Wed Feb 13 00:22:29 UTC 201920190213002229

a/kernel-firmware-20190212_28f5f7d-noarch-1.txz:  Upgraded.
a/kernel-generic-4.19.21-x86_64-1.txz:  Upgraded.
a/kernel-huge-4.19.21-x86_64-1.txz:  Upgraded.
a/kernel-modules-4.19.21-x86_64-1.txz:  Upgraded.
ap/lxc-2.0.9_d3a03247-x86_64-1.txz:  Upgraded.
  This update fixes a security issue where a malicious privileged container
  could overwrite the host binary and thus gain root-level code execution on
  the host. As the LXC project considers privileged containers to be unsafe
  no CVE has been assigned for this issue for LXC. To prevent this attack,
  LXC has been patched to create a temporary copy of the calling binary
  itself when it starts or attaches to containers. To do this LXC creates an
  anonymous, in-memory file using the memfd_create() system call and copies
  itself into the temporary in-memory file, which is then sealed to prevent
  further modifications. LXC then executes this sealed, in-memory file
  instead of the original on-disk binary.
  For more information, see:
    https://seclists.org/oss-sec/2019/q1/119
  (* Security fix *)
d/kernel-headers-4.19.21-x86-1.txz:  Upgraded.
k/kernel-source-4.19.21-noarch-1.txz:  Upgraded.
l/libbluray-1.1.0-x86_64-1.txz:  Upgraded.
l/libcap-2.26-x86_64-2.txz:  Rebuilt.
  Don't ship static library.
l/xapian-core-1.4.10-x86_64-1.txz:  Upgraded.
n/gnupg2-2.2.13-x86_64-1.txz:  Upgraded.
n/irssi-1.2.0-x86_64-1.txz:  Upgraded.
n/libassuan-2.5.3-x86_64-1.txz:  Upgraded.
x/bitmap-1.0.9-x86_64-1.txz:  Upgraded.
x/libXau-1.0.9-x86_64-1.txz:  Upgraded.
x/pixman-0.38.0-x86_64-1.txz:  Upgraded.
isolinux/initrd.img:  Rebuilt.
kernels/*:  Upgraded.
usb-and-pxe-installers/usbboot.img:  Rebuilt.

1 files changed, 51 insertions, 0 deletions

diff --git a/source/ap/lxc/get-lxc.sh b/source/ap/lxc/get-lxc.sh
new file mode 100755
index 00000000..28f7321a
--- /dev/null
+++ b/source/ap/lxc/get-lxc.sh
@@ -0,0 +1,51 @@
+#!/bin/sh
+
+# Copyright 2019  Patrick J. Volkerding, Sebeka, Minnesota, USA
+# All rights reserved.
+#
+# Redistribution and use of this script, with or without modification, is
+# permitted provided that the following conditions are met:
+#
+# 1. Redistributions of this script must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+#
+#  THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED
+#  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+#  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO
+#  EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+#  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+#  PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
+#  OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+#  WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+#  OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+#  ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+# Pull a stable branch + patches
+BRANCH=${1:-stable-2.0}
+
+# Clear download area:
+rm -rf lxc
+
+# Clone repository:
+git clone git://github.com/lxc/lxc
+
+# checkout $BRANCH:
+( cd lxc 
+  git checkout $BRANCH || exit 1
+)
+
+LXC_MAJOR=$(cd lxc && grep "^m4_define(\[lxc_version_major" configure.ac | cut -f 2 -d ' ' | tr -d ')')
+LXC_MINOR=$(cd lxc && grep "^m4_define(\[lxc_version_minor" configure.ac | cut -f 2 -d ' ' | tr -d ')')
+LXC_MICRO=$(cd lxc && grep "^m4_define(\[lxc_version_micro" configure.ac | cut -f 2 -d ' ' | tr -d ')')
+HEADISAT="$( cd lxc && git log -1 --format=%h )"
+DATE="$( cd lxc && git log -1 --format=%ad --date=format:%Y%m%d )"
+
+# Cleanup.  We're not packing up the whole git repo.
+( cd lxc && find . -type d -name ".git*" -exec rm -rf {} \; 2> /dev/null )
+mv lxc lxc-${LXC_MAJOR}.${LXC_MINOR}.${LXC_MICRO}_${HEADISAT}
+tar cf lxc-${LXC_MAJOR}.${LXC_MINOR}.${LXC_MICRO}_${HEADISAT}.tar lxc-${LXC_MAJOR}.${LXC_MINOR}.${LXC_MICRO}_${HEADISAT}
+xz -9 -f lxc-${LXC_MAJOR}.${LXC_MINOR}.${LXC_MICRO}_${HEADISAT}.tar
+rm -rf lxc-${LXC_MAJOR}.${LXC_MINOR}.${LXC_MICRO}_${HEADISAT}
+echo
+echo "lxc branch $BRANCH with HEAD at $HEADISAT packaged as lxc-${LXC_MAJOR}.${LXC_MINOR}.${LXC_MICRO}_${HEADISAT}.tar.xz"
+echo