedStreams uint32 // number of open streams initiated by server push ++ curHandlers uint32 // number of running handler goroutines + maxClientStreamID uint32 // max ever seen from client (odd), or 0 if there have been no client requests + maxPushPromiseID uint32 // ID of the last push promise (even), or 0 if there have been no pushes + streams map[uint32]*stream ++ unstartedHandlers []unstartedHandler + initialStreamSendWindowSize int32 + maxFrameSize int32 + headerTableSize uint32 +@@ -887,6 +889,8 @@ func (sc *serverConn) serve() { + return + case gracefulShutdownMsg: + sc.startGracefulShutdownInternal() ++ case handlerDoneMsg: ++ sc.handlerDone() + default: + panic("unknown timer") + } +@@ -932,6 +936,7 @@ var ( + idleTimerMsg = new(serverMessage) + shutdownTimerMsg = new(serverMessage) + gracefulShutdownMsg = new(serverMessage) ++ handlerDoneMsg = new(serverMessage) + ) + + func (sc *serverConn) onSettingsTimer() { sc.sendServeMsg(settingsTimerMsg) } +@@ -1889,8 +1894,7 @@ func (sc *serverConn) processHeaders(f *MetaHeadersFrame) error { + sc.conn.SetReadDeadline(time.Time{}) + } + +- go sc.runHandler(rw, req, handler) +- return nil ++ return sc.scheduleHandler(id, rw, req, handler) + } + + func (st *stream) processTrailerHeaders(f *MetaHeadersFrame) error { +@@ -2137,8 +2141,62 @@ func (sc *serverConn) newWriterAndRequestNoBody(st *stream, rp requestParam) (*r + return rw, req, nil + } + ++type unstartedHandler struct { ++ streamID uint32 ++ rw *responseWriter ++ req *http.Request ++ handler func(http.ResponseWriter, *http.Request) ++} ++ ++// scheduleHandler starts a handler goroutine, ++// or schedules one to start as soon as an existing handler finishes. ++func (sc *serverConn) scheduleHandler(streamID uint32, rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) error { ++ sc.serveG.check() ++ maxHandlers := sc.advMaxStreams ++ if sc.curHandlers < maxHandlers { ++ sc.curHandlers++ ++ go sc.runHandler(rw, req, handler) ++ return nil ++ } ++ if len(sc.unstartedHandlers) > int(4*sc.advMaxStreams) { ++ return ConnectionError(ErrCodeEnhanceYourCalm) ++ } ++ sc.unstartedHandlers = append(sc.unstartedHandlers, unstartedHandler{ ++ streamID: streamID, ++ rw: rw, ++ req: req, ++ handler: handler, ++ }) ++ return nil ++} ++ ++func (sc *serverConn) handlerDone() { ++ sc.serveG.check() ++ sc.curHandlers-- ++ i := 0 ++ maxHandlers := sc.advMaxStreams ++ for ; i < len(sc.unstartedHandlers); i++ { ++ u := sc.unstartedHandlers[i] ++ if sc.streams[u.streamID] == nil { ++ // This stream was reset before its goroutine had a chance to start. ++ continue ++ } ++ if sc.curHandlers >= maxHandlers { ++ break ++ } ++ sc.curHandlers++ ++ go sc.runHandler(u.rw, u.req, u.handler) ++ sc.unstartedHandlers[i] = unstartedHandler{} // don't retain references ++ } ++ sc.unstartedHandlers = sc.unstartedHandlers[i:] ++ if len(sc.unstartedHandlers) == 0 { ++ sc.unstartedHandlers = nil ++ } ++} ++ + // Run on its own goroutine. + func (sc *serverConn) runHandler(rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) { ++ defer sc.sendServeMsg(handlerDoneMsg) + didPanic := true + defer func() { + rw.rws.stream.cancelCtx() +-- +2.33.8 diff --git a/SPECS/prometheus-process-exporter/prometheus-process-exporter.spec b/SPECS/prometheus-process-exporter/prometheus-process-exporter.spec index 610e549de3c..8f570f65d39 100644 --- a/SPECS/prometheus-process-exporter/prometheus-process-exporter.spec +++ b/SPECS/prometheus-process-exporter/prometheus-process-exporter.spec @@ -5,7 +5,7 @@ Summary: Prometheus exporter exposing process metrics from procfs Name: prometheus-process-exporter Version: 0.7.10 -Release: 15%{?dist} +Release: 18%{?dist} License: MIT Vendor: Microsoft Corporation Distribution: Mariner @@ -30,6 +30,9 @@ Source3: %{name}.logrotate Source4: %{name}.conf Patch0: 01-fix-RSS-test-on-non4K-pagesize-systems.patch Patch1: 03-disable-fakescraper.patch +# Can be removed if we ever update to a version that includes this pull request: https://github.com/ncabatoff/process-exporter/pull/264. +Patch2: CVE-2022-21698.patch +Patch3: CVE-2023-44487.patch BuildRequires: golang BuildRequires: systemd-rpm-macros @@ -45,10 +48,11 @@ instrument with Prometheus. This exporter solves that issue by mining process metrics from procfs. %prep -%autosetup -p1 -n process-exporter-%{version} - +%autosetup -N -n process-exporter-%{version} +# Apply vendor before patching rm -rf vendor tar -xf %{SOURCE1} --no-same-owner +%autopatch -p1 %build LDFLAGS="-X github.com/ncabatoff/process-exporter/version.Version=%{version} \ @@ -97,6 +101,15 @@ getent passwd 'prometheus' >/dev/null || useradd -r -g 'prometheus' -d '%{_share %dir %attr(0755,prometheus,prometheus) %{_sharedstatedir}/prometheus %changelog +* Fri Feb 09 2024 Muhammad Falak - 0.7.10-18 +- Bump release to rebuild with go 1.21.6 + +* Thu Feb 08 2024 Daniel McIlvaney - 0.7.10-17 +- Address CVE-2023-44487 by patching vendored golang.org/x/net + +* Wed Feb 07 2024 Tobias Brick - 0.7.10-16 +- Patch to fix CVE-2022-21698 + * Mon Oct 16 2023 CBL-Mariner Servicing Account - 0.7.10-15 - Bump release to rebuild with go 1.20.9 diff --git a/SPECS/prometheus/prometheus.spec b/SPECS/prometheus/prometheus.spec index 2afd56a924a..20c2f2503f8 100644 --- a/SPECS/prometheus/prometheus.spec +++ b/SPECS/prometheus/prometheus.spec @@ -4,7 +4,7 @@ Summary: Prometheus monitoring system and time series database Name: prometheus Version: 2.37.0 -Release: 11%{?dist} +Release: 12%{?dist} License: Apache-2.0 Vendor: Microsoft Corporation Distribution: Mariner @@ -131,6 +131,9 @@ fi %doc README.md RELEASE.md documentation %changelog +* Fri Feb 02 2024 CBL-Mariner Servicing Account - 2.37.0-12 +- Bump release to rebuild with go 1.21.6 + * Mon Oct 16 2023 CBL-Mariner Servicing Account - 2.37.0-11 - Bump release to rebuild with go 1.20.9 diff --git a/SPECS/python-virtualenv/pin-pytest-version.patch b/SPECS/python-virtualenv/pin-pytest-version.patch new file mode 100644 index 00000000000..f467820373d --- /dev/null +++ b/SPECS/python-virtualenv/pin-pytest-version.patch @@ -0,0 +1,28 @@ +From 40d446bf7f2c3ee200599ec8675a2b57ed024909 Mon Sep 17 00:00:00 2001 +From: corvus-callidus <108946721+corvus-callidus@users.noreply.github.com> +Date: Wed, 7 Feb 2024 17:12:27 +0000 +Subject: [PATCH] Restrict pytest versions for compatibility + +Version 20.14.0 of virtualenv uses now-deprecated pytest APIs. Version 8 of +pytest now treats the deprecated APIs as errors, so we need to restrict the +version of pytest for compatibility with this older version of virtualenv. + +--- + setup.cfg | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/setup.cfg b/setup.cfg +index 991979b..0fbfac7 100644 +--- a/setup.cfg ++++ b/setup.cfg +@@ -96,7 +96,7 @@ testing = + coverage>=4 + coverage-enable-subprocess>=1 + flaky>=3 +- pytest>=4 ++ pytest>=4,<8 + pytest-env>=0.6.2 + pytest-freezegun>=0.4.1 + pytest-mock>=2 +-- +2.33.8 diff --git a/SPECS/python-virtualenv/python-virtualenv.spec b/SPECS/python-virtualenv/python-virtualenv.spec index 663e68567cb..6bf7383de70 100644 --- a/SPECS/python-virtualenv/python-virtualenv.spec +++ b/SPECS/python-virtualenv/python-virtualenv.spec @@ -1,7 +1,7 @@ Summary: Virtual Python Environment builder Name: python-virtualenv Version: 20.14.0 -Release: 5%{?dist} +Release: 6%{?dist} License: MIT Vendor: Microsoft Corporation Distribution: Mariner @@ -10,6 +10,7 @@ URL: https://pypi.python.org/pypi/virtualenv Source0: https://files.pythonhosted.org/packages/4a/c3/04f361a90ed4e6b3f3f696d61db5c786eaa741d2a6c125bc905b8a1c0200/virtualenv-%{version}.tar.gz#/%{name}-%{version}.tar.gz # Derived from upstream patch https://github.com/pypa/virtualenv/commit/9f9dc6250fc88e92b1ca6206429966788846d696 Patch0: fix-plugin-attribute-name.patch +Patch1: pin-pytest-version.patch BuildArch: noarch %description @@ -22,7 +23,7 @@ BuildRequires: python3-setuptools_scm BuildRequires: python3-xml BuildRequires: python3-wheel -%if %{with_check} +%if 0%{?with_check} BuildRequires: python3-pip %endif @@ -56,6 +57,9 @@ tox -e py %{_bindir}/virtualenv %changelog +* Wed Feb 07 2024 corvus-callidus <108946721+corvus-callidus@users.noreply.github.com> - 20.14.0-6 +- Fix pytest version to <8 for compatibility + * Thu Jan 25 2024 corvus-callidus <108946721+corvus-callidus@users.noreply.github.com> - 20.14.0-5 - Add missing runtime dependency on python-six diff --git a/SPECS/rook/CVE-2022-21698.patch b/SPECS/rook/CVE-2022-21698.patch new file mode 100644 index 00000000000..b2c866f6bf5 --- /dev/null +++ b/SPECS/rook/CVE-2022-21698.patch @@ -0,0 +1,364 @@ +From 253029f7ffbade99588df59a8b89a35d99197fe0 Mon Sep 17 00:00:00 2001 +From: Tobias Brick +Date: Tue, 18 Jan 2022 10:19:28 +0100 +Subject: [PATCH] Port upstream patch + https://github.com/prometheus/client_golang/commit/9075cdf61646b5adf54d3ba77a0e4f6c65cb4fd7 + +Differences: +- Removed tests +- Removed some comments that don't merge +- Line numbers and such + +Based on: + +From 9075cdf61646b5adf54d3ba77a0e4f6c65cb4fd7 Mon Sep 17 00:00:00 2001 +From: Kemal Akkoyun +Date: Tue, 18 Jan 2022 10:19:28 +0100 +Subject: [PATCH] promhttp: Check validity of method and code label values + (#962) + +* Check validity of method and code label values + +Signed-off-by: Kemal Akkoyun + +* Use more flexibly functional option pattern for configuration + +Signed-off-by: Kemal Akkoyun + +* Update documentation + +Signed-off-by: Kemal Akkoyun + +* Simplify + +Signed-off-by: Kemal Akkoyun + +* Fix inconsistent method naming + +Signed-off-by: Kemal Akkoyun +--- +vendor/github.com/prometheus/client_golang/prometheuspromhttp/instrument_client.go | 28 ++++++-- +vendor/github.com/prometheus/client_golang/prometheuspromhttp/instrument_server.go | 82 ++++++++++++++++++------ +vendor/github.com/prometheus/client_golang/prometheuspromhttp/option.go | 31 +++++++++ + 3 files changed, 116 insertions(+), 25 deletions(-) + create mode 100644vendor/github.com/prometheus/client_golang/prometheuspromhttp/option.go + +diff --git a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go +index 83c49b6..861b4d2 100644 +--- a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go ++++ b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go +@@ -49,7 +49,10 @@ func InstrumentRoundTripperInFlight(gauge prometheus.Gauge, next http.RoundTripp + // http.RoundTripper to observe the request result with the provided CounterVec. + // The CounterVec must have zero, one, or two non-const non-curried labels. For + // those, the only allowed label names are "code" and "method". The function +-// panics otherwise. Partitioning of the CounterVec happens by HTTP status code ++// panics otherwise. For the "method" label a predefined default label value set ++// is used to filter given values. Values besides predefined values will count ++// as `unknown` method.`WithExtraMethods` can be used to add more ++// methods to the set. Partitioning of the CounterVec happens by HTTP status code + // and/or HTTP method if the respective instance label names are present in the + // CounterVec. For unpartitioned counting, use a CounterVec with zero labels. + // +@@ -57,13 +60,18 @@ func InstrumentRoundTripperInFlight(gauge prometheus.Gauge, next http.RoundTripp + // is not incremented. + // + // See the example for ExampleInstrumentRoundTripperDuration for example usage. +-func InstrumentRoundTripperCounter(counter *prometheus.CounterVec, next http.RoundTripper) RoundTripperFunc { ++func InstrumentRoundTripperCounter(counter *prometheus.CounterVec, next http.RoundTripper, opts ...Option) RoundTripperFunc { ++ rtOpts := &option{} ++ for _, o := range opts { ++ o(rtOpts) ++ } ++ + code, method := checkLabels(counter) + + return RoundTripperFunc(func(r *http.Request) (*http.Response, error) { + resp, err := next.RoundTrip(r) + if err == nil { +- counter.With(labels(code, method, r.Method, resp.StatusCode)).Inc() ++ counter.With(labels(code, method, r.Method, resp.StatusCode, rtOpts.extraMethods...)).Inc() + } + return resp, err + }) +@@ -73,7 +81,10 @@ func InstrumentRoundTripperCounter(counter *prometheus.CounterVec, next http.Rou + // http.RoundTripper to observe the request duration with the provided + // ObserverVec. The ObserverVec must have zero, one, or two non-const + // non-curried labels. For those, the only allowed label names are "code" and +-// "method". The function panics otherwise. The Observe method of the Observer ++// "method". The function panics otherwise. For the "method" label a predefined ++// default label value set is used to filter given values. Values besides ++// predefined values will count as `unknown` method. `WithExtraMethods` ++// can be used to add more methods to the set. The Observe method of the Observer + // in the ObserverVec is called with the request duration in + // seconds. Partitioning happens by HTTP status code and/or HTTP method if the + // respective instance label names are present in the ObserverVec. For +@@ -85,14 +96,19 @@ func InstrumentRoundTripperCounter(counter *prometheus.CounterVec, next http.Rou + // + // Note that this method is only guaranteed to never observe negative durations + // if used with Go1.9+. +-func InstrumentRoundTripperDuration(obs prometheus.ObserverVec, next http.RoundTripper) RoundTripperFunc { ++func InstrumentRoundTripperDuration(obs prometheus.ObserverVec, next http.RoundTripper, opts ...Option) RoundTripperFunc { ++ rtOpts := &option{} ++ for _, o := range opts { ++ o(rtOpts) ++ } ++ + code, method := checkLabels(obs) + + return RoundTripperFunc(func(r *http.Request) (*http.Response, error) { + start := time.Now() + resp, err := next.RoundTrip(r) + if err == nil { +- obs.With(labels(code, method, r.Method, resp.StatusCode)).Observe(time.Since(start).Seconds()) ++ obs.With(labels(code, method, r.Method, resp.StatusCode, rtOpts.extraMethods...)).Observe(time.Since(start).Seconds()) + } + return resp, err + }) +diff --git a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go +index 9db2438..91802f8 100644 +--- a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go ++++ b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go +@@ -58,7 +58,12 @@ func InstrumentHandlerInFlight(g prometheus.Gauge, next http.Handler) http.Handl + // + // Note that this method is only guaranteed to never observe negative durations + // if used with Go1.9+. +-func InstrumentHandlerDuration(obs prometheus.ObserverVec, next http.Handler) http.HandlerFunc { ++func InstrumentHandlerDuration(obs prometheus.ObserverVec, next http.Handler, opts ...Option) http.HandlerFunc { ++ mwOpts := &option{} ++ for _, o := range opts { ++ o(mwOpts) ++ } ++ + code, method := checkLabels(obs) + + if code { +@@ -67,14 +72,14 @@ func InstrumentHandlerDuration(obs prometheus.ObserverVec, next http.Handler) ht + d := newDelegator(w, nil) + next.ServeHTTP(d, r) + +- obs.With(labels(code, method, r.Method, d.Status())).Observe(time.Since(now).Seconds()) ++ obs.With(labels(code, method, r.Method, d.Status(), mwOpts.extraMethods...)).Observe(time.Since(now).Seconds()) + }) + } + + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + now := time.Now() + next.ServeHTTP(w, r) +- obs.With(labels(code, method, r.Method, 0)).Observe(time.Since(now).Seconds()) ++ obs.With(labels(code, method, r.Method, 0, mwOpts.extraMethods...)).Observe(time.Since(now).Seconds()) + }) + } + +@@ -91,20 +96,25 @@ func InstrumentHandlerDuration(obs prometheus.ObserverVec, next http.Handler) ht + // If the wrapped Handler panics, the Counter is not incremented. + // + // See the example for InstrumentHandlerDuration for example usage. +-func InstrumentHandlerCounter(counter *prometheus.CounterVec, next http.Handler) http.HandlerFunc { ++func InstrumentHandlerCounter(counter *prometheus.CounterVec, next http.Handler, opts ...Option) http.HandlerFunc { ++ mwOpts := &option{} ++ for _, o := range opts { ++ o(mwOpts) ++ } ++ + code, method := checkLabels(counter) + + if code { + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + d := newDelegator(w, nil) + next.ServeHTTP(d, r) +- counter.With(labels(code, method, r.Method, d.Status())).Inc() ++ counter.With(labels(code, method, r.Method, d.Status(), mwOpts.extraMethods...)).Inc() + }) + } + + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + next.ServeHTTP(w, r) +- counter.With(labels(code, method, r.Method, 0)).Inc() ++ counter.With(labels(code, method, r.Method, 0, mwOpts.extraMethods...)).Inc() + }) + } + +@@ -126,13 +136,18 @@ func InstrumentHandlerCounter(counter *prometheus.CounterVec, next http.Handler) + // if used with Go1.9+. + // + // See the example for InstrumentHandlerDuration for example usage. +-func InstrumentHandlerTimeToWriteHeader(obs prometheus.ObserverVec, next http.Handler) http.HandlerFunc { ++func InstrumentHandlerTimeToWriteHeader(obs prometheus.ObserverVec, next http.Handler, opts ...Option) http.HandlerFunc { ++ mwOpts := &option{} ++ for _, o := range opts { ++ o(mwOpts) ++ } ++ + code, method := checkLabels(obs) + + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + now := time.Now() + d := newDelegator(w, func(status int) { +- obs.With(labels(code, method, r.Method, status)).Observe(time.Since(now).Seconds()) ++ obs.With(labels(code, method, r.Method, status, mwOpts.extraMethods...)).Observe(time.Since(now).Seconds()) + }) + next.ServeHTTP(d, r) + }) +@@ -154,7 +169,12 @@ func InstrumentHandlerTimeToWriteHeader(obs prometheus.ObserverVec, next http.Ha + // If the wrapped Handler panics, no values are reported. + // + // See the example for InstrumentHandlerDuration for example usage. +-func InstrumentHandlerRequestSize(obs prometheus.ObserverVec, next http.Handler) http.HandlerFunc { ++func InstrumentHandlerRequestSize(obs prometheus.ObserverVec, next http.Handler, opts ...Option) http.HandlerFunc { ++ mwOpts := &option{} ++ for _, o := range opts { ++ o(mwOpts) ++ } ++ + code, method := checkLabels(obs) + + if code { +@@ -162,14 +182,14 @@ func InstrumentHandlerRequestSize(obs prometheus.ObserverVec, next http.Handler) + d := newDelegator(w, nil) + next.ServeHTTP(d, r) + size := computeApproximateRequestSize(r) +- obs.With(labels(code, method, r.Method, d.Status())).Observe(float64(size)) ++ obs.With(labels(code, method, r.Method, d.Status(), mwOpts.extraMethods...)).Observe(float64(size)) + }) + } + + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + next.ServeHTTP(w, r) + size := computeApproximateRequestSize(r) +- obs.With(labels(code, method, r.Method, 0)).Observe(float64(size)) ++ obs.With(labels(code, method, r.Method, 0, mwOpts.extraMethods...)).Observe(float64(size)) + }) + } + +@@ -189,12 +209,18 @@ func InstrumentHandlerRequestSize(obs prometheus.ObserverVec, next http.Handler) + // If the wrapped Handler panics, no values are reported. + // + // See the example for InstrumentHandlerDuration for example usage. +-func InstrumentHandlerResponseSize(obs prometheus.ObserverVec, next http.Handler) http.Handler { ++func InstrumentHandlerResponseSize(obs prometheus.ObserverVec, next http.Handler, opts ...Option) http.Handler { ++ mwOpts := &option{} ++ for _, o := range opts { ++ o(mwOpts) ++ } ++ + code, method := checkLabels(obs) ++ + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + d := newDelegator(w, nil) + next.ServeHTTP(d, r) +- obs.With(labels(code, method, r.Method, d.Status())).Observe(float64(d.Written())) ++ obs.With(labels(code, method, r.Method, d.Status(), mwOpts.extraMethods...)).Observe(float64(d.Written())) + }) + } + +@@ -279,7 +305,7 @@ func isLabelCurried(c prometheus.Collector, label string) bool { + // unnecessary allocations on each request. + var emptyLabels = prometheus.Labels{} + +-func labels(code, method bool, reqMethod string, status int) prometheus.Labels { ++func labels(code, method bool, reqMethod string, status int, extraMethods ...string) prometheus.Labels { + if !(code || method) { + return emptyLabels + } +@@ -289,7 +315,7 @@ func labels(code, method bool, reqMethod string, status int) prometheus.Labels { + labels["code"] = sanitizeCode(status) + } + if method { +- labels["method"] = sanitizeMethod(reqMethod) ++ labels["method"] = sanitizeMethod(reqMethod, extraMethods...) + } + + return labels +@@ -319,7 +345,12 @@ func computeApproximateRequestSize(r *http.Request) int { + return s + } + +-func sanitizeMethod(m string) string { ++// If the wrapped http.Handler has a known method, it will be sanitized and returned. ++// Otherwise, "unknown" will be returned. The known method list can be extended ++// as needed by using extraMethods parameter. ++func sanitizeMethod(m string, extraMethods ...string) string { ++ // See https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods for ++ // the methods chosen as default. + switch m { + case "GET", "get": + return "get" +@@ -337,15 +368,25 @@ func sanitizeMethod(m string) string { + return "options" + case "NOTIFY", "notify": + return "notify" ++ case "TRACE", "trace": ++ return "trace" ++ case "PATCH", "patch": ++ return "patch" + default: +- return strings.ToLower(m) ++ for _, method := range extraMethods { ++ if strings.EqualFold(m, method) { ++ return strings.ToLower(m) ++ } ++ } ++ return "unknown" + } + } + + // If the wrapped http.Handler has not set a status code, i.e. the value is +-// currently 0, santizeCode will return 200, for consistency with behavior in ++// currently 0, sanitizeCode will return 200, for consistency with behavior in + // the stdlib. + func sanitizeCode(s int) string { ++ // See for accepted codes https://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml + switch s { + case 100: + return "100" +@@ -442,6 +483,9 @@ func sanitizeCode(s int) string { + return "511" + + default: +- return strconv.Itoa(s) ++ if s >= 100 && s <= 599 { ++ return strconv.Itoa(s) ++ } ++ return "unknown" + } + } +diff --git a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/option.go b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/option.go +new file mode 100644 +index 0000000..35e41bd +--- /dev/null ++++ b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/option.go +@@ -0,0 +1,31 @@ ++// Copyright 2022 The Prometheus Authors ++// Licensed under the Apache License, Version 2.0 (the "License"); ++// you may not use this file except in compliance with the License. ++// You may obtain a copy of the License at ++// ++// http://www.apache.org/licenses/LICENSE-2.0 ++// ++// Unless required by applicable law or agreed to in writing, software ++// distributed under the License is distributed on an "AS IS" BASIS, ++// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. ++// See the License for the specific language governing permissions and ++// limitations under the License. ++ ++package promhttp ++ ++// Option are used to configure a middleware or round tripper.. ++type Option func(*option) ++ ++type option struct { ++ extraMethods []string ++} ++ ++// WithExtraMethods adds additional HTTP methods to the list of allowed methods. ++// See https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods for the default list. ++// ++// See the example for ExampleInstrumentHandlerWithExtraMethods for example usage. ++func WithExtraMethods(methods ...string) Option { ++ return func(o *option) { ++ o.extraMethods = methods ++ } ++} +-- +2.33.8 + diff --git a/SPECS/rook/CVE-2023-44487.patch b/SPECS/rook/CVE-2023-44487.patch new file mode 100644 index 00000000000..1e70a1becec --- /dev/null +++ b/SPECS/rook/CVE-2023-44487.patch @@ -0,0 +1,143 @@ +From 09521d1d12e9adf1ecd318a034c33b36f9e56eb2 Mon Sep 17 00:00:00 2001 +From: Damien Neil +Date: Fri, 6 Oct 2023 09:51:19 -0700 +Subject: [PATCH] http2: limit maximum handler goroutines to + MaxConcurrentStreams + +When the peer opens a new stream while we have MaxConcurrentStreams +handler goroutines running, defer starting a handler until one +of the existing handlers exits. + +Fixes golang/go#63417 +Fixes CVE-2023-39325 + +Change-Id: If0531e177b125700f3e24c5ebd24b1023098fa6d +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2045854 +TryBot-Result: Security TryBots +Reviewed-by: Ian Cottrell +Reviewed-by: Tatiana Bradley +Run-TryBot: Damien Neil +Reviewed-on: https://go-review.googlesource.com/c/net/+/534215 +Reviewed-by: Michael Pratt +Reviewed-by: Dmitri Shuralyov +LUCI-TryBot-Result: Go LUCI +Auto-Submit: Dmitri Shuralyov +Reviewed-by: Damien Neil + +Modified to apply to vendored code by: Daniel McIlvaney + - Adjusted paths + - Removed reference to server_test.go + - Removed reference to upgradeRequest() which is not in old versions of the vendored code + - Removed reference to countError() which is not in old versions of the vendored code +--- + vendor/golang.org/x/net/http2/server.go | 62 ++++++++++++++++++++++++- + 1 file changed, 60 insertions(+), 2 deletions(-) + +diff --git a/vendor/golang.org/x/net/http2/server.go b/vendor/golang.org/x/net/http2/server.go +index 09bc705..390243f 100644 +--- a/vendor/golang.org/x/net/http2/server.go ++++ b/vendor/golang.org/x/net/http2/server.go +@@ -515,9 +515,11 @@ type serverConn struct { + advMaxStreams uint32 // our SETTINGS_MAX_CONCURRENT_STREAMS advertised the client + curClientStreams uint32 // number of open streams initiated by the client + curPushedStreams uint32 // number of open streams initiated by server push ++ curHandlers uint32 // number of running handler goroutines + maxClientStreamID uint32 // max ever seen from client (odd), or 0 if there have been no client requests + maxPushPromiseID uint32 // ID of the last push promise (even), or 0 if there have been no pushes + streams map[uint32]*stream ++ unstartedHandlers []unstartedHandler + initialStreamSendWindowSize int32 + maxFrameSize int32 + headerTableSize uint32 +@@ -887,6 +889,8 @@ func (sc *serverConn) serve() { + return + case gracefulShutdownMsg: + sc.startGracefulShutdownInternal() ++ case handlerDoneMsg: ++ sc.handlerDone() + default: + panic("unknown timer") + } +@@ -932,6 +936,7 @@ var ( + idleTimerMsg = new(serverMessage) + shutdownTimerMsg = new(serverMessage) + gracefulShutdownMsg = new(serverMessage) ++ handlerDoneMsg = new(serverMessage) + ) + + func (sc *serverConn) onSettingsTimer() { sc.sendServeMsg(settingsTimerMsg) } +@@ -1889,8 +1894,7 @@ func (sc *serverConn) processHeaders(f *MetaHeadersFrame) error { + sc.conn.SetReadDeadline(time.Time{}) + } + +- go sc.runHandler(rw, req, handler) +- return nil ++ return sc.scheduleHandler(id, rw, req, handler) + } + + func (st *stream) processTrailerHeaders(f *MetaHeadersFrame) error { +@@ -2137,8 +2141,62 @@ func (sc *serverConn) newWriterAndRequestNoBody(st *stream, rp requestParam) (*r + return rw, req, nil + } + ++type unstartedHandler struct { ++ streamID uint32 ++ rw *responseWriter ++ req *http.Request ++ handler func(http.ResponseWriter, *http.Request) ++} ++ ++// scheduleHandler starts a handler goroutine, ++// or schedules one to start as soon as an existing handler finishes. ++func (sc *serverConn) scheduleHandler(streamID uint32, rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) error { ++ sc.serveG.check() ++ maxHandlers := sc.advMaxStreams ++ if sc.curHandlers < maxHandlers { ++ sc.curHandlers++ ++ go sc.runHandler(rw, req, handler) ++ return nil ++ } ++ if len(sc.unstartedHandlers) > int(4*sc.advMaxStreams) { ++ return ConnectionError(ErrCodeEnhanceYourCalm) ++ } ++ sc.unstartedHandlers = append(sc.unstartedHandlers, unstartedHandler{ ++ streamID: streamID, ++ rw: rw, ++ req: req, ++ handler: handler, ++ }) ++ return nil ++} ++ ++func (sc *serverConn) handlerDone() { ++ sc.serveG.check() ++ sc.curHandlers-- ++ i := 0 ++ maxHandlers := sc.advMaxStreams ++ for ; i < len(sc.unstartedHandlers); i++ { ++ u := sc.unstartedHandlers[i] ++ if sc.streams[u.streamID] == nil { ++ // This stream was reset before its goroutine had a chance to start. ++ continue ++ } ++ if sc.curHandlers >= maxHandlers { ++ break ++ } ++ sc.curHandlers++ ++ go sc.runHandler(u.rw, u.req, u.handler) ++ sc.unstartedHandlers[i] = unstartedHandler{} // don't retain references ++ } ++ sc.unstartedHandlers = sc.unstartedHandlers[i:] ++ if len(sc.unstartedHandlers) == 0 { ++ sc.unstartedHandlers = nil ++ } ++} ++ + // Run on its own goroutine. + func (sc *serverConn) runHandler(rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) { ++ defer sc.sendServeMsg(handlerDoneMsg) + didPanic := true + defer func() { + rw.rws.stream.cancelCtx() +-- +2.33.8 diff --git a/SPECS/rook/rook.spec b/SPECS/rook/rook.spec index 3235566a0e0..9f6d38d39a1 100644 --- a/SPECS/rook/rook.spec +++ b/SPECS/rook/rook.spec @@ -19,7 +19,7 @@ Summary: Orchestrator for distributed storage systems in cloud-native environments Name: rook Version: 1.6.2 -Release: 15%{?dist} +Release: 18%{?dist} License: Apache-2.0 Vendor: Microsoft Corporation Distribution: Mariner @@ -52,6 +52,10 @@ Source99: update-tarball.sh # creating a new SUSE release branch of Rook. # Change the default FlexVolume dir path to support Kubic. Patch0: flexvolume-dir.patch +# Patches the vendered source tarball; must be applied after untarring that tarball. +# Can be removed if we upgrade to prometheus-node-exporter 1.10.0 or later. +Patch1: CVE-2022-21698.patch +Patch2: CVE-2023-44487.patch # Ceph version is needed to set correct container tag in manifests BuildRequires: ceph # Rook requirements @@ -122,8 +126,10 @@ This package contains Helm Charts for Rook. %define _buildshell /bin/bash %prep -%autosetup -p1 +%autosetup -N +# Apply vendor before patching tar -xf %{SOURCE1} --no-same-owner +%autopatch -p1 %build # remove symbols unsupported by k8s (+) from version @@ -248,6 +254,15 @@ sed -i -e "s|\(.*tag: \)VERSION|\1%{helm_appVersion}|" %{values_yaml} # bother adding docs or changelog or anything %changelog +* Fri Feb 09 2024 Muhammad Falak - 1.6.2-18 +- Bump release to rebuild with go 1.21.6 + +* Thu Feb 08 2024 Daniel McIlvaney - 1.6.2-17 +- Address CVE-2023-44487 by patching vendored golang.org/x/net + +* Wed Feb 07 2024 Tobias Brick - 1.6.2-16 +- Patch to fix CVE-2022-21698 + * Mon Oct 16 2023 CBL-Mariner Servicing Account - 1.6.2-15 - Bump release to rebuild with go 1.20.9 diff --git a/SPECS/skopeo/skopeo.spec b/SPECS/skopeo/skopeo.spec index 9085d8f1a2d..94f1a72e9a1 100644 --- a/SPECS/skopeo/skopeo.spec +++ b/SPECS/skopeo/skopeo.spec @@ -1,7 +1,7 @@ Summary: Inspect container images and repositories on registries Name: skopeo Version: 1.14.1 -Release: 1%{?dist} +Release: 2%{?dist} License: Apache-2.0 Vendor: Microsoft Corporation Distribution: Mariner @@ -46,6 +46,9 @@ make test-unit-local %{_mandir}/man1/%%{name}* %changelog +* Fri Feb 02 2024 CBL-Mariner Servicing Account - 1.14.1-2 +- Bump release to rebuild with go 1.21.6 + * Fri Jan 19 2024 Muhammad Falak - 1.14.1-1 - Bump version to 1.14.1 to address https://github.com/advisories/GHSA-jq35-85cj-fj4p diff --git a/SPECS/sos/bump-version-4-6-1.patch b/SPECS/sos/bump-version-4-6-1.patch new file mode 100644 index 00000000000..fdc9ee47c6f --- /dev/null +++ b/SPECS/sos/bump-version-4-6-1.patch @@ -0,0 +1,63 @@ +From d338a232cd7c829ca8ca5e5febef51035d1f7da5 Mon Sep 17 00:00:00 2001 +From: Pavel Moravec +Date: Wed, 10 Jan 2024 16:47:44 +0100 +Subject: [PATCH] [build] Bump version to 4.6.1 + +Signed-off-by: Pavel Moravec +--- + docs/conf.py | 4 ++-- + sos.spec | 5 ++++- + sos/__init__.py | 2 +- + 3 files changed, 7 insertions(+), 4 deletions(-) + +diff --git a/docs/conf.py b/docs/conf.py +index 5f105373e..57d1b9297 100644 +--- a/docs/conf.py ++++ b/docs/conf.py +@@ -59,9 +59,9 @@ + # built documents. + # + # The short X.Y version. +-version = '4.6.0' ++version = '4.6.1' + # The full version, including alpha/beta/rc tags. +-release = '4.6.0' ++release = '4.6.1' + + # The language for content autogenerated by Sphinx. Refer to documentation + # for a list of supported languages. +diff --git a/sos.spec b/sos.spec +index b575b5232..a08e2857b 100644 +--- a/sos.spec ++++ b/sos.spec +@@ -1,6 +1,6 @@ + Summary: A set of tools to gather troubleshooting information from a system + Name: sos +-Version: 4.6.0 ++Version: 4.6.1 + Release: 1%{?dist} + Source0: https://github.com/sosreport/sos/archive/%{name}-%{version}.tar.gz + License: GPL-2.0-or-later +@@ -90,6 +90,9 @@ rm -rf %{buildroot}/usr/config/ + %config(noreplace) %{_sysconfdir}/sos/sos.conf + + %changelog ++* Wed Jan 10 2024 Pavel Moravec = 4.6.1 ++- New upstream release ++ + * Thu Aug 17 2023 Jake Hunsaker = 4.6.0 + - New upstream release + +diff --git a/sos/__init__.py b/sos/__init__.py +index 78e452676..18d18c4c7 100644 +--- a/sos/__init__.py ++++ b/sos/__init__.py +@@ -14,7 +14,7 @@ + This module houses the i18n setup and message function. The default is to use + gettext to internationalize messages. + """ +-__version__ = "4.6.0" ++__version__ = "4.6.1" + + import os + import sys diff --git a/SPECS/sos/sos.signatures.json b/SPECS/sos/sos.signatures.json index 7514eea5d04..d2fbb756756 100644 --- a/SPECS/sos/sos.signatures.json +++ b/SPECS/sos/sos.signatures.json @@ -1,5 +1,5 @@ { - "Signatures": { - "sos-4.4.tar.gz": "c020555f9f961e466712bb18640962606f8b321788c63626406bdc52d4ea7bb4" - } -} \ No newline at end of file + "Signatures": { + "sos-4.6.1.tar.gz": "9b6172171ced37f6e086d4bd7764163530cd4b145336e8734faf201b9a14664d" + } +} diff --git a/SPECS/sos/sos.spec b/SPECS/sos/sos.spec index 2d6b2c3d4f4..dc81e261602 100644 --- a/SPECS/sos/sos.spec +++ b/SPECS/sos/sos.spec @@ -1,15 +1,16 @@ %{!?python3_sitelib: %global python3_sitelib %(python3 -c "from distutils.sysconfig import get_python_lib;print(get_python_lib())")} Summary: A set of tools to gather troubleshooting information from a system Name: sos -Version: 4.4 -Release: 2%{?dist} -License: GPLv2+ +Version: 4.6.1 +Release: 1%{?dist} +License: GPL-2.0-or-later Vendor: Microsoft Corporation Distribution: Mariner URL: https://github.com/sosreport/sos -#Source0: https://github.com/sosreport/sos/archive/%%{version}.tar.gz -Source0: %{name}-%{version}.tar.gz -BuildRequires: gettext +Source0: https://github.com/sosreport/sos/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz +# The sos-4.6.1.tar.gz is missing a commit to bump the version to 4.6.1 +# https://github.com/orgs/sosreport/discussions/3492 +Patch0: bump-version-4-6-1.patch BuildRequires: python3-devel BuildRequires: python3-setuptools Requires: bzip2 @@ -18,8 +19,9 @@ Requires: python3-libxml2 Requires: python3-magic Requires: python3-pexpect Requires: python3-rpm -Requires: tar -Requires: xz +Requires: python3-setuptools +# Mandatory just for uploading to a SFTP server: +Recommends: python3-requests BuildArch: noarch %description @@ -29,7 +31,7 @@ diagnostic purposes and debugging. Sos is commonly used to help support technicians and developers. %prep -%autosetup -n %{name}-%{version} +%autosetup -p1 -n %{name}-%{version} %build python3 setup.py build @@ -52,7 +54,9 @@ rm -rf %{buildroot}%{_prefix}/config/ %find_lang %{name} || echo 0 -%files -f %{name}.lang +# internationalization is currently broken. Uncomment this line once fixed. +# %%files -f %%{name}.lang +%files %license LICENSE %doc AUTHORS README.md %{_sbindir}/sos @@ -69,6 +73,10 @@ rm -rf %{buildroot}%{_prefix}/config/ %config(noreplace) %{_sysconfdir}/sos/sos.conf %changelog +* Tue Jan 30 2024 Aadhar Agarwal - 4.6.1-1 +- Upgrade to 4.6.1 +- Migrated to SPDX license + * Mon Apr 03 2023 Mykhailo Bykhovtsev - 4.4-2 - Fixing missing runtime dep of python3-magic diff --git a/SPECS/sriov-network-device-plugin/sriov-network-device-plugin.signatures.json b/SPECS/sriov-network-device-plugin/sriov-network-device-plugin.signatures.json index aa848d3116b..5a3ac0d6057 100644 --- a/SPECS/sriov-network-device-plugin/sriov-network-device-plugin.signatures.json +++ b/SPECS/sriov-network-device-plugin/sriov-network-device-plugin.signatures.json @@ -1,5 +1,5 @@ { - "Signatures": { - "sriov-network-device-plugin-3.5.1.tar.gz": "60ea0e1dfd2eced7c6fadc13b38f80393f258dc65f14ca78b4fa2e6c22cb3433" - } -} + "Signatures": { + "sriov-network-device-plugin-3.6.2.tar.gz": "3c296396e3badfa357f42fba89bb357fa0fffe9b04161b2dda2d804c5528c8ef" + } +} \ No newline at end of file diff --git a/SPECS/sriov-network-device-plugin/sriov-network-device-plugin.spec b/SPECS/sriov-network-device-plugin/sriov-network-device-plugin.spec index 161505c4f48..b5c514af906 100644 --- a/SPECS/sriov-network-device-plugin/sriov-network-device-plugin.spec +++ b/SPECS/sriov-network-device-plugin/sriov-network-device-plugin.spec @@ -1,7 +1,7 @@ Summary: Plugin for discovering and advertising networking resources Name: sriov-network-device-plugin -Version: 3.5.1 -Release: 3%{?dist} +Version: 3.6.2 +Release: 2%{?dist} License: MIT Vendor: Microsoft Corporation Distribution: Mariner @@ -34,6 +34,12 @@ install -D -m0755 images/ddptool-1.0.1.12.tar.gz %{buildroot}%{_datadir}/%{name} %{_datadir}/%{name}/ddptool-1.0.1.12.tar.gz %changelog +* Thu Feb 08 2024 Muhammad Falak - 3.6.2-2 +- Bump release to rebuild with go 1.21.6 + +* Wed Jan 24 2024 Sudhanshu Mishra - 3.6.2-1 +- Upgrade to v3.6.2 + * Mon Oct 16 2023 CBL-Mariner Servicing Account - 3.5.1-3 - Bump release to rebuild with go 1.20.9 diff --git a/SPECS/tdnf/tdnf-add-installonlypkgs-config.patch b/SPECS/tdnf/tdnf-add-installonlypkgs-config.patch index 3e6f2d3e3c0..e6cf24a3c68 100644 --- a/SPECS/tdnf/tdnf-add-installonlypkgs-config.patch +++ b/SPECS/tdnf/tdnf-add-installonlypkgs-config.patch @@ -15,11 +15,10 @@ index 67c4d51..8ec4003 100644 [main] gpgcheck=1 installonly_limit=3 -+installonlypkgs=kernel kernel-hci kernel-mos kernel-mshv kernel-uvm kernel-uvm-cvm kernel-azure ++installonlypkgs=kernel kernel-hci kernel-mos kernel-mshv kernel-uvm kernel-azure clean_requirements_on_remove=0 repodir=/etc/yum.repos.d cachedir=/var/cache/tdnf plugins=1 -- 2.34.1 - diff --git a/SPECS/telegraf/telegraf.spec b/SPECS/telegraf/telegraf.spec index ec95e02ba54..1a25029797c 100644 --- a/SPECS/telegraf/telegraf.spec +++ b/SPECS/telegraf/telegraf.spec @@ -1,7 +1,7 @@ Summary: agent for collecting, processing, aggregating, and writing metrics. Name: telegraf Version: 1.28.5 -Release: 1%{?dist} +Release: 2%{?dist} License: MIT Vendor: Microsoft Corporation Distribution: Mariner @@ -81,6 +81,9 @@ fi %dir %{_sysconfdir}/%{name}/telegraf.d %changelog +* Fri Feb 02 2024 CBL-Mariner Servicing Account - 1.28.5-2 +- Bump release to rebuild with go 1.21.6 + * Tue Dec 05 2023 Osama Esmail - 1.28.5-1 - Updating to version 1.28.5 to address critical CVEs - Fix testing diff --git a/SPECS/terraform/CVE-2023-44487.patch b/SPECS/terraform/CVE-2023-44487.patch new file mode 100644 index 00000000000..ef93a0fc7fb --- /dev/null +++ b/SPECS/terraform/CVE-2023-44487.patch @@ -0,0 +1,142 @@ +From 231b82cc8f9f1d35384a5b26917d1a9ac797ab6b Mon Sep 17 00:00:00 2001 +From: Damien Neil +Date: Fri, 6 Oct 2023 09:51:19 -0700 +Subject: [PATCH] http2: limit maximum handler goroutines to + MaxConcurrentStreams + +When the peer opens a new stream while we have MaxConcurrentStreams +handler goroutines running, defer starting a handler until one +of the existing handlers exits. + +Fixes golang/go#63417 +Fixes CVE-2023-39325 + +Change-Id: If0531e177b125700f3e24c5ebd24b1023098fa6d +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2045854 +TryBot-Result: Security TryBots +Reviewed-by: Ian Cottrell +Reviewed-by: Tatiana Bradley +Run-TryBot: Damien Neil +Reviewed-on: https://go-review.googlesource.com/c/net/+/534215 +Reviewed-by: Michael Pratt +Reviewed-by: Dmitri Shuralyov +LUCI-TryBot-Result: Go LUCI +Auto-Submit: Dmitri Shuralyov +Reviewed-by: Damien Neil + +Modified to apply to vendored code by: Daniel McIlvaney + - Adjusted paths + - Removed reference to server_test.go + - Removed reference to upgradeRequest() which is not in old versions of the vendored code +--- + vendor/golang.org/x/net/http2/server.go | 62 ++++++++++++++++++++++++- + 1 file changed, 60 insertions(+), 2 deletions(-) + +diff --git a/vendor/golang.org/x/net/http2/server.go b/vendor/golang.org/x/net/http2/server.go +index e644d9b..f56dbe9 100644 +--- a/vendor/golang.org/x/net/http2/server.go ++++ b/vendor/golang.org/x/net/http2/server.go +@@ -520,9 +520,11 @@ type serverConn struct { + advMaxStreams uint32 // our SETTINGS_MAX_CONCURRENT_STREAMS advertised the client + curClientStreams uint32 // number of open streams initiated by the client + curPushedStreams uint32 // number of open streams initiated by server push ++ curHandlers uint32 // number of running handler goroutines + maxClientStreamID uint32 // max ever seen from client (odd), or 0 if there have been no client requests + maxPushPromiseID uint32 // ID of the last push promise (even), or 0 if there have been no pushes + streams map[uint32]*stream ++ unstartedHandlers []unstartedHandler + initialStreamSendWindowSize int32 + maxFrameSize int32 + headerTableSize uint32 +@@ -909,6 +911,8 @@ func (sc *serverConn) serve() { + return + case gracefulShutdownMsg: + sc.startGracefulShutdownInternal() ++ case handlerDoneMsg: ++ sc.handlerDone() + default: + panic("unknown timer") + } +@@ -954,6 +958,7 @@ var ( + idleTimerMsg = new(serverMessage) + shutdownTimerMsg = new(serverMessage) + gracefulShutdownMsg = new(serverMessage) ++ handlerDoneMsg = new(serverMessage) + ) + + func (sc *serverConn) onSettingsTimer() { sc.sendServeMsg(settingsTimerMsg) } +@@ -1911,8 +1916,7 @@ func (sc *serverConn) processHeaders(f *MetaHeadersFrame) error { + sc.conn.SetReadDeadline(time.Time{}) + } + +- go sc.runHandler(rw, req, handler) +- return nil ++ return sc.scheduleHandler(id, rw, req, handler) + } + + func (st *stream) processTrailerHeaders(f *MetaHeadersFrame) error { +@@ -2159,8 +2163,62 @@ func (sc *serverConn) newWriterAndRequestNoBody(st *stream, rp requestParam) (*r + return rw, req, nil + } + ++type unstartedHandler struct { ++ streamID uint32 ++ rw *responseWriter ++ req *http.Request ++ handler func(http.ResponseWriter, *http.Request) ++} ++ ++// scheduleHandler starts a handler goroutine, ++// or schedules one to start as soon as an existing handler finishes. ++func (sc *serverConn) scheduleHandler(streamID uint32, rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) error { ++ sc.serveG.check() ++ maxHandlers := sc.advMaxStreams ++ if sc.curHandlers < maxHandlers { ++ sc.curHandlers++ ++ go sc.runHandler(rw, req, handler) ++ return nil ++ } ++ if len(sc.unstartedHandlers) > int(4*sc.advMaxStreams) { ++ return sc.countError("too_many_early_resets", ConnectionError(ErrCodeEnhanceYourCalm)) ++ } ++ sc.unstartedHandlers = append(sc.unstartedHandlers, unstartedHandler{ ++ streamID: streamID, ++ rw: rw, ++ req: req, ++ handler: handler, ++ }) ++ return nil ++} ++ ++func (sc *serverConn) handlerDone() { ++ sc.serveG.check() ++ sc.curHandlers-- ++ i := 0 ++ maxHandlers := sc.advMaxStreams ++ for ; i < len(sc.unstartedHandlers); i++ { ++ u := sc.unstartedHandlers[i] ++ if sc.streams[u.streamID] == nil { ++ // This stream was reset before its goroutine had a chance to start. ++ continue ++ } ++ if sc.curHandlers >= maxHandlers { ++ break ++ } ++ sc.curHandlers++ ++ go sc.runHandler(u.rw, u.req, u.handler) ++ sc.unstartedHandlers[i] = unstartedHandler{} // don't retain references ++ } ++ sc.unstartedHandlers = sc.unstartedHandlers[i:] ++ if len(sc.unstartedHandlers) == 0 { ++ sc.unstartedHandlers = nil ++ } ++} ++ + // Run on its own goroutine. + func (sc *serverConn) runHandler(rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) { ++ defer sc.sendServeMsg(handlerDoneMsg) + didPanic := true + defer func() { + rw.rws.stream.cancelCtx() +-- +2.33.8 diff --git a/SPECS/terraform/terraform.spec b/SPECS/terraform/terraform.spec index a485dbc3b39..4070e1a9327 100644 --- a/SPECS/terraform/terraform.spec +++ b/SPECS/terraform/terraform.spec @@ -1,7 +1,7 @@ Summary: Infrastructure as code deployment management tool Name: terraform Version: 1.3.2 -Release: 12%{?dist} +Release: 13%{?dist} License: MPLv2.0 Vendor: Microsoft Corporation Distribution: Mariner @@ -27,6 +27,8 @@ Source0: https://github.com/hashicorp/terraform/archive/refs/tags/v%{vers # See: https://reproducible-builds.org/docs/archives/ # - For the value of "--mtime" use the date "2021-04-26 00:00Z" to simplify future updates. Source1: %{name}-%{version}-vendor.tar.gz +Patch0: CVE-2023-44487.patch + %global debug_package %{nil} %define our_gopath %{_topdir}/.gopath BuildRequires: golang <= 1.18.8 @@ -35,10 +37,12 @@ BuildRequires: golang <= 1.18.8 Terraform is an infrastructure as code deployment management tool %prep -%autosetup -p1 +%autosetup -N +# Apply vendor before patching +tar --no-same-owner -xf %{SOURCE1} +%autopatch -p1 %build -tar --no-same-owner -xf %{SOURCE1} export GOPATH=%{our_gopath} go build -mod=vendor -v -a -o terraform @@ -57,6 +61,9 @@ install -p -m 755 -t %{buildroot}%{_bindir} ./terraform %{_bindir}/terraform %changelog +* Thu Feb 01 2024 Daniel McIlvaney - 1.3.2-13 +- Address CVE-2023-44487 by patching vendored golang.org/x/net + * Mon Oct 16 2023 CBL-Mariner Servicing Account - 1.3.2-12 - Bump release to rebuild with go 1.20.9 diff --git a/SPECS/tzdata/tzdata.signatures.json b/SPECS/tzdata/tzdata.signatures.json index 6294c95d9d6..e51cc8e0862 100644 --- a/SPECS/tzdata/tzdata.signatures.json +++ b/SPECS/tzdata/tzdata.signatures.json @@ -1,5 +1,5 @@ { - "Signatures": { - "tzdata2023c.tar.gz": "3f510b5d1b4ae9bb38e485aa302a776b317fb3637bdb6404c4adf7b6cadd965c" - } + "Signatures": { + "tzdata2024a.tar.gz": "0d0434459acbd2059a7a8da1f3304a84a86591f6ed69c6248fffa502b6edffe3" + } } \ No newline at end of file diff --git a/SPECS/tzdata/tzdata.spec b/SPECS/tzdata/tzdata.spec index 64cc26a6078..2b701feb5bc 100644 --- a/SPECS/tzdata/tzdata.spec +++ b/SPECS/tzdata/tzdata.spec @@ -1,6 +1,6 @@ Summary: Time zone data Name: tzdata -Version: 2023c +Version: 2024a Release: 1%{?dist} License: Public Domain Vendor: Microsoft Corporation @@ -45,6 +45,9 @@ ln -svf %{_datarootdir}/zoneinfo/UTC %{buildroot}%{_sysconfdir}/localtime %{_datadir}/* %changelog +* Fri Feb 02 2024 CBL-Mariner Servicing Account - 2024a-1 +- Auto-upgrade to 2024a - upgrade to version 2024a + * Thu Mar 30 2023 CBL-Mariner Service Account - 2023c-1 - Update to version "2023c". diff --git a/SPECS/vitess/CVE-2023-44487.patch b/SPECS/vitess/CVE-2023-44487.patch new file mode 100644 index 00000000000..8f91fa92d54 --- /dev/null +++ b/SPECS/vitess/CVE-2023-44487.patch @@ -0,0 +1,152 @@ +From cfb6510164d254bb74e00f066883d4a74458f6b5 Mon Sep 17 00:00:00 2001 +From: Damien Neil +Date: Fri, 6 Oct 2023 09:51:19 -0700 +Subject: [PATCH] http2: limit maximum handler goroutines to + MaxConcurrentStreams + +When the peer opens a new stream while we have MaxConcurrentStreams +handler goroutines running, defer starting a handler until one +of the existing handlers exits. + +Fixes golang/go#63417 +Fixes CVE-2023-39325 + +Change-Id: If0531e177b125700f3e24c5ebd24b1023098fa6d +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2045854 +TryBot-Result: Security TryBots +Reviewed-by: Ian Cottrell +Reviewed-by: Tatiana Bradley +Run-TryBot: Damien Neil +Reviewed-on: https://go-review.googlesource.com/c/net/+/534215 +Reviewed-by: Michael Pratt +Reviewed-by: Dmitri Shuralyov +LUCI-TryBot-Result: Go LUCI +Auto-Submit: Dmitri Shuralyov +Reviewed-by: Damien Neil + +Modified to apply to vendored code by: Daniel McIlvaney + - Adjusted paths + - Removed reference to server_test.go +--- + vendor/golang.org/x/net/http2/server.go | 66 ++++++++++++++++++++++++- + 1 file changed, 64 insertions(+), 2 deletions(-) + +diff --git a/vendor/golang.org/x/net/http2/server.go b/vendor/golang.org/x/net/http2/server.go +index 8cb14f3..6000140 100644 +--- a/vendor/golang.org/x/net/http2/server.go ++++ b/vendor/golang.org/x/net/http2/server.go +@@ -581,9 +581,11 @@ type serverConn struct { + advMaxStreams uint32 // our SETTINGS_MAX_CONCURRENT_STREAMS advertised the client + curClientStreams uint32 // number of open streams initiated by the client + curPushedStreams uint32 // number of open streams initiated by server push ++ curHandlers uint32 // number of running handler goroutines + maxClientStreamID uint32 // max ever seen from client (odd), or 0 if there have been no client requests + maxPushPromiseID uint32 // ID of the last push promise (even), or 0 if there have been no pushes + streams map[uint32]*stream ++ unstartedHandlers []unstartedHandler + initialStreamSendWindowSize int32 + maxFrameSize int32 + peerMaxHeaderListSize uint32 // zero means unknown (default) +@@ -981,6 +983,8 @@ func (sc *serverConn) serve() { + return + case gracefulShutdownMsg: + sc.startGracefulShutdownInternal() ++ case handlerDoneMsg: ++ sc.handlerDone() + default: + panic("unknown timer") + } +@@ -1028,6 +1032,7 @@ var ( + idleTimerMsg = new(serverMessage) + shutdownTimerMsg = new(serverMessage) + gracefulShutdownMsg = new(serverMessage) ++ handlerDoneMsg = new(serverMessage) + ) + + func (sc *serverConn) onSettingsTimer() { sc.sendServeMsg(settingsTimerMsg) } +@@ -2022,8 +2027,7 @@ func (sc *serverConn) processHeaders(f *MetaHeadersFrame) error { + } + } + +- go sc.runHandler(rw, req, handler) +- return nil ++ return sc.scheduleHandler(id, rw, req, handler) + } + + func (sc *serverConn) upgradeRequest(req *http.Request) { +@@ -2043,6 +2047,10 @@ func (sc *serverConn) upgradeRequest(req *http.Request) { + sc.conn.SetReadDeadline(time.Time{}) + } + ++ // This is the first request on the connection, ++ // so start the handler directly rather than going ++ // through scheduleHandler. ++ sc.curHandlers++ + go sc.runHandler(rw, req, sc.handler.ServeHTTP) + } + +@@ -2283,8 +2291,62 @@ func (sc *serverConn) newResponseWriter(st *stream, req *http.Request) *response + return &responseWriter{rws: rws} + } + ++type unstartedHandler struct { ++ streamID uint32 ++ rw *responseWriter ++ req *http.Request ++ handler func(http.ResponseWriter, *http.Request) ++} ++ ++// scheduleHandler starts a handler goroutine, ++// or schedules one to start as soon as an existing handler finishes. ++func (sc *serverConn) scheduleHandler(streamID uint32, rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) error { ++ sc.serveG.check() ++ maxHandlers := sc.advMaxStreams ++ if sc.curHandlers < maxHandlers { ++ sc.curHandlers++ ++ go sc.runHandler(rw, req, handler) ++ return nil ++ } ++ if len(sc.unstartedHandlers) > int(4*sc.advMaxStreams) { ++ return sc.countError("too_many_early_resets", ConnectionError(ErrCodeEnhanceYourCalm)) ++ } ++ sc.unstartedHandlers = append(sc.unstartedHandlers, unstartedHandler{ ++ streamID: streamID, ++ rw: rw, ++ req: req, ++ handler: handler, ++ }) ++ return nil ++} ++ ++func (sc *serverConn) handlerDone() { ++ sc.serveG.check() ++ sc.curHandlers-- ++ i := 0 ++ maxHandlers := sc.advMaxStreams ++ for ; i < len(sc.unstartedHandlers); i++ { ++ u := sc.unstartedHandlers[i] ++ if sc.streams[u.streamID] == nil { ++ // This stream was reset before its goroutine had a chance to start. ++ continue ++ } ++ if sc.curHandlers >= maxHandlers { ++ break ++ } ++ sc.curHandlers++ ++ go sc.runHandler(u.rw, u.req, u.handler) ++ sc.unstartedHandlers[i] = unstartedHandler{} // don't retain references ++ } ++ sc.unstartedHandlers = sc.unstartedHandlers[i:] ++ if len(sc.unstartedHandlers) == 0 { ++ sc.unstartedHandlers = nil ++ } ++} ++ + // Run on its own goroutine. + func (sc *serverConn) runHandler(rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) { ++ defer sc.sendServeMsg(handlerDoneMsg) + didPanic := true + defer func() { + rw.rws.stream.cancelCtx() +-- +2.33.8 diff --git a/SPECS/vitess/vitess.spec b/SPECS/vitess/vitess.spec index 79a5afcc78e..d619180376c 100644 --- a/SPECS/vitess/vitess.spec +++ b/SPECS/vitess/vitess.spec @@ -3,7 +3,7 @@ Name: vitess Version: 16.0.2 -Release: 6%{?dist} +Release: 7%{?dist} Summary: Database clustering system for horizontal scaling of MySQL # Upstream license specification: MIT and Apache-2.0 License: MIT and ASL 2.0 @@ -25,7 +25,8 @@ Source0: %{name}-%{version}.tar.gz # --pax-option=exthdr.name=%d/PaxHeaders/%f,delete=atime,delete=ctime \ # -cf %%{name}-%%{version}-vendor.tar.gz vendor # -Source1: %{name}-%{version}-vendor.tar.gz +Source1: %{name}-%{version}-vendor.tar.gz +Patch0: CVE-2023-44487.patch BuildRequires: golang %description @@ -39,7 +40,10 @@ with an atomic cutover step that takes only a few seconds. %prep -%autosetup -p1 +%autosetup -N +# Apply vendor before patching +tar --no-same-owner -xf %{SOURCE1} +%autopatch -p1 # sed in Mariner does not work on a group of files; use for-loop to apply # to apply to individual file @@ -52,10 +56,6 @@ rm -rf go/trace/plugin_datadog.go mv go/README.md README-go.md %build - -# create vendor folder from the vendor tarball and set vendor mode -tar -xf %{SOURCE1} --no-same-owner - export VERSION=%{version} for cmd in $(find go/cmd/* -maxdepth 0 -type d); do @@ -104,6 +104,9 @@ go check -t go/cmd \ %{_bindir}/* %changelog +* Thu Feb 01 2024 Daniel McIlvaney - 16.0.2-7 +- Address CVE-2023-44487 by patching vendored golang.org/x/net + * Mon Oct 16 2023 CBL-Mariner Servicing Account - 16.0.2-6 - Bump release to rebuild with go 1.20.9 diff --git a/cgmanifest.json b/cgmanifest.json index d151f5dc8a0..f17dd9f0530 100644 --- a/cgmanifest.json +++ b/cgmanifest.json @@ -4620,8 +4620,8 @@ "type": "other", "other": { "name": "golang", - "version": "1.20.10", - "downloadUrl": "https://golang.org/dl/go1.20.10.src.tar.gz" + "version": "1.21.6", + "downloadUrl": "https://golang.org/dl/go1.21.6.src.tar.gz" } } }, @@ -6540,8 +6540,8 @@ "type": "other", "other": { "name": "hyperv-daemons", - "version": "5.15.148.1", - "downloadUrl": "https://github.com/microsoft/CBL-Mariner-Linux-Kernel/archive/rolling-lts/mariner-2/5.15.148.1.tar.gz" + "version": "5.15.148.2", + "downloadUrl": "https://github.com/microsoft/CBL-Mariner-Linux-Kernel/archive/rolling-lts/mariner-2/5.15.148.2.tar.gz" } } }, @@ -8121,8 +8121,8 @@ "type": "other", "other": { "name": "kernel", - "version": "5.15.148.1", - "downloadUrl": "https://github.com/microsoft/CBL-Mariner-Linux-Kernel/archive/rolling-lts/mariner-2/5.15.148.1.tar.gz" + "version": "5.15.148.2", + "downloadUrl": "https://github.com/microsoft/CBL-Mariner-Linux-Kernel/archive/rolling-lts/mariner-2/5.15.148.2.tar.gz" } } }, @@ -8131,8 +8131,8 @@ "type": "other", "other": { "name": "kernel-azure", - "version": "5.15.148.1", - "downloadUrl": "https://github.com/microsoft/CBL-Mariner-Linux-Kernel/archive/rolling-lts/mariner-2/5.15.148.1.tar.gz" + "version": "5.15.148.2", + "downloadUrl": "https://github.com/microsoft/CBL-Mariner-Linux-Kernel/archive/rolling-lts/mariner-2/5.15.148.2.tar.gz" } } }, @@ -8141,8 +8141,8 @@ "type": "other", "other": { "name": "kernel-hci", - "version": "5.15.148.1", - "downloadUrl": "https://github.com/microsoft/CBL-Mariner-Linux-Kernel/archive/rolling-lts/mariner-2/5.15.148.1.tar.gz" + "version": "5.15.148.2", + "downloadUrl": "https://github.com/microsoft/CBL-Mariner-Linux-Kernel/archive/rolling-lts/mariner-2/5.15.148.2.tar.gz" } } }, @@ -8151,8 +8151,8 @@ "type": "other", "other": { "name": "kernel-headers", - "version": "5.15.148.1", - "downloadUrl": "https://github.com/microsoft/CBL-Mariner-Linux-Kernel/archive/rolling-lts/mariner-2/5.15.148.1.tar.gz" + "version": "5.15.148.2", + "downloadUrl": "https://github.com/microsoft/CBL-Mariner-Linux-Kernel/archive/rolling-lts/mariner-2/5.15.148.2.tar.gz" } } }, @@ -8161,8 +8161,8 @@ "type": "other", "other": { "name": "kernel-mos", - "version": "5.15.148.1", - "downloadUrl": "https://github.com/microsoft/CBL-Mariner-Linux-Kernel/archive/rolling-lts/mariner-2-mos/5.15.148.1.tar.gz" + "version": "5.15.148.2", + "downloadUrl": "https://github.com/microsoft/CBL-Mariner-Linux-Kernel/archive/rolling-lts/mariner-2-mos/5.15.148.2.tar.gz" } } }, @@ -8196,16 +8196,6 @@ } } }, - { - "component": { - "type": "other", - "other": { - "name": "kernel-uvm-cvm", - "version": "6.1.0.mshv14", - "downloadUrl": "https://cblmarinerstorage.blob.core.windows.net/sources/core/kernel-uvm-6.1.0.mshv14.tar.gz" - } - } - }, { "component": { "type": "other", @@ -12631,8 +12621,8 @@ "type": "other", "other": { "name": "lz4", - "version": "1.9.3", - "downloadUrl": "https://github.com/lz4/lz4/archive/v1.9.3/lz4-1.9.3.tar.gz" + "version": "1.9.4", + "downloadUrl": "https://github.com/lz4/lz4/archive/v1.9.4/lz4-1.9.4.tar.gz" } } }, @@ -13643,8 +13633,8 @@ "type": "other", "other": { "name": "msft-golang", - "version": "1.20.11", - "downloadUrl": "https://github.com/microsoft/go/releases/download/v1.20.11-1/go.20231107.4.src.tar.gz" + "version": "1.21.6", + "downloadUrl": "https://github.com/microsoft/go/releases/download/v1.21.6-1/go.20240111.3.src.tar.gz" } } }, @@ -14363,8 +14353,8 @@ "type": "other", "other": { "name": "nmi", - "version": "1.8.7", - "downloadUrl": "https://github.com/Azure/aad-pod-identity/archive/refs/tags/v1.8.7.tar.gz" + "version": "1.8.11", + "downloadUrl": "https://github.com/Azure/aad-pod-identity/archive/refs/tags/v1.8.11.tar.gz" } } }, @@ -14458,6 +14448,16 @@ } } }, + { + "component": { + "type": "other", + "other": { + "name": "nss-mdns", + "version": "0.15.1", + "downloadUrl": "https://github.com/lathiat/nss-mdns/releases/download/v0.15.1/nss-mdns-0.15.1.tar.gz" + } + } + }, { "component": { "type": "other", @@ -27967,8 +27967,8 @@ "type": "other", "other": { "name": "sos", - "version": "4.4", - "downloadUrl": "https://github.com/sosreport/sos/archive/4.4.tar.gz" + "version": "4.6.1", + "downloadUrl": "https://github.com/sosreport/sos/archive/4.6.1.tar.gz" } } }, @@ -28157,8 +28157,8 @@ "type": "other", "other": { "name": "sriov-network-device-plugin", - "version": "3.5.1", - "downloadUrl": "https://github.com/k8snetworkplumbingwg/sriov-network-device-plugin/archive/refs/tags/v3.5.1.tar.gz" + "version": "3.6.2", + "downloadUrl": "https://github.com/k8snetworkplumbingwg/sriov-network-device-plugin/archive/refs/tags/v3.6.2.tar.gz" } } }, @@ -28997,8 +28997,8 @@ "type": "other", "other": { "name": "tzdata", - "version": "2023c", - "downloadUrl": "https://data.iana.org/time-zones/releases/tzdata2023c.tar.gz" + "version": "2024a", + "downloadUrl": "https://data.iana.org/time-zones/releases/tzdata2024a.tar.gz" } } }, diff --git a/toolkit/Makefile b/toolkit/Makefile index d3ab4ae280e..9c3cdbd5c85 100644 --- a/toolkit/Makefile +++ b/toolkit/Makefile @@ -171,6 +171,9 @@ TLS_KEY ?= ##help:var:LOG_LEVEL:{panic,fatal,error,warn,info,debug,trace}=Set logging level for toolkit. # panic,fatal,error,warn,info,debug,trace LOG_LEVEL ?= info +##help:var:LOG_COLOR:{always,auto,never}=Set logging color for toolkit terminal output. +# always,auto,never +LOG_COLOR ?= auto STOP_ON_WARNING ?= n STOP_ON_PKG_FAIL ?= n STOP_ON_FETCH_FAIL ?= n diff --git a/toolkit/docs/building/building.md b/toolkit/docs/building/building.md index 6865ece8df1..3a15e060c92 100644 --- a/toolkit/docs/building/building.md +++ b/toolkit/docs/building/building.md @@ -809,6 +809,7 @@ To reproduce an ISO build, run the same make invocation as before, but set: | Variable | Default | Description |:------------------------------|:-------------------------------------------------------------------------------------------------------|:--- | LOG_LEVEL | info | Console log level for go tools (`panic, fatal, error, warn, info, debug, trace`) +| LOG_COLOR | auto | Console log color for go tools (`always`, `auto`, `never`). `always` enables color in both logs and terminal output, `auto`(default option) enables color in terminal output, and `never` disables color in all. | STOP_ON_WARNING | n | Stop on non-fatal makefile failures (see `$(call print_warning, message)`) | STOP_ON_PKG_FAIL | n | Stop all package builds on any failure rather than try and continue. | SRPM_FILE_SIGNATURE_HANDLING | enforce | Behavior when checking source file hashes from SPEC files. `update` will create a new entry in the signature file (`enforce, skip, update`) diff --git a/toolkit/imageconfigs/baremetal.json b/toolkit/imageconfigs/baremetal.json index bd75941ae08..3b59d5972cd 100644 --- a/toolkit/imageconfigs/baremetal.json +++ b/toolkit/imageconfigs/baremetal.json @@ -51,12 +51,17 @@ "packagelists/selinux-full.json" ], "KernelCommandLine": { - "ExtraCommandLine": "console=tty0 console=ttyS0", + "ExtraCommandLine": "console=tty0 console=ttyS0 rd.info log_buf_len=1M", "SELinux": "enforcing" }, "KernelOptions": { "default": "kernel" }, + "FinalizeImageScripts": [ + { + "Path": "scripts/cleanup.sh" + } + ], "Hostname": "azure-linux" } ] diff --git a/toolkit/imageconfigs/packagelists/core-packages-image.json b/toolkit/imageconfigs/packagelists/core-packages-image.json index 6b697d4248c..f7c5a6ba11e 100644 --- a/toolkit/imageconfigs/packagelists/core-packages-image.json +++ b/toolkit/imageconfigs/packagelists/core-packages-image.json @@ -6,8 +6,7 @@ "cronie-anacron", "logrotate", "core-packages-base-image", - "initramfs", - "shadow-utils" + "initramfs" ], "_comment": "Install 'initramfs' last to avoid unnecessary regeneration when other packages, such as 'kernel', are installed." } diff --git a/toolkit/imageconfigs/qemu-guest.json b/toolkit/imageconfigs/qemu-guest.json index 654e2b1552d..152b0330d30 100644 --- a/toolkit/imageconfigs/qemu-guest.json +++ b/toolkit/imageconfigs/qemu-guest.json @@ -55,6 +55,11 @@ "KernelOptions": { "default": "kernel-hci" }, + "FinalizeImageScripts": [ + { + "Path": "scripts/cleanup.sh" + } + ], "Hostname": "azure-linux" } ] diff --git a/toolkit/imageconfigs/scripts/cleanup.sh b/toolkit/imageconfigs/scripts/cleanup.sh new file mode 100755 index 00000000000..8c43b6ac31b --- /dev/null +++ b/toolkit/imageconfigs/scripts/cleanup.sh @@ -0,0 +1,22 @@ +#!/bin/bash + +# Copyright (c) Microsoft Corporation. +# Licensed under the MIT License. + +set -eux + +# cleanup symlinks created by the toolkit that are not needed for base images +if [ -L /srv ]; then + echo "Removing /srv symlink" + rm /srv +else + echo "/srv symlink does not exist" +fi + +# cleanup any logs that may have been created during the build +if [ -d /var/log ]; then + echo "Clearing /var/log" + rm -rf /var/log/* +else + echo "/var/log does not exist" +fi diff --git a/toolkit/resources/manifests/package/pkggen_core_aarch64.txt b/toolkit/resources/manifests/package/pkggen_core_aarch64.txt index 3c2904ee86d..0aab73741f8 100644 --- a/toolkit/resources/manifests/package/pkggen_core_aarch64.txt +++ b/toolkit/resources/manifests/package/pkggen_core_aarch64.txt @@ -1,5 +1,5 @@ filesystem-1.1-20.cm2.aarch64.rpm -kernel-headers-5.15.148.1-1.cm2.noarch.rpm +kernel-headers-5.15.148.2-1.cm2.noarch.rpm glibc-2.35-6.cm2.aarch64.rpm glibc-devel-2.35-6.cm2.aarch64.rpm glibc-i18n-2.35-6.cm2.aarch64.rpm diff --git a/toolkit/resources/manifests/package/pkggen_core_x86_64.txt b/toolkit/resources/manifests/package/pkggen_core_x86_64.txt index ca2b36b4feb..c4135c13736 100644 --- a/toolkit/resources/manifests/package/pkggen_core_x86_64.txt +++ b/toolkit/resources/manifests/package/pkggen_core_x86_64.txt @@ -1,5 +1,5 @@ filesystem-1.1-20.cm2.x86_64.rpm -kernel-headers-5.15.148.1-1.cm2.noarch.rpm +kernel-headers-5.15.148.2-1.cm2.noarch.rpm glibc-2.35-6.cm2.x86_64.rpm glibc-devel-2.35-6.cm2.x86_64.rpm glibc-i18n-2.35-6.cm2.x86_64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_aarch64.txt b/toolkit/resources/manifests/package/toolchain_aarch64.txt index c404d7b0d64..079c441e928 100644 --- a/toolkit/resources/manifests/package/toolchain_aarch64.txt +++ b/toolkit/resources/manifests/package/toolchain_aarch64.txt @@ -136,7 +136,7 @@ intltool-0.51.0-7.cm2.noarch.rpm itstool-2.0.6-4.cm2.noarch.rpm kbd-2.2.0-1.cm2.aarch64.rpm kbd-debuginfo-2.2.0-1.cm2.aarch64.rpm -kernel-headers-5.15.148.1-1.cm2.noarch.rpm +kernel-headers-5.15.148.2-1.cm2.noarch.rpm kmod-29-2.cm2.aarch64.rpm kmod-debuginfo-29-2.cm2.aarch64.rpm kmod-devel-29-2.cm2.aarch64.rpm @@ -222,9 +222,9 @@ lua-libs-5.4.4-1.cm2.aarch64.rpm lua-rpm-macros-1-6.cm2.noarch.rpm lua-srpm-macros-1-6.cm2.noarch.rpm lua-static-5.4.4-1.cm2.aarch64.rpm -lz4-1.9.3-1.cm2.aarch64.rpm -lz4-debuginfo-1.9.3-1.cm2.aarch64.rpm -lz4-devel-1.9.3-1.cm2.aarch64.rpm +lz4-1.9.4-1.cm2.aarch64.rpm +lz4-debuginfo-1.9.4-1.cm2.aarch64.rpm +lz4-devel-1.9.4-1.cm2.aarch64.rpm m4-1.4.19-2.cm2.aarch64.rpm m4-debuginfo-1.4.19-2.cm2.aarch64.rpm make-4.3-3.cm2.aarch64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_x86_64.txt b/toolkit/resources/manifests/package/toolchain_x86_64.txt index 3f7ffc40cf3..010998f20c2 100644 --- a/toolkit/resources/manifests/package/toolchain_x86_64.txt +++ b/toolkit/resources/manifests/package/toolchain_x86_64.txt @@ -141,8 +141,8 @@ intltool-0.51.0-7.cm2.noarch.rpm itstool-2.0.6-4.cm2.noarch.rpm kbd-2.2.0-1.cm2.x86_64.rpm kbd-debuginfo-2.2.0-1.cm2.x86_64.rpm -kernel-cross-headers-5.15.148.1-1.cm2.noarch.rpm -kernel-headers-5.15.148.1-1.cm2.noarch.rpm +kernel-cross-headers-5.15.148.2-1.cm2.noarch.rpm +kernel-headers-5.15.148.2-1.cm2.noarch.rpm kmod-29-2.cm2.x86_64.rpm kmod-debuginfo-29-2.cm2.x86_64.rpm kmod-devel-29-2.cm2.x86_64.rpm @@ -228,9 +228,9 @@ lua-libs-5.4.4-1.cm2.x86_64.rpm lua-rpm-macros-1-6.cm2.noarch.rpm lua-srpm-macros-1-6.cm2.noarch.rpm lua-static-5.4.4-1.cm2.x86_64.rpm -lz4-1.9.3-1.cm2.x86_64.rpm -lz4-debuginfo-1.9.3-1.cm2.x86_64.rpm -lz4-devel-1.9.3-1.cm2.x86_64.rpm +lz4-1.9.4-1.cm2.x86_64.rpm +lz4-debuginfo-1.9.4-1.cm2.x86_64.rpm +lz4-devel-1.9.4-1.cm2.x86_64.rpm m4-1.4.19-2.cm2.x86_64.rpm m4-debuginfo-1.4.19-2.cm2.x86_64.rpm make-4.3-3.cm2.x86_64.rpm diff --git a/toolkit/scripts/chroot.mk b/toolkit/scripts/chroot.mk index da4f61a94f7..08af968dcad 100644 --- a/toolkit/scripts/chroot.mk +++ b/toolkit/scripts/chroot.mk @@ -54,7 +54,8 @@ validate-chroot: $(go-validatechroot) $(chroot_worker) --worker-chroot="$(chroot_worker)" \ --worker-manifest="$(worker_chroot_manifest)" \ --log-file="$(LOGS_DIR)/worker/validate.log" \ - --log-level="$(LOG_LEVEL)" + --log-level="$(LOG_LEVEL)" \ + --log-color="$(LOG_COLOR)" ######## MACRO TOOLS ######## diff --git a/toolkit/scripts/imggen.mk b/toolkit/scripts/imggen.mk index d0f16522947..34b30450055 100644 --- a/toolkit/scripts/imggen.mk +++ b/toolkit/scripts/imggen.mk @@ -119,6 +119,7 @@ $(image_package_cache_summary): $(go-imagepkgfetcher) $(chroot_worker) $(toolcha --base-dir=$(CONFIG_BASE_DIR) \ --log-level=$(LOG_LEVEL) \ --log-file=$(LOGS_DIR)/imggen/imagepkgfetcher.log \ + --log-color=$(LOG_COLOR) \ --rpm-dir=$(RPMS_DIR) \ --tmp-dir=$(image_fetcher_tmp_dir) \ --toolchain-rpms-dir="$(TOOLCHAIN_RPMS_DIR)" \ @@ -154,6 +155,7 @@ $(STATUS_FLAGS_DIR)/imager_disk_output.flag: $(go-imager) $(image_package_cache_ --base-dir=$(CONFIG_BASE_DIR) \ --log-level=$(LOG_LEVEL) \ --log-file=$(LOGS_DIR)/imggen/imager.log \ + --log-color=$(LOG_COLOR) \ --local-repo $(local_and_external_rpm_cache) \ --tdnf-worker $(chroot_worker) \ --repo-file=$(imggen_local_repo) \ @@ -184,6 +186,7 @@ image: $(imager_disk_output_dir) $(imager_disk_output_files) $(go-roast) $(depen --release-version $(RELEASE_VERSION) \ --log-level=$(LOG_LEVEL) \ --log-file=$(LOGS_DIR)/imggen/roast.log \ + --log-color=$(LOG_COLOR) \ --image-tag=$(IMAGE_TAG) \ --cpu-prof-file=$(PROFILE_DIR)/roast.cpu.pprof \ --mem-prof-file=$(PROFILE_DIR)/roast.mem.pprof \ @@ -200,6 +203,7 @@ $(image_external_package_cache_summary): $(cached_file) $(go-imagepkgfetcher) $( --base-dir=$(CONFIG_BASE_DIR) \ --log-level=$(LOG_LEVEL) \ --log-file=$(LOGS_DIR)/imggen/externalimagepkgfetcher.log \ + --log-color=$(LOG_COLOR) \ --rpm-dir=$(RPMS_DIR) \ --tmp-dir=$(image_fetcher_tmp_dir) \ --toolchain-rpms-dir="$(TOOLCHAIN_RPMS_DIR)" \ @@ -247,6 +251,7 @@ iso: $(initrd_img) $(iso_deps) --iso-repo $(local_and_external_rpm_cache) \ --log-level=$(LOG_LEVEL) \ --log-file=$(LOGS_DIR)/imggen/isomaker.log \ + --log-color=$(LOG_COLOR) \ $(if $(filter y,$(UNATTENDED_INSTALLER)),--unattended-install) \ --output-dir $(artifact_dir) \ --image-tag=$(IMAGE_TAG) diff --git a/toolkit/scripts/pkggen.mk b/toolkit/scripts/pkggen.mk index 1ad8057628b..41beca8e905 100644 --- a/toolkit/scripts/pkggen.mk +++ b/toolkit/scripts/pkggen.mk @@ -39,7 +39,7 @@ preprocessed_file = $(PKGBUILD_DIR)/preprocessed_graph.dot built_file = $(PKGBUILD_DIR)/built_graph.dot output_csv_file = $(PKGBUILD_DIR)/build_state.csv -logging_command = --log-file=$(LOGS_DIR)/pkggen/workplan/$(notdir $@).log --log-level=$(LOG_LEVEL) +logging_command = --log-file=$(LOGS_DIR)/pkggen/workplan/$(notdir $@).log --log-level=$(LOG_LEVEL) --log-color=$(LOG_COLOR) $(call create_folder,$(LOGS_DIR)/pkggen/workplan) $(call create_folder,$(rpmbuilding_logs_dir)) diff --git a/toolkit/scripts/precache.mk b/toolkit/scripts/precache.mk index 358a48cd8e9..70633ac2562 100644 --- a/toolkit/scripts/precache.mk +++ b/toolkit/scripts/precache.mk @@ -42,6 +42,7 @@ $(STATUS_FLAGS_DIR)/precache.flag: $(go-precacher) $(chroot_worker) $(rpms_snaps --worker-dir $(precache_chroot_dir) \ --log-file=$(precache_logs_path) \ --log-level=$(LOG_LEVEL) \ + --log-color=$(LOG_COLOR) \ --cpu-prof-file=$(PROFILE_DIR)/precacher.cpu.pprof \ --mem-prof-file=$(PROFILE_DIR)/precacher.mem.pprof \ --trace-file=$(PROFILE_DIR)/precacher.trace \ diff --git a/toolkit/scripts/repoquerywrapper.mk b/toolkit/scripts/repoquerywrapper.mk index bc0a59c9e64..e5218968f63 100644 --- a/toolkit/scripts/repoquerywrapper.mk +++ b/toolkit/scripts/repoquerywrapper.mk @@ -46,6 +46,7 @@ $(STATUS_FLAGS_DIR)/repoquerywrapper.flag: $(go-repoquerywrapper) $(chroot_worke --worker-dir $(repoquerywrapper_chroot_dir) \ --log-file=$(repoquerywrapper_logs_path) \ --log-level=$(LOG_LEVEL) \ + --log-color=$(LOG_COLOR) \ --cpu-prof-file=$(PROFILE_DIR)/repoquerywrapper.cpu.pprof \ --mem-prof-file=$(PROFILE_DIR)/repoquerywrapper.mem.pprof \ --trace-file=$(PROFILE_DIR)/repoquerywrapper.trace \ diff --git a/toolkit/scripts/srpm_pack.mk b/toolkit/scripts/srpm_pack.mk index 58892656128..5b4404aeda5 100644 --- a/toolkit/scripts/srpm_pack.mk +++ b/toolkit/scripts/srpm_pack.mk @@ -100,6 +100,7 @@ $(STATUS_FLAGS_DIR)/build_srpms.flag: $(chroot_worker) $(local_specs) $(local_sp $(if $(SRPM_PACK_LIST),--pack-list=$(srpm_pack_list_file)) \ --log-file=$(SRPM_BUILD_LOGS_DIR)/srpmpacker.log \ --log-level=$(LOG_LEVEL) \ + --log-color=$(LOG_COLOR) \ --cpu-prof-file=$(PROFILE_DIR)/srpm_packer.cpu.pprof \ --mem-prof-file=$(PROFILE_DIR)/srpm_packer.mem.pprof \ --trace-file=$(PROFILE_DIR)/srpm_packer.trace \ @@ -124,6 +125,7 @@ $(STATUS_FLAGS_DIR)/build_toolchain_srpms.flag: $(toolchain_spec_list) $(go-srpm $(if $(filter y,$(RUN_CHECK)),--run-check) \ --log-file=$(LOGS_DIR)/toolchain/srpms/toolchain_srpmpacker.log \ --log-level=$(LOG_LEVEL) \ + --log-color=$(LOG_COLOR) \ --cpu-prof-file=$(PROFILE_DIR)/srpm_toolchain_packer.cpu.pprof \ --mem-prof-file=$(PROFILE_DIR)/srpm_toolchain_packer.mem.pprof \ --trace-file=$(PROFILE_DIR)/srpm_toolchain_packer.trace \ diff --git a/toolkit/scripts/toolkit.mk b/toolkit/scripts/toolkit.mk index a2623e80ec8..6ab0fd42711 100644 --- a/toolkit/scripts/toolkit.mk +++ b/toolkit/scripts/toolkit.mk @@ -102,7 +102,8 @@ $(rpms_snapshot_per_specs): $(go-rpmssnapshot) $(chroot_worker) $(local_specs) $ --dist-tag=$(DIST_TAG) \ --worker-tar="$(chroot_worker)" \ --log-level=$(LOG_LEVEL) \ - --log-file="$(rpms_snapshot_logs_path)" + --log-file="$(rpms_snapshot_logs_path)" \ + --log-color="$(LOG_COLOR)" print-build-summary: sed -E -n 's:^.+level=info msg="Built \(([^\)]+)\) -> \[(.+)\].+$:\1\t\2:gp' $(LOGS_DIR)/pkggen/rpmbuilding/* | tee $(LOGS_DIR)/pkggen/build-summary.csv @@ -113,7 +114,7 @@ run-specarchchecker: $(valid_arch_spec_names) @cat $(valid_arch_spec_names) && echo "" # File doesn't have a newline at the end, so add one via echo. @echo "Valid arch spec names generated under '$(valid_arch_spec_names)'." -$(valid_arch_spec_names): $(go-specarchchecker) $(chroot_worker) $(local_specs) $(local_spec_dirs) $(SPECS_DIR) $(depend_PACKAGE_BUILD_LIST) $(depend_PACKAGE_REBUILD_LIST) +$(valid_arch_spec_names): $(go-specarchchecker) $(chroot_worker) $(local_specs) $(local_spec_dirs) $(SPECS_DIR) $(depend_PACKAGE_BUILD_LIST) $(depend_PACKAGE_REBUILD_LIST) $(go-specarchchecker) \ --input="$(SPECS_DIR)" \ --output="$@" \ @@ -124,4 +125,5 @@ $(valid_arch_spec_names): $(go-specarchchecker) $(chroot_worker) $(local_specs) --dist-tag=$(DIST_TAG) \ --worker-tar="$(chroot_worker)" \ --log-level=$(LOG_LEVEL) \ - --log-file="$(valid_arch_spec_names_logs_path)" + --log-file="$(valid_arch_spec_names_logs_path)" \ + --log-color="$(LOG_COLOR)" diff --git a/toolkit/tools/bldtracker/bldtracker.go b/toolkit/tools/bldtracker/bldtracker.go index 32bea8c03d7..fc23875a9bc 100644 --- a/toolkit/tools/bldtracker/bldtracker.go +++ b/toolkit/tools/bldtracker/bldtracker.go @@ -27,7 +27,7 @@ var ( scriptName = app.Flag("script-name", "The name of the current tool.").Required().String() stepPath = app.Flag("step-path", "A '/' separated path of steps").Default("").String() outPath = app.Flag("out-path", "The file that stores timestamp CSVs.").Required().String() // currently must be absolute - logLevel = exe.LogLevelFlag(app) + logFlags = exe.SetupLogFlags(app) validModes = []string{initializeMode, recordMode, stopMode, finishMode} mode = app.Flag("mode", "The mode of this tool. Could be 'initialize' ('i') or 'record' ('r').").Required().Enum(validModes...) ) @@ -35,7 +35,7 @@ var ( func main() { app.Version(exe.ToolkitVersion) kingpin.MustParse(app.Parse(os.Args[1:])) - setupLogger(*logLevel) + setupLogger(*logFlags.LogLevel) // Perform different actions based on the input "mode". switch *mode { diff --git a/toolkit/tools/boilerplate/boilerplate.go b/toolkit/tools/boilerplate/boilerplate.go index 2a3caba8084..edaa4b9f9c0 100644 --- a/toolkit/tools/boilerplate/boilerplate.go +++ b/toolkit/tools/boilerplate/boilerplate.go @@ -19,9 +19,7 @@ import ( var ( app = kingpin.New("boilerplate", "A sample golang tool for Mariner.") - logFile = exe.LogFileFlag(app) - logLevel = exe.LogLevelFlag(app) - + logFlags = exe.SetupLogFlags(app) timestampFile = app.Flag("timestamp-file", "File that stores timestamps for this program.").String() ) @@ -29,7 +27,7 @@ func main() { app.Version(exe.ToolkitVersion) kingpin.MustParse(app.Parse(os.Args[1:])) - logger.InitBestEffort(*logFile, *logLevel) + logger.InitBestEffort(logFlags) timestamp.BeginTiming("boilerplate", *timestampFile) defer timestamp.CompleteTiming() diff --git a/toolkit/tools/depsearch/depsearch.go b/toolkit/tools/depsearch/depsearch.go index 307aa93e0b5..0f8ac849f88 100644 --- a/toolkit/tools/depsearch/depsearch.go +++ b/toolkit/tools/depsearch/depsearch.go @@ -43,8 +43,7 @@ var ( filterFile = app.Flag("rpm-filter-file", "Filter the returned packages based on this list of *.rpm filenames (defaults to the x86_64 toolchain manifest './resources/manifests/package/toolchain_x86_64.txt' if it exists)").ExistingFile() filter = app.Flag("rpm-filter", "Only print any packages that are missing from the rpm-filter-file (useful for debugging toolchain package issues for example)").Bool() - logFile = exe.LogFileFlag(app) - logLevel = exe.LogLevelFlag(app) + logFlags = exe.SetupLogFlags(app) ) func main() { @@ -55,7 +54,7 @@ func main() { app.Version(exe.ToolkitVersion) kingpin.MustParse(app.Parse(os.Args[1:])) - logger.InitBestEffort(*logFile, *logLevel) + logger.InitBestEffort(logFlags) // only understand verbosity from 1 - 4 (spec, rpm, details, full node) if verbosity == nil || *verbosity > 4 || *verbosity < 1 { diff --git a/toolkit/tools/downloader/downloader.go b/toolkit/tools/downloader/downloader.go index 7f00490f581..c1b56d15cf2 100644 --- a/toolkit/tools/downloader/downloader.go +++ b/toolkit/tools/downloader/downloader.go @@ -26,8 +26,7 @@ import ( var ( app = kingpin.New("downloader", "Download files to a location") - logFile = exe.LogFileFlag(app) - logLevel = exe.LogLevelFlag(app) + logFlags = exe.SetupLogFlags(app) noClobber = app.Flag("no-clobber", "Do not overwrite existing files").Bool() noVerbose = app.Flag("no-verbose", "Do not print verbose output").Bool() @@ -43,7 +42,7 @@ var ( func main() { app.Version(exe.ToolkitVersion) kingpin.MustParse(app.Parse(os.Args[1:])) - logger.InitBestEffort(*logFile, *logLevel) + logger.InitBestEffort(logFlags) if *noVerbose { logger.Log.SetLevel(logrus.WarnLevel) } diff --git a/toolkit/tools/go.mod b/toolkit/tools/go.mod index ca2a66940ef..97942d1ce91 100644 --- a/toolkit/tools/go.mod +++ b/toolkit/tools/go.mod @@ -8,6 +8,7 @@ require ( github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d github.com/bendahl/uinput v1.4.0 github.com/cavaliercoder/go-cpio v0.0.0-20180626203310-925f9528c45e + github.com/fatih/color v1.16.0 github.com/gdamore/tcell v1.4.0 github.com/jinzhu/copier v0.3.2 github.com/juliangruber/go-intersect v1.1.0 @@ -38,6 +39,8 @@ require ( github.com/klauspost/compress v1.10.5 // indirect github.com/kylelemons/godebug v1.1.0 // indirect github.com/lucasb-eyer/go-colorful v1.0.3 // indirect + github.com/mattn/go-colorable v0.1.13 // indirect + github.com/mattn/go-isatty v0.0.20 // indirect github.com/mattn/go-runewidth v0.0.7 // indirect github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e // indirect github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8 // indirect diff --git a/toolkit/tools/go.sum b/toolkit/tools/go.sum index cf51ddf7ac7..5b5f636f814 100644 --- a/toolkit/tools/go.sum +++ b/toolkit/tools/go.sum @@ -26,6 +26,8 @@ github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/dnaeon/go-vcr v1.2.0 h1:zHCHvJYTMh1N7xnV7zf1m1GPBF9Ad0Jk/whtQ1663qI= +github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM= +github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE= github.com/gdamore/encoding v1.0.0 h1:+7OoQ1Bc6eTm5niUzBa0Ctsh6JbMW6Ra+YNuAtDBdko= github.com/gdamore/encoding v1.0.0/go.mod h1:alR0ol34c49FCSBLjhosxzcPHQbf2trDkoo5dl+VrEg= github.com/gdamore/tcell v1.3.0/go.mod h1:Hjvr+Ofd+gLglo7RYKxxnzCBmev3BzsS67MebKS4zMM= @@ -53,6 +55,11 @@ github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+ github.com/lucasb-eyer/go-colorful v1.0.2/go.mod h1:0MS4r+7BZKSJ5mw4/S5MPN+qHFF1fYclkSPilDOKW0s= github.com/lucasb-eyer/go-colorful v1.0.3 h1:QIbQXiugsb+q10B+MI+7DI1oQLdmnep86tWFlaaUAac= github.com/lucasb-eyer/go-colorful v1.0.3/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0= +github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA= +github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg= +github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM= +github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY= +github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y= github.com/mattn/go-runewidth v0.0.4/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU= github.com/mattn/go-runewidth v0.0.7 h1:Ei8KR0497xHyKJPAv59M1dkC+rOZCMBJ+t3fZ+twI54= github.com/mattn/go-runewidth v0.0.7/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI= @@ -92,6 +99,8 @@ golang.org/x/sys v0.0.0-20191018095205-727590c5006e/go.mod h1:h1NjWce9XRLGQEsW7w golang.org/x/sys v0.0.0-20210616045830-e2b7044e8c71/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc= golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= diff --git a/toolkit/tools/graphPreprocessor/graphPreprocessor.go b/toolkit/tools/graphPreprocessor/graphPreprocessor.go index f20a85e0c36..9e7bccb24b2 100644 --- a/toolkit/tools/graphPreprocessor/graphPreprocessor.go +++ b/toolkit/tools/graphPreprocessor/graphPreprocessor.go @@ -19,8 +19,7 @@ var ( outputGraphFile = exe.OutputFlag(app, "Output file to export the scrubbed graph to") hydratedBuild = app.Flag("hydrated-build", "Build individual packages with dependencies Hydrated").Bool() - logFile = exe.LogFileFlag(app) - logLevel = exe.LogLevelFlag(app) + logFlags = exe.SetupLogFlags(app) ) func replaceRunNodesWithPrebuiltNodes(pkgGraph *pkggraph.PkgGraph) (err error) { @@ -65,7 +64,7 @@ func replaceRunNodesWithPrebuiltNodes(pkgGraph *pkggraph.PkgGraph) (err error) { func main() { app.Version(exe.ToolkitVersion) kingpin.MustParse(app.Parse(os.Args[1:])) - logger.InitBestEffort(*logFile, *logLevel) + logger.InitBestEffort(logFlags) scrubbedGraph, err := pkggraph.ReadDOTGraphFile(*inputGraphFile) if err != nil { diff --git a/toolkit/tools/graphanalytics/graphanalytics.go b/toolkit/tools/graphanalytics/graphanalytics.go index fdaaa131e96..7e79b7173a5 100644 --- a/toolkit/tools/graphanalytics/graphanalytics.go +++ b/toolkit/tools/graphanalytics/graphanalytics.go @@ -36,15 +36,14 @@ var ( app = kingpin.New("graphanalytics", "A tool to print analytics of a given dependency graph.") inputGraphFile = exe.InputFlag(app, "Path to the DOT graph file to analyze.") maxResults = app.Flag("max-results", "The number of results to print per category. Set 0 to print unlimited.").Default(defaultMaxResults).Int() - logFile = exe.LogFileFlag(app) - logLevel = exe.LogLevelFlag(app) + logFlags = exe.SetupLogFlags(app) ) func main() { app.Version(exe.ToolkitVersion) kingpin.MustParse(app.Parse(os.Args[1:])) - logger.InitBestEffort(*logFile, *logLevel) + logger.InitBestEffort(logFlags) err := analyzeGraph(*inputGraphFile, *maxResults) if err != nil { diff --git a/toolkit/tools/grapher/grapher.go b/toolkit/tools/grapher/grapher.go index 929824e3da3..47743993821 100644 --- a/toolkit/tools/grapher/grapher.go +++ b/toolkit/tools/grapher/grapher.go @@ -23,8 +23,7 @@ var ( input = exe.InputFlag(app, "Input json listing all local SRPMs") output = exe.OutputFlag(app, "Output file to export the graph to") - logFile = exe.LogFileFlag(app) - logLevel = exe.LogLevelFlag(app) + logFlags = exe.SetupLogFlags(app) profFlags = exe.SetupProfileFlags(app) strictGoals = app.Flag("strict-goals", "Don't allow missing goal packages").Bool() strictUnresolved = app.Flag("strict-unresolved", "Don't allow missing unresolved packages").Bool() @@ -52,7 +51,7 @@ func main() { app.Version(exe.ToolkitVersion) kingpin.MustParse(app.Parse(os.Args[1:])) - logger.InitBestEffort(*logFile, *logLevel) + logger.InitBestEffort(logFlags) prof, err := profile.StartProfiling(profFlags) if err != nil { diff --git a/toolkit/tools/graphpkgfetcher/graphpkgfetcher.go b/toolkit/tools/graphpkgfetcher/graphpkgfetcher.go index f079259c40c..3c6b1ae3138 100644 --- a/toolkit/tools/graphpkgfetcher/graphpkgfetcher.go +++ b/toolkit/tools/graphpkgfetcher/graphpkgfetcher.go @@ -67,8 +67,7 @@ var ( inputSummaryFile = app.Flag("input-summary-file", "Path to a file with the summary of packages cloned to be restored").String() outputSummaryFile = app.Flag("output-summary-file", "Path to save the summary of packages cloned").String() - logFile = exe.LogFileFlag(app) - logLevel = exe.LogLevelFlag(app) + logFlags = exe.SetupLogFlags(app) profFlags = exe.SetupProfileFlags(app) timestampFile = app.Flag("timestamp-file", "File that stores timestamps for this program.").String() ) @@ -76,7 +75,7 @@ var ( func main() { app.Version(exe.ToolkitVersion) kingpin.MustParse(app.Parse(os.Args[1:])) - logger.InitBestEffort(*logFile, *logLevel) + logger.InitBestEffort(logFlags) prof, err := profile.StartProfiling(profFlags) if err != nil { diff --git a/toolkit/tools/imageconfigvalidator/imageconfigvalidator.go b/toolkit/tools/imageconfigvalidator/imageconfigvalidator.go index 1c150de5ca4..aedee4fbd31 100644 --- a/toolkit/tools/imageconfigvalidator/imageconfigvalidator.go +++ b/toolkit/tools/imageconfigvalidator/imageconfigvalidator.go @@ -24,8 +24,7 @@ import ( var ( app = kingpin.New("imageconfigvalidator", "A tool for validating image configuration files") - logFile = exe.LogFileFlag(app) - logLevel = exe.LogLevelFlag(app) + logFlags = exe.SetupLogFlags(app) profFlags = exe.SetupProfileFlags(app) input = exe.InputStringFlag(app, "Path to the image config file.") @@ -39,7 +38,7 @@ func main() { app.Version(exe.ToolkitVersion) kingpin.MustParse(app.Parse(os.Args[1:])) - logger.InitBestEffort(*logFile, *logLevel) + logger.InitBestEffort(logFlags) prof, err := profile.StartProfiling(profFlags) if err != nil { @@ -119,7 +118,6 @@ func validatePackages(config configuration.Config) (err error) { verityDebugPkgName = "verity-read-only-root-debug-tools" dracutFipsPkgName = "dracut-fips" fipsKernelCmdLine = "fips=1" - userAddPkgName = "shadow-utils" ) for _, systemConfig := range config.SystemConfigs { @@ -131,7 +129,6 @@ func validatePackages(config configuration.Config) (err error) { foundVerityInitramfsPackage := false foundVerityInitramfsDebugPackage := false foundDracutFipsPackage := false - foundUserAddPackage := false kernelCmdLineString := systemConfig.KernelCommandLine.ExtraCommandLine selinuxPkgName := systemConfig.KernelCommandLine.SELinuxPolicy if selinuxPkgName == "" { @@ -154,9 +151,6 @@ func validatePackages(config configuration.Config) (err error) { if pkg == selinuxPkgName { foundSELinuxPackage = true } - if pkg == userAddPkgName { - foundUserAddPackage = true - } } if systemConfig.ReadOnlyVerityRoot.Enable { if !foundVerityInitramfsPackage { @@ -176,11 +170,6 @@ func validatePackages(config configuration.Config) (err error) { return fmt.Errorf("%s: [SELinux] selected, but '%s' package is not included in the package lists", validateError, selinuxPkgName) } } - if len(systemConfig.Users) > 0 || len(systemConfig.Groups) > 0 { - if !foundUserAddPackage { - return fmt.Errorf("%s: add users require '%s' package that is not included in the package lists", validateError, userAddPkgName) - } - } } return diff --git a/toolkit/tools/imagecustomizer/main.go b/toolkit/tools/imagecustomizer/main.go index 54d467a4e15..1d504646a3c 100644 --- a/toolkit/tools/imagecustomizer/main.go +++ b/toolkit/tools/imagecustomizer/main.go @@ -26,8 +26,7 @@ var ( configFile = app.Flag("config-file", "Path of the image customization config file.").Required().String() rpmSources = app.Flag("rpm-source", "Path to a RPM repo config file or a directory containing RPMs.").Strings() disableBaseImageRpmRepos = app.Flag("disable-base-image-rpm-repos", "Disable the base image's RPM repos as an RPM source").Bool() - logFile = exe.LogFileFlag(app) - logLevel = exe.LogLevelFlag(app) + logFlags = exe.SetupLogFlags(app) profFlags = exe.SetupProfileFlags(app) timestampFile = app.Flag("timestamp-file", "File that stores timestamps for this program.").String() ) @@ -41,7 +40,7 @@ func main() { kingpin.Fatalf("Either --output-image-format or --output-split-partitions-format must be specified.") } - logger.InitBestEffort(*logFile, *logLevel) + logger.InitBestEffort(logFlags) prof, err := profile.StartProfiling(profFlags) if err != nil { diff --git a/toolkit/tools/imagegen/installutils/installutils.go b/toolkit/tools/imagegen/installutils/installutils.go index 02217f2cbab..ac5f8cc329d 100644 --- a/toolkit/tools/imagegen/installutils/installutils.go +++ b/toolkit/tools/imagegen/installutils/installutils.go @@ -387,8 +387,7 @@ func PopulateInstallRoot(installChroot *safechroot.Chroot, packagesToInstall []s defer timestamp.StopEvent(nil) const ( - filesystemPkg = "filesystem" - shadowUtilsPkg = "shadow-utils" + filesystemPkg = "filesystem" ) defer stopGPGAgent(installChroot) @@ -440,14 +439,6 @@ func PopulateInstallRoot(installChroot *safechroot.Chroot, packagesToInstall []s if err != nil { return } - if len(config.Users) > 0 || len(config.Groups) > 0 { - shadowUtilsInstalled := 0 - shadowUtilsInstalled, err = TdnfInstallWithProgress(shadowUtilsPkg, installRoot, packagesInstalled, totalPackages, true) - if err != nil { - return - } - packagesInstalled += shadowUtilsInstalled - } hostname := config.Hostname if !isRootFS && mountPointToFsTypeMap[rootMountPoint] != overlay { @@ -458,18 +449,6 @@ func PopulateInstallRoot(installChroot *safechroot.Chroot, packagesToInstall []s } } - // Add groups - err = addGroups(installChroot, config.Groups) - if err != nil { - return - } - - // Add users - err = addUsers(installChroot, config.Users) - if err != nil { - return - } - // Install packages one-by-one to avoid exhausting memory // on low resource systems for _, pkg := range packagesToInstall { @@ -494,6 +473,18 @@ func PopulateInstallRoot(installChroot *safechroot.Chroot, packagesToInstall []s if err != nil { return } + + // Add groups + err = addGroups(installChroot, config.Groups) + if err != nil { + return + } + } + + // Add users + err = addUsers(installChroot, config.Users) + if err != nil { + return } // Add machine-id diff --git a/toolkit/tools/imagepkgfetcher/imagepkgfetcher.go b/toolkit/tools/imagepkgfetcher/imagepkgfetcher.go index 1ccec3c626e..b743acd3c86 100644 --- a/toolkit/tools/imagepkgfetcher/imagepkgfetcher.go +++ b/toolkit/tools/imagepkgfetcher/imagepkgfetcher.go @@ -48,8 +48,7 @@ var ( inputSummaryFile = app.Flag("input-summary-file", "Path to a file with the summary of packages cloned to be restored").String() outputSummaryFile = app.Flag("output-summary-file", "Path to save the summary of packages cloned").String() - logFile = exe.LogFileFlag(app) - logLevel = exe.LogLevelFlag(app) + logFlags = exe.SetupLogFlags(app) profFlags = exe.SetupProfileFlags(app) timestampFile = app.Flag("timestamp-file", "File that stores timestamps for this program.").String() ) @@ -57,7 +56,7 @@ var ( func main() { app.Version(exe.ToolkitVersion) kingpin.MustParse(app.Parse(os.Args[1:])) - logger.InitBestEffort(*logFile, *logLevel) + logger.InitBestEffort(logFlags) prof, profErr := profile.StartProfiling(profFlags) if profErr != nil { @@ -160,11 +159,11 @@ func cloneSystemConfigs(cloner repocloner.RepoCloner, configFile, baseDirPath st if err != nil { // Fallback to legacy flow with multiple transactions in case we get a OOM error from a large transaction. logger.Log.Warnf("Failed to clone packages in a single transaction, will retry with individual transactions... (%s)", err) - logger.Log.Warnf("\tCheck log file '%s' for more details from package manager.", *logFile) + logger.Log.Warnf("\tCheck log file '%s' for more details from package manager.", *logFlags.LogFile) _, err = cloner.CloneByPackageVer(cloneDeps, packageVersionsInConfig...) if err != nil { logger.Log.Errorf("Also failed to clone packages with individual transactions. Error: %s", err) - logger.Log.Errorf("\tCheck log file '%s' for more details from package manager.", *logFile) + logger.Log.Errorf("\tCheck log file '%s' for more details from package manager.", *logFlags.LogFile) } } return diff --git a/toolkit/tools/imager/imager.go b/toolkit/tools/imager/imager.go index 06d2ea5fc71..a042eac6d88 100644 --- a/toolkit/tools/imager/imager.go +++ b/toolkit/tools/imager/imager.go @@ -37,8 +37,7 @@ var ( liveInstallFlag = app.Flag("live-install", "Enable to perform a live install to the disk specified in config file.").Bool() emitProgress = app.Flag("emit-progress", "Write progress updates to stdout, such as percent complete and current action.").Bool() timestampFile = app.Flag("timestamp-file", "File that stores timestamps for this program.").String() - logFile = exe.LogFileFlag(app) - logLevel = exe.LogLevelFlag(app) + logFlags = exe.SetupLogFlags(app) profFlags = exe.SetupProfileFlags(app) ) @@ -69,7 +68,7 @@ func main() { app.Version(exe.ToolkitVersion) kingpin.MustParse(app.Parse(os.Args[1:])) - logger.InitBestEffort(*logFile, *logLevel) + logger.InitBestEffort(logFlags) prof, err := profile.StartProfiling(profFlags) if err != nil { diff --git a/toolkit/tools/internal/exe/exe.go b/toolkit/tools/internal/exe/exe.go index 180509cb82e..05604cbb758 100644 --- a/toolkit/tools/internal/exe/exe.go +++ b/toolkit/tools/internal/exe/exe.go @@ -40,14 +40,12 @@ func OutputDirFlag(k *kingpin.Application, doc string) *string { return k.Flag("output-dir", doc).Required().String() } -// LogFileFlag registers a log file flag for k and returns the passed value -func LogFileFlag(k *kingpin.Application) *string { - return k.Flag(logger.FileFlag, logger.FileFlagHelp).String() -} - -// LogLevelFlag registers a log level flag for k and returns the passed value -func LogLevelFlag(k *kingpin.Application) *string { - return k.Flag(logger.LevelsFlag, logger.LevelsHelp).PlaceHolder(logger.LevelsPlaceholder).Enum(logger.Levels()...) +func SetupLogFlags(k *kingpin.Application) *logger.LogFlags { + lf := &logger.LogFlags{} + lf.LogColor = k.Flag(logger.ColorFlag, logger.ColorFlagHelp).PlaceHolder(logger.ColorsPlaceholder).Enum(logger.Colors()...) + lf.LogFile = k.Flag(logger.FileFlag, logger.FileFlagHelp).String() + lf.LogLevel = k.Flag(logger.LevelsFlag, logger.LevelsHelp).PlaceHolder(logger.LevelsPlaceholder).Enum(logger.Levels()...) + return lf } // PlaceHolderize takes a list of available inputs and returns a corresponding placeholder diff --git a/toolkit/tools/internal/logger/log.go b/toolkit/tools/internal/logger/log.go index 59ebcd88f82..b79b7ccebeb 100644 --- a/toolkit/tools/internal/logger/log.go +++ b/toolkit/tools/internal/logger/log.go @@ -27,6 +27,9 @@ var ( // Valid log levels levelsArray = []string{"panic", "fatal", "error", "warn", "info", "debug", "trace"} + + // Valid log colors + colorsArray = []string{"always", "auto", "never"} ) const ( @@ -45,16 +48,37 @@ const ( // FileFlagHelp is the suggested help message for the logfile flag FileFlagHelp = "Path to the image's log file." + // ColorsPlaceholder are all valid log colors separated by '|' character. + ColorsPlaceholder = "(always|auto|never)" + + // ColorFlag is the suggested name for logcolor flag + ColorFlag = "log-color" + + // ColorFlagHelp is the suggested help message for the logcolor flag + ColorFlagHelp = "Color setting for log terminal output." + defaultLogFileLevel = logrus.DebugLevel defaultStderrLogLevel = logrus.InfoLevel parentCallerLevel = 1 + colorModeAuto = "auto" + colorModeAlways = "always" + colorModeNever = "never" ) +type LogFlags struct { + LogColor *string + LogFile *string + LogLevel *string +} + // initLogFile initializes the common logger with a file -func initLogFile(filePath string) (err error) { +func initLogFile(filePath string, color string) (err error) { + useColors := false + if color == colorModeAlways { + useColors = true + } const ( noToolName = "" - useColors = false ) err = os.MkdirAll(filepath.Dir(filePath), os.ModePerm) @@ -81,7 +105,7 @@ func InitStderrLog() { log.Panic("Failed to get caller info.") } - initStderrLogInternal(callerFilePath) + initStderrLogInternal(callerFilePath, colorModeAuto) } // SetFileLogLevel sets the lowest log level for file output @@ -95,7 +119,11 @@ func SetStderrLogLevel(level string) (err error) { } // InitBestEffort runs InitStderrLog always, and InitLogFile if path is not empty -func InitBestEffort(path string, level string) { +func InitBestEffort(lf *LogFlags) { + level := *lf.LogLevel + color := *lf.LogColor + path := *lf.LogFile + if level == "" { level = defaultStderrLogLevel.String() } @@ -105,10 +133,10 @@ func InitBestEffort(path string, level string) { log.Panic("Failed to get caller info.") } - initStderrLogInternal(callerFilePath) + initStderrLogInternal(callerFilePath, color) if path != "" { - PanicOnError(initLogFile(path), "Failed while setting log file (%s).", path) + PanicOnError(initLogFile(path, color), "Failed while setting log file (%s).", path) } PanicOnError(SetStderrLogLevel(level), "Failed while setting log level.") @@ -119,6 +147,11 @@ func Levels() []string { return levelsArray } +// Colors returns list of strings representing valid log colors. +func Colors() []string { + return colorsArray +} + // PanicOnError logs the error and any message strings and then panics func PanicOnError(err interface{}, args ...interface{}) { if err != nil { @@ -179,8 +212,11 @@ func ReplaceStderrFormatter(newFormatter logrus.Formatter) (oldFormatter logrus. return stderrHook.ReplaceFormatter(newFormatter) } -func initStderrLogInternal(callerFilePath string) { - const useColors = true +func initStderrLogInternal(callerFilePath string, color string) { + useColors := true + if color == colorModeNever { + useColors = false + } Log = logrus.New() Log.ReportCaller = true diff --git a/toolkit/tools/internal/logger/writerhook.go b/toolkit/tools/internal/logger/writerhook.go index ad2fe0cca87..32b9fb0d9c2 100644 --- a/toolkit/tools/internal/logger/writerhook.go +++ b/toolkit/tools/internal/logger/writerhook.go @@ -6,9 +6,11 @@ package logger import ( "fmt" "io" + "regexp" "runtime" "sync" + "github.com/fatih/color" "github.com/sirupsen/logrus" ) @@ -18,8 +20,15 @@ type writerHook struct { level logrus.Level writer io.Writer formatter logrus.Formatter + useColors bool } +var ( + + // colorCodeRegex is of type '\x1b[0m' or '\x1b[31m', etc. + colorCodeRegex = regexp.MustCompile(`\x1b\[[0-9]+m`) +) + // newWriterHook returns new writerHook func newWriterHook(writer io.Writer, level logrus.Level, useColors bool, toolName string) *writerHook { formatter := &logrus.TextFormatter{ @@ -31,11 +40,9 @@ func newWriterHook(writer io.Writer, level logrus.Level, useColors bool, toolNam if toolName != "" { formatter.CallerPrettyfier = func(frame *runtime.Frame) (function string, file string) { - const gray = 90 - toolNameField := fmt.Sprintf("[%s]", toolName) if useColors { - toolNameField = fmt.Sprintf("[\x1b[%dm%s\x1b[0m]", gray, toolName) + toolNameField = fmt.Sprintf(color.HiYellowString("[%s]"), toolName) } return "", toolNameField @@ -46,6 +53,7 @@ func newWriterHook(writer io.Writer, level logrus.Level, useColors bool, toolNam level: level, writer: writer, formatter: formatter, + useColors: useColors, } } @@ -56,6 +64,10 @@ func (h *writerHook) Fire(entry *logrus.Entry) (err error) { return } + if !h.useColors { + entry.Message = colorCodeRegex.ReplaceAllString(entry.Message, "") + } + h.lock.Lock() defer h.lock.Unlock() diff --git a/toolkit/tools/internal/sliceutils/sliceutils.go b/toolkit/tools/internal/sliceutils/sliceutils.go index c9612153adb..91f142074a9 100644 --- a/toolkit/tools/internal/sliceutils/sliceutils.go +++ b/toolkit/tools/internal/sliceutils/sliceutils.go @@ -59,11 +59,12 @@ func PackageVerMatch(expected, given interface{}) bool { return reflect.DeepEqual(expected.(*pkgjson.PackageVer), given.(*pkgjson.PackageVer)) } -// SetToSlice converts a map[T]bool to a slice containing the map's keys. -func SetToSlice[T comparable](inputSet map[T]bool) []T { +// SetToSlice converts a map[K]bool to a slice containing the map's keys, iff the key's value is true. +func SetToSlice[K comparable](inputSet map[K]bool) []K { index := 0 - outputSlice := make([]T, len(inputSet)) + outputSlice := make([]K, len(inputSet)) for element, elementInSet := range inputSet { + // Add key to slice if value is true if elementInSet { outputSlice[index] = element index++ @@ -72,7 +73,16 @@ func SetToSlice[T comparable](inputSet map[T]bool) []T { return outputSlice[:index] } -// SliceToSet converts a slice of K to a map[K]bool. +// MapToSlice converts a map[K]V to a slice containing the map's keys. +func MapToSlice[K comparable, V any](inputMap map[K]V) []K { + outputSlice := make([]K, 0, len(inputMap)) + for element := range inputMap { + outputSlice = append(outputSlice, element) + } + return outputSlice +} + +// SliceToSet converts a slice of K to a map[K]bool, with each value set to true. func SliceToSet[K comparable](inputSlice []K) (outputSet map[K]bool) { outputSet = make(map[K]bool, len(inputSlice)) for _, element := range inputSlice { diff --git a/toolkit/tools/internal/sliceutils/sliceutils_test.go b/toolkit/tools/internal/sliceutils/sliceutils_test.go index ca33c631cfa..046c1c8e387 100644 --- a/toolkit/tools/internal/sliceutils/sliceutils_test.go +++ b/toolkit/tools/internal/sliceutils/sliceutils_test.go @@ -154,3 +154,33 @@ func TestShouldRemoveDuplicates(t *testing.T) { assert.Contains(t, outputSlice, "C") assert.NotContains(t, outputSlice, "X") } + +// MapToSlice() should return empty slice for nil map +func TestMapToSliceShouldCreateEmptySliceFromNil(t *testing.T) { + outputSlice := MapToSlice[string, any](nil) + + assert.NotNil(t, outputSlice) + assert.Empty(t, outputSlice) +} + +// MapToSlice() should return empty slice for empty map +func TestMapToSliceShouldCreateEmptySliceFromEmptyMap(t *testing.T) { + outputSlice := MapToSlice(make(map[string]string)) + + assert.NotNil(t, outputSlice) + assert.Empty(t, outputSlice) +} + +// MapToSlice() should return slice with all the keys in the map +func TestMapToSliceReturnKeysInMap(t *testing.T) { + inputMap := map[string]bool{ + "A": true, + "B": true, + "X": false, + "Y": false, + } + expectedOutput := []string{"A", "B", "X", "Y"} + outputSlice := MapToSlice(inputMap) + + assert.ElementsMatch(t, expectedOutput, outputSlice) +} diff --git a/toolkit/tools/isomaker/isomaker.go b/toolkit/tools/isomaker/isomaker.go index 56d420adee7..5c3ecfcf1ca 100644 --- a/toolkit/tools/isomaker/isomaker.go +++ b/toolkit/tools/isomaker/isomaker.go @@ -26,15 +26,14 @@ var ( imageTag = app.Flag("image-tag", "Tag (text) appended to the image name. Empty by default.").String() - logFilePath = exe.LogFileFlag(app) - logLevel = exe.LogLevelFlag(app) + logFlags = exe.SetupLogFlags(app) ) func main() { app.Version(exe.ToolkitVersion) kingpin.MustParse(app.Parse(os.Args[1:])) - logger.InitBestEffort(*logFilePath, *logLevel) + logger.InitBestEffort(logFlags) isoMaker := NewIsoMaker( *unattendedInstall, diff --git a/toolkit/tools/liveinstaller/liveinstaller.go b/toolkit/tools/liveinstaller/liveinstaller.go index a158f7fd07e..edee36b2923 100644 --- a/toolkit/tools/liveinstaller/liveinstaller.go +++ b/toolkit/tools/liveinstaller/liveinstaller.go @@ -36,8 +36,7 @@ var ( buildDir = app.Flag("build-dir", "Directory to store temporary files while building.").Required().ExistingDir() baseDirPath = app.Flag("base-dir", "Base directory for relative file paths from the config. Defaults to config's directory.").ExistingDir() - logFile = exe.LogFileFlag(app) - logLevel = exe.LogLevelFlag(app) + logFlags = exe.SetupLogFlags(app) ) // Every valid mouse event handler will follow the format: @@ -69,7 +68,7 @@ func main() { app.Version(exe.ToolkitVersion) kingpin.MustParse(app.Parse(os.Args[1:])) - logger.InitBestEffort(*logFile, *logLevel) + logger.InitBestEffort(logFlags) // Prevent a SIGINT (Ctr-C) from stopping liveinstaller while an installation is in progress. // It is the responsibility of the installer's user interface (terminal installer or Calamares) to handle quit requests from the user. diff --git a/toolkit/tools/osmodifier/main.go b/toolkit/tools/osmodifier/main.go index 2a8706adc5f..8c262153886 100644 --- a/toolkit/tools/osmodifier/main.go +++ b/toolkit/tools/osmodifier/main.go @@ -19,8 +19,7 @@ var ( app = kingpin.New("osmodifier", "Used to modify os") configFile = app.Flag("config-file", "Path of the os modification config file.").Required().String() - logFile = exe.LogFileFlag(app) - logLevel = exe.LogLevelFlag(app) + logFlags = exe.SetupLogFlags(app) profFlags = exe.SetupProfileFlags(app) timestampFile = app.Flag("timestamp-file", "File that stores timestamps for this program.").String() ) @@ -30,7 +29,7 @@ func main() { kingpin.MustParse(app.Parse(os.Args[1:])) - logger.InitBestEffort(*logFile, *logLevel) + logger.InitBestEffort(logFlags) prof, err := profile.StartProfiling(profFlags) if err != nil { diff --git a/toolkit/tools/pkgworker/pkgworker.go b/toolkit/tools/pkgworker/pkgworker.go index afa039175ec..a008d4fe99c 100644 --- a/toolkit/tools/pkgworker/pkgworker.go +++ b/toolkit/tools/pkgworker/pkgworker.go @@ -61,8 +61,7 @@ var ( maxCPU = app.Flag("max-cpu", "Max number of CPUs used for package building").Default("").String() timeout = app.Flag("timeout", "Timeout for package building").Required().Duration() - logFile = exe.LogFileFlag(app) - logLevel = exe.LogLevelFlag(app) + logFlags = exe.SetupLogFlags(app) ) var ( @@ -72,7 +71,7 @@ var ( func main() { app.Version(exe.ToolkitVersion) kingpin.MustParse(app.Parse(os.Args[1:])) - logger.InitBestEffort(*logFile, *logLevel) + logger.InitBestEffort(logFlags) rpmsDirAbsPath, err := filepath.Abs(*rpmsDirPath) logger.PanicOnError(err, "Unable to find absolute path for RPMs directory '%s'", *rpmsDirPath) @@ -119,7 +118,7 @@ func main() { } builtRPMs, err := buildSRPMInChroot(chrootDir, rpmsDirAbsPath, toolchainDirAbsPath, *workerTar, *srpmFile, *repoFile, *rpmmacrosFile, *outArch, defines, *noCleanup, *runCheck, *packagesToInstall, ccacheManager, *timeout) - logger.PanicOnError(err, "Failed to build SRPM '%s'. For details see log file: %s .", *srpmFile, *logFile) + logger.PanicOnError(err, "Failed to build SRPM '%s'. For details see log file: %s .", *srpmFile, *logFlags.LogFile) // For regular (non-test) package builds: // - Copy the SRPM which produced the package to the output directory. diff --git a/toolkit/tools/precacher/precacher.go b/toolkit/tools/precacher/precacher.go index 42eb19e1099..b467a4250cb 100644 --- a/toolkit/tools/precacher/precacher.go +++ b/toolkit/tools/precacher/precacher.go @@ -48,8 +48,7 @@ type downloadResult struct { var ( app = kingpin.New("precacher", "Pre-hydrate RPM cache for a given set of repo URLs and a RPM snapshot file.") - logFile = exe.LogFileFlag(app) - logLevel = exe.LogLevelFlag(app) + logFlags = exe.SetupLogFlags(app) profFlags = exe.SetupProfileFlags(app) timestampFile = app.Flag("timestamp-file", "File that stores timestamps for this program.").String() @@ -68,7 +67,7 @@ var ( func main() { app.Version(exe.ToolkitVersion) kingpin.MustParse(app.Parse(os.Args[1:])) - logger.InitBestEffort(*logFile, *logLevel) + logger.InitBestEffort(logFlags) prof, err := profile.StartProfiling(profFlags) if err != nil { diff --git a/toolkit/tools/repoquerywrapper/repoquerywrapper.go b/toolkit/tools/repoquerywrapper/repoquerywrapper.go index f3ba6a985e1..9a33e7a3621 100644 --- a/toolkit/tools/repoquerywrapper/repoquerywrapper.go +++ b/toolkit/tools/repoquerywrapper/repoquerywrapper.go @@ -25,8 +25,7 @@ const ( var ( app = kingpin.New("repoquerywrapper", "Runs queries against RPMs repo in bulk.") - logFile = exe.LogFileFlag(app) - logLevel = exe.LogLevelFlag(app) + logFlags = exe.SetupLogFlags(app) profFlags = exe.SetupProfileFlags(app) timestampFile = app.Flag("timestamp-file", "File that stores timestamps for this program.").String() @@ -43,7 +42,7 @@ var ( func main() { app.Version(exe.ToolkitVersion) kingpin.MustParse(app.Parse(os.Args[1:])) - logger.InitBestEffort(*logFile, *logLevel) + logger.InitBestEffort(logFlags) prof, err := profile.StartProfiling(profFlags) if err != nil { diff --git a/toolkit/tools/roast/roast.go b/toolkit/tools/roast/roast.go index 84a1a8b000f..79beb72ab17 100644 --- a/toolkit/tools/roast/roast.go +++ b/toolkit/tools/roast/roast.go @@ -40,8 +40,7 @@ type convertResult struct { var ( app = kingpin.New("roast", "A tool to convert raw disk file into another image type") - logFile = exe.LogFileFlag(app) - logLevel = exe.LogLevelFlag(app) + logFlags = exe.SetupLogFlags(app) profFlags = exe.SetupProfileFlags(app) inputDir = exe.InputDirFlag(app, "A directory containing a .RAW image or a rootfs directory") @@ -62,7 +61,7 @@ var ( func main() { app.Version(exe.ToolkitVersion) kingpin.MustParse(app.Parse(os.Args[1:])) - logger.InitBestEffort(*logFile, *logLevel) + logger.InitBestEffort(logFlags) prof, err := profile.StartProfiling(profFlags) if err != nil { diff --git a/toolkit/tools/rpmssnapshot/rpmssnapshot.go b/toolkit/tools/rpmssnapshot/rpmssnapshot.go index e7b9d2a41cc..cf73ecadf90 100644 --- a/toolkit/tools/rpmssnapshot/rpmssnapshot.go +++ b/toolkit/tools/rpmssnapshot/rpmssnapshot.go @@ -25,14 +25,13 @@ var ( distTag = app.Flag("dist-tag", "The distribution tag.").Required().String() workerTar = app.Flag("worker-tar", "Full path to worker_chroot.tar.gz.").Required().ExistingFile() - logFile = exe.LogFileFlag(app) - logLevel = exe.LogLevelFlag(app) + logFlags = exe.SetupLogFlags(app) ) func main() { app.Version(exe.ToolkitVersion) kingpin.MustParse(app.Parse(os.Args[1:])) - logger.InitBestEffort(*logFile, *logLevel) + logger.InitBestEffort(logFlags) snapshotGenerator, err := rpmssnapshot.New(*buildDirPath, *workerTar, *specsDirPath) if err != nil { diff --git a/toolkit/tools/scheduler/scheduler.go b/toolkit/tools/scheduler/scheduler.go index 2b88f6be722..0bc7db90375 100644 --- a/toolkit/tools/scheduler/scheduler.go +++ b/toolkit/tools/scheduler/scheduler.go @@ -103,8 +103,7 @@ var ( testsToRun = app.Flag("tests", "Space separated list of tests that should be ran. Omit this argument to run package tests.").String() testsToRerun = app.Flag("rerun-tests", "Space separated list of package tests that should be re-ran.").String() - logFile = exe.LogFileFlag(app) - logLevel = exe.LogLevelFlag(app) + logFlags = exe.SetupLogFlags(app) profFlags = exe.SetupProfileFlags(app) timestampFile = app.Flag("timestamp-file", "File that stores timestamps for this program.").String() ) @@ -112,7 +111,7 @@ var ( func main() { app.Version(exe.ToolkitVersion) kingpin.MustParse(app.Parse(os.Args[1:])) - logger.InitBestEffort(*logFile, *logLevel) + logger.InitBestEffort(logFlags) prof, err := profile.StartProfiling(profFlags) if err != nil { @@ -173,7 +172,7 @@ func main() { Timeout: *timeout, LogDir: *buildLogsDir, - LogLevel: *logLevel, + LogLevel: *logFlags.LogLevel, } agent, err := buildagents.BuildAgentFactory(*buildAgent) diff --git a/toolkit/tools/scheduler/schedulerutils/buildworker.go b/toolkit/tools/scheduler/schedulerutils/buildworker.go index 48c0676d59c..936693e4f18 100644 --- a/toolkit/tools/scheduler/schedulerutils/buildworker.go +++ b/toolkit/tools/scheduler/schedulerutils/buildworker.go @@ -299,7 +299,7 @@ func testSRPMFile(agent buildagents.BuildAgent, checkAttempts int, basePackageNa _, logFile, buildErr = agent.BuildPackage(basePackageName, srpmFile, logBaseName, outArch, runCheck, dependencies) if buildErr != nil { - logger.Log.Warnf("Test build for '%s' failed on a non-test build issue. Error: %s, for details see: %s", srpmFile, buildErr, logFile) + logger.Log.Warnf("Test build for '%s' failed on a non-test build issue. Error: %s", srpmFile, buildErr) return } @@ -309,7 +309,7 @@ func testSRPMFile(agent buildagents.BuildAgent, checkAttempts int, basePackageNa }, checkAttempts, retryDuration) if err != nil && checkFailed { - logger.Log.Warnf("Tests failed for '%s'. Error: %s, for details see: %s", srpmFile, err, logFile) + logger.Log.Warnf("Tests failed for '%s'. Error: %s", srpmFile, err) err = nil } return diff --git a/toolkit/tools/scheduler/schedulerutils/printresults.go b/toolkit/tools/scheduler/schedulerutils/printresults.go index b8031bd1f63..1fe6af328a8 100644 --- a/toolkit/tools/scheduler/schedulerutils/printresults.go +++ b/toolkit/tools/scheduler/schedulerutils/printresults.go @@ -5,12 +5,17 @@ package schedulerutils import ( "encoding/csv" + "fmt" "os" "path/filepath" + "sort" "sync" "github.com/microsoft/CBL-Mariner/toolkit/tools/internal/logger" "github.com/microsoft/CBL-Mariner/toolkit/tools/internal/pkggraph" + "github.com/microsoft/CBL-Mariner/toolkit/tools/internal/sliceutils" + + "github.com/fatih/color" ) // PrintBuildResult prints a build result to the logger. @@ -105,113 +110,107 @@ func PrintBuildSummary(pkgGraph *pkggraph.PkgGraph, graphMutex *sync.RWMutex, bu } } - logger.Log.Info("---------------------------") - logger.Log.Info("--------- Summary ---------") - logger.Log.Info("---------------------------") - - logger.Log.Infof("Number of built SRPMs: %d", len(builtSRPMs)) - logger.Log.Infof("Number of tested SRPMs: %d", len(testedSRPMs)) - logger.Log.Infof("Number of prebuilt SRPMs: %d", len(prebuiltSRPMs)) - logger.Log.Infof("Number of prebuilt delta SRPMs: %d", len(prebuiltDeltaSRPMs)) - logger.Log.Infof("Number of skipped SRPMs tests: %d", len(skippedSRPMsTests)) - logger.Log.Infof("Number of failed SRPMs: %d", len(failedSRPMs)) - logger.Log.Infof("Number of failed SRPMs tests: %d", len(failedSRPMsTests)) - logger.Log.Infof("Number of blocked SRPMs: %d", len(blockedSRPMs)) - logger.Log.Infof("Number of blocked SRPMs tests: %d", len(blockedSRPMsTests)) - logger.Log.Infof("Number of unresolved dependencies: %d", len(unresolvedDependencies)) - - if allowToolchainRebuilds && (len(rpmConflicts) > 0 || len(srpmConflicts) > 0) { - logger.Log.Infof("Toolchain RPMs conflicts are ignored since ALLOW_TOOLCHAIN_REBUILDS=y") - } - - if len(rpmConflicts) > 0 || len(srpmConflicts) > 0 { - conflictsLogger("Number of toolchain RPM conflicts: %d", len(rpmConflicts)) - conflictsLogger("Number of toolchain SRPM conflicts: %d", len(srpmConflicts)) - } - - if len(builtSRPMs) != 0 { - logger.Log.Info("Built SRPMs:") - for srpm := range builtSRPMs { - logger.Log.Infof("--> %s", filepath.Base(srpm)) - } - } - - if len(testedSRPMs) != 0 { - logger.Log.Info("Tested SRPMs:") - for srpm := range testedSRPMs { - logger.Log.Infof("--> %s", filepath.Base(srpm)) - } - } + printSummary(failedSRPMs, failedSRPMsTests, prebuiltSRPMs, prebuiltDeltaSRPMs, builtSRPMs, testedSRPMs, skippedSRPMsTests, unresolvedDependencies, blockedSRPMs, blockedSRPMsTests, rpmConflicts, srpmConflicts, allowToolchainRebuilds, conflictsLogger) if len(prebuiltSRPMs) != 0 { - logger.Log.Info("Prebuilt SRPMs:") - for srpm := range prebuiltSRPMs { - logger.Log.Infof("--> %s", filepath.Base(srpm)) + logger.Log.Info(color.GreenString("Prebuilt SRPMs:")) + keys := mapToSortedSlice(prebuiltSRPMs) + for _, prebuiltSRPM := range keys { + logger.Log.Infof("--> %s", filepath.Base(prebuiltSRPM)) } } if len(prebuiltDeltaSRPMs) != 0 { - logger.Log.Info("Skipped SRPMs (i.e., delta mode is on, packages are already available in a repo):") - for srpm := range prebuiltDeltaSRPMs { - logger.Log.Infof("--> %s", filepath.Base(srpm)) + logger.Log.Info(color.GreenString("Skipped SRPMs (i.e., delta mode is on, packages are already available in a repo):")) + keys := mapToSortedSlice(prebuiltDeltaSRPMs) + for _, prebuiltDeltaSRPM := range keys { + logger.Log.Infof("--> %s", filepath.Base(prebuiltDeltaSRPM)) } } if len(skippedSRPMsTests) != 0 { - logger.Log.Info("Skipped SRPMs tests:") - for srpm := range skippedSRPMsTests { - logger.Log.Infof("--> %s", filepath.Base(srpm)) + logger.Log.Info(color.GreenString("Skipped SRPMs tests:")) + keys := mapToSortedSlice(skippedSRPMsTests) + for _, skippedSRPMsTest := range keys { + logger.Log.Infof("--> %s", filepath.Base(skippedSRPMsTest)) } } - if len(failedSRPMs) != 0 { - logger.Log.Info("Failed SRPMs:") - for _, failure := range failedSRPMs { - logger.Log.Infof("--> %s , error: %s, for details see: %s", failure.Node.SRPMFileName(), failure.Err, failure.LogFile) + if len(builtSRPMs) != 0 { + logger.Log.Info(color.GreenString("Built SRPMs:")) + keys := mapToSortedSlice(builtSRPMs) + for _, builtSRPM := range keys { + logger.Log.Infof("--> %s ", filepath.Base(builtSRPM)) } } - if len(failedSRPMsTests) != 0 { - logger.Log.Info("Failed SRPMs tests:") - for _, failure := range failedSRPMsTests { - logger.Log.Infof("--> %s , error: %s, for details see: %s", failure.Node.SRPMFileName(), failure.Err, failure.LogFile) + if len(testedSRPMs) != 0 { + logger.Log.Info(color.GreenString("Tested SRPMs:")) + keys := mapToSortedSlice(testedSRPMs) + for _, testedSRPM := range keys { + logger.Log.Infof("--> %s", filepath.Base(testedSRPM)) } } - if len(blockedSRPMs) != 0 { - logger.Log.Info("Blocked SRPMs:") - for srpm := range blockedSRPMs { - logger.Log.Infof("--> %s", filepath.Base(srpm)) + if len(unresolvedDependencies) != 0 { + logger.Log.Info(color.RedString("Unresolved dependencies:")) + keys := mapToSortedSlice(unresolvedDependencies) + for _, unresolvedDependency := range keys { + logger.Log.Infof("--> %s", filepath.Base(unresolvedDependency)) } } - if len(blockedSRPMsTests) != 0 { - logger.Log.Info("Blocked SRPMs tests:") - for srpm := range blockedSRPMsTests { - logger.Log.Infof("--> %s", filepath.Base(srpm)) + if len(blockedSRPMs) != 0 { + logger.Log.Info(color.RedString("Blocked SRPMs:")) + keys := mapToSortedSlice(blockedSRPMs) + for _, blockedSRPM := range keys { + logger.Log.Infof("--> %s", filepath.Base(blockedSRPM)) } } - if len(unresolvedDependencies) != 0 { - logger.Log.Info("Unresolved dependencies:") - for dependency := range unresolvedDependencies { - logger.Log.Infof("--> %s", dependency) + if len(blockedSRPMsTests) != 0 { + logger.Log.Info(color.RedString("Blocked SRPMs tests:")) + keys := mapToSortedSlice(blockedSRPMsTests) + for _, blockedSRPMsTest := range keys { + logger.Log.Infof("--> %s", filepath.Base(blockedSRPMsTest)) } } if len(rpmConflicts) != 0 { - conflictsLogger("RPM conflicts with toolchain: ") + conflictsLogger(color.RedString("RPM conflicts with toolchain:")) + sort.Strings(rpmConflicts) for _, conflict := range rpmConflicts { conflictsLogger("--> %s", conflict) } } if len(srpmConflicts) != 0 { - conflictsLogger("SRPM conflicts with toolchain: ") + conflictsLogger(color.RedString("SRPM conflicts with toolchain:")) + sort.Strings(srpmConflicts) for _, conflict := range srpmConflicts { conflictsLogger("--> %s", conflict) } } + + if len(failedSRPMs) != 0 { + logger.Log.Info(color.RedString("Failed SRPMs:")) + keys := mapToSortedSlice(failedSRPMs) + for _, key := range keys { + failure := failedSRPMs[key] + logger.Log.Infof("--> %s , error: %s, for details see: %s", failure.Node.SRPMFileName(), failure.Err, failure.LogFile) + } + } + + if len(failedSRPMsTests) != 0 { + logger.Log.Info(color.RedString("Failed SRPMs tests:")) + keys := mapToSortedSlice(failedSRPMsTests) + for _, key := range keys { + failure := failedSRPMsTests[key] + logger.Log.Infof("--> %s , error: %s, for details see: %s", failure.Node.SRPMFileName(), failure.Err, failure.LogFile) + } + } + + printSummary(failedSRPMs, failedSRPMsTests, prebuiltSRPMs, prebuiltDeltaSRPMs, builtSRPMs, testedSRPMs, skippedSRPMsTests, unresolvedDependencies, blockedSRPMs, blockedSRPMsTests, rpmConflicts, srpmConflicts, allowToolchainRebuilds, conflictsLogger) } func buildResultsSetToNodesSet(statesSet map[string]*BuildResult) (result map[string]*pkggraph.PkgNode) { @@ -334,3 +333,49 @@ func unbuiltPackagesCSVRows(pkgGraph *pkggraph.PkgGraph, unbuiltPackages, failed return } + +// printSummary prints summarized numbers of the build to the logger. +func printSummary(failedSRPMs, failedSRPMsTests map[string]*BuildResult, prebuiltSRPMs, prebuiltDeltaSRPMs, builtSRPMs, testedSRPMs, skippedSRPMsTests, unresolvedDependencies map[string]bool, blockedSRPMs, blockedSRPMsTests map[string]*pkggraph.PkgNode, rpmConflicts, srpmConflicts []string, allowToolchainRebuilds bool, conflictsLogger func(format string, args ...interface{})) { + logger.Log.Info("---------------------------") + logger.Log.Info("--------- Summary ---------") + logger.Log.Info("---------------------------") + + logger.Log.Infof(color.GreenString(summaryLine("Number of prebuilt SRPMs:", len(prebuiltSRPMs)))) + logger.Log.Infof(color.GreenString(summaryLine("Number of prebuilt delta SRPMs:", len(prebuiltDeltaSRPMs)))) + logger.Log.Infof(color.GreenString(summaryLine("Number of skipped SRPMs tests:", len(skippedSRPMsTests)))) + logger.Log.Infof(color.GreenString(summaryLine("Number of built SRPMs:", len(builtSRPMs)))) + logger.Log.Infof(color.GreenString(summaryLine("Number of tested SRPMs:", len(testedSRPMs)))) + printErrorInfoByCondition(len(unresolvedDependencies) > 0, summaryLine("Number of unresolved dependencies:", len(unresolvedDependencies))) + printErrorInfoByCondition(len(blockedSRPMs) > 0, summaryLine("Number of blocked SRPMs:", len(blockedSRPMs))) + printErrorInfoByCondition(len(blockedSRPMsTests) > 0, summaryLine("Number of blocked SRPMs tests:", len(blockedSRPMsTests))) + printErrorInfoByCondition(len(failedSRPMs) > 0, summaryLine("Number of failed SRPMs:", len(failedSRPMs))) + printErrorInfoByCondition(len(failedSRPMsTests) > 0, summaryLine("Number of failed SRPMs tests:", len(failedSRPMsTests))) + if allowToolchainRebuilds && (len(rpmConflicts) > 0 || len(srpmConflicts) > 0) { + logger.Log.Infof("Toolchain RPMs conflicts are ignored since ALLOW_TOOLCHAIN_REBUILDS=y") + } + + printErrorInfoByCondition(!allowToolchainRebuilds && len(rpmConflicts) > 0, summaryLine("Number of toolchain RPM conflicts:", len(rpmConflicts))) + printErrorInfoByCondition(!allowToolchainRebuilds && len(srpmConflicts) > 0, summaryLine("Number of toolchain SRPM conflicts:", len(srpmConflicts))) +} + +// printErrorInfoByCondition prints error or info level logs depending on the input condition. +// If the condition is true, it prints an error level log and an info level one otherwise. +func printErrorInfoByCondition(condition bool, format string, arg ...any) { + if condition { + logger.Log.Errorf(color.RedString(format, arg...)) + } else { + logger.Log.Infof(color.GreenString(format, arg...)) + } +} + +// summaryLine returns padded and type-formatted string for build summary. +func summaryLine(message string, count int) string { + return fmt.Sprintf("%-36s%d", message, count) +} + +// mapToSortedSlice converts a map[string]V to a sorted slice containing the map's keys. +func mapToSortedSlice[V any](inputMap map[string]V) []string { + outputSlice := sliceutils.MapToSlice(inputMap) + sort.Strings(outputSlice) + return outputSlice +} diff --git a/toolkit/tools/specarchchecker/specarchchecker.go b/toolkit/tools/specarchchecker/specarchchecker.go index 19643afff14..0b2bd63b4fa 100644 --- a/toolkit/tools/specarchchecker/specarchchecker.go +++ b/toolkit/tools/specarchchecker/specarchchecker.go @@ -32,14 +32,13 @@ var ( testOnly = app.Flag("test-only", "Whether or not to run the filter out specs which don't run tests.").Bool() - logFile = exe.LogFileFlag(app) - logLevel = exe.LogLevelFlag(app) + logFlags = exe.SetupLogFlags(app) ) func main() { app.Version(exe.ToolkitVersion) kingpin.MustParse(app.Parse(os.Args[1:])) - logger.InitBestEffort(*logFile, *logLevel) + logger.InitBestEffort(logFlags) packagesToBuild := exe.ParseListArgument(*pkgsToBuild) packagesToRebuild := exe.ParseListArgument(*pkgsToRebuild) diff --git a/toolkit/tools/specreader/specreader.go b/toolkit/tools/specreader/specreader.go index 32419fa1ea5..07f3ac6743c 100644 --- a/toolkit/tools/specreader/specreader.go +++ b/toolkit/tools/specreader/specreader.go @@ -81,8 +81,7 @@ var ( workerTar = app.Flag("worker-tar", "Full path to worker_chroot.tar.gz. If this argument is empty, specs will be parsed in the host environment.").ExistingFile() targetArch = app.Flag("target-arch", "The architecture of the machine the RPM binaries run on").String() runCheck = app.Flag("run-check", "Whether or not to run the spec file's check section during package build.").Bool() - logFile = exe.LogFileFlag(app) - logLevel = exe.LogLevelFlag(app) + logFlags = exe.SetupLogFlags(app) profFlags = exe.SetupProfileFlags(app) timestampFile = app.Flag("timestamp-file", "File that stores timestamps for this program.").String() ) @@ -90,7 +89,7 @@ var ( func main() { app.Version(exe.ToolkitVersion) kingpin.MustParse(app.Parse(os.Args[1:])) - logger.InitBestEffort(*logFile, *logLevel) + logger.InitBestEffort(logFlags) prof, err := profile.StartProfiling(profFlags) if err != nil { diff --git a/toolkit/tools/srpmpacker/srpmpacker.go b/toolkit/tools/srpmpacker/srpmpacker.go index 003994a7984..e6fc8d423f4 100644 --- a/toolkit/tools/srpmpacker/srpmpacker.go +++ b/toolkit/tools/srpmpacker/srpmpacker.go @@ -101,8 +101,7 @@ var ( specsDir = exe.InputDirFlag(app, "Path to the SPEC directory to create SRPMs from.") outDir = exe.OutputDirFlag(app, "Directory to place the output SRPM.") - logFile = exe.LogFileFlag(app) - logLevel = exe.LogLevelFlag(app) + logFlags = exe.SetupLogFlags(app) profFlags = exe.SetupProfileFlags(app) timestampFile = app.Flag("timestamp-file", "File that stores timestamps for this program.").String() @@ -131,7 +130,7 @@ var ( func main() { app.Version(exe.ToolkitVersion) kingpin.MustParse(app.Parse(os.Args[1:])) - logger.InitBestEffort(*logFile, *logLevel) + logger.InitBestEffort(logFlags) prof, err := profile.StartProfiling(profFlags) if err != nil { diff --git a/toolkit/tools/validatechroot/validatechroot.go b/toolkit/tools/validatechroot/validatechroot.go index 244d6efd8fd..5cf7a0dcb23 100644 --- a/toolkit/tools/validatechroot/validatechroot.go +++ b/toolkit/tools/validatechroot/validatechroot.go @@ -32,14 +32,13 @@ var ( workerTar = app.Flag("worker-chroot", "Full path to worker_chroot.tar.gz").Required().ExistingFile() workerManifest = app.Flag("worker-manifest", "Full path to the worker manifest file").Required().ExistingFile() - logFile = exe.LogFileFlag(app) - logLevel = exe.LogLevelFlag(app) + logFlags = exe.SetupLogFlags(app) ) func main() { app.Version(exe.ToolkitVersion) kingpin.MustParse(app.Parse(os.Args[1:])) - logger.InitBestEffort(*logFile, *logLevel) + logger.InitBestEffort(logFlags) err := validateWorker(*toolchainRpmsDir, *tmpDir, *workerTar, *workerManifest)