Weekly portage-stable package updates 2025-09-01

changelog/security/2025-09-03-weekly-updates.md

@@ -0,0 +1,6 @@
+- vim ([CVE-2025-53905](https://www.cve.org/CVERecord?id=CVE-2025-53905), [CVE-2025-53906](https://www.cve.org/CVERecord?id=CVE-2025-53906), [CVE-2025-9390](https://www.cve.org/CVERecord?id=CVE-2025-9390))
+- go ([CVE-2025-47906](https://www.cve.org/CVERecord?id=CVE-2025-47906), [CVE-2025-47907](https://www.cve.org/CVERecord?id=CVE-2025-47907))
+- glib ([CVE-2025-7039](https://www.cve.org/CVERecord?id=CVE-2025-7039))
+- gnutls ([CVE-2025-32988](https://www.cve.org/CVERecord?id=CVE-2025-32988), [CVE-2025-32989](https://www.cve.org/CVERecord?id=CVE-2025-32989), [CVE-2025-32990](https://www.cve.org/CVERecord?id=CVE-2025-32990), [CVE-2025-6395](https://www.cve.org/CVERecord?id=CVE-2025-6395))
+- iperf ([CVE-2025-54349](https://www.cve.org/CVERecord?id=CVE-2025-54349), [CVE-2025-54350](https://www.cve.org/CVERecord?id=CVE-2025-54350), [CVE-2025-54351](https://www.cve.org/CVERecord?id=CVE-2025-54351))
+- glibc ([CVE-2025-8058](https://www.cve.org/CVERecord?id=CVE-2025-8058))

changelog/updates/2025-09-03-weekly-updates.md

@@ -0,0 +1,29 @@
+- SDK: gnu-efi ([4.0.2](https://github.com/ncroxon/gnu-efi/releases/tag/4.0.2))
+- SDK: go ([1.24.6](https://go.dev/doc/devel/release#go1.24.minor))
+- SDK: rust ([1.88.0](https://blog.rust-lang.org/2025/06/26/Rust-1.88.0/))
+- SDK: sbsigntools ([0.9.5](https://git.kernel.org/pub/scm/linux/kernel/git/jejb/sbsigntools.git/commit/?h=v0.9.5&id=9cfca9fe7aa7a8e29b92fe33ce8433e212c9a8ba))
+- base, dev: azure-vm-utils ([0.7.0](https://github.com/Azure/azure-vm-utils/releases/tag/v0.7.0))
+- base, dev: cryptsetup ([2.8.0](https://gitlab.com/cryptsetup/cryptsetup/-/blob/v2.8.0/docs/v2.8.0-ReleaseNotes))
+- base, dev: curl ([8.15.0](https://curl.se/ch/8.15.0.html))
+- base, dev: e2fsprogs ([1.47.3](https://e2fsprogs.sourceforge.net/e2fsprogs-release.html#1.47.3))
+- base, dev: glib ([2.84.4](https://gitlab.gnome.org/GNOME/glib/-/releases/2.84.4))
+- base, dev: gnutls ([3.8.10](https://lists.gnupg.org/pipermail/gnutls-help/2025-July/004883.html))
+- base, dev: kmod ([34.2](https://lwn.net/Articles/1011365/))
+- base, dev: libsodium ([1.0.20_p20250606](https://raw.githubusercontent.com/jedisct1/libsodium/7e024fbf096c84bef866b21f521c516591908bef/ChangeLog))
+- base, dev: lsof ([4.99.5](https://github.com/lsof-org/lsof/releases/tag/4.99.5))
+- base, dev: ncurses ([6.5_p20250531](https://invisible-island.net/ncurses/NEWS.html#t20250531))
+- base, dev: nettle ([3.10.2](https://git.lysator.liu.se/nettle/nettle/-/raw/nettle_3.10.2_release_20250626/ChangeLog))
+- base, dev: nvidia-drivers-service (arm64) (570.172.08)
+- base, dev: openssl ([3.4.2](https://github.com/openssl/openssl/releases/tag/openssl-3.4.2))
+- base, dev: pciutils ([3.14.0](https://git.kernel.org/pub/scm/utils/pciutils/pciutils.git/plain/ChangeLog?h=v3.14.0))
+- base, dev: pkgconf ([2.5.1](https://raw.githubusercontent.com/pkgconf/pkgconf/refs/tags/pkgconf-2.5.1/NEWS) (includes [2.5.0](https://raw.githubusercontent.com/pkgconf/pkgconf/refs/tags/pkgconf-2.5.0/NEWS)))
+- base, dev: selinux ([2.20250213](https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20250213))
+- base, dev: sudo ([1.9.17_p2](https://github.com/sudo-project/sudo/releases/tag/v1.9.17p2))
+- base, dev: vim ([9.1.1652](https://github.com/vim/vim/commits/v9.1.1652/))
+- dev: gnuconfig ([20250710](https://cgit.git.savannah.gnu.org/cgit/config.git/log/?id=a2287c3041a3f2a204eb942e09c015eab00dc7dd))
+- dev: iperf ([3.19.1](https://github.com/esnet/iperf/releases/tag/3.19.1))
+- sysext-incus, sysext-podman, vmware: fuse ([3.17.3](https://raw.githubusercontent.com/libfuse/libfuse/refs/tags/fuse-3.17.3/ChangeLog.rst))
+- sysext-incus: cowsql ([1.15.9](https://github.com/cowsql/cowsql/commits/v1.15.9/))
+- sysext-nvidia-drivers-570, sysext-nvidia-drivers-570-open: nvidia-drivers (570.181)
+- sysext-python: rich ([14.1.0](https://github.com/Textualize/rich/releases/tag/v14.1.0))
+- sysext-python: truststore ([0.10.4](https://raw.githubusercontent.com/sethmlarson/truststore/refs/tags/v0.10.4/CHANGELOG.md))

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/flatcar-selinux-patches/0001-Flatcar-modifications.patch

@@ -1,4 +1,4 @@
-From b4725fecc9298279266ecfd842536b1b1c03cdb0 Mon Sep 17 00:00:00 2001
+From 9398464fe4d29cb3e9ad3c04c2c749747438fb65 Mon Sep 17 00:00:00 2001
 From: Krzesimir Nowak <knowak@microsoft.com>
 Date: Mon, 4 Dec 2023 12:17:25 +0100
 Subject: [PATCH] Flatcar modifications
@@ -55,7 +55,7 @@ index 63d2f9cb8..62dff5f94 100644
  dev_read_rand(traceroute_t)
  dev_read_urand(traceroute_t)
 diff --git a/refpolicy/policy/modules/kernel/corenetwork.if.in b/refpolicy/policy/modules/kernel/corenetwork.if.in
-index bc1535469..d057c4031 100644
+index 1f0ad3df4..6a1cdba0e 100644
 --- a/refpolicy/policy/modules/kernel/corenetwork.if.in
 +++ b/refpolicy/policy/modules/kernel/corenetwork.if.in
 @@ -877,6 +877,32 @@ interface(`corenet_sctp_bind_generic_node',`
@@ -115,10 +115,10 @@ index b1649ec3a..ca612de44 100644
  # Infiniband
  corenet_ib_access_all_pkeys(corenet_unconfined_type)
 diff --git a/refpolicy/policy/modules/kernel/files.if b/refpolicy/policy/modules/kernel/files.if
-index 778e82713..d1bd353e0 100644
+index 709a1b71b..73b17285e 100644
 --- a/refpolicy/policy/modules/kernel/files.if
 +++ b/refpolicy/policy/modules/kernel/files.if
-@@ -8065,3 +8065,48 @@ interface(`files_relabel_all_pidfiles',`
+@@ -8118,3 +8118,48 @@ interface(`files_relabel_all_pidfiles',`
  	relabel_files_pattern($1, pidfile, pidfile)
  	relabel_lnk_files_pattern($1, pidfile, pidfile)
  ')
@@ -168,10 +168,10 @@ index 778e82713..d1bd353e0 100644
 +	relabelfrom_chr_files_pattern($1, { file_type -policy_config_t $2 }, { file_type -policy_config_t $2 })
 +')
 diff --git a/refpolicy/policy/modules/kernel/kernel.te b/refpolicy/policy/modules/kernel/kernel.te
-index b791ebc71..c80159473 100644
+index 6d8ec0f77..df620faef 100644
 --- a/refpolicy/policy/modules/kernel/kernel.te
 +++ b/refpolicy/policy/modules/kernel/kernel.te
-@@ -377,6 +377,131 @@ files_mounton_default(kernel_t)
+@@ -374,6 +374,131 @@ files_mounton_default(kernel_t)
 
  mcs_process_set_categories(kernel_t)
 
@@ -321,7 +321,7 @@ index f98e68ba0..045b1b5b2 100644
  /run/containers(/.*)?		gen_context(system_u:object_r:container_runtime_t,s0)
  /run/crun(/.*)?		gen_context(system_u:object_r:container_runtime_t,s0)
 diff --git a/refpolicy/policy/modules/services/container.te b/refpolicy/policy/modules/services/container.te
-index 8fcd88e1e..ab16ff8b7 100644
+index c71ae54f4..a231f7664 100644
 --- a/refpolicy/policy/modules/services/container.te
 +++ b/refpolicy/policy/modules/services/container.te
 @@ -58,6 +58,52 @@ gen_tunable(container_use_dri, false)
@@ -386,7 +386,7 @@ index 8fcd88e1e..ab16ff8b7 100644
 
  ## <desc>
  ##	<p>
-@@ -1247,3 +1293,125 @@ optional_policy(`
+@@ -1249,3 +1295,125 @@ optional_policy(`
         unconfined_domain_noaudit(spc_user_t)
         domain_ptrace_all_domains(spc_user_t)
  ')
@@ -513,12 +513,12 @@ index 8fcd88e1e..ab16ff8b7 100644
 +#
 +allow container_t tmp_t:file { read };
 diff --git a/refpolicy/policy/modules/system/init.te b/refpolicy/policy/modules/system/init.te
-index 796426508..e1761f8fd 100644
+index 1320f7aae..61ead9795 100644
 --- a/refpolicy/policy/modules/system/init.te
 +++ b/refpolicy/policy/modules/system/init.te
-@@ -1686,3 +1686,11 @@ optional_policy(`
- 	userdom_dontaudit_rw_all_users_stream_sockets(systemprocess)
+@@ -1728,3 +1728,11 @@ optional_policy(`
  	userdom_dontaudit_write_user_tmp_files(systemprocess)
+ 	userdom_dontaudit_use_user_terminals(systemprocess)
  ')
 +
 +#
@@ -529,27 +529,27 @@ index 796426508..e1761f8fd 100644
 +require { type unconfined_t; }
 +allow init_t unconfined_t:file exec_file_perms;
 diff --git a/refpolicy/policy/modules/system/locallogin.te b/refpolicy/policy/modules/system/locallogin.te
-index 9534db006..e60eb7b59 100644
+index 995c80be2..933278d2f 100644
 --- a/refpolicy/policy/modules/system/locallogin.te
 +++ b/refpolicy/policy/modules/system/locallogin.te
 @@ -34,7 +34,14 @@ role system_r types sulogin_t;
 
  allow local_login_t self:capability { chown dac_override dac_read_search fowner fsetid kill setgid setuid sys_nice sys_resource sys_tty_config };
  dontaudit local_login_t self:capability net_admin;
--allow local_login_t self:process { getcap setcap setexec setrlimit setsched };
+-allow local_login_t self:process { getcap setcap setexec setrlimit setsched signal };
 +#
 +# FLATCAR:
 +#
 +# Added setpgid here.
 +#
 +# TODO: What AVC does this fix?
 +#
-+allow local_login_t self:process { setpgid getcap setcap setexec setrlimit setsched };
++allow local_login_t self:process { setpgid getcap setcap setexec setrlimit setsched signal };
  allow local_login_t self:fd use;
  allow local_login_t self:fifo_file rw_fifo_file_perms;
  allow local_login_t self:sock_file read_sock_file_perms;
 diff --git a/refpolicy/policy/modules/system/logging.te b/refpolicy/policy/modules/system/logging.te
-index ed01f0e4a..9504b6e72 100644
+index 14d3132be..ce40abc52 100644
 --- a/refpolicy/policy/modules/system/logging.te
 +++ b/refpolicy/policy/modules/system/logging.te
 @@ -507,6 +507,15 @@ userdom_dontaudit_search_user_home_dirs(syslogd_t)
@@ -569,5 +569,5 @@ index ed01f0e4a..9504b6e72 100644
  	allow syslogd_t self:netlink_audit_socket connected_socket_perms;
  	allow syslogd_t self:capability2 audit_read;
 -- 
-2.34.1
+2.49.1
 

sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords

@@ -32,16 +32,15 @@ app-crypt/azure-keyvault-pkcs11
 # The only available ebuild (from GURU) has ~amd64 and no keyword for arm64 yet.
 =app-crypt/clevis-19-r1 **
 
-# Needed to address CVE-2025-1215, CVE-2025-22134, CVE-2025-24014, GHSA-63p5-mwg2-787v, CVE-2025-27423, CVE-2025-29768
-=app-editors/vim-9.1.1436 ~amd64 ~arm64
-=app-editors/vim-core-9.1.1436 ~amd64 ~arm64
+# Needed to address the ever-growing list of CVEs
+=app-editors/vim-9.1.1652 ~amd64 ~arm64
+=app-editors/vim-core-9.1.1652 ~amd64 ~arm64
 
 # Needed by arm64-native SDK.
 =app-emulation/open-vmdk-1.0 *
 
 # Keep versions on both arches in sync.
 =app-emulation/qemu-guest-agent-9.2.0 ~arm64
-=dev-build/meson-1.7.2 ~arm64
 
 # Packages are in Gentoo but not expected to be used outside Flatcar, so they
 # are generally never stabilised. Thus an unusual form is used to pick up the
@@ -51,21 +50,18 @@ dev-cpp/azure-identity
 dev-cpp/azure-security-keyvault-certificates
 dev-cpp/azure-security-keyvault-keys
 
-# CVE-2025-4674
-=dev-lang/go-1.24.5-r1 ~arm64 ~amd64
-
 # Keep versions on both arches in sync.
 =dev-lang/yasm-1.3.0-r1 ~arm64
-=dev-libs/cowsql-1.15.8 ~arm64
+=dev-libs/cowsql-1.15.9 ~arm64
 =dev-libs/ding-libs-0.6.2-r1 ~arm64
 
+# CVE-2025-7039
+=dev-libs/glib-2.84.4 ~amd64 ~arm64
+
 # The only available ebuild (from GURU) has ~amd64 and no keyword for arm64 yet.
 =dev-libs/jose-12 **
 =dev-libs/luksmeta-9-r1 **
 
-# CVE-2025-49794, CVE-2025-49795, CVE-2025-49796
-=dev-libs/libxml2-2.13.8-r2 ~amd64 ~arm64
-
 # Keep versions on both arches in sync.
 =dev-libs/raft-0.22.1 ~arm64
 
@@ -75,8 +71,9 @@ dev-cpp/azure-security-keyvault-keys
 # Catalyst 4 is not stable yet, but earlier versions are masked now.
 =dev-util/catalyst-4.0.0 ~amd64 ~arm64
 
-# Keep versions on both arches in sync.
-=dev-util/xdelta-3.0.11-r1 ~arm64
+# CVE-2025-7039
+=dev-util/gdbus-codegen-2.84.4 ~amd64 ~arm64
+=dev-util/glib-utils-2.84.4 ~amd64 ~arm64
 
 # Keep versions on both arches in sync.
 =net-firewall/conntrack-tools-1.4.8-r1 ~arm64
@@ -87,7 +84,9 @@ dev-cpp/azure-security-keyvault-keys
 # Keep versions on both arches in sync.
 =net-libs/libnetfilter_cthelper-1.0.1-r1 ~arm64
 =net-libs/libnetfilter_cttimeout-1.0.1 ~arm64
-=net-misc/curl-8.14.1 ~arm64
+
+# CVE-2025-54349, CVE-2025-54350, CVE-2025-54351
+=net-misc/iperf-3.19.1 ~amd64 ~arm64
 
 # Packages are in Gentoo but not expected to be used outside Flatcar, so they
 # are generally never stabilised. Thus an unusual form is used to pick up the
@@ -101,8 +100,6 @@ sys-apps/azure-vm-utils
 =sys-boot/mokutil-0.7.2 **
 
 # Enable ipvsadm for arm64.
-=sys-fs/zfs-2.3.3 ~arm64
-=sys-fs/zfs-kmod-2.3.3 ~arm64
 =sys-cluster/ipvsadm-1.31-r1 ~arm64
 
 # Keep versions on both arches in sync.

sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask

@@ -25,3 +25,4 @@
 # mask a specific version in hope that the future update may be smaller,
 # who knows.
 =sys-firmware/intel-microcode-20250512_p20250513
+=sys-firmware/intel-microcode-20250812_p20250813

sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.provided

@@ -14,3 +14,7 @@ dev-util/source-highlight-3.1.9-r2
 # Pulled in by bpftool[-clang], We never provided co-re in bpftool and
 # for now continue to do so.
 sys-devel/bpf-toolchain-14.2.0_p1
+
+# Pulled by app-crypt/sbsigntools - we never needed it and it pulls a
+# ton of other packages.
+dev-perl/Locale-gettext-1.70.0_p20181130

sdk_container/src/third_party/portage-stable/app-admin/sudo/sudo-1.9.17_p2.ebuild

@@ -34,7 +34,7 @@ else
 	"
 
 	if [[ ${PV} != *_beta* && ${PV} != *_rc* ]] ; then
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+		KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86"
 	fi
 
 	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-sudo )"