Update to 5.7.1 upstream release

Upstream tag: v5.7.1
Upstream commit: f845d14e

Commit authored by Packit automation (https://packit.dev/)

.gitignore

@@ -1876,3 +1876,21 @@
 /v5.3.1.tar.gz
 /v5.3.2.tar.gz
 /v5.4.0-rc2.tar.gz
+/v5.4.0-rc3.tar.gz
+/v5.4.0.tar.gz
+/v5.4.1.tar.gz
+/v5.4.2.tar.gz
+/v5.5.0-rc1.tar.gz
+/v5.5.0-rc2.tar.gz
+/v5.5.0.tar.gz
+/v5.5.1.tar.gz
+/v5.5.2.tar.gz
+/v5.6.0-rc1.tar.gz
+/v5.6.0-rc2.tar.gz
+/v5.6.0.tar.gz
+/v5.6.1.tar.gz
+/v5.6.2.tar.gz
+/v5.7.0-rc1.tar.gz
+/v5.7.0-rc2.tar.gz
+/v5.7.0.tar.gz
+/v5.7.1.tar.gz

.packit.yaml

@@ -36,30 +36,37 @@ packages:
   podman-eln:
     specfile_path: rpm/podman.spec
 
+# Disable automatic merging for Copr builds (and subsequent Testing Farm)
+merge_pr_in_ci: false
+
 srpm_build_deps:
   - git-archive-all
   - make
 
 actions:
-  fix-spec-file:
-    - "bash .packit.sh"
+  fix-spec-file: "bash .packit-copr-rpm.sh"
+  pre-sync: "bash .packit-rpm-git-commit.sh"
 
 jobs:
   - job: copr_build
     trigger: pull_request
     packages: [podman-fedora]
-    notifications: &packit_build_failure_notification
+    notifications: &packit_generic_failure_notification
       failure_comment:
-        message: "Ephemeral COPR build failed. @containers/packit-build please check."
+        message: "[NON-BLOCKING] Packit jobs failed. @containers/packit-build please check. Everyone else, feel free to ignore."
     enable_net: true
-    targets: &fedora_copr_targets
+    targets:
       - fedora-all-x86_64
       - fedora-all-aarch64
+    # Re-enable these scans if OpenScanHub starts scanning go packages
+    # https://packit.dev/posts/openscanhub-prototype
+    osh_diff_scan_after_copr_build: false
 
+  # Ignore until golang is updated in distro buildroot to go 1.23.3+
   - job: copr_build
-    trigger: pull_request
+    trigger: ignore
     packages: [podman-eln]
-    notifications: *packit_build_failure_notification
+    notifications: *packit_generic_failure_notification
     enable_net: true
     targets:
       fedora-eln-x86_64:
@@ -69,12 +76,13 @@ jobs:
         additional_repos:
           - "https://kojipkgs.fedoraproject.org/repos/eln-build/latest/aarch64/"
 
+  # Ignore until golang is updated in distro buildroot to go 1.23.3+
   - job: copr_build
-    trigger: pull_request
+    trigger: ignore
     packages: [podman-centos]
-    notifications: *packit_build_failure_notification
+    notifications: *packit_generic_failure_notification
     enable_net: true
-    targets: &centos_copr_targets
+    targets:
       - centos-stream-9-x86_64
       - centos-stream-9-aarch64
       - centos-stream-10-x86_64
@@ -84,62 +92,19 @@ jobs:
   - job: copr_build
     trigger: commit
     packages: [podman-fedora]
-    notifications:
-      failure_comment:
-        message: "podman-next COPR build failed. @containers/packit-build please check."
     branch: main
     owner: rhcontainerbot
     project: podman-next
     enable_net: true
 
+  # Tests on Fedora
   - job: tests
     trigger: pull_request
     packages: [podman-fedora]
-    targets: *fedora_copr_targets
-    require: &dev_tests
-      label:
-        absent:
-          - release
-    tf_extra_params:
-      environments:
-        - artifacts:
-          - type: repository-file
-            id: https://copr.fedorainfracloud.org/coprs/rhcontainerbot/podman-next/repo/fedora-$releasever/rhcontainerbot-podman-next-fedora-$releasever.repo
-    identifier: "dev"
-
-  - job: tests
-    trigger: pull_request
-    packages: [podman-fedora]
-    targets: *fedora_copr_targets
-    require: &release_tests
-      label:
-        present:
-          - release
-    preserve_project: true
-    identifier: "release"
-
-  # FIXME: Enable centos stream tests after containers-common is fixed
-  # FIXME: centos stream 10 currently also lacks bats
-  # https://bugzilla.redhat.com/show_bug.cgi?id=2329315
-  - job: tests
-    trigger: ignore
-    packages: [podman-centos]
-    targets: *centos_copr_targets
-    require: *dev_tests
-    tf_extra_params:
-      environments:
-        - artifacts:
-          - type: repository-file
-            id: https://copr.fedorainfracloud.org/coprs/rhcontainerbot/podman-next/repo/centos-stream-$releasever/rhcontainerbot-podman-next-centos-stream-$releasever.repo
-    identifier: "dev"
-
-  - job: tests
-    trigger: ignore
-    packages: [podman-centos]
-    targets: *centos_copr_targets
-    require: *release_tests
-    preserve_project: true
-    identifier: "release"
+    notifications: *packit_generic_failure_notification
+    targets:
+      - fedora-all
+    tmt_plan: "/plans/system/*"
 
   - job: tests
     identifier: cockpit-revdeps
@@ -156,12 +121,24 @@ jobs:
         - artifacts:
           - type: repository-file
             id: https://copr.fedorainfracloud.org/coprs/g/cockpit/main-builds/repo/fedora-$releasever/group_cockpit-main-builds-fedora-$releasever.repo
-          - type: repository-file
-            id: https://copr.fedorainfracloud.org/coprs/rhcontainerbot/podman-next/repo/fedora-$releasever/rhcontainerbot-podman-next-fedora-$releasever.repo
           tmt:
             context:
               revdeps: "yes"
 
+  - job: tests
+    identifier: tmt-revdeps
+    trigger: pull_request
+    packages: [podman-fedora]
+    notifications:
+      failure_comment:
+        message: "tmt tests failed for commit {commit_sha}. @lsm5, @psss, @thrix please check."
+    targets:
+      - fedora-latest
+    fmf_url: https://github.com/teemtee/tmt
+    fmf_path: /plans/friends
+    fmf_ref: main
+    tmt_plan: "/podman"
+
   - job: propose_downstream
     trigger: release
     update_release: false
@@ -169,13 +146,6 @@ jobs:
     dist_git_branches: &fedora_targets
       - fedora-all
 
-  - job: propose_downstream
-    trigger: release
-    update_release: false
-    packages: [podman-centos]
-    dist_git_branches:
-      - c10s
-
   - job: koji_build
     trigger: commit
     packages: [podman-fedora]

README.packit

@@ -1,3 +1,3 @@
 This repository is maintained by packit.
 https://packit.dev/
-The file was generated using packit 1.0.1.
+The file was generated using packit 1.12.0.post1.dev22+gfe66fd850.

gating.yaml

@@ -8,6 +8,7 @@ subject_type: koji_build
 rules:
   - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}
 
+# recipients: jnovy, lsm5, santiago
 --- !Policy
 product_versions:
   - rhel-*

plans/system.fmf

@@ -5,21 +5,15 @@ execute:
     how: tmt
 
 prepare:
+    - how: shell
+      script: modprobe null_blk nr_devices=1
+      order: 5
     - when: distro == centos-stream or distro == rhel
       how: shell
       script: |
         dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-$(rpm --eval '%{?rhel}').noarch.rpm
         dnf -y config-manager --set-enabled epel
       order: 10
-    - when: initiator == packit
-      how: shell
-      script: |
-        COPR_REPO_FILE="/etc/yum.repos.d/*podman-next*.repo"
-        if compgen -G $COPR_REPO_FILE > /dev/null; then
-            sed -i -n '/^priority=/!p;$apriority=1' $COPR_REPO_FILE
-        fi
-        dnf -y upgrade --allowerasing
-      order: 20
 
 adjust+:
     - enabled: false

plans/tmt.fmf

@@ -1,5 +1,10 @@
 summary: Run tmt container provision test (downstream only)
 
+enabled: false
+adjust+:
+    - enabled: true
+      when: initiator != packit and distro != rhel
+
 discover:
     how: fmf
     filter: 'tag:tmt & tag:downstream'
@@ -7,15 +12,6 @@ discover:
 execute:
     how: tmt
 
-provision:
-    how: artemis
-    hardware:
-        memory: ">= 16 GB"
-        cpu:
-            cores: ">= 4"
-            threads: ">=8"
-        disk:
-            - size: ">= 512 GB"
 prepare:
     - when: distro == centos-stream or distro == rhel
       how: shell
@@ -23,7 +19,3 @@ prepare:
         dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-$(rpm --eval '%{?rhel}').noarch.rpm
         dnf -y config-manager --set-enabled epel
       order: 10
-
-adjust+:
-    - enabled: false
-      when: revdeps == yes

plans/toolbox.fmf

@@ -1,4 +1,20 @@
 summary: Run toolbox tests (downstream only)
+
+enabled: false
+adjust+:
+    - enabled: true
+      when: initiator != packit and distro == fedora
+
+provision:
+    how: artemis
+    hardware:
+        memory: ">= 16 GB"
+        cpu:
+            cores: ">= 4"
+            threads: ">=8"
+        disk:
+            - size: ">= 512 GB"
+
 prepare:
     - name: packages
       how: install

podman.spec

@@ -7,27 +7,29 @@
 %global debug_package %{nil}
 %endif
 
-# RHEL's default %%gobuild macro doesn't account for the BUILDTAGS variable, so we
-# set it separately here and do not depend on RHEL's go-[s]rpm-macros package
-# until that's fixed.
-# c9s bz: https://bugzilla.redhat.com/show_bug.cgi?id=2227328
-%if %{defined rhel} && 0%{?rhel} < 10
-%define gobuild(o:) go build -buildmode pie -compiler gc -tags="rpm_crashtraceback libtrust_openssl ${BUILDTAGS:-}" -ldflags "-linkmode=external -compressdwarf=false ${LDFLAGS:-} -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -extldflags '%__global_ldflags'" -a -v -x %{?**};
-%endif
-
 %global gomodulesmode GO111MODULE=on
 
-%if %{defined rhel}
-# _user_tmpfiles.d currently undefined on rhel
-%global _user_tmpfilesdir %{_datadir}/user-tmpfiles.d
-%endif
-
 %if %{defined fedora}
 %define build_with_btrfs 1
+# qemu-system* isn't packageed for CentOS Stream / RHEL
+%define qemu 1
+# bats is included in the default repos (No epel/copr etc.)
+%define distro_bats 1
+%if %{?fedora} >= 43
+%define sequoia 1
+%endif
 %endif
 
 %if %{defined copr_username}
 %define copr_build 1
+%if "%{copr_username}" == "rhcontainerbot" && "%{copr_projectname}" == "podman-next"
+%define next_build 1
+%endif
+%endif
+
+# Only RHEL and CentOS Stream rpms are built with fips-enabled go compiler
+%if %{defined rhel}
+%define fips_enabled 1
 %endif
 
 %global container_base_path github.com/containers
@@ -43,8 +45,14 @@
 # podman-machine subpackage will be present only on these architectures
 %global machine_arches x86_64 aarch64
 
-Name: podman
 %if %{defined copr_build}
+%define build_origin Copr: %{?copr_username}/%{?copr_projectname}
+%else
+%define build_origin %{?packager}
+%endif
+
+Name: podman
+%if %{defined next_build}
 Epoch: 102
 %else
 Epoch: 5
@@ -55,14 +63,14 @@ Epoch: 5
 # If that's what you're reading, Version must be 0, and will be updated by Packit for
 # copr and koji builds.
 # If you're reading this on dist-git, the version is automatically filled in by Packit.
-Version: 5.4.0~rc2
+Version: 5.7.1
 # The `AND` needs to be uppercase in the License for SPDX compatibility
 License: Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND MIT AND MPL-2.0
 Release: %autorelease
 %if %{defined golang_arches_future}
 ExclusiveArch: %{golang_arches_future}
 %else
-ExclusiveArch: aarch64 ppc64le s390x x86_64
+ExclusiveArch: aarch64 ppc64le s390x x86_64 riscv64
 %endif
 Summary: Manage Pods, Containers and Container Images
 URL: https://%{name}.io/
@@ -91,7 +99,7 @@ BuildRequires: shadow-utils-subid-devel
 BuildRequires: pkgconfig
 BuildRequires: make
 BuildRequires: man-db
-BuildRequires: ostree-devel
+BuildRequires: sqlite-devel
 BuildRequires: systemd
 BuildRequires: systemd-devel
 Requires: catatonit
@@ -104,6 +112,10 @@ Requires: containers-common-extra >= 5:0.58.0-1
 %else
 Requires: containers-common-extra
 %endif
+%if %{defined sequoia}
+Requires: podman-sequoia
+%endif
+
 Obsoletes: %{name}-quadlet <= 5:4.4.0-1
 Provides: %{name}-quadlet = %{epoch}:%{version}-%{release}
 
@@ -139,22 +151,26 @@ pages and %{name}.
 Summary: Tests for %{name}
 
 Requires: %{name} = %{epoch}:%{version}-%{release}
-%if %{defined fedora}
+%if %{defined distro_bats}
 Requires: bats
 %endif
+Requires: attr
 Requires: jq
 Requires: skopeo
 Requires: nmap-ncat
 Requires: httpd-tools
 Requires: openssl
 Requires: socat
+Requires: slirp4netns
 Requires: buildah
 Requires: gnupg
+Requires: xfsprogs
 
 %description tests
 %{summary}
 
-This package contains system tests for %{name}
+This package contains system tests for %{name}. Only intended to be used for
+gating tests. Not supported for end users / customers.
 
 %package remote
 Summary: (Experimental) Remote client for managing %{name} containers
@@ -187,7 +203,17 @@ when `%{_bindir}/%{name}sh` is set as a login shell or set as os.Args[0].
 Summary: Metapackage for setting up %{name} machine
 Requires: %{name} = %{epoch}:%{version}-%{release}
 Requires: gvisor-tap-vsock
-Requires: qemu
+%if %{defined qemu}
+%ifarch aarch64
+Requires: qemu-system-aarch64-core
+%endif
+%ifarch x86_64
+Requires: qemu-system-x86-core
+%endif
+%else
+Requires: qemu-kvm
+%endif
+Requires: qemu-img
 Requires: virtiofsd
 ExclusiveArch: x86_64 aarch64
 
@@ -205,14 +231,6 @@ sed -i 's;@@PODMAN@@\;$(BINDIR);@@PODMAN@@\;%{_bindir};' Makefile
 sed -i '/DELETE ON RHEL9/,/DELETE ON RHEL9/d' libpod/runtime.go
 %endif
 
-# These changes are only meant for copr builds
-%if %{defined copr_build}
-# podman --version should show short sha
-sed -i "s/^const RawVersion = .*/const RawVersion = \"##VERSION##-##SHORT_SHA##\"/" version/rawversion/version.go
-# use ParseTolerant to allow short sha in version
-sed -i "s/^var Version.*/var Version, err = semver.ParseTolerant(rawversion.RawVersion)/" version/version.go
-%endif
-
 %build
 %set_build_flags
 export CGO_CFLAGS=$CFLAGS
@@ -229,29 +247,48 @@ export CGO_CFLAGS+=" -m64 -mtune=generic -fcf-protection=full"
 export GOPROXY=direct
 
 LDFLAGS="-X %{ld_libpod}/define.buildInfo=${SOURCE_DATE_EPOCH:-$(date +%s)} \
+         -X \"%{ld_libpod}/define.buildOrigin=%{build_origin}\" \
          -X %{ld_libpod}/config._installPrefix=%{_prefix} \
          -X %{ld_libpod}/config._etcDir=%{_sysconfdir} \
          -X %{ld_project}/pkg/systemd/quadlet._binDir=%{_bindir}"
 
+# This variable will be set by Packit actions. See .packit.yaml in the root dir
+# of the repo (upstream as well as Fedora dist-git).
+GIT_COMMIT="f845d14e941889ba4c071f35233d09b29d363c75"
+LDFLAGS="$LDFLAGS -X %{ld_libpod}/define.gitCommit=$GIT_COMMIT"
+
 # build rootlessport first
 %gobuild -o bin/rootlessport ./cmd/rootlessport
 
-export BASEBUILDTAGS="seccomp exclude_graphdriver_devicemapper $(hack/systemd_tag.sh) $(hack/libsubid_tag.sh)"
+export BASEBUILDTAGS="seccomp $(hack/systemd_tag.sh) $(hack/libsubid_tag.sh) libsqlite3 grpcnotrace"
+
+# libtrust_openssl buildtag switches to using the FIPS-compatible func
+# `ecdsa.HashSign`.
+# Ref 1: https://github.com/golang-fips/go/blob/main/patches/015-add-hash-sign-verify.patch#L22
+# Ref 2: https://github.com/containers/libtrust/blob/main/ec_key_openssl.go#L23
+%if %{defined fips_enabled}
+export BASEBUILDTAGS="$BASEBUILDTAGS libtrust_openssl"
+%endif
 
 # build %%{name}
-export BUILDTAGS="$BASEBUILDTAGS $(hack/btrfs_installed_tag.sh) $(hack/btrfs_tag.sh) $(hack/libdm_tag.sh)"
+export BUILDTAGS="$BASEBUILDTAGS $(hack/btrfs_installed_tag.sh)"
+
+%if %{defined sequoia}
+export BUILDTAGS="$BUILDTAGS containers_image_sequoia"
+%endif
+
 %gobuild -o bin/%{name} ./cmd/%{name}
 
 # build %%{name}-remote
-export BUILDTAGS="$BASEBUILDTAGS exclude_graphdriver_btrfs btrfs_noversion remote"
+export BUILDTAGS="$BASEBUILDTAGS exclude_graphdriver_btrfs remote"
 %gobuild -o bin/%{name}-remote ./cmd/%{name}
 
 # build quadlet
-export BUILDTAGS="$BASEBUILDTAGS $(hack/btrfs_installed_tag.sh) $(hack/btrfs_tag.sh)"
+export BUILDTAGS="$BASEBUILDTAGS $(hack/btrfs_installed_tag.sh)"
 %gobuild -o bin/quadlet ./cmd/quadlet
 
 # build %%{name}-testing
-export BUILDTAGS="$BASEBUILDTAGS $(hack/btrfs_installed_tag.sh) $(hack/btrfs_tag.sh)"
+export BUILDTAGS="$BASEBUILDTAGS $(hack/btrfs_installed_tag.sh)"
 %gobuild -o bin/podman-testing ./cmd/podman-testing
 
 # reset LDFLAGS for plugins binaries
@@ -271,11 +308,6 @@ PODMAN_VERSION=%{version} %{__make} DESTDIR=%{buildroot} PREFIX=%{_prefix} ETCDI
        install.remote \
        install.testing
 
-# See above for the iptables.conf declaration
-%if %{defined fedora} && 0%{?fedora} < 41
-%{__make} DESTDIR=%{buildroot} MODULESLOADDIR=%{_modulesloaddir} install.modules-load
-%endif
-
 sed -i 's;%{buildroot};;g' %{buildroot}%{_bindir}/docker
 
 # do not include docker and podman-remote man pages in main package
@@ -296,6 +328,9 @@ ln -s ../virtiofsd %{buildroot}%{_libexecdir}/%{name}
 #define license tag if not already defined
 %{!?_licensedir:%global license %doc}
 
+# Include empty check to silence rpmlint warning
+%check
+
 %files -f %{name}.file-list
 %license LICENSE vendor/modules.txt
 %doc README.md CONTRIBUTING.md install.md transfer.md

sources

@@ -1 +1 @@
-SHA512 (v5.4.0-rc2.tar.gz) = 74c6e59489e4fc473f23c4642e72bd60c434a4160b871b47032d95b8a06e73ad7d1032299f8a421a42084b3fd7d090afbfd2688781dc4753986bbeb3a686e523
+SHA512 (v5.7.1.tar.gz) = 81fd4c27ff1d16dcb85229d4e4fd2cb06943ddfe966b5324fa8a8a957b2d2ec2aed7c5da05d6c009148f53b76545b27b0cba506622c8861f70bf7cad6c214a08

test/tmt/system.fmf

@@ -1,14 +1,10 @@
 require:
-    - attr
-    - bats
-    - podman-remote
     - podman-tests
     - psmisc
-    - slirp4netns
 
 environment:
+    # PODMAN_TESTING envvar is set in system.sh
     PODMAN: /usr/bin/podman
-    PODMAN_TESTING: /usr/bin/podman-testing
     QUADLET: /usr/libexec/podman/quadlet
     ROOTLESS_USER: "fedora"
 adjust+:
@@ -18,13 +14,16 @@ adjust+:
     - when: distro == rhel
       environment+:
         ROOTLESS_USER: "cloud-user"
+    - when: initiator != "packit"
+      environment+:
+        RELEASE_TESTING: true
 
 /local-root:
     tag: [ local, root ]
     summary: local rootful test
     test: bash ./system.sh
     duration: 30m
-    
+
 /local-rootless:
     tag: [ local, rootless ]
     summary: rootless test
@@ -38,6 +37,8 @@ adjust+:
     duration: 30m
     environment+:
         PODMAN: /usr/bin/podman-remote
+    require+:
+        - podman-remote
 
 /remote-rootless:
     tag: [ remote, rootless ]
@@ -46,3 +47,5 @@ adjust+:
     duration: 30m
     environment+:
         PODMAN: /usr/bin/podman-remote
+    require+:
+        - podman-remote

test/tmt/system.sh

@@ -12,6 +12,7 @@ rpm -q \
     conmon \
     container-selinux \
     containers-common \
+    criu \
     crun \
     netavark \
     passt \
@@ -22,18 +23,18 @@ rpm -q \
     systemd
 
 export system_service_cmd="/usr/bin/podman system service --timeout=0 &"
-export test_cmd="whoami && cd /usr/share/podman/test/system && bats ."
+export test_cmd="whoami && cd /usr/share/podman/test/system && PODMAN_TESTING=/usr/bin/podman-testing bats ."
 
 if [[ -z $1 ]]; then
     if [[ $PODMAN == "/usr/bin/podman-remote" ]]; then
-        eval $system_service_cmd
+        eval "$system_service_cmd"
     fi
-    eval $test_cmd
+    eval "$test_cmd"
 elif [[ $1 == "rootless" ]]; then
     if [[ $PODMAN == "/usr/bin/podman-remote" ]]; then
         su - "$ROOTLESS_USER" -c "eval $system_service_cmd"
     fi
-    su --whitelist-environment=$(cat ./tmt-envvars | tr '\n' ',') - "$ROOTLESS_USER" -c "eval $test_cmd"
+    su - "$ROOTLESS_USER" -c "eval $test_cmd"
 fi
 
 # Kill all podman processes for remote tests

test/tmt/tmt-envvars

@@ -1,20 +0,0 @@
-TMT_TREE
-TMT_PLAN_DATA
-TMT_VERSION
-TMT_TEST_NAME
-TMT_TEST_DATA
-TMT_TEST_SERIAL_NUMBER
-TMT_TEST_ITERATION_ID
-TMT_TEST_METADATA
-TMT_SOURCE_DIR
-TMT_REBOOT_COUNT
-TMT_TEST_RESTART_COUNT
-TMT_TOPOLOGY_BASH
-TMT_TOPOLOGY_YAML
-TMT_TEST_PIDFILE
-TMT_TEST_PIDFILE_LOCK
-TMT_TEST_PIDFILE_ROOT
-PODMAN
-PODMAN_TESTING
-QUADLET
-ROOTLESS_USER

test/tmt/tmt.fmf

@@ -1,10 +1,9 @@
 enabled: false
 adjust:
     enabled: true
-    when: initiator != packit and distro != rhel-10 or distro != centos-stream-10
-
+    when: initiator != packit && distro != rhel
 summary: Make sure that TMT container provision works
-tag: [ tmt, downstream ]
+tag: [downstream]
 require:
   - tmt+provision-container
 test: