🛡️ SUSE-SU-2024:3186-1 — buildah (CVE-2024-3727 +3 more)

Security update for buildah

This update for buildah fixes the following issues:

Update to version 1.35.4:

• CVE-2024-3727 updates (bsc#1224117)
• Bump go-jose CVE-2024-28180
• Bump ocicrypt and go-jose CVE-2024-28180

Update to version 1.35.3:

• correctly configure /etc/hosts and resolv.conf
• buildah: refactor resolv/hosts setup.
• rename the hostFile var to reflect
• CVE-2024-24786 protobuf to 1.33

Update to version 1.35.1:

• CVE-2024-1753 container escape fix (bsc#1221677)
• Buildah dropped cni support, require netavark instead (bsc#1221243)
• Remove obsolete requires libcontainers-image & libcontainers-storage
• Require passt for rootless networking (poo#156955)

Buildah moved to passt/pasta for rootless networking from slirp4netns

(https://github.com/containers/common/pull/1846)

Update to version 1.35.0:

• Bump c/common v0.58.0, c/image v5.30.0, c/storage v1.53.0
• conformance tests: don't break on trailing zeroes in layer blobs
• Add a conformance test for copying to a mounted prior stage
• cgroups: reuse version check from c/common
• Update vendor of containers/(common,image)
• manifest add: complain if we get artifact flags without --artifact
• Use retry logic from containers/common
• Vendor in containers/(storage,image,common)
• Update module golang.org/x/crypto to v0.20.0
• Add comment re: Total Success task name
• tests: skip_if_no_unshare(): check for --setuid
• Properly handle build --pull=false
• Update module go.etcd.io/bbolt to v1.3.9
• Update module github.com/opencontainers/image-spec to v1.1.0
• build --all-platforms: skip some base 'image' platforms
• Bump main to v1.35.0-dev
• Vendor in latest containers/(storage,image,common)
• Split up error messages for missing --sbom related flags
• buildah manifest: add artifact-related options
• cmd/buildah/manifest.go: lock lists before adding/annotating/pushing
• cmd/buildah/manifest.go: don't make struct declarations aliases
• Use golang.org/x/exp/slices.Contains
• Try Cirrus with a newer VM version
• Set CONTAINERS_CONF in the chroot-mount-flags integration test
• Update to match dependency API update
• Update github.com/openshift/imagebuilder and containers/common
• docs: correct default authfile path
• tests: retrofit test for heredoc summary
• build, heredoc: show heredoc summary in build output
• manifest, push: add support for --retry and --retry-delay
• imagebuildah: fix crash with empty RUN
• Make buildah match podman for handling of ulimits
• docs: move footnotes to where they're applicable
• Allow users to specify no-dereference
• docs: use reversed logo for dark theme in README
• build,commit: add --sbom to scan and produce SBOMs when committing
• commit: force omitHistory if the parent has layers but no history
• docs: fix a couple of typos
• internal/mkcw.Archive(): handle extra image content
• stage_executor,heredoc: honor interpreter in heredoc
• stage_executor,layers: burst cache if heredoc content is changed
• Replace map[K]bool with map[K]struct{} where it makes sense
• Bump CI VMs
• Replace strings.SplitN with strings.Cut
• Document use of containers-transports values in buildah
• manifest: addCompression use default from containers.conf
• commit: add a --add-file flag
• mkcw: populate the rootfs using an overlay
• [skip-ci] Update actions/stale action to v9
• Ignore errors if label.Relabel returns ENOSUP