Rebuilt for Python 3.15.0b4 ABI change

Signed-off-by: Radostin Stoyanov <rstoyanov@fedoraproject.org>

.fmf/version

@@ -0,0 +1 @@
+1

.gitignore

@@ -57,3 +57,7 @@
 /criu-3.18.tar.gz
 /criu-3.19.tar.gz
 /criu-4.0.tar.gz
+/criu-4.1.tar.gz
+/criu-4.1.1.tar.gz
+/criu-4.2.tar.gz
+/criu-4.2.1.tar.gz

Makefile.config-set-CR_PLUGIN_DEFAULT-variable.patch

@@ -1,49 +0,0 @@
-From bb35901e78216917ce8066fa805ce27f273d76a2 Mon Sep 17 00:00:00 2001
-From: Radostin Stoyanov <rstoyanov@fedoraproject.org>
-Date: Thu, 26 Sep 2024 10:59:32 +0100
-Subject: [PATCH] Makefile.config: set CR_PLUGIN_DEFAULT variable
-
-By default, CRIU uses the path "/usr/lib/criu" to install and load
-plugins at runtime. This path is defined by the `PLUGINDIR` variable
-in Makefile.install and `CR_PLUGIN_DEFAULT` in `criu/include/plugin.h`.
-However, some distribution packages might install the CRIU plugins at
-"/usr/lib64/criu" instead. This patch updates the makefile to align
-the path defined by `CR_PLUGIN_DEFAULT` with the value of `PLUGINDIR`.
-
-Signed-off-by: Radostin Stoyanov <rstoyanov@fedoraproject.org>
----
- Makefile.config         | 4 ++++
- plugins/amdgpu/Makefile | 2 +-
- 2 files changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/Makefile.config b/Makefile.config
-index 52c250b21..5ab689d41 100644
---- a/Makefile.config
-+++ b/Makefile.config
-@@ -59,6 +59,10 @@ endif
- 
- export LIBS += $(LIBS_FEATURES)
- 
-+ifneq ($(PLUGINDIR),)
-+                FEATURE_DEFINES	+= -DCR_PLUGIN_DEFAULT="\"$(PLUGINDIR)\""
-+endif
-+
- CONFIG_FILE = .config
- 
- $(CONFIG_FILE):
-diff --git a/plugins/amdgpu/Makefile b/plugins/amdgpu/Makefile
-index 7d3388b80..a20d1d163 100644
---- a/plugins/amdgpu/Makefile
-+++ b/plugins/amdgpu/Makefile
-@@ -15,7 +15,7 @@ DEPS_NOK 		:= ;
- __nmk_dir ?= ../../scripts/nmk/scripts/
- include $(__nmk_dir)msg.mk
- 
--PLUGIN_CFLAGS  		:= -g -Wall -Werror -D _GNU_SOURCE -shared -nostartfiles -fPIC -DCR_PLUGIN_DEFAULT="$(PLUGINDIR)"
-+PLUGIN_CFLAGS  		:= -g -Wall -Werror -D _GNU_SOURCE -shared -nostartfiles -fPIC
- PLUGIN_LDFLAGS		:= -lpthread -lrt -ldrm -ldrm_amdgpu
- 
- ifeq ($(CONFIG_AMDGPU),y)
--- 
-2.46.1
-

criu.spec

@@ -1,18 +1,19 @@
 %global py_prefix python3
 %global py_binary %{py_prefix}
 
-# With annobin enabled, CRIU does not work anymore. It seems CRIU's
-# parasite code breaks if annobin is enabled.
+# CRIU's parasite/restorer code (criu/pie/) is compiled with its own CFLAGS
+# that already disable hardening (-fno-stack-protector, -U_FORTIFY_SOURCE,
+# -D_FORTIFY_SOURCE=0, -nostdlib). Standard RHEL hardening flags (PIE, RELRO,
+# FORTIFY_SOURCE, stack protector) only affect the main criu binary and libs.
+#
+# Annobin remains disabled because its instrumentation gets injected into
+# every compilation unit including parasite code, and there is no per-target
+# way to exclude it through the Makefile.
 %undefine _annotated_build
 
-# Disable automatic call to the set_build_flags macro
-# at the beginning of the build, check, and install.
-# This change was introduced in Fedora 36.
-%undefine _auto_set_build_flags
-
 Name: criu
-Version: 4.0
-Release: 1%{?dist}
+Version: 4.2.1
+Release: 2%{?dist}
 Summary: Tool for Checkpoint/Restore in User-space
 License: GPL-2.0-only AND LGPL-2.1-only AND MIT
 URL: http://criu.org/
@@ -23,8 +24,6 @@ Source0: https://github.com/checkpoint-restore/criu/archive/v%{version}/criu-%{v
 # in RPM and DEB is different.
 Patch99: criu.pc.patch
 
-Patch100: Makefile.config-set-CR_PLUGIN_DEFAULT-variable.patch
-
 Source5: criu-tmpfiles.conf
 
 BuildRequires: gcc
@@ -33,25 +32,26 @@ BuildRequires: libnet-devel
 BuildRequires: protobuf-devel protobuf-c-devel %{py_prefix}-devel libnl3-devel libcap-devel
 BuildRequires: %{py_prefix}-pip
 BuildRequires: %{py_prefix}-setuptools
-BuildRequires: %{py_prefix}-wheel
+BuildRequires: (%{py_prefix}-wheel if %{py_prefix}-setuptools < 71)
 BuildRequires: %{py_prefix}-protobuf
 BuildRequires: asciidoctor
 BuildRequires: perl-interpreter
 BuildRequires: libselinux-devel
 BuildRequires: gnutls-devel
 BuildRequires: libdrm-devel
+BuildRequires: libuuid-devel
+BuildRequires: nftables-devel
 # Checkpointing containers with a tmpfs requires tar
 Recommends: tar
 %if 0%{?fedora}
 BuildRequires: libbsd-devel
-BuildRequires: nftables-devel
 %endif
 BuildRequires: make
 
 # user-space and kernel changes are only available for x86_64, arm,
 # ppc64le, aarch64 and s390x
 # https://bugzilla.redhat.com/show_bug.cgi?id=902875
-ExclusiveArch: x86_64 %{arm} ppc64le aarch64 s390x
+ExclusiveArch: x86_64 %{arm} ppc64le aarch64 s390x riscv64
 
 %description
 criu is the user-space part of Checkpoint/Restore in User-space
@@ -116,28 +116,42 @@ This script can help to workaround the so called "PID mismatch" problem.
 %setup -q
 %patch -P 99 -p1
 
-%patch -P 100 -p1
-
 %build
 # This package calls LD directly without specifying the LTO plugins.  Until
 # that is fixed, disable LTO.
 %define _lto_cflags %{nil}
 
+# CRIU's nmk build system calls ld directly for intermediate partial linking
+# (ld -r). RHEL LDFLAGS contain -specs= options that only gcc understands;
+# raw ld rejects them. Create a wrapper that strips -specs= for direct ld
+# calls. The final criu binary link uses gcc (CC), not ld, so it still gets
+# full hardening (-pie, -z relro, -z now) from the spec files.
+mkdir -p %{_builddir}/bin
+cat > %{_builddir}/bin/ld << 'LDWRAPPER'
+#!/bin/sh
+for arg do
+  shift
+  case "$arg" in -specs=*) continue ;; esac
+  set -- "$@" "$arg"
+done
+exec /usr/bin/ld "$@"
+LDWRAPPER
+chmod +x %{_builddir}/bin/ld
+
 # %{?_smp_mflags} does not work
-# -fstack-protector breaks build
-CFLAGS+=`echo %{optflags} | sed -e 's,-fstack-protector\S*,,g'` make V=1 WERROR=0 PREFIX=%{_prefix} RUNDIR=/run/criu PYTHON=%{py_binary} PLUGINDIR=%{_libdir}/criu
+CFLAGS+="%{optflags}" make V=1 WERROR=0 LD=%{_builddir}/bin/ld PREFIX=%{_prefix} RUNDIR=/run/criu PYTHON=%{py_binary} PLUGINDIR=%{_libdir}/criu NETWORK_LOCK_DEFAULT=NETWORK_LOCK_NFTABLES
 make V=1 WERROR=0 PREFIX=%{_prefix} PLUGINDIR=%{_libdir}/criu amdgpu_plugin
 make docs V=1
 
 
 %install
 sed -e "s,--upgrade --ignore-installed,--no-index --no-deps -v --no-build-isolation,g" -i lib/Makefile -i crit/Makefile
-make install-criu DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir}
-make install-lib DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} PYTHON=%{py_binary} PIPFLAGS="--no-build-isolation --no-index --no-deps --progress-bar off --upgrade --ignore-installed"
-make install-amdgpu_plugin DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} PLUGINDIR=%{_libdir}/criu
-make install-cuda_plugin DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} PLUGINDIR=%{_libdir}/criu
-make install-crit DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} PYTHON=%{py_binary} PIPFLAGS="--no-build-isolation --no-index --no-deps --progress-bar off --upgrade --ignore-installed"
-make install-man DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir}
+make install-criu LD=%{_builddir}/bin/ld DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} BINDIR=%{_bindir} SBINDIR=%{_sbindir}
+make install-lib LD=%{_builddir}/bin/ld DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} PYTHON=%{py_binary} PIPFLAGS="--no-build-isolation --no-index --no-deps --progress-bar off --upgrade --ignore-installed"
+make install-amdgpu_plugin LD=%{_builddir}/bin/ld DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} PLUGINDIR=%{_libdir}/criu
+make install-cuda_plugin LD=%{_builddir}/bin/ld DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} PLUGINDIR=%{_libdir}/criu
+make install-crit LD=%{_builddir}/bin/ld DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir}  BINDIR=%{_bindir} SBINDIR=%{_sbindir} PYTHON=%{py_binary} PIPFLAGS="--no-build-isolation --no-index --no-deps --progress-bar off --upgrade --ignore-installed"
+make install-man LD=%{_builddir}/bin/ld DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir}
 rm -f $RPM_BUILD_ROOT%{_mandir}/man1/compel.1
 
 mkdir -p %{buildroot}%{_tmpfilesdir}
@@ -188,6 +202,90 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a
 %tmpfiles_create %{name}.conf
 
 %changelog
+* Wed Jul 22 2026 Python Maint <python-maint@redhat.com> - 4.2.1-2
+- Rebuilt for Python 3.15.0b4 ABI change
+
+* Tue Jul 21 2026 Radostin Stoyanov <rstoyanov@fedoraproject.org> - 4.2.1-1
+- Update to 4.2.1
+- Drop patches merged upstream
+
+* Wed Jul 15 2026 Fedora Release Engineering <releng@fedoraproject.org> - 4.2-22
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
+
+* Mon Jul 06 2026 Adrian Reber <areber@redhat.com> - 4.2-21
+- One more test only patch for linux 7.1
+
+* Wed Jun 03 2026 Python Maint <python-maint@redhat.com> - 4.2-20
+- Rebuilt for Python 3.15
+
+* Thu May 28 2026 Miroslav Suchy <msuchy@redhat.com> - 4.2-19
+- rebuild for https://fedoraproject.org/wiki/Changes/Protobuf_5.x/6.x
+
+* Wed Apr 22 2026 Adrian Reber <adrian@lisas.de> - 4.2-18
+- Route veth restore through usernsd for userns mode (upstream PR#3006)
+- Fix rseq01 test for kernel 7.0 rseq changes (upstream PR#3007)
+- Handle UDPLITE removal in kernel 7.1 (upstream PR#3003)
+
+* Thu Mar 26 2026 Adrian Reber <adrian@lisas.de> - 4.2-17
+- Always use nftables network locking backend
+
+* Tue Mar 03 2026 Adrian Reber <areber@redhat.com> - 4.2-16
+- Fix tty compiler error (const qualifier warning)
+
+* Tue Mar 03 2026 Adrian Reber <areber@redhat.com> - 4.2-15
+- Fix rseq build failure with latest glibc in rawhide
+
+* Mon Mar 02 2026 Christopher Lusk <clusk@redhat.com> - 4.2-14
+- Re-enable binary hardening flags for main binary
+
+* Fri Jan 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 4.2-13
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
+
+* Fri Jan 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 4.2-12
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
+
+* Mon Nov 17 2025 Cristian Le <git@lecris.dev> - 4.2-11
+- Convert STI tests to TMT (rhbz#2382879)
+
+* Mon Nov 17 2025 Adrian Reber <adrian@lisas.de> - 4.2-5
+- Update to 4.2
+
+* Fri Sep 19 2025 Python Maint <python-maint@redhat.com> - 4.1.1-4
+- Rebuilt for Python 3.14.0rc3 bytecode
+
+* Wed Aug 27 2025 Miro Hrončok <mhroncok@redhat.com> - 4.1.1-3
+- Drop unused BuildRequires on python3-wheel
+
+* Fri Aug 15 2025 Python Maint <python-maint@redhat.com> - 4.1.1-2
+- Rebuilt for Python 3.14.0rc2 bytecode
+
+* Wed Jul 30 2025 Adrian Reber <adrian@lisas.de> - 4.1.1-1
+- Update to 4.1.1
+
+* Wed Jul 23 2025 Fedora Release Engineering <releng@fedoraproject.org> - 4.1-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Tue Jun 17 2025 Python Maint <python-maint@redhat.com> - 4.1-4
+- Rebuilt for Python 3.14
+
+* Wed Apr 23 2025 David Abdurachmanov <davidlt@rivosinc.com> - 4.1-3
+- Enable for riscv64
+
+* Mon Apr 21 2025 Adrian Reber <adrian@lisas.de> - 4.1-2
+- Apply upstream patch to fix a runc regression
+
+* Mon Apr 07 2025 Radostin Stoyanov <rstoyanov@fedoraproject.org> - 4.1-1
+- Update to 4.1
+
+* Thu Jan 16 2025 Fedora Release Engineering <releng@fedoraproject.org> - 4.0-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
+* Sun Dec 08 2024 Radostin Stoyanov <rstoyanov@fedoraproject.org> - 4.0-3
+- Apply patch to handle vvar_vclock vma-s in rawhide
+
+* Thu Oct 17 2024 Adrian Reber <adrian@lisas.de> - 4.0-2
+- Recommends: iptables
+
 * Thu Sep 26 2024 Radostin Stoyanov <rstoyanov@fedoraproject.org> - 4.0-1
 - Update to 4.0
 - Add package for cuda-plugin

plans.fmf

@@ -0,0 +1,21 @@
+summary: Run all tests
+discover:
+  how: fmf
+prepare:
+  - name: Install the main package
+    how: install
+    package:
+      - criu
+execute:
+  how: tmt
+
+/zdtm:
+  # Use the srpm sources
+  discover+:
+    dist-git-source: true
+    dist-git-merge: true
+    test: /tests/zdtm
+
+/podman:
+  discover+:
+    test: /tests/podman

rpminspect.yaml

@@ -0,0 +1,4 @@
+---
+annocheck:
+  jobs:
+    - hardened: --verbose --skip-dynamic-tags --skip-property-note --skip-bind-now --skip-pie --skip-cf-protection --skip-notes --skip-gaps --skip-optimization --skip-stack-clash --skip-stack-prot --skip-branch-protection

sources

@@ -1 +1 @@
-SHA512 (criu-4.0.tar.gz) = 38a3ae353385b1cc4e63f9b317af67bea88d67322e549cf87501873d59bdcc50e92f9c2ef85c736973c551520a91f579f80a010871d245b1a43a29f9fc69b1ab
+SHA512 (criu-4.2.1.tar.gz) = 73a4f5d9e6af2d07c0b234201cce09a827dcb1dcb1b1095cb3944a0a37dd34f4d5ef3ce34e12568c38dff2b517809e64aff55be605e934d2ab39daa659ca9a97

tests/main.fmf

@@ -1,16 +1,8 @@
----
-- hosts: localhost
-  roles:
-  - role: standard-test-source
-    tags:
-    - classic
-  - role: standard-test-basic
-    tags:
-    - classic
-    required_packages:
-    - podman
-    - curl
-    - jq
+/zdtm:
+  summary: Test zdtm
+  test: ./run-zdtm.sh
+  duration: 30m
+  require:
     - checkpolicy
     - policycoreutils
     - make
@@ -24,14 +16,17 @@
     - libnl3-devel
     - libcap-devel
     - libaio-devel
+    - libuuid-devel
     - nftables-devel
     - python3-pyyaml
     - python3-protobuf
     - python-unversioned-command
-    tests:
-    - zdtm:
-        dir: .
-        run: ./run-zdtm.sh
-    - podman:
-        dir: .
-        run: ./run-podman-checkpoint-restore.sh
+    - crit
+    - python3-criu
+/podman:
+  summary: Test podman
+  test: ./run-podman-checkpoint-restore.sh
+  require:
+    - podman
+    - curl
+    - jq

tests/run-podman-checkpoint-restore.sh

@@ -3,6 +3,9 @@
 set -eux
 
 ls -la
+uname -a
+rpm -qi criu || true
+criu --version
 
 echo "Start container"
 podman --log-level debug run -d quay.io/adrianreber/counter

tests/run-zdtm.sh

@@ -3,6 +3,8 @@
 set -xe
 
 uname -a
+rpm -qi criu || true
+criu --version
 
 # These zdtm tests are skipped because they fail only in CI system
 EXCLUDES=" \
@@ -13,6 +15,19 @@ EXCLUDES=" \
 	-x zdtm/static/socket-tcp4v6-closed \
 	-x zdtm/static/maps01 \
 	-x zdtm/static/maps04 \
+	-x zdtm/static/del_standalone_un \
+	-x zdtm/static/del_standalone_un_seqpacket \
+	-x zdtm/static/deleted_unix_sock \
+	-x zdtm/static/fifo_upon_unix_socket00 \
+	-x zdtm/static/sk-unix-dgram-ghost \
+	-x zdtm/static/sk-unix01 \
+	-x zdtm/static/sk-unix01-seqpacket \
+	-x zdtm/static/socket-tcpbuf \
+	-x zdtm/static/socket-tcpbuf6 \
+	-x zdtm/static/sockets00 \
+	-x zdtm/static/sockets00-seqpacket \
+	-x zdtm/static/sockets03 \
+	-x zdtm/static/sockets03-seqpacket \
 	-x zdtm/static/cgroup04 \
 	-x zdtm/static/cgroup_ifpriomap \
 	-x zdtm/static/netns_sub \
@@ -33,10 +48,10 @@ run_test() {
 
 RESULT=42
 
-# this socket brakes CRIU's test cases
+# this socket breaks CRIU's test cases
 rm -f /var/lib/sss/pipes/nss
 
-cd "source/criu-$(crit --version)/"
+cd ../criu-$(crit --version)
 
 echo "Build CRIU"
 make -j"$(nproc)"