Script 'mail_helper' called by obssrc
Hello community,

here is the log from the commit of package libcontainers-common for 
openSUSE:Factory checked in at 2022-01-21 01:25:10
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/libcontainers-common (Old)
 and      /work/SRC/openSUSE:Factory/.libcontainers-common.new.1938 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Package is "libcontainers-common"

Fri Jan 21 01:25:10 2022 rev:44 rq:947411 version:20210626

Changes:
--------
--- 
/work/SRC/openSUSE:Factory/libcontainers-common/libcontainers-common.changes    
    2021-09-30 23:43:22.408467876 +0200
+++ 
/work/SRC/openSUSE:Factory/.libcontainers-common.new.1938/libcontainers-common.changes
      2022-01-21 01:25:29.210559767 +0100
@@ -1,0 +2,5 @@
+Tue Jan 11 12:56:24 UTC 2022 - Dan ??erm??k <dcer...@suse.com>
+
+- Switch registries.conf to v2 format
+
+-------------------------------------------------------------------
@@ -4,0 +10,96 @@
+
+0.42.3:
+
+* (*libimage.Image).HasDifferentDigest: add authentication
+
+0.42.2:
+
+    Backports for Podman 3.3.2
+    Fix the fallback runtime path
+    Switch default Rootless Networking to "CNI" for OSX
+    libimage: disk usage: catch corrupted images
+    set GOPROXY=https://proxy.golang.org
+
+
+0.44.0:
+
+    Add HelperBinariesDir field to engine config
+    Add space trimming check in sysctl.Validate
+    Cirrus: Use fresher VM images
+    Fix `pkg/sysctl` path typo
+    Fix the fallback runtime path
+    Switch default Rootless Networking to "CNI" for OSX
+    Update pkg/sysctl/sysctl.go
+    add some cni plugin paths
+    build(deps): bump github.com/containers/image/v5 from 5.15.0 to 5.16.0
+    build(deps): bump github.com/containers/storage from 1.34.0 to 1.35.0
+    build(deps): bump github.com/onsi/gomega from 1.15.0 to 1.16.0
+    build(deps): bump github.com/opencontainers/runc from 1.0.1 to 1.0.2
+    build(deps): bump github.com/opencontainers/selinux from 1.8.4 to 1.8.5
+    docs/containers.conf.5.md: Fix manpage section
+    fix untag + v0.43.2
+    libimage: disk usage: catch corrupted images
+    libimage: relax untag by digest checks
+    path: dest paths inside container should always be treated as *nix type
+    remove-image: Add optional `LookupManifest` to RemoveImagesOptions.
+    runtime: Add ReturnManifestIfPresent to LookupImageOptions
+    runtime: Add `ManifestList` to `LookupImageOptions`
+    seccomp: allow memfd_secret
+
+0.43.2:
+
+* libimage: relax untag by digest checks
+* path: dest paths inside container should always be treated as *nix type
+
+0.43.1:
+
+Fix spelling mistakes
+Fix examples in containers.conf
+
+
+0.43.0:
+
+    Add documentation for Containerfile and Dockerfile
+    Remove no_libsubid flag
+    Add machine_image to containers.conf
+    build(deps): bump github.com/containers/storage from 1.33.1 to 1.34.0
+    build(deps): bump github.com/opencontainers/selinux from 1.8.2 to 1.8.4
+    Add machine_image to containers.conf
+    Switch default logdriver and eventslogger to journald, if root
+    build(deps): bump github.com/BurntSushi/toml from 0.3.1 to 0.4.1
+    build(deps): bump github.com/onsi/gomega from 1.14.0 to 1.15.0
+    libimage: {un}tag: reject digests
+    build(deps): bump github.com/docker/docker from 20.10.7+incompatible to 
20.10.8+incompatible
+    style: complete containers#556 to-do list part 4
+    build(deps): bump github.com/containers/image/v5 from 5.14.0 to 5.15.0
+    set GOPROXY=https://proxy.golang.org
+
+
+0.42.1:
+
+* pull: fallthrough for registry parsing errors
+
+0.42.0:
+
+* Remove --accept-repositories flag
+* pull policy: support camel cases
+* Use authfile in options to search image
+* vendor in containers/storage v1.33.0
+* config: split arguments in DBUS_SESSION_BUS_ADDRESS
+* pkg/seccomp: avoid DefaultErrnoRet: null
+* Add and use libimage.Runtime.imageIDsForManifest()
+* Add libimage/manifests.LockerForImage()
+* Add support for path based registry in login/logout
+* libimage: pull: normalize docker-daemon
+* libimage: report all removed images
+* libruntime: layer tree: handle empty images
+* refine dangling filters
+* libimage.RuntimeFromStore(): stop overriding the BlobInfoCache location
+* build(deps): bump github.com/opencontainers/runc from 1.0.0 to 1.0.1
+* pull with custom platform: handle "localhost/"
+* User option to prepare container after creation for volume copy-up. Docker 
does this by default.
+* add config option for ChownCopiedFiles
+* build(deps): bump github.com/containers/storage from 1.32.5 to 1.32.6
+* libimage: image tree: fix nil deref
+
+
@@ -5,0 +107,331 @@
+
+3.3.1:
+
+### Bugfixes
+- Fixed a bug where unit files created by `podman generate systemd` could not 
cleanup shut down containers when stopped by `systemctl stop` 
([#11304](https://github.com/containers/podman/issues/11304)).
+- Fixed a bug where `podman machine` commands would not properly locate the 
`gvproxy` binary in some circumstances.
+- Fixed a bug where containers created as part of a pod using the 
`--pod-id-file` option would not join the pod's network namespace 
([#11303](https://github.com/containers/podman/issues/11303)).
+- Fixed a bug where Podman, when using the systemd cgroups driver, could 
sometimes leak dbus sessions.
+- Fixed a bug where the `until` filter to `podman logs` and `podman events` 
was improperly handled, requiring input to be negated 
([#11158](https://github.com/containers/podman/issues/11158)).
+- Fixed a bug where rootless containers using CNI networking run on systems 
using `systemd-resolved` for DNS would fail to start if resolved symlinked 
`/etc/resolv.conf` to an absolute path 
([#11358](https://github.com/containers/podman/issues/11358)).
+
+### API
+- A large number of potential file descriptor leaks from improperly closing 
client connections have been fixed.
+
+
+3.3.0:
+
+### Features
+- Containers inside VMs created by `podman machine` will now automatically 
handle port forwarding - containers in `podman machine` VMs that publish ports 
via `--publish` or `--publish-all` will have these ports not just forwarded on 
the VM, but also on the host system.
+- The `podman play kube` command's `--network` option now accepts advanced 
network options (e.g. `--network slirp4netns:port_handler=slirp4netns`) 
([#10807](https://github.com/containers/podman/issues/10807)).
+- The `podman play kube` commmand now supports Kubernetes liveness probes, 
which will be created as Podman healthchecks.
+- Podman now provides a systemd unit, `podman-restart.service`, which, when 
enabled, will restart all containers that were started with `--restart=always` 
after the system reboots.
+- Rootless Podman can now be configured to use CNI networking by default by 
using the `rootless_networking` option in `containers.conf`.
+- Images can now be pulled using `image:tag@digest` syntax (e.g. `podman pull 
fedora:34@sha256:1b0d4ddd99b1a8c8a80e885aafe6034c95f266da44ead992aab388e6aa91611a`)
 ([#6721](https://github.com/containers/podman/issues/6721)).
+- The `podman container checkpoint` and `podman container restore` commands 
can now be used to checkpoint containers that are in pods, and restore those 
containers into pods.
+- The `podman container restore` command now features a new option, 
`--publish`, to change the ports that are forwarded to a container that is 
being restored from an exported checkpoint.
+- The `podman container checkpoint` command now features a new option, 
`--compress`, to specify the compression algorithm that will be used on the 
generated checkpoint.
+- The `podman pull` command can now pull multiple images at once (e.g. `podman 
pull fedora:34 ubi8:latest` will pull both specified images).
+- THe `podman cp` command can now copy files from one container into another 
directly (e.g. `podman cp containera:/etc/hosts containerb:/etc/`) 
([#7370](https://github.com/containers/podman/issues/7370)).
+- The `podman cp` command now supports a new option, `--archive`, which 
controls whether copied files will be chown'd to the UID and GID of the user of 
the destination container.
+- The `podman stats` command now provides two additional metrics: Average CPU, 
and CPU time.
+- The `podman pod create` command supports a new flag, `--pid`, to specify the 
PID namespace of the pod. If specified, containers that join the pod will 
automatically share its PID namespace.
+- The `podman pod create` command supports a new flag, `--infra-name`, which 
allows the name of the pod's infra container to be set 
([#10794](https://github.com/containers/podman/issues/10794)).
+- The `podman auto-update` command has had its output reformatted - it is now 
much clearer what images were pulled and what containers were updated.
+- The `podman auto-update` command now supports a new option, `--dry-run`, 
which reports what would be updated but does not actually perform the update 
([#9949](https://github.com/containers/podman/issues/9949)).
+- The `podman build` command now supports a new option, `--secret`, to mount 
secrets into build containers.
+- The `podman manifest remove` command now has a new alias, `podman manifest 
rm`.
+- The `podman login` command now supports a new option, `--verbose`, to print 
detailed information about where the credentials entered were stored.
+- The `podman events` command now supports a new event, `exec_died`, which is 
produced when an exec session exits, and includes the exit code of the exec 
session.
+- The `podman system connection add` command now supports adding connections 
that connect using the `tcp://` and `unix://` URL schemes.
+- The `podman system connection list` command now supports a new flag, 
`--format`, to determine how the output is printed.
+- The `podman volume prune` and `podman volume ls` commands' `--filter` option 
now support a new filter, `until`, that matches volumes created before a 
certain time ([#10579](https://github.com/containers/podman/issues/10579)).
+- The `podman ps --filter` option's `network` filter now accepts a new value: 
`container:`, which matches containers that share a network namespace with a 
specific container 
([#10361](https://github.com/containers/podman/issues/10361)).
+- The `podman diff` command can now accept two arguments, allowing two images 
or two containers to be specified; the diff between the two will be printed 
([#10649](https://github.com/containers/podman/issues/10649)).
+- Podman can now optionally copy-up content from containers into volumes 
mounted into those containers earlier (at creation time, instead of at runtime) 
via the `prepare_on_create` option in `containers.conf` 
([#10262](https://github.com/containers/podman/issues/10262)).
+- A new option, `--gpus`, has been added to `podman create` and `podman run` 
as a no-op for better compatibility with Docker. If the 
nvidia-container-runtime package is installed, GPUs should be automatically 
added to containers without using the flag.
+- If an invalid subcommand is provided, similar commands to try will now be 
suggested in the error message.
+
+### Changes
+- The `podman system reset` command now removes non-Podman (e.g. Buildah and 
CRI-O) containers as well.
+- The new port forwarding offered by `podman machine` requires 
[gvproxy](https://github.com/containers/gvisor-tap-vsock) in order to function.
+- Podman will now automatically create the default CNI network if it does not 
exist, for both root and rootless users. This will only be done once per user - 
if the network is subsequently removed, it will not be recreated.
+- The `install.cni` makefile option has been removed. It is no longer required 
to distribute the default `87-podman.conflist` CNI configuration file, as 
Podman will now automatically create it.
+- The `--root` option to Podman will not automatically clear all default 
storage options when set. Storage options can be set manually using 
`--storage-opt` ([#10393](https://github.com/containers/podman/issues/10393)).
+- The output of `podman system connection list` is now deterministic, with 
connections being sorted alpabetically by their name.
+- The auto-update service (`podman-auto-update.service`) has had its default 
timer adjusted so it now starts at a random time up to 15 minutes after 
midnight, to help prevent system congestion from numerous daily services run at 
once.
+- Systemd unit files generated by `podman generate systemd` now depend on 
`network-online.target` by default 
([#10655](https://github.com/containers/podman/issues/10655)).
+- Systemd unit files generated by `podman generate systemd` now use 
`Type=notify` by default, instead of using PID files.
+- The `podman info` command's logic for detecting package versions on Gentoo 
has been improved, and should be significantly faster.
+
+### Bugfixes
+- Fixed a bug where the `podman play kube` command did not perform SELinux 
relabelling of volumes specified with a `mountPath` that included the `:z` or 
`:Z` options ([#9371](https://github.com/containers/podman/issues/9371)).
+- Fixed a bug where the `podman play kube` command would ignore the `USER` and 
`EXPOSE` directives in images 
([#9609](https://github.com/containers/podman/issues/9609)).
+- Fixed a bug where the `podman play kube` command would only accept lowercase 
pull policies.
+- Fixed a bug where named volumes mounted into containers with the `:z` or 
`:Z` options were not appropriately relabelled for access from the container 
([#10273](https://github.com/containers/podman/issues/10273)).
+- Fixed a bug where the `podman logs -f` command, with the `journald` log 
driver, could sometimes fail to pick up the last line of output from a 
container ([#10323](https://github.com/containers/podman/issues/10323)).
+- Fixed a bug where running `podman rm` on a container created with the `--rm` 
option would occasionally emit an error message saying the container failed to 
be removed, when it was successfully removed.
+- Fixed a bug where starting a Podman container would segfault if the 
`LISTEN_PID` and `LISTEN_FDS` environment variables were set, but 
`LISTEN_FDNAMES` was not 
([#10435](https://github.com/containers/podman/issues/10435)).
+- Fixed a bug where exec sessions in containers were sometimes not cleaned up 
when run without `-d` and when the associated `podman exec` process was killed 
before completion.
+- Fixed a bug where `podman system service` could, when run in a systemd unit 
file with sdnotify in use, drop some connections when it was starting up.
+- Fixed a bug where containers run using the REST API using the `slirp4netns` 
network mode would leave zombie processes that were not cleaned up until 
`podman system service` exited 
([#9777](https://github.com/containers/podman/issues/9777)).
+- Fixed a bug where the `podman system service` command would leave zombie 
processes after its initial launch that were not cleaned up until it exited 
([#10575](https://github.com/containers/podman/issues/10575)).
+- Fixed a bug where VMs created by `podman machine` could not be started after 
the host system restarted 
([#10824](https://github.com/containers/podman/issues/10824)).
+- Fixed a bug where the `podman pod ps` command would not show headers for 
optional information (e.g. container names when the `--ctr-names` option was 
given).
+- Fixed a bug where the remote Podman client's `podman create` and `podman 
run` commands would ignore timezone configuration from the server's 
`containers.conf` file 
([#11124](https://github.com/containers/podman/issues/11124)).
+- Fixed a bug where the remote Podman client's `podman build` command would 
only respect `.containerignore` and not `.dockerignore` files (when both are 
present, `.containerignore` will be preferred) 
([#10907](https://github.com/containers/podman/issues/10907)).
+- Fixed a bug where the remote Podman client's `podman build` command would 
fail to send the Dockerfile being built to the server when it was excluded by 
the `.dockerignore` file, resulting in an error 
([#9867](https://github.com/containers/podman/issues/9867)).
+- Fixed a bug where the remote Podman client's `podman build` command could 
unexpectedly stop streaming the output of the build 
([#10154](https://github.com/containers/podman/issues/10154)).
+- Fixed a bug where the remote Podman client's `podman build` command would 
fail to build when run on Windows 
([#11259](https://github.com/containers/podman/issues/11259)).
+- Fixed a bug where the `podman manifest create` command accepted at most two 
arguments (an arbitrary number of images are allowed as arguments, which will 
be added to the manifest).
+- Fixed a bug where named volumes would not be properly chowned to the UID and 
GID of the directory they were mounted over when first mounted into a container 
([#10776](https://github.com/containers/podman/issues/10776)).
+- Fixed a bug where named volumes created using a volume plugin would be 
removed from Podman, even if the plugin reported a failure to remove the volume 
([#11214](https://github.com/containers/podman/issues/11214)).
+- Fixed a bug where the remote Podman client's `podman exec -i` command would 
hang when input was provided via shell redirection (e.g. `podman --remote exec 
-i foo cat <<<"hello"`) 
([#7360](https://github.com/containers/podman/issues/7360)).
+- Fixed a bug where containers created with `--rm` were not immediately 
removed after being started by `podman start` if they failed to start 
([#10935](https://github.com/containers/podman/issues/10935)).
+- Fixed a bug where the `--storage-opt` flag to `podman create` and `podman 
run` was nonfunctional 
([#10264](https://github.com/containers/podman/issues/10264)).
+- Fixed a bug where the `--device-cgroup-rule` option to `podman create` and 
`podman run` was nonfunctional 
([#10302](https://github.com/containers/podman/issues/10302)).
+- Fixed a bug where the `--tls-verify` option to `podman manifest push` was 
nonfunctional.
+- Fixed a bug where the `podman import` command could, in some circumstances, 
produce empty images 
([#10994](https://github.com/containers/podman/issues/10994)).
+- Fixed a bug where images pulled using the `docker-daemon:` transport had the 
wrong registry (`localhost` instead of `docker.io/library`) 
([#10998](https://github.com/containers/podman/issues/10998)).
+- Fixed a bug where operations that pruned images (`podman image prune` and 
`podman system prune`) would prune untagged images with children 
([#10832](https://github.com/containers/podman/issues/10832)).
+- Fixed a bug where dual-stack networks created by `podman network create` did 
not properly auto-assign an IPv4 subnet when one was not explicitly specified 
([#11032](https://github.com/containers/podman/issues/11032)).
+- Fixed a bug where port forwarding using the `rootlessport` port forwarder 
would break when a network was disconnected and then reconnected 
([#10052](https://github.com/containers/podman/issues/10052)).
+- Fixed a bug where Podman would ignore user-specified SELinux policies for 
containers using the Kata OCI runtime, or containers using systemd as PID 1 
([#11100](https://github.com/containers/podman/issues/11100)).
+- Fixed a bug where Podman containers created using `--net=host` would add an 
entry to `/etc/hosts` for the container's hostname pointing to `127.0.1.1` 
([#10319](https://github.com/containers/podman/issues/10319)).
++++ 3453 more lines (skipped)
++++ between 
/work/SRC/openSUSE:Factory/libcontainers-common/libcontainers-common.changes
++++ and 
/work/SRC/openSUSE:Factory/.libcontainers-common.new.1938/libcontainers-common.changes

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Other differences:
------------------
++++++ registries.conf ++++++
--- /var/tmp/diff_new_pack.CBg6N8/_old  2022-01-21 01:25:29.942554749 +0100
+++ /var/tmp/diff_new_pack.CBg6N8/_new  2022-01-21 01:25:29.946554722 +0100
@@ -1,21 +1,78 @@
 # For more information on this configuration file, see 
containers-registries.conf(5).
 #
-# Registries to search for images that are not fully-qualified.
-# i.e. foobar.com/my_image:latest vs my_image:latest
-[registries.search]
-registries = ["registry.opensuse.org", "docker.io"]
-
-# Registries that do not use TLS when pulling images or uses self-signed
-# certificates.
-[registries.insecure]
-registries = []
-
-# Blocked Registries, blocks the `docker daemon` from pulling from the blocked 
registry.  If you specify
-# "*", then the docker daemon will only be allowed to pull from registries 
listed above in the search
-# registries.  Blocked Registries is deprecated because other container 
runtimes and tools will not use it.
-# It is recommended that you use the trust policy file 
/etc/containers/policy.json to control which
-# registries you want to allow users to pull and push from.  policy.json gives 
greater flexibility, and
-# supports all container runtimes and tools including the docker daemon, 
cri-o, buildah ...
-[registries.block]
-registries = []
+# NOTE: RISK OF USING UNQUALIFIED IMAGE NAMES
+# We recommend always using fully qualified image names including the registry
+# server (full dns name), namespace, image name, and tag
+# (e.g., registry.opensuse.org/opensuse/tumbleweed:latest). Pulling by digest 
(i.e.,
+# registry.opensuse.org/project/name@digest) further eliminates the ambiguity 
of tags.
+# When using short names, there is always an inherent risk that the image being
+# pulled could be spoofed. For example, a user wants to pull an image named
+# `foobar` from a registry and expects it to come from myregistry.com. If
+# myregistry.com is not first in the search list, an attacker could place a
+# different `foobar` image at a registry earlier in the search list. The user
+# would accidentally pull and run the attacker's image and code rather than the
+# intended content. We recommend only adding registries which are completely
+# trusted (i.e., registries which don't allow unknown or anonymous users to
+# create accounts with arbitrary names). This will prevent an image from being
+# spoofed, squatted or otherwise made insecure.  If it is necessary to use one
+# of these registries, it should be added at the end of the list.
+#
+# # An array of host[:port] registries to try when pulling an unqualified 
image, in order.
+unqualified-search-registries = ["registry.opensuse.org", "docker.io"]
+#
+# [[registry]]
+# # The "prefix" field is used to choose the relevant [[registry]] TOML table;
+# # (only) the TOML table with the longest match for the input image name
+# # (taking into account namespace/repo/tag/digest separators) is used.
+# # 
+# # The prefix can also be of the form: *.example.com for wildcard subdomain
+# # matching.
+# #
+# # If the prefix field is missing, it defaults to be the same as the 
"location" field.
+# prefix = "example.com/foo"
+#
+# # If true, unencrypted HTTP as well as TLS connections with untrusted
+# # certificates are allowed.
+# insecure = false
+#
+# # If true, pulling images with matching names is forbidden.
+# blocked = false
+#
+# # The physical location of the "prefix"-rooted namespace.
+# #
+# # By default, this is equal to "prefix" (in which case "prefix" can be 
omitted
+# # and the [[registry]] TOML table can only specify "location").
+# #
+# # Example: Given
+# #   prefix = "example.com/foo"
+# #   location = "internal-registry-for-example.net/bar"
+# # requests for the image example.com/foo/myimage:latest will actually work 
with the
+# # internal-registry-for-example.net/bar/myimage:latest image.
+#
+# # The location can be empty iff prefix is in a
+# # wildcarded format: "*.example.com". In this case, the input reference will
+# # be used as-is without any rewrite.
+# location = internal-registry-for-example.com/bar"
+#
+# # (Possibly-partial) mirrors for the "prefix"-rooted namespace.
+# #
+# # The mirrors are attempted in the specified order; the first one that can be
+# # contacted and contains the image will be used (and if none of the mirrors 
contains the image,
+# # the primary location specified by the "registry.location" field, or using 
the unmodified
+# # user-specified reference, is tried last).
+# #
+# # Each TOML table in the "mirror" array can contain the following fields, 
with the same semantics
+# # as if specified in the [[registry]] TOML table directly:
+# # - location
+# # - insecure
+# [[registry.mirror]]
+# location = "example-mirror-0.local/mirror-for-foo"
+# [[registry.mirror]]
+# location = "example-mirror-1.local/mirrors/foo"
+# insecure = true
+# # Given the above, a pull of example.com/foo/image:latest will try:
+# # 1. example-mirror-0.local/mirror-for-foo/image:latest
+# # 2. example-mirror-1.local/mirrors/foo/image:latest
+# # 3. internal-registry-for-example.net/bar/image:latest
+# # in order, and use the first one that exists.
 

Reply via email to