Weekly portage-stable package updates 2026-01-12

.github/workflows/portage-stable-packages-list

@@ -3,6 +3,7 @@
 acct-group/adm
 acct-group/audio
 acct-group/cdrom
+acct-group/cuse
 acct-group/dialout
 acct-group/disk
 acct-group/dnsmasq
@@ -11,6 +12,7 @@ acct-group/floppy
 acct-group/incus
 acct-group/incus-admin
 acct-group/input
+acct-group/jobserver
 acct-group/kmem
 acct-group/kvm
 acct-group/lp
@@ -303,7 +305,6 @@ dev-libs/yajl
 
 dev-perl/File-Slurper
 dev-perl/Parse-Yapp
-dev-perl/PerlIO-utf8_strict
 
 dev-python/backports-tarfile
 dev-python/cachecontrol
@@ -392,6 +393,7 @@ dev-util/pkgcheck
 dev-util/pkgconf
 dev-util/re2c
 dev-util/xdelta
+dev-util/xxd
 
 dev-vcs/git
 
@@ -401,6 +403,7 @@ eclass/alternatives.eclass
 eclass/app-alternatives.eclass
 eclass/autotools.eclass
 eclass/bash-completion-r1.eclass
+eclass/branding.eclass
 eclass/cargo.eclass
 eclass/check-reqs.eclass
 eclass/cmake-multilib.eclass
@@ -750,7 +753,6 @@ virtual/perl-Carp
 virtual/perl-Encode
 virtual/perl-Exporter
 virtual/perl-ExtUtils-MakeMaker
-virtual/perl-XSLoader
 virtual/pkgconfig
 virtual/resolvconf
 virtual/service-manager

build_library/toolchain_util.sh

@@ -490,10 +490,14 @@ binutils_set_latest_profile() {
 # The extra flag can be blank, hardenednopie, and so on. See gcc-config -l
 # Usage: gcc_get_latest_profile chost [extra]
 gcc_get_latest_profile() {
-    local prefix="${1}-"
-    local suffix="${2+-$2}"
+    local prefix=${1}
+    local suffix=${2+-${2}}
     local status
-    gcc-config -l | cut -d' ' -f3 | grep "^${prefix}[0-9\\.]*${suffix}$" | tail -n1
+    gcc-config --list-profiles --nocolor | \
+        sed -e 's/^\s*//' | \
+        cut -d' ' -f2 | \
+        grep "^${prefix}-[0-9\\.]*${suffix}$" | \
+        tail -n1
 
     # return 1 if anything in the above pipe failed
     for status in ${PIPESTATUS[@]}; do

changelog/security/2026-01-21-weekly-updates.md

@@ -0,0 +1,7 @@
+- bind ([CVE-2025-40778](https://www.cve.org/CVERecord?id=CVE-2025-40778), [CVE-2025-40780](https://www.cve.org/CVERecord?id=CVE-2025-40780), [CVE-2025-8677](https://www.cve.org/CVERecord?id=CVE-2025-8677))
+- gnupg ([CVE-2025-68972](https://www.cve.org/CVERecord/?id=CVE-2025-68972), [CVE-2025-68973](https://www.cve.org/CVERecord/?id=CVE-2025-68973), [gnupg-20251228-notdash](https://gpg.fail/notdash))
+- gnutls ([CVE-2025-9820](https://www.cve.org/CVERecord?id=CVE-2025-9820))
+- go ([CVE-2025-61727](https://www.cve.org/CVERecord?id=CVE-2025-61727), [CVE-2025-61729](https://www.cve.org/CVERecord?id=CVE-2025-61729))
+- libarchive ([CVE-2025-60753](https://www.cve.org/CVERecord?id=CVE-2025-60753))
+- podman ([CVE-2025-9566](https://www.cve.org/CVERecord?id=CVE-2025-9566), [CVE-2025-52881](https://www.cve.org/CVERecord?id=CVE-2025-52881))
+- urllib3 ([CVE-2025-66418](https://www.cve.org/CVERecord?id=CVE-2025-66418), [CVE-2025-66471](https://www.cve.org/CVERecord?id=CVE-2025-66471))

changelog/updates/2026-01-21-weekly-updates.md

@@ -0,0 +1,58 @@
+- SDK: cmake ([4.1.4](https://cmake.org/cmake/help/v4.1/release/4.1.html#updates))
+- SDK: crossdev ([20251214](https://gitweb.gentoo.org/proj/crossdev.git/log/?h=20251214))
+- SDK: go ([1.25.5](https://go.dev/doc/devel/release#go1.25.minor))
+- SDK: perl ([5.42.0](https://perldoc.perl.org/perl5420delta))
+- SDK: rust ([1.91.0](https://blog.rust-lang.org/2025/10/30/Rust-1.91.0/) (includes [1.90.0](https://blog.rust-lang.org/2025/09/18/Rust-1.90.0/)))
+- azure, dev, sysext-python: urllib3 ([2.6.3](https://raw.githubusercontent.com/urllib3/urllib3/refs/tags/2.6.3/CHANGES.rst))
+- base, dev: bash ([5.3_p9](https://cgit.git.savannah.gnu.org/cgit/bash.git/log/?id=637f5c8696a6adc9b4519f1cd74aa78492266b7f))
+- base, dev: bind ([9.18.42](https://bind9.readthedocs.io/en/v9.18.42/notes.html#notes-for-bind-9-18-42))
+- base, dev: binutils-config ([5.6](https://gitweb.gentoo.org/proj/binutils-config.git/log/?h=v5.6))
+- base, dev: btrfs-progs ([6.17.1](https://github.com/kdave/btrfs-progs/releases/tag/v6.17.1))
+- base, dev: coreutils ([9.9](https://lists.gnu.org/archive/html/coreutils-announce/2025-11/msg00000.html))
+- base, dev: cri-tools ([1.33.0](https://github.com/kubernetes-sigs/cri-tools/releases/tag/v1.33.0))
+- base, dev: curl ([8.17.0](https://curl.se/ch/8.17.0.html))
+- base, dev: elfutils ([0.194](https://inbox.sourceware.org/elfutils-devel/CAJDtP-S0rYAOZQeDZvMtPkQztgK9RboWtYwpqNLCNGNdaSGn-A@mail.gmail.com/T/#u))
+- base, dev: git ([2.52.0](https://raw.githubusercontent.com/git/git/refs/tags/v2.52.0/Documentation/RelNotes/2.52.0.adoc))
+- base, dev: gnupg ([2.5.16](https://lists.gnupg.org/pipermail/gnupg-announce/2025q4/000500.html https://lists.gnupg.org/pipermail/gnupg-announce/2024q3/000484.html) (includes [2.5](https://lists.gnu.org/archive/html/info-gnu/2024-07/msg00005.html)))
+- base, dev: gnutls ([3.8.11](https://lists.gnu.org/archive/html/info-gnu/2025-11/msg00003.html))
+- base, dev: kexec-tools ([2.0.32](https://github.com/horms/kexec-tools/commits/v2.0.32/))
+- base, dev: libarchive ([3.8.5](https://github.com/libarchive/libarchive/releases/tag/v3.8.5) (includes [3.8.4](https://github.com/libarchive/libarchive/releases/tag/v3.8.4), [3.8.3](https://github.com/libarchive/libarchive/releases/tag/v3.8.3), [3.8.2](https://github.com/libarchive/libarchive/releases/tag/v3.8.2)))
+- base, dev: libcap ([2.77](https://sites.google.com/site/fullycapable/release-notes-for-libcap#h.mr55t4z9vzea))
+- base, dev: libnftnl ([1.3.1](https://lwn.net/Articles/1049279/))
+- base, dev: libnl ([3.11.0](https://lists.infradead.org/pipermail/libnl/2024-October/002441.html))
+- base, dev: libnvme ([1.16.1](https://github.com/linux-nvme/libnvme/releases/tag/v1.16.1) (includes [1.16](https://github.com/linux-nvme/libnvme/releases/tag/v1.16)))
+- base, dev: libpcre2 ([10.47](https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.47))
+- base, dev: libxml2 ([2.15.1](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.15.1) (includes [2.5.0](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.15.0)))
+- base, dev: nvme-cli ([2.16](https://github.com/linux-nvme/nvme-cli/releases/tag/v2.16))
+- base, dev: pambase ([20251104](https://gitweb.gentoo.org/proj/pambase.git/log/?h=pambase-20251104))
+- base, dev: readline ([8.3_p3](https://cgit.git.savannah.gnu.org/cgit/readline.git/log/?id=553d6bb272f26400d6d4d1cac7c1df84c447449b))
+- base, dev: selinux-base ([2.20250618](https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20250618))
+- base, dev: systemd ([257.10](https://github.com/systemd/systemd/commits/v257.10/))
+- base, dev: thin-provisioning-tools ([1.3.1](https://raw.githubusercontent.com/device-mapper-utils/thin-provisioning-tools/refs/tags/v1.3.1/CHANGES))
+- base, dev: usbutils ([019](https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usbutils.git/plain/NEWS?h=v019))
+- base, dev: userspace-rcu ([0.15.5](https://lwn.net/Articles/1046059/))
+- base, dev: xfsprogs ([6.17.0](https://web.git.kernel.org/pub/scm/fs/xfs/xfsprogs-dev.git/plain/doc/CHANGES?h=v6.17.0))
+- dev, sysext-incus: squashfs-tools ([4.7.4](https://github.com/plougher/squashfs-tools/releases?q=4.7.4))
+- dev: bash-completion ([2.17.0](https://github.com/scop/bash-completion/releases/tag/2.17.0))
+- dev: binutils ([2.45.1](https://sourceware.org/pipermail/binutils/2025-November/145592.html))
+- dev: cJSON ([1.7.19](https://github.com/DaveGamble/cJSON/releases/tag/v1.7.19))
+- dev: gcc-config ([2.12.2](https://gitweb.gentoo.org/proj/gcc-config.git/log/?h=v2.12.2))
+- dev: portage ([3.0.72](https://gitweb.gentoo.org/proj/portage.git/plain/NEWS?h=portage-3.0.72) (includes [3.0.71](https://gitweb.gentoo.org/proj/portage.git/plain/NEWS?h=portage-3.0.71), [3.0.70](https://gitweb.gentoo.org/proj/portage.git/plain/NEWS?h=portage-3.0.70)))
+- sysext-containerd: containerd ([2.2.0](https://github.com/containerd/containerd/releases/tag/v2.2.0))
+- sysext-containerd: runc ([1.4.0](https://github.com/opencontainers/runc/releases/tag/v1.4.0))
+- sysext-docker: docker ([28.2.2](https://github.com/moby/moby/releases/tag/v28.2.2) (includes [28.2.1](https://github.com/moby/moby/releases/tag/v28.2.1), [28.2.0](https://github.com/moby/moby/releases/tag/v28.2.0), [28.1.1](https://github.com/moby/moby/releases/tag/v28.1.1), [28.1.0](https://github.com/moby/moby/releases/tag/v28.1.0)))
+- sysext-docker: docker-cli ([28.4.0](https://github.com/moby/moby/releases/tag/v28.4.0) (includes [28.3.0](https://github.com/moby/moby/releases/tag/v28.3.0), [28.2.0](https://github.com/moby/moby/releases/tag/v28.2.0), [28.1.0](https://github.com/moby/moby/releases/tag/v28.1.0)))
+- sysext-incus: incus ([6.0.5](https://discuss.linuxcontainers.org/t/incus-6-0-5-lts-has-been-released/24445))
+- sysext-incus: lxc ([6.0.5](https://discuss.linuxcontainers.org/t/lxc-6-0-5-lts-has-been-released/24438))
+- sysext-incus: lxcfs ([6.0.5](https://discuss.linuxcontainers.org/t/lxcfs-6-0-5-lts-has-been-released/24437))
+- sysext-nvidia-drivers-570, sysext-nvidia-drivers-570-open: nvidia-drivers (570.207)
+- sysext-podman: containers-image ([5.35.0](https://github.com/containers/image/releases/tag/v5.35.0))
+- sysext-podman: gpgme ([2.0.1](https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gpgme.git;a=blob_plain;f=NEWS;h=1fd34dbd9143829e9163d402ab0191a9fc6adab2;hb=e4adebe020b07bc47e583817576ce98ca93e9711))
+- sysext-podman: podman ([5.7.0](https://github.com/containers/podman/releases/tag/v5.7.0) (includes [5.6.0](https://github.com/containers/podman/releases/tag/v5.6.0)))
+- sysext-python: charset-normalizer ([3.4.4](https://github.com/jawah/charset_normalizer/releases/tag/3.4.4))
+- sysext-python: idna ([3.11](https://github.com/kjd/idna/releases/tag/v3.11))
+- sysext-python: msgpack ([1.1.2](https://github.com/msgpack/msgpack-python/releases/tag/v1.1.2))
+- sysext-python: pip ([25.3](https://github.com/pypa/pip/blob/25.3/NEWS.rst))
+- sysext-python: setuptools-scm ([9.2.2](https://github.com/pypa/setuptools-scm/releases/tag/v9.2.2))
+- sysext-python: trove-classifiers ([2025.11.14.15](https://github.com/pypa/trove-classifiers/releases/tag/2025.11.14.15))
+- sysext-zfs: zfs ([2.3.4](https://github.com/openzfs/zfs/releases/tag/zfs-2.3.4))

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/flatcar-selinux-patches/0001-Flatcar-modifications.patch

@@ -1,4 +1,4 @@
-From 9398464fe4d29cb3e9ad3c04c2c749747438fb65 Mon Sep 17 00:00:00 2001
+From 4028416511d3e2b1ea8172efe3546b7c1c104a28 Mon Sep 17 00:00:00 2001
 From: Krzesimir Nowak <knowak@microsoft.com>
 Date: Mon, 4 Dec 2023 12:17:25 +0100
 Subject: [PATCH] Flatcar modifications
@@ -13,14 +13,13 @@ Subject: [PATCH] Flatcar modifications
  policy/modules/services/container.te    | 170 +++++++++++++++++++++++-
  policy/modules/system/init.te           |   8 ++
  policy/modules/system/locallogin.te     |   9 +-
- policy/modules/system/logging.te        |   9 ++
- 10 files changed, 427 insertions(+), 3 deletions(-)
+ 9 files changed, 418 insertions(+), 3 deletions(-)
 
 diff --git a/refpolicy/policy/modules/admin/netutils.te b/refpolicy/policy/modules/admin/netutils.te
-index 63d2f9cb8..62dff5f94 100644
+index ac11d1c99..c5501c28f 100644
 --- a/refpolicy/policy/modules/admin/netutils.te
 +++ b/refpolicy/policy/modules/admin/netutils.te
-@@ -128,6 +128,16 @@ corenet_raw_sendrecv_generic_if(ping_t)
+@@ -133,6 +133,16 @@ corenet_raw_sendrecv_generic_if(ping_t)
  corenet_raw_sendrecv_generic_node(ping_t)
  corenet_tcp_sendrecv_generic_node(ping_t)
  corenet_raw_bind_generic_node(ping_t)
@@ -37,7 +36,7 @@ index 63d2f9cb8..62dff5f94 100644
 
  dev_read_urand(ping_t)
 
-@@ -213,6 +223,16 @@ corenet_udp_bind_traceroute_port(traceroute_t)
+@@ -218,6 +228,16 @@ corenet_udp_bind_traceroute_port(traceroute_t)
  corenet_tcp_connect_all_ports(traceroute_t)
  corenet_sendrecv_all_client_packets(traceroute_t)
  corenet_sendrecv_traceroute_server_packets(traceroute_t)
@@ -92,7 +91,7 @@ index 1f0ad3df4..6a1cdba0e 100644
  ## <summary>
  ##	Bind TCP sockets to generic nodes.
 diff --git a/refpolicy/policy/modules/kernel/corenetwork.te.in b/refpolicy/policy/modules/kernel/corenetwork.te.in
-index b1649ec3a..ca612de44 100644
+index 6902c41f0..afb537ab7 100644
 --- a/refpolicy/policy/modules/kernel/corenetwork.te.in
 +++ b/refpolicy/policy/modules/kernel/corenetwork.te.in
 @@ -381,7 +381,17 @@ allow corenet_unconfined_type port_type:sctp_socket { name_connect };
@@ -115,10 +114,10 @@ index b1649ec3a..ca612de44 100644
  # Infiniband
  corenet_ib_access_all_pkeys(corenet_unconfined_type)
 diff --git a/refpolicy/policy/modules/kernel/files.if b/refpolicy/policy/modules/kernel/files.if
-index 709a1b71b..73b17285e 100644
+index fe81fd9a0..8f620c8f8 100644
 --- a/refpolicy/policy/modules/kernel/files.if
 +++ b/refpolicy/policy/modules/kernel/files.if
-@@ -8118,3 +8118,48 @@ interface(`files_relabel_all_pidfiles',`
+@@ -8246,3 +8246,48 @@ interface(`files_relabel_all_pidfiles',`
  	relabel_files_pattern($1, pidfile, pidfile)
  	relabel_lnk_files_pattern($1, pidfile, pidfile)
  ')
@@ -168,10 +167,10 @@ index 709a1b71b..73b17285e 100644
 +	relabelfrom_chr_files_pattern($1, { file_type -policy_config_t $2 }, { file_type -policy_config_t $2 })
 +')
 diff --git a/refpolicy/policy/modules/kernel/kernel.te b/refpolicy/policy/modules/kernel/kernel.te
-index 6d8ec0f77..df620faef 100644
+index 3751b3082..e7f45a5e6 100644
 --- a/refpolicy/policy/modules/kernel/kernel.te
 +++ b/refpolicy/policy/modules/kernel/kernel.te
-@@ -374,6 +374,131 @@ files_mounton_default(kernel_t)
+@@ -375,6 +375,131 @@ files_mounton_default(kernel_t)
 
  mcs_process_set_categories(kernel_t)
 
@@ -304,10 +303,10 @@ index 6d8ec0f77..df620faef 100644
  mls_process_write_all_levels(kernel_t)
  mls_file_write_all_levels(kernel_t)
 diff --git a/refpolicy/policy/modules/services/container.fc b/refpolicy/policy/modules/services/container.fc
-index f98e68ba0..045b1b5b2 100644
+index 010387a3a..ba0619561 100644
 --- a/refpolicy/policy/modules/services/container.fc
 +++ b/refpolicy/policy/modules/services/container.fc
-@@ -38,6 +38,12 @@ HOME_DIR/\.docker(/.*)?		gen_context(system_u:object_r:container_conf_home_t,s0)
+@@ -42,6 +42,12 @@ HOME_DIR/\.docker(/.*)?		gen_context(system_u:object_r:container_conf_home_t,s0)
  /etc/cni(/.*)?		gen_context(system_u:object_r:container_config_t,s0)
  /etc/docker(/.*)?		gen_context(system_u:object_r:container_config_t,s0)
  /etc/containerd(/.*)?		gen_context(system_u:object_r:container_config_t,s0)
@@ -321,10 +320,10 @@ index f98e68ba0..045b1b5b2 100644
  /run/containers(/.*)?		gen_context(system_u:object_r:container_runtime_t,s0)
  /run/crun(/.*)?		gen_context(system_u:object_r:container_runtime_t,s0)
 diff --git a/refpolicy/policy/modules/services/container.te b/refpolicy/policy/modules/services/container.te
-index c71ae54f4..a231f7664 100644
+index 4ff585bf6..859cff514 100644
 --- a/refpolicy/policy/modules/services/container.te
 +++ b/refpolicy/policy/modules/services/container.te
-@@ -58,6 +58,52 @@ gen_tunable(container_use_dri, false)
+@@ -84,6 +84,52 @@ gen_tunable(container_use_dri, false)
  ## </desc>
  gen_tunable(container_use_ecryptfs, false)
 
@@ -377,7 +376,7 @@ index c71ae54f4..a231f7664 100644
  ## <desc>
  ##	<p>
  ##	Allow containers to use all capabilities in a
-@@ -65,7 +111,7 @@ gen_tunable(container_use_ecryptfs, false)
+@@ -91,7 +137,7 @@ gen_tunable(container_use_ecryptfs, false)
  ##	directly on the host.
  ##	</p>
  ## </desc>
@@ -386,7 +385,7 @@ index c71ae54f4..a231f7664 100644
 
  ## <desc>
  ##	<p>
-@@ -1249,3 +1295,125 @@ optional_policy(`
+@@ -1431,3 +1477,125 @@ optional_policy(`
         unconfined_domain_noaudit(spc_user_t)
         domain_ptrace_all_domains(spc_user_t)
  ')
@@ -513,10 +512,10 @@ index c71ae54f4..a231f7664 100644
 +#
 +allow container_t tmp_t:file { read };
 diff --git a/refpolicy/policy/modules/system/init.te b/refpolicy/policy/modules/system/init.te
-index 1320f7aae..61ead9795 100644
+index c2f33c2bd..4415fa6eb 100644
 --- a/refpolicy/policy/modules/system/init.te
 +++ b/refpolicy/policy/modules/system/init.te
-@@ -1728,3 +1728,11 @@ optional_policy(`
+@@ -1754,3 +1754,11 @@ optional_policy(`
  	userdom_dontaudit_write_user_tmp_files(systemprocess)
  	userdom_dontaudit_use_user_terminals(systemprocess)
  ')
@@ -529,7 +528,7 @@ index 1320f7aae..61ead9795 100644
 +require { type unconfined_t; }
 +allow init_t unconfined_t:file exec_file_perms;
 diff --git a/refpolicy/policy/modules/system/locallogin.te b/refpolicy/policy/modules/system/locallogin.te
-index 995c80be2..933278d2f 100644
+index 89b852574..08b822fa4 100644
 --- a/refpolicy/policy/modules/system/locallogin.te
 +++ b/refpolicy/policy/modules/system/locallogin.te
 @@ -34,7 +34,14 @@ role system_r types sulogin_t;
@@ -548,26 +547,6 @@ index 995c80be2..933278d2f 100644
  allow local_login_t self:fd use;
  allow local_login_t self:fifo_file rw_fifo_file_perms;
  allow local_login_t self:sock_file read_sock_file_perms;
-diff --git a/refpolicy/policy/modules/system/logging.te b/refpolicy/policy/modules/system/logging.te
-index 14d3132be..ce40abc52 100644
---- a/refpolicy/policy/modules/system/logging.te
-+++ b/refpolicy/policy/modules/system/logging.te
-@@ -507,6 +507,15 @@ userdom_dontaudit_search_user_home_dirs(syslogd_t)
-
- ifdef(`init_systemd',`
- 	# for systemd-journal
-+
-+	#
-+	# FLATCAR:
-+	#
-+	# TODO: What AVC does this fix?
-+	#
-+	require { type kernel_t; }
-+	allow syslogd_t kernel_t:netlink_audit_socket getattr;
-+
- 	allow syslogd_t self:capability audit_control;
- 	allow syslogd_t self:netlink_audit_socket connected_socket_perms;
- 	allow syslogd_t self:capability2 audit_read;
 -- 
-2.49.1
+2.52.0
 

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0001-wait-online-set-any-by-default.patch

@@ -1,4 +1,4 @@
-From 83043596b6cc74b6f049999fa660afd983dc493a Mon Sep 17 00:00:00 2001
+From 4f4420815e5b51a481245db012a70e0d872ae368 Mon Sep 17 00:00:00 2001
 From: David Michael <dm0@redhat.com>
 Date: Tue, 16 Apr 2019 02:44:51 +0000
 Subject: [PATCH 1/8] wait-online: set --any by default
@@ -28,5 +28,5 @@ index 6f5aef903a..0acb3e76b9 100644
  STATIC_DESTRUCTOR_REGISTER(arg_interfaces, hashmap_free_free_freep);
  STATIC_DESTRUCTOR_REGISTER(arg_ignore, strv_freep);
 -- 
-2.51.0
+2.52.0
 

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0002-needs-update-don-t-require-strictly-newer-usr.patch

@@ -1,4 +1,4 @@
-From 3d6bfde35c8ce5c21ca55104852a319246a92bb8 Mon Sep 17 00:00:00 2001
+From 5097368cb45b455355165706876509272e49d538 Mon Sep 17 00:00:00 2001
 From: Alex Crawford <alex.crawford@coreos.com>
 Date: Wed, 2 Mar 2016 10:46:33 -0800
 Subject: [PATCH 2/8] needs-update: don't require strictly newer usr
@@ -54,5 +54,5 @@ index 1a03fdbe37..8577c35fa0 100644
 
  static bool in_first_boot(void) {
 -- 
-2.51.0
+2.52.0
 

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0003-core-use-max-for-DefaultTasksMax.patch

@@ -1,4 +1,4 @@
-From 6f691278df570cc87cb863a98fe320a1997c6dad Mon Sep 17 00:00:00 2001
+From 18ce110c4a4a5065ac9003ef67ccd58ada6d3c38 Mon Sep 17 00:00:00 2001
 From: Adrian Vladu <avladu@cloudbasesolutions.com>
 Date: Fri, 16 Feb 2024 11:22:08 +0000
 Subject: [PATCH 3/8] core: use max for DefaultTasksMax
@@ -34,7 +34,7 @@ index f7b414da5c..9c07e235ab 100644
          Kernel has a default value for <varname>kernel.pid_max=</varname> and an algorithm of counting in case of more than 32 cores.
          For example, with the default <varname>kernel.pid_max=</varname>, <varname>DefaultTasksMax=</varname> defaults to 4915,
 diff --git a/src/core/manager.c b/src/core/manager.c
-index 4ccaba9054..3ab59c5bb3 100644
+index e9fa84079d..af8d3c7b41 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
 @@ -117,7 +117,7 @@
@@ -60,5 +60,5 @@ index 1c08aa4d22..2faea3605e 100644
  #DefaultLimitFSIZE=
  #DefaultLimitDATA=
 -- 
-2.51.0
+2.52.0
 

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0004-systemd-Disable-SELinux-permissions-checks.patch

@@ -1,4 +1,4 @@
-From 78b2d8b1a6df073003d64cffa532c3a320e96ad4 Mon Sep 17 00:00:00 2001
+From 1716754b1f3ea3d5d3f232d9fe50ba1df0c5eff7 Mon Sep 17 00:00:00 2001
 From: Matthew Garrett <mjg59@coreos.com>
 Date: Tue, 20 Dec 2016 16:43:22 +0000
 Subject: [PATCH 4/8] systemd: Disable SELinux permissions checks
@@ -25,5 +25,5 @@ index a67a520a3b..3365b920eb 100644
  #include <errno.h>
  #include <selinux/avc.h>
 -- 
-2.51.0
+2.52.0
 

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0005-Revert-getty-Pass-tty-to-use-by-agetty-via-stdin.patch

@@ -1,4 +1,4 @@
-From 8064e1544a2b89f8389c0469ed4879a287a045a7 Mon Sep 17 00:00:00 2001
+From c3ff2dca5d6148a4d09237923aba7b4bd334cddb Mon Sep 17 00:00:00 2001
 From: Sayan Chowdhury <schowdhury@microsoft.com>
 Date: Fri, 16 Dec 2022 16:28:26 +0530
 Subject: [PATCH 5/8] Revert "getty: Pass tty to use by agetty via stdin"
@@ -91,5 +91,5 @@ index 20a5eb2754..ba4cbc0edb 100644
  TTYReset=yes
  TTYVHangup=yes
 -- 
-2.51.0
+2.52.0
 

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0006-units-Keep-using-old-journal-file-format.patch

@@ -1,4 +1,4 @@
-From c2924cc57c9e4aa836021ec2567c0fdbebecf944 Mon Sep 17 00:00:00 2001
+From 63fe9e7a742c070c83919be74c383f74420e6777 Mon Sep 17 00:00:00 2001
 From: Adrian Vladu <avladu@cloudbasesolutions.com>
 Date: Fri, 16 Feb 2024 11:29:04 +0000
 Subject: [PATCH 6/8] units: Keep using old journal file format
@@ -38,5 +38,5 @@ index b705ce08ff..874701dac4 100644
  FileDescriptorStoreMax=4224
  Group=systemd-journal
 -- 
-2.51.0
+2.52.0