Commit Graph

1945 Commits

Author SHA1 Message Date
Bruce Ashfield
2bc6173b83 runc: update to 1.1.3
Bumping runc to version v1.1.3-2-g1e7bb5b7, which comprises the following commits:

    eb1552a0 VERSION: back to development
    6724737f VERSION: release 1.1.3
    91fa032d ci: add basic checks for CHANGELOG.md
    7219387e cgroups: systemd: skip adding device paths that don't exist
    93d1807b libcontainer: relax getenv_int sanity check
    8242c05d script/seccomp.sh: check tarball sha256
    017cb29b Dockerfile,scripts/release: bump libseccomp to v2.5.4
    51649a7d Allow mounting of /proc/sys/kernel/ns_last_pid
    3a09da6b ci: drop docker layer caching from release job
    8b93f9fb seccomp: enosys: always return -ENOSYS for setup(2) on s390(x)
    fc2a8fe1 libct/cg/sd: check dbus.ErrClosed instead of isDbusError
    d105e052 libct/seccomp/config: add missing KillThread, KillProcess
    e4474ef8 [1.1] vendor: bump seccomp/libseccomp-golang to f33da4d
    dc083b2b fix deprecated ActKill
    bf1cd884 ci: use golangci-lint-action v3, GO_VERSION
    1feafc31 ci: bump golangci-lint to v1.44
    89f79ff0 libct: StartInitialization: fix %w related warning
    3b7f2605 Format sources using gofumpt 0.2.1
    eeac4e77 build(deps): bump actions/checkout from 2 to 3
    cd7fa00d Vagrantfile.fedora: fix build wrt new git

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-12-22 10:28:08 -05:00
Adrian Freihofer
82ea96b5a1 runc-opencontainers: drop obsolete patch
commit e4474ef881401b2f3ed3ba806a288bb986dcac49 of runc does a vendor
update which includes the reverted fix again. The commit is after 1.2.0
and before 1.3.0 --> the next cherry-pick updates runc to 1.3.0 and the
fix will be back.

Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-12-22 10:28:08 -05:00
Bruce Ashfield
101c60f003 docker-ce: update to 20.10.16
Bumping moby to version v20.10.16, which comprises the following commits:

    a15acb4bd6 [20.10] vendor: golang.org/x/sys v0.0.0-20220412211240-33da011f77ad
    5f2e0b79ad [20.10] update golang to 1.17.10
    be7855fdbe vendor: update github.com/containerd/cgroups and github.com/cilium/ebpf
    414a9e24a7 update containerd binary to v1.6.4
    47b6a924b6 update containerd binary to v1.6.3
    6d7c2b2d26 update containerd binary to v1.6.2
    91708bf704 update containerd binary to v1.6.1
    53ae17008e Revert "[20.10] update containerd binary to 1.5.11"
    961b9a78d5 update runc binary to v1.1.1
    97972dac5f update runc binary to v1.1.0
    033a819714 [20.10] update golang to 1.17.9
    a80884126b Jenkinsfile: add workaround for CVE-2022-24765
    09d6fcdfec update to go 1.17.8 to address CVE-2022-24921
    5957684b2c Update Go to 1.17.7
    55b72c70ba Update Go to 1.17.6
    fdf3020bd5 Update Go to 1.17.5
    36e164ba80 Update Go to 1.17.4
    ecfba8f588 Update Go to 1.17.3
    4e14dcc125 Update Go to 1.17.2
    c32b5ece31 Update Go to 1.17.1
    7096508811 vendor: update archive/tar to match Go 1.17.0
    a1150245cc Update to Go 1.17.0, and gofmt with Go 1.17
    95cc7115fb hack/vendor.sh: allow go version to be specified with .0
    949c33b1c5 vendor: golang.org/x/sys  63515b42dcdf9544f4e6a02fd7632793fde2f72d (for Go 1.17)
    8392285876 vendor: golang.org/x/sys d19ff857e887eacb631721f188c7d365c2331456
    4e81bcf380 Makefile: update buildx to v0.8.2
    74e699c8d3 Makefile: update buildx version to v0.6.0
    bc3cc2e7ac Makefile: install buildx from binary release, instead of building
    492fac20af api: docs: fix indentation of HostConfig.SecurityOpt (v1.39-v1.41)
    3cba2682d8 api: docs: move ContainerWaitResponse to definitions (v1.39-v1.41)
    55e71450ae api: docs: move VolumeCreateOptions to definitions (v1.39-v1.41)
    c54362cd64 api: docs: move Volume examples inline (v1.39-v1.41)
    c60ff9b296 doc: server API Correct ImagesCreate - platform parameter added in 1.32
    7a45f7a8cc docs: cleanup swagger API with multiple examples (v1.25-v1.41)
    29bb9204bf api: docs: add IPAMConfig on IPAM (v1.41)
    77f6564369 api: docs: document MountPoint fields (v1.25-v1.41)
    51ea235ab8 api: docs: remove deprecated RootFS.BaseLayer (API v1.25-v1.41)
    3d6b4ae572 Correct type of Mounts in ContainerSummary in docs (v1.25-v1.40)
    6e8b9809b7 Correct type of Mounts in ContainerSummary in docs
    621a98dac0 api: docs: fix warning about comment indentation (API v1.40-v1.41)
    bb9ef98060 api: docs: update docs for /images/{name}/json (API v1.39-v1.41)
    88ca5cec4e daemon: fix error-message for minimum allowed kernel-memory limit
    3ea996abd7 docs: add missing KernelMemoryTCP to api v1.40 and v1.41
    b475bc95cd docs/api: add missing 400 response for POST /containers/{id}/wait
    ae07b3cc96 docs/api: update /containers/{id}/wait "condition" parameter (v1.30-v1.41)
    19555fa92d [20.10] vendor: github.com/docker/distribution v2.8.1
    32fe0bbb91 daemon: use RWMutex for stateCounter
    ed8fb00b65 errdefs: move GetHTTPErrorStatusCode to api/server/httpstatus
    3bd611d7a5 log error message when receiving an unexpected type error
    7dfe7a1752 [20.10] update containerd binary to 1.5.11
    af953d2f38 [20.10] vendor: containerd 7cfa023d95d37076d5ab035003d4839f4b6ba791
    5f9753ae73 client: remove containerd "platform" dependency
    4df345e65d client: remove unused Platform field from configWrapper
    dd38613d0c oci: inheritable capability set should be empty
    2825bf7123 Only check if route overlaps routes with scope: LINK
    f5c56eaca8 [20.10] bump swarmkit for config size increase
    ce3b6d1ae9 distribution: retry downloading schema config on retryable error

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-12-22 10:28:08 -05:00
Bruce Ashfield
038dd4e5a2 docker/moby/libnetwork: update to -latest
Bumping libnetwork to version v0.7.0-dev.3-1830-g339b972b, which comprises the following commits:

    9db86fb7 Only check if route overlaps routes with scope: LINK
    7b9c2905 fix port forwarding with ipv6.disable=1

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-12-22 10:28:08 -05:00
Bruce Ashfield
51317b8578 docker/moby: update to 20.10.16
Bumping moby to version v20.10.16, which comprises the following commits:

    a15acb4bd6 [20.10] vendor: golang.org/x/sys v0.0.0-20220412211240-33da011f77ad
    5f2e0b79ad [20.10] update golang to 1.17.10
    be7855fdbe vendor: update github.com/containerd/cgroups and github.com/cilium/ebpf
    414a9e24a7 update containerd binary to v1.6.4
    47b6a924b6 update containerd binary to v1.6.3
    6d7c2b2d26 update containerd binary to v1.6.2
    91708bf704 update containerd binary to v1.6.1
    53ae17008e Revert "[20.10] update containerd binary to 1.5.11"
    961b9a78d5 update runc binary to v1.1.1
    97972dac5f update runc binary to v1.1.0
    033a819714 [20.10] update golang to 1.17.9
    a80884126b Jenkinsfile: add workaround for CVE-2022-24765
    09d6fcdfec update to go 1.17.8 to address CVE-2022-24921
    5957684b2c Update Go to 1.17.7
    55b72c70ba Update Go to 1.17.6
    fdf3020bd5 Update Go to 1.17.5
    36e164ba80 Update Go to 1.17.4
    ecfba8f588 Update Go to 1.17.3
    4e14dcc125 Update Go to 1.17.2
    c32b5ece31 Update Go to 1.17.1
    7096508811 vendor: update archive/tar to match Go 1.17.0
    a1150245cc Update to Go 1.17.0, and gofmt with Go 1.17
    95cc7115fb hack/vendor.sh: allow go version to be specified with .0
    949c33b1c5 vendor: golang.org/x/sys  63515b42dcdf9544f4e6a02fd7632793fde2f72d (for Go 1.17)
    8392285876 vendor: golang.org/x/sys d19ff857e887eacb631721f188c7d365c2331456
    4e81bcf380 Makefile: update buildx to v0.8.2
    74e699c8d3 Makefile: update buildx version to v0.6.0
    bc3cc2e7ac Makefile: install buildx from binary release, instead of building
    492fac20af api: docs: fix indentation of HostConfig.SecurityOpt (v1.39-v1.41)
    3cba2682d8 api: docs: move ContainerWaitResponse to definitions (v1.39-v1.41)
    55e71450ae api: docs: move VolumeCreateOptions to definitions (v1.39-v1.41)
    c54362cd64 api: docs: move Volume examples inline (v1.39-v1.41)
    c60ff9b296 doc: server API Correct ImagesCreate - platform parameter added in 1.32
    7a45f7a8cc docs: cleanup swagger API with multiple examples (v1.25-v1.41)
    29bb9204bf api: docs: add IPAMConfig on IPAM (v1.41)
    77f6564369 api: docs: document MountPoint fields (v1.25-v1.41)
    51ea235ab8 api: docs: remove deprecated RootFS.BaseLayer (API v1.25-v1.41)
    3d6b4ae572 Correct type of Mounts in ContainerSummary in docs (v1.25-v1.40)
    6e8b9809b7 Correct type of Mounts in ContainerSummary in docs
    621a98dac0 api: docs: fix warning about comment indentation (API v1.40-v1.41)
    bb9ef98060 api: docs: update docs for /images/{name}/json (API v1.39-v1.41)
    88ca5cec4e daemon: fix error-message for minimum allowed kernel-memory limit
    3ea996abd7 docs: add missing KernelMemoryTCP to api v1.40 and v1.41
    b475bc95cd docs/api: add missing 400 response for POST /containers/{id}/wait
    ae07b3cc96 docs/api: update /containers/{id}/wait "condition" parameter (v1.30-v1.41)
    19555fa92d [20.10] vendor: github.com/docker/distribution v2.8.1
    32fe0bbb91 daemon: use RWMutex for stateCounter
    ed8fb00b65 errdefs: move GetHTTPErrorStatusCode to api/server/httpstatus
    3bd611d7a5 log error message when receiving an unexpected type error
    7dfe7a1752 [20.10] update containerd binary to 1.5.11
    af953d2f38 [20.10] vendor: containerd 7cfa023d95d37076d5ab035003d4839f4b6ba791
    5f9753ae73 client: remove containerd "platform" dependency
    4df345e65d client: remove unused Platform field from configWrapper
    dd38613d0c oci: inheritable capability set should be empty
    2825bf7123 Only check if route overlaps routes with scope: LINK
    f5c56eaca8 [20.10] bump swarmkit for config size increase
    ce3b6d1ae9 distribution: retry downloading schema config on retryable error

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-12-22 10:28:08 -05:00
Joakim Roubert
a0d0f4ff48 upx: Use git fetcher instead of gitsm
The current upx will trigger the Bitbake Fetcher Error added in
Kirkstone 4.0.5 189a6d452e3037c9e94ccdf6af38359fc6058064 commit. This
patch replaces gitsm with git and explicitly adds the git submodules
with the corresponding commits.

Change-Id: I1b1231f06481f7a1e25dc35277d0f1725c7631e0
Signed-off-by: Joakim Roubert <joakimr@axis.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-12-08 15:33:51 -05:00
Bruce Ashfield
8c6de8297f upx: update to latest devel release
The upx development branch history has been rebaseed, so we update
our SRCREV to match.

As part of this update, we can drop our patch as it has now been
merged into the project.

The cmake structure has changed slightly, so we inherit cmake-native
to make it available as part of the Makefile driven build.

And finally, the name and location of the binary has changed, so
we adapt our install rule to match.

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-12-08 15:33:46 -05:00
Bruce Ashfield
e68bfe7dae yq: fix build
The yq build was broken:

  - some repositories have moved from master -> main
  - missing dependencies, that were being fetched in the compile task

Correcting these issues fixes yq' build

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-11-29 23:06:20 -05:00
Mark Hatle
9a487c1851 xen: Make xilinx extension generic
Move the xilinx specific bbappend to a wildcard append.

Signed-off-by: Mark Hatle <mark.hatle@kernel.crashing.org>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-10-26 10:10:08 -04:00
Guenther Meyer
9482648daf kubernetes: fixed typos
After upgrading from honister to kirkstone the build always failed
during the package_write_ipk step, because the package name has
been overwritten because of the typo in FILES.
While investigating, I discovered another typo in class-devupstream.

Signed-off-by: Guenther Meyer <g.meyer@signum-media.de>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-09-26 08:48:10 -04:00
sakib.sajal@windriver.com
8c5f038cb9 buildah: add recipe for buildah v1.26
buildah is a command line tool, to be installed and run on target,
that can be used to:
   - create a working container, either from scratch or using an image
     as a starting point
   - create an image, either from a working container or via the
     instructions in a Dockerfile
   - images can be built in either the OCI image format or the
     traditional upstream docker image format
   - mount a working container's root filesystem for manipulation
   - unmount a working container's root filesystem
   - use the updated contents of a container's root filesystem as a
     filesystem layer to create a new image
   - delete a working container or an image
   - rename a local container

Testing:
Setup the build directory:
   $ . oe-init-build-env <build_dir>

Add to local.conf:
   IMAGE_INSTALL:append = " buildah kernel-modules"
   KERNEL_FEATURES += "features/overlayfs/overlayfs.cfgi \
                       features/netfilter/netfilter.scc  \
                       features/lxc/lxc-enable.scc"
   IMAGE_ROOTFS_EXTRA_SPACE = "5242880"

Build image:
   $ bitbake core-image-minimal

Run the image:
   $ runqemu nographic kvm qemuparams="-m 4096"

On target:
Pull an image:
   > cnt=$(buildah from fedora)

Or build from Dockerfile
   > buildah bud -t <image_name>:<tag> .

Mount the image:
   > mnt=$(buildah mount ${cnt})

Install packages on the container rootfs:
   > dnf install --installroot $mnt <packages_to_install> -y

Copy local files to the container:
   > buildah copy $cnt <local_file> <dest_on_container>

Save the changes to an image
   > buildah commit --format docker $cnt <name>:<tag>

Run the image using buildah:
   > buildah run $cnt /bin/sh

Or using docker:
   > docker run -it <name>:<tag>

Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-09-19 10:31:08 -04:00
Andrei Gherzan
33d0a5183d catatonit: Integrate version 0.1.7
This is useful for podman system tests.

Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-09-19 10:30:56 -04:00
Andrei Gherzan
e11d5b630e podman: Fix merge typo
2b28d64667 brought a typo when resolving
merge/rebase conflict. This fixes it.

Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-08-31 08:19:34 -04:00
Andrei Gherzan
2b28d64667 podman: Patch for CVE-2022-27649
Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-08-30 21:46:46 -04:00
Andrei Gherzan
5be5485413 skopeo: Mark CVE-2019-10214 as fixed
This CVE was fixed[1] in the container image go library skopeo is using
(vendoring). The current version of the image go module is v5.20.0 while
the fix landed since v3.0.0[2].

See RedHat's resolution[3] for more details.

[1] https://github.com/containers/image/issues/654
[2] a3d69a4a89
[3] https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10214

Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-08-25 22:54:03 -04:00
Andrei Gherzan
6063ad1781 podman: Rename podman-rootless.conf sysctl file to aid overrides
Files are sorted in lexicographic order. Moving podman-rootless.conf to
something greater then '00' would help with systems providing default
values in other configuration files that can be overridden by
podman-rootless.conf.

Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-08-25 22:51:57 -04:00
sakib.sajal@windriver.com
33eec78a24 ceph: upgrade v15.2.15 -> v15.2.17
Upgrade ceph to latest v15.x.
Minor upgrade containing fix for CVE-2022-0670.

Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-08-20 23:22:22 -04:00
Andrei Gherzan
406eb64e01 singularity: Drop explicit runtime dep glibc
There is no need we can see for this dependency to be provided as such -
especially forcing this to using glibc.

Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-08-20 23:19:28 -04:00
Andrei Gherzan
26a361a39f cni: Use gcc-based toolchain
clang-based builds are still broken due to:
https://github.com/llvm/llvm-project/issues/53999

Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-08-03 23:19:26 -04:00
Andrei Gherzan
cb9ed15183 podman: Use gcc-based toolchain
clang-based builds are still broken due to:
https://github.com/llvm/llvm-project/issues/53999

Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-08-03 23:19:26 -04:00
Andrei Gherzan
11a0576c3c podman: Backport patch to fix duplicate switch statements
This will fix clang-based builds.

Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-08-03 23:19:26 -04:00
Andrei Gherzan
16e29a7818 runc: Backport patch to fix duplicate switch statements
This will fix clang-based builds.

Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-08-03 23:19:26 -04:00
Changqing Li
845077ca99 criu: fix patch fuzz and remove unused patch
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-08-03 23:06:59 -04:00
Bruce Ashfield
bb9187d34d containerd: update to 1.6.6
Bumping containerd to version v1.6.6-10-g4e92d8e7e, which comprises the following commits:

    37dfc5c9d [release/1.6] Fix WWW-Authenticate parsing
    fa2016d58 [release/1.6] Downgrade MinGW to version 10.2.0
    99c56d217 ctr: fix label args used in NewContainer
    51de785f8 [release/1.6] Make building static binaries simpler
    2ea4e6348 update runc binary to v1.1.3
    61213742a Prepare release notes for v1.6.6
    f92068350 Implicitly discard the input to drain the reader
    2eb67213b [release/1.6] Limit the response size of ExecSync
    185e87275 Prepare release notes for v1.6.5
    5c9c83d3e [release/1.6] update golang to 1.17.11
    fdcdc27bc update go-cni/for cni update fixing plugins that don't respond with version
    e33b9e709 archive: add human-readable hint to Lchown error
    3bb5a9d19 config: improve config v1 deprecation message
    6eff5b6c0 [release/1.6] go.mod: Bump hcsshim to 0.9.3
    f1d2d9260 [release/1.6] vendor: golang.org/x/sys v0.0.0-20220412211240-33da011f77ad
    9f99be51b [release/1.6] update golang to 1.17.10
    246a1b42e vendor: github.com/opencontainers/runc v1.1.2
    43717e03a update runc binary to v1.1.2
    82a77be2d reverts removal of parallel run from critest
    06bdfeb67 Allow git commands in Vagrantfile
    70839a344 Bug fix for mount path handling
    1520bae0f update critools to v1.24
    0d1d2953b Prepare release notes for 1.6.4
    42d691fe6 Bump opencontainers/selinux from 1.10.0 to 1.10.1
    e9f22e008 Update go-cni to v1.1.5
    be4909e95 cri: close fifos when container is deleted
    baa386dc0 Prepare release notes for v1.6.3
    e8da82adc tracing: fix panic on startup when configured
    1764ea9a2 CRI: improve image pulling performance
    9cd76d465 [release/1.6] update golang to 1.17.9
    c09cc1242 check for duplicate nspath possibilities
    fe6ba62ce metrics/cgroups: fix deadlock issue in Add during Collect
    8b81a7843 [release/1.6] go.mod: update image-spec to merge-commit of v1 into main
    f2ba2041b update runc binary to v1.1.1
    b736b4dab go.mod: github.com/opencontainers/runc v1.1.1
    72f1e58c7 CI: add Rocky Linux 8
    7ede40c5c [release/1.6] vendor: github.com/containerd/imgcrypt v1.1.4
    5538be6cf cgroup2: monitor OOMKill instead of OOM to prevent missing container OOM events
    da35c19da Test turning off golang CI lint cache
    a0213573b Add nolint:staticcheck to platform-specific calls
    ad0036ed6 Update prometheus client vendor
    c7bbf316f Mount devmapper xfs file system with "nouuid" option.
    a1de89c3e Make the temp mount as ready only in container WithVolumes
    82a12edf2 moving up to go-cni v1.1.4
    28b44826b native: fix deadlock from leaving transactions open
    8461dd6e5 Prepare release notes for v1.6.2
    91800c4e9 Add static checks to shim for Windows
    ca51d7f85 Update go.mod go version
    765df6609 [release/1.6] remove empty go mod to allow building for go 1.18
    e9af80859 Fix the Inheritable capability defaults.
    7c929318a Update TestNormalize to only test Windows
    06985e7d0 Upgrade golangci-lint and its GitHub Action
    b13d3e05c cri: relax test for system without hugetlb

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-08-03 23:05:32 -04:00
Vasileios Anagnostopoulos
33fb354402 image-oci-umoci: add parameter for stop signal
Add an optional parameter that allows to override the stop
signal that is used.

Signed-off-by: Vasileios Anagnostopoulos <vasileios.anagnostopoulos@siemens.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-07-18 08:44:32 -04:00
Pascal Bach
6c6b9283dd image-oci-umoci: properly handle tags other than latest
Signed-off-by: Pascal Bach <pascal.bach@siemens.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-07-18 08:44:15 -04:00
Andrei Gherzan
90f42b34fd fuse-overlayfs: Fix buffer overflow bug on workdir path
Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-07-15 17:13:05 -04:00
Andrei Gherzan
39ef27d458 podman: Add support for rootless mode
This support is disabled by default and exposed via PACKAGECONFIG.

Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-07-15 17:13:05 -04:00
Andrei Gherzan
c30b03a308 podman: Silence docker emulation warnings
Podman can run in via a docker symlink emulating docker commands. By
default this generates a runtime warning. This change silences it via
the provided interface.

Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-07-15 17:13:05 -04:00
Andrei Gherzan
55e9f7a38c slirp4netns: Runtime recommend the tun kernel module
slirp4netns uses a TAP device to connect to the internet in an
unprivileged way. Without the required kernel support (TAP/TUN),
slirp4netns will fail at runtime.

Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-07-15 17:13:04 -04:00
Bruce Ashfield
d81de7af35 runc/docker: update to 1.1.2
Bumping runc to version v1.1.2-9-gb507e2da, which comprises the following commits:

    bf1cd884 ci: use golangci-lint-action v3, GO_VERSION
    1feafc31 ci: bump golangci-lint to v1.44
    89f79ff0 libct: StartInitialization: fix %w related warning
    3b7f2605 Format sources using gofumpt 0.2.1
    eeac4e77 build(deps): bump actions/checkout from 2 to 3
    cd7fa00d Vagrantfile.fedora: fix build wrt new git
    cdfdbe55 VERSION: back to development
    a916309f VERSION: release 1.1.2
    364ec0f1 runc: do not set inheritable capabilities
    8959e372 VERSION: back to development
    52de29d7 VERSION: release 1.1.1
    2636e1cb CHANGELOG.md: add 1.1.1 release notes
    036cc348 CI/cirrus: add centos-stream-9
    db953158 README.md: add cirrus-ci badge
    ea19181e README,libct/README: fix pkg.go.dev badges
    8290c4cf libct/cg: IsCgroup2HybridMode: don't panic
    ee7ba6cb configs/validate: looser validation for RDT
    96193422 libct/cg/sd/v2: fix ENOENT on cgroup delegation
    35784a3e ensure the path is a sub-cgroup path
    986e7c53 libct: fixStdioPermissions: ignore EROFS
    5053a065 libct: fixStdioPermissions: skip chown if not needed
    d2939b6b libct: fixStdioPermissions: minor refactoring

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-07-07 10:57:45 -04:00
Bruce Ashfield
8da1fd0f8b runc: update to 1.1.2
Bumping runc to version v1.1.2-9-gb507e2da, which comprises the following commits:

    bf1cd884 ci: use golangci-lint-action v3, GO_VERSION
    1feafc31 ci: bump golangci-lint to v1.44
    89f79ff0 libct: StartInitialization: fix %w related warning
    3b7f2605 Format sources using gofumpt 0.2.1
    eeac4e77 build(deps): bump actions/checkout from 2 to 3
    cd7fa00d Vagrantfile.fedora: fix build wrt new git
    cdfdbe55 VERSION: back to development
    a916309f VERSION: release 1.1.2
    364ec0f1 runc: do not set inheritable capabilities
    8959e372 VERSION: back to development
    52de29d7 VERSION: release 1.1.1
    2636e1cb CHANGELOG.md: add 1.1.1 release notes
    036cc348 CI/cirrus: add centos-stream-9
    db953158 README.md: add cirrus-ci badge
    ea19181e README,libct/README: fix pkg.go.dev badges
    8290c4cf libct/cg: IsCgroup2HybridMode: don't panic
    ee7ba6cb configs/validate: looser validation for RDT
    96193422 libct/cg/sd/v2: fix ENOENT on cgroup delegation
    35784a3e ensure the path is a sub-cgroup path
    986e7c53 libct: fixStdioPermissions: ignore EROFS
    5053a065 libct: fixStdioPermissions: skip chown if not needed
    d2939b6b libct: fixStdioPermissions: minor refactoring

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-07-07 10:57:45 -04:00
Bertrand Marquis
788175640d xen/sysvinit: add hvc0 console only if not there already
The base inittab recipe is creating inittab entries for consoles listed
in SERIAL_CONSOLES.
For qemu, this contains "115200,hvc0" so an entry is created in inittab
for it.
Prevent to create a second entry if hvc0 is present in SERIAL_CONSOLES.

On qemuarm, this solves issues with the console when starting on top of
Xen as dom0.

Signed-off-by: Bertrand Marquis <bertrand.marquis@arm.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-07-07 10:22:18 -04:00
Andrei Gherzan
d577f45ac6 podman: Fix host contamination
The project's internal Makefile uses BUILDFLAGS variable to pass
arguments to `go build` while Yocto/OE defines it as GOBUILDFLAGS. Add a
patch to align this and avoid using host headers in which case, a musl
build will fail similarly to:

| [...]ld: /tmp/go-link-3172010154/000015.o: in function `vfprintf':
| /usr/include/x86_64-linux-gnu/bits/stdio2.h:130: undefined reference to `__vfprintf_chk'
| [...]ld: /tmp/go-link-3172010154/000016.o: in function `fprintf':
| /usr/include/x86_64-linux-gnu/bits/stdio2.h💯 undefined reference to `__fprintf_chk'
| collect2: error: ld returned 1 exit status

Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-07-05 16:26:27 -04:00
Jeremy Puhlman
16d6581fe4 cloud-init: install sysvinit initscripts
The redhat versions work with out modification.

Signed-off-by: Jeremy A. Puhlman <jpuhlman@mvista.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-06-27 23:38:41 -04:00
Jeremy Puhlman
466db3796a cloud-init: add rdpends for netifaces and charset-normalizer
Signed-off-by: Jeremy A. Puhlman <jpuhlman@mvista.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-06-27 23:38:41 -04:00
Jeremy Puhlman
af1a411781 cloud-init: add depend on udev in sysvinit case.
Just as with systemd, the build needs the dev manager installed
as a dependancy

Signed-off-by: Jeremy A. Puhlman <jpuhlman@mvista.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-06-27 23:38:41 -04:00
Chen Qi
0d35c19435 netns: adjust GOROOT, CGO_CFLAGS and CGO_LDFALGS
Adjust the GOROOT setting as directory specified by the original
one does not exist.

The CGO_CFLAGS and CGO_LDFLAGS should use target flags instead
of the nativesdk ones.

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-06-20 12:09:51 -04:00
Chen Qi
9bfdd564cd oci-image-tools: adjust GOROOT, CGO_CFLAGS and CGO_LDFALGS
Adjust the GOROOT setting as directory specified by the original
one does not exist.

The CGO_CFLAGS and CGO_LDFLAGS should use target flags instead
of the nativesdk ones.

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-06-20 12:09:51 -04:00
Chen Qi
0d2ea6a1ad riddler: adjust GOROOT, CGO_CFLAGS and CGO_LDFALGS
Adjust the GOROOT setting as directory specified by the original
one does not exist.

The CGO_CFLAGS and CGO_LDFLAGS should use target flags instead
of the nativesdk ones.

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-06-20 12:09:51 -04:00
Chen Qi
ca033baeb3 oci-runtime-tools: adjust GOROOT, CGO_CFLAGS and CGO_LDFALGS
Adjust the GOROOT setting as directory specified by the original
one does not exist.

The CGO_CFLAGS and CGO_LDFLAGS should use target flags instead
of the nativesdk ones.

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-06-20 12:09:51 -04:00
Chen Qi
eea5c954e9 umoci: adjust CGO_CFLAGS and CGO_LDFLAGS settings
The CGO_CFLAGS and CGO_LDFLAGS should use target flags instead
of the nativesdk ones.

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-06-20 12:09:51 -04:00
Chen Qi
4e19bc7c96 skopeo: clean up depends and fix CGO settings
According to https://github.com/containers/skopeo/blob/main/install.md#building-from-source,
the ostree dependency is not needed.

Also, adjust the CGO_CFLAGS and CGO_LDFALGS to use target
flags instead of the SDK ones.

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-06-20 12:09:51 -04:00
Chen Qi
fe1bd21891 docker-distribution: upgrade to 2.8.1
v2.8.1 is the latest stable version.

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-06-20 12:09:51 -04:00
Chen Qi
cddd676f40 docker-distribution: fix build error on new hosts
Fix settings for GOROOT, CGO_CFLAGS and CGO_LDFLAGS.

The previous setting for GOROOT is no longer valid as the directory
does not exist for now. So adjust the GOROOT setting.

Currently CGO_CFLAGS is set to use BUILDSDK_CFLAGS, and this is
incorrect. We need target flags instead of SDK related flags. Such
setting happens to work for some hosts. However, when building on
newer hosts, we get QA error like below:

  ERROR: docker-distribution-v2.7.1-r0 do_package_qa:
  QA Issue: /usr/sbin/registry contained in package docker-registry requires
  libc.so.6(GLIBC_2.34)(64bit), but no providers found in RDEPENDS_docker-registry? [file-rdeps]

The above error was found on hardknott on host Fedora 35.
Tracking down the error and I found it's using host stuff which is likely
to be caused by using incorrect CGO_CFLAGS. As the master branch is
using the same settings, it has the same issue.

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-06-20 12:09:51 -04:00
Chen Qi
0642784cb1 docker-distribution: fix the inehrit and systemd settings
In order for systemd variables such as SYSTEMD_AUTO_ENABLE to have
effect, we need to inherit the systemd class. We also need to specify
the package which contains the service.

As go.bbclass already inherits goarch.bbclass, we only need to inehrit
go.bbclass.

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-06-20 12:09:51 -04:00
Michal Orzel
a2dd7d887f xen: Disable highmem on qemuarm
By default, highmem option is enabled for machine types later than
virt-2.12. This allows qemu to place devices and RAM in physical
address space above 32-bits. This can cause issues as according to the
documentation Xen supports up to 12GiB of physical address space.
Recently the issue was observed using runqemu, that was causing Linux
running on top of Xen to stall when trying to access ECAM space placed
by qemu at 256GiB mark. Even though this issue is most probably related
to QEMU and not Xen (the investigation showed that it can map ECAM
space correctly), it is best to avoid such issues by disabling highmem
on qemuarm.

Signed-off-by: Michal Orzel <michal.orzel@arm.com>
Reviewed-by: Bertrand Marquis <bertrand.marquis@arm.com>
Reviewed-by: Christopher Clark <christopher.w.clark@gmail.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-06-20 12:08:58 -04:00
Michal Orzel
15ed3e5294 Revert "xen: Disable PCI on qemuarm with Xen"
This reverts commit fb0a7b97db.

Justification:
Commit fb0a7b97db removed the PCI node from the qemu device tree
due to the issue when trying to access PCI configuration space that
was causing Linux running on top of Xen to end up in an infinite loop.
The investigation showed that the problem occurs due to qemu placing
ECAM space at 256GiB mark. Even though Xen officially supports on arm32
up to 12GiB of physical address space, it is able to map it correctly
for dom0. However, when Linux tries to access the ECAM space and the
stage2 translation fault occurs, HPFAR register contains incorrect IPA.
We can say it is incorrect because using hardware AT instruction or
software lookup, we can obtain the correct IPA from the same VA. This
can suggest that the problem is related to QEMU fault handling.

Instead of removing the PCI node the follow-up commit will disable
highmem option in qemu which will cause placing ECAM space in the
32-bit space.

Signed-off-by: Michal Orzel <michal.orzel@arm.com>
Reviewed-by: Bertrand Marquis <bertrand.marquis@arm.com>
Reviewed-by: Christopher Clark <christopher.w.clark@gmail.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-06-20 12:08:58 -04:00
Bruce Ashfield
42c308c7ad k3s: update recipe formatting and map googlesource to github
Reformat the k3s depedencies and src_uri into a more readible and
maintainable format.

We also map googlesoruce to github for better fetching, as suggested
by Diego Sueiro <diego.sueiro@arm.com>.

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-06-20 12:08:58 -04:00
Chen Qi
b70d6bb357 criu: fix QA issue about shebang too long
There's a QA issue about criu complaining the shebang
of crit script is too long. We should replace it with
'#!/usr/bin/env python3'.

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2022-06-07 10:00:50 -04:00