[rpms/buildah] update-buildah-cve-2026-46597: bump golang.org/x/crypto to v0.53.0 to fix CVE-2026-39832 and CVE-2026-39835

[rpms/buildah] update-buildah-cve-2026-46597: bump golang.org/x/crypto to v0.53.0 to fix CVE-2026-39832 and CVE-2026-39835

[Jindrich Novy]

            A new commit has been pushed.

            Repo   : rpms/buildah
            Branch : update-buildah-cve-2026-46597
            Commit : 91a5f04a262eb2553c2d6a549b0c4bf70fddc00f
            Author : Jindrich Novy <jnovy@redhat.com>
            Date   : 2026-07-08T11:17:18+02:00
            Stats  : +9/-5 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/buildah/c/91a5f04a262eb2553c2d6a549b0c4bf70fddc00f?branch=update-buildah-cve-2026-46597

            Log:
            bump golang.org/x/crypto to v0.53.0 to fix CVE-2026-39832 and CVE-2026-39835

Switch Source0 to consume tarball from the internal GitLab
sustaining-engineering repo instead of GitHub.

Resolves: RHEL-188733 RHEL-190066
Signed-off-by: Jindrich Novy <jnovy@redhat.com>

---
diff --git a/buildah.spec b/buildah.spec
index 3c6d0fd..e264377 100644
--- a/buildah.spec
+++ b/buildah.spec
@@ -11,7 +11,7 @@
 
 %global import_path github.com/containers/buildah
 %global branch release-1.43
-%global commit0 c6eb14c2b812c3fcca6a2efedac27bbde5ad7af8
+%global commit0 08482e746b5a5d210703df043a783789c20142ee
 %global shortcommit0 %(c=%{commit0}; echo ${c:0:7})
 
 %if %{defined fedora}
@@ -40,7 +40,7 @@ Epoch: 2
 Version: 1.43.1
 # The `AND` needs to be uppercase in the License for SPDX compatibility
 License: Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND MIT AND MPL-2.0
-Release:        2%{?dist}
+Release:        3%{?dist}
 %if %{defined golang_arches_future}
 ExclusiveArch: %{golang_arches_future}
 %else
@@ -49,7 +49,7 @@ ExclusiveArch: aarch64 ppc64le s390x x86_64
 Summary: A command line tool used for creating OCI Images
 URL: https://%{name}.io
 %if 0%{?branch:1}
-Source0: https://%{import_path}/tarball/%{commit0}/%{branch}-%{shortcommit0}.tar.gz
+Source0: https://gitlab.cee.redhat.com/sustaining-engineering/container-tools/src-git/%{name}/-/archive/%{commit0}/%{branch}-%{shortcommit0}.tar.gz
 %else
 Source0: https://%{import_path}/archive/%{commit0}/%{name}-%{version}-%{shortcommit0}.tar.gz
 %endif
@@ -117,7 +117,7 @@ This package contains system tests for %{name}
 
 %prep
 %if 0%{?branch:1}
-%autosetup -Sgit -n containers-%{name}-%{shortcommit0}
+%autosetup -Sgit -n %{name}-%{commit0}
 %else
 %autosetup -Sgit -n %{name}-%{commit0}
 %endif
@@ -206,6 +206,10 @@ rm %{buildroot}%{_datadir}/%{name}/test/system/tools/build/*
 %{_datadir}/%{name}/test
 
 %changelog
+* Wed Jul 08 2026 Jindrich Novy <jnovy@redhat.com> - 2:1.43.1-3
+- bump golang.org/x/crypto to v0.53.0 to fix CVE-2026-39832 and CVE-2026-39835
+- Resolves: RHEL-188733 RHEL-190066
+
 * Sun May 04 2026 Jindrich Novy <jnovy@redhat.com> - 102:1.43.1-2
 - Rebuild for CVE-2026-25679
 - Resolves: RHEL-158759

diff --git a/sources b/sources
index 033ff63..ca66eb4 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (release-1.43-c6eb14c.tar.gz) = 39a271ea0179c0ac9479aeb14558d43ddeebe663026c73203dc3bc490f6929889db7b445ac2911df83a91b5708775a100576dd333fc32ed21932a080d220a6a1
+SHA512 (release-1.43-08482e7.tar.gz) = f40f9481af53f8055d573f7c0f7a441cc43eecd3389d4f9612ae0ec619c6cc6a19bcf69abb28c58aa444e8442943e2e274831d6528aeffc48b5da2ca444dd1b9