A flaw was found in the containers/storage library.

#!/usr/bin/env bash
# CVE-2026-79699 checker — containers/storage whiteout directory replacement
# Run on hosts with Podman, Buildah, or Skopeo installed.
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

RESULT="UNKNOWN"

check_version() {
  local tool="$1"
  local ver
  ver=$("$tool" --version 2>/dev/null | grep -oP '[0-9]+\.[0-9]+\.[0-9]+' | head -1) || return 1
  echo "[*] Found $tool version: $ver"
  echo "$ver"
}

version_gte() {
  # Returns 0 if $1 >= $2
  printf '%s\n%s' "$2" "$1" | sort -V -C
}

# Check Podman
if command -v podman &>/dev/null; then
  PODMAN_VER=$(check_version podman)
  if [ -n "$PODMAN_VER" ]; then
    MAJOR=$(echo "$PODMAN_VER" | cut -d. -f1)
    if [ "$MAJOR" -eq 5 ]; then
      if version_gte "$PODMAN_VER" "5.8.7"; then
        echo "[+] Podman $PODMAN_VER >= 5.8.7 — PATCHED"
        RESULT="PATCHED"
      else
        echo "[-] Podman $PODMAN_VER < 5.8.7 — VULNERABLE"
        RESULT="VULNERABLE"
      fi
    elif [ "$MAJOR" -ge 6 ]; then
      if version_gte "$PODMAN_VER" "6.1.2"; then
        echo "[+] Podman $PODMAN_VER >= 6.1.2 — PATCHED"
        RESULT="PATCHED"
      else
        echo "[-] Podman $PODMAN_VER < 6.1.2 — VULNERABLE"
        RESULT="VULNERABLE"
      fi
    elif [ "$MAJOR" -le 4 ]; then
      echo "[-] Podman $PODMAN_VER (v4.x or older) — VULNERABLE (EOL branch)"
      RESULT="VULNERABLE"
    fi
  fi
fi

# Check Buildah
if command -v buildah &>/dev/null; then
  BUILDAH_VER=$(check_version buildah)
  if [ -n "$BUILDAH_VER" ]; then
    echo "[*] Buildah $BUILDAH_VER detected — cross-reference with go.podman.io/storage version"
    # Buildah doesn't directly expose storage lib version; flag if Podman wasn't found
    if [ "$RESULT" = "UNKNOWN" ]; then
      echo "[!] Cannot determine patch status from Buildah version alone."
      echo "[!] Check: go list -m go.podman.io/storage 2>/dev/null in the build environment."
    fi
  fi
fi

# Check Skopeo
if command -v skopeo &>/dev/null; then
  SKOPEO_VER=$(check_version skopeo)
  if [ -n "$SKOPEO_VER" ]; then
    echo "[*] Skopeo $SKOPEO_VER detected — cross-reference with go.podman.io/storage version"
  fi
fi

# Try to check the Go module directly if available
if command -v go &>/dev/null; then
  STORAGE_VER=$(go list -m -json go.podman.io/storage 2>/dev/null | grep -oP '"Version":\s*"v?\K[0-9.]+' || true)
  if [ -n "$STORAGE_VER" ]; then
    echo "[*] go.podman.io/storage module version: $STORAGE_VER"
    if version_gte "$STORAGE_VER" "1.64.1"; then
      echo "[+] storage >= 1.64.1 — PATCHED"
      RESULT="PATCHED"
    elif version_gte "$STORAGE_VER" "1.63.0"; then
      echo "[-] storage >= 1.63.0 but < 1.64.1 — VULNERABLE"
      RESULT="VULNERABLE"
    elif version_gte "$STORAGE_VER" "1.62.1"; then
      echo "[+] storage >= 1.62.1 (1.62.x branch) — PATCHED"
      RESULT="PATCHED"
    else
      echo "[-] storage < 1.62.1 — VULNERABLE"
      RESULT="VULNERABLE"
    fi
  fi
fi

if ! command -v podman &>/dev/null && ! command -v buildah &>/dev/null && ! command -v skopeo &>/dev/null; then
  echo "[*] No Podman/Buildah/Skopeo found — not affected."
  RESULT="PATCHED"
fi

echo ""
echo "=== CVE-2026-79699 STATUS: $RESULT ==="

case "$RESULT" in
  PATCHED)    exit 0 ;;
  VULNERABLE) exit 1 ;;
  *)          exit 2 ;;
esac