crun: update to 1.28-tip

Crosses both the 1.27 and 1.28 release tags. Adds json-c (>= 0.14) to
DEPENDS — upstream crun's configure.ac now does an unconditional
PKG_CHECK_MODULES([JSON_C], [json-c >= 0.14]) and won't configure without
it. The dep is satisfied by oe-core's json-c_0.18.bb.

Bumping crun to version 1.28-1-g7e45b26b, which comprises the following commits:

    54f16ffb NEWS: tag 1.28
    c6f338ac Do not follow rootfs /dev symlinks (CVE-2026-47766)
    535e114b krun: request enabling DHCP client
    e521de6a krun: check krun_add_net_unixstream dlsym
    bd939e69 tests: add libzstd-devel to fuzzing Dockerfile
    1edb6cc7 tests, system-blake3: drop libyajl-dev
    21c96879 krun: document microVM configuration options in man page
    a6151b6a krun: add support for nested virtualization
    9f67d80b Build: Use system libblake if available
    b62cfdda Replace YAJL with json-c for JSON parsing and generation
    b1cf0328 status: restrict valid container ID names
    7771192e cgroup: reject ".." in delegate-cgroup annotation
    a773c6bb tests: set executable bit for python test files
    5fc99f02 tests: drop centos8-build CI job
    a8deee3b chroot_realpath: fix potential buffer overflows in destination buffer
    db1be9b2 .clang-format: fixup for v22.1.4
    d914b7d8 exec: use default env with --env
    d85bf0e8 crun exec: more verbose exec error message
    8fab8854 build(deps): bump uraimo/run-on-arch-action from 3.0.1 to 3.1.0
    ac46d9a0 krun: allow configuring the virtiofs device
    3212b444 fix: correct UID/GID mapping buffer offset for multi-line mappings
    d328b172 krun: fix parsing optional fields from krun_vm.json
    738f7ad7 krun: reopen config file
    d0277ef8 libcrun: use O_PATH where applicable
    3ec076b3 NEWS: tag 1.27.1
    60b2e8f8 tests, podman: pin to 5.8
    3010d29d tests: fix failure in user namespace
    d6ffa244 krun: remove unused variable
    1c5c2f7d linux: pass correct propagation to get_bind_mount
    d97461f0 tests: add regression test for idmapped mount leak
    59cfa8b8 Revert "linux: skip redundant MS_PRIVATE propagation mounts"
    f1b70c0b tests: add subcgroup cleanup test
    6177dd86 cgroup: fix recursive cgroup cleanup consuming caller's fd
    6c58b0c6 fix -Wdiscarded-qualifiers warnings
    acb904c6 krun: Build passt argv based on nitro variant
    8199cbb2 krun: implement support for passt networking
    7c2500df krun: ignore RAM configurations below 128MB
    23f7d9f0 krun: consolidate configuration in configure_vm
    04c19ac6 krun: process the vm configuration earlier
    81c21e0d handlers: add new hook to close fds
    d8813f3d .codespellrc: ignore passt
    94d7f641 utils: fix apparmor profile not applied in user namespaces
    805e6a44 libcrun: skip cgroup filesystem type check when cgroups are disabled
    4c530d43 libcrun: fall back to bind mount for /dev/console on read-only file systems
    a718a92c NEWS: tag 1.27
    6220914d nix: generate git-version.h in buildPhase
    9553f8b8 exec: strengthen -u value validation
    1bd7f424 exec: fix CVE-2026-30892
    5699da29 nix: fix zlib cross-compilation for s390x
    237f8100 nix: remove global overlay to eliminate rebuild cascade
    b37594dc release: use path: flake ref to avoid libgit2 safe.directory
    aaa6056c release: seed /nix from container image when empty
    c4e3fd22 linux: set MS_PRIVATE on detached mounts from get_bind_mount()
    360621a3 Revert "container: skip sigaction reset in unblock_signals for the run path"
    5d1b0284 nix: migrate to flakes
    246a3367 nix: generate git-version.h in buildPhase
    3e9986bc nix: bump nixos/nix image from 2.24.9 to 2.34.2
    094c97f3 nix: update
    195f664f seccomp_notify: tighten crun_make_error input
    1d76be72 seccomp: tighten crun_make_error input
    62d3e852 container: tighten crun_make_error input
    254a8a75 linux: use open_tree+mount_setattr for device mounts
    2d6f4c0e linux: use open_tree+move_mount for masked paths
    45e62ce5 linux: use open_tree+mount_setattr for readonly paths
    f53aa376 linux: use mount_setattr for readonly remounts in finalize_mounts
    2dae2238 linux: skip redundant MS_PRIVATE propagation mounts
    38e17199 container: skip sigaction reset in unblock_signals for the run path
    4b66d8f0 cgroup: skip enable_controllers when joined via CLONE_INTO_CGROUP
    a59b186b linux: validate run.oci.mount_context_type annotation value
    16bd4e48 utils: do not use errno after success
    63ce25da container: delete the container on poststart hooks failures

crun/ocispec: update to latest

    fb6b69f src: replace YAJL with json-c for JSON parsing and generation
    eb7489b fuzzing: add multi-mode round-trip fuzzer and CI job
    e6cba25 tests: add test-15 for int64 and uint64 value parsing
    f6f93b0 validate: fix LibFuzzer build by removing HF_ITER and guarding main()
    f310714 tests: fix memory leak of error string in test-2
    1315777 ci: update GitHub Actions to non-deprecated versions
    7e13990 ci: pin to ubuntu 24.04
    015bb87 sources: extract compound field generate pattern into emit_compound_gen()
    37bba6c sources: extract pointer clone pattern into emit_pointer_clone()
    be6fbb4 sources: use free_and_null() in pointer type emit_free methods
    92f2b1d sources: extract common array generate preamble into helper
    790d3a6 sources: extract common array parse preamble into helper
    689ac4b sources: centralize JSON library references into json_api.py
    5a0e037 source: fix ByteArrayHandler nested array parsing
    03bae1d source: add missing emit_clone() to BasicMapArrayHandler
    dbb5155 source: fix invalid else() syntax in byte array generation
    692b0b6 source: fix typo in ByteArrayHandler nested array parsing
    2acd6dc source: fix mapStringObject clone to copy len and keys

crun/rspec: update to v1.3.0-tip

    63c1dd6 Blank line before table Fixes #1134
    c668b01 config-linux: allow empty strings in memory policy nodes field
    0ef13af Add step to update website after a release

crun/imagespec: update to v1.1.1-tip

    751ed12 Fix one-sentence-per-line violations
    b9060a3 Clarify that whiteout filenames require a non-empty basename
    fccd049 Fix: Make the config field optional

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>

1 files changed, 6 insertions, 6 deletions

diff --git a/recipes-containers/crun/crun_git.bb b/recipes-containers/crun/crun_git.bb
index d2f7b63b..1fa9f886 100644
--- a/recipes-containers/crun/crun_git.bb
+++ b/recipes-containers/crun/crun_git.bb
@@ -3,10 +3,10 @@ LICENSE = "GPL-2.0-only"
 LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263"
 PRIORITY = "optional"
 
-SRCREV_crun = "393509db566bedea037d1599c5a58b896f5d3b01"
-SRCREV_libocispec = "8b07b619df73a113f7721f1c7ce24f2572b04cea"
-SRCREV_ispec = "a4c6ade7bb82b316d45391f572727a63e268b252"
-SRCREV_rspec = "6f7b71c2d216403715f7364ac88dec88d9da989c"
+SRCREV_crun = "7e45b26ba9524290af70ffe645911f7e032d6913"
+SRCREV_libocispec = "8034d0ecd27f646ba3ffae5ff24db234ce062825"
+SRCREV_ispec = "13cff54902ec9ad6320cbc487a685b66fcd67171"
+SRCREV_rspec = "6999a89a76a0329f440d5740497bedb9dd431297"
 SRCREV_yajl = "f344d21280c3e4094919fd318bc5ce75da91fc06"
 
 SRCREV_FORMAT = "crun_rspec"
@@ -19,7 +19,7 @@ SRC_URI = "git://github.com/containers/crun.git;branch=main;name=crun;protocol=h
            file://0002-libocispec-fix-array-items-parsing.patch;patchdir=libocispec \
           "
 
-PV = "1.26.0+git"
+PV = "1.28.0+git"
 
 inherit autotools-brokensep pkgconfig features_check
 
@@ -44,7 +44,7 @@ PACKAGECONFIG[man] = ",,go-md2man-native"
 PACKAGECONFIG[seccomp] = "--enable-seccomp,--disable-seccomp,libseccomp"
 PACKAGECONFIG[systemd] = "--enable-systemd,--disable-systemd,systemd"
 
-DEPENDS = "m4-native"
+DEPENDS = "m4-native json-c"
 DEPENDS:append:libc-musl = " argp-standalone"
 
 do_configure:prepend () {