Weekly portage-stable package updates 2026-09-14

.github/workflows/portage-stable-packages-list

@@ -357,6 +357,7 @@ dev-python/platformdirs
 dev-python/pluggy
 dev-python/ply
 dev-python/poetry-core
+dev-python/py-landlock
 dev-python/pycparser
 dev-python/pydecomp
 dev-python/pygments
@@ -371,6 +372,7 @@ dev-python/six
 dev-python/snakeoil
 dev-python/tomli
 dev-python/tomli-w
+dev-python/tomlkit
 dev-python/tree-sitter
 dev-python/trove-classifiers
 dev-python/truststore

changelog/security/2026-09-14-weekly-updates.md

@@ -0,0 +1,13 @@
+- containerd ([CVE-2026-53495](https://www.cve.org/CVERecord?id=CVE-2026-53495), [GHSA-rp3h-jf77-q9p4](https://github.com/containerd/containerd/security/advisories/GHSA-rp3h-jf77-q9p4))
+- cpio ([CVE-2026-66485](https://www.cve.org/CVERecord?id=CVE-2026-66485), [CVE-2026-66486](https://www.cve.org/CVERecord?id=CVE-2026-66486))
+- cri-tools ([CVE-2026-34040](https://www.cve.org/CVERecord?id=CVE-2026-34040), [CVE-2026-41567](https://www.cve.org/CVERecord?id=CVE-2026-41567), [CVE-2026-42306](https://www.cve.org/CVERecord?id=CVE-2026-42306), [CVE-2026-39883](https://www.cve.org/CVERecord?id=CVE-2026-39883))
+- crun ([CVE-2026-88264](https://www.cve.org/CVERecord?id=CVE-2026-88264), [CVE-2026-88265](https://www.cve.org/CVERecord?id=CVE-2026-88265))
+- curl ([CVE-2026-13608](https://www.cve.org/CVERecord?id=CVE-2026-13608), [CVE-2026-18924](https://www.cve.org/CVERecord?id=CVE-2026-18924), [CVE-2026-19931](https://www.cve.org/CVERecord?id=CVE-2026-19931), [CVE-2026-80229](https://www.cve.org/CVERecord?id=CVE-2026-80229), [CVE-2026-80230](https://www.cve.org/CVERecord?id=CVE-2026-80230), [CVE-2026-80231](https://www.cve.org/CVERecord?id=CVE-2026-80231), [CVE-2026-80255](https://www.cve.org/CVERecord?id=CVE-2026-80255), [CVE-2026-80256](https://www.cve.org/CVERecord?id=CVE-2026-80256))
+- gawk ([CVE-2026-40553](https://www.cve.org/CVERecord?id=CVE-2026-40553), [CVE-2026-40467](https://www.cve.org/CVERecord?id=CVE-2026-40467), [CVE-2026-40468](https://www.cve.org/CVERecord?id=CVE-2026-40468))
+- libpcap ([CVE-2026-0799](https://www.cve.org/CVERecord?id=CVE-2026-0799), [CVE-2026-18238](https://www.cve.org/CVERecord?id=CVE-2026-18238), [CVE-2026-18313](https://www.cve.org/CVERecord?id=CVE-2026-18313), [CVE-2026-31911](https://www.cve.org/CVERecord?id=CVE-2026-31911), [CVE-2026-31912](https://www.cve.org/CVERecord?id=CVE-2026-31912), [CVE-2026-6244](https://www.cve.org/CVERecord?id=CVE-2026-6244), [CVE-2026-6554](https://www.cve.org/CVERecord?id=CVE-2026-6554))
+- libpcre2 ([CVE-2026-86145](https://www.cve.org/CVERecord?id=CVE-2026-86145), [CVE-2026-89156](https://www.cve.org/CVERecord?id=CVE-2026-89156), [CVE-2026-89161](https://www.cve.org/CVERecord?id=CVE-2026-89161), [GHSA-9qww-pwc4-77qq](https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-9qww-pwc4-77qq), [GHSA-q7rw-r7qq-2hx6](https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q7rw-r7qq-2hx6))
+- libxml2 ([CVE-2026-86137](https://www.cve.org/CVERecord?id=CVE-2026-86137), [CVE-2026-86138](https://www.cve.org/CVERecord?id=CVE-2026-86138), [CVE-2026-86139](https://www.cve.org/CVERecord?id=CVE-2026-86139), [CVE-2026-86140](https://www.cve.org/CVERecord?id=CVE-2026-86140), [CVE-2026-86141](https://www.cve.org/CVERecord?id=CVE-2026-86141), [CVE-2026-86142](https://www.cve.org/CVERecord?id=CVE-2026-86142), [CVE-2026-86143](https://www.cve.org/CVERecord?id=CVE-2026-86143), [CVE-2026-86144](https://www.cve.org/CVERecord?id=CVE-2026-86144))
+- nghttp2 ([CVE-2026-58055](https://www.cve.org/CVERecord?id=CVE-2026-58055))
+- python ([CVE-2026-19672](https://www.cve.org/CVERecord?id=CVE-2026-19672))
+- sssd ([CVE-2026-87853](https://www.cve.org/CVERecord?id=CVE-2026-87853))
+- xz-utils ([GHSA-5qpq-xqfv-j9pg](https://github.com/tukaani-project/xz/security/advisories/GHSA-5qpq-xqfv-j9pg))

changelog/updates/2026-09-14-weekly-updates.md

@@ -0,0 +1,26 @@
+- SDK: pkgcheck ([0.10.43](https://github.com/pkgcore/pkgcheck/releases/tag/v0.10.43))
+- base, dev: checkpolicy ([3.11](https://github.com/SELinuxProject/selinux/releases/tag/3.11))
+- base, dev: cri-tools ([1.37.0](https://github.com/kubernetes-sigs/cri-tools/releases/tag/v1.37.0))
+- base, dev: curl ([8.22.0](https://curl.se/ch/8.22.0.html))
+- base, dev: dracut ([112](https://github.com/dracut-ng/dracut/releases/tag/112))
+- base, dev: gawk ([5.4.1](https://lists.gnu.org/archive/html/info-gnu/2026-07/msg00001.html) (includes [5.4.0](https://lists.gnu.org/archive/html/info-gnu/2026-02/msg00011.html)))
+- base, dev: libgcrypt ([1.12.4](https://lists.gnu.org/archive/html/info-gnu/2026-09/msg00002.html))
+- base, dev: libpcap ([1.10.7](https://raw.githubusercontent.com/the-tcpdump-group/libpcap/refs/tags/libpcap-1.10.7/CHANGES))
+- base, dev: libpcre2 ([10.48](https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48))
+- base, dev: libxml2 ([2.15.4](https://gitlab.gnome.org/GNOME/libxml2/-/raw/v2.15.4/NEWS))
+- base, dev: nghttp2 ([1.70.0](https://github.com/nghttp2/nghttp2/releases/tag/v1.70.0))
+- base, dev: pkgconf ([3.0.7](https://raw.githubusercontent.com/pkgconf/pkgconf/refs/tags/pkgconf-3.0.7/NEWS) (includes [3.0.0](https://raw.githubusercontent.com/pkgconf/pkgconf/refs/tags/pkgconf-3.0.0/NEWS)))
+- base, dev: selinux-base ([2.20260616_p1](https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20260616))
+- base, dev: selinux-base-policy ([2.20260616_p1](https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20260616))
+- base, dev: selinux-container ([2.20260616_p1](https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20260616))
+- base, dev: selinux-dbus ([2.20260616_p1](https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20260616))
+- base, dev: selinux-policykit ([2.20260616_p1](https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20260616))
+- base, dev: selinux-sssd ([2.20260616_p1](https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20260616))
+- base, dev: selinux-unconfined ([2.20260616_p1](https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20260616))
+- base, dev: xz-utils ([5.8.4](https://github.com/tukaani-project/xz/releases/tag/v5.8.4))
+- dev: gnuconfig (20260517)
+- sysext-containerd: containerd ([2.3.5](https://github.com/containerd/containerd/releases/tag/v2.3.5))
+- sysext-podman: crun ([1.29.1](https://github.com/containers/crun/releases/tag/1.29.1) (includes [1.29](https://github.com/containers/crun/releases/tag/1.29)))
+- sysext-python: platformdirs ([4.11.3](https://github.com/tox-dev/platformdirs/releases/tag/4.11.3) (includes [4.11.2](https://github.com/tox-dev/platformdirs/releases/tag/4.11.2), [4.11.1](https://github.com/tox-dev/platformdirs/releases/tag/4.11.1), [4.11.0](https://github.com/tox-dev/platformdirs/releases/tag/4.11.0)))
+- sysext-python: setuptools ([84.0.0](https://raw.githubusercontent.com/pypa/setuptools/refs/tags/v84.0.0/NEWS.rst))
+- sysext-python: wheel ([0.48.0](https://github.com/pypa/wheel/releases/tag/0.48.0))

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/app-arch/cpio/0001-Minor-fixes.patch

@@ -0,0 +1,209 @@
+From 17bf1b06a49a36eb13ee8dd8799f732f223f2257 Mon Sep 17 00:00:00 2001
+From: Sergey Poznyakoff <gray@gnu.org>
+Date: Fri, 1 May 2026 08:19:41 +0300
+Subject: [PATCH 1/2] Minor fixes
+
+* src/makepath.c: Don't use alloca.
+* src/userspec.c: Likewise.
+---
+ src/makepath.c | 31 ++++++++++++++---------
+ src/userspec.c | 67 +++++++++++++++++++++++++-------------------------
+ 2 files changed, 53 insertions(+), 45 deletions(-)
+
+diff --git a/src/makepath.c b/src/makepath.c
+index 29d2992..0de1adb 100644
+--- a/src/makepath.c
++++ b/src/makepath.c
+@@ -47,24 +47,19 @@
+    Return 0 if ARGPATH exists as a directory with the proper
+    ownership and permissions when done, otherwise 1.  */
+
+-int
+-make_path (char const *argpath,
+-	   uid_t owner,
+-	   gid_t group,
+-	   const char *verbose_fmt_string)
++static int
++make_path0 (char *dirpath,
++	    uid_t owner,
++	    gid_t group,
++	    const char *verbose_fmt_string)
+ {
+-  char *dirpath;		/* A copy we can scribble NULs on.  */
+   struct stat stats;
+-  int retval = 0;
+   mode_t tmpmode;
+   mode_t invert_permissions;
+   int we_are_root = getuid () == 0;
+-  dirpath = alloca (strlen (argpath) + 1);
+-
+-  strcpy (dirpath, argpath);
+
+   if (stat (dirpath, &stats))
+-    {
++  {
+       tmpmode = MODE_RWX & ~ newdir_umask;
+       invert_permissions = we_are_root ? 0 : MODE_WXUSR & ~ tmpmode;
+
+@@ -157,5 +152,19 @@ make_path (char const *argpath,
+
+     }
+
++  return 0;
++}
++
++int
++make_path (char const *argpath,
++	   uid_t owner,
++	   gid_t group,
++	   const char *verbose_fmt_string)
++{
++  char *dirpath = xstrdup (argpath);
++  int retval = make_path0 (dirpath, owner, group, verbose_fmt_string);
++  free (dirpath);
+   return retval;
+ }
++
++
+diff --git a/src/userspec.c b/src/userspec.c
+index 43d565c..f116ae7 100644
+--- a/src/userspec.c
++++ b/src/userspec.c
+@@ -19,7 +19,6 @@
+ /* Written by David MacKenzie <djm@gnu.ai.mit.edu>.  */
+
+ #include <system.h>
+-#include <alloca.h>
+ #include <stdio.h>
+ #include <ctype.h>
+ #include <sys/types.h>
+@@ -33,18 +32,6 @@
+ # define endgrent()
+ #endif
+
+-/* Perform the equivalent of the statement `dest = strdup (src);',
+-   but obtaining storage via alloca instead of from the heap.  */
+-
+-#define V_STRDUP(dest, src)						\
+-  do									\
+-    {									\
+-      int _len = strlen ((src));					\
+-      (dest) = (char *) alloca (_len + 1);				\
+-      strcpy (dest, src);						\
+-    }									\
+-  while (0)
+-
+ /* Return nonzero if STR represents an unsigned decimal integer,
+    otherwise return 0. */
+
+@@ -57,6 +44,18 @@ isnumber_p (const char *str)
+   return 1;
+ }
+
++static void
++store_string (char **bufptr, size_t *buflen, char *str)
++{
++  size_t len = strlen (str) + 1;
++  if (len > *buflen)
++    {
++      *bufptr = xrealloc (*bufptr, len);
++      *buflen = len;
++    }
++  strcpy (*bufptr, str);
++}
++
+ /* Extract from NAME, which has the form "[user][:.][group]",
+    a USERNAME, UID U, GROUPNAME, and GID G.
+    Either user or group, or both, must be present.
+@@ -70,23 +69,21 @@ isnumber_p (const char *str)
+    Return NULL if successful, a static error message string if not.  */
+
+ const char *
+-parse_user_spec (const char *spec_arg, uid_t *uid, gid_t *gid,
+-		 char **username_arg, char **groupname_arg)
++parse_user_spec0 (char *spec, uid_t *uid, gid_t *gid,
++		  char **username_arg, char **groupname_arg)
+ {
+   static const char *tired = "virtual memory exhausted";
+   const char *error_msg;
+-  char *spec;			/* A copy we can write on.  */
+   struct passwd *pwd;
+   struct group *grp;
+   char *g, *u, *separator;
+-  char *groupname;
++  char *groupname = NULL;
++  size_t grouplen = 0;
+
+   error_msg = NULL;
+   *username_arg = *groupname_arg = NULL;
+   groupname = NULL;
+
+-  V_STRDUP (spec, spec_arg);
+-
+   /* Find the separator if there is one.  */
+   separator = strchr (spec, ':');
+   if (separator == NULL)
+@@ -143,11 +140,12 @@ parse_user_spec (const char *spec_arg, uid_t *uid, gid_t *gid,
+ 	      if (grp == NULL)
+ 		{
+ 		  char nbuf[UINTMAX_STRSIZE_BOUND];
+-		  V_STRDUP (groupname, umaxtostr (pwd->pw_gid, nbuf));
++		  store_string (&groupname, &grouplen,
++				umaxtostr (pwd->pw_gid, nbuf));
+ 		}
+ 	      else
+ 		{
+-		  V_STRDUP (groupname, grp->gr_name);
++		  store_string (&groupname, &grouplen, grp->gr_name);
+ 		}
+ 	      endgrent ();
+ 	    }
+@@ -178,7 +176,7 @@ parse_user_spec (const char *spec_arg, uid_t *uid, gid_t *gid,
+       endgrent ();		/* Save a file descriptor.  */
+
+       if (error_msg == NULL)
+-	V_STRDUP (groupname, g);
++	store_string (&groupname, &grouplen, g);
+     }
+
+   if (error_msg == NULL)
+@@ -191,23 +189,24 @@ parse_user_spec (const char *spec_arg, uid_t *uid, gid_t *gid,
+ 	}
+
+       if (groupname != NULL && error_msg == NULL)
+-	{
+-	  *groupname_arg = strdup (groupname);
+-	  if (*groupname_arg == NULL)
+-	    {
+-	      if (*username_arg != NULL)
+-		{
+-		  free (*username_arg);
+-		  *username_arg = NULL;
+-		}
+-	      error_msg = tired;
+-	    }
+-	}
++	*groupname_arg = groupname;
+     }
++  else
++    free (groupname);
+
+   return error_msg;
+ }
+
++const char *
++parse_user_spec (const char *spec_arg, uid_t *uid, gid_t *gid,
++		 char **username, char **groupname)
++{
++  char *spec = xstrdup (spec_arg);
++  const char *retval = parse_user_spec0 (spec, uid, gid, username, groupname);
++  free (spec);
++  return retval;
++}
++
+ #ifdef TEST
+
+ #define NULL_CHECK(s) ((s) == NULL ? "(null)" : (s))
+-- 
+2.55.0
+