Update to 5.4.2 upstream release

Upstream tag: v5.4.2
Upstream commit: be85287f

Commit authored by Packit automation (https://packit.dev/)

.gitignore

@@ -1847,3 +1847,30 @@
 /v4.9.1.tar.gz
 /v4.9.2.tar.gz
 /v5.0.0-rc1.tar.gz
+/v5.0.0-rc2.tar.gz
+/v5.0.0-rc3.tar.gz
+/v5.0.0-rc4.tar.gz
+/v5.0.0-rc5.tar.gz
+/v5.0.0-rc6.tar.gz
+/v5.0.0-rc7.tar.gz
+/v5.0.0.tar.gz
+/v5.0.1.tar.gz
+/v5.0.2.tar.gz
+/v5.0.3.tar.gz
+/v5.1.0-rc1.tar.gz
+/v5.1.0.tar.gz
+/v5.1.1.tar.gz
+/v5.1.2.tar.gz
+/v5.2.0-rc2.tar.gz
+/v5.2.0.tar.gz
+/v5.2.1.tar.gz
+/v5.2.2.tar.gz
+/v5.2.3.tar.gz
+/v5.2.4.tar.gz
+/v5.2.5.tar.gz
+/v5.3.0.tar.gz
+/v5.3.1.tar.gz
+/v5.3.2.tar.gz
+/v5.4.0.tar.gz
+/v5.4.1.tar.gz
+/v5.4.2.tar.gz

.packit.yaml

@@ -2,39 +2,67 @@
 # See the documentation for more information:
 # https://packit.dev/docs/configuration/
 
-specfile_path: rpm/podman.spec
+downstream_package_name: podman
 upstream_tag_template: v{version}
 
+packages:
+  podman-fedora:
+    pkg_tool: fedpkg
+    specfile_path: rpm/podman.spec
+  podman-centos:
+    pkg_tool: centpkg
+    specfile_path: rpm/podman.spec
+  podman-eln:
+    specfile_path: rpm/podman.spec
+
 srpm_build_deps:
   - git-archive-all
   - make
 
 actions:
-  fix-spec-file:
-    - "bash .packit.sh"
+  fix-spec-file: "bash .packit-copr-rpm.sh"
+  pre-sync: "bash .packit-rpm-git-commit.sh"
 
 jobs:
   - job: copr_build
     trigger: pull_request
-    notifications:
+    packages: [podman-fedora]
+    notifications: &packit_generic_failure_notification
       failure_comment:
-        message: "Ephemeral COPR build failed. @containers/packit-build please check."
+        message: "[NON-BLOCKING] Packit jobs failed. @containers/packit-build please check. Everyone else, feel free to ignore."
     enable_net: true
     targets:
       - fedora-all-x86_64
       - fedora-all-aarch64
-      - fedora-eln-x86_64
-      - fedora-eln-aarch64
-      - centos-stream+epel-next-8-x86_64
-      - centos-stream+epel-next-8-aarch64
-      - centos-stream+epel-next-9-x86_64
-      - centos-stream+epel-next-9-aarch64
-    additional_repos:
-      - "copr://rhcontainerbot/podman-next"
+
+  - job: copr_build
+    trigger: pull_request
+    packages: [podman-eln]
+    notifications: *packit_generic_failure_notification
+    enable_net: true
+    targets:
+      fedora-eln-x86_64:
+        additional_repos:
+          - "https://kojipkgs.fedoraproject.org/repos/eln-build/latest/x86_64/"
+      fedora-eln-aarch64:
+        additional_repos:
+          - "https://kojipkgs.fedoraproject.org/repos/eln-build/latest/aarch64/"
+
+  - job: copr_build
+    trigger: pull_request
+    packages: [podman-centos]
+    notifications: *packit_generic_failure_notification
+    enable_net: true
+    targets:
+      - centos-stream-9-x86_64
+      - centos-stream-9-aarch64
+      - centos-stream-10-x86_64
+      - centos-stream-10-aarch64
 
   # Run on commit to main branch
   - job: copr_build
     trigger: commit
+    packages: [podman-fedora]
     notifications:
       failure_comment:
         message: "podman-next COPR build failed. @containers/packit-build please check."
@@ -46,6 +74,7 @@ jobs:
   - job: tests
     identifier: cockpit-revdeps
     trigger: pull_request
+    packages: [podman-fedora]
     notifications:
       failure_comment:
         message: "Cockpit tests failed for commit {commit_sha}. @martinpitt, @jelly, @mvollmer please check."
@@ -66,16 +95,32 @@ jobs:
   - job: propose_downstream
     trigger: release
     update_release: false
+    packages: [podman-fedora]
+    dist_git_branches: &fedora_targets
+      - fedora-all
+
+  - job: propose_downstream
+    trigger: release
+    update_release: false
+    packages: [podman-centos]
     dist_git_branches:
-      - fedora-development # Implies fedora-rawhide and any branched but unreleased version, will include f40 before f40 is marked stable.
+      - c10s
 
   - job: koji_build
     trigger: commit
-    dist_git_branches:
-      - fedora-development
+    packages: [podman-fedora]
+    sidetag_group: podman-releases
+    dist_git_branches: *fedora_targets
 
-        # TODO: Revisit once fedora 40 is branched and manual bodhi is enabled
-        #- job: bodhi_update
-        #trigger: commit
-        #dist_git_branches:
-        #- fedora-40 # rawhide updates are created automatically
+  - job: bodhi_update
+    trigger: koji_build
+    packages: [podman-fedora]
+    sidetag_group: podman-releases
+    # Dependencies are not rpm dependencies, but packages that should go in the
+    # same bodhi update
+    # Ref: https://packit.dev/docs/fedora-releases-guide/releasing-multiple-packages
+    dependencies:
+      - buildah
+      - containers-common
+      - skopeo
+    dist_git_branches: *fedora_targets

README.packit

@@ -1,3 +1,3 @@
 This repository is maintained by packit.
 https://packit.dev/
-The file was generated using packit 0.90.0.post1.dev9+g1f0325d1.
+The file was generated using packit 1.4.0.post1.dev4+g043c5fde.

podman.spec

@@ -7,34 +7,23 @@
 %global debug_package %{nil}
 %endif
 
-# RHEL's default %%gobuild macro doesn't account for the BUILDTAGS variable, so we
-# set it separately here and do not depend on RHEL's go-[s]rpm-macros package
-# until that's fixed.
-# c9s bz: https://bugzilla.redhat.com/show_bug.cgi?id=2227328
-# c8s bz: https://bugzilla.redhat.com/show_bug.cgi?id=2227331
-%if %{defined rhel} && 0%{?rhel} < 10
-%define gobuild(o:) go build -buildmode pie -compiler gc -tags="rpm_crashtraceback libtrust_openssl ${BUILDTAGS:-}" -ldflags "-linkmode=external -compressdwarf=false ${LDFLAGS:-} -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -extldflags '%__global_ldflags'" -a -v -x %{?**};
-# python3 dep conditional for rhel8
-%if %{?rhel} == 8
-%define rhel8py3 1
-%endif
-%endif
-
 %global gomodulesmode GO111MODULE=on
 
-%if %{defined rhel}
-# _user_tmpfiles.d currently undefined on rhel
-%global _user_tmpfilesdir %{_datadir}/user-tmpfiles.d
-%endif
-
 %if %{defined fedora}
 %define build_with_btrfs 1
+# qemu-system* isn't packageed for CentOS Stream / RHEL
+%define qemu 1
 %endif
 
 %if %{defined copr_username}
 %define copr_build 1
 %endif
 
+# Only RHEL and CentOS Stream rpms are built with fips-enabled go compiler
+%if %{defined rhel}
+%define fips_enabled 1
+%endif
+
 %global container_base_path github.com/containers
 %global container_base_url https://%{container_base_path}
 
@@ -45,6 +34,15 @@
 # %%{name}
 %global git0 %{container_base_url}/%{name}
 
+# podman-machine subpackage will be present only on these architectures
+%global machine_arches x86_64 aarch64
+
+%if %{defined copr_build}
+%define build_origin Copr: %{?copr_username}/%{?copr_projectname}
+%else
+%define build_origin %{?packager}
+%endif
+
 Name: podman
 %if %{defined copr_build}
 Epoch: 102
@@ -57,14 +55,14 @@ Epoch: 5
 # If that's what you're reading, Version must be 0, and will be updated by Packit for
 # copr and koji builds.
 # If you're reading this on dist-git, the version is automatically filled in by Packit.
-Version: 5.0.0~rc1
+Version: 5.4.2
 # The `AND` needs to be uppercase in the License for SPDX compatibility
 License: Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND MIT AND MPL-2.0
 Release: %autorelease
 %if %{defined golang_arches_future}
 ExclusiveArch: %{golang_arches_future}
 %else
-ExclusiveArch: aarch64 ppc64le s390x x86_64
+ExclusiveArch: aarch64 ppc64le s390x x86_64 riscv64
 %endif
 Summary: Manage Pods, Containers and Container Images
 URL: https://%{name}.io/
@@ -81,7 +79,7 @@ BuildRequires: glibc-devel
 BuildRequires: glibc-static
 BuildRequires: golang
 BuildRequires: git-core
-%if !%{defined gobuild}
+%if %{undefined rhel} || 0%{?rhel} >= 10
 BuildRequires: go-rpm-macros
 %endif
 BuildRequires: gpgme-devel
@@ -96,19 +94,16 @@ BuildRequires: man-db
 BuildRequires: ostree-devel
 BuildRequires: systemd
 BuildRequires: systemd-devel
-%if %{defined rhel8py3}
-BuildRequires: python3
-%endif
 Requires: catatonit
 Requires: conmon >= 2:2.1.7-2
-Requires: containers-common-extra
-%if %{defined rhel} && !%{defined eln}
-Recommends: gvisor-tap-vsock-gvforwarder
+%if %{defined fedora} && 0%{?fedora} >= 40
+# TODO: Remove the f40 conditional after a few releases to keep conditionals to
+# a minimum
+# Ref: https://bugzilla.redhat.com/show_bug.cgi?id=2269148
+Requires: containers-common-extra >= 5:0.58.0-1
 %else
-Requires: gvisor-tap-vsock-gvforwarder
+Requires: containers-common-extra
 %endif
-Recommends: gvisor-tap-vsock
-Provides: %{name}-quadlet
 Obsoletes: %{name}-quadlet <= 5:4.4.0-1
 Provides: %{name}-quadlet = %{epoch}:%{version}-%{release}
 
@@ -124,8 +119,6 @@ additional privileges.
 Both tools share image (not container) storage, hence each can use or
 manipulate images (but not containers) created by the other.
 
-%{summary}
-%{repo} Simple management tool for pods, containers and images
 
 %package docker
 Summary: Emulate Docker CLI using %{name}
@@ -146,7 +139,10 @@ pages and %{name}.
 Summary: Tests for %{name}
 
 Requires: %{name} = %{epoch}:%{version}-%{release}
+%if %{defined fedora}
 Requires: bats
+%endif
+Requires: attr
 Requires: jq
 Requires: skopeo
 Requires: nmap-ncat
@@ -155,6 +151,7 @@ Requires: openssl
 Requires: socat
 Requires: buildah
 Requires: gnupg
+Requires: xfsprogs
 
 %description tests
 %{summary}
@@ -187,6 +184,30 @@ capabilities specified in user quadlets.
 It is a symlink to %{_bindir}/%{name} and execs into the `%{name}sh` container
 when `%{_bindir}/%{name}sh` is set as a login shell or set as os.Args[0].
 
+%ifarch %{machine_arches}
+%package machine
+Summary: Metapackage for setting up %{name} machine
+Requires: %{name} = %{epoch}:%{version}-%{release}
+Requires: gvisor-tap-vsock
+%if %{defined qemu}
+%ifarch aarch64
+Requires: qemu-system-aarch64-core
+%endif
+%ifarch x86_64
+Requires: qemu-system-x86-core
+%endif
+%else
+Requires: qemu-kvm
+%endif
+Requires: qemu-img
+Requires: virtiofsd
+ExclusiveArch: x86_64 aarch64
+
+%description machine
+This subpackage installs the dependencies for %{name} machine, for more see:
+https://docs.podman.io/en/latest/markdown/podman-machine.1.html
+%endif
+
 %prep
 %autosetup -Sgit -n %{name}-%{version_no_tilde}
 sed -i 's;@@PODMAN@@\;$(BINDIR);@@PODMAN@@\;%{_bindir};' Makefile
@@ -196,14 +217,6 @@ sed -i 's;@@PODMAN@@\;$(BINDIR);@@PODMAN@@\;%{_bindir};' Makefile
 sed -i '/DELETE ON RHEL9/,/DELETE ON RHEL9/d' libpod/runtime.go
 %endif
 
-# These changes are only meant for copr builds
-%if %{defined copr_build}
-# podman --version should show short sha
-sed -i "s/^const RawVersion = .*/const RawVersion = \"##VERSION##-##SHORT_SHA##\"/" version/rawversion/version.go
-# use ParseTolerant to allow short sha in version
-sed -i "s/^var Version.*/var Version, err = semver.ParseTolerant(rawversion.RawVersion)/" version/version.go
-%endif
-
 %build
 %set_build_flags
 export CGO_CFLAGS=$CFLAGS
@@ -219,16 +232,30 @@ export CGO_CFLAGS+=" -m64 -mtune=generic -fcf-protection=full"
 
 export GOPROXY=direct
 
-LDFLAGS="-X %{ld_libpod}/define.buildInfo=$(date +%s) \
+LDFLAGS="-X %{ld_libpod}/define.buildInfo=${SOURCE_DATE_EPOCH:-$(date +%s)} \
+         -X \"%{ld_libpod}/define.buildOrigin=%{build_origin}\" \
          -X %{ld_libpod}/config._installPrefix=%{_prefix} \
          -X %{ld_libpod}/config._etcDir=%{_sysconfdir} \
          -X %{ld_project}/pkg/systemd/quadlet._binDir=%{_bindir}"
 
+# This variable will be set by Packit actions. See .packit.yaml in the root dir
+# of the repo (upstream as well as Fedora dist-git).
+GIT_COMMIT="be85287fcf4590961614ee37be65eeb315e5d9ff"
+LDFLAGS="$LDFLAGS -X %{ld_libpod}/define.gitCommit=$GIT_COMMIT"
+
 # build rootlessport first
 %gobuild -o bin/rootlessport ./cmd/rootlessport
 
 export BASEBUILDTAGS="seccomp exclude_graphdriver_devicemapper $(hack/systemd_tag.sh) $(hack/libsubid_tag.sh)"
 
+# libtrust_openssl buildtag switches to using the FIPS-compatible func
+# `ecdsa.HashSign`.
+# Ref 1: https://github.com/golang-fips/go/blob/main/patches/015-add-hash-sign-verify.patch#L22
+# Ref 2: https://github.com/containers/libtrust/blob/main/ec_key_openssl.go#L23
+%if %{defined fips_enabled}
+export BASEBUILDTAGS="$BASEBUILDTAGS libtrust_openssl"
+%endif
+
 # build %%{name}
 export BUILDTAGS="$BASEBUILDTAGS $(hack/btrfs_installed_tag.sh) $(hack/btrfs_tag.sh) $(hack/libdm_tag.sh)"
 %gobuild -o bin/%{name} ./cmd/%{name}
@@ -241,6 +268,10 @@ export BUILDTAGS="$BASEBUILDTAGS exclude_graphdriver_btrfs btrfs_noversion remot
 export BUILDTAGS="$BASEBUILDTAGS $(hack/btrfs_installed_tag.sh) $(hack/btrfs_tag.sh)"
 %gobuild -o bin/quadlet ./cmd/quadlet
 
+# build %%{name}-testing
+export BUILDTAGS="$BASEBUILDTAGS $(hack/btrfs_installed_tag.sh) $(hack/btrfs_tag.sh)"
+%gobuild -o bin/podman-testing ./cmd/podman-testing
+
 # reset LDFLAGS for plugins binaries
 LDFLAGS=''
 
@@ -248,7 +279,7 @@ LDFLAGS=''
 
 %install
 install -dp %{buildroot}%{_unitdir}
-PODMAN_VERSION=%{version} %{__make} PREFIX=%{buildroot}%{_prefix} ETCDIR=%{_sysconfdir} \
+PODMAN_VERSION=%{version} %{__make} DESTDIR=%{buildroot} PREFIX=%{_prefix} ETCDIR=%{_sysconfdir} \
        install.bin \
        install.man \
        install.systemd \
@@ -256,27 +287,38 @@ PODMAN_VERSION=%{version} %{__make} PREFIX=%{buildroot}%{_prefix} ETCDIR=%{_sysc
        install.docker \
        install.docker-docs \
        install.remote \
-%if %{defined _modulesloaddir}
-        install.modules-load
+       install.testing
+
+# See above for the iptables.conf declaration
+%if %{defined fedora} && 0%{?fedora} < 41
+%{__make} DESTDIR=%{buildroot} MODULESLOADDIR=%{_modulesloaddir} install.modules-load
 %endif
 
 sed -i 's;%{buildroot};;g' %{buildroot}%{_bindir}/docker
 
 # do not include docker and podman-remote man pages in main package
-for file in `find %{buildroot}%{_mandir}/man[15] -type f | sed "s,%{buildroot},," | grep -v -e remote -e docker`; do
-    echo "$file*" >> podman.file-list
+for file in `find %{buildroot}%{_mandir}/man[157] -type f | sed "s,%{buildroot},," | grep -v -e %{name}sh.1 -e remote -e docker`; do
+    echo "$file*" >> %{name}.file-list
 done
 
 rm -f %{buildroot}%{_mandir}/man5/docker*.5
 
-install -d -p %{buildroot}/%{_datadir}/%{name}/test/system
-cp -pav test/system %{buildroot}/%{_datadir}/%{name}/test/
+install -d -p %{buildroot}%{_datadir}/%{name}/test/system
+cp -pav test/system %{buildroot}%{_datadir}/%{name}/test/
+
+%ifarch %{machine_arches}
+# symlink virtiofsd in %%{name} libexecdir for machine subpackage
+ln -s ../virtiofsd %{buildroot}%{_libexecdir}/%{name}
+%endif
 
 #define license tag if not already defined
 %{!?_licensedir:%global license %doc}
 
+# Include empty check to silence rpmlint warning
+%check
+
 %files -f %{name}.file-list
-%license LICENSE
+%license LICENSE vendor/modules.txt
 %doc README.md CONTRIBUTING.md install.md transfer.md
 %{_bindir}/%{name}
 %dir %{_libexecdir}/%{name}
@@ -293,13 +335,17 @@ cp -pav test/system %{buildroot}/%{_datadir}/%{name}/test/
 %{_tmpfilesdir}/%{name}.conf
 %{_systemdgeneratordir}/%{name}-system-generator
 %{_systemdusergeneratordir}/%{name}-user-generator
-%if %{defined _modulesloaddir}
+# iptables modules are only needed with iptables-legacy,
+# as of f41 netavark will default to nftables so do not load unessary modules
+# https://fedoraproject.org/wiki/Changes/NetavarkNftablesDefault
+%if %{defined fedora} && 0%{?fedora} < 41
 %{_modulesloaddir}/%{name}-iptables.conf
 %endif
 
 %files docker
 %{_bindir}/docker
 %{_mandir}/man1/docker*.1*
+%{_sysconfdir}/profile.d/%{name}-docker.*
 %{_tmpfilesdir}/%{name}-docker.conf
 %{_user_tmpfilesdir}/%{name}-docker.conf
 
@@ -314,15 +360,18 @@ cp -pav test/system %{buildroot}/%{_datadir}/%{name}/test/
 %{_datadir}/zsh/site-functions/_%{name}-remote
 
 %files tests
+%{_bindir}/%{name}-testing
 %{_datadir}/%{name}/test
 
 %files -n %{name}sh
 %{_bindir}/%{name}sh
+%{_mandir}/man1/%{name}sh.1*
+
+%ifarch %{machine_arches}
+%files machine
+%dir %{_libexecdir}/%{name}
+%{_libexecdir}/%{name}/virtiofsd
+%endif
 
 %changelog
-%if %{defined autochangelog}
 %autochangelog
-%else
-* Mon May 01 2023 RH Container Bot <rhcontainerbot@fedoraproject.org>
-- Placeholder changelog for envs that are not autochangelog-ready
-%endif

sources

@@ -1 +1 @@
-SHA512 (v5.0.0-rc1.tar.gz) = 95452d5489b167cff24620b5a7504e1363d8276cf4e7c026d43ea2e9b24dde1c595b6e763a1065087d876e5ad56e62f7cda6e53838abdeac7eeb3deadcfd88ae
+SHA512 (v5.4.2.tar.gz) = 482fde529766ca1b509a08bab4beb59a5935ebc6b27bc886c33597183258631e8c8db03ebb521baefd7989305aa76fad14c1359e211a0fe75c855c14bbaca960

tests/roles/run_bats_tests/files/run_bats_tests.sh

@@ -27,7 +27,7 @@ exec &> >(tee -a $FULL_LOG)
 echo "Packages:"
 echo "  Kernel: $(uname -r)"
 rpm -qa |\
-    egrep 'podman|conmon|containers-common|crun|runc|iptable|slirp|aardvark|netavark|containernetworking-plugins|systemd|container-selinux|passt' |\
+    grep -E 'buildah|skopeo|toolbox|podman|conmon|containers-common|crun|runc|iptable|slirp|aardvark|netavark|containernetworking-plugins|systemd|container-selinux|passt' |\
     sort |\
     sed -e 's/^/  /'
 

tests/run_podman_tests.yml

@@ -3,6 +3,11 @@
   dnf: name="podman-remote" state=installed
   when: podman_bin == "podman-remote"
 
+# As of podman 5.0, slirp is a soft dependency. Until/unless it is
+# actually deprecated, we continue to test with it.
+- name: "slirp4netns | install"
+  dnf: name="slirp4netns" state=installed
+
 - include_role:
     name: run_bats_tests
   vars:
@@ -13,10 +18,12 @@
       package: podman
       environment:
         PODMAN: /usr/bin/{{ podman_bin }}
+        PODMAN_TESTING: /usr/bin/podman-testing
         QUADLET: /usr/libexec/podman/quadlet
     - name: "{{ podman_bin }} rootless"
       package: podman
       environment:
         PODMAN: /usr/bin/{{ podman_bin }}
+        PODMAN_TESTING: /usr/bin/podman-testing
         QUADLET: /usr/libexec/podman/quadlet
       become: true

tests/test_podman.yml

@@ -31,8 +31,8 @@
     loop_control:
       loop_var: podman_bin
 
-  - name: test toolbox
-    include_tasks: test_toolbox.yml
+  - name: test toolbx
+    include_tasks: test_toolbx.yml
 
   # Postprocessing: check for FAIL or ERROR in any test, exit 1 if so
   - name: check results

tests/test_toolbx.yml

@@ -3,8 +3,9 @@
     name: run_bats_tests
   vars:
     tests:
-    - name: toolbox
+    - name: toolbx
       package: toolbox
       become: true
       environment:
+        TMPDIR: /var/tmp
         XDG_RUNTIME_DIR: /run/user/{{ rootless_uid }}