Abadawi/skopeo/CVE 2024 28180

[abadawi591]

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

• The toolchain has been rebuilt successfully (or no changes were made to it)
• The toolchain/worker package manifests are up-to-date
• Any updated packages successfully build (or no packages were changed)
• Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
• Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• All package sources are available
• cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
• LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
• All source files have up-to-date hashes in the *.signatures.json files
• sudo make go-tidy-all and sudo make go-test-coverage pass
• Documentation has been updated to match any changes to the build system
• Ready to merge

---

Summary

What does the PR accomplish, why was it needed?
Fix https://nvd.nist.gov/vuln/detail/CVE-2024-28180 for skopeo.

Change Log

patch skopeo to fix CVE-2024-28180

Does this affect the toolchain?

No

Links to CVEs

• https://nvd.nist.gov/vuln/detail/CVE-2024-28180

Test Methodology

• Pipeline build id: 652037
• https://dev.azure.com/mariner-org/mariner/_build/results?buildId=652037&view=results

[christopherco]

Patch does not apply correctly to the skopeo source. Does not look like the patch file is actually meant for skopeo's source code directly.

time="2024-10-05T06:22:32Z" level=debug msg="+ cd skopeo-1.14.2"
time="2024-10-05T06:22:32Z" level=debug msg="+ /bin/chmod -Rf a+rX,u+w,g-w,o-w ."
time="2024-10-05T06:22:32Z" level=debug msg="+ /usr/lib/rpm/rpmuncompress /usr/src/mariner/SOURCES/CVE-2023-45288.patch"
time="2024-10-05T06:22:32Z" level=debug msg="+ /bin/patch -p1 -s --fuzz=0 --no-backup-if-mismatch -f"
time="2024-10-05T06:22:32Z" level=debug msg="+ /usr/lib/rpm/rpmuncompress /usr/src/mariner/SOURCES/CVE-2024-3727.patch"
time="2024-10-05T06:22:32Z" level=debug msg="+ /bin/patch -p1 -s --fuzz=0 --no-backup-if-mismatch -f"
time="2024-10-05T06:22:32Z" level=debug msg="+ /usr/lib/rpm/rpmuncompress /usr/src/mariner/SOURCES/CVE-2024-6104.patch"
time="2024-10-05T06:22:32Z" level=debug msg="+ /bin/patch -p1 -s --fuzz=0 --no-backup-if-mismatch -f"
time="2024-10-05T06:22:32Z" level=debug msg="+ /usr/lib/rpm/rpmuncompress /usr/src/mariner/SOURCES/CVE-2024-6104.patch"
time="2024-10-05T06:22:32Z" level=debug msg="+ /bin/patch -p1 -s --fuzz=0 --no-backup-if-mismatch -f"
time="2024-10-05T06:22:32Z" level=debug msg="5 out of 5 hunks FAILED -- saving rejects to file vendor/github.com/hashicorp/go-retryablehttp/client.go.rej"
time="2024-10-05T06:22:32Z" level=debug msg="error: Bad exit status from /var/tmp/rpm-tmp.xOC1yt (%prep)"
time="2024-10-05T06:22:32Z" level=debug msg="    Could not canonicalize hostname: 8a060651c000001"
time="2024-10-05T06:22:32Z" level=debug msg="    %changelog not in descending chronological order"
time="2024-10-05T06:22:32Z" level=debug msg="    Bad exit status from /var/tmp/rpm-tmp.xOC1yt (%prep)"
time="2024-10-05T06:22:32Z" level=debug
time="2024-10-05T06:22:32Z" level=debug msg="RPM build warnings:"
time="2024-10-05T06:22:32Z" level=debug

[christopherco]

Also looks like the patch file is not being applied in the spec