[v3.4 backport] Bump github.com/containers/psgo to v1.7.2

[lsm5]

Resolves: CVE-2022-1227

Upstream fix: containers/psgo#92

Signed-off-by: Lokesh Mandvekar [email protected]

main branch is on v1.7.2 so that's what I bumped this branch to.

@mheon @rhatdan @vrothberg @TomSweeneyRedHat @Luap99 PTAL
/cc @containers/podman-maintainers

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: lsm5
To complete the pull request process, please assign umohnani8 after the PR has been reviewed.
You can assign the PR to them by writing /assign @umohnani8 in a comment when ready.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[rhatdan]

This code requires golang 1.16.

[lsm5]

ugh .. i'll update it, thanks

[mheon]

@vrothberg PTAL

[Luap99]

This bumps way to many dependencies for a backport, it should only include the fix.

[lsm5]

This bumps way to many dependencies for a backport, it should only include the fix.

Looking at psgo commit logs, there's only an extra opencontainers/runc module update from v1.0.2 to v1.0.3, in addition to the actual fix for the cve. Is that still a deal breaker?

Also, i guess backport is a misnomer here, since I didn't actually cherry-pick the commit from main, but manually ran go get ...

[Luap99]

This bumps way to many dependencies for a backport, it should only include the fix.

Looking at psgo commit logs, there's only an extra opencontainers/runc module update from v1.0.2 to v1.0.3, in addition to the actual fix for the cve. Is that still a deal breaker?

No that would be fine for me, it is just that he current PR bumps minor and major versions such as c/storage which we should never do for patch releases unless absolutely necessary. Patch releases should only add bug/security fixes.

[vrothberg]

All the BZs are assigned to me. I appreciate helping hands but note that it's already chaotic to handle. We need backports in psgo first.

[vrothberg]

I started the backports. Need to go through c/storage -> c/psgo -> c/podman for all kinds of versions. Let's start with v3.4 first since that's upstream.

[lsm5]

All the BZs are assigned to me. I appreciate helping hands but note that it's already chaotic to handle. We need backports in psgo first.

Closing. I'll build podman for f35 only after we have v3.4 updated upstream.