Merge pull request #3459 from flatcar/buildbot/weekly-portage-stable-package-updates-2025-11-03

Weekly portage-stable package updates 2025-11-03

Author: krnowak

.github/workflows/portage-stable-packages-list

@@ -79,6 +79,7 @@ app-alternatives/awk
 app-alternatives/bc
 app-alternatives/bzip2
 app-alternatives/cpio
+app-alternatives/gpg
 app-alternatives/gzip
 app-alternatives/lex
 app-alternatives/ninja

changelog/security/2025-11-05-weekly-updates.md

@@ -0,0 +1,2 @@
+- coreutils ([CVE-2025-5278](https://www.cve.org/CVERecord?id=CVE-2025-5278))
+- go ([CVE-2025-47912](https://www.cve.org/CVERecord?id=CVE-2025-47912), [CVE-2025-58183](https://www.cve.org/CVERecord?id=CVE-2025-58183), [CVE-2025-58185](https://www.cve.org/CVERecord?id=CVE-2025-58185), [CVE-2025-58186](https://www.cve.org/CVERecord?id=CVE-2025-58186), [CVE-2025-58187](https://www.cve.org/CVERecord?id=CVE-2025-58187), [CVE-2025-58188](https://www.cve.org/CVERecord?id=CVE-2025-58188), [CVE-2025-58189](https://www.cve.org/CVERecord?id=CVE-2025-58189), [CVE-2025-61723](https://www.cve.org/CVERecord?id=CVE-2025-61723), [CVE-2025-61724](https://www.cve.org/CVERecord?id=CVE-2025-61724), [CVE-2025-61725](https://www.cve.org/CVERecord?id=CVE-2025-61725))

changelog/updates/2025-11-05-weekly-updates.md

@@ -0,0 +1,19 @@
+- SDK: cmake ([4.1.2](https://cmake.org/cmake/help/v4.1/release/4.1.html#id22) (includes [4.1.1](https://cmake.org/cmake/help/v4.1/release/4.1.html#id21), [4.1](https://cmake.org/cmake/help/v4.1/release/4.1.html), [4.0](https://cmake.org/cmake/help/v4.0/release/4.0.html)))
+- SDK: go ([1.25.3](https://go.dev/doc/devel/release#go1.25.minor))
+- base, dev: btrfs-progs ([6.17](https://github.com/kdave/btrfs-progs/releases/tag/v6.17))
+- base, dev: cifs-utils ([7.4](https://lwn.net/Articles/1024956/))
+- base, dev: coreutils ([9.8](https://lists.gnu.org/archive/html/info-gnu/2025-09/msg00005.html))
+- base, dev: hwdata ([0.399](https://github.com/vcrhonek/hwdata/releases/tag/v0.399))
+- base, dev: inih ([62](https://github.com/benhoyt/inih/releases/tag/r62) (includes [61](https://github.com/benhoyt/inih/releases/tag/r61)))
+- base, dev: iproute2 ([6.17.0](https://lore.kernel.org/all/[email protected]/))
+- base, dev: kbd ([2.9.0](https://github.com/legionus/kbd/releases/tag/v2.9.0))
+- base, dev: libtirpc ([1.3.7](https://git.linux-nfs.org/?p=steved/libtirpc.git;a=log;h=refs/tags/libtirpc-1-3-7))
+- base, dev: samba ([4.22.5](https://www.samba.org/samba/history/samba-4.22.5.html) (includes [4.22.4](https://www.samba.org/samba/history/samba-4.22.4.html)))
+- base, dev: strace ([6.17](https://github.com/strace/strace/releases/tag/v6.17))
+- base, dev: util-linux ([2.41.2](https://github.com/util-linux/util-linux/blob/v2.41.2/Documentation/releases/v2.41.2-ReleaseNotes))
+- dev: portage ([3.0.69.3](https://gitweb.gentoo.org/proj/portage.git/tree/NEWS?h=portage-3.0.69.3) (includes [3.0.69.2](https://gitweb.gentoo.org/proj/portage.git/tree/NEWS?h=portage-3.0.69.2), [3.0.69.1](https://gitweb.gentoo.org/proj/portage.git/tree/NEWS?h=portage-3.0.69.1), [3.0.69](https://gitweb.gentoo.org/proj/portage.git/tree/NEWS?h=portage-3.0.69)))
+- sysext-overlaybd: overlaybd ([1.0.16](https://github.com/containerd/overlaybd/releases/tag/v1.0.16))
+- sysext-podman: netavark ([1.16.1](https://github.com/containers/netavark/releases/tag/v1.16.1) (includes [1.16.0](https://github.com/containers/netavark/releases/tag/v1.16.0)))
+- sysext-python: more-itertools ([10.8.0](https://github.com/more-itertools/more-itertools/releases/tag/v10.8.0))
+- sysext-python: setuptools-scm ([9.2.0](https://github.com/pypa/setuptools-scm/releases/tag/v9.2.0) (includes [9.1.0](https://github.com/pypa/setuptools-scm/releases/tag/v9.1.0), [9.0.0](https://github.com/pypa/setuptools-scm/releases/tag/v9.0.0)))
+- sysext-python: trove-classifiers ([2025.9.11.17](https://github.com/pypa/trove-classifiers/releases/tag/2025.9.11.17) (includes (2025.9.9.12)[https://github.com/pypa/trove-classifiers/releases/tag/2025.9.9.12], [2025.9.8.13](https://github.com/pypa/trove-classifiers/releases/tag/2025.9.8.13)))

sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords

@@ -56,9 +56,6 @@ dev-cpp/azure-security-keyvault-keys
 =dev-libs/cowsql-1.15.9 ~arm64
 =dev-libs/ding-libs-0.6.2-r1 ~arm64
 
-# CVE-2025-7039
-=dev-libs/glib-2.84.4 ~amd64 ~arm64
-
 # The only available ebuild (from GURU) has ~amd64 and no keyword for arm64 yet.
 =dev-libs/jose-12 **
 
@@ -74,16 +71,9 @@ dev-cpp/azure-security-keyvault-keys
 # Catalyst 4 is not stable yet, but earlier versions are masked now.
 =dev-util/catalyst-4.0.0 ~amd64 ~arm64
 
-# CVE-2025-7039
-=dev-util/gdbus-codegen-2.84.4 ~amd64 ~arm64
-=dev-util/glib-utils-2.84.4 ~amd64 ~arm64
-
 # Keep versions on both arches in sync.
 =net-firewall/conntrack-tools-1.4.8-r1 ~arm64
 
-# Needed to address CVE-2025-2312.
-=net-fs/cifs-utils-7.3 ~amd64 ~arm64
-
 # Keep versions on both arches in sync.
 =net-libs/libnetfilter_cthelper-1.0.1-r1 ~arm64
 =net-libs/libnetfilter_cttimeout-1.0.1 ~arm64
@@ -100,6 +90,7 @@ dev-cpp/azure-security-keyvault-keys
 sys-apps/azure-vm-utils
 
 # Keep versions on both arches in sync.
+=sys-apps/coreutils-9.8-r1 ~amd64
 =sys-apps/zram-generator-1.2.1 ~arm64
 =sys-auth/sssd-2.9.7 ~arm64
 =sys-boot/mokutil-0.7.2 **
@@ -108,9 +99,7 @@ sys-apps/azure-vm-utils
 =sys-cluster/ipvsadm-1.31-r1 ~arm64
 
 # Keep versions on both arches in sync.
-=sys-devel/binutils-2.45-r1 ~arm64
 =sys-fs/lxcfs-6.0.4 ~arm64
-=sys-libs/binutils-libs-2.45-r1 ~arm64
 
 =app-containers/containerd-2.1* ~amd64 ~arm64
 =app-containers/runc-1.3* ~amd64 ~arm64

sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use.force

@@ -7,6 +7,7 @@ app-alternatives/awk gawk
 app-alternatives/bc gnu
 app-alternatives/bzip2 reference
 app-alternatives/cpio gnu
+app-alternatives/gpg reference
 app-alternatives/gzip reference
 app-alternatives/lex flex
 app-alternatives/ninja reference

sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use.mask

@@ -1,5 +1,5 @@
-# We don't ship GnuTLS by default, and smartcard has a dep loop
-app-crypt/gnupg smartcard ssl
+# Smartcard has a dep loop.
+app-crypt/gnupg smartcard
 
 # Our ISOs are not built with Catalyst.
 dev-util/catalyst iso

sdk_container/src/third_party/coreos-overlay/sys-fs/overlaybd/files/0001-Patch-Photon-after-fetching-to-fix-cross-issues.patch

@@ -0,0 +1,25 @@
+From 72d823c414a1416dffc2276e5a0a17f03c5e4549 Mon Sep 17 00:00:00 2001
+From: James Le Cuirot <[email protected]>
+Date: Mon, 28 Jul 2025 12:16:50 +0100
+Subject: [PATCH 1/2] Patch Photon after fetching to fix cross issues
+
+Signed-off-by: James Le Cuirot <[email protected]>
+---
+ CMake/Findphoton.cmake | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/CMake/Findphoton.cmake b/CMake/Findphoton.cmake
+index c905bd9..5507f66 100644
+--- a/CMake/Findphoton.cmake
++++ b/CMake/Findphoton.cmake
+@@ -6,6 +6,7 @@ FetchContent_Declare(
+   photon
+   GIT_REPOSITORY https://github.com/alibaba/PhotonLibOS.git
+   GIT_TAG v0.6.17
++  PATCH_COMMAND patch -p1 -i @FILESDIR@/photon-cross.patch
+ )
+ 
+ if(BUILD_TESTING)
+-- 
+2.51.0
+

sdk_container/src/third_party/coreos-overlay/sys-fs/overlaybd/files/0002-Patch-yaml-cpp-after-fetching-to-fix-cmake-issues.patch

@@ -0,0 +1,25 @@
+From eae89e8432d993417e6f0e17ae519b4e02f72c9b Mon Sep 17 00:00:00 2001
+From: Krzesimir Nowak <[email protected]>
+Date: Fri, 7 Nov 2025 12:06:05 +0100
+Subject: [PATCH 2/2] Patch yaml-cpp after fetching to fix cmake issues
+
+Signed-off-by: Krzesimir Nowak <[email protected]>
+---
+ CMakeLists.txt | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 753b081..03b2ab9 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -53,6 +53,7 @@ if (NOT yaml-cpp_FOUND)
+     yaml-cpp
+     GIT_REPOSITORY https://github.com/jbeder/yaml-cpp.git
+     GIT_TAG 0.8.0
++    PATCH_COMMAND patch -p1 -i @FILESDIR@/yaml-cpp-cmake-4.0.patch
+   )
+   FetchContent_MakeAvailable(yaml-cpp)
+ endif()
+-- 
+2.51.0
+