# SPDX-License-Identifier: Apache-2.0
%global commit e8a2a28891ba41f3fb737dee8bb7120745d75826
%global go_commit f7823281fa4485c87f1db03f9c8b016abd74e413
%global go_base_commit 8686fbc69d8037d5a2b994d17e74b27255a836bc
%global go_version 1.27.3
%global selinuxtype targeted
%global go_licenses Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND MIT
# Fedora's default per-package build ID collides across these five programs.
# Append an ID derived from each Go build while preserving all Fedora flags.
%define gvisor_ldflags %{gobuild_ldflags} -B gobuildid

Name:           gvisor
Version:        20261026.0
Release:        1%{?dist}
Summary:        OCI container runtime with a user-space kernel
# Go sources plus the libc/libgcc runtime linked by static PIE.
License:        %{go_licenses} AND LGPL-2.1-or-later AND (GPL-3.0-or-later WITH GCC-exception-3.1)
URL:            https://gvisor.dev/
# Upstream-generated Go source. Any reviewed release delta is pinned in Source5.
Source0:        https://codeload.github.com/google/gvisor/tar.gz/%{go_commit}#/gvisor-%{go_commit}.tar.gz
# Generated with Fedora go-vendor-tools; contains source dependencies only.
Source1:        %{name}-%{version}-vendor.tar.gz
Source2:        go-vendor-tools.toml
# Original C/assembly/BPF sources omitted by the generated Go export.
Source3:        https://codeload.github.com/google/gvisor/tar.gz/%{commit}#/gvisor-%{commit}.tar.gz
Source4:        source-release.py
Source5:        upstream.json
Source6:        prepare-go-source.py
Source7:        build-native.sh
Source8:        runsc-kvm
Source9:        50-gvisor.conf
Source10:       gvisor.cil
Source11:       README.md
Source12:       freestanding-pie.lds
Source13:       check-helpers.py
Source14:       LINKING.md
%if "%{commit}" != "%{go_base_commit}"
# Verify the complete base-to-release source delta before applying the overlay.
Source15:       https://codeload.github.com/google/gvisor/tar.gz/%{go_base_commit}#/gvisor-%{go_base_commit}.tar.gz
%endif
# Backport upstream's compatibility fix for Fedora 45/Rawhide's Go 1.27.
Patch0:         grpc-go127.patch
# Keep the freestanding ARM64 helper free of runtime relocations.
Patch1:         freestanding-pie.patch

ExclusiveArch:  x86_64 aarch64
BuildRequires:  go-vendor-tools
BuildRequires:  go-rpm-macros
BuildRequires:  golang >= %{go_version}
BuildRequires:  gcc
BuildRequires:  gcc-c++
BuildRequires:  glibc-static
BuildRequires:  binutils
BuildRequires:  clang
BuildRequires:  libbpf-devel
%ifarch x86_64
# clang -target bpf selects glibc's 32-bit header stubs.
BuildRequires:  glibc-devel(x86-32)
%endif
BuildRequires:  python3
BuildRequires:  python3-pyelftools
BuildRequires:  patch
BuildRequires:  selinux-policy-devel
Requires:       %{name}-selinux = %{version}-%{release}
Provides:       runsc = %{version}-%{release}
# Migration from the retired Fedora runtime and the COPR predecessor.
# Keep these compatibility names through Fedora 46; review removal for Fedora 47.
Provides:       golang-gvisor = %{version}-%{release}
Provides:       golang-gvisor%{?_isa} = %{version}-%{release}
Obsoletes:      golang-gvisor < 20261012.0-2

%description
gVisor is an OCI container runtime that runs applications inside a user-space
kernel. This package includes runsc and its matching helper directory, plus
Podman runtime entries for system-call interception and KVM.

%package containerd
Summary:        Containerd shim for the gVisor runtime
License:        %{go_licenses}
Requires:       %{name}%{?_isa} = %{version}-%{release}

Provides:       golang-gvisor-containerd = %{version}-%{release}
Provides:       golang-gvisor-containerd%{?_isa} = %{version}-%{release}
Obsoletes:      golang-gvisor-containerd < 20261012.0-2

%description containerd
The containerd shim compiled from the same gVisor source release.

%package selinux
Summary:        SELinux file labels for gVisor
License:        Apache-2.0
BuildArch:      noarch
Requires:       container-selinux
Requires:       selinux-policy-targeted
Requires(postun): policycoreutils
Requires(posttrans): policycoreutils
Requires(posttrans): libselinux-utils
Requires(posttrans): container-selinux
Requires(posttrans): selinux-policy-targeted
Provides:       golang-gvisor-selinux = %{version}-%{release}
Obsoletes:      golang-gvisor-selinux < 20261012.0-2
%{?selinux_requires_min}

%description selinux
Labels gVisor executables with Fedora's existing container runtime type.
This policy supplies file contexts and does not add access rules.

%prep
%if "%{commit}" != "%{go_base_commit}"
%define gvisor_base_arg --base-archive %{SOURCE15}
%else
%define gvisor_base_arg %{nil}
%endif
python3 %{SOURCE4} verify --pin %{SOURCE5} --archive %{SOURCE0} --master-archive %{SOURCE3} %{gvisor_base_arg}
%setup -q -n gvisor-%{go_commit}
# Reject new embedded binaries and regenerate every known one from source.
python3 %{SOURCE6} --pin %{SOURCE5} --master-archive %{SOURCE3} %{gvisor_base_arg} .
# The vendor archive may include go.mod/go.sum changes from go mod tidy.
tar -xzf %{SOURCE1}
%patch -P0 -p1
%patch -P1 -p1 -d .rpm-native
install -m0644 %{SOURCE11} RPM-README.md
install -m0644 %{SOURCE14} RPM-LINKING.md

%generate_buildrequires
%go_vendor_license_buildrequires -c %{SOURCE2}

%build
export CGO_ENABLED=1 GO_BUILDTAGS="netgo osusergo" GO111MODULE=on GOTOOLCHAIN=local GOPROXY=off GOSUMDB=off
export GOCACHE="$PWD/.gocache"
export GO_LDFLAGS="-X gvisor.dev/gvisor/runsc/version.version=release-%{version}"
export CFLAGS="%{build_cflags}"
export CGO_CFLAGS="%{build_cflags}"
bash %{SOURCE7} "$PWD/.rpm-native" "$PWD" %{SOURCE12}
# Only runsc (its gofer subcommand) and the sentry re-exec after pivot_root.
# Scope static libc linkage to those two programs; preserve all Fedora flags.
# See RPM-LINKING.md for source references and the maintenance requirements.
%define __golang_extldflags -static-pie
%gobuild -ldflags="%{gvisor_ldflags}" -mod=vendor -p=%{_smp_build_ncpus} -o release/runsc ./runsc
%gobuild -ldflags="%{gvisor_ldflags}" -mod=vendor -p=%{_smp_build_ncpus} -o release/gvisor-bin/gvisor_sentry ./runsc/cmd/sentry
%undefine __golang_extldflags
# Host-side processes can use the system loader and shared libc normally.
%gobuild -ldflags="%{gvisor_ldflags}" -mod=vendor -p=%{_smp_build_ncpus} -o release/containerd-shim-runsc-v1 ./shim
%gobuild -ldflags="%{gvisor_ldflags}" -mod=vendor -p=%{_smp_build_ncpus} -o release/gvisor-bin/checkpointgofer ./runsc/checkpointgofer
%gobuild -ldflags="%{gvisor_ldflags}" -mod=vendor -p=%{_smp_build_ncpus} -o release/gvisor-bin/runsc-metric-server ./runsc/cmd/metricserver

%install
install -d -m0755 %{buildroot}%{_libexecdir}/gvisor/gvisor-bin
install -pm0755 release/runsc %{buildroot}%{_libexecdir}/gvisor/runsc
cp -a release/gvisor-bin/. %{buildroot}%{_libexecdir}/gvisor/gvisor-bin/
install -Dpm0755 release/containerd-shim-runsc-v1 %{buildroot}%{_bindir}/containerd-shim-runsc-v1
install -Dpm0755 %{SOURCE8} %{buildroot}%{_bindir}/runsc-kvm
ln -s ../libexec/gvisor/runsc %{buildroot}%{_bindir}/runsc
install -Dpm0644 %{SOURCE9} %{buildroot}%{_datadir}/containers/containers.conf.d/50-gvisor.conf
install -Dpm0644 %{SOURCE10} %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}/gvisor.cil
%go_vendor_license_install -c %{SOURCE2}
# Preserve the system runtime notices too; these are not Go modules scanned by
# go-vendor-tools. The matching system SRPMs are identified in the build log.
install -d %{buildroot}%{_licensedir}/%{name}/system-runtime/{glibc,libgcc}
cp -p %{_licensedir}/glibc/* %{buildroot}%{_licensedir}/%{name}/system-runtime/glibc/
cp -p %{_licensedir}/libgcc/* %{buildroot}%{_licensedir}/%{name}/system-runtime/libgcc/
rpm -q --qf '%%{NAME} %%{EVR}.%%{ARCH} source=%%{SOURCERPM}\n' glibc-static libgcc

%check
test "$(%{buildroot}%{_libexecdir}/gvisor/runsc --version | sed -n 's/^runsc version //p')" = "release-%{version}"
# RPM's debug extraction and stripping have already run by this stage.
for helper in checkpointgofer gvisor-sentry-prewarmer gvisor_sentry runsc-fd-parking runsc-metric-server gvisor-proc-umounter; do
    test -x %{buildroot}%{_libexecdir}/gvisor/gvisor-bin/$helper
done
test "$(find release/gvisor-bin -type f | wc -l)" -eq 6
# Validate each executable's linking policy, PIE, W^X and unique build ID.
# Exercise native helpers and the dynamically linked host-side processes.
python3 %{SOURCE13} %{buildroot}%{_libexecdir}/gvisor %{buildroot}%{_bindir}/containerd-shim-runsc-v1
python3 -c 'import tomllib; tomllib.load(open("%{SOURCE9}", "rb"))'
bash -n %{SOURCE8}

export CGO_ENABLED=1 GO_BUILDTAGS="netgo osusergo" GO111MODULE=on GOTOOLCHAIN=local GOPROXY=off GOSUMDB=off
export GOCACHE="$PWD/.gocache"
%gotest -mod=vendor ./pkg/binary ./pkg/fspath
go_vendor_license -c %{SOURCE2} report --verify '%{go_licenses}'

%postun selinux
%selinux_modules_uninstall -s %{selinuxtype} gvisor

%posttrans selinux
# A rename erases the predecessor with $1=0; its postun removes this module.
# Install after all erasures so the policy survives that migration.
%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/gvisor.cil
if selinuxenabled; then
    restorecon -R %{_libexecdir}/gvisor %{_bindir}/runsc %{_bindir}/runsc-kvm 2>/dev/null || :
fi

%files -f %{go_vendor_license_filelist}
%doc RPM-README.md RPM-LINKING.md
%license %{_licensedir}/%{name}/system-runtime/
%{_bindir}/runsc
%{_bindir}/runsc-kvm
%{_libexecdir}/gvisor/
%dir %{_datadir}/containers
%dir %{_datadir}/containers/containers.conf.d
%{_datadir}/containers/containers.conf.d/50-gvisor.conf

%files containerd
%{_bindir}/containerd-shim-runsc-v1

%files selinux
%license LICENSE
%{_datadir}/selinux/packages/%{selinuxtype}/gvisor.cil

%changelog
* Wed Oct 28 2026 gVisor RPM maintainers - 20261026.0-1
- Update to upstream stable release 20261026.0 and Fedora Go 1.27.3.
- Verify the parent Go export and restore the single tagged source change.

* Fri Oct 23 2026 gVisor RPM maintainers - 20261019.0-2
- Dynamically link the host-side shim, metrics server and checkpoint gofer.
- Limit static libc to runsc and the sentry; document the sandbox requirement.
- Check per-program linking, RELRO/NOW and offline host-side service protocols.

* Fri Oct 23 2026 gVisor RPM maintainers - 20261019.0-1
- Update to upstream stable release 20261019.0.
- Build the new proc-unmount helper with static PIE and native protocol checks.
- Use upstream's newly complete Go helper export directly.

* Sat Oct 17 2026 gVisor RPM maintainers - 20261012.0-4
- Expand Fedora linker flags at build time so package notes are retained.

* Sat Oct 17 2026 gVisor RPM maintainers - 20261012.0-3
- Keep AArch64 helper GOT slots within the small read-only image.
- Use a PC-relative reference for the freestanding parking helper's name.

* Sat Oct 17 2026 gVisor RPM maintainers - 20261012.0-2
- Rename the vendored application to gvisor with runtime upgrade compatibility.
- Preserve the SELinux module when replacing the old package names.
- Build every executable as static PIE and retain Fedora's Go hardening flags.
- Add native helper lifecycle and ELF hardening checks.

* Sat Oct 17 2026 gVisor RPM maintainers - 20261012.0-1
- Update to upstream stable release 20261012.0.
- Require Fedora's Go 1.27.2 and adapt to upstream's external-only helpers.

* Wed Oct 07 2026 gVisor RPM maintainers - 20260928.0-2
- Backport upstream gRPC HTTP/2 compatibility for Fedora's Go 1.27.

* Wed Oct 07 2026 gVisor RPM maintainers - 20260928.0-1
- Update the retired golang-gvisor runtime using Fedora's Go toolchain.
- Rebuild every embedded native input and ship the complete helper directory.