Skip to content

Commit 2431fb3

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #21472 from mheon/vendor_runc_main
Update to runc main, removing pin to an older version
2 parents 11c37d5 + 7de64b4 commit 2431fb3

File tree

130 files changed

+6150
-2401
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

130 files changed

+6150
-2401
lines changed

Diff for: ‎docs/source/markdown/options/sbom-image-output.md

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
####> This option file is used in:
2+
####> podman farm build
3+
####> If file is edited, make sure the changes
4+
####> are applicable to all of those.
5+
#### **--sbom-image-output**=*path*
6+
7+
When generating SBOMs, store the generated SBOM in the specified path in the
8+
output image. There is no default.

Diff for: ‎docs/source/markdown/options/sbom-image-purl-output.md

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
####> This option file is used in:
2+
####> podman farm build
3+
####> If file is edited, make sure the changes
4+
####> are applicable to all of those.
5+
#### **--sbom-image-purl-output**=*path*
6+
7+
When generating SBOMs, scan them for PURL ([package
8+
URL](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst))
9+
information, and save a list of found PURLs to the specified path in the output
10+
image. There is no default.

Diff for: ‎docs/source/markdown/options/sbom-merge-strategy.md

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
####> This option file is used in:
2+
####> podman farm build
3+
####> If file is edited, make sure the changes
4+
####> are applicable to all of those.
5+
#### **--sbom-merge-strategy**=*method*
6+
7+
If more than one **--sbom-scanner-command** value is being used, use the
8+
specified method to merge the output from later commands with output from
9+
earlier commands. Recognized values include:
10+
11+
- cat
12+
Concatenate the files.
13+
- merge-cyclonedx-by-component-name-and-version
14+
Merge the "component" fields of JSON documents, ignoring values from
15+
documents when the combination of their "name" and "version" values is
16+
already present. Documents are processed in the order in which they are
17+
generated, which is the order in which the commands that generate them
18+
were specified.
19+
- merge-spdx-by-package-name-and-versioninfo
20+
Merge the "package" fields of JSON documents, ignoring values from
21+
documents when the combination of their "name" and "versionInfo" values is
22+
already present. Documents are processed in the order in which they are
23+
generated, which is the order in which the commands that generate them
24+
were specified.

Diff for: ‎docs/source/markdown/options/sbom-output.md

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
####> This option file is used in:
2+
####> podman farm build
3+
####> If file is edited, make sure the changes
4+
####> are applicable to all of those.
5+
#### **--sbom-output**=*file*
6+
7+
When generating SBOMs, store the generated SBOM in the named file on the local
8+
filesystem. There is no default.

Diff for: ‎docs/source/markdown/options/sbom-purl-output.md

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
####> This option file is used in:
2+
####> podman farm build
3+
####> If file is edited, make sure the changes
4+
####> are applicable to all of those.
5+
#### **--sbom-purl-output**=*file*
6+
7+
When generating SBOMs, scan them for PURL ([package
8+
URL](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst))
9+
information, and save a list of found PURLs to the named file in the local
10+
filesystem. There is no default.

Diff for: ‎docs/source/markdown/options/sbom-scanner-command.md

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
####> This option file is used in:
2+
####> podman farm build
3+
####> If file is edited, make sure the changes
4+
####> are applicable to all of those.
5+
#### **--sbom-scanner-command**=*image*
6+
7+
Generate SBOMs by running the specified command from the scanner image. If
8+
multiple commands are specified, they are run in the order in which they are
9+
specified. These text substitutions are performed:
10+
- {ROOTFS}
11+
The root of the built image's filesystem, bind mounted.
12+
- {CONTEXT}
13+
The build context and additional build contexts, bind mounted.
14+
- {OUTPUT}
15+
The name of a temporary output file, to be read and merged with others or copied elsewhere.

Diff for: ‎docs/source/markdown/options/sbom-scanner-image.md

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
####> This option file is used in:
2+
####> podman farm build
3+
####> If file is edited, make sure the changes
4+
####> are applicable to all of those.
5+
#### **--sbom-scanner-image**=*image*
6+
7+
Generate SBOMs using the specified scanner image.

Diff for: ‎docs/source/markdown/options/sbom.md

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
####> This option file is used in:
2+
####> podman farm build
3+
####> If file is edited, make sure the changes
4+
####> are applicable to all of those.
5+
#### **--sbom**=*preset*
6+
7+
Generate SBOMs (Software Bills Of Materials) for the output image by scanning
8+
the working container and build contexts using the named combination of scanner
9+
image, scanner commands, and merge strategy. Must be specified with one or
10+
more of **--sbom-image-output**, **--sbom-image-purl-output**, **--sbom-output**,
11+
and **--sbom-purl-output**. Recognized presets, and the set of options which
12+
they equate to:
13+
14+
- "syft", "syft-cyclonedx":
15+
--sbom-scanner-image=ghcr.io/anchore/syft
16+
--sbom-scanner-command="/syft scan -q dir:{ROOTFS} --output cyclonedx-json={OUTPUT}"
17+
--sbom-scanner-command="/syft scan -q dir:{CONTEXT} --output cyclonedx-json={OUTPUT}"
18+
--sbom-merge-strategy=merge-cyclonedx-by-component-name-and-version
19+
- "syft-spdx":
20+
--sbom-scanner-image=ghcr.io/anchore/syft
21+
--sbom-scanner-command="/syft scan -q dir:{ROOTFS} --output spdx-json={OUTPUT}"
22+
--sbom-scanner-command="/syft scan -q dir:{CONTEXT} --output spdx-json={OUTPUT}"
23+
--sbom-merge-strategy=merge-spdx-by-package-name-and-versioninfo
24+
- "trivy", "trivy-cyclonedx":
25+
--sbom-scanner-image=ghcr.io/aquasecurity/trivy
26+
--sbom-scanner-command="trivy filesystem -q {ROOTFS} --format cyclonedx --output {OUTPUT}"
27+
--sbom-scanner-command="trivy filesystem -q {CONTEXT} --format cyclonedx --output {OUTPUT}"
28+
--sbom-merge-strategy=merge-cyclonedx-by-component-name-and-version
29+
- "trivy-spdx":
30+
--sbom-scanner-image=ghcr.io/aquasecurity/trivy
31+
--sbom-scanner-command="trivy filesystem -q {ROOTFS} --format spdx-json --output {OUTPUT}"
32+
--sbom-scanner-command="trivy filesystem -q {CONTEXT} --format spdx-json --output {OUTPUT}"
33+
--sbom-merge-strategy=merge-spdx-by-package-name-and-versioninfo

Diff for: ‎docs/source/markdown/podman-build.1.md.in

+91
Original file line numberDiff line numberDiff line change
@@ -326,6 +326,97 @@ Pull image policy. The default is **missing**.
326326

327327
@@option runtime-flag
328328

329+
#### **--sbom**=*preset*
330+
331+
Generate SBOMs (Software Bills Of Materials) for the output image by scanning
332+
the working container and build contexts using the named combination of scanner
333+
image, scanner commands, and merge strategy. Must be specified with one or
334+
more of **--sbom-image-output**, **--sbom-image-purl-output**, **--sbom-output**,
335+
and **--sbom-purl-output**. Recognized presets, and the set of options which
336+
they equate to:
337+
338+
- "syft", "syft-cyclonedx":
339+
--sbom-scanner-image=ghcr.io/anchore/syft
340+
--sbom-scanner-command="/syft scan -q dir:{ROOTFS} --output cyclonedx-json={OUTPUT}"
341+
--sbom-scanner-command="/syft scan -q dir:{CONTEXT} --output cyclonedx-json={OUTPUT}"
342+
--sbom-merge-strategy=merge-cyclonedx-by-component-name-and-version
343+
- "syft-spdx":
344+
--sbom-scanner-image=ghcr.io/anchore/syft
345+
--sbom-scanner-command="/syft scan -q dir:{ROOTFS} --output spdx-json={OUTPUT}"
346+
--sbom-scanner-command="/syft scan -q dir:{CONTEXT} --output spdx-json={OUTPUT}"
347+
--sbom-merge-strategy=merge-spdx-by-package-name-and-versioninfo
348+
- "trivy", "trivy-cyclonedx":
349+
--sbom-scanner-image=ghcr.io/aquasecurity/trivy
350+
--sbom-scanner-command="trivy filesystem -q {ROOTFS} --format cyclonedx --output {OUTPUT}"
351+
--sbom-scanner-command="trivy filesystem -q {CONTEXT} --format cyclonedx --output {OUTPUT}"
352+
--sbom-merge-strategy=merge-cyclonedx-by-component-name-and-version
353+
- "trivy-spdx":
354+
--sbom-scanner-image=ghcr.io/aquasecurity/trivy
355+
--sbom-scanner-command="trivy filesystem -q {ROOTFS} --format spdx-json --output {OUTPUT}"
356+
--sbom-scanner-command="trivy filesystem -q {CONTEXT} --format spdx-json --output {OUTPUT}"
357+
--sbom-merge-strategy=merge-spdx-by-package-name-and-versioninfo
358+
359+
#### **--sbom-image-output**=*path*
360+
361+
When generating SBOMs, store the generated SBOM in the specified path in the
362+
output image. There is no default.
363+
364+
#### **--sbom-image-purl-output**=*path*
365+
366+
When generating SBOMs, scan them for PURL ([package
367+
URL](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst))
368+
information, and save a list of found PURLs to the specified path in the output
369+
image. There is no default.
370+
371+
#### **--sbom-merge-strategy**=*method*
372+
373+
If more than one **--sbom-scanner-command** value is being used, use the
374+
specified method to merge the output from later commands with output from
375+
earlier commands. Recognized values include:
376+
377+
- cat
378+
Concatenate the files.
379+
- merge-cyclonedx-by-component-name-and-version
380+
Merge the "component" fields of JSON documents, ignoring values from
381+
documents when the combination of their "name" and "version" values is
382+
already present. Documents are processed in the order in which they are
383+
generated, which is the order in which the commands that generate them
384+
were specified.
385+
- merge-spdx-by-package-name-and-versioninfo
386+
Merge the "package" fields of JSON documents, ignoring values from
387+
documents when the combination of their "name" and "versionInfo" values is
388+
already present. Documents are processed in the order in which they are
389+
generated, which is the order in which the commands that generate them
390+
were specified.
391+
392+
#### **--sbom-output**=*file*
393+
394+
When generating SBOMs, store the generated SBOM in the named file on the local
395+
filesystem. There is no default.
396+
397+
#### **--sbom-purl-output**=*file*
398+
399+
When generating SBOMs, scan them for PURL ([package
400+
URL](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst))
401+
information, and save a list of found PURLs to the named file in the local
402+
filesystem. There is no default.
403+
404+
#### **--sbom-scanner-command**=*image*
405+
406+
Generate SBOMs by running the specified command from the scanner image. If
407+
multiple commands are specified, they are run in the order in which they are
408+
specified. These text substitutions are performed:
409+
- {ROOTFS}
410+
The root of the built image's filesystem, bind mounted.
411+
- {CONTEXT}
412+
The build context and additional build contexts, bind mounted.
413+
- {OUTPUT}
414+
The name of a temporary output file, to be read and merged with others or copied elsewhere.
415+
416+
#### **--sbom-scanner-image**=*image*
417+
418+
Generate SBOMs using the specified scanner image.
419+
329420
@@option secret.image
330421

331422
@@option security-opt.image

Diff for: ‎docs/source/markdown/podman-farm-build.1.md.in

+16
Original file line numberDiff line numberDiff line change
@@ -179,6 +179,22 @@ Build only on farm nodes that match the given platforms.
179179

180180
@@option runtime-flag
181181

182+
@@option sbom
183+
184+
@@option sbom-image-output
185+
186+
@@option sbom-image-purl-output
187+
188+
@@option sbom-merge-strategy
189+
190+
@@option sbom-output
191+
192+
@@option sbom-purl-output
193+
194+
@@option sbom-scanner-command
195+
196+
@@option sbom-scanner-image
197+
182198
@@option secret.image
183199

184200
@@option security-opt.image

Diff for: ‎go.mod

+8-8
Original file line numberDiff line numberDiff line change
@@ -10,15 +10,15 @@ require (
1010
github.com/checkpoint-restore/checkpointctl v1.1.0
1111
github.com/checkpoint-restore/go-criu/v7 v7.0.0
1212
github.com/containernetworking/plugins v1.4.0
13-
github.com/containers/buildah v1.33.2-0.20231121195905-d1a1c53c8e1c
13+
github.com/containers/buildah v1.34.1-0.20240201124221-b850c711ff5c
1414
github.com/containers/common v0.57.1-0.20240130143645-b26099256b92
1515
github.com/containers/conmon v2.0.20+incompatible
1616
github.com/containers/gvisor-tap-vsock v0.7.2
1717
github.com/containers/image/v5 v5.29.2-0.20240130233108-e66a1ade2efc
1818
github.com/containers/libhvee v0.6.0
1919
github.com/containers/ocicrypt v1.1.9
2020
github.com/containers/psgo v1.8.0
21-
github.com/containers/storage v1.52.1-0.20240130205044-62997abeaf2f
21+
github.com/containers/storage v1.52.1-0.20240202181245-1419a5980565
2222
github.com/coreos/go-systemd/v22 v22.5.1-0.20231103132048-7d375ecc2b09
2323
github.com/coreos/stream-metadata-go v0.4.4
2424
github.com/crc-org/vfkit v0.5.0
@@ -43,6 +43,7 @@ require (
4343
github.com/mattn/go-shellwords v1.0.12
4444
github.com/mattn/go-sqlite3 v1.14.20
4545
github.com/mdlayher/vsock v1.2.1
46+
github.com/moby/sys/user v0.1.0
4647
github.com/moby/term v0.5.0
4748
github.com/nxadm/tail v1.4.11
4849
github.com/onsi/ginkgo/v2 v2.15.0
@@ -71,7 +72,7 @@ require (
7172
golang.org/x/sys v0.16.0
7273
golang.org/x/term v0.16.0
7374
golang.org/x/text v0.14.0
74-
google.golang.org/protobuf v1.31.0
75+
google.golang.org/protobuf v1.32.0
7576
gopkg.in/inf.v0 v0.9.1
7677
gopkg.in/yaml.v3 v3.0.1
7778
k8s.io/kubernetes v1.28.4
@@ -98,7 +99,7 @@ require (
9899
github.com/containerd/typeurl/v2 v2.1.1 // indirect
99100
github.com/containernetworking/cni v1.1.2 // indirect
100101
github.com/containers/libtrust v0.0.0-20230121012942-c1716e8a8d01 // indirect
101-
github.com/containers/luksy v0.0.0-20231030195837-b5a7f79da98b // indirect
102+
github.com/containers/luksy v0.0.0-20240129181507-b62d551ce6d8 // indirect
102103
github.com/coreos/go-oidc/v3 v3.9.0 // indirect
103104
github.com/coreos/go-systemd v0.0.0-20190719114852-fd7a80b32e1f // indirect
104105
github.com/cyberphone/json-canonicalization v0.0.0-20231217050601-ba74d44ecf5f // indirect
@@ -109,7 +110,7 @@ require (
109110
github.com/docker/docker-credential-helpers v0.8.1 // indirect
110111
github.com/felixge/httpsnoop v1.0.4 // indirect
111112
github.com/fsnotify/fsnotify v1.7.0 // indirect
112-
github.com/fsouza/go-dockerclient v1.10.0 // indirect
113+
github.com/fsouza/go-dockerclient v1.10.1 // indirect
113114
github.com/gabriel-vasile/mimetype v1.4.2 // indirect
114115
github.com/gin-contrib/sse v0.1.0 // indirect
115116
github.com/gin-gonic/gin v1.9.1 // indirect
@@ -160,11 +161,10 @@ require (
160161
github.com/miekg/pkcs11 v1.1.1 // indirect
161162
github.com/mistifyio/go-zfs/v3 v3.0.1 // indirect
162163
github.com/mitchellh/mapstructure v1.5.0 // indirect
163-
github.com/moby/buildkit v0.12.3 // indirect
164+
github.com/moby/buildkit v0.12.5 // indirect
164165
github.com/moby/patternmatcher v0.6.0 // indirect
165166
github.com/moby/sys/mountinfo v0.7.1 // indirect
166167
github.com/moby/sys/sequential v0.5.0 // indirect
167-
github.com/moby/sys/user v0.1.0 // indirect
168168
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
169169
github.com/modern-go/reflect2 v1.0.2 // indirect
170170
github.com/morikuni/aec v1.0.0 // indirect
@@ -220,4 +220,4 @@ require (
220220
tags.cncf.io/container-device-interface/specs-go v0.6.0 // indirect
221221
)
222222

223-
replace github.com/opencontainers/runc => github.com/opencontainers/runc v1.1.1-0.20230904132852-a0466dd76f23
223+
replace github.com/opencontainers/runc => github.com/opencontainers/runc v1.1.1-0.20240131200429-02120488a4c0

0 commit comments

Comments
 (0)