Vendor in new opencontainers/selinux

docs/source/markdown/podman-build.1.md

@@ -320,6 +320,10 @@ Print usage statement
 
 Pass through HTTP Proxy environment variables.
 
+#### **--identity-label**
+
+Adds default identity label `io.buildah.version` if set. (default true).
+
 #### **--ignorefile**
 
 Path to an alternative .containerignore file.

go.mod

@@ -11,13 +11,13 @@ require (
 	github.com/container-orchestrated-devices/container-device-interface v0.3.0
 	github.com/containernetworking/cni v1.0.1
 	github.com/containernetworking/plugins v1.1.1
-	github.com/containers/buildah v1.24.3-0.20220310160415-5ec70bf01ea5
-	github.com/containers/common v0.47.5-0.20220323125147-7dc6e944d625
+	github.com/containers/buildah v1.25.2-0.20220406205807-5b8e79118057
+	github.com/containers/common v0.47.5-0.20220405040919-5d3a1effbf99
 	github.com/containers/conmon v2.0.20+incompatible
-	github.com/containers/image/v5 v5.20.1-0.20220310094651-0d8056ee346f
+	github.com/containers/image/v5 v5.21.0
 	github.com/containers/ocicrypt v1.1.3
 	github.com/containers/psgo v1.7.2
-	github.com/containers/storage v1.38.3-0.20220321121613-8e565392dd91
+	github.com/containers/storage v1.39.1-0.20220330193934-f3200eb5a5d9
 	github.com/coreos/go-systemd/v22 v22.3.2
 	github.com/coreos/stream-metadata-go v0.0.0-20210225230131-70edb9eb47b3
 	github.com/cyphar/filepath-securejoin v0.2.3
@@ -45,16 +45,15 @@ require (
 	github.com/mrunalp/fileutils v0.5.0
 	github.com/nxadm/tail v1.4.8
 	github.com/onsi/ginkgo v1.16.5
-	github.com/onsi/gomega v1.18.1
+	github.com/onsi/gomega v1.19.0
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/opencontainers/image-spec v1.0.3-0.20220114050600-8b9d41f48198
-	github.com/opencontainers/runc v1.1.0
+	github.com/opencontainers/runc v1.1.1
 	github.com/opencontainers/runtime-spec v1.0.3-0.20211214071223-8958f93039ab
 	github.com/opencontainers/runtime-tools v0.9.1-0.20220110225228-7e2d60f1e41f
-	github.com/opencontainers/selinux v1.10.0
+	github.com/opencontainers/selinux v1.10.1
 	github.com/pkg/errors v0.9.1
 	github.com/pmezard/go-difflib v1.0.0
-	github.com/prometheus/client_golang v1.11.1 // indirect
 	github.com/rootless-containers/rootlesskit v1.0.0
 	github.com/sirupsen/logrus v1.8.1
 	github.com/spf13/cobra v1.4.0

pkg/api/handlers/compat/images_build.go

@@ -95,6 +95,7 @@ func BuildImage(w http.ResponseWriter, r *http.Request) {
 		ForceRm                bool     `schema:"forcerm"`
 		From                   string   `schema:"from"`
 		HTTPProxy              bool     `schema:"httpproxy"`
+		IdentityLabel          bool     `schema:"identitylabel"`
 		Ignore                 bool     `schema:"ignore"`
 		Isolation              string   `schema:"isolation"`
 		Jobs                   int      `schema:"jobs"` // nolint
@@ -126,10 +127,11 @@ func BuildImage(w http.ResponseWriter, r *http.Request) {
 		UnsetEnvs              []string `schema:"unsetenv"`
 		Secrets                string   `schema:"secrets"`
 	}{
-		Dockerfile: "Dockerfile",
-		Registry:   "docker.io",
-		Rm:         true,
-		ShmSize:    64 * 1024 * 1024,
+		Dockerfile:    "Dockerfile",
+		IdentityLabel: true,
+		Registry:      "docker.io",
+		Rm:            true,
+		ShmSize:       64 * 1024 * 1024,
 	}
 
 	decoder := r.Context().Value(api.DecoderKey).(*schema.Decoder)
@@ -522,6 +524,7 @@ func BuildImage(w http.ResponseWriter, r *http.Request) {
 			DNSSearch:          dnssearch,
 			DNSServers:         dnsservers,
 			HTTPProxy:          query.HTTPProxy,
+			IdentityLabel:      types.NewOptionalBool(query.IdentityLabel),
 			LabelOpts:          labelOpts,
 			Memory:             query.Memory,
 			MemorySwap:         query.MemSwap,

pkg/bindings/images/build.go

@@ -19,6 +19,7 @@ import (
 	"strings"
 
 	"github.com/containers/buildah/define"
+	"github.com/containers/image/v5/types"
 	"github.com/containers/podman/v4/pkg/auth"
 	"github.com/containers/podman/v4/pkg/bindings"
 	"github.com/containers/podman/v4/pkg/domain/entities"
@@ -250,6 +251,12 @@ func Build(ctx context.Context, containerFiles []string, options entities.BuildO
 
 	params.Set("pullpolicy", options.PullPolicy.String())
 
+	switch options.CommonBuildOpts.IdentityLabel {
+	case types.OptionalBoolTrue:
+		params.Set("identitylabel", "1")
+	case types.OptionalBoolFalse:
+		params.Set("identitylabel", "0")
+	}
 	if options.Quiet {
 		params.Set("q", "1")
 	}

test/buildah-bud/apply-podman-deltas

@@ -136,10 +136,6 @@ errmsg "no such file or directory" \
 
 ###############################################################################
 # BEGIN tests that don't make sense under podman due to fundamental differences
-
-skip "N/A under podman" \
-     "bud-flags-order-verification"
-
 # TODO
 # Some of the podman tests in CI expects exit code 125, which might not be true
 # since exit code from runtime is relayed as it is without any modification both
@@ -152,6 +148,9 @@ skip "N/A under podman" \
 skip "podman CI expects all exit code to be 125 this test has anomaly behaviour" \
      "bud with --add-host"
 
+skip "podman CI expects all exit code to be 125 this test has anomaly behaviour" \
+     "bud - invalid runtime flags test"
+
 skip "does not work under podman" \
      "bud without any arguments should succeed"
 
@@ -181,6 +180,9 @@ skip "buildah runs with --cgroup-manager=cgroupfs, podman with systemd" \
 ###############################################################################
 # BEGIN tests which are skipped because they make no sense under podman-remote
 
+skip_if_remote "--runtime-flags does not work with podman-remote" \
+               "bud - invalid runtime flags test"
+
 skip_if_remote "--target does not work with podman-remote" \
                "bud-target"