commit runc for openSUSE:Factory
Hello community, here is the log from the commit of package runc for openSUSE:Factory checked in at 2020-08-31 16:47:44 Comparing /work/SRC/openSUSE:Factory/runc (Old) and /work/SRC/openSUSE:Factory/.runc.new.3399 (New) Package is "runc" Mon Aug 31 16:47:44 2020 rev:32 rq:830453 version:1.0.0~rc92 Changes: --- /work/SRC/openSUSE:Factory/runc/runc.changes2020-07-06 16:14:08.316369126 +0200 +++ /work/SRC/openSUSE:Factory/.runc.new.3399/runc.changes 2020-08-31 16:48:23.068300146 +0200 @@ -1,0 +2,9 @@ +Fri Aug 28 07:38:29 UTC 2020 - Ralf Haferkamp + +- Upgrade to runc v1.0.0~rc92 (bsc#1175821). Upstream changelog is + available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc92 + + * Updates to CRIU support. + * Improvements to cgroupfs performance and correctness. + +--- Old: runc-1.0.0-rc91.tar.xz runc-1.0.0-rc91.tar.xz.asc New: runc-1.0.0-rc92.tar.xz runc-1.0.0-rc92.tar.xz.asc Other differences: -- ++ runc.spec ++ --- /var/tmp/diff_new_pack.Q3fNfr/_old 2020-08-31 16:48:26.112301622 +0200 +++ /var/tmp/diff_new_pack.Q3fNfr/_new 2020-08-31 16:48:26.112301622 +0200 @@ -24,7 +24,7 @@ # Package-wide golang version %define go_version 1.13 %define go_tool go -%define _version 1.0.0-rc91 +%define _version 1.0.0-rc92 %define project github.com/opencontainers/runc # enable libseccomp for sle >= sle12sp2 @@ -41,7 +41,7 @@ %endif Name: runc -Version:1.0.0~rc91 +Version:1.0.0~rc92 Release:0 Summary:Tool for spawning and running OCI containers License:Apache-2.0 ++ runc-1.0.0-rc91.tar.xz -> runc-1.0.0-rc92.tar.xz ++ 56616 lines of diff (skipped)
commit runc for openSUSE:Factory
Hello community,
here is the log from the commit of package runc for openSUSE:Factory checked in
at 2020-07-06 16:14:00
Comparing /work/SRC/openSUSE:Factory/runc (Old)
and /work/SRC/openSUSE:Factory/.runc.new.3060 (New)
Package is "runc"
Mon Jul 6 16:14:00 2020 rev:31 rq:818193 version:1.0.0~rc91
Changes:
--- /work/SRC/openSUSE:Factory/runc/runc.changes2020-05-14
23:22:31.404683612 +0200
+++ /work/SRC/openSUSE:Factory/.runc.new.3060/runc.changes 2020-07-06
16:14:08.316369126 +0200
@@ -1,0 +2,17 @@
+Thu Jul 2 01:24:49 UTC 2020 - Aleksa Sarai
+
+- Upgrade to runc v1.0.0~rc91. Upstream changelog is available from
+ https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc91
+
+ * This release of runc has experimental support for cgroupv2-only systems.
+
+- Remove upstreamed patches:
+ - bsc1149954-0001-sd-notify-do-not-hang-when-NOTIFY_SOCKET-is-used-wit.patch
+ - bsc1168481-0001-cgroup-devices-major-cleanups-and-minimal-transition.patch
+
+---
+Thu Jun 25 22:34:03 UTC 2020 - Aleksa Sarai
+
+- Switch to Go 1.13 for build.
+
+---
Old:
bsc1149954-0001-sd-notify-do-not-hang-when-NOTIFY_SOCKET-is-used-wit.patch
bsc1168481-0001-cgroup-devices-major-cleanups-and-minimal-transition.patch
runc-1.0.0-rc10.tar.xz
runc-1.0.0-rc10.tar.xz.asc
New:
runc-1.0.0-rc91.tar.xz
runc-1.0.0-rc91.tar.xz.asc
Other differences:
--
++ runc.spec ++
--- /var/tmp/diff_new_pack.v0LCZB/_old 2020-07-06 16:14:10.116374646 +0200
+++ /var/tmp/diff_new_pack.v0LCZB/_new 2020-07-06 16:14:10.120374657 +0200
@@ -22,9 +22,9 @@
%define git_version %{nil}
# Package-wide golang version
-%define go_version 1.10
+%define go_version 1.13
%define go_tool go
-%define _version 1.0.0-rc10
+%define _version 1.0.0-rc91
%define project github.com/opencontainers/runc
# enable libseccomp for sle >= sle12sp2
@@ -41,7 +41,7 @@
%endif
Name: runc
-Version:1.0.0~rc10
+Version:1.0.0~rc91
Release:0
Summary:Tool for spawning and running OCI containers
License:Apache-2.0
@@ -51,13 +51,11 @@
Source1:
https://github.com/opencontainers/runc/releases/download/v%{_version}/runc.tar.xz.asc#/runc-%{_version}.tar.xz.asc
Source2:runc.keyring
Source3:runc-rpmlintrc
-# FIX-UPSTREAM: Backport of https://github.com/opencontainers/runc/pull/1807.
bsc#1149954
-Patch0:
bsc1149954-0001-sd-notify-do-not-hang-when-NOTIFY_SOCKET-is-used-wit.patch
-# FIX-UPSTREAM: Backport of https://github.com/opencontainers/runc/pull/2391.
bsc#1168481
-Patch1:
bsc1168481-0001-cgroup-devices-major-cleanups-and-minimal-transition.patch
BuildRequires: fdupes
BuildRequires: go-go-md2man
-BuildRequires: golang(API) >= %{go_version}
+# Due to a limitation in openSUSE's Go packaging we cannot have a BuildRequires
+# for 'golang(API) >= 1.x' here, so just require 1.x exactly. bsc#1172608
+BuildRequires: go%{go_version}
%if 0%{?with_libseccomp}
BuildRequires: libseccomp-devel
%endif
@@ -73,7 +71,7 @@
%package test
Summary:Test package for runc
Group: System/Management
-BuildRequires: golang(API) >= %{go_version}
+BuildRequires: go%{go_version}
%if 0%{?with_libseccomp}
BuildRequires: libseccomp-devel
%endif
@@ -88,10 +86,6 @@
%prep
%setup -q -n %{name}-%{_version}
-# bsc#1149954
-%patch0 -p1
-# bsc#1168481
-%patch1 -p1
%build
# Do not use symlinks. If you want to run the unit tests for this package at
++ runc-1.0.0-rc10.tar.xz -> runc-1.0.0-rc91.tar.xz ++
208392 lines of diff (skipped)
commit runc for openSUSE:Factory
Hello community,
here is the log from the commit of package runc for openSUSE:Factory checked in
at 2020-05-14 23:22:28
Comparing /work/SRC/openSUSE:Factory/runc (Old)
and /work/SRC/openSUSE:Factory/.runc.new.2738 (New)
Package is "runc"
Thu May 14 23:22:28 2020 rev:30 rq:804891 version:1.0.0~rc10
Changes:
--- /work/SRC/openSUSE:Factory/runc/runc.changes2020-04-15
19:53:43.401578118 +0200
+++ /work/SRC/openSUSE:Factory/.runc.new.2738/runc.changes 2020-05-14
23:22:31.404683612 +0200
@@ -1,0 +2,7 @@
+Wed May 13 06:49:44 UTC 2020 - Aleksa Sarai
+
+- Backport https://github.com/opencontainers/runc/pull/2391 to help fix
+ bsc#1168481.
+ + bsc1168481-0001-cgroup-devices-major-cleanups-and-minimal-transition.patch
+
+---
New:
bsc1168481-0001-cgroup-devices-major-cleanups-and-minimal-transition.patch
Other differences:
--
++ runc.spec ++
--- /var/tmp/diff_new_pack.92cgHD/_old 2020-05-14 23:22:32.124685183 +0200
+++ /var/tmp/diff_new_pack.92cgHD/_new 2020-05-14 23:22:32.124685183 +0200
@@ -51,8 +51,10 @@
Source1:
https://github.com/opencontainers/runc/releases/download/v%{_version}/runc.tar.xz.asc#/runc-%{_version}.tar.xz.asc
Source2:runc.keyring
Source3:runc-rpmlintrc
-# FIX-UPSTREAM: cherry pick of https://github.com/opencontainers/runc/pull/1807
+# FIX-UPSTREAM: Backport of https://github.com/opencontainers/runc/pull/1807.
bsc#1149954
Patch0:
bsc1149954-0001-sd-notify-do-not-hang-when-NOTIFY_SOCKET-is-used-wit.patch
+# FIX-UPSTREAM: Backport of https://github.com/opencontainers/runc/pull/2391.
bsc#1168481
+Patch1:
bsc1168481-0001-cgroup-devices-major-cleanups-and-minimal-transition.patch
BuildRequires: fdupes
BuildRequires: go-go-md2man
BuildRequires: golang(API) >= %{go_version}
@@ -86,7 +88,10 @@
%prep
%setup -q -n %{name}-%{_version}
+# bsc#1149954
%patch0 -p1
+# bsc#1168481
+%patch1 -p1
%build
# Do not use symlinks. If you want to run the unit tests for this package at
++
bsc1168481-0001-cgroup-devices-major-cleanups-and-minimal-transition.patch
++
3832 lines (skipped)
commit runc for openSUSE:Factory
Hello community,
here is the log from the commit of package runc for openSUSE:Factory checked in
at 2020-04-15 19:53:41
Comparing /work/SRC/openSUSE:Factory/runc (Old)
and /work/SRC/openSUSE:Factory/.runc.new.2738 (New)
Package is "runc"
Wed Apr 15 19:53:41 2020 rev:29 rq:793810 version:1.0.0~rc10
Changes:
--- /work/SRC/openSUSE:Factory/runc/runc.changes2020-02-06
13:19:05.280668201 +0100
+++ /work/SRC/openSUSE:Factory/.runc.new.2738/runc.changes 2020-04-15
19:53:43.401578118 +0200
@@ -1,0 +2,15 @@
+Tue Apr 14 10:16:21 UTC 2020 - Ralf Haferkamp
+
+- Renamed patch:
+ 0001-sd-notify-do-not-hang-when-NOTIFY_SOCKET-is-used-wit.patch
+ to
+ bsc1149954-0001-sd-notify-do-not-hang-when-NOTIFY_SOCKET-is-used-wit.patch
+
+---
+Wed Mar 18 08:57:34 UTC 2020 - Ralf Haferkamp
+
+- Added fix for bsc#1149954
+ * 0001-sd-notify-do-not-hang-when-NOTIFY_SOCKET-is-used-wit.patch
+(cherry pick of https://github.com/opencontainers/runc/pull/1807)
+
+---
New:
bsc1149954-0001-sd-notify-do-not-hang-when-NOTIFY_SOCKET-is-used-wit.patch
Other differences:
--
++ runc.spec ++
--- /var/tmp/diff_new_pack.wtPxFu/_old 2020-04-15 19:53:44.161578461 +0200
+++ /var/tmp/diff_new_pack.wtPxFu/_new 2020-04-15 19:53:44.161578461 +0200
@@ -51,6 +51,8 @@
Source1:
https://github.com/opencontainers/runc/releases/download/v%{_version}/runc.tar.xz.asc#/runc-%{_version}.tar.xz.asc
Source2:runc.keyring
Source3:runc-rpmlintrc
+# FIX-UPSTREAM: cherry pick of https://github.com/opencontainers/runc/pull/1807
+Patch0:
bsc1149954-0001-sd-notify-do-not-hang-when-NOTIFY_SOCKET-is-used-wit.patch
BuildRequires: fdupes
BuildRequires: go-go-md2man
BuildRequires: golang(API) >= %{go_version}
@@ -84,6 +86,7 @@
%prep
%setup -q -n %{name}-%{_version}
+%patch0 -p1
%build
# Do not use symlinks. If you want to run the unit tests for this package at
++
bsc1149954-0001-sd-notify-do-not-hang-when-NOTIFY_SOCKET-is-used-wit.patch
++
>From 5d13416879fe0f50c300d94c569ea77950cbee94 Mon Sep 17 00:00:00 2001
From: Giuseppe Scrivano
Date: Fri, 25 May 2018 18:04:06 +0200
Subject: [PATCH] sd-notify: do not hang when NOTIFY_SOCKET is used with create
if NOTIFY_SOCKET is used, do not block the main runc process waiting
for events on the notify socket. Bind mount the parent directory of
the notify socket, so that "start" can create the socket and it is
still accessible from the container.
Signed-off-by: Giuseppe Scrivano
(cherry picked from commit 25fd4a67571992b9121f77d2a4f0d89d4375f383)
---
notify_socket.go | 132 +--
signals.go | 4 +-
start.go | 13 -
utils_linux.go | 12 -
4 files changed, 116 insertions(+), 45 deletions(-)
diff --git a/notify_socket.go b/notify_socket.go
index e7453c62..f313a7a6 100644
--- a/notify_socket.go
+++ b/notify_socket.go
@@ -7,11 +7,13 @@ import (
"fmt"
"net"
"os"
+ "path"
"path/filepath"
+ "strconv"
+ "time"
+ "github.com/opencontainers/runc/libcontainer"
"github.com/opencontainers/runtime-spec/specs-go"
-
- "github.com/sirupsen/logrus"
"github.com/urfave/cli"
)
@@ -27,12 +29,12 @@ func newNotifySocket(context *cli.Context, notifySocketHost
string, id string) *
}
root := filepath.Join(context.GlobalString("root"), id)
- path := filepath.Join(root, "notify.sock")
+ socketPath := filepath.Join(root, "notify", "notify.sock")
notifySocket := {
socket: nil,
host: notifySocketHost,
- socketPath: path,
+ socketPath: socketPath,
}
return notifySocket
@@ -44,13 +46,19 @@ func (s *notifySocket) Close() error {
// If systemd is supporting sd_notify protocol, this function will add support
// for sd_notify protocol from within the container.
-func (s *notifySocket) setupSpec(context *cli.Context, spec *specs.Spec) {
- mount := specs.Mount{Destination: s.host, Source: s.socketPath,
Options: []string{"bind"}}
+func (s *notifySocket) setupSpec(context *cli.Context, spec *specs.Spec) error
{
+ pathInContainer := filepath.Join("/run/notify", path.Base(s.socketPath))
+ mount := specs.Mount{
+ Destination: path.Dir(pathInContainer),
+ Source: path.Dir(s.socketPath),
+ Options: []string{"bind", "nosuid", "noexec", "nodev",
"ro"},
+ }
spec.Mounts = append(spec.Mounts, mount)
- spec.Process.Env =
commit runc for openSUSE:Factory
Hello community,
here is the log from the commit of package runc for openSUSE:Factory checked in
at 2020-02-06 13:19:01
Comparing /work/SRC/openSUSE:Factory/runc (Old)
and /work/SRC/openSUSE:Factory/.runc.new.26092 (New)
Package is "runc"
Thu Feb 6 13:19:01 2020 rev:28 rq:769817 version:1.0.0~rc10
Changes:
--- /work/SRC/openSUSE:Factory/runc/runc.changes2020-01-30
09:31:14.389163842 +0100
+++ /work/SRC/openSUSE:Factory/.runc.new.26092/runc.changes 2020-02-06
13:19:05.280668201 +0100
@@ -9,0 +10,5 @@
+Tue Jan 21 22:10:58 UTC 2020 - Bjørn Lie
+
+- Change packagewide go version to be greater or equal to 1.10.
+
+---
Other differences:
--
++ runc.spec ++
--- /var/tmp/diff_new_pack.pkqFgA/_old 2020-02-06 13:19:06.988669038 +0100
+++ /var/tmp/diff_new_pack.pkqFgA/_new 2020-02-06 13:19:06.988669038 +0100
@@ -53,7 +53,7 @@
Source3:runc-rpmlintrc
BuildRequires: fdupes
BuildRequires: go-go-md2man
-BuildRequires: golang(API) = %{go_version}
+BuildRequires: golang(API) >= %{go_version}
%if 0%{?with_libseccomp}
BuildRequires: libseccomp-devel
%endif
@@ -68,14 +68,13 @@
%package test
Summary:Test package for runc
-# Make sure we require go 1.7
Group: System/Management
-BuildRequires: golang(API) = %{go_version}
-Requires: go-go-md2man
-Requires: libapparmor-devel
+BuildRequires: golang(API) >= %{go_version}
%if 0%{?with_libseccomp}
BuildRequires: libseccomp-devel
%endif
+Requires: go-go-md2man
+Requires: libapparmor-devel
Requires: libselinux-devel
Recommends: criu
BuildArch: noarch
commit runc for openSUSE:Factory
Hello community,
here is the log from the commit of package runc for openSUSE:Factory checked in
at 2020-01-30 09:30:55
Comparing /work/SRC/openSUSE:Factory/runc (Old)
and /work/SRC/openSUSE:Factory/.runc.new.26092 (New)
Package is "runc"
Thu Jan 30 09:30:55 2020 rev:27 rq:766725 version:1.0.0~rc10
Changes:
--- /work/SRC/openSUSE:Factory/runc/runc.changes2020-01-23
16:08:00.959532798 +0100
+++ /work/SRC/openSUSE:Factory/.runc.new.26092/runc.changes 2020-01-30
09:31:14.389163842 +0100
@@ -1,0 +2,8 @@
+Thu Jan 23 17:18:05 UTC 2020 - Aleksa Sarai
+
+- Upgrade to runc v1.0.0~rc10. Upstream changelog is available from
+ https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc10
+- Drop upstreamed patches:
+ - CVE-2019-19921.patch
+
+---
Old:
CVE-2019-19921.patch
runc-1.0.0-rc9.tar.xz
runc-1.0.0-rc9.tar.xz.asc
New:
runc-1.0.0-rc10.tar.xz
runc-1.0.0-rc10.tar.xz.asc
Other differences:
--
++ runc.spec ++
--- /var/tmp/diff_new_pack.T87s6k/_old 2020-01-30 09:31:15.633164508 +0100
+++ /var/tmp/diff_new_pack.T87s6k/_new 2020-01-30 09:31:15.637164510 +0100
@@ -24,7 +24,7 @@
# Package-wide golang version
%define go_version 1.10
%define go_tool go
-%define _version 1.0.0-rc9
+%define _version 1.0.0-rc10
%define project github.com/opencontainers/runc
# enable libseccomp for sle >= sle12sp2
@@ -41,7 +41,7 @@
%endif
Name: runc
-Version:1.0.0~rc9
+Version:1.0.0~rc10
Release:0
Summary:Tool for spawning and running OCI containers
License:Apache-2.0
@@ -51,8 +51,6 @@
Source1:
https://github.com/opencontainers/runc/releases/download/v%{_version}/runc.tar.xz.asc#/runc-%{_version}.tar.xz.asc
Source2:runc.keyring
Source3:runc-rpmlintrc
-# FIX-UPSTREAM: Backport of https://github.com/opencontainers/runc/pull/2207.
-Patch1: CVE-2019-19921.patch
BuildRequires: fdupes
BuildRequires: go-go-md2man
BuildRequires: golang(API) = %{go_version}
@@ -87,8 +85,6 @@
%prep
%setup -q -n %{name}-%{_version}
-# CVE-2019-19921
-%patch1 -p1
%build
# Do not use symlinks. If you want to run the unit tests for this package at
++ runc-1.0.0-rc9.tar.xz -> runc-1.0.0-rc10.tar.xz ++
10492 lines of diff (skipped)
commit runc for openSUSE:Factory
Hello community,
here is the log from the commit of package runc for openSUSE:Factory checked in
at 2020-01-23 16:07:57
Comparing /work/SRC/openSUSE:Factory/runc (Old)
and /work/SRC/openSUSE:Factory/.runc.new.26092 (New)
Package is "runc"
Thu Jan 23 16:07:57 2020 rev:26 rq:765105 version:1.0.0~rc9
Changes:
--- /work/SRC/openSUSE:Factory/runc/runc.changes2020-01-16
18:19:51.960928151 +0100
+++ /work/SRC/openSUSE:Factory/.runc.new.26092/runc.changes 2020-01-23
16:08:00.959532798 +0100
@@ -1,0 +2,6 @@
+Fri Jan 17 03:02:46 UTC 2020 - Aleksa Sarai
+
+- Update CVE-2019-19921 patch to match upstream PR.
+ * CVE-2019-19921.patch
+
+---
Other differences:
--
++ CVE-2019-19921.patch ++
--- /var/tmp/diff_new_pack.NWPweF/_old 2020-01-23 16:08:02.743533855 +0100
+++ /var/tmp/diff_new_pack.NWPweF/_new 2020-01-23 16:08:02.771533872 +0100
@@ -1,4 +1,4 @@
-From 9975f5238a792586bfa3e36e4c66a8d1154b44ac Mon Sep 17 00:00:00 2001
+From 3291d66b98445bd7f7d02eac7f2bca2ac2c56942 Mon Sep 17 00:00:00 2001
From: Aleksa Sarai
Date: Sat, 21 Dec 2019 23:40:17 +1100
Subject: [PATCH] rootfs: do not permit /proc mounts to non-directories
@@ -17,19 +17,19 @@
Fixes: CVE-2019-19921
Signed-off-by: Aleksa Sarai
---
- libcontainer/rootfs_linux.go | 14 ++
- 1 file changed, 14 insertions(+)
+ libcontainer/rootfs_linux.go | 12
+ 1 file changed, 12 insertions(+)
diff --git a/libcontainer/rootfs_linux.go b/libcontainer/rootfs_linux.go
-index 291021440a1a..6bc0747f9f7e 100644
+index 291021440a1a..106c4c2b98bf 100644
--- a/libcontainer/rootfs_linux.go
+++ b/libcontainer/rootfs_linux.go
-@@ -299,6 +299,20 @@ func mountToRootfs(m *configs.Mount, rootfs, mountLabel
string, enableCgroupns b
+@@ -299,6 +299,18 @@ func mountToRootfs(m *configs.Mount, rootfs, mountLabel
string, enableCgroupns b
switch m.Device {
case "proc", "sysfs":
-+ // If the destination already exists and is not a directory, we
remove
-+ // it. This is to avoid mounting through a symlink or similar
-- which
++ // If the destination already exists and is not a directory, we
bail
++ // out This is to avoid mounting through a symlink or similar
-- which
+ // has been a "fun" attack scenario in the past.
+ // TODO: This won't be necessary once we switch to libpathrs
and we can
+ // stop all of these symlink-exchange attacks.
@@ -38,9 +38,7 @@
+ return err
+ }
+ } else if fi.Mode() == 0 {
-+ if err := os.Remove(dest); err != nil {
-+ return err
-+ }
++ return fmt.Errorf("filesystem %q must be mounted on
ordinary directory", m.Device)
+ }
if err := os.MkdirAll(dest, 0755); err != nil {
return err
commit runc for openSUSE:Factory
Hello community,
here is the log from the commit of package runc for openSUSE:Factory checked in
at 2020-01-16 18:19:36
Comparing /work/SRC/openSUSE:Factory/runc (Old)
and /work/SRC/openSUSE:Factory/.runc.new.26092 (New)
Package is "runc"
Thu Jan 16 18:19:36 2020 rev:25 rq:764685 version:1.0.0~rc9
Changes:
--- /work/SRC/openSUSE:Factory/runc/runc.changes2019-10-10
11:50:06.867851648 +0200
+++ /work/SRC/openSUSE:Factory/.runc.new.26092/runc.changes 2020-01-16
18:19:51.960928151 +0100
@@ -1,0 +2,6 @@
+Tue Jan 14 04:44:36 UTC 2020 - Aleksa Sarai
+
+- Add backported fix for CVE-2019-19921. bsc#1160452
+ + CVE-2019-19921.patch
+
+---
New:
CVE-2019-19921.patch
Other differences:
--
++ runc.spec ++
--- /var/tmp/diff_new_pack.rrNHEr/_old 2020-01-16 18:19:53.980929294 +0100
+++ /var/tmp/diff_new_pack.rrNHEr/_new 2020-01-16 18:19:53.980929294 +0100
@@ -1,7 +1,7 @@
#
# spec file for package runc
#
-# Copyright (c) 2019 SUSE LINUX GmbH, Nuernberg, Germany.
+# Copyright (c) 2020 SUSE LLC
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
@@ -46,11 +46,13 @@
Summary:Tool for spawning and running OCI containers
License:Apache-2.0
Group: System/Management
-Url:https://github.com/opencontainers/runc
+URL:https://github.com/opencontainers/runc
Source0:
https://github.com/opencontainers/runc/releases/download/v%{_version}/runc.tar.xz#/runc-%{_version}.tar.xz
Source1:
https://github.com/opencontainers/runc/releases/download/v%{_version}/runc.tar.xz.asc#/runc-%{_version}.tar.xz.asc
Source2:runc.keyring
Source3:runc-rpmlintrc
+# FIX-UPSTREAM: Backport of https://github.com/opencontainers/runc/pull/2207.
+Patch1: CVE-2019-19921.patch
BuildRequires: fdupes
BuildRequires: go-go-md2man
BuildRequires: golang(API) = %{go_version}
@@ -85,6 +87,8 @@
%prep
%setup -q -n %{name}-%{_version}
+# CVE-2019-19921
+%patch1 -p1
%build
# Do not use symlinks. If you want to run the unit tests for this package at
++ CVE-2019-19921.patch ++
>From 9975f5238a792586bfa3e36e4c66a8d1154b44ac Mon Sep 17 00:00:00 2001
From: Aleksa Sarai
Date: Sat, 21 Dec 2019 23:40:17 +1100
Subject: [PATCH] rootfs: do not permit /proc mounts to non-directories
mount(2) will blindly follow symlinks, which is a problem because it
allows a malicious container to trick runc into mounting /proc to an
entirely different location (and thus within the attacker's control for
a rename-exchange attack).
This is just a hotfix (to "stop the bleeding"), and the more complete
fix would be finish libpathrs and port runc to it (to avoid these types
of attacks entirely, and defend against a variety of other /proc-related
attacks). It can be bypased by someone having "/" be a volume controlled
by another container.
Fixes: CVE-2019-19921
Signed-off-by: Aleksa Sarai
---
libcontainer/rootfs_linux.go | 14 ++
1 file changed, 14 insertions(+)
diff --git a/libcontainer/rootfs_linux.go b/libcontainer/rootfs_linux.go
index 291021440a1a..6bc0747f9f7e 100644
--- a/libcontainer/rootfs_linux.go
+++ b/libcontainer/rootfs_linux.go
@@ -299,6 +299,20 @@ func mountToRootfs(m *configs.Mount, rootfs, mountLabel
string, enableCgroupns b
switch m.Device {
case "proc", "sysfs":
+ // If the destination already exists and is not a directory, we
remove
+ // it. This is to avoid mounting through a symlink or similar
-- which
+ // has been a "fun" attack scenario in the past.
+ // TODO: This won't be necessary once we switch to libpathrs
and we can
+ // stop all of these symlink-exchange attacks.
+ if fi, err := os.Lstat(dest); err != nil {
+ if !os.IsNotExist(err) {
+ return err
+ }
+ } else if fi.Mode() == 0 {
+ if err := os.Remove(dest); err != nil {
+ return err
+ }
+ }
if err := os.MkdirAll(dest, 0755); err != nil {
return err
}
--
2.24.1
commit runc for openSUSE:Factory
Hello community,
here is the log from the commit of package runc for openSUSE:Factory checked in
at 2019-10-10 11:50:05
Comparing /work/SRC/openSUSE:Factory/runc (Old)
and /work/SRC/openSUSE:Factory/.runc.new.2352 (New)
Package is "runc"
Thu Oct 10 11:50:05 2019 rev:24 rq:735405 version:1.0.0~rc9
Changes:
--- /work/SRC/openSUSE:Factory/runc/runc.changes2019-05-02
19:14:45.993081177 +0200
+++ /work/SRC/openSUSE:Factory/.runc.new.2352/runc.changes 2019-10-10
11:50:06.867851648 +0200
@@ -1,0 +2,15 @@
+Sat Oct 5 11:40:13 UTC 2019 - Aleksa Sarai
+
+- Upgrade to runc v1.0.0~rc9. Upstream changelog is available from
+ https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc9
+- Remove upstreamed patches:
+ - CVE-2019-16884.patch
+
+---
+Thu Sep 26 14:54:07 UTC 2019 - Aleksa Sarai
+
+- Add backported fix for CVE-2019-16884. bsc#1152308
+ + CVE-2019-16884.patch
+- Add runc-rpmlintrc to drop runc-test rpmlint warnings.
+
+---
Old:
runc-1.0.0-rc8.tar.xz
runc-1.0.0-rc8.tar.xz.asc
New:
runc-1.0.0-rc9.tar.xz
runc-1.0.0-rc9.tar.xz.asc
runc-rpmlintrc
Other differences:
--
++ runc.spec ++
--- /var/tmp/diff_new_pack.vvmj1v/_old 2019-10-10 11:50:07.355850352 +0200
+++ /var/tmp/diff_new_pack.vvmj1v/_new 2019-10-10 11:50:07.355850352 +0200
@@ -24,7 +24,7 @@
# Package-wide golang version
%define go_version 1.10
%define go_tool go
-%define _version 1.0.0-rc8
+%define _version 1.0.0-rc9
%define project github.com/opencontainers/runc
# enable libseccomp for sle >= sle12sp2
@@ -41,7 +41,7 @@
%endif
Name: runc
-Version:1.0.0~rc8
+Version:1.0.0~rc9
Release:0
Summary:Tool for spawning and running OCI containers
License:Apache-2.0
@@ -50,6 +50,7 @@
Source0:
https://github.com/opencontainers/runc/releases/download/v%{_version}/runc.tar.xz#/runc-%{_version}.tar.xz
Source1:
https://github.com/opencontainers/runc/releases/download/v%{_version}/runc.tar.xz.asc#/runc-%{_version}.tar.xz.asc
Source2:runc.keyring
+Source3:runc-rpmlintrc
BuildRequires: fdupes
BuildRequires: go-go-md2man
BuildRequires: golang(API) = %{go_version}
@@ -90,9 +91,9 @@
# some point during the build and you need to directly use go list directly it
# will get confused by symlinks.
export GOPATH=${HOME}/go
-mkdir -pv $HOME/go/src/%project
+mkdir -p $HOME/go/src/%project
rm -rf $HOME/go/src/%project/*
-cp -av * $HOME/go/src/%project
+cp -a * $HOME/go/src/%project
# Additionally enable seccomp.
%if 0%{?with_libseccomp}
@@ -113,7 +114,7 @@
source ./.runc_build_env
# Build runc.
-make -C "$HOME/go/src/%project" EXTRA_FLAGS="-x $BUILDFLAGS"
BUILDTAGS="$BUILDTAGS" COMMIT_NO="%{git_version}" runc
+make -C "$HOME/go/src/%project" EXTRA_FLAGS="$BUILDFLAGS"
BUILDTAGS="$BUILDTAGS" COMMIT_NO="%{git_version}" runc
mv "$HOME/go/src/%project/runc" %{name}-%{version}
# Build man pages, this can only be done on arches where we can build
go-md2man.
++ runc-1.0.0-rc8.tar.xz -> runc-1.0.0-rc9.tar.xz ++
56569 lines of diff (skipped)
++ runc-rpmlintrc ++
# -test is something that is used internally and isn't actually shipped -- it's
a pseudo-source package.
addFilter ("^runc(-kubic)?-test.*")
commit runc for openSUSE:Factory
Hello community,
here is the log from the commit of package runc for openSUSE:Factory checked in
at 2019-05-02 19:14:41
Comparing /work/SRC/openSUSE:Factory/runc (Old)
and /work/SRC/openSUSE:Factory/.runc.new.5148 (New)
Package is "runc"
Thu May 2 19:14:41 2019 rev:23 rq:699413 version:1.0.0~rc8
Changes:
--- /work/SRC/openSUSE:Factory/runc/runc.changes2019-02-24
17:04:01.916662297 +0100
+++ /work/SRC/openSUSE:Factory/.runc.new.5148/runc.changes 2019-05-02
19:14:45.993081177 +0200
@@ -1,0 +2,9 @@
+Mon Apr 29 11:56:21 UTC 2019 - Aleksa Sarai
+
+- Upgrade to runc v1.0.0~rc8. Upstream changelog is available from
+ https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc8
+- Includes upstreamed patches for regressions (bsc#1131314 bsc#1131553).
+- Remove upstreamed patches:
+ - CVE-2019-5736.patch
+
+---
Old:
CVE-2019-5736.patch
runc-1.0.0-rc6.tar.xz
runc-1.0.0-rc6.tar.xz.asc
New:
runc-1.0.0-rc8.tar.xz
runc-1.0.0-rc8.tar.xz.asc
Other differences:
--
++ runc.spec ++
--- /var/tmp/diff_new_pack.bAdV1U/_old 2019-05-02 19:14:47.225084310 +0200
+++ /var/tmp/diff_new_pack.bAdV1U/_new 2019-05-02 19:14:47.229084320 +0200
@@ -24,7 +24,7 @@
# Package-wide golang version
%define go_version 1.10
%define go_tool go
-%define _version 1.0.0-rc6
+%define _version 1.0.0-rc8
%define project github.com/opencontainers/runc
# enable libseccomp for sle >= sle12sp2
@@ -41,7 +41,7 @@
%endif
Name: runc
-Version:1.0.0~rc6
+Version:1.0.0~rc8
Release:0
Summary:Tool for spawning and running OCI containers
License:Apache-2.0
@@ -50,8 +50,6 @@
Source0:
https://github.com/opencontainers/runc/releases/download/v%{_version}/runc.tar.xz#/runc-%{_version}.tar.xz
Source1:
https://github.com/opencontainers/runc/releases/download/v%{_version}/runc.tar.xz.asc#/runc-%{_version}.tar.xz.asc
Source2:runc.keyring
-# FIX-UPSTREAM: Fix for CVE-2019-5736. bsc#1121967
-Patch: CVE-2019-5736.patch
BuildRequires: fdupes
BuildRequires: go-go-md2man
BuildRequires: golang(API) = %{go_version}
@@ -60,7 +58,6 @@
%endif
BuildRequires: libselinux-devel
Recommends: criu
-BuildRoot: %{_tmppath}/%{name}-%{version}-build
%description
runc is a CLI tool for spawning and running containers according to the OCI
@@ -87,8 +84,6 @@
%prep
%setup -q -n %{name}-%{_version}
-# CVE-2019-5736 bsc#1121967
-%patch -p1
%build
# Do not use symlinks. If you want to run the unit tests for this package at
++ runc-1.0.0-rc6.tar.xz -> runc-1.0.0-rc8.tar.xz ++
137815 lines of diff (skipped)
commit runc for openSUSE:Factory
Hello community,
here is the log from the commit of package runc for openSUSE:Factory checked in
at 2019-02-24 17:03:54
Comparing /work/SRC/openSUSE:Factory/runc (Old)
and /work/SRC/openSUSE:Factory/.runc.new.28833 (New)
Package is "runc"
Sun Feb 24 17:03:54 2019 rev:22 rq:674113 version:1.0.0~rc6
Changes:
--- /work/SRC/openSUSE:Factory/runc/runc.changes2018-12-27
00:25:20.139862053 +0100
+++ /work/SRC/openSUSE:Factory/.runc.new.28833/runc.changes 2019-02-24
17:04:01.916662297 +0100
@@ -1,0 +2,7 @@
+Wed Feb 6 08:10:47 UTC 2019 - Aleksa Sarai
+
+- Add fix for CVE-2019-5736 (effectively copying /proc/self/exe during re-exec
+ to avoid write attacks to the host runc binary). bsc#1121967
+ + CVE-2019-5736.patch
+
+---
@@ -10,0 +18 @@
+
New:
CVE-2019-5736.patch
Other differences:
--
++ runc.spec ++
--- /var/tmp/diff_new_pack.QMJ7ox/_old 2019-02-24 17:04:03.884661361 +0100
+++ /var/tmp/diff_new_pack.QMJ7ox/_new 2019-02-24 17:04:03.896661355 +0100
@@ -1,7 +1,7 @@
#
# spec file for package runc
#
-# Copyright (c) 2018 SUSE LINUX GmbH, Nuernberg, Germany.
+# Copyright (c) 2019 SUSE LINUX GmbH, Nuernberg, Germany.
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
@@ -12,7 +12,7 @@
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.
-# Please submit bugfixes or comments via http://bugs.opensuse.org/
+# Please submit bugfixes or comments via https://bugs.opensuse.org/
#
# nodebuginfo
@@ -50,6 +50,8 @@
Source0:
https://github.com/opencontainers/runc/releases/download/v%{_version}/runc.tar.xz#/runc-%{_version}.tar.xz
Source1:
https://github.com/opencontainers/runc/releases/download/v%{_version}/runc.tar.xz.asc#/runc-%{_version}.tar.xz.asc
Source2:runc.keyring
+# FIX-UPSTREAM: Fix for CVE-2019-5736. bsc#1121967
+Patch: CVE-2019-5736.patch
BuildRequires: fdupes
BuildRequires: go-go-md2man
BuildRequires: golang(API) = %{go_version}
@@ -85,6 +87,8 @@
%prep
%setup -q -n %{name}-%{_version}
+# CVE-2019-5736 bsc#1121967
+%patch -p1
%build
# Do not use symlinks. If you want to run the unit tests for this package at
++ CVE-2019-5736.patch ++
>From 0a8e4117e7f715d5fbeef398405813ce8e88558b Mon Sep 17 00:00:00 2001
From: Aleksa Sarai
Date: Wed, 9 Jan 2019 13:40:01 +1100
Subject: [PATCH] nsenter: clone /proc/self/exe to avoid exposing host binary
to container
There are quite a few circumstances where /proc/self/exe pointing to a
pretty important container binary is a _bad_ thing, so to avoid this we
have to make a copy (preferably doing self-clean-up and not being
writeable).
We require memfd_create(2) -- though there is an O_TMPFILE fallback --
but we can always extend this to use a scratch MNT_DETACH overlayfs or
tmpfs. The main downside to this approach is no page-cache sharing for
the runc binary (which overlayfs would give us) but this is far less
complicated.
This is only done during nsenter so that it happens transparently to the
Go code, and any libcontainer users benefit from it. This also makes
ExtraFiles and --preserve-fds handling trivial (because we don't need to
worry about it).
Fixes: CVE-2019-5736
Co-developed-by: Christian Brauner
Signed-off-by: Aleksa Sarai
---
libcontainer/nsenter/cloned_binary.c | 268 +++
libcontainer/nsenter/nsexec.c| 11 ++
2 files changed, 279 insertions(+)
create mode 100644 libcontainer/nsenter/cloned_binary.c
diff --git a/libcontainer/nsenter/cloned_binary.c
b/libcontainer/nsenter/cloned_binary.c
new file mode 100644
index ..c8a42c23f73f
--- /dev/null
+++ b/libcontainer/nsenter/cloned_binary.c
@@ -0,0 +1,268 @@
+/*
+ * Copyright (C) 2019 Aleksa Sarai
+ * Copyright (C) 2019 SUSE LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define _GNU_SOURCE
+#include
+#include
+#include
+#include
+#include
+#include
+#include
+#include
+
+#include
+#include
+#include
+#include
+#include
+#include
+
+/* Use our own wrapper for
commit runc for openSUSE:Factory
Hello community,
here is the log from the commit of package runc for openSUSE:Factory checked in
at 2018-12-27 00:25:07
Comparing /work/SRC/openSUSE:Factory/runc (Old)
and /work/SRC/openSUSE:Factory/.runc.new.28833 (New)
Package is "runc"
Thu Dec 27 00:25:07 2018 rev:21 rq:660263 version:1.0.0~rc6
Changes:
--- /work/SRC/openSUSE:Factory/runc/runc.changes2018-12-05
09:37:10.401113581 +0100
+++ /work/SRC/openSUSE:Factory/.runc.new.28833/runc.changes 2018-12-27
00:25:20.139862053 +0100
@@ -1,0 +2,15 @@
+Wed Dec 19 19:55:11 UTC 2018 - c...@suse.com
+
+- Update go requirements to >= go1.10 to fix
+ * bsc#1118897 CVE-2018-16873
+go#29230 cmd/go: remote command execution during "go get -u"
+ * bsc#1118898 CVE-2018-16874
+go#29231 cmd/go: directory traversal in "go get" via curly braces in
import paths
+ * bsc#1118899 CVE-2018-16875
+go#29233 crypto/x509: CPU denial of service
+---
+Thu Dec 13 04:34:25 UTC 2018 - d...@suse.com
+
+- Require golang = 1.10.
+
+---
Other differences:
--
++ runc.spec ++
--- /var/tmp/diff_new_pack.5NCDL8/_old 2018-12-27 00:25:20.623861658 +0100
+++ /var/tmp/diff_new_pack.5NCDL8/_new 2018-12-27 00:25:20.623861658 +0100
@@ -12,7 +12,7 @@
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.
-# Please submit bugfixes or comments via https://bugs.opensuse.org/
+# Please submit bugfixes or comments via http://bugs.opensuse.org/
#
# nodebuginfo
@@ -21,6 +21,8 @@
# only package released versions (unlike docker-runc).
%define git_version %{nil}
+# Package-wide golang version
+%define go_version 1.10
%define go_tool go
%define _version 1.0.0-rc6
%define project github.com/opencontainers/runc
@@ -50,7 +52,7 @@
Source2:runc.keyring
BuildRequires: fdupes
BuildRequires: go-go-md2man
-BuildRequires: golang(API) = 1.10
+BuildRequires: golang(API) = %{go_version}
%if 0%{?with_libseccomp}
BuildRequires: libseccomp-devel
%endif
@@ -68,7 +70,7 @@
Summary:Test package for runc
# Make sure we require go 1.7
Group: System/Management
-BuildRequires: golang(API) = 1.7
+BuildRequires: golang(API) = %{go_version}
Requires: go-go-md2man
Requires: libapparmor-devel
%if 0%{?with_libseccomp}
commit runc for openSUSE:Factory
Hello community,
here is the log from the commit of package runc for openSUSE:Factory checked in
at 2018-12-05 09:37:06
Comparing /work/SRC/openSUSE:Factory/runc (Old)
and /work/SRC/openSUSE:Factory/.runc.new.19453 (New)
Package is "runc"
Wed Dec 5 09:37:06 2018 rev:20 rq:652640 version:1.0.0~rc6
Changes:
--- /work/SRC/openSUSE:Factory/runc/runc.changes2018-11-06
15:29:22.252158986 +0100
+++ /work/SRC/openSUSE:Factory/.runc.new.19453/runc.changes 2018-12-05
09:37:10.401113581 +0100
@@ -1,0 +2,6 @@
+Thu Nov 29 09:10:09 UTC 2018 - Aleksa Sarai
+
+- Upgrade to runc v1.0.0~rc6. Upstream changelog is available from
+ https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc6
+
+---
Old:
_service
runc-1.0.0-rc5.tar.xz
runc-1.0.0-rc5.tar.xz.asc
New:
runc-1.0.0-rc6.tar.xz
runc-1.0.0-rc6.tar.xz.asc
Other differences:
--
++ runc.spec ++
--- /var/tmp/diff_new_pack.DrLigw/_old 2018-12-05 09:37:10.977112950 +0100
+++ /var/tmp/diff_new_pack.DrLigw/_new 2018-12-05 09:37:10.981112946 +0100
@@ -22,7 +22,7 @@
%define git_version %{nil}
%define go_tool go
-%define _version 1.0.0-rc5
+%define _version 1.0.0-rc6
%define project github.com/opencontainers/runc
# enable libseccomp for sle >= sle12sp2
@@ -39,20 +39,18 @@
%endif
Name: runc
-Version:1.0.0~rc5
+Version:1.0.0~rc6
Release:0
Summary:Tool for spawning and running OCI containers
License:Apache-2.0
Group: System/Management
Url:https://github.com/opencontainers/runc
-Source0:runc-%{_version}.tar.xz
-Source1:runc-%{_version}.tar.xz.asc
+Source0:
https://github.com/opencontainers/runc/releases/download/v%{_version}/runc.tar.xz#/runc-%{_version}.tar.xz
+Source1:
https://github.com/opencontainers/runc/releases/download/v%{_version}/runc.tar.xz.asc#/runc-%{_version}.tar.xz.asc
Source2:runc.keyring
BuildRequires: fdupes
-# Make sure we require go 1.7
BuildRequires: go-go-md2man
-BuildRequires: libapparmor-devel
-BuildRequires: golang(API) = 1.7
+BuildRequires: golang(API) = 1.10
%if 0%{?with_libseccomp}
BuildRequires: libseccomp-devel
%endif
++ runc-1.0.0-rc5.tar.xz -> runc-1.0.0-rc6.tar.xz ++
7448 lines of diff (skipped)
commit runc for openSUSE:Factory
Hello community,
here is the log from the commit of package runc for openSUSE:Factory checked in
at 2018-11-06 15:29:02
Comparing /work/SRC/openSUSE:Factory/runc (Old)
and /work/SRC/openSUSE:Factory/.runc.new (New)
Package is "runc"
Tue Nov 6 15:29:02 2018 rev:19 rq:645770 version:1.0.0~rc5
Changes:
--- /work/SRC/openSUSE:Factory/runc/runc.changes2018-06-22
13:15:41.302358855 +0200
+++ /work/SRC/openSUSE:Factory/.runc.new/runc.changes 2018-11-06
15:29:22.252158986 +0100
@@ -1,0 +2,5 @@
+Wed Oct 31 14:01:03 UTC 2018 - Valentin Rothberg
+
+- Create a symlink in /usr/bin/runc to enable rootless Podman and Buildah.
+
+---
Other differences:
--
++ runc.spec ++
--- /var/tmp/diff_new_pack.YtNdGO/_old 2018-11-06 15:29:23.132157651 +0100
+++ /var/tmp/diff_new_pack.YtNdGO/_new 2018-11-06 15:29:23.136157644 +0100
@@ -12,7 +12,7 @@
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.
-# Please submit bugfixes or comments via http://bugs.opensuse.org/
+# Please submit bugfixes or comments via https://bugs.opensuse.org/
#
# nodebuginfo
@@ -130,8 +130,11 @@
%install
source ./.runc_build_env
-# We install to /usr/sbin/runc as per upstream.
+# We install to /usr/sbin/runc as per upstream an create a symlink in /usr/bin
+# for rootless tools.
install -D -m755 %{name}-%{version} %{buildroot}%{_sbindir}/%{name}
+install -m 755 -d %{buildroot}%{_bindir}
+ln -s %{_sbindir}/%{name} %{buildroot}%{_bindir}/%{name}
install -d -m755 %{buildroot}/usr/src/%{name}/
cp -av $HOME/go/src/%{project}/* %{buildroot}/usr/src/%{name}/
@@ -148,6 +151,7 @@
%doc README.md
%license LICENSE
%{_sbindir}/%{name}
+%{_bindir}/%{name}
%{_mandir}/man8/runc*.8.gz
%files test
commit runc for openSUSE:Factory
Hello community,
here is the log from the commit of package runc for openSUSE:Factory checked in
at 2018-06-22 13:15:38
Comparing /work/SRC/openSUSE:Factory/runc (Old)
and /work/SRC/openSUSE:Factory/.runc.new (New)
Package is "runc"
Fri Jun 22 13:15:38 2018 rev:18 rq:616570 version:1.0.0~rc5
Changes:
--- /work/SRC/openSUSE:Factory/runc/runc.changes2018-06-08
23:09:58.879946204 +0200
+++ /work/SRC/openSUSE:Factory/.runc.new/runc.changes 2018-06-22
13:15:41.302358855 +0200
@@ -1,0 +2,5 @@
+Wed Jun 13 12:59:09 UTC 2018 - dcass...@suse.com
+
+- Make use of %license macro
+
+---
Other differences:
--
++ runc.spec ++
--- /var/tmp/diff_new_pack.ZoUmbs/_old 2018-06-22 13:15:42.406317919 +0200
+++ /var/tmp/diff_new_pack.ZoUmbs/_new 2018-06-22 13:15:42.410317771 +0200
@@ -145,7 +145,8 @@
%files
%defattr(-,root,root)
-%doc README.md LICENSE
+%doc README.md
+%license LICENSE
%{_sbindir}/%{name}
%{_mandir}/man8/runc*.8.gz
commit runc for openSUSE:Factory
Hello community,
here is the log from the commit of package runc for openSUSE:Factory checked in
at 2018-06-08 23:09:53
Comparing /work/SRC/openSUSE:Factory/runc (Old)
and /work/SRC/openSUSE:Factory/.runc.new (New)
Package is "runc"
Fri Jun 8 23:09:53 2018 rev:17 rq:614156 version:1.0.0~rc5
Changes:
--- /work/SRC/openSUSE:Factory/runc/runc.changes2018-03-01
12:03:44.466856240 +0100
+++ /work/SRC/openSUSE:Factory/.runc.new/runc.changes 2018-06-08
23:09:58.879946204 +0200
@@ -1,0 +2,7 @@
+Tue Jun 5 06:38:40 UTC 2018 - asa...@suse.com
+
+- Remove 'go test' from %check section, as it has only ever caused us problems
+ and hasn't (as far as I remember) ever caught a release-blocking issue. Smoke
+ testing has been far more useful. boo#1095817
+
+---
Other differences:
--
++ runc.spec ++
--- /var/tmp/diff_new_pack.jgSXEX/_old 2018-06-08 23:10:00.531886561 +0200
+++ /var/tmp/diff_new_pack.jgSXEX/_new 2018-06-08 23:10:00.539886273 +0200
@@ -121,22 +121,11 @@
man/md2man-all.sh
%check
-source ./.runc_build_env
-cd $HOME/go/src/%project
-
-PKG_LIST=$(go list ./... \
- | grep -v '%{project}/libcontainer/cgroups/fs$' \
- | grep -v '%{project}/libcontainer$' \
- | grep -v '%{project}/libcontainer/integration$' \
- | grep -v '%{project}/libcontainer/nsenter$' \
- | grep -v '%{project}/libcontainer/user$' \
- | grep -v '%{project}/libcontainer/xattr$' \
-%if ! 0%{?with_libseccomp}
- | grep -v '%{project}/libcontainer/seccomp$' \
- | grep -v 'github.com/seccomp/libseccomp-golang$' \
-%endif
- )
-%go_tool test -buildmode=pie -tags "$BUILDTAGS" -timeout 3m -v $PKG_LIST
+# We used to run 'go test' here, however we found that this actually didn't
+# catch any issues that were caught by smoke testing, and %check would
+# continually cause package builds to fail due to flaky tests. If you ever need
+# to know how the testing was done, you can always look in the package history.
+# boo#1095817
%install
source ./.runc_build_env
commit runc for openSUSE:Factory
Hello community,
here is the log from the commit of package runc for openSUSE:Factory checked in
at 2018-03-01 12:03:37
Comparing /work/SRC/openSUSE:Factory/runc (Old)
and /work/SRC/openSUSE:Factory/.runc.new (New)
Package is "runc"
Thu Mar 1 12:03:37 2018 rev:16 rq:580741 version:1.0.0~rc5
Changes:
--- /work/SRC/openSUSE:Factory/runc/runc.changes2017-08-24
18:22:29.722144284 +0200
+++ /work/SRC/openSUSE:Factory/.runc.new/runc.changes 2018-03-01
12:03:44.466856240 +0100
@@ -1,0 +2,8 @@
+Tue Feb 27 17:18:32 UTC 2018 - asa...@suse.com
+
+- Upgrade to runc v1.0.0~rc5. Upstream changelog is available from
+ https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc5
+- Remove patch now merged upstream.
+ - bsc1053532-0001-makefile-drop-usage-of-install.patch
+
+---
Old:
bsc1053532-0001-makefile-drop-usage-of-install.patch
runc-1.0.0-rc4.tar.xz
runc-1.0.0-rc4.tar.xz.asc
New:
runc-1.0.0-rc5.tar.xz
runc-1.0.0-rc5.tar.xz.asc
Other differences:
--
++ runc.spec ++
--- /var/tmp/diff_new_pack.AzWb4c/_old 2018-03-01 12:03:45.542817644 +0100
+++ /var/tmp/diff_new_pack.AzWb4c/_new 2018-03-01 12:03:45.546817500 +0100
@@ -1,7 +1,7 @@
#
# spec file for package runc
#
-# Copyright (c) 2017 SUSE LINUX GmbH, Nuernberg, Germany.
+# Copyright (c) 2018 SUSE LINUX GmbH, Nuernberg, Germany.
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
@@ -22,7 +22,7 @@
%define git_version %{nil}
%define go_tool go
-%define _version 1.0.0-rc4
+%define _version 1.0.0-rc5
%define project github.com/opencontainers/runc
# enable libseccomp for sle >= sle12sp2
@@ -39,7 +39,7 @@
%endif
Name: runc
-Version:1.0.0~rc4
+Version:1.0.0~rc5
Release:0
Summary:Tool for spawning and running OCI containers
License:Apache-2.0
@@ -57,8 +57,6 @@
BuildRequires: libseccomp-devel
%endif
BuildRequires: libselinux-devel
-# SUSE-FIX-UPSTREAM: Backport of
https://github.com/opencontainers/runc/pull/1555. bsc#1053532
-Patch100: bsc1053532-0001-makefile-drop-usage-of-install.patch
Recommends: criu
BuildRoot: %{_tmppath}/%{name}-%{version}-build
@@ -87,8 +85,6 @@
%prep
%setup -q -n %{name}-%{_version}
-# bsc#1053532
-%patch100 -p1
%build
# Do not use symlinks. If you want to run the unit tests for this package at
++ _service ++
--- /var/tmp/diff_new_pack.AzWb4c/_old 2018-03-01 12:03:45.578816353 +0100
+++ /var/tmp/diff_new_pack.AzWb4c/_new 2018-03-01 12:03:45.582816209 +0100
@@ -2,13 +2,13 @@
https
github.com
- opencontainers/runc/releases/download/v1.0.0-rc4/runc.tar.xz
- runc-1.0.0-rc4.tar.xz
+ opencontainers/runc/releases/download/v1.0.0-rc5/runc.tar.xz
+ runc-1.0.0-rc5.tar.xz
https
github.com
- opencontainers/runc/releases/download/v1.0.0-rc4/runc.tar.xz.asc
- runc-1.0.0-rc4.tar.xz.asc
+ opencontainers/runc/releases/download/v1.0.0-rc5/runc.tar.xz.asc
+ runc-1.0.0-rc5.tar.xz.asc
++ runc-1.0.0-rc4.tar.xz -> runc-1.0.0-rc5.tar.xz ++
48265 lines of diff (skipped)
commit runc for openSUSE:Factory
Hello community,
here is the log from the commit of package runc for openSUSE:Factory checked in
at 2017-08-24 18:22:28
Comparing /work/SRC/openSUSE:Factory/runc (Old)
and /work/SRC/openSUSE:Factory/.runc.new (New)
Package is "runc"
Thu Aug 24 18:22:28 2017 rev:15 rq:517695 version:1.0.0~rc4
Changes:
--- /work/SRC/openSUSE:Factory/runc/runc.changes2017-08-17
11:44:29.538583431 +0200
+++ /work/SRC/openSUSE:Factory/.runc.new/runc.changes 2017-08-24
18:22:29.722144284 +0200
@@ -1,0 +2,6 @@
+Thu Aug 17 04:39:56 UTC 2017 - asa...@suse.com
+
+- Use .tar.xz provided by upstream, as well as include the keyring to allow
+ full provenance of the source.
+
+---
Old:
runc-v1.0.0rc4.tar.xz
New:
runc-1.0.0-rc4.tar.xz
runc-1.0.0-rc4.tar.xz.asc
runc.keyring
Other differences:
--
++ runc.spec ++
--- /var/tmp/diff_new_pack.jlJy9f/_old 2017-08-24 18:22:30.742000684 +0200
+++ /var/tmp/diff_new_pack.jlJy9f/_new 2017-08-24 18:22:30.746000121 +0200
@@ -22,7 +22,7 @@
%define git_version %{nil}
%define go_tool go
-%define _version 1.0.0rc4
+%define _version 1.0.0-rc4
%define project github.com/opencontainers/runc
# enable libseccomp for sle >= sle12sp2
@@ -45,7 +45,9 @@
License:Apache-2.0
Group: System/Management
Url:https://github.com/opencontainers/runc
-Source: %{name}-v%{_version}.tar.xz
+Source0:runc-%{_version}.tar.xz
+Source1:runc-%{_version}.tar.xz.asc
+Source2:runc.keyring
BuildRequires: fdupes
# Make sure we require go 1.7
BuildRequires: go-go-md2man
@@ -84,7 +86,7 @@
Test package for runc. It contains the source code and the tests.
%prep
-%setup -q -n %{name}-v%{_version}
+%setup -q -n %{name}-%{_version}
# bsc#1053532
%patch100 -p1
++ _service ++
--- /var/tmp/diff_new_pack.jlJy9f/_old 2017-08-24 18:22:30.837987169 +0200
+++ /var/tmp/diff_new_pack.jlJy9f/_new 2017-08-24 18:22:30.837987169 +0200
@@ -1,17 +1,14 @@
-
-https://github.com/opencontainers/runc.git
-git
-runc
-@PARENT_TAG@+r@TAG_OFFSET@
-master
-.git
+
+https
+ github.com
+ opencontainers/runc/releases/download/v1.0.0-rc4/runc.tar.xz
+ runc-1.0.0-rc4.tar.xz
-
-*.tar
-xz
-
-
-runc
+
+https
+ github.com
+ opencontainers/runc/releases/download/v1.0.0-rc4/runc.tar.xz.asc
+ runc-1.0.0-rc4.tar.xz.asc
++ runc.keyring ++
pub rsa4096 2016-06-21 [SC] [expires: 2031-06-18]
5F36C6C61B5460124A75F5A69E18AA267DDB8DB4
uid [ultimate] Aleksa Sarai
uid [ultimate] Aleksa Sarai
sub rsa4096 2016-06-21 [E] [expires: 2031-06-18]
-BEGIN PGP PUBLIC KEY BLOCK-
mQINBFdpGN0BEADMEmLpnUel7OI2SM8f88i7w0iRgJd4kOvF1z673+zWCgaw9QW8
ha7wAm/+3isas9IqlvGx61i6hbO7TFwcYi472VHhs4HP8jMtWytHHkjc3O9xlMc0
CfekjIpoR1CffYtCvkLr8/f74jHNRfqsmZ1Oxa9GjbhgDnbw4Baztp6WctzMXyOJ
j5bJuSfQTcgFbIeQ27zx7gNjbnHyEP5TEm1/CeoWpGPpZLJPiKHdI/TBCyFexHJ0
IlabKc4DC43RZyh0Btuf+FiX9K2NkoCC7l5nQdde8B6YG7SA6xEhwhQ73bSs7A56
rlZxfIFmLCB/81FyXk5eH0Eu9Lbwj69YQ81EdkLnLAyP3ZB+MRGuiWVD88Jr1He2
25m3dxTVzaP0TAV4LqdbuqTwr2wagu9MZQ5XXDiaEuiPwTrO10xlmivOjRaWxoWA
E0I3fOdrzqfg9XK6g1pG23v2WhHFIejqVCXrf5oPcCd62lGeh0ghEdNN89ikXbka
1PJRiWI3uDQ6STSKa+6uC5eUM7tK/ymqS8JYSQf4d3eIaC2H403psPt5kbq1bHdx
nRPX2eh/t1QzR1dhPxzai4CzLERIYJ9iD4nGiSscwy0P44AgyeuywSg4qXzr9Sfe
igOj+6lfJb3iZRN3dKLTRAKWvo7yfdi/UOycodlaQyW8v0yXAx7Yh1NgJQARAQAB
tB1BbGVrc2EgU2FyYWkgPGFzYXJhaUBzdXNlLmRlPokCPQQTAQgAJwUCV2kY3QIb
AwUJHDIEgAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRCeGKomfduNtGecEACZ
JLVdeKHKsSUqTLOjbC6t9uKfKlNpu+iQ2/TS9YazLWXoFEc8f/uWB8BpHcJBFrqz
j+mI34ShEkbbNJArxR76njnAtPF+73GiD0dAjRDWz8YtQgSg5UhYm6O2Si/EM4I8
TDzflyjaZltCkDe2U+2T8dTkYxqOi11IuCukPBNe0moxGKvLGPWEqZQMPCfBgllD
lv2Toiry2Fp1bkBlT6hk0C684rfAwzPQuH0BBv8vgfgroRMJg/qfZb64lhMCXaPr
rCtVHP+F1bVXKZCBCt7ETTtcteUEKaFmGgDGpXGnIqPL5iWLK5u8DQL/1lGcinj9
QdD9IUNqsrsNAbdyMMqQvZKQwIVDgFMXrCwSRymOi6cppN7eF0VyFN7YsATttRGx
CZBoSMhVW6VVxuJFGaQWFXWthVGVEd2jkvny1TX8Nm8KBHC2G/wNVU3pKrCPhMCt
rYc8xWZ+6uisQ6XWs8H4nyBOVN6RvhIqqXJL1nvViOSFMLSDyFgPA16368krgxYE
pVDvie04aDjKZj2/0LSogNQPqZxs8uKIjLZ1NYQQmCQ8Dx9/nshg1wbyDD/c///M
EmVFmZhlNLZ8tV/iTlwfD/4vjbeaAQTVanhPFRbUtmL/iuz5f0gH0b0xc+mc+yQ1
egjBwMuKr+h7jbSXIWoFGZLrqT3WswTg0Khk6oEL57QeQWxla3NhIFNhcmFpIDxh
c2FyYWlAc3VzZS5jb20+iQI9BBMBCAAnBQJXaRngAhsDBQkcMgSABQsJCAcCBhUI
CQoLAgQWAgMBAh4BAheAAAoJEJ4YqiZ924202mIQAIjGrikF7OPBCbV5Oo4oC0QQ
7HcG+DM9cN6UcFO+rzWQxZ/atEpiULa4O3YKoGOkSV5WAjUpaY5Rf7Obt3EjgrwE
PhtGvOpC6kkkTV43RmmK06CxHiZPrUJBwcpbW1rf2JZx7PPBMbZfsmWdVZc+LjzC
D3KtJ7xhzT0mi+zN5ONNHody6sDQO6n0mN+bRVxiVdcxwjYHfJYGobI6aaKyupvl
commit runc for openSUSE:Factory
Hello community,
here is the log from the commit of package runc for openSUSE:Factory checked in
at 2017-08-17 11:44:20
Comparing /work/SRC/openSUSE:Factory/runc (Old)
and /work/SRC/openSUSE:Factory/.runc.new (New)
Package is "runc"
Thu Aug 17 11:44:20 2017 rev:14 rq:517265 version:1.0.0~rc4
Changes:
--- /work/SRC/openSUSE:Factory/runc/runc.changes2017-07-30
11:23:00.606392464 +0200
+++ /work/SRC/openSUSE:Factory/.runc.new/runc.changes 2017-08-17
11:44:29.538583431 +0200
@@ -1,0 +2,56 @@
+Sun Aug 13 14:25:32 UTC 2017 - asa...@suse.com
+
+- Use the upstream Makefile, to ensure that we always include the version
+ information in runc. This was confusing users (and Docker). bsc#1053532
+- Add a backported patch to fix a Makefile bug.
+ https://github.com/opencontainers/runc/pull/1555
+ + bsc1053532-0001-makefile-drop-usage-of-install.patch
+
+---
+Thu Aug 10 17:14:02 UTC 2017 - asa...@suse.com
+
+- Update to runc v1.0.0-rc4. Upstream changelog:
+ + runc now supports v1.0.0 of the OCI runtime specification. #1527
+ + Rootless containers support has been released. The current state of
+ this feature is that it only supports single-{uid,gid} mappings as an
+ unprivileged user, and cgroups are completely unsupported. Work is
+ being done to improve this. #774
+ + Rather than relying on CRIU version nnumbers, actually check if the
+ system supports pre-dumping. #1371
+ + Allow the PIDs cgroup limit to be updated. #1423
+ + Add support for checkpoint/restore of containers with orphaned PTYs
+ (which is effectively all containers with terminal=true). #1355
+ + Permit prestart hooks to modify the cgroup configuration of a
+ container. #1239
+ + Add support for a wide variety of mount options. #1460
+ + Expose memory.use_hierarchy in MemoryStats. #1378
+ * Fix incorrect handling of systems without the freezer cgroup. #1387
+ * Many, many changes to switch away from Go's "syscall" stdlib to
+ "golang.org/x/sys/unix". #1394 #1398 #1442 #1464 #1467 #1470 #1474
+ #1478 #1491 #1482 #1504 #1519 #1530
+ * Set cgroup resources when restoring a container. #1399
+ * Switch back to using /sbin as the installation directory. #1406
+ * Remove the arbitrary container ID length restriction. #1435
+ * Make container force deletion ignore non-existent containers. #1451
+ * Improve handling of arbitrary cgroup mount locations when populating
+ cpuset. #1372
+ * Make the SaneTerminal interface public. #1479
+ * Fix cases where runc would report a container to be in a "Running"
+ state if the init was a zombie or dead. #1489
+ * Do not set supplementary groups for numeric users. #1450
+ * Fix various issues with the "owner" field in runc-list. #1516
+ * Many other miscellaneous fixes, some of which were made by first-time
+ contributors. Thanks, and welcome to the project! #1406 #1400 #1365
+ #1396 #1402 #1414 #1412 #1408 #1418 #1425 #1428 #1436 #1433 #1438
+ #1410 #1447 #1388 #1484 #1481 #1496 #1245 #1524 #1534 #1526 #1533
+ - Remove any semblance of non-Linux support. #1502
+ - We no longer use shfmt for testing. #1510
+
+---
+Wed Aug 2 13:51:43 UTC 2017 - asa...@suse.com
+
+- Use -buildmode=pie for tests and binary build. bsc#1048046 bsc#1051429
+- Cleanup seccomp builds similar to bsc#1028638
+- Remove the usage of 'cp -r' to reduce noise in the build logs.
+
+---
Old:
runc-v1.0.0rc3+r133.tar.xz
New:
bsc1053532-0001-makefile-drop-usage-of-install.patch
runc-v1.0.0rc4.tar.xz
Other differences:
--
++ runc.spec ++
--- /var/tmp/diff_new_pack.zKq1Zp/_old 2017-08-17 11:44:31.090364418 +0200
+++ /var/tmp/diff_new_pack.zKq1Zp/_new 2017-08-17 11:44:31.102362725 +0200
@@ -14,13 +14,32 @@
# Please submit bugfixes or comments via http://bugs.opensuse.org/
#
+# nodebuginfo
+# We don't include a git_version in the "upstream" runc package, because we
+# only package released versions (unlike docker-runc).
+%define git_version %{nil}
+
%define go_tool go
-%define _version 1.0.0rc3+r133
+%define _version 1.0.0rc4
+%define project github.com/opencontainers/runc
+
+# enable libseccomp for sle >= sle12sp2
+%if 0%{?sle_version} >= 120200
+%define with_libseccomp 1
+%endif
+# enable libseccomp for leap >= 42.2
+%if 0%{?leap_version} >= 420200
+%define with_libseccomp 1
+%endif
+# enable libseccomp for Factory
+%if
commit runc for openSUSE:Factory
Hello community,
here is the log from the commit of package runc for openSUSE:Factory checked in
at 2017-07-30 11:22:54
Comparing /work/SRC/openSUSE:Factory/runc (Old)
and /work/SRC/openSUSE:Factory/.runc.new (New)
Package is "runc"
Sun Jul 30 11:22:54 2017 rev:13 rq:509158 version:1.0.0~rc3+r133
Changes:
--- /work/SRC/openSUSE:Factory/runc/runc.changes2017-05-20
10:13:26.873709051 +0200
+++ /work/SRC/openSUSE:Factory/.runc.new/runc.changes 2017-07-30
11:23:00.606392464 +0200
@@ -1,0 +2,7 @@
+Thu Jul 6 17:14:17 UTC 2017 - th...@suse.de
+
+- switch to opencontainers/runc master branch
+- remove CVE-2016-9962.patch
+- stop providing docker-runc
+
+---
Old:
CVE-2016-9962.patch
runc-git.9c2d8d1.tar.xz
New:
runc-v1.0.0rc3+r133.tar.xz
Other differences:
--
++ runc.spec ++
--- /var/tmp/diff_new_pack.04G6pv/_old 2017-07-30 11:23:03.294013218 +0200
+++ /var/tmp/diff_new_pack.04G6pv/_new 2017-07-30 11:23:03.302012089 +0200
@@ -17,29 +17,16 @@
%define go_tool go
-
-# MANUAL: Update the git_version and git_revision
-# FIX-OPENSUSE: This will be removed as soon as we move Docker's runC fork into
-# a separate package. This whole versioning mess is caused by
-# Docker vendoring non-releases of runC.
-%define git_version 9c2d8d1
-# How to get the git_revision
-# git clone ${url}.git runc-upstream
-# cd runc-upstream
-# git checkout $git_version
-# git_revision=r$(git rev-list HEAD | wc -l)
-%define git_revision r2947
-%define version_unconverted %{git_version}
+%define _version 1.0.0rc3+r133
Name: runc
-Version:0.1.1+git%{git_revision}_%{git_version}
+Version:1.0.0~rc3+r133
Release:0
Summary:Tool for spawning and running OCI containers
License:Apache-2.0
Group: System/Management
Url:https://github.com/opencontainers/runc
-Source: %{name}-git.%{git_version}.tar.xz
-Patch0: CVE-2016-9962.patch
+Source: %{name}-v%{_version}.tar.xz
BuildRequires: fdupes
# Make sure we require go 1.7
BuildRequires: go-go-md2man
@@ -78,8 +65,7 @@
Test package for runc. It contains the source code and the tests.
%prep
-%setup -q -n %{name}-git.%{git_version}
-%patch0 -p1
+%setup -q -n %{name}-v%{_version}
%build
# Do not use symlinks. If you want to run the unit tests for this package at
@@ -125,7 +111,6 @@
# symlink runc as docker-runc. bsc#1015661
install -d -m755 %{buildroot}/%{_bindir}
-ln -s /usr/sbin/runc %{buildroot}/%{_bindir}/docker-runc
install -d -m755 %{buildroot}%{_mandir}/man8
install -m644 man/man8/runc*.8 %{buildroot}%{_mandir}/man8
@@ -138,7 +123,6 @@
%defattr(-,root,root)
%doc README.md LICENSE
%{_sbindir}/%{name}
-%{_bindir}/docker-runc
%{_mandir}/man8/runc*.8.gz
++ _service ++
--- /var/tmp/diff_new_pack.04G6pv/_old 2017-07-30 11:23:03.350005318 +0200
+++ /var/tmp/diff_new_pack.04G6pv/_new 2017-07-30 11:23:03.354004753 +0200
@@ -1,14 +1,10 @@
-
-https://github.com/docker/runc.git
+https://github.com/opencontainers/runc.git
git
runc
-git.%h
-9c2d8d184e5da67c95d601382adf14862e4f2228
+@PARENT_TAG@+r@TAG_OFFSET@
+master
.git
commit runc for openSUSE:Factory
Hello community,
here is the log from the commit of package runc for openSUSE:Factory checked in
at 2017-05-20 10:13:19
Comparing /work/SRC/openSUSE:Factory/runc (Old)
and /work/SRC/openSUSE:Factory/.runc.new (New)
Package is "runc"
Sat May 20 10:13:19 2017 rev:12 rq:494718 version:0.1.1+gitr2947_9c2d8d1
Changes:
--- /work/SRC/openSUSE:Factory/runc/runc.changes2017-04-17
10:26:23.213571574 +0200
+++ /work/SRC/openSUSE:Factory/.runc.new/runc.changes 2017-05-20
10:13:26.873709051 +0200
@@ -1,0 +2,33 @@
+Thu May 4 19:04:49 UTC 2017 - jmassaguer...@suse.com
+
+- fix the golang requirement to 1.7 to the subpackages
+
+---
+Tue May 2 15:49:41 UTC 2017 - jmassaguer...@suse.com
+
+- fix golang requirement to 1.7
+
+---
+Fri Apr 28 16:16:00 UTC 2017 - jeng...@inai.de
+
+- Substitute %__-type macro indirections
+
+---
+Thu Apr 13 16:34:03 UTC 2017 - jmassaguer...@suse.com
+
+- update version to the one required by docker-17.04.0-ce (bsc#1034053)
+ remove ignore_cgroup2_mountpoint.patch . This is already included in
+ the upstream source code.
+
+---
+Wed Apr 12 09:55:28 UTC 2017 - jmassaguer...@suse.com
+
+- Make sure this is being built with go 1.7
+
+---
+Tue Apr 11 15:37:36 UTC 2017 - jmassaguer...@suse.com
+
+- remove the go_arches macro because we are using go1.7 which
+ is available in all archs
+
+---
Old:
ignore_cgroup2_mountpoint.patch
runc-git.2f7393a.tar.xz
New:
runc-git.9c2d8d1.tar.xz
Other differences:
--
++ runc.spec ++
--- /var/tmp/diff_new_pack.8jeepG/_old 2017-05-20 10:13:27.493621463 +0200
+++ /var/tmp/diff_new_pack.8jeepG/_new 2017-05-20 10:13:27.493621463 +0200
@@ -16,37 +16,19 @@
#
-# Check if go_arches is defined in the project configuration
-# Otherwise, define it here
-# In order to define it in the project configuration, see
-#
-# https://en.opensuse.org/openSUSE:Build%20Service%20prjconf#Macros
-#
-# The Macros tag is the one that defines the go_arches variable to be used
-# in the spec file.
-# The "define" one is to help the specfile parser of the buildservice
-# to see what packages are being built. You also want to define it here
-# for keeping things consistent.
-
-%{!?go_arches: %global go_arches %ix86 x86_64 aarch64 ppc64le}
-
-%ifarch %go_arches
%define go_tool go
-%else
-%define go_tool go-6
-%endif
# MANUAL: Update the git_version and git_revision
# FIX-OPENSUSE: This will be removed as soon as we move Docker's runC fork into
# a separate package. This whole versioning mess is caused by
# Docker vendoring non-releases of runC.
-%define git_version 2f7393a
+%define git_version 9c2d8d1
# How to get the git_revision
# git clone ${url}.git runc-upstream
# cd runc-upstream
# git checkout $git_version
# git_revision=r$(git rev-list HEAD | wc -l)
-%define git_revision r2942
+%define git_revision r2947
%define version_unconverted %{git_version}
Name: runc
@@ -58,15 +40,11 @@
Url:https://github.com/opencontainers/runc
Source: %{name}-git.%{git_version}.tar.xz
Patch0: CVE-2016-9962.patch
-Patch1: ignore_cgroup2_mountpoint.patch
BuildRequires: fdupes
-%ifarch %go_arches
-BuildRequires: go >= 1.5
+# Make sure we require go 1.7
BuildRequires: go-go-md2man
-%else
-BuildRequires: gcc6-go >= 6.1
-%endif
BuildRequires: libapparmor-devel
+BuildRequires: golang(API) = 1.7
# Seccomp isn't supported on aarch64.
%ifnarch aarch64
BuildRequires: libseccomp-devel
@@ -83,13 +61,10 @@
%package test
Summary:Test package for runc
+# Make sure we require go 1.7
Group: System/Management
-%ifarch %go_arches
-Requires: go >= 1.5
+BuildRequires: golang(API) = 1.7
Requires: go-go-md2man
-%else
-Requires: gcc6-go >= 6.1
-%endif
Requires: libapparmor-devel
# Seccomp isn't supported on aarch64.
%ifnarch aarch64
@@ -105,9 +80,6 @@
%prep
%setup -q -n %{name}-git.%{git_version}
%patch0 -p1
-%if 0%{?suse_version} > 1320
-%patch1 -p1
-%endif
%build
# Do not use symlinks. If you want to run the unit tests for this package at
@@ -132,11 +104,8 @@
%go_tool build "$BUILDFLAGS" -tags "$BUILDTAGS" -x -o %{name}-%{version}
github.com/opencontainers/%{name}
# Build man pages, this can only be done on arches where we can build
go-md2man.
-%ifarch %go_arches
man/md2man-all.sh
commit runc for openSUSE:Factory
Hello community,
here is the log from the commit of package runc for openSUSE:Factory checked in
at 2017-04-17 10:26:20
Comparing /work/SRC/openSUSE:Factory/runc (Old)
and /work/SRC/openSUSE:Factory/.runc.new (New)
Package is "runc"
Mon Apr 17 10:26:20 2017 rev:11 rq:487329 version:0.1.1+gitr2942_2f7393a
Changes:
--- /work/SRC/openSUSE:Factory/runc/runc.changes2017-03-12
20:05:55.749378120 +0100
+++ /work/SRC/openSUSE:Factory/.runc.new/runc.changes 2017-04-17
10:26:23.213571574 +0200
@@ -1,0 +2,7 @@
+Wed Mar 29 15:47:52 UTC 2017 - jmassaguer...@suse.com
+
+- fix bsc#1028113 - runc: make sure to ignore cgroup v2 mountpoints
+ This is a backport of https://github.com/opencontainers/runc/pull/1266
+ + ignore_cgroup2_mountpoint.patch
+
+---
New:
ignore_cgroup2_mountpoint.patch
Other differences:
--
++ runc.spec ++
--- /var/tmp/diff_new_pack.PvApuC/_old 2017-04-17 10:26:24.037454897 +0200
+++ /var/tmp/diff_new_pack.PvApuC/_new 2017-04-17 10:26:24.041454331 +0200
@@ -58,6 +58,7 @@
Url:https://github.com/opencontainers/runc
Source: %{name}-git.%{git_version}.tar.xz
Patch0: CVE-2016-9962.patch
+Patch1: ignore_cgroup2_mountpoint.patch
BuildRequires: fdupes
%ifarch %go_arches
BuildRequires: go >= 1.5
@@ -104,6 +105,9 @@
%prep
%setup -q -n %{name}-git.%{git_version}
%patch0 -p1
+%if 0%{?suse_version} > 1320
+%patch1 -p1
+%endif
%build
# Do not use symlinks. If you want to run the unit tests for this package at
++ ignore_cgroup2_mountpoint.patch ++
>From e7b57cb042130edf86506d189734018edc3f2c18 Mon Sep 17 00:00:00 2001
From: Mrunal Patel
Date: Tue, 10 Jan 2017 15:13:28 -0800
Subject: [PATCH] Ignore cgroup2 mountpoints
Our current cgroup parsing logic assumes cgroup v1 mounts
so we should ignore cgroup2 mounts for now
Backport: https://github.com/opencontainers/runc/pull/1266
Signed-off-by: Mrunal Patel
Signed-off-by: Aleksa Sarai
---
libcontainer/cgroups/utils.go | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libcontainer/cgroups/utils.go b/libcontainer/cgroups/utils.go
index 8946dd5959e4..c6db0039e654 100644
--- a/libcontainer/cgroups/utils.go
+++ b/libcontainer/cgroups/utils.go
@@ -149,7 +149,7 @@ func getCgroupMountsHelper(ss map[string]bool, mi
io.Reader, all bool) ([]Mount,
if sepIdx == -1 {
return nil, fmt.Errorf("invalid mountinfo format")
}
- if txt[sepIdx+3:sepIdx+9] != "cgroup" {
+ if txt[sepIdx+3:sepIdx+10] == "cgroup2" ||
txt[sepIdx+3:sepIdx+9] != "cgroup" {
continue
}
fields := strings.Split(txt, " ")
--
2.12.2
commit runc for openSUSE:Factory
Hello community,
here is the log from the commit of package runc for openSUSE:Factory checked in
at 2017-03-12 20:05:55
Comparing /work/SRC/openSUSE:Factory/runc (Old)
and /work/SRC/openSUSE:Factory/.runc.new (New)
Package is "runc"
Sun Mar 12 20:05:55 2017 rev:10 rq:478794 version:0.1.1+gitr2942_2f7393a
Changes:
--- /work/SRC/openSUSE:Factory/runc/runc.changes2017-01-23
11:36:54.941912764 +0100
+++ /work/SRC/openSUSE:Factory/.runc.new/runc.changes 2017-03-12
20:05:55.749378120 +0100
@@ -1,0 +2,5 @@
+Fri Feb 24 18:08:10 UTC 2017 - jmassaguer...@suse.com
+
+- update to docker-1.13.0 requirement
+
+---
Old:
runc-git.50a19c6.tar.xz
New:
runc-git.2f7393a.tar.xz
Other differences:
--
++ runc.spec ++
--- /var/tmp/diff_new_pack.KAEVkH/_old 2017-03-12 20:05:56.453278515 +0100
+++ /var/tmp/diff_new_pack.KAEVkH/_new 2017-03-12 20:05:56.457277949 +0100
@@ -40,13 +40,13 @@
# FIX-OPENSUSE: This will be removed as soon as we move Docker's runC fork into
# a separate package. This whole versioning mess is caused by
# Docker vendoring non-releases of runC.
-%define git_version 50a19c6
+%define git_version 2f7393a
# How to get the git_revision
# git clone ${url}.git runc-upstream
# cd runc-upstream
# git checkout $git_version
# git_revision=r$(git rev-list HEAD | wc -l)
-%define git_revision r2819
+%define git_revision r2942
%define version_unconverted %{git_version}
Name: runc
++ CVE-2016-9962.patch ++
--- /var/tmp/diff_new_pack.KAEVkH/_old 2017-03-12 20:05:56.477275120 +0100
+++ /var/tmp/diff_new_pack.KAEVkH/_new 2017-03-12 20:05:56.477275120 +0100
@@ -31,10 +31,10 @@
5 files changed, 42 insertions(+), 37 deletions(-)
diff --git a/libcontainer/container_linux.go b/libcontainer/container_linux.go
-index 29c8b3437be3..4110af6fd89d 100644
+index 82c6d8e..369b5d5 100644
--- a/libcontainer/container_linux.go
+++ b/libcontainer/container_linux.go
-@@ -294,21 +294,29 @@ func (c *linuxContainer) newParentProcess(p *Process,
doInit bool) (parentProces
+@@ -297,21 +297,29 @@ func (c *linuxContainer) newParentProcess(p *Process,
doInit bool) (parentProces
if err != nil {
return nil, newSystemErrorWithCause(err, "creating new init
pipe")
}
@@ -71,7 +71,7 @@
cmd := exec.Command(c.initArgs[0], c.initArgs[1:]...)
cmd.Stdin = p.Stdin
cmd.Stdout = p.Stdout
-@@ -317,10 +325,9 @@ func (c *linuxContainer) commandTemplate(p *Process,
childPipe, rootDir *os.File
+@@ -320,10 +328,9 @@ func (c *linuxContainer) commandTemplate(p *Process,
childPipe, rootDir *os.File
if cmd.SysProcAttr == nil {
cmd.SysProcAttr = {}
}
@@ -84,7 +84,7 @@
// NOTE: when running a container with no PID namespace and the parent
process spawning the container is
// PID1 the pdeathsig is being delivered to the container's init
process by the kernel for some reason
// even with the parent still running.
-@@ -357,7 +364,7 @@ func (c *linuxContainer) newInitProcess(p *Process, cmd
*exec.Cmd, parentPipe, c
+@@ -360,7 +367,7 @@ func (c *linuxContainer) newInitProcess(p *Process, cmd
*exec.Cmd, parentPipe, c
}, nil
}
@@ -93,7 +93,7 @@
cmd.Env = append(cmd.Env, "_LIBCONTAINER_INITTYPE="+string(initSetns))
state, err := c.currentState()
if err != nil {
-@@ -378,7 +385,6 @@ func (c *linuxContainer) newSetnsProcess(p *Process, cmd
*exec.Cmd, parentPipe,
+@@ -381,7 +388,6 @@ func (c *linuxContainer) newSetnsProcess(p *Process, cmd
*exec.Cmd, parentPipe,
config:c.newInitConfig(p),
process: p,
bootstrapData: data,
++ _service ++
--- /var/tmp/diff_new_pack.KAEVkH/_old 2017-03-12 20:05:56.501271724 +0100
+++ /var/tmp/diff_new_pack.KAEVkH/_new 2017-03-12 20:05:56.501271724 +0100
@@ -8,7 +8,7 @@
git
runc
git.%h
-50a19c6ff828
+2f7393a47307a16f8cee44a37b262e8b81021e3e
.git
++ runc-git.50a19c6.tar.xz -> runc-git.2f7393a.tar.xz ++
4168 lines of diff (skipped)
commit runc for openSUSE:Factory
Hello community,
here is the log from the commit of package runc for openSUSE:Factory checked in
at 2017-01-23 11:36:50
Comparing /work/SRC/openSUSE:Factory/runc (Old)
and /work/SRC/openSUSE:Factory/.runc.new (New)
Package is "runc"
Changes:
--- /work/SRC/openSUSE:Factory/runc/runc.changes2017-01-10
10:44:32.474394530 +0100
+++ /work/SRC/openSUSE:Factory/.runc.new/runc.changes 2017-01-23
11:36:54.941912764 +0100
@@ -1,0 +2,7 @@
+Fri Jan 13 13:58:33 UTC 2017 - jmassaguer...@suse.com
+
+- fix CVE-2016-9962 bsc#1012568 and applying the patch
+ CVE-2016-9962.patch, because 1.12.6 partially fixes it (it contains
+ the first patch attached in bsc#1012568)
+
+---
Old:
runc-git.f59ba3cdd76f.tar.xz
New:
CVE-2016-9962.patch
runc-git.50a19c6.tar.xz
Other differences:
--
++ runc.spec ++
--- /var/tmp/diff_new_pack.1y6yTQ/_old 2017-01-23 11:36:55.50983 +0100
+++ /var/tmp/diff_new_pack.1y6yTQ/_new 2017-01-23 11:36:55.513831656 +0100
@@ -1,7 +1,7 @@
#
# spec file for package runc
#
-# Copyright (c) 2016 SUSE LINUX GmbH, Nuernberg, Germany.
+# Copyright (c) 2017 SUSE LINUX GmbH, Nuernberg, Germany.
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
@@ -40,13 +40,13 @@
# FIX-OPENSUSE: This will be removed as soon as we move Docker's runC fork into
# a separate package. This whole versioning mess is caused by
# Docker vendoring non-releases of runC.
-%define git_version f59ba3cdd76f
+%define git_version 50a19c6
# How to get the git_revision
# git clone ${url}.git runc-upstream
# cd runc-upstream
# git checkout $git_version
# git_revision=r$(git rev-list HEAD | wc -l)
-%define git_revision r2818
+%define git_revision r2819
%define version_unconverted %{git_version}
Name: runc
@@ -57,6 +57,7 @@
Group: System/Management
Url:https://github.com/opencontainers/runc
Source: %{name}-git.%{git_version}.tar.xz
+Patch0: CVE-2016-9962.patch
BuildRequires: fdupes
%ifarch %go_arches
BuildRequires: go >= 1.5
@@ -102,6 +103,7 @@
%prep
%setup -q -n %{name}-git.%{git_version}
+%patch0 -p1
%build
# Do not use symlinks. If you want to run the unit tests for this package at
++ CVE-2016-9962.patch ++
>From 9729fc3127c5e27d59a0126f52e91c61037173ae Mon Sep 17 00:00:00 2001
From: Aleksa Sarai
Date: Tue, 29 Nov 2016 01:25:06 +1100
Subject: [PATCH] libcontainer: init: only pass stateDirFd when creating a
container
If we pass a file descriptor to the host filesystem while joining a
container, there is a race condition where a process inside the
container can ptrace(2) the joining process and stop it from closing its
file descriptor to the stateDirFd. Then the process can access the *host*
filesystem from that file descriptor.
To fix this, don't open or pass the stateDirFd to the init process
unless we're creating a new container. A proper fix for this would be to
remove the need for even passing around directory file descriptors
(which are quite dangerous in the context of mount namespaces).
SUSE: This is an additional patch which was the original "fix" for the
CVE. It was agreed that the patch was too complicated to be used
as a fix for a security issue -- but it will be upstreamed once
the embargo passes.
Fixes: CVE-2016-9962
Signed-off-by: Aleksa Sarai
---
libcontainer/container_linux.go | 30 ++
libcontainer/factory_linux.go| 37 ++---
libcontainer/init_linux.go | 3 +--
libcontainer/process_linux.go| 2 --
libcontainer/setns_init_linux.go | 7 +--
5 files changed, 42 insertions(+), 37 deletions(-)
diff --git a/libcontainer/container_linux.go b/libcontainer/container_linux.go
index 29c8b3437be3..4110af6fd89d 100644
--- a/libcontainer/container_linux.go
+++ b/libcontainer/container_linux.go
@@ -294,21 +294,29 @@ func (c *linuxContainer) newParentProcess(p *Process,
doInit bool) (parentProces
if err != nil {
return nil, newSystemErrorWithCause(err, "creating new init
pipe")
}
- rootDir, err := os.Open(c.root)
- if err != nil {
- return nil, err
- }
- cmd, err := c.commandTemplate(p, childPipe, rootDir)
+ cmd, err := c.commandTemplate(p, childPipe)
if err != nil {
return nil, newSystemErrorWithCause(err, "creating new command
template")
}
if !doInit {
- return c.newSetnsProcess(p, cmd, parentPipe, childPipe,
commit runc for openSUSE:Factory
Hello community,
here is the log from the commit of package runc for openSUSE:Factory checked in
at 2016-11-24 21:26:04
Comparing /work/SRC/openSUSE:Factory/runc (Old)
and /work/SRC/openSUSE:Factory/.runc.new (New)
Package is "runc"
Changes:
--- /work/SRC/openSUSE:Factory/runc/runc.changes2016-10-26
13:29:18.0 +0200
+++ /work/SRC/openSUSE:Factory/.runc.new/runc.changes 2016-11-24
21:26:05.0 +0100
@@ -1,0 +2,8 @@
+Thu Nov 24 11:05:41 UTC 2016 - jmassaguer...@suse.com
+
+- fix version by adding a revision "counter" so that it will always
+ increase
+
+ fix bsc#1009961
+
+---
Other differences:
--
++ runc.spec ++
--- /var/tmp/diff_new_pack.DkMowG/_old 2016-11-24 21:26:06.0 +0100
+++ /var/tmp/diff_new_pack.DkMowG/_new 2016-11-24 21:26:06.0 +0100
@@ -36,11 +36,18 @@
%define go_tool go-6
%endif
+# MANUAL: Update the git_version and git_revision
%define git_version 02f8fa7
+# How to get the git_revision
+# git clone ${url}.git runc-upstream
+# cd runc-upstream
+# git checkout $git_version
+# git_revision=r$(git rev-list HEAD | wc -l)
+%define git_revision r2816
%define version_unconverted %{git_version}
Name: runc
-Version:0.1.1+git%{git_version}
+Version:0.1.1+git%{git_revision}_%{git_version}
Release:0
Summary:Tool for spawning and running OCI containers
License:Apache-2.0
commit runc for openSUSE:Factory
Hello community,
here is the log from the commit of package runc for openSUSE:Factory checked in
at 2016-10-26 13:29:17
Comparing /work/SRC/openSUSE:Factory/runc (Old)
and /work/SRC/openSUSE:Factory/.runc.new (New)
Package is "runc"
Changes:
--- /work/SRC/openSUSE:Factory/runc/runc.changes2016-09-30
15:31:56.0 +0200
+++ /work/SRC/openSUSE:Factory/.runc.new/runc.changes 2016-10-26
13:29:18.0 +0200
@@ -1,0 +2,5 @@
+Thu Oct 13 11:04:27 UTC 2016 - jmassaguer...@suse.com
+
+- update to 02f8fa7 because that is the needed version for docker 1.12.1
(bsc#1004490)
+
+---
Old:
runc-git.cc29e3d.tar.xz
New:
runc-git.02f8fa7.tar.xz
Other differences:
--
++ runc.spec ++
--- /var/tmp/diff_new_pack.ADx5CY/_old 2016-10-26 13:29:20.0 +0200
+++ /var/tmp/diff_new_pack.ADx5CY/_new 2016-10-26 13:29:20.0 +0200
@@ -36,7 +36,7 @@
%define go_tool go-6
%endif
-%define git_version cc29e3d
+%define git_version 02f8fa7
%define version_unconverted %{git_version}
Name: runc
++ _service ++
--- /var/tmp/diff_new_pack.ADx5CY/_old 2016-10-26 13:29:20.0 +0200
+++ /var/tmp/diff_new_pack.ADx5CY/_new 2016-10-26 13:29:20.0 +0200
@@ -4,7 +4,7 @@
git
runc
git.%h
-cc29e3dded8e27ba8f65738f40d251c885030a28
+02f8fa7863dd3f82909a73e2061897828460d52f
.git
++ runc-git.cc29e3d.tar.xz -> runc-git.02f8fa7.tar.xz ++
8665 lines of diff (skipped)
commit runc for openSUSE:Factory
Hello community,
here is the log from the commit of package runc for openSUSE:Factory checked in
at 2016-09-30 15:31:55
Comparing /work/SRC/openSUSE:Factory/runc (Old)
and /work/SRC/openSUSE:Factory/.runc.new (New)
Package is "runc"
Changes:
--- /work/SRC/openSUSE:Factory/runc/runc.changes2016-09-21
18:49:19.0 +0200
+++ /work/SRC/openSUSE:Factory/.runc.new/runc.changes 2016-09-30
15:31:56.0 +0200
@@ -1,0 +2,5 @@
+Wed Sep 21 05:13:26 UTC 2016 - jeng...@inai.de
+
+- Run fdupes.
+
+---
Other differences:
--
++ runc.spec ++
--- /var/tmp/diff_new_pack.4YDaeV/_old 2016-09-30 15:31:58.0 +0200
+++ /var/tmp/diff_new_pack.4YDaeV/_new 2016-09-30 15:31:58.0 +0200
@@ -47,6 +47,7 @@
Group: System/Management
Url:https://github.com/opencontainers/runc
Source: %{name}-git.%{git_version}.tar.xz
+BuildRequires: fdupes
%ifarch %go_arches
BuildRequires: go >= 1.5
BuildRequires: go-go-md2man
@@ -144,6 +145,8 @@
%{__install} -m644 man/man8/runc*.8 %{buildroot}%{_mandir}/man8
%endif
+%fdupes %{buildroot}/%{_prefix}
+
%files
%defattr(-,root,root)
%doc README.md LICENSE
commit runc for openSUSE:Factory
Hello community,
here is the log from the commit of package runc for openSUSE:Factory checked in
at 2016-09-21 18:49:18
Comparing /work/SRC/openSUSE:Factory/runc (Old)
and /work/SRC/openSUSE:Factory/.runc.new (New)
Package is "runc"
Changes:
--- /work/SRC/openSUSE:Factory/runc/runc.changes2016-08-18
09:18:09.0 +0200
+++ /work/SRC/openSUSE:Factory/.runc.new/runc.changes 2016-09-21
18:49:19.0 +0200
@@ -1,0 +2,49 @@
+Mon Sep 19 11:57:45 UTC 2016 - jmassaguer...@suse.com
+
+- fix go_arches definition: use global instead of define, otherwise
+ it fails to build
+
+---
+Fri Aug 26 08:59:54 UTC 2016 - asa...@suse.com
+
+- Remove docker-runc symlink because it's been fixed within the Docker
+ package. bsc#978260
+
+---
+Thu Aug 25 17:02:33 UTC 2016 - jmassaguer...@suse.com
+
+- Create a symlink /usr/sbin/docker-runc -> /usr/sbin/docker
+ Docker expects this symlink to exist bsc#978260
+
+---
+Thu Aug 25 15:56:00 UTC 2016 - jmassaguer...@suse.com
+
+- Remove GOPATH at the end of the GOPATH assignment
+ cause GOPATH is empty and if we do that, we get the path ""
+ appended, which causes gcc6-go to complain
+
+---
+Wed Aug 24 12:27:57 UTC 2016 - jmassaguer...@suse.com
+
+- add go_arches in project configuration: this way, we can use the
+ same spec file but decide in the project configuration if to
+ use gc-go or gcc-go for some archs.
+
+---
+Thu Aug 18 10:35:29 UTC 2016 - jmassaguer...@suse.com
+
+- use gcc6-go instead of gcc5-go (bsc#988408)
+- build ppc64le with gc-go because this version builds with gc-go 1.6
+
+---
+Thu Aug 18 10:34:29 UTC 2016 - cbrau...@suse.de
+
+- bump git commit id to the one required by docker v1.12.0 (bsc#995058)
+- run unit tests during package build
+- remove seccomp-use-pkg-config.patch
+ The patch is now upstream.
+- remove GO_BUILD_FLAGS macro and substitute with BUILDFLAGS env variable to
+ allow for easier string appending.
+- only run unit test on architectures that provide the go list and go test
tools
+
+---
Old:
runc-0.1.1.tar.xz
seccomp-use-pkg-config.patch
New:
runc-git.cc29e3d.tar.xz
Other differences:
--
++ runc.spec ++
--- /var/tmp/diff_new_pack.qSUnuG/_old 2016-09-21 18:49:21.0 +0200
+++ /var/tmp/diff_new_pack.qSUnuG/_new 2016-09-21 18:49:21.0 +0200
@@ -16,31 +16,42 @@
#
-%define go_arches %ix86 x86_64 aarch64
+# Check if go_arches is defined in the project configuration
+# Otherwise, define it here
+# In order to define it in the project configuration, see
+#
+# https://en.opensuse.org/openSUSE:Build%20Service%20prjconf#Macros
+#
+# The Macros tag is the one that defines the go_arches variable to be used
+# in the spec file.
+# The "define" one is to help the specfile parser of the buildservice
+# to see what packages are being built. You also want to define it here
+# for keeping things consistent.
+
+%{!?go_arches: %global go_arches %ix86 x86_64 aarch64 ppc64le}
+
%ifarch %go_arches
%define go_tool go
-%define GO_BUILD_FLAGS %{nil}
%else
-%define go_tool go-5
-%define GO_BUILD_FLAGS "-gccgoflags=-Wl,--add-needed -Wl,--no-as-needed
-static-libgo -ldl -lseccomp -lselinux -lapparmor"
+%define go_tool go-6
%endif
-%define version_unconverted 0.1.1
+%define git_version cc29e3d
+%define version_unconverted %{git_version}
Name: runc
-Version:0.1.1
+Version:0.1.1+git%{git_version}
Release:0
Summary:Tool for spawning and running OCI containers
License:Apache-2.0
Group: System/Management
Url:https://github.com/opencontainers/runc
-Source: %{name}-%{version}.tar.xz
-Patch0: seccomp-use-pkg-config.patch
+Source: %{name}-git.%{git_version}.tar.xz
%ifarch %go_arches
BuildRequires: go >= 1.5
BuildRequires: go-go-md2man
%else
-BuildRequires: gcc5-go >= 5.0
+BuildRequires: gcc6-go >= 6.1
%endif
BuildRequires: libapparmor-devel
# Seccomp isn't supported on aarch64.
@@ -64,7 +75,7 @@
Requires: go >= 1.5
Requires: go-go-md2man
%else
-Requires: gcc5-go >= 5.0
+Requires: gcc6-go >= 6.1
%endif
Requires: libapparmor-devel
# Seccomp isn't supported on aarch64.
@@ -79,35 +90,50 @@
Test package for runc. It contains the source code and the tests.
%prep
commit runc for openSUSE:Factory
Hello community,
here is the log from the commit of package runc for openSUSE:Factory checked in
at 2016-08-18 09:18:07
Comparing /work/SRC/openSUSE:Factory/runc (Old)
and /work/SRC/openSUSE:Factory/.runc.new (New)
Package is "runc"
Changes:
--- /work/SRC/openSUSE:Factory/runc/runc.changes2016-07-30
00:27:43.0 +0200
+++ /work/SRC/openSUSE:Factory/.runc.new/runc.changes 2016-08-18
09:18:09.0 +0200
@@ -1,0 +2,9 @@
+Wed Aug 17 10:29:15 UTC 2016 - cbrau...@suse.de
+
+- Add runc-test package which contains the source code and the test. This
+ package will be used to run the integration tests.
+- Simplify package build and check sections: Instead of symlinking we default
to
+ cp -avr. go list gets confused by symlinks hence, we need to copy the source
+ code anyway if we want to run unit tests during package build at some point.
+
+---
Other differences:
--
++ runc.spec ++
--- /var/tmp/diff_new_pack.ol4TnP/_old 2016-08-18 09:18:10.0 +0200
+++ /var/tmp/diff_new_pack.ol4TnP/_new 2016-08-18 09:18:10.0 +0200
@@ -57,16 +57,40 @@
of Docker. It was originally designed to be a replacement for LXC within
Docker,
and has grown to become a separate project entirely.
+%package test
+Summary:Test package for runc
+Group: System/Management
+%ifarch %go_arches
+Requires: go >= 1.5
+Requires: go-go-md2man
+%else
+Requires: gcc5-go >= 5.0
+%endif
+Requires: libapparmor-devel
+# Seccomp isn't supported on aarch64.
+%ifnarch aarch64
+Requires: libseccomp-devel
+%endif
+Requires: libselinux-devel
+Recommends: criu
+BuildArch: noarch
+
+%description test
+Test package for runc. It contains the source code and the tests.
+
%prep
%setup -q -n %{name}-%{version}
# Apply the vendor'd patch to the right subdirectory.
%patch0 -p1 -d Godeps/_workspace/src/github.com/seccomp/libseccomp-golang
%build
-# Create buildir,
-export GOPATH=$PWD/Godeps/_workspace
-mkdir -pv $GOPATH/src/github.com/opencontainers/
-ln -svfn $PWD $GOPATH/src/github.com/opencontainers/runc
+# Do not use symlinks. If you want to run the unit tests for this package at
+# some point during the build and you need to directly use go list directly it
+# will get confused by symlinks.
+export
GOPATH=${HOME}/go:${HOME}/go/src/github.com/opencontainers/runc/Godeps/_workspace:${GOPATH}
+mkdir -pv $HOME/go/src/github.com/opencontainers/runc
+rm -rf $HOME/go/src/github.com/opencontainers/runc/*
+cp -avr * $HOME/go/src/github.com/opencontainers/runc
# Build all features.
export BUILDTAGS="apparmor selinux"
@@ -86,6 +110,8 @@
%install
%{__install} -D -m755 %{name}-%{version} %{buildroot}%{_sbindir}/%{name}
+install -d -m755 %{buildroot}/usr/src/runc/
+cp -avr $HOME/go/src/github.com/opencontainers/runc/*
%{buildroot}/usr/src/runc/
%ifarch %go_arches
%{__install} -d -m755 %{buildroot}%{_mandir}/man8
@@ -101,4 +127,10 @@
%{_mandir}/man8/runc*.8.gz
%endif
+%files test
+%defattr(-,root,root)
+/usr/src/runc/
+%exclude /usr/src/runc/runc
+%exclude /usr/src/runc/runc/Godeps/_workspace/pkg
+
%changelog
commit runc for openSUSE:Factory
Hello community,
here is the log from the commit of package runc for openSUSE:Factory checked in
at 2016-07-30 00:27:41
Comparing /work/SRC/openSUSE:Factory/runc (Old)
and /work/SRC/openSUSE:Factory/.runc.new (New)
Package is "runc"
Changes:
--- /work/SRC/openSUSE:Factory/runc/runc.changes2016-05-04
08:19:56.0 +0200
+++ /work/SRC/openSUSE:Factory/.runc.new/runc.changes 2016-07-30
00:27:43.0 +0200
@@ -4 +4 @@
-* Update to runC 0.1.1. Changelog from upstream:
+* Update to runC 0.1.1. (bsc#989566 FATE#320763) Changelog from upstream:
Other differences:
--
++ runc.spec ++
--- /var/tmp/diff_new_pack.CHeeRp/_old 2016-07-30 00:27:44.0 +0200
+++ /var/tmp/diff_new_pack.CHeeRp/_new 2016-07-30 00:27:44.0 +0200
@@ -15,6 +15,7 @@
# Please submit bugfixes or comments via http://bugs.opensuse.org/
#
+
%define go_arches %ix86 x86_64 aarch64
%ifarch %go_arches
%define go_tool go
@@ -99,3 +100,5 @@
%ifarch %go_arches
%{_mandir}/man8/runc*.8.gz
%endif
+
+%changelog
commit runc for openSUSE:Factory
Hello community,
here is the log from the commit of package runc for openSUSE:Factory checked in
at 2016-05-04 08:19:55
Comparing /work/SRC/openSUSE:Factory/runc (Old)
and /work/SRC/openSUSE:Factory/.runc.new (New)
Package is "runc"
Changes:
New Changes file:
--- /dev/null 2016-04-07 01:36:33.300037506 +0200
+++ /work/SRC/openSUSE:Factory/.runc.new/runc.changes 2016-05-04
08:19:56.0 +0200
@@ -0,0 +1,73 @@
+---
+Fri Apr 29 09:03:24 UTC 2016 - asa...@suse.de
+
+* Update to runC 0.1.1. Changelog from upstream:
+
+ This release includes a bug fix for adding the selinux mount label in the
specification.
+
+---
+Tue Apr 19 09:59:05 UTC 2016 - asa...@suse.de
+
+* Don't use gcc-go for aarch64, since gc has grown support for it and is more
+ stable.
+
+---
+Fri Apr 15 10:46:04 UTC 2016 - asa...@suse.de
+
+* Disable seccomp entirely for aarch64 builds, since it is not provided on all
+ SUSE platforms.
+
+---
+Wed Apr 13 12:03:09 UTC 2016 - asa...@suse.de
+
+* Update to runC 0.1.0. Changelog from upstream:
+
+ This release updates runc to the OCI runtime specification v0.5.0 and
includes
+ various fixes and features.
+
+ Features:
+ + cgroups: pid limits and stats
+ + cgroups: kmem stats
+ + systemd cgroup support
+ + libcontainer specconv package
+ + no pivot root option
+ + numeric ids are treated as uid/gid
+ + hook improvements
+
+ Bug Fixes:
+ * log flushing
+ * atomic pid file creation
+ * init error recovery
+ * seccomp logging removed
+ * delete container on aborted start
+ * /dev bind mount handling
+
+---
+Wed Mar 30 14:18:18 UTC 2016 - asa...@suse.de
+
+* Install to /usr/sbin. https://github.com/opencontainers/runc/pull/702
+
+---
+Sun Mar 27 14:50:32 UTC 2016 - asa...@suse.de
+
+* Added runC man pages.
+* Recommended criu, since it's required for the checkpoint and restore
+ functionality.
+
+---
+Sun Mar 27 10:14:32 UTC 2016 - asa...@suse.de
+
+* Small updates to method of compilation to better match Makefile.
+
+---
+Mon Mar 21 12:04:59 UTC 2016 - asa...@suse.de
+
+* Make compilation work on gcc-go only systems (ppc and s390).
+
+---
+Mon Mar 21 08:24:02 UTC 2016 - asa...@suse.de
+
+* initial import of runC 0.0.9
+* add patch seccomp-use-pkg-config.patch which allows us to build runC, since
+ they assume that the seccomp.h file lives at /usr/include/seccomp.h.
+
New:
_service
runc-0.1.1.tar.xz
runc.changes
runc.spec
seccomp-use-pkg-config.patch
Other differences:
--
++ runc.spec ++
#
# spec file for package runc
#
# Copyright (c) 2016 SUSE LINUX GmbH, Nuernberg, Germany.
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
# upon. The license for this file, and modifications and additions to the
# file, is the same license as for the pristine package itself (unless the
# license for the pristine package is not an Open Source License, in which
# case the license is the MIT License). An "Open Source License" is a
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.
# Please submit bugfixes or comments via http://bugs.opensuse.org/
#
%define go_arches %ix86 x86_64 aarch64
%ifarch %go_arches
%define go_tool go
%define GO_BUILD_FLAGS %{nil}
%else
%define go_tool go-5
%define GO_BUILD_FLAGS "-gccgoflags=-Wl,--add-needed -Wl,--no-as-needed
-static-libgo -ldl -lseccomp -lselinux -lapparmor"
%endif
%define version_unconverted 0.1.1
Name: runc
Version:0.1.1
Release:0
Summary:Tool for spawning and running OCI containers
License:Apache-2.0
Group: System/Management
Url:https://github.com/opencontainers/runc
Source: %{name}-%{version}.tar.xz
Patch0: seccomp-use-pkg-config.patch
%ifarch %go_arches
BuildRequires: go >= 1.5
BuildRequires: go-go-md2man
%else
BuildRequires: gcc5-go >= 5.0
%endif
BuildRequires: libapparmor-devel
# Seccomp isn't supported on aarch64.
%ifnarch aarch64
BuildRequires: libseccomp-devel
%endif
BuildRequires: libselinux-devel
Recommends: criu
BuildRoot:
