[v0.51] Bump c/image to v5.24.3, c/common to v0.51.4

[TomSweeneyRedHat]

As the title says, bump c/image to v5.24.3 to address CVE-2024-3727, then bump c/common to include it in Podman v4.4.1-rhel.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: TomSweeneyRedHat

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [TomSweeneyRedHat]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[TomSweeneyRedHat]

I seem to remember seeing this error elsewhere, but I can't find the secret sauce to fix it:

go: github.com/containerd/[email protected] requires
	github.com/containerd/[email protected] requires
	github.com/containerd/[email protected] requires
	github.com/Microsoft/[email protected] requires
	github.com/containerd/[email protected] requires
	github.com/Microsoft/hcsshim/[email protected] requires
	github.com/docker/[email protected] requires
	github.com/mitchellh/[email protected]: invalid version: git ls-remote -q origin in /var/tmp/go/pkg/mod/cache/vcs/94ed57c5b21c953d93b47487113db43a5c9b69fd990329ec70dc77348c4dd443: exit status 128:
	fatal: could not read Username for 'https://github.com': terminal prompts disabled
Confirm the import path was entered correctly.
If this is a private repository, see https://golang.org/doc/faq#git_https for additional information.
make: *** [Makefile:68: vendor] Error 1

Anyone's memory cells connecting better than mine are tonight?

[kwilczynski]

github.com/mitchellh/[email protected]

@TomSweeneyRedHat, try:

GOPROXY="https://proxy.golang.org/" go mod tidy

This is because the github.com/mitchellh/osext does not exist and returns 404 back to Git. Some project somewhere needs to update its dependencies.

[kwilczynski]

@TomSweeneyRedHat, there are other issues here per:

go: github.com/containers/common/libimage imports
	github.com/containers/ocicrypt/config imports
	gopkg.in/yaml.v3 tested by
	gopkg.in/yaml.v3.test imports
	gopkg.in/check.v1 imports
	github.com/kr/pretty imports
	github.com/rogpeppe/go-internal/fmtsort loaded from github.com/rogpeppe/[email protected],
	but go 1.16 would select v1.8.0

To upgrade to the versions selected by go 1.16:
	go mod tidy -go=1.16 && go mod tidy -go=1.17
If reproducibility with go 1.16 is not needed:
	go mod tidy -compat=1.17
For other options, see:
	https://golang.org/doc/modules/pruning
go: github.com/containers/common/libimage imports
	github.com/containers/ocicrypt/config imports
	gopkg.in/yaml.v3 tested by
	gopkg.in/yaml.v3.test imports
	gopkg.in/check.v1 imports
	github.com/kr/pretty imports
	github.com/rogpeppe/go-internal/fmtsort loaded from github.com/rogpeppe/[email protected],
	but go 1.16 would select v1.8.0

[TomSweeneyRedHat]

@kwilczynski TYVM! It looks like mitchell/osext is not used and dragged in by contained from some far flung dependency. They got rid of it in 1.6.31, but bumping up that high in this branch dragged in a boatload of other nasty. When contained ran into this same issue, they excluded osext. I've tried doing the same and will cross my fingers that will cure it. If not, I'll dive into your other suggestions.

[kwilczynski]

@kwilczynski TYVM! It looks like mitchell/osext is not used and dragged in by contained from some far flung dependency. They got rid of it in 1.6.31, but bumping up that high in this branch dragged in a boatload of other nasty. When contained ran into this same issue, they excluded osext. I've tried doing the same and will cross my fingers that will cure it. If not, I'll dive into your other suggestions.

@TomSweeneyRedHat, looks like excluding the github.com/mitchellh/osext did the trick here. Nice!

[TomSweeneyRedHat]

Happy Green Test buttons! @Luap99 and @rhatdan PTAL

[rhatdan]

/lgtm

[TomSweeneyRedHat]

Fixes: https://issues.redhat.com/browse/RHEL-59127 once this is vendored into Podman v4.4.*

[mheon]

Let me check if the mergebot is stuck

[mheon]

LGTM for reference

[mheon]

It shouldn't be stuck.
I'm just pressing the button.

[TomSweeneyRedHat]

Too many PRs, thix addresses CVE-2024-3727 follow on fix. #2157 fixes https://issues.redhat.com/browse/RHEL-59127 .

Once a release is cut and then c/common vendored into Skopeo and Podman, this will fix:
https://issues.redhat.com/browse/OCPBUGS-37020
https://issues.redhat.com/browse/OCPBUGS-37009
https://issues.redhat.com/browse/OCPBUGS-37010
https://issues.redhat.com/browse/OCPBUGS-37022
https://issues.redhat.com/browse/OCPBUGS-37011
https://issues.redhat.com/browse/OCPBUGS-37023

I'm waiting for #2157 to merge before creating a c/common release and then merge into Podman/Skopeo.