diff --git a/.gitignore b/.gitignore index e394912..5bb2950 100644 --- a/.gitignore +++ b/.gitignore @@ -1876,3 +1876,21 @@ /v5.3.1.tar.gz /v5.3.2.tar.gz /v5.4.0-rc2.tar.gz +/v5.4.0-rc3.tar.gz +/v5.4.0.tar.gz +/v5.4.1.tar.gz +/v5.4.2.tar.gz +/v5.5.0-rc1.tar.gz +/v5.5.0-rc2.tar.gz +/v5.5.0.tar.gz +/v5.5.1.tar.gz +/v5.5.2.tar.gz +/v5.6.0-rc1.tar.gz +/v5.6.0-rc2.tar.gz +/v5.6.0.tar.gz +/v5.6.1.tar.gz +/v5.6.2.tar.gz +/v5.7.0-rc1.tar.gz +/v5.7.0-rc2.tar.gz +/v5.7.0.tar.gz +/v5.7.1.tar.gz diff --git a/.packit.yaml b/.packit.yaml index 09334de..117c7b5 100644 --- a/.packit.yaml +++ b/.packit.yaml @@ -36,30 +36,37 @@ packages: podman-eln: specfile_path: rpm/podman.spec +# Disable automatic merging for Copr builds (and subsequent Testing Farm) +merge_pr_in_ci: false + srpm_build_deps: - git-archive-all - make actions: - fix-spec-file: - - "bash .packit.sh" + fix-spec-file: "bash .packit-copr-rpm.sh" + pre-sync: "bash .packit-rpm-git-commit.sh" jobs: - job: copr_build trigger: pull_request packages: [podman-fedora] - notifications: &packit_build_failure_notification + notifications: &packit_generic_failure_notification failure_comment: - message: "Ephemeral COPR build failed. @containers/packit-build please check." + message: "[NON-BLOCKING] Packit jobs failed. @containers/packit-build please check. Everyone else, feel free to ignore." enable_net: true - targets: &fedora_copr_targets + targets: - fedora-all-x86_64 - fedora-all-aarch64 + # Re-enable these scans if OpenScanHub starts scanning go packages + # https://packit.dev/posts/openscanhub-prototype + osh_diff_scan_after_copr_build: false + # Ignore until golang is updated in distro buildroot to go 1.23.3+ - job: copr_build - trigger: pull_request + trigger: ignore packages: [podman-eln] - notifications: *packit_build_failure_notification + notifications: *packit_generic_failure_notification enable_net: true targets: fedora-eln-x86_64: @@ -69,12 +76,13 @@ jobs: additional_repos: - "https://kojipkgs.fedoraproject.org/repos/eln-build/latest/aarch64/" + # Ignore until golang is updated in distro buildroot to go 1.23.3+ - job: copr_build - trigger: pull_request + trigger: ignore packages: [podman-centos] - notifications: *packit_build_failure_notification + notifications: *packit_generic_failure_notification enable_net: true - targets: ¢os_copr_targets + targets: - centos-stream-9-x86_64 - centos-stream-9-aarch64 - centos-stream-10-x86_64 @@ -84,62 +92,19 @@ jobs: - job: copr_build trigger: commit packages: [podman-fedora] - notifications: - failure_comment: - message: "podman-next COPR build failed. @containers/packit-build please check." branch: main owner: rhcontainerbot project: podman-next enable_net: true + # Tests on Fedora - job: tests trigger: pull_request packages: [podman-fedora] - targets: *fedora_copr_targets - require: &dev_tests - label: - absent: - - release - tf_extra_params: - environments: - - artifacts: - - type: repository-file - id: https://copr.fedorainfracloud.org/coprs/rhcontainerbot/podman-next/repo/fedora-$releasever/rhcontainerbot-podman-next-fedora-$releasever.repo - identifier: "dev" - - - job: tests - trigger: pull_request - packages: [podman-fedora] - targets: *fedora_copr_targets - require: &release_tests - label: - present: - - release - preserve_project: true - identifier: "release" - - # FIXME: Enable centos stream tests after containers-common is fixed - # FIXME: centos stream 10 currently also lacks bats - # https://bugzilla.redhat.com/show_bug.cgi?id=2329315 - - job: tests - trigger: ignore - packages: [podman-centos] - targets: *centos_copr_targets - require: *dev_tests - tf_extra_params: - environments: - - artifacts: - - type: repository-file - id: https://copr.fedorainfracloud.org/coprs/rhcontainerbot/podman-next/repo/centos-stream-$releasever/rhcontainerbot-podman-next-centos-stream-$releasever.repo - identifier: "dev" - - - job: tests - trigger: ignore - packages: [podman-centos] - targets: *centos_copr_targets - require: *release_tests - preserve_project: true - identifier: "release" + notifications: *packit_generic_failure_notification + targets: + - fedora-all + tmt_plan: "/plans/system/*" - job: tests identifier: cockpit-revdeps @@ -156,12 +121,24 @@ jobs: - artifacts: - type: repository-file id: https://copr.fedorainfracloud.org/coprs/g/cockpit/main-builds/repo/fedora-$releasever/group_cockpit-main-builds-fedora-$releasever.repo - - type: repository-file - id: https://copr.fedorainfracloud.org/coprs/rhcontainerbot/podman-next/repo/fedora-$releasever/rhcontainerbot-podman-next-fedora-$releasever.repo tmt: context: revdeps: "yes" + - job: tests + identifier: tmt-revdeps + trigger: pull_request + packages: [podman-fedora] + notifications: + failure_comment: + message: "tmt tests failed for commit {commit_sha}. @lsm5, @psss, @thrix please check." + targets: + - fedora-latest + fmf_url: https://github.com/teemtee/tmt + fmf_path: /plans/friends + fmf_ref: main + tmt_plan: "/podman" + - job: propose_downstream trigger: release update_release: false @@ -169,13 +146,6 @@ jobs: dist_git_branches: &fedora_targets - fedora-all - - job: propose_downstream - trigger: release - update_release: false - packages: [podman-centos] - dist_git_branches: - - c10s - - job: koji_build trigger: commit packages: [podman-fedora] diff --git a/README.packit b/README.packit index 5732d6a..1d2f35b 100644 --- a/README.packit +++ b/README.packit @@ -1,3 +1,3 @@ This repository is maintained by packit. https://packit.dev/ -The file was generated using packit 1.0.1. +The file was generated using packit 1.12.0.post1.dev22+gfe66fd850. diff --git a/gating.yaml b/gating.yaml index 1fb3172..92c7dc4 100644 --- a/gating.yaml +++ b/gating.yaml @@ -8,6 +8,7 @@ subject_type: koji_build rules: - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} +# recipients: jnovy, lsm5, santiago --- !Policy product_versions: - rhel-* diff --git a/plans/system.fmf b/plans/system.fmf index 6a2c5ba..b04c062 100644 --- a/plans/system.fmf +++ b/plans/system.fmf @@ -5,21 +5,15 @@ execute: how: tmt prepare: + - how: shell + script: modprobe null_blk nr_devices=1 + order: 5 - when: distro == centos-stream or distro == rhel how: shell script: | dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-$(rpm --eval '%{?rhel}').noarch.rpm dnf -y config-manager --set-enabled epel order: 10 - - when: initiator == packit - how: shell - script: | - COPR_REPO_FILE="/etc/yum.repos.d/*podman-next*.repo" - if compgen -G $COPR_REPO_FILE > /dev/null; then - sed -i -n '/^priority=/!p;$apriority=1' $COPR_REPO_FILE - fi - dnf -y upgrade --allowerasing - order: 20 adjust+: - enabled: false diff --git a/plans/tmt.fmf b/plans/tmt.fmf index fa96694..1589b5c 100644 --- a/plans/tmt.fmf +++ b/plans/tmt.fmf @@ -1,5 +1,10 @@ summary: Run tmt container provision test (downstream only) +enabled: false +adjust+: + - enabled: true + when: initiator != packit and distro != rhel + discover: how: fmf filter: 'tag:tmt & tag:downstream' @@ -7,15 +12,6 @@ discover: execute: how: tmt -provision: - how: artemis - hardware: - memory: ">= 16 GB" - cpu: - cores: ">= 4" - threads: ">=8" - disk: - - size: ">= 512 GB" prepare: - when: distro == centos-stream or distro == rhel how: shell @@ -23,7 +19,3 @@ prepare: dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-$(rpm --eval '%{?rhel}').noarch.rpm dnf -y config-manager --set-enabled epel order: 10 - -adjust+: - - enabled: false - when: revdeps == yes diff --git a/plans/toolbox.fmf b/plans/toolbox.fmf index 81504f6..0aceed0 100644 --- a/plans/toolbox.fmf +++ b/plans/toolbox.fmf @@ -1,4 +1,20 @@ summary: Run toolbox tests (downstream only) + +enabled: false +adjust+: + - enabled: true + when: initiator != packit and distro == fedora + +provision: + how: artemis + hardware: + memory: ">= 16 GB" + cpu: + cores: ">= 4" + threads: ">=8" + disk: + - size: ">= 512 GB" + prepare: - name: packages how: install diff --git a/podman.spec b/podman.spec index d8c58d1..1475aed 100644 --- a/podman.spec +++ b/podman.spec @@ -7,27 +7,29 @@ %global debug_package %{nil} %endif -# RHEL's default %%gobuild macro doesn't account for the BUILDTAGS variable, so we -# set it separately here and do not depend on RHEL's go-[s]rpm-macros package -# until that's fixed. -# c9s bz: https://bugzilla.redhat.com/show_bug.cgi?id=2227328 -%if %{defined rhel} && 0%{?rhel} < 10 -%define gobuild(o:) go build -buildmode pie -compiler gc -tags="rpm_crashtraceback libtrust_openssl ${BUILDTAGS:-}" -ldflags "-linkmode=external -compressdwarf=false ${LDFLAGS:-} -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -extldflags '%__global_ldflags'" -a -v -x %{?**}; -%endif - %global gomodulesmode GO111MODULE=on -%if %{defined rhel} -# _user_tmpfiles.d currently undefined on rhel -%global _user_tmpfilesdir %{_datadir}/user-tmpfiles.d -%endif - %if %{defined fedora} %define build_with_btrfs 1 +# qemu-system* isn't packageed for CentOS Stream / RHEL +%define qemu 1 +# bats is included in the default repos (No epel/copr etc.) +%define distro_bats 1 +%if %{?fedora} >= 43 +%define sequoia 1 +%endif %endif %if %{defined copr_username} %define copr_build 1 +%if "%{copr_username}" == "rhcontainerbot" && "%{copr_projectname}" == "podman-next" +%define next_build 1 +%endif +%endif + +# Only RHEL and CentOS Stream rpms are built with fips-enabled go compiler +%if %{defined rhel} +%define fips_enabled 1 %endif %global container_base_path github.com/containers @@ -43,8 +45,14 @@ # podman-machine subpackage will be present only on these architectures %global machine_arches x86_64 aarch64 -Name: podman %if %{defined copr_build} +%define build_origin Copr: %{?copr_username}/%{?copr_projectname} +%else +%define build_origin %{?packager} +%endif + +Name: podman +%if %{defined next_build} Epoch: 102 %else Epoch: 5 @@ -55,14 +63,14 @@ Epoch: 5 # If that's what you're reading, Version must be 0, and will be updated by Packit for # copr and koji builds. # If you're reading this on dist-git, the version is automatically filled in by Packit. -Version: 5.4.0~rc2 +Version: 5.7.1 # The `AND` needs to be uppercase in the License for SPDX compatibility License: Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND MIT AND MPL-2.0 Release: %autorelease %if %{defined golang_arches_future} ExclusiveArch: %{golang_arches_future} %else -ExclusiveArch: aarch64 ppc64le s390x x86_64 +ExclusiveArch: aarch64 ppc64le s390x x86_64 riscv64 %endif Summary: Manage Pods, Containers and Container Images URL: https://%{name}.io/ @@ -91,7 +99,7 @@ BuildRequires: shadow-utils-subid-devel BuildRequires: pkgconfig BuildRequires: make BuildRequires: man-db -BuildRequires: ostree-devel +BuildRequires: sqlite-devel BuildRequires: systemd BuildRequires: systemd-devel Requires: catatonit @@ -104,6 +112,10 @@ Requires: containers-common-extra >= 5:0.58.0-1 %else Requires: containers-common-extra %endif +%if %{defined sequoia} +Requires: podman-sequoia +%endif + Obsoletes: %{name}-quadlet <= 5:4.4.0-1 Provides: %{name}-quadlet = %{epoch}:%{version}-%{release} @@ -139,22 +151,26 @@ pages and %{name}. Summary: Tests for %{name} Requires: %{name} = %{epoch}:%{version}-%{release} -%if %{defined fedora} +%if %{defined distro_bats} Requires: bats %endif +Requires: attr Requires: jq Requires: skopeo Requires: nmap-ncat Requires: httpd-tools Requires: openssl Requires: socat +Requires: slirp4netns Requires: buildah Requires: gnupg +Requires: xfsprogs %description tests %{summary} -This package contains system tests for %{name} +This package contains system tests for %{name}. Only intended to be used for +gating tests. Not supported for end users / customers. %package remote Summary: (Experimental) Remote client for managing %{name} containers @@ -187,7 +203,17 @@ when `%{_bindir}/%{name}sh` is set as a login shell or set as os.Args[0]. Summary: Metapackage for setting up %{name} machine Requires: %{name} = %{epoch}:%{version}-%{release} Requires: gvisor-tap-vsock -Requires: qemu +%if %{defined qemu} +%ifarch aarch64 +Requires: qemu-system-aarch64-core +%endif +%ifarch x86_64 +Requires: qemu-system-x86-core +%endif +%else +Requires: qemu-kvm +%endif +Requires: qemu-img Requires: virtiofsd ExclusiveArch: x86_64 aarch64 @@ -205,14 +231,6 @@ sed -i 's;@@PODMAN@@\;$(BINDIR);@@PODMAN@@\;%{_bindir};' Makefile sed -i '/DELETE ON RHEL9/,/DELETE ON RHEL9/d' libpod/runtime.go %endif -# These changes are only meant for copr builds -%if %{defined copr_build} -# podman --version should show short sha -sed -i "s/^const RawVersion = .*/const RawVersion = \"##VERSION##-##SHORT_SHA##\"/" version/rawversion/version.go -# use ParseTolerant to allow short sha in version -sed -i "s/^var Version.*/var Version, err = semver.ParseTolerant(rawversion.RawVersion)/" version/version.go -%endif - %build %set_build_flags export CGO_CFLAGS=$CFLAGS @@ -229,29 +247,48 @@ export CGO_CFLAGS+=" -m64 -mtune=generic -fcf-protection=full" export GOPROXY=direct LDFLAGS="-X %{ld_libpod}/define.buildInfo=${SOURCE_DATE_EPOCH:-$(date +%s)} \ + -X \"%{ld_libpod}/define.buildOrigin=%{build_origin}\" \ -X %{ld_libpod}/config._installPrefix=%{_prefix} \ -X %{ld_libpod}/config._etcDir=%{_sysconfdir} \ -X %{ld_project}/pkg/systemd/quadlet._binDir=%{_bindir}" +# This variable will be set by Packit actions. See .packit.yaml in the root dir +# of the repo (upstream as well as Fedora dist-git). +GIT_COMMIT="f845d14e941889ba4c071f35233d09b29d363c75" +LDFLAGS="$LDFLAGS -X %{ld_libpod}/define.gitCommit=$GIT_COMMIT" + # build rootlessport first %gobuild -o bin/rootlessport ./cmd/rootlessport -export BASEBUILDTAGS="seccomp exclude_graphdriver_devicemapper $(hack/systemd_tag.sh) $(hack/libsubid_tag.sh)" +export BASEBUILDTAGS="seccomp $(hack/systemd_tag.sh) $(hack/libsubid_tag.sh) libsqlite3 grpcnotrace" + +# libtrust_openssl buildtag switches to using the FIPS-compatible func +# `ecdsa.HashSign`. +# Ref 1: https://github.com/golang-fips/go/blob/main/patches/015-add-hash-sign-verify.patch#L22 +# Ref 2: https://github.com/containers/libtrust/blob/main/ec_key_openssl.go#L23 +%if %{defined fips_enabled} +export BASEBUILDTAGS="$BASEBUILDTAGS libtrust_openssl" +%endif # build %%{name} -export BUILDTAGS="$BASEBUILDTAGS $(hack/btrfs_installed_tag.sh) $(hack/btrfs_tag.sh) $(hack/libdm_tag.sh)" +export BUILDTAGS="$BASEBUILDTAGS $(hack/btrfs_installed_tag.sh)" + +%if %{defined sequoia} +export BUILDTAGS="$BUILDTAGS containers_image_sequoia" +%endif + %gobuild -o bin/%{name} ./cmd/%{name} # build %%{name}-remote -export BUILDTAGS="$BASEBUILDTAGS exclude_graphdriver_btrfs btrfs_noversion remote" +export BUILDTAGS="$BASEBUILDTAGS exclude_graphdriver_btrfs remote" %gobuild -o bin/%{name}-remote ./cmd/%{name} # build quadlet -export BUILDTAGS="$BASEBUILDTAGS $(hack/btrfs_installed_tag.sh) $(hack/btrfs_tag.sh)" +export BUILDTAGS="$BASEBUILDTAGS $(hack/btrfs_installed_tag.sh)" %gobuild -o bin/quadlet ./cmd/quadlet # build %%{name}-testing -export BUILDTAGS="$BASEBUILDTAGS $(hack/btrfs_installed_tag.sh) $(hack/btrfs_tag.sh)" +export BUILDTAGS="$BASEBUILDTAGS $(hack/btrfs_installed_tag.sh)" %gobuild -o bin/podman-testing ./cmd/podman-testing # reset LDFLAGS for plugins binaries @@ -271,11 +308,6 @@ PODMAN_VERSION=%{version} %{__make} DESTDIR=%{buildroot} PREFIX=%{_prefix} ETCDI install.remote \ install.testing -# See above for the iptables.conf declaration -%if %{defined fedora} && 0%{?fedora} < 41 -%{__make} DESTDIR=%{buildroot} MODULESLOADDIR=%{_modulesloaddir} install.modules-load -%endif - sed -i 's;%{buildroot};;g' %{buildroot}%{_bindir}/docker # do not include docker and podman-remote man pages in main package @@ -296,6 +328,9 @@ ln -s ../virtiofsd %{buildroot}%{_libexecdir}/%{name} #define license tag if not already defined %{!?_licensedir:%global license %doc} +# Include empty check to silence rpmlint warning +%check + %files -f %{name}.file-list %license LICENSE vendor/modules.txt %doc README.md CONTRIBUTING.md install.md transfer.md diff --git a/sources b/sources index 88bca5d..1ab124d 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v5.4.0-rc2.tar.gz) = 74c6e59489e4fc473f23c4642e72bd60c434a4160b871b47032d95b8a06e73ad7d1032299f8a421a42084b3fd7d090afbfd2688781dc4753986bbeb3a686e523 +SHA512 (v5.7.1.tar.gz) = 81fd4c27ff1d16dcb85229d4e4fd2cb06943ddfe966b5324fa8a8a957b2d2ec2aed7c5da05d6c009148f53b76545b27b0cba506622c8861f70bf7cad6c214a08 diff --git a/test/tmt/system.fmf b/test/tmt/system.fmf index 3e5d52d..65f4dd0 100644 --- a/test/tmt/system.fmf +++ b/test/tmt/system.fmf @@ -1,14 +1,10 @@ require: - - attr - - bats - - podman-remote - podman-tests - psmisc - - slirp4netns environment: + # PODMAN_TESTING envvar is set in system.sh PODMAN: /usr/bin/podman - PODMAN_TESTING: /usr/bin/podman-testing QUADLET: /usr/libexec/podman/quadlet ROOTLESS_USER: "fedora" adjust+: @@ -18,13 +14,16 @@ adjust+: - when: distro == rhel environment+: ROOTLESS_USER: "cloud-user" + - when: initiator != "packit" + environment+: + RELEASE_TESTING: true /local-root: tag: [ local, root ] summary: local rootful test test: bash ./system.sh duration: 30m - + /local-rootless: tag: [ local, rootless ] summary: rootless test @@ -38,6 +37,8 @@ adjust+: duration: 30m environment+: PODMAN: /usr/bin/podman-remote + require+: + - podman-remote /remote-rootless: tag: [ remote, rootless ] @@ -46,3 +47,5 @@ adjust+: duration: 30m environment+: PODMAN: /usr/bin/podman-remote + require+: + - podman-remote diff --git a/test/tmt/system.sh b/test/tmt/system.sh index 9ed099f..3cd29da 100644 --- a/test/tmt/system.sh +++ b/test/tmt/system.sh @@ -12,6 +12,7 @@ rpm -q \ conmon \ container-selinux \ containers-common \ + criu \ crun \ netavark \ passt \ @@ -22,18 +23,18 @@ rpm -q \ systemd export system_service_cmd="/usr/bin/podman system service --timeout=0 &" -export test_cmd="whoami && cd /usr/share/podman/test/system && bats ." +export test_cmd="whoami && cd /usr/share/podman/test/system && PODMAN_TESTING=/usr/bin/podman-testing bats ." if [[ -z $1 ]]; then if [[ $PODMAN == "/usr/bin/podman-remote" ]]; then - eval $system_service_cmd + eval "$system_service_cmd" fi - eval $test_cmd + eval "$test_cmd" elif [[ $1 == "rootless" ]]; then if [[ $PODMAN == "/usr/bin/podman-remote" ]]; then su - "$ROOTLESS_USER" -c "eval $system_service_cmd" fi - su --whitelist-environment=$(cat ./tmt-envvars | tr '\n' ',') - "$ROOTLESS_USER" -c "eval $test_cmd" + su - "$ROOTLESS_USER" -c "eval $test_cmd" fi # Kill all podman processes for remote tests diff --git a/test/tmt/tmt-envvars b/test/tmt/tmt-envvars deleted file mode 100644 index 3ae53a1..0000000 --- a/test/tmt/tmt-envvars +++ /dev/null @@ -1,20 +0,0 @@ -TMT_TREE -TMT_PLAN_DATA -TMT_VERSION -TMT_TEST_NAME -TMT_TEST_DATA -TMT_TEST_SERIAL_NUMBER -TMT_TEST_ITERATION_ID -TMT_TEST_METADATA -TMT_SOURCE_DIR -TMT_REBOOT_COUNT -TMT_TEST_RESTART_COUNT -TMT_TOPOLOGY_BASH -TMT_TOPOLOGY_YAML -TMT_TEST_PIDFILE -TMT_TEST_PIDFILE_LOCK -TMT_TEST_PIDFILE_ROOT -PODMAN -PODMAN_TESTING -QUADLET -ROOTLESS_USER diff --git a/test/tmt/tmt.fmf b/test/tmt/tmt.fmf index 187fc1c..f016947 100644 --- a/test/tmt/tmt.fmf +++ b/test/tmt/tmt.fmf @@ -1,10 +1,9 @@ enabled: false adjust: enabled: true - when: initiator != packit and distro != rhel-10 or distro != centos-stream-10 - + when: initiator != packit && distro != rhel summary: Make sure that TMT container provision works -tag: [ tmt, downstream ] +tag: [downstream] require: - tmt+provision-container test: