deps: update to github.com/cyphar/[email protected]

[cyphar]

This fixes a regression in use of securejoin.MkdirAll, where multiple
runc processes racing to create the same mountpoint in a shared rootfs
would result in spurious EEXIST errors. In particular, this regression
caused issues with BuildKit.

Fixes: dd827f7 ("utils: switch to securejoin.MkdirAllHandle")
Fixes #4543
Signed-off-by: Aleksa Sarai [email protected]

[kolyshkin]

LGTM (also reviewed cyphar/filepath-securejoin#35, which also LGTM).

[lifubang]

I think we can make v1.2.3 release now!

Another thing, maybe we also need to backport to release-1.1, because it's also a regression in that branch, and we have not announced EOL of v1.1 yet.
Maybe we need to add a RELEASE.md to announce our release policy?

[cyphar]

@lifubang 1.1.x doesn't use securejoin.MkdirAll, it still uses the hotfix implementation which doesn't have this exact regression. Looking at the implementation though, there is a very small race window where you could see this behaviour (if the directory is created after the first openat but before the mkdir). We could fix it, but it seems quite unlikely that you'll hit the issue in practice (given that this behaviour was only noticed in 1.2.x) and I don't think it's worth doing another 1.1.x release just for this.

Regarding RELEASE.md, I sent an email to all the maintainers a few months ago to try to get some agreement on the policy we want before we write it down. I can open a PR with my proposal if you like.

[lifubang]

I can open a PR with my proposal if you like.

Yes, thanks.

[tonistiigi]

1.1.x doesn't use securejoin.MkdirAll, it still uses the hotfix implementation which doesn't have this exact regression. Looking at the implementation though, there is a very small race window where you could see this behaviour (if the directory is created after the first openat but before the mkdir). We could fix it, but it seems quite unlikely that you'll hit the issue in practice (given that this behaviour was only noticed in 1.2.x) and I don't think it's worth doing another 1.1.x release just for this.

FWIW I did reproduce this in 1.1.14 as well with steps from #4543 . I didn't notice any meaningful difference in how often it appeared.

[cyphar]

Hmmm, that's odd. I would've expected the race window to be much smaller...