# SPDX-License-Identifier: Apache-2.0
%global debug_package %{nil}
%global _build_id_links none
# Preserve the upstream executables byte for byte after signature verification.
%global __brp_strip %{nil}
%global __brp_strip_static_archive %{nil}
%global __brp_strip_comment_note %{nil}
%global selinuxtype targeted

Name:           gvisor
Version:        20260928.0
Release:        1%{?dist}
Summary:        Sandboxed OCI container runtime
License:        Apache-2.0 AND MIT AND BSD-3-Clause
URL:            https://gvisor.dev/
Source0:        https://storage.googleapis.com/gvisor/releases/pool/%{version}/binary-amd64/runsc.deb#/runsc-amd64.deb
Source1:        https://storage.googleapis.com/gvisor/releases/pool/%{version}/binary-arm64/runsc.deb#/runsc-arm64.deb
Source2:        gvisor.asc
Source3:        InRelease
Source4:        Packages-amd64
Source5:        Packages-arm64
Source6:        verify-release.py
Source7:        https://raw.githubusercontent.com/google/gvisor/release-%{version}/LICENSE
Source8:        runsc-kvm
Source9:        50-gvisor.conf
Source10:       gvisor.cil
Source11:       README.md

ExclusiveArch:  x86_64 aarch64
BuildRequires:  python3
BuildRequires:  gnupg2
BuildRequires:  binutils
BuildRequires:  tar
BuildRequires:  gzip
BuildRequires:  selinux-policy-devel
Requires:       %{name}-selinux = %{version}-%{release}
Provides:       runsc = %{version}-%{release}

%description
Google's official stable gVisor release binaries, authenticated using the
upstream signed APT index and packaged without recompilation or stripping.
Includes runsc and its complete matching helper directory, plus optional
Podman runtime entries for systrap and KVM. The default container runtime,
host security settings and running services are not changed.

%package containerd
Summary:        Containerd shim for the gVisor runtime
Requires:       %{name}%{?_isa} = %{version}-%{release}

%description containerd
The matching upstream containerd-shim-runsc-v1 binary. This package does not
install a containerd daemon or modify an existing containerd configuration.

%package selinux
Summary:        SELinux file labels for gVisor
BuildArch:      noarch
Requires:       container-selinux
Requires:       selinux-policy-targeted
Requires(postun): policycoreutils
Requires(posttrans): policycoreutils
%{?selinux_requires_min}

%description selinux
Labels the gVisor runtime and its helpers with Fedora's existing container
runtime executable type. This policy adds file labels only, without new
access rules, permissive domains, or changes to SELinux booleans.

%prep
%setup -q -c -T
%ifarch x86_64
python3 %{SOURCE6} %{_sourcedir} --version %{version} --arch amd64
ar x %{SOURCE0}
%else
python3 %{SOURCE6} %{_sourcedir} --version %{version} --arch arm64
ar x %{SOURCE1}
%endif
tar --extract --gzip --file data.tar.gz --no-same-owner usr/bin
install -m0644 %{SOURCE7} LICENSE
install -m0644 %{SOURCE11} README.md

%build
# The verified official binaries are the build inputs.

%install
install -d -m0755 %{buildroot}%{_libexecdir}/gvisor/gvisor-bin
install -pm0755 usr/bin/runsc %{buildroot}%{_libexecdir}/gvisor/runsc
for helper in checkpointgofer gvisor-sentry-prewarmer gvisor_sentry runsc-fd-parking runsc-metric-server; do
    install -pm0755 usr/bin/gvisor-bin/$helper %{buildroot}%{_libexecdir}/gvisor/gvisor-bin/$helper
done
install -Dpm0755 usr/bin/containerd-shim-runsc-v1 %{buildroot}%{_bindir}/containerd-shim-runsc-v1
install -Dpm0755 %{SOURCE8} %{buildroot}%{_bindir}/runsc-kvm
ln -s ../libexec/gvisor/runsc %{buildroot}%{_bindir}/runsc
install -Dpm0644 %{SOURCE9} %{buildroot}%{_datadir}/containers/containers.conf.d/50-gvisor.conf
install -Dpm0644 %{SOURCE10} %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}/gvisor.cil

%check
test "$(%{buildroot}%{_libexecdir}/gvisor/runsc --version | sed -n 's/^runsc version //p')" = "release-%{version}"
cmp usr/bin/runsc %{buildroot}%{_libexecdir}/gvisor/runsc
cmp usr/bin/containerd-shim-runsc-v1 %{buildroot}%{_bindir}/containerd-shim-runsc-v1
for helper in checkpointgofer gvisor-sentry-prewarmer gvisor_sentry runsc-fd-parking runsc-metric-server; do
    test -x %{buildroot}%{_libexecdir}/gvisor/gvisor-bin/$helper
    cmp usr/bin/gvisor-bin/$helper %{buildroot}%{_libexecdir}/gvisor/gvisor-bin/$helper
done
test "$(find usr/bin/gvisor-bin -type f | wc -l)" -eq 5
python3 -c 'import tomllib; tomllib.load(open("%{SOURCE9}", "rb"))'
bash -n %{SOURCE8}

%post selinux
%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/gvisor.cil

%postun selinux
%selinux_modules_uninstall -s %{selinuxtype} gvisor

%posttrans selinux
if selinuxenabled; then
    restorecon -R %{_libexecdir}/gvisor %{_bindir}/runsc %{_bindir}/runsc-kvm 2>/dev/null || :
fi

%files
%license LICENSE
%doc README.md
%{_bindir}/runsc
%{_bindir}/runsc-kvm
%{_libexecdir}/gvisor/
%dir %{_datadir}/containers
%dir %{_datadir}/containers/containers.conf.d
%{_datadir}/containers/containers.conf.d/50-gvisor.conf

%files containerd
%{_bindir}/containerd-shim-runsc-v1

%files selinux
%license LICENSE
%{_datadir}/selinux/packages/%{selinuxtype}/gvisor.cil

%changelog
* Tue Oct 06 2026 gVisor RPM maintainers - 20260928.0-1
- Package authenticated upstream releases for Fedora and Secureblue.
- Include all helpers, optional KVM integration and SELinux file labels.