------------------------------------------------------------------ --- Changelog.all ----------- Fri May 9 13:06:22 UTC 2025 ------ ------------------------------------------------------------------ ------------------------------------------------------------------ ------------------ 2025-5-9 - May 9 2025 ------------------- ------------------------------------------------------------------ ++++ sle-module-containers-release: - automatically generated by openSUSE-release-tools/pkglistgen ------------------------------------------------------------------ ------------------ 2025-4-23 - Apr 23 2025 ------------------- ------------------------------------------------------------------ ++++ kubevirt: - Remove custom SELinux policy from virt-launcher container ------------------------------------------------------------------ ------------------ 2025-4-22 - Apr 22 2025 ------------------- ------------------------------------------------------------------ ++++ kubevirt: - Update to version 1.5.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.5.0 - Drop patches 0001-feat-pass-timeout-from-virt-monitor-to-virt-tail.patch - Add patches 0002-chore-deps-update-module-golang.org-x-crypto-to-v0.3.patch (bsc#1239328) 0003-chore-deps-update-module-golang.org-x-oauth2-to-v0.2.patch (bsc#1239190) 0004-chore-deps-update-module-golang.org-x-net-to-v0.36.0.patch (bsc#1238704) - Rename patch 0002-Ensure-SEV-VMs-use-stateless-OVMF-firmware.patch 0001-Ensure-SEV-VMs-use-stateless-OVMF-firmware.patch ------------------------------------------------------------------ ------------------ 2025-4-9 - Apr 9 2025 ------------------- ------------------------------------------------------------------ ++++ containerd: - Update to containerd v1.7.27. Upstream release notes: bsc#1239749 CVE-2024-40635 - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch ------------------------------------------------------------------ ------------------ 2025-3-27 - Mar 27 2025 ------------------- ------------------------------------------------------------------ ++++ open-vm-tools: - (bsc#1237180): Ensure vmtoolsd.service and vgauthd.service are set to enabled by default. Do this by removing vmblock-fuse.service from the %pre section in the spec file. vmblock-fuse.service still remains in the %pre desktop section. ------------------------------------------------------------------ ------------------ 2025-3-26 - Mar 26 2025 ------------------- ------------------------------------------------------------------ ++++ docker: - Don't use the new container-selinux conditional requires on SLE-12, as the RPM version there doesn't support it. Arguably the change itself is a bit suspect but we can fix that later. bsc#1237367 ++++ docker-stable: - Don't use the new container-selinux conditional requires on SLE-12, as the RPM version there doesn't support it. Arguably the change itself is a bit suspect but we can fix that later. bsc#1237367 ------------------------------------------------------------------ ------------------ 2025-3-25 - Mar 25 2025 ------------------- ------------------------------------------------------------------ ++++ docker: - Add backport for golang.org/x/oauth2 CVE-2025-22868 fix. bsc#1239185 + 0006-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch - Add backport for golang.org/x/crypto CVE-2025-22869 fix. bsc#1239322 + 0007-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch - Refresh patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch ++++ docker-stable: - Add backport for golang.org/x/oauth2 CVE-2025-22868 fix. bsc#1239185 + 0011-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch - Add backport for golang.org/x/crypto CVE-2025-22869 fix. bsc#1239322 + 0012-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch - Refresh patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0006-CVE-2024-2365x-update-buildkit-to-include-CVE-patche.patch * 0007-bsc1221916-update-to-patched-buildkit-version-to-fix.patch * 0008-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch * 0009-CVE-2024-41110-AuthZ-plugin-securty-fixes.patch * 0010-CVE-2024-29018-libnet-Don-t-forward-to-upstream-reso.patch - Move test-related patch to the end of the patch stack: - 0011-TESTS-backport-fixes-for-integration-tests.patch + 0013-TESTS-backport-fixes-for-integration-tests.patch ------------------------------------------------------------------ ------------------ 2025-3-24 - Mar 24 2025 ------------------- ------------------------------------------------------------------ ++++ buildah: - Add patch for CVE-2025-22869 - bsc#1239339 Rebase patches: * 0001-pkg-subscriptions-use-securejoin-for-the-container-p.patch * 0002-Use-securejoin.SecureJoin-when-forming-userns-paths.patch * 0003-c-common-default-to-slirp4netns-as-the-rootless-netw.patch * 0004-http2-close-connections-when-receiving-too-many-head.patch * 0005-CVE-2025-27144-vendor-don-t-allow-unbounded-amounts-.patch Add patch: * 0006-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch ------------------------------------------------------------------ ------------------ 2025-3-23 - Mar 23 2025 ------------------- ------------------------------------------------------------------ ++++ nvidia-container-runtime: - build with PIE, build against current GO. (bsc#1239955) - build with PIE, build with current GO. bsc#1239955 ------------------------------------------------------------------ ------------------ 2025-3-20 - Mar 20 2025 ------------------- ------------------------------------------------------------------ ++++ docker: - Make container-selinux requirement conditional on selinux-policy (bsc#1237367) ++++ docker-stable: - Make container-selinux requirement conditional on selinux-policy (bsc#1237367) ++++ open-vm-tools: - remove unused pcre build dependency ------------------------------------------------------------------ ------------------ 2025-3-18 - Mar 18 2025 ------------------- ------------------------------------------------------------------ ++++ podman: - Add patch for CVE-2025-22869 (bsc#1239330): * 0006-CVE-2025-22869-ssh-limit-the-size-of-the-internal-pa.patch - Rebase patches: * 0001-vendor-update-c-buildah-to-1.33.12.patch * 0002-Backport-fix-for-CVE-2024-6104.patch * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch * 0004-http2-close-connections-when-receiving-too-many-head.patch * 0005-CVE-2025-27144-vendor-don-t-allow-unbounded-amounts-.patch ------------------------------------------------------------------ ------------------ 2025-3-13 - Mar 13 2025 ------------------- ------------------------------------------------------------------ ++++ helm: - Update to version 3.17.2 (bsc#1238688, CVE-2025-22870): * Updating to 0.37.0 for x/net * build(deps): bump the k8s-io group with 7 updates ------------------------------------------------------------------ ------------------ 2025-3-10 - Mar 10 2025 ------------------- ------------------------------------------------------------------ ++++ helm: - skip 32bit builds on SLFO ++++ kubernetes-old: - Update to version 1.29.14: * Find full changelog – https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#v1214 - Update .spec file to bump go version build requirements: * `BuildRequires: go >= 1.22.12` * ref: https://github.com/kubernetes/kubernetes/blob/v1.29.14/build/dependencies.yaml#L115-L117 ++++ kubernetes: - Update to version 1.31.6: * Find full changelog – https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.31.md#v1316 - Update .spec file to bump go version build requirements: * `BuildRequires: go >= 1.22.12` * ref: https://github.com/kubernetes/kubernetes/blob/v1.31.6/build/dependencies.yaml#L117-L119 ------------------------------------------------------------------ ------------------ 2025-3-3 - Mar 3 2025 ------------------- ------------------------------------------------------------------ ++++ buildah: - Add patch for CVE-2025-27144 (bsc#1237681): * 0005-CVE-2025-27144-vendor-don-t-allow-unbounded-amounts-.patch - Rebase patches: * 0001-vendor-bump-buildah-to-1.37.6-CVE-2024-11218.patch * 0002-Use-securejoin.SecureJoin-when-forming-userns-paths.patch * 0003-c-common-default-to-slirp4netns-as-the-rootless-netw.patch * 0004-http2-close-connections-when-receiving-too-many-head.patch ++++ podman: - Add patch for CVE-2025-27144 (bsc#1237641): * 0005-CVE-2025-27144-vendor-don-t-allow-unbounded-amounts-.patch - Rebase patches: * 0001-vendor-update-c-buildah-to-1.33.12.patch * 0002-Backport-fix-for-CVE-2024-6104.patch * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch * 0004-http2-close-connections-when-receiving-too-many-head.patch ------------------------------------------------------------------ ------------------ 2025-2-28 - Feb 28 2025 ------------------- ------------------------------------------------------------------ ++++ containerd: - Update to containerd v1.7.26. Upstream release notes: - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch ------------------------------------------------------------------ ------------------ 2025-2-25 - Feb 25 2025 ------------------- ------------------------------------------------------------------ ++++ open-vm-tools: - Revert previous change (Thu Feb 20 23:08:43 UTC 2025). The proposed solutions was non-standard. ------------------------------------------------------------------ ------------------ 2025-2-20 - Feb 20 2025 ------------------- ------------------------------------------------------------------ ++++ open-vm-tools: - (bsc#1237180): Ensure vmtoolsd.service, vgauthd.service, and vmblock-fuse.service are set to enabled by default. ------------------------------------------------------------------ ------------------ 2025-2-19 - Feb 19 2025 ------------------- ------------------------------------------------------------------ ++++ docker: - Update to Docker 27.5.1-ce. See upstream changelog online at bsc#1237335 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to docker-buildx 0.20.1. See upstream changelog online at ------------------------------------------------------------------ ------------------ 2025-2-14 - Feb 14 2025 ------------------- ------------------------------------------------------------------ ++++ helm: - reduce test flakyness by limiting parallelism to what upstream uses ------------------------------------------------------------------ ------------------ 2025-2-13 - Feb 13 2025 ------------------- ------------------------------------------------------------------ ++++ helm: - Update to version 3.17.1: * add test for nullifying nested global value * Add test case for removing an entire object * Tests for bugfix: Override subcharts with null values #12879 * merge null child chart objects * build(deps): bump the k8s-io group with 7 updates * fix: check group for resource info match ------------------------------------------------------------------ ------------------ 2025-2-12 - Feb 12 2025 ------------------- ------------------------------------------------------------------ ++++ aardvark-dns: - Update to version 1.12.2: * Release v1.12.2 * Update release notes for 1.12.2 * coredns: work on tcp requests concurrently * tcp: add timeout to connection * cirrus: update branch names * Release v1.12.1 * Updated release notes for 1.12.1 * Change av cargo categories * Bump to 1.13.0-dev * Release 1.12.0 * Release notes for 1.12 * config: ignore enoent errors while reading configs * run cargo update * update upsteam resolvers on each refresh * fix(deps): update rust crate syslog to v7 * fix(deps): update rust crate tokio to 1.39.2 * add tcp support for forwarding (bsc#1234660) * add tcp listening support * test: add new test to check for startup error * return bind error to caller on first start * add our own error type and use it over anyhow * server: use anyhow to wrap parse_configs error * server: split out main loop into new function * main: remove aardvark-dns error prefix * coredns: remove unnecessary try_join! call * coredns: drop pointless name var * serve: read nameservers once * replace signal-hook with tokio::signal * serve: fix broken error logging * server: improve parent <-> child error handling * add some basic perf check script * fix(deps): update rust crate tokio to 1.39.0 * coredns: create reply_ip() function * coredns: match dns type explicitly * server: use only one tokio runtime * coredns: improve indentation for process_message() * coredns: move upstream resolvers detection later * coredns: do not clone sender * read AARDVARK_NO_PROXY once * coredns: move main code out of select! * coredns: fix "name" naming * coredns: remove unused forward_addr/port * coredns: fix handling of dns search domain * coredns: rework PTR lookup flow * fix(deps): update rust crate tokio to 1.38.1 * [skip-ci] TMT: Reorg upstream tests for downstream reusability * [skip-ci] Packit: use `packages: [aardvark-dns-fedora]` for podman-next builds * Be sure to have at least Epoch 2 to preserve upgrade path in c10s. * fix(deps): update rust crate log to 0.4.22 * [CI:BUILD] rpm: Update Rust macro usage * fix(deps): update rust crate tokio to 1.38.0 * Bump to 1.12.0-dev ++++ buildah: - Add patch for CVE-2023-45288 (bsc#1236531) Rebase patches: * 0001-pkg-subscriptions-use-securejoin-for-the-container-p.patch * 0002-Use-securejoin.SecureJoin-when-forming-userns-paths.patch * 0003-c-common-default-to-slirp4netns-as-the-rootless-netw.patch Added patch: * 0004-http2-close-connections-when-receiving-too-many-head.patch (CVE-2023-45288 - bsc#1236531) ------------------------------------------------------------------ ------------------ 2025-2-11 - Feb 11 2025 ------------------- ------------------------------------------------------------------ ++++ netavark: - Use recommended way to require latest rust—require cargo. - Update to version 1.12.2: * Release v1.12.2 * Release notes for 1.12.2 * fix new rust 1.80 lint issues * silence new rust 1.80 warnings * aardvark: on start failure delete entries again * iptables: make dns rules cover tcp as well * nftables: make dns rules cover tcp as well * Release v1.12.1 * Update release notes for v1.12.1 * Change nv cargo categories * Bump to 1.13.0-dev * Release 1.12 * Release Notes for 1.12 * run cargo update * rpm: use nftables as default for f41 * fix(deps): update rust crate serde_json to 1.0.121 * fix(deps): update rust crate tokio to 1.39.2 * aardvark-dns: trim whitespaces from error text * fix(deps): update rust crate env_logger to 0.11.5 * [skip-ci] RPM: handle iptables/nftables dependencies * fix aardvark-dns error handling * fix(deps): update rust crate tokio to 1.39.1 * fix(deps): update rust crate env_logger to 0.11.4 * fix(deps): update rust crate tokio to 1.38.1 * update mozim to 0.2.4 (bsc#1236567) * fix(deps): update rust crate serde_json to 1.0.120 * netavark: dhcp_proxy: use dns servers from dhcp lease * fix(deps): update rust crate serde_json to 1.0.119 * fix(deps): update rust crate netlink-packet-route to 0.20.1 * fix(deps): update rust crate log to 0.4.22 * Fix Epoch so upgrade path is preserved from Fedora/RHEL. * test: add macvlan metric test * fix(deps): update rust crate serde_json to 1.0.118 * fix(deps): update rust crate url to 2.5.2 * fix(deps): update rust crate prost to 0.12.6 * fix(deps): update rust crate url to 2.5.1 * fix(deps): update rust crate iptables to 0.5.2 * [CI:BUILD] rpm: Update Rust macro usage * fix(deps): update rust crate nftables to 0.4.1 * fix(deps): update rust crate tokio to 1.38.0 * Bump to 1.12.0-dev ------------------------------------------------------------------ ------------------ 2025-2-7 - Feb 7 2025 ------------------- ------------------------------------------------------------------ ++++ podman: - Add patch for CVE-2023-45288 (bsc#1236507): * 0004-http2-close-connections-when-receiving-too-many-head.patch - Add supplemental patch for CVE-2024-6104 (bsc#1227052): * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch - Rebase patches: * 0001-vendor-update-c-buildah-to-1.33.12.patch * 0002-Backport-fix-for-CVE-2024-6104.patch ------------------------------------------------------------------ ------------------ 2025-1-29 - Jan 29 2025 ------------------- ------------------------------------------------------------------ ++++ container-suseconnect: - build with go1.23 ------------------------------------------------------------------ ------------------ 2025-1-27 - Jan 27 2025 ------------------- ------------------------------------------------------------------ ++++ buildah: - Update to version 1.35.5 (fix for CVE-2024-11218; bsc#1236272): * Tag v1.35.5 * Fix TOCTOU error when bind and cache mounts use "src" values * define.TempDirForURL(): always use an intermediate subdirectory * internal/volume.GetBindMount(): discard writes in bind mounts * pkg/overlay: add a MountLabel flag to Options * pkg/overlay: add a ForceMount flag to Options * Add internal/volumes.bindFromChroot() * Add an internal/open package * Properly validate cache IDs and sources * CVE-2024-9407: validate "bind-propagation" flag settings * Allow cache mounts to be stages or additional build contexts * Integration tests: switch some base images * Disable most packit copr targets * Cross-build on Fedora - Rebase patches: * 0001-pkg-subscriptions-use-securejoin-for-the-container-p.patch * 0002-Use-securejoin.SecureJoin-when-forming-userns-paths.patch * 0003-c-common-default-to-slirp4netns-as-the-rootless-netw.patch - Removed patches(merged upstream): * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch * 0003-Properly-validate-cache-IDs-and-sources.patch ------------------------------------------------------------------ ------------------ 2025-1-23 - Jan 23 2025 ------------------- ------------------------------------------------------------------ ++++ podman: - Add patch for CVE-2024-11218 (bsc#1236270): * 0002-vendor-update-c-buildah-to-1.33.12.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Removed patches (merged upstream and into the new patch): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch * 0004-Properly-validate-cache-IDs-and-sources.patch * 0005-Use-securejoin.SecureJoin-when-forming-userns-paths.patch ------------------------------------------------------------------ ------------------ 2025-1-17 - Jan 17 2025 ------------------- ------------------------------------------------------------------ ++++ kubevirt: - Fix guest-console-log failure during live migration and Harvester upgrades 0001-feat-pass-timeout-from-virt-monitor-to-virt-tail.patch - Fix SEV(ES) guests not being bootable from incompatible firmware 0002-Ensure-SEV-VMs-use-stateless-OVMF-firmware.patch (bsc#1232762) - Update to version 1.4.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.4.0 - Drop patches 0001-Consider-the-new-DV-reason-ImagePullFailed.patch 0002-tests-Set-FSGroup-to-ensure-proper-permissions.patch - Add patches 0001-feat-pass-timeout-from-virt-monitor-to-virt-tail.patch 0002-Ensure-SEV-VMs-use-stateless-OVMF-firmware.patch (bsc#1232762) ------------------------------------------------------------------ ------------------ 2025-1-16 - Jan 16 2025 ------------------- ------------------------------------------------------------------ ++++ helm: - Update to 3.17.0 (bsc#1235318, CVE-2024-45338): Full changelog: https://github.com/helm/helm/releases/tag/v3.17.0 * Notable Changes - Allow pulling and installation by OCI digest - Annotations and dependencies are now in chart metadata output - New --take-ownership flag for install and upgrade commands - SDK: Authorizer and registry authorizer are now configurable - Removed the Kubernetes configuration file permissions check - Added username/password to helm push and dependency build/update subcommands - Added toYamlPretty template function ------------------------------------------------------------------ ------------------ 2025-1-12 - Jan 12 2025 ------------------- ------------------------------------------------------------------ ++++ containerd: - Update to containerd v1.7.25. Upstream release notes: - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch ------------------------------------------------------------------ ------------------ 2024-12-18 - Dec 18 2024 ------------------- ------------------------------------------------------------------ ++++ docker: - Update to Docker 27.4.1-ce. See upstream changelog online at - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch ++++ docker-stable: - Add backport for CVE-2024-29018 fix. bsc#1234089 + 0010-CVE-2024-29018-libnet-Don-t-forward-to-upstream-reso.patch - Add backport for CVE-2024-23650 fix and rename patch filename. bsc#1219437 - 0006-CVE-2024-23653-update-buildkit-to-include-CVE-patche.patch + 0006-CVE-2024-2365x-update-buildkit-to-include-CVE-patche.patch - Reorder and rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0007-bsc1221916-update-to-patched-buildkit-version-to-fix.patch * 0008-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch * 0009-CVE-2024-41110-AuthZ-plugin-securty-fixes.patch - 0010-TESTS-backport-fixes-for-integration-tests.patch + 0011-TESTS-backport-fixes-for-integration-tests.patch ------------------------------------------------------------------ ------------------ 2024-12-17 - Dec 17 2024 ------------------- ------------------------------------------------------------------ ++++ docker: - Update to docker-buildx 0.19.3. See upstream changelog online at ++++ docker-stable: - Update to docker-buildx 0.19.3. See upstream changelog online at ------------------------------------------------------------------ ------------------ 2024-12-16 - Dec 16 2024 ------------------- ------------------------------------------------------------------ ++++ helm: - Update to version 3.16.4 (bsc#1234482, CVE-2024-45337): * Bump golang.org/x/crypto from 0.30.0 to 0.31.0 * Bump the k8s-io group with 7 updates ------------------------------------------------------------------ ------------------ 2024-12-13 - Dec 13 2024 ------------------- ------------------------------------------------------------------ ++++ docker: - Update to Docker 27.4.0-ce. See upstream changelog online at - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Remove upstreamed patches: - 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch - 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch ------------------------------------------------------------------ ------------------ 2024-12-11 - Dec 11 2024 ------------------- ------------------------------------------------------------------ ++++ docker: - Update docker-buildx to v0.19.2. See upstream changelog online at . Some notable changelogs from the last update: * * - Update to Go 1.22. - Add a new toggle file /etc/docker/suse-secrets-enable which allows users to disable the SUSEConnect integration with Docker (which creates special mounts in /run/secrets to allow container-suseconnect to authenticate containers with registries on registered hosts). bsc#1231348 bsc#1232999 In order to disable these mounts, just do echo 0 > /etc/docker/suse-secrets-enable and restart Docker. In order to re-enable them, just do echo 1 > /etc/docker/suse-secrets-enable and restart Docker. Docker will output information on startup to tell you whether the SUSE secrets feature is enabled or not. * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch ++++ docker-stable: - Update docker-buildx to v0.19.2. See upstream changelog online at . Some notable changelogs from the last update: * * - Update to Go 1.22. - Add a new toggle file /etc/docker/suse-secrets-enable which allows users to disable the SUSEConnect integration with Docker (which creates special mounts in /run/secrets to allow container-suseconnect to authenticate containers with registries on registered hosts). bsc#1231348 bsc#1232999 In order to disable these mounts, just do echo 0 > /etc/docker/suse-secrets-enable and restart Docker. In order to re-enable them, just do echo 1 > /etc/docker/suse-secrets-enable and restart Docker. Docker will output information on startup to tell you whether the SUSE secrets feature is enabled or not. * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch ------------------------------------------------------------------ ------------------ 2024-11-27 - Nov 27 2024 ------------------- ------------------------------------------------------------------ ++++ docker: - Disable docker-buildx builds for SLES. It turns out that build containers with docker-buildx don't currently get the SUSE secrets mounts applied, meaning that container-suseconnect doesn't work when building images. bsc#1233819 ++++ docker-stable: - Disable docker-buildx builds for SLES. It turns out that build containers with docker-buildx don't currently get the SUSE secrets mounts applied, meaning that container-suseconnect doesn't work when building images. bsc#1233819 ------------------------------------------------------------------ ------------------ 2024-11-20 - Nov 20 2024 ------------------- ------------------------------------------------------------------ ++++ bmake: - Fix variable used in rules to build shared libs on Linux The form: `-Wl,"-soname lib${LIB}.so.${SHLIB_MAJOR}"` caused an error message: Error: unable to disambiguate: -soname libelf.so.1 \ (did you mean --soname libelf.so.1 ?) Instead it should be: `-Wl,"-soname,lib${LIB}.so.${SHLIB_MAJOR}"` as it is in the latest version of bmake. (bsc#1233508) Fix-variable-used-in-rules-to-build-shared-libs-on-Linux.patch ++++ docker: - Add docker-integration-tests-devel subpackage for building and running the upstream Docker integration tests on machines to test that Docker works properly. Users should not install this package. - docker-rpmlintrc updated to include allow-list for all of the integration tests package, since it contains a bunch of stuff that wouldn't normally be allowed. ++++ docker-stable: - Add docker-integration-tests-devel subpackage for building and running the upstream Docker integration tests on machines to test that Docker works properly. Users should not install this package. - docker-rpmlintrc updated to include allow-list for all of the integration tests package, since it contains a bunch of stuff that wouldn't normally be allowed. - Rebased patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0006-CVE-2024-23653-update-buildkit-to-include-CVE-patche.patch * 0007-bsc1221916-update-to-patched-buildkit-version-to-fix.patch * 0008-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch * 0009-CVE-2024-41110-AuthZ-plugin-securty-fixes.patch - Added patches: + 0010-TESTS-backport-fixes-for-integration-tests.patch ------------------------------------------------------------------ ------------------ 2024-11-14 - Nov 14 2024 ------------------- ------------------------------------------------------------------ ++++ helm: - Update to version 3.16.3: * fix: fix label name * Fix typo in pkg/lint/rules/chartfile_test.go * Increasing the size of the runner used for releases. * fix(hooks): correct hooks delete order * Bump github.com/containerd/containerd from 1.7.12 to 1.7.23 ------------------------------------------------------------------ ------------------ 2024-11-12 - Nov 12 2024 ------------------- ------------------------------------------------------------------ ++++ docker: - Remove DOCKER_NETWORK_OPTS from docker.service. This was removed from sysconfig a long time ago, and apparently this causes issues with systemd in some cases. ++++ docker-stable: - Remove DOCKER_NETWORK_OPTS from docker.service. This was removed from sysconfig a long time ago, and apparently this causes issues with systemd in some cases. - Update --add-runtime to point to correct binary path. ------------------------------------------------------------------ ------------------ 2024-11-4 - Nov 4 2024 ------------------- ------------------------------------------------------------------ ++++ kubernetes-old: - Update to version 1.28.15: * bump golang to 1.22.8 * kubeadm: fix a bug where the RemoveMember function did not return the correct member list when the member to be removed did not exist * Fix daemonset to ensure old unhealthy pods are counted towards max unavailable budget. * fix pod index label name * kubeadm: check the member list status before adding or removing an etcd member * kubeadm: check whether the peer URL for the added etcd member already exists when the MemberAddAsLearner/MemberAdd fails * add cross image as well * bugfix: endpoints controller track resource version conrrectly * Remove `socat` and `ebtables` from kubeadm preflight checks - Update .spec file to bump go version build requirements: * `BuildRequires: go >= 1.22.8` * ref: https://github.com/kubernetes/kubernetes/blob/v1.28.15/build/dependencies.yaml#L115-L117 ++++ kubernetes: - Update to version 1.30.6: * bump golang to 1.22.8 * kubeadm: fix a bug where the RemoveMember function did not return the correct member list when the member to be removed did not exist * Fix deleted UDP endpoint detection * Fix daemonset to ensure old unhealthy pods are counted towards max unavailable budget. * kubeadm: check the member list status before adding or removing an etcd member * kubeadm: check whether the peer URL for the added etcd member already exists when the MemberAddAsLearner/MemberAdd fails * bugfix: endpoints controller track resource version conrrectly * define some default kube-apiserver flags for tests disabling unneded controllers * Remove `socat` and `ebtables` from kubeadm preflight checks * Add activeDeadlineSeconds to kubeadm upgrade-health-check job * run update-vendor.sh and fix up broken go.sum(s) * Fix verify-vendor script to check all go.mod and go.sum files * fix memory leak from global MeterProvider - Update .spec file to bump go version build requirements: * `BuildRequires: go >= 1.22.8` * ref: https://github.com/kubernetes/kubernetes/blob/v1.30.6/build/dependencies.yaml#L117-L119 ------------------------------------------------------------------ ------------------ 2024-10-30 - Oct 30 2024 ------------------- ------------------------------------------------------------------ ++++ buildah: - Add patch for bsc#1232522; default to slirp4netns on SLE instead of pasta: * 0005-c-common-default-to-slirp4netns-as-the-rootless-netw.patch ------------------------------------------------------------------ ------------------ 2024-10-28 - Oct 28 2024 ------------------- ------------------------------------------------------------------ ++++ containerd: - Update to containerd v1.7.23. Upstream release notes: - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch ------------------------------------------------------------------ ------------------ 2024-10-22 - Oct 22 2024 ------------------- ------------------------------------------------------------------ ++++ buildah: - Add patch for CVE-2024-9676 (bsc#1231698): * 0004-Use-securejoin.SecureJoin-when-forming-userns-paths.patch - Rebase patches: * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch * 0003-Properly-validate-cache-IDs-and-sources.patch ++++ podman: - Add patch for CVE-2024-9676 (bsc#1231698): * 0005-Use-securejoin.SecureJoin-when-forming-userns-paths.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch * 0004-Properly-validate-cache-IDs-and-sources.patch ------------------------------------------------------------------ ------------------ 2024-10-18 - Oct 18 2024 ------------------- ------------------------------------------------------------------ ++++ podman: - Load ip_tables and ip6_tables kernel module (bsc#1214612) * Required for rootless mode as a regular user has no permission to load kernel modules ------------------------------------------------------------------ ------------------ 2024-10-16 - Oct 16 2024 ------------------- ------------------------------------------------------------------ ++++ docker: - Further merge docker and docker-stable specfiles to minimise the differences. The main thing is that we now include both halves of the Conflicts/Provides/Obsoletes dance in both specfiles. - Update to docker-buildx v0.17.1 to match standalone docker-buildx package we are replacing. See upstream changelog online at ++++ docker-stable: - Further merge docker and docker-stable specfiles to minimise the differences. The main thing is that we now include both halves of the Conflicts/Provides/Obsoletes dance in both specfiles. - Update to docker-buildx v0.17.1 to match standalone docker-buildx package we are replacing. See upstream changelog online at ------------------------------------------------------------------ ------------------ 2024-10-15 - Oct 15 2024 ------------------- ------------------------------------------------------------------ ++++ buildah: - Add patch for CVE-2024-9675 (bsc#1231499): * 0003-Properly-validate-cache-IDs-and-sources.patch - Rebase patches: * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch ++++ kubevirt: - Enable aarch64 build for SLE and mark it as techpreview (jsc#PED-10545) ++++ podman: - Add patch for CVE-2024-9675 (bsc#1231499): * 0004-Properly-validate-cache-IDs-and-sources.patch - Add patch for CVE-2024-9407 (bsc#1231208): * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch ------------------------------------------------------------------ ------------------ 2024-10-14 - Oct 14 2024 ------------------- ------------------------------------------------------------------ ++++ kubernetes-old: - Update to version 1.28.14: * Release commit for Kubernetes v1.28.14 * succeeded pod is being re-admitted * Build etcd image of v3.5.15 * Update etcd from v3.5.14 to v3.5.15 * add missing RBAC to statefulset-controller for StatefulSetAutoDeletePVC feature * Bump images, dependencies and versions to go 1.22.6 and distroless iptables * Add a new workqueue to endpointslice controller for updating topology cache and checking node topology distribution. * fix a scheduler preemption issue that victim is not patched properly * kube-proxy: initialization wait for service and endpoint handlers synced - Update .spec file to bump go version build requirements: * `BuildRequires: go >= 1.22.6` * ref: https://github.com/kubernetes/kubernetes/blob/v1.28.14/build/dependencies.yaml#L115-L117 ------------------------------------------------------------------ ------------------ 2024-10-11 - Oct 11 2024 ------------------- ------------------------------------------------------------------ ++++ helm: - Update to version 3.16.2: * Revering change unrelated to issue #13176 * adds tests for handling of Helm index with broken chart versions #13176 * improves handling of Helm index with broken helm chart versions [#13176] * Bump the k8s-io group with 7 updates * adding check-latest:true * Grammar fixes * Fix typos ++++ open-vm-tools: - convert to obs_scm - update to 12.5.0 (boo#1231826): There are no new features in the open-vm-tools 12.5.0 release. This is primarily a maintenance release that addresses a few critical problems, including: * A Github pull request has been integrated. Please see the Resolved Issues section of the Release Notes. * For a more complete list of issues resolved in this release, see the Resolved Issues section of the Release Notes. For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.5.0 Release Notes are available at: https://github.com/vmware/open-vm-tools/blob/stable-12.5.0/ReleaseNotes.md The granular changes that have gone into the 12.5.0 release are in the ChangeLog at: https://github.com/vmware/open-vm-tools/blob/stable-12.5.0/open-vm-tools/ChangeLog ------------------------------------------------------------------ ------------------ 2024-10-3 - Oct 3 2024 ------------------- ------------------------------------------------------------------ ++++ podman: - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch ------------------------------------------------------------------ ------------------ 2024-10-2 - Oct 2 2024 ------------------- ------------------------------------------------------------------ ++++ buildah: - Add patches for CVE-2024-9407 and CVE-2024-9341: * 0001-CVE-2024-9407-validate-bind-propagation-flag-setting.patch (bsc#1231208 aka CVE-2024-9407) * 0002-conmon-pkg-subscriptions-use-securejoin-for-the-cont.patch (bsc#1231230 aka CVE-2024-9341) ------------------------------------------------------------------ ------------------ 2024-9-24 - Sep 24 2024 ------------------- ------------------------------------------------------------------ ++++ kubernetes: - Update to version 1.30.5: * Restart the init container to not be stuck in created state * succeeded pod is being re-admitted * Avoid SidecarContainers code path for non-sidecar pods * Build etcd image of v3.5.15 * Update etcd from v3.5.14 to v3.5.15 * add missing RBAC to statefulset-controller for StatefulSetAutoDeletePVC feature * Bump images, dependencies and versions to go 1.22.6 and distroless iptables * Fix openapi-gen dependency. * update coredns/corefile-migration to v1.0.24 to support coredns v1.11.3 * kubeadm: bump coredns to 1.11.3 * kube-up.sh: bump coreDNS to 1.11.3 * Add a new workqueue to endpointslice controller for updating topology cache and checking node topology distribution. * fix a scheduler preemption issue that victim is not patched properly * kube-proxy: initialization wait for service and endpoint handlers synced * make PodIP.IP and HostIP.IP required. - Update .spec file to bump go version build requirements: * `BuildRequires: go >= 1.22.6` * ref: https://github.com/kubernetes/kubernetes/blob/v1.30.5/build/dependencies.yaml#L117-L119 ------------------------------------------------------------------ ------------------ 2024-9-18 - Sep 18 2024 ------------------- ------------------------------------------------------------------ ++++ docker: - Add %{_sysconfdir}/audit/rules.d to filelist. ------------------------------------------------------------------ ------------------ 2024-9-14 - Sep 14 2024 ------------------- ------------------------------------------------------------------ ++++ helm: - Update to version 3.16.1: * bumping version to 1.22.7 * Merge pull request #13327 from mattfarina/revert-11726 - Update to version 3.16.0: Helm v3.16.0 is a feature release. Users are encouraged to upgrade for the best experience. * Notable Changes - added sha512sum template function - added ActiveHelp for cmds that don't take any more args - drops very old Kubernetes versions support in helm create - add --skip-schema-validation flag to helm 'install', 'upgrade' and 'lint' - fixed bug to now use burst limit setting for discovery - Added windows arm64 support * Full changelog see https://github.com/helm/helm/releases/tag/v3.16.0 ------------------------------------------------------------------ ------------------ 2024-9-11 - Sep 11 2024 ------------------- ------------------------------------------------------------------ ++++ containerd: - Update to containerd v1.7.22. Upstream release notes: - Bump minimum Go version to 1.22. - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch ------------------------------------------------------------------ ------------------ 2024-9-7 - Sep 7 2024 ------------------- ------------------------------------------------------------------ ++++ docker: - Mark docker-buildx as required since classic "docker build" has been deprecated since Docker 23.0. bsc#1230331 - Import docker-buildx v0.16.2 as a subpackage. Previously this was a separate package, but with docker-stable it will be necessary to maintain the packages together and it makes more sense to have them live in the same OBS package. bsc#1230333 - Make some minor name macro updates to help with the docker-stable package fork. ++++ docker-stable: - Import specfile changes for docker-buildx as well as the changes to help reduce specfile differences between docker-stable and docker. bsc#1230331 bsc#1230333 ------------------------------------------------------------------ ------------------ 2024-9-5 - Sep 5 2024 ------------------- ------------------------------------------------------------------ ++++ containerd: - Update to containerd v1.7.21. Upstream release notes: Fixes CVE-2023-47108. bsc#1217070 Fixes CVE-2023-45142. bsc#1228553 - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch ------------------------------------------------------------------ ------------------ 2024-8-26 - Aug 26 2024 ------------------- ------------------------------------------------------------------ ++++ kubevirt: - Update to version 1.3.1 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.3.1 - Fix DV error report via VM printable status 0001-Consider-the-new-DV-reason-ImagePullFailed.patch - Fix permission error in storage migration tests 0002-tests-Set-FSGroup-to-ensure-proper-permissions.patch ------------------------------------------------------------------ ------------------ 2024-8-16 - Aug 16 2024 ------------------- ------------------------------------------------------------------ ++++ kubernetes-old: - Update to version 1.28.13: * Respect controllers on PVCs for retention policy * Updating kubelet on Windows to query uuid from registry * Update err message before ratcheting enabled. * Hot fix for panic on schema conversion. * update container ubuntu sha256 * update driver installer * mount-utils: treat syscall.ENODEV as corrupted mount * api: fix ValidatingAdmissionPolicyList json tag * apiserver: fix watch namespace * Fix that PodIP field is not set for terminal pod * Use omitempty for optional fields in Job Pod Failure Policy * bugfix: dont skip reconcile for unchanged policy if last sync failed ++++ kubernetes: - Update to version 1.30.4: * Updating kubelet on Windows to query uuid from registry * Move APIServingWithRoutine to alpha and disabled by default. * kubeadm: Add '--yes' flag to the list of allowed flags * Terminate restartable init containers ignoring not-started containers * Hot fix for panic on schema conversion. * moving for easier cherry-pick * Falls back to SPDY for gorilla/websocket https proxy error * kubeadm: fix join bug where kubeletconfig was not patched in memory * mount-utils: treat syscall.ENODEV as corrupted mount * apiserver: fix watch namespace * api: fix ValidatingAdmissionPolicyList json tag * Fix that PodIP field is not set for terminal pod * Use omitempty for optional fields in Job Pod Failure Policy * Fixed metrics missing issue for metrics reference page * kubeadm: fix a bug in v1beta3.JoinConfiguration.Discovery.Timeout * Respect controllers on PVCs for retention policy ------------------------------------------------------------------ ------------------ 2024-8-14 - Aug 14 2024 ------------------- ------------------------------------------------------------------ ++++ docker-stable: - Backport patch for CVE-2024-41110. bsc#1228324 + 0009-CVE-2024-41110-AuthZ-plugin-securty-fixes.patch ++++ helm: - Update to version 3.15.4: * Bump the k8s-io group across 1 directory with 7 updates * Bump github.com/docker/docker ------------------------------------------------------------------ ------------------ 2024-8-6 - Aug 6 2024 ------------------- ------------------------------------------------------------------ ++++ kubernetes-old: - Follow up changes after go version bump to 1.22: - For ppc64le platform: disabled `export GOLDFLAGS='-linkmode=external'`. * to fix the build failure error: `-linkmode=external requires external (cgo) linking, but cgo is not enabled` - For linux/s390x platform: disabled building kubernetes binaries with `-buildmode=pie` * `-buildmode=pie` with "internal linking" is not yet supported on linux/s390x platform * ref: https://github.com/golang/go/blob/a63907808d14679c723e566cb83acc76fc8cafc2/src/internal/platform/supported.go#L223-L232 * ref: https://github.com/golang/go/issues/64875#issuecomment-1870734528 - Update to version 1.28.12: * Add funcs in pkg/filesystem/util that can actually set file permissiosn on Windows and update container log dir perms to 660 on Windows * Mark a test case which sets up a sample-apiserver as serial due to potential conflicts with other test cases which do the same. * Fix pv reclaim failed due to its phase is wrongly updated to the Failed state by kcm * fix issue with using feature HonorPVReclaimPolicy in csi-provisioner * defaultMaskedPaths must be kept in sync with moby/moby. * gitRepo volume: directory must be max 1 level deep * Bump images, dependencies and versions to go 1.22.5 and distroless iptables * Fix endpoints status out-of-sync when the pod state changes rapidly * Fix verify target to not update env var if already set * fix: skip isPodWorthRequeuing only when SchedulingGates gates the pod - Update .spec file to bump go version build requirements: * `BuildRequires: go >= 1.22.5` * `BuildRequires: golang(API) = 1.22` * ref: https://github.com/kubernetes/kubernetes/blob/v1.28.12/build/dependencies.yaml#L115-L117 ++++ kubernetes: - Update to version 1.30.3: * Add funcs in pkg/filesystem/util that can actually set file permissiosn on Windows and update container log dir perms to 660 on Windows * Fix pv reclaim failed due to its phase is wrongly updated to the Failed state by kcm * Mark a test case which sets up a sample-apiserver as serial due to potential conflicts with other test cases which do the same. * defaultMaskedPaths must be kept in sync with moby/moby. * gitRepo volume: directory must be max 1 level deep * Bump images, dependencies and versions to go 1.22.5 and distroless iptables * Fix endpoints status out-of-sync when the pod state changes rapidly * fix: skip isPodWorthRequeuing only when SchedulingGates gates the pod * Clean up the featureGates during the matchSuccessPolicy unit tests * Initialize terminating field in the Job controller unit tests * Job: Fix a bug that the SuccessCriteriaMet condition is added to the Job with successPolicy even if the JobSuccessPolicy featureGate is disabled - Update .spec file to bump go version build requirements: * `BuildRequires: go >= 1.22.5` * ref: https://github.com/kubernetes/kubernetes/blob/v1.30.3/build/dependencies.yaml#L117-L119 ------------------------------------------------------------------ ------------------ 2024-7-31 - Jul 31 2024 ------------------- ------------------------------------------------------------------ ++++ docker: - Update to Docker 26.1.5-ce. See upstream changelog online at bsc#1230294 - This update includes fixes for: * CVE-2024-41110. bsc#1228324 * CVE-2023-47108. bsc#1217070 * CVE-2023-45142. bsc#1228553 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch * cli-0001-docs-include-required-tools-in-source-tree.patch [NOTE: This update was only ever released in SLES and Leap.] - Update to Docker 25.0.6-ce. See upstream changelog online at - This update includes fixes for: * CVE-2024-41110. bsc#1228324 * CVE-2023-47108. bsc#1217070 bsc#1229806 * CVE-2023-45142. bsc#1228553 bsc#1229806 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch ------------------------------------------------------------------ ------------------ 2024-7-19 - Jul 19 2024 ------------------- ------------------------------------------------------------------ ++++ containerized-data-importer: - Add registry path for SLE15 SP7 ++++ kubevirt: - Update to version 1.3.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.3.0 - Drop upstreamed patch 0001-Collect-component-Role-rules-under-operator-Role-ins.patch - Add registry path for SLE15 SP7 ------------------------------------------------------------------ ------------------ 2024-7-11 - Jul 11 2024 ------------------- ------------------------------------------------------------------ ++++ helm: - Update to version 3.15.3: * fix(helm): Use burst limit setting for discovery * fixed dependency_update_test.go * fix(dependencyBuild): prevent race condition in concurrent helm dependency * fix: respect proxy envvars on helm install/upgrade * Merge pull request #13085 from alex-kattathra-johnson/issue-12961 ------------------------------------------------------------------ ------------------ 2024-7-8 - Jul 8 2024 ------------------- ------------------------------------------------------------------ ++++ kubevirt: - Update to version 1.2.2 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.2.2 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.2.1 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.2.0 - Drop patches 0001-tests-Adapt-VM-phase-expectation.patch 0002-Update-tls-error-string-in-migration-test.patch 0003-tests-Expect-PendingPopulation-phase.patch 0004-Improve-the-handling-of-ordinal-pod-interface-name-for-upgrade.patch 0005-Collect-component-Role-rules-under-operator-Role-ins.patch - Add patch 0001-Collect-component-Role-rules-under-operator-Role-ins.patch - Pack configuration files for libvirt ------------------------------------------------------------------ ------------------ 2024-7-1 - Jul 1 2024 ------------------- ------------------------------------------------------------------ ++++ open-vm-tools: - Update to 12.4.5 (build 23787635) (boo#1227181) - There are no new features in the open-vm-tools 12.4.5 release. This is primarily a maintenance release that addresses a few critical problems, including: - A Github pull request and associated issue has been handled. Please see the Resolved Issues section of the Release Notes. - A number of issues flagged by Coverity and ShellCheck have been addressed. - A vmtoolsd process hang related to nested logging from an RPC Channel error has been fixed. For a more complete list of issues resolved in this release, see the Resolved Issues section of the Release Notes. For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.4.5 Release Notes are available at: https://github.com/vmware/open-vm-tools/blob/stable-12.4.5/ReleaseNotes.md The granular changes that have gone into the 12.4.5 release are in the ChangeLog at: https://github.com/vmware/open-vm-tools/blob/stable-12.4.5/open-vm-tools/ChangeLog ++++ podman: - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man ------------------------------------------------------------------ ------------------ 2024-6-26 - Jun 26 2024 ------------------- ------------------------------------------------------------------ ++++ kubernetes-old: - Update to version 1.28.11: * Bump images, dependencies and versions to go 1.21.11 and distroless iptables/setcap/debian-base * Don't fill in NodeToStatusMap with UnschedulableAndUnresolvable * Revert "scheduler: preallocation for NodeToStatusMap" * add an integration test when nodeAffinity specifies a non-existent node. * base on allNodes when calculating nextStartNodeIndex * backport verify-govulncheck.sh to 1.28 * Don't sort under lock * Fix printPod panic with spurious container statuses * Cherry pick #124618 to 1.28 * Fix NFS related issues on GCP/Ubuntu * fix requests tracker concurrency * fix conflict race in statefulset rest update * fix stateful set pod recreation and event spam * fix pods tracking and internal error checking in statefulset tests * Updated & added visibility to apiserver x509 test certificates expiring this year ++++ kubernetes: - Update to version 1.30.2: * Bump images, dependencies and versions to go 1.22.4 and distroless iptables/setcap/debian-base * update driver installer * Don't fill in NodeToStatusMap with UnschedulableAndUnresolvable * Revert "scheduler: preallocation for NodeToStatusMap" * kubeadm: use the actual configured kubelet healthz address:port * kubectl create cronjobs: Manually set OwnerReferences * add an integration test when nodeAffinity specifies a non-existent node. * base on allNodes when calculating nextStartNodeIndex * Fix printPod panic with spurious container statuses * Adding the feature gates to fix cost for VAP and webhook matchConditions. * cherry pick #124618 to 1.30 * fix requests tracker concurrency * fix conflict race in statefulset rest update * fix stateful set pod recreation and event spam * fix pods tracking and internal error checking in statefulset tests * Updated & added visibility to apiserver x509 test certificates expiring this year ------------------------------------------------------------------ ------------------ 2024-6-24 - Jun 24 2024 ------------------- ------------------------------------------------------------------ ++++ containerd: - Revert noarch for devel subpackage for SLE 15 Switching to noarch causes issues on SLES maintenance updates, reverting it fixes our image builds ++++ docker: - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - Fix BuildKit's symlink resolution logic to correctly handle non-lexical symlinks. Backport of and . bsc#1221916 + 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch - Write volume options atomically so sudden system crashes won't result in future Docker starts failing due to empty files. Backport of . bsc#1214855 + 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch ------------------------------------------------------------------ ------------------ 2024-6-20 - Jun 20 2024 ------------------- ------------------------------------------------------------------ ++++ kubevirt: - Collect component Role rules under operator Role instead of ClusterRole (bsc#1223965, CVE-2024-33394) 0005-Collect-component-Role-rules-under-operator-Role-ins.patch ------------------------------------------------------------------ ------------------ 2024-6-16 - Jun 16 2024 ------------------- ------------------------------------------------------------------ ++++ docker-stable: - Initial docker-stable release, forked from Docker 24.0.6-ce release (packaged on 2023-10-11). - Update to Docker 24.0.9-ce, which is the latest version of the 24.0.x branch. It seems likely this will be the last upstream version of the 24.0.x branch (it seems Mirantis is going to do LTS for 23.0.x, not 24.0.x). - Fix BuildKit's symlink resolution logic to correctly handle non-lexical symlinks. Backport of and . bsc#1221916 + 0007-bsc1221916-update-to-patched-buildkit-version-to-fix.patch - Write volume options atomically so sudden system crashes won't result in future Docker starts failing due to empty files. Backport of . bsc#1214855 + 0008-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch ------------------------------------------------------------------ ------------------ 2024-6-13 - Jun 13 2024 ------------------- ------------------------------------------------------------------ ++++ helm: - Update to version 3.15.2: * fix: wrong cli description * fix typo in load_plugins.go * fix docs of DeployedAll * Bump github.com/docker/docker * bump oras minor version * feat(load.go): add warning on requirements.lock ------------------------------------------------------------------ ------------------ 2024-6-7 - Jun 7 2024 ------------------- ------------------------------------------------------------------ ++++ obs-service-docker_label_helper: - Support Docker.FLAVOR in _multibuild (boo#1225985) ++++ podman: - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev ------------------------------------------------------------------ ------------------ 2024-6-6 - Jun 6 2024 ------------------- ------------------------------------------------------------------ ++++ docker: - Update to Docker 26.1.4-ce. See upstream changelog online at - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch ------------------------------------------------------------------ ------------------ 2024-6-3 - Jun 3 2024 ------------------- ------------------------------------------------------------------ ++++ aardvark-dns: - Remove redundant source: cargo_config - Update to version 1.11.0: * Release v1.11.0 * v1.11.0 release notes * run cargo update * chore(deps): update dependency containers/automation_images to v20240529 * Internal networks cannot make external DNS requests * fix(deps): update rust crate anyhow to 1.0.86 * fix(deps): update rust crate nix to 0.29.0 * [skip-ci] RPM: use default __cargo macro across all envs * chore(deps): update dependency containers/automation_images to v20240513 * fix(deps): update rust crate anyhow to 1.0.83 * [skip-ci] Packit: separate `packages` key for rhel jobs * fix(deps): update rust crate libc to 0.2.154 * [skip-ci] Packit: enable rhel10, c10s tests and c10s downstream sync * [skip-ci] Packit: Remove EL8 jobs * fix(deps): update rust crate syslog to ^6.1.1 * fix reverse ipv6 lookup test flake * fix(deps): update hickory-dns monorepo to 0.24.1 * chore(deps): update rust crate chrono to 0.4.38 * Don't tear down all server threads on SIGHUP (bsc#1224167) * fix(deps): update rust crate anyhow to 1.0.82 * fix(deps): update rust crate tokio to 1.37.0 * Update to nix-0.28.0 * update chrono package * chore(deps): update dependency containers/automation_images to v20240320 * fix(deps): update rust crate anyhow to 1.0.81 * tests: check queried domain name in reverse lookup tests * fix: set name for answers in reverse lookups * chore: fix typo in runner script * chore: fix log message when doing reverse lookup * fix(deps): update rust crate log to 0.4.21 * fix(deps): update rust crate anyhow to 1.0.80 * chore(deps): update rust crate chrono to 0.4.34 * fix(deps): update rust crate async-broadcast to 0.7.0 * fix(deps): update rust crate tokio to 1.36.0 * [CI:DOCS] Packit: disable bodhi tasks * chore(deps): update rust crate chrono to 0.4.33 * Bump to 1.11.0-dev ++++ netavark: - Remove redundant source: cargo_config - Update to version 1.11.0: * Release v1.11.0 * Update release notes for 1.11.0 * update netlink-packet-route to 0.20.0 * run cargo update * fix: remove extra / in make install and uninstall * chore(deps): update dependency containers/automation_images to v20240529 * fix(deps): update rust crate nix to 0.29.0 * fix(deps): update rust crate nispor to 1.2.19 * fix(deps): update rust crate anyhow to 1.0.86 * fix(deps): update rust crate anyhow to 1.0.85 * [skip-ci] Packit: do not create dup jobs on podman-next * fix(deps): update rust crate anyhow to 1.0.84 * [skip-ci] RPM: use default __cargo macro across all envs * [skip-ci] RPM: switch default firewall to nftables on EL10+ * chore(deps): update dependency containers/automation_images to v20240513 * Add conditional compilation of default firewall driver * fix(deps): update rust crate serde_json to 1.0.117 * fix new clippy warnings * Update CI image to fedora 40 * fix ncat sctp tests * fix(deps): update rust crate anyhow to 1.0.83 * build(deps): bump h2 from 0.3.25 to 0.3.26 * [skip-ci] Packit: distinct `-rhel` packages value * [skip-ci] Packit: enable c10s downstream sync * fix(deps): update rust crate libc to 0.2.154 * fix(deps): update rust crate ipnet to 2.9.0 * fix(deps): update rust crate tower to 0.4.13 * fix(deps): update rust crate tokio-stream to 0.1.15 * fix(deps): update rust crate prost to 0.12.4 * fix(deps): update rust crate iptables to 0.5.1 * [skip-ci] Packit: remove el8 jobs * fix(deps): update rust crate anyhow to 1.0.82 * fix(deps): update rust crate serde to 1.0.199 * Add suffix to Aardvark internal network filenames * fix port forward with strict RPF and multi networks * renovate: stop rebasing PRs automatically * chore(deps): update rust crate chrono to 0.4.38 * fix(deps): update rust crate serde_json to 1.0.116 * fix(deps): update rust crate netlink-sys to 0.8.6 * nftables: only dump netavark table rules * update nftables to 0.4 * fix aardvark-dns netns check * fix(deps): update rust crate tokio to 1.37 * fix(deps): update rust crate netlink-packet-route to 0.19.0 * Update to nix-0.28.0 * fix(deps): update rust crate mozim to 0.2.3 * fix(deps): update rust crate nispor to 1.2.18 * Update chrono * fix(deps): update rust crate serde_json to 1.0.115 * build(deps): bump mio from 0.8.9 to 0.8.11 * [skip-ci] rpm: aardvark-dns is a hard dep across the board * Update Rust crate env_logger to 0.11.3 * Update Rust crate serde to 1.0.197 * Update Rust crate tempfile to 3.10.1 * Update Rust crate log to 0.4.21 * Update Rust crate zbus to 3.15.2 * Update Rust crate serde_json to 1.0.114 * Update Rust crate env_logger to 0.11.2 * Update Rust crate chrono to 0.4.34 * Update Rust crate tonic-build to 0.11 * Update Rust crate tonic to 0.11 * fix netavark update to not start a new aardvark-dns * Update Rust crate tempfile to 3.10.0 * Update Rust crate zbus to 3.15.0 * Update Rust crate tokio to 1.36 * Update Rust crate chrono to 0.4.33 * Do not perform network namespace detection on AV update * [CI:BUILD] Packit/rpm: fix aardvark-dns handling * Update Rust crate serde_json to 1.0.113 * Update Rust crate serde_json to 1.0.112 * Update Rust crate env_logger to 0.11.1 * update README with nftables support * Bump to v1.11.0-dev * perf-netavark: accept fw driver as argument * perf-netavark: fix missing --config arg ------------------------------------------------------------------ ------------------ 2024-5-23 - May 23 2024 ------------------- ------------------------------------------------------------------ ++++ helm: - Update to version 3.15.1: * Fixing build issue where wrong version is used ------------------------------------------------------------------ ------------------ 2024-5-22 - May 22 2024 ------------------- ------------------------------------------------------------------ ++++ containerd: - Update to containerd v1.7.17. Upstream release notes: - Switch back to using tar_scm service. Aside from obs_scm using more bandwidth and storage than a locally-compressed tar.xz, it seems there's some weird issue with paths in obscpio that break our SLE-12-only patch. - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.16. Upstream release notes: CVE-2023-45288 bsc#1221400 ------------------------------------------------------------------ ------------------ 2024-5-18 - May 18 2024 ------------------- ------------------------------------------------------------------ ++++ helm: - Update to version 3.15.0 (bsc#1220207, CVE-2024-26147, bsc#1219969, CVE-2024-25620): - obsoletes CVE-2024-26147.patch in older distributions - obsoletes CVE-2024-25620.patch in odler distributions Helm v3.15.0 is a feature release. Users are encouraged to upgrade for the best experience. * Updating to k8s 1.30 c4e37b3 (Matt Farina) * bump version to v3.15.0 d7afa3b (Matt Farina) * bump version to 7743467 (Matt Farina) * Fix namespace on kubeconfig error 214fb6e (Calvin Krist) * Update testdata PKI with keys that have validity until 3393 (Fixes #12880) 1b75d48 (Dirk Müller) * chore(deps): bump golang.org/x/net from 0.17.0 to 0.23.0 dac23c8 (dependabot[bot]) * chore(deps): bump github/codeql-action from 3.24.7 to 3.24.10 167d576 (dependabot[bot]) * chore: remove repetitive words dd37787 (deterclosed) * Modified how created annotation is populated based on package creation time 0a69a0d (Andrew Block) * chore(deps): bump github.com/docker/docker aaaf112 (dependabot[bot]) * chore(deps): bump google.golang.org/protobuf from 1.31.0 to 1.33.0 7f53529 (dependabot[bot]) * Enabling hide secrets on install and upgrade dry run 25c4738 (Matt Farina) * chore(deps): bump github/codeql-action from 3.24.6 to 3.24.7 ff94e93 (dependabot[bot]) * Fixing all the linting errors d58d7b3 (Robert Sirchia) * Add a note about --dry-run displaying secrets a23dd9e (Matt Farina) * chore(deps): bump golang.org/x/term from 0.15.0 to 0.18.0 275f2ab (dependabot[bot]) * Updating .gitignore 8b424ba (Robert Sirchia) * chore(deps): bump github/codeql-action from 3.24.5 to 3.24.6 e22d881 (dependabot[bot]) * chore(deps): bump github/codeql-action from 3.24.3 to 3.24.5 4f200fa (dependabot[bot]) * Some fixes 764557c (Matt Farina) * chore(deps): bump github/codeql-action from 3.23.1 to 3.24.3 5bc97b9 (dependabot[bot]) * chore(deps): bump golangci/golangci-lint-action from 3.7.0 to 4.0.0 e6db0ec (dependabot[bot]) * add error messages 8d19bcb (George Jenkins) * Fix: Ignore alias validation error for index load 68294fd (George Jenkins) * validation fix 8e6a514 (Matt Farina) * bug: add proxy support for oci getter 94c1dea (Ricardo Maraschini) * chore(deps): bump actions/setup-go from 4.1.0 to 5.0.0 cbab6d6 (dependabot[bot]) * chore(deps): bump github/codeql-action from 3.23.0 to 3.23.1 de332ae (dependabot[bot]) * chore(deps): bump github.com/containerd/containerd from 1.7.11 to 1.7.12 a2dd34b (dependabot[bot]) * Update architecture detection method 57a1bb8 (weidongkl) * chore(deps): bump github/codeql-action from 3.22.11 to 3.23.0 8cab7c1 (dependabot[bot]) * chore(deps): bump github.com/DATA-DOG/go-sqlmock from 1.5.0 to 1.5.2 5f9533f (dependabot[bot]) * Improve release action 4790bb9 (George Jenkins) * chore(deps): bump actions/setup-go from 4.1.0 to 5.0.0 f980ad3 (dependabot[bot]) * Fix grammatical error c25736c (Matt Carr) * Updated for review comments d2cf8c6 (MichaelMorris) * Add robustness to wait status checks fc74964 (MichaelMorris) * refactor: create a helper for checking if a release is uninstalled f908379 (Alex Petrov) * fix: reinstall previously uninstalled chart with --keep-history 9e198fa (Alex Petrov) ------------------------------------------------------------------ ------------------ 2024-5-17 - May 17 2024 ------------------- ------------------------------------------------------------------ ++++ kubernetes-old: - Update to version 1.28.10: * scheduler: preallocation for NodeToStatusMap * add e2e test when a plugin (in-tree or out-of-tree) return non-existent/illegal nodes, the pod should be scheduled normally if suitable nodes exists * test to catch illegal nodeNames returned by PreFilterResult * add integration test for pod with pvc has node-affinity to non-existent/existent nodes * hotfix when a plugin (in-tree or out-of-tree) return non-existent/illegal nodes, the pod scheduling flow will abort immediately. * Fix PersistentVolumeLabel admission plugin on Azure * cluster/gce: upgrade cos-97-lts -> cos-109-lts * storage e2e: update hostpath and mock images * add log verbosity to endpoint topology hint loop. * Rename `cluster` to `storage_cluster_id` for apiserver_storage_size_bytes metric * gce: fix test for non-existing instance in cloud * cloud-node-lifecycle controller: add fallback for empty providerID in shutdown ++++ kubernetes: - Update to version 1.30.1: * Clean up PersistentVolumeLabel admission plugin * scheduler: preallocation for NodeToStatusMap * tag service.spec.TrafficDistribution field as alpha * tag TrafficDistribution tests to avoid running on clusters without the feature enabled * fix(api): make LocalObjectReference.Name and HostAlias.IP required (#124553) * kubeadm: check for available nodes during 'CreateJob' preflight * Idempotent transformers in scheduler & kcm * kubeadm: fix bug of kubeletconfig not being downloaded on upgrade * e2e framework: configure Ginkgo logger and klog consistently * e2e node: fix -v support * Update applyconfig-gen for pacakges where group and dir differ in name * kube_codegen: expose applyconfig-openapi-schema flag for client generation ------------------------------------------------------------------ ------------------ 2024-5-14 - May 14 2024 ------------------- ------------------------------------------------------------------ ++++ containerized-data-importer: - Bump github.com/containers/image/v5 (bsc#1224119, CVE-2024-3727) 0001-Bump-github.com-containers-image-v5-to-v5.30.1.patch ------------------------------------------------------------------ ------------------ 2024-5-10 - May 10 2024 ------------------- ------------------------------------------------------------------ ++++ buildah: - Update to version 1.35.4: * [release-1.35] Bump to Buildah v1.35.4 * [release-1.35] CVE-2024-3727 updates (bsc#1224117) * integration test: handle new labels in "bud and test --unsetlabel" * [release-1.35] Bump go-jose CVE-2024-28180 * [release-1.35] Bump ocicrypt and go-jose CVE-2024-28180 ------------------------------------------------------------------ ------------------ 2024-4-24 - Apr 24 2024 ------------------- ------------------------------------------------------------------ ++++ docker: - Update to Docker 26.1.0-ce. See upstream changelog online at - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch ------------------------------------------------------------------ ------------------ 2024-4-21 - Apr 21 2024 ------------------- ------------------------------------------------------------------ ++++ containerd: - Use obs_scm service instead of tar_scm - Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch (merged upstream at ) - Update to containerd v1.7.15. Upstream release notes: - Update to containerd v1.7.14. Upstream release notes: - Update to containerd v1.7.13. Upstream release notes: - Update to containerd v1.7.12. Upstream release notes: - Update to containerd v1.7.11. Upstream release notes: GHSA-jq35-85cj-fj4p bsc#1224323 ------------------------------------------------------------------ ------------------ 2024-4-19 - Apr 19 2024 ------------------- ------------------------------------------------------------------ ++++ kubernetes: - For linux/s390x platform: disabled building kubernetes binaries with `-buildmode=pie` * `-buildmode=pie` with "internal linking" is not yet supported on linux/s390x platform * ref: https://github.com/golang/go/blob/a63907808d14679c723e566cb83acc76fc8cafc2/src/internal/platform/supported.go#L223-L232 * ref: https://github.com/golang/go/issues/64875#issuecomment-1870734528 ------------------------------------------------------------------ ------------------ 2024-4-18 - Apr 18 2024 ------------------- ------------------------------------------------------------------ ++++ docker: - Update to Docker 26.0.1-ce. See upstream changelog online at - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Update --add-runtime to point to correct binary path. ++++ kubernetes-old: - Update to version 1.28.9: * Add envFrom to serviceaccount admission plugin * update debian-base to bookworm-v1.0.2 * [go] Bump images, dependencies and versions to go 1.22.1 and distroless iptables / set-cap * [CVE-2023-45288] .*: bump x/net to v0.23.0, bsc#1229869 * Use the right feature gate when updating uncertain volumes * fix panic with SIGSEGV in kubeadm certs check-expiration * hack/tools: bump honnef.co/go/tools to v0.4.6 * Serve watch without resourceVersion from cache and introduce a WatchFromStorageWithoutResourceVersion feature gate to allow serving watch from storage. * fix aggregator path filtering to include / * Filter aggregated apiservice gv * Use DBG=1 for conformance verification * build: use -trimpath in non-DBG mode - Update .spec file to bump go version build requirements: * `BuildRequires: go >= 1.21.9` * ref: https://github.com/kubernetes/kubernetes/blob/v1.28.9/build/dependencies.yaml#L115-L117 ++++ kubernetes: - initial package for Kubernetes v1.30.0 * Full changelog - https://github.com/kubernetes/kubernetes/blob/v1.30.0/CHANGELOG/CHANGELOG-1.30.md ------------------------------------------------------------------ ------------------ 2024-4-12 - Apr 12 2024 ------------------- ------------------------------------------------------------------ ++++ kubevirt: - Improve the OrdinalPodInterfaceName mechanism (bsc#1222699) 0004-Improve-the-handling-of-ordinal-pod-interface-name-for-upgrade.patch ------------------------------------------------------------------ ------------------ 2024-4-10 - Apr 10 2024 ------------------- ------------------------------------------------------------------ ++++ helm: - Update to version 3.14.4: Helm v3.14.4 is a patch release. Users are encouraged to upgrade for the best experience. Users are encouraged to upgrade for the best experience. * refactor: create a helper for checking if a release is uninstalled 81c902a (Alex Petrov) * fix: reinstall previously uninstalled chart with --keep-history 5a11c76 (Alex Petrov) * chore: remove repetitive words fb3d880 (deterclosed) * chore(deps): bump google.golang.org/protobuf from 1.31.0 to 1.33.0 01ac4a2 (dependabot[bot]) * chore(deps): bump github.com/docker/docker 138602d (dependabot[bot]) * bug: add proxy support for oci getter aa7d953 (Ricardo Maraschini) ------------------------------------------------------------------ ------------------ 2024-4-8 - Apr 8 2024 ------------------- ------------------------------------------------------------------ ++++ kubernetes-old: - update .spec file to set FORCE_HOST_GO env variable, to force k8s build scripts use the local GOTOOLCHAIN version from the build pipeline (i.e. GOTOOLCHAIN='local') * ref: https://github.com/kubernetes/kubernetes/blob/9791f0d1f39f3f1e0796add7833c1059325d5098/hack/lib/golang.sh#L507 - Update to version 1.28.8: * remove --v arg from kubetest2-tester-ginkgo test args * ci: bump kind to latest for kms jobs * [go] Bump images, dependencies and versions to go 1.21.8 / distroless-iptables to v0.4.6 * [CVE-2024-24786] Bump github.com/golang/protobuf v1.5.4, google.golang.org/protobuf v1.33.0, bsc#1229867 * keep existing PDB conditions when updating status * Validate restartable init container state transition * Test that separation of streams work by using progress notifies * Prevent watch cache starvation, by moving its watch to separate RPC and add a SeparateCacheWatchRPC feature flag to disable this behavior * fix UT failure TestPrintIPAddressList * Fix race condition between external-resizer and kubelet * codegen: don't nuke files if only verifying * dra: increase timeout in setupFakeDRADriverGRPCServer to prevent tests to flake. * e2e_node: replace `registry.k8s.io/stress:v1` with agnhost * promote agnhost to v2.47 * fixing issue with GetCPUUsageNanoCores on Windows * Fix cleanup of file subpaths * etcd: Update to version 3.5.12 * build etcd image v3.5.12 - Update .spec file to bump go version build requirements: * `BuildRequires: go >= 1.21.8` * ref: https://github.com/kubernetes/kubernetes/blob/v1.28.8/build/dependencies.yaml#L115-L117 ------------------------------------------------------------------ ------------------ 2024-4-3 - Apr 3 2024 ------------------- ------------------------------------------------------------------ ++++ kubevirt: - Fix test of secure migration with TLS (bsc#1221431) 0002-Update-tls-error-string-in-migration-test.patch - Fix volume phase condition in migration test (bsc#1221430) 0003-tests-Expect-PendingPopulation-phase.patch ------------------------------------------------------------------ ------------------ 2024-4-2 - Apr 2 2024 ------------------- ------------------------------------------------------------------ ++++ buildah: - Update to version 1.35.3: * [release-1.35] Bump to Buildah v1.35.3 * [release-1.35] correctly configure /etc/hosts and resolv.conf * [release-1.35] buildah: refactor resolv/hosts setup. * [release-1.35] rename the hostFile var to reflect * [release-1.35] Bump c/common to v0.58.1 * [release-1.35] Bump Buildah to v1.35.2 * [release-1.35] CVE-2024-24786 protobuf to 1.33 * [release-1.35] Bump to v1.35.2-dev ------------------------------------------------------------------ ------------------ 2024-3-27 - Mar 27 2024 ------------------- ------------------------------------------------------------------ ++++ open-vm-tools: - Remove protobuf < 22 dependency from spec file (bsc#1217478) Required linking with additional absl libraries for sle_version > 150400. - Use (boo#1222089) for updating open-vm-tools to version 12.4.0. ------------------------------------------------------------------ ------------------ 2024-3-25 - Mar 25 2024 ------------------- ------------------------------------------------------------------ ++++ docker: [NOTE: This update was only ever released in SLES and Leap.] - Update to Docker 25.0.5-ce. See upstream changelog online at bsc#1223409 bsc#1234089 CVE-2024-29018 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Remove upstreamed patches: - 0007-daemon-overlay2-remove-world-writable-permission-fro.patch - Update --add-runtime to point to correct binary path. ------------------------------------------------------------------ ------------------ 2024-3-23 - Mar 23 2024 ------------------- ------------------------------------------------------------------ ++++ open-vm-tools: - update to 12.4.0: https://github.com/vmware/open-vm-tools/blob/stable-12.4.0/ReleaseNotes.md https://github.com/vmware/open-vm-tools/blob/stable-12.4.0/open-vm-tools/ChangeLog There are no new features in the open-vm-tools 12.4.0 release. This is primarily a maintenance release that addresses a few critical problems, including: * A Github pull request has been handled. Please see the Resolved Issues section of the Release Notes. * A number of issues flagged by Coverity have been addressed. * For issues resolved in this release, see the Resolved Issues section of the Release Notes. ------------------------------------------------------------------ ------------------ 2024-3-19 - Mar 19 2024 ------------------- ------------------------------------------------------------------ ++++ buildah: - Add patch for CVE-2024-1753 / bsc#1221677: 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 1.35.1: * [release-1.35] Bump to v1.35.1 * [release-1.35] CVE-2024-1753 container escape fix (bsc#1221677) - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch ++++ podman: - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch ------------------------------------------------------------------ ------------------ 2024-3-18 - Mar 18 2024 ------------------- ------------------------------------------------------------------ ++++ buildah: - Buildah dropped cni support, require netavark instead (boo#1221243) ------------------------------------------------------------------ ------------------ 2024-3-16 - Mar 16 2024 ------------------- ------------------------------------------------------------------ ++++ helm: - Update to version 3.14.3: * Add a note about --dry-run displaying secrets * add error messages * Fix: Ignore alias validation error for index load * chore(deps): bump github.com/containerd/containerd from 1.7.11 to 1.7.12 * chore(deps): bump github.com/DATA-DOG/go-sqlmock from 1.5.0 to 1.5.2 * Update architecture detection method ------------------------------------------------------------------ ------------------ 2024-3-14 - Mar 14 2024 ------------------- ------------------------------------------------------------------ ++++ buildah: - Remove obsolete requires libcontainers-image & libcontainers-storage - Require passt for rootless networking (poo#156955) Buildah moved to passt/pasta for rootless networking from slirp4netns (https://github.com/containers/common/pull/1846) ------------------------------------------------------------------ ------------------ 2024-3-8 - Mar 8 2024 ------------------- ------------------------------------------------------------------ ++++ docker: [NOTE: This update was only ever released in SLES and Leap.] - Add patch to fix bsc#1220339 * 0007-daemon-overlay2-remove-world-writable-permission-fro.patch - rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch ------------------------------------------------------------------ ------------------ 2024-3-7 - Mar 7 2024 ------------------- ------------------------------------------------------------------ ++++ buildah: - Update to version 1.35.0: * Bump v1.35.0 * Bump c/common v0.58.0, c/image v5.30.0, c/storage v1.53.0 * conformance tests: don't break on trailing zeroes in layer blobs * Add a conformance test for copying to a mounted prior stage * fix(deps): update module github.com/stretchr/testify to v1.9.0 * cgroups: reuse version check from c/common * Update vendor of containers/(common,image) * fix(deps): update github.com/containers/storage digest to eadc620 * fix(deps): update github.com/containers/luksy digest to ceb12d4 * fix(deps): update github.com/containers/image/v5 digest to cdc6802 * manifest add: complain if we get artifact flags without --artifact * Use retry logic from containers/common * Vendor in containers/(storage,image,common) * Update module golang.org/x/crypto to v0.20.0 * Add comment re: Total Success task name * tests: skip_if_no_unshare(): check for --setuid * Properly handle build --pull=false * [skip-ci] Update tim-actions/get-pr-commits action to v1.3.1 * Update module go.etcd.io/bbolt to v1.3.9 * Revert "Reduce official image size" * Update module github.com/opencontainers/image-spec to v1.1.0 * Reduce official image size * Build with CNI support on FreeBSD * build --all-platforms: skip some base "image" platforms * Bump main to v1.35.0-dev * Vendor in latest containers/(storage,image,common) * Split up error messages for missing --sbom related flags * `buildah manifest`: add artifact-related options * cmd/buildah/manifest.go: lock lists before adding/annotating/pushing * cmd/buildah/manifest.go: don't make struct declarations aliases * Use golang.org/x/exp/slices.Contains * Disable loong64 again * Fix a couple of typos in one-line comments * egrep is obsolescent; use grep -E * Try Cirrus with a newer VM version * Set CONTAINERS_CONF in the chroot-mount-flags integration test * Update to match dependency API update * Update github.com/openshift/imagebuilder and containers/common * docs: correct default authfile path * fix(deps): update module github.com/containerd/containerd to v1.7.13 * tests: retrofit test for heredoc summary * build, heredoc: show heredoc summary in build output * manifest, push: add support for --retry and --retry-delay * fix(deps): update github.com/openshift/imagebuilder digest to b767bc3 * imagebuildah: fix crash with empty RUN * fix(deps): update github.com/containers/luksy digest to b62d551 * fix(deps): update module github.com/opencontainers/runc to v1.1.12 [security] * fix(deps): update module github.com/moby/buildkit to v0.12.5 [security] * Make buildah match podman for handling of ulimits * docs: move footnotes to where they're applicable * Allow users to specify no-dereference * Run codespell on code * Fix FreeBSD version parsing * Fix a build break on FreeBSD * Remove a bad FROM line * fix(deps): update module github.com/onsi/gomega to v1.31.1 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc6 * docs: use reversed logo for dark theme in README * build,commit: add --sbom to scan and produce SBOMs when committing * commit: force omitHistory if the parent has layers but no history * docs: fix a couple of typos * internal/mkcw.Archive(): handle extra image content * stage_executor,heredoc: honor interpreter in heredoc * stage_executor,layers: burst cache if heredoc content is changed * fix(deps): update module golang.org/x/crypto to v0.18.0 * Replace map[K]bool with map[K]struct{} where it makes sense * fix(deps): update module golang.org/x/sync to v0.6.0 * fix(deps): update module golang.org/x/term to v0.16.0 * Bump CI VMs * Replace strings.SplitN with strings.Cut * fix(deps): update github.com/containers/storage digest to ef81e9b * fix(deps): update github.com/containers/image/v5 digest to 1b221d4 * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.1 * Document use of containers-transports values in buildah * fix(deps): update module golang.org/x/crypto to v0.17.0 [security] * chore(deps): update dependency containers/automation_images to v20231208 * manifest: addCompression use default from containers.conf * commit: add a --add-file flag * mkcw: populate the rootfs using an overlay * chore(deps): update dependency containers/automation_images to v20230517 * [skip-ci] Update actions/stale action to v9 * fix(deps): update module github.com/containernetworking/plugins to v1.4.0 * fix(deps): update github.com/containers/image/v5 digest to 7a40fee * Bump to v1.34.1-dev * Ignore errors if label.Relabel returns ENOSUP ------------------------------------------------------------------ ------------------ 2024-2-28 - Feb 28 2024 ------------------- ------------------------------------------------------------------ ++++ buildah: - Require cni-plugins (bsc#1220568) ++++ container-suseconnect: - update to 2.5.0: * Upgrade to go 1.21 * Allow setting of SCC credentials via environment variables * Bump github.com/urfave/cli/v2 from 2.25.7 to 2.27.1 * Use switch instead of else if construction * Add system token header to query SCC subscriptions (bsc#1219855) - run tests ------------------------------------------------------------------ ------------------ 2024-2-26 - Feb 26 2024 ------------------- ------------------------------------------------------------------ ++++ containerd: - Use %patch -P N instead of deprecated %patchN. ++++ kubernetes-old: - Update to version 1.28.7: * [go] Bump images, dependencies and versions to go 1.21.7 / setcap/debian-base to bookworm-v1.0.1 and distroless-iptables to v0.4.5 * Add processStartTime in metrics/slis * Revert "kubeadm: fix a bug where the uploaded kubelet configuration in kube-system/kubelet-config ConfigMap does not respect user patch" * kubeadm: better checks if the node is CP during "upgrade node" * If a pvc has an empty storageclass name, don't try to assign a default StorageClass to it. * Drop PendingChanges methods from change trackers, move into UpdateResults * Squash some unnecessarily-chained methods in the change trackers - Update .spec file to bump go version build requirements: * `BuildRequires: golang(API) = 1.21` ++++ open-vm-tools: - Use %patch -P N instead of deprecated %patchN. ------------------------------------------------------------------ ------------------ 2024-2-23 - Feb 23 2024 ------------------- ------------------------------------------------------------------ ++++ buildah: - Update to version 1.34.1: * [release-1.34] Bump to v1.34.1 * [release-1.34] Vendor bumps (fixes bsc#1219563) * manifest: addCompression use default from containers.conf * Build with CNI support on FreeBSD * tests: retrofit test for heredoc summary * build, heredoc: show heredoc summary in build output * docs: correct default authfile path * Make buildah match podman for handling of ulimits * imagebuildah: fix crash with empty RUN * docs: move footnotes to where they're applicable * Run codespell on code * Fix FreeBSD version parsing * Allow users to specify no-dereference * Fix a build break on FreeBSD * Remove a bad FROM line * commit: force omitHistory if the parent has layers but no history * docs: fix a couple of typos * stage_executor,heredoc: honor interpreter in heredoc * stage_executor,layers: burst cache if heredoc content is changed * Replace map[K]bool with map[K]struct{} where it makes sense * Replace strings.SplitN with strings.Cut * Document use of containers-transports values in buildah * commit: add a --add-file flag * mkcw: populate the rootfs using an overlay * Ignore errors if label.Relabel returns ENOSUP * manifest: addCompression use default from containers.conf ++++ helm: - Update to version 3.14.2 (bsc#1220207, CVE-2024-26147): * Fix for uninitialized variable in yaml parsing ------------------------------------------------------------------ ------------------ 2024-2-22 - Feb 22 2024 ------------------- ------------------------------------------------------------------ ++++ buildah: - Allow to disable apparmor support (ALP supports only SELinux) ++++ docker: - Allow to disable apparmor support (ALP supports only SELinux) ++++ kubernetes-old: - Use %patch -P N instead of deprecated %patchN. ------------------------------------------------------------------ ------------------ 2024-2-17 - Feb 17 2024 ------------------- ------------------------------------------------------------------ ++++ docker: - Update to Docker 25.0.3-ce. See upstream changelog online at - Fixes: * bsc#1219267 - CVE-2024-23651 * bsc#1219268 - CVE-2024-23652 * bsc#1219438 - CVE-2024-23653 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Remove upstreamed patches: - 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch ------------------------------------------------------------------ ------------------ 2024-2-15 - Feb 15 2024 ------------------- ------------------------------------------------------------------ ++++ helm: - Update to version 3.14.1 (bsc#1219969, CVE-2024-25620): * validation fix ------------------------------------------------------------------ ------------------ 2024-2-14 - Feb 14 2024 ------------------- ------------------------------------------------------------------ ++++ docker: - Vendor latest buildkit v0.11: Add patch 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch that vendors in the latest v0.11 buildkit branch including bugfixes for the following: * bsc#1219438: CVE-2024-23653 * bsc#1219268: CVE-2024-23652 * bsc#1219267: CVE-2024-23651 - rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - switch from %patchN to %patch -PN syntax - remove unused rpmlint filters and add filters to silence pointless bash & zsh completion warnings ------------------------------------------------------------------ ------------------ 2024-2-13 - Feb 13 2024 ------------------- ------------------------------------------------------------------ ++++ netavark: - Update to version 1.10.3: * v1.10.3 * fix netavark update to not start a new aardvark-dns ------------------------------------------------------------------ ------------------ 2024-2-6 - Feb 6 2024 ------------------- ------------------------------------------------------------------ ++++ netavark: - Rely only on . for aardvark-dns requires, even though it is released in sync with netavark, relying on patch version is brittle. ------------------------------------------------------------------ ------------------ 2024-2-1 - Feb 1 2024 ------------------- ------------------------------------------------------------------ ++++ netavark: - Update to version 1.10.2: * Release v1.10.2 * Release notes for v1.10.2 * [CI:BUILD] Packit/rpm: fix aardvark-dns handling * Do not perform network namespace detection on AV update * Release v1.10.1 * Updated release notes for v1.10.1 * update to nftables release 0.3 from crates.io * DISTRO_PACKAGE: fix incorrect vendored tar archive URL * Bump to 1.11.0-dev * Release 1.10.0 * Release notes for 1.10.0 * RPM: update .cargo/config before building * Add support for isolation to the nftables driver * build(deps): bump h2 from 0.3.22 to 0.3.24 * chore(deps): update rust crate chrono to 0.4.32 * fix(deps): update rust crate env_logger to 0.11.0 * chore(deps): update dependency containers/automation_images to v20240102 * Bump nftables-rs to latest commit * Netavark: nftables support * fix(deps): update rust crate serde_json to 1.0.111 * feat: added the --firewall-driver option * Document how to generate a code coverage report for netavark * fix(deps): update rust crate clap to ~4.4.12 * fix(deps): update rust crate serde_json to 1.0.110 * fix(deps): update rust-futures monorepo to 0.3.30 * fix(deps): update rust crate nispor to 1.2.16 * chore(deps): update rust crate tempfile to 3.9.0 * Use tonic::transport::Uri instead of HTTP * chore(deps): update dependency containers/automation_images to v20231208 * fix(deps): update rust crate tokio to 1.35 * dhcp-proxy: return actual error instead of generic one * dhcp-proxy: skip set gateway if missing * bump netlink-packet-route to 0.18.1 * chore(deps): update rust crate once_cell to 1.19.0 * fix(deps): update rust crate nispor to 1.2.15 * fix(deps): update rust crate serde to 1.0.193 * fix(deps): update rust crate clap to ~4.4.10 * aardvark: show error if process is in wrong netns * aardvark: remove unessesary unlock lockfile calls * fix(deps): update rust crate url to 2.5.0 * Bump working version to v1.10.0-dev ------------------------------------------------------------------ ------------------ 2024-1-25 - Jan 25 2024 ------------------- ------------------------------------------------------------------ ++++ aardvark-dns: - Update to version 1.10.0: * Release 1.10.0 * Release notes for 1.10.0 * chore(deps): update rust crate chrono to 0.4.32 * chore(deps): update dependency containers/automation_images to v20240102 * fix(deps): update rust crate futures-util to 0.3.30 * fix(deps): update rust crate anyhow to 1.0.79 * fix(deps): update rust crate tokio to 1.35.1 * chore(deps): update dependency containers/automation_images to v20231208 * fix(deps): update rust crate tokio to 1.35.0 * fix duplicated IP CI flake * server: remove unused kill switch * fix(deps): update rust crate clap to ~4.4.10 * Bump working version to v1.10.0-dev ------------------------------------------------------------------ ------------------ 2024-1-24 - Jan 24 2024 ------------------- ------------------------------------------------------------------ ++++ kubernetes-old: - Update .spec file to remove go version build requirements: * above build requirement causing build failures with following error: - `go: download go1.20.13 for linux/amd64: toolchain not available` - ref: https://go.dev/doc/toolchain - Update to version 1.28.6: * Revert "Graduate Evented PLEG to Beta" * [go] Bump images, dependencies and versions to go 1.20.13 and distroless iptables to 0.2.9 * e2e framework: adapt unit test to Go 1.22 * use context for lazy evaluation. * Handle edge cases in seat demand stats * .*: bump golang.org/x/tools to v0.16.1 * fix: 119921 * Use a separate function for checking if device was reconstructed * Add tests for checking of uncertain device paths * Fix device uncertain errors on reboot * fix(scheduler): fix incorrect loop logic in MultiPoint to avoid a plugin being loaded multiple times * Add unit test for Job Controller for panic when PodFailurePolicy is used on 1.28 * etcd: Update to version 3.5.10 * kube-proxy: Fix etp:Local for externalIPs - Update to version 1.28.5: * enable SchedulerQueueingHints feature gate in TestIncomingPodsMetrics * fix: disable SchedulerQueueingHints feature flag by default * Fix panic if there are more terminating pods than active pods * [go] Bump images, dependencies and versions to go 1.20.12 * Move adding GroupVersion log until after an update is confirmed * pass GOTOOLCHAIN to build containers * handle GOTOOLCHAIN in kube::golang::verify_go_version * fix: requeue pods rejected by Extenders properly * Bump distroless-iptables to 0.2.8 based on Go 1.20.11 * fix: smb file share unavailable issue when it's deleted * Make StatefulSet restart pods with phase Succeeded * run hack scripts to update cyphar/filepath-securejoin to v0.2.4 correctly * update filepath-securejoin dependency to 0.2.4 to fix security vulnerability * DRA: call plugins for claims even if exist in cache * Fix panic when process RunScorePlugins for cap out of range * e2e: bootstrap vsphere tests earlier * apf: request ejected from queue should use reason 'time-out' * apf: remove RequestWaitLimit from queueset config * apf: remove timeoutOldRequestsAndRejectOrEnqueueLocked function * apf: use context for queue wait * apiserver: add flow control metric current_inqueue_seats ------------------------------------------------------------------ ------------------ 2024-1-19 - Jan 19 2024 ------------------- ------------------------------------------------------------------ ++++ helm: - determine git commit hash automatically ------------------------------------------------------------------ ------------------ 2024-1-18 - Jan 18 2024 ------------------- ------------------------------------------------------------------ ++++ helm: - Update to version 3.14.0: * Notable Changes - New helm search flag of --fail-on-no-result - Allow a nested tpl invocation access to defines - Speed up the tpl function - Added qps/HELM_QPS parameter that tells Kubernetes packages how to operate - Added --kube-version to lint command - The ignore pkg is now public * Changelog - Improve release action - bump version to - Fix issues when verify generation readiness was merged - fix test to use the default code's k8sVersionMinor - lint: Add --kube-version flag to set capabilities and deprecation rules - Update to Go 1.21 for builds - chore(deps): bump github.com/containerd/containerd from 1.7.6 to 1.7.11 - chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 - Removing Asset Transparency - tests(pkg/engine): test RenderWithClientProvider - Make the `ignore` pkg public again - chore(deps): bump golang.org/x/crypto from 0.14.0 to 0.17.0 - Updating to Kubernetes 1.29.0 libraries - feature(pkg/engine): introduce RenderWithClientProvider - chore(deps): bump github/codeql-action from 2.22.10 to 3.22.11 - chore(deps): bump github/codeql-action from 2.22.9 to 2.22.10 - Updating Helm libraries for k8s 1.28.4 - chore(deps): bump github/codeql-action from 2.22.8 to 2.22.9 - Remove excessive logging - chore(deps): bump github/codeql-action from 2.22.7 to 2.22.8 - chore(deps): bump github/codeql-action from 2.22.5 to 2.22.7 - Update CONTRIBUTING.md - Fixing release labelling in rollback - chore(deps): bump github.com/docker/docker - chore(deps): bump github/codeql-action from 2.22.4 to 2.22.5 - feat: move livenessProbe and readinessProbe values to default values file - Revert "fix(main): fix basic auth for helm pull or push" - chore(deps): bump google.golang.org/grpc from 1.54.0 to 1.56.3 - Revert "fix(registry): address anonymous pull issue" - Update get-helm-3 - chore(deps): bump github/codeql-action from 2.22.3 to 2.22.4 - chore(deps): bump actions/checkout from 3.6.0 to 4.1.1 - chore(deps): bump github/codeql-action from 2.21.8 to 2.22.3 - Drop filterSystemLabels usage from Query method - Apply review suggestions - Update get-helm-3 to get version through get.helm.sh - feat: print failed hook name - chore(deps): bump golang.org/x/net from 0.13.0 to 0.17.0 - Fixing precedence issue with the import of values. - chore(create): indent to spaces - Allow using label selectors for system labels for sql backend. - Allow using label selectors for system labels for secrets and configmap backends. - remove useless print during prepareUpgrade - Add missing with clause to release gh action - FIX Default ServiceAccount yaml - fix(registry): address anonymous pull issue - fix(registry): unswallow error - Fix missing run statement on release action - Add qps/HELM_QPS parameter - chore(deps): bump oras.land/oras-go from 1.2.3 to 1.2.4 - chore(deps): bump github/codeql-action from 2.21.7 to 2.21.8 - bump version to v3.13.0 - chore(deps): bump github.com/evanphx/json-patch - chore(deps): bump golang.org/x/text from 0.11.0 to 0.13.0 - Write latest version to get.helm.sh bucket - Increased release information key name max length. - Pin gox to specific commit - Remove `GoFish` from package managers for installing the binary - Test update for "Allow a nested `tpl` invocation access to `defines` in a containing one" - Test update for "Speed up `tpl`" - addressing comment - Add support for RISC-V - lint and validate dependency metadata to reference dependencies with a unique key (name or alias) - Work around template.Clone omitting options - fix: pass 'passCredentialsAll' as env-var to getter - feat: pass basic auth to env-vars when running download plugins - helm search: New CLI Flag --fail-on-no-result - Update pkg/kube/ready.go - fix post install hook deletion due to before-hook-creation policy - Allow a nested `tpl` invocation access to `defines` in a containing one - Remove the 'reference templates' concept - Speed up `tpl` - ready checker- comment update - ready checker- remove duplicate statefulset generational check - Verify generation in readiness checks - feat(helm): add --reset-then-reuse-values flag to 'helm upgrade' ------------------------------------------------------------------ ------------------ 2024-1-15 - Jan 15 2024 ------------------- ------------------------------------------------------------------ ++++ containerd: - Enable manpage generation - Make devel package noarch - adjust rpmlint filters ------------------------------------------------------------------ ------------------ 2024-1-12 - Jan 12 2024 ------------------- ------------------------------------------------------------------ ++++ kubevirt: - Fix test with initially invalid DataVolume (bsc#1218174) 0001-tests-Adapt-VM-phase-expectation.patch ------------------------------------------------------------------ ------------------ 2024-1-8 - Jan 8 2024 ------------------- ------------------------------------------------------------------ ++++ containerd: - Add patch for bsc#1217952: + 0002-shim-Create-pid-file-with-0644-permissions.patch ------------------------------------------------------------------ ------------------ 2024-1-4 - Jan 4 2024 ------------------- ------------------------------------------------------------------ ++++ kubevirt: - Update to version 1.1.1 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.1.1 - Drop upstreamed patches 0001-Update-google.golang.org-grpc-to-1.56.3.patch 0002-virt-launcher-fix-qemu-non-root-path.patch 0003-cgroupsv2-reconstruct-device-allowlist.patch 0004-seccomp-Use-Names-field-to-define-the-syscall.patch ++++ podman: - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev ------------------------------------------------------------------ ------------------ 2024-1-3 - Jan 3 2024 ------------------- ------------------------------------------------------------------ ++++ containerized-data-importer: - Set ExclusiveArch conditionally depending on the distro - Remove SLE15 SP4 from the distro check (end of general support) ++++ kubevirt: - Fix seccomp profile for post-copy migration 0004-seccomp-Use-Names-field-to-define-the-syscall.patch - Set ExclusiveArch conditionally depending on the distro - Remove SLE15 SP4 from the distro check (end of general support) ------------------------------------------------------------------ ------------------ 2023-12-20 - Dec 20 2023 ------------------- ------------------------------------------------------------------ ++++ open-vm-tools: - Own %{_modulesloaddir}: used to be present via udev-mini -> kmod - > suse-module-tools dependency before. ------------------------------------------------------------------ ------------------ 2023-12-19 - Dec 19 2023 ------------------- ------------------------------------------------------------------ ++++ conmon: - New upstream release 2.1.10 Bug fixes: * Fix incorrect free in conn_sock (removes fix-incorrect-free-in-conn_sock.patch) * logging: Respect log-size-max immediately after open ------------------------------------------------------------------ ------------------ 2023-12-18 - Dec 18 2023 ------------------- ------------------------------------------------------------------ ++++ conmon: - Add fix-incorrect-free-in-conn_sock.patch This fixes a regression in 2.1.9 (https://github.com/containers/conmon/issues/475 and https://github.com/containers/conmon/issues/477) ------------------------------------------------------------------ ------------------ 2023-12-15 - Dec 15 2023 ------------------- ------------------------------------------------------------------ ++++ conmon: - New upstream release 2.1.9 [#]## Bug fixes * fix some issues flagged by SAST scan * src: fix write after end of buffer * src: open all files with O_CLOEXEC * oom-score: restore oom score before running exit command [#]## Features * Forward more messages on the sd-notify socket * logging: -l passthrough accepts TTYs ------------------------------------------------------------------ ------------------ 2023-12-14 - Dec 14 2023 ------------------- ------------------------------------------------------------------ ++++ buildah: - Drop 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch (merged upstream; https://github.com/containers/buildah/pull/5183) - Update to version 1.34.0: * Bump to v1.34.0 * fix(deps): update module github.com/containerd/containerd to v1.7.11 * fix(deps): update github.com/containers/storage digest to 15c3cb7 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.2 * fix(deps): update github.com/containers/common digest to 630c929 * fix(deps): update module github.com/moby/buildkit to v0.12.4 * fix(deps): update github.com/openshift/imagebuilder digest to ef2a5fe * [CI:DOCS] man pages: underscores, too-wide lines * fix(deps): update module github.com/containerd/containerd to v1.7.10 * run.bats: use --quiet --pull=false when using a prefetched image * internal/mkcw/embed/entrypoint.gz: rename to include the arch * internal/mkcw/embed/entrypoint.gz: compress with -n9 * fix(deps): update module golang.org/x/crypto to v0.16.0 * Integration tests: make skip_if_no_unshare check --map-users * fix(deps): update module golang.org/x/term to v0.15.0 * fix(deps): update module golang.org/x/sys to v0.15.0 * fix(deps): update module github.com/onsi/ginkgo to v2 * vendor: update c/{common,image,storage} * run: Allow using just one jail per container on FreeBSD * Remove makefile targets entrypoint{,.gz} for non x86_64 ++++ helm: - Update to version 3.13.3: * Updating Helm libraries for k8s 1.28.4 * Remove excessive logging * chore(create): indent to spaces ------------------------------------------------------------------ ------------------ 2023-12-13 - Dec 13 2023 ------------------- ------------------------------------------------------------------ ++++ podman: - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available ------------------------------------------------------------------ ------------------ 2023-12-11 - Dec 11 2023 ------------------- ------------------------------------------------------------------ ++++ open-vm-tools: - Fix (bsc#1217796) - Fix outdated libxmlsec1 dependency version. Updates to open-vm-tools for SLES 12 SP4 and SP5 are now being built againt against libxmlsec1-1-1.2.37. Update the spec file to now require libxmlsec1-openssl1 >= 1.2.37. ++++ podman: - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev ------------------------------------------------------------------ ------------------ 2023-12-7 - Dec 7 2023 ------------------- ------------------------------------------------------------------ ++++ podman: - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) ------------------------------------------------------------------ ------------------ 2023-12-6 - Dec 6 2023 ------------------- ------------------------------------------------------------------ ++++ podman: - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev ------------------------------------------------------------------ ------------------ 2023-12-4 - Dec 4 2023 ------------------- ------------------------------------------------------------------ ++++ containerd: - Update to containerd v1.7.10. Upstream release notes: - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch ------------------------------------------------------------------ ------------------ 2023-11-30 - Nov 30 2023 ------------------- ------------------------------------------------------------------ ++++ aardvark-dns: - Update to version 1.9.0: * Release v1.9.0 * v1.9.0 Update release notes * run cargo update * chore(deps): update dependency containers/automation_images to v20231116 * fix(deps): update rust crate tokio to 1.34.0 * fix(deps): update rust crate async-broadcast to 0.6.0 * update trust-dns to hickory * fix(deps): update rust crate futures-util to 0.3.29 * fix(deps): update rust crate trust-dns-server to 0.23.2 * fix(deps): update rust crate trust-dns-proto to 0.23.2 * tmt: initial enablement * aardvark main: change error reporting * chore(deps): update dependency containers/automation_images to v20231004 * fix(deps): update rust crate trust-dns-proto to 0.23.1 * fix(deps): update rust crate trust-dns-client to 0.23.1 * clippy: some format fixes * fix(deps): update rust crate tokio to 1.33.0 * Bump to v1.9.0-dev ++++ netavark: - Update to version 1.9.0: * v1.9.0 Release * v1.9.0 Release notes * test: fix syntax problem in helpers.bash * run cargo update * use OsString/Path over String for file paths * chore(deps): update dependency containers/automation_images to v20231116 * firewalld-reload: fix CI tests * firewalld-reload: prevent race which could leak fw rules * fix(deps): update rust crate clap to ~4.4.8 * CI: skip broken firewalld test * fix(deps): update rust crate http to 0.2.11 * rpm: add netavark-firewalld-reload.service to spec * firewalld-reload: add integration tests * firewall/state: make sure to ignore enoent on read * firewall-reload: integrate actual logic to reload rules * firewall/state: improve error messages * firewall: add state functions to serialize configs * firewalld: fix lint errors with rust v1.73 * firewall: do not use full Network in NetworkStruct * firewall: add dns_port to SetupNetwork * add firewalld-reload subcommand * fix(deps): update rust crate http to 0.2.10 * fix(deps): update rust crate env_logger to 0.10.1 * fix(deps): update rust crate tokio to 1.34 * Update rust container build files * bridge: force static mac on bridge interface * fix(deps): update rust crate futures-core to 0.3.29 * fix(deps): update rust crate serde to 1.0.190 * fix(deps): update rust crate serde_json to 1.0.108 * fix(deps): update rust crate sysctl to 0.5.5 * fix(deps): update rust-futures monorepo to 0.3.29 * CI: Drop CI VM distro name * chore(deps): update dependency containers/automation_images to v20231004 * fix(deps): update rust crate tokio to 1.33 * build-sys: Filter to tier 2 Linux declaratively * fix(deps): update rust crate sha2 to 0.10.8 * fix podman.io community link * Bump to v1.9.0-dev ------------------------------------------------------------------ ------------------ 2023-11-28 - Nov 28 2023 ------------------- ------------------------------------------------------------------ ++++ podman: - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address ------------------------------------------------------------------ ------------------ 2023-11-27 - Nov 27 2023 ------------------- ------------------------------------------------------------------ ++++ buildah: - Update to version 1.33.2: * [release-1.33.2] Bump to v1.33.2 * Update minimum to golang 1.20 * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.0 * fix(deps): update module github.com/moby/buildkit to v0.12.3 * Bump to v1.33.2-dev ++++ distribution: - update to 2.8.3 (bsc#1216491): * Pass `BUILDTAGS` argument to `go build` * Enable Go build tags * `reference`: replace deprecated function `SplitHostname` * Dont parse errors as JSON unless Content-Type is set to JSON * update to go 1.20.8 * Set `Content-Type` header in registry client `ReadFrom` * deprecate reference package, migrate to github.com/distribution/reference * `digestset`: deprecate package in favor of `go- digest/digestset` * Do not close HTTP request body in HTTP handler * Add v2.8.3 release notes ------------------------------------------------------------------ ------------------ 2023-11-24 - Nov 24 2023 ------------------- ------------------------------------------------------------------ ++++ kubernetes-old: - Update .spec file to bump go version build requirements: * `BuildRequires: go >= 1.20.11` - Update to version 1.28.4: * Use golang library instead of mklink * [go] Bump images, dependencies and versions to go 1.20.11 * Fixing attempt to deploy past allocatable memory limits test on Windows * bump golang.org/grpc to v1.56.3 * Add more test cases ensuring nextScheduleTimeDuration is never < 0 * Modify mostRecentScheduleTime to return more detailed information about missed schedules * removing the import of "k8s.io/utils/ptr" because it was introduced after 1.28 * Fixing CurrentReplicas and CurrentRevision in completeRollingUpdate * Use Patch instead of SSA for Pod Disruption condition * KCCM: fix GCP ILB by reintroducing readiness predicate for eTP:Local * Fix panic testing intree vSphere dynamic PV. * service controller: improve node lifecycle updates - update nodes if providerID has changed * implement Stringer for podActions * Retry operations if CSI Driver Isn't Found by Treating this Error as Transient ------------------------------------------------------------------ ------------------ 2023-11-21 - Nov 21 2023 ------------------- ------------------------------------------------------------------ ++++ containerized-data-importer: - Update to version 1.58.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.0 ------------------------------------------------------------------ ------------------ 2023-11-20 - Nov 20 2023 ------------------- ------------------------------------------------------------------ ++++ buildah: - Add patch: * 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch (fixes builds on non x86_64) - Update to version 1.33.1: * Bump to v1.33.1 * Bump to v1.31.2-dev * Bump to v1.31.1 * fix(deps): update module github.com/moby/buildkit to v0.11.4 [security] * test,heredoc: use fedora instead of docker.io/library/python:latest * Bump to v1.33.1-dev * Bump to v1.33.0 * Never omit layers for emptyLayer instructions when squashing/cwing * Add OverrideChanges and OverrideConfig to CommitOptions * buildah: add heredoc support for RUN, COPY and ADD * vendor: bump imagebuilder to v1.2.6-0.20231110114814-35a50d57f722 * conformance tests: archive the context directory as 0:0 (#5171) * blobcacheinfo,test: blobs must be resued when pushing across registry * Bump c/storage v1.51.0, c/image v5.29.0, c/common v0.57.0 * pkg/util.MirrorToTempFileIfPathIsDescriptor(): don't leak an fd * StageExecutor.Execute: force a commit for --unsetenv, too * Increase a copier+chroot test timeout * Add support for --compat-auth-file in login/logout * Update existing tests for error message change * Update c/image and c/common to latest * fix(deps): update module github.com/containerd/containerd to v1.7.9 * build: downgrade to go 1.20 * Add godoc for pkg/parse.GetTempDir * conformance tests: use go-dockerclient for BuildKit builds * Make TEE types case-insensitive * fix(deps): update module golang.org/x/crypto to v0.15.0 * Tweak some help descriptions * Stop using DefaultNetworkSysctl and use containers.conf only * Implement ADD checksum flag #5135 * vendor of openshift/imagebuilder #5135 * Pass secrets from the host down to internal podman containers * Update cirrus and version of golang * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * pkg/parse.Platform(): minor simplification * createConfigsAndManifests: clear history before cw-specific logic * Use a constant definition instead of "scratch" * conformance: use require.NoErrorf() more * fix(deps): update module golang.org/x/term to v0.14.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sys to v0.14.0 * fix(deps): update github.com/containers/common digest to 8354404 * fix(deps): update module github.com/opencontainers/runc to v1.1.10 * fix(deps): update github.com/containers/luksy digest to b5a7f79 * Log the platform for build errors during multi-platform builds * Use mask definitions from containers/common * Vendor in latest containers/common * fix(deps): update module github.com/containerd/containerd to v1.7.8 * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * container.conf: support attributed string slices * fix(deps): update module sigs.k8s.io/yaml to v1.4.0 * Use cutil.StringInSlice rather then contains * Add --no-hostname option to buildah containers * vendor c/common: appendable containers.conf strings, Part 1 * fix(deps): update module github.com/onsi/gomega to v1.28.1 * chroot.setupChrootBindMounts: pay more attention to flags * chore(deps): update dependency containers/automation_images to v20231004 * Vendor containers/common * chore(deps): update module golang.org/x/net to v0.17.0 [security] * run: use internal.GetTempDir with os.MkdirTemp * fix(deps): update module github.com/containerd/containerd to v1.7.7 * imagebuildah,multi-stage: do not remove base images * gitignore: add mkcw binary * mkcw: remove entrypoint binaries * fix(deps): update module golang.org/x/crypto to v0.14.0 * fix(deps): update module golang.org/x/sys to v0.13.0 * fix(deps): update module golang.org/x/sync to v0.4.0 * Update some comments related to confidential workload * Use the parent's image ID in the config that we pass to imagebuilder * fix(deps): update github.com/containers/common digest to 8892536 * fix(deps): update github.com/containers/luksy digest to 6df88cb * bug: Ensure the mount type is always BindMount by default * Protocol can be specified with --port. Ex. --port 514/udp * fix(deps): update module github.com/onsi/gomega to v1.28.0 * build,config: add support for --unsetlabel * tests/bud: add tests * [CI:BUILD] Packit: tag @containers/packit-build on copr build failures * stage_executor: allow images without layers * vendor of containers/common * Removing selinux_tag.sh as no longer needed after 580356f [NO NEW TESTS NEEDED] * add/copy: make sure we handle relative path names correctly * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Bump to v1.33.0-dev * imagebuildah: consider ignorefile with --build-context ------------------------------------------------------------------ ------------------ 2023-11-14 - Nov 14 2023 ------------------- ------------------------------------------------------------------ ++++ kubevirt: - Update to version 1.1.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.1.0 - Drop upstreamed patches 0001-Fix-qemu-system-lookup.patch 0003-Virtiofs-Remove-duplicated-functional-tests.patch 0005-Support-multiple-watchdogs-in-the-domain-schema.patch - Add patches 0001-Update-google.golang.org-grpc-to-1.56.3.patch (CVE-2023-44487) 0002-virt-launcher-fix-qemu-non-root-path.patch 0003-cgroupsv2-reconstruct-device-allowlist.patch ------------------------------------------------------------------ ------------------ 2023-11-8 - Nov 8 2023 ------------------- ------------------------------------------------------------------ ++++ helm: - Update to version 3.13.2 (bsc#1217013): * chore(deps): bump google.golang.org/grpc from 1.54.0 to 1.56.3 * Update get-helm-3 * chore(deps): bump github.com/docker/docker * Fixing release labelling in rollback * Drop filterSystemLabels usage from Query method * Apply review suggestions * Allow using label selectors for system labels for sql backend. * Allow using label selectors for system labels for secrets and configmap backends. * Revert "fix(main): fix basic auth for helm pull or push" * Revert "fix(registry): address anonymous pull issue" * chore(deps): bump golang.org/x/net from 0.13.0 to 0.17.0 * Update get-helm-3 to get version through get.helm.sh ++++ podman: - Use crun only on selected archs ------------------------------------------------------------------ ------------------ 2023-11-1 - Nov 1 2023 ------------------- ------------------------------------------------------------------ ++++ buildah: - Update to version 1.32.2: * Mask /sys/devices/virtual/powercap by default * tag v1.32.2 ++++ podman: - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev ------------------------------------------------------------------ ------------------ 2023-10-31 - Oct 31 2023 ------------------- ------------------------------------------------------------------ ++++ podman: - crun is not available for armv6 (because of criu), so use runc on armv6 ------------------------------------------------------------------ ------------------ 2023-10-30 - Oct 30 2023 ------------------- ------------------------------------------------------------------ ++++ open-vm-tools: - Update to 12.3.5 (build 22544099) (boo#1216670) - There are no new features in the open-vm-tools 12.3.5 release. This is primarily a maintenance release that addresses a few critical problems, including: - This release resolves CVE-2023-34058. For more information on this vulnerability and its impact on VMware products, see https://www.vmware.com/security/advisories/VMSA-2023-0024.html. - This release resolves CVE-2023-34059 which only affects open-vm-tools. For more information on this vulnerability, please see the Resolved Issues section of the Release Notes. - A GitHub issue has been handled. Please see the Resolved Issues section of the Release Notes. - An update to the deployPkg plugin to coordinate with recent releases of cloud-init for improvement for guest VM customization. - For issues resolved in this release, see the Resolved Issues section of the Release Notes. - For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.3.5 - Release Notes are available at https://github.com/vmware/open-vm-tools/blob/stable-12.3.5/ReleaseNotes.md - The granular changes that have gone into the 12.3.5 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.3.5/open-vm-tools/ChangeLog - Drop patch now contained in 12.3.5: - CVE-2023-34058.patch - CVE-2023-34059.patch ------------------------------------------------------------------ ------------------ 2023-10-27 - Oct 27 2023 ------------------- ------------------------------------------------------------------ ++++ containerd: - Update to containerd v1.7.8. Upstream release notes: Includes fixes for: - CVE-2022-1996 bsc#1200528 - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch ++++ docker: - Update to Docker 24.0.7-ce. See upstream changelog online at . bsc#1217513 * Deny containers access to /sys/devices/virtual/powercap by default. - CVE-2020-8694 bsc#1170415 - CVE-2020-8695 bsc#1170446 - CVE-2020-12912 bsc#1178760 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch ------------------------------------------------------------------ ------------------ 2023-10-26 - Oct 26 2023 ------------------- ------------------------------------------------------------------ ++++ kubernetes-old: - Update .spec file to bump go version build requirements: * `BuildRequires: go >= 1.20.10` - Update to version 1.28.3: * Register UnauthenticatedHTTP2DOSMitigation into kube components (CVE-2023-44487, CVE-2023-39325), bsc#1229869 * Skip TestUnauthenticatedHTTP2ClientConnectionClose http1 tests (CVE-2023-44487, CVE-2023-39325), bsc#1229869 * Disable UnauthenticatedHTTP2DOSMitigation by default (CVE-2023-44487, CVE-2023-39325), bsc#1229869 * Prevent rapid reset http2 DOS on API server (CVE-2023-44487, CVE-2023-39325), bsc#1229869 * Fix concurrent write when filling PVC labels * Modify test PVC to detect concurrent map write bug * [go] Bump images, dependencies and versions to go 1.20.10 * Fix to honor PDB with an empty selector `{}` * .: bump golang.org/x/net to v0.17.0 * Mark a volume as uncertain-attached after detach error * Unit & integration tests for OpenAPIV2 AddUpdateAPIService * Fix 120878 - Refactor cacheabledownloader so handler can be updated and fix AddUpdateAPIService to update handler * Fix 120739 - Prevent AddUpdateAPIService from blocking on updating spec * Fix 120758 - prevent cache Load on uninitialized spec * Add nil checks for hpa object target type values * Make a certain ipv4-vs-ipv6 config error non-fatal, for backward compat * [go] Bump images, versions and deps to use Go 1.20.9 * Only configure swap if available on node * Use local isCgroup2UnifiedMode consistently * cronjob controller: ensure already existing jobs are added to Active list of cronjobs * reintroduce resourcequota.NewMonitor * change rolling update logic to exclude sunsetting nodes * vsphere: adapt to govmomi bump * .: bump govmomi to v0.30.6 * Increase range of job_sync_duration_seconds * sync Service API status rest storage * kubeadm: remove reference of k8s.io/kubernetes/pkg/apis/core/v1 * fix race on etcd client constructor for healthchecks * e2e pods: fix WaitForPodsResponding retry * kmsv2: reload metrics bug fix backport * scheduler: start scheduling attempt with clean UnschedulablePlugins ------------------------------------------------------------------ ------------------ 2023-10-24 - Oct 24 2023 ------------------- ------------------------------------------------------------------ ++++ buildah: - Update to version 1.32.1: * tag v1.32.1 * chroot.setupChrootBindMounts: pay more attention to flags * .cirrus.yml: run tests relative to the release-1.32 branch ------------------------------------------------------------------ ------------------ 2023-10-22 - Oct 22 2023 ------------------- ------------------------------------------------------------------ ++++ open-vm-tools: - Drop pkgconfig(gdk-pixbuf-xlib-2.0) BuildRequires: No longer needed, nor used (since 12.3.0 release). ------------------------------------------------------------------ ------------------ 2023-10-20 - Oct 20 2023 ------------------- ------------------------------------------------------------------ ++++ containerized-data-importer: - Update to version 1.57.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0 ++++ open-vm-tools: - Fix (bsc#1216432) - VUL-0: CVE-2023-34058: open-vm-tools: SAML token signature bypass vulnerability. - Fix (bsc#1216433) - VUL-0: : CVE-2023-34059: open-vm-tools: file descriptor hijack vulnerability + Add patch: - CVE-2023-34058.patch - CVE-2023-34059.patch ------------------------------------------------------------------ ------------------ 2023-10-18 - Oct 18 2023 ------------------- ------------------------------------------------------------------ ++++ containerized-data-importer: - Update to version 1.56.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.56.0 ++++ kubevirt: - Update to version 1.0.1 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.1 - Drop patches: 0001-guestfs-flag-to-set-uid-and-gid.patch 0002-network-Use-JSON-syntax-for-slirp-device.patch 0003-Vulnerability-fix-limit-operator-secrets-permission.patch 0004-TSC-frequencies-add-250PPM-tolerance.patch - Add patches: 0001-Fix-qemu-system-lookup.patch 0003-Virtiofs-Remove-duplicated-functional-tests.patch 0005-Support-multiple-watchdogs-in-the-domain-schema.patch ------------------------------------------------------------------ ------------------ 2023-10-13 - Oct 13 2023 ------------------- ------------------------------------------------------------------ ++++ containerd: - Update to containerd v1.7.7. Upstream release notes: - Add patch to fix build on SLE-12: + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch ------------------------------------------------------------------ ------------------ 2023-10-12 - Oct 12 2023 ------------------- ------------------------------------------------------------------ ++++ helm: - Update to version 3.13.1: * Fixing precedence issue with the import of values. * Add missing with clause to release gh action * FIX Default ServiceAccount yaml * fix(registry): unswallow error * remove useless print during prepareUpgrade * fix(registry): address anonymous pull issue * Fix missing run statement on release action * Write latest version to get.helm.sh bucket * chore(deps): bump oras.land/oras-go from 1.2.3 to 1.2.4 * Increased release information key name max length. * chore(deps): bump golang.org/x/text from 0.11.0 to 0.13.0 ++++ podman: - Use crun on Tumbleweed & ALP for WASM support ------------------------------------------------------------------ ------------------ 2023-10-11 - Oct 11 2023 ------------------- ------------------------------------------------------------------ ++++ docker: - Add a patch to fix apparmor on SLE-12, reverting the upstream removal of version-specific templating for the default apparmor profile. bsc#1213500 + 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch ------------------------------------------------------------------ ------------------ 2023-10-6 - Oct 6 2023 ------------------- ------------------------------------------------------------------ ++++ buildah: - Bump BuildRequired golang version to >= 1.21, fixes bsc#1216005 ++++ podman: - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev ------------------------------------------------------------------ ------------------ 2023-10-5 - Oct 5 2023 ------------------- ------------------------------------------------------------------ ++++ container-suseconnect: - spec file cleanups ------------------------------------------------------------------ ------------------ 2023-10-2 - Oct 2 2023 ------------------- ------------------------------------------------------------------ ++++ slirp4netns: - version update to 1.2.2 * Enabled reproducible builds (#324, #325, #326) ------------------------------------------------------------------ ------------------ 2023-9-29 - Sep 29 2023 ------------------- ------------------------------------------------------------------ ++++ podman: - Build against latest stable Go version (bsc#1215807) ------------------------------------------------------------------ ------------------ 2023-9-28 - Sep 28 2023 ------------------- ------------------------------------------------------------------ ++++ aardvark-dns: - Update to version 1.8.0: * Release v1.8.0 * update release notes for v1.8.0 * run cargo update * Packit: switch to @containers/packit-build team for copr failure notification comments * [CI:BUILD] Packit: tag @lsm5 on copr build failures * chore(deps): update rust crate chrono to 0.4.31 * cargo: bump chrono to 0.4.30 * test: IPv6 format is changed in v1.72.0 * bump nix to 0.27.1 * vendor: bump trust_dns_proto and trust_dns_client to 0.23.0 * fix(deps): update rust crate trust-dns-server to 0.23.0 * [CI:BUILD] rpm: spdx compatible license field * fix(deps): update rust crate anyhow to 1.0.75 * fix(deps): update rust crate tokio to 1.32.0 * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update rust crate tokio to 1.31.0 * fix(deps): update rust crate anyhow to 1.0.74 * fix(deps): update rust crate anyhow to 1.0.73 * fix(deps): update rust crate log to 0.4.20 * chore(deps): update dependency containers/automation_images to v20230809 * fix(deps): update rust crate tokio to 1.30.0 * fix(deps): update rust crate clap to 4.3.21 * packit: Build PRs into default packit COPRs * chore(deps): update dependency containers/automation_images to v20230807 * fix(deps): update rust crate anyhow to 1.0.72 * fix(deps): update rust crate signal-hook to 0.3.17 * fix(deps): update rust crate clap to 4.3.19 * fix(deps): update rust crate clap to 4.3.15 * fix(deps): update rust crate signal-hook to 0.3.16 * [CI:BUILD] Packit: remove pre-sync action * fix(deps): update rust crate clap to 4.3.11 * fix(deps): update rust crate tokio to 1.29.1 * fix(deps): update rust crate clap to 4.3.10 * [CI:BUILD] RPM: cleanup spec and fix eln builds * bump to v1.8.0-devel ++++ conmon: - go 1.19 EOL, swith to go >= 1.20 * [bsc#1215806] ++++ helm: - Update to version 3.13.0 (bsc#1215588): * bump version to v3.13.0 * Fix leaking goroutines in Install * chore(deps): bump github.com/containerd/containerd from 1.7.3 to 1.7.6 * chore(deps): bump github/codeql-action from 2.21.5 to 2.21.7 * Update Helm to use k8s 1.28.2 libraries * chore(deps): bump github.com/cyphar/filepath-securejoin * make the dependabot k8s.io group explicit * use dependabot's group support for k8s.io dependencies * chore(deps): bump transparencylog/github-releases-asset-transparency-verify-action * chore(deps): bump github/codeql-action from 2.21.4 to 2.21.5 * doc:Executing helm rollback release 0 will roll back to the previous release * add check if all migrations already applied * chore(deps): bump github.com/moby/term * chore(deps): bump actions/checkout from 3.5.3 to 3.6.0 * chore(deps): bump golang.org/x/term from 0.10.0 to 0.11.0 * Use labels instead of selectorLabels for pod labels * fix(helm): fix GetPodLogs, the hooks should be sorted before get the logs of each hook * chore(deps): bump github.com/rubenv/sql-migrate from 1.5.1 to 1.5.2 * add rollback unit test * fix: helm rollback err tips * chore(deps): bump github.com/containerd/containerd from 1.7.0 to 1.7.3 * Add Ian Zink (z4ce) as triage maintainer * chore(deps): bump github/codeql-action from 2.21.3 to 2.21.4 * chore: HTTPGetter add default timeout * fix: precedence typo * Avoid nil dereference if passing a nil resolver * Add required changes after merge * goimports * Fix #3352, add support for --ignore-not-found just like kubectl delete * chore(deps): bump github/codeql-action from 2.21.2 to 2.21.3 * chore(deps): bump actions/setup-go from 4.0.1 to 4.1.0 * Fix helm may identify achieve of the application/x-gzip as application/vnd.ms-fontobject * Restore `helm get metadata` command * Revert "Add `helm get metadata` command" * Update pkg/action/install.go * test: replace `ensure.TempDir` with `t.TempDir` * chore(deps): bump github/codeql-action from 2.21.0 to 2.21.2 * use json api url + report curl/wget error on fail * Added error in case try to supply custom label with name of system label during install/upgrade * Updated per feedback from gjenkins8 * fix(main): fix basic auth for helm pull or push * chore(deps): bump github.com/sirupsen/logrus from 1.9.0 to 1.9.3 * cmd: support generating index in JSON format * repo: detect JSON and unmarshal efficiently * Tweaking new dry-run internal handling * chore(deps): bump github/codeql-action from 2.20.3 to 2.21.0 * chore(deps): bump github.com/stretchr/testify from 1.8.2 to 1.8.4 * chore(deps): bump github.com/BurntSushi/toml from 1.2.1 to 1.3.2 * chore(deps): bump github.com/opencontainers/image-spec * bump kubernetes modules to v0.27.3 * chore(deps): bump actions/checkout from 3.2.0 to 3.5.3 * chore(deps): bump actions/setup-go from 3.5.0 to 4.0.1 * chore(deps): bump github/codeql-action from 2.1.37 to 2.20.3 * chore(deps): bump github.com/spf13/cobra from 1.6.1 to 1.7.0 * chore(deps): bump golang.org/x/crypto from 0.5.0 to 0.11.0 * chore(deps): bump golang.org/x/text from 0.9.0 to 0.11.0 * chore(deps): bump k8s.io/klog/v2 from 2.90.1 to 2.100.1 * chore(deps): bump github.com/docker/docker * Remove warning for template directory not found. * Add gjenkins8 as triage maintainer * Added tests for created OCI annotation time format * Add created OCI annotation * Fix multiple bugs in values handling * chore: fix a typo in `manager.go` * chore(deps): bump github.com/rubenv/sql-migrate from 1.3.1 to 1.5.1 * add GetRegistryClient method * chore(deps): bump oras.land/oras-go from 1.2.2 to 1.2.3 * oci: add tests for plain HTTP and insecure HTTPS registries * chore(deps): bump github.com/opencontainers/runc from 1.1.4 to 1.1.5 * oci: Add flag `--plain-http` to enable working with HTTP registries * docs: add an example for using the upgrade command with existing values * Replace `fmt.Fprintf` with `fmt.Fprint` in get_metadata.go * Replace `fmt.Fprintln` with `fmt.Fprintf` in get_metadata.go * update kubernetes dependencies from v0.27.0 to v0.27.1 * Add ClientOptResolver to test util file * Check that missing keys are still handled in tpl * chore(deps): bump github.com/docker/distribution * tests: change crd golden file to match after #11870 * Adding details on the Factory interface * move Joe Julian to maintainer * update autoscaling/v2beta1 to autoscaling/v2 in skeleton chart * chore(deps): bump github.com/Masterminds/squirrel from 1.5.3 to 1.5.4 * chore(deps): bump github.com/lib/pq from 1.10.7 to 1.10.9 * chore(deps): bump github.com/Masterminds/semver/v3 from 3.2.0 to 3.2.1 * bump version to v3.12.0 * feat(helm): add ability for --dry-run to do lookup functions When a helm command is run with the --dry-run flag, it will try to connect to the cluster to be able to render lookup functions. Closes #8137 * Updating the Helm maintainers * strip trailing newline from Files.Lines * add some test case * fix comment grammar error. * bugfix:(#11391) helm lint infinite loop when malformed template object * pkg/engine: fix nil-dereference * pkg/chartutil: fix nil-dereference * pkg/action: fix nil-dereference * full source path when output-dir is not provided * Update cmd/helm/upgrade.go * Update cmd/helm/install.go * added Contributing.md section and ref link in the README * fix: add podLabels * feat(helm): add ability for --dry-run to do lookup functions When a helm command is run with the --dry-run flag, it will try to connect to the cluster if the value is 'server' to be able to render lookup functions. Closes #8137 * feat(helm): add ability for --dry-run to do lookup functions * Add `CHART`, `VERSION` and `APP_VERSION` fields to `get all` command output * Adjust `get` command description to account metadata * fix typo: mountPath * add volumes and volumeMounts in chartutil * Seed a default switch to control `automountServiceAccountToken` * Avoid confusing error when passing in '--version X.Y.Z' * Use errors.Is to compare * Add `helm get metadata` command * Use wrapped error so that ErrNoObjectsVisited can be compared after return. * Add exact version test. See also #7563 Signed-off-by: Igor Manushin * Update dependabot config to include github actions * strict file permissions of repository.yaml * Check redefinition of define and include in tpl * Check that `.Template` is passed through `tpl` * Make sure empty `tpl` values render empty. * Pick the test improvement out of PR#8371 * #11369 Use the correct index repo cache directory in the `parallelRepoUpdate` method as well * #11369 Add a test case to prove the bug and its resolution * ref(helm): export DescriptorPullSummary fields * feat(helm): add 'ClientOptResolver' ClientOption * Fix flaky TestSQLCreate test by making sqlmock ignore order of sql requests * Fixing tests after adding labels to release fixture * Make default release fixture contain custom labels to make tests check that labels are not lost * Added support for storing custom labels in SQL storage driver * Adding support merging new custom labels with original release labels during upgrade * Added note to install/upgrade commands that original release labels wouldn't be persisted in upgraded release * Added unit tests for implemented install/upgrade labels logic * Remove redudant types from util_test.go * Added tests for newly introduced util.go functions * Fix broken tests for SQL storage driver * Fix broken tests for configmap and secret storage drivers * Make superseded releases keep labels * Support configmap storage driver for install/upgrade actions - -labels argument * Added upgrade --install labels argument support * Add labels support for install action with secret storage backend * test: added tests to load plugin from home dir with space * fix: plugin does not load when helm base dir contains space * Add priority class to kind sorter * Fixes #10566 * test(search): add mixedCase test case * fix(search): print repo search result in original case * Adjust error message wrongly claiming that there is a resource conflict * Throw an error from jobReady() if the job exceeds its BackoffLimit * github: add Asset Transparency action for GitHub releases ++++ netavark: - Update to version 1.8.0: * Release v1.8.0 * update release notes for v1.8.0 * run cargo update * Add vrf support for bridges * Packit: switch to @containers/packit-build team for copr failure notification comments * fix(deps): update rust crate nispor to 1.2.14 * [CI:BUILD] Packit: tag @lsm5 on copr build failures * chore(deps): update rust crate chrono to 0.4.31 * fix(deps): update rust crate serde_json to 1.0.107 * rust io safety: convert RawFd to BorrowedFd<> * bump nix to 0.27.1 * chore(deps): update rust crate chrono to 0.4.30 * fix(deps): update rust crate serde_json to 1.0.106 * chore(deps): update rust crate chrono to 0.4.29 * fix(deps): update rust crate netlink-packet-route to 0.17.1 * Bump tonic and prost * Update container image to F38 * Add ACCEPT rules in firewall for bridge network with internal dns. * chore(deps): update rust crate tonic-build to 0.10 * fix(deps): update rust crate nispor to 1.2.13 * fix(deps): update rust crate serde to 1.0.188 * Fix clippy warnings about formatting * update chrono crate * fix(deps): update rust crate url to 2.4.1 * Add protoc dependency to README * [CI:BUILD] rpm: spdx compatible license field * fix(deps): update rust crate tokio to 1.32 * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update rust crate serde_json to 1.0.105 * fix(deps): update rust crate tokio to 1.31 * fix(deps): update rust crate log to 0.4.20 * run cargo update * update tonic-build to 0.9.2 * bump rust edition to 2021 * iptables: drop invalid packages * fix(deps): update rust crate tokio to 1.30 * docs: Convert markdown with go-md2man instead of mandown * fix(deps): update rust crate clap to 4.3.21 * packit: Build PRs into default packit COPRs * chore(deps): update dependency containers/automation_images to v20230807 * fix(deps): update rust crate serde to 1.0.183 * fix(deps): update rust crate serde to 1.0.181 * fix(deps): update rust crate serde to 1.0.180 * fix(deps): update rust crate serde_json to 1.0.104 * fix(deps): update rust crate serde to 1.0.179 * fix(deps): update rust crate serde to 1.0.176 * fix(deps): update rust crate clap to 4.3.19 * fix(deps): update rust crate serde to 1.0.175 * fix(deps): update rust crate clap to 4.3.17 * fix(deps): update rust crate clap to 4.3.15 * fix(deps): update rust crate clap to 4.3.12 * fix(deps): update rust crate serde_json to 1.0.103 * [CI:BUILD] Packit: remove pre-sync action * fix(deps): update rust crate serde_json to 1.0.102 * fix(deps): update rust crate nispor to 1.2.12 * macvlan: use netlink type for bclim * bump netlink deps * fix(deps): update rust crate serde to 1.0.171 * fix(deps): update rust crate serde to 1.0.167 * fix(deps): update rust crate clap to 4.3.11 * fix(deps): update rust crate serde to 1.0.166 * fix(deps): update rust crate serde_json to 1.0.100 * iptables: improve error when ip6?tables commands are missing * fix(deps): update rust crate clap to 4.3.10 * fix(deps): update rust crate zbus to 3.14.1 * [CI:BUILD] RPM: Fix ELN build and cleanup spec * bump to v1.8.0-dev ++++ open-vm-tools: - 15 sp4 currently uses open-vm-tools rpms from 15 sp3. As such, enable the spec file fix for bug (bsc#1205927) for 15 sp3 onwards. ++++ podman: - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f ------------------------------------------------------------------ ------------------ 2023-9-27 - Sep 27 2023 ------------------- ------------------------------------------------------------------ ++++ buildah: - Update to version 1.32.0: * Tag v1.32.0 * GetTmpDir is not using ImageCopyTmpdir correctly * Run codespell on code * Bump vendor containers/(common, storage, image) * Cirrus: Remove multi-arch buildah image builds * fix(deps): update module github.com/containerd/containerd to v1.7.6 * Split GetTempDir from internal/util * Move most of internal/parse to internal/volumes * copier: remove libimage dependency via util package * Add some docs for `build --cw`, `commit --cw`, and `mkcw` * Add `buildah mkcw`, add `--cw` to `buildah commit` and `buildah build` * Make sure that pathnames picked up from the environment are absolute * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * Don't try to look up names when committing images * fix(deps): update module golang.org/x/crypto to v0.13.0 * docs: use valid github repo * fix(deps): update module golang.org/x/sys to v0.12.0 * vendor containers/common@12405381ff45 * push: --force-compression should be true with --compression-format * Update module github.com/containerd/containerd to v1.7.5 * [skip-ci] Update tim-actions/commit-message-checker-with-regex action to v0.3.2 * docs: add reference to oci-hooks * Support passing of ULimits as -1 to mean max * GHA: Attempt to fix discussion_lock workflow * Fixing the owner of the storage.conf. * pkg/chrootuser: Ignore comments when parsing /etc/group on FreeBSD * Use buildah repo rather then podman repo * GHA: Closed issue/PR comment-lock test * fix(deps): update module github.com/containers/storage to v1.49.0 * chore(deps): update dependency containers/automation_images to v20230816 * Replace troff code with markdown in buildah-{copy,add}.1.md * [CI:BUILD] rpm: spdx compatible license field * executor: build-arg warnings must honor global args * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * chroot: `setSeccomp` add support for `ArchPARISC(64)` and `ArchRISCV64` * make,cross: restore loong64 * Clear CommonBuildOpts when loading Builder status * buildah/push/manifest-push: add support for --force-compression * vendor: bump c/common to v0.55.1-0.20230811093040-524b4d5c12f9 * chore(deps): update dependency containers/automation_images to v20230809 * [CI:BUILD] RPM: fix buildtags * fix(deps): update module github.com/opencontainers/runc to v1.1.9 * chore(deps): update dependency ubuntu to v22 * chore(deps): update dependency containers/automation_images to v20230807 * [CI:BUILD] Packit: add fedora-eln targets * [CI:BUILD] RPM: build docs with vendored go-md2man * packit: Build PRs into default packit COPRs * Update install.md * Update install.md changes current Debian stable version name * fix(deps): update module golang.org/x/term to v0.11.0 * fix(deps): update module golang.org/x/crypto to v0.12.0 * tests: fix layer-label tests * buildah: add --layer-label for setting labels on layers * Cirrus: container/rootless env. var. passthrough * Cirrus: Remove duplicate env. var. definitions * fix(deps): update github.com/containers/storage digest to c3da76f * Add a missing .Close() call on an ImageSource * Create only a reference when that's all we need * Add a missing .Close() call on an ImageDestination * CI:BUILD] RPM: define gobuild macro for rhel/centos stream * manifest/push: add support for --add-compression * manifest/inspect: add support for tls-verify and authfile * vendor: bump c/common to v0.55.1-0.20230727095721-647ed1d4d79a * vendor: bump c/image to v5.26.1-0.20230726142307-8c387a14f4ac * fix(deps): update module github.com/containerd/containerd to v1.7.3 * fix(deps): update module github.com/onsi/gomega to v1.27.10 * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * fix(deps): update module github.com/containers/image/v5 to v5.26.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0 * Update vendor of containers/(storage,image,common) * fix(deps): update module github.com/opencontainers/runc to v1.1.8 * [CI:BUILD] Packit: remove pre-sync action * fix(deps): update module github.com/containers/common to v0.55.2 * [CI:BUILD] Packit: downstream task script needs GOPATH * Vendor in containers/(common, image, storage) * fix(deps): update module golang.org/x/term to v0.10.0 * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * contrib/buildahimage: set config correctly for rootless build user * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Bump to v1.32.0-dev * Update debian install instructions * pkg/overlay: add limited support for FreeBSD ------------------------------------------------------------------ ------------------ 2023-9-21 - Sep 21 2023 ------------------- ------------------------------------------------------------------ ++++ open-vm-tools: - open-vm-tools is built with containerinfo plugin from 15 sp3 onwards ------------------------------------------------------------------ ------------------ 2023-9-20 - Sep 20 2023 ------------------- ------------------------------------------------------------------ ++++ kubernetes-old: - Update to version 1.28.2: * fix(queue_test): make sure the first bind failure via counter * [go] Bump images, versions and deps to use Go 1.20.8 * scheduler: unit test case for concurrent event with other pod * scheduler: fix tracking of concurrent events * sort stability list of metrics in the shell command * Feature-gate SidecarContainers code in pkg/kubelet/kuberuntime * Add an e2e test for the pod sandbox changed scenario * fix: concurrent map writes in e2e test * Automated cherry pick of #119776: Fix a job quota related deadlock (#120319) * TopologyAwareHints: Take lock in HasPopulatedHints * Fallback to legacy discovery on a wider range of conditions in aggregator * Fix OpenAPI aggregation cleanup * apiextensions-apiserver: generate applyconfigurations * Revert to json-patch 4.12.0 * update build cross image to the correct release branch image * Mark Job onPodConditions as optional in pod failure policy * Incorporating feedback on 119341 * Release commit for Kubernetes v1.28.1 * Add wait for cache sync * check for overflow * Fix CEL cost handling of zero length replacement strings * Use env varaibles for passing path * Use environment varaibles for parameters in Powershell * e2e framework util subtle bug checking endpoints * Pass Pinned field to kubecontainer.Image * prep for go1.21: use -e in go list * kubeadm: fix nil pointer when etcd member is already removed * update to golangci-lint v1.54.1 + go-ruleguard v0.4.0 * Make gomaxprocs install optional, limit to tests * Drop [Feature: tag to make sure this tests runs on pre-submits * Statefulset should wait for new replicas when removing .start.ordinal * e2e WaitForServiceEndpointsNum take into account the address family * fix: when PreFilter returns UnschedulableAndUnresolvable, copy the state in all nodes in statusmap * Fix a bug that PostFilter plugin may not function if previous PreFilter plugins return Skip * Add test coverage of result size of string operations * Bump cel-go to v0.16.1 - initial package for Kubernetes v1.28.0 ------------------------------------------------------------------ ------------------ 2023-9-14 - Sep 14 2023 ------------------- ------------------------------------------------------------------ ++++ containerd: - Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes: bsc#1215323 ++++ docker: - Update to Docker 24.0.6-ce. See upstream changelog online at . bsc#1215323 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Switch from disabledrun to manualrun in _service. - Add a docker.socket unit file, but with socket activation effectively disabled to ensure that Docker will always run even if you start the socket individually. Users should probably just ignore this unit file. bsc#1210141 ------------------------------------------------------------------ ------------------ 2023-9-13 - Sep 13 2023 ------------------- ------------------------------------------------------------------ ++++ buildah: - Update to version 1.31.3: * [release-1.31] Bump to v1.31.3 * [release-1.31] Bump c/common 0.55.4, c/image 5.26.2, c/storage 1.48.1 * rpm: spdx compatible license field * RPM: fix buildtags * [release-1.31] Bump to v1.31.3-dev ------------------------------------------------------------------ ------------------ 2023-9-6 - Sep 6 2023 ------------------- ------------------------------------------------------------------ ++++ conmon: - Update to version 2.1.8: * stdio: ignore EIO for terminals (bsc#1217773) * ensure console socket buffers are properly sized * conmon: drop return after pexit() * ctrl: make accept4 failures fatal * logging: avoid opening /dev/null for each write * oom: restore old OOM score * Use default umask 0022 * cli: log parsing errors to stderr * Changes to build conmon for riscv64 * Changes to build conmon for ppc64le * Fix close_other_fds on FreeBSD ++++ open-vm-tools: - Update to 12.3.0 (build 22234872) (boo#1214850) - There are no new features in the open-vm-tools 12.3.0 release. This is primarily a maintenance release that addresses a few critical problems, including: - This release integrates CVE-2023-20900 without the need for a patch. For more information on this vulnerability and its impact on VMware products, see https://www.vmware.com/security/advisories/VMSA-2023-0019.html. - A tools.conf configuration setting is available to temporaily direct Linux quiesced snaphots to restore pre open-vm-tools 12.2.0 behavior of ignoring file systems already frozen. - Building of the VMware Guest Authentication Service (VGAuth) using "xml-security-c" and "xerces-c" is being deprecated. - A number of Coverity reported issues have been addressed. - A number of GitHub issues and pull requests have been handled. Please see the Resolves Issues section of the Release Notes. - For issues resolved in this release, see the Resolved Issues section of the Release Notes. - For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.3.0 - Release Notes are available at https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/ReleaseNotes.md - The granular changes that have gone into the 12.3.0 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/open-vm-tools/ChangeLog - Fix (bsc#1205927) - hv_vmbus module is loaded unnecessarily in VMware guests - jsc-PED-1344 - reinable building containerinfo plugin for SLES 15 SP4. - Drop patch now contained in 12.3.0: + 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch + 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch + 2023-20867-Remove-some-dead-code.patch + CVE-20230-20900.patch ------------------------------------------------------------------ ------------------ 2023-8-31 - Aug 31 2023 ------------------- ------------------------------------------------------------------ ++++ containerd: - Add `Provides: cri-runtime` to use containerd as container runtime in Factory Kubernetes packages ------------------------------------------------------------------ ------------------ 2023-8-29 - Aug 29 2023 ------------------- ------------------------------------------------------------------ ++++ podman: - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev ------------------------------------------------------------------ ------------------ 2023-8-28 - Aug 28 2023 ------------------- ------------------------------------------------------------------ ++++ open-vm-tools: - Fix (bsc#1214566) - (CVE-2023-20900) - VUL-0: CVE-2023-20900: open-vm-tools: SAML token signature bypass vulnerability + Add patch: CVE-20230-20900.patch ------------------------------------------------------------------ ------------------ 2023-8-21 - Aug 21 2023 ------------------- ------------------------------------------------------------------ ++++ slirp4netns: - Update to version 1.2.1: * sandbox: Add support for escaping resolv.conf symlinks (#318) * parson: update to v1.5.2 (#320) ------------------------------------------------------------------ ------------------ 2023-8-16 - Aug 16 2023 ------------------- ------------------------------------------------------------------ ++++ podman: - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error ------------------------------------------------------------------ ------------------ 2023-8-11 - Aug 11 2023 ------------------- ------------------------------------------------------------------ ++++ buildah: - Update to version 1.31.2: * [release-1.31] Bump to v1.31.2 * [release-1.31] Bump to v1.31.2-dev * [release-1.31] Bump to v1.31.1 * [release-1.31] Remove zstd:chunked from man, bump c/common to v0.55.3 * [CI:BUILD] Packit: add fedora-eln targets * [CI:BUILD] RPM: build docs with vendored go-md2man * packit: Build PRs into default packit COPRs * [CI:BUILD] Packit: remove pre-sync action * CI:BUILD] RPM: define gobuild macro for rhel/centos stream ++++ helm: - Update to version 3.12.3: * bump kubernetes modules to v0.27.3 * Add priority class to kind sorter ++++ podman: - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev ------------------------------------------------------------------ ------------------ 2023-8-3 - Aug 3 2023 ------------------- ------------------------------------------------------------------ ++++ podman: - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` ------------------------------------------------------------------ ------------------ 2023-7-25 - Jul 25 2023 ------------------- ------------------------------------------------------------------ ++++ docker: - Update to Docker 24.0.5-ce. See upstream changelog online at . bsc#1213229 ------------------------------------------------------------------ ------------------ 2023-7-21 - Jul 21 2023 ------------------- ------------------------------------------------------------------ ++++ podman: - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message ------------------------------------------------------------------ ------------------ 2023-7-20 - Jul 20 2023 ------------------- ------------------------------------------------------------------ ++++ buildah: - Update to version 1.31.1: * [release-1.31] Bump c/common ------------------------------------------------------------------ ------------------ 2023-7-13 - Jul 13 2023 ------------------- ------------------------------------------------------------------ ++++ helm: - Update to version 3.12.2: * add GetRegistryClient method * chore(deps): bump oras.land/oras-go from 1.2.2 to 1.2.3 ------------------------------------------------------------------ ------------------ 2023-7-12 - Jul 12 2023 ------------------- ------------------------------------------------------------------ ++++ containerized-data-importer: - Add registry path for SLE15 SP6 ++++ kubevirt: - Add registry path for SLE15 SP6 ------------------------------------------------------------------ ------------------ 2023-7-11 - Jul 11 2023 ------------------- ------------------------------------------------------------------ ++++ aardvark-dns: - Disable restricting builds only for tier1 platforms i.e. only for x86_64 and aarch64 and enable for all. ++++ netavark: - Disable restricting builds only for tier1 platforms i.e. only for x86_64 and aarch64 and enable for all. ------------------------------------------------------------------ ------------------ 2023-7-7 - Jul 7 2023 ------------------- ------------------------------------------------------------------ ++++ docker: - Update to Docker 24.0.4-ce. See upstream changelog online at . bsc#1213500 - Update to Docker 24.0.3-ce. See upstream changelog online at . bsc#1213120 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch ------------------------------------------------------------------ ------------------ 2023-7-3 - Jul 3 2023 ------------------- ------------------------------------------------------------------ ++++ aardvark-dns: - Update to version 1.7.0: * release v1.7.0 * Update release notes for v1.7.0 * fix(deps): update rust crate tokio to 1.29.0 * fix(deps): update rust crate clap to 4.3.8 * fix(deps): update rust crate clap to 4.3.5 * run cargo update * [CI:BUILD] Packit: add Fedora downstream tasks * fix(deps): update rust crate clap to 4.3.4 * chore(deps): update dependency containers/automation_images to v20230614 * fix(deps): update rust crate clap to 4.3.3 * fix(deps): update rust crate log to 0.4.19 * fix(deps): update rust crate clap to 4.3.2 * fix(deps): update rust crate clap to 4.3.1 * cirrus: remove verify_vendor task * chore(deps): update dependency containers/automation_images to v20230601 * fix(deps): update rust crate trust-dns-server to 0.22.1 * chore(deps): update rust crate chrono to 0.4.26 * fix(deps): update rust crate tokio to 1.28.2 * fix(deps): update rust crate log to 0.4.18 * chore(deps): update rust crate chrono to 0.4.25 * fix(deps): update rust crate clap to 4.3.0 * chore(deps): update dependency containers/automation_images to v20230517 * fix(deps): update rust crate tokio to 1.28.1 * chore(deps): update dependency containers/automation_images to v20230426 * fix(deps): update rust crate clap to 4.2.7 * fix(deps): update rust crate anyhow to 1.0.71 * fix typo in makefile * fix(deps): update rust crate tokio to 1.28.0 * fix(deps): update rust crate clap to 4.2.5 * fix(deps): update rust crate syslog to ^6.1.0 * fix(deps): update rust crate clap to 4.2.4 * fix(deps): update rust crate clap to 4.2.3 * fix(deps): update rust crate clap to v4 * chore(deps): update dependency containers/automation_images to v20230405 * bump to v1.7.0-dev ++++ buildah: - Update to version 1.31.0: * Bump 1.31.0 * Bump c/common to 0.55.1 and c/image to 5.26.1 * Update vendor of containers/common * Run unit tests for copier and chroot without -cover * Fix transition test to work with latest selinux policy * Bump c/image to 5.26.0 and c/common to 0.54.0 * chore: replace `github.com/ghodss/yaml` with `sigs.k8s.io/yaml` * rootless: use default_rootless_network_cmd config * vendor: update c/{common,image,storage} to latest * chore: pkg imported more than once * buildah: add pasta(1) support * use slirp4netns package from c/common * update c/common to latest * add hostname to /etc/hosts when running with host network * vendor: update c/common to latest * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * fix(deps): update module golang.org/x/sync to v0.3.0 * fix(deps): update module golang.org/x/crypto to v0.10.0 * Add smoke tests for encryption CLI helpers * fix(deps): update module golang.org/x/term to v0.9.0 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.3 * Remove device mapper support * Remove use of deprecated tar.TypeRegA * Update tooling to support newer golangci-lint * Make cli.EncryptConfig,DecryptConfig, GetFormat public * Don't decrypt images by default * fix(deps): update module github.com/onsi/gomega to v1.27.8 * fix(deps): update github.com/containers/storage digest to 3f3fb2f * Renovate: Don't touch fragile test stuffs * [CI:DOCS] Update comment to remove ambiguity * fix(deps): update github.com/containers/image/v5 digest to abe5133 * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * fix(deps): update module github.com/containerd/containerd to v1.7.2 * Explicitly ref. quay images for CI * At startup, log the effective capabilities for debugging * parse: use GetTempDir from internal utils * GetTmpDir: honor image_copy_tmp_dir from containers.conf * docs/Makefile: don't show sed invocations * CI: Support testing w/ podman-next COPR packages * intermediate-images inherit-label test: make it debuggable * fix(deps): update github.com/containers/common digest to 462ccdd * Add a warning to `--secret` docs * vendor: bump c/storage to v1.46.2-0.20230526114421-55ee2d19292f * executor: apply label to only final stage * remove registry.centos.org * Go back to setting SysProcAttr.Pdeathsig for child processes * Fix auth.json path (validated on Fedora 38) wq Signed-off-by: Andreas Mack * fix(deps): update module github.com/stretchr/testify to v1.8.3 * CI: fix test broken by renovatebot * chore(deps): update quay.io/libpod/testimage docker tag to v20221018 * fix(deps): update module github.com/onsi/gomega to v1.27.7 * test: use debian instead of docker.io/library/debian:testing-slim * vendor: bump logrus to 1.9.2 * [skip-ci] Update tim-actions/get-pr-commits action to v1.3.0 * Revert "Proof of concept: nightly dependency treadmill" * fix(deps): update module github.com/sirupsen/logrus to v1.9.1 * vendor in containers/(common,storage,image) * fix(deps): update module github.com/docker/distribution to v2.8.2+incompatible * run: drop Pdeathsig * chroot: lock thread before setPdeathsig * tests: add a case for required=false * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * build: validate volumes on backend * secret: accept required flag w/o value * fix(deps): update module github.com/containerd/containerd to v1.7.1 * fix(deps): update module golang.org/x/crypto to v0.9.0 * Update the demos README file to fix minor typos * fix(deps): update module golang.org/x/sync to v0.2.0 * fix(deps): update module golang.org/x/term to v0.8.0 * manifest, push: use source as destination if not specified * run,mount: remove path only if they didnt pre-exist * Cirrus: Fix meta task failing to find commit * parse: filter edge-case for podman-remote * fix(deps): update module github.com/opencontainers/runc to v1.1.7 * fix(deps): update module github.com/docker/docker to v23.0.5+incompatible * build: --platform must accept only arch * fix(deps): update module github.com/containers/common to v0.53.0 * makefile: increase conformance timeout * Cap suffixDigitsModulo to a 9-digits suffix. * Rename conflict to suffixDigitsModulo * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix(deps): update module github.com/opencontainers/runc to v1.1.6 * chore(deps): update centos docker tag to v8 * Clarify the need for qemu-user-static package * chore(deps): update quay.io/centos/centos docker tag to v8 * Renovate: Ensure test/tools/go.mod is managed * Revert "buildah image should not enable fuse-overlayfs for rootful mode" * Bump to v1.31.0-dev * parse: add support for relabel bind mount option ++++ netavark: - Update to version 1.7.0: * release v1.7.0 * Update release notes for v1.7.0 * fix(deps): update rust crate tokio to 1.29 * netavark: make --config required for dns * fix(deps): update rust crate serde_json to 1.0.99 * fix(deps): update rust crate clap to 4.3.8 * [CI:BUILD] Packit: add Fedora downstream tasks * run cargo update * fix(deps): update rust crate serde_json to 1.0.97 * fix(deps): update rust crate sha2 to 0.10.7 * fix(deps): update rust crate clap to 4.3.4 * chore(deps): update dependency containers/automation_images to v20230614 * fix(deps): update rust crate clap to 4.3.3 * fix(deps): update rust crate log to 0.4.19 * aardvark: fix missleading dns disabled log * firewall: add NETAVARK_ISOLATION_3 chain for strict isolation * docs: fix link to getting started * fix(deps): update rust crate serde to 1.0.164 * netlink: fix incorrect info log for del_route * dhcp-proxy: apply new ip address/gateway * test-dhcp: fix broekn has_ip() check * dhcp-proxy: actually implement renewing leases * dhcp-proxy: simplify code * dhcp-proxy: drop macaddr dependency * dhcp-proxy: remove some unused traits * fix(deps): update rust crate zbus to 3.13.1 * fix(deps): update rust crate clap to 4.3.2 * chore(deps): update rust crate once_cell to 1.18.0 * fix(deps): update rust crate url to 2.4.0 * fix(deps): update rust crate clap to 4.3.1 * chore(deps): update dependency containers/automation_images to v20230601 * chore(deps): update rust crate chrono to 0.4.26 * chore(deps): update rust crate chrono to 0.4.25 * fix(deps): update rust crate log to 0.4.18 * chore(deps): update rust crate once_cell to 1.17.2 * macvlan: add bclim option * parse_option(): return option instead of default * add no_default_gateway option * fix(deps): update rust crate clap to 4.3.0 * chore(deps): update dependency containers/automation_images to v20230517 * fix(deps): update rust crate serde to 1.0.163 * Add ability to add static route * fix(deps): update rust crate serde to 1.0.162 * Cirrus: Update fedora name to match image * fix(deps): update rust crate clap to 4.2.7 * chore(deps): update dependency containers/automation_images to v20230426 * correct typo in Makefile * simplify path printing * fix(deps): update rust crate tokio to 1.28 * aardvark-dns pid: return better errors * fix comment in Subnet definition * aardvark: no error when aardvark config is not there * fix(deps): update rust crate zbus to 3.12.0 * fix(deps): update rust crate clap to 4.2.4 * fix(deps): update rust crate clap to 4.2.2 * fix(deps): update rust crate serde_json to 1.0.96 * update clap to v4 * fix(deps): update rust crate serde to 1.0.160 * bump to v1.7.0-dev ------------------------------------------------------------------ ------------------ 2023-6-29 - Jun 29 2023 ------------------- ------------------------------------------------------------------ ++++ docker: - Recommend docker-rootless-extras instead of Require(ing) it, given it's an additional functionality and not inherently required for docker to function. ++++ podman: - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. ------------------------------------------------------------------ ------------------ 2023-6-27 - Jun 27 2023 ------------------- ------------------------------------------------------------------ ++++ open-vm-tools: - limit to protobuf < 22 for now until build failures have been fixed ++++ podman: - Prefer Podman's new network stack (netavark) exclusively on ALP - Remove unused podman-cni-config subpackage, add systemd ------------------------------------------------------------------ ------------------ 2023-6-23 - Jun 23 2023 ------------------- ------------------------------------------------------------------ ++++ netavark: - Add aardvark-dns as Requires for netavark ------------------------------------------------------------------ ------------------ 2023-6-20 - Jun 20 2023 ------------------- ------------------------------------------------------------------ ++++ docker: - Add docker-rootless-extras subpackage (https://docs.docker.com/engine/security/rootless) ++++ rootlesskit: - Update to version 1.1.1: * v1.1.1 * Bump up deps * Build(deps): Bump github.com/urfave/cli/v2 from 2.25.4 to 2.25.5 * Build(deps): Bump github.com/urfave/cli/v2 from 2.25.3 to 2.25.4 * Remove duplicate id ranges returned by getsubu/gid for username/uid * Build(deps): Bump github.com/sirupsen/logrus from 1.9.1 to 1.9.2 * Build(deps): Bump github.com/sirupsen/logrus from 1.9.0 to 1.9.1 * Build(deps): Bump golang.org/x/sys from 0.7.0 to 0.8.0 * Build(deps): Bump github.com/urfave/cli/v2 from 2.25.1 to 2.25.3 * Build(deps): Bump golang.org/x/sys from 0.6.0 to 0.7.0 * Build(deps): Bump github.com/urfave/cli/v2 from 2.25.0 to 2.25.1 * Build(deps): Bump golang.org/x/sys from 0.5.0 to 0.6.0 * Build(deps): Bump github.com/urfave/cli/v2 from 2.24.4 to 2.25.0 * Build(deps): Bump golang.org/x/net from 0.1.0 to 0.7.0 * Build(deps): Bump github.com/urfave/cli/v2 from 2.24.3 to 2.24.4 * CI: update Docker to v23.0.0 * Build(deps): Bump golang.org/x/sys from 0.4.0 to 0.5.0 * Build(deps): Bump github.com/urfave/cli/v2 from 2.24.2 to 2.24.3 * Build(deps): Bump github.com/urfave/cli/v2 from 2.24.1 to 2.24.2 * Build(deps): Bump github.com/urfave/cli/v2 from 2.23.7 to 2.24.1 * CI: update Docker to v23.0.0-rc.1 * Bump github.com/urfave/cli/v2 from 2.23.6 to 2.23.7 * Bump golang.org/x/sys from 0.3.0 to 0.4.0 * Bump github.com/urfave/cli/v2 from 2.23.5 to 2.23.6 * Bump golang.org/x/sys from 0.2.0 to 0.3.0 * v1.1.0+dev - Add package to SLE for docker-rootless (jsc#PED-5840) ------------------------------------------------------------------ ------------------ 2023-6-15 - Jun 15 2023 ------------------- ------------------------------------------------------------------ ++++ helm: - Update to version 3.12.1: * add some test case * fix comment grammar error. * bugfix:(#11391) helm lint infinite loop when malformed template object * chore(deps): bump github.com/opencontainers/runc from 1.1.4 to 1.1.5 * chore(deps): bump github.com/docker/distribution * update autoscaling/v2beta1 to autoscaling/v2 in skeleton chart * test(search): add mixedCase test case * chore(deps): bump github.com/lib/pq from 1.10.7 to 1.10.9 * chore(deps): bump github.com/Masterminds/squirrel from 1.5.3 to 1.5.4 * chore(deps): bump github.com/Masterminds/semver/v3 from 3.2.0 to 3.2.1 * fix(search): print repo search result in original case * strict file permissions of repository.yaml * update kubernetes dependencies from v0.27.0 to v0.27.1 ------------------------------------------------------------------ ------------------ 2023-6-14 - Jun 14 2023 ------------------- ------------------------------------------------------------------ ++++ docker: - Update to Docker 24.0.2-ce. See upstream changelog online at . bsc#1212368 * Includes the upstreamed fix for the mount table pollution issue. bsc#1210797 - Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as being provided by this package. - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch ------------------------------------------------------------------ ------------------ 2023-6-12 - Jun 12 2023 ------------------- ------------------------------------------------------------------ ++++ open-vm-tools: - Fix (bsc#1212143) - (CVE-2023-20867) - VUL-0: CVE-2023-20867: open-vm-tools: Authentication Bypass vulnerability in the vgauth module + Add patch: 2023-20867-Remove-some-dead-code.patch ------------------------------------------------------------------ ------------------ 2023-5-29 - May 29 2023 ------------------- ------------------------------------------------------------------ ++++ podman: - Update to version 4.5.1: * Release v4.5.1 * [CI:DOCS] Final release notes for v4.5.1 * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * Revert "Resolve symlink path for qemu directory if possible" * no need for podman-next rpm test on maint branch * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * network create/update: allow dns servers comma separated * machine: fix default connection URL to use 127.0.0.1 * compat: accept tag in /images/create?fromSrc * compat container create: match duplicate mounts correctly * machine: qemu only remove connection after confirmation * windows: podman save allow the use of stdout * remote: exec inspect update exec session status * podman-remote logs: handle server error correctly * libpod: stop containers with --restart=always * Do not include image annotations when building spec * [v4.5] system tests: fix race in kube-play read-only * api: fix parsing filters * Support systemd optional prefix '-' for devices. * *: migrate image registry to registry.k8s.io * Makefile: include `release-artifacts` target * [CI:BUILD] Packit: Initial Enablement * Bump to v4.5.1-dev ------------------------------------------------------------------ ------------------ 2023-5-21 - May 21 2023 ------------------- ------------------------------------------------------------------ ++++ containerd: - Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes: bsc#1211578 - Require a minimum Go version explicitly rather than using golang(API). Fixes the change for bsc#1210298. ++++ docker: - Update to Docker 23.0.6-ce. See upstream changelog online at . bsc#1211578 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Re-unify packaging for SLE-12 and SLE-15. - Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers (the uapi headers in SLE-12 are too old). + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch - Re-numbered patches: - 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch` ------------------------------------------------------------------ ------------------ 2023-5-16 - May 16 2023 ------------------- ------------------------------------------------------------------ ++++ python3-kubernetes: - changes to fix unresolvable/failing package build for SLE-15-SP4, https://build.suse.de/request/show/297283 : * added: `BuildRequires: %{python_module Sphinx >= 1.3.1}` * reverted below changes from `Wed May 3 09:53:22 UTC 2023` * * reverted: `%python_build` -> `%pyproject_wheel` and `%python_install` -> `%pyproject_install` * * reverted: `BuildRequires: %{python_module pip}` * * reverted: `BuildRequires: %{python_module wheel}` ------------------------------------------------------------------ ------------------ 2023-5-12 - May 12 2023 ------------------- ------------------------------------------------------------------ ++++ distribution: - update to 2.8.2 (bsc#1207705, CVE-2023-2253, bsc#1210428): * Revert registry/client: set `Accept: identity` header when getting layers * Parse `http` forbidden as denied * Fix CVE-2023-2253 runaway allocation on /v2/_catalog * Fix panic in inmemory driver * update to go1.19.9 * Add code to handle pagination of parts. Fixes max layer size of 10GB bug * Dockerfile: fix filenames of artifacts - drop aws-sdk-1.42.27-update.patch (no longer wanted) - drop 0001-Fix-runaway-allocation-on-v2-_catalog.patch (upstream) ------------------------------------------------------------------ ------------------ 2023-5-11 - May 11 2023 ------------------- ------------------------------------------------------------------ ++++ helm: - Update to version 3.12.0 (bsc#1215711, CVE-2023-25173): * bump version to v3.12.0 * Attach annotations to OCI artifacts * chore: bump k8s.io dependencies to v0.27.1 * Bump k8s.io deps from v0.26.0 to v0.27.0 * Only run tests once * chore(deps): bump golang.org/x/text from 0.7.0 to 0.9.0 * Fix goroutine leak in action install * fix quiet lint does not fail on non-linting errors * create failing test for quietly linting a chart that doesn't exist * chore(deps): bump github.com/docker/docker * Fixes Readiness Check for statefulsets using partitioned rolling update. (#11774) * fix: failed testcase on windows * Fix 32bit-x86 typo in testsuite * chore(deps): bump github.com/containerd/containerd from 1.6.15 to 1.7.0 * Handle failed DNS case for Go 1.20+ * Updating the Go version in go.mod * Bump the Go version * Fix goroutine leak in perform * Properly invalidate client after CRD install * Provide a helper to set the registryClient in cmd * Reimplemented change in httpgetter for insecure TLS option * Removed conditional * Added insecure option to login subcommand * Added support for insecure OCI registries * Enable custom certificates option for OCI * Add testing to default and release branches * Added back CircleCI config.yaml * Updates based on feedback * Removed remaining CircleCI artifacts * Remove job dependency. Should have done when I moved job to new file * Remove check to run only in helm org * Add why comments * Convert remaining CircleCI config to GitHub Actions * Changed how the setup-go action sets go version * CircleCI Migration * chore:Use http constants as http.request parameters * update k8s registry domain * don't mark issues as stale where a PR is in progress * chore(deps): bump github.com/rubenv/sql-migrate from 1.2.0 to 1.3.1 * Update to func handling * Add option to support cascade deletion options * the linter varcheck and deadcode are deprecated (since v1.49.0) * Check status code before retrying request * Fix improper use of Table request/response to k8s API * bump version to v3.11.0 * fix template --output-dir issue * Add protection for stack-overflows for nested keys * Fixing indentation * feature(helm): add --set-literal flag for literal string interpretation