Skip to content

Commit fdfae9c

Browse files
hbebermanjslobodzian
hbeberman
authored and
jslobodzian
committed
moby-containerd: fix test compatibility with golang 1.21 (#8031)
1 parent 8d75f68 commit fdfae9c

File tree

4 files changed

+104
-2
lines changed

4 files changed

+104
-2
lines changed

‎SPECS/moby-containerd-cc/fix_cc_tests_for_golang1.21.patch

+47
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
Backported from upstream 5d9bf7d1398f645882e5c2becc7815daa1770c26
2+
3+
Signed-off-by: Akihiro Suda <[email protected]>
4+
Signed-off-by: Henry Beberman <[email protected]>
5+
6+
diff -Naur a/contrib/apparmor/apparmor.go b/contrib/apparmor/apparmor.go
7+
--- a/contrib/apparmor/apparmor.go 2024-02-09 13:19:03.000000000 +0000
8+
+++ b/contrib/apparmor/apparmor.go 2024-02-22 00:22:43.993021818 +0000
9+
@@ -39,6 +39,11 @@
10+
11+
// WithDefaultProfile will generate a default apparmor profile under the provided name
12+
// for the container. It is only generated if a profile under that name does not exist.
13+
+//
14+
+// FIXME: pkg/cri/[sb]server/container_create_linux_test.go depends on go:noinline
15+
+// since Go 1.21.
16+
+//
17+
+//go:noinline
18+
func WithDefaultProfile(name string) oci.SpecOpts {
19+
return func(_ context.Context, _ oci.Client, _ *containers.Container, s *specs.Spec) error {
20+
if err := LoadDefaultProfile(name); err != nil {
21+
diff -Naur a/contrib/seccomp/seccomp.go b/contrib/seccomp/seccomp.go
22+
--- a/contrib/seccomp/seccomp.go 2024-02-09 13:19:03.000000000 +0000
23+
+++ b/contrib/seccomp/seccomp.go 2024-02-22 00:49:25.471844786 +0000
24+
@@ -30,6 +30,11 @@
25+
// WithProfile receives the name of a file stored on disk comprising a json
26+
// formatted seccomp profile, as specified by the opencontainers/runtime-spec.
27+
// The profile is read from the file, unmarshaled, and set to the spec.
28+
+//
29+
+// FIXME: pkg/cri/[sb]server/container_create_linux_test.go depends on go:noinline
30+
+// since Go 1.21.
31+
+//
32+
+//go:noinline
33+
func WithProfile(profile string) oci.SpecOpts {
34+
return func(_ context.Context, _ oci.Client, _ *containers.Container, s *specs.Spec) error {
35+
s.Linux.Seccomp = &specs.LinuxSeccomp{}
36+
@@ -46,6 +51,11 @@
37+
38+
// WithDefaultProfile sets the default seccomp profile to the spec.
39+
// Note: must follow the setting of process capabilities
40+
+//
41+
+// FIXME: pkg/cri/[sb]server/container_create_linux_test.go depends on go:noinline
42+
+// since Go 1.21.
43+
+//
44+
+//go:noinline
45+
func WithDefaultProfile() oci.SpecOpts {
46+
return func(_ context.Context, _ oci.Client, _ *containers.Container, s *specs.Spec) error {
47+
s.Linux.Seccomp = DefaultProfile(s)

‎SPECS/moby-containerd-cc/moby-containerd-cc.spec

+5-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
Summary: Industry-standard container runtime for confidential containers
77
Name: moby-%{upstream_name}
88
Version: 1.7.7
9-
Release: 1%{?dist}
9+
Release: 2%{?dist}
1010
License: ASL 2.0
1111
Group: Tools/Container
1212
URL: https://www.containerd.io
@@ -18,6 +18,7 @@ Source1: containerd.service
1818
Source2: containerd.toml
1919
Patch0: CVE-2023-47108.patch
2020
Patch1: CVE-2023-44487.patch
21+
Patch2: fix_cc_tests_for_golang1.21.patch
2122

2223
%{?systemd_requires}
2324

@@ -79,6 +80,9 @@ fi
7980
%config(noreplace) %{_sysconfdir}/containerd/config.toml
8081

8182
%changelog
83+
* Wed Feb 21 2024 Henry Beberman <[email protected]> - 1.7.7-2
84+
- Backport upstream patch for no-inlining seccomp and apparmor functions to fix tests.
85+
8286
* Tue Feb 20 2024 Mitch Zhu <[email protected]> - 1.7.7-1
8387
- Upgrade to upstream containerd v1.7.7.
8488

‎SPECS/moby-containerd/fix_tests_for_golang1.21.patch

+47
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
Backported from upstream 5d9bf7d1398f645882e5c2becc7815daa1770c26
2+
3+
Signed-off-by: Akihiro Suda <[email protected]>
4+
Signed-off-by: Henry Beberman <[email protected]>
5+
6+
diff -Naur a/contrib/apparmor/apparmor.go b/contrib/apparmor/apparmor.go
7+
--- a/contrib/apparmor/apparmor.go 2023-12-08 23:30:22.000000000 +0000
8+
+++ b/contrib/apparmor/apparmor.go 2024-02-21 23:33:58.302514996 +0000
9+
@@ -40,6 +40,11 @@
10+
11+
// WithDefaultProfile will generate a default apparmor profile under the provided name
12+
// for the container. It is only generated if a profile under that name does not exist.
13+
+//
14+
+// FIXME: pkg/cri/[sb]server/container_create_linux_test.go depends on go:noinline
15+
+// since Go 1.21.
16+
+//
17+
+//go:noinline
18+
func WithDefaultProfile(name string) oci.SpecOpts {
19+
return func(_ context.Context, _ oci.Client, _ *containers.Container, s *specs.Spec) error {
20+
if err := LoadDefaultProfile(name); err != nil {
21+
diff -Naur a/contrib/seccomp/seccomp.go b/contrib/seccomp/seccomp.go
22+
--- a/contrib/seccomp/seccomp.go 2023-12-08 23:30:22.000000000 +0000
23+
+++ b/contrib/seccomp/seccomp.go 2024-02-21 23:34:20.362648277 +0000
24+
@@ -30,6 +30,11 @@
25+
// WithProfile receives the name of a file stored on disk comprising a json
26+
// formatted seccomp profile, as specified by the opencontainers/runtime-spec.
27+
// The profile is read from the file, unmarshaled, and set to the spec.
28+
+//
29+
+// FIXME: pkg/cri/[sb]server/container_create_linux_test.go depends on go:noinline
30+
+// since Go 1.21.
31+
+//
32+
+//go:noinline
33+
func WithProfile(profile string) oci.SpecOpts {
34+
return func(_ context.Context, _ oci.Client, _ *containers.Container, s *specs.Spec) error {
35+
s.Linux.Seccomp = &specs.LinuxSeccomp{}
36+
@@ -46,6 +51,11 @@
37+
38+
// WithDefaultProfile sets the default seccomp profile to the spec.
39+
// Note: must follow the setting of process capabilities
40+
+//
41+
+// FIXME: pkg/cri/[sb]server/container_create_linux_test.go depends on go:noinline
42+
+// since Go 1.21.
43+
+//
44+
+//go:noinline
45+
func WithDefaultProfile() oci.SpecOpts {
46+
return func(_ context.Context, _ oci.Client, _ *containers.Container, s *specs.Spec) error {
47+
s.Linux.Seccomp = DefaultProfile(s)

‎SPECS/moby-containerd/moby-containerd.spec

+5-1
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
Summary: Industry-standard container runtime
66
Name: moby-%{upstream_name}
77
Version: 1.6.26
8-
Release: 3%{?dist}
8+
Release: 4%{?dist}
99
License: ASL 2.0
1010
Group: Tools/Container
1111
URL: https://www.containerd.io
@@ -17,6 +17,7 @@ Source1: containerd.service
1717
Source2: containerd.toml
1818
Patch0: Makefile.patch
1919
Patch1: add_ptrace_readby_tracedby_to_apparmor.patch
20+
Patch2: fix_tests_for_golang1.21.patch
2021

2122
%{?systemd_requires}
2223

@@ -90,6 +91,9 @@ fi
9091
%dir /opt/containerd/lib
9192

9293
%changelog
94+
* Wed Feb 21 2024 Henry Beberman <[email protected]> - 1.6.26-4
95+
- Backport upstream patch for no-inlining seccomp and apparmor functions to fix tests.
96+
9397
* Fri Feb 02 2024 CBL-Mariner Servicing Account <[email protected]> - 1.6.26-3
9498
- Bump release to rebuild with go 1.21.6
9599

0 commit comments

Comments
 (0)