CVE-2019-10214

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• QEMU: slirp: heap buffer overflow during packet reassembly (CVE-2019-14378)

• containers/image: not enforcing TLS when sending username+password credentials to token servers leading to credential disclosure (CVE-2019-10214)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.1 Release Notes linked from the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• QEMU: slirp: heap buffer overflow during packet reassembly (CVE-2019-14378)

• containers/image: not enforcing TLS when sending username+password credentials to token servers leading to credential disclosure (CVE-2019-10214)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.1 Release Notes linked from the References section.

The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launch a MiTM attack and steal login credentials or bearer tokens.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• QEMU: slirp: heap buffer overflow during packet reassembly (CVE-2019-14378)

• containers/image: not enforcing TLS when sending username+password credentials to token servers leading to credential disclosure (CVE-2019-10214)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• QEMU: slirp: heap buffer overflow during packet reassembly (CVE-2019-14378)

• containers/image: not enforcing TLS when sending username+password credentials to token servers leading to credential disclosure (CVE-2019-10214)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The HTTP client used to connect to the container registry authorization service explicitly disables TLS verification, allowing an attacker that is able to MITM the connection to steal credentials.

This update for buildah fixes the following issues:

Security issue fixed:

• CVE-2019-10214: Fixed missing enforcement of TLS connections. (bsc#1144065)

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for skopeo fixes the following issues:

Security issues fixed:

• CVE-2019-10214: Fixed missing enforcement of TLS connections (bsc#1144065).

This update was imported from the SUSE:SLE-15:Update update project.

This update for podman fixes the following issues:

Security issue fixed:

• CVE-2019-10214: Fixed missing enforcement of TLS connections. (bsc#1144065)

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for skopeo fixes the following issues:

Security issues fixed:

• CVE-2019-10214: Fixed missing enforcement of TLS connections (bsc#1144065).

This update was imported from the SUSE:SLE-15:Update update project.

This update for skopeo fixes the following issues:

Update to skopeo v0.1.41 (bsc#1165715):

• Bump github.com/containers/image/v5 from 5.2.0 to 5.2.1
• Bump gopkg.in/yaml.v2 from 2.2.7 to 2.2.8
• Bump github.com/containers/common from 0.0.7 to 0.1.4
• Remove the reference to openshift/api
• vendor github.com/containers/image/[email protected]
• Manually update buildah to v1.13.1
• add specific authfile options to copy (and sync) command.
• Bump github.com/containers/buildah from 1.11.6 to 1.12.0
• Add context to --encryption-key / --decryption-key processing failures
• Bump github.com/containers/storage from 1.15.2 to 1.15.3
• Bump github.com/containers/buildah from 1.11.5 to 1.11.6
• remove direct reference on c/image/storage
• Makefile: set GOBIN
• Bump gopkg.in/yaml.v2 from 2.2.2 to 2.2.7
• Bump github.com/containers/storage from 1.15.1 to 1.15.2
• Introduce the sync command
• openshift cluster: remove .docker directory on teardown
• Bump github.com/containers/storage from 1.14.0 to 1.15.1
• document installation via apk on alpine
• Fix typos in doc for image encryption
• Image encryption/decryption support in skopeo
• make vendor-in-container
• Bump github.com/containers/buildah from 1.11.4 to 1.11.5
• Travis: use go v1.13
• Use a Windows Nano Server image instead of Server Core for multi-arch testing
• Increase test timeout to 15 minutes
• Run the test-system container without --net=host
• Mount /run/systemd/journal/socket into test-system containers
• Don't unnecessarily filter out vendor from (go list ./...) output
• Use -mod=vendor in (go {list,test,vet})
• Bump github.com/containers/buildah from 1.8.4 to 1.11.4
• Bump github.com/urfave/cli from 1.20.0 to 1.22.1
• skopeo: drop support for ostree
• Don't critically fail on a 403 when listing tags
• Revert 'Temporarily work around auth.json location confusion'
• Remove references to atomic
• Remove references to storage.conf
• Dockerfile: use golang-github-cpuguy83-go-md2man
• bump version to v0.1.41-dev
• systemtest: inspect container image different from current platform arch

Changes in v0.1.40:

• vendor containers/image v5.0.0
• copy: add a --all/-a flag
• System tests: various fixes
• Temporarily work around auth.json location confusion
• systemtest: copy: docker->storage->oci-archive
• systemtest/010-inspect.bats: require only PATH
• systemtest: add simple env test in inspect.bats
• bash completion: add comments to keep scattered options in sync
• bash completion: use read -r instead of disabling SC2207
• bash completion: support --opt arg completion
• bash-completion: use replacement instead of sed
• bash completion: disable shellcheck SC2207
• bash completion: double-quote to avoid re-splitting
• bash completions: use bash replacement instead of sed
• bash completion: remove unused variable
• bash-completions: split decl and assignment to avoid masking retvals
• bash completion: double-quote fixes
• bash completion: hard-set PROG=skopeo
• bash completion: remove unused variable
• bash completion: use || instead of -o
• bash completion: rm eval on assigned variable
• copy: add --dest-compress-format and --dest-compress-level
• flag: add optionalIntValue
• Makefile: use go proxy
• inspect --raw: skip the NewImage() step
• update OCI image-spec to 775207bd45b6cb8153ce218cc59351799217451f
• inspect.go: inspect env variables
• ostree: use both image and & storage buildtags

Update to skopeo v0.1.39 (bsc#1159530):

• inspect: add a --config flag
• Add --no-creds flag to skopeo inspect
• Add --quiet option to skopeo copy
• New progress bars
• Parallel Pulls and Pushes for major speed improvements
• containers/image moved to a new progress-bar library to fix various issues related to overlapping bars and redundant entries.
• enforce blocking of registries
• Allow storage-multiple-manifests
• When copying images and the output is not a tty (e.g., when piping to a file) print single lines instead of using progress bars. This avoids long and hard to parse…

This update introduces kubernetes version 1.14.1 and cri-o 1.17.1 to Leap 15.1.

This update for buildah fixes the following issues:

buildah was updated to v1.17.0 (bsc#1165184):

• Handle cases where other tools mount/unmount containers
• overlay.MountReadOnly: support RO overlay mounts
• overlay: use fusermount for rootless umounts
• overlay: fix umount
• Switch default log level of Buildah to Warn. Users need to see these messages
• Drop error messages about OCI/Docker format to Warning level
• build(deps): bump github.com/containers/common from 0.26.0 to 0.26.2
• tests/testreport: adjust for API break in storage v1.23.6
• build(deps): bump github.com/containers/storage from 1.23.5 to 1.23.7
• build(deps): bump github.com/fsouza/go-dockerclient from 1.6.5 to 1.6.6
• copier: put: ignore Typeflag='g'
• Use curl to get repo file (fix #2714)
• build(deps): bump github.com/containers/common from 0.25.0 to 0.26.0
• build(deps): bump github.com/spf13/cobra from 1.0.0 to 1.1.1
• Remove docs that refer to bors, since we're not using it
• Buildah bud should not use stdin by default
• bump containerd, docker, and golang.org/x/sys
• Makefile: cross: remove windows.386 target
• copier.copierHandlerPut: don't check length when there are errors
• Stop excessive wrapping
• CI: require that conformance tests pass
• bump(github.com/openshift/imagebuilder) to v1.1.8
• Skip tlsVerify insecure BUILD_REGISTRY_SOURCES
• Fix build path wrong containers/podman#7993
• refactor pullpolicy to avoid deps
• build(deps): bump github.com/containers/common from 0.24.0 to 0.25.0
• CI: run gating tasks with a lot more memory
• ADD and COPY: descend into excluded directories, sometimes
• copier: add more context to a couple of error messages
• copier: check an error earlier
• copier: log stderr output as debug on success
• Update nix pin with make nixpkgs
• Set directory ownership when copied with ID mapping
• build(deps): bump github.com/sirupsen/logrus from 1.6.0 to 1.7.0
• build(deps): bump github.com/containers/common from 0.23.0 to 0.24.0
• Cirrus: Remove bors artifacts
• Sort build flag definitions alphabetically
• ADD: only expand archives at the right time
• Remove configuration for bors
• Shell Completion for podman build flags
• Bump c/common to v0.24.0
• New CI check: xref --help vs man pages
• CI: re-enable several linters
• Move --userns-uid-map/--userns-gid-map description into buildah man page
• add: preserve ownerships and permissions on ADDed archives
• Makefile: tweak the cross-compile target
• Bump containers/common to v0.23.0
• chroot: create bind mount targets 0755 instead of 0700
• Change call to Split() to safer SplitN()
• chroot: fix handling of errno seccomp rules
• build(deps): bump github.com/containers/image/v5 from 5.5.2 to 5.6.0
• Add In Progress section to contributing
• integration tests: make sure tests run in ${topdir}/tests
• Run(): ignore containers.conf's environment configuration
• Warn when setting healthcheck in OCI format
• Cirrus: Skip git-validate on branches
• tools: update git-validation to the latest commit
• tools: update golangci-lint to v1.18.0
• Add a few tests of push command
• Add(): fix handling of relative paths with no ContextDir
• build(deps): bump github.com/containers/common from 0.21.0 to 0.22.0
• Lint: Use same linters as podman
• Validate: reference HEAD
• Fix buildah mount to display container names not ids
• Update nix pin with make nixpkgs
• Add missing --format option in buildah from man page
• Fix up code based on codespell
• build(deps): bump github.com/openshift/imagebuilder from 1.1.6 to 1.1.7
• build(deps): bump github.com/containers/storage from 1.23.4 to 1.23.5
• Improve buildah completions
• Cirrus: Fix validate commit epoch
• Fix bash completion of manifest flags
• Uniform some man pages
• Update Buildah Tutorial to address BZ1867426
• Update bash completion of manifest add sub command
• copier.Get(): hard link targets shouldn't be relative paths
• build(deps): bump github.com/onsi/gomega from 1.10.1 to 1.10.2
• Pass timestamp down to history lines
• Timestamp…

This update for buildah, libcontainers-common, podman fixes the following issues:

Changes in libcontainers-common:

• Update common to 0.33.0
• Update image to 5.9.0
• Update podman to 2.2.1
• Update storage to 1.24.5
• Switch to seccomp profile provided by common instead of podman
• Update containers.conf to match latest version

Changes in buildah:

Update to version 1.19.2:

• Update vendor of containers/storage and containers/common
• Buildah inspect should be able to inspect manifests
• Make buildah push support pushing manifests lists and digests
• Fix handling of TMPDIR environment variable
• Add support for --manifest flags
• Upper directory should match mode of destination directory
• Only grab the OS, Arch if the user actually specified them
• Use --arch and --os and --variant options to select architecture and os
• Cirrus: Track libseccomp and golang version
• copier.PutOptions: add an 'IgnoreDevices' flag
• fix: rmi --prune when parent image is in store.
• build(deps): bump github.com/containers/storage from 1.24.3 to 1.24.4
• build(deps): bump github.com/containers/common from 0.31.1 to 0.31.2
• Allow users to specify stdin into containers
• Drop log message on failure to mount on /sys file systems to info
• Spelling
• SELinux no longer requires a tag.
• build(deps): bump github.com/opencontainers/selinux from 1.6.0 to 1.8.0
• build(deps): bump github.com/containers/common from 0.31.0 to 0.31.1
• Update nix pin with make nixpkgs
• Switch references of /var/run -> /run
• Allow FROM to be overriden with from option
• copier: don't assume we can chroot() on Unixy systems
• copier: add PutOptions.NoOverwriteDirNonDir, Get/PutOptions.Rename
• copier: handle replacing directories with not-directories
• copier: Put: skip entries with zero-length names
• build(deps): bump github.com/containers/storage from 1.24.2 to 1.24.3
• Add U volume flag to chown source volumes
• Turn off PRIOR_UBUNTU Test until vm is updated
• pkg, cli: rootless uses correct isolation
• build(deps): bump github.com/onsi/gomega from 1.10.3 to 1.10.4
• update installation doc to reflect current status
• Move away from using docker.io
• enable short-name aliasing
• build(deps): bump github.com/containers/storage from 1.24.1 to 1.24.2
• build(deps): bump github.com/containers/common from 0.30.0 to 0.31.0
• Throw errors when using bogus --network flags
• pkg/supplemented test: replace our null blobinfocache
• build(deps): bump github.com/containers/common from 0.29.0 to 0.30.0
• inserts forgotten quotation mark
• Not prefer use local image create/add manifest
• Add container information to .containerenv
• Add --ignorefile flag to use alternate .dockerignore flags
• Add a source debug build
• Fix crash on invalid filter commands
• build(deps): bump github.com/containers/common from 0.27.0 to 0.29.0
• Switch to using containers/common pkg's
• fix: non-portable shebang #2812
• Remove copy/paste errors that leaked Podman into man pages.
• Add suggests cpp to spec file
• Apply suggestions from code review
• update docs for debian testing and unstable
• imagebuildah: disable pseudo-terminals for RUN
• Compute diffID for mapped-layer at creating image source
• intermediateImageExists: ignore images whose history we can't read
• Bump to v1.19.0-dev
• build(deps): bump github.com/containers/common from 0.26.3 to 0.27.0
• Fix testing error caused by simultanious merge
• Vendor in containers/storage v1.24.0
• short-names aliasing
• Add --policy flag to buildah pull
• Stop overwrapping and stuttering
• copier.Get(): ignore ENOTSUP/ENOSYS when listing xattrs
• Run: don't forcibly disable UTS namespaces in rootless mode
• test: ensure non-directory in a Dockerfile path is handled correctly
• Add a few tests for pull command
• Fix buildah config --cmd to handle array
• build(deps): bump github.com/containers/storage from 1.23.8 to 1.23.9
• Fix NPE when Dockerfile path contains non-directory entries
• Update buildah bud man page from podman build man page *…

This update for buildah fixes the following issues:

buildah was updated to version 1.23.1:

Update to version 1.22.3:

• Update dependencies
• Post-branch commit
• Accept repositories on login/logout

Update to version 1.22.0:

• c/image, c/storage, c/common vendor before Podman 3.3 release
• Proposed patch for 3399 (shadowutils)
• Fix handling of --restore shadow-utils
• runtime-flag (debug) test: handle old & new runc
• Allow dst and destination for target in secret mounts
• Multi-arch: Always push updated version-tagged img
• imagebuildah.stageExecutor.prepare(): remove pseudonym check
• refine dangling filter
• Chown with environment variables not set should fail
• Just restore protections of shadow-utils
• Remove specific kernel version number requirement from install.md
• Multi-arch image workflow: Make steps generic
• chroot: fix environment value leakage to intermediate processes
• Update nix pin with make nixpkgs
• buildah source - create and manage source images
• Update cirrus-cron notification GH workflow
• Reuse code from containers/common/pkg/parse
• Cirrus: Freshen VM images
• Fix excludes exception begining with / or ./
• Fix syntax for --manifest example
• vendor containers/common@main
• Cirrus: Drop dependence on fedora-minimal
• Adjust conformance-test error-message regex
• Workaround appearance of differing debug messages
• Cirrus: Install docker from package cache
• Switch rusagelogfile to use options.Out
• Turn stdio back to blocking when command finishes
• Add support for default network creation
• Cirrus: Updates for master->main rename
• Change references from master to main
• Add --env and --workingdir flags to run command
• [CI:DOCS] buildah bud: spelling --ignore-file requires parameter
• [CI:DOCS] push/pull: clarify supported transports
• Remove unused function arguments
• Create mountOptions for mount command flags
• Extract version command implementation to function
• Add --json flags to mount and version commands
• copier.Put(): set xattrs after ownership
• buildah add/copy: spelling
• buildah copy and buildah add should support .containerignore
• Remove unused util.StartsWithValidTransport
• Fix documentation of the --format option of buildah push
• Don't use alltransports.ParseImageName with known transports
• man pages: clarify rmi removes dangling parents
• [CI:DOCS] Fix links to c/image master branch
• imagebuildah: use the specified logger for logging preprocessing warnings
• Fix copy into workdir for a single file
• Fix docs links due to branch rename
• Update nix pin with make nixpkgs
• fix(docs): typo
• Move to v1.22.0-dev
• Fix handling of auth.json file while in a user namespace
• Add rusage-logfile flag to optionally send rusage to a file
• imagebuildah: redo step logging
• Add volumes to make running buildah within a container easier
• Add and use a 'copy' helper instead of podman load/save
• Bump github.com/containers/common from 0.38.4 to 0.39.0
• containerImageRef/containerImageSource: don't buffer uncompressed layers
• containerImageRef(): squashed images have no parent images
• Sync. workflow across skopeo, buildah, and podman
• Bump github.com/containers/storage from 1.31.1 to 1.31.2
• Bump github.com/opencontainers/runc from 1.0.0-rc94 to 1.0.0-rc95
• Bump to v1.21.1-dev [NO TESTS NEEDED]

These are all security issues fixed in the buildah-1.23.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the cri-o-1.22.0-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the podman-3.3.1-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the skopeo-1.2.3-1.2 package on the GA media of openSUSE Tumbleweed.

This update for skopeo fixes the following issues:

Security issues fixed:

• CVE-2019-10214: Fixed missing enforcement of TLS connections (bsc#1144065).

This update for buildah fixes the following issues:

Security issue fixed:

• CVE-2019-10214: Fixed missing enforcement of TLS connections. (bsc#1144065)

This update for podman fixes the following issues:

Security issue fixed:

• CVE-2019-10214: Fixed missing enforcement of TLS connections. (bsc#1144065)

This update for skopeo fixes the following issues:

Update to skopeo v0.1.41 (bsc#1165715):

• Bump github.com/containers/image/v5 from 5.2.0 to 5.2.1
• Bump gopkg.in/yaml.v2 from 2.2.7 to 2.2.8
• Bump github.com/containers/common from 0.0.7 to 0.1.4
• Remove the reference to openshift/api
• vendor github.com/containers/image/[email protected]
• Manually update buildah to v1.13.1
• add specific authfile options to copy (and sync) command.
• Bump github.com/containers/buildah from 1.11.6 to 1.12.0
• Add context to --encryption-key / --decryption-key processing failures
• Bump github.com/containers/storage from 1.15.2 to 1.15.3
• Bump github.com/containers/buildah from 1.11.5 to 1.11.6
• remove direct reference on c/image/storage
• Makefile: set GOBIN
• Bump gopkg.in/yaml.v2 from 2.2.2 to 2.2.7
• Bump github.com/containers/storage from 1.15.1 to 1.15.2
• Introduce the sync command
• openshift cluster: remove .docker directory on teardown
• Bump github.com/containers/storage from 1.14.0 to 1.15.1
• document installation via apk on alpine
• Fix typos in doc for image encryption
• Image encryption/decryption support in skopeo
• make vendor-in-container
• Bump github.com/containers/buildah from 1.11.4 to 1.11.5
• Travis: use go v1.13
• Use a Windows Nano Server image instead of Server Core for multi-arch testing
• Increase test timeout to 15 minutes
• Run the test-system container without --net=host
• Mount /run/systemd/journal/socket into test-system containers
• Don't unnecessarily filter out vendor from (go list ./...) output
• Use -mod=vendor in (go {list,test,vet})
• Bump github.com/containers/buildah from 1.8.4 to 1.11.4
• Bump github.com/urfave/cli from 1.20.0 to 1.22.1
• skopeo: drop support for ostree
• Don't critically fail on a 403 when listing tags
• Revert 'Temporarily work around auth.json location confusion'
• Remove references to atomic
• Remove references to storage.conf
• Dockerfile: use golang-github-cpuguy83-go-md2man
• bump version to v0.1.41-dev
• systemtest: inspect container image different from current platform arch

Changes in v0.1.40:

• vendor containers/image v5.0.0
• copy: add a --all/-a flag
• System tests: various fixes
• Temporarily work around auth.json location confusion
• systemtest: copy: docker->storage->oci-archive
• systemtest/010-inspect.bats: require only PATH
• systemtest: add simple env test in inspect.bats
• bash completion: add comments to keep scattered options in sync
• bash completion: use read -r instead of disabling SC2207
• bash completion: support --opt arg completion
• bash-completion: use replacement instead of sed
• bash completion: disable shellcheck SC2207
• bash completion: double-quote to avoid re-splitting
• bash completions: use bash replacement instead of sed
• bash completion: remove unused variable
• bash-completions: split decl and assignment to avoid masking retvals
• bash completion: double-quote fixes
• bash completion: hard-set PROG=skopeo
• bash completion: remove unused variable
• bash completion: use || instead of -o
• bash completion: rm eval on assigned variable
• copy: add --dest-compress-format and --dest-compress-level
• flag: add optionalIntValue
• Makefile: use go proxy
• inspect --raw: skip the NewImage() step
• update OCI image-spec to 775207bd45b6cb8153ce218cc59351799217451f
• inspect.go: inspect env variables
• ostree: use both image and & storage buildtags

Update to skopeo v0.1.39 (bsc#1159530):

• inspect: add a --config flag
• Add --no-creds flag to skopeo inspect
• Add --quiet option to skopeo copy
• New progress bars
• Parallel Pulls and Pushes for major speed improvements
• containers/image moved to a new progress-bar library to fix various issues related to overlapping bars and redundant entries.
• enforce blocking of registries
• Allow storage-multiple-manifests
• When copying images and the output is not a tty (e.g., when piping to a file) print single lines instead of using progress bars. This avoids long and hard to parse…

This update for buildah fixes the following issues:

buildah was updated to v1.17.0 (bsc#1165184):

• Handle cases where other tools mount/unmount containers
• overlay.MountReadOnly: support RO overlay mounts
• overlay: use fusermount for rootless umounts
• overlay: fix umount
• Switch default log level of Buildah to Warn. Users need to see these messages
• Drop error messages about OCI/Docker format to Warning level
• build(deps): bump github.com/containers/common from 0.26.0 to 0.26.2
• tests/testreport: adjust for API break in storage v1.23.6
• build(deps): bump github.com/containers/storage from 1.23.5 to 1.23.7
• build(deps): bump github.com/fsouza/go-dockerclient from 1.6.5 to 1.6.6
• copier: put: ignore Typeflag='g'
• Use curl to get repo file (fix #2714)
• build(deps): bump github.com/containers/common from 0.25.0 to 0.26.0
• build(deps): bump github.com/spf13/cobra from 1.0.0 to 1.1.1
• Remove docs that refer to bors, since we're not using it
• Buildah bud should not use stdin by default
• bump containerd, docker, and golang.org/x/sys
• Makefile: cross: remove windows.386 target
• copier.copierHandlerPut: don't check length when there are errors
• Stop excessive wrapping
• CI: require that conformance tests pass
• bump(github.com/openshift/imagebuilder) to v1.1.8
• Skip tlsVerify insecure BUILD_REGISTRY_SOURCES
• Fix build path wrong containers/podman#7993
• refactor pullpolicy to avoid deps
• build(deps): bump github.com/containers/common from 0.24.0 to 0.25.0
• CI: run gating tasks with a lot more memory
• ADD and COPY: descend into excluded directories, sometimes
• copier: add more context to a couple of error messages
• copier: check an error earlier
• copier: log stderr output as debug on success
• Update nix pin with make nixpkgs
• Set directory ownership when copied with ID mapping
• build(deps): bump github.com/sirupsen/logrus from 1.6.0 to 1.7.0
• build(deps): bump github.com/containers/common from 0.23.0 to 0.24.0
• Cirrus: Remove bors artifacts
• Sort build flag definitions alphabetically
• ADD: only expand archives at the right time
• Remove configuration for bors
• Shell Completion for podman build flags
• Bump c/common to v0.24.0
• New CI check: xref --help vs man pages
• CI: re-enable several linters
• Move --userns-uid-map/--userns-gid-map description into buildah man page
• add: preserve ownerships and permissions on ADDed archives
• Makefile: tweak the cross-compile target
• Bump containers/common to v0.23.0
• chroot: create bind mount targets 0755 instead of 0700
• Change call to Split() to safer SplitN()
• chroot: fix handling of errno seccomp rules
• build(deps): bump github.com/containers/image/v5 from 5.5.2 to 5.6.0
• Add In Progress section to contributing
• integration tests: make sure tests run in ${topdir}/tests
• Run(): ignore containers.conf's environment configuration
• Warn when setting healthcheck in OCI format
• Cirrus: Skip git-validate on branches
• tools: update git-validation to the latest commit
• tools: update golangci-lint to v1.18.0
• Add a few tests of push command
• Add(): fix handling of relative paths with no ContextDir
• build(deps): bump github.com/containers/common from 0.21.0 to 0.22.0
• Lint: Use same linters as podman
• Validate: reference HEAD
• Fix buildah mount to display container names not ids
• Update nix pin with make nixpkgs
• Add missing --format option in buildah from man page
• Fix up code based on codespell
• build(deps): bump github.com/openshift/imagebuilder from 1.1.6 to 1.1.7
• build(deps): bump github.com/containers/storage from 1.23.4 to 1.23.5
• Improve buildah completions
• Cirrus: Fix validate commit epoch
• Fix bash completion of manifest flags
• Uniform some man pages
• Update Buildah Tutorial to address BZ1867426
• Update bash completion of manifest add sub command
• copier.Get(): hard link targets shouldn't be relative paths
• build(deps): bump github.com/onsi/gomega from 1.10.1 to 1.10.2
• Pass timestamp down to history lines
• Timestamp…

This update for buildah fixes the following issues:

buildah was updated to version 1.23.1:

Update to version 1.22.3:

• Update dependencies
• Post-branch commit
• Accept repositories on login/logout

Update to version 1.22.0:

• c/image, c/storage, c/common vendor before Podman 3.3 release
• Proposed patch for 3399 (shadowutils)
• Fix handling of --restore shadow-utils
• runtime-flag (debug) test: handle old & new runc
• Allow dst and destination for target in secret mounts
• Multi-arch: Always push updated version-tagged img
• imagebuildah.stageExecutor.prepare(): remove pseudonym check
• refine dangling filter
• Chown with environment variables not set should fail
• Just restore protections of shadow-utils
• Remove specific kernel version number requirement from install.md
• Multi-arch image workflow: Make steps generic
• chroot: fix environment value leakage to intermediate processes
• Update nix pin with make nixpkgs
• buildah source - create and manage source images
• Update cirrus-cron notification GH workflow
• Reuse code from containers/common/pkg/parse
• Cirrus: Freshen VM images
• Fix excludes exception begining with / or ./
• Fix syntax for --manifest example
• vendor containers/common@main
• Cirrus: Drop dependence on fedora-minimal
• Adjust conformance-test error-message regex
• Workaround appearance of differing debug messages
• Cirrus: Install docker from package cache
• Switch rusagelogfile to use options.Out
• Turn stdio back to blocking when command finishes
• Add support for default network creation
• Cirrus: Updates for master->main rename
• Change references from master to main
• Add --env and --workingdir flags to run command
• [CI:DOCS] buildah bud: spelling --ignore-file requires parameter
• [CI:DOCS] push/pull: clarify supported transports
• Remove unused function arguments
• Create mountOptions for mount command flags
• Extract version command implementation to function
• Add --json flags to mount and version commands
• copier.Put(): set xattrs after ownership
• buildah add/copy: spelling
• buildah copy and buildah add should support .containerignore
• Remove unused util.StartsWithValidTransport
• Fix documentation of the --format option of buildah push
• Don't use alltransports.ParseImageName with known transports
• man pages: clarify rmi removes dangling parents
• [CI:DOCS] Fix links to c/image master branch
• imagebuildah: use the specified logger for logging preprocessing warnings
• Fix copy into workdir for a single file
• Fix docs links due to branch rename
• Update nix pin with make nixpkgs
• fix(docs): typo
• Move to v1.22.0-dev
• Fix handling of auth.json file while in a user namespace
• Add rusage-logfile flag to optionally send rusage to a file
• imagebuildah: redo step logging
• Add volumes to make running buildah within a container easier
• Add and use a 'copy' helper instead of podman load/save
• Bump github.com/containers/common from 0.38.4 to 0.39.0
• containerImageRef/containerImageSource: don't buffer uncompressed layers
• containerImageRef(): squashed images have no parent images
• Sync. workflow across skopeo, buildah, and podman
• Bump github.com/containers/storage from 1.31.1 to 1.31.2
• Bump github.com/opencontainers/runc from 1.0.0-rc94 to 1.0.0-rc95
• Bump to v1.21.1-dev [NO TESTS NEEDED]