Release 3.23

Upstream release 3.23

Signed-off-by: Christophe de Dinechin <dinechin@redhat.com>

.gitignore

@@ -1,3 +1,4 @@
+.vscode
 /kata-containers-2.0.0.tar.gz
 /kata-containers-2.0.1.tar.gz
 /kata-containers-2.0.2.tar.gz
@@ -37,3 +38,40 @@
 /kata-containers-3.0.0-vendor.tar.gz
 /kata-containers-3.0.1.tar.gz
 /kata-containers-3.0.1-vendor.tar.gz
+/kata-containers-3.1.3.tar.gz
+/kata-containers-3.1.3-vendor.tar.gz
+/kata-containers-3.2.0.tar.gz
+/kata-containers-3.2.0-vendor.tar.gz
+/kata-containers-3.6.0-vendor.tar.gz
+/kata-containers-3.6.0.tar.gz
+/kata-containers-3.7.0-vendor.tar.gz
+/kata-containers-3.7.0.tar.gz
+/kata-containers-3.9.0-vendor.tar.gz
+/kata-containers-3.9.0.tar.gz
+/kata-containers-3.11.0-vendor.tar.gz
+/kata-containers-3.11.0.tar.gz
+/kata-containers-3.12.0-vendor.tar.gz
+/kata-containers-3.12.0.tar.gz
+/kata-containers-3.13.0-vendor.tar.gz
+/kata-containers-3.13.0.tar.gz
+/kata-containers-3.14.0-vendor.tar.gz
+/kata-containers-3.14.0.tar.gz
+/kata-containers-3.15.0.tar.gz
+/kata-containers-3.15.0-vendor.tar.gz
+/kata-containers-3.16.0.tar.gz
+/kata-containers-3.16.0-vendor.tar.gz
+/kata-containers-3.16.0-fedora-vendor.tar.gz
+/kata-containers-3.17.0.tar.gz
+/kata-containers-3.17.0-vendor.tar.gz
+/kata-containers-3.18.0.tar.gz
+/kata-containers-3.18.0-vendor.tar.gz
+/kata-containers-3.19.1.tar.gz
+/kata-containers-3.19.1-vendor.tar.gz
+/kata-containers-3.20.0.tar.gz
+/kata-containers-3.20.0-vendor.tar.gz
+/kata-containers-3.21.0.tar.gz
+/kata-containers-3.21.0-vendor.tar.gz
+/kata-containers-3.22.0.tar.gz
+/kata-containers-3.22.0-vendor.tar.gz
+/kata-containers-3.23.0.tar.gz
+/kata-containers-3.23.0-vendor.tar.gz

0999-osbuilder-Adjust-agent_version-for-our-builds.patch

@@ -1,4 +1,4 @@
-From f1b45ad2295eb260d0c53f6d90ede35b4b2ad510 Mon Sep 17 00:00:00 2001
+From dbc78715ffe7b4011383d585548352ca2ea57f32 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= <fidencio@redhat.com>
 Date: Wed, 1 Sep 2021 17:39:17 -0300
 Subject: [PATCH] Adjust agent_version for our builds
@@ -10,24 +10,27 @@ As we move things around when installing osbuilder, we need to adapt
 where we get the agent_version from.
 
 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com>
+[gkurz: rebased on top of 3.7.0]
+Signed-off-by: Greg Kurz <gkurz@redhat.com>
 ---
- tools/osbuilder/scripts/lib.sh | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
+ tools/osbuilder/scripts/lib.sh | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
 
 diff --git a/tools/osbuilder/scripts/lib.sh b/tools/osbuilder/scripts/lib.sh
-index 33a01f0..4225741 100644
+index 5e3687595953..53d544e7b1d0 100644
 --- a/tools/osbuilder/scripts/lib.sh
 +++ b/tools/osbuilder/scripts/lib.sh
-@@ -164,8 +164,7 @@ create_summary_file()
+@@ -180,9 +180,7 @@ create_summary_file()
  	local agent="${AGENT_DEST}"
  	[ "$AGENT_INIT" = yes ] && agent="${init}"
  
 -	local -r agentdir="${script_dir}/../../../"
--	local -r agent_version=$(cat ${agentdir}/VERSION)
+-	local agent_version=$(cat ${agentdir}/VERSION 2> /dev/null)
+-	[ -z "$agent_version" ] && agent_version="unknown"
 +	agent_version=$(cat "${script_dir}/../../VERSION")
  
  	cat >"$file"<<-EOF
  	---
 -- 
-2.37.2
+2.45.2
 

1000-Remove-shebang-in-non-executable-completion-script.patch

@@ -1,25 +0,0 @@
-From 1c65024709d7c28bf78b42c59a135df17513d78d Mon Sep 17 00:00:00 2001
-From: Christophe de Dinechin <dinechin@redhat.com>
-Date: Thu, 12 Sep 2019 12:57:39 +0200
-Subject: [PATCH] Remove shebang in non-executable completion script
-
-Raised during package review [1] by rpmlint
-
-[1] https://bugzilla.redhat.com/show_bug.cgi?id=1590425#c8
-
-Signed-off-by: Christophe de Dinechin <dinechin@redhat.com>
----
- src/runtime/data/completions/bash/kata-runtime | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/src/runtime/data/completions/bash/kata-runtime b/src/runtime/data/completions/bash/kata-runtime
-index c293483..58ab978 100644
---- a/src/runtime/data/completions/bash/kata-runtime
-+++ b/src/runtime/data/completions/bash/kata-runtime
-@@ -1,4 +1,3 @@
--#!/usr/bin/env bash
- #
- # Copyright (c) 2018 Intel Corporation
- #
---
-2.21.0

1001-Remove-warnings-as-compilation-errors.patch

@@ -0,0 +1,204 @@
+From 983b1fb5ba4a4b8ecbb24938b3fd055c007a73d8 Mon Sep 17 00:00:00 2001
+From: Emanuel Lima <emlima@redhat.com>
+Date: Mon, 6 Jan 2025 16:11:19 -0300
+Subject: [PATCH] Remove warnings as compilation errors
+
+Signed-off-by: Emanuel Lima <emlima@redhat.com>
+---
+ src/agent/Makefile                 | 4 ++--
+ src/dragonball/Makefile            | 4 ++--
+ src/libs/Makefile                  | 2 +-
+ src/runtime-rs/Makefile            | 4 ++--
+ src/tools/agent-ctl/Makefile       | 4 ++--
+ src/tools/genpolicy/Makefile       | 6 +++---
+ src/tools/kata-ctl/Makefile        | 6 +++---
+ src/tools/runk/Makefile            | 2 +-
+ src/tools/trace-forwarder/Makefile | 2 +-
+ utils.mk                           | 2 +-
+ 10 files changed, 18 insertions(+), 18 deletions(-)
+
+diff --git a/src/agent/Makefile b/src/agent/Makefile
+--- a/src/agent/Makefile
++++ b/src/agent/Makefile
+@@ -120,7 +120,7 @@ static-checks-build: $(GENERATED_CODE)
+ $(TARGET): $(GENERATED_CODE) $(TARGET_PATH)
+
+ $(TARGET_PATH): show-summary
+-	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo build --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release) $(EXTRA_RUSTFEATURES)
++	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) " cargo build --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release) $(EXTRA_RUSTFEATURES)
+
+ $(GENERATED_FILES): %: %.in $(VERSION_FILE)
+ 	@sed $(foreach r,$(GENERATED_REPLACEMENTS),-e 's|@$r@|$($r)|g') "$<" > "$@"
+@@ -127,7 +127,7 @@ $(GENERATED_FILES): %: %.in $(VERSION_FILE)
+
+ ##TARGET optimize: optimized  build
+ optimize: show-summary show-header
+-	@RUSTFLAGS="-C link-arg=-s $(EXTRA_RUSTFLAGS) --deny warnings" cargo build --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release) $(EXTRA_RUSTFEATURES)
++	@RUSTFLAGS="-C link-arg=-s $(EXTRA_RUSTFLAGS) " cargo build --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release) $(EXTRA_RUSTFEATURES)
+
+ ##TARGET install: install agent
+ install: install-services
+
+diff --git a/src/dragonball/Makefile b/src/dragonball/Makefile
+index 40bb7f915..5eb2c1016 100644
+--- a/src/dragonball/Makefile
++++ b/src/dragonball/Makefile
+@@ -27,8 +27,8 @@ clippy:
+ 	@echo "INFO: cargo clippy..."
+ 	cargo clippy --all-targets --all-features \
+ 		-- \
+-		-D warnings
++
+
+ vendor:
+ 	@echo "INFO: vendor do nothing.."
+
+diff --git a/src/libs/Makefile b/src/libs/Makefile
+index aabaa3391..1fb6b20c3 100644
+--- a/src/libs/Makefile
++++ b/src/libs/Makefile
+@@ -25,7 +25,7 @@ clippy:
+ 	@echo "INFO: cargo clippy..."
+ 	cargo clippy --all-targets --all-features --release \
+ 		-- \
+-		-D warnings
++
+
+ format:
+ 	@echo "INFO: cargo fmt..."
+diff --git a/src/runtime-rs/Makefile b/src/runtime-rs/Makefile
+--- a/src/runtime-rs/Makefile
++++ b/src/runtime-rs/Makefile
+@@ -658,7 +658,7 @@ static-checks-build: $(GENERATED_FILES)
+ $(TARGET): $(GENERATED_FILES) $(TARGET_PATH)
+
+ $(TARGET_PATH): $(SOURCES) | show-summary
+-	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo build --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release) $(EXTRA_RUSTFEATURES)
++	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) " cargo build --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release) $(EXTRA_RUSTFEATURES)
+
+ $(GENERATED_FILES): %: %.in
+ 	@sed \
+@@ -668,7 +668,7 @@ $(GENERATED_FILES): %: %.in
+
+ ##TARGET optimize: optimized  build
+ optimize: $(SOURCES) | show-summary show-header
+-	@RUSTFLAGS="-C link-arg=-s $(EXTRA_RUSTFLAGS) --deny warnings" cargo build --target $(TRIPLE) --$(BUILD_TYPE) $(EXTRA_RUSTFEATURES)
++	@RUSTFLAGS="-C link-arg=-s $(EXTRA_RUSTFLAGS) " cargo build --target $(TRIPLE) --$(BUILD_TYPE) $(EXTRA_RUSTFEATURES)
+
+ ##TARGET clean: clean build
+ clean: clean-generated-files
+diff --git a/src/tools/agent-ctl/Makefile b/src/tools/agent-ctl/Makefile
+index a49f88e6b..855017db4 100644
+--- a/src/tools/agent-ctl/Makefile
++++ b/src/tools/agent-ctl/Makefile
+@@ -9,7 +9,7 @@ endif
+ default: build
+
+ build:
+-	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo build --target $(TRIPLE) --$(BUILD_TYPE)
++	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) " cargo build --target $(TRIPLE) --$(BUILD_TYPE)
+
+ static-checks-build:
+ 	@echo "INFO: static-checks-build do nothing.."
+@@ -23,7 +23,7 @@ vendor:
+ test:
+
+ install:
+-	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo install --locked --target $(TRIPLE) --path .
++	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) " cargo install --locked --target $(TRIPLE) --path .
+
+ check: standard_rust_check
+
+diff --git a/src/tools/genpolicy/Makefile b/src/tools/genpolicy/Makefile
+index 7410e20ed..b33541467 100644
+--- a/src/tools/genpolicy/Makefile
++++ b/src/tools/genpolicy/Makefile
+@@ -24,7 +24,7 @@ $(GENERATED_FILES): %: %.in
+ default: build
+
+ build: $(GENERATED_FILES)
+-	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo build --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release)
++	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) " cargo build --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release)
+
+ static-checks-build:
+ 	@echo "INFO: static-checks-build do nothing.."
+@@ -37,10 +37,10 @@ vendor:
+ 	cargo vendor
+
+ test: $(GENERATED_FILES)
+-	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo test --all-targets --all-features --target $(TRIPLE)
++	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) " cargo test --all-targets --all-features --target $(TRIPLE)
+
+ install: $(GENERATED_FILES)
+-	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo install --locked --target $(TRIPLE) --path .
++	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) " cargo install --locked --target $(TRIPLE) --path .
+
+ check:  $(GENERATED_CODE) standard_rust_check
+
+diff --git a/src/tools/kata-ctl/Makefile b/src/tools/kata-ctl/Makefile
+index 7595c0c23..05d171f5a 100644
+--- a/src/tools/kata-ctl/Makefile
++++ b/src/tools/kata-ctl/Makefile
+@@ -43,7 +43,7 @@ default: $(TARGET) build
+ $(TARGET): $(GENERATED_CODE)
+
+ build:
+-	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo build --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release) $(EXTRA_RUSTFEATURES)
++	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) " cargo build --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release) $(EXTRA_RUSTFEATURES)
+
+ static-checks-build: $(GENERATED_CODE)
+
+@@ -59,10 +59,10 @@ vendor:
+ 	cargo vendor
+
+ test: $(GENERATED_CODE)
+-	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo test --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release) $(EXTRA_RUSTFEATURES) -- --nocapture
++	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) " cargo test --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release) $(EXTRA_RUSTFEATURES) -- --nocapture
+
+ install:
+-	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo install --locked --target $(TRIPLE) --path . --root $(INSTALL_PATH)
++	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) " cargo install --locked --target $(TRIPLE) --path . --root $(INSTALL_PATH)
+
+ check: $(GENERATED_CODE) standard_rust_check
+
+diff --git a/src/tools/runk/Makefile b/src/tools/runk/Makefile
+index 186955679..b23cab145 100644
+--- a/src/tools/runk/Makefile
++++ b/src/tools/runk/Makefile
+@@ -32,7 +32,7 @@ endif
+ default: build
+
+ build:
+-	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo build --target $(TRIPLE) --$(BUILD_TYPE) $(EXTRA_RUSTFEATURES)
++	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) " cargo build --target $(TRIPLE) --$(BUILD_TYPE) $(EXTRA_RUSTFEATURES)
+
+ static-checks-build:
+ 	@echo "INFO: static-checks-build do nothing.."
+diff --git a/src/tools/trace-forwarder/Makefile b/src/tools/trace-forwarder/Makefile
+index 5d9f71856..bf6b80a54 100644
+--- a/src/tools/trace-forwarder/Makefile
++++ b/src/tools/trace-forwarder/Makefile
+@@ -9,7 +9,7 @@ endif
+ default: build
+
+ build:
+-	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo build --target $(TRIPLE) --$(BUILD_TYPE)
++	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) " cargo build --target $(TRIPLE) --$(BUILD_TYPE)
+
+ static-checks-build:
+ 	@echo "INFO: static-checks-build do nothing.."
+diff --git a/utils.mk b/utils.mk
+index 1a153e26c..4edba5524 100644
+--- a/utils.mk
++++ b/utils.mk
+@@ -183,7 +183,7 @@ standard_rust_check:
+ 	cargo fmt -- --check
+ 	cargo clippy --all-targets --all-features --release \
+ 		-- \
+-		-D warnings
++
+
+ # Install a file (full version).
+ #
+--
+2.47.1

50-kata

@@ -3,3 +3,6 @@
   runtime_type = "vm"
   runtime_root = "/run/vc"
   privileged_without_host_devices = true
+  allowed_annotations = [
+      "io.kubernetes.cri-o.Devices",
+  ]

kata-containers.spec

@@ -27,8 +27,8 @@
 %global rcstr -%{rcver}
 %endif
 
-# htps://github.com/kata-containers/kata-containers
-Version: 3.0.1
+# https://github.com/kata-containers/kata-containers
+Version: 3.23.0
 %global tag         %{version}%{?rcstr}
 
 %global domain      github.com
@@ -39,7 +39,7 @@ Version: 3.0.1
 
 
 %global common_description %{expand:
-Kata Containers version 2.x repository. Kata Containers is an open source
+Kata Containers version 3.x repository. Kata Containers is an open source
 project and community working to build a standard implementation of lightweight
 Virtual Machines (VMs) that feel and perform like containers, but provide the
 workload isolation and security advantages of VMs. https://katacontainers.io/.}
@@ -52,10 +52,13 @@ workload isolation and security advantages of VMs. https://katacontainers.io/.}
                     CONTRIBUTING.md\\\
                     src/agent/README.md
 
+# Note: the original vendor tarball is quite big (918M for 3.16)
+# Unlike for RHEL, we cannot strip it down because we build all components
+# (RHEL builds only build kata-agent)
 Name:       %{repo}
-Release:    1%{?rcrel}%{?dist}.1
-Summary:    Kata Containers version 2.x repository
-License:    ASL 2.0
+Release:    1%{?rcrel}%{?dist}
+Summary:    Kata Containers version 3.x repository
+License:    Apache-2.0
 Url:        https://%{download}
 Source0:    https://%{download}/archive/%{version}%{?rcstr}/%{repo}-%{version}%{?rcstr}.tar.gz
 Source1:    https://%{download}/releases/download/%{version}/%{repo}-%{version}%{?rcstr}-vendor.tar.gz
@@ -66,8 +69,7 @@ Source5:    50-kata
 
 # Keep this patch downstream as it'd be hard to justify such change upstream
 Patch0999:  0999-osbuilder-Adjust-agent_version-for-our-builds.patch
-Patch1000:  1000-Remove-shebang-in-non-executable-completion-script.patch
-
+Patch1001:  1001-Remove-warnings-as-compilation-errors.patch
 
 %if 0%{?have_go_rpm_macros}
 BuildRequires: go-rpm-macros
@@ -80,15 +82,20 @@ BuildRequires: git-core
 BuildRequires: libselinux-devel
 BuildRequires: libseccomp-devel
 BuildRequires: make
+BuildRequires: openssl-devel
 BuildRequires: systemd
 BuildRequires: gcc
 BuildRequires: protobuf-compiler
+BuildRequires: clang-libs
 
 %{?systemd_requires}
 # %%check requirements
+BuildRequires: dbus
+BuildRequires: dbus-daemon
 BuildRequires: dracut
 BuildRequires: kernel
 BuildRequires: busybox
+BuildRequires: rsyslog
 
 %if 0%{?bundled_rust_deps}
 BuildRequires: cargo
@@ -131,10 +138,13 @@ BuildRequires: crate(ttrpc/default) >= 0.0.0
 %endif
 
 Requires: busybox
+Requires: binutils
 Requires: dracut
 Requires: kernel
-Requires: qemu-kvm-core >= 4.2.0-4
-Requires: %{_libexecdir}/virtiofsd
+Requires: qemu-kvm-core >= 8.2.0-1
+# For /usr/libexec/virtiofsd
+Requires: (virtiofsd or qemu-virtiofsd)
+Suggests: virtiofsd
 
 Conflicts: kata-agent
 Conflicts: kata-ksm-throttler
@@ -146,6 +156,9 @@ Conflicts: kata-shim
 # The following architectures lack the required qemu support
 ExcludeArch: %{arm} %{ix86} s390 s390x
 
+# Building kata-ctl on ppc64le is currently being skipped
+ExcludeArch: ppc64le
+
 %description
 %{common_description}
 
@@ -206,8 +219,8 @@ ExcludeArch: %{arm} %{ix86} s390 s390x
 
 %global agent_make_vars         %{rust_make_vars} \\\
                                 DESTDIR=%{buildroot}%{kataagentdir}
-%global log_parser_vars         %{rust_make_vars} \\\
-                                BINDIR=%{buildroot}%{_bindir}
+%global kata_ctl_vars           %{rust_make_vars} \\\
+                                INSTALL_PATH=%{buildroot}%{_prefix}
 
 %prep
 %autosetup -S git -p1 -n %{kata_build_dir}
@@ -218,6 +231,8 @@ tar -xf %{SOURCE1}
 # Not using gobuild here in order to stick to how upstream builds
 # (This builds multiple binaries)
 %build
+%set_build_flags
+
 export PATH=$PATH:"$(pwd)/go/bin"
 export GOPATH="$(pwd)/go"
 
@@ -234,8 +249,8 @@ pushd src/agent
 touch kata-agent
 popd
 
-pushd src/tools/log-parser
-%make_build %{log_parser_vars}
+pushd src/tools/kata-ctl
+%make_build %{kata_ctl_vars}
 popd
 
 pushd tools/osbuilder
@@ -260,8 +275,10 @@ pushd src/agent
 %make_install %{agent_make_vars}
 popd
 
-pushd src/tools/log-parser
-%make_install %{log_parser_vars}
+pushd src/tools/kata-ctl
+%make_install %{kata_ctl_vars}
+rm -f %{buildroot}%{_prefix}/.crates.toml
+rm -f %{buildroot}%{_prefix}/.crates2.json
 popd
 
 pushd tools/osbuilder
@@ -350,8 +367,8 @@ fi
 %dir %{kataagentdir}
 %{kataagentdir}/*
 
-#log-parser
-%{_bindir}/kata-log-parser
+#kata-ctl
+%{_bindir}/kata-ctl
 
 #osbuilder
 %dir %{kataosbuilderdir}
@@ -367,13 +384,120 @@ fi
 %exclude %{katadefaults}/configuration-*.toml
 %exclude %{kataosbuilderdir}/rootfs-builder/alpine
 %exclude %{kataosbuilderdir}/rootfs-builder/centos
-%exclude %{kataosbuilderdir}/rootfs-builder/clearlinux
 %exclude %{kataosbuilderdir}/rootfs-builder/debian
 %exclude %{kataosbuilderdir}/rootfs-builder/template
 %exclude %{kataosbuilderdir}/rootfs-builder/ubuntu
 
 
 %changelog
+* Mon Nov 03 2025 Christophe de Dinechin <dinechin@redhat.com> - 3.22.0-1
+- kata-containers 3.22.0
+
+* Sun Oct 12 2025 Maxwell G <maxwell@gtmx.me> - 3.21.0-1.2
+- Rebuild for golang 1.25.2
+
+* Fri Oct 10 2025 Alejandro Sáez <asm@redhat.com> - 3.21.0-1.1
+- rebuild
+
+* Thu Sep 25 2025 Christophe de Dinechin <dinechin@redhat.com> - 3.21.0-1
+- kata-containers 3.21.0
+
+* Wed Sep 10 2025 Christophe de Dinechin <dinechin@redhat.com> - 3.20.0-1
+- kata-containers 3.20.0
+
+* Fri Aug 15 2025 Maxwell G <maxwell@gtmx.me> - 3.19.1-1.1
+- Rebuild for golang-1.25.0
+
+* Mon Jul 28 2025 Christophe de Dinechin <dinechin@redhat.com> - 3.19.1-1
+- kata-containers 3.19.0
+
+* Mon Jul 28 2025 Christophe de Dinechin <dinechin@redhat.com> - 3.18.0-1
+- kata-containers 3.18.0
+
+* Fri Jul 25 2025 Christophe de Dinechin <dinechin@redhat.com> - 3.17.0-1
+- kata-containers 3.17.0
+
+* Thu Jul 24 2025 Christophe de Dinechin <dinechin@redhat.com> - 3.16.0-1
+- kata-containers 3.16.0
+
+* Thu Jul 24 2025 Christophe de Dinechin <dinechin@redhat.com> - 3.15.0-1
+- kata-containers 3.15.0
+
+* Wed Jul 23 2025 Christophe de Dinechin <dinechin@redhat.com> - 3.14.1-1
+- kata-containers 3.14.1, add fix for systemd configuration and rpm sanity test
+
+* Tue Jul 08 2025 Christophe de Dinechin <dinechin@redhat.com> - 3.14.0-1
+- kata-containers 3.14.0, update to latest release
+
+* Mon Jul 07 2025 Christophe de Dinechin <dinechin@redhat.com> - 3.13.0-1
+- kata-containers 3.13.0, required vendor source correction
+
+* Mon Jan 20 2025 Fedora Release Engineering <releng@fedoraproject.org> - 3.12.0-1.2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
+* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 3.12.0-1.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
+* Mon Jan 06 2025 Emanuel Lima <emlima@redhat.com> - 3.12.0-1
+- kata-containers 3.12.0
+
+* Tue Nov 26 2024 Emanuel Lima <emlima@redhat.com> - 3.11.0-1
+- kata-containers 3.11.0
+
+* Mon Oct 07 2024 Emanuel Lima <emlima@redhat.com> - 3.9.0-1
+- kata-containers 3.9.0
+  Fix warnings as compilation errors patch
+  Add time dependency compilation error patch
+  Add arch name compilation failure patch
+  Add binutils and rsyslog as dependencies
+  Add AGENT_POLICY patch
+
+* Mon Sep 16 2024 Emanuel Lima <emlima@redhat.com> - 3.7.0-1
+- kata-containers 3.7.0
+  Add "io.kubernetes.cri-o.Devices" to cri-o config
+  Remove the openssl feature patch
+  Bump QEMU to 8.2
+  Add Remove-warnings-as-compilation-errors patch
+
+* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.0-1.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
+* Tue Jun 18 2024 Emanuel Lima <emlima@redhat.com> - 3.6.0-2
+- Add openssl-devel as a dependency
+- Build kata-ctl instead of log-parser
+- Add clang-libs, dbus and dbus-daemon as  build dependencies
+- Exclude ppc64le from the build pipeline
+
+* Tue Jun 18 2024 Emanuel Lima <emlima@redhat.com> - 3.6.0-1
+- Bump to kata-containers-3.6.0
+- Fix agent-Remove-openssl-vendored-feature patch
+
+* Fri Apr 05 2024 Emanuel Lima <emlima@redhat.com> - 3.3.0-1
+- Add clang-libs as a build dependency
+  Apply spec-Bump-Kata-Containers-to-its-3.3.0-release.patch
+  Apply agent-Remove-vendored-features-from-openssl-sys.patch
+  Apply spec-Add-openssl-devel-as-a-dependency.patch
+  Apply spec-Build-kata-ctl-instead-of-log-parser.patch
+
+* Sun Feb 11 2024 Maxwell G <maxwell@gtmx.me> - 3.2.0-2.3
+- Rebuild for golang 1.22.0
+
+* Wed Jan 24 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.0-2.2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Sat Jan 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.0-2.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Mon Nov 06 2023 Emanuel Lima <emlima@redhat.com> - 3.2.0-2
+- migrated to SPDX license
+- kata-containers-3.2.0 final
+
+* Thu Sep 28 2023 Emanuel Lima <emlima@redhat.com> - 3.2.0-1
+- kata-containers-3.2.0
+
+* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 3.0.1-1.2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
 * Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 3.0.1-1.1
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
 

kata-osbuilder.sh

@@ -210,6 +210,11 @@ generate_rootfs()
 
     # Generate modules-load.d file
     generate_modules_load_conf
+
+    # Mask initrd.target and default to multi-user.target
+    # Temporary workaround for KATA-3944
+    systemctl mask --root=${DRACUT_ROOTFS} initrd.target
+    systemctl set-default --root=${DRACUT_ROOTFS} multi-user.target
 }
 
 

sources

@@ -1,2 +1,2 @@
-SHA512 (kata-containers-3.0.1.tar.gz) = 060af46e0dc6e26465d2288fe58a22536522fd4bdf88e3f3ce6a8d83fc104c0095e28ffa9339f0722302f43cc6582a07e0a9cf1809c08ac45fdd320495f16c59
-SHA512 (kata-containers-3.0.1-vendor.tar.gz) = 95878a8260a5f14468a96d020881fb5d05e9b37c7cf886825f1df300ab0e231cc960fa179cc77f9fb967b0cf3f5cb7f2ae1aff63998dae445e718214fd3f8def
+SHA512 (kata-containers-3.23.0.tar.gz) = d921dace40545fab47647c68357d88bf2807b74d5b3546ed0d91416b98fbad4ecaabf449abcc20e34cee8fbcacffe4a66a6012b63815e6b2c60c0319f982cc6e
+SHA512 (kata-containers-3.23.0-vendor.tar.gz) = 484c2dececc31a4fa9d4662f0a0051d52a916728e673396fbb70ab8ef02eb3ac225b815a03e2799aa7bcfe6478dd3ad785c628879914b0b113123f3952795c7b

test-kata-rpm-containerd.sh

@@ -0,0 +1,93 @@
+#!/bin/bash
+set -euo pipefail
+
+# Usage: ./test_kata_rpm_containerd.sh /path/to/kata-containers-*.rpm
+
+RPM_PATH=${1:-}
+
+if [[ -z "$RPM_PATH" ]]; then
+  echo "Usage: $0 /path/to/kata-containers-*.rpm"
+  exit 1
+fi
+
+# 1. Remove existing kata-containers packages and install the RPM
+echo "[1/7] Removing existing kata-containers packages..."
+sudo rpm -e --allmatches kata-containers 2>/dev/null || echo "No existing kata-containers packages to remove"
+
+echo "[2/7] Installing Kata Containers RPM: $RPM_PATH"
+sudo rpm -i "$RPM_PATH"
+
+echo "[3/7] Checking installed binaries and versions..."
+# kata-agent is not expected on the host; it runs inside the Kata VM image.
+if command -v kata-runtime >/dev/null 2>&1; then
+  kata-runtime --version
+else
+  echo "kata-runtime not found in PATH!"; exit 1
+fi
+if command -v kata-ctl >/dev/null 2>&1; then
+  kata-ctl version
+else
+  echo "kata-ctl not found in PATH!"; exit 1
+fi
+
+echo "[4/7] Checking QEMU version..."
+if command -v qemu-system-x86_64 >/dev/null 2>&1; then
+  qemu-system-x86_64 --version
+else
+  echo "qemu-system-x86_64 not found in PATH!"; exit 1
+fi
+
+echo "[5/7] Loading vhost_net kernel module (required for Kata networking)..."
+sudo modprobe vhost_net
+
+# 6. Run kata-runtime check (system compatibility)
+echo "[6/7] Running kata-runtime check (system compatibility)..."
+if ! kata-runtime check; then
+  echo "[ERROR] System is not capable of running Kata Containers."
+  exit 1
+fi
+
+# 7. Run a simple Kata container using containerd (if available)
+echo "[7/7] Attempting to run a test container with Kata runtime (containerd)..."
+if command -v ctr >/dev/null 2>&1; then
+  # Clean up any existing test containers
+  echo "[Test] Cleaning up any existing test containers..."
+  sudo ctr task kill kata-test-bg 2>/dev/null || true
+  sudo ctr task rm kata-test-bg 2>/dev/null || true
+  sudo ctr container rm kata-test-bg 2>/dev/null || true
+
+  sudo ctr images pull docker.io/library/alpine:latest
+  # Start a container in the background (do not use --rm so we can exec into it)
+  sudo ctr run -d --runtime io.containerd.kata.v2 docker.io/library/alpine:latest kata-test-bg sleep 300
+  # Wait a moment for the container to be up
+  sleep 2
+  echo "[Test] Exec into the running container and run 'uname -a'..."
+  sudo ctr task exec --exec-id kata-uname kata-test-bg uname -a
+  echo "[Test] Show /etc/os-release inside the container..."
+  sudo ctr task exec --exec-id kata-osrel kata-test-bg cat /etc/os-release
+
+  echo "[Test] Verify we're running in a Kata VM by checking /proc/cmdline..."
+  HOST_CMDLINE=$(cat /proc/cmdline)
+  GUEST_CMDLINE=$(sudo ctr task exec --exec-id kata-cmdline kata-test-bg cat /proc/cmdline)
+  echo "[Test] Host cmdline: ${HOST_CMDLINE}"
+  echo "[Test] Container cmdline: ${GUEST_CMDLINE}"
+  if [[ "${HOST_CMDLINE}" == "${GUEST_CMDLINE}" ]]; then
+    echo "[ERROR] VM verification: Container cmdline is the same as host - this indicates the container is NOT running in a Kata VM!"
+    exit 1
+  else
+    echo "[SUCCESS] Kata VM isolation is working correctly!"
+  fi
+  # Clean up: kill the task and delete the container
+  echo "[Cleanup] Deleting test container..."
+  sudo ctr task kill kata-test-bg || true
+  sudo ctr task rm kata-test-bg || true
+  sudo ctr container rm kata-test-bg || true
+  # Also run the original test (run+rm)
+  sudo ctr run --runtime io.containerd.kata.v2 --rm docker.io/library/alpine:latest kata-test uname -a || {
+    echo "Failed to run container with Kata runtime."; exit 1;
+  }
+else
+  echo "containerd (ctr) not found, skipping container test."
+fi
+
+echo "All tests completed. If no errors above, the RPM is likely working with containerd."

test-kata-rpm-crio.sh

@@ -0,0 +1,208 @@
+#!/bin/bash
+set -euo pipefail
+
+# Usage: ./test_kata_rpm_crio.sh /path/to/kata-containers-3.20*.rpm
+
+RPM_PATH=${1:-}
+
+if [[ -z "$RPM_PATH" ]]; then
+  echo "Usage: $0 /path/to/kata-containers-*.rpm"
+  exit 1
+fi
+
+# 1. Remove existing kata-containers packages and install the RPM
+echo "[1/7] Removing existing kata-containers packages..."
+sudo rpm -e --allmatches kata-containers 2>/dev/null || echo "No existing kata-containers packages to remove"
+
+echo "[2/7] Installing Kata Containers RPM: $RPM_PATH"
+sudo rpm -i "$RPM_PATH"
+
+echo "[3/7] Checking installed binaries and versions..."
+# kata-agent is not expected on the host; it runs inside the Kata VM image.
+if command -v kata-runtime >/dev/null 2>&1; then
+  kata-runtime --version
+else
+  echo "kata-runtime not found in PATH!"; exit 1
+fi
+if command -v kata-ctl >/dev/null 2>&1; then
+  kata-ctl version
+else
+  echo "kata-ctl not found in PATH!"; exit 1
+fi
+
+echo "[4/7] Checking QEMU version..."
+if command -v qemu-system-x86_64 >/dev/null 2>&1; then
+  qemu-system-x86_64 --version
+else
+  echo "qemu-system-x86_64 not found in PATH!"; exit 1
+fi
+
+echo "[5/7] Loading vhost_net kernel module (required for Kata networking)..."
+sudo modprobe vhost_net
+
+# 6. Run kata-runtime check (system compatibility)
+echo "[6/7] Running kata-runtime check (system compatibility)..."
+if ! kata-runtime check; then
+  echo "[ERROR] System is not capable of running Kata Containers."
+  exit 1
+fi
+
+# 7. Run a simple Kata container using CRI-O (if available)
+echo "[7/7] Attempting to run a test container with Kata runtime (CRI-O)..."
+if command -v crictl >/dev/null 2>&1; then
+  # Check if CRI-O is running, if not try to start it
+  if ! systemctl is-active --quiet crio; then
+    echo "[Test] CRI-O is not running, attempting to start it..."
+    sudo systemctl start crio || {
+      echo "[WARNING] Failed to start CRI-O..."
+      exit 1
+    }
+  fi
+
+  # Configure crictl to use CRI-O instead of containerd
+  echo "[Test] Configuring crictl to use CRI-O..."
+  sudo crictl config --set runtime-endpoint=unix:///var/run/crio/crio.sock
+  sudo crictl config --set image-endpoint=unix:///var/run/crio/crio.sock
+  # Pull the image
+  echo "[Test] Pulling alpine image..."
+  sudo crictl pull docker.io/library/alpine:latest
+
+  # Create temporary pod and container config files
+  echo "[Test] Creating pod and container configurations..."
+
+  # Create pod config (minimal Kata documentation config)
+  cat > /tmp/pod-config.json << 'EOF'
+{
+    "metadata": {
+        "name": "busybox-pod",
+        "uid": "busybox-pod",
+        "namespace": "test.kata"
+    },
+    "hostname": "busybox_host",
+    "log_directory": "",
+    "dns_config": {
+    },
+    "port_mappings": [],
+    "resources": {
+    },
+    "labels": {
+    },
+    "annotations": {
+    },
+    "linux": {
+    }
+}
+EOF
+
+  # Create container config
+  cat > /tmp/container-config.json << 'EOF'
+{
+  "metadata": {
+    "name": "busybox-container"
+  },
+  "image": {
+    "image": "docker.io/library/alpine:latest"
+  },
+  "command": ["sleep", "300"],
+  "linux": {}
+}
+EOF
+
+  # Create pod sandbox
+  echo "[Test] Creating pod sandbox with kata runtime..."
+  POD_ID=$(sudo crictl runp --runtime kata /tmp/pod-config.json 2>/dev/null || echo "")
+  if [[ -z "$POD_ID" ]]; then
+    echo "[Test] Failed to create pod sandbox with Kata runtime"
+    journalctl -g kata
+    echo "[Test] Failed to create pod sandbox with Kata runtime, exiting"
+    exit 1
+  fi
+
+  if [[ -n "$POD_ID" ]]; then
+    echo "[Test] Pod created with ID: $POD_ID, waiting for it to be ready..."
+    # Wait for pod to be ready (up to 30 seconds)
+    for i in {1..30}; do
+      if sudo crictl inspectp $POD_ID >/dev/null 2>&1; then
+        echo "[Test] Pod is ready!"
+        break
+      fi
+      echo "[Test] Waiting for pod to be ready... ($i/30)"
+      sleep 1
+    done
+
+    # Create container
+    echo "[Test] Creating container..."
+    CONTAINER_ID=$(sudo crictl create $POD_ID /tmp/container-config.json /tmp/pod-config.json 2>/dev/null || echo "")
+    if [[ -z "$CONTAINER_ID" ]]; then
+      echo "[Test] Creating container with default runtime..."
+      CONTAINER_ID=$(sudo crictl create $POD_ID /tmp/container-config.json /tmp/pod-config.json 2>/dev/null || echo "")
+    fi
+
+    if [[ -n "$CONTAINER_ID" ]]; then
+      echo "[Test] Container created with ID: $CONTAINER_ID"
+
+      # Start container
+      echo "[Test] Starting container..."
+      if ! sudo crictl start $CONTAINER_ID 2>/dev/null; then
+        # Clean up and retry
+        echo "[Test] Container start failed, cleaning up and retrying..."
+        sudo crictl stop $CONTAINER_ID 2>/dev/null || true
+        sudo crictl rm $CONTAINER_ID 2>/dev/null || true
+        CONTAINER_ID=$(sudo crictl create $POD_ID /tmp/container-config.json /tmp/pod-config.json 2>/dev/null || echo "")
+        if [[ -z "$CONTAINER_ID" ]] || ! sudo crictl start $CONTAINER_ID; then
+          echo "[ERROR] Failed to start container after cleanup"
+          exit 1
+        fi
+      fi
+
+      # Wait a moment for the container to be up
+      sleep 2
+
+      # Execute commands in the container
+      echo "[Test] Exec into the running container and run 'uname -a'..."
+      sudo crictl exec $CONTAINER_ID uname -a || echo "uname command failed"
+
+      echo "[Test] Show /etc/os-release inside the container..."
+      sudo crictl exec $CONTAINER_ID cat /etc/os-release || echo "cat /etc/os-release failed"
+
+      echo "[Test] Verify we're running in a Kata VM by checking /proc/cmdline..."
+      HOST_CMDLINE=$(cat /proc/cmdline)
+      GUEST_CMDLINE=$(sudo crictl exec $CONTAINER_ID cat /proc/cmdline || echo "cat /proc/cmdline command failed")
+      echo "[Test] Host cmdline: ${HOST_CMDLINE}"
+      echo "[Test] Container cmdline: ${GUEST_CMDLINE}"
+      if [[ "${HOST_CMDLINE}" == "${GUEST_CMDLINE}" ]]; then
+          echo "[ERROR] The container is NOT running in a Kata VM!"
+      else
+          echo "[SUCCESS] Kata VM isolation is working correctly!"
+      fi
+
+      # Clean up
+      echo "[Cleanup] Stopping and removing container..."
+      sudo crictl stop $CONTAINER_ID || true
+      sudo crictl rm $CONTAINER_ID || true
+
+      if [[ "${HOST_CMDLINE}" == "${GUEST_CMDLINE}" ]]; then
+          echo "[ERROR] Container was running but not with Kata runtime"
+          exit 1
+      fi
+    else
+      echo "[ERROR] Failed to create container"
+    fi
+
+    # Clean up pod
+    echo "[Cleanup] Removing pod sandbox..."
+    sudo crictl stopp $POD_ID || true
+    sudo crictl rmp $POD_ID || true
+  else
+    echo "[ERROR] Failed to create pod sandbox"
+  fi
+
+  # Clean up temp files
+  rm -f /tmp/pod-config.json /tmp/container-config.json
+
+  echo "[Test] CRI-O container test completed."
+else
+  echo "CRI-O (crictl) not found, skipping container test."
+fi
+
+echo "All tests completed. If no errors above, the RPM is likely working with CRI-O."

vendor-tarball.sh

@@ -0,0 +1,59 @@
+#!/bin/bash
+set -xeuo pipefail
+
+# Kata version
+KATA_VERSION=3.20.0
+RUST_SOURCES_TO_FIX="src/agent src/tools/kata-ctl"
+
+# Original vendor tarball downloaded from upstream
+ORIG_TARBALL="kata-containers-${KATA_VERSION}.tar.gz"
+ORIG_VENDOR_TARBALL="kata-containers-${KATA_VERSION}-vendor.tar.gz"
+TMPDIR="tmp_vendor_extract"
+
+# Build directories for agent and kata-ctl
+RPM_BUILD_DIR="$HOME/rpmbuild/BUILD/kata-containers-${KATA_VERSION}-build/kata-containers-${KATA_VERSION}"
+KATA_AGENT_BUILD_DIR="$RPM_BUILD_DIR/src/agent"
+KATA_CTL_BUILD_DIR="$RPM_BUILD_DIR/src/tools/kata-ctl"
+
+# Extracted directories in the tarball
+KATA_AGENT_EXTRACTED_DIR="$TMPDIR/src/agent"
+KATA_CTL_EXTRACTED_DIR="$TMPDIR/src/tools/kata-ctl"
+
+# 1. Extract the original vendor tarball
+rm -rf "$TMPDIR"
+mkdir -p "$TMPDIR"
+[ -f "$ORIG_VENDOR_TARBALL" ] || wget https://github.com/kata-containers/kata-containers/releases/download/$KATA_VERSION/$ORIG_VENDOR_TARBALL
+
+tar xzf "$ORIG_VENDOR_TARBALL" -C "$TMPDIR"
+
+# 2. Run cargo vendor in both build directories
+mkdir -p $RPM_BUILD_DIR
+[ -f "$ORIG_TARBALL" ] || wget https://github.com/kata-containers/kata-containers/archive/$KATA_VERSION/$ORIG_TARBALL
+tar xzf "$ORIG_TARBALL" -C $RPM_BUILD_DIR/..
+for dir in "$KATA_AGENT_BUILD_DIR" "$KATA_CTL_BUILD_DIR"; do
+    pushd "$dir"
+    cargo vendor
+    popd
+done
+
+# 3. Copy updated vendor and Cargo.lock into the extracted tree for both components
+for src_dir in $RUST_SOURCES_TO_FIX; do
+    BUILD_DIR="$HOME/rpmbuild/BUILD/kata-containers-${KATA_VERSION}-build/kata-containers-${KATA_VERSION}/$src_dir"
+    EXTRACTED_DIR="$TMPDIR/$src_dir"
+    rm -rf "$EXTRACTED_DIR/vendor"
+    cp -a "$BUILD_DIR/vendor" "$EXTRACTED_DIR/"
+    cp "$BUILD_DIR/Cargo.lock" "$EXTRACTED_DIR/"
+done
+
+# 4. Remove stale ext.rs if both ext.rs and ext/mod.rs exist in time crate for both
+for EXTRACTED_DIR in "$KATA_AGENT_EXTRACTED_DIR" "$KATA_CTL_EXTRACTED_DIR"; do
+    TIME_SRC="$EXTRACTED_DIR/vendor/time/src"
+    if [[ -f "$TIME_SRC/ext.rs" && -d "$TIME_SRC/ext" ]]; then
+        rm -f "$TIME_SRC/ext.rs"
+    fi
+done
+
+# 5. Repack the updated vendor tarball
+tar czf "$ORIG_VENDOR_TARBALL" -C "$TMPDIR" .
+
+echo "Updated vendor tarball created: $ORIG_VENDOR_TARBALL"