summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* crun: update to 1.28-tipBruce Ashfield2026-05-281-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Crosses both the 1.27 and 1.28 release tags. Adds json-c (>= 0.14) to DEPENDS — upstream crun's configure.ac now does an unconditional PKG_CHECK_MODULES([JSON_C], [json-c >= 0.14]) and won't configure without it. The dep is satisfied by oe-core's json-c_0.18.bb. Bumping crun to version 1.28-1-g7e45b26b, which comprises the following commits: 54f16ffb NEWS: tag 1.28 c6f338ac Do not follow rootfs /dev symlinks (CVE-2026-47766) 535e114b krun: request enabling DHCP client e521de6a krun: check krun_add_net_unixstream dlsym bd939e69 tests: add libzstd-devel to fuzzing Dockerfile 1edb6cc7 tests, system-blake3: drop libyajl-dev 21c96879 krun: document microVM configuration options in man page a6151b6a krun: add support for nested virtualization 9f67d80b Build: Use system libblake if available b62cfdda Replace YAJL with json-c for JSON parsing and generation b1cf0328 status: restrict valid container ID names 7771192e cgroup: reject ".." in delegate-cgroup annotation a773c6bb tests: set executable bit for python test files 5fc99f02 tests: drop centos8-build CI job a8deee3b chroot_realpath: fix potential buffer overflows in destination buffer db1be9b2 .clang-format: fixup for v22.1.4 d914b7d8 exec: use default env with --env d85bf0e8 crun exec: more verbose exec error message 8fab8854 build(deps): bump uraimo/run-on-arch-action from 3.0.1 to 3.1.0 ac46d9a0 krun: allow configuring the virtiofs device 3212b444 fix: correct UID/GID mapping buffer offset for multi-line mappings d328b172 krun: fix parsing optional fields from krun_vm.json 738f7ad7 krun: reopen config file d0277ef8 libcrun: use O_PATH where applicable 3ec076b3 NEWS: tag 1.27.1 60b2e8f8 tests, podman: pin to 5.8 3010d29d tests: fix failure in user namespace d6ffa244 krun: remove unused variable 1c5c2f7d linux: pass correct propagation to get_bind_mount d97461f0 tests: add regression test for idmapped mount leak 59cfa8b8 Revert "linux: skip redundant MS_PRIVATE propagation mounts" f1b70c0b tests: add subcgroup cleanup test 6177dd86 cgroup: fix recursive cgroup cleanup consuming caller's fd 6c58b0c6 fix -Wdiscarded-qualifiers warnings acb904c6 krun: Build passt argv based on nitro variant 8199cbb2 krun: implement support for passt networking 7c2500df krun: ignore RAM configurations below 128MB 23f7d9f0 krun: consolidate configuration in configure_vm 04c19ac6 krun: process the vm configuration earlier 81c21e0d handlers: add new hook to close fds d8813f3d .codespellrc: ignore passt 94d7f641 utils: fix apparmor profile not applied in user namespaces 805e6a44 libcrun: skip cgroup filesystem type check when cgroups are disabled 4c530d43 libcrun: fall back to bind mount for /dev/console on read-only file systems a718a92c NEWS: tag 1.27 6220914d nix: generate git-version.h in buildPhase 9553f8b8 exec: strengthen -u value validation 1bd7f424 exec: fix CVE-2026-30892 5699da29 nix: fix zlib cross-compilation for s390x 237f8100 nix: remove global overlay to eliminate rebuild cascade b37594dc release: use path: flake ref to avoid libgit2 safe.directory aaa6056c release: seed /nix from container image when empty c4e3fd22 linux: set MS_PRIVATE on detached mounts from get_bind_mount() 360621a3 Revert "container: skip sigaction reset in unblock_signals for the run path" 5d1b0284 nix: migrate to flakes 246a3367 nix: generate git-version.h in buildPhase 3e9986bc nix: bump nixos/nix image from 2.24.9 to 2.34.2 094c97f3 nix: update 195f664f seccomp_notify: tighten crun_make_error input 1d76be72 seccomp: tighten crun_make_error input 62d3e852 container: tighten crun_make_error input 254a8a75 linux: use open_tree+mount_setattr for device mounts 2d6f4c0e linux: use open_tree+move_mount for masked paths 45e62ce5 linux: use open_tree+mount_setattr for readonly paths f53aa376 linux: use mount_setattr for readonly remounts in finalize_mounts 2dae2238 linux: skip redundant MS_PRIVATE propagation mounts 38e17199 container: skip sigaction reset in unblock_signals for the run path 4b66d8f0 cgroup: skip enable_controllers when joined via CLONE_INTO_CGROUP a59b186b linux: validate run.oci.mount_context_type annotation value 16bd4e48 utils: do not use errno after success 63ce25da container: delete the container on poststart hooks failures crun/ocispec: update to latest fb6b69f src: replace YAJL with json-c for JSON parsing and generation eb7489b fuzzing: add multi-mode round-trip fuzzer and CI job e6cba25 tests: add test-15 for int64 and uint64 value parsing f6f93b0 validate: fix LibFuzzer build by removing HF_ITER and guarding main() f310714 tests: fix memory leak of error string in test-2 1315777 ci: update GitHub Actions to non-deprecated versions 7e13990 ci: pin to ubuntu 24.04 015bb87 sources: extract compound field generate pattern into emit_compound_gen() 37bba6c sources: extract pointer clone pattern into emit_pointer_clone() be6fbb4 sources: use free_and_null() in pointer type emit_free methods 92f2b1d sources: extract common array generate preamble into helper 790d3a6 sources: extract common array parse preamble into helper 689ac4b sources: centralize JSON library references into json_api.py 5a0e037 source: fix ByteArrayHandler nested array parsing 03bae1d source: add missing emit_clone() to BasicMapArrayHandler dbb5155 source: fix invalid else() syntax in byte array generation 692b0b6 source: fix typo in ByteArrayHandler nested array parsing 2acd6dc source: fix mapStringObject clone to copy len and keys crun/rspec: update to v1.3.0-tip 63c1dd6 Blank line before table Fixes #1134 c668b01 config-linux: allow empty strings in memory policy nodes field 0ef13af Add step to update website after a release crun/imagespec: update to v1.1.1-tip 751ed12 Fix one-sentence-per-line violations b9060a3 Clarify that whiteout filenames require a non-empty basename fccd049 Fix: Make the config field optional Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* criu: update to v4.2-tipBruce Ashfield2026-05-282-11/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Switches the recipe from 'master' (frozen at v4.2 tag) to 'criu-dev' (active development), picking up 211 commits past v4.2 — including AMDGPU plugin work, kernel 7.0 rseq compat, protobuf 7.x compat, and a host of restore/zdtm fixes. Two recipe-side adjustments are needed for the new tree to build under OE: - Set HOSTCC=${BUILD_CC} so the compel host-tool build can find a host compiler. Upstream commit 36c63ecb5 ("make: default CC to cc instead of gcc") changed scripts/nmk/scripts/tools.mk to default HOSTCC to 'cc', which the native sysroot doesn't provide (only the prefixed x86_64-poky-linux-gcc). - Refresh 0001-plugins-cuda-pass-DEBUG_PREFIX_MAP.patch for new context: upstream added $(DEFINES) to the cuda_plugin.so build line, so the refreshed patch now inserts our $(DEBUG_PREFIX_MAP) before $(DEFINES) rather than at the (no-longer-present) original position. Bumping criu to version v4.2-211-g4d76d1acd, which comprises the following commits: 4d76d1acd ci: shard alpine-test into parallel jobs to reduce CI time da5b7bf82 zdtm: unregister rseq before zeroing the rseq area 3db4b0922 plugins/amdgpu: Fix unbalanced quotes in a warning message 3805d59cc plugins/amdgpu: Demote one more error to warning 71be2f42e plugins/amdgpu: Fix strtoul error handling eca973251 plugins/amdgpu: Fixup printf format in env handling f73bf1b05 plugins/amdgpu: Reduce scope of some globals 1961c5e0d plugins/amdgpu: Cleanup env variable handling e40e6f766 restore: add missing continue in restorer_get_vma_hint b0b89a94f zdtm: check reservation mmaps are restored correctly 7daaa11aa mem: don't PROT_WRITE on reservation mmaps 2c9ee0abd restore: update prev_vma_end after processing the last vma in a list 5039458f6 pie/restorer: normalize tv_nsec when re-anchoring absolute timerfd expiry 9a1453b38 compel: keep ELF metadata for ld.lld 36c63ecb5 make: default CC to cc instead of gcc 4bc9adf11 contrib: add tests for criu-service-client 57a92dbb3 contrib: add reference client for criu-service 14cb3c201 net: Route veth restore through usernsd for userns mode c1cea9004 pycriu: Fix FieldDescriptor.label removal in protobuf 7.x 5546c06a1 zdtm: Fix rseq01 test for kernel 7.0 rseq changes 9777d2cf0 zdtm: Skip socket_udplite test when kernel lacks UDPLITE 09d7f7a2e ci: Add vanilla next kernel test variant to Lima CI job 189ad2c6f sockets: Treat UDPLITE as optional in collect_err() f6b7fb610 plugins/amdgpu: Fix remaining wrong usages of pr_perror 543612ae4 plugins/amdgpu: amdgpu_plugin_drm_restore_file() does not need to use libdrm 4cf1e190e plugins/amdgpu: Use save_vma_updates for all call sites 93ee1c527 plugins/amdgpu: Do not try dmabuf fd restore if render restore failed 9a65f7ede plugins/amdgpu: Convert away from libc buffered file IO 909eb890f plugins/amdgpu: Use the load_img helper in drm file restore 65f7baaf0 plugins/amdgpu: Move drm file dump and restore into helpers 05961714e plugins/amdgpu: Add plugin to inventory even if process has no vmas 7041509a5 plugins/amdgpu: Check sdma operation type early and once 8315b1a7a plugins/amdgpu: Fix open_drm_render_device() a85c10c77 plugins/amdgpu: Do not eat the errno in kmtIoctl e656198ca plugins/amdgpu: Reduce amount of debug logging a little bit 59eac8cc6 plugins/amdgpu: Remove plugin_log_msg() ea080673b plugins/amdgpu: Consolidate vm_info collection 5659b3954 plugins/amdgpu: Correct offset type and add error handling for seek operations 830e6cd3b plugins/amdgpu: Flatten amdgpu_restore_init a bit b9b1600bf plugins/amdgpu: Close dma-buf image file if the read fails 19baa7c37 plugins/amdgpu: Close the directory when image probing fails 0bd0c14bd plugins/amdgpu: Propagate failure to save buffer object content e26ed5163 plugins/amdgpu: Fix logging of failures to open files during restore init b1281444a plugins/amdgpu: Fix drm pages size header c0002ed83 plugins/amdgpu: Remove unused new_minor from struct vma_metadata ae4ed06f5 plugins/amdgpu: Remove unused current_pid global variable 52faca651 plugins/amdgpu: Fix one error message 9293f14fd plugins/amdgpu: Check that image unpacking worked during plugin init 5b88d1690 plugins/amdgpu: Fix shared memory allocation and teardown 81df65929 plugins/amdgpu: Use correct sizes to unmap sdma copy objects 47ab00240 plugins/amdgpu: Fix error handling in plugin init d96a2eb29 plugins/amdgpu: Close file on failures in amdgpu_plugin_dmabuf_restore 79c347c1e plugins/amdgpu: Clarify open_img_file docstring 592f04507 files-reg: warn when external file has no inherit-fd mapping on restore 176f14019 zdtm/bpfmap: parse frozen field with SCNu32 1e200015a proc_parse: Preallocate extra space for possible option string growth 9afe2e92d zdtm/ipc: use snprintf and bounded writes for sysctl payloads 740d67749 zdtm/ipc: close sysctl fd on write error paths 712f68d49 zdtm/packet_sock_mmap: keep parser warning-free with unsigned maj/min d24bfbf7d test/bers: use size_t format specifiers for file counters 3d5eb1c14 proc_parse: use matching unsigned formats for uid/gid and tfd parsing f943d4f32 bfd: fix partial write handling in bwritev() 78a712021 bfd: Support dynamic buffer resizing 351a16cab plugin/amdgpu: validate dmabuf_fd before drmPrimeFDToHandle() call 315fbed8f plugin/amdgpu: fix resource leaks in drm dump error paths b518e768c plugin/amdgpu: fix use of uninitialized pointers on partial allocation failure c2fba65e5 plugin/amdgpu: fix device handle leak in handle_for_shared_bo_fd() 9965ede5c plugin/amdgpu: set errno in open_img_file() on read/write failure 3e8d166ab plugin/amdgpu: fix fd leak in open_img_file() on fdopen failure 8e36132ef plugin/amdgpu: fix resource leaks in drm restore error paths b8d118a75 plugin/amdgpu: fix memory leak in dmabuf restore error paths 16b252ee2 plugin/amdgpu: add missing xzalloc() NULL checks in drm af32d407a plugin/amdgpu: check posix_memalign() return value 611af0188 plugin/amdgpu: add open_img_file error handling 22c3ab6b8 proc: Fix potential buffer overflow in parse_threads e956db75f restore: Fix exit code truncation for zombies c11579493 criu: Fix garbage write to /proc files fbcc99480 restore: Fix incorrect mmap error check 2c20b0482 restore: Fix memory leak of siginfo_priv_nr b0ebc416a restore: Fix memory leaks in CoreEntry handling 128566551 ci: remove aarch64 Fedora Rawhide from Cirrus CI 81f26b6b1 ci: add aarch64 matrix build for Fedora Rawhide test 87951452f test/rpc: clean up stale pidfile and socket before starting service ab28d4466 test/rpc: add page server address test f513ac16a cr-service: fix address handling of requests b19f73467 zdtm: add pipe_owner test for pipe ownership preservation fa7918890 pipes: restore pipe ownership to fix /proc/self/fd access 711b4ebfb ci: port Vagrant Fedora Rawhide test to GitHub Actions 9d8b23d5d ci: fix podman pids limit for thread-bomb test 4bcf08ce7 compel: fix heap alignment for structs with xsave state e39ff5228 tests: it seems 30 seconds timeout is not always enough 31d941ba7 sk-queue: increase CMSG_MAX_SIZE to handle all SCM types 7539f399f coredump: enable coredump generation on riscv64 c70a4b384 zdtm: add timerslack_ns test b258d6454 criu: restore timer_slack_ns per thread dfed6f073 criu: collect and dump timer_slack_ns per thread 985e6c6dd images: add timerslack_ns field to thread_core_entry 21c14313d contributing: document AI-assisted contribution guidelines 33dca7905 zdtm: add file_lease05 test for broken read lease restore 64c8d4a11 file-lock: fix type confusion in broken lease restore 33e340bed zdtm: fix TOCTOU race creating criu.tree directory 010a346c6 feat: remove build-time patches from Nixpkgs bbcadd85f feat: specify ourselves as Nix flake source f81e46b73 ci: upgrade CodeQL actions from v3 to v4 bce0a3c75 plugin/amdgpu: Don't print error when restoring drm file bd4cd4e9e plugin/amdgpu: Check output of open_img_file af3f4be06 ci: remove mips64el-stable-cross and mips64el-unstable-cross 7582216e1 loongarch64: implement atomic_dec_and_test 65cb18af2 pycriu: Force python protobuf backend in 3.14+ c9a0190f0 ci: mark archlinux-test as continue-on-error a13ce915c zdtm: use private bind-mount as GCOV external mount target e6bea0372 ci: stabilize gcov-test coverage upload bcd66dc30 scripts: fully qualify base image references a72bf212e scripts: improve layer caching of container builds 941f9b108 readme: update reference to consolidated workflows 5e1531888 ci: use clean state before self-contained check 5add27e6c compel/infect: optimize compel_stop_tasks_on_syscall 4a67a9a46 restorer: use atomic to synchronize threads e718fac15 compel: simplify compel_stop_on_syscall 7daebbe46 compel: remove hardware breakpoint usage 869d481cf restore: parallelize task stopping in attach_to_tasks and catch_tasks 15f11e404 compel/infect: Use waitpid with specific PIDs in compel_stop_tasks_on_syscall 09134c8ca restore: read user ns from pstree ids image f5974cc32 pagemap-cache: stop filling cache on VMA_AREA_GUARD 1bcbc55eb criu: fix double-open of userns image in --stream mode 04f1b9fb6 test: libcriu: use installed headers and library 3f3acc320 scripts: rseq: fix detection of rseq_cpu_id_state 8c29a7ccd ci: Consolidate test workflows and gate them by Alpine Test 5468d4a53 plugin/amdgpu: fix pr_perror trailing newline 555b257c5 plugin/amdgpu: Catch error for failure to open drm device 50e22d80a sk-queue: Fix memory leaks in error paths 1524ffc99 sk-queue: Add missing MSG_CTRUNC check in dump_sk_queue c180188db zdtm: fix incorrect open() syscall use for file creation without mode f22c95d2d restore: move cgroup restore after creds are prepared 1a4b338ed unix: fix dangling pointers in icon hash on error path 813e1a525 sk-inet: remove trailing whitespace 39c66a704 pagemap: detect EOF on truncated pages in process_async_reads() cf2b8c4bc restorer: detect EOF on truncated pages file to prevent infinite loop 7c5b745c6 MAINTAINERS: Update maintainer roles c5b81c0d7 Add UPDATE_INETSK hook for inet address rewrite cff99dbcc fsnotify: Fix mnt_id type to avoid undefined behavior with -1 sentinel 859924c2f fsnotify: Check mntns_get_root_by_mnt_id() return value in get_mark_path() 82c09bb92 ci: Re-enable zdtm/static/binfmt_misc 5c994447a zdtm/static/binfmt_misc: make the random generation actually random 838a59087 zdtm/static/binfmt_misc: run cleanup hook before restore 577c9a0f2 zdtm.py: ignore utf-8 conversion errors in test logs e6510a338 criu: Support binfmt_misc sandboxing ecab9e357 criu: kerndat: add kerndat_has_binfmt_misc_sandboxing() 0ae3a9498 criu: Remove legacy binfmt_misc handling code 100b3087f compel/x86: probe kernel task_size at runtime c676864d4 test: Add ZDTM test for SIGEV_THREAD_ID timer on thread leader aef72658c dump: Initialize thread leader's vtid before dumping posix timers 4d293afbe page-xfer: Fix page_read resource leak in page_pipe_from_pagemap() b5d531eb4 sk-unix: fix mutex_ghost deadlock on connect failure in post_open_standalone fc2cddbdb plugin/amdgpu: Allow dump with victim unable to see all gpus cfccc8387 fsnotify: Fix memory leak in pre_dump_one_fanotify error path 90407c014 fsnotify: Fix memory leak in pre_dump_one_inotify error path 155514d34 fsnotify: Improve error messages with more context 9e2c0cc56 fsnotify: Fix file descriptor leak in restore_one_inotify() 15bd86094 github: add Copilot repository-specific instructions 9e5fbcd66 pycriu: Fix self-dump failure with explicit PID 21a675826 cr-restore/shstk: Make arch_shstk_unlock use correct pid 07af3304f restore/pie: check return value of sys_rseq on unregister fb59ae504 test: fix GCC 16 compile error b208bec12 crit: show dead task_state 9885fb3c7 crit: fix incorrect task state decoding 71fe85ec9 ci: add iproute2 to the list of packages in apt-packages.sh 36f1e9d38 amdgpu: use fseeko with large-file support instead of fseeko64 ddf7a170f infect-types: fix user_gcs redefine error 2dd66866e zdtm/cgroup_stray: fix uninitialized variable 974c1bc89 zdtm/tempfs_subns: fix uninitialized variable b1a51489d compel: fix sys_clock_gettime function signature fc1867c44 kerndat: Fix error handling for kerndat_has_timer_cr_ids() fail 2e5f9facf util: Make close_safe() reset fd to -1 even on close() failure d4e811413 readme: use a local copy of the CRIU logo 30acbabcd ci: also exclude docker version 29 f66e59ee5 cr-dump: fix error handling f78bea8d3 zdtm: gcs: add opt-in GCS test support for AArch64 d591e320e criu/restore: gcs: adds restore implementation for Guarded Control Stack 2429d49e6 criu/dump: gcs: save GCS state during dump 41ecb7ac7 images: aarch64: add user_aarch64_gcs_entry 92e6e523b compel: gcs: add opt-in GCS test support for AArch64 2f676d20e compel: gcs: set up GCS token/restorer for rt_sigreturn 6bb856b0a compel: gcs: initial GCS support for signal frames 73ca07148 gcs: add GCS constants and helper macros 501b714f7 compel/aarch64: refactor fpregs handling 90300748e tty: fix compiler error 09bb36266 restore: fix "Defect type: UNINIT" bf82389de dump: fix "Defect type: IDENTICAL_BRANCHES" 2cf8f13ca doc: update pipe/socket examples for --inherit-fd 62aadb22a amdgpu: use 64-bit offsets for parallel restore 1db7eed69 amdgpu: use local kernel headers instead of libdrm 29525f8cb codespell: skip amdgpu kernel headers e4a5e164b plugins/amdgpu: update kernel headers f56ccfd2d plugins/amdgpu: remove unused variable 6ed49894c plugins/amdgpu: add a comment for retry_needed 77e6558dd plugins/amdgpu: apply code-style fixes 690b61043 plugins/amdgpu: return 0 in post_dump_dmabuf_check ff35a9126 plugins/amdgpu: remove excessive debug messages 9e404e208 plugin/amdgpu: Support for checkpoint of dmabuf fds d43217dad plugin: Add DUMP_DEVICES_LATE callback db0ec806d plugin/amdgpu: Add handling for amdgpu drm buffer objects 5eb61e1b1 plugin/amdgpu: Add drm header 0b7ca29c1 plugin/amdgpu: Add amdgpu drm header fb02dbf68 files-ext: Allow plugin files to retry 7a4ee0ae8 restorer: Skip non-regular VMAs 920437205 plugins/amdgpu: Update `README.md` and `criu-amdgpu-plugin.txt` 4a3a695df plugins/amdgpu: Implement parallel restore 33ed774c8 plugins/amdgpu: Add parallel restore command 638614075 plugins/amdgpu: Add socket operations ddbb3dbd8 limit the field width of 'scanf' 3c7d4fa01 criu: Version 4.2 (CRIUTIBILITY) Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* cri-tools: update to v1.36.0-tipBruce Ashfield2026-05-282-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumping cri-tools to version v1.36.0-90-g5b24423f, which comprises the following commits: 722f32d9 enable zizmor 44739caa build(deps): bump the gomod group with 4 updates 672af9eb align local containerized test with CI 4d8700e0 crictl: deduplicate pull-related CLI flags 327420d2 crictl: extract generic resourceStatus to deduplicate status functions feb33d5f Remove accidentally committed crictl binary 599eb98f crictl: extract shared helpers and fix ContainerStats context ca182722 build(deps): bump crate-ci/typos from 1.46.2 to 1.46.3 41d99943 RunPodSandbox state contract and blocking behavior 924b3f91 add a root span 27965b7a task: add prettier to dependencies 85613d53 build(deps): bump the gomod group with 2 updates cca05915 crictl: add unit tests for utility functions afc8031e crictl: replace sort.Sort types with slices.SortFunc 1132c1ec task: bump ubuntu to latest LTS baef25ec crictl: consolidate pull flag definitions 672f15df hack/tools: update cri-dockerd to v0.4.3 and go-md2man to v2.0.7 1cb460d4 crictl: use sentinel error for empty ID validation 2b23070f ci: cancel in-progress workflow runs on new push f8a06b7b crictl: encapsulate global config and add client injection for testability d4020096 smoke test for NRI integration tests fcce23a4 Bump crate-ci/typos from 1.46.1 to 1.46.2 64b7931f Bump the gomod group with 2 updates 09088498 bump k8s.io dependencies to v0.36.1 e283eb1f Bump google.golang.org/grpc from 1.81.0 to 1.81.1 in the gomod group 2936afd8 ci: declare contents: read across the 4 remaining workflows d1a6602a Bump Go version to 1.26.3 4fb994e1 Bump the gomod group across 1 directory with 3 updates 9670a1a9 Bump crate-ci/typos from 1.46.0 to 1.46.1 1cdbfd11 Bump the gomod group with 3 updates a48b368f fix: use full path for go-md2man in verify-docs.sh 3be057e2 bumped linter and made it run on all platforms 00547873 Bump github.com/opencontainers/selinux in the gomod group d4532c43 refactor: move linux-specific validation code to separate files 5d60ceed local dev docker-based containerd environment 37552aba improve agent docs and fix zeitgeist for macOS ebd7d9b8 Bump google.golang.org/grpc from 1.80.0 to 1.81.0 in the gomod group 9dcc45fc Bump crate-ci/typos from 1.45.2 to 1.46.0 40f63b5b remove year from boilerplate bb03b7a1 Bump the gomod group with 2 updates b2918849 Bump crate-ci/typos from 1.45.1 to 1.45.2 c7e207d7 Bump the gomod group across 1 directory with 9 updates ea9454e9 bump cri-tools version to v1.36.0 after release 82f28d67 bumpo to release version of 1.36 5988383a add copyright dfd5525f crictl: replace docker/docker timestamp dependency a846c714 fix typo: intead -> instead 3f28b1c4 Add SergeyKanzhelev and tallclair to sig-node-approvers 58a1a780 Bump crate-ci/typos from 1.45.0 to 1.45.1 31b19db9 Bump actions/cache from 5.0.4 to 5.0.5 a1fa6b1f Makefile: Don't explicitly pass GOFLAGS to go commands 507358f9 Bump actions/upload-artifact from 7.0.0 to 7.0.1 3f90c7cf Bump k8s.io dependencies to v0.36.0-rc.0 27c856e8 more gitignore 30434d06 bump go tp 1.26.2 7d5c1228 Bump crate-ci/typos from 1.44.0 to 1.45.0 aad688ce Bump google.golang.org/grpc from 1.79.3 to 1.80.0 in the gomod group af533d44 Bump actions/setup-go from 6.3.0 to 6.4.0 ffa8e166 validate: add KubernetesPodUIDLabel to container attributes test bdffd30d validate: use subset checks for labels and annotations 661c011e removed deprecated TODO 746da572 Use k8s v0.36.0-beta.0 c98d29d2 Remediate GHSA-6g7g-w4f8-9c9x (bummp jsonparser to 1.1.2) 58323188 Remediate CVE-2026-33186 (bump grpc to 1.79.3) d2f54006 validate: add conformance tests for attribute preservation a8b6fcf6 Revert "Disable runc integration tests due to AppArmor issue" c633d342 adopt the latest cri client 76ce604b Bump actions/cache from 5.0.3 to 5.0.4 5077d436 feat: add prettier validation to Makefile and AGENTS.md 43768b05 crictl: replace utilyaml with sigs.k8s.io/yaml 3866e388 Add verify rule to Makefile cdd3d738 created a local copy of AggregateGoroutines 14a98847 start using k8s.io/streaming 9ddc149f use latest cri client with the logger used from context Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* cri-o: update to v1.36.0-tipBruce Ashfield2026-05-281-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumping cri-o to version v1.36.0-32-g869599c20b, which comprises the following commits: cdf4881647 Bump go 5b23b14018 Update nixpkgs 13d308b934 Bump version to v1.37.0 572a5a1530 test(server): add test case for empty env values 875a46be10 test: rewrite TestMergeEnvs to use table-driven tests with more edge cases a0d5a70e70 Remove incorrect deprecation notice from crio.conf 87e12006b4 Address PR feedback: simplify comment and remove benchmarks f22d2024a2 Fix markdown lint and typos errors 2d6fe8bf61 build(deps): bump the gomod group across 1 directory with 30 updates 727d18bfee pinns: terminate long_options array for getopt_long 698d2c477c build(deps): bump the actions group across 1 directory with 18 updates 7ffa9b6097 use compact logging only for List* RPCs 4a5b77d5cd netns file cleanup after CRI-O restart with invalid namespace 24f7b608b9 Improve release notes template 0305311d28 version: bump cri-o.spec in version bump and release scripts 92b75982c2 Update nixpkgs e5a6f664a3 Delete updateunified binary 698c222454 Bump k8s.io packages to v1.36 ff69f0eb7b oci: clone execPIDs map to avoid segfault 8ff525cf03 cnimgr: continuously poll CNI STATUS to detect runtime health changes 50bad6de7d metrics: add default_runtime 47cc14fe65 MAINTAINERS: move @kolyshkin to alumni d73341fb45 deps: bump go to 1.26.2 f50fd5bd2c vendor: update github.com/moby/spdystream to v0.5.1 1b111f660d Add inject_gomaxprocs via runtime handler precreate hook 88e8f422b5 oci: wait for exit file before defaulting to exit code 255 8b9a4a37e5 Add SLSA provenance attestation to release notes template ca4496cc7b Implement Stream* RPCs e70f41a322 Embed git commit in static binaries via ldflags 6c9718d73a Disable zlib s390x vectorized CRC32 for cross-compilation 498e33a723 Update nixpkgs ded8ab8c6b Modernize nix setup to use flakes 9c75852b3d Make artifact pinned status respect pinned_images configuration a21c685723 fix: address review comments for additional artifact stores c608ffc3a9 feat: add support for additional read-only artifact stores 5ca7b348ae Switch to go 1.26 456e2e70f9 Add integration test for updating cgroup v2 unified resources 5dd7bb4e3d Add libpathrs version to dependencies 2b23b4810d Add libpathrs-devel to github-actions 8d8d342a15 Add libpathrs-devel to Fedora packages for runc build cd2b28f0d4 Add unified cgroup resource update support for cgroup v2 a45b2e4977 version: sync cri-o.spec with development version 01ee67395e Update utils_bench_test.go 4201b78274 perf(server): optimize mergeEnvs to eliminate O(N*M) string splits Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* nerdctl: fix PV valueZhixiong Chi2026-05-281-1/+1
| | | | | | | | During the last upgradeing, the source has been upgraded to v2.2.1, but the PV is not. So make it be accurate. Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* cowsql: update to v1.15.9-tipBruce Ashfield2026-05-281-4/+1
| | | | | | | | | | | | | | | | | Drops the GCC 15 -Wno-error=discarded-qualifiers workaround — upstream fixed it (64982fb). Bumping cowsql to version v1.15.9-9-g7c4d731, which comprises the following commits: 64982fb Fix -Wdiscarded-qualifiers warnings when using C23 memchr 2fa8608 build(deps): bump actions/checkout from 5 to 6 a27e21b refactor: replace semaphores, mutexes, conditions and threads with uv equivalents 8e73441 refactor: remove unused semaphore 'stopped' from cowsql_node structure 5b67836 build(deps): bump actions/checkout from 4 to 5 83b1d3a Release v1.15.9 Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* oe-go-mod-fetcher: filter license scan to actually-unpacked modulesBruce Ashfield2026-05-281-4/+148
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The --scan-licenses output (go-mod-licenses.inc) was iterating every module in modules.json, which mirrors go.sum and includes every version Go fetched for hash verification — including unselected indirect-dep versions and test-/tool-only deps. bitbake's do_populate_lic validates each LIC_FILES_CHKSUM entry against an unpacked module dir at pkg/mod/<module>@<version>/. Modules that go.sum lists but go build does not import never get unpacked there, so the QA check fails with "invalid file" errors — hundreds at a time on a busy project like cosign. Add a tiered filter to scan_module_licenses(): 1. Walk GOMODCACHE for *@v* directories. This is exactly the set the discovery step's `go build` populated, and matches 1:1 what bitbake will unpack at build time from the SRC_URI entries we generate. 2. Fall back to `go list -m all` (the MVS-selected set). Smaller than go.sum but larger than the unpacked set; useful when GOMODCACHE isn't yet populated. Set GOPROXY explicitly so the helper can download a newer toolchain if go.mod's directive requires one (do_generate_modules's env has GOPROXY=off). 3. No filter — original behavior, kept for safety. For cosign 3.0.6-tip, this trims go-mod-licenses.inc from 1320 to 265 lines (1068 unselected entries pruned) and resolves all do_populate_lic QA errors. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* cosign: update to v3.0.6-tipBruce Ashfield2026-05-287-1009/+884
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumping cosign to version v3.0.6-44-g55f4d9e2, which comprises the following commits: 55f4d9e2 Enable initialize command output in conformance (#4892) 9146e3fd Fix Ed25519ph check to respect custom signing configs in sign-blob (#4880) 0bfb59e0 chore(deps): bump github.com/jackc/pgx/v5 from 5.8.0 to 5.9.2 (#4833) 3384f6a2 chore(deps): bump the actions group with 4 updates (#4890) f3177523 chore(deps): bump actions/github-script from 8.0.0 to 9.0.0 (#4891) 074c598a chore(deps): bump k8s.io/apimachinery from 0.35.3 to 0.36.1 (#4859) ca9906d1 chore(deps): bump github.com/buildkite/agent/v3 from 3.118.0 to 3.127.0 (#4861) 5b603990 update go-github to v88 (#4887) 29dc88b8 bump static-debian to static-debian13 (#4888) 74650550 update builder to use go1.26.3 (#4885) cb68b297 bump golangci-lint (#4886) da174ac4 Fix unsafe type assertion in Rego policy evaluation (#4882) b4e1761f fix: check HTTP status code in LoadFileOrURL (#4877) a01e484b Use the configured Target Repository more consistently. (#4836) d3f481eb Deprecate Flags for v4: OCI Referrers (#4804) 6ea2f187 Fix crash verifying timestamps when no timestamp was verified (#4881) 7993b350 Undo skip setcap for HashiCorp Vault (#4879) cd402b41 Fix impossible status code checks in GitHub provider PutSecret (#4876) f02ee6f5 chore(deps): bump github.com/open-policy-agent/opa from 1.14.1 to 1.16.2 (#4862) cca05a3f chore(deps): bump github.com/go-piv/piv-go/v2 from 2.5.0 to 2.6.0 (#4863) 2d3bebf1 chore(deps): bump github.com/in-toto/attestation from 1.1.2 to 1.2.0 (#4798) 4df4c13c chore(deps): bump golang from 1.25.6 to 1.25.7 in the all group (#4690) b2cc7950 chore(deps): bump codecov/codecov-action from 5.5.2 to 6.0.0 (#4800) e5871155 chore(deps): bump github.com/in-toto/in-toto-golang (#4855) 4df629ef chore(deps): bump the actions group across 1 directory with 6 updates (#4864) bf57b898 feat(cli): add Rekor v2 flag to cosign signing-config create (#4868) 8a86a7cf fix: use Header.Set to prevent duplicate Authorization on retry (#4870) b33aaacb fix: close file descriptor leaked in WriteSignedImageIndexImages loop (#4869) d5891a86 deprecate private-infrastructure and record-creation-timestamp flags (#4854) a1ec0737 Add bundle upgrade command (#4820) 6a80f22c Fix typo in map of verify fields unsupported for new bundle format (#4853) f15ac759 Deprecate flags bundle (#4838) 08952e2c Deprecate flags signing config (#4844) f5373b06 Switch from cosign copy to oras copy (#4819) 5fff8869 Deprecate Flags for v4: Certificates (#4822) 39940de0 chore(deps): bump the gomod group across 1 directory with 10 updates (#4840) 394ab4da fix: honor --digestAlg when hashing a blob in verify-blob-attestation (#4813) f02250eb fix(load): pass NameOptions to name.ParseReference (#4786) 032c0ea4 Update conformance to latest (#4843) 13a3d79e Require bundle output or registry upload (#4785) 040443cf bundle create: Prevent IgnoreTlog when bundle contains SET (#4829) b7462fb6 ci: Skip setcap for HashiCorp Vault 1d5c7a6d Sign exclusively via sigstore-go (#4618) a6bd85fc fix(pkcs11-tool): GetKeysInfo not initializing YKCS11 correctly (#4803) f1ad3ee9 Fix DSSE predicate check (GHSA-w6c6-c85g-mmv6) (#4801) Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* containerd: update to v2.3.1Bruce Ashfield2026-05-272-8/+8
| | | | | | | | | | | | | | | | | | | | | | We refresh a patch for context, and also pickup the following changes: f588bc6fb contrib/checkpoint: increase timeouts to 30s 58af96519 Prepare release notes for v2.3.1 8f0b3ca83 Update api to v1.11.1 da7aef299 Prepare release notes for api/v1.11.1 5282d4e09 Wire task address and version fields e44f5f9ec protos: include task API address to CreateTaskRequest 4d80a31bf seccomp: Block AF_ALG in default socket policy 2ed0d97b6 seccomp: Document socket rule scope and socketcall limitation 2be0710b8 overlay: disable "rebase" capability when running in UserNS 3a88fdde0 server: tolerate failed gRPC plugins when starting listeners 1d601271a fix: close boltdb on metadata and mount plugin close 3b199c22b Update Go to 1.26.3 a05ae7885 oci: return explicit error for out-of-range USER values d666d2e42 Refactor transfer unpack configuration setup ccc3bd7b9 Fix optional transfer differ setup Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* conmon: update to v2.2.1-tipBruce Ashfield2026-05-271-1/+1
| | | | | | | | | | | | | Bumping conmon to version v2.2.1-33-g5352940, which comprises the following commits: 1b45f46 Update dependency opencontainers/runc to v1.4.2 8596fc6 Reset create_pid after waitpid to prevent signaling unrelated processes bafb655 signal: replace raise(SIGUSR1) with self-pipe to fix SIGABRT on glibc >= 2.42 e0c56ec ci: replace Cirrus CI with GitHub Actions 3bf4bd9 cgroup: skip legacy v1 controller lines when parsing cgroup v2 path 8bc1877 chore(deps): update dependency containernetworking/plugins to v1.9.1 Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* catatonit: update to v0.2.1-tipBruce Ashfield2026-05-271-1/+1
| | | | | | | | | | Bumping catatonit to version v0.2.1-7-g00f6c0f, which comprises the following commits: 40bf6d7 build: enable stricter format string warnings cfaa5d4 catatonit: fix format specifier for long long fd value 56579ad main: don't use secure_getenv Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* buildah: update to v1.43.1Bruce Ashfield2026-05-271-2/+2
| | | | | | | | | | | | | | | | | | | Bumping buildah to version v1.43.1-4-g1d61d5217, which comprises the following commits: 0203efa67 tests: remove dependencies on online apt repositories c2e1324b1 Cite go module change 310b1c8f5 [release-1.43] Bump Buildah to v1.43.1 fb349f2d6 [release-1.43] Bump c/common v0.67.1, c/image v5.39.2 ccba7c460 update module github.com/go-jose/go-jose/v4 to v4.1.4 [security] 0d8e18550 ignore ErrLayerUnknown in cache lookup 8499b1a41 fix setting of gid 3780f1490 fix call to chown 0158b5b31 [release-1.43] Bump Buildah to v1.43.0 f40d38a2f [release-1.43] fix source test 07b8495c8 [release-1.43] Bump common 0.67.0, image 5.39.1, storage 1.62.0 7178b10ac [release-1.43] Bump dest branch in cirrus to 1.43 Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* aardvark-dns: update to v1.17.1Bruce Ashfield2026-05-272-45/+47
| | | | | | | | | | | Bumping aardvark-dns to version v1.17.1-1-g880f690, which comprises the following commits: d9d17d4 release v1.17.1 b2cf5c7 release notes for v1.17.1 0bc10b3 migration to oidc connection b66c50e fix handling of incorrect tcp packets Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* docker-compose: fix PVBruce Ashfield2026-05-121-1/+1
| | | | | | | | When docker-compose was updated, the hash was set properly but the PV was not. We are actually building docker compose 5.1.x, so we adjust the PV to be accurate. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* conf: add kvm-host.conf configuration fragmentBruce Ashfield2026-05-122-0/+21
| | | | | | | | | | | | | | Building kvm-image-minimal fails without the 'kvm' DISTRO_FEATURE, requiring users to manually add it to local.conf. Every other virtualization platform (Xen, Docker, Podman, k3s, containerd) already has a composable configuration fragment in conf/distro/include/ that can be included with a single require line. Add kvm-host.conf following the same pattern as xen-host.conf: a pure delta fragment that appends the kvm DISTRO_FEATURE. Composable with any container profile and the base meta-virt-host.conf. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* xen: fix buildpaths QA errors for hypervisor EFI and debug packagesBruce Ashfield2026-05-121-2/+15
| | | | | | | | | | | | | | | | | | | | | | Xen's hypervisor Makefile overrides CFLAGS entirely with its own flags (nostdinc, fno-builtin, etc.), so OE's DEBUG_PREFIX_MAP flags added via CFLAGS never reach the hypervisor compilation. The existing prefix map entries in xen.inc appeared to work only because sstate was caching pre-built packages — a fresh rebuild exposes the embedded TMPDIR paths in the EFI binary and debug symbols. Inject the prefix maps through EXTRA_CFLAGS_XEN_CORE, which is Xen's own mechanism for accepting additional compiler flags and is already passed through to oe_runmake. This fixes the EFI binary paths. The xen-syms debug binary retains one source path in .debug_str from the linker/assembly stage, which does not honor the C compiler's -fdebug-prefix-map. Since xen-syms is only shipped in the -dbg package (not a deployment target), skip buildpaths for xen-dbg. This is an optional QA test — not in CHECKLAYER_REQUIRED_TESTS — so it has no impact on yocto-check-layer compatibility. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* libvirt: fix python3 compatibility in hook_support.pyMassimiliano Minella2026-05-111-2/+2
| | | | | | | | | | | | | | | | By default Popen expects all the streams to be bytes-like objects but, in the Popen.communicate() function call, the "input" argument is a string, making the call fail with the error: qemu hook error: a bytes-like object is required, not 'str' Fix the error by setting text mode to True in the subprocess creation. Also fix the "SyntaxWarning: invalid escape sequence '\w'" in the regex used to match script names. Signed-off-by: Massimiliano Minella <massimiliano.minella@se.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* image-oci: don't preserve ownership in directories/files/host layer copiesTim Orling2026-05-111-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The multi-layer 'directories', 'files', and 'host' branches in IMAGE_CMD:oci copy delta content into the OCI bundle rootfs with 'cp -a'. 'cp -a' implies '--preserve=all', which calls lchown() on the destination to copy ownership from the source. When a directories/files layer copies a symbolic link whose target does not exist at build time (for example, the '/dev/stdout' and '/dev/stderr' log forwarding symlinks used by the official nginx Docker image), lchown() can return EINVAL under pseudo and 'cp' aborts with: cp: failed to preserve ownership for .../var/log/nginx/access.log: Invalid argument failing the whole do_image_oci task. The single-layer rootfs copy already handles this correctly: cp -r -a --no-preserve=ownership ${IMAGE_ROOTFS}/* $image_bundle_name/rootfs and the multi-layer 'packages' branch uses 'rsync -a --no-owner --no-group' for the same reason. Bring the three remaining cp -a sites in line by adding '--no-preserve=ownership'. Ownership inside an OCI image is set by umoci based on the image config and source ownership has no meaning for symlinks to runtime device nodes anyway, so dropping preservation is the correct behaviour. Reproduce: declare a directories: layer that copies a path containing a symlink to '/dev/stdout' or '/dev/stderr' (e.g. a postprocess that creates /var/log/nginx/{access,error}.log -> /dev/{stdout,stderr} to mirror the upstream nginx Docker image). Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* podlet: add podlet utilityPatrick Vogelaar2026-05-112-0/+378
| | | | | | | Podlet generates Podman Quadlet files from a Podman command, compose file, or existing object. Signed-off-by: Patrick Vogelaar <patrick.vogelaar@belden.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* vcontainer: add BBMASK for parse savings and suppress layer warningsBruce Ashfield2026-05-106-17/+196
| | | | | | | | | | | | | | | | | | | | | | | | | | | The initial vcontainer distro had no BBMASK at all, making it effectively poky with fewer DISTRO_FEATURES. Every multiconfig parsed the entire recipe universe even though container image builds only need a small subset. With 4+ multiconfigs, the parse overhead is significant. Add vcontainer-bbmask.inc as a lighter alternative to vruntime's aggressive BBMASK. It masks the same categories irrelevant to any container/VM build (graphics, multimedia, desktop, virtualization platforms, orchestration tools, meta-python, meta-filesystems, meta-webserver) but keeps the OCI tooling that vruntime blocks: umoci, container-registry, image recipes, sloci, oci-image-tools. Masking entire layers (meta-python, meta-filesystems, meta-webserver) produces BBFILE_PATTERN warnings because the layers are registered in bblayers.conf (shared with the main build) but have zero recipes after masking. BitBake provides BBFILE_PATTERN_IGNORE_EMPTY_<collection> to suppress this, but checks it on self.data (the base datastore), not per-multiconfig datastores. Setting it in the distro config has no effect. Move the suppression to meta-virt-host.conf which is included by the main build's local.conf and therefore visible to the base datastore. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* container-registry: add multi-arch OCI push support and testsBruce Ashfield2026-05-103-1/+612
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The registry push script (container-registry-index.bb) treated all OCI directories as single-arch, calling 'skopeo copy oci:<dir>' which fails with "more than one image in oci, choose an image" when the directory contains a multi-arch image index. The original push implementation predated multi-arch OCI support and only handled the single-manifest case. Detect multi-arch OCI Image Index directories (both flat and nested layouts) in the direct-path push mode and use 'skopeo copy --all' to push the entire manifest list to the registry in one operation. This preserves the multi-platform structure so that clients pulling from the registry automatically get the correct architecture. Also strip the '-multiarch' suffix from directory names when deriving the registry image name, so container-base-multiarch-multiarch-oci pushes as 'container-base' rather than 'container-base-multiarch'. Add build-profiles.md documentation for the vcontainer distro, container multiconfigs, and multi-arch container build workflow. Add test_vcontainer_distro.py with 54 tests across three tiers: - Tier 1: Static file assertions (vruntime-base.inc, vcontainer.conf, multiconfigs, bbclass defaults, recipe structure) - Tier 2: Cross-file consistency (shared base, distro-MC alignment, bbclass-to-multiconfig file matching) - Tier 3: Build output verification (OCI index structure, platform entries, blob integrity, manifest validation) Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* vcontainer-common: support nested OCI layout and fix vimport shell errorsBruce Ashfield2026-05-101-31/+40
| | | | | | | | | | | | | | | | | | | | | | | | | | | The multi-arch OCI functions (is_oci_image_index, get_oci_platforms, select_platform_manifest) only checked index.json directly for platform information. With the skopeo-compatible nested OCI layout — where index.json references a single image index blob that in turn contains the per-platform manifests — the functions failed to detect multi-arch images because index.json no longer contains platform entries. Add _resolve_oci_platform_file() helper that handles both layouts: - Flat: platform info directly in index.json (legacy/simple case) - Nested: index.json → image index blob → platform manifests All three multi-arch functions now use this single helper, eliminating the layout resolution logic that would otherwise be duplicated in each. Also fixes two issues in the vimport case block: - 'local' keyword used outside a function (bash error on line 1879). The vimport handler is in a case statement in the main script body, not inside a function, so 'local' is invalid. The original multi-arch code was written assuming it would be inside a function. - OCI_SELECTED_PLATFORM was blank in output because select_platform_manifest sets it inside a $() subshell, where variable assignments are lost. Use normalize_arch_to_oci directly for the display message instead. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* oci-multiarch: fix MC defaults, deploy dependency, and OCI layoutBruce Ashfield2026-05-102-12/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Three issues prevented oci-multiarch.bbclass from producing usable multi-architecture container images: 1. MC defaults pointed to vruntime-* multiconfigs, whose BBMASK blocks OCI tooling. Changed to container-* multiconfigs which use the new vcontainer distro without BBMASK. 2. mcdepends targeted do_image_oci, but the OCI output is only deployed to deploy/images/ by the later do_image_complete task. The bbclass then failed to find the OCI directory at the expected deploy path. The original implementation assumed do_image_oci was the final step, but OE-core's image pipeline has a separate deploy phase. 3. The OCI Image Index was written directly into index.json with multiple manifest entries. This is valid per the OCI spec but skopeo requires index.json to reference a single entry when there are multiple images. The fix writes the multi-platform image index as a blob in blobs/sha256/ and has index.json reference it with a single entry of mediaType application/vnd.oci.image.index.v1+json. This nested layout is what tools like buildah and crane produce for multi-arch images, and is required for 'skopeo copy --all' to work. Also adds container-base-multiarch.bb recipe that wires up container-base for aarch64 + x86_64 builds via the oci-multiarch class. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* vcontainer: add OCI builder distro with shared baseBruce Ashfield2026-05-107-37/+77
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The oci-multiarch.bbclass was dead code because vruntime's BBMASK blocks the OCI tooling (umoci, skopeo) needed to build container images. We could not simply use the vruntime multiconfigs for OCI image builds because the aggressive recipe masking that keeps vruntime rootfs minimal also removes the packages needed for container image creation. Rather than maintaining two independent distro configs with duplicated DISTRO_FEATURES, extract the common configuration into a shared base fragment and create a new distro that omits the BBMASK. Changes: - Extract vruntime-base.inc from vruntime.conf with shared settings: stripped DISTRO_FEATURES, opted-out features, native class overrides - Simplify vruntime.conf to require vruntime-base.inc, keeping only VM-specific settings (BBMASK, busybox init, ptest disable) - Add vcontainer.conf: requires the same shared base but without BBMASK, giving OCI tooling full access to the package set - Add container-aarch64 and container-x86-64 multiconfigs using the vcontainer distro with separate TMPDIRs - Add container multiconfigs to BBMULTICONFIG in meta-virt-host.conf - Remove unused container.conf placeholder from 2022 IMAGE_FSTYPES is intentionally NOT set in vcontainer.conf because the 'oci' type requires image-oci.bbclass which only container image recipes inherit. Setting it distro-wide breaks non-container images parsed under this distro (e.g., core-image-multilib-example from meta-skeleton). Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* vcontainer: add --config / VDKR_CONFIG for docker/podman auth credentialsTim Orling2026-04-296-0/+392
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a VDKR_CONFIG / VPDMN_CONFIG env var and a matching --config <path> CLI flag that passes an existing docker config.json / podman auth.json into the QEMU-hosted container runtime so pulls from private registries work without having to retype --registry-user / --registry-pass on every command. Security posture (defence in depth): - Host-side pre-flight validation in vrunner.sh (validate_auth_config): reject symlinks, non-regular files, missing / unreadable files, files smaller than 2 bytes (minimum "{}") or larger than 1 MiB, and any permissions other than 0400 / 0600 / 0200. WARN if not owned by the invoking user. - Stage the file into a dedicated per-invocation directory under $TEMP_DIR at mode 0400 inside a 0700 parent; auto-cleanup rides the existing EXIT/INT/TERM trap. - Expose the staged file over a *separate* read-only virtio-9p tag ("${TOOL_NAME}_auth") so credentials cannot leak into the general /mnt/share input/output directory or into storage.tar outputs. - Only a boolean flag ("${CMDLINE_PREFIX}_auth=1") is appended to the kernel cmdline - never the path, the env var name, or the contents. - Guest mounts /mnt/auth ro,nosuid,nodev,noexec, copies to the runtime's canonical path, then unmounts immediately so neither the runtime nor user workloads keep a reference to the host staging directory. vrunner.sh: - Initialise AUTH_CONFIG from $VDKR_CONFIG / $VPDMN_CONFIG - Parse --config <path> (overrides the env vars) - Add validate_auth_config() and setup_auth_share() with the rules above - Call setup_auth_share in both the daemon start path and the non-daemon / batch-import path vcontainer-init-common.sh: - Default RUNTIME_AUTH="0" and parse ${VCONTAINER_RUNTIME_PREFIX}_auth=* from the kernel cmdline - Define mount_auth_share() / unmount_auth_share() using the per-runtime "${VCONTAINER_RUNTIME_NAME}_auth" 9p tag, mounted at /mnt/auth with ro,nosuid,nodev,noexec vdkr-init.sh: - install_auth_config() copies /mnt/auth/config.json to /root/.docker/config.json (mode 0600; parent dir 0700) - Called after install_registry_ca in main flow so --config takes precedence over --registry-user / --registry-pass; logs a NOTE when both mechanisms are supplied - Unmounts /mnt/auth after copy vpdmn-init.sh: - install_auth_config() copies to /run/containers/0/auth.json (the rootful podman canonical path) and exports REGISTRY_AUTH_FILE so the creds are picked up regardless of podman's search order - Mode 0600 on the file, 0700 on the containing directory - Unmounts /mnt/auth after copy vcontainer-common.sh: - Honour $VDKR_CONFIG / $VPDMN_CONFIG, parse --config, and forward AUTH_CONFIG to vrunner.sh via --config in build_runner_args - Document the flag and env vars in show_usage README.md: - New "Passing an existing docker/podman auth file (--config)" section with examples for both runtimes, a table of target paths, and the full security model AI-Generated: Claude Cowork Opus 4.7 Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* tests: add vcontainer --config / VDKR_CONFIG auth plumbing testsTim Orling2026-04-292-0/+643
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a new pytest module (tests/test_vcontainer_auth_config.py) covering the registry-auth-config feature introduced in the previous commit. Split into two tiers: TestAuthConfigStaticPlumbing (40 static/shell-level assertions): - vrunner.sh: AUTH_CONFIG picks up VDKR_CONFIG/VPDMN_CONFIG; --config parsing; validate_auth_config and setup_auth_share definitions; every validator reject rule (symlink / non-regular / unreadable / missing / <2B / >1MiB / mode whitelist 400|600|200 / non-owner WARN); 0700 staging dir and 0400 staged file; readonly=on on the 9p share; dedicated ${TOOL_NAME}_auth tag. Critically also asserts that AUTH_CONFIG, VDKR_CONFIG and VPDMN_CONFIG never appear in KERNEL_APPEND - only the ${CMDLINE_PREFIX}_auth=1 flag does. - vcontainer-common.sh: env-var init, --config parsing, AUTH_CONFIG forwarding via --config to vrunner, and show_usage documentation. - vcontainer-init-common.sh: RUNTIME_AUTH default, cmdline parsing, mount_auth_share/unmount_auth_share presence, dedicated per-runtime ${VCONTAINER_RUNTIME_NAME}_auth tag, and the ro,nosuid,nodev,noexec mount options. - vdkr-init.sh: install_auth_config present, writes to /root/.docker/config.json with 0600 and 0700 parent, mount + unmount pairing, precedence NOTE logged, and ordering after install_registry_ca so --config wins over --registry-user/-pass. - vpdmn-init.sh: writes to /run/containers/0/auth.json with matching modes, exports REGISTRY_AUTH_FILE, mount/unmount pairing, and ordering after verify_podman. - README.md: --config section exists and documents both env vars and both runtime target paths. TestAuthConfigValidator (13 functional cases): - Extracts validate_auth_config() from vrunner.sh with a brace-matching parser, sources it in a bash subshell with a stubbed log() helper, and drives it with real files: accepts modes 0600 / 0400, accepts the 2-byte minimum "{}", rejects missing / symlink / directory / empty / 1-byte / >1 MiB / 0644 (world-readable) / 0640 / 0700 (owner-exec) / 0000 (unreadable, skipped when running as root). Path resolution is resilient: VCONTAINER_FILES_DIR env override first, otherwise repo-relative to the test file, falling back to the /opt/bruce/poky path used elsewhere in the suite. No tests need QEMU, a registry, or network. All 53 tests complete in ~0.1s. Add tests/__pycache__ to .gitignore. AI-Generated: Claude Cowork Opus 4.7 Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* python3-dotenv: Fix CVE-2026-28684Bin Cao2026-04-292-0/+364
| | | | | | | | | | | Backported from [1], verified with the test script from [2]. [1] https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311 [2] https://github.com/theskumar/python-dotenv/security/advisories/GHSA-mf9w-mj56-hr94 [3] https://nvd.nist.gov/vuln/detail/CVE-2026-28684 Signed-off-by: Bin Cao <bin.cao.cn@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* vcontainer-common: fix vstorage commands with --state-dirBruce Ashfield2026-04-291-7/+15
| | | | | | | | | | | | | vstorage list/df/clean scanned DEFAULT_STATE_DIR (~/.vpdmn/) for arch subdirectories, ignoring --state-dir. On CI where tests use --state-dir ~/.vpdmn-test/x86_64, the default directory doesn't exist so vstorage list reports "(no storage directories found)" and test_vstorage_shows_memres_status fails. Derive VSTORAGE_ROOT from the parent of STATE_DIR when --state-dir is set, so all vstorage subcommands scan the correct storage root. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* podman: fix CNI build tag for non-netavark networking configurationsBruce Ashfield2026-04-291-1/+7
| | | | | | | | | | | | | | | | BUILDTAGS_EXTRA was gated on VIRTUAL-RUNTIME_container_networking == "cni", which excluded the cni build tag in vruntime builds where that variable is intentionally blank (vpdmn-rootfs-image installs cni packages directly). This caused podman to be compiled with netavark-only support, failing at runtime with "cni support is not enabled in this build" when containers.conf sets network_backend = "cni". Include the cni build tag unless the distro explicitly selects netavark. This respects the podman profile's upstream preference for netavark-only while ensuring all other configurations (containerd, default, docker, k3s, vruntime) retain CNI support. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* vcontainer-tarball: add CI-safe environment script for autobuilderBruce Ashfield2026-04-281-2/+27
| | | | | | | | | | | | | The existing environment-setup-* script uses BASH_SOURCE to derive VCONTAINER_DIR, which is empty when parsed by yocto-autobuilder-helper's enable_tools_tarball() since it doesn't evaluate shell expressions. Generate a separate environment-setup-ci with flat export lines using baked-in absolute paths from ${SDKPATH}/${SDKPATHNATIVE}. The AB parser picks these up directly. SDK relocation rewrites the paths at install time. The interactive bash script is unchanged. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* oe-go-mod-fetcher: add license scanning for Go module dependenciesBruce Ashfield2026-04-284-4/+1304
| | | | | | | | | | | | | | | | | | | | | | | Add --scan-licenses to oe-go-mod-fetcher.py which scans Go module zips for license files and generates go-mod-licenses.inc with LICENSE and LIC_FILES_CHKSUM entries matching OE-core's go-mod-update-modules format. License detection uses OE-core's glob patterns and MD5 + crunched MD5 matching against known SPDX licenses. The hash database resolves from: 1. --common-license-dir (explicit path) 2. Auto-detected poky tree common-licenses 3. Bundled scripts/data/license-hashes.csv (offline fallback) New files: - scripts/generate-license-hashes.py: regenerate bundled CSV - scripts/data/license-hashes.csv: pre-computed hash DB (704 entries) bbclass changes: - go-mod-discovery: pass --scan-licenses during do_generate_modules - GO_MOD_DISCOVERY_SKIP_LICENSES variable to bypass scanning - do_update_license_hashes task to refresh bundled CSV Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* cosign: switch to go-mod-vcs generated license scanningBruce Ashfield2026-04-283-276/+1047
| | | | | | | | | Replace the go-mod-update-modules generated cosign-licenses.inc with go-mod-licenses.inc produced by oe-go-mod-fetcher --scan-licenses. The new file is generated during discover_and_generate alongside the other .inc files. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* cosign: convert to go-mod-vcs hybrid fetchBruce Ashfield2026-04-287-268/+3081
| | | | | | | | | | | | | | | | Convert from go-mod + go-mod-update-modules to go-mod-vcs hybrid fetch mode, consistent with other Go recipes in the layer (k3s, nerdctl, docker-compose, etc.). - Replace cosign-go-mods.inc (gomod:// only) with generated go-mod-hybrid-{gomod,git,cache}.inc and go-mod-{git,cache}.inc - Keep cosign-licenses.inc for dependency license tracking (our go-mod-vcs tooling does not yet generate license metadata) - Add GO_MOD_VCS_EXCLUDE for buf.build (no git repo) and software.sslmate.com/src/go-pkcs12 (unreachable commit) - Set GO_MOD_DISCOVERY_SRCDIR to match go.bbclass source layout Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* oe-go-mod-fetcher: improve error messages with recipe-ready fix snippetsBruce Ashfield2026-04-281-6/+24
| | | | | | | | | | | | | | | | | | | When the fetcher encounters unverifiable commits or modules with no repository metadata, the error messages now show two equivalent options: Option 1: For bitbake users (most common) — add GO_MOD_VCS_EXCLUDE and a gomod:// SRC_URI entry to the recipe, fetching the module via the Go module proxy instead of git. Option 2: For direct oe-go-mod-fetcher.py invocation — pass --inject-commit / --set-repo on the command line with a complete example showing all required arguments. Both options produce the same result. The previous messages only suggested --inject-commit and --set-repo without context on where or how to use them. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* cosign: add recipe for container signing tool v3.0.6Tim Orling2026-04-283-0/+554
| | | | | | | | | | | | | Add cosign [1] recipe for sigstore's [2] container signing, verification and storage tool [3]. Includes auto-generated Go module dependencies and license tracking via go-mod-update-modules. [1] https://github.com/sigstore/cosign/releases/tag/v3.0.6 [2] https://www.sigstore.dev/ [3] https://docs.sigstore.dev/cosign/signing/overview/ Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* vcontainer-initramfs-create: fix kernel deploy dependency via do_buildBruce Ashfield2026-04-281-11/+10
| | | | | | | | | | | | | | | | | | | | | On sstate-accelerated builds, the kernel binary (bzImage/Image) was missing from MC_DEPLOY because do_compile depended on the image recipes' do_image_complete, which runs before do_build. The kernel deploy dependency (virtual/kernel:do_deploy) is attached to do_build in image.bbclass, so depending on do_image_complete cut the chain short and virtual/kernel:do_deploy was never guaranteed to have run. Fix by depending on do_build instead of do_image_complete. The image artifacts (cpio.gz, squashfs) are already in DEPLOY_DIR_IMAGE after do_image_complete, so they remain available. do_build additionally ensures virtual/kernel:do_deploy has completed, placing the kernel in MC_DEPLOY for our do_compile to copy. This avoids adding an explicit virtual/kernel:do_deploy dependency which would couple this recipe to the kernel and prevent use cases where the kernel is provided externally. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* test_vdkr_registry: fix test_image_requires_subcommandTim Orling2026-04-281-1/+5
| | | | | | | | | vdkr.run() merges stderr into stdout (see conftest.py), so the error message ends up in result.stdout even though the script writes it to stderr (>&2). Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* lxc: delete extraneous PACKAGECONFIG[systemd] lineGavvala, Kris2026-04-281-1/+0
| | | | | | | | | | | | | | | | | | The PACKAGECONFIG[systemd] variable is assigned twice, with the second assignment overriding the first. This patch removes the unused assignment to avoid confusion. The duplication was introduced in an August 25, 2022 patch: 05f316f7 lxc: update to 5.x and meson Verfied that the build did not change after this deletion by checking the log files before and after and finding the same message: export systemd_system_unitdir="/usr/lib/systemd/system" export systemd_unitdir="/usr/lib/systemd" export systemd_user_unitdir="/usr/lib/systemd/user" Signed-off-by: Kris Gavvala <kris.gavvala@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* libvirt: remove obsolete depends to avahiLouis Rannou2026-04-281-1/+1
| | | | | | | | | | | | | libvirt has removed support for avahi in version 5.5.0 in 2019: * Remove Avahi mDNS support This feature was never used outside of virt-manager, which has itself stopped using it a while ago. Signed-off-by: Louis Rannou <louis.rannou@non.se.com> Signed-off-by: Louis Rannou <louis.rannou@semalibre.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* podman: update version to match golangs version.goBruce Ashfield2026-04-281-1/+1
| | | | | | | | | | | | The update cycle used the git tags to update the PV version, but when you build podman, the version pulled into the executables is from: version/rawversion/version.go Which currently reports: 5.8.3-dev Bumping the PV to match. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* ca-certificates: remove conditional SRC_URI entriesBruce Ashfield2026-04-281-4/+3
| | | | | | | The entire file is conditional, we don't need protections on the SRC_URI entries. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* distro/vruntime: remove now uncessary DISTRO_FEATURES_DEFAULTTim Orling2026-04-281-2/+2
| | | | | | | | | | | | | | | | DISTRO_FEATURES_DEFAULT has been obsoleted [1][2]. Follow the pattern in meta-yocto [3] and remove it. Fixes: ERROR: Nothing PROVIDES 'nativesdk-libseccomp' ... [1] https://git.openembedded.org/openembedded-core/commit/meta/conf?id=0548ea447445834647be7ef35ed0ae8d1d3387b3 [2] https://git.openembedded.org/openembedded-core/commit/meta/conf?id=159148f4de2595556fef6e8678578df83383857b [3] https://git.yoctoproject.org/meta-yocto/commit/?id=96085aaec5bfb33c4e4322465eaf0af370db6fc0 Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* ca-certificates: Ensure changes only apply with the selected DISTRO_FEATURESRichard Purdie2026-04-282-38/+39
| | | | | | | | | | | | | | | This fixes yocto-check-layer failures: ca-certificates:do_recipe_qa: 4d7b7adb7436eeb5714c354f3c590e7e69294ea044452343d24e64c92d5c040f -> c1676ce811efe714731b666ccd683586477f7a1b52ad7597148bd9d709291220 List of dependencies for variable SRC_URI changed from 'frozenset({'PV', 'SRC_URI[sha256sum]', 'BPN'})' to 'frozenset({'SRC_URI[le-r11.sha256sum]', 'BPN', 'SRC_URI[le-e8.sha256sum]', 'PV', 'SRC_URI[sha256sum]'})' Variable SRC_URI value changed: @@ -1 +1,2 @@ -${DEBIAN_MIRROR}/main/c/ca-certificates/${BPN}_${PV}.tar.xz file://0001-update-ca-certificates-don-t-use-Debianisms-in-run-p.patch file://0003-update-ca-certificates-use-relative-symlinks-from-ET.patch file://0001-Revert-mozilla-certdata2pem.py-print-a-warning-for-e.patch +${DEBIAN_MIRROR}/main/c/ca-certificates/${BPN}_${PV}.tar.xz file://0001-update-ca-certificates-don-t-use-Debianisms-in-run-p.patch file://0003-update-ca-certificates-use-relative-symlinks-from-ET.patch file://0001-Revert-mozilla-certdata2pem.py-print-a-warning-for-e.patch ${@bb.utils.contains('DISTRO_FEATURES', 'virtualization', 'https://letsencrypt.org/certs/2024/e8.pem;name=le-e8;unpack=0 https://letsencrypt.org/certs/2024/r11.pem;name=le-r11;unpack=0', '', d)} +DISTRO_FEATURES{virtualization} = Unset Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* layer.conf/qemu-system-native: Improve native DISTRO_FEATURE handlingRichard Purdie2026-04-282-4/+4
| | | | | | | | | | | | | OE-Core needs to make some improvements to the way DISTRO_FEATURES is being built but this will break the way meta-virtualization is handling native propagation. Use DISTRO_FEATURES_FILTER_NATIVE which is designed for this. That then means updating the bbappend just to look at DISTRO_FEATURES and to look for both possible values. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* podman: update SRC_URIPatrick Vogelaar2026-04-241-2/+2
| | | | | | | | | | | | Podman is hosted under github as podman and not libpod. Accessing github.com/containers/libpod automatically forwards to github.com/containers/podman. This commit does not really fix a problem but reflects more the current repository name. Signed-off-by: Patrick Vogelaar <patrick.vogelaar@belden.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* podman: update to v5.8.2Bruce Ashfield2026-04-241-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumping libpod to version v5.8.2-5-g88c5aaeec6, which comprises the following commits: 78da75528f Install WiX v5.0.2 to build the Windows installer 7a47175665 Bump Podman to v5.8.3-dev 5b263b5f5b Bump to v5.8.2 884cd28228 Release notes for v5.8.2 6cffe93d88 hyperV: fix powershell path escape f13de01b6d cirrus: bump linux machine aarch64 test timeout d1cf366b0f Remove iptables references in upgrade tests add385e31c bindings: artifact extract reject invalid names a49ad4be81 use chrootarchive over plain archive package 92cd24903f fix symlink handling in checkpoint restore 0fa3043415 add missing O_CLOEXEC to open calls 9c262736e4 Fix Quadlet `Lookup()` stripping unmatched quotes 75820ddac5 Add e2e test for shell driver DriverOpts cross-contamination fix e9fe245626 Fix shell driver DriverOpts cross-contamination in secret creation 7250b06e25 libpod: fix data race on deferredErr in attachExecHTTP 51b5c59310 Consolidate build secret tests and assert no podman-build-secret leak 15a2a7d605 Remote build: `nTar` secrets with relative paths and ignore bypass e5fe3fdf69 api: fix missing return after error in SystemCheck handler c91cd99291 test: relax rootless runc pid namespace assertion 26047f43b5 New images 2026-03-19 d49a9208bd cirrus: ensure NOTIFY_SOCKET is properly unset for all tests 1a9ae9dcba update fedoral base image to 43 and related tests 759df25a88 new image sfx for debian 14 28a39dd1ba libpod: Don't dereference ctrSpec.Linux if it is nil 7f37fbd6af quadlet: allow empty Entrypoint to clear image default 24fd9eb605 [v5.8] Bump Buildah to 1.43.1, c/common v0.67.1, c/image v5.39.2 42ac589e4d bump go-jose/go-jose to v4.1.4 fcc6ae217c [v5.8] Fix `unless-stopped` containers not restarting after ... 6a9ea849a0 Bump Podman to v5.8.2-dev c6077f6457 Bump to v5.8.1 dfe5dae2d6 Release notes for v5.8.1 Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* tests: fix FD inheritance in test harness for all vdkr/vpdmn commandsBruce Ashfield2026-04-223-17/+38
| | | | | | | | | | | | | | | | | | Change VdkrRunner.run() and VpdmnRunner.run() to use Popen with start_new_session=True, stdin=DEVNULL, and file-based stdout instead of subprocess.run(capture_output=True). This prevents daemon background processes from inheriting pipe FDs, which causes communicate() to hang in CI/test harness environments (e.g., buildbot). The fix applies to all commands, not just memres start, because any vdkr command can auto-start the daemon (auto-daemon is enabled by default). Also fix test_volume_mount_requires_memres to check both stdout and stderr for the error message, since stderr is now merged into stdout by the Popen approach. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* vcontainer: detach background-process stdio from memres start callerBruce Ashfield2026-04-223-7/+35
| | | | | | | | | | | | | | | | | | | | | | | | The memres start operation spawns long-running background processes (host-side idle watchdog and Xen domain monitor) that persist beyond the vrunner.sh script. These processes inherited file descriptors 0/1/2 from the parent shell without redirection. When invoked through a harness capturing output via pipes—such as pytest's subprocess.run(..., capture_output=True)—the inherited pipe write-ends kept the caller's read/communicate() operations blocked until memres stop executed, potentially for up to 30 minutes (IDLE_TIMEOUT default). The fix fully detaches stdio from three background spawners: - vrunner.sh: Watchdog subshell now redirects stdin from /dev/null, stdout/stderr to /dev/null, and uses disown - vrunner-backend-qemu.sh: Adds stdin redirection from /dev/null to existing log file redirections - vrunner-backend-xen.sh: Applies same detachment plus disown for daemon mode; redirects stdin for ephemeral-mode console reader From: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* tests: fix memres start hanging in subprocess.runBruce Ashfield2026-04-221-2/+58
| | | | | | | | | | | | | | | | | | | | | | memres start spawns background processes (QEMU VM, idle watchdog) that persist after the vrunner script exits. When invoked via subprocess.run(capture_output=True), these background processes inherit the pipe file descriptors, preventing communicate() from returning until all pipe holders exit — which can be 30+ minutes (the idle timeout). Fix by using Popen with: - stdin=subprocess.DEVNULL (no inherited stdin pipe) - file-based stdout (no pipe FDs to inherit) - start_new_session=True (new process group, so wait() only waits for the parent script, not the background children) This matches the behavior when running from a shell, where the daemon processes are fully detached from the caller's FD table. Applied to both VdkrRunner and VpdmnRunner memres_start methods. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* tests: add @pytest.mark.memres to daemon-dependent testsBruce Ashfield2026-04-222-0/+16
| | | | | | | | | | | | | | | | | | | | | | Test classes that depend on vmemres (daemon mode) were not marked, causing them to run even when filtered with '-m "not memres"'. This caused timeout failures on CI/buildbot environments where KVM may not be available and daemon startup exceeds the test timeout. Mark the following classes with @pytest.mark.memres in both test_vdkr.py and test_vpdmn.py: - TestMemresBasic - TestPortForwarding (vdkr only) - TestContainerLifecycle - TestVolumeMounts - TestSystem - TestVstorage - TestRun - TestAutoStartDaemon (vdkr only) - TestDynamicPortForwarding (vdkr only) - TestPortForwardRegistry (vdkr only) Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-07-20 11:00:03 +0000