podman-3:3.4.7-1

- built v3.4.7
- Resolves: #2070368, #2074164 - Security fix for CVE-2022-1227
- Resolves: #2045880, #2067448 - Security fix for CVE-2022-21698
- Resolves: #2064702, #2074267 - Security fix for CVE-2022-27191
- Resolves: #2066568, #2070102 - Security fix for CVE-2022-27649

Signed-off-by: Lokesh Mandvekar <lsm5@fedoraproject.org>

.gitignore

@@ -1628,3 +1628,37 @@
 /podman-9da4169.tar.gz
 /podman-f98605e.tar.gz
 /podman-763d522.tar.gz
+/v3.0.0.tar.gz
+/v3.0.1.tar.gz
+/v3.1.0-rc1.tar.gz
+/v3.1.0-rc2.tar.gz
+/dnsname-3b29247.tar.gz
+/v3.1.0.tar.gz
+/v3.1.1.tar.gz
+/v3.1.2.tar.gz
+/v3.2.0-rc1.tar.gz
+/v3.2.0-rc2.tar.gz
+/v3.2.0-rc3.tar.gz
+/v3.2.0.tar.gz
+/podman-machine-cni-afab2d8.tar.gz
+/v3.2.1.tar.gz
+/v3.2.2.tar.gz
+/v3.2.3.tar.gz
+/v3.3.0-rc1.tar.gz
+/dnsname-dc59f28.tar.gz
+/gvisor-tap-vsock-27590a0.tar.gz
+/v3.3.0-rc2.tar.gz
+/v3.3.0-rc3.tar.gz
+/v3.3.0.tar.gz
+/v3.3.1.tar.gz
+/dnsname-18822f9.tar.gz
+/podman-machine-cni-0749884.tar.gz
+/v3.4.0-rc1.tar.gz
+/v3.4.0-rc2.tar.gz
+/v3.4.0.tar.gz
+/v3.4.1.tar.gz
+/gvisor-tap-vsock-4ee84d6.tar.gz
+/v3.4.2.tar.gz
+/v3.4.3.tar.gz
+/v3.4.4.tar.gz
+/v3.4.7.tar.gz

podman.spec

@@ -31,42 +31,62 @@
 # To build a random user's fork/commit, comment out above line,
 # uncomment below line and replace the placeholders and commit0 below with the right info
 #%%global git0 https://github.com/$GITHUB_USER/$GITHUB_USER_REPO
-%global commit0 763d522983b819ecd38689c9c0840069d1e2b530
-%global shortcommit0 %(c=%{commit0}; echo ${c:0:7})
 
+# dnsname
 %global repo_plugins dnsname
 # https://github.com/containers/dnsname
-%global import_path_plugins %%{provider}.%{provider_tld}/%{project}/%{repo_plugins}
+%global import_path_plugins %{provider}.%{provider_tld}/%{project}/%{repo_plugins}
 %global git_plugins https://%{import_path_plugins}
-%global commit_plugins c654c95366ac5f309ca3e5727c9b858864247328
+%global commit_plugins 18822f9a4fb35d1349eb256f4cd2bfd372474d84
 %global shortcommit_plugins %(c=%{commit_plugins}; echo ${c:0:7})
 
-# Used for comparing with latest upstream tag
-# to decide whether to autobuild (non-rawhide only)
-%define built_tag v3.0.0-rc3
+# podman-machine-cni
+%global repo_mcni  %{name}-machine-cni
+# https://github.com/containers/podman-machine-cni
+%global import_path_mcni %{provider}.%{provider_tld}/%{project}/%{repo_mcni}
+%global git_mcni https://%{import_path_mcni}
+%global commit_mcni 0749884b8d1a455c68da30789e37811ec0809d51
+%global shortcommit_mcni %(c=%{commit_mcni}; echo ${c:0:7})
+
+# gvproxy
+%global repo_gvproxy gvisor-tap-vsock
+# https://github.com/containers/gvisor-tap-vsock
+%global import_path_gvproxy %%{provider}.%{provider_tld}/%{project}/%{repo_gvproxy}
+%global git_gvproxy https://%{import_path_gvproxy}
+%global commit_gvproxy 4ee84d66bd86668f011733d8873989b5862bcd07
+%global shortcommit_gvproxy %(c=%{commit_gvproxy}; echo ${c:0:7})
+
+%global built_tag v3.4.7
+%global built_tag_strip %(b=%{built_tag}; echo ${b:1})
 
 Name: podman
 %if 0%{?fedora}
-Epoch: 2
+Epoch: 3
 %else
 Epoch: 0
 %endif
-Version: 3.0.0
+Version: 3.4.7
 # RELEASE TAG SHOULD ALWAYS BEGIN WITH A NUMBER
 # N.foo if released, 0.N.foo if unreleased
 # Rawhide almost always ships unreleased builds,
 # so release tag should be of the form 0.N.foo
-Release: 0.208.dev.git%{shortcommit0}%{?dist}
+Release: 1%{?dist}
 Summary: Manage Pods, Containers and Container Images
-License: ASL 2.0
+License: ASL 2.0 and BSD and ISC and MIT and MPLv2.0
 URL: https://%{name}.io/
-Source0: %{git0}/archive/%{commit0}/%{name}-%{shortcommit0}.tar.gz
+ExclusiveArch: %{golang_arches}
+Source0: %{git0}/archive/%{built_tag}.tar.gz
 Source1: %{git_plugins}/archive/%{commit_plugins}/%{repo_plugins}-%{shortcommit_plugins}.tar.gz
+Source2: %{git_mcni}/archive/%{commit_mcni}/%{repo_mcni}-%{shortcommit_mcni}.tar.gz
+Source3: %{git_gvproxy}/archive/%{commit_gvproxy}/%{repo_gvproxy}-%{shortcommit_gvproxy}.tar.gz
 Provides: %{name}-manpages = %{epoch}:%{version}-%{release}
 Obsoletes: %{name}-manpages < %{epoch}:%{version}-%{release}
-# If go_compiler is not set to 1, there is no virtual provide. Use golang instead.
+%if 0%{?fedora} && ! 0%{?rhel}
+BuildRequires: btrfs-progs-devel
+%endif
 BuildRequires: gcc
-BuildRequires: golang
+BuildRequires: golang >= 1.16.6
+BuildRequires: go-rpm-macros
 BuildRequires: glib2-devel
 BuildRequires: glibc-devel
 BuildRequires: glibc-static
@@ -77,100 +97,92 @@ BuildRequires: libassuan-devel
 BuildRequires: libgpg-error-devel
 BuildRequires: libseccomp-devel
 BuildRequires: libselinux-devel
+%if 0%{?fedora} >= 35
+BuildRequires: shadow-utils-subid-devel
+%endif
 BuildRequires: pkgconfig
 BuildRequires: make
+BuildRequires: ostree-devel
 BuildRequires: systemd
 BuildRequires: systemd-devel
-Requires: containers-common
-Requires: containernetworking-plugins >= 0.8.6-1
+Requires: containers-common >= 4:1-20
+Requires: containernetworking-plugins >= 1.0.0-0.2.rc1
 Requires: iptables
 Requires: nftables
-Requires: conmon >= 2:2.0.16-1
-Requires: oci-runtime
+Requires: conmon >= 2:2.0.30-2
+Recommends: %{name}-plugins = %{epoch}:%{version}-%{release}
+Recommends: fuse-overlayfs >= 0.3-8
+Recommends: catatonit
+Recommends: slirp4netns >= 1.1.8-1
 Recommends: %{name}-plugins = %{epoch}:%{version}-%{release}
 Obsoletes: oci-systemd-hook <= 0.2.0-3
 %if 0%{?fedora} && ! 0%{?rhel}
 BuildRequires: btrfs-progs-devel
 %endif
-%if 0%{?fedora} || 0%{?rhel}
-BuildRequires: ostree-devel
-Recommends: fuse-overlayfs >= 0.3-8
-Recommends: crun >= 0.14-2
-%endif
-%if 0%{?fedora} || 0%{?centos} >= 8 || 0%{?rhel}
-Recommends: catatonit
-Requires: (container-selinux if selinux-policy)
-Recommends: runc
-Recommends: slirp4netns >= 0.3.0-2
-%else
-Requires: catatonit
-Requires: container-selinux
-Requires: runc
-Requires: slirp4netns >= 0.3.0-2
-%endif
-
 # vendored libraries
-# awk '{print "Provides: bundled(golang("$1")) = "$2}' go.mod | sort
-Provides: bundled(golang(github.com/BurntSushi/toml)) = v0.3.1
-#Provides: bundled(golang(github.com/blang/semver)) = v3.5.1+incompatible
-#Provides: bundled(golang(github.com/buger/goterm)) = v0.0.0-20181115115552-c206103e1f37
-#Provides: bundled(golang(github.com/checkpoint-restore/go-criu)) = v0.0.0-20190109184317-bdb7599cd87b
-#Provides: bundled(golang(github.com/codahale/hdrhistogram)) = v0.0.0-20161010025455-3a0bb77429bd
-Provides: bundled(golang(github.com/containernetworking/cni)) = v0.8.0
-Provides: bundled(golang(github.com/containernetworking/plugins)) = v0.8.7
-#Provides: bundled(golang(github.com/containers/buildah)) = v1.15.1-0.20200813183340-0a8dc1f8064c
-#Provides: bundled(golang(github.com/containers/common)) = v0.20.3-0.20200827091701-a550d6a98aa3
-#Provides: bundled(golang(github.com/containers/conmon)) = v2.0.20+incompatible
-Provides: bundled(golang(github.com/containers/image/v5)) = v5.5.2
-Provides: bundled(golang(github.com/containers/psgo)) = v1.5.1
-Provides: bundled(golang(github.com/containers/storage)) = v1.23.2
-Provides: bundled(golang(github.com/coreos/go-systemd/v22)) = v22.1.0
-Provides: bundled(golang(github.com/cri-o/ocicni)) = v0.2.0
-Provides: bundled(golang(github.com/cyphar/filepath-securejoin)) = v0.2.2
-Provides: bundled(golang(github.com/davecgh/go-spew)) = v1.1.1
+# awk '{print "Provides: bundled(golang("$1")) = "$2}' go.mod | sort | uniq | sed -e 's/-/_/g' -e '/bundled(golang())/d' -e '/bundled(golang(go\|module\|replace\|require))/d'
+Provides: bundled(golang(github.com/BurntSushi/toml)) = v0.4.1
+Provides: bundled(golang(github.com/blang/semver)) = v3.5.1+incompatible
+Provides: bundled(golang(github.com/buger/goterm)) = v0.0.0_20181115115552_c206103e1f37
+Provides: bundled(golang(github.com/checkpoint_restore/checkpointctl)) = v0.0.0_20210301084134_a2024f5584e7
+Provides: bundled(golang(github.com/checkpoint_restore/go_criu/v5)) = v5.1.0
+Provides: bundled(golang(github.com/container_orchestrated_devices/container_device_interface)) = v0.0.0_20210325223243_f99e8b6c10b9
+Provides: bundled(golang(github.com/containernetworking/cni)) = v0.8.1
+Provides: bundled(golang(github.com/containernetworking/plugins)) = v0.9.1
+Provides: bundled(golang(github.com/containers/buildah)) = v1.23.1
+Provides: bundled(golang(github.com/containers/common)) = v0.44.5
+Provides: bundled(golang(github.com/containers/conmon)) = v2.0.20+incompatible
+Provides: bundled(golang(github.com/containers/image/v5)) = v5.17.0
+Provides: bundled(golang(github.com/containers/ocicrypt)) = v1.1.2
+Provides: bundled(golang(github.com/containers/psgo)) = v1.7.2_0.20220414132323_3ae304491648
+Provides: bundled(golang(github.com/containers/storage)) = v1.37.2
+Provides: bundled(golang(github.com/coreos/go_systemd/v22)) = v22.3.2
+Provides: bundled(golang(github.com/coreos/stream_metadata_go)) = v0.0.0_20210225230131_70edb9eb47b3
+Provides: bundled(golang(github.com/cri_o/ocicni)) = v0.2.1_0.20210621164014_d0acc7862283
+Provides: bundled(golang(github.com/cyphar/filepath_securejoin)) = v0.2.3
+Provides: bundled(golang(github.com/davecgh/go_spew)) = v1.1.1
+Provides: bundled(golang(github.com/digitalocean/go_qemu)) = v0.0.0_20210209191958_152a1535e49f
 Provides: bundled(golang(github.com/docker/distribution)) = v2.7.1+incompatible
-#Provides: bundled(golang(github.com/docker/docker)) = v1.4.2-0.20191219165747-a9416c67da9f
-Provides: bundled(golang(github.com/docker/go-connections)) = v0.4.0
-Provides: bundled(golang(github.com/docker/go-units)) = v0.4.0
-Provides: bundled(golang(github.com/fsnotify/fsnotify)) = v1.4.9
+Provides: bundled(golang(github.com/docker/docker)) = v20.10.11+incompatible
+Provides: bundled(golang(github.com/docker/go_connections)) = v0.4.0
+Provides: bundled(golang(github.com/docker/go_plugins_helpers)) = v0.0.0_20200102110956_c9a8a2d92ccc
+Provides: bundled(golang(github.com/docker/go_units)) = v0.4.0
+Provides: bundled(golang(github.com/dtylman/scp)) = v0.0.0_20181017070807_f3000a34aef4
+Provides: bundled(golang(github.com/fsnotify/fsnotify)) = v1.5.1
 Provides: bundled(golang(github.com/ghodss/yaml)) = v1.0.0
-Provides: bundled(golang(github.com/godbus/dbus/v5)) = v5.0.3
-#Provides: bundled(golang(github.com/google/shlex)) = v0.0.0-20181106134648-c34317bd91bf
-Provides: bundled(golang(github.com/google/uuid)) = v1.1.2
-Provides: bundled(golang(github.com/gorilla/mux)) = v1.7.4
+Provides: bundled(golang(github.com/godbus/dbus/v5)) = v5.0.6
+Provides: bundled(golang(github.com/google/shlex)) = v0.0.0_20181106134648_c34317bd91bf
+Provides: bundled(golang(github.com/google/uuid)) = v1.3.0
+Provides: bundled(golang(github.com/gorilla/handlers)) = v0.0.0_20150720190736_60c7bfde3e33
+Provides: bundled(golang(github.com/gorilla/mux)) = v1.8.0
 Provides: bundled(golang(github.com/gorilla/schema)) = v1.2.0
-Provides: bundled(golang(github.com/hashicorp/go-multierror)) = v1.1.0
+Provides: bundled(golang(github.com/hashicorp/go_multierror)) = v1.1.1
 Provides: bundled(golang(github.com/hpcloud/tail)) = v1.0.0
-Provides: bundled(golang(github.com/json-iterator/go)) = v1.1.10
-#Provides: bundled(golang(github.com/mrunalp/fileutils)) = v0.0.0-20171103030105-7d4729fb3618
-Provides: bundled(golang(github.com/onsi/ginkgo)) = v1.14.0
-Provides: bundled(golang(github.com/onsi/gomega)) = v1.10.1
-Provides: bundled(golang(github.com/opencontainers/go-digest)) = v1.0.0
-#Provides: bundled(golang(github.com/opencontainers/image-spec)) = v1.0.2-0.20190823105129-775207bd45b6
-#Provides: bundled(golang(github.com/opencontainers/runc)) = v1.0.0-rc91.0.20200708210054-ce54a9d4d79b
-#Provides: bundled(golang(github.com/opencontainers/runtime-spec)) = v1.0.3-0.20200817204227-f9c09b4ea1df
-Provides: bundled(golang(github.com/opencontainers/runtime-tools)) = v0.9.0
-Provides: bundled(golang(github.com/opencontainers/selinux)) = v1.6.0
-Provides: bundled(golang(github.com/opentracing/opentracing-go)) = v1.2.0
+Provides: bundled(golang(github.com/json_iterator/go)) = v1.1.12
+Provides: bundled(golang(github.com/moby/term)) = v0.0.0_20210619224110_3f7ff695adc6
+Provides: bundled(golang(github.com/mrunalp/fileutils)) = v0.5.0
+Provides: bundled(golang(github.com/onsi/ginkgo)) = v1.16.4
+Provides: bundled(golang(github.com/onsi/gomega)) = v1.16.0
+Provides: bundled(golang(github.com/opencontainers/go_digest)) = v1.0.0
+Provides: bundled(golang(github.com/opencontainers/image_spec)) = v1.0.2_0.20210819154149_5ad6f50d6283
+Provides: bundled(golang(github.com/opencontainers/runc)) = v1.0.2
+Provides: bundled(golang(github.com/opencontainers/runtime_spec)) = v1.0.3_0.20210326190908_1c3f411f0417
+Provides: bundled(golang(github.com/opencontainers/runtime_tools)) = v0.9.0
+Provides: bundled(golang(github.com/opencontainers/selinux)) = v1.9.1
 Provides: bundled(golang(github.com/pkg/errors)) = v0.9.1
-Provides: bundled(golang(github.com/pmezard/go-difflib)) = v1.0.0
-Provides: bundled(golang(github.com/rootless-containers/rootlesskit)) = v0.10.0
-Provides: bundled(golang(github.com/sirupsen/logrus)) = v1.6.0
-Provides: bundled(golang(github.com/spf13/cobra)) = v0.0.7
+Provides: bundled(golang(github.com/pmezard/go_difflib)) = v1.0.0
+Provides: bundled(golang(github.com/prometheus/client_golang)) = v1.11.1
+Provides: bundled(golang(github.com/rootless_containers/rootlesskit)) = v0.14.5
+Provides: bundled(golang(github.com/sirupsen/logrus)) = v1.8.1
+Provides: bundled(golang(github.com/spf13/cobra)) = v1.2.1
 Provides: bundled(golang(github.com/spf13/pflag)) = v1.0.5
-Provides: bundled(golang(github.com/stretchr/testify)) = v1.6.1
-#Provides: bundled(golang(github.com/syndtr/gocapability)) = v0.0.0-20180916011248-d98352740cb2
-Provides: bundled(golang(github.com/uber/jaeger-client-go)) = v2.25.0+incompatible
-Provides: bundled(golang(github.com/uber/jaeger-lib)) = v2.2.0+incompatible
-#Provides: bundled(golang(github.com/varlink/go)) = v0.0.0-20190502142041-0f1d566d194b
-Provides: bundled(golang(github.com/vishvananda/netlink)) = v1.1.0
-Provides: bundled(golang(go.etcd.io/bbolt)) = v1.3.5
-#Provides: bundled(golang(golang.org/x/crypto)) = v0.0.0-20200622213623-75b288015ac9
-#Provides: bundled(golang(golang.org/x/net)) = v0.0.0-20200707034311-ab3426394381
-#Provides: bundled(golang(golang.org/x/sync)) = v0.0.0-20200317015054-43a5402ce75a
-#Provides: bundled(golang(golang.org/x/sys)) = v0.0.0-20200728102440-3e129f6d46b1
-Provides: bundled(golang(k8s.io/api)) = v0.18.8
-Provides: bundled(golang(k8s.io/apimachinery)) = v0.19.0
+Provides: bundled(golang(github.com/stretchr/testify)) = v1.7.0
+Provides: bundled(golang(github.com/syndtr/gocapability)) = v0.0.0_20200815063812_42c35b437635
+Provides: bundled(golang(github.com/uber/jaeger_client_go)) = v2.29.1+incompatible
+Provides: bundled(golang(github.com/vbauerster/mpb/v6)) = v6.0.4
+Provides: bundled(golang(github.com/vishvananda/netlink)) = v1.1.1_0.20201029203352_d40f9887b852
+Provides: bundled(golang(k8s.io/api)) = v0.22.1
+Provides: bundled(golang(k8s.io/apimachinery)) = v0.22.1
 
 %description
 %{name} (Pod Manager) is a fully featured container engine that is a simple
@@ -399,6 +411,7 @@ connections as well.
 %package plugins
 Summary: Plugins for %{name}
 Requires: dnsmasq
+Recommends: %{name}-gvproxy = %{epoch}:%{version}-%{release}
 
 %description plugins
 This plugin sets up the use of dnsmasq on a given CNI network so
@@ -408,25 +421,46 @@ that dnsmasq will read in.  Similarly, when a pod
 is removed from the network, it will remove the entry from the hosts
 file.  Each CNI network will have its own dnsmasq instance.
 
+%package gvproxy
+Summary: Go replacement for libslirp and VPNKit
+
+%description gvproxy
+A replacement for libslirp and VPNKit, written in pure Go.
+It is based on the network stack of gVisor. Compared to libslirp,
+gvisor-tap-vsock brings a configurable DNS server and
+dynamic port forwarding.
+
 %prep
-%autosetup -Sgit -n %{name}-%{commit0}
-rm -f docs/source/markdown/containers-mounts.conf.5.md
+%autosetup -Sgit -n %{name}-%{built_tag_strip}
+%ifarch %{ix86} armv7hl
+sed -i 's/id128StringMax := C.ulong/id128StringMax := C.uint/' vendor/github.com/coreos/go-systemd/v22/sdjournal/journal.go
+%endif
 
 # untar dnsname
 tar zxf %{SOURCE1}
 
+# untar %%{name}-machine-cni
+tar zxf %{SOURCE2}
+
+# untar %%{name}-gvproxy
+tar zxf %{SOURCE3}
+
 %build
+%set_build_flags
 export GO111MODULE=off
 export GOPATH=$(pwd)/_build:$(pwd)
-export CGO_CFLAGS='-O2 -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -ffat-lto-objects -fexceptions -fasynchronous-unwind-tables -fstack-protector-strong -fstack-clash-protection -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64'
+export CGO_CFLAGS=$CFLAGS
+# These extra flags present in $CFLAGS have been skipped for now as they break the build
+CGO_CFLAGS=$(echo $CGO_CFLAGS | sed 's/-flto=auto//g')
+CGO_CFLAGS=$(echo $CGO_CFLAGS | sed 's/-Wp,D_GLIBCXX_ASSERTIONS//g')
+CGO_CFLAGS=$(echo $CGO_CFLAGS | sed 's/-specs=\/usr\/lib\/rpm\/redhat\/redhat-annobin-cc1//g')
+
 %ifarch x86_64
 export CGO_CFLAGS="$CGO_CFLAGS -m64 -mtune=generic"
 %if 0%{?fedora} || 0%{?centos} >= 8
 export CGO_CFLAGS="$CGO_CFLAGS -fcf-protection"
 %endif
 %endif
-# These extra flags present in %%{optflags} have been skipped for now as they break the build
-#export CGO_CFLAGS="$CGO_CFLAGS -flto=auto -Wp,D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1"
 
 mkdir _build
 pushd _build
@@ -437,8 +471,8 @@ ln -s vendor src
 
 # build %%{name}
 export BUILDTAGS="seccomp exclude_graphdriver_devicemapper $(hack/btrfs_installed_tag.sh) $(hack/btrfs_tag.sh) $(hack/libdm_tag.sh) $(hack/selinux_tag.sh) $(hack/systemd_tag.sh)"
-%if 0%{?centos}
-export BUILDTAGS+=" containers_image_ostree_stub"
+%if 0%{?fedora} >= 35
+export BUILDTAGS+=" $(hack/libsubid_tag.sh)"
 %endif
 
 # build date. FIXME: Makefile uses '/v2/libpod', that doesn't work here?
@@ -450,7 +484,7 @@ LDFLAGS="-X %{import_path}/libpod/define.buildInfo=$(date +%s)"
 export BUILDTAGS+=" exclude_graphdriver_btrfs btrfs_noversion remote"
 %gobuild -o bin/%{name}-remote %{import_path}/cmd/%{name}
 
-pushd dnsname-%{commit_plugins}
+pushd %{repo_plugins}-%{commit_plugins}
 mkdir _build
 pushd _build
 mkdir -p src/%{provider}.%{provider_tld}/%{project}
@@ -461,41 +495,67 @@ export GOPATH=$(pwd)/_build:$(pwd)
 %gobuild -o bin/dnsname %{import_path_plugins}/plugins/meta/dnsname
 popd
 
-%{__make} docs
+pushd %{repo_mcni}-%{commit_mcni}
+mkdir _build
+pushd _build
+mkdir -p src/%{provider}.%{provider_tld}/%{project}
+ln -s ../../../../ src/%{import_path_mcni}
+popd
+ln -s vendor src
+export GOPATH=$(pwd)/_build:$(pwd)
+%gobuild -o bin/%{name}-machine %{import_path_mcni}/plugins/meta/%{name}-machine
+popd
+
+pushd %{repo_gvproxy}-%{commit_gvproxy}
+mkdir _build
+pushd _build
+mkdir -p src/%{provider}.%{provider_tld}/%{project}
+ln -s ../../../../ src/%{import_path_gvproxy}
+popd
+ln -s vendor src
+export GOPATH=$(pwd)/_build:$(pwd)
+%gobuild -o bin/gvproxy %{import_path_gvproxy}/cmd/gvproxy
+popd
+
+%{__make} docs docker-docs
 
 %install
 install -dp %{buildroot}%{_unitdir}
 PODMAN_VERSION=%{version} %{__make} PREFIX=%{buildroot}%{_prefix} ETCDIR=%{buildroot}%{_sysconfdir} \
         install.bin-nobuild \
         install.man-nobuild \
-        install.cni \
         install.systemd \
         install.completions \
         install.docker \
+        install.docker-docs-nobuild \
 %if 0%{?fedora} || 0%{?rhel}
         install.remote-nobuild \
 %endif
 
 mv pkg/hooks/README.md pkg/hooks/README-hooks.md
 
-# install plugins
-pushd dnsname-%{commit_plugins}
+# install dnsname plugin
+pushd %{repo_plugins}-%{commit_plugins}
 %{__make} PREFIX=%{_prefix} DESTDIR=%{buildroot} install
 popd
 
+# install machine-cni plugin
+pushd %{repo_mcni}-%{commit_mcni}
+%{__make} PREFIX=%{_prefix} DESTDIR=%{buildroot} install
+popd
+
+# install gvproxy
+pushd %{repo_gvproxy}-%{commit_gvproxy}
+install -dp %{buildroot}%{_libexecdir}/%{name}
+install -p -m0755 bin/gvproxy %{buildroot}%{_libexecdir}/%{name}
+popd
+
 # do not include docker and podman-remote man pages in main package
 for file in `find %{buildroot}%{_mandir}/man[15] -type f | sed "s,%{buildroot},," | grep -v -e remote -e docker`; do
     echo "$file*" >> podman.file-list
 done
 
-# do not install remote manpages on centos7
-%if 0%{?centos} && 0%{?centos} < 8
-rm -rf %{buildroot}%{_mandir}/man1/docker-remote.1
-rm -rf %{buildroot}%{_mandir}/man1/%{name}-remote.1
-rm -rf %{buildroot}%{_mandir}/man5/%{name}-remote.conf.5
-%endif
-
-# source codes for building projects
+# source code for building projects
 %if 0%{?with_devel}
 install -d -p %{buildroot}/%{gopath}/src/%{import_path}/
 
@@ -562,10 +622,6 @@ export GOPATH=%{buildroot}/%{gopath}:$(pwd)/vendor:%{gopath}
 install -d -p %{buildroot}/%{_datadir}/%{name}/test/system
 cp -pav test/system %{buildroot}/%{_datadir}/%{name}/test/
 
-%triggerpostun -- %{name} < 1.1
-%{_bindir}/%{name} system renumber
-exit 0
-
 #define license tag if not already defined
 %{!?_licensedir:%global license %doc}
 
@@ -579,15 +635,16 @@ exit 0
 %{_datadir}/zsh/site-functions/_%{name}
 %dir %{_datadir}/fish/vendor_completions.d
 %{_datadir}/fish/vendor_completions.d/%{name}.fish
-%config(noreplace) %{_sysconfdir}/cni/net.d/87-%{name}-bridge.conflist
 %{_unitdir}/%{name}-auto-update.service
 %{_unitdir}/%{name}-auto-update.timer
 %{_unitdir}/%{name}.service
 %{_unitdir}/%{name}.socket
+%{_unitdir}/%{name}-restart.service
 %{_userunitdir}/%{name}-auto-update.service
 %{_userunitdir}/%{name}-auto-update.timer
 %{_userunitdir}/%{name}.service
 %{_userunitdir}/%{name}.socket
+%{_userunitdir}/%{name}-restart.service
 %{_usr}/lib/tmpfiles.d/%{name}.conf
 
 %files docker
@@ -627,12 +684,249 @@ exit 0
 %endif
 
 %files plugins
-%license dnsname-%{commit_plugins}/LICENSE
-%doc dnsname-%{commit_plugins}/{README.md,README_PODMAN.md}
+%license %{repo_plugins}-%{commit_plugins}/LICENSE
+%doc %{repo_plugins}-%{commit_plugins}/{README.md,README_PODMAN.md}
 %{_libexecdir}/cni/dnsname
+%{_libexecdir}/cni/%{name}-machine
+
+%files gvproxy
+%license %{repo_gvproxy}-%{commit_gvproxy}/LICENSE
+%doc %{repo_gvproxy}-%{commit_gvproxy}/README.md
+%dir %{_libexecdir}/%{name}
+%{_libexecdir}/%{name}/gvproxy
+
+%triggerpostun -- %{name} <= 3.2
+rm -f %{_sharedstatedir}/containers/storage/libpod/defaultCNINetExists
+exit 0
 
 # rhcontainerbot account currently managed by lsm5
 %changelog
+* Thu Apr 21 2022 Lokesh Mandvekar <lsm5@fedoraproject.org> - 3:3.4.7-1
+- built v3.4.7
+- Resolves: #2070368, #2074164 - Security fix for CVE-2022-1227
+- Resolves: #2045880, #2067448 - Security fix for CVE-2022-21698
+- Resolves: #2064702, #2074267 - Security fix for CVE-2022-27191
+- Resolves: #2066568, #2070102 - Security fix for CVE-2022-27649
+
+* Tue Dec 07 2021 RH Container Bot <rhcontainerbot@fedoraproject.org> - 3:3.4.3-1
+- autobuilt v3.4.3
+
+* Fri Nov 12 2021 RH Container Bot <rhcontainerbot@fedoraproject.org> - 3:3.4.2-1
+- autobuilt v3.4.2
+
+* Wed Oct 20 2021 RH Container Bot <rhcontainerbot@fedoraproject.org> - 3:3.4.1-1
+- autobuilt v3.4.1
+
+* Tue Oct 05 2021 Stephen Gallagher <sgallagh@redhat.com> - 3:3.4.0-4
+- Drop i686 support for RHEL >= 9
+- RHEL 9 does not have i686 support for golang
+
+* Mon Oct 04 2021 Lokesh Mandvekar <lsm5@fedoraproject.org> - 3:3.4.0-3
+- Gating tests: fix permissions error
+- From: Ed Santiago <santiago@redhat.com>
+
+* Fri Oct 01 2021 Timm Bäder <tbaeder@redhat.com> - 3:3.4.0-2
+- Remove individual flags from $CFLAGS instead of hardcoding all flags
+
+* Thu Sep 30 2021 RH Container Bot <rhcontainerbot@fedoraproject.org> - 3:3.4.0-1
+- autobuilt v3.4.0
+
+* Fri Sep 24 2021 Lokesh Mandvekar <lsm5@fedoraproject.org> - 3:3.4.0-0.10.rc2
+- build with libsubid buildtag
+
+* Fri Sep 24 2021 Lokesh Mandvekar <lsm5@fedoraproject.org> - 3:3.4.0-0.9.rc2
+- depend on shadow-utils-subid for f35 and higher
+
+* Fri Sep 24 2021 Lokesh Mandvekar <lsm5@fedoraproject.org> - 3:3.4.0-0.8.rc2
+* Wed Dec 08 2021 RH Container Bot <rhcontainerbot@fedoraproject.org> - 3:3.4.4-1
+- autobuilt v3.4.4
+
+* Tue Dec 07 2021 RH Container Bot <rhcontainerbot@fedoraproject.org> - 3:3.4.3-1
+- autobuilt v3.4.3
+
+* Fri Nov 12 2021 RH Container Bot <rhcontainerbot@fedoraproject.org> - 3:3.4.2-1
+- autobuilt v3.4.2
+
+* Wed Oct 20 2021 RH Container Bot <rhcontainerbot@fedoraproject.org> - 3:3.4.1-1
+- autobuilt v3.4.1
+
+* Tue Oct 05 2021 Stephen Gallagher <sgallagh@redhat.com> - 3:3.4.0-4
+- Drop i686 support for RHEL >= 9
+- RHEL 9 does not have i686 support for golang
+
+* Mon Oct 04 2021 Lokesh Mandvekar <lsm5@fedoraproject.org> - 3:3.4.0-3
+- Gating tests: fix permissions error
+- From: Ed Santiago <santiago@redhat.com>
+
+* Fri Oct 01 2021 Timm Bäder <tbaeder@redhat.com> - 3:3.4.0-2
+- Remove individual flags from $CFLAGS instead of hardcoding all flags
+
+* Thu Sep 30 2021 RH Container Bot <rhcontainerbot@fedoraproject.org> - 3:3.4.0-1
+- autobuilt v3.4.0
+
+* Fri Sep 24 2021 Lokesh Mandvekar <lsm5@fedoraproject.org> - 3:3.4.0-0.10.rc2
+- build with libsubid buildtag
+
+* Fri Sep 24 2021 Lokesh Mandvekar <lsm5@fedoraproject.org> - 3:3.4.0-0.9.rc2
+- depend on shadow-utils-subid for f35 and higher
+
+* Fri Sep 24 2021 Lokesh Mandvekar <lsm5@fedoraproject.org> - 3:3.4.0-0.8.rc2
+- bump release to stay ahead of older fedoras
+
+* Fri Sep 24 2021 RH Container Bot <rhcontainerbot@fedoraproject.org> - 3:3.4.0-0.7.rc2
+- autobuilt v3.4.0-rc2
+
+* Thu Sep 23 2021 Daniel J Walsh <dwalsh@redhat.com> - 3:3.4.0-0.6.rc1
+- Add shadow-utils-subid-devel requirement
+
+* Thu Sep 23 2021 Daniel J Walsh <dwalsh@redhat.com> - 3:3.4.0-0.5.rc1
+- rm -f /var/lib/containers/storage/libpod/defaultCNINetExists in post
+
+* Wed Sep 22 2021 Lokesh Mandvekar <lsm5@fedoraproject.org> - 3:3.4.0-0.4.rc1
+- bump conmon requirement for remote gating tests
+
+* Wed Sep 22 2021 Lokesh Mandvekar <lsm5@fedoraproject.org> - 3:3.4.0-0.3.rc1
+- Requires: conmon >= 2:2.0.30 for remote gating tests
+
+* Thu Sep 16 2021 RH Container Bot <rhcontainerbot@fedoraproject.org> - 3:3.4.0-0.1.rc1
+- autobuilt v3.4.0-rc1
+
+* Tue Aug 31 2021 Lokesh Mandvekar <lsm5@fedoraproject.org> - 3:3.3.1-2
+- bump release to be on par with f35
+
+* Mon Aug 30 2021 RH Container Bot <rhcontainerbot@fedoraproject.org> - 3:3.3.1-1
+- autobuilt v3.3.1
+
+* Fri Aug 27 2021 Lokesh Mandvekar <lsm5@fedoraproject.org> - 3:3.3.0-2
+- update gvproxy binary name
+
+* Fri Aug 20 2021 RH Container Bot <rhcontainerbot@fedoraproject.org> - 3:3.3.0-1
+- autobuilt v3.3.0
+
+* Tue Aug 17 2021 RH Container Bot <rhcontainerbot@fedoraproject.org> - 3:3.3.0-0.14.rc3
+- autobuilt v3.3.0-rc3
+
+* Mon Aug 16 2021 Lokesh Mandvekar <lsm5@fedoraproject.org> - 3:3.3.0-0.13.rc2
+- Bump to v3.3.0-rc2
+- Include podman-gvproxy which provides
+/usr/libexecdir/podman/podman-gvproxy
+- Bump dnsname to v1.3.0 commit dc59f28
+
+* Tue Aug 10 2021 RH Container Bot <rhcontainerbot@fedoraproject.org> - 3:3.3.0-0.12.rc1
+- autobuilt v3.3.0-rc1
+
+* Tue Aug 10 2021 RH Container Bot <rhcontainerbot@fedoraproject.org> - 3:3.3.0-0.11.rc1
+- autobuilt v3.3.0-rc1
+
+* Tue Aug 10 2021 RH Container Bot <rhcontainerbot@fedoraproject.org> - 3:3.3.0-0.10.rc1
+- autobuilt v3.3.0-rc1
+
+* Thu Aug 05 2021 RH Container Bot <rhcontainerbot@fedoraproject.org> - 3:3.3.0-0.9.rc1
+- autobuilt v3.3.0-rc1
+
+* Thu Aug 05 2021 RH Container Bot <rhcontainerbot@fedoraproject.org> - 3:3.3.0-0.8.rc1
+- autobuilt v3.3.0-rc1
+
+* Thu Aug 05 2021 RH Container Bot <rhcontainerbot@fedoraproject.org> - 3:3.3.0-0.7.rc1
+- autobuilt v3.3.0-rc1
+
+* Thu Aug 05 2021 RH Container Bot <rhcontainerbot@fedoraproject.org> - 3:3.3.0-0.6.rc1
+- autobuilt v3.3.0-rc1
+
+* Thu Aug 05 2021 RH Container Bot <rhcontainerbot@fedoraproject.org> - 3:3.3.0-0.5.rc1
+- autobuilt v3.3.0-rc1
+
+* Thu Aug 05 2021 RH Container Bot <rhcontainerbot@fedoraproject.org> - 3:3.3.0-0.4.rc1
+- autobuilt v3.3.0-rc1
+
+* Thu Aug 05 2021 RH Container Bot <rhcontainerbot@fedoraproject.org> - 3:3.3.0-0.3.rc1
+- autobuilt v3.3.0-rc1
+
+* Wed Aug 04 2021 RH Container Bot <rhcontainerbot@fedoraproject.org> - 3:3.3.0-0.2.rc1
+- autobuilt v3.3.0-rc1
+
+* Tue Aug 03 2021 RH Container Bot <rhcontainerbot@fedoraproject.org> - 3:3.3.0-0.1.rc1
+- autobuilt v3.3.0-rc1
+
+* Mon Aug 02 2021 Lokesh Mandvekar <lsm5@fedoraproject.org> - 3:3.2.3-2
+- Resolves: #1983596, #1987739 - Security fix for CVE-2021-34558
+
+* Fri Jul 16 2021 Lokesh Mandvekar <lsm5@fedoraproject.org> - 3:3.2.3-1
+- Resolves: #1969264, #1982881 - Security fix for CVE-2021-3602
+- bump to v3.2.3
+
+* Fri Jun 25 2021 Lokesh Mandvekar <lsm5@fedoraproject.org> - 3:3.2.2-1
+- bump to v3.2.2
+
+* Mon Jun 14 2021 RH Container Bot <rhcontainerbot@fedoraproject.org> - 3:3.2.1-1
+- autobuilt v3.2.1
+
+* Wed Jun 09 2021 Lokesh Mandvekar <lsm5@fedoraproject.org> - 3:3.2.0-5
+- use latest containers-common
+
+* Wed Jun 09 2021 Lokesh Mandvekar <lsm5@fedoraproject.org> - 3:3.2.0-4
+- remove max crun dep requirement - fixed in crun 0.20.1-1
+
+* Tue Jun 08 2021 Lokesh Mandvekar <lsm5@fedoraproject.org> - 3:3.2.0-3
+- keep crun on 0.19.1-3
+
+* Tue Jun 08 2021 Lokesh Mandvekar <lsm5@fedoraproject.org> - 3:3.2.0-2
+- include podman-machine-cni in podman-plugins subpackage
+
+* Fri Jun 04 2021 RH Container Bot <rhcontainerbot@fedoraproject.org> - 3:3.2.0-1
+- autobuilt v3.2.0
+
+* Wed May 26 2021 RH Container Bot <rhcontainerbot@fedoraproject.org> - 3:3.2.0-0.2.rc3
+- autobuilt v3.2.0-rc3
+
+* Fri May 21 2021 RH Container Bot <rhcontainerbot@fedoraproject.org> - 3:3.2.0-0.1.rc2
+- autobuilt v3.2.0-rc2
+
+* Wed May 12 2021 Dusty Mabe <dusty@dustymabe.com> - 3:3.1.2-3
+- Backport upstream bugfix: https://github.com/containers/podman/pull/10253
+
+* Tue May 11 2021 Lokesh Mandvekar <lsm5@fedoraproject.org> - 3:3.1.2-2
+- revert to v3.1.2 with Epoch bump to 3 to account for bad v3.2.0-rc1 in stable
+
+* Wed May 05 2021 RH Container Bot <rhcontainerbot@fedoraproject.org> - 2:3.2.0-0.1.rc1
+- autobuilt v3.2.0-rc1
+
+* Thu Apr 22 2021 Lokesh Mandvekar <lsm5@fedoraproject.org> - 2:3.1.2-1
+- bump to v3.1.2
+
+* Mon Apr 19 2021 Lokesh Mandvekar <lsm5@fedoraproject.org> - 2:3.1.1-2
+- update containers-common and related deps
+
+* Mon Apr 19 2021 RH Container Bot <rhcontainerbot@fedoraproject.org> - 2:3.1.1-1
+- autobuilt v3.1.1
+
+* Mon Apr 12 2021 Lokesh Mandvekar <lsm5@fedoraproject.org> - 2:3.1.0-3
+- bump dependencies
+
+* Mon Apr 05 2021 Lokesh Mandvekar <lsm5@fedoraproject.org> - 2:3.1.0-2
+- requires crun instead of recommends
+
+* Tue Mar 30 2021 RH Container Bot <rhcontainerbot@fedoraproject.org> - 2:3.1.0-1
+- autobuilt v3.1.0
+
+* Thu Mar 25 2021 Lokesh Mandvekar <lsm5@fedoraproject.org> - 2:3.1.0-0.3.rc2
+- bump dnsname and crun dep
+
+* Tue Mar 23 2021 RH Container Bot <rhcontainerbot@fedoraproject.org> - 2:3.1.0-0.2.rc2
+- autobuilt v3.1.0-rc2
+
+* Mon Mar 08 2021 RH Container Bot <rhcontainerbot@fedoraproject.org> - 2:3.1.0-0.1.rc1
+- autobuilt v3.1.0-rc1
+
+* Mon Mar 01 2021 Lokesh Mandvekar <lsm5@fedoraproject.org> - 2:3.0.1-2
+- bump min deps
+
+* Mon Feb 22 2021 Lokesh Mandvekar <lsm5@fedoraproject.org> - 2:3.0.1-1
+- bump to v3.0.1
+
+* Fri Feb 12 2021 Lokesh Mandvekar <lsm5@fedoraproject.org> - 2:3.0.0-1
+- bump to v3.0.0
+
 * Tue Feb 09 2021 RH Container Bot <rhcontainerbot@fedoraproject.org> - 2:3.0.0-0.208.dev.git763d522
 - autobuilt 763d522
 

sources

@@ -1,2 +1,4 @@
-SHA512 (dnsname-c654c95.tar.gz) = 34c844ca3ebe24b069077836d27e828ebbfd61c13e0aa943838af9aae475258c3f02e7d1c5e61362cb6904287eee4e3fc85cc2879216e1a8e1142b69731926f0
-SHA512 (podman-763d522.tar.gz) = fe0df1b62d2a844fb1478d47232f2b2b09cd0b73bea6509e323dc8306aeef92337980af017b2034eec7ad5b3ba73acfcc5c5137ff48b5008098345c993a47f17
+SHA512 (dnsname-18822f9.tar.gz) = de371722fbf18cd23b31485ee7ba36bb41d0d9a932d15e50872989c3ca1ff7246da63143c3725d81089fadda3821a54c18b22150d9d16005b07df6824f5f71f8
+SHA512 (gvisor-tap-vsock-4ee84d6.tar.gz) = 6b0e97f25f0c9ec0f018edcf9c1801daaeacc4d97d05cc2b453467e071c50693bb44d483bac34e64e0c9de71e78e47810a7c46d028553adee9fd6f593df8eb1a
+SHA512 (podman-machine-cni-0749884.tar.gz) = fe5f6a69118c0d3475c76c61bf1b50f1d5772fe9a4d20b23e59010e72f8cbd7fb7d4091ce8ab43af8becf77e5234b63191e3e01932f30f8386235822de2e42f4
+SHA512 (v3.4.7.tar.gz) = 0f0700a630b6289a08ded15a256128a1cf7a13b92ab12f869a3827fc26624111ade71cc13148b55dec802ccc8698902fe926a66f11ef4805babd5d0421519908

tests/roles/run_bats_tests/files/run_bats_tests.sh

@@ -42,10 +42,19 @@ if ! cd $testdir; then
     exit 0
 fi
 
+if [[ $PODMAN =~ remote ]]; then
+    ${PODMAN%%-remote} system service -t0 &>/dev/null &
+    PODMAN_SERVER_PID=$!
+fi
+
 echo "\$ bats ."
 bats .
 rc=$?
 
+if [[ -n "$PODMAN_SERVER_PID" ]]; then
+    kill $PODMAN_SERVER_PID
+fi
+
 echo $divider
 echo "bats completed with status $rc"
 

tests/test_podman.yml

@@ -39,6 +39,12 @@
     loop_control:
       loop_var: want_cgroups
 
+  - name: test podman-remote
+    include_tasks: test_podman_remote.yml
+
+  - name: test toolbox
+    include_tasks: test_toolbox.yml
+
   # Postprocessing: check for FAIL or ERROR in any test, exit 1 if so
   - name: check results
     include_tasks: check_results.yml

tests/test_podman_remote.yml

@@ -0,0 +1,17 @@
+---
+- name: "podman-remote | install"
+  dnf: name="podman-remote" state=installed
+
+- include_role:
+    name: run_bats_tests
+  vars:
+    tests:
+      - name: podman-remote root
+        package: podman
+        environment:
+          PODMAN: /usr/bin/podman-remote
+      - name: podman-remote rootless
+        package: podman
+        environment:
+          PODMAN: /usr/bin/podman-remote
+        become: true