Update to 1.40.0 upstream release

Upstream tag: v1.40.0
Upstream commit: ff62e3e8

Commit authored by Packit automation (https://packit.dev/)

.fmf/version

@@ -0,0 +1 @@
+1

.gitignore

@@ -704,3 +704,21 @@
 /v1.32.2.tar.gz
 /v1.33.2.tar.gz
 /v1.34.0.tar.gz
+/v1.34.1.tar.gz
+/v1.35.0.tar.gz
+/v1.35.1.tar.gz
+/v1.35.2.tar.gz
+/v1.35.3.tar.gz
+/v1.35.4.tar.gz
+/v1.36.0.tar.gz
+/v1.37.0.tar.gz
+/v1.37.1.tar.gz
+/v1.37.3.tar.gz
+/v1.37.4.tar.gz
+/v1.37.5.tar.gz
+/v1.38.0.tar.gz
+/v1.38.1.tar.gz
+/v1.39.0.tar.gz
+/v1.39.1.tar.gz
+/v1.39.2.tar.gz
+/v1.40.0.tar.gz

.packit.yaml

@@ -2,53 +2,146 @@
 # See the documentation for more information:
 # https://packit.dev/docs/configuration/
 
-specfile_path: rpm/buildah.spec
+downstream_package_name: buildah
 upstream_tag_template: v{version}
 
+# These files get synced from upstream to downstream (Fedora / CentOS Stream) on every
+# propose-downstream job. This is done so tests maintained upstream can be run
+# downstream in Zuul CI and Bodhi.
+# Ref: https://packit.dev/docs/configuration#files_to_sync
+files_to_sync:
+  - src: rpm/gating.yaml
+    dest: gating.yaml
+    delete: true
+  - src: plans/
+    dest: plans/
+    delete: true
+    mkpath: true
+  - src: tests/tmt/
+    dest: tests/tmt/
+    delete: true
+    mkpath: true
+  - src: .fmf/
+    dest: .fmf/
+    delete: true
+  - .packit.yaml
+
+packages:
+  buildah-fedora:
+    pkg_tool: fedpkg
+    specfile_path: rpm/buildah.spec
+  buildah-centos:
+    pkg_tool: centpkg
+    specfile_path: rpm/buildah.spec
+  buildah-eln:
+    specfile_path: rpm/buildah.spec
+
 srpm_build_deps:
   - make
 
 jobs:
   - job: copr_build
     trigger: pull_request
-    notifications:
+    packages: [buildah-fedora]
+    notifications: &copr_build_failure_notification
       failure_comment:
         message: "Ephemeral COPR build failed. @containers/packit-build please check."
+    targets: &fedora_copr_targets
+    # f40 ships go 1.22 and we require go 1.23 now. This should be revert to fedora-all
+    # once either f40 is rebased to go 1.23 or f42 is released and f40 EOL.
+      - fedora-latest-stable-x86_64
+      - fedora-latest-stable-aarch64
+      - fedora-development-x86_64
+      - fedora-development-aarch64
     enable_net: true
+
+  - job: copr_build
+    trigger: pull_request
+    packages: [buildah-eln]
+    notifications: *copr_build_failure_notification
     targets:
-      - fedora-all-x86_64
-      - fedora-all-aarch64
-      - fedora-eln-x86_64
-      - fedora-eln-aarch64
-      - centos-stream+epel-next-8-x86_64
-      - centos-stream+epel-next-8-aarch64
-      - centos-stream+epel-next-9-x86_64
-      - centos-stream+epel-next-9-aarch64
-    additional_repos:
-      - "copr://rhcontainerbot/podman-next"
+      fedora-eln-x86_64:
+        additional_repos:
+          - "https://kojipkgs.fedoraproject.org/repos/eln-build/latest/x86_64/"
+      fedora-eln-aarch64:
+        additional_repos:
+          - "https://kojipkgs.fedoraproject.org/repos/eln-build/latest/aarch64/"
+    enable_net: true
+
+  - job: copr_build
+    trigger: pull_request
+    packages: [buildah-centos]
+    notifications: *copr_build_failure_notification
+    targets: &centos_copr_targets
+      - centos-stream-9-x86_64
+      - centos-stream-9-aarch64
+      - centos-stream-10-x86_64
+      - centos-stream-10-aarch64
+    enable_net: true
 
   # Run on commit to main branch
   - job: copr_build
     trigger: commit
+    packages: [buildah-fedora]
     notifications:
       failure_comment:
         message: "podman-next COPR build failed. @containers/packit-build please check."
+    branch: main
     owner: rhcontainerbot
     project: podman-next
     enable_net: true
 
+  # Tests on Fedora for main branch PRs
+  - job: tests
+    trigger: pull_request
+    packages: [buildah-fedora]
+    targets: &fedora_copr_test_targets
+    # See the other comment above, this should be reverted to fedora-all when possible.
+      - fedora-latest-stable-x86_64
+      - fedora-development-x86_64
+    tf_extra_params:
+      environments:
+        - artifacts:
+          - type: repository-file
+            id: https://copr.fedorainfracloud.org/coprs/rhcontainerbot/podman-next/repo/fedora-$releasever/rhcontainerbot-podman-next-fedora-$releasever.repo
+
+  # Tests on CentOS Stream for main branch PRs
+  - job: tests
+    trigger: pull_request
+    packages: [buildah-centos]
+    targets: &centos_copr_test_targets
+      - centos-stream-9-x86_64
+      - centos-stream-10-x86_64
+    tf_extra_params:
+      environments:
+        - artifacts:
+          - type: repository-file
+            id: https://copr.fedorainfracloud.org/coprs/rhcontainerbot/podman-next/repo/centos-stream-$releasever/rhcontainerbot-podman-next-centos-stream-$releasever.repo
+
+  # Sync to Fedora
   - job: propose_downstream
     trigger: release
+    packages: [buildah-fedora]
+    update_release: false
+    dist_git_branches: &fedora_targets
+      - fedora-all
+
+  # Sync to CentOS Stream
+  - job: propose_downstream
+    trigger: release
+    packages: [buildah-centos]
     update_release: false
     dist_git_branches:
-      - fedora-all
+      - c10s
 
+  # Fedora Koji build
   - job: koji_build
     trigger: commit
-    dist_git_branches:
-      - fedora-all
-
-  - job: bodhi_update
-    trigger: commit
-    dist_git_branches:
-      - fedora-branched # rawhide updates are created automatically
+    packages: [buildah-fedora]
+    sidetag_group: podman-releases
+    # Dependents are not rpm dependencies, but the package whose bodhi update
+    # should include this package.
+    # Ref: https://packit.dev/docs/fedora-releases-guide/releasing-multiple-packages
+    dependents:
+      - podman
+    dist_git_branches: *fedora_targets

README.packit

@@ -1,3 +1,3 @@
 This repository is maintained by packit.
 https://packit.dev/
-The file was generated using packit 0.87.1.post1.dev7+g9f53ebb4.
+The file was generated using packit 1.6.0.post1.dev2+gd5a7662a.

buildah.spec

@@ -7,27 +7,24 @@
 %global debug_package   %{nil}
 %endif
 
-# RHEL's default %%gobuild macro doesn't account for the BUILDTAGS variable, so we
-# set it separately here and do not depend on RHEL's go-[s]rpm-macros package
-# until that's fixed.
-# c9s bz: https://bugzilla.redhat.com/show_bug.cgi?id=2227328
-# c8s bz: https://bugzilla.redhat.com/show_bug.cgi?id=2227331
-%if %{defined rhel}
-%define gobuild(o:) go build -buildmode pie -compiler gc -tags="rpm_crashtraceback libtrust_openssl ${BUILDTAGS:-}" -ldflags "-linkmode=external -compressdwarf=false ${LDFLAGS:-} -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -extldflags '%__global_ldflags'" -a -v -x %{?**};
-%endif
-
 %global gomodulesmode GO111MODULE=on
 
-%if 0%{defined fedora}
+%if %{defined fedora}
 %define build_with_btrfs 1
 %endif
 
+%if %{defined rhel}
+%define fips 1
+%endif
+
 %global git0 https://github.com/containers/%{name}
 
 Name: buildah
 # Set different Epoch for copr
 %if %{defined copr_username}
 Epoch: 102
+%else
+Epoch: 2
 %endif
 # DO NOT TOUCH the Version string!
 # The TRUE source of this specfile is:
@@ -35,7 +32,7 @@ Epoch: 102
 # If that's what you're reading, Version must be 0, and will be updated by Packit for
 # copr and koji builds.
 # If you're reading this on dist-git, the version is automatically filled in by Packit.
-Version: 1.34.0
+Version: 1.40.0
 # The `AND` needs to be uppercase in the License for SPDX compatibility
 License: Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND MIT AND MPL-2.0
 Release: %autorelease
@@ -82,11 +79,17 @@ or
 * save container's root file system layer to create a new image
 * delete a working container or an image
 
+# This subpackage is only intended for CI testing.
+# Not meant for end user/customer usage.
 %package tests
 Summary: Tests for %{name}
 
-Requires: %{name} = %{version}-%{release}
+Requires: %{name} = %{epoch}:%{version}-%{release}
+%if %{defined bats_epel}
 Requires: bats
+%else
+Recommends: bats
+%endif
 Requires: bzip2
 Requires: podman
 Requires: golang
@@ -120,15 +123,20 @@ export CGO_CFLAGS+=" -m64 -mtune=generic -fcf-protection=full"
 export CNI_VERSION=`grep '^# github.com/containernetworking/cni ' src/modules.txt | sed 's,.* ,,'`
 export LDFLAGS="-X main.buildInfo=`date +%s` -X main.cniVersion=${CNI_VERSION}"
 
-export BUILDTAGS="seccomp exclude_graphdriver_devicemapper $(hack/systemd_tag.sh) $(hack/libsubid_tag.sh)"
+export BUILDTAGS="seccomp $(hack/systemd_tag.sh) $(hack/libsubid_tag.sh)"
 %if !%{defined build_with_btrfs}
 export BUILDTAGS+=" btrfs_noversion exclude_graphdriver_btrfs"
 %endif
 
+%if %{defined fips}
+export BUILDTAGS+=" libtrust_openssl"
+%endif
+
 %gobuild -o bin/%{name} ./cmd/%{name}
 %gobuild -o bin/imgtype ./tests/imgtype
 %gobuild -o bin/copy ./tests/copy
 %gobuild -o bin/tutorial ./tests/tutorial
+%gobuild -o bin/inet ./tests/inet
 %{__make} docs
 
 %install
@@ -139,14 +147,18 @@ cp -pav tests/. %{buildroot}/%{_datadir}/%{name}/test/system
 cp bin/imgtype %{buildroot}/%{_bindir}/%{name}-imgtype
 cp bin/copy    %{buildroot}/%{_bindir}/%{name}-copy
 cp bin/tutorial %{buildroot}/%{_bindir}/%{name}-tutorial
+cp bin/inet     %{buildroot}/%{_bindir}/%{name}-inet
 
 rm %{buildroot}%{_datadir}/%{name}/test/system/tools/build/*
 
 #define license tag if not already defined
 %{!?_licensedir:%global license %doc}
 
+# Include check to silence rpmlint.
+%check
+
 %files
-%license LICENSE
+%license LICENSE vendor/modules.txt
 %doc README.md
 %{_bindir}/%{name}
 %{_mandir}/man1/%{name}*
@@ -159,6 +171,7 @@ rm %{buildroot}%{_datadir}/%{name}/test/system/tools/build/*
 %{_bindir}/%{name}-imgtype
 %{_bindir}/%{name}-copy
 %{_bindir}/%{name}-tutorial
+%{_bindir}/%{name}-inet
 %{_datadir}/%{name}/test
 
 %changelog

gating.yaml

@@ -1,14 +1,16 @@
 --- !Policy
 product_versions:
   - fedora-*
-decision_context: bodhi_update_push_stable
+decision_contexts:
+  - bodhi_update_push_stable
+  - bodhi_update_push_testing
 subject_type: koji_build
 rules:
   - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}
+
 --- !Policy
 product_versions:
-  - fedora-*
-decision_context: bodhi_update_push_testing
-subject_type: koji_build
+  - rhel-*
+decision_context: osci_compose_gate
 rules:
-  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}
+  - !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}

plans/main.fmf

@@ -0,0 +1,34 @@
+discover:
+    how: fmf
+
+execute:
+    how: tmt
+
+prepare:
+    - when: distro == centos-stream or distro == rhel
+      how: shell
+      script: |
+        dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-$(rpm --eval '%{?rhel}').noarch.rpm
+        dnf -y config-manager --set-enabled epel
+      order: 10
+    - when: initiator == packit
+      how: shell
+      script: |
+        COPR_REPO_FILE="/etc/yum.repos.d/*podman-next*.repo"
+        if compgen -G $COPR_REPO_FILE > /dev/null; then
+            sed -i -n '/^priority=/!p;$apriority=1' $COPR_REPO_FILE
+        fi
+        dnf -y upgrade --allowerasing
+      order: 20
+
+provision:
+    how: artemis
+    hardware:
+        memory: ">= 16 GB"
+        cpu:
+            cores: ">= 4"
+            threads: ">=8"
+        disk:
+            - size: ">= 512 GB"
+
+

sources

@@ -1 +1 @@
-SHA512 (v1.34.0.tar.gz) = a3836ce540058f418131969e157d548864727398535e4e99a693d883419b8d764da7166f9b9376c2b9686d8beac101687843c2e93198b16328ef333ad96d55db
+SHA512 (v1.40.0.tar.gz) = bb96d04a17ab5a77e5d984dca369e3890131044c505ae3b030d95ffd66378df22da33315a50c9e500e783345ded23ebacdfa0965002a18e1d929c5fa3ce39311

tests/test_buildah.sh

@@ -1,69 +0,0 @@
-#!/bin/bash -e
-
-# Log program and kernel versions
-echo "Important package versions:"
-(
-    uname -r
-    rpm -qa |\
-        egrep 'buildah|podman|conmon|containers-common|crun|runc|iptable|slirp|aardvark|netavark|containernetworking-plugins|systemd|container-selinux' |\
-        sort
-) | sed -e 's/^/  /'
-
-# Log environment; or at least the useful bits
-echo "Environment:"
-env | grep -v LS_COLORS= | sort | sed -e 's/^/  /'
-
-export BUILDAH_BINARY=/usr/bin/buildah
-export IMGTYPE_BINARY=/usr/bin/buildah-imgtype
-export COPY_BINARY=/usr/bin/buildah-copy
-export TUTORIAL_BINARY=/usr/bin/buildah-tutorial
-
-###############################################################################
-# BEGIN setup/teardown
-
-# Start a registry
-pre_bats_setup() {
-    REGISTRY_FQIN=quay.io/libpod/registry:2
-
-    AUTHDIR=/tmp/buildah-tests-auth.$$
-    mkdir -p $AUTHDIR
-
-    CERT=$AUTHDIR/domain.crt
-    if [ ! -e $CERT ]; then
-        openssl req -newkey rsa:4096 -nodes -sha256 \
-                -keyout $AUTHDIR/domain.key -x509 -days 2 \
-                -out $AUTHDIR/domain.crt \
-                -subj "/C=US/ST=Foo/L=Bar/O=Red Hat, Inc./CN=registry host certificate" \
-                -addext subjectAltName=DNS:localhost
-    fi
-
-    if [ ! -e $AUTHDIR/htpasswd ]; then
-        htpasswd -Bbn testuser testpassword > $AUTHDIR/htpasswd
-    fi
-
-    podman rm -f registry || true
-    podman run -d -p 5000:5000 \
-           --name registry \
-           -v $AUTHDIR:/auth:Z \
-           -e "REGISTRY_AUTH=htpasswd" \
-           -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" \
-           -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \
-           -e REGISTRY_HTTP_TLS_CERTIFICATE=/auth/domain.crt \
-           -e REGISTRY_HTTP_TLS_KEY=/auth/domain.key \
-           $REGISTRY_FQIN
-}
-
-post_bats_teardown() {
-    podman rm -f registry
-}
-
-# END   setup/teardown
-###############################################################################
-# BEGIN actual test
-
-pre_bats_setup
-bats /usr/share/buildah/test/system
-rc=$?
-post_bats_teardown
-
-exit $rc

tests/test_buildah.yml

@@ -1,17 +0,0 @@
----
-- hosts: localhost
-  environment:
-    TMPDIR: /var/tmp
-  roles:
-    - role: standard-test-basic
-      tags:
-        - classic
-        - container
-      required_packages:
-        - buildah
-        - buildah-tests
-      tests:
-        - root-test:
-            dir: ./
-            run: ./test_buildah.sh
-            timeout: 80m

tests/tests.yml

@@ -1 +0,0 @@
-- import_playbook: test_buildah.yml

tests/tmt/system.fmf

@@ -0,0 +1,17 @@
+require:
+    - buildah-tests
+    - git-daemon
+    - slirp4netns
+
+environment:
+    BUILDAH_BINARY: /usr/bin/buildah
+    IMGTYPE_BINARY: /usr/bin/buildah-imgtype
+    INET_BINARY: /usr/bin/buildah-inet
+    COPY_BINARY: /usr/bin/buildah-copy
+    TUTORIAL_BINARY: /usr/bin/buildah-tutorial
+    TMPDIR: /var/tmp
+
+/local/root:
+    summary: System test
+    test: bash ./system.sh
+    duration: 60m

tests/tmt/system.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+set -exo pipefail
+
+uname -r
+
+rpm -q \
+    aardvark-dns \
+    buildah \
+    buildah-tests \
+    conmon \
+    container-selinux \
+    containers-common \
+    crun \
+    netavark \
+    systemd
+
+bats /usr/share/buildah/test/system