weekly portage stable package updates 2026-07-06 security edition by tormath1 · Pull Request #4132 · flatcar/scripts

tormath1 · 2026-07-06T09:49:42Z

In this PR, we extract security updates from the weekly update.

openssl
containerd (upstream PR: app-containers/containerd: bump to 2.2.5 gentoo/gentoo#46520)
runc

Testing done

Manually emerged

Closes:

Changelog entries added in the respective changelog/ directory (user-facing change, bug fix, security fix, update)
Inspected CI output for image differences: /boot and /usr size, packages, list files for any missing binaries, kernel modules, config files, kernel modules, etc.
CI: https://jenkins.flatcar.org/job/container/job/packages_all_arches/355/cldsv/

It's from Gentoo commit c57f55232814e5968dac23710b7c8927cb6b7e5e. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org> Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>

Copilot

Pull request overview

This PR updates the portage-stable package set with a focus on security-related bumps, primarily refreshing OpenSSL ebuilds/manifests (including new patching where needed) and aligning container runtime dependencies (containerd → newer runc).

Changes:

Update OpenSSL ebuilds across multiple maintained branches, including verify-sig key dependency bumps and build/install logic alignment for newer OpenSSL series.
Refresh OpenSSL distfiles in dev-libs/openssl/Manifest, add an x86 AVX2 guard patch for 4.0.1, and drop no-longer-used patch files/older ebuilds.
Add runc-1.3.6 and bump containerd’s minimum required runc version accordingly, with corresponding Manifest updates.

Reviewed changes

Copilot reviewed 19 out of 20 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-4.0.9999.ebuild	Bump verify-sig OpenSSL key dependency version for the OpenSSL 4.0 live ebuild.
sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-4.0.1.ebuild	Update OpenSSL 4.0.1 ebuild logic (sysroot/multibuild flow) and apply new x86 AVX2-related patch.
sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.6.9999.ebuild	Bump verify-sig OpenSSL key dependency version for the OpenSSL 3.6 live ebuild.
sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.6.3.ebuild	Update OpenSSL 3.6.3 ebuild logic to the newer sysroot/multibuild-based flow.
sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.9999.ebuild	Bump verify-sig OpenSSL key dependency version for the OpenSSL 3.5 live ebuild.
sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.7.ebuild	Bump verify-sig OpenSSL key dependency version and drop obsolete ppc64 patch application.
sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.4.9999.ebuild	Bump verify-sig OpenSSL key dependency version for the OpenSSL 3.4 live ebuild.
sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.4.6.ebuild	Bump verify-sig OpenSSL key dependency version for OpenSSL 3.4.6.
sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.0.9999.ebuild	Bump verify-sig OpenSSL key dependency version for the OpenSSL 3.0 live ebuild.
sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.0.21.ebuild	Bump verify-sig OpenSSL key dependency version for OpenSSL 3.0.21.
sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.3.7.ebuild	Remove the OpenSSL 3.3.7 ebuild from the snapshot.
sdk_container/src/third_party/portage-stable/dev-libs/openssl/Manifest	Update OpenSSL distfile list and checksums to match the new version set.
sdk_container/src/third_party/portage-stable/dev-libs/openssl/files/openssl-4.0.1-x86-avx2.patch	Add patch to constrain AVX2 base64 path to x86_64 builds.
sdk_container/src/third_party/portage-stable/dev-libs/openssl/files/openssl-3.5.5-ppc64.patch	Remove obsolete OpenSSL ppc64 patch file.
sdk_container/src/third_party/portage-stable/dev-libs/openssl/files/openssl-3.5.5-ppc64-be.patch	Remove obsolete OpenSSL ppc64 big-endian patch file.
sdk_container/src/third_party/portage-stable/dev-libs/openssl/files/openssl-3.3.2-silence-warning.patch	Remove unused OpenSSL patch file previously tied to older versions.
sdk_container/src/third_party/portage-stable/app-containers/runc/runc-1.3.6.ebuild	Add runc 1.3.6 ebuild.
sdk_container/src/third_party/portage-stable/app-containers/runc/Manifest	Update runc distfile checksums for 1.3.6.
sdk_container/src/third_party/portage-stable/app-containers/containerd/Manifest	Update containerd distfile entry (2.2.5).
sdk_container/src/third_party/portage-stable/app-containers/containerd/containerd-2.2.5.ebuild	Bump containerd’s minimum runc dependency to >=1.3.6.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

dongsupark · 2026-07-06T10:03:34Z

Thanks. We should be able to close flatcar/Flatcar#2178, as runc gets bumped to 1.3.6.

krnowak

Package automation didn't report anything else worth mentioning - the ebuilds didn't change in significant way.

krnowak · 2026-07-06T10:35:04Z

@@ -0,0 +1,2 @@
+- openssl ([3.5.7](https://openssl-library.org/news/openssl-3.5-notes/))


Suggested change

- openssl ([3.5.7](https://openssl-library.org/news/openssl-3.5-notes/))

- base, dev: openssl ([3.5.7](https://openssl-library.org/news/openssl-3.5-notes/))

krnowak · 2026-07-06T10:36:28Z

@@ -0,0 +1,2 @@
+- openssl ([3.5.7](https://openssl-library.org/news/openssl-3.5-notes/))
+- sysext-containerd: containerd ([2.2.5](https://github.com/containerd/containerd/releases/tag/v2.2.5))


Suggested change

- sysext-containerd: containerd ([2.2.5](https://github.com/containerd/containerd/releases/tag/v2.2.5))

- sysext-containerd: containerd ([2.2.5](https://github.com/containerd/containerd/releases/tag/v2.2.5) (includes [2.2.4](https://github.com/containerd/containerd/releases/tag/v2.2.4), [2.2.3](https://github.com/containerd/containerd/releases/tag/v2.2.3)))

krnowak · 2026-07-06T10:40:04Z

Thanks. We should be able to close flatcar/Flatcar#2178, as runc gets bumped to 1.3.6.

There is no runc bump happening - we are currently running 1.4.0-r1, which seems to be still vulnerable.

krnowak · 2026-07-06T10:42:51Z

I think cherry-picking app-container/runc from weekly updates branch should be enough - we have accept keywords in line for 1.4* line of releases.

It's from Gentoo commit 92ad322050427f76c2b3575e947c9c4453bc30a4. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org> Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>

Copilot

Pull request overview

Copilot reviewed 23 out of 23 changed files in this pull request and generated 2 comments.

Upstream PR is opened Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>

Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>

tormath1 · 2026-07-06T13:28:24Z

I think cherry-picking app-container/runc from weekly updates branch should be enough - we have accept keywords in line for 1.4* line of releases.

Ok done, runc commit has been cherry-picked, runc security issue has been linked and CI has been restarted.

Copilot

Pull request overview

Copilot reviewed 23 out of 23 changed files in this pull request and generated 1 comment.

chewi

You missed my additional containerd commit to require Go >=1.25, but that's no big deal, we'll have that anyway.

krnowak · 2026-07-06T16:32:06Z

pkg auto reports and some quick comments:

app-containers/containerd: [SYSEXT-CONTAINERD]
- from 2.2.2 to 2.2.5
- build dependencies:
  - added a dependency 'sec-policy/selinux-docker' for USE 'selinux?'
- runtime dependencies:
  - changes for app-containers/runc:
    - changed version constraint from >=1.3.4 to >=1.3.6
- TODO: review ebuild.diff
- TODO: review occurrences
- release notes: TODO

This will fail the build, because we enable selinux for app-containers/containerd in coreos/base/package.use, but don't have sec-policy/selinux-docker imported in portage-stable. Also, why on earth it is a build dependency?

app-containers/runc: [SYSEXT-CONTAINERD]
- from 1.4.0-r1 to 1.4.3
- package became unstable on 'amd64'
  - TODO: add/update accept keywords for this package in overlay profiles
- package became unstable on 'arm64'
  - TODO: add/update accept keywords for this package in overlay profiles
- removed IUSE flag 'kmem'
  - TODO: describe removed IUSE flag
- dependencies:
  - dropped a dependency 'sys-libs/libapparmor' for USE 'apparmor?'
- TODO: review ebuild.diff
- TODO: review occurrences
- release notes: TODO

kmem USE flag is dropped, and its only use in the ebuild was $(usex kmem '' 'nokmem'), which means that nothing is passed to the build system if kmem is enabled (and it was by default)

dev-libs/openssl: [PROD] [DEV]
- from 3.5.6 to 3.5.7
- build dependencies:
  - changes for sec-keys/openpgp-keys-openssl with USE conditionals 'verify-sig?':
    - changed version constraint from >=20240920 to >=20260415
- TODO: review ebuild.diff
- TODO: review other.diff
- TODO: review occurrences
- release notes: TODO

chewi · 2026-07-06T16:49:41Z

This will fail the build, because we enable selinux for app-containers/containerd in coreos/base/package.use, but don't have sec-policy/selinux-docker imported in portage-stable. Also, why on earth it is a build dependency?

It looks like it was added to BDEPEND instead of RDEPEND in the latest version in gentoo/gentoo@ab0ae3b by mistake. @thesamesam, please can you confirm?

thesamesam · 2026-07-06T16:53:49Z

Yes, a mistake - please fix it up if you can.

I was wondering about the apparmor thing too but didn't have a chance to check that.

chewi · 2026-07-06T17:02:46Z

Fixed in gentoo/gentoo@890b6da.

tormath1 · 2026-07-06T17:10:39Z

@krnowak thanks for providing additional informations.

This will fail the build, because we enable selinux for app-containers/containerd in coreos/base/package.use, but don't have sec-policy/selinux-docker imported in portage-stable. Also, why on earth it is a build dependency?

The build did not fail because it seems we did not ask for selinux for containerd:

scripts/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use

Line 146 in 9a0834c

app-containers/containerd btrfs device-mapper

That said, the CI looks good and downloaded image gives:

Flatcar Container Linux by Kinvolk developer 9999.0.101+tormath1-security for QEMU
Last login: Mon Jul  6 17:04:37 UTC 2026 on tty1
core@localhost ~ $ openssl version
OpenSSL 3.5.7 9 Jun 2026 (Library: OpenSSL 3.5.7 9 Jun 2026)
core@localhost ~ $ containerd --version
containerd github.com/containerd/containerd/v2 v2.2.5 e53c7c1516c3b2bff98eb76f1f4117477e6f4e66
core@localhost ~ $ runc --version
runc version 1.4.3
commit: bb14dabeb7185bb72c8c86735d090dcb20f36587
spec: 1.3.0
go: go1.26.3-X:nodwarf5
libseccomp: 2.6.0

I'll merge the PR once the CI will be fully green.

chewi · 2026-07-06T17:15:02Z

The build did not fail because it seems we did not ask for selinux for containerd:

That's probably because it was BDEPEND and we don't enable selinux for the SDK.

chewi · 2026-07-06T17:17:00Z

On closer inspection, you're right, we only enable it on runc for some reason.

dev-libs/openssl: Sync with Gentoo

3516745

It's from Gentoo commit c57f55232814e5968dac23710b7c8927cb6b7e5e. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org> Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>

Copilot AI review requested due to automatic review settings July 6, 2026 09:49

tormath1 self-assigned this Jul 6, 2026

tormath1 had a problem deploying to development July 6, 2026 09:49 — with GitHub Actions Error

Copilot started reviewing on behalf of tormath1 July 6, 2026 09:50 View session

tormath1 added the main label Jul 6, 2026

tormath1 added this to Flatcar tactical, release planning, and roadmap Jul 6, 2026

tormath1 moved this to ✅ Testing / in Review in Flatcar tactical, release planning, and roadmap Jul 6, 2026

tormath1 moved this from ✅ Testing / in Review to ⚒️ In Progress in Flatcar tactical, release planning, and roadmap Jul 6, 2026

Copilot AI reviewed Jul 6, 2026

View reviewed changes

tormath1 had a problem deploying to development July 6, 2026 09:56 — with GitHub Actions Error

krnowak reviewed Jul 6, 2026

View reviewed changes

app-containers/runc: Sync with Gentoo

4267f2a

It's from Gentoo commit 92ad322050427f76c2b3575e947c9c4453bc30a4. Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org> Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>

tormath1 force-pushed the tormath1/weekly-portage-stable-package-updates-2026-07-06-security branch from c2fc555 to 03235b2 Compare July 6, 2026 13:07

Copilot AI review requested due to automatic review settings July 6, 2026 13:07

tormath1 had a problem deploying to development July 6, 2026 13:07 — with GitHub Actions Error

Copilot started reviewing on behalf of tormath1 July 6, 2026 13:08 View session

Copilot AI reviewed Jul 6, 2026

View reviewed changes

Comment thread sdk_container/src/third_party/portage-stable/app-containers/runc/runc-1.4.3.ebuild

Comment thread sdk_container/src/third_party/portage-stable/app-containers/runc/runc-1.4.3.ebuild

tormath1 added 2 commits July 6, 2026 15:24

app-containers/containerd: bump to 2.2.5

a5ddc35

Upstream PR is opened Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>

changelog: add entries

84d959f

Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>

tormath1 force-pushed the tormath1/weekly-portage-stable-package-updates-2026-07-06-security branch from 03235b2 to 84d959f Compare July 6, 2026 13:25

tormath1 requested a deployment to development July 6, 2026 13:25 — with GitHub Actions Waiting

tormath1 marked this pull request as ready for review July 6, 2026 13:43

tormath1 requested a review from a team as a code owner July 6, 2026 13:43

Copilot AI review requested due to automatic review settings July 6, 2026 13:43

Copilot started reviewing on behalf of tormath1 July 6, 2026 13:43 View session

Copilot AI reviewed Jul 6, 2026

View reviewed changes

Comment thread sdk_container/src/third_party/portage-stable/app-containers/runc/runc-1.4.3.ebuild

dongsupark approved these changes Jul 6, 2026

View reviewed changes

chewi approved these changes Jul 6, 2026

View reviewed changes

tormath1 merged commit c2f4958 into main Jul 6, 2026
24 of 26 checks passed

github-project-automation Bot moved this from ⚒️ In Progress to Implemented in Flatcar tactical, release planning, and roadmap Jul 6, 2026

tormath1 deleted the tormath1/weekly-portage-stable-package-updates-2026-07-06-security branch July 6, 2026 18:15

This was referenced Jul 6, 2026

update: containerd flatcar/Flatcar#2182

Closed

update: openssl flatcar/Flatcar#2177

Closed

update: runc flatcar/Flatcar#2178

Closed

		@@ -0,0 +1,2 @@
		- openssl ([3.5.7](https://openssl-library.org/news/openssl-3.5-notes/))

	- openssl ([3.5.7](https://openssl-library.org/news/openssl-3.5-notes/))
	- base, dev: openssl ([3.5.7](https://openssl-library.org/news/openssl-3.5-notes/))

		@@ -0,0 +1,2 @@
		- openssl ([3.5.7](https://openssl-library.org/news/openssl-3.5-notes/))
		- sysext-containerd: containerd ([2.2.5](https://github.com/containerd/containerd/releases/tag/v2.2.5))

Uh oh!

Conversation

tormath1 commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Testing done

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

dongsupark commented Jul 6, 2026

Uh oh!

krnowak left a comment

Choose a reason for hiding this comment

Uh oh!

krnowak Jul 6, 2026

Choose a reason for hiding this comment

Uh oh!

krnowak Jul 6, 2026

Choose a reason for hiding this comment

Uh oh!

krnowak commented Jul 6, 2026

Uh oh!

krnowak commented Jul 6, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

tormath1 commented Jul 6, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

chewi left a comment

Choose a reason for hiding this comment

Uh oh!

krnowak commented Jul 6, 2026

Uh oh!

chewi commented Jul 6, 2026

Uh oh!

thesamesam commented Jul 6, 2026

Uh oh!

chewi commented Jul 6, 2026

Uh oh!

tormath1 commented Jul 6, 2026

Uh oh!

chewi commented Jul 6, 2026

Uh oh!

chewi commented Jul 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

tormath1 commented Jul 6, 2026 •

edited

Loading