diff --git a/.gitignore b/.gitignore index 1039674..bc39355 100644 --- a/.gitignore +++ b/.gitignore @@ -1847,3 +1847,30 @@ /v4.9.1.tar.gz /v4.9.2.tar.gz /v5.0.0-rc1.tar.gz +/v5.0.0-rc2.tar.gz +/v5.0.0-rc3.tar.gz +/v5.0.0-rc4.tar.gz +/v5.0.0-rc5.tar.gz +/v5.0.0-rc6.tar.gz +/v5.0.0-rc7.tar.gz +/v5.0.0.tar.gz +/v5.0.1.tar.gz +/v5.0.2.tar.gz +/v5.0.3.tar.gz +/v5.1.0-rc1.tar.gz +/v5.1.0.tar.gz +/v5.1.1.tar.gz +/v5.1.2.tar.gz +/v5.2.0-rc2.tar.gz +/v5.2.0.tar.gz +/v5.2.1.tar.gz +/v5.2.2.tar.gz +/v5.2.3.tar.gz +/v5.2.4.tar.gz +/v5.2.5.tar.gz +/v5.3.0.tar.gz +/v5.3.1.tar.gz +/v5.3.2.tar.gz +/v5.4.0.tar.gz +/v5.4.1.tar.gz +/v5.4.2.tar.gz diff --git a/.packit.yaml b/.packit.yaml index afcebd1..7c088fc 100644 --- a/.packit.yaml +++ b/.packit.yaml @@ -2,39 +2,67 @@ # See the documentation for more information: # https://packit.dev/docs/configuration/ -specfile_path: rpm/podman.spec +downstream_package_name: podman upstream_tag_template: v{version} +packages: + podman-fedora: + pkg_tool: fedpkg + specfile_path: rpm/podman.spec + podman-centos: + pkg_tool: centpkg + specfile_path: rpm/podman.spec + podman-eln: + specfile_path: rpm/podman.spec + srpm_build_deps: - git-archive-all - make actions: - fix-spec-file: - - "bash .packit.sh" + fix-spec-file: "bash .packit-copr-rpm.sh" + pre-sync: "bash .packit-rpm-git-commit.sh" jobs: - job: copr_build trigger: pull_request - notifications: + packages: [podman-fedora] + notifications: &packit_generic_failure_notification failure_comment: - message: "Ephemeral COPR build failed. @containers/packit-build please check." + message: "[NON-BLOCKING] Packit jobs failed. @containers/packit-build please check. Everyone else, feel free to ignore." enable_net: true targets: - fedora-all-x86_64 - fedora-all-aarch64 - - fedora-eln-x86_64 - - fedora-eln-aarch64 - - centos-stream+epel-next-8-x86_64 - - centos-stream+epel-next-8-aarch64 - - centos-stream+epel-next-9-x86_64 - - centos-stream+epel-next-9-aarch64 - additional_repos: - - "copr://rhcontainerbot/podman-next" + + - job: copr_build + trigger: pull_request + packages: [podman-eln] + notifications: *packit_generic_failure_notification + enable_net: true + targets: + fedora-eln-x86_64: + additional_repos: + - "https://kojipkgs.fedoraproject.org/repos/eln-build/latest/x86_64/" + fedora-eln-aarch64: + additional_repos: + - "https://kojipkgs.fedoraproject.org/repos/eln-build/latest/aarch64/" + + - job: copr_build + trigger: pull_request + packages: [podman-centos] + notifications: *packit_generic_failure_notification + enable_net: true + targets: + - centos-stream-9-x86_64 + - centos-stream-9-aarch64 + - centos-stream-10-x86_64 + - centos-stream-10-aarch64 # Run on commit to main branch - job: copr_build trigger: commit + packages: [podman-fedora] notifications: failure_comment: message: "podman-next COPR build failed. @containers/packit-build please check." @@ -46,6 +74,7 @@ jobs: - job: tests identifier: cockpit-revdeps trigger: pull_request + packages: [podman-fedora] notifications: failure_comment: message: "Cockpit tests failed for commit {commit_sha}. @martinpitt, @jelly, @mvollmer please check." @@ -66,16 +95,32 @@ jobs: - job: propose_downstream trigger: release update_release: false + packages: [podman-fedora] + dist_git_branches: &fedora_targets + - fedora-all + + - job: propose_downstream + trigger: release + update_release: false + packages: [podman-centos] dist_git_branches: - - fedora-development # Implies fedora-rawhide and any branched but unreleased version, will include f40 before f40 is marked stable. + - c10s - job: koji_build trigger: commit - dist_git_branches: - - fedora-development + packages: [podman-fedora] + sidetag_group: podman-releases + dist_git_branches: *fedora_targets - # TODO: Revisit once fedora 40 is branched and manual bodhi is enabled - #- job: bodhi_update - #trigger: commit - #dist_git_branches: - #- fedora-40 # rawhide updates are created automatically + - job: bodhi_update + trigger: koji_build + packages: [podman-fedora] + sidetag_group: podman-releases + # Dependencies are not rpm dependencies, but packages that should go in the + # same bodhi update + # Ref: https://packit.dev/docs/fedora-releases-guide/releasing-multiple-packages + dependencies: + - buildah + - containers-common + - skopeo + dist_git_branches: *fedora_targets diff --git a/README.packit b/README.packit index 29cc7d8..bb4a369 100644 --- a/README.packit +++ b/README.packit @@ -1,3 +1,3 @@ This repository is maintained by packit. https://packit.dev/ -The file was generated using packit 0.90.0.post1.dev9+g1f0325d1. +The file was generated using packit 1.4.0.post1.dev4+g043c5fde. diff --git a/podman.spec b/podman.spec index 68b810f..4b8218c 100644 --- a/podman.spec +++ b/podman.spec @@ -7,34 +7,23 @@ %global debug_package %{nil} %endif -# RHEL's default %%gobuild macro doesn't account for the BUILDTAGS variable, so we -# set it separately here and do not depend on RHEL's go-[s]rpm-macros package -# until that's fixed. -# c9s bz: https://bugzilla.redhat.com/show_bug.cgi?id=2227328 -# c8s bz: https://bugzilla.redhat.com/show_bug.cgi?id=2227331 -%if %{defined rhel} && 0%{?rhel} < 10 -%define gobuild(o:) go build -buildmode pie -compiler gc -tags="rpm_crashtraceback libtrust_openssl ${BUILDTAGS:-}" -ldflags "-linkmode=external -compressdwarf=false ${LDFLAGS:-} -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -extldflags '%__global_ldflags'" -a -v -x %{?**}; -# python3 dep conditional for rhel8 -%if %{?rhel} == 8 -%define rhel8py3 1 -%endif -%endif - %global gomodulesmode GO111MODULE=on -%if %{defined rhel} -# _user_tmpfiles.d currently undefined on rhel -%global _user_tmpfilesdir %{_datadir}/user-tmpfiles.d -%endif - %if %{defined fedora} %define build_with_btrfs 1 +# qemu-system* isn't packageed for CentOS Stream / RHEL +%define qemu 1 %endif %if %{defined copr_username} %define copr_build 1 %endif +# Only RHEL and CentOS Stream rpms are built with fips-enabled go compiler +%if %{defined rhel} +%define fips_enabled 1 +%endif + %global container_base_path github.com/containers %global container_base_url https://%{container_base_path} @@ -45,6 +34,15 @@ # %%{name} %global git0 %{container_base_url}/%{name} +# podman-machine subpackage will be present only on these architectures +%global machine_arches x86_64 aarch64 + +%if %{defined copr_build} +%define build_origin Copr: %{?copr_username}/%{?copr_projectname} +%else +%define build_origin %{?packager} +%endif + Name: podman %if %{defined copr_build} Epoch: 102 @@ -57,14 +55,14 @@ Epoch: 5 # If that's what you're reading, Version must be 0, and will be updated by Packit for # copr and koji builds. # If you're reading this on dist-git, the version is automatically filled in by Packit. -Version: 5.0.0~rc1 +Version: 5.4.2 # The `AND` needs to be uppercase in the License for SPDX compatibility License: Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND MIT AND MPL-2.0 Release: %autorelease %if %{defined golang_arches_future} ExclusiveArch: %{golang_arches_future} %else -ExclusiveArch: aarch64 ppc64le s390x x86_64 +ExclusiveArch: aarch64 ppc64le s390x x86_64 riscv64 %endif Summary: Manage Pods, Containers and Container Images URL: https://%{name}.io/ @@ -81,7 +79,7 @@ BuildRequires: glibc-devel BuildRequires: glibc-static BuildRequires: golang BuildRequires: git-core -%if !%{defined gobuild} +%if %{undefined rhel} || 0%{?rhel} >= 10 BuildRequires: go-rpm-macros %endif BuildRequires: gpgme-devel @@ -96,19 +94,16 @@ BuildRequires: man-db BuildRequires: ostree-devel BuildRequires: systemd BuildRequires: systemd-devel -%if %{defined rhel8py3} -BuildRequires: python3 -%endif Requires: catatonit Requires: conmon >= 2:2.1.7-2 -Requires: containers-common-extra -%if %{defined rhel} && !%{defined eln} -Recommends: gvisor-tap-vsock-gvforwarder +%if %{defined fedora} && 0%{?fedora} >= 40 +# TODO: Remove the f40 conditional after a few releases to keep conditionals to +# a minimum +# Ref: https://bugzilla.redhat.com/show_bug.cgi?id=2269148 +Requires: containers-common-extra >= 5:0.58.0-1 %else -Requires: gvisor-tap-vsock-gvforwarder +Requires: containers-common-extra %endif -Recommends: gvisor-tap-vsock -Provides: %{name}-quadlet Obsoletes: %{name}-quadlet <= 5:4.4.0-1 Provides: %{name}-quadlet = %{epoch}:%{version}-%{release} @@ -124,8 +119,6 @@ additional privileges. Both tools share image (not container) storage, hence each can use or manipulate images (but not containers) created by the other. -%{summary} -%{repo} Simple management tool for pods, containers and images %package docker Summary: Emulate Docker CLI using %{name} @@ -146,7 +139,10 @@ pages and %{name}. Summary: Tests for %{name} Requires: %{name} = %{epoch}:%{version}-%{release} +%if %{defined fedora} Requires: bats +%endif +Requires: attr Requires: jq Requires: skopeo Requires: nmap-ncat @@ -155,6 +151,7 @@ Requires: openssl Requires: socat Requires: buildah Requires: gnupg +Requires: xfsprogs %description tests %{summary} @@ -187,6 +184,30 @@ capabilities specified in user quadlets. It is a symlink to %{_bindir}/%{name} and execs into the `%{name}sh` container when `%{_bindir}/%{name}sh` is set as a login shell or set as os.Args[0]. +%ifarch %{machine_arches} +%package machine +Summary: Metapackage for setting up %{name} machine +Requires: %{name} = %{epoch}:%{version}-%{release} +Requires: gvisor-tap-vsock +%if %{defined qemu} +%ifarch aarch64 +Requires: qemu-system-aarch64-core +%endif +%ifarch x86_64 +Requires: qemu-system-x86-core +%endif +%else +Requires: qemu-kvm +%endif +Requires: qemu-img +Requires: virtiofsd +ExclusiveArch: x86_64 aarch64 + +%description machine +This subpackage installs the dependencies for %{name} machine, for more see: +https://docs.podman.io/en/latest/markdown/podman-machine.1.html +%endif + %prep %autosetup -Sgit -n %{name}-%{version_no_tilde} sed -i 's;@@PODMAN@@\;$(BINDIR);@@PODMAN@@\;%{_bindir};' Makefile @@ -196,14 +217,6 @@ sed -i 's;@@PODMAN@@\;$(BINDIR);@@PODMAN@@\;%{_bindir};' Makefile sed -i '/DELETE ON RHEL9/,/DELETE ON RHEL9/d' libpod/runtime.go %endif -# These changes are only meant for copr builds -%if %{defined copr_build} -# podman --version should show short sha -sed -i "s/^const RawVersion = .*/const RawVersion = \"##VERSION##-##SHORT_SHA##\"/" version/rawversion/version.go -# use ParseTolerant to allow short sha in version -sed -i "s/^var Version.*/var Version, err = semver.ParseTolerant(rawversion.RawVersion)/" version/version.go -%endif - %build %set_build_flags export CGO_CFLAGS=$CFLAGS @@ -219,16 +232,30 @@ export CGO_CFLAGS+=" -m64 -mtune=generic -fcf-protection=full" export GOPROXY=direct -LDFLAGS="-X %{ld_libpod}/define.buildInfo=$(date +%s) \ +LDFLAGS="-X %{ld_libpod}/define.buildInfo=${SOURCE_DATE_EPOCH:-$(date +%s)} \ + -X \"%{ld_libpod}/define.buildOrigin=%{build_origin}\" \ -X %{ld_libpod}/config._installPrefix=%{_prefix} \ -X %{ld_libpod}/config._etcDir=%{_sysconfdir} \ -X %{ld_project}/pkg/systemd/quadlet._binDir=%{_bindir}" +# This variable will be set by Packit actions. See .packit.yaml in the root dir +# of the repo (upstream as well as Fedora dist-git). +GIT_COMMIT="be85287fcf4590961614ee37be65eeb315e5d9ff" +LDFLAGS="$LDFLAGS -X %{ld_libpod}/define.gitCommit=$GIT_COMMIT" + # build rootlessport first %gobuild -o bin/rootlessport ./cmd/rootlessport export BASEBUILDTAGS="seccomp exclude_graphdriver_devicemapper $(hack/systemd_tag.sh) $(hack/libsubid_tag.sh)" +# libtrust_openssl buildtag switches to using the FIPS-compatible func +# `ecdsa.HashSign`. +# Ref 1: https://github.com/golang-fips/go/blob/main/patches/015-add-hash-sign-verify.patch#L22 +# Ref 2: https://github.com/containers/libtrust/blob/main/ec_key_openssl.go#L23 +%if %{defined fips_enabled} +export BASEBUILDTAGS="$BASEBUILDTAGS libtrust_openssl" +%endif + # build %%{name} export BUILDTAGS="$BASEBUILDTAGS $(hack/btrfs_installed_tag.sh) $(hack/btrfs_tag.sh) $(hack/libdm_tag.sh)" %gobuild -o bin/%{name} ./cmd/%{name} @@ -241,6 +268,10 @@ export BUILDTAGS="$BASEBUILDTAGS exclude_graphdriver_btrfs btrfs_noversion remot export BUILDTAGS="$BASEBUILDTAGS $(hack/btrfs_installed_tag.sh) $(hack/btrfs_tag.sh)" %gobuild -o bin/quadlet ./cmd/quadlet +# build %%{name}-testing +export BUILDTAGS="$BASEBUILDTAGS $(hack/btrfs_installed_tag.sh) $(hack/btrfs_tag.sh)" +%gobuild -o bin/podman-testing ./cmd/podman-testing + # reset LDFLAGS for plugins binaries LDFLAGS='' @@ -248,7 +279,7 @@ LDFLAGS='' %install install -dp %{buildroot}%{_unitdir} -PODMAN_VERSION=%{version} %{__make} PREFIX=%{buildroot}%{_prefix} ETCDIR=%{_sysconfdir} \ +PODMAN_VERSION=%{version} %{__make} DESTDIR=%{buildroot} PREFIX=%{_prefix} ETCDIR=%{_sysconfdir} \ install.bin \ install.man \ install.systemd \ @@ -256,27 +287,38 @@ PODMAN_VERSION=%{version} %{__make} PREFIX=%{buildroot}%{_prefix} ETCDIR=%{_sysc install.docker \ install.docker-docs \ install.remote \ -%if %{defined _modulesloaddir} - install.modules-load + install.testing + +# See above for the iptables.conf declaration +%if %{defined fedora} && 0%{?fedora} < 41 +%{__make} DESTDIR=%{buildroot} MODULESLOADDIR=%{_modulesloaddir} install.modules-load %endif sed -i 's;%{buildroot};;g' %{buildroot}%{_bindir}/docker # do not include docker and podman-remote man pages in main package -for file in `find %{buildroot}%{_mandir}/man[15] -type f | sed "s,%{buildroot},," | grep -v -e remote -e docker`; do - echo "$file*" >> podman.file-list +for file in `find %{buildroot}%{_mandir}/man[157] -type f | sed "s,%{buildroot},," | grep -v -e %{name}sh.1 -e remote -e docker`; do + echo "$file*" >> %{name}.file-list done rm -f %{buildroot}%{_mandir}/man5/docker*.5 -install -d -p %{buildroot}/%{_datadir}/%{name}/test/system -cp -pav test/system %{buildroot}/%{_datadir}/%{name}/test/ +install -d -p %{buildroot}%{_datadir}/%{name}/test/system +cp -pav test/system %{buildroot}%{_datadir}/%{name}/test/ + +%ifarch %{machine_arches} +# symlink virtiofsd in %%{name} libexecdir for machine subpackage +ln -s ../virtiofsd %{buildroot}%{_libexecdir}/%{name} +%endif #define license tag if not already defined %{!?_licensedir:%global license %doc} +# Include empty check to silence rpmlint warning +%check + %files -f %{name}.file-list -%license LICENSE +%license LICENSE vendor/modules.txt %doc README.md CONTRIBUTING.md install.md transfer.md %{_bindir}/%{name} %dir %{_libexecdir}/%{name} @@ -293,13 +335,17 @@ cp -pav test/system %{buildroot}/%{_datadir}/%{name}/test/ %{_tmpfilesdir}/%{name}.conf %{_systemdgeneratordir}/%{name}-system-generator %{_systemdusergeneratordir}/%{name}-user-generator -%if %{defined _modulesloaddir} +# iptables modules are only needed with iptables-legacy, +# as of f41 netavark will default to nftables so do not load unessary modules +# https://fedoraproject.org/wiki/Changes/NetavarkNftablesDefault +%if %{defined fedora} && 0%{?fedora} < 41 %{_modulesloaddir}/%{name}-iptables.conf %endif %files docker %{_bindir}/docker %{_mandir}/man1/docker*.1* +%{_sysconfdir}/profile.d/%{name}-docker.* %{_tmpfilesdir}/%{name}-docker.conf %{_user_tmpfilesdir}/%{name}-docker.conf @@ -314,15 +360,18 @@ cp -pav test/system %{buildroot}/%{_datadir}/%{name}/test/ %{_datadir}/zsh/site-functions/_%{name}-remote %files tests +%{_bindir}/%{name}-testing %{_datadir}/%{name}/test %files -n %{name}sh %{_bindir}/%{name}sh +%{_mandir}/man1/%{name}sh.1* + +%ifarch %{machine_arches} +%files machine +%dir %{_libexecdir}/%{name} +%{_libexecdir}/%{name}/virtiofsd +%endif %changelog -%if %{defined autochangelog} %autochangelog -%else -* Mon May 01 2023 RH Container Bot -- Placeholder changelog for envs that are not autochangelog-ready -%endif diff --git a/sources b/sources index 8937017..f9d6862 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v5.0.0-rc1.tar.gz) = 95452d5489b167cff24620b5a7504e1363d8276cf4e7c026d43ea2e9b24dde1c595b6e763a1065087d876e5ad56e62f7cda6e53838abdeac7eeb3deadcfd88ae +SHA512 (v5.4.2.tar.gz) = 482fde529766ca1b509a08bab4beb59a5935ebc6b27bc886c33597183258631e8c8db03ebb521baefd7989305aa76fad14c1359e211a0fe75c855c14bbaca960 diff --git a/tests/roles/run_bats_tests/files/run_bats_tests.sh b/tests/roles/run_bats_tests/files/run_bats_tests.sh index 90884cb..e82a903 100755 --- a/tests/roles/run_bats_tests/files/run_bats_tests.sh +++ b/tests/roles/run_bats_tests/files/run_bats_tests.sh @@ -27,7 +27,7 @@ exec &> >(tee -a $FULL_LOG) echo "Packages:" echo " Kernel: $(uname -r)" rpm -qa |\ - egrep 'podman|conmon|containers-common|crun|runc|iptable|slirp|aardvark|netavark|containernetworking-plugins|systemd|container-selinux|passt' |\ + grep -E 'buildah|skopeo|toolbox|podman|conmon|containers-common|crun|runc|iptable|slirp|aardvark|netavark|containernetworking-plugins|systemd|container-selinux|passt' |\ sort |\ sed -e 's/^/ /' diff --git a/tests/run_podman_tests.yml b/tests/run_podman_tests.yml index de7ddff..06b2525 100644 --- a/tests/run_podman_tests.yml +++ b/tests/run_podman_tests.yml @@ -3,6 +3,11 @@ dnf: name="podman-remote" state=installed when: podman_bin == "podman-remote" +# As of podman 5.0, slirp is a soft dependency. Until/unless it is +# actually deprecated, we continue to test with it. +- name: "slirp4netns | install" + dnf: name="slirp4netns" state=installed + - include_role: name: run_bats_tests vars: @@ -13,10 +18,12 @@ package: podman environment: PODMAN: /usr/bin/{{ podman_bin }} + PODMAN_TESTING: /usr/bin/podman-testing QUADLET: /usr/libexec/podman/quadlet - name: "{{ podman_bin }} rootless" package: podman environment: PODMAN: /usr/bin/{{ podman_bin }} + PODMAN_TESTING: /usr/bin/podman-testing QUADLET: /usr/libexec/podman/quadlet become: true diff --git a/tests/test_podman.yml b/tests/test_podman.yml index e5c82a1..d471630 100644 --- a/tests/test_podman.yml +++ b/tests/test_podman.yml @@ -31,8 +31,8 @@ loop_control: loop_var: podman_bin - - name: test toolbox - include_tasks: test_toolbox.yml + - name: test toolbx + include_tasks: test_toolbx.yml # Postprocessing: check for FAIL or ERROR in any test, exit 1 if so - name: check results diff --git a/tests/test_toolbox.yml b/tests/test_toolbx.yml similarity index 80% rename from tests/test_toolbox.yml rename to tests/test_toolbx.yml index 9b0859c..58494f4 100644 --- a/tests/test_toolbox.yml +++ b/tests/test_toolbx.yml @@ -3,8 +3,9 @@ name: run_bats_tests vars: tests: - - name: toolbox + - name: toolbx package: toolbox become: true environment: + TMPDIR: /var/tmp XDG_RUNTIME_DIR: /run/user/{{ rootless_uid }}