CVE-2024-22038

This update for osc, obs-scm-bridge fixes the following issues:

Changes in osc:

• 1.24.0

  • Command-line:
    • Add '--target-owner' option to 'git-obs repo fork' command
    • Add '--self' parameter to fix 'no matching parent repo' error message in 'git-obs pr create'
    • Fix 'osc aggregatepac' for scmsync packages
    • Fix 'osc build' to retrieve buildconfig from git package's cache
    • Fix 'osc token' error handling for project wide trigger
    • Fix string formatting for id in obs-request.xml in 'git-obs pr dump'
  • Library:
    • Consolidate build types in build.py and commandline.py
    • Fix build.get_build_type() by comparing binary_type only if specified
    • Make use of queryconfig tool configurable and consistent
    • Fix how get_request_collection() filters the projects and packages
    • Support copying packages from an scmsync source, when target exists
    • Add timestamps to the DEBUG output
    • Update new project template

• 1.23.0

  • Command-line:
    • Add '--target-owner' option to 'git-obs pr create' to specify the target owner explicitly
    • Add '--target-branch' option to 'git-obs staging search' command
    • Added 'git-obs staging search' command to find project PRs with referenced package PRs that have all been approved
    • Change 'git-obs pr dump' to produce directories that match the specified pull request IDs
    • Change 'git-obs pr dump' to write STATUS file
    • Properly error out on invalid 'PR:' references in 'git-obs pr dump'
    • Fix 'git-obs pr create' when the source repo is not a fork
    • Fix 'git-obs api' command when server returns 'null'
    • Fix 'osc build --alternative-project=...' when there's no .osc in the current directory
    • Fix argument and store handling in 'osc results' command
  • Library:
    • Add Manifest.get_package_paths() method that lists all paths to existings packages in a project
    • Fix Manifest class to handle loading empty YAML files or strings
    • Fix working with meta during git rebase by determining the current branch from rebase head
    • Fix handling local branch when fetching remote
    • Move get_label_ids() from PullRequest to Repo class
    • Change GitStore not to require apiurl anymore
    • Fix storing last_buildroot for git packages
    • Store the last buildroot only if there's a store detected
    • Fix BuildRoot so it acts as a tuple and the individual values are accessible via indexes
    • Make PullReqest.parse_id() more permissive by accepting trailing whitespaces
    • Fix 'missingok' argument in server_diff()
    • Fix gitea_api.PullRequest ordering methods
    • Add return to gitea_api.Branch.list()

• PKGBUILD changes

  • Remove redundant packages from makedepends. If a package depends on something, it implicitly makedepends on it as well
  • Add python-ruamel-yaml dependency
  • Build and install man pages
  • Add python-argparse-manpage and python-sphinx to makedepends for building man pages
  • Add check() to run the test suite
  • Add checkdepends for test suite dependencies
  • Add optdepends as an equivalent to RPM's Recommends, making it easier for users to find packages needed for optional features
  • Use $pkgname variable across the script
  • Install shell completion files
  • Bump pkgrel

• 1.22.0

  • Command-line:
    • Add 'git-obs staging' commands
    • Add '--gitea-fork-org' option to 'osc fork' command
    • Add '--git-branch' option to 'osc fork' command
    • Add 'DELETE' to 'git-obs api' allowed methods
    • Add commit messages as commented lines to the template in 'git-obs pr create'
    • Add filtering by label to 'git-obs pr list'
    • Properly handle fork mismatch in 'osc fork'
    • Change 'osc build' to build from any git repo if '--alternative-project' is specified
    • Fix 'osc service' for git based packages
    • Fix 'git-obs pr dump' to skip the dump if the target has the same updated_at timestamp as the pull request in Gitea
    • Fix 'git-obs pr dump' to do…

This update for build, product-composer fixes the following issues:

Changes in build:

• Support a new "IgnoreRebuild" config.

• build-recipe-kiwi:

  • Add support for oci containers
  • Avoid needlessly compressing container images
  • Detect container images based on build result file name

• Fix queryrecipe to use the summary and the description from the main package

• config: Add slfo-main build configuration

• drop the inner quotes, not needed on bash 4 and breaks on bash 3

• build: in the ccache case, after test -e also accept -L

• container:

  • Add microdnf package manager support
  • Add experimental support for the container-timestamp build option

• sbom:

  • allow to create v1 intoto data
  • spdx: connect OPERATING-SYSTEM package to the root package
  • Transfer product vcs and disturl

• Support --cms-nocerts and --cms-keyid in the signdummy

• Support chroot builds inside of containers

• runservice tool, allow to specify the modes. Can be used on plain git source now also

• Support --mtime option for cpio creation

• generate_sbom:

  • Support also unzck compressed repomd files
  • Fail when given --product directory is missing
  • support zstd compressed repomd data

• build-vm-lxc: support lxc >= 5

• vc: Hide an annoying error message when not using NIS

• added leap-16.0 and leap-16.1 build configs. (not named sl16.0 anymore, but using same string as the git branch)

• Implement cmssign support in signdummy

• pbuild: mark git assets with a fixed commit as immutable

• mkosi

  • check if old parameters are supported before passing them
  • support old bash version

• Do not crash on small files that start with the PE magic

• Harden export_debian_orig_from_git (CVE-2024-22038, boo#1230469)

Changes in product-composer:

update to version 0.9.6:

• Speed-up reading of rpm headers
• Flush output lines to get get correct timestamps in OBS

update to version 0.9.5:

• Be a bit more verbose to track used times per step in OBS
• Fix a crash when doing version compare with an epoch

update to version 0.9.4:

• Give an error when trying to add updateinfo meta data without all binary revisions.
• Hand over vcs and disturl data to generate_sbom. (We require a recent build package therefore)

This update for obs-scm-bridge fixes the following issues:

Updated to version 0.5.4:

• CVE-2024-22038: Fixed DoS attacks, information leaks with crafted Git repositories (bnc#1230469)

This update for build fixes the following issues:

• CVE-2024-22038: Fixed DoS attacks, information leaks with crafted Git repositories (bnc#1230469)

Other fixes:

• Fixed behaviour when using '--shell' aka 'osc shell' option in a VM build. Startup is faster and permissions stay intact now.

• fixes for POSIX compatibility for obs-docker-support adn mkbaselibs

• Add support for apk in docker/podman builds

• Add support for 'wget' in Docker images

• Fix debian support for Dockerfile builds

• Fix preinstallimages in containers

• mkosi: add back system-packages used by build-recipe directly

• pbuild: parse the Release files for debian repos

• mkosi: drop most systemd/build-packages deps and use obs_scm directory as source if present

• improve source copy handling

• Introduce --repos-directory and --containers-directory options

• productcompose: support of building against a baseiso

• preinstallimage: avoid inclusion of build script generated files

• preserve timestamps on sources copy-in for kiwi and productcompose

• alpine package support updates

• tumbleweed config update

• debian: Support installation of foreign architecture packages (required for armv7l setups)

• Parse unknown timezones as UTC

• Apk (Alpine Linux) format support added

• Implement default value in parameter expansion

• Also support supplements that use & as 'and'

• Add workaround for skopeo's argument parser

• add cap-htm=off on power9

• Fixed usage of chown calls

• Remove leading go from purl locators

• container related:

  • Implement support for the new <containers> element in kiwi recipes
  • Fixes for SBOM and dependencies of multi stage container builds
  • obs-docker-support: enable dnf and yum substitutions

• Arch Linux:

  • fix file path for Arch repo
  • exclude unsupported arch
  • Use root as download user

• build-vm-qemu: force sv48 satp mode on riscv64

• mkosi:

  • Create .sha256 files after mkosi builds
  • Always pass --image-version to mkosi

• General improvements and bugfixes (mkosi, pbuild, appimage/livebuild, obs work detection, documention, SBOM)

• Support slsa v1 in unpack_slsa_provenance

• generate_sbom: do not clobber spdx supplier

• Harden export_debian_orig_from_git (bsc#1230469)

• SBOM generation:

  • Adding golang introspection support
  • Adding rust binary introspection support
  • Keep track of unknwon licenses and add a 'hasExtractedLicensingInfos' section
  • Also normalize licenses for cyclonedx
  • Make generate_sbom errors fatal
  • general improvements

• Fix noprep building not working because the buildir is removed

• kiwi image: also detect a debian build if /var/lib/dpkg/status is present

• Do not use the Encode module to convert a code point to utf8

• Fix personality syscall number for riscv

• add more required recommendations for KVM builds

• set PACKAGER field in build-recipe-arch

• fix writing _modulemd.yaml

• pbuild: support --release and --baselibs option

• container:

  • copy base container information from the annotation into the containerinfo
  • track base containers over multiple stages
  • always put the base container last in the dependencies

• providing fileprovides in createdirdeps tool

• Introduce buildflag nochecks

• productcompose: support all option

• config update: tumbleweed using preinstallexpand

• minor improvements

• tumbleweed build config update

• support the %load macro

• improve container filename generation (docker)

• fix hanging curl calls during build (docker)

• productcompose: fix milestone query

• tumbleweed build config update

• 15.6 build config fixes

• sourcerpm & sourcedep handling fixes

• productcompose:

  • Fix milestone handling
  • Support bcntsynctag

• Adding debian support to generate_sbom

• Add syscall for personality switch on loongarch64 kernel

• vm-build: ext3 & ext4: fix disk space allocation

• mkosi format updates, not fully working yet

• pbuild exception fixes

• Fixes for current…

This update for build, product-composer fixes the following issues:

Changes in build:

• Support a new "IgnoreRebuild" config.

• build-recipe-kiwi:

  • Add support for oci containers
  • Avoid needlessly compressing container images
  • Detect container images based on build result file name

• Fix queryrecipe to use the summary and the description from the main package

• config: Add slfo-main build configuration

• drop the inner quotes, not needed on bash 4 and breaks on bash 3

• build: in the ccache case, after test -e also accept -L

• container:

  • Add microdnf package manager support
  • Add experimental support for the container-timestamp build option

• sbom:

  • allow to create v1 intoto data
  • spdx: connect OPERATING-SYSTEM package to the root package
  • Transfer product vcs and disturl

• Support --cms-nocerts and --cms-keyid in the signdummy

• Support chroot builds inside of containers

• runservice tool, allow to specify the modes. Can be used on plain git source now also

• Support --mtime option for cpio creation

• generate_sbom:

  • Support also unzck compressed repomd files
  • Fail when given --product directory is missing
  • support zstd compressed repomd data

• build-vm-lxc: support lxc >= 5

• vc: Hide an annoying error message when not using NIS

• added leap-16.0 and leap-16.1 build configs. (not named sl16.0 anymore, but using same string as the git branch)

• Implement cmssign support in signdummy

• pbuild: mark git assets with a fixed commit as immutable

• mkosi

  • check if old parameters are supported before passing them
  • support old bash version

• Do not crash on small files that start with the PE magic

• Harden export_debian_orig_from_git (CVE-2024-22038, boo#1230469)

Changes in product-composer:

update to version 0.9.6:

• Speed-up reading of rpm headers
• Flush output lines to get get correct timestamps in OBS

update to version 0.9.5:

• Be a bit more verbose to track used times per step in OBS
• Fix a crash when doing version compare with an epoch

update to version 0.9.4:

• Give an error when trying to add updateinfo meta data without all binary revisions.
• Hand over vcs and disturl data to generate_sbom. (We require a recent build package therefore)