A flaw was found in the buildah/copier Go package.

#!/usr/bin/env bash
# CVE-2026-79705 — buildah/copier symlink path traversal checker
# Checks installed buildah version and Go module dependency.
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

RESULT="UNKNOWN"

version_gte() {
  # Returns 0 if $1 >= $2 using sort -V
  [ "$(printf '%s\n%s' "$1" "$2" | sort -V | head -n1)" = "$2" ]
}

# --- Check 1: buildah binary ---
if command -v buildah &>/dev/null; then
  BVERSION=$(buildah --version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
  if [ -n "$BVERSION" ]; then
    echo "[*] Detected buildah version: $BVERSION"
    # Buildah itself uses chroot and is NOT vulnerable, but check
    # if the bundled copier library is patched anyway.
    # Patched: >= 1.43.4 (in 1.43.x line) or >= 1.45.1 (in 1.44+)
    MAJOR_MINOR=$(echo "$BVERSION" | grep -oE '^[0-9]+\.[0-9]+')
    if version_gte "$BVERSION" "1.45.1"; then
      echo "[+] buildah >= 1.45.1 — copier library is PATCHED"
      echo "[i] Note: buildah itself was never vulnerable (chroot hardening)."
      RESULT="PATCHED"
    elif [ "$MAJOR_MINOR" = "1.43" ] && version_gte "$BVERSION" "1.43.4"; then
      echo "[+] buildah 1.43.x >= 1.43.4 — copier library is PATCHED"
      echo "[i] Note: buildah itself was never vulnerable (chroot hardening)."
      RESULT="PATCHED"
    elif [ "$MAJOR_MINOR" = "1.44" ] || { [ "$MAJOR_MINOR" = "1.45" ] && ! version_gte "$BVERSION" "1.45.1"; }; then
      echo "[-] buildah $BVERSION — bundled copier is VULNERABLE"
      echo "[i] Note: buildah itself uses chroot and is NOT exploitable,"
      echo "    but other tools linking this copier version may be."
      RESULT="VULNERABLE"
    elif ! version_gte "$BVERSION" "1.43.4"; then
      echo "[-] buildah $BVERSION < 1.43.4 — bundled copier is VULNERABLE"
      RESULT="VULNERABLE"
    else
      echo "[?] buildah $BVERSION — cannot determine patch status"
    fi
  fi
else
  echo "[*] buildah binary not found on this host."
fi

# --- Check 2: Go module dependency (for Go projects) ---
if command -v go &>/dev/null; then
  echo ""
  echo "[*] Scanning Go module cache for buildah/copier..."
  GOMODCACHE=$(go env GOMODCACHE 2>/dev/null || echo "")
  if [ -n "$GOMODCACHE" ] && [ -d "$GOMODCACHE" ]; then
    FOUND=$(find "$GOMODCACHE" -path '*/containers/buildah@*' -name 'copier' -type d 2>/dev/null || true)
    if [ -n "$FOUND" ]; then
      echo "[!] Found buildah/copier in Go module cache:"
      echo "$FOUND"
      echo "[i] Audit go.mod files in your projects for this import."
      if [ "$RESULT" = "UNKNOWN" ]; then
        RESULT="VULNERABLE"
      fi
    else
      echo "[+] No buildah/copier found in Go module cache."
      if [ "$RESULT" = "UNKNOWN" ]; then
        RESULT="PATCHED"
      fi
    fi
  fi
fi

echo ""
echo "=== RESULT: $RESULT ==="

case "$RESULT" in
  PATCHED)    exit 0 ;;
  VULNERABLE) exit 1 ;;
  *)          exit 2 ;;
esac