From 49770fe26b5fe213e8380a3bddd41fcb7dd0e0a7 Mon Sep 17 00:00:00 2001
From: Christophe de Dinechin <dinechin@redhat.com>
Date: Wed, 10 Sep 2025 16:31:17 +0200
Subject: [PATCH 01/10] Bump to Kata Containers 3.20

Signed-off-by: Christophe de Dinechin <dinechin@redhat.com>
---
 .gitignore           | 2 ++
 kata-containers.spec | 7 +++++--
 test-kata-rpm.sh     | 4 ++--
 vendor-tarball.sh    | 2 +-
 4 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/.gitignore b/.gitignore
index cf34e1f..a94ec42 100644
--- a/.gitignore
+++ b/.gitignore
@@ -67,3 +67,5 @@
 /kata-containers-3.18.0-vendor.tar.gz
 /kata-containers-3.19.1.tar.gz
 /kata-containers-3.19.1-vendor.tar.gz
+/kata-containers-3.20.0.tar.gz
+/kata-containers-3.20.0-vendor.tar.gz
diff --git a/kata-containers.spec b/kata-containers.spec
index cdb4a9a..de639ee 100644
--- a/kata-containers.spec
+++ b/kata-containers.spec
@@ -28,7 +28,7 @@
 %endif
 
 # https://github.com/kata-containers/kata-containers
-Version: 3.19.1
+Version: 3.20.0
 %global tag         %{version}%{?rcstr}
 
 %global domain      github.com
@@ -56,7 +56,7 @@ workload isolation and security advantages of VMs. https://katacontainers.io/.}
 # Unlike for RHEL, we cannot strip it down because we build all components
 # (RHEL builds only build kata-agent)
 Name:       %{repo}
-Release:    1%{?rcrel}%{?dist}.1
+Release:    1%{?rcrel}%{?dist}
 Summary:    Kata Containers version 3.x repository
 License:    Apache-2.0
 Url:        https://%{download}
@@ -390,6 +390,9 @@ fi
 
 
 %changelog
+* Wed Sep 10 2025 Christophe de Dinechin <dinechin@redhat.com> - 3.20.0-1
+- kata-containers 3.20.0
+
 * Fri Aug 15 2025 Maxwell G <maxwell@gtmx.me> - 3.19.1-1.1
 - Rebuild for golang-1.25.0
 
diff --git a/test-kata-rpm.sh b/test-kata-rpm.sh
index 76c6ac3..f9e893c 100755
--- a/test-kata-rpm.sh
+++ b/test-kata-rpm.sh
@@ -1,12 +1,12 @@
 #!/bin/bash
 set -euo pipefail
 
-# Usage: ./test_kata_rpm.sh /path/to/kata-containers-3.15*.rpm
+# Usage: ./test_kata_rpm.sh /path/to/kata-containers-3.20*.rpm
 
 RPM_PATH=${1:-}
 
 if [[ -z "$RPM_PATH" ]]; then
-  echo "Usage: $0 /path/to/kata-containers-3.15*.rpm"
+  echo "Usage: $0 /path/to/kata-containers-3.20*.rpm"
   exit 1
 fi
 
diff --git a/vendor-tarball.sh b/vendor-tarball.sh
index fb6a23c..6676c88 100755
--- a/vendor-tarball.sh
+++ b/vendor-tarball.sh
@@ -2,7 +2,7 @@
 set -xeuo pipefail
 
 # Kata version
-KATA_VERSION=3.14.0
+KATA_VERSION=3.20.0
 RUST_SOURCES_TO_FIX="src/agent src/tools/kata-ctl"
 
 # Original vendor tarball downloaded from upstream

From 82c9c9ca9a0f71972d2dfbde0362edf19abd339e Mon Sep 17 00:00:00 2001
From: Christophe de Dinechin <dinechin@redhat.com>
Date: Thu, 11 Sep 2025 14:44:16 +0200
Subject: [PATCH 02/10] Commit missing sources

Doing some experiments with Cursor, and apparently that messed up the
sources file, which was not committed correctly.

Signed-off-by: Christophe de Dinechin <dinechin@redhat.com>
---
 sources | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sources b/sources
index a58f5cf..1d2d3f2 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (kata-containers-3.19.1.tar.gz) = 4a8c70fead695693fc9b9978944e3131fea8e85cb01814de72920088dba8c9707da3c7df592444e32a170a18e13dc1a7a6806069f4821d7f30b0db8b221016a7
-SHA512 (kata-containers-3.19.1-vendor.tar.gz) = f4650f056999cce79bb58b37bba8e38c18fee8e98610e185d5cccf844045f38ec62503368497c84d209e788c4e47c72afaf3392f619b6f3a1f5e3779bf6139f6
+SHA512 (kata-containers-3.20.0.tar.gz) = 8864bda669fac2ae6983b940d61961c05d6d25497bb98120f0c2fd62adbaf8fbbe2473682e4d9b694c01a451ffcbdd0c9d407da8bcc82936a61912d2487db639
+SHA512 (kata-containers-3.20.0-vendor.tar.gz) = 48ed8fb337cbccb229f6b4b1beb019a92ec577a4b0ac9e3517c9b4fd1105b8bf7ad5e7424045005134afb2e5791bd6a80a8965067acc4066e5fe70346a652bf7

From ceb50da3cd6c9dda3ef75f1c86868e4675fe7154 Mon Sep 17 00:00:00 2001
From: Christophe de Dinechin <dinechin@redhat.com>
Date: Thu, 25 Sep 2025 16:21:42 +0200
Subject: [PATCH 03/10] Bump to Kata 3.21.0

This matches Kata release 3.21.0
https://github.com/kata-containers/kata-containers/releases/tag/3.21.0

Signed-off-by: Christophe de Dinechin <dinechin@redhat.com>
---
 .gitignore           | 2 ++
 kata-containers.spec | 5 ++++-
 sources              | 4 ++--
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/.gitignore b/.gitignore
index a94ec42..1264cb2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -69,3 +69,5 @@
 /kata-containers-3.19.1-vendor.tar.gz
 /kata-containers-3.20.0.tar.gz
 /kata-containers-3.20.0-vendor.tar.gz
+/kata-containers-3.21.0.tar.gz
+/kata-containers-3.21.0-vendor.tar.gz
diff --git a/kata-containers.spec b/kata-containers.spec
index de639ee..2262221 100644
--- a/kata-containers.spec
+++ b/kata-containers.spec
@@ -28,7 +28,7 @@
 %endif
 
 # https://github.com/kata-containers/kata-containers
-Version: 3.20.0
+Version: 3.21.0
 %global tag         %{version}%{?rcstr}
 
 %global domain      github.com
@@ -390,6 +390,9 @@ fi
 
 
 %changelog
+* Thu Sep 25 2025 Christophe de Dinechin <dinechin@redhat.com> - 3.21.0-1
+- kata-containers 3.21.0
+
 * Wed Sep 10 2025 Christophe de Dinechin <dinechin@redhat.com> - 3.20.0-1
 - kata-containers 3.20.0
 
diff --git a/sources b/sources
index 1d2d3f2..dafeef3 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (kata-containers-3.20.0.tar.gz) = 8864bda669fac2ae6983b940d61961c05d6d25497bb98120f0c2fd62adbaf8fbbe2473682e4d9b694c01a451ffcbdd0c9d407da8bcc82936a61912d2487db639
-SHA512 (kata-containers-3.20.0-vendor.tar.gz) = 48ed8fb337cbccb229f6b4b1beb019a92ec577a4b0ac9e3517c9b4fd1105b8bf7ad5e7424045005134afb2e5791bd6a80a8965067acc4066e5fe70346a652bf7
+SHA512 (kata-containers-3.21.0.tar.gz) = 703cf7ea73a306d190955c04041fdcecffc7de20b05c231aca3ccfae0e53ebdd7221b9a04d0f02e129c88e9084bdcca2ec8f6f440b1e5b450fd4fc5768f46615
+SHA512 (kata-containers-3.21.0-vendor.tar.gz) = d695f2c6e03402f2543daadf1506da614a032180d22855c3fa973380072166b157d19990ca9429f48379fca61801f85caff25e38b5ae27e483eda1d2692bcfec

From 625c6453e11af9ab23290a0fdf99aa2ea9ae3a0b Mon Sep 17 00:00:00 2001
From: Christophe de Dinechin <dinechin@redhat.com>
Date: Tue, 30 Sep 2025 16:57:51 +0200
Subject: [PATCH 04/10] Add tests for CRIO and make test for containerd more
 explicit

Add an rpm test that specifically uses crio, and make the containerd
test more specifically mention containerd both in the name and in the
description of the test.

Also, the tests now first erase any old kata-containers package so
that make sure we test a "from scratch" installation.

Signed-off-by: Christophe de Dinechin <dinechin@redhat.com>
---
 ...kata-rpm.sh => test-kata-rpm-containerd.sh |  43 ++--
 test-kata-rpm-crio.sh                         | 190 ++++++++++++++++++
 2 files changed, 217 insertions(+), 16 deletions(-)
 rename test-kata-rpm.sh => test-kata-rpm-containerd.sh (57%)
 create mode 100755 test-kata-rpm-crio.sh

diff --git a/test-kata-rpm.sh b/test-kata-rpm-containerd.sh
similarity index 57%
rename from test-kata-rpm.sh
rename to test-kata-rpm-containerd.sh
index f9e893c..95f7d54 100755
--- a/test-kata-rpm.sh
+++ b/test-kata-rpm-containerd.sh
@@ -1,20 +1,23 @@
 #!/bin/bash
 set -euo pipefail
 
-# Usage: ./test_kata_rpm.sh /path/to/kata-containers-3.20*.rpm
+# Usage: ./test_kata_rpm_containerd.sh /path/to/kata-containers-*.rpm
 
 RPM_PATH=${1:-}
 
 if [[ -z "$RPM_PATH" ]]; then
-  echo "Usage: $0 /path/to/kata-containers-3.20*.rpm"
+  echo "Usage: $0 /path/to/kata-containers-*.rpm"
   exit 1
 fi
 
-# 1. Install the RPM
-echo "[1/6] Installing Kata Containers RPM: $RPM_PATH"
-sudo dnf install -y "$RPM_PATH"
+# 1. Remove existing kata-containers packages and install the RPM
+echo "[1/7] Removing existing kata-containers packages..."
+sudo rpm -e --allmatches kata-containers 2>/dev/null || echo "No existing kata-containers packages to remove"
 
-echo "[2/6] Checking installed binaries and versions..."
+echo "[2/7] Installing Kata Containers RPM: $RPM_PATH"
+sudo rpm -i "$RPM_PATH"
+
+echo "[3/7] Checking installed binaries and versions..."
 # kata-agent is not expected on the host; it runs inside the Kata VM image.
 if command -v kata-runtime >/dev/null 2>&1; then
   kata-runtime --version
@@ -27,35 +30,43 @@ else
   echo "kata-ctl not found in PATH!"; exit 1
 fi
 
-echo "[3/6] Checking QEMU version..."
+echo "[4/7] Checking QEMU version..."
 if command -v qemu-system-x86_64 >/dev/null 2>&1; then
   qemu-system-x86_64 --version
 else
   echo "qemu-system-x86_64 not found in PATH!"; exit 1
 fi
 
-echo "[4/6] Loading vhost_net kernel module (required for Kata networking)..."
+echo "[5/7] Loading vhost_net kernel module (required for Kata networking)..."
 sudo modprobe vhost_net
 
-# 5. Run kata-runtime check (system compatibility)
-echo "[5/6] Running kata-runtime check (system compatibility)..."
+# 6. Run kata-runtime check (system compatibility)
+echo "[6/7] Running kata-runtime check (system compatibility)..."
 if ! kata-runtime check; then
   echo "[ERROR] System is not capable of running Kata Containers."
   exit 1
 fi
 
-# 6. Run a simple Kata container using containerd (if available)
-echo "[6/6] Attempting to run a test container with Kata runtime (containerd)..."
+# 7. Run a simple Kata container using containerd (if available)
+echo "[7/7] Attempting to run a test container with Kata runtime (containerd)..."
 if command -v ctr >/dev/null 2>&1; then
+  # Clean up any existing test containers
+  echo "[Test] Cleaning up any existing test containers..."
+  sudo ctr task kill kata-test-bg 2>/dev/null || true
+  sudo ctr task rm kata-test-bg 2>/dev/null || true
+  sudo ctr container rm kata-test-bg 2>/dev/null || true
+  
   sudo ctr images pull docker.io/library/alpine:latest
   # Start a container in the background (do not use --rm so we can exec into it)
   sudo ctr run -d --runtime io.containerd.kata.v2 docker.io/library/alpine:latest kata-test-bg sleep 300
   # Wait a moment for the container to be up
   sleep 2
-  echo "[Test] Exec into the running container and run 'ls -lR /'..."
-  sudo ctr task exec -t --exec-id kata-ls kata-test-bg ls -lR /
+  echo "[Test] Exec into the running container and run 'uname -a'..."
+  sudo ctr task exec --exec-id kata-uname kata-test-bg uname -a
   echo "[Test] Show /etc/os-release inside the container..."
-  sudo ctr task exec -t --exec-id kata-osrel kata-test-bg cat /etc/os-release
+  sudo ctr task exec --exec-id kata-osrel kata-test-bg cat /etc/os-release
+  echo "[Test] Show ls -lR /usr inside the container..."
+  sudo ctr task exec --exec-id kata-ls kata-test-bg ls -lR /usr
   # Clean up: kill the task and delete the container
   echo "[Cleanup] Deleting test container..."
   sudo ctr task kill kata-test-bg || true
@@ -77,4 +88,4 @@ else
   echo "journalctl not found, skipping log check."
 fi
 
-echo "All tests completed. If no errors above, the RPM is likely working." 
\ No newline at end of file
+echo "All tests completed. If no errors above, the RPM is likely working with containerd." 
\ No newline at end of file
diff --git a/test-kata-rpm-crio.sh b/test-kata-rpm-crio.sh
new file mode 100755
index 0000000..d02d2d8
--- /dev/null
+++ b/test-kata-rpm-crio.sh
@@ -0,0 +1,190 @@
+#!/bin/bash
+set -euo pipefail
+
+# Usage: ./test_kata_rpm_crio.sh /path/to/kata-containers-3.20*.rpm
+
+RPM_PATH=${1:-}
+
+if [[ -z "$RPM_PATH" ]]; then
+  echo "Usage: $0 /path/to/kata-containers-*.rpm"
+  exit 1
+fi
+
+# 1. Remove existing kata-containers packages and install the RPM
+echo "[1/7] Removing existing kata-containers packages..."
+sudo rpm -e --allmatches kata-containers 2>/dev/null || echo "No existing kata-containers packages to remove"
+
+echo "[2/7] Installing Kata Containers RPM: $RPM_PATH"
+sudo rpm -i "$RPM_PATH"
+
+echo "[3/7] Checking installed binaries and versions..."
+# kata-agent is not expected on the host; it runs inside the Kata VM image.
+if command -v kata-runtime >/dev/null 2>&1; then
+  kata-runtime --version
+else
+  echo "kata-runtime not found in PATH!"; exit 1
+fi
+if command -v kata-ctl >/dev/null 2>&1; then
+  kata-ctl version
+else
+  echo "kata-ctl not found in PATH!"; exit 1
+fi
+
+echo "[4/7] Checking QEMU version..."
+if command -v qemu-system-x86_64 >/dev/null 2>&1; then
+  qemu-system-x86_64 --version
+else
+  echo "qemu-system-x86_64 not found in PATH!"; exit 1
+fi
+
+echo "[5/7] Loading vhost_net kernel module (required for Kata networking)..."
+sudo modprobe vhost_net
+
+# 6. Run kata-runtime check (system compatibility)
+echo "[6/7] Running kata-runtime check (system compatibility)..."
+if ! kata-runtime check; then
+  echo "[ERROR] System is not capable of running Kata Containers."
+  exit 1
+fi
+
+# 7. Run a simple Kata container using CRI-O (if available)
+echo "[7/7] Attempting to run a test container with Kata runtime (CRI-O)..."
+if command -v crictl >/dev/null 2>&1; then
+  # Check if CRI-O is running, if not try to start it
+  if ! systemctl is-active --quiet crio; then
+    echo "[Test] CRI-O is not running, attempting to start it..."
+    sudo systemctl start crio || {
+      echo "[WARNING] Failed to start CRI-O, falling back to containerd test..."
+      echo "[Test] Running containerd test instead..."
+      if command -v ctr >/dev/null 2>&1; then
+        sudo ctr images pull docker.io/library/alpine:latest
+        sudo ctr run --runtime io.containerd.kata.v2 --rm docker.io/library/alpine:latest kata-test-crio-fallback uname -a || {
+          echo "Failed to run container with containerd fallback."; exit 1;
+        }
+        echo "[Test] Containerd fallback test completed."
+      else
+        echo "Neither CRI-O nor containerd available for testing."
+      fi
+      exit 0
+    }
+  fi
+  
+  # Configure crictl to use CRI-O instead of containerd
+  echo "[Test] Configuring crictl to use CRI-O..."
+  sudo crictl config --set runtime-endpoint=unix:///var/run/crio/crio.sock
+  sudo crictl config --set image-endpoint=unix:///var/run/crio/crio.sock
+  # Pull the image
+  echo "[Test] Pulling alpine image..."
+  sudo crictl pull docker.io/library/alpine:latest
+  
+  # Create temporary pod and container config files
+  echo "[Test] Creating pod and container configurations..."
+  
+  # Create pod config
+  cat > /tmp/pod-config.json << 'EOF'
+{
+  "metadata": {
+    "name": "kata-test-pod",
+    "namespace": "default",
+    "uid": "kata-test-pod-uid"
+  },
+  "log_directory": "/tmp",
+  "linux": {}
+}
+EOF
+
+  # Create container config
+  cat > /tmp/container-config.json << 'EOF'
+{
+  "metadata": {
+    "name": "kata-test-container"
+  },
+  "image": {
+    "image": "docker.io/library/alpine:latest"
+  },
+  "command": ["sleep", "300"],
+  "linux": {}
+}
+EOF
+
+  # Create pod sandbox
+  echo "[Test] Creating pod sandbox with kata runtime..."
+  POD_ID=$(sudo crictl runp --runtime kata /tmp/pod-config.json 2>/dev/null || echo "")
+  if [[ -z "$POD_ID" ]]; then
+    echo "[Test] Creating pod sandbox with default runtime..."
+    POD_ID=$(sudo crictl runp /tmp/pod-config.json 2>/dev/null || echo "")
+  fi
+  
+  if [[ -n "$POD_ID" ]]; then
+    echo "[Test] Pod created with ID: $POD_ID, waiting for it to be ready..."
+    # Wait for pod to be ready (up to 30 seconds)
+    for i in {1..30}; do
+      if sudo crictl inspectp $POD_ID >/dev/null 2>&1; then
+        echo "[Test] Pod is ready!"
+        break
+      fi
+      echo "[Test] Waiting for pod to be ready... ($i/30)"
+      sleep 1
+    done
+    
+    # Create container
+    echo "[Test] Creating container..."
+    CONTAINER_ID=$(sudo crictl create $POD_ID /tmp/container-config.json /tmp/pod-config.json 2>/dev/null || echo "")
+    if [[ -z "$CONTAINER_ID" ]]; then
+      echo "[Test] Creating container with default runtime..."
+      CONTAINER_ID=$(sudo crictl create $POD_ID /tmp/container-config.json /tmp/pod-config.json 2>/dev/null || echo "")
+    fi
+    
+    if [[ -n "$CONTAINER_ID" ]]; then
+      echo "[Test] Container created with ID: $CONTAINER_ID"
+      
+      # Start container
+      echo "[Test] Starting container..."
+      sudo crictl start $CONTAINER_ID
+      
+      # Wait a moment for the container to be up
+      sleep 2
+      
+      # Execute commands in the container
+      echo "[Test] Exec into the running container and run 'uname -a'..."
+      sudo crictl exec $CONTAINER_ID uname -a || echo "uname command failed"
+      
+      echo "[Test] Show /etc/os-release inside the container..."
+      sudo crictl exec $CONTAINER_ID cat /etc/os-release || echo "cat /etc/os-release failed"
+      
+      echo "[Test] Show ls -lR /usr inside the container..."
+      sudo crictl exec $CONTAINER_ID ls -lR /usr || echo "ls -lR /usr command failed"
+      
+      # Clean up
+      echo "[Cleanup] Stopping and removing container..."
+      sudo crictl stop $CONTAINER_ID || true
+      sudo crictl rm $CONTAINER_ID || true
+    else
+      echo "[ERROR] Failed to create container"
+    fi
+    
+    # Clean up pod
+    echo "[Cleanup] Removing pod sandbox..."
+    sudo crictl stopp $POD_ID || true
+    sudo crictl rmp $POD_ID || true
+  else
+    echo "[ERROR] Failed to create pod sandbox"
+  fi
+  
+  # Clean up temp files
+  rm -f /tmp/pod-config.json /tmp/container-config.json
+  
+  echo "[Test] CRI-O container test completed."
+else
+  echo "CRI-O (crictl) not found, skipping container test."
+fi
+
+# Check logs for errors
+echo "[Post-test] Checking Kata logs for errors..."
+if journalctl --version >/dev/null 2>&1; then
+  sudo journalctl -xe | grep kata || echo "No kata logs found."
+else
+  echo "journalctl not found, skipping log check."
+fi
+
+echo "All tests completed. If no errors above, the RPM is likely working with CRI-O."

From 7b79010e72ba9bc602c3ef93edb9f768767c5639 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alejandro=20S=C3=A1ez?= <asm@redhat.com>
Date: Fri, 10 Oct 2025 14:42:09 +0200
Subject: [PATCH 05/10] rebuild

---
 kata-containers.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/kata-containers.spec b/kata-containers.spec
index 2262221..f6c333a 100644
--- a/kata-containers.spec
+++ b/kata-containers.spec
@@ -56,7 +56,7 @@ workload isolation and security advantages of VMs. https://katacontainers.io/.}
 # Unlike for RHEL, we cannot strip it down because we build all components
 # (RHEL builds only build kata-agent)
 Name:       %{repo}
-Release:    1%{?rcrel}%{?dist}
+Release:    1%{?rcrel}%{?dist}.1
 Summary:    Kata Containers version 3.x repository
 License:    Apache-2.0
 Url:        https://%{download}
@@ -390,6 +390,9 @@ fi
 
 
 %changelog
+* Fri Oct 10 2025 Alejandro Sáez <asm@redhat.com> - 3.21.0-1.1
+- rebuild
+
 * Thu Sep 25 2025 Christophe de Dinechin <dinechin@redhat.com> - 3.21.0-1
 - kata-containers 3.21.0
 

From a016dd8f899af48b3ad41608603e21f6817d0e91 Mon Sep 17 00:00:00 2001
From: Maxwell G <maxwell@gtmx.me>
Date: Sat, 11 Oct 2025 21:13:42 -0500
Subject: [PATCH 06/10] Rebuild for golang 1.25.2

---
 kata-containers.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/kata-containers.spec b/kata-containers.spec
index f6c333a..3ac104f 100644
--- a/kata-containers.spec
+++ b/kata-containers.spec
@@ -56,7 +56,7 @@ workload isolation and security advantages of VMs. https://katacontainers.io/.}
 # Unlike for RHEL, we cannot strip it down because we build all components
 # (RHEL builds only build kata-agent)
 Name:       %{repo}
-Release:    1%{?rcrel}%{?dist}.1
+Release:    1%{?rcrel}%{?dist}.2
 Summary:    Kata Containers version 3.x repository
 License:    Apache-2.0
 Url:        https://%{download}
@@ -390,6 +390,9 @@ fi
 
 
 %changelog
+* Sun Oct 12 2025 Maxwell G <maxwell@gtmx.me> - 3.21.0-1.2
+- Rebuild for golang 1.25.2
+
 * Fri Oct 10 2025 Alejandro Sáez <asm@redhat.com> - 3.21.0-1.1
 - rebuild
 

From 04e99cd11445251fb9b96a8c169b40684090ff48 Mon Sep 17 00:00:00 2001
From: Christophe de Dinechin <dinechin@redhat.com>
Date: Tue, 30 Sep 2025 18:04:50 +0200
Subject: [PATCH 07/10] Check that we are indeed running in a VM

When running in kata containers, we should be running in a VM.
One manifestation is that the boot command line is different.
Check that and report it.

Signed-off-by: Christophe de Dinechin <dinechin@redhat.com>
---
 test-kata-rpm-containerd.sh | 26 +++++++-------
 test-kata-rpm-crio.sh       | 67 +++++++++++++++++++++++--------------
 2 files changed, 55 insertions(+), 38 deletions(-)

diff --git a/test-kata-rpm-containerd.sh b/test-kata-rpm-containerd.sh
index 95f7d54..f34c27a 100755
--- a/test-kata-rpm-containerd.sh
+++ b/test-kata-rpm-containerd.sh
@@ -55,7 +55,7 @@ if command -v ctr >/dev/null 2>&1; then
   sudo ctr task kill kata-test-bg 2>/dev/null || true
   sudo ctr task rm kata-test-bg 2>/dev/null || true
   sudo ctr container rm kata-test-bg 2>/dev/null || true
-  
+
   sudo ctr images pull docker.io/library/alpine:latest
   # Start a container in the background (do not use --rm so we can exec into it)
   sudo ctr run -d --runtime io.containerd.kata.v2 docker.io/library/alpine:latest kata-test-bg sleep 300
@@ -65,8 +65,18 @@ if command -v ctr >/dev/null 2>&1; then
   sudo ctr task exec --exec-id kata-uname kata-test-bg uname -a
   echo "[Test] Show /etc/os-release inside the container..."
   sudo ctr task exec --exec-id kata-osrel kata-test-bg cat /etc/os-release
-  echo "[Test] Show ls -lR /usr inside the container..."
-  sudo ctr task exec --exec-id kata-ls kata-test-bg ls -lR /usr
+
+  echo "[Test] Verify we're running in a Kata VM by checking /proc/cmdline..."
+  HOST_CMDLINE=$(cat /proc/cmdline)
+  GUEST_CMDLINE=$(sudo ctr task exec --exec-id kata-cmdline kata-test-bg cat /proc/cmdline)
+  echo "[Test] Host cmdline: ${HOST_CMDLINE}"
+  echo "[Test] Container cmdline: ${GUEST_CMDLINE}"
+  if [[ "${HOST_CMDLINE}" == "${GUEST_CMDLINE}" ]]; then
+    echo "[ERROR] VM verification: Container cmdline is the same as host - this indicates the container is NOT running in a Kata VM!"
+    exit 1
+  else
+    echo "[SUCCESS] Kata VM isolation is working correctly!"
+  fi
   # Clean up: kill the task and delete the container
   echo "[Cleanup] Deleting test container..."
   sudo ctr task kill kata-test-bg || true
@@ -80,12 +90,4 @@ else
   echo "containerd (ctr) not found, skipping container test."
 fi
 
-# Check logs for errors
-echo "[Post-test] Checking Kata logs for errors..."
-if journalctl --version >/dev/null 2>&1; then
-  sudo journalctl -xe | grep kata || echo "No kata logs found."
-else
-  echo "journalctl not found, skipping log check."
-fi
-
-echo "All tests completed. If no errors above, the RPM is likely working with containerd." 
\ No newline at end of file
+echo "All tests completed. If no errors above, the RPM is likely working with containerd."
diff --git a/test-kata-rpm-crio.sh b/test-kata-rpm-crio.sh
index d02d2d8..357d26c 100755
--- a/test-kata-rpm-crio.sh
+++ b/test-kata-rpm-crio.sh
@@ -68,7 +68,7 @@ if command -v crictl >/dev/null 2>&1; then
       exit 0
     }
   fi
-  
+
   # Configure crictl to use CRI-O instead of containerd
   echo "[Test] Configuring crictl to use CRI-O..."
   sudo crictl config --set runtime-endpoint=unix:///var/run/crio/crio.sock
@@ -76,10 +76,10 @@ if command -v crictl >/dev/null 2>&1; then
   # Pull the image
   echo "[Test] Pulling alpine image..."
   sudo crictl pull docker.io/library/alpine:latest
-  
+
   # Create temporary pod and container config files
   echo "[Test] Creating pod and container configurations..."
-  
+
   # Create pod config
   cat > /tmp/pod-config.json << 'EOF'
 {
@@ -114,7 +114,7 @@ EOF
     echo "[Test] Creating pod sandbox with default runtime..."
     POD_ID=$(sudo crictl runp /tmp/pod-config.json 2>/dev/null || echo "")
   fi
-  
+
   if [[ -n "$POD_ID" ]]; then
     echo "[Test] Pod created with ID: $POD_ID, waiting for it to be ready..."
     # Wait for pod to be ready (up to 30 seconds)
@@ -126,7 +126,7 @@ EOF
       echo "[Test] Waiting for pod to be ready... ($i/30)"
       sleep 1
     done
-    
+
     # Create container
     echo "[Test] Creating container..."
     CONTAINER_ID=$(sudo crictl create $POD_ID /tmp/container-config.json /tmp/pod-config.json 2>/dev/null || echo "")
@@ -134,35 +134,58 @@ EOF
       echo "[Test] Creating container with default runtime..."
       CONTAINER_ID=$(sudo crictl create $POD_ID /tmp/container-config.json /tmp/pod-config.json 2>/dev/null || echo "")
     fi
-    
+
     if [[ -n "$CONTAINER_ID" ]]; then
       echo "[Test] Container created with ID: $CONTAINER_ID"
-      
+
       # Start container
       echo "[Test] Starting container..."
-      sudo crictl start $CONTAINER_ID
-      
+      if ! sudo crictl start $CONTAINER_ID 2>/dev/null; then
+        # Clean up and retry
+        echo "[Test] Container start failed, cleaning up and retrying..."
+        sudo crictl stop $CONTAINER_ID 2>/dev/null || true
+        sudo crictl rm $CONTAINER_ID 2>/dev/null || true
+        CONTAINER_ID=$(sudo crictl create $POD_ID /tmp/container-config.json /tmp/pod-config.json 2>/dev/null || echo "")
+        if [[ -z "$CONTAINER_ID" ]] || ! sudo crictl start $CONTAINER_ID; then
+          echo "[ERROR] Failed to start container after cleanup"
+          exit 1
+        fi
+      fi
+
       # Wait a moment for the container to be up
       sleep 2
-      
+
       # Execute commands in the container
       echo "[Test] Exec into the running container and run 'uname -a'..."
       sudo crictl exec $CONTAINER_ID uname -a || echo "uname command failed"
-      
+
       echo "[Test] Show /etc/os-release inside the container..."
       sudo crictl exec $CONTAINER_ID cat /etc/os-release || echo "cat /etc/os-release failed"
-      
-      echo "[Test] Show ls -lR /usr inside the container..."
-      sudo crictl exec $CONTAINER_ID ls -lR /usr || echo "ls -lR /usr command failed"
-      
+
+      echo "[Test] Verify we're running in a Kata VM by checking /proc/cmdline..."
+      HOST_CMDLINE=$(cat /proc/cmdline)
+      GUEST_CMDLINE=$(sudo crictl exec $CONTAINER_ID cat /proc/cmdline || echo "cat /proc/cmdline command failed")
+      echo "[Test] Host cmdline: ${HOST_CMDLINE}"
+      echo "[Test] Container cmdline: ${GUEST_CMDLINE}"
+      if [[ "${HOST_CMDLINE}" == "${GUEST_CMDLINE}" ]]; then
+          echo "[ERROR] The container is NOT running in a Kata VM!"
+      else
+          echo "[SUCCESS] Kata VM isolation is working correctly!"
+      fi
+
       # Clean up
       echo "[Cleanup] Stopping and removing container..."
       sudo crictl stop $CONTAINER_ID || true
       sudo crictl rm $CONTAINER_ID || true
+
+      if [[ "${HOST_CMDLINE}" == "${GUEST_CMDLINE}" ]]; then
+          echo "[ERROR] Container was running but not with Kata runtime"
+          exit 1
+      fi
     else
       echo "[ERROR] Failed to create container"
     fi
-    
+
     # Clean up pod
     echo "[Cleanup] Removing pod sandbox..."
     sudo crictl stopp $POD_ID || true
@@ -170,21 +193,13 @@ EOF
   else
     echo "[ERROR] Failed to create pod sandbox"
   fi
-  
+
   # Clean up temp files
   rm -f /tmp/pod-config.json /tmp/container-config.json
-  
+
   echo "[Test] CRI-O container test completed."
 else
   echo "CRI-O (crictl) not found, skipping container test."
 fi
 
-# Check logs for errors
-echo "[Post-test] Checking Kata logs for errors..."
-if journalctl --version >/dev/null 2>&1; then
-  sudo journalctl -xe | grep kata || echo "No kata logs found."
-else
-  echo "journalctl not found, skipping log check."
-fi
-
 echo "All tests completed. If no errors above, the RPM is likely working with CRI-O."

From 845a5f76e32e68e94fca768e7fdfc5ebc6eb65fd Mon Sep 17 00:00:00 2001
From: Christophe de Dinechin <dinechin@redhat.com>
Date: Mon, 3 Nov 2025 15:29:02 +0100
Subject: [PATCH 08/10] tests: Remove steps that retry with containerd

The CRIO test is specifically designed to test CRIO, so avoid falling
back to containerd if things don't work with CRIO.

Signed-off-by: Christophe de Dinechin <dinechin@redhat.com>
---
 test-kata-rpm-crio.sh | 49 +++++++++++++++++++++++--------------------
 1 file changed, 26 insertions(+), 23 deletions(-)

diff --git a/test-kata-rpm-crio.sh b/test-kata-rpm-crio.sh
index 357d26c..fc5365b 100755
--- a/test-kata-rpm-crio.sh
+++ b/test-kata-rpm-crio.sh
@@ -54,18 +54,8 @@ if command -v crictl >/dev/null 2>&1; then
   if ! systemctl is-active --quiet crio; then
     echo "[Test] CRI-O is not running, attempting to start it..."
     sudo systemctl start crio || {
-      echo "[WARNING] Failed to start CRI-O, falling back to containerd test..."
-      echo "[Test] Running containerd test instead..."
-      if command -v ctr >/dev/null 2>&1; then
-        sudo ctr images pull docker.io/library/alpine:latest
-        sudo ctr run --runtime io.containerd.kata.v2 --rm docker.io/library/alpine:latest kata-test-crio-fallback uname -a || {
-          echo "Failed to run container with containerd fallback."; exit 1;
-        }
-        echo "[Test] Containerd fallback test completed."
-      else
-        echo "Neither CRI-O nor containerd available for testing."
-      fi
-      exit 0
+      echo "[WARNING] Failed to start CRI-O..."
+      exit 1
     }
   fi
 
@@ -80,16 +70,27 @@ if command -v crictl >/dev/null 2>&1; then
   # Create temporary pod and container config files
   echo "[Test] Creating pod and container configurations..."
 
-  # Create pod config
+  # Create pod config (minimal Kata documentation config)
   cat > /tmp/pod-config.json << 'EOF'
 {
-  "metadata": {
-    "name": "kata-test-pod",
-    "namespace": "default",
-    "uid": "kata-test-pod-uid"
-  },
-  "log_directory": "/tmp",
-  "linux": {}
+    "metadata": {
+        "name": "busybox-pod",
+        "uid": "busybox-pod",
+        "namespace": "test.kata"
+    },
+    "hostname": "busybox_host",
+    "log_directory": "",
+    "dns_config": {
+    },
+    "port_mappings": [],
+    "resources": {
+    },
+    "labels": {
+    },
+    "annotations": {
+    },
+    "linux": {
+    }
 }
 EOF
 
@@ -97,7 +98,7 @@ EOF
   cat > /tmp/container-config.json << 'EOF'
 {
   "metadata": {
-    "name": "kata-test-container"
+    "name": "busybox-container"
   },
   "image": {
     "image": "docker.io/library/alpine:latest"
@@ -111,8 +112,10 @@ EOF
   echo "[Test] Creating pod sandbox with kata runtime..."
   POD_ID=$(sudo crictl runp --runtime kata /tmp/pod-config.json 2>/dev/null || echo "")
   if [[ -z "$POD_ID" ]]; then
-    echo "[Test] Creating pod sandbox with default runtime..."
-    POD_ID=$(sudo crictl runp /tmp/pod-config.json 2>/dev/null || echo "")
+    echo "[Test] Failed to create pod sandbox with Kata runtime"
+    journalctl -g kata
+    echo "[Test] Failed to create pod sandbox with Kata runtime, exiting"
+    exit 1
   fi
 
   if [[ -n "$POD_ID" ]]; then

From 60b7e16b8b8cadea74bf83fa724536f4efe5a609 Mon Sep 17 00:00:00 2001
From: Christophe de Dinechin <dinechin@redhat.com>
Date: Mon, 3 Nov 2025 17:10:47 +0100
Subject: [PATCH 09/10] Bump to Kata Containers 3.22

Signed-off-by: Christophe de Dinechin <dinechin@redhat.com>
---
 .gitignore           | 2 ++
 kata-containers.spec | 7 +++++--
 sources              | 4 ++--
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/.gitignore b/.gitignore
index 1264cb2..ad07063 100644
--- a/.gitignore
+++ b/.gitignore
@@ -71,3 +71,5 @@
 /kata-containers-3.20.0-vendor.tar.gz
 /kata-containers-3.21.0.tar.gz
 /kata-containers-3.21.0-vendor.tar.gz
+/kata-containers-3.22.0.tar.gz
+/kata-containers-3.22.0-vendor.tar.gz
diff --git a/kata-containers.spec b/kata-containers.spec
index 3ac104f..69bdb99 100644
--- a/kata-containers.spec
+++ b/kata-containers.spec
@@ -28,7 +28,7 @@
 %endif
 
 # https://github.com/kata-containers/kata-containers
-Version: 3.21.0
+Version: 3.22.0
 %global tag         %{version}%{?rcstr}
 
 %global domain      github.com
@@ -56,7 +56,7 @@ workload isolation and security advantages of VMs. https://katacontainers.io/.}
 # Unlike for RHEL, we cannot strip it down because we build all components
 # (RHEL builds only build kata-agent)
 Name:       %{repo}
-Release:    1%{?rcrel}%{?dist}.2
+Release:    1%{?rcrel}%{?dist}
 Summary:    Kata Containers version 3.x repository
 License:    Apache-2.0
 Url:        https://%{download}
@@ -390,6 +390,9 @@ fi
 
 
 %changelog
+* Mon Nov 03 2025 Christophe de Dinechin <dinechin@redhat.com> - 3.22.0-1
+- kata-containers 3.22.0
+
 * Sun Oct 12 2025 Maxwell G <maxwell@gtmx.me> - 3.21.0-1.2
 - Rebuild for golang 1.25.2
 
diff --git a/sources b/sources
index dafeef3..c82bc85 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (kata-containers-3.21.0.tar.gz) = 703cf7ea73a306d190955c04041fdcecffc7de20b05c231aca3ccfae0e53ebdd7221b9a04d0f02e129c88e9084bdcca2ec8f6f440b1e5b450fd4fc5768f46615
-SHA512 (kata-containers-3.21.0-vendor.tar.gz) = d695f2c6e03402f2543daadf1506da614a032180d22855c3fa973380072166b157d19990ca9429f48379fca61801f85caff25e38b5ae27e483eda1d2692bcfec
+SHA512 (kata-containers-3.22.0.tar.gz) = 142bc70b6455f545d534371a845980ed00985d7225b5f672f3fef046a6f0a31871bd69ee2c931ab94c10089086123fe5987ec6615d7a7308027531269c4dae48
+SHA512 (kata-containers-3.22.0-vendor.tar.gz) = 10b28d746d5176acce4abcb902213edcfb43b0b390a5d20f114b7dc4e11bc8de26098f180bdf75bcff3e6d03f2b3a31908f4386d7ca24119f9e001cd99c52060

From 92c293dcd189083a0b49fa9157420b4cbad8a92b Mon Sep 17 00:00:00 2001
From: Christophe de Dinechin <dinechin@redhat.com>
Date: Mon, 15 Dec 2025 17:26:07 +0100
Subject: [PATCH 10/10] Release 3.23

Upstream release 3.23

Signed-off-by: Christophe de Dinechin <dinechin@redhat.com>
---
 .gitignore                                       |  2 ++
 1001-Remove-warnings-as-compilation-errors.patch | 12 ++++++------
 kata-containers.spec                             |  2 +-
 sources                                          |  4 ++--
 4 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/.gitignore b/.gitignore
index ad07063..4678ac9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -73,3 +73,5 @@
 /kata-containers-3.21.0-vendor.tar.gz
 /kata-containers-3.22.0.tar.gz
 /kata-containers-3.22.0-vendor.tar.gz
+/kata-containers-3.23.0.tar.gz
+/kata-containers-3.23.0-vendor.tar.gz
diff --git a/1001-Remove-warnings-as-compilation-errors.patch b/1001-Remove-warnings-as-compilation-errors.patch
index 140375f..19fffda 100644
--- a/1001-Remove-warnings-as-compilation-errors.patch
+++ b/1001-Remove-warnings-as-compilation-errors.patch
@@ -18,18 +18,18 @@ Signed-off-by: Emanuel Lima <emlima@redhat.com>
  10 files changed, 18 insertions(+), 18 deletions(-)
 
 diff --git a/src/agent/Makefile b/src/agent/Makefile
-index e62a894aa..39d351213 100644
 --- a/src/agent/Makefile
 +++ b/src/agent/Makefile
-@@ -130,14 +130,14 @@ static-checks-build: $(GENERATED_CODE)
+@@ -120,7 +120,7 @@ static-checks-build: $(GENERATED_CODE)
  $(TARGET): $(GENERATED_CODE) $(TARGET_PATH)
 
  $(TARGET_PATH): show-summary
 -	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo build --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release) $(EXTRA_RUSTFEATURES)
 +	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) " cargo build --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release) $(EXTRA_RUSTFEATURES)
 
- $(GENERATED_FILES): %: %.in
+ $(GENERATED_FILES): %: %.in $(VERSION_FILE)
  	@sed $(foreach r,$(GENERATED_REPLACEMENTS),-e 's|@$r@|$($r)|g') "$<" > "$@"
+@@ -127,7 +127,7 @@ $(GENERATED_FILES): %: %.in $(VERSION_FILE)
 
  ##TARGET optimize: optimized  build
  optimize: show-summary show-header
@@ -38,6 +38,7 @@ index e62a894aa..39d351213 100644
 
  ##TARGET install: install agent
  install: install-services
+
 diff --git a/src/dragonball/Makefile b/src/dragonball/Makefile
 index 40bb7f915..5eb2c1016 100644
 --- a/src/dragonball/Makefile
@@ -66,10 +67,9 @@ index aabaa3391..1fb6b20c3 100644
  format:
  	@echo "INFO: cargo fmt..."
 diff --git a/src/runtime-rs/Makefile b/src/runtime-rs/Makefile
-index 0bb0617ff..188040864 100644
 --- a/src/runtime-rs/Makefile
 +++ b/src/runtime-rs/Makefile
-@@ -600,7 +600,7 @@ static-checks-build: $(GENERATED_FILES)
+@@ -658,7 +658,7 @@ static-checks-build: $(GENERATED_FILES)
  $(TARGET): $(GENERATED_FILES) $(TARGET_PATH)
 
  $(TARGET_PATH): $(SOURCES) | show-summary
@@ -78,7 +78,7 @@ index 0bb0617ff..188040864 100644
 
  $(GENERATED_FILES): %: %.in
  	@sed \
-@@ -610,7 +610,7 @@ $(GENERATED_FILES): %: %.in
+@@ -668,7 +668,7 @@ $(GENERATED_FILES): %: %.in
 
  ##TARGET optimize: optimized  build
  optimize: $(SOURCES) | show-summary show-header
diff --git a/kata-containers.spec b/kata-containers.spec
index 69bdb99..2ed9f3c 100644
--- a/kata-containers.spec
+++ b/kata-containers.spec
@@ -28,7 +28,7 @@
 %endif
 
 # https://github.com/kata-containers/kata-containers
-Version: 3.22.0
+Version: 3.23.0
 %global tag         %{version}%{?rcstr}
 
 %global domain      github.com
diff --git a/sources b/sources
index c82bc85..0c1fe9f 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (kata-containers-3.22.0.tar.gz) = 142bc70b6455f545d534371a845980ed00985d7225b5f672f3fef046a6f0a31871bd69ee2c931ab94c10089086123fe5987ec6615d7a7308027531269c4dae48
-SHA512 (kata-containers-3.22.0-vendor.tar.gz) = 10b28d746d5176acce4abcb902213edcfb43b0b390a5d20f114b7dc4e11bc8de26098f180bdf75bcff3e6d03f2b3a31908f4386d7ca24119f9e001cd99c52060
+SHA512 (kata-containers-3.23.0.tar.gz) = d921dace40545fab47647c68357d88bf2807b74d5b3546ed0d91416b98fbad4ecaabf449abcc20e34cee8fbcacffe4a66a6012b63815e6b2c60c0319f982cc6e
+SHA512 (kata-containers-3.23.0-vendor.tar.gz) = 484c2dececc31a4fa9d4662f0a0051d52a916728e673396fbb70ab8ef02eb3ac225b815a03e2799aa7bcfe6478dd3ad785c628879914b0b113123f3952795c7b