[rpms/buildah] update-buildah-cve-2026-46597: buildah-1.39.0-2.el9

[rpms/buildah] update-buildah-cve-2026-46597: buildah-1.39.0-2.el9

[Jindrich Novy]

            A new commit has been pushed.

            Repo   : rpms/buildah
            Branch : update-buildah-cve-2026-46597
            Commit : 6350b40a109901cc89ee177c1a7ebdbc8059fc41
            Author : Jindrich Novy <jnovy@redhat.com>
            Date   : 2025-02-13T12:43:27+01:00
            Stats  : +17/-11 in 1 file(s)
            URL    : https://src.fedoraproject.org/rpms/buildah/c/6350b40a109901cc89ee177c1a7ebdbc8059fc41?branch=update-buildah-cve-2026-46597

            Log:
            buildah-1.39.0-2.el9

- sync spec with upstream
- Related: RHEL-60277

Signed-off-by: Jindrich Novy <jnovy@redhat.com>

---
diff --git a/buildah.spec b/buildah.spec
index d60e551..47c489c 100644
--- a/buildah.spec
+++ b/buildah.spec
@@ -7,21 +7,16 @@
 %global debug_package   %{nil}
 %endif
 
-# RHEL's default %%gobuild macro doesn't account for the BUILDTAGS variable, so we
-# set it separately here and do not depend on RHEL's go-[s]rpm-macros package
-# until that's fixed.
-# c9s bz: https://bugzilla.redhat.com/show_bug.cgi?id=2227328
-# c8s bz: https://bugzilla.redhat.com/show_bug.cgi?id=2227331
-%if %{defined rhel}
-%define gobuild(o:) go build -buildmode pie -compiler gc -tags="rpm_crashtraceback libtrust_openssl ${BUILDTAGS:-}" -ldflags "-linkmode=external -compressdwarf=false ${LDFLAGS:-} -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -extldflags '%__global_ldflags'" -a -v -x %{?**};
-%endif
-
 %global gomodulesmode GO111MODULE=on
 
-%if 0%{defined fedora}
+%if %{defined fedora}
 %define build_with_btrfs 1
 %endif
 
+%if %{defined rhel}
+%define fips 1
+%endif
+
 %global git0 https://github.com/containers/%{name}
 
 Name: buildah
@@ -40,7 +35,7 @@ Epoch: 2
 Version: 1.39.0
 # The `AND` needs to be uppercase in the License for SPDX compatibility
 License: Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND MIT AND MPL-2.0
-Release: 1%{?dist}
+Release: 2%{?dist}
 %if %{defined golang_arches_future}
 ExclusiveArch: %{golang_arches_future}
 %else
@@ -129,6 +124,10 @@ export BUILDTAGS="seccomp $(hack/systemd_tag.sh) $(hack/libsubid_tag.sh)"
 export BUILDTAGS+=" btrfs_noversion exclude_graphdriver_btrfs"
 %endif
 
+%if %{defined fips}
+export BUILDTAGS+=" libtrust_openssl"
+%endif
+
 %gobuild -o bin/%{name} ./cmd/%{name}
 %gobuild -o bin/imgtype ./tests/imgtype
 %gobuild -o bin/copy ./tests/copy
@@ -151,6 +150,9 @@ rm %{buildroot}%{_datadir}/%{name}/test/system/tools/build/*
 #define license tag if not already defined
 %{!?_licensedir:%global license %doc}
 
+# Include check to silence rpmlint.
+%check
+
 %files
 %license LICENSE vendor/modules.txt
 %doc README.md
@@ -169,6 +171,10 @@ rm %{buildroot}%{_datadir}/%{name}/test/system/tools/build/*
 %{_datadir}/%{name}/test
 
 %changelog
+* Thu Feb 13 2025 Jindrich Novy <jnovy@redhat.com> - 2:1.39.0-2
+- sync spec with upstream
+- Related: RHEL-60277
+
 * Tue Feb 04 2025 Jindrich Novy <jnovy@redhat.com> - 2:1.39.0-1
 - update to https://github.com/containers/buildah/releases/tag/v1.39.0
 - Related: RHEL-60277