diff --git a/.gitignore b/.gitignore index e81c38c..b2825e5 100644 --- a/.gitignore +++ b/.gitignore @@ -426,3 +426,74 @@ /buildah-3177db5.tar.gz /buildah-f89b081.tar.gz /buildah-f1cf92b.tar.gz +/buildah-843d15d.tar.gz +/buildah-665dc2f.tar.gz +/buildah-10542ed.tar.gz +/buildah-3b9c6a3.tar.gz +/buildah-aba0d4d.tar.gz +/buildah-c61925b.tar.gz +/buildah-a5fabab.tar.gz +/buildah-e54da62.tar.gz +/buildah-e48ff81.tar.gz +/buildah-11ad04e.tar.gz +/buildah-d3804fa.tar.gz +/buildah-c18e043.tar.gz +/buildah-17ceb60.tar.gz +/buildah-1db2cde.tar.gz +/buildah-25c294c.tar.gz +/buildah-912ca5a.tar.gz +/buildah-2fc064e.tar.gz +/buildah-e9a6703.tar.gz +/buildah-31a01b4.tar.gz +/buildah-9c031e0.tar.gz +/buildah-20e41b7.tar.gz +/buildah-c3070ba.tar.gz +/buildah-310c02b.tar.gz +/buildah-f5dbfc1.tar.gz +/buildah-c554675.tar.gz +/buildah-e48fa75.tar.gz +/buildah-f7ff4c1.tar.gz +/buildah-7a88d7e.tar.gz +/buildah-c404c89.tar.gz +/buildah-db3ced9.tar.gz +/buildah-81e2659.tar.gz +/buildah-f4970e6.tar.gz +/buildah-0d5ab1d.tar.gz +/buildah-0b9a534.tar.gz +/buildah-bea8692.tar.gz +/buildah-8169acd.tar.gz +/buildah-3af27b4.tar.gz +/buildah-63567cb.tar.gz +/buildah-42a48f9.tar.gz +/buildah-f35e7d4.tar.gz +/buildah-7b0dfb8.tar.gz +/buildah-7610123.tar.gz +/buildah-828035f.tar.gz +/buildah-b438050.tar.gz +/buildah-6a7ace0.tar.gz +/buildah-f80da42.tar.gz +/buildah-0f6c2a9.tar.gz +/buildah-3184920.tar.gz +/buildah-9bd70ac.tar.gz +/buildah-7957c13.tar.gz +/buildah-4fc49ce.tar.gz +/buildah-ab1adf1.tar.gz +/buildah-75e94a2.tar.gz +/buildah-de0f541.tar.gz +/buildah-dbf0777.tar.gz +/buildah-0ac2a67.tar.gz +/buildah-f7a3515.tar.gz +/buildah-2c46b4b.tar.gz +/buildah-295b825.tar.gz +/v1.16.1.tar.gz +/v1.16.2.tar.gz +/v1.16.4.tar.gz +/v1.16.5.tar.gz +/v1.17.0.tar.gz +/v1.18.0.tar.gz +/v1.19.0.tar.gz +/v1.19.1.tar.gz +/v1.19.2.tar.gz +/v1.19.3.tar.gz +/buildah-6002877.tar.gz +/v1.19.4.tar.gz diff --git a/buildah.spec b/buildah.spec index 724e71f..25200c2 100644 --- a/buildah.spec +++ b/buildah.spec @@ -17,27 +17,28 @@ %define gobuild(o:) GO111MODULE=off go build -buildmode pie -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "${LDFLAGS:-} -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -extldflags '-Wl,-z,relro -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld '" -a -v -x %{?**}; %endif -%define provider github -%define provider_tld com -%define project containers -%define repo buildah +%global provider github +%global provider_tld com +%global project containers +%global repo buildah # https://github.com/containers/buildah -%define import_path %{provider}.%{provider_tld}/%{project}/%{repo} -%define git0 https://%{import_path} -%define commit0 f1cf92bba2345a555a437dc533d420769ecb66b2 -%define shortcommit0 %(c=%{commit0}; echo ${c:0:7}) +%global import_path %{provider}.%{provider_tld}/%{project}/%{repo} +%global git0 https://%{import_path} # Used for comparing with latest upstream tag # to decide whether to autobuild (non-rawhide only) -%define built_tag v1.13.2 +%define built_tag v1.19.4 +%define built_tag_strip %(b=%{built_tag}; echo ${b:1}) +%define download_url https://%{import_path}/archive/%{built_tag}.tar.gz Name: %{repo} -Version: 1.14.0 -Release: 0.35.dev.git%{shortcommit0}%{?dist} +Version: 1.19.4 +Release: 1%{?dist} Summary: A command line tool used for creating OCI Images License: ASL 2.0 URL: https://%{name}.io -Source: %{git0}/archive/%{commit0}/%{name}-%{shortcommit0}.tar.gz +Source: %{download_url} +BuildRequires: device-mapper-devel BuildRequires: golang BuildRequires: git BuildRequires: glib2-devel @@ -46,20 +47,28 @@ BuildRequires: go-md2man BuildRequires: gpgme-devel BuildRequires: libassuan-devel BuildRequires: make -Requires: crun >= 0.10-1 Requires: containers-common -%if 0%{?fedora} -BuildRequires: btrfs-progs-devel -BuildRequires: device-mapper-devel +%if 0%{?fedora} || 0%{?centos} >= 8 || 0%{?eln} BuildRequires: ostree-devel -BuildRequires: libseccomp-static -Recommends: container-selinux -Recommends: slirp4netns >= 0.3-0 -Recommends: fuse-overlayfs +Requires: oci-runtime >= 2 +Recommends: crun >= 0.17-3 %else -#### DO NOT REMOVE - NEEDED FOR CENTOS -BuildRequires: libseccomp-devel +Requires: runc +%endif +# No btrfs for centos 8 +%if 0%{?fedora} || 0%{?centos} <= 7 +BuildRequires: btrfs-progs-devel +%endif +%if 0%{?fedora} || 0%{?eln} +BuildRequires: libseccomp-static Requires: libseccomp >= 2.4.1-0 +Recommends: container-selinux +Recommends: slirp4netns >= 1.1.8-1 +Recommends: fuse-overlayfs +Suggests: cpp +%else +BuildRequires: libseccomp-devel +Requires: libseccomp Requires: container-selinux Requires: slirp4netns >= 0.3-0 %endif @@ -82,6 +91,8 @@ Requires: bzip2 Requires: podman Requires: golang Requires: jq +Requires: httpd-tools +Requires: openssl %description tests %{summary} @@ -89,7 +100,7 @@ Requires: jq This package contains system tests for %{name} %prep -%autosetup -Sgit -n %{name}-%{commit0} +%autosetup -Sgit -n %{name}-%{built_tag_strip} sed -i 's/GOMD2MAN =/GOMD2MAN ?=/' docs/Makefile sed -i '/docs install/d' Makefile @@ -102,9 +113,22 @@ popd mv vendor src +export CGO_CFLAGS="-O2 -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -ffat-lto-objects -fexceptions -fasynchronous-unwind-tables -fstack-protector-strong -fstack-clash-protection -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64" +%ifarch x86_64 +export CGO_CFLAGS="$CGO_CFLAGS -m64 -mtune=generic" +%if 0%{?fedora} || 0%{?centos} >= 8 +export CGO_CFLAGS="$CGO_CFLAGS -fcf-protection" +%endif +%endif +# These extra flags present in %%{optflags} have been skipped for now as they break the build +#export CGO_CFLAGS="$CGO_CFLAGS -flto=auto -Wp,D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1" + export GOPATH=$(pwd)/_build:$(pwd) export BUILDTAGS='seccomp selinux' -%gobuild -o %{name} %{import_path}/cmd/%{name} +%if 0%{?centos} >= 8 +export BUILDTAGS+=' exclude_graphdriver_btrfs' +%endif +%gobuild -o bin/%{name} %{import_path}/cmd/%{name} %gobuild -o imgtype %{import_path}/tests/imgtype GOMD2MAN=go-md2man %{__make} -C docs @@ -135,6 +159,271 @@ cp imgtype %{buildroot}/%{_bindir}/%{name}-imgtype %{_datadir}/%{name}/test %changelog +* Tue Feb 09 2021 Lokesh Mandvekar - 1.19.4-1 +- Resolves: #1919391, #1926796 - Security fix for CVE-2021-20206 +- bump to v1.19.4 +- adjust dependencies + +* Fri Jan 29 2021 RH Container Bot - 1.19.3-1 +- autobuilt v1.19.3 + +* Fri Jan 15 2021 RH Container Bot - 1.19.2-1 +- autobuilt v1.19.2 + +* Thu Jan 14 2021 RH Container Bot - 1.19.1-1 +- autobuilt v1.19.1 + +* Sat Jan 9 2021 RH Container Bot - 1.19.0-1 +- autobuilt v1.19.0 + +* Mon Dec 7 2020 Lokesh Mandvekar - 1.18.0-3 +- bump release tag for centos OBS + +* Mon Dec 07 2020 Lokesh Mandvekar - 1.18.0-2 +- harden cgo based go binaries +- Reported-by: Wade Mealing + +* Mon Nov 16 2020 RH Container Bot - 1.18.0-1 +- autobuilt v1.18.0 + +* Mon Nov 9 2020 Lokesh Mandvekar - 1.17.0-2 +- rebuild + +* Thu Nov 5 2020 RH Container Bot - 1.17.0-1 +- autobuilt v1.17.0 + +* Thu Oct 22 2020 RH Container Bot - 1.16.5-1 +- autobuilt v1.16.5 + +* Fri Oct 2 2020 RH Container Bot - 1.16.4-1 +- autobuilt v1.16.4 + +* Tue Sep 22 2020 RH Container Bot - 1.16.2-1 +- autobuilt v1.16.2 + +* Mon Sep 21 2020 Lokesh Mandvekar - 1.16.1-3 +- adjust deps for centos 7 + +* Wed Sep 16 2020 Lokesh Mandvekar - 1.16.1-2 +- fix build issues + +* Fri Sep 11 2020 RH Container Bot - 1.16.1-1 +- autobuilt v1.16.1 + +* Wed Sep 09 2020 Lokesh Mandvekar - 1.16.0-2 +- fix gating tests + +* Mon Sep 7 2020 Dan Walsh - 1.16.0-1 +- Bump to next major release + +* Thu Sep 3 2020 RH Container Bot - 1.15.2-1 +- autobuilt v1.15.2 + +* Mon Jul 27 2020 Fedora Release Engineering - 1.15.0-0.68.dev.git2c46b4b +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Tue May 26 2020 Lokesh Mandvekar - 1.15.0-0.67.dev.git2c46b4b +- update deps for centos + +* Tue May 26 2020 RH Container Bot - 1.15.0-0.66.dev.git2c46b4b +- autobuilt 2c46b4b + +* Tue May 26 2020 RH Container Bot - 1.15.0-0.65.dev.gitf7a3515 +- autobuilt f7a3515 + +* Mon May 25 2020 RH Container Bot - 1.15.0-0.64.dev.git0ac2a67 +- autobuilt 0ac2a67 + +* Sun May 24 2020 RH Container Bot - 1.15.0-0.63.dev.gitdbf0777 +- autobuilt dbf0777 + +* Sat May 23 2020 RH Container Bot - 1.15.0-0.62.dev.gitde0f541 +- autobuilt de0f541 + +* Thu May 21 2020 RH Container Bot - 1.15.0-0.61.dev.git75e94a2 +- autobuilt 75e94a2 + +* Thu May 21 2020 RH Container Bot - 1.15.0-0.60.dev.gitab1adf1 +- autobuilt ab1adf1 + +* Wed May 20 2020 RH Container Bot - 1.15.0-0.59.dev.git4fc49ce +- autobuilt 4fc49ce + +* Mon May 18 2020 RH Container Bot - 1.15.0-0.58.dev.git7957c13 +- autobuilt 7957c13 + +* Wed May 13 2020 RH Container Bot - 1.15.0-0.57.dev.git9bd70ac +- autobuilt 9bd70ac + +* Tue May 12 2020 RH Container Bot - 1.15.0-0.56.dev.git3184920 +- autobuilt 3184920 + +* Mon May 11 2020 RH Container Bot - 1.15.0-0.55.dev.git0f6c2a9 +- autobuilt 0f6c2a9 + +* Mon May 11 2020 RH Container Bot - 1.15.0-0.54.dev.gitf80da42 +- autobuilt f80da42 + +* Fri May 08 2020 RH Container Bot - 1.15.0-0.53.dev.git6a7ace0 +- autobuilt 6a7ace0 + +* Tue May 05 2020 RH Container Bot - 1.15.0-0.52.dev.gitb438050 +- autobuilt b438050 + +* Mon May 04 2020 RH Container Bot - 1.15.0-0.51.dev.git828035f +- autobuilt 828035f + +* Mon May 04 2020 RH Container Bot - 1.15.0-0.50.dev.git7610123 +- autobuilt 7610123 + +* Mon May 04 2020 RH Container Bot - 1.15.0-0.49.dev.git7b0dfb8 +- autobuilt 7b0dfb8 + +* Fri May 01 2020 RH Container Bot - 1.15.0-0.48.dev.gitf35e7d4 +- autobuilt f35e7d4 + +* Fri May 01 2020 RH Container Bot - 1.15.0-0.47.dev.git42a48f9 +- autobuilt 42a48f9 + +* Fri May 01 2020 RH Container Bot - 1.15.0-0.46.dev.git63567cb +- autobuilt 63567cb + +* Fri May 01 2020 RH Container Bot - 1.15.0-0.45.dev.git3af27b4 +- autobuilt 3af27b4 + +* Tue Apr 28 2020 RH Container Bot - 1.15.0-0.44.dev.git8169acd +- autobuilt 8169acd + +* Tue Apr 28 2020 RH Container Bot - 1.15.0-0.43.dev.gitbea8692 +- autobuilt bea8692 + +* Fri Apr 24 2020 RH Container Bot - 1.15.0-0.42.dev.git0b9a534 +- autobuilt 0b9a534 + +* Fri Apr 24 2020 RH Container Bot - 1.15.0-0.41.dev.git0d5ab1d +- autobuilt 0d5ab1d + +* Thu Apr 23 2020 Lokesh Mandvekar - 1.15.0-0.40.dev.gitf4970e6 +- use latest commit + +* Thu Apr 23 2020 RH Container Bot - 1.15.0-0.39.dev.git843d15d +- autobuilt 843d15d + +* Mon Apr 20 2020 RH Container Bot - 1.15.0-0.38.dev.gitf4970e6 +- autobuilt f4970e6 + +* Thu Apr 16 2020 RH Container Bot - 1.15.0-0.37.dev.git81e2659 +- autobuilt 81e2659 + +* Tue Apr 14 2020 RH Container Bot - 1.15.0-0.36.dev.gitdb3ced9 +- autobuilt db3ced9 + +* Mon Apr 13 2020 RH Container Bot - 1.15.0-0.35.dev.gitc404c89 +- autobuilt c404c89 + +* Mon Apr 13 2020 RH Container Bot - 1.15.0-0.34.dev.git7a88d7e +- autobuilt 7a88d7e + +* Thu Apr 09 2020 RH Container Bot - 1.15.0-0.33.dev.gitf7ff4c1 +- autobuilt f7ff4c1 + +* Thu Apr 09 2020 RH Container Bot - 1.15.0-0.32.dev.gite48fa75 +- autobuilt e48fa75 + +* Tue Apr 07 2020 RH Container Bot - 1.15.0-0.31.dev.gitc554675 +- autobuilt c554675 + +* Tue Apr 07 2020 RH Container Bot - 1.15.0-0.30.dev.gitf5dbfc1 +- autobuilt f5dbfc1 + +* Tue Apr 07 2020 RH Container Bot - 1.15.0-0.29.dev.git310c02b +- autobuilt 310c02b + +* Tue Apr 07 2020 RH Container Bot - 1.15.0-0.28.dev.gitc3070ba +- autobuilt c3070ba + +* Mon Apr 06 2020 RH Container Bot - 1.15.0-0.27.dev.git20e41b7 +- autobuilt 20e41b7 + +* Mon Apr 06 2020 RH Container Bot - 1.15.0-0.26.dev.git9c031e0 +- autobuilt 9c031e0 + +* Sat Apr 04 2020 RH Container Bot - 1.15.0-0.25.dev.git31a01b4 +- autobuilt 31a01b4 + +* Thu Apr 02 2020 RH Container Bot - 1.15.0-0.24.dev.gite9a6703 +- autobuilt e9a6703 + +* Wed Apr 01 2020 RH Container Bot - 1.15.0-0.23.dev.git2fc064e +- autobuilt 2fc064e + +* Tue Mar 31 2020 RH Container Bot - 1.15.0-0.22.dev.git912ca5a +- autobuilt 912ca5a + +* Tue Mar 31 2020 RH Container Bot - 1.15.0-0.21.dev.git25c294c +- autobuilt 25c294c + +* Mon Mar 30 2020 RH Container Bot - 1.15.0-0.20.dev.git1db2cde +- autobuilt 1db2cde + +* Sat Mar 28 2020 RH Container Bot - 1.15.0-0.19.dev.git17ceb60 +- autobuilt 17ceb60 + +* Fri Mar 27 2020 RH Container Bot - 1.15.0-0.18.dev.gitc18e043 +- autobuilt c18e043 + +* Fri Mar 27 2020 RH Container Bot - 1.15.0-0.17.dev.gitd3804fa +- autobuilt d3804fa + +* Thu Mar 26 2020 RH Container Bot - 1.15.0-0.16.dev.git11ad04e +- autobuilt 11ad04e + +* Thu Mar 26 2020 RH Container Bot - 1.15.0-0.15.dev.gite48ff81 +- autobuilt e48ff81 + +* Thu Mar 26 2020 RH Container Bot - 1.15.0-0.14.dev.gite54da62 +- autobuilt e54da62 + +* Wed Mar 25 2020 RH Container Bot - 1.15.0-0.13.dev.gita5fabab +- autobuilt a5fabab + +* Wed Mar 25 2020 RH Container Bot - 1.15.0-0.12.dev.gitc61925b +- autobuilt c61925b + +* Mon Mar 23 2020 RH Container Bot - 1.15.0-0.11.dev.gitaba0d4d +- autobuilt aba0d4d + +* Mon Mar 23 2020 RH Container Bot - 1.15.0-0.10.dev.git3b9c6a3 +- autobuilt 3b9c6a3 + +* Mon Mar 23 2020 RH Container Bot - 1.15.0-0.9.dev.git10542ed +- autobuilt 10542ed + +* Thu Mar 19 2020 RH Container Bot - 1.15.0-0.8.dev.git665dc2f +- autobuilt 665dc2f + +* Thu Mar 19 2020 Lokesh Mandvekar - 1.15.0-0.7.dev.git843d15d +- use correct commit + +* Thu Mar 19 2020 RH Container Bot - 1.15.0-0.6.dev.gitf1cf92b +- autobuilt 843d15d + +* Thu Mar 19 2020 RH Container Bot - 1.15.0-0.5.dev.gitf1cf92b +- autobuilt a2285ed + +* Wed Mar 18 2020 RH Container Bot - 1.15.0-0.4.dev.gitf1cf92b +- autobuilt a2285ed + +* Wed Mar 18 2020 RH Container Bot - 1.15.0-0.3.dev.gitf1cf92b +- autobuilt a2285ed + +* Tue Mar 17 2020 RH Container Bot - 1.15.0-0.2.dev.gitf1cf92b +- autobuilt 040fb4b + +* Mon Mar 16 2020 RH Container Bot - 1.15.0-0.1.dev.gitf1cf92b +- bump to 1.15.0 +- autobuilt d26f437 + * Wed Feb 05 2020 RH Container Bot - 1.14.0-0.35.dev.gitf1cf92b - autobuilt f1cf92b diff --git a/gating.yaml b/gating.yaml index 92d738a..c8a218f 100644 --- a/gating.yaml +++ b/gating.yaml @@ -2,5 +2,13 @@ product_versions: - fedora-* decision_context: bodhi_update_push_stable +subject_type: koji_build rules: - - !PassingTestCaseRule {test_case_name: org.centos.prod.ci.pipeline.allpackages-build.complete} + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} +--- !Policy +product_versions: + - fedora-* +decision_context: bodhi_update_push_testing +subject_type: koji_build +rules: + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} diff --git a/sources b/sources index 06b1e00..bfe45e2 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (buildah-f1cf92b.tar.gz) = 1ace9b914d3f12fb80fb03e5fc95453f4f3c830c1a075c1367d8d866b549df43279fa1c01683009b8ea8c374c0551def0522963b9be75622c185c19e62dda770 +SHA512 (v1.19.4.tar.gz) = 688c96a5f5b4ba821410b6343f879a7d6aaa41ee60821f2ae5b58924c02bf75182d958e6a45995a3fcb61a55b9a7d76b87a9ce40a9461102e0fc9408595a22c2 diff --git a/tests/test_buildah.sh b/tests/test_buildah.sh index 2227107..aade91c 100755 --- a/tests/test_buildah.sh +++ b/tests/test_buildah.sh @@ -19,6 +19,8 @@ export IMGTYPE_BINARY=/usr/bin/buildah-imgtype # Start a registry pre_bats_setup() { + REGISTRY_FQIN=quay.io/libpod/registry:2 + AUTHDIR=/tmp/buildah-tests-auth.$$ mkdir -p $AUTHDIR @@ -27,12 +29,12 @@ pre_bats_setup() { openssl req -newkey rsa:4096 -nodes -sha256 \ -keyout $AUTHDIR/domain.key -x509 -days 2 \ -out $AUTHDIR/domain.crt \ - -subj "/C=US/ST=Foo/L=Bar/O=Red Hat, Inc./CN=localhost" + -subj "/C=US/ST=Foo/L=Bar/O=Red Hat, Inc./CN=registry host certificate" \ + -addext subjectAltName=DNS:localhost fi if [ ! -e $AUTHDIR/htpasswd ]; then - podman run --rm --entrypoint htpasswd registry:2 \ - -Bbn testuser testpassword > $AUTHDIR/htpasswd + htpasswd -Bbn testuser testpassword > $AUTHDIR/htpasswd fi podman rm -f registry || true @@ -44,7 +46,7 @@ pre_bats_setup() { -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \ -e REGISTRY_HTTP_TLS_CERTIFICATE=/auth/domain.crt \ -e REGISTRY_HTTP_TLS_KEY=/auth/domain.key \ - registry:2 + $REGISTRY_FQIN } post_bats_teardown() { diff --git a/tests/test_buildah.yml b/tests/test_buildah.yml index be1ce31..4820a9f 100644 --- a/tests/test_buildah.yml +++ b/tests/test_buildah.yml @@ -1,5 +1,7 @@ --- - hosts: localhost + environment: + TMPDIR: /var/tmp roles: - role: standard-test-basic tags: