Skip to content

Commit 2818abf

Browse files
mheonmheon
committed
Update to runc main, removing pin to an older version
We were pinned to a specific commit to ensure that tests kept passing. Hopefully they pass now, as we need to grab latest runc for CVE fixes. Also grab Buildah main to fix a build issue on FreeBSD. After a botched manual vendor, I used Ed's treadmill script and squashed it into this commit to make Git happy. Thanks bunches Ed. Signed-off-by: Matt Heon <[email protected]>
1 parent 5e64d4f commit 2818abf

File tree

174 files changed

+22578
-920
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

174 files changed

+22578
-920
lines changed

‎docs/source/markdown/options/sbom-image-output.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
####> This option file is used in:
2+
####> podman farm build
3+
####> If file is edited, make sure the changes
4+
####> are applicable to all of those.
5+
#### **--sbom-image-output**=*path*
6+
7+
When generating SBOMs, store the generated SBOM in the specified path in the
8+
output image. There is no default.

‎docs/source/markdown/options/sbom-image-purl-output.md

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
####> This option file is used in:
2+
####> podman farm build
3+
####> If file is edited, make sure the changes
4+
####> are applicable to all of those.
5+
#### **--sbom-image-purl-output**=*path*
6+
7+
When generating SBOMs, scan them for PURL ([package
8+
URL](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst))
9+
information, and save a list of found PURLs to the specified path in the output
10+
image. There is no default.

‎docs/source/markdown/options/sbom-merge-strategy.md

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
####> This option file is used in:
2+
####> podman farm build
3+
####> If file is edited, make sure the changes
4+
####> are applicable to all of those.
5+
#### **--sbom-merge-strategy**=*method*
6+
7+
If more than one **--sbom-scanner-command** value is being used, use the
8+
specified method to merge the output from later commands with output from
9+
earlier commands. Recognized values include:
10+
11+
- cat
12+
Concatenate the files.
13+
- merge-cyclonedx-by-component-name-and-version
14+
Merge the "component" fields of JSON documents, ignoring values from
15+
documents when the combination of their "name" and "version" values is
16+
already present. Documents are processed in the order in which they are
17+
generated, which is the order in which the commands that generate them
18+
were specified.
19+
- merge-spdx-by-package-name-and-versioninfo
20+
Merge the "package" fields of JSON documents, ignoring values from
21+
documents when the combination of their "name" and "versionInfo" values is
22+
already present. Documents are processed in the order in which they are
23+
generated, which is the order in which the commands that generate them
24+
were specified.

‎docs/source/markdown/options/sbom-output.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
####> This option file is used in:
2+
####> podman farm build
3+
####> If file is edited, make sure the changes
4+
####> are applicable to all of those.
5+
#### **--sbom-output**=*file*
6+
7+
When generating SBOMs, store the generated SBOM in the named file on the local
8+
filesystem. There is no default.

‎docs/source/markdown/options/sbom-purl-output.md

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
####> This option file is used in:
2+
####> podman farm build
3+
####> If file is edited, make sure the changes
4+
####> are applicable to all of those.
5+
#### **--sbom-purl-output**=*file*
6+
7+
When generating SBOMs, scan them for PURL ([package
8+
URL](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst))
9+
information, and save a list of found PURLs to the named file in the local
10+
filesystem. There is no default.

‎docs/source/markdown/options/sbom-scanner-command.md

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
####> This option file is used in:
2+
####> podman farm build
3+
####> If file is edited, make sure the changes
4+
####> are applicable to all of those.
5+
#### **--sbom-scanner-command**=*image*
6+
7+
Generate SBOMs by running the specified command from the scanner image. If
8+
multiple commands are specified, they are run in the order in which they are
9+
specified. These text substitutions are performed:
10+
- {ROOTFS}
11+
The root of the built image's filesystem, bind mounted.
12+
- {CONTEXT}
13+
The build context and additional build contexts, bind mounted.
14+
- {OUTPUT}
15+
The name of a temporary output file, to be read and merged with others or copied elsewhere.

‎docs/source/markdown/options/sbom-scanner-image.md

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
####> This option file is used in:
2+
####> podman farm build
3+
####> If file is edited, make sure the changes
4+
####> are applicable to all of those.
5+
#### **--sbom-scanner-image**=*image*
6+
7+
Generate SBOMs using the specified scanner image.

‎docs/source/markdown/options/sbom.md

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
####> This option file is used in:
2+
####> podman farm build
3+
####> If file is edited, make sure the changes
4+
####> are applicable to all of those.
5+
#### **--sbom**=*preset*
6+
7+
Generate SBOMs (Software Bills Of Materials) for the output image by scanning
8+
the working container and build contexts using the named combination of scanner
9+
image, scanner commands, and merge strategy. Must be specified with one or
10+
more of **--sbom-image-output**, **--sbom-image-purl-output**, **--sbom-output**,
11+
and **--sbom-purl-output**. Recognized presets, and the set of options which
12+
they equate to:
13+
14+
- "syft", "syft-cyclonedx":
15+
--sbom-scanner-image=ghcr.io/anchore/syft
16+
--sbom-scanner-command="/syft scan -q dir:{ROOTFS} --output cyclonedx-json={OUTPUT}"
17+
--sbom-scanner-command="/syft scan -q dir:{CONTEXT} --output cyclonedx-json={OUTPUT}"
18+
--sbom-merge-strategy=merge-cyclonedx-by-component-name-and-version
19+
- "syft-spdx":
20+
--sbom-scanner-image=ghcr.io/anchore/syft
21+
--sbom-scanner-command="/syft scan -q dir:{ROOTFS} --output spdx-json={OUTPUT}"
22+
--sbom-scanner-command="/syft scan -q dir:{CONTEXT} --output spdx-json={OUTPUT}"
23+
--sbom-merge-strategy=merge-spdx-by-package-name-and-versioninfo
24+
- "trivy", "trivy-cyclonedx":
25+
--sbom-scanner-image=ghcr.io/aquasecurity/trivy
26+
--sbom-scanner-command="trivy filesystem -q {ROOTFS} --format cyclonedx --output {OUTPUT}"
27+
--sbom-scanner-command="trivy filesystem -q {CONTEXT} --format cyclonedx --output {OUTPUT}"
28+
--sbom-merge-strategy=merge-cyclonedx-by-component-name-and-version
29+
- "trivy-spdx":
30+
--sbom-scanner-image=ghcr.io/aquasecurity/trivy
31+
--sbom-scanner-command="trivy filesystem -q {ROOTFS} --format spdx-json --output {OUTPUT}"
32+
--sbom-scanner-command="trivy filesystem -q {CONTEXT} --format spdx-json --output {OUTPUT}"
33+
--sbom-merge-strategy=merge-spdx-by-package-name-and-versioninfo

‎docs/source/markdown/podman-build.1.md.in

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -326,6 +326,97 @@ Pull image policy. The default is **missing**.
326326

327327
@@option runtime-flag
328328

329+
#### **--sbom**=*preset*
330+
331+
Generate SBOMs (Software Bills Of Materials) for the output image by scanning
332+
the working container and build contexts using the named combination of scanner
333+
image, scanner commands, and merge strategy. Must be specified with one or
334+
more of **--sbom-image-output**, **--sbom-image-purl-output**, **--sbom-output**,
335+
and **--sbom-purl-output**. Recognized presets, and the set of options which
336+
they equate to:
337+
338+
- "syft", "syft-cyclonedx":
339+
--sbom-scanner-image=ghcr.io/anchore/syft
340+
--sbom-scanner-command="/syft scan -q dir:{ROOTFS} --output cyclonedx-json={OUTPUT}"
341+
--sbom-scanner-command="/syft scan -q dir:{CONTEXT} --output cyclonedx-json={OUTPUT}"
342+
--sbom-merge-strategy=merge-cyclonedx-by-component-name-and-version
343+
- "syft-spdx":
344+
--sbom-scanner-image=ghcr.io/anchore/syft
345+
--sbom-scanner-command="/syft scan -q dir:{ROOTFS} --output spdx-json={OUTPUT}"
346+
--sbom-scanner-command="/syft scan -q dir:{CONTEXT} --output spdx-json={OUTPUT}"
347+
--sbom-merge-strategy=merge-spdx-by-package-name-and-versioninfo
348+
- "trivy", "trivy-cyclonedx":
349+
--sbom-scanner-image=ghcr.io/aquasecurity/trivy
350+
--sbom-scanner-command="trivy filesystem -q {ROOTFS} --format cyclonedx --output {OUTPUT}"
351+
--sbom-scanner-command="trivy filesystem -q {CONTEXT} --format cyclonedx --output {OUTPUT}"
352+
--sbom-merge-strategy=merge-cyclonedx-by-component-name-and-version
353+
- "trivy-spdx":
354+
--sbom-scanner-image=ghcr.io/aquasecurity/trivy
355+
--sbom-scanner-command="trivy filesystem -q {ROOTFS} --format spdx-json --output {OUTPUT}"
356+
--sbom-scanner-command="trivy filesystem -q {CONTEXT} --format spdx-json --output {OUTPUT}"
357+
--sbom-merge-strategy=merge-spdx-by-package-name-and-versioninfo
358+
359+
#### **--sbom-image-output**=*path*
360+
361+
When generating SBOMs, store the generated SBOM in the specified path in the
362+
output image. There is no default.
363+
364+
#### **--sbom-image-purl-output**=*path*
365+
366+
When generating SBOMs, scan them for PURL ([package
367+
URL](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst))
368+
information, and save a list of found PURLs to the specified path in the output
369+
image. There is no default.
370+
371+
#### **--sbom-merge-strategy**=*method*
372+
373+
If more than one **--sbom-scanner-command** value is being used, use the
374+
specified method to merge the output from later commands with output from
375+
earlier commands. Recognized values include:
376+
377+
- cat
378+
Concatenate the files.
379+
- merge-cyclonedx-by-component-name-and-version
380+
Merge the "component" fields of JSON documents, ignoring values from
381+
documents when the combination of their "name" and "version" values is
382+
already present. Documents are processed in the order in which they are
383+
generated, which is the order in which the commands that generate them
384+
were specified.
385+
- merge-spdx-by-package-name-and-versioninfo
386+
Merge the "package" fields of JSON documents, ignoring values from
387+
documents when the combination of their "name" and "versionInfo" values is
388+
already present. Documents are processed in the order in which they are
389+
generated, which is the order in which the commands that generate them
390+
were specified.
391+
392+
#### **--sbom-output**=*file*
393+
394+
When generating SBOMs, store the generated SBOM in the named file on the local
395+
filesystem. There is no default.
396+
397+
#### **--sbom-purl-output**=*file*
398+
399+
When generating SBOMs, scan them for PURL ([package
400+
URL](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst))
401+
information, and save a list of found PURLs to the named file in the local
402+
filesystem. There is no default.
403+
404+
#### **--sbom-scanner-command**=*image*
405+
406+
Generate SBOMs by running the specified command from the scanner image. If
407+
multiple commands are specified, they are run in the order in which they are
408+
specified. These text substitutions are performed:
409+
- {ROOTFS}
410+
The root of the built image's filesystem, bind mounted.
411+
- {CONTEXT}
412+
The build context and additional build contexts, bind mounted.
413+
- {OUTPUT}
414+
The name of a temporary output file, to be read and merged with others or copied elsewhere.
415+
416+
#### **--sbom-scanner-image**=*image*
417+
418+
Generate SBOMs using the specified scanner image.
419+
329420
@@option secret.image
330421

331422
@@option security-opt.image

‎docs/source/markdown/podman-farm-build.1.md.in

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -179,6 +179,22 @@ Build only on farm nodes that match the given platforms.
179179

180180
@@option runtime-flag
181181

182+
@@option sbom
183+
184+
@@option sbom-image-output
185+
186+
@@option sbom-image-purl-output
187+
188+
@@option sbom-merge-strategy
189+
190+
@@option sbom-output
191+
192+
@@option sbom-purl-output
193+
194+
@@option sbom-scanner-command
195+
196+
@@option sbom-scanner-image
197+
182198
@@option secret.image
183199

184200
@@option security-opt.image

‎go.mod

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ require (
1010
github.com/checkpoint-restore/checkpointctl v1.1.0
1111
github.com/checkpoint-restore/go-criu/v7 v7.0.0
1212
github.com/containernetworking/plugins v1.4.0
13-
github.com/containers/buildah v1.33.2-0.20231121195905-d1a1c53c8e1c
13+
github.com/containers/buildah v1.34.1-0.20240201124221-b850c711ff5c
1414
github.com/containers/common v0.57.1-0.20240130143645-b26099256b92
1515
github.com/containers/conmon v2.0.20+incompatible
1616
github.com/containers/gvisor-tap-vsock v0.7.2
@@ -91,14 +91,15 @@ require (
9191
github.com/chenzhuoyu/base64x v0.0.0-20230717121745-296ad89f973d // indirect
9292
github.com/chenzhuoyu/iasm v0.9.0 // indirect
9393
github.com/chzyer/readline v1.5.1 // indirect
94+
github.com/cilium/ebpf v0.9.1 // indirect
9495
github.com/containerd/cgroups/v3 v3.0.2 // indirect
9596
github.com/containerd/containerd v1.7.12 // indirect
9697
github.com/containerd/log v0.1.0 // indirect
9798
github.com/containerd/stargz-snapshotter/estargz v0.15.1 // indirect
9899
github.com/containerd/typeurl/v2 v2.1.1 // indirect
99100
github.com/containernetworking/cni v1.1.2 // indirect
100101
github.com/containers/libtrust v0.0.0-20230121012942-c1716e8a8d01 // indirect
101-
github.com/containers/luksy v0.0.0-20231030195837-b5a7f79da98b // indirect
102+
github.com/containers/luksy v0.0.0-20240129181507-b62d551ce6d8 // indirect
102103
github.com/coreos/go-oidc/v3 v3.9.0 // indirect
103104
github.com/coreos/go-systemd v0.0.0-20190719114852-fd7a80b32e1f // indirect
104105
github.com/cyberphone/json-canonicalization v0.0.0-20231217050601-ba74d44ecf5f // indirect
@@ -109,7 +110,7 @@ require (
109110
github.com/docker/docker-credential-helpers v0.8.1 // indirect
110111
github.com/felixge/httpsnoop v1.0.4 // indirect
111112
github.com/fsnotify/fsnotify v1.7.0 // indirect
112-
github.com/fsouza/go-dockerclient v1.10.0 // indirect
113+
github.com/fsouza/go-dockerclient v1.10.1 // indirect
113114
github.com/gabriel-vasile/mimetype v1.4.2 // indirect
114115
github.com/gin-contrib/sse v0.1.0 // indirect
115116
github.com/gin-gonic/gin v1.9.1 // indirect
@@ -160,7 +161,7 @@ require (
160161
github.com/miekg/pkcs11 v1.1.1 // indirect
161162
github.com/mistifyio/go-zfs/v3 v3.0.1 // indirect
162163
github.com/mitchellh/mapstructure v1.5.0 // indirect
163-
github.com/moby/buildkit v0.12.3 // indirect
164+
github.com/moby/buildkit v0.12.5 // indirect
164165
github.com/moby/patternmatcher v0.6.0 // indirect
165166
github.com/moby/sys/mountinfo v0.7.1 // indirect
166167
github.com/moby/sys/sequential v0.5.0 // indirect
@@ -219,5 +220,3 @@ require (
219220
gopkg.in/yaml.v2 v2.4.0 // indirect
220221
tags.cncf.io/container-device-interface/specs-go v0.6.0 // indirect
221222
)
222-
223-
replace github.com/opencontainers/runc => github.com/opencontainers/runc v1.1.1-0.20230904132852-a0466dd76f23

0 commit comments

Comments
 (0)