🛡️ SUSE-SU-2026:21518-1 — build (CVE-2024-22038)

Security update for build, product-composer

This update for build, product-composer fixes the following issues:

Changes in build:

• Support a new "IgnoreRebuild" config.
• build-recipe-kiwi:
• Add support for oci containers
• Avoid needlessly compressing container images
• Detect container images based on build result file name
• Fix queryrecipe to use the summary and the description from the main package
• config: Add slfo-main build configuration
• drop the inner quotes, not needed on bash 4 and breaks on bash 3
• build: in the ccache case, after test -e also accept -L
• container:
• Add microdnf package manager support
• Add experimental support for the container-timestamp build option
• sbom:
• allow to create v1 intoto data
• spdx: connect OPERATING-SYSTEM package to the root package
• Transfer product vcs and disturl
• Support --cms-nocerts and --cms-keyid in the signdummy
• Support chroot builds inside of containers
• runservice tool, allow to specify the modes. Can be

used on plain git source now also

• Support --mtime option for cpio creation
• generate_sbom:
• Support also unzck compressed repomd files
• Fail when given --product directory is missing
• support zstd compressed repomd data
• build-vm-lxc: support lxc >= 5
• vc: Hide an annoying error message when not using NIS
• added leap-16.0 and leap-16.1 build configs.

(not named sl16.0 anymore, but using same string as the git branch)

• Implement cmssign support in signdummy
• pbuild: mark git assets with a fixed commit as immutable
• mkosi
• check if old parameters are supported before passing them
• support old bash version
• Do not crash on small files that start with the PE magic
• Harden export_debian_orig_from_git (CVE-2024-22038, boo#1230469)

Changes in product-composer:

update to version 0.9.6:

• Speed-up reading of rpm headers
• Flush output lines to get get correct timestamps in OBS

update to version 0.9.5:

• Be a bit more verbose to track used times per step in OBS
• Fix a crash when doing version compare with an epoch

update to version 0.9.4:

• Give an error when trying to add updateinfo meta data

without all binary revisions.

• Hand over vcs and disturl data to generate_sbom.

(We require a recent build package therefore)