When setting mount propagation on the root mount before unmounting it,
use MS_REBIND, since we know it's already a bind mount, and we actually
want to affect the extant bind mount instead of creating another right
over it. Otherwise, we might as well have not bothered.

Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>

[release-1.39] chroot createPlatformContainer: use MS_REMOUNT

…ecurity]

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

…6005-to-release-1.39

[release-1.39] chore(deps): update module github.com/go-jose/go-jose/v4 to v4.0.5 [security]

Tell Cirrus to compare PRs on this branch to the release-1.39 branch
rather than main.

Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>

Tag a new release to pull in that fix for chroot isolation.

Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>

[release-1.39] tag v1.39.1

Bumping c/common to v0.62.1, c/image to v5.34.1 in preparation
for the RHEL 9.6/10.0 ZeroDay

Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>

update some URLs

The origin repository renamed its "master" branch to "main", so we need
to update our references to items in that branch.

Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>

Bump to Buildah v1.39.2 in preparation for the
RHEL 9.6/10.0 ZeroDay and to provide BYOPKI
Certificate Validation.

Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>

[release-1.39] Bump c/image to v5.34.1, c/common v0.62.1, c/buildah v1.39.2

c/common v0.62.2

Bump:
c/storage to v1.57.2
c/image to v5.34.2
c/common to v0.62.2

to eventually resolve: https://issues.redhat.com/browse/RHEL-82511 and
https://issues.redhat.com/browse/RHEL-82509

in RHEL 9.6/10.0 ZeroDay once up in Podman

Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>

Bump to Buildh v1.39.3

Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>

[release-1.39] Bump c/storage to v1.57.2, c/image v5.34.2, c/common v0.62.2, c/buildah v1.39.3

When attempting to change the mount propagation of the old root
directory tree before unmounting it, it's enough that we pass the
requested propagation flags.

In particular, MS_REC is the only flag that is supposed to be allowed to
be specified along with a mount propagation flag, but in practice it was
only triggering an error some of the time, and CI wasn't one of those
times.

The added test mounts the root filesystem as an overlay and then runs
buildah as a rootless user on top of that, which is more comparable to a
root-on-composefs configuration, which manages to trigger the error.

Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>

…6088-to-release-1.39

[release-1.39] createPlatformContainer: drop MS_REMOUNT|MS_BIND

Bump to c/common to v0.62.3 to vendor in c/image v5.34.3.

This is the third SIC vendor dance step dance to resolve a DiffID
issue noted in https://issues.redhat.com/browse/RHEL-85218 and
https://issues.redhat.com/browse/RHEL-85219

Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>

Bumping to Buildah v1.39.4 in preparation of RHEL 9.6/10.0 ZeroDay.
This will help to resolve a number of Jira cards.

Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>

[release-1.39] Bump c/image to v5.34.3, c/common v0.62.3, Bulidah v1.39.4