weekly portage stable package updates 2026-07-06 security edition

changelog/security/2026-07-06-weekly-updates-security.md

@@ -0,0 +1,3 @@
+- openssl ([CVE-2026-34180](https://www.cve.org/CVERecord?id=CVE-2026-34180), [CVE-2026-34181](https://www.cve.org/CVERecord?id=CVE-2026-34181), [CVE-2026-34182](https://www.cve.org/CVERecord?id=CVE-2026-34182), [CVE-2026-34183](https://www.cve.org/CVERecord?id=CVE-2026-34183), [CVE-2026-35188](https://www.cve.org/CVERecord?id=CVE-2026-35188), [CVE-2026-42764](https://www.cve.org/CVERecord?id=CVE-2026-42764), [CVE-2026-42765](https://www.cve.org/CVERecord?id=CVE-2026-42765), [CVE-2026-42766](https://www.cve.org/CVERecord?id=CVE-2026-42766), [CVE-2026-42767](https://www.cve.org/CVERecord?id=CVE-2026-42767), [CVE-2026-42768](https://www.cve.org/CVERecord?id=CVE-2026-42768), [CVE-2026-42769](https://www.cve.org/CVERecord?id=CVE-2026-42769), [CVE-2026-42770](https://www.cve.org/CVERecord?id=CVE-2026-42770), [CVE-2026-42771](https://www.cve.org/CVERecord?id=CVE-2026-42771), [CVE-2026-45445](https://www.cve.org/CVERecord?id=CVE-2026-45445), [CVE-2026-45446](https://www.cve.org/CVERecord?id=CVE-2026-45446), [CVE-2026-45447](https://www.cve.org/CVERecord?id=CVE-2026-45447), [CVE-2026-7383](https://www.cve.org/CVERecord?id=CVE-2026-7383), [CVE-2026-9076](https://www.cve.org/CVERecord?id=CVE-2026-9076))
+- containerd ([CVE-2026-47262](https://www.cve.org/CVERecord?id=CVE-2026-47262), [CVE-2026-50195](https://www.cve.org/CVERecord?id=CVE-2026-50195), [CVE-2026-53488](https://www.cve.org/CVERecord?id=CVE-2026-53488), [CVE-2026-53489](https://www.cve.org/CVERecord?id=CVE-2026-53489), [CVE-2026-53492](https://www.cve.org/CVERecord?id=CVE-2026-53492))
+- runc ([CVE-2026-41579](https://www.cve.org/CVERecord?id=CVE-2026-41579))

changelog/updates/2026-07-06-weekly-updates-security.md

@@ -0,0 +1,3 @@
+- base, dev: openssl ([3.5.7](https://openssl-library.org/news/openssl-3.5-notes/))
+- sysext-containerd: containerd ([2.2.5](https://github.com/containerd/containerd/releases/tag/v2.2.5) (includes [2.2.4](https://github.com/containerd/containerd/releases/tag/v2.2.4), [2.2.3](https://github.com/containerd/containerd/releases/tag/v2.2.3)))
+- sysext-containerd: runc ([1.4.3](https://github.com/opencontainers/runc/releases/tag/v1.4.3) (includes [1.4.2](https://github.com/opencontainers/runc/releases/tag/v1.4.2), [1.4.1](https://github.com/opencontainers/runc/releases/tag/v1.4.1)))

sdk_container/src/third_party/portage-stable/app-containers/containerd/Manifest

@@ -10,3 +10,4 @@ DIST containerd-2.1.5.tar.gz 10622156 BLAKE2B b612e9606554d492f59d4665dcbd85b0fd
 DIST containerd-2.2.0.tar.gz 11475770 BLAKE2B 154d7d547d52925ff46431cea20db38dc72ec87ef90fd112472cb3ec7f2ebd8cfb121f98a3bc3870f8452473b35c3e1c84671b9fc31347f98259b34a70e740f9 SHA512 3121a1e0401e0283ff9d8454e945b427bcb0214e7e67271815117cb82dee1488c4d963c2193eb9c0ab5d395dd2e2705975ac31ce3e400264933d05d62fd0faac
 DIST containerd-2.2.1.tar.gz 11492859 BLAKE2B 5ee7a5388ec5a247a530be505068162318505741e77ab2a103ba8a33c3e76fbac55a64504429f9c636e41cb4826e1acc6b7f817398928a0d6b8ebd94797b8b7b SHA512 6bbfe356bdb0fd70c5b3ca0d932b790bb34b40832392e6a309a907351dc344e3b6059e2cd583145200aab218b4e8f5160d698f2b3a84d05bbf834d023eea4bd3
 DIST containerd-2.2.2.tar.gz 11531809 BLAKE2B 6605d5d2de275c9485dd92d4e56fc87853a4fe45cdc78e0a5f7d5178525f6e6925ea765e29bf3a4891dc318062a7577c7628fd63df451a2ba404852e0b5f0224 SHA512 4471047360cd1430a189829a74d605dbe89abe092f0e0ba53ad5954269f253c7c277b8097c5d12acb9e0592a39e50e1808c92e73596e3d2d97cf945f15063ca0
+DIST containerd-2.2.5.tar.gz 10922595 BLAKE2B 2f6a4653d3b5dcb7a82e9255e7557d5e92c1c65f344abce4fe44bebde2727cc6a414be235e9cdcebaca1660326dfa249cf3f559505e3c7529bf463199a0e3f4c SHA512 5d658c8daa48e3b5369995847d15e3dae4367e7221a5a34115bb74723707053378a2d489b29e6f2742e04bdfc2362c02df34fcb403fc0adb144e19bd352d7741

sdk_container/src/third_party/portage-stable/app-containers/containerd/containerd-2.2.5.ebuild

@@ -0,0 +1,82 @@
+# Copyright 2022-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-env go-module systemd toolchain-funcs
+
+GIT_REVISION=e53c7c1516c3b2bff98eb76f1f4117477e6f4e66
+
+DESCRIPTION="A daemon to control runC"
+HOMEPAGE="https://containerd.io/"
+SRC_URI="https://github.com/containerd/containerd/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+IUSE="apparmor btrfs device-mapper +cri +seccomp selinux test"
+# tests require root or docker
+RESTRICT="test"
+
+DEPEND="
+	btrfs? ( sys-fs/btrfs-progs )
+	seccomp? ( sys-libs/libseccomp )
+"
+# recommended minimum version of runc is found in script/setup/runc-version
+RDEPEND="${DEPEND}
+	>=app-containers/runc-1.3.6[apparmor?,seccomp?]
+"
+BDEPEND="
+	selinux? ( sec-policy/selinux-docker )
+	dev-go/go-md2man
+	virtual/pkgconfig
+"
+
+src_prepare() {
+	default
+	sed -i \
+		-e "s/-s -w//" \
+		Makefile || die
+	sed -i \
+		-e "s:/usr/local:/usr:" \
+		containerd.service || die
+}
+
+src_compile() {
+	local options=(
+		$(usev apparmor)
+		$(usex btrfs "" "no_btrfs")
+		$(usex cri "" "no_cri")
+		$(usex device-mapper "" "no_devmapper")
+		$(usev seccomp)
+		$(usev selinux)
+	)
+
+	local myemakeargs=(
+		BUILDTAGS="${options[*]}"
+		REVISION="${GIT_REVISION}"
+		VERSION=v${PV}
+	)
+
+	emake "${myemakeargs[@]}" all
+
+	# race condition in man target https://bugs.gentoo.org/765100
+	tc-env_build go-env_run emake "${myemakeargs[@]}" man -j1 #nowarn
+}
+
+src_install() {
+	rm bin/gen-manpages || die
+	dobin bin/*
+	doman man/*
+	newconfd "${FILESDIR}"/${PN}.confd "${PN}"
+	newinitd "${FILESDIR}"/${PN}.initd "${PN}"
+	systemd_dounit containerd.service
+	keepdir /var/lib/containerd
+
+	# we already installed manpages, remove markdown source
+	# before installing docs directory
+	rm -r docs/man || die
+
+	local DOCS=( ADOPTERS.md README.md RELEASES.md ROADMAP.md SCOPE.md docs/. )
+	einstalldocs
+}

sdk_container/src/third_party/portage-stable/app-containers/runc/Manifest

@@ -1,3 +1,5 @@
 DIST runc-1.2.8.tar.gz 2834651 BLAKE2B 5f76e40ee8bda4668758dce318625af1dbb13c0d33a17c9c872bc68aefd6311cac570ed934a69b92b4a327c6084ff6d6d55f8914b105513f9484bbc903107a4d SHA512 8d29a2ca179320f9a01c37383506f10aea1764e18b3321c507787556e3a531e23221f8369696d8caaf30124a523a68d0ad3609bae5ab06aa6c519e644d54d4ef
 DIST runc-1.3.3.tar.gz 2929410 BLAKE2B 1feddc154836eff606a685a0c0d606c1bbcd5a1a1ec8a288233581a88e0b3b6a95f446125688a8dca5efd5a275bf22931553cb9ab894f6aa0826d5a1274b6f91 SHA512 9ce0af1b79163c44913979c0483322247b154109871a113726163f64c6354141e7cefb5fb6e1225eaa4bb48a1e33ba9a6049cb45cb2af8793134647dad18c8dc
 DIST runc-1.4.0.tar.gz 2958986 BLAKE2B 9a363986a05c2c19646373373b94944642bf9f74a2a9f10d201baff7d76d54e39e273d6ceb9f94449926246ec22c2b863812ca1e4e8910cb166294b7ea7c4068 SHA512 a5b52d8494a4210d9ff4caefd0513b94b80ef9dd16c6eb369761cde2fce30214f765eee01c3cbb2e0cfd933371362fd89b08656b434d76038ffe1f8a59dea215
+DIST runc-1.4.2.tar.gz 2961237 BLAKE2B 440771f2cf21ba47c3a6c368179bb28bb50b794913e9ad1a6f8ffc3f06bcdf2d99a000ce261b0ea70bf3a2f998acd2f6ff7770ebc17915501f63b46f08c1f77c SHA512 93bd1d6641b55afa7fa415d26fd898371c63f3caae353c6bea7318eeac49835a29df0331f62d54bf2ab1a640105c541c7eb04c32bc3d1006df53d857d113775e
+DIST runc-1.4.3.tar.gz 2962885 BLAKE2B d5e9ac412e94cf5465de59375d5c582b9d6e19366af641d1ea3e1aa2c962f7fbd93a6910ea44d148fde5378061b64797449661def2be101cc0509441428a0692 SHA512 a4c5310f0b44603af330a75b254f13df59d5319e570aa51eedbcab24854f229e65fe3be291e93e87286e646e360b15fa46db9fe6394b6c879cbd7c5984b5c424

sdk_container/src/third_party/portage-stable/app-containers/runc/runc-1.4.2.ebuild

@@ -0,0 +1,154 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module linux-info
+
+# update on bump, look for commit ID on release tag.
+# https://github.com/opencontainers/runc
+RUNC_COMMIT=c241c0bb5e60a8e8c1b2e53d4eca8d0068d8d57e
+
+CONFIG_CHECK="~USER_NS"
+
+DESCRIPTION="runc container cli tools"
+HOMEPAGE="https://github.com/opencontainers/runc/"
+MY_PV="${PV/_/-}"
+SRC_URI="https://github.com/opencontainers/${PN}/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}/${PN}-${MY_PV}"
+
+LICENSE="Apache-2.0 BSD-2 BSD MIT"
+SLOT="0"
+KEYWORDS="amd64 ~arm arm64 ppc64 ~riscv ~x86"
+IUSE="apparmor +kmem +seccomp selinux test"
+
+COMMON_DEPEND="
+	apparmor? ( sys-libs/libapparmor )
+	seccomp? ( sys-libs/libseccomp )"
+DEPEND="${COMMON_DEPEND}"
+RDEPEND="${COMMON_DEPEND}
+	!app-emulation/docker-runc
+	selinux? ( sec-policy/selinux-container )"
+BDEPEND="
+	dev-go/go-md2man
+	test? ( "${RDEPEND}" )"
+
+# tests need busybox binary, and portage namespace
+# sandboxing disabled: mount-sandbox pid-sandbox ipc-sandbox
+# majority of tests pass
+RESTRICT+=" test"
+
+# Please refer:
+# https://github.com/opencontainers/runc/blob/main/script/check-config.sh
+pkg_setup() {
+	CONFIG_CHECK="
+		~NAMESPACES
+		~NET_NS
+		~PID_NS
+		~IPC_NS
+		~UTS_NS
+		~CGROUPS
+		~CGROUP_CPUACCT
+		~CGROUP_DEVICE
+		~CGROUP_FREEZER
+		~CGROUP_SCHED
+		~CPUSETS
+		~MEMCG
+		~KEYS
+		~VETH
+		~BRIDGE
+		~BRIDGE_NETFILTER
+		~IP_NF_FILTER
+		~IP_NF_TARGET_MASQUERADE
+		~NETFILTER_XT_MATCH_ADDRTYPE
+		~NETFILTER_XT_MATCH_COMMENT
+		~NETFILTER_XT_MATCH_CONNTRACK
+		~NETFILTER_XT_MATCH_IPVS
+		~IP_NF_NAT
+		~NF_NAT
+		~POSIX_MQUEUE
+		~OVERLAY_FS
+	"
+
+	CONFIG_CHECK+="
+		~USER_NS
+	"
+
+	use seccomp && CONFIG_CHECK+="
+		~SECCOMP
+		~SECCOMP_FILTER
+	"
+	WARNING_SECCOMP="CONFIG_SECCOMP is required as optional feature"
+
+	CONFIG_CHECK+="
+		~CGROUP_PIDS
+	"
+	WARNING_CGROUP_PIDS="CONFIG_CGROUP_PIDS is required as optional feature"
+
+	if kernel_is lt 6 1; then
+		CONFIG_CHECK+="
+			~MEMCG_SWAP
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~BLK_CGROUP
+		~BLK_DEV_THROTTLING
+		~CGROUP_PERF
+		~CGROUP_HUGETLB
+		~NET_CLS_CGROUP
+		~CFS_BANDWIDTH
+		~FAIR_GROUP_SCHED
+		~RT_GROUP_SCHED
+		~IP_NF_TARGET_REDIRECT
+		~IP_VS
+		~IP_VS_NFCT
+		~IP_VS_PROTO_TCP
+		~IP_VS_PROTO_UDP
+		~IP_VS_RR
+		~CHECKPOINT_RESTORE
+		~CGROUP_NET_PRIO
+	"
+
+	use selinux && CONFIG_CHECK+="
+		~SECURITY_SELINUX"
+
+	use apparmor && CONFIG_CHECK+="
+		~SECURITY_APPARMOR"
+
+	if [[ -n ${CONFIG_CHECK} ]]; then
+		linux-info_pkg_setup
+	fi
+}
+
+src_compile() {
+	# build up optional flags
+	local options=(
+		$(usev apparmor)
+		$(usev seccomp)
+		$(usex kmem '' 'nokmem')
+	)
+
+	myemakeargs=(
+		BUILDTAGS="${options[*]}"
+		COMMIT="${RUNC_COMMIT}"
+	)
+
+	emake "${myemakeargs[@]}" runc man
+}
+
+src_install() {
+	myemakeargs+=(
+		PREFIX="${ED}/usr"
+		BINDIR="${ED}/usr/bin"
+		MANDIR="${ED}/usr/share/man"
+	)
+	emake "${myemakeargs[@]}" install install-man install-bash
+
+	local DOCS=( README.md PRINCIPLES.md docs/. )
+	einstalldocs
+}
+
+src_test() {
+	emake "${myemakeargs[@]}" localunittest
+}