[v4.4.1-crio] Bump Buildah to v1.29.3 CVE-2024-1753

[TomSweeneyRedHat]

As the title says. Addresses CVE-2024-1753
https://issues.redhat.com/browse/OCPBUGS-30996

[NO NEW TESTS NEEDED]

Does this PR introduce a user-facing change?

None

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: TomSweeneyRedHat

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [TomSweeneyRedHat]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[TomSweeneyRedHat]

@mheon PTAL. I strongly suspect this will be bloated too

[TomSweeneyRedHat]

@edsantiago any thoughts on the test errors here?

[edsantiago]

The common error I see is

crun: setgroups: Invalid argument

...which doesn't really give anyone anything to go on. @giuseppe?

[mheon]

I think we're missing a patch in this branch, but it's hard to say which one.

[giuseppe]

The common error I see is

crun: setgroups: Invalid argument

...which doesn't really give anyone anything to go on. @giuseppe?

that error means that we are trying to use a gid that is not present in the current user namespace. In other words, we are using a too small user namespace for the specified gid.

[giuseppe]

[+0584s] time="2024-03-29T09:05:45-05:00" level=error msg="\"crun: mount `devpts` to `/dev/pts`: Invalid argument: OCI runtime error\""

the one above could fail for the same reason

[giuseppe]

CI failures are introduced by 59ebe6d (#21132)

[giuseppe]

if the branch is used only for CRI-O, then rootless should not matter

[rhatdan]

/lgtm

[TomSweeneyRedHat]

Good catch @giuseppe , I had completely forgotten about that. @mheon do we close our eyes and push the shiny merge button?

[mheon]

CI on this branch is obviously broken and has been since it was created. I'm still concerned because this is not specifically for CRI-O, just for OCP, but we have merged into the branch before despite failing CI.