Weekly portage-stable package updates 2026-08-24

.github/workflows/portage-stable-packages-list

@@ -516,6 +516,7 @@ eclass/wrapper.eclass
 eclass/xdg-utils.eclass
 eclass/xdg.eclass
 eclass/xorg-3.eclass
+eclass/xorg-meson.eclass
 
 licenses
 

build_library/dev_container_util.sh

@@ -22,7 +22,7 @@ configure_dev_portage() {
     local repo
     for repo in portage-stable coreos-overlay; do
         sudo mkdir -p "${root_fs_dir}/var/lib/portage/${repo}"
-        sudo rsync -rtl --exclude=md5-cache \
+        sudo rsync -rtl --exclude=md5-cache --insecure-links \
             "${SRC_ROOT}/third_party/${repo}/metadata" \
             "${SRC_ROOT}/third_party/${repo}/profiles" \
             "${root_fs_dir}/var/lib/portage/${repo}"

build_library/prod_image_util.sh

@@ -134,7 +134,7 @@ create_prod_image() {
   fi
 
   sudo cp -a "${root_fs_dir}" "${BUILD_DIR}/root_fs_dir2"
-  sudo rsync -a --delete  "${BUILD_DIR}/configroot/etc/portage" "${BUILD_DIR}/root_fs_dir2/etc"
+  sudo rsync -a --delete --insecure-links "${BUILD_DIR}/configroot/etc/portage" "${BUILD_DIR}/root_fs_dir2/etc"
   sudo mksquashfs "${BUILD_DIR}/root_fs_dir2"  "${BUILD_DIR}/${image_sysext_base}" -noappend -xattrs-exclude '^btrfs.'
   sudo rm -rf "${BUILD_DIR}/root_fs_dir2"
 

changelog/security/2026-08-28-weekly-updates.md

@@ -0,0 +1,12 @@
+- expat ([CVE-2026-72522](https://www.cve.org/CVERecord?id=CVE-2026-72522))
+- glib ([CVE-2026-15588](https://www.cve.org/CVERecord?id=CVE-2026-15588))
+- go ([CVE-2026-33818](https://www.cve.org/CVERecord/?id=CVE-2026-33818), [CVE-2026-39821](https://www.cve.org/CVERecord/?id=CVE-2026-39821), [CVE-2026-46600](https://www.cve.org/CVERecord/?id=CVE-2026-46600), [CVE-2026-56853](https://www.cve.org/CVERecord/?id=CVE-2026-56853), [CVE-2026-56858](https://www.cve.org/CVERecord/?id=CVE-2026-56858), [CVE-2026-56859](https://www.cve.org/CVERecord/?id=CVE-2026-56859), [CVE-2026-56860](https://www.cve.org/CVERecord/?id=CVE-2026-56860), [CVE-2026-56862](https://www.cve.org/CVERecord/?id=CVE-2026-56862), [CVE-2026-56864](https://www.cve.org/CVERecord/?id=CVE-2026-56864), [CVE-2026-56865](https://www.cve.org/CVERecord/?id=CVE-2026-56865))
+- incus ([CVE-2026-62867](https://www.cve.org/CVERecord?id=CVE-2026-62867), [CVE-2026-62940](https://www.cve.org/CVERecord?id=CVE-2026-62940), [CVE-2026-62941](https://www.cve.org/CVERecord?id=CVE-2026-62941), [CVE-2026-63125](https://www.cve.org/CVERecord?id=CVE-2026-63125), [CVE-2026-63343](https://www.cve.org/CVERecord?id=CVE-2026-63343), [GHSA-26gp-p5fw-3r2h](https://github.com/lxc/incus/security/advisories/GHSA-26gp-p5fw-3r2h), [GHSA-67qw-68v3-36h6](https://github.com/lxc/incus/security/advisories/GHSA-67qw-68v3-36h6), [GHSA-7fj9-65v4-rp7h](https://github.com/lxc/incus/security/advisories/GHSA-7fj9-65v4-rp7h), [GHSA-p2v3-6wvc-cv3p](https://github.com/lxc/incus/security/advisories/GHSA-p2v3-6wvc-cv3p), [GHSA-4qxq-p5hm-3q3p](https://github.com/lxc/incus/security/advisories/GHSA-4qxq-p5hm-3q3p), [GHSA-m3j6-p3v3-qmjv](https://github.com/lxc/incus/security/advisories/GHSA-m3j6-p3v3-qmjv), [CVE-2026-62313](https://www.cve.org/CVERecord/?id=CVE-2026-62313), [GHSA-6v6x-387m-rj4w](https://github.com/lxc/incus/security/advisories/GHSA-6v6x-387m-rj4w))
+- intel-microcode ([CVE-2025-31936](https://www.cve.org/CVERecord?id=CVE-2025-31936), [CVE-2025-31938](https://www.cve.org/CVERecord?id=CVE-2025-31938), [CVE-2025-35973](https://www.cve.org/CVERecord?id=CVE-2025-35973), [CVE-2026-20707](https://www.cve.org/CVERecord?id=CVE-2026-20707), [CVE-2026-20713](https://www.cve.org/CVERecord?id=CVE-2026-20713), [CVE-2026-20716](https://www.cve.org/CVERecord?id=CVE-2026-20716), [CVE-2026-20760](https://www.cve.org/CVERecord?id=CVE-2026-20760), [CVE-2026-20917](https://www.cve.org/CVERecord?id=CVE-2026-20917))
+- open-iscsi ([CVE-2026-44943](https://www.cve.org/CVERecord?id=CVE-2026-44943), [CVE-2026-44944](https://www.cve.org/CVERecord?id=CVE-2026-44944))
+- openssh ([CVE-2026-73281](https://www.cve.org/CVERecord?id=CVE-2026-73281), [CVE-2026-73282](https://www.cve.org/CVERecord?id=CVE-2026-73282), [CVE-2026-73283](https://www.cve.org/CVERecord?id=CVE-2026-73283))
+- openssl ([CVE-2026-14456](https://www.cve.org/CVERecord?id=CVE-2026-14456), [CVE-2026-14457](https://www.cve.org/CVERecord?id=CVE-2026-14457), [CVE-2026-18798](https://www.cve.org/CVERecord?id=CVE-2026-18798), [CVE-2026-54874](https://www.cve.org/CVERecord?id=CVE-2026-54874), [CVE-2026-63072](https://www.cve.org/CVERecord?id=CVE-2026-63072), [CVE-2026-63073](https://www.cve.org/CVERecord?id=CVE-2026-63073), [CVE-2026-63074](https://www.cve.org/CVERecord?id=CVE-2026-63074), [CVE-2026-63075](https://www.cve.org/CVERecord?id=CVE-2026-63075), [CVE-2026-63076](https://www.cve.org/CVERecord?id=CVE-2026-63076), [CVE-2026-75803](https://www.cve.org/CVERecord?id=CVE-2026-75803))
+- rpcbind ([CVE-2026-16277](https://www.cve.org/CVERecord?id=CVE-2026-16277), [CVE-2026-16461](https://www.cve.org/CVERecord?id=CVE-2026-16461))
+- rsync ([CVE-2026-53783](https://www.cve.org/CVERecord?id=CVE-2026-53783), [CVE-2026-53784](https://www.cve.org/CVERecord?id=CVE-2026-53784), [CVE-2026-53785](https://www.cve.org/CVERecord?id=CVE-2026-53785), [CVE-2026-53786](https://www.cve.org/CVERecord?id=CVE-2026-53786), [CVE-2026-53788](https://www.cve.org/CVERecord?id=CVE-2026-53788), [CVE-2026-53789](https://www.cve.org/CVERecord?id=CVE-2026-53789), [CVE-2026-53790](https://www.cve.org/CVERecord?id=CVE-2026-53790), [CVE-2026-53791](https://www.cve.org/CVERecord?id=CVE-2026-53791), [CVE-2026-53792](https://www.cve.org/CVERecord?id=CVE-2026-53792), [CVE-2026-53793](https://www.cve.org/CVERecord?id=CVE-2026-53793), [CVE-2026-53794](https://www.cve.org/CVERecord?id=CVE-2026-53794), [CVE-2026-53795](https://www.cve.org/CVERecord?id=CVE-2026-53795), [CVE-2026-53796](https://www.cve.org/CVERecord?id=CVE-2026-53796), [CVE-2026-53797](https://www.cve.org/CVERecord?id=CVE-2026-53797), [CVE-2026-53798](https://www.cve.org/CVERecord?id=CVE-2026-53798), [CVE-2026-53799](https://www.cve.org/CVERecord?id=CVE-2026-53799), [CVE-2026-53800](https://www.cve.org/CVERecord?id=CVE-2026-53800), [CVE-2026-53801](https://www.cve.org/CVERecord?id=CVE-2026-53801), [CVE-2026-53802](https://www.cve.org/CVERecord?id=CVE-2026-53802), [CVE-2026-53803](https://www.cve.org/CVERecord?id=CVE-2026-53803), [CVE-2026-70452](https://www.cve.org/CVERecord?id=CVE-2026-70452), [CVE-2026-70453](https://www.cve.org/CVERecord?id=CVE-2026-70453), [CVE-2026-70454](https://www.cve.org/CVERecord?id=CVE-2026-70454), [CVE-2026-70455](https://www.cve.org/CVERecord?id=CVE-2026-70455), [CVE-2026-70456](https://www.cve.org/CVERecord?id=CVE-2026-70456), [CVE-2026-70457](https://www.cve.org/CVERecord?id=CVE-2026-70457), [CVE-2026-70458](https://www.cve.org/CVERecord?id=CVE-2026-70458), [CVE-2026-70459](https://www.cve.org/CVERecord?id=CVE-2026-70459), [CVE-2026-70460](https://www.cve.org/CVERecord?id=CVE-2026-70460), [CVE-2026-70461](https://www.cve.org/CVERecord?id=CVE-2026-70461), [CVE-2026-70462](https://www.cve.org/CVERecord?id=CVE-2026-70462), [CVE-2026-70463](https://www.cve.org/CVERecord?id=CVE-2026-70463), [CVE-2026-70464](https://www.cve.org/CVERecord?id=CVE-2026-70464))
+- unzip (CAN-2026-2034440, CAN-2026-2034442, CAN-2026-2034443)
+- zip ([zip-20260814](https://sintonen.fi/advisories/infozip-test-option-command-injection.txt))

changelog/updates/2026-08-28-weekly-updates.md

@@ -0,0 +1,31 @@
+- SDK: go ([1.26.7](https://go.dev/doc/devel/release#go1.26.7) (includes [1.26.6](https://go.dev/doc/devel/release#go1.26.6)))
+- SDK: meson ([1.11.2](https://github.com/mesonbuild/meson/commits/1.11.2/))
+- SDK: pkgcheck ([0.10.42](https://github.com/pkgcore/pkgcheck/releases/tag/v0.10.42) (includes [0.10.41](https://github.com/pkgcore/pkgcheck/releases/tag/v0.10.41)))
+- SDK: rust ([1.96.1](https://blog.rust-lang.org/2026/06/30/Rust-1.96.1/) (includes [1.96.0](https://blog.rust-lang.org/2026/05/28/Rust-1.96.0/)))
+- base, dev: bash ([5.3_p15](https://cgit.git.savannah.gnu.org/cgit/bash.git/log/?id=b460816602167718f78a6233164e8875f49b75b2))
+- base, dev: bind ([9.20.26](https://bind9.readthedocs.io/en/v9.20.26/notes.html#notes-for-bind-9-20-26) (includes [9.20.25](https://bind9.readthedocs.io/en/v9.20.25/notes.html#notes-for-bind-9-20-25), [9.20.24](https://bind9.readthedocs.io/en/v9.20.24/notes.html#notes-for-bind-9-20-24)))
+- base, dev: expat ([2.8.3](https://blog.hartwork.org/posts/expat-2-8-3-released/))
+- base, dev: findutils ([4.11.0](https://cgit.git.savannah.gnu.org/cgit/findutils.git/tree/NEWS?h=v4.11.0))
+- base, dev: glib ([2.88.3](https://gitlab.gnome.org/GNOME/glib/-/releases/2.88.3))
+- base, dev: gnupg ([2.5.21](https://dev.gnupg.org/T8262.html))
+- base, dev: intel-microcode ([20260812_p20260813](https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20260812) (includes [20260811_p20260811](https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20260811)))
+- base, dev: leancrypto ([1.8.0](https://leancrypto.org/leancrypto/releases/leancrypto-1.8.0/index.html))
+- base, dev: libevent ([2.1.13](https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable))
+- base, dev: openssh ([10.5_p1](https://www.openssh.org/txt/release-10.5))
+- base, dev: rsync ([3.5.0](https://download.samba.org/pub/rsync/NEWS#3.5.0))
+- base, dev: sqlite ([3.53.3](https://sqlite.org/releaselog/3_53_3.html))
+- base, dev: unzip ([6.0_p31](https://metadata.ftp-master.debian.org/changelogs//main/u/unzip/unzip_6.0-31_changelog))
+- base, dev: zip ([3.0_p16](https://metadata.ftp-master.debian.org/changelogs//main/z/zip/zip_3.0-16_changelog))
+- dev: bash-completion ([2.18.0](https://cgit.git.savannah.gnu.org/cgit/bash.git/log/?id=b460816602167718f78a6233164e8875f49b75b2))
+- dev: binutils ([2.46.1](https://lists.gnu.org/archive/html/info-gnu/2026-06/msg00003.html))
+- dev: gentoolkit ([0.8.0](https://gitweb.gentoo.org/proj/gentoolkit.git/log/?h=gentoolkit-0.8.0))
+- dev: pahole ([1.31](https://git.kernel.org/pub/scm/devel/pahole/pahole.git/tag/?h=v1.31))
+- dev: portage ([3.0.81.3](https://raw.githubusercontent.com/gentoo/portage/refs/tags/portage-3.0.81.3/NEWS))
+- sysext-containerd: containerd ([2.3.4](https://github.com/containerd/containerd/releases/tag/v2.3.4))
+- sysext-incus: incus ([7.3](https://discuss.linuxcontainers.org/t/incus-7-3-has-been-released/27033))
+- sysext-podman: gpgme ([2.1.2](https://raw.githubusercontent.com/gpg/gpgme/refs/tags/gpgme-2.1.2/NEWS))
+- sysext-python: charset-normalizer ([3.4.9](https://github.com/jawah/charset_normalizer/releases/tag/3.4.9))
+- sysext-python: jaraco-functools ([4.6.0](https://raw.githubusercontent.com/jaraco/jaraco.functools/refs/tags/v4.6.0/NEWS.rst))
+- sysext-python: jaraco-text ([4.3.0](https://raw.githubusercontent.com/jaraco/jaraco.text/refs/tags/v4.3.0/NEWS.rst))
+- sysext-python: platformdirs ([4.10.1](https://github.com/tox-dev/platformdirs/releases/tag/4.10.1))
+- sysext-python: setuptools ([83.0.0](https://raw.githubusercontent.com/pypa/setuptools/refs/tags/v83.0.0/NEWS.rst))

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/net-nds/rpcbind/0001-rpcinfo-stack-buffer-overflow-in-rpcinfo-rpcbaddrlis.patch

@@ -0,0 +1,30 @@
+From bb9bb7286a4c345442946dc2ce3c9e7f67e96d4d Mon Sep 17 00:00:00 2001
+From: Steve Dickson <steved@redhat.com>
+Date: Wed, 27 May 2026 11:42:11 -0400
+Subject: [PATCH] rpcinfo: stack buffer overflow in rpcinfo rpcbaddrlist()
+
+rpcinfo's rpcbaddrlist() formats two server-controlled, unbounded XDR strings into a fixed 128-byte stack buffer with sprintf(). A malicious or on-path rpcbind server overflows it when a user runs:
+rpcinfo -l <host> <prognum> <versnum>
+
+Reported-by: Michalis Vasileiadis <vmihalis.tmd@gmail.com>
+Signed-off-by: Steve Dickson <steved@redhat.com>
+---
+ src/rpcinfo.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/rpcinfo.c b/src/rpcinfo.c
+index c59e8b4..30d535e 100644
+--- a/src/rpcinfo.c
++++ b/src/rpcinfo.c
+@@ -1104,7 +1104,7 @@ rpcbaddrlist (
+
+ 	  re = &head->rpcb_entry_map;
+ 	  printf ("%10u%3u    ", parms.r_prog, parms.r_vers);
+-	  sprintf (buf, "%s/%s/%s ",
++	  snprintf (buf, sizeof(buf), "%s/%s/%s ",
+ 		   re->r_nc_protofmly, re->r_nc_proto,
+ 		   re->r_nc_semantics == NC_TPI_CLTS ? "clts" :
+ 		   re->r_nc_semantics == NC_TPI_COTS ? "cots" : "cots_ord");
+-- 
+2.54.0
+

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/net-nds/rpcbind/0002-rpcinfo-stack-buffer-overflow-in-rpcinfo-rpcbdump.patch

@@ -0,0 +1,47 @@
+From 62371b84babbc2f3546edb44d7d2b1ba62429d03 Mon Sep 17 00:00:00 2001
+From: Krzesimir Nowak <knowak@microsoft.com>
+Date: Tue, 25 Aug 2026 20:19:01 +0200
+Subject: [PATCH] rpcinfo: stack buffer overflow in rpcinfo rpcbdump()
+
+rpcinfo's rpcbdump() formats a server-controlled list of versions into
+a fixed size buffer with sprintf(). A malicious server returning a
+large number of versions may overflow it.
+
+Reported-by: Michalis Vasileiadis <vmihalis.tmd@gmail.com>
+Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
+---
+ src/rpcinfo.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/src/rpcinfo.c b/src/rpcinfo.c
+index 30d535e..9917913 100644
+--- a/src/rpcinfo.c
++++ b/src/rpcinfo.c
+@@ -958,17 +958,19 @@ rpcbdump (
+       for (rs = rs_head; rs; rs = rs->next)
+ 	{
+ 	  size_t netidmax = sizeof(buf) - 1;
+-	  char *p = buf;
++	  int l = 0;
+
+ 	  printf ("%10ld  ", rs->prog);
+ 	  for (vl = rs->vlist; vl; vl = vl->next)
+ 	    {
+-	      sprintf (p, "%d", vl->vers);
+-	      p = p + strlen (p);
++	      l += printf ("%d", vl->vers);
+ 	      if (vl->next)
+-		sprintf (p++, ",");
++		l += printf (",");
+ 	    }
+-	  printf ("%-10s", buf);
++	  if (l < 10)
++	    printf("%*s", 10 - l, " ");
++	  else
++	    printf(" ");
+ 	  buf[0] = '\0';
+
+           for (nl = rs->nlist; nl; nl = nl->next)
+-- 
+2.54.0
+

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/net-nds/rpcbind/README.md

@@ -0,0 +1,7 @@
+The patch
+`0001-rpcinfo-stack-buffer-overflow-in-rpcinfo-rpcbaddrlis.patch`
+fixes CVE-2026-16277 and can be dropped when updating to rpcbind
+1.2.9. The patch
+`0002-rpcinfo-stack-buffer-overflow-in-rpcinfo-rpcbdump.patch` fixes
+CVE-2026-16461 and, as of 2026-08-25, this hasn't been yet fixed by
+upstream.