Inspektor Gadget

Tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF

https://www.inspektor-gadget.io/

Bumping Inspektor Gadget in Fedora

This document describes how to bump Inspektor Gadget in Fedora. The whole process can be achieved using the corresponding container:

$ docker build --build-arg USER=$USER --build-arg UID=$(id -u) --build-arg GID=$(id -g) -t fedora-ig-bumper -f Dockerfile .
# For rootfull docker use the following:
$ docker run -ti --rm -v $(pwd):/work -w /work -p 12345:12345 fedora-ig-bumper
# For rootless podman, use the following:
$ podman run -ti --rm -v $(pwd):/work -w /work -p 12345:12345 --userns=keep-id fedora-ig-bumper

From now, all the commands will be run as your user from the fedora-ig-bumper container.

Updating the version

The following line needs to be updated to reflect the version bump:

...
%global goipath         github.com/inspektor-gadget/inspektor-gadget
Version:                0.38.0
...

Getting the sources

We first need to fetch the latest source:

$ spectool -g inspektor-gadget.spec
...
Downloaded: inspektor-gadget-0.38.0.tar.gz

We should now get all the dependencies and create an archive for them:

$ go_vendor_archive create inspektor-gadget.spec
* Treating /work/inspektor-gadget-0.38.0.tar.gz as an archive. Unpacking...
$ go mod tidy
...
$ go mod vendor
Creating archive...

These operations should have created the inspektor-gadget-0.38.0.tar.gz and inspektor-gadget-0.38.0-vendor.tar.xz archives:

$ ls -1
README.md
go-vendor-tools.toml
inspektor-gadget-0.38.0-vendor.tar.xz
inspektor-gadget-0.38.0.tar.gz
inspektor-gadget.spec
sources

Let's now upload the archives to Fedora infrastructure.

# First connect to kerberos:
$ fkinit -u casquette
...
Valid starting     Expires            Service principal
03/10/25 15:45:13  03/11/25 15:45:11  krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG
        renew until 03/17/25 15:45:11
# We can now upload the archives:
$ fedpkg new-sources inspektor-gadget-0.38.0.tar.gz inspektor-gadget-0.38.0-vendor.tar.xz
...
Source upload succeeded. Don't forget to commit the sources file
# Add modifications done to sources and inspektor-gadget.spec.
$ git add -p
$ git commit -s

Building the package

Building locally

We have all the files needed to build the package, let's build it:

$ fedpkg local
...
Wrote: /work/inspektor-gadget-0.38.0-1.fc43.src.rpm
Wrote: /work/x86_64/inspektor-gadget-debugsource-0.38.0-1.fc43.x86_64.rpm
Wrote: /work/x86_64/inspektor-gadget-0.38.0-1.fc43.x86_64.rpm
Wrote: /work/x86_64/inspektor-gadget-debuginfo-0.38.0-1.fc43.x86_64.rpm
...

Everything was built and tested, you should now have the package available:

$ rpm -ql x86_64/inspektor-gadget-0.38.0-1.fc40.x86_64.rpm
/usr/bin/ig
...
/usr/share/licenses/inspektor-gadget
/usr/share/licenses/inspektor-gadget/LICENSE
/usr/share/licenses/inspektor-gadget/LICENSE-bpf.txt
...

Congratulations! You successfully built Inspektor Gadget Fedora package!

Building the package in Fedora infrastucture

You need to be connected to kerberos and run the following command:

$ fedpkg scratch-build
...
130092374 build (rawhide, inspektor-gadget-0.38.0-1.fc43.src.rpm) completed successfully

Testing in a Container

Let's now test ig in-situ:

$ docker run -ti --rm -v $(pwd):/work -w /work fedora
# Install the new package
[root@139a35ba4247 work]# dnf install -y x86_64/inspektor-gadget-0.38.0-1.fc40.x86_64.rpm
...
Complete!
[root@139a35ba4247 work]# ig --help
Collection of gadgets for containers

Usage:
  ig [command]

...

Making the build official

Once you have built and tested the package, you can now publish it by using the following:

# Push previous commit containing modifications to inspektor-gadget.spec and sources files.
# Open the URL in browser to grant authorization to fedpkg push to push commits.
$ fedpkg push
Please visit https://id.fedoraproject.org/openidc/Authorization... to grant authorization
# Rawhide packages are updated once a day.
$ fedpkg build

If you are building for a release different than rawhide, you need to run the following:

$ fedpkg update --type enhancement --notes "Update to v0.38.0"

Congratulations! You successfully bumped Inspektor Gadget Fedora package!

Handling CVE in dependencies

In case there is a CVE in dependency which was fixed upstream, we need to update the vendor archive. Hopefully, go_vendor_archive already handles this. Let's take the real example of github.com/go-viper/mapstructure/v2:

$ go_vendor_archive override --config go-vendor-tools.toml github.com/go-viper/mapstructure/v2 v2.3.0
# go-vendor-tools was updated to use v2.3.0 instead:
$ git diff
diff --git a/go-vendor-tools.toml b/go-vendor-tools.toml
index bc94737..05214fb 100644
--- a/go-vendor-tools.toml
+++ b/go-vendor-tools.toml
@@ -1,5 +1,7 @@
 [archive]

+[archive.dependency_overrides]
+"github.com/go-viper/mapstructure/v2" = "v2.3.0"
 [[licensing.licenses]]
 path = "LICENSE-bpf.txt"
 sha256sum = "7a83d7bd42c0c13bb77d9b4e76a08d3aa8b0ca71189573ddc8bb1d06d094abf0"
# Now, let's create the archive with this version of the dependency:
$ go_vendor_archive create --config go-vendor-tools.toml inspektor-gadget.spec
...
$ go get github.com/go-viper/mapstructure/v2@v2.3.0
go: upgraded github.com/go-viper/mapstructure/v2 v2.2.1 => v2.3.0
$ go mod tidy
$ go mod vendor
Creating archive...

The archive was updated, you can now continue by uploading it with fedpkg new-sources and continue as usual.