flatcar/scripts alpha-3941.0.0

on GitHub

Changes since Alpha 3913.0.0

Security fixes:

• Downgraded xz-utils to 5.4.2 as precaution even though Flatcar is not affected of the SSH backdoor (CVE-2024-3094)
• c-ares (CVE-2024-25629)
• coreutils (coreutils-2024-03-28)
• curl (CVE-2024-2004, CVE-2024-2379, CVE-2024-2398, CVE-2024-2466)
• nghttp2 (CVE-2024-28182)

Bug fixes:

• Disabled user-configdrive.service on OpenStack when config drive is used, which caused the hostname to be overwritten. The coreos-cloudinit.service unit already runs on OpenStack if the system is not configured via ignition. (Flatcar#1385)
• Fixed toolbox to prevent mounted ctr snapshots from being garbage-collected (toolbox#9)

Changes:

• Added zram-generator package to the image (scripts#1772)
• Add Intel igc driver to support I225/I226 family NICs. (flatcar/scripts#1786)
• Added Hyper-V VHDX image (flatcar/scripts#1791)
• Added support for unlocking the rootfs with a TPM set up by systemd-cryptenroll (bootengine#93)
• Disabled real-time priority for multipathd as it prevents the cgroups2 cpu controller from working. (flatcar/scripts#1771)
• Enabled amd-pstate,amd-pstate-epp cpufreq drivers for some AMD CPUs in the kernel. (flatcar/scripts#1770)
• Enabled ntpd by default on AWS & GCP, enabled chronyd by default on Azure. The native time sync source is used on each cloud. (scripts#1792)
  • Enabled the ptp_vmw module in the kernel.
  • Switched ptp_kvm from kernel builtin to module.
• Enabled the GRUB TPM2 module to measure the boot code path and files into PCR 8+9 in UEFI (scripts#1861)
• Hyper-V images, both .vhd and .vhdx files are available as zip compressed, switching from bzip2 to a built-in available Windows compression - zip (scripts#1878)
• OpenStack, Brightbox: Added the flatcar.autologin kernel cmdline parameter by default as the hypervisor manages access to the console (scripts#1866)
• Removed actool from the image and acbuild from the SDK as these tools are deprecated and not used (scripts#1817)
• SDK: Unified qemu image formats, so that the qemu_uefi build target provides the regular qemu and the qemu_uefi_secure artifacts (scripts#1847)
• The default VM memory was bumped to 2 GB in the Qemu script and for VMware OVFs (scripts#1827)

Updates:

• Linux Firmware (20240410)
• acl (2.3.2)
• attr (2.5.2)
• bpftool (6.7.6)
• c-ares (1.27.0 (includes 1.26.0))
• ca-certificates (3.99)
• containerd (1.7.15 (includes 1.7.14))
• coreutils (9.5)
• curl (8.7.1 (includes 8.7.0))
• ethtool (6.7)
• git (2.43.2)
• inih (58)
• ipset (7.21 (includes 7.20))
• iputils (20240117 (includes 20231222)
• libnvme (1.8)
• nghttp2 (1.61.0 (includes 1.58.0, 1.59.0 and 1.60.0))
• nvme-cli (2.8)
• open-vm-tools (12.4.0)
• samba (4.18.9)
• selinux-refpolicy (2.20240226)
• SDK: libpng (1.6.43 (includes 1.6.42 and 1.6.41))
• SDK: Rust (1.77.1 (includes 1.77.0))