Repository: kubernetes-sigs/security-profiles-operator
Pull request #2106 (2024-02-01 23:59:09)

build(deps): bump github.com/containers/common from 0.57.3 to 0.57.4
Bumps [github.com/containers/common](https://github.com/containers/common) from 0.57.3 to 0.57.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/containers/common/releases">github.com/containers/common's releases</a>.</em></p>
<blockquote>
<h2>v0.57.4</h2>
<h2>What's Changed</h2>
<ul>
<li>[v0.57] Bump c/image to v5.29.2, common to v0.57.3, then v0.57.4-dev by <a href="https://github.com/TomSweeneyRedHat"><code>@​TomSweeneyRedHat</code></a> in <a href="https://redirect.github.com/containers/common/pull/1835">containers/common#1835</a></li>
<li>[0.57] backport: <a href="https://redirect.github.com/containers/common/issues/1775">#1775</a> by <a href="https://github.com/sohankunkerkar"><code>@​sohankunkerkar</code></a> in <a href="https://redirect.github.com/containers/common/pull/1810">containers/common#1810</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/containers/common/compare/v0.57.3...v0.57.4">https://github.com/containers/common/compare/v0.57.3...v0.57.4</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/containers/common/commit/215e898615b7de5f789be60784b8303f2ab6de3d"><code>215e898</code></a> [v0.57] Bump to v0.57.4</li>
<li><a href="https://github.com/containers/common/commit/963608a146a6c102a839673b60b318413ede356c"><code>963608a</code></a> Merge pull request <a href="https://redirect.github.com/containers/common/issues/1810">#1810</a> from sohankunkerkar/v0.57</li>
<li><a href="https://github.com/containers/common/commit/62b839e2da193c8be0f0ffc830874ea28c1f0c95"><code>62b839e</code></a> Merge pull request <a href="https://redirect.github.com/containers/common/issues/1835">#1835</a> from TomSweeneyRedHat/dev/tsweeney/image_5_29_2</li>
<li><a href="https://github.com/containers/common/commit/e5e83ee1cfc0496149b99ad088fa858297a0ee11"><code>e5e83ee</code></a> [v0.57] Bump to v0.57.4-dev</li>
<li><a href="https://github.com/containers/common/commit/5d2ceab3652a7c951e1a6c634a838604845ab8b9"><code>5d2ceab</code></a> pkg/timezone: add helper function to configure timezone for pods/containers</li>
<li>See full diff in <a href="https://github.com/containers/common/compare/v0.57.3...v0.57.4">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/containers/common&package-manager=go_modules&previous-version=0.57.3&new-version=0.57.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions


</details>

k8s-ci-robot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/2106#" title="Author self-approved">dependabot[bot]</a>*
**Once this PR has been reviewed and has the lgtm label**, please assign [pjbgf](https://github.com/pjbgf) for approval. For more information see [the Kubernetes Code Review Process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process).

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["pjbgf"]} -->
k8s-ci-robot: Hi @dependabot[bot]. Thanks for your PR.

I'm waiting for a [kubernetes-sigs](https://github.com/orgs/kubernetes-sigs/people) member to verify that this patch is reasonable to test. If it is, they should reply with `/ok-to-test` on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should [join the org](https://git.k8s.io/community/community-membership.md#member) to skip this step.

Once the patch is verified, the new status will be reflected by the `ok-to-test` label.

I understand the commands that are listed [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>

k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/2106#pullrequestreview-1858968964" title="Approved">ccojocar</a>*, *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/2106#" title="Author self-approved">dependabot[bot]</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/OWNERS)~~ [ccojocar]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->

Patch:
diff --git a/dependencies.yaml b/dependencies.yaml
index fbb66da57..15854a708 100644
--- a/dependencies.yaml
+++ b/dependencies.yaml
@@ -164,7 +164,7 @@ dependencies:
       match: baseProfileNameCrun
 
   - name: runc
-    version: v1.1.11
+    version: v1.1.12
     refPaths:
     - path: examples/baseprofile-runc.yaml
       match: name
diff --git a/examples/baseprofile-runc.yaml b/examples/baseprofile-runc.yaml
index 883cb7287..d1a48eda1 100644
--- a/examples/baseprofile-runc.yaml
+++ b/examples/baseprofile-runc.yaml
@@ -2,7 +2,7 @@
 apiVersion: security-profiles-operator.x-k8s.io/v1beta1
 kind: SeccompProfile
 metadata:
-  name: runc-v1.1.11
+  name: runc-v1.1.12
 spec:
   defaultAction: SCMP_ACT_ERRNO
   architectures:
@@ -31,6 +31,7 @@ spec:
         - fstat
         - fstatfs
         - futex
+        - getcwd
         - getdents64
         - getpid
         - getppid
diff --git a/go.mod b/go.mod
index 468a3237c..112495b41 100644
--- a/go.mod
+++ b/go.mod
@@ -7,7 +7,7 @@ require (
 	github.com/aquasecurity/libbpfgo v0.6.0-libbpf-1.3
 	github.com/blang/semver/v4 v4.0.0
 	github.com/cert-manager/cert-manager v1.14.0
-	github.com/containers/common v0.57.3
+	github.com/containers/common v0.57.4
 	github.com/go-logr/logr v1.4.1
 	github.com/google/go-cmp v0.6.0
 	github.com/google/go-containerregistry v0.19.0
diff --git a/go.sum b/go.sum
index 7d4ece3a0..7f5c8898d 100644
--- a/go.sum
+++ b/go.sum
@@ -209,8 +209,8 @@ github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be h1:J5BL
 github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be/go.mod h1:mk5IQ+Y0ZeO87b858TlA645sVcEcbiX6YqP98kt+7+w=
 github.com/containerd/stargz-snapshotter/estargz v0.15.1 h1:eXJjw9RbkLFgioVaTG+G/ZW/0kEe2oEKCdS/ZxIyoCU=
 github.com/containerd/stargz-snapshotter/estargz v0.15.1/go.mod h1:gr2RNwukQ/S9Nv33Lt6UC7xEx58C+LHRdoqbEKjz1Kk=
-github.com/containers/common v0.57.3 h1:g4NqE/4iqunqgp7htfJLPKAFKf1PAXkv2I65a7+lQJI=
-github.com/containers/common v0.57.3/go.mod h1:o3L3CyOI9yr+JC8l4dZgvqTxcjs3qdKmkek00uchgvw=
+github.com/containers/common v0.57.4 h1:kmfBad92kUjP5X44BPpOwMe+eZQqaKETfS+ASeL0g+g=
+github.com/containers/common v0.57.4/go.mod h1:o3L3CyOI9yr+JC8l4dZgvqTxcjs3qdKmkek00uchgvw=
 github.com/coreos/go-oidc/v3 v3.9.0 h1:0J/ogVOd4y8P0f0xUh8l9t07xRP/d8tccvjHl2dcsSo=
 github.com/coreos/go-oidc/v3 v3.9.0/go.mod h1:rTKz2PYwftcrtoCzV5g5kvfJoWcm0Mk8AF8y1iAQro4=
 github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs=
diff --git a/hack/ci/Vagrantfile-ubuntu b/hack/ci/Vagrantfile-ubuntu
index 93bb12643..aceb78094 100644
--- a/hack/ci/Vagrantfile-ubuntu
+++ b/hack/ci/Vagrantfile-ubuntu
@@ -56,7 +56,7 @@ Vagrant.configure("2") do |config|
       apt-get autoremove -y
 
       # Some tests require runc
-      RUNC_VERSION=v1.1.11
+      RUNC_VERSION=v1.1.12
       RUNC_BINARY=/usr/bin/crio-runc
       curl -sSfL --retry 5 --retry-delay 3 "https://github.com/opencontainers/runc/releases/download/$RUNC_VERSION/runc.amd64" -o "$RUNC_BINARY"
       chmod +x "$RUNC_BINARY"
diff --git a/installation-usage.md b/installation-usage.md
index e979465c1..a7c036286 100644
--- a/installation-usage.md
+++ b/installation-usage.md
@@ -519,7 +519,7 @@ metadata:
   name: profile1
 spec:
   defaultAction: SCMP_ACT_ERRNO
-  baseProfileName: runc-v1.1.9
+  baseProfileName: runc-v1.1.12
   syscalls:
     - action: SCMP_ACT_ALLOW
       names:
@@ -555,7 +555,7 @@ metadata:
   name: profile1
 spec:
   defaultAction: SCMP_ACT_ERRNO
-  baseProfileName: oci://ghcr.io/security-profiles/runc:v1.1.11
+  baseProfileName: oci://ghcr.io/security-profiles/runc:v1.1.12
 ```
 
 The resulting profile `profile1` will then contain all base syscalls from the
@@ -1962,18 +1962,18 @@ The `spoc` client is able to pull security profiles from OCI artifact compatible
 registries. To do that, just run `spoc pull`:
 
 ```console
-> spoc pull ghcr.io/security-profiles/runc:v1.1.11
-16:32:29.795597 Pulling profile from: ghcr.io/security-profiles/runc:v1.1.11
+> spoc pull ghcr.io/security-profiles/runc:v1.1.12
+16:32:29.795597 Pulling profile from: ghcr.io/security-profiles/runc:v1.1.12
 16:32:29.795610 Verifying signature
 
-Verification for ghcr.io/security-profiles/runc:v1.1.11 --
+Verification for ghcr.io/security-profiles/runc:v1.1.12 --
 The following checks were performed on each of these signatures:
   - Existence of the claims in the transparency log was verified offline
   - The code-signing certificate was verified using trusted certificate authority certificates
 
 [{"critical":{"identity":{"docker-reference":"ghcr.io/security-profiles/runc"},…}}]
 16:32:33.208695 Creating file store in: /tmp/pull-3199397214
-16:32:33.208713 Verifying reference: ghcr.io/security-profiles/runc:v1.1.11
+16:32:33.208713 Verifying reference: ghcr.io/security-profiles/runc:v1.1.12
 16:32:33.208718 Creating repository for ghcr.io/security-profiles/runc
 16:32:33.208742 Using tag: v1.1.4
 16:32:33.208743 Copying profile from repository
@@ -2107,15 +2107,15 @@ The Security Profiles Operator will try to pull the correct profile by using
 way, for example if a profile does not support any platform:
 
 ```
-> spoc pull ghcr.io/security-profiles/runc:v1.1.11
-11:07:14.788840 Pulling profile from: ghcr.io/security-profiles/runc:v1.1.11
+> spoc pull ghcr.io/security-profiles/runc:v1.1.12
+11:07:14.788840 Pulling profile from: ghcr.io/security-profiles/runc:v1.1.12
 11:07:14.788852 Verifying signature
 …
 11:07:17.559037 Copying profile from repository
 11:07:18.359152 Trying to read profile: profile-linux-amd64.yaml
 11:07:18.359209 Trying to read profile: profile.yaml
 11:07:18.359224 Trying to unmarshal seccomp profile
-11:07:18.359728 Got SeccompProfile: runc-v1.1.9
+11:07:18.359728 Got SeccompProfile: runc-v1.1.12
 11:07:18.359732 Saving profile in: /tmp/profile.yaml
 ```
 
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 40a060557..9d5b2c230 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -395,7 +395,7 @@ github.com/common-nighthawk/go-figure
 ## explicit; go 1.19
 github.com/containerd/stargz-snapshotter/estargz
 github.com/containerd/stargz-snapshotter/estargz/errorutil
-# github.com/containers/common v0.57.3
+# github.com/containers/common v0.57.4
 ## explicit; go 1.18
 github.com/containers/common/pkg/seccomp
 # github.com/coreos/go-oidc/v3 v3.9.0


Test patch:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 3ef4e8abc..08ccfe706 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -200,6 +200,6 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v3.5.2
-      - uses: crate-ci/typos@v1.17.2
+      - uses: crate-ci/typos@v1.18.0
         with:
           config: .typos.toml
diff --git a/test/tc_base_profiles_test.go b/test/tc_base_profiles_test.go
index fe4cd2487..7925e890d 100644
--- a/test/tc_base_profiles_test.go
+++ b/test/tc_base_profiles_test.go
@@ -24,7 +24,7 @@ import (
 )
 
 const (
-	baseProfileNameRunc = "runc-v1.1.11"
+	baseProfileNameRunc = "runc-v1.1.12"
 	baseProfileNameCrun = "crun-v1.14"
 )