Release 3.23

Upstream release 3.23 Signed-off-by: Christophe de Dinechin <dinechin@redhat.com>
Bump to Kata Containers 3.22
2025-12-16 11:33:36 +01:00 · 2025-11-03 17:40:14 +01:00 · 2025-11-03 17:12:04 +01:00 · 2025-11-03 17:12:04 +01:00 · 2025-10-11 21:13:42 -05:00 · 2025-10-10 14:42:09 +02:00
11 changed files with 488 additions and 4162 deletions
--- a/.gitignore
+++ b/.gitignore
@ -52,3 +52,26 @@
 /kata-containers-3.11.0.tar.gz
 /kata-containers-3.12.0-vendor.tar.gz
 /kata-containers-3.12.0.tar.gz
+/kata-containers-3.13.0-vendor.tar.gz
+/kata-containers-3.13.0.tar.gz
+/kata-containers-3.14.0-vendor.tar.gz
+/kata-containers-3.14.0.tar.gz
+/kata-containers-3.15.0.tar.gz
+/kata-containers-3.15.0-vendor.tar.gz
+/kata-containers-3.16.0.tar.gz
+/kata-containers-3.16.0-vendor.tar.gz
+/kata-containers-3.16.0-fedora-vendor.tar.gz
+/kata-containers-3.17.0.tar.gz
+/kata-containers-3.17.0-vendor.tar.gz
+/kata-containers-3.18.0.tar.gz
+/kata-containers-3.18.0-vendor.tar.gz
+/kata-containers-3.19.1.tar.gz
+/kata-containers-3.19.1-vendor.tar.gz
+/kata-containers-3.20.0.tar.gz
+/kata-containers-3.20.0-vendor.tar.gz
+/kata-containers-3.21.0.tar.gz
+/kata-containers-3.21.0-vendor.tar.gz
+/kata-containers-3.22.0.tar.gz
+/kata-containers-3.22.0-vendor.tar.gz
+/kata-containers-3.23.0.tar.gz
+/kata-containers-3.23.0-vendor.tar.gz
--- a/1000-Remove-shebang-in-non-executable-completion-script.patch
+++ b/1000-Remove-shebang-in-non-executable-completion-script.patch
@ -1,25 +0,0 @@
-From 1c65024709d7c28bf78b42c59a135df17513d78d Mon Sep 17 00:00:00 2001
-From: Christophe de Dinechin <dinechin@redhat.com>
-Date: Thu, 12 Sep 2019 12:57:39 +0200
-Subject: [PATCH] Remove shebang in non-executable completion script
-
-Raised during package review [1] by rpmlint
-
-[1] https://bugzilla.redhat.com/show_bug.cgi?id=1590425#c8
-
-Signed-off-by: Christophe de Dinechin <dinechin@redhat.com>
---
- src/runtime/data/completions/bash/kata-runtime | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/src/runtime/data/completions/bash/kata-runtime b/src/runtime/data/completions/bash/kata-runtime
-index c293483..58ab978 100644
--- a/src/runtime/data/completions/bash/kata-runtime
-+++ b/src/runtime/data/completions/bash/kata-runtime
-@@ -1,4 +1,3 @@
-#!/usr/bin/env bash
- #
- # Copyright (c) 2018 Intel Corporation
- #
--
-2.21.0
--- a/1001-Remove-warnings-as-compilation-errors.patch
+++ b/1001-Remove-warnings-as-compilation-errors.patch
@ -18,47 +18,41 @@ Signed-off-by: Emanuel Lima <emlima@redhat.com>
 10 files changed, 18 insertions(+), 18 deletions(-)

 diff --git a/src/agent/Makefile b/src/agent/Makefile
-index e62a894aa..39d351213 100644
 --- a/src/agent/Makefile
 +++ b/src/agent/Makefile
-@@ -134,14 +134,14 @@ static-checks-build: $(GENERATED_CODE)
+@@ -120,7 +120,7 @@ static-checks-build: $(GENERATED_CODE)
 $(TARGET): $(GENERATED_CODE) $(TARGET_PATH)
- 
+
 $(TARGET_PATH): show-summary
 -	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo build --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release) $(EXTRA_RUSTFEATURES)
 +	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) " cargo build --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release) $(EXTRA_RUSTFEATURES)
- 
- $(GENERATED_FILES): %: %.in
+
+ $(GENERATED_FILES): %: %.in $(VERSION_FILE)
 	@sed $(foreach r,$(GENERATED_REPLACEMENTS),-e 's|@$r@|$($r)|g') "$<" > "$@"
- 
+@@ -127,7 +127,7 @@ $(GENERATED_FILES): %: %.in $(VERSION_FILE)
+
 ##TARGET optimize: optimized  build
 optimize: show-summary show-header
 -	@RUSTFLAGS="-C link-arg=-s $(EXTRA_RUSTFLAGS) --deny warnings" cargo build --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release) $(EXTRA_RUSTFEATURES)
 +	@RUSTFLAGS="-C link-arg=-s $(EXTRA_RUSTFLAGS) " cargo build --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release) $(EXTRA_RUSTFEATURES)
- 
+
 ##TARGET install: install agent
 install: install-services
+
 diff --git a/src/dragonball/Makefile b/src/dragonball/Makefile
 index 40bb7f915..5eb2c1016 100644
 --- a/src/dragonball/Makefile
 +++ b/src/dragonball/Makefile
-@@ -27,14 +27,14 @@ clippy:
+@@ -27,8 +27,8 @@ clippy:
 	@echo "INFO: cargo clippy..."
 	cargo clippy --all-targets --all-features \
 		-- \
 -		-D warnings
 +
- 
+
 vendor:
 	@echo "INFO: vendor do nothing.."
- 
- format:
- 	@echo "INFO: rust fmt..."
-	# This is kinda dirty step here simply because cargo fmt --all will apply fmt to all dependencies of dragonball which will include /src/libs/protocols with some file generated during compilation time and could not be formatted when you use cargo fmt --all before building the whole project. In order to avoid this problem, we do fmt check in this following way. 
-+	# This is kinda dirty step here simply because cargo fmt --all will apply fmt to all dependencies of dragonball which will include /src/libs/protocols with some file generated during compilation time and could not be formatted when you use cargo fmt --all before building the whole project. In order to avoid this problem, we do fmt check in this following way.
- 	rustfmt --edition 2018 ./src/dbs_address_space/src/lib.rs ./src/dbs_allocator/src/lib.rs ./src/dbs_arch/src/lib.rs ./src/dbs_boot/src/lib.rs ./src/dbs_device/src/lib.rs ./src/dbs_interrupt/src/lib.rs ./src/dbs_legacy_devices/src/lib.rs ./src/dbs_pci/src/lib.rs ./src/dbs_upcall/src/lib.rs ./src/dbs_utils/src/lib.rs ./src/dbs_virtio_devices/src/lib.rs ./src/lib.rs --check
- 
- clean:
+
 diff --git a/src/libs/Makefile b/src/libs/Makefile
 index aabaa3391..1fb6b20c3 100644
 --- a/src/libs/Makefile
@ -69,144 +63,142 @@ index aabaa3391..1fb6b20c3 100644
 		-- \
 -		-D warnings
 +
- 
+
 format:
 	@echo "INFO: cargo fmt..."
 diff --git a/src/runtime-rs/Makefile b/src/runtime-rs/Makefile
-index 0bb0617ff..188040864 100644
 --- a/src/runtime-rs/Makefile
 +++ b/src/runtime-rs/Makefile
-@@ -580,7 +580,7 @@ static-checks-build: $(GENERATED_FILES)
+@@ -658,7 +658,7 @@ static-checks-build: $(GENERATED_FILES)
 $(TARGET): $(GENERATED_FILES) $(TARGET_PATH)
- 
+
 $(TARGET_PATH): $(SOURCES) | show-summary
 -	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo build --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release) $(EXTRA_RUSTFEATURES)
 +	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) " cargo build --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release) $(EXTRA_RUSTFEATURES)
- 
+
 $(GENERATED_FILES): %: %.in
 	@sed \
-@@ -590,7 +590,7 @@ $(GENERATED_FILES): %: %.in
- 
+@@ -668,7 +668,7 @@ $(GENERATED_FILES): %: %.in
+
 ##TARGET optimize: optimized  build
 optimize: $(SOURCES) | show-summary show-header
 -	@RUSTFLAGS="-C link-arg=-s $(EXTRA_RUSTFLAGS) --deny warnings" cargo build --target $(TRIPLE) --$(BUILD_TYPE) $(EXTRA_RUSTFEATURES)
 +	@RUSTFLAGS="-C link-arg=-s $(EXTRA_RUSTFLAGS) " cargo build --target $(TRIPLE) --$(BUILD_TYPE) $(EXTRA_RUSTFEATURES)
- 
+
 ##TARGET clean: clean build
 clean: clean-generated-files
 diff --git a/src/tools/agent-ctl/Makefile b/src/tools/agent-ctl/Makefile
 index a49f88e6b..855017db4 100644
 --- a/src/tools/agent-ctl/Makefile
 +++ b/src/tools/agent-ctl/Makefile
-@@ -13,7 +13,7 @@ endif
+@@ -9,7 +9,7 @@ endif
 default: build
- 
+
 build:
 -	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo build --target $(TRIPLE) --$(BUILD_TYPE)
 +	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) " cargo build --target $(TRIPLE) --$(BUILD_TYPE)
- 
+
 static-checks-build:
 	@echo "INFO: static-checks-build do nothing.."
-@@ -27,7 +27,7 @@ vendor:
+@@ -23,7 +23,7 @@ vendor:
 test:
- 
+
 install:
 -	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo install --locked --target $(TRIPLE) --path .
 +	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) " cargo install --locked --target $(TRIPLE) --path .
- 
+
 check: standard_rust_check
- 
+
 diff --git a/src/tools/genpolicy/Makefile b/src/tools/genpolicy/Makefile
 index 7410e20ed..b33541467 100644
 --- a/src/tools/genpolicy/Makefile
 +++ b/src/tools/genpolicy/Makefile
-@@ -28,7 +28,7 @@ $(GENERATED_FILES): %: %.in
+@@ -24,7 +24,7 @@ $(GENERATED_FILES): %: %.in
 default: build
- 
+
 build: $(GENERATED_FILES)
-	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo build --target $(TRIPLE) --$(BUILD_TYPE)
-+	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) " cargo build --target $(TRIPLE) --$(BUILD_TYPE)
- 
+-	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo build --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release)
+	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) " cargo build --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release)
+
 static-checks-build:
 	@echo "INFO: static-checks-build do nothing.."
-@@ -41,10 +41,10 @@ vendor:
+@@ -37,10 +37,10 @@ vendor:
 	cargo vendor
- 
+
 test: $(GENERATED_FILES)
 -	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo test --all-targets --all-features --target $(TRIPLE)
 +	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) " cargo test --all-targets --all-features --target $(TRIPLE)
- 
+
 install: $(GENERATED_FILES)
 -	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo install --locked --target $(TRIPLE) --path .
 +	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) " cargo install --locked --target $(TRIPLE) --path .
- 
+
 check:  $(GENERATED_CODE) standard_rust_check
- 
+
 diff --git a/src/tools/kata-ctl/Makefile b/src/tools/kata-ctl/Makefile
 index 7595c0c23..05d171f5a 100644
 --- a/src/tools/kata-ctl/Makefile
 +++ b/src/tools/kata-ctl/Makefile
@@ -43,7 +43,7 @@ default: $(TARGET) build
 $(TARGET): $(GENERATED_CODE)
- 
+
 build:
 -	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo build --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release) $(EXTRA_RUSTFEATURES)
 +	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) " cargo build --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release) $(EXTRA_RUSTFEATURES)
- 
+
 static-checks-build: $(GENERATED_CODE)
- 
+
@@ -59,10 +59,10 @@ vendor:
 	cargo vendor
- 
+
 test: $(GENERATED_CODE)
 -	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo test --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release) $(EXTRA_RUSTFEATURES) -- --nocapture
 +	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) " cargo test --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release) $(EXTRA_RUSTFEATURES) -- --nocapture
- 
+
 install:
 -	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo install --locked --target $(TRIPLE) --path . --root $(INSTALL_PATH)
 +	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) " cargo install --locked --target $(TRIPLE) --path . --root $(INSTALL_PATH)
- 
+
 check: $(GENERATED_CODE) standard_rust_check
- 
+
 diff --git a/src/tools/runk/Makefile b/src/tools/runk/Makefile
 index 186955679..b23cab145 100644
 --- a/src/tools/runk/Makefile
 +++ b/src/tools/runk/Makefile
-@@ -36,7 +36,7 @@ endif
+@@ -32,7 +32,7 @@ endif
 default: build
- 
+
 build:
 -	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo build --target $(TRIPLE) --$(BUILD_TYPE) $(EXTRA_RUSTFEATURES)
 +	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) " cargo build --target $(TRIPLE) --$(BUILD_TYPE) $(EXTRA_RUSTFEATURES)
- 
+
 static-checks-build:
 	@echo "INFO: static-checks-build do nothing.."
 diff --git a/src/tools/trace-forwarder/Makefile b/src/tools/trace-forwarder/Makefile
 index 5d9f71856..bf6b80a54 100644
 --- a/src/tools/trace-forwarder/Makefile
 +++ b/src/tools/trace-forwarder/Makefile
-@@ -13,7 +13,7 @@ endif
+@@ -9,7 +9,7 @@ endif
 default: build
- 
+
 build:
 -	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo build --target $(TRIPLE) --$(BUILD_TYPE)
 +	@RUSTFLAGS="$(EXTRA_RUSTFLAGS) " cargo build --target $(TRIPLE) --$(BUILD_TYPE)
- 
+
 static-checks-build:
 	@echo "INFO: static-checks-build do nothing.."
 diff --git a/utils.mk b/utils.mk
 index 1a153e26c..4edba5524 100644
 --- a/utils.mk
 +++ b/utils.mk
-@@ -176,7 +176,7 @@ standard_rust_check:
+@@ -183,7 +183,7 @@ standard_rust_check:
 	cargo fmt -- --check
 	cargo clippy --all-targets --all-features --release \
 		-- \
 -		-D warnings
 +
- 
+
 # Install a file (full version).
 #
-- 
+--
 2.47.1
-
--- a/1002-Bump-time-dependency-for-Kata.patch
+++ b/1002-Bump-time-dependency-for-Kata.patch
--- a/1003-Fix-arch-name-compilation-failure.patch
+++ b/1003-Fix-arch-name-compilation-failure.patch
@ -1,491 +0,0 @@
-From 7cca06342688f838f1b5c13d5f8fb8800e55f0d9 Mon Sep 17 00:00:00 2001
-From: Emanuel Lima <emlima@redhat.com>
-Date: Mon, 6 Jan 2025 16:18:26 -0300
-Subject: [PATCH] Fix arch name compilation failure
-
-Signed-off-by: Christophe de Dinechin <dinechin@redhat.com>
-[emlima: fix some more occurences and typos]
-Signed-off-by: Emanuel Lima <emlima@redhat.com>
---
- docs/Developer-Guide.md                              |  8 ++++----
- src/agent/Makefile                                   |  2 +-
- src/libs/kata-sys-util/src/protection.rs             |  4 ++--
- src/runtime-rs/Makefile                              |  4 ++--
- src/tools/agent-ctl/Makefile                         |  2 +-
- src/tools/genpolicy/Makefile                         |  2 +-
- src/tools/kata-ctl/Cross.toml                        |  2 +-
- src/tools/kata-ctl/src/arch/mod.rs                   | 10 +++++-----
- src/tools/kata-ctl/src/arch/powerpc64le/mod.rs       |  4 ++--
- src/tools/runk/Makefile                              |  2 +-
- src/tools/trace-forwarder/Makefile                   |  2 +-
- tests/common.bash                                    |  4 ++--
- tests/install_rust.sh                                |  2 +-
- tests/kata-arch.sh                                   |  2 +-
- tools/osbuilder/rootfs-builder/ubuntu/Dockerfile.in  |  4 ++--
- tools/osbuilder/rootfs-builder/ubuntu/config.sh      |  2 +-
- tools/osbuilder/scripts/lib.sh                       |  2 +-
- tools/packaging/scripts/configure-hypervisor.sh      |  2 +-
- tools/packaging/static-build/agent/Dockerfile        |  2 +-
- .../static-build/coco-guest-components/Dockerfile    |  2 +-
- tools/packaging/static-build/qemu/Dockerfile         |  3 +--
- tools/packaging/static-build/shim-v2/Dockerfile      | 12 ++++++------
- tools/packaging/static-build/shim-v2/build.sh        |  2 +-
- .../packaging/static-build/virtiofsd/gnu/Dockerfile  |  2 +-
- .../packaging/static-build/virtiofsd/musl/Dockerfile |  2 +-
- utils.mk                                             |  2 +-
- 26 files changed, 43 insertions(+), 44 deletions(-)
-
-diff --git a/docs/Developer-Guide.md b/docs/Developer-Guide.md
-index dcb88d49a..14928ea0a 100644
--- a/docs/Developer-Guide.md
-+++ b/docs/Developer-Guide.md
-@@ -239,7 +239,7 @@ The agent is built with a statically linked `musl.` The default `libc` used is `
- ```bash
- $ export ARCH="$(uname -m)"
- $ if [ "$ARCH" = "ppc64le" -o "$ARCH" = "s390x" ]; then export LIBC=gnu; else export LIBC=musl; fi
-$ [ "${ARCH}" == "ppc64le" ] && export ARCH=powerpc64le
-+$ [ "${ARCH}" == "ppc64le" ] && export ARCH=powerpc64
- $ rustup target add "${ARCH}-unknown-linux-${LIBC}"
- ```
- 
-@@ -268,7 +268,7 @@ to install `libseccomp` for the agent.
- 
- ```bash
- $ mkdir -p ${seccomp_install_path} ${gperf_install_path}
-$ pushd kata-containers/ci 
-+$ pushd kata-containers/ci
- $ script -fec 'sudo -E ./install_libseccomp.sh ${seccomp_install_path} ${gperf_install_path}"'
- $ export LIBSECCOMP_LIB_PATH="${seccomp_install_path}/lib"
- $ popd
-@@ -415,11 +415,11 @@ $ script -fec 'sudo -E AGENT_INIT=yes USE_DOCKER=true SECCOMP=no ./rootfs.sh "${
- > - Check the [compatibility matrix](../tools/osbuilder/README.md#platform-distro-compatibility-matrix) before creating rootfs.
- 
- Optionally, add your custom agent binary to the rootfs with the following commands. The default `$LIBC` used
-is `musl`, but on ppc64le and s390x, `gnu` should be used. Also, Rust refers to ppc64le as `powerpc64le`:
-+is `musl`, but on ppc64le and s390x, `gnu` should be used. Also, Rust refers to ppc64le as `powerpc64`:
- ```bash
- $ export ARCH="$(uname -m)"
- $ [ "${ARCH}" == "ppc64le" ] || [ "${ARCH}" == "s390x" ] && export LIBC=gnu || export LIBC=musl
-$ [ "${ARCH}" == "ppc64le" ] && export ARCH=powerpc64le
-+$ [ "${ARCH}" == "ppc64le" ] && export ARCH=powerpc64
- $ sudo install -o root -g root -m 0550 -T "${ROOTFS_DIR}/../../../../src/agent/target/${ARCH}-unknown-linux-${LIBC}/release/kata-agent" "${ROOTFS_DIR}/sbin/init"
- ```
- 
-diff --git a/src/agent/Makefile b/src/agent/Makefile
-index 39d351213..1f818ebaf 100644
--- a/src/agent/Makefile
-+++ b/src/agent/Makefile
-@@ -54,7 +54,7 @@ endif
- include ../../utils.mk
- 
- ifeq ($(ARCH), ppc64le)
-    override ARCH = powerpc64le
-+    override ARCH = powerpc64
- endif
- 
- ##VAR STANDARD_OCI_RUNTIME=yes|no define if agent enables standard oci runtime feature
-diff --git a/src/libs/kata-sys-util/src/protection.rs b/src/libs/kata-sys-util/src/protection.rs
-index 74ccd5006..dba40a5d5 100644
--- a/src/libs/kata-sys-util/src/protection.rs
-+++ b/src/libs/kata-sys-util/src/protection.rs
-@@ -14,7 +14,7 @@ use std::path::Path;
- use std::path::PathBuf;
- use thiserror::Error;
- 
-#[cfg(any(target_arch = "s390x", target_arch = "powerpc64le"))]
-+#[cfg(any(target_arch = "s390x", target_arch = "powerpc64"))]
- use nix::unistd::Uid;
- 
- #[cfg(target_arch = "x86_64")]
-@@ -234,7 +234,7 @@ pub fn available_guest_protection() -> Result<GuestProtection, ProtectionError>
-     Ok(GuestProtection::Se)
- }
- 
-#[cfg(target_arch = "powerpc64le")]
-+#[cfg(target_arch = "powerpc64")]
- pub fn available_guest_protection() -> Result<check::GuestProtection, check::ProtectionError> {
-     if !Uid::effective().is_root() {
-         return Err(check::ProtectionError::NoPerms);
-diff --git a/src/runtime-rs/Makefile b/src/runtime-rs/Makefile
-index 188040864..46912d480 100644
--- a/src/runtime-rs/Makefile
-+++ b/src/runtime-rs/Makefile
-@@ -18,7 +18,7 @@ CONTAINERD_RUNTIME_NAME = io.containerd.kata.v2
- include ../../utils.mk
- 
- ifeq ($(ARCH), ppc64le)
-    override ARCH = powerpc64le
-+    override ARCH = powerpc64
- endif
- 
- ARCH_DIR = arch
-@@ -31,7 +31,7 @@ test:
- 	@echo "s390x is not currently supported"
- 	exit 0
- install: install-runtime install-configs
-else ifeq ($(ARCH), powerpc64le)
-+else ifeq ($(ARCH), powerpc64)
- default:
- 	@echo "PowerPC 64 LE is not currently supported"
- 	exit 0
-diff --git a/src/tools/agent-ctl/Makefile b/src/tools/agent-ctl/Makefile
-index 855017db4..cf168e862 100644
--- a/src/tools/agent-ctl/Makefile
-+++ b/src/tools/agent-ctl/Makefile
-@@ -6,7 +6,7 @@
- include ../../../utils.mk
- 
- ifeq ($(ARCH), ppc64le)
-     override ARCH = powerpc64le
-+     override ARCH = powerpc64
- endif
- 
- .DEFAULT_GOAL := default
-diff --git a/src/tools/genpolicy/Makefile b/src/tools/genpolicy/Makefile
-index b33541467..f1b4b754a 100644
--- a/src/tools/genpolicy/Makefile
-+++ b/src/tools/genpolicy/Makefile
-@@ -7,7 +7,7 @@
- include ../../../utils.mk
- 
- ifeq ($(ARCH), ppc64le)
-     override ARCH = powerpc64le
-+     override ARCH = powerpc64
-  endif
- 
- COMMIT_HASH := $(shell git rev-parse HEAD 2>/dev/null || true)
-diff --git a/src/tools/kata-ctl/Cross.toml b/src/tools/kata-ctl/Cross.toml
-index 88f18e96e..e07b885a8 100644
--- a/src/tools/kata-ctl/Cross.toml
-+++ b/src/tools/kata-ctl/Cross.toml
-@@ -8,5 +8,5 @@ pre-build = ["dpkg --add-architecture arm64 && apt-get update && apt-get install
- pre-build = ["dpkg --add-architecture amd64 && apt-get update && apt-get install -y libssl-dev:amd64"]
- 
- # Powerpc compile seems to be broken, due to `ring` crate not being supported on powerpc.
-[target.powerpc64le-unknown-linux-gnu]
-+[target.powerpc64-unknown-linux-gnu]
- pre-build = ["dpkg --add-architecture ppc64le && apt-get update && apt-get install -y libssl-dev:ppc64le"]
-diff --git a/src/tools/kata-ctl/src/arch/mod.rs b/src/tools/kata-ctl/src/arch/mod.rs
-index b0010955d..aa6a527ff 100644
--- a/src/tools/kata-ctl/src/arch/mod.rs
-+++ b/src/tools/kata-ctl/src/arch/mod.rs
-@@ -8,10 +8,10 @@ pub mod aarch64;
- #[cfg(target_arch = "aarch64")]
- pub use aarch64 as arch_specific;
- 
-#[cfg(target_arch = "powerpc64le")]
-pub mod powerpc64le;
-#[cfg(target_arch = "powerpc64le")]
-pub use powerpc64le as arch_specific;
-+#[cfg(target_arch = "powerpc64")]
-+pub mod powerpc64;
-+#[cfg(target_arch = "powerpc64")]
-+pub use powerpc64 as arch_specific;
- 
- #[cfg(target_arch = "s390x")]
- pub mod s390x;
-@@ -25,7 +25,7 @@ pub use x86_64 as arch_specific;
- 
- #[cfg(not(any(
-     target_arch = "aarch64",
-    target_arch = "powerpc64le",
-+    target_arch = "powerpc64",
-     target_arch = "s390x",
-     target_arch = "x86_64"
- )))]
-diff --git a/src/tools/kata-ctl/src/arch/powerpc64le/mod.rs b/src/tools/kata-ctl/src/arch/powerpc64le/mod.rs
-index bf5822c04..dbd09e651 100644
--- a/src/tools/kata-ctl/src/arch/powerpc64le/mod.rs
-+++ b/src/tools/kata-ctl/src/arch/powerpc64le/mod.rs
-@@ -4,7 +4,7 @@
- //
- 
- use crate::types::*;
-#[cfg(target_arch = "powerpc64le")]
-+#[cfg(target_arch = "powerpc64")]
- pub use arch_specific::*;
- 
- mod arch_specific {
-@@ -16,7 +16,7 @@ mod arch_specific {
-     pub const ARCH_CPU_MODEL_FIELD: &str = "model";
- 
-     pub fn check() -> Result<()> {
-        unimplemented!("Check not implemented in powerpc64le");
-+        unimplemented!("Check not implemented in powerpc64");
-     }
- 
-     pub fn get_checks() -> Option<&'static [CheckItem<'static>]> {
-diff --git a/src/tools/runk/Makefile b/src/tools/runk/Makefile
-index b23cab145..af85ba6d6 100644
--- a/src/tools/runk/Makefile
-+++ b/src/tools/runk/Makefile
-@@ -9,7 +9,7 @@ LIBC ?= gnu
- include ../../../utils.mk
- 
- ifeq ($(ARCH), ppc64le)
-     override ARCH = powerpc64le
-+     override ARCH = powerpc64
- endif
- 
- TARGET = runk
-diff --git a/src/tools/trace-forwarder/Makefile b/src/tools/trace-forwarder/Makefile
-index bf6b80a54..81de556c7 100644
--- a/src/tools/trace-forwarder/Makefile
-+++ b/src/tools/trace-forwarder/Makefile
-@@ -6,7 +6,7 @@
- include ../../../utils.mk
- 
- ifeq ($(ARCH), ppc64le)
-     override ARCH = powerpc64le
-+     override ARCH = powerpc64
- endif
- 
- .DEFAULT_GOAL := default
-diff --git a/tests/common.bash b/tests/common.bash
-index ca8b59bbf..78f894287 100644
--- a/tests/common.bash
-+++ b/tests/common.bash
-@@ -601,7 +601,7 @@ function clone_cri_containerd() {
- # version: the version of the tarball that will be downloaded
- # tarball-name: the name of the tarball that will be downloaded
- function download_github_project_tarball() {
-	project="${1}" 
-+	project="${1}"
- 	version="${2}"
- 	tarball_name="${3}"
- 
-@@ -752,7 +752,7 @@ function arch_to_rust() {
- 
- 	case "${arch}" in
- 		aarch64) echo "${arch}";;
-		ppc64le) echo "powerpc64le";;
-+		ppc64le) echo "powerpc64";;
- 		x86_64) echo "${arch}";;
- 		s390x) echo "${arch}";;
- 		*) die "unsupported architecture: ${arch}";;
-diff --git a/tests/install_rust.sh b/tests/install_rust.sh
-index b44b94be7..08ae157e0 100755
--- a/tests/install_rust.sh
-+++ b/tests/install_rust.sh
-@@ -35,7 +35,7 @@ export PATH="${PATH}:${HOME}/.cargo/bin"
- ## this command will not take too long to run.
- rustup toolchain install ${version}
- rustup default ${version}
-if [ "${rustarch}" == "powerpc64le" ] || [ "${rustarch}" == "s390x" ] ; then
-+if [ "${rustarch}" == "powerpc64" ] || [ "${rustarch}" == "s390x" ] ; then
- 	rustup target add ${rustarch}-unknown-linux-gnu
- else
- 	rustup target add ${rustarch}-unknown-linux-musl
-diff --git a/tests/kata-arch.sh b/tests/kata-arch.sh
-index 38146ef72..1a6643fe0 100755
--- a/tests/kata-arch.sh
-+++ b/tests/kata-arch.sh
-@@ -46,7 +46,7 @@ function arch_to_rust() {
- 	local arch="$1"
- 
- 	if [ "${arch}" == "ppc64le" ]; then
-		arch="powerpc64le"
-+		arch="powerpc64"
- 	fi
- 
- 	echo "${arch}"
-diff --git a/tools/osbuilder/rootfs-builder/ubuntu/Dockerfile.in b/tools/osbuilder/rootfs-builder/ubuntu/Dockerfile.in
-index d67bceb99..6ea7e3d23 100644
--- a/tools/osbuilder/rootfs-builder/ubuntu/Dockerfile.in
-+++ b/tools/osbuilder/rootfs-builder/ubuntu/Dockerfile.in
-@@ -33,7 +33,7 @@ RUN apt-get update && \
-     $(gcc_arch="@ARCH@" && [ "$(uname -m)" != "$gcc_arch" ] && ( \
-          libc_arch="$gcc_arch" && \
-          [ "$gcc_arch" = aarch64 ] && libc_arch=arm64; \
-         [ "$gcc_arch" = ppc64le ] && gcc_arch=powerpc64le && libc_arch=ppc64el; \
-+         [ "$gcc_arch" = ppc64le ] && gcc_arch=powerpc64 && libc_arch=ppc64el; \
-          [ "$gcc_arch" = s390x ] && gcc_arch=s390x && libc_arch=s390x; \
-          [ "$gcc_arch" = x86_64 ] && gcc_arch=x86-64 && libc_arch=amd64; \
-          echo "gcc-$gcc_arch-linux-gnu libc6-dev-$libc_arch-cross")) \
-@@ -77,7 +77,7 @@ RUN ARCH=$(uname -m); \
-     libc=""; \
-     case "${ARCH}" in \
-         "aarch64") rust_arch="${ARCH}"; libc="musl"; ;; \
-        "ppc64le") rust_arch="powerpc64le"; libc="gnu"; ;; \
-+        "ppc64le") rust_arch="powerpc64"; libc="gnu"; ;; \
-         "x86_64") rust_arch="${ARCH}"; libc="musl"; ;; \
-         "s390x") rust_arch="${ARCH}"; libc="gnu"; ;; \
-         *) echo "Unsupported architecture: ${ARCH}" && exit 1 ;; \
-diff --git a/tools/osbuilder/rootfs-builder/ubuntu/config.sh b/tools/osbuilder/rootfs-builder/ubuntu/config.sh
-index 356505527..e9ff5c105 100644
--- a/tools/osbuilder/rootfs-builder/ubuntu/config.sh
-+++ b/tools/osbuilder/rootfs-builder/ubuntu/config.sh
-@@ -22,7 +22,7 @@ esac
- 
- if [ "$(uname -m)" != "$ARCH" ]; then
- 	case "$ARCH" in
-		ppc64le) cc_arch=powerpc64le;;
-+		ppc64le) cc_arch=powerpc64;;
- 		x86_64) cc_arch=x86-64;;
- 		*) cc_arch="$ARCH"
- 	esac
-diff --git a/tools/osbuilder/scripts/lib.sh b/tools/osbuilder/scripts/lib.sh
-index 5e3687595..670e58c24 100644
--- a/tools/osbuilder/scripts/lib.sh
-+++ b/tools/osbuilder/scripts/lib.sh
-@@ -221,7 +221,7 @@ generate_dockerfile()
- 	[ -d "${dir}" ] || die "${dir}: not a directory"
- 
- 	local rustarch="$ARCH"
-	[ "$ARCH" = ppc64le ] && rustarch=powerpc64le
-+	[ "$ARCH" = ppc64le ] && rustarch=powerpc64
- 
- 	[ -n "${http_proxy:-}" ] && readonly set_proxy="RUN sed -i '$ a proxy="${http_proxy:-}"' /etc/dnf/dnf.conf /etc/yum.conf; true"
- 
-diff --git a/tools/packaging/scripts/configure-hypervisor.sh b/tools/packaging/scripts/configure-hypervisor.sh
-index 73f51817b..6e948d183 100755
--- a/tools/packaging/scripts/configure-hypervisor.sh
-+++ b/tools/packaging/scripts/configure-hypervisor.sh
-@@ -213,7 +213,7 @@ generate_qemu_options() {
- 	if [ $arch != $host ];then
- 		case $arch in
- 			aarch64) qemu_options+=(size:--cross-prefix=aarch64-linux-gnu-);;
-			ppc64le) qemu_options+=(size:--cross-prefix=powerpc64le-linux-gnu-);;
-+			ppc64le) qemu_options+=(size:--cross-prefix=powerpc64-linux-gnu-);;
- 			s390x) exit;;
- 			x86_64);;
- 			*) exit;;
-diff --git a/tools/packaging/static-build/agent/Dockerfile b/tools/packaging/static-build/agent/Dockerfile
-index fed801d94..5fc9f1201 100644
--- a/tools/packaging/static-build/agent/Dockerfile
-+++ b/tools/packaging/static-build/agent/Dockerfile
-@@ -45,7 +45,7 @@ RUN ARCH=$(uname -m); \
- 	libc=""; \
-     	case "${ARCH}" in \
- 	        "aarch64") rust_arch="${ARCH}"; libc="musl" ;; \
-	        "ppc64le") rust_arch="powerpc64le"; libc="gnu" ;; \
-+	        "ppc64le") rust_arch="powerpc64"; libc="gnu" ;; \
- 	        "x86_64") rust_arch="${ARCH}"; libc="musl" ;; \
- 	        "s390x") rust_arch="${ARCH}"; libc="gnu" ;; \
- 	        *) echo "Unsupported architecture: ${ARCH}" && exit 1 ;; \
-diff --git a/tools/packaging/static-build/coco-guest-components/Dockerfile b/tools/packaging/static-build/coco-guest-components/Dockerfile
-index d5fcedb05..1b7054f31 100644
--- a/tools/packaging/static-build/coco-guest-components/Dockerfile
-+++ b/tools/packaging/static-build/coco-guest-components/Dockerfile
-@@ -48,7 +48,7 @@ RUN ARCH=$(uname -m); \
- 	rust_arch=""; \
-     	case "${ARCH}" in \
- 	        "aarch64") rust_arch="${ARCH}" ;; \
-	        "ppc64le") rust_arch="powerpc64le" ;; \
-+	        "ppc64le") rust_arch="powerpc64" ;; \
- 	        "x86_64") rust_arch="${ARCH}" ;; \
- 	        "s390x") rust_arch="${ARCH}" ;; \
- 	        *) echo "Unsupported architecture: ${ARCH}" && exit 1 ;; \
-diff --git a/tools/packaging/static-build/qemu/Dockerfile b/tools/packaging/static-build/qemu/Dockerfile
-index 7a910958f..2560fc7da 100644
--- a/tools/packaging/static-build/qemu/Dockerfile
-+++ b/tools/packaging/static-build/qemu/Dockerfile
-@@ -67,7 +67,6 @@ RUN apt-get update && apt-get upgrade -y && \
- 	    rsync \
- 	    zlib1g-dev${DPKG_ARCH} && \
-     if [ "${ARCH}" != s390x ]; then apt-get install -y --no-install-recommends libpmem-dev${DPKG_ARCH}; fi && \
-    GCC_ARCH="${ARCH}" && if [ "${ARCH}" = "ppc64le" ]; then GCC_ARCH="powerpc64le"; fi && \
-+    GCC_ARCH="${ARCH}" && if [ "${ARCH}" = "ppc64le" ]; then GCC_ARCH="powerpc64"; fi && \
-     if [ "${ARCH}" != "$(uname -m)" ]; then apt-get install --no-install-recommends -y gcc-"${GCC_ARCH}"-linux-gnu; fi && \
-     apt-get clean && rm -rf /var/lib/apt/lists/
-
-diff --git a/tools/packaging/static-build/shim-v2/Dockerfile b/tools/packaging/static-build/shim-v2/Dockerfile
-index 808f24346..cc3930e1f 100644
--- a/tools/packaging/static-build/shim-v2/Dockerfile
-+++ b/tools/packaging/static-build/shim-v2/Dockerfile
-@@ -6,7 +6,7 @@ FROM ubuntu:20.04
- ENV DEBIAN_FRONTEND=noninteractive
- 
- ENV GO_HOME="/opt"
-ENV GOCACHE="${GO_HOME}/.cache" 
-+ENV GOCACHE="${GO_HOME}/.cache"
- ENV RUSTUP_HOME="/opt/rustup"
- ENV CARGO_HOME="/opt/cargo"
- ENV PATH="/opt/cargo/bin/:/opt/go/bin:${PATH}"
-@@ -32,19 +32,19 @@ RUN apt-get update && \
-         sudo && \
-         apt-get clean && rm -rf /var/lib/apt/lists/&& \
-         curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain ${RUST_VERSION}
-    
-+
- RUN ARCH=$(uname -m); \
-    	rust_arch=""; \
-    	libc=""; \
-    	case "${ARCH}" in \
-         "aarch64") rust_arch="${ARCH}"; libc="musl"; ;; \
-        "ppc64le") rust_arch="powerpc64le"; libc="gnu"; ;; \
-+        "ppc64le") rust_arch="powerpc64"; libc="gnu"; ;; \
-         "x86_64") rust_arch="${ARCH}"; libc="musl"; ;; \
-         "s390x") rust_arch="${ARCH}"; libc="gnu"; ;; \
-         *) echo "Unsupported architecture: ${ARCH}" && exit 1 ;; \
-   	esac; \
-   	rustup target add "${rust_arch}-unknown-linux-${libc}" 
-        
-+   	rustup target add "${rust_arch}-unknown-linux-${libc}"
-+
- RUN ARCH=$(uname -m); \
-     goarch=""; \
-     kernelname=$(uname -s | tr '[:upper:]' '[:lower:]'); \
-@@ -58,6 +58,6 @@ RUN ARCH=$(uname -m); \
-     curl -OL "https://storage.googleapis.com/golang/go${GO_VERSION}.${kernelname}-${goarch}.tar.gz" && \
-     tar -C "${GO_HOME}" -xzf "go${GO_VERSION}.${kernelname}-${goarch}.tar.gz" && \
-     rm "go${GO_VERSION}.${kernelname}-${goarch}.tar.gz"
-        
-+
- # aarch64 requires this name -- link for all
- RUN ln -s /usr/bin/musl-gcc "/usr/bin/$(uname -m)-linux-musl-gcc"
-diff --git a/tools/packaging/static-build/shim-v2/build.sh b/tools/packaging/static-build/shim-v2/build.sh
-index 3944b0928..8fa9013d8 100755
--- a/tools/packaging/static-build/shim-v2/build.sh
-+++ b/tools/packaging/static-build/shim-v2/build.sh
-@@ -49,7 +49,7 @@ docker pull ${container_image} || \
- arch=${ARCH:-$(uname -m)}
- GCC_ARCH=${arch}
- if [ ${arch} = "ppc64le" ]; then
-	GCC_ARCH="powerpc64le"
-+	GCC_ARCH="powerpc64"
- 	arch="ppc64"
- fi
- 
-diff --git a/tools/packaging/static-build/virtiofsd/gnu/Dockerfile b/tools/packaging/static-build/virtiofsd/gnu/Dockerfile
-index b0cd97584..9f155e8fc 100644
--- a/tools/packaging/static-build/virtiofsd/gnu/Dockerfile
-+++ b/tools/packaging/static-build/virtiofsd/gnu/Dockerfile
-@@ -33,7 +33,7 @@ RUN ARCH=$(uname -m); \
-     	extra_rust_flags=" -C link-self-contained=yes"; \
-        	case "${ARCH}" in \
-             "aarch64") rust_arch="${ARCH}"; libc="musl"; arch_libc="" ;; \
-            "ppc64le") rust_arch="powerpc64le"; libc="gnu"; arch_libc=${rust_arch}-linux-${libc}; extra_rust_flags="" ;; \
-+            "ppc64le") rust_arch="powerpc64"; libc="gnu"; arch_libc=${rust_arch}-linux-${libc}; extra_rust_flags="" ;; \
-             "x86_64") rust_arch="${ARCH}"; libc="musl"; arch_libc="" ;; \
-             "s390x") rust_arch="${ARCH}"; libc="gnu"; arch_libc=${rust_arch}-linux-${libc}; extra_rust_flags="" ;; \
-             *) echo "Unsupported architecture: ${ARCH}" && exit 1 ;; \
-diff --git a/tools/packaging/static-build/virtiofsd/musl/Dockerfile b/tools/packaging/static-build/virtiofsd/musl/Dockerfile
-index 270aadf52..85e3db10f 100644
--- a/tools/packaging/static-build/virtiofsd/musl/Dockerfile
-+++ b/tools/packaging/static-build/virtiofsd/musl/Dockerfile
-@@ -30,7 +30,7 @@ RUN ARCH=$(uname -m); \
-     	extra_rust_flags=" -C link-self-contained=yes"; \
-         	case "${ARCH}" in \
-     	        "aarch64") rust_arch="${ARCH}"; libc="musl"; arch_libc="" ;; \
-    	        "ppc64le") rust_arch="powerpc64le"; libc="gnu"; arch_libc=${rust_arch}-linux-${libc}; extra_rust_flags="" ;; \
-+    	        "ppc64le") rust_arch="powerpc64"; libc="gnu"; arch_libc=${rust_arch}-linux-${libc}; extra_rust_flags="" ;; \
-     	        "x86_64") rust_arch="${ARCH}"; libc="musl"; arch_libc="" ;; \
-     	        "s390x") rust_arch="${ARCH}"; libc="gnu"; arch_libc=${rust_arch}-linux-${libc}; extra_rust_flags="" ;; \
-     	        *) echo "Unsupported architecture: ${ARCH}" && exit 1 ;; \
-diff --git a/utils.mk b/utils.mk
-index 4edba5524..23b73fc8d 100644
--- a/utils.mk
-+++ b/utils.mk
-@@ -147,7 +147,7 @@ endif
- 
- ifeq ($(ARCH), ppc64le)
-     override LIBC = gnu
-    $(warning "WARNING: powerpc64le-unknown-linux-musl target is unavailable")
-+    $(warning "WARNING: powerpc64-unknown-linux-musl target is unavailable")
- endif
- 
- ifeq ($(ARCH), s390x)
-- 
-2.47.1
-
--- a/kata-containers.spec
+++ b/kata-containers.spec
@ -28,7 +28,7 @@
 %endif

 # https://github.com/kata-containers/kata-containers
-Version: 3.12.0
+Version: 3.23.0
 %global tag         %{version}%{?rcstr}

 %global domain      github.com
@ -52,8 +52,11 @@ workload isolation and security advantages of VMs. https://katacontainers.io/.}
                    CONTRIBUTING.md\\\
                    src/agent/README.md

+# Note: the original vendor tarball is quite big (918M for 3.16)
+# Unlike for RHEL, we cannot strip it down because we build all components
+# (RHEL builds only build kata-agent)
 Name:       %{repo}
-Release:    1%{?rcrel}%{?dist}.2
+Release:    1%{?rcrel}%{?dist}
 Summary:    Kata Containers version 3.x repository
 License:    Apache-2.0
 Url:        https://%{download}
@ -66,10 +69,7 @@ Source5:    50-kata

 # Keep this patch downstream as it'd be hard to justify such change upstream
 Patch0999:  0999-osbuilder-Adjust-agent_version-for-our-builds.patch
-Patch1000:  1000-Remove-shebang-in-non-executable-completion-script.patch
 Patch1001:  1001-Remove-warnings-as-compilation-errors.patch
-Patch1002:  1002-Bump-time-dependency-for-Kata.patch
-Patch1003:  1003-Fix-arch-name-compilation-failure.patch

 %if 0%{?have_go_rpm_macros}
 BuildRequires: go-rpm-macros
@ -390,6 +390,48 @@ fi


 %changelog
+* Mon Nov 03 2025 Christophe de Dinechin <dinechin@redhat.com> - 3.22.0-1
+- kata-containers 3.22.0
+
+* Sun Oct 12 2025 Maxwell G <maxwell@gtmx.me> - 3.21.0-1.2
+- Rebuild for golang 1.25.2
+
+* Fri Oct 10 2025 Alejandro Sáez <asm@redhat.com> - 3.21.0-1.1
+- rebuild
+
+* Thu Sep 25 2025 Christophe de Dinechin <dinechin@redhat.com> - 3.21.0-1
+- kata-containers 3.21.0
+
+* Wed Sep 10 2025 Christophe de Dinechin <dinechin@redhat.com> - 3.20.0-1
+- kata-containers 3.20.0
+
+* Fri Aug 15 2025 Maxwell G <maxwell@gtmx.me> - 3.19.1-1.1
+- Rebuild for golang-1.25.0
+
+* Mon Jul 28 2025 Christophe de Dinechin <dinechin@redhat.com> - 3.19.1-1
+- kata-containers 3.19.0
+
+* Mon Jul 28 2025 Christophe de Dinechin <dinechin@redhat.com> - 3.18.0-1
+- kata-containers 3.18.0
+
+* Fri Jul 25 2025 Christophe de Dinechin <dinechin@redhat.com> - 3.17.0-1
+- kata-containers 3.17.0
+
+* Thu Jul 24 2025 Christophe de Dinechin <dinechin@redhat.com> - 3.16.0-1
+- kata-containers 3.16.0
+
+* Thu Jul 24 2025 Christophe de Dinechin <dinechin@redhat.com> - 3.15.0-1
+- kata-containers 3.15.0
+
+* Wed Jul 23 2025 Christophe de Dinechin <dinechin@redhat.com> - 3.14.1-1
+- kata-containers 3.14.1, add fix for systemd configuration and rpm sanity test
+
+* Tue Jul 08 2025 Christophe de Dinechin <dinechin@redhat.com> - 3.14.0-1
+- kata-containers 3.14.0, update to latest release
+
+* Mon Jul 07 2025 Christophe de Dinechin <dinechin@redhat.com> - 3.13.0-1
+- kata-containers 3.13.0, required vendor source correction
+
 * Mon Jan 20 2025 Fedora Release Engineering <releng@fedoraproject.org> - 3.12.0-1.2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild

--- a/kata-osbuilder.sh
+++ b/kata-osbuilder.sh
@ -210,6 +210,11 @@ generate_rootfs()

    # Generate modules-load.d file
    generate_modules_load_conf
+
+    # Mask initrd.target and default to multi-user.target
+    # Temporary workaround for KATA-3944
+    systemctl mask --root=${DRACUT_ROOTFS} initrd.target
+    systemctl set-default --root=${DRACUT_ROOTFS} multi-user.target
 }


--- a/4
+++ b/4
@ -1,2 +1,2 @@
-SHA512 (kata-containers-3.12.0-vendor.tar.gz) = 5d84664f6fbc6c7be53509391e248959247f1873fac171373a23dcb8f12f0fcf5dd6e72ab22e36488694d93f73d94197e1c86bba32ea3a0cdacb3a57b03952de
-SHA512 (kata-containers-3.12.0.tar.gz) = efef81a537498b4d5ee02f836e054c635849db4a8916f099d4b4935d657fbaa095a041a2077b5b78f047282a4d11e583ee202a15705821fedbd663a0890156ea
+SHA512 (kata-containers-3.23.0.tar.gz) = d921dace40545fab47647c68357d88bf2807b74d5b3546ed0d91416b98fbad4ecaabf449abcc20e34cee8fbcacffe4a66a6012b63815e6b2c60c0319f982cc6e
+SHA512 (kata-containers-3.23.0-vendor.tar.gz) = 484c2dececc31a4fa9d4662f0a0051d52a916728e673396fbb70ab8ef02eb3ac225b815a03e2799aa7bcfe6478dd3ad785c628879914b0b113123f3952795c7b
--- a/test-kata-rpm-containerd.sh
+++ b/test-kata-rpm-containerd.sh
@ -0,0 +1,93 @@
+#!/bin/bash
+set -euo pipefail
+
+# Usage: ./test_kata_rpm_containerd.sh /path/to/kata-containers-*.rpm
+
+RPM_PATH=${1:-}
+
+if [[ -z "$RPM_PATH" ]]; then
+  echo "Usage: $0 /path/to/kata-containers-*.rpm"
+  exit 1
+fi
+
+# 1. Remove existing kata-containers packages and install the RPM
+echo "[1/7] Removing existing kata-containers packages..."
+sudo rpm -e --allmatches kata-containers 2>/dev/null || echo "No existing kata-containers packages to remove"
+
+echo "[2/7] Installing Kata Containers RPM: $RPM_PATH"
+sudo rpm -i "$RPM_PATH"
+
+echo "[3/7] Checking installed binaries and versions..."
+# kata-agent is not expected on the host; it runs inside the Kata VM image.
+if command -v kata-runtime >/dev/null 2>&1; then
+  kata-runtime --version
+else
+  echo "kata-runtime not found in PATH!"; exit 1
+fi
+if command -v kata-ctl >/dev/null 2>&1; then
+  kata-ctl version
+else
+  echo "kata-ctl not found in PATH!"; exit 1
+fi
+
+echo "[4/7] Checking QEMU version..."
+if command -v qemu-system-x86_64 >/dev/null 2>&1; then
+  qemu-system-x86_64 --version
+else
+  echo "qemu-system-x86_64 not found in PATH!"; exit 1
+fi
+
+echo "[5/7] Loading vhost_net kernel module (required for Kata networking)..."
+sudo modprobe vhost_net
+
+# 6. Run kata-runtime check (system compatibility)
+echo "[6/7] Running kata-runtime check (system compatibility)..."
+if ! kata-runtime check; then
+  echo "[ERROR] System is not capable of running Kata Containers."
+  exit 1
+fi
+
+# 7. Run a simple Kata container using containerd (if available)
+echo "[7/7] Attempting to run a test container with Kata runtime (containerd)..."
+if command -v ctr >/dev/null 2>&1; then
+  # Clean up any existing test containers
+  echo "[Test] Cleaning up any existing test containers..."
+  sudo ctr task kill kata-test-bg 2>/dev/null || true
+  sudo ctr task rm kata-test-bg 2>/dev/null || true
+  sudo ctr container rm kata-test-bg 2>/dev/null || true
+
+  sudo ctr images pull docker.io/library/alpine:latest
+  # Start a container in the background (do not use --rm so we can exec into it)
+  sudo ctr run -d --runtime io.containerd.kata.v2 docker.io/library/alpine:latest kata-test-bg sleep 300
+  # Wait a moment for the container to be up
+  sleep 2
+  echo "[Test] Exec into the running container and run 'uname -a'..."
+  sudo ctr task exec --exec-id kata-uname kata-test-bg uname -a
+  echo "[Test] Show /etc/os-release inside the container..."
+  sudo ctr task exec --exec-id kata-osrel kata-test-bg cat /etc/os-release
+
+  echo "[Test] Verify we're running in a Kata VM by checking /proc/cmdline..."
+  HOST_CMDLINE=$(cat /proc/cmdline)
+  GUEST_CMDLINE=$(sudo ctr task exec --exec-id kata-cmdline kata-test-bg cat /proc/cmdline)
+  echo "[Test] Host cmdline: ${HOST_CMDLINE}"
+  echo "[Test] Container cmdline: ${GUEST_CMDLINE}"
+  if [[ "${HOST_CMDLINE}" == "${GUEST_CMDLINE}" ]]; then
+    echo "[ERROR] VM verification: Container cmdline is the same as host - this indicates the container is NOT running in a Kata VM!"
+    exit 1
+  else
+    echo "[SUCCESS] Kata VM isolation is working correctly!"
+  fi
+  # Clean up: kill the task and delete the container
+  echo "[Cleanup] Deleting test container..."
+  sudo ctr task kill kata-test-bg || true
+  sudo ctr task rm kata-test-bg || true
+  sudo ctr container rm kata-test-bg || true
+  # Also run the original test (run+rm)
+  sudo ctr run --runtime io.containerd.kata.v2 --rm docker.io/library/alpine:latest kata-test uname -a || {
+    echo "Failed to run container with Kata runtime."; exit 1;
+  }
+else
+  echo "containerd (ctr) not found, skipping container test."
+fi
+
+echo "All tests completed. If no errors above, the RPM is likely working with containerd."
--- a/test-kata-rpm-crio.sh
+++ b/test-kata-rpm-crio.sh
@ -0,0 +1,208 @@
+#!/bin/bash
+set -euo pipefail
+
+# Usage: ./test_kata_rpm_crio.sh /path/to/kata-containers-3.20*.rpm
+
+RPM_PATH=${1:-}
+
+if [[ -z "$RPM_PATH" ]]; then
+  echo "Usage: $0 /path/to/kata-containers-*.rpm"
+  exit 1
+fi
+
+# 1. Remove existing kata-containers packages and install the RPM
+echo "[1/7] Removing existing kata-containers packages..."
+sudo rpm -e --allmatches kata-containers 2>/dev/null || echo "No existing kata-containers packages to remove"
+
+echo "[2/7] Installing Kata Containers RPM: $RPM_PATH"
+sudo rpm -i "$RPM_PATH"
+
+echo "[3/7] Checking installed binaries and versions..."
+# kata-agent is not expected on the host; it runs inside the Kata VM image.
+if command -v kata-runtime >/dev/null 2>&1; then
+  kata-runtime --version
+else
+  echo "kata-runtime not found in PATH!"; exit 1
+fi
+if command -v kata-ctl >/dev/null 2>&1; then
+  kata-ctl version
+else
+  echo "kata-ctl not found in PATH!"; exit 1
+fi
+
+echo "[4/7] Checking QEMU version..."
+if command -v qemu-system-x86_64 >/dev/null 2>&1; then
+  qemu-system-x86_64 --version
+else
+  echo "qemu-system-x86_64 not found in PATH!"; exit 1
+fi
+
+echo "[5/7] Loading vhost_net kernel module (required for Kata networking)..."
+sudo modprobe vhost_net
+
+# 6. Run kata-runtime check (system compatibility)
+echo "[6/7] Running kata-runtime check (system compatibility)..."
+if ! kata-runtime check; then
+  echo "[ERROR] System is not capable of running Kata Containers."
+  exit 1
+fi
+
+# 7. Run a simple Kata container using CRI-O (if available)
+echo "[7/7] Attempting to run a test container with Kata runtime (CRI-O)..."
+if command -v crictl >/dev/null 2>&1; then
+  # Check if CRI-O is running, if not try to start it
+  if ! systemctl is-active --quiet crio; then
+    echo "[Test] CRI-O is not running, attempting to start it..."
+    sudo systemctl start crio || {
+      echo "[WARNING] Failed to start CRI-O..."
+      exit 1
+    }
+  fi
+
+  # Configure crictl to use CRI-O instead of containerd
+  echo "[Test] Configuring crictl to use CRI-O..."
+  sudo crictl config --set runtime-endpoint=unix:///var/run/crio/crio.sock
+  sudo crictl config --set image-endpoint=unix:///var/run/crio/crio.sock
+  # Pull the image
+  echo "[Test] Pulling alpine image..."
+  sudo crictl pull docker.io/library/alpine:latest
+
+  # Create temporary pod and container config files
+  echo "[Test] Creating pod and container configurations..."
+
+  # Create pod config (minimal Kata documentation config)
+  cat > /tmp/pod-config.json << 'EOF'
+{
+    "metadata": {
+        "name": "busybox-pod",
+        "uid": "busybox-pod",
+        "namespace": "test.kata"
+    },
+    "hostname": "busybox_host",
+    "log_directory": "",
+    "dns_config": {
+    },
+    "port_mappings": [],
+    "resources": {
+    },
+    "labels": {
+    },
+    "annotations": {
+    },
+    "linux": {
+    }
+}
+EOF
+
+  # Create container config
+  cat > /tmp/container-config.json << 'EOF'
+{
+  "metadata": {
+    "name": "busybox-container"
+  },
+  "image": {
+    "image": "docker.io/library/alpine:latest"
+  },
+  "command": ["sleep", "300"],
+  "linux": {}
+}
+EOF
+
+  # Create pod sandbox
+  echo "[Test] Creating pod sandbox with kata runtime..."
+  POD_ID=$(sudo crictl runp --runtime kata /tmp/pod-config.json 2>/dev/null || echo "")
+  if [[ -z "$POD_ID" ]]; then
+    echo "[Test] Failed to create pod sandbox with Kata runtime"
+    journalctl -g kata
+    echo "[Test] Failed to create pod sandbox with Kata runtime, exiting"
+    exit 1
+  fi
+
+  if [[ -n "$POD_ID" ]]; then
+    echo "[Test] Pod created with ID: $POD_ID, waiting for it to be ready..."
+    # Wait for pod to be ready (up to 30 seconds)
+    for i in {1..30}; do
+      if sudo crictl inspectp $POD_ID >/dev/null 2>&1; then
+        echo "[Test] Pod is ready!"
+        break
+      fi
+      echo "[Test] Waiting for pod to be ready... ($i/30)"
+      sleep 1
+    done
+
+    # Create container
+    echo "[Test] Creating container..."
+    CONTAINER_ID=$(sudo crictl create $POD_ID /tmp/container-config.json /tmp/pod-config.json 2>/dev/null || echo "")
+    if [[ -z "$CONTAINER_ID" ]]; then
+      echo "[Test] Creating container with default runtime..."
+      CONTAINER_ID=$(sudo crictl create $POD_ID /tmp/container-config.json /tmp/pod-config.json 2>/dev/null || echo "")
+    fi
+
+    if [[ -n "$CONTAINER_ID" ]]; then
+      echo "[Test] Container created with ID: $CONTAINER_ID"
+
+      # Start container
+      echo "[Test] Starting container..."
+      if ! sudo crictl start $CONTAINER_ID 2>/dev/null; then
+        # Clean up and retry
+        echo "[Test] Container start failed, cleaning up and retrying..."
+        sudo crictl stop $CONTAINER_ID 2>/dev/null || true
+        sudo crictl rm $CONTAINER_ID 2>/dev/null || true
+        CONTAINER_ID=$(sudo crictl create $POD_ID /tmp/container-config.json /tmp/pod-config.json 2>/dev/null || echo "")
+        if [[ -z "$CONTAINER_ID" ]] || ! sudo crictl start $CONTAINER_ID; then
+          echo "[ERROR] Failed to start container after cleanup"
+          exit 1
+        fi
+      fi
+
+      # Wait a moment for the container to be up
+      sleep 2
+
+      # Execute commands in the container
+      echo "[Test] Exec into the running container and run 'uname -a'..."
+      sudo crictl exec $CONTAINER_ID uname -a || echo "uname command failed"
+
+      echo "[Test] Show /etc/os-release inside the container..."
+      sudo crictl exec $CONTAINER_ID cat /etc/os-release || echo "cat /etc/os-release failed"
+
+      echo "[Test] Verify we're running in a Kata VM by checking /proc/cmdline..."
+      HOST_CMDLINE=$(cat /proc/cmdline)
+      GUEST_CMDLINE=$(sudo crictl exec $CONTAINER_ID cat /proc/cmdline || echo "cat /proc/cmdline command failed")
+      echo "[Test] Host cmdline: ${HOST_CMDLINE}"
+      echo "[Test] Container cmdline: ${GUEST_CMDLINE}"
+      if [[ "${HOST_CMDLINE}" == "${GUEST_CMDLINE}" ]]; then
+          echo "[ERROR] The container is NOT running in a Kata VM!"
+      else
+          echo "[SUCCESS] Kata VM isolation is working correctly!"
+      fi
+
+      # Clean up
+      echo "[Cleanup] Stopping and removing container..."
+      sudo crictl stop $CONTAINER_ID || true
+      sudo crictl rm $CONTAINER_ID || true
+
+      if [[ "${HOST_CMDLINE}" == "${GUEST_CMDLINE}" ]]; then
+          echo "[ERROR] Container was running but not with Kata runtime"
+          exit 1
+      fi
+    else
+      echo "[ERROR] Failed to create container"
+    fi
+
+    # Clean up pod
+    echo "[Cleanup] Removing pod sandbox..."
+    sudo crictl stopp $POD_ID || true
+    sudo crictl rmp $POD_ID || true
+  else
+    echo "[ERROR] Failed to create pod sandbox"
+  fi
+
+  # Clean up temp files
+  rm -f /tmp/pod-config.json /tmp/container-config.json
+
+  echo "[Test] CRI-O container test completed."
+else
+  echo "CRI-O (crictl) not found, skipping container test."
+fi
+
+echo "All tests completed. If no errors above, the RPM is likely working with CRI-O."
--- a/vendor-tarball.sh
+++ b/vendor-tarball.sh
@ -0,0 +1,59 @@
+#!/bin/bash
+set -xeuo pipefail
+
+# Kata version
+KATA_VERSION=3.20.0
+RUST_SOURCES_TO_FIX="src/agent src/tools/kata-ctl"
+
+# Original vendor tarball downloaded from upstream
+ORIG_TARBALL="kata-containers-${KATA_VERSION}.tar.gz"
+ORIG_VENDOR_TARBALL="kata-containers-${KATA_VERSION}-vendor.tar.gz"
+TMPDIR="tmp_vendor_extract"
+
+# Build directories for agent and kata-ctl
+RPM_BUILD_DIR="$HOME/rpmbuild/BUILD/kata-containers-${KATA_VERSION}-build/kata-containers-${KATA_VERSION}"
+KATA_AGENT_BUILD_DIR="$RPM_BUILD_DIR/src/agent"
+KATA_CTL_BUILD_DIR="$RPM_BUILD_DIR/src/tools/kata-ctl"
+
+# Extracted directories in the tarball
+KATA_AGENT_EXTRACTED_DIR="$TMPDIR/src/agent"
+KATA_CTL_EXTRACTED_DIR="$TMPDIR/src/tools/kata-ctl"
+
+# 1. Extract the original vendor tarball
+rm -rf "$TMPDIR"
+mkdir -p "$TMPDIR"
+[ -f "$ORIG_VENDOR_TARBALL" ] || wget https://github.com/kata-containers/kata-containers/releases/download/$KATA_VERSION/$ORIG_VENDOR_TARBALL
+
+tar xzf "$ORIG_VENDOR_TARBALL" -C "$TMPDIR"
+
+# 2. Run cargo vendor in both build directories
+mkdir -p $RPM_BUILD_DIR
+[ -f "$ORIG_TARBALL" ] || wget https://github.com/kata-containers/kata-containers/archive/$KATA_VERSION/$ORIG_TARBALL
+tar xzf "$ORIG_TARBALL" -C $RPM_BUILD_DIR/..
+for dir in "$KATA_AGENT_BUILD_DIR" "$KATA_CTL_BUILD_DIR"; do
+    pushd "$dir"
+    cargo vendor
+    popd
+done
+
+# 3. Copy updated vendor and Cargo.lock into the extracted tree for both components
+for src_dir in $RUST_SOURCES_TO_FIX; do
+    BUILD_DIR="$HOME/rpmbuild/BUILD/kata-containers-${KATA_VERSION}-build/kata-containers-${KATA_VERSION}/$src_dir"
+    EXTRACTED_DIR="$TMPDIR/$src_dir"
+    rm -rf "$EXTRACTED_DIR/vendor"
+    cp -a "$BUILD_DIR/vendor" "$EXTRACTED_DIR/"
+    cp "$BUILD_DIR/Cargo.lock" "$EXTRACTED_DIR/"
+done
+
+# 4. Remove stale ext.rs if both ext.rs and ext/mod.rs exist in time crate for both
+for EXTRACTED_DIR in "$KATA_AGENT_EXTRACTED_DIR" "$KATA_CTL_EXTRACTED_DIR"; do
+    TIME_SRC="$EXTRACTED_DIR/vendor/time/src"
+    if [[ -f "$TIME_SRC/ext.rs" && -d "$TIME_SRC/ext" ]]; then
+        rm -f "$TIME_SRC/ext.rs"
+    fi
+done
+
+# 5. Repack the updated vendor tarball
+tar czf "$ORIG_VENDOR_TARBALL" -C "$TMPDIR" .
+
+echo "Updated vendor tarball created: $ORIG_VENDOR_TARBALL"
Author	SHA1	Message	Date
Christophe de Dinechin	92c293dcd1	Release 3.23 Upstream release 3.23 Signed-off-by: Christophe de Dinechin <dinechin@redhat.com>	2025-12-16 11:33:36 +01:00
Christophe de Dinechin	60b7e16b8b	Bump to Kata Containers 3.22 Signed-off-by: Christophe de Dinechin <dinechin@redhat.com>	2025-11-03 17:40:14 +01:00
Christophe de Dinechin	845a5f76e3	tests: Remove steps that retry with containerd The CRIO test is specifically designed to test CRIO, so avoid falling back to containerd if things don't work with CRIO. Signed-off-by: Christophe de Dinechin <dinechin@redhat.com>	2025-11-03 17:12:04 +01:00
Christophe de Dinechin	04e99cd114	Check that we are indeed running in a VM When running in kata containers, we should be running in a VM. One manifestation is that the boot command line is different. Check that and report it. Signed-off-by: Christophe de Dinechin <dinechin@redhat.com>	2025-11-03 17:12:04 +01:00
Maxwell G	a016dd8f89	Rebuild for golang 1.25.2	2025-10-11 21:13:42 -05:00
Alejandro Sáez	7b79010e72	rebuild	2025-10-10 14:42:09 +02:00
Christophe de Dinechin	625c6453e1	Add tests for CRIO and make test for containerd more explicit Add an rpm test that specifically uses crio, and make the containerd test more specifically mention containerd both in the name and in the description of the test. Also, the tests now first erase any old kata-containers package so that make sure we test a "from scratch" installation. Signed-off-by: Christophe de Dinechin <dinechin@redhat.com>	2025-09-30 17:09:36 +02:00
Christophe de Dinechin	ceb50da3cd	Bump to Kata 3.21.0 This matches Kata release 3.21.0 https://github.com/kata-containers/kata-containers/releases/tag/3.21.0 Signed-off-by: Christophe de Dinechin <dinechin@redhat.com>	2025-09-25 16:21:42 +02:00
Christophe de Dinechin	82c9c9ca9a	Commit missing sources Doing some experiments with Cursor, and apparently that messed up the sources file, which was not committed correctly. Signed-off-by: Christophe de Dinechin <dinechin@redhat.com>	2025-09-11 14:44:16 +02:00
Christophe de Dinechin	49770fe26b	Bump to Kata Containers 3.20 Signed-off-by: Christophe de Dinechin <dinechin@redhat.com>	2025-09-10 17:58:14 +02:00
Maxwell G	881c99d754	Rebuild for golang-1.25.0	2025-08-15 18:01:56 -05:00
Christophe de Dinechin	7a5a0f3ba2	Bump to Kata 3.19.1 Latest release - Skipping short-lived 3.19.0 Signed-off-by: Christophe de Dinechin <dinechin@redhat.com>	2025-07-29 14:12:36 +02:00
Christophe de Dinechin	0a3ee4381d	Bump to Kata Container 3.18 Signed-off-by: Christophe de Dinechin <dinechin@redhat.com>	2025-07-28 13:58:41 +02:00
Christophe de Dinechin	870d089304	Bump to Kata Containers 3.17.0 Version bump, also rename test_kata_rpm.sh to test-kata-rpm.sh Signed-off-by: Christophe de Dinechin <dinechin@redhat.com>	2025-07-25 21:27:01 +02:00
Christophe de Dinechin	837f56b76e	Revert "Changes to use the reduced `fedora` vendor tarball" In the Fedora case, we need to build tools like `kata-ctl`, so we need the corresponding vendoring code. Without it, the build fails with messages like: Updating git repository `https://github.com/firecracker-microvm/micro-http` error: failed to get `micro_http` as a dependency of package `kata-ctl v0.0.1 (/builddir/build/BUILD/kata-containers-3.16.0-build/kata-containers-3.16.0/src/tools/kata-ctl)`	2025-07-25 14:47:08 +02:00
Christophe de Dinechin	8fdc6ee100	Changes to use the reduced `fedora` vendor tarball The procedure to reduce the vendor tarball means that the name of the sources changes. Signed-off-by: Christophe de Dinechin <dinechin@redhat.com>	2025-07-25 14:12:52 +02:00
Christophe de Dinechin	c424516c70	Bump to Kata Containers 3.16 Some changes required to the 1001 patch file for src/genpolicy/Makefile Signed-off-by: Christophe de Dinechin <dinechin@redhat.com>	2025-07-24 18:14:37 +02:00
Christophe de Dinechin	cc66eb9f6b	Bump to Kata 3.15 Signed-off-by: Christophe de Dinechin <dinechin@redhat.com>	2025-07-24 13:29:08 +02:00
Christophe de Dinechin	f96442ccb6	Pick up the correct systemd unit when starting the OS With the current configuration, we get: [ 1.209181] systemd[1]: Failed to isolate default target: Unit rescue.service not found. [!!!!!!] Failed to isolate default target. [ 1.210339] systemd[1]: Freezing execution. Also added a very basic script, test_kata_rpm.sh, to check using `ctr` that we can run a basic Alpine container with the installed runtime. Signed-off-by: Christophe de Dinechin <dinechin@redhat.com> Suggested-by: Greg Kurz <gkurz@redhat.com>	2025-07-23 17:15:43 +02:00
Christophe de Dinechin	5674945806	Bump to Kata Containers 3.14 Adjusted patch 1001-Remove-warnings-as-compilation-errors.patch Removed patches 1000, 1002 and 1003, no longer needed Signed-off-by: Christophe de Dinechin <dinechin@redhat.com>	2025-07-09 11:50:30 +02:00
Christophe de Dinechin	13346c448b	Bump to Kata Containers 3.13 The upstream vendor tarball contains an outdated version of the Rust `time` crate, which causes problems with recent Rust compiler versions. This was addressed earlier by patching the `Cargo.lock` to require a more recent version of the `time` crate, but that itself caused some dependencies to not be found in the upstream vendor tarball. In order to address the issue, both `kata-agent` and `kata-ctl` had to be revendored to pick up time version 0.3.37. As a result, the `kata-containers-3.13.0-vendor.tar.gz` that was added to sources does not match the upstream source. If you need to reconstruct the vendor tarball, the required steps are documented in the `vendor-tarball.sh` script. Signed-off-by: Christophe de Dinechin <dinechin@redhat.com>	2025-07-07 17:58:46 +02:00