Kurtzer, Gregory M., Bauer, Michael, Cclerget et al. · Zenodo (CERN European Organization for Nuclear Research) · 2018
Greetings Singularity Folks! <em>Note: to install from a tarball, please use the attached <code>singularity-v3.0.0.tar.gz</code> asset. The <code>Source code (zip)</code> and <code>Source code (tar.gz)</code> are automatically generated by GitHub and are not correct release tarballs.</em> It is our greatest pleasure to finally announce the release of Singularity <code>v3.0.0</code>. For the last 10 months, we've been hard at work on making sure this new iteration of Singularity is as successful as possible. On the SylabsIO website you can read about our decision to migrate from C to Golang, the new Singularity Image Format (SIF), our new GitHub branch structure, the Sylabs Container Library, and more on all parts the development cycle of <code>v3.0.0</code>. A full list of changes and improvements from <code>v2.6.0</code> -> <code>v3.0.0</code> can be found in the changelog. If you have any feedback, please reach out to us. As always, we greatly appreciate your feedback and contributions.
Cited by 1Open access
Kurtzer, Gregory M., Cclerget, Bauer, Michael et al. · Zenodo (CERN European Organization for Nuclear Research) · 2021
Bug Fixes Accommodate /sys/fs/selinux mount changes on kernel 5.9+. Fix loop devices file descriptor leak when shared loop devices is enabled. Use MaxLoopDevices variable from config file in all appropriate locations. Use -buildmode=default (non pie) on ppc64le to prevent crashes when using plugins. Remove spurious warning in parseTokenSection() e2e test fixes for new kernels, new unsquashfs version. Show correct web URI for detached builds against alternate remotes. Thanks / Reporting Bugs Thanks to our contributors for code, feedback and, testing efforts! As always, please report any bugs to: https://github.com/hpcng/singularity/issues/new If you think that you've discovered a security vulnerability please report it to: security@sylabs.io Have fun! Downloads Please use the <code>singularity-3.7.1.tar.gz</code> download below to obtain and install Singularity 3.7.1. The GitHub auto-generated 'Source Code' downloads do not include required dependencies etc.
Cited by 2Open access
Kurtzer, Gregory M., Cclerget, Bauer, Michael et al. · Zenodo (CERN European Organization for Nuclear Research) · 2020
This is a new version of Singularity with many new features, bug fixes, and other improvements detailed below. Some behaviour has changed. Please read the release notes below carefully before updating a production system. New features / functionalities Allow configuration of global custom keyservers, separate from remote endpoints. Add a new global keyring, for public keys only (used for ECL). The <code>remote login</code> commmand now suports authentication to Docker/OCI registries and custom keyservers. New <code>--exclusive</code> option for <code>remote use</code> allows admin to lock usage to a specific remote. A new <code>Fingerprints:</code> header in definition files will check that a SIF source image can be verified, and is signed with keys matching all specified fingerprints. Labels can be set dynamically from a build's <code>%post</code> section by setting them in the <code>SINGULARITY_LABELS</code> environment variable. New <code>build-arch</code> label is automatically set to the architecure of the host during a container build. New <code>-D/--description</code> flag for <code>singularity push</code> sets description for a library container image. <code>singularity remote status</code> shows validity of authentication token if set. <code>singularity push</code> reports quota usage and URL on successful push to a library server that supports this. A new <code>--no-mount</code> flag for actions allows a user to disable proc/sys/dev/devpts/home/tmp/hostfs/cwd mounts, even if they are enabled in <code>singularity.conf</code>. Changed defaults / behaviours When actions (run/shell/exec...) are used without <code>--fakeroot</code> the umask from the calling environment will be propagated into the container, so that files are created with expected permissions. Use the new <code>--no-umask</code> flag to return to the previous behaviour of setting a default 0022 umask. Container metadata, environment, scripts are recorded in a descriptor in builds to SIF files, and <code>inspect</code> will use this if present. The <code>--nv</code> flag for NVIDIA GPU support will not resolve libraries reported by <code>nvidia-container-cli</code> via the ld cache. Will instead respect absolute paths to libraries reported by the tool, and bind all versioned symlinks to them. General re-work of the <code>remote login</code> flow, adds prompts and token verification before replacing an existing authentication token. The Execution Control List (ECL) now verifies container fingerprints using the new global keyring. Previously all users would need relevant keys in their own keyring. The SIF layer mediatype for ORAS has been changed to <code>application/vnd.sylabs.sif.layer.v1.sif</code> reflecting the published opencontainers/artifacts value. <code>SINGULARITY_BIND</code> has been restored as an environment variable set within a running container. It now reflects all user binds requested by the <code>-B/--bind</code> flag, as well as via <code>SINGULARITY_BIND[PATHS]</code>. <code>singularity search</code> now correctly searches for container images matching the host architecture by default. A new <code>--arch</code> flag allows searching for other architectures. A new results format gives more detail about container image results, while users and collections are no longer returned. Bug Fixes Support larger definition files, environments etc. by passing engine configuration in the environment vs. via socket buffer. Ensure <code>docker-daemon:</code> and other source operations respect <code>SINGULARITY_TMPDIR</code> for all temporary files. Support double quoted filenames in the <code>%files</code> section of build definitions. Correct <code>cache list</code> sizes to show KiB with powers of 1024, matching <code>du</code> etc. Don't fail on <code>enable fusemount=no</code> when no fuse mounts are needed. Pull OCI images to the correct requested location when the cache is disabled. Ensure <code>Singularity></code> prompt is set when container has no environment script, or singularity is called through a wrapper script. Avoid build failures in <code>yum/dnf</code> operations against the 'setup' package on <code>RHEL/CentOS/Fedora</code> by ensuring staged <code>/etc/</code> files do not match distro default content. Failed binds to <code>/etc/hosts</code> and <code>/etc/localtime</code> in a container run with <code>--contain</code> are no longer fatal errors. Don't initialize the cache for actions where it is not required. Increase embedded shell interpreter timeout, to allow slow-running environment scripts to complete. Correct buffer handling for key import to allow import from STDIN. Reset environment to avoid <code>LD_LIBRARYPATH</code> issues when resolving dependencies for the <code>unsquashfs</code> sandbox. Fall back to <code>/sbin/ldconfig</code> if <code>ldconfig</code> on <code>PATH</code> fails while resolving GPU libraries. Fixes problems on systems using Nix / Guix. Address issues caused by error code changes in <code>unsquashfs</code> version 4.4. Ensure <code>/dev/kfd</code> is bound into container for ROCm when <code>--rocm</code> is used with <code>--contain</code>. Tolerate comments on <code>%files</code> sections in build definition files. Fix a loop device file descriptor leak. Known Issues A change in Linux kernel 5.9 causes <code>--fakeroot</code> builds to fail with a <code>/sys/fs/selinux</code> remount error. This will be addressed in Singularity v3.5.1. Thanks / Reporting Bugs Thanks to our contributors for code, feedback and, testing efforts! As always, please report any bugs to: https://github.com/hpcng/singularity/issues/new If you think that you've discovered a security vulnerability please report it to: security@sylabs.io Have fun! Downloads Please use the <code>singularity-3.7.0.tar.gz</code> download below to obtain and install Singularity 3.7.0. The GitHub auto-generated 'Source Code' downloads do not include required dependencies etc.
Cited by 2Open access
Kurtzer, Gregory M., Cclerget, Bauer, Michael et al. · Zenodo (CERN European Organization for Nuclear Research) · 2019
Howdy Singularity Containnerds! 🤓 This point release fixes a few pesky bugs that were discovered in v3.2.0. In particular it: Allows users to join instances with non-suid workflow Removes false warning when seccomp is disabled on the host Fixes an issue in the terminal when piping output to commands Binds NVIDIA persistenced socket when <code>--nv</code> is invoked As always, please report any bugs to: https://github.com/sylabs/singularity/issues/new And if you think that you've discovered a security vulnerability please report it to: security@sylabs.io Have fun!
Cited by 0Open access
Kurtzer, Gregory M., Cclerget, Bauer, Michael et al. · Zenodo (CERN European Organization for Nuclear Research) · 2019
Greetings Singularity community! The 3.2.0 release contains fixes for a <em>high severity</em> security issue affecting Singularity >=3.1.0 on Linux kernels that support namespace requirements (<code>pid</code> namespace) for creating and joining instances (CVE-2019-11328). A malicious user with local/network access to the host system (e.g. ssh) could exploit this vulnerability due to insecure permissions allowing a user to edit files within <code>/run/singularity/instances/sing/<user>/<instance></code>. The manipulation of those files can change the behavior of the <code>starter-suid</code> program when instances are joined resulting in potential privilege escalation on the host. Singularity 3.2.0 should be installed immediately, and all previous versions of Singularity should be removed. The vulnerability addressed in this release affects systems on which unprivileged users are permitted to initiate and join instances via the suid workflow. If you are unable to upgrade immediately, you should disable the suid workflow on your system. You can do so by setting the following in the <code>singularity.conf</code> file: <pre><code>allow setuid = no </code></pre> In addition to a security patch, 3.2.0 has a lot of great features. Highlights include a new plugin system, the added ability to create multi-stage builds, and better integration with the Singularity Container Services KeyStore. More details appear in the release notes below: Security related fix Instance files are now stored in user's home directory for privacy and many checks have been added to ensure that a user can't manipulate files to change <code>starter-suid</code> behavior when instances are joined (many thanks to Matthias Gerstner from the SUSE security team for finding and securely reporting this vulnerability) New features / functionalities Introduced a new basic framework for creating and managing plugins Added the ability to create containers through multi-stage builds Created the concept of a Sylabs Cloud "remote" endpoint and added the ability for users and admins to set them through CLI and conf files Added caching for images from Singularity Hub Made it possible to compile Singularity outside of <code>$GOPATH</code> Added a json partition to SIF files for OCI configuration when building from an OCI source Full integration with Singularity desktop for MacOS code base New Commands Introduced the <code>plugin</code> command group for creating and managing plugins <code>compile</code> Compile a singularity plugin <code>disable</code> disable an installed singularity plugin <code>enable</code> Enable an installed singularity plugin <code>inspect</code> Inspect a singularity plugin (either an installed one or an image) <code>install</code> Install a singularity plugin <code>list</code> List installed singularity plugins <code>uninstall</code> Uninstall removes the named plugin from the system Introduced the <code>remote</code> command group to support management of Singularity endpoints: <code>add</code> Create a new Sylabs Cloud remote endpoint <code>list</code> List all remote endpoints that are configured <code>login</code> Log into a remote endpoint using an authentication token <code>remove</code> Remove an existing Sylabs Cloud remote endpoint <code>status</code> Check the status of the services at an endpoint <code>use</code> Set a remote endpoint to be used by default Added to the <code>key</code> command group to improve PGP key management: <code>export</code> Export a public or private key into a specific file <code>import</code> Import a local key into the local keyring <code>remove</code> Remove a local public key Added the <code>Stage: <name></code> keyword to the definition file header and the <code>from <stage name></code> option/argument pair to the <code>%files</code> section to support multistage builds Deprecated / removed commands The <code>--token/-t</code> option has been deprecated in favor of the <code>singularity remote</code> command group Changed defaults / behaviors Ask to confirm password on a newly generated PGP key Prompt to push a key to the KeyStore when generated Refuse to push an unsigned container unless overridden with <code>--allow-unauthenticated/-U</code> option Warn and prompt when pulling an unsigned container without the <code>--allow-unauthenticated/-U</code> option As always, please report any bugs to: https://github.com/sylabs/singularity/issues/new And if you think that you've discovered a security vulnerability please report it to: security@sylabs.io
Cited by 0Open access
Kurtzer, Gregory M., Cclerget, Bauer, Michael et al. · Zenodo (CERN European Organization for Nuclear Research) · 2020
Singularity 3.6.1 is a patch release fixing some bugs raised soon after the 3.6.0 release. In particular, an issue where supplying an empty string <code>""</code> as the destination to <code>singularity build</code> could result in the removal of the current directory has been addressed. Other fixes correct problems with <code>mksquashfs</code> limits, environment in Singularity 2.2 containers, and address a change in overlay behavior with an improved error message. New features / functionalities Support compilation with FORTIFY_SOURCE=2 and build in pie mode with fstack-protector enabled (#5433). Bug Fixes Provide advisory message r.e. need for upper and work to exist in overlay images. Use squashfs mem and processor limits in squashfs gzip check. Ensure build destination path is not an empty string - do not overwrite CWD. Don't unset PATH when interpreting legacy /environment files. Thanks to our contributors for code, feedback and, testing efforts! As always, please report any bugs to: https://github.com/hpcng/singularity/issues/new If you think that you've discovered a security vulnerability please report it to: security@sylabs.io Have fun!
Cited by 0Open access
Gregory Kurtzer, Krishna Muriki, Bauer, Michael et al. · OSTI OAI (U.S. Department of Energy Office of Scientific and Technical Information) · 2021
Singularity 3.7.3 is a security release. We recommend all users upgrade to this version. Security Related Fixes CVE-2021-29136: A dependency used by Singularity to extract docker/OCI image layers can be tricked into modifying host files by creating a malicious layer that has a symlink with the name "." (or "/"), when running as root. This vulnerability affects a <code>singularity build</code> or <code>singularity pull</code> as root, from a docker or OCI source. Thanks / Reporting Bugs Thanks to our contributors for code, feedback and, testing efforts! As always, please report any bugs to: https://github.com/hpcng/singularity/issues/new If you think that you've discovered a security vulnerability please report it to: security@sylabs.io Have fun! Downloads Please use the <code>singularity-3.7.3.tar.gz</code> download below to obtain and install Singularity 3.7.3. The GitHub auto-generated 'Source Code' downloads do not include required dependencies etc.
Cited by 11Open access
Sachin Labade, J Gilsdorf, Annika Hohenthal et al. · GAP BODHI TARU - A GLOBAL JOURNAL OF HUMANITIES · 2023
Due to the widespread growth and the flexibility to adopt itself to geo-socio-cultural changes, English has become a global language. This article intends to show the transgression of English from being the language of cultural hegemony (singularity) to becoming the language of multicultural identification in the light of the world Englishes (plurality). However, the main focus is to show how New Englishes can encourage as well as threaten the chances of English to become the Global Common Language (singularity)
Cited by 0Open access
Kurtzer, Gregory M., Cclerget, Bauer, Michael et al. · Zenodo (CERN European Organization for Nuclear Research) · 2019
Great news Singularity fans! Here comes a new feature release! And this is a big one! Singularity v3.1.0 contains a ton of new features, enhancements and bug fixes. The big news is that there is now an OCI compliant variant of the Singularity runtime! (Thanks @cclerget!) Using the <code>oci</code> command group, a user can launch a fully OCI compliant version of Singularity. Here's a high-level overview of the changes in this release. For more details, see the git log. New Commands Introduced the <code>oci</code> command group to support a new OCI compliant variant of the Singularity runtime: <code>attach</code> Attach console to a running container process <code>create</code> Create a container from a bundle directory <code>delete</code> Delete container <code>exec</code> Execute a command within container <code>kill</code> Kill a container <code>mount</code> Mount create an OCI bundle from SIF image <code>pause</code> Suspends all processes inside the container <code>resume</code> Resumes all processes previously paused inside the container <code>run</code> Create/start/attach/delete a container from a bundle directory <code>start</code> Start container process <code>state</code> Query state of a container <code>umount</code> Umount delete bundle <code>update</code> Update container cgroups resources Added <code>cache</code> command group to inspect and manage cached files <code>clean</code> Clean your local Singularity cache <code>list</code> List your local Singularity cache New features / functionalities Can now build CLI on darwin for limited functionality on Mac Added the <code>scratch</code> bootstrap agent to build from anything Reintroduced support for zypper bootstrap agent Added the ability to overwrite a new <code>singularity.conf</code> when building from RPM if desired Fixed several regressions and omissions in SCIF support Added caching for containers pulled/built from the Container Library Changed <code>keys</code> command group to <code>key</code> (retained hidden <code>keys</code> command for backward compatibility) Created an <code>RPMPREFIX</code> variable to allow RPMs to be installed in custom locations Greatly expanded CI unit and end-to-end testing Please test this new release candidate in all of your exotic environments so that we can catch any bugs before they make it into GA. As always, please report any bugs to: https://github.com/sylabs/singularity/issues/new And if you think that you've discovered a security vulnerability please report it to: security@sylabs.io Thanks! Happy hacking!
Cited by 0Open access
Kurtzer, Gregory M., Cclerget, Bauer, Michael et al. · Zenodo (CERN European Organization for Nuclear Research) · 2019
Howdy Singularity-ers! It's our great pleasure to announce a release candidate for the newest version of Singularity! 3.2.0 has a lot of great features. Highlights include a new plugin system, the added ability to create multi-stage builds, and better integration with the Singularity Container Services KeyStore. More details appear in the release notes below: New features / functionalities Introduced a new basic framework for creating and managing plugins Added the ability to create containers through multi-stage builds Created the concept of a Sylabs Cloud "remote" endpoint and added the ability for users and admins to set them through CLI and conf files Added caching for images from Singularity Hub Made it possible to compile Singularity outside of <code>$GOPATH</code> Added a json partition to SIF files for OCI configuration when building from an OCI source Full integration with Singularity desktop for MacOS code base Added --nocolor flag to Singularity client to disable color in logging New Commands Introduced the <code>plugin</code> command group for creating and managing plugins <code>compile</code> Compile a singularity plugin <code>disable</code> disable an installed singularity plugin <code>enable</code> Enable an installed singularity plugin <code>inspect</code> Inspect a singularity plugin (either an installed one or an image) <code>install</code> Install a singularity plugin <code>list</code> List installed singularity plugins <code>uninstall</code> Uninstall removes the named plugin from the system Introduced the <code>remote</code> command group to support management of Singularity endpoints: <code>add</code> Create a new Sylabs Cloud remote endpoint <code>list</code> List all remote endpoints that are configured <code>login</code> Log into a remote endpoint using an authentication token <code>remove</code> Remove an existing Sylabs Cloud remote endpoint <code>status</code> Check the status of the services at an endpoint <code>use</code> Set a remote endpoint to be used by default Added to the <code>key</code> command group to improve PGP key management: <code>export</code> Export a public or private key into a specific file <code>import</code> Import a local key into the local keyring <code>remove</code> Remove a local public key Added the <code>Stage: <name></code> keyword to the definition file header and the <code>from <stage name></code> option/argument pair to the <code>%files</code> section to support multistage builds Deprecated / removed commands The <code>--token/-t</code> option has been deprecated in favor of the <code>singularity remote</code> command group Changed defaults / behaviors Ask to confirm password on a newly generated PGP key Prompt to push a key to the KeyStore when generated Refuse to push an unsigned container unless overridden with <code>--allow-unauthenticated/-U</code> option Warn and prompt when pulling an unsigned container without the <code>--allow-unauthenticated/-U</code> option` Want to help the development effort? You can do so by testing this release candidate! Every bug that is found and squashed at this stage will help ensure that the general release of 3.2.0 is clean and stable. As always, please report any bugs to: https://github.com/sylabs/singularity/issues/new And if you think that you've discovered a security vulnerability please report it to: security@sylabs.io Thanks, and have fun!
Cited by 0Open access
Kurtzer, Gregory M., Cclerget, Bauer, Michael et al. · Zenodo (CERN European Organization for Nuclear Research) · 2019
Howdy Singularity cowpokes! :cowboy_hat_face: :cow2: The major new feature of this release is the ability to build and run encrypted containers. These containers are encrypted at rest, in transit, and even while running! There is no intermediate decrypted rootfs left around upon termination. Data is decrypted totally in kernel space. Below is a slightly more thorough list of changes in 3.4.0. For a complete list, please see the commit history in git and on GitHub. New features / functionalities New support for building and running encrypted containers with RSA keys and passphrases <code>--pem-path</code> option added to the <code>build</code> and action commands for RSA based encrypted containers <code>--passphrase</code> option added to <code>build</code> and action commands for passphrase based encrypted containers <code>SINGULARITY_ENCRYPTION_PEM_PATH</code> and <code>SINGULARITY_ENCRYPTION_PASSPHRASE</code> environment variables added to serve same functions as above <code>--encrypt</code> option added to <code>build</code> command to build an encrypted container when environment variables contain a secret New <code>--disable-cache</code> flag prevents caching of downloaded containers Added support for multi-line variables in singularity def-files Added support for 'indexed' def-file variables (like arrays) Added support for SUSE SLE Products Added the def-file variables: product, user, regcode, productpgp, registerurl, modules, otherurl (indexed) Support multiple-architecture tags in the SCS library Added a <code>--dry-run</code> flag to <code>cache clean</code> Added a <code>SINGULARITY_SYPGPDIR</code> environment variable to specify the location of PGP key data Added a <code>--nonet</code> option to the action commands to disable networking when running with the <code>--vm</code> option Added a <code>--long-list</code> flag to the <code>key search</code> command to preserve Added experimental, hidden <code>--fusemount</code> flag to pass a command to mount a libfuse3 based file system within the container Changed defaults / behaviors Runtime now properly honors <code>SINGULARITY_DISABLE_CACHE</code> environment variable <code>remote add</code> command now automatically attempts to login and a <code>--no-login</code> flag is added to disable this behavior Using the <code>pull</code> command to download an unsigned container no longer produces an error code <code>cache clean</code> command now prompts user before cleaning when run without <code>--force</code> option and is more verbose Shortened the default output of the <code>key search</code> command Deprecated / removed commands The <code>--allow-unsigned</code> flag to <code>pull</code> has been deprecated and will be removed in the future As always, please report any bugs to: https://github.com/sylabs/singularity/issues/new And if you think that you've discovered a security vulnerability please report it to: security@sylabs.io Have fun!
Cited by 1Open access
Kurtzer, Gregory M., Cclerget, Bauer, Michael et al. · Zenodo (CERN European Organization for Nuclear Research) · 2019
This is the v3.4.2 bugfix release of Singularity, which addresses non-security related issues that were found in v3.4.1. We recommend you update to v3.4.2 for improved stability. This release addresses the following issues: Sets workable permissions on OCI -> sandbox rootless builds Fallback correctly to user namespace for non setuid installation Correctly handle the starter-suid binary for non-root installs Creates CACHEDIR if it doesn't exist Sets apex loglevel for umoci to match singularity loglevel Thanks to our contributors for code, feedback and, testing efforts! As always, please report any bugs to: https://github.com/sylabs/singularity/issues/new If you think that you've discovered a security vulnerability please report it to: security@sylabs.io Have fun!
Cited by 0Open access
Kurtzer, Gregory M., Cclerget, Bauer, Michael et al. · Zenodo (CERN European Organization for Nuclear Research) · 2019
Security Release The 3.5.2 release of Singularity contains fixes for a security issue related to incorrect file permissions (CVE-2019-19724) on user configuration and cache directories. In Singularity >=3.3.0 (on all OS/kernels) the <code>$HOME/.singularity</code> directory holding user configuration and caches is incorrectly created with 777 permissions. If the <code>$HOME</code> directory of a user has group/any <code>x</code> permission set, then a malicious user with login access to the host system may traverse into <code>$HOME/.singularity</code> and: Inject a remote.yaml configuration file that can direct interactions with Sylabs cloud services / Singularity Enterprise to a malicious server. This may result in the execution of malicious container images. Read the content of a user's cached containers, which may include sensitive private data. In Singularity >=2.4.0 (on all OS/kernels) the <code>$HOME/.singularity</code> directory and any explicit <code>SINGULARITY_CACHEDIR</code> directory are created with 755, or umask dependent permissions. If a user's <code>$HOME</code> directory, or the directory containing an explicitly set <code>SINGULARITY_CACHEDIR</code>, have group/any <code>x</code> permission set, then a malicious user with login access to the host system may: Read the content of a user's cached containers, which may include sensitive private data. Singularity 3.5.2 should be installed immediately, and all previous versions of Singularity should be removed. Additionally, we recommend running <code>chmod 700</code> against the <code>.singularity</code> directory within all user $HOME directories, especially if $HOME directories may have group/any <code>x</code> bits set on your system. Mitigations / Notes If no user <code>$HOME</code> directories have group/any <code>x</code> bits set, and <code>SINGULARITY_CACHEDIR</code> has never been set to a location open to shared access, the exploits listed above are not possible. If Singularity is configured to only run containers signed with keys specified in an execution control list, and these keys are not compromised, arbitrary malicious containers cannot be run with a <code>remote.yaml</code> exploit. Singularity 3.5.2 ensures <code>700</code> permissions are set on <code>$HOME/.singularity</code> when the <code>singularity</code> command is run by a user, and that <code>700</code> permissions are set for any existing or new explicit cache directory configured using the <code>SINGULARITY_CACHEDIR</code> environment variable. This release makes additional permission changes to further harden plugin operations against weak directory permissions / sudo secure umask settings, that should not occur without explicit administrator action. Singularity Desktop for Mac Previous alpha and beta versions of Singularity Desktop for Mac are affected by this issue. A new beta release, beta-v0.2, is being prepared, and will be available shortly. Patches against prior versions In keeping with our commitment to the open source community to release security patches incorporated into Singularity PRO, Sylabs is also releasing patches that can be applied to the 3.1, 2.6, 2.5, and 2.4 series. Even though 3.5.2 technically deprecates all previous open-source versions of Singularity, interested parties can find the patches to fix this specific issue at the following links: 3.1: https://repo.sylabs.io/security/2019/CVE-2019-19724-31.diff 2.6 / 2.5 / 2.4: https://repo.sylabs.io/security/2019/CVE-2019-19724-2x.diff Note - these prior versions of Singularity may be subject to additional security issues, addressed by further patches released previously. Please review the release history carefully before using a deprecated version of Singularity. Release Notes Security related fix 700 permissions are enforced on <code>$HOME/.singularity</code> and <code>SINGULARITY_CACHEDIR</code> directories (CVE-2019-19724). Many thanks to Stuart Barkley for reporting this issue. Bug Fixes Fixes an issue preventing use of <code>.docker/config</code> for docker registry authentication. Fixes the <code>run-help</code> command in the unprivileged workflow. Fixes a regression in the <code>inspect</code> command to support older image formats. Adds a workaround for an EL6 kernel bug regarding shared bind mounts. Fixes caching of http(s) sources with conflicting filenames. Fixes a fakeroot sandbox build error on certain filesystems, e.g. lustre, GPFS. Fixes a fakeroot build failure to a sandbox in $HOME. Fixes a fakeroot build failure from a bad def file section script location. Fixes container execution errors when CWD is a symlink. Provides a useful warning r.e. possible fakeroot build issues when seccomp support is not available. Fixes an issue where the <code>--disable-cache</code> option was not being honored.
Cited by 0Open access
Larus, James, Hunt, Galen, Tarditi, David · Infoscience (Ecole Polytechnique Fédérale de Lausanne) · 2006
VLSC
Cited by 0Open access
Bulletin of Miscellaneous Information (Royal Gardens Kew)
Far-ranging thoughts about the future of technology and what it might do for humanity.(Sorry it's dark; I lean back too often and my software tones down the brightness for some reason)Â
Cited by 0
Michael A. Peters · 2017
Cited by 0
Holm Altenbach, Andreas Öchsner · 2020
Cited by 0
Wayne B. Hanewicz, Chris Weigel · 2011
Cited by 0
Lüdeke, Christine, Throm, Claudia, Hochschule Pforzheim · 2017
Cited by 0
SpringerReference · 2012
Cited by 0