[rpms/buildah] update-buildah-cve-2026-46597: buildah-1.22.0-0.2.el9

[Jindrich Novy <jnovy@redhat.com>]

            A new commit has been pushed.

            Repo   : rpms/buildah
            Branch : update-buildah-cve-2026-46597
            Commit : 8d8b292f232b61ae6b8998983af5f137de453e07
            Author : Jindrich Novy <jnovy@redhat.com>
            Date   : 2021-06-14T08:58:31+02:00
            Stats  : +57/-97 in 4 file(s)
            URL    : https://src.fedoraproject.org/rpms/buildah/c/8d8b292f232b61ae6b8998983af5f137de453e07?branch=update-buildah-cve-2026-46597

            Log:
            buildah-1.22.0-0.2.el9

- update buildah
- Related: #1970747

Signed-off-by: Jindrich Novy <jnovy@redhat.com>

---
diff --git a/buildah.spec b/buildah.spec
index 1516320..2c04119 100644
--- a/buildah.spec
+++ b/buildah.spec
@@ -14,13 +14,13 @@ go build -buildmode pie -compiler gc -tags="rpm_crashtraceback libtrust_openssl 
 %endif
 
 %global import_path github.com/containers/buildah
-#%%global branch release-1.16
-%global commit0 293e02ac068513a08c38dbe434dea73560f90c25
+%global branch master
+%global commit0 9c7f50b80b4599b7e3e090787dc5da9ece58875a
 %global shortcommit0 %(c=%{commit0}; echo ${c:0:7})
 
 Name: buildah
-Version: 1.20.0
-Release: 2%{?dist}
+Version: 1.22.0
+Release: 0.2%{?dist}
 Summary: A command line tool used for creating OCI Images
 License: ASL 2.0
 URL: https://%{name}.io
@@ -62,7 +62,10 @@ Requires: %{name} = %{version}-%{release}
 Requires: bzip2
 Requires: podman
 Requires: golang
+Requires: jq
 Requires: httpd-tools
+Requires: openssl
+Requires: nmap-ncat
 
 %description tests
 %{summary}
@@ -122,6 +125,10 @@ make DESTDIR=%{buildroot} PREFIX=%{_prefix} -C docs install
 %{_datadir}/%{name}/test
 
 %changelog
+* Mon Jun 14 2021 Jindrich Novy <jnovy@redhat.com> - 1.22.0-0.2
+- update buildah
+- Related: #1970747
+
 * Thu Apr 15 2021 Mohan Boddu <mboddu@redhat.com> - 1.20.0-2
 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
 

diff --git a/sources b/sources
index 2c53a38..c10c36c 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (buildah-1.20.0-293e02a.tar.gz) = 67cc5db314a496cb2ab0a627a1d00fa343c8350ea1674f0a011ac10e1f685c413c16846c9b6a00e7acefe06828a9bcd657a252d1a90857f418d07be4ddc586ce
+SHA512 (master-9c7f50b.tar.gz) = da2ae906d2cbbc1e2ad112e3be5e6ba4a48a0d15c89de9660ba65d9a0b9f7ce939f429ed9ee523d93b448bb7af123677a9603f7a1e40564ae8b9de2202fd6e26

diff --git a/tests/test_buildah.sh b/tests/test_buildah.sh
index 410fdcd..13ac761 100755
--- a/tests/test_buildah.sh
+++ b/tests/test_buildah.sh
@@ -1,21 +1,26 @@
-#!/bin/bash
-#
-# Simple buildah tests
-#
+#!/bin/bash -e
 
-export PATH=/usr/local/bin:/usr/sbin:/usr/bin
-export TMPDIR=/var/tmp
+# Log program and kernel versions
+echo "Important package versions:"
+(
+    uname -r
+    rpm -qa | egrep 'buildah|podman|conmon|crun|runc|iptable|slirp|systemd' | sort
+) | sed -e 's/^/  /'
 
-TEST_LOG=/tmp/test.$(id -un).log
-FULL_LOG=/tmp/test.$(id -un).debug.log
-rm -f $TEST_LOG $FULL_LOG
+# Log environment; or at least the useful bits
+echo "Environment:"
+env | grep -v LS_COLORS= | sort | sed -e 's/^/  /'
 
-# Log program versions
-rpm -q buildah buildah-tests  > $FULL_LOG
+export BUILDAH_BINARY=/usr/bin/buildah
+export IMGTYPE_BINARY=/usr/bin/buildah-imgtype
+
+###############################################################################
+# BEGIN setup/teardown
 
-cd /usr/share/buildah/test/system || exit 1
+# Start a registry
+pre_bats_setup() {
+    REGISTRY_FQIN=docker.io/library/registry:2
 
-start_registry() {
     AUTHDIR=/tmp/buildah-tests-auth.$$
     mkdir -p $AUTHDIR
 
@@ -29,10 +34,10 @@ start_registry() {
     fi
 
     if [ ! -e $AUTHDIR/htpasswd ]; then
-        podman run --entrypoint htpasswd registry:2 \
-               -Bbn testuser testpassword > $AUTHDIR/htpasswd
+        htpasswd -Bbn testuser testpassword > $AUTHDIR/htpasswd
     fi
 
+    podman rm -f registry || true
     podman run -d -p 5000:5000 \
            --name registry \
            -v $AUTHDIR:/auth:Z \
@@ -41,21 +46,20 @@ start_registry() {
            -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \
            -e REGISTRY_HTTP_TLS_CERTIFICATE=/auth/domain.crt \
            -e REGISTRY_HTTP_TLS_KEY=/auth/domain.key \
-           registry:2
+           $REGISTRY_FQIN
 }
 
+post_bats_teardown() {
+    podman rm -f registry
+}
 
-export BUILDAH_BINARY=/usr/bin/buildah
-export IMGTYPE_BINARY=/usr/bin/buildah-imgtype
-
-start_registry                       >> $FULL_LOG 2>&1
+# END   setup/teardown
+###############################################################################
+# BEGIN actual test
 
-bats . &> $TEST_LOG
+pre_bats_setup
+bats /usr/share/buildah/test/system
 rc=$?
-
-echo "------------------------------" >> $FULL_LOG
-echo "bats completed with status $rc" >> $FULL_LOG
-
-podman rm -f registry                 >> $FULL_LOG
+post_bats_teardown
 
 exit $rc

diff --git a/tests/test_buildah.yml b/tests/test_buildah.yml
index 58b0710..4820a9f 100644
--- a/tests/test_buildah.yml
+++ b/tests/test_buildah.yml
@@ -1,68 +1,17 @@
 ---
 - hosts: localhost
-  vars:
-  - artifacts: ./artifacts
-  # FIXME! It would be cleaner to include 'buildah' in this list; but the
-  # dnf module is broken in ansible <= 2.8, it doesn't report failures
-  # to install as long as _one_ package installs! So if buildah installs
-  # but buildah-tests doesn't, the `dnf` stanza succeeds, then the test
-  # one fails with a less-than-helpful error.
-  #
-  # See https://github.com/ansible/ansible/pull/49760
-  - required_packages:
-      - buildah-tests
-  tags:
-    - classic
-
-  - name: install packages
-    dnf: name="{{ required_packages }}" state=installed
-
-  # Sigh; RHEL8 doesn't have BATS
-  - name: bats | fetch and unpack tarball
-    unarchive:
-      src: https://github.com/bats-core/bats-core/archive/v1.1.0.tar.gz
-      dest: /root
-      remote_src: true
-
-  - name: bats | install
-    command: ./install.sh /usr/local
-    args:
-      chdir: /root/bats-core-1.1.0
-
-##  - name: local registry | setup
-
-  - name: create nonroot user
-    user:
-      name: testuser
-      shell: /bin/bash
-
-  - block:
-      - name: root | run test
-        script: ./test_buildah.sh
-    always:
-      - name: root | pull out logs
-        fetch:
-          src: "/tmp/{{ item }}"
-          dest: "{{ artifacts }}/{{ item }}"
-          flat: yes
-        with_items:
-          - test.root.log
-          - test.root.debug.log
-
-  - block:
-      - name: nonroot | run test
-        script: ./test_buildah.sh
-        args:
-          chdir: /home/testuser
-        become: yes
-        become_user: testuser
-    always:
-      - name: nonroot | pull out logs
-        fetch:
-          src: "/tmp/{{ item }}"
-          dest: "{{ artifacts }}/{{ item }}"
-          flat: yes
-        with_items:
-          - test.testuser.log
-          - test.testuser.debug.log
-    when: false
+  environment:
+    TMPDIR: /var/tmp
+  roles:
+    - role: standard-test-basic
+      tags:
+        - classic
+        - container
+      required_packages:
+        - buildah
+        - buildah-tests
+      tests:
+        - root-test:
+            dir: ./
+            run: ./test_buildah.sh
+            timeout: 60m