.gitignore

@@ -1 +1 @@
-SOURCES/toolbox-0.1.1-vendored.tar.xz
+SOURCES/toolbox-0.0.99.4-vendored.tar.xz

.toolbox.metadata

@@ -1 +1 @@
-6eb68dfe5b1cb7e8653a34d9bf38c68c06d4fa8e SOURCES/toolbox-0.1.1-vendored.tar.xz
+3a2506e53c44cab54d476ee38af7197175e8af10 SOURCES/toolbox-0.0.99.4-vendored.tar.xz

SOURCES/toolbox-Add-migration-paths-for-coreos-toolbox-users.patch

@@ -1,4 +1,4 @@
-From c25ad44b7cb50d470b1533931b7808cc194f0d50 Mon Sep 17 00:00:00 2001
+From d461caa5b1a278124d039df93140d2d5bf4eabe7 Mon Sep 17 00:00:00 2001
 From: Debarshi Ray <rishi@fedoraproject.org>
 Date: Wed, 18 Aug 2021 17:55:21 +0200
 Subject: [PATCH 1/2] cmd/run: Make sosreport work by setting the HOST
@@ -10,10 +10,10 @@ https://bugzilla.redhat.com/show_bug.cgi?id=1940037
  1 file changed, 1 insertion(+)
 
 diff --git a/src/cmd/run.go b/src/cmd/run.go
-index 719c0d6abb20..92a097283f38 100644
+index 7657ffa50821..23d422623b14 100644
 --- a/src/cmd/run.go
 +++ b/src/cmd/run.go
-@@ -566,6 +566,7 @@ func constructExecArgs(container, preserveFDs string,
+@@ -501,6 +501,7 @@ func constructExecArgs(container, preserveFDs string,
  	execArgs = append(execArgs, envOptions...)
  
  	execArgs = append(execArgs, []string{
@@ -22,10 +22,10 @@ index 719c0d6abb20..92a097283f38 100644
  		"--preserve-fds", preserveFDs,
  	}...)
 -- 
-2.46.1
+2.39.2
 
 
-From e7877a4d1d38dc35aa6da6c012ec9a23397b7aa4 Mon Sep 17 00:00:00 2001
+From 3c2c67752e8f88f72058799cbce3612fc937b230 Mon Sep 17 00:00:00 2001
 From: Debarshi Ray <rishi@fedoraproject.org>
 Date: Fri, 10 Dec 2021 13:42:15 +0100
 Subject: [PATCH 2/2] test/system: Update to test the migration path for
@@ -36,39 +36,36 @@ This reverts the changes to the tests made in commit
 ca899c8a561f357ae32c6ba6813520fd8b682abb and the parts of commit
 3aeb7cf288319e35eb9c5e26ea18d97452462c1e that were removed.
 ---
- test/system/002-help.bats | 14 --------------
+ test/system/002-help.bats | 11 -----------
  test/system/100-root.bats | 27 +++++++++++++++++++++++++++
- 2 files changed, 27 insertions(+), 14 deletions(-)
+ 2 files changed, 27 insertions(+), 11 deletions(-)
  create mode 100644 test/system/100-root.bats
 
 diff --git a/test/system/002-help.bats b/test/system/002-help.bats
-index a8bfbc2c79d2..5dd14025ea0b 100644
+index 7e4565e9d23d..58a4c2c87ece 100644
 --- a/test/system/002-help.bats
 +++ b/test/system/002-help.bats
-@@ -33,20 +33,6 @@ teardown() {
+@@ -23,17 +23,6 @@ setup() {
-   cleanup_all
+   _setup_environment
  }
  
--@test "help: Smoke test" {
+-@test "help: Try to run toolbox with no command" {
--  run --keep-empty-lines --separate-stderr "$TOOLBX"
+-  run $TOOLBOX
 -
 -  assert_failure
--  assert [ ${#lines[@]} -eq 0 ]
--  lines=("${stderr_lines[@]}")
 -  assert_line --index 0 "Error: missing command"
--  assert_line --index 2 "create    Create a new Toolbx container"
+-  assert_line --index 1 "create    Create a new toolbox container"
--  assert_line --index 3 "enter     Enter an existing Toolbx container"
+-  assert_line --index 2 "enter     Enter an existing toolbox container"
--  assert_line --index 4 "list      List all existing Toolbx containers and images"
+-  assert_line --index 3 "list      List all existing toolbox containers and images"
--  assert_line --index 6 "Run 'toolbox --help' for usage."
+-  assert_line --index 4 "Run 'toolbox --help' for usage."
--  assert [ ${#stderr_lines[@]} -eq 7 ]
 -}
 -
- @test "help: Command 'help'" {
+ @test "help: Run command 'help'" {
    if ! command -v man 2>/dev/null; then
-     skip "not found man(1)"
+     skip "Test works only if man is in PATH"
 diff --git a/test/system/100-root.bats b/test/system/100-root.bats
 new file mode 100644
-index 000000000000..cf35d60ac25c
+index 000000000000..32d87904213e
 --- /dev/null
 +++ b/test/system/100-root.bats
 @@ -0,0 +1,27 @@
@@ -80,15 +77,15 @@ index 000000000000..cf35d60ac25c
 +
 +setup() {
 +  _setup_environment
-+  cleanup_all
++  cleanup_containers
 +}
 +
 +teardown() {
-+  cleanup_all
++  cleanup_containers
 +}
 +
 +@test "root: Try to enter the default container with no containers created" {
-+  run "$TOOLBX" <<< "n"
++  run $TOOLBOX <<< "n"
 +
 +  assert_success
 +  assert_line --index 0 "No toolbox containers found. Create now? [y/N] A container can be created later with the 'create' command."
@@ -100,5 +97,5 @@ index 000000000000..cf35d60ac25c
 +  skip "Testing of entering toolboxes is not implemented"
 +}
 -- 
-2.46.1
+2.39.2
 

SOURCES/toolbox-Don-t-use-podman-1-when-generating-the-comp.patch

@@ -0,0 +1,89 @@
+From fc5f568c5d82f4a16982268fa67092e52be91fbe Mon Sep 17 00:00:00 2001
+From: Debarshi Ray <rishi@fedoraproject.org>
+Date: Tue, 28 Feb 2023 17:12:04 +0100
+Subject: [PATCH] cmd/root: Don't use podman(1) when generating the completions
+
+Ever since commit bafbbe81c9220cb3, the shell completions are generated
+while building Toolbx using the 'completion' command.  This involves
+running toolbox(1) itself, and hence invoking 'podman version' to decide
+if 'podman system migrate' is needed or not.
+
+Unfortunately, some build environments, like Fedora's, are set up inside
+a chroot(2) or systemd-nspawn(1) or similar, where 'podman version' may
+not work because it does various things with namespaces(7) and clone(2)
+that can, under certain circumstances, encounter an EPERM.
+
+Therefore, it's better to avoid using podman(1) when generating the
+shell completions, especially, since they are generated by Cobra itself
+and podman(1) is not involved at all.
+
+Note that podman(1) is needed when the generated shell completions are
+actually used in interactive command line environments.  The shell
+completions invoke the hidden '__complete' command to get the results
+that are presented to the user, and, if needed, 'podman system migrate'
+will continue to be run as part of that.
+
+This partially reverts commit f3e005d0142d7ec76d5ac8f0a2f331a52fd46011
+because podman(1) is now only an optional runtime dependency for the
+system tests.
+
+https://github.com/containers/podman/issues/17657
+---
+ meson.build     | 2 +-
+ src/cmd/root.go | 9 +++++++--
+ 2 files changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/meson.build b/meson.build
+index 6f044bb204e3..653a3d3ac588 100644
+--- a/meson.build
++++ b/meson.build
+@@ -18,12 +18,12 @@ subid_dep = cc.find_library('subid', has_headers: ['shadow/subid.h'])
+ 
+ go = find_program('go')
+ go_md2man = find_program('go-md2man')
+-podman = find_program('podman')
+ 
+ bats = find_program('bats', required: false)
+ codespell = find_program('codespell', required: false)
+ htpasswd = find_program('htpasswd', required: false)
+ openssl = find_program('openssl', required: false)
++podman = find_program('podman', required: false)
+ shellcheck = find_program('shellcheck', required: false)
+ skopeo = find_program('skopeo', required: false)
+ 
+diff --git a/src/cmd/root.go b/src/cmd/root.go
+index 304b03dcd889..9975ccc7a4c8 100644
+--- a/src/cmd/root.go
++++ b/src/cmd/root.go
+@@ -166,7 +166,7 @@ func preRun(cmd *cobra.Command, args []string) error {
+ 
+ 	logrus.Debugf("TOOLBOX_PATH is %s", toolboxPath)
+ 
+-	if err := migrate(); err != nil {
++	if err := migrate(cmd, args); err != nil {
+ 		return err
+ 	}
+ 
+@@ -211,13 +211,18 @@ func rootRun(cmd *cobra.Command, args []string) error {
+ 	return rootRunImpl(cmd, args)
+ }
+ 
+-func migrate() error {
++func migrate(cmd *cobra.Command, args []string) error {
+ 	logrus.Debug("Migrating to newer Podman")
+ 
+ 	if utils.IsInsideContainer() {
+ 		return nil
+ 	}
+ 
++	if cmdName, completionCmdName := cmd.Name(), completionCmd.Name(); cmdName == completionCmdName {
++		logrus.Debugf("Migration not needed: command %s doesn't need it", cmdName)
++		return nil
++	}
++
+ 	configDir, err := os.UserConfigDir()
+ 	if err != nil {
+ 		logrus.Debugf("Migrating to newer Podman: failed to get the user config directory: %s", err)
+-- 
+2.39.1
+

SOURCES/toolbox-Don-t-validate-subordinate-IDs-when-generat.patch

@@ -0,0 +1,149 @@
+From 52de8d4a933ab6a4b1b6ef1c02c7e9f1f834c4a5 Mon Sep 17 00:00:00 2001
+From: Debarshi Ray <rishi@fedoraproject.org>
+Date: Wed, 1 Mar 2023 19:41:56 +0100
+Subject: [PATCH 1/3] cmd/root: Sprinkle a debug log
+
+https://github.com/containers/toolbox/pull/1251
+---
+ src/cmd/root.go | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/cmd/root.go b/src/cmd/root.go
+index 304b03dcd889..82fbfd651c33 100644
+--- a/src/cmd/root.go
++++ b/src/cmd/root.go
+@@ -215,6 +215,7 @@ func migrate() error {
+ 	logrus.Debug("Migrating to newer Podman")
+ 
+ 	if utils.IsInsideContainer() {
++		logrus.Debug("Migration not needed: running inside a container")
+ 		return nil
+ 	}
+ 
+-- 
+2.39.2
+
+
+From 0beab62c935cd1166d6b03f58c519bbc7b040221 Mon Sep 17 00:00:00 2001
+From: Debarshi Ray <rishi@fedoraproject.org>
+Date: Wed, 1 Mar 2023 19:46:11 +0100
+Subject: [PATCH 2/3] cmd/root: Shuffle some code around and sprinkle some
+ debug logs
+
+Having a separate convenience function reduces the indentation levels by
+at least one, and sometimes two, and makes it easy to have more detailed
+debug logs.
+
+This will make the subsequent commit easier to read.
+
+https://github.com/containers/toolbox/issues/1246
+---
+ src/cmd/root.go | 32 ++++++++++++++++++++++++--------
+ 1 file changed, 24 insertions(+), 8 deletions(-)
+
+diff --git a/src/cmd/root.go b/src/cmd/root.go
+index 82fbfd651c33..4c740ec60d38 100644
+--- a/src/cmd/root.go
++++ b/src/cmd/root.go
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright © 2019 – 2022 Red Hat Inc.
++ * Copyright © 2019 – 2023 Red Hat Inc.
+  *
+  * Licensed under the Apache License, Version 2.0 (the "License");
+  * you may not use this file except in compliance with the License.
+@@ -139,13 +139,8 @@ func preRun(cmd *cobra.Command, args []string) error {
+ 	if !utils.IsInsideContainer() {
+ 		logrus.Debugf("Running on a cgroups v%d host", cgroupsVersion)
+ 
+-		if currentUser.Uid != "0" {
+-			logrus.Debugf("Looking for sub-GID and sub-UID ranges for user %s", currentUser.Username)
+-
+-			if _, err := utils.ValidateSubIDRanges(currentUser); err != nil {
+-				logrus.Debugf("Looking for sub-GID and sub-UID ranges: %s", err)
+-				return newSubIDError()
+-			}
++		if _, err := validateSubIDRanges(cmd, args, currentUser); err != nil {
++			return err
+ 		}
+ 	}
+ 
+@@ -387,3 +382,24 @@ func setUpLoggers() error {
+ 
+ 	return nil
+ }
++
++func validateSubIDRanges(cmd *cobra.Command, args []string, user *user.User) (bool, error) {
++	logrus.Debugf("Looking for sub-GID and sub-UID ranges for user %s", user.Username)
++
++	if user.Uid == "0" {
++		logrus.Debugf("Look-up not needed: user %s doesn't need them", user.Username)
++		return true, nil
++	}
++
++	if utils.IsInsideContainer() {
++		logrus.Debug("Look-up not needed: running inside a container")
++		return true, nil
++	}
++
++	if _, err := utils.ValidateSubIDRanges(user); err != nil {
++		logrus.Debugf("Looking for sub-GID and sub-UID ranges: %s", err)
++		return false, newSubIDError()
++	}
++
++	return true, nil
++}
+-- 
+2.39.2
+
+
+From d09c9cd1de41b6e85a6953902c9982778a423f3c Mon Sep 17 00:00:00 2001
+From: Jan Zerebecki <jan.suse@zerebecki.de>
+Date: Wed, 1 Mar 2023 19:52:28 +0100
+Subject: [PATCH 3/3] cmd/root: Don't validate subordinate IDs when generating
+ the completions
+
+Ever since commit bafbbe81c9220cb3, the shell completions are generated
+while building Toolbx using the 'completion' command.  This involves
+running toolbox(1) itself, and hence validating the subordinate user and
+group ID ranges.
+
+Unfortunately, some build environments, like openSUSE's, don't have
+subordinate ID ranges set up.  Therefore, it's better to not validate
+the subordinate ID ranges when generating the shell completions, since
+they are generated by Cobra itself and subordinate ID ranges are not
+involved at all.
+
+Note that subordinate ID ranges may be needed when the generated shell
+completions are actually used in interactive command line environments.
+The shell completions invoke the hidden '__complete' command to get the
+results that are presented to the user, and, if needed, the subordinate
+ID ranges will continue to be used by podman(1) as part of that.
+
+Some changes by Debarshi Ray.
+
+https://github.com/containers/toolbox/issues/1246
+https://github.com/containers/toolbox/pull/1249
+---
+ src/cmd/root.go | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/src/cmd/root.go b/src/cmd/root.go
+index 4c740ec60d38..efee8ce9990b 100644
+--- a/src/cmd/root.go
++++ b/src/cmd/root.go
+@@ -396,6 +396,11 @@ func validateSubIDRanges(cmd *cobra.Command, args []string, user *user.User) (bo
+ 		return true, nil
+ 	}
+ 
++	if cmdName, completionCmdName := cmd.Name(), completionCmd.Name(); cmdName == completionCmdName {
++		logrus.Debugf("Look-up not needed: command %s doesn't need them", cmdName)
++		return true, nil
++	}
++
+ 	if _, err := utils.ValidateSubIDRanges(user); err != nil {
+ 		logrus.Debugf("Looking for sub-GID and sub-UID ranges: %s", err)
+ 		return false, newSubIDError()
+-- 
+2.39.2
+

SOURCES/toolbox-Make-the-build-flags-match-Fedora.patch

@@ -1,47 +0,0 @@
-From 7dc70160c8ff531473004e879dd57ec303789d71 Mon Sep 17 00:00:00 2001
-From: Debarshi Ray <rishi@fedoraproject.org>
-Date: Mon, 29 Jun 2020 17:57:47 +0200
-Subject: [PATCH] build: Make the build flags match Fedora's %{gobuildflags}
-
-Note that these flags are meant for every CPU architecture other than
-PPC64, and should be kept updated to match Fedora's Go guidelines. Use
-'rpm --eval "%{gobuildflags}"' to expand the %{gobuildflags} macro.
----
- src/go-build-wrapper | 11 ++++++++---
- 1 file changed, 8 insertions(+), 3 deletions(-)
-
-diff --git a/src/go-build-wrapper b/src/go-build-wrapper
-index a5a1a6a508fb..5978422e9aed 100755
---- a/src/go-build-wrapper
-+++ b/src/go-build-wrapper
-@@ -33,9 +33,9 @@ if ! cd "$1"; then
-     exit 1
- fi
- 
--tags=""
-+tags="-tags rpm_crashtraceback,${GO_BUILDTAGS:-}"
- if $7; then
--    tags="-tags migration_path_for_coreos_toolbox"
-+    tags="$tags,migration_path_for_coreos_toolbox"
- fi
- 
- if ! libc_dir=$("$5" --print-file-name=libc.so); then
-@@ -114,9 +114,14 @@ dynamic_linker="/run/host$dynamic_linker_canonical_dirname/$dynamic_linker_basen
- 
- # shellcheck disable=SC2086
- go build \
-+        -buildmode pie \
-+        -compiler gc \
-         $tags \
-         -trimpath \
--        -ldflags "-extldflags '-Wl,-dynamic-linker,$dynamic_linker -Wl,-rpath,/run/host$libc_dir_canonical_dirname -Wl,--export-dynamic -Wl,--unresolved-symbols=ignore-in-object-files' -linkmode external -X github.com/containers/toolbox/pkg/version.currentVersion=$4" \
-+        -ldflags "${GO_LDFLAGS:-} -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \n') -compressdwarf=false -extldflags '-Wl,-z,relro -Wl,--as-needed -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -Wl,--build-id=sha1 -specs=/usr/lib/rpm/redhat/redhat-package-notes -Wl,-dynamic-linker,$dynamic_linker -Wl,-rpath,/run/host$libc_dir_canonical_dirname -Wl,--export-dynamic -Wl,--unresolved-symbols=ignore-in-object-files' -linkmode external -X github.com/containers/toolbox/pkg/version.currentVersion=$4" \
-+        -a \
-+        -v \
-+        -x \
-         -o "$2/$3"
- 
- exit "$?"
--- 
-2.46.1
-

SOURCES/toolbox-Make-the-build-flags-match-RHEL-10.patch

@@ -1,71 +0,0 @@
-From f08f64c0d5f2019055381c3c00426fe8545e5e31 Mon Sep 17 00:00:00 2001
-From: Debarshi Ray <rishi@fedoraproject.org>
-Date: Mon, 29 Jun 2020 17:57:47 +0200
-Subject: [PATCH] build: Make the build flags match RHEL 10's %{gobuildflags}
-
-These reflect the defaults for RHEL 10.0 Beta, because RHEL 10.0 is
-still early in its development cycle and the defaults may be in a state
-of flux.  Some exceptions are mentioned below.
-
-The '-z pack-relative-relocs' linker flag was left out.  It's currently
-not supported on s390x, so using it would require architecture specific
-patches, which is a hassle.  Support for aarch64 was recently added [1],
-so hopefully s390x will also be supported soon.
-
-The change to use the RPM's %{name}, %{version}, %{release} and the
-SOURCE_DATE_EPOCH environment variable [2], instead of /dev/urandom, to
-generate the build ID annotation for the toolbox(1) binary [2] was left
-out.  It will need more work to propagate the RPM's %{name}, %{version}
-and %{release} to Meson.
-
-Note that these flags are meant for every CPU architecture other than
-PPC64, and should be kept updated to match RHEL 10's Go guidelines. Use
-'rpm --eval "%{gobuildflags}"' to expand the %{gobuildflags} macro.
-
-[1] CentOS Stream redhat-rpm-config commit 3c5a6b17540b2a0b
-    https://gitlab.com/redhat/centos-stream/rpms/redhat-rpm-config/-/commit/3c5a6b17540b2a0b
-    https://gitlab.com/redhat/centos-stream/rpms/redhat-rpm-config/-/merge_requests/42
-    https://issues.redhat.com/browse/RHEL-40379
-
-[2] go-rpm-macros commit 1980932bf3a21890
-    https://pagure.io/go-rpm-macros/c/1980932bf3a21890
-    https://fedoraproject.org/wiki/Changes/ReproduciblePackageBuilds
----
- src/go-build-wrapper | 11 ++++++++---
- 1 file changed, 8 insertions(+), 3 deletions(-)
-
-diff --git a/src/go-build-wrapper b/src/go-build-wrapper
-index a5a1a6a508fb..5978422e9aed 100755
---- a/src/go-build-wrapper
-+++ b/src/go-build-wrapper
-@@ -33,9 +33,9 @@ if ! cd "$1"; then
-     exit 1
- fi
- 
--tags=""
-+tags="-tags rpm_crashtraceback,${GO_BUILDTAGS:-}"
- if $7; then
--    tags="-tags migration_path_for_coreos_toolbox"
-+    tags="$tags,migration_path_for_coreos_toolbox"
- fi
- 
- if ! libc_dir=$("$5" --print-file-name=libc.so); then
-@@ -114,9 +114,14 @@ dynamic_linker="/run/host$dynamic_linker_canonical_dirname/$dynamic_linker_basen
- 
- # shellcheck disable=SC2086
- go build \
-+        -buildmode pie \
-+        -compiler gc \
-         $tags \
-         -trimpath \
--        -ldflags "-extldflags '-Wl,-dynamic-linker,$dynamic_linker -Wl,-rpath,/run/host$libc_dir_canonical_dirname -Wl,--export-dynamic -Wl,--unresolved-symbols=ignore-in-object-files' -linkmode external -X github.com/containers/toolbox/pkg/version.currentVersion=$4" \
-+        -ldflags "${GO_LDFLAGS:-} -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \n') -compressdwarf=false -extldflags '-Wl,-z,relro -Wl,--as-needed -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -Wl,--build-id=sha1 -specs=/usr/lib/rpm/redhat/redhat-package-notes -Wl,-dynamic-linker,$dynamic_linker -Wl,-rpath,/run/host$libc_dir_canonical_dirname -Wl,--export-dynamic -Wl,--unresolved-symbols=ignore-in-object-files' -linkmode external -X github.com/containers/toolbox/pkg/version.currentVersion=$4" \
-+        -a \
-+        -v \
-+        -x \
-         -o "$2/$3"
- 
- exit "$?"
--- 
-2.46.1
-

SOURCES/toolbox-Make-the-build-flags-match-RHEL-9.patch

@@ -1,50 +0,0 @@
-From ff1320fa869f1e4952836436ab2ad928cbba0987 Mon Sep 17 00:00:00 2001
-From: Debarshi Ray <rishi@fedoraproject.org>
-Date: Mon, 29 Jun 2020 17:57:47 +0200
-Subject: [PATCH] build: Make the build flags match RHEL 9's %{gobuildflags}
-
-These reflect the defaults for RHEL 9.5, because RHEL 9.6 is still early
-in its development cycle and the defaults may be in a state of flux.
-
-Note that these flags are meant for every CPU architecture other than
-PPC64, and should be kept updated to match RHEL 9's Go guidelines. Use
-'rpm --eval "%{gobuildflags}"' to expand the %{gobuildflags} macro.
----
- src/go-build-wrapper | 11 ++++++++---
- 1 file changed, 8 insertions(+), 3 deletions(-)
-
-diff --git a/src/go-build-wrapper b/src/go-build-wrapper
-index a5a1a6a508fb..0a2c7526f210 100755
---- a/src/go-build-wrapper
-+++ b/src/go-build-wrapper
-@@ -33,9 +33,9 @@ if ! cd "$1"; then
-     exit 1
- fi
- 
--tags=""
-+tags="-tags rpm_crashtraceback,${GO_BUILDTAGS:-},libtrust_openssl"
- if $7; then
--    tags="-tags migration_path_for_coreos_toolbox"
-+    tags="$tags,migration_path_for_coreos_toolbox"
- fi
- 
- if ! libc_dir=$("$5" --print-file-name=libc.so); then
-@@ -114,9 +114,14 @@ dynamic_linker="/run/host$dynamic_linker_canonical_dirname/$dynamic_linker_basen
- 
- # shellcheck disable=SC2086
- go build \
-+        -buildmode pie \
-+        -compiler gc \
-         $tags \
-         -trimpath \
--        -ldflags "-extldflags '-Wl,-dynamic-linker,$dynamic_linker -Wl,-rpath,/run/host$libc_dir_canonical_dirname -Wl,--export-dynamic -Wl,--unresolved-symbols=ignore-in-object-files' -linkmode external -X github.com/containers/toolbox/pkg/version.currentVersion=$4" \
-+        -ldflags "${GO_LDFLAGS:-} -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \n') -compressdwarf=false -extldflags '-Wl,-z,relro -Wl,--as-needed -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -Wl,-dynamic-linker,$dynamic_linker -Wl,-rpath,/run/host$libc_dir_canonical_dirname -Wl,--export-dynamic -Wl,--unresolved-symbols=ignore-in-object-files' -linkmode external -X github.com/containers/toolbox/pkg/version.currentVersion=$4" \
-+        -a \
-+        -v \
-+        -x \
-         -o "$2/$3"
- 
- exit "$?"
--- 
-2.46.1
-

SOURCES/toolbox-Make-the-build-flags-match-RHEL-s-gobuild-for-PPC64.patch

@@ -0,0 +1,55 @@
+From 973600219168f3c4efeb627c103085555327eaa5 Mon Sep 17 00:00:00 2001
+From: Debarshi Ray <rishi@fedoraproject.org>
+Date: Mon, 29 Jun 2020 17:57:47 +0200
+Subject: [PATCH] build: Make the build flags match RHEL's %{gobuildflags} for
+ PPC64
+
+The Go toolchain also doesn't like the LDFLAGS environment variable as
+exported by RHEL's %{meson} RPM macro, and RHEL's RPM toolchain doesn't
+like the compressed DWARF data generated by the Go toolchain.
+
+Note that these flags are only meant for the "ppc64" CPU architecture,
+and should be kept updated to match RHEL's Go guidelines. Use
+'rpm --eval "%{gobuildflags}"' to expand the %{gobuildflags} macro.
+---
+ src/go-build-wrapper | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/src/go-build-wrapper b/src/go-build-wrapper
+index c572d6dfb02b..86f174716608 100755
+--- a/src/go-build-wrapper
++++ b/src/go-build-wrapper
+@@ -33,9 +33,9 @@ if ! cd "$1"; then
+     exit 1
+ fi
+ 
+-tags=""
++tags="-tags rpm_crashtraceback,${BUILDTAGS:-},libtrust_openssl"
+ if $7; then
+-    tags="-tags migration_path_for_coreos_toolbox"
++    tags="$tags,migration_path_for_coreos_toolbox"
+ fi
+ 
+ if ! libc_dir=$("$5" --print-file-name=libc.so); then
+@@ -70,11 +70,16 @@ fi
+ 
+ dynamic_linker="/run/host$dynamic_linker_canonical_dirname/$dynamic_linker_basename"
+ 
++unset LDFLAGS
++
+ # shellcheck disable=SC2086
+ go build \
++        -compiler gc \
+         $tags \
+-        -trimpath \
+-        -ldflags "-extldflags '-Wl,-dynamic-linker,$dynamic_linker -Wl,-rpath,/run/host$libc_dir_canonical_dirname' -linkmode external -X github.com/containers/toolbox/pkg/version.currentVersion=$4" \
++        -ldflags "${LDFLAGS:-} -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \n') -compressdwarf=false -extldflags '-Wl,-z,relro -Wl,--as-needed -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -Wl,-dynamic-linker,$dynamic_linker -Wl,-rpath,/run/host$libc_dir_canonical_dirname' -linkmode external -X github.com/containers/toolbox/pkg/version.currentVersion=$4" \
++        -a \
++        -v \
++        -x \
+         -o "$2/$3"
+ 
+ exit "$?"
+-- 
+2.39.2
+

SOURCES/toolbox-Make-the-build-flags-match-RHEL-s-gobuild.patch

@@ -0,0 +1,55 @@
+From aeaa8cd30a8c5ad33ee1fe6b9e84ecbb28f7264c Mon Sep 17 00:00:00 2001
+From: Debarshi Ray <rishi@fedoraproject.org>
+Date: Mon, 29 Jun 2020 17:57:47 +0200
+Subject: [PATCH] build: Make the build flags match RHEL's %{gobuildflags}
+
+The Go toolchain doesn't like the LDFLAGS environment variable as
+exported by RHEL's %{meson} RPM macro, and RHEL's RPM toolchain doesn't
+like the compressed DWARF data generated by the Go toolchain.
+
+Note that these flags are meant for every CPU architecture other than
+PPC64, and should be kept updated to match RHEL's Go guidelines. Use
+'rpm --eval "%{gobuildflags}"' to expand the %{gobuildflags} macro.
+---
+ src/go-build-wrapper | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/src/go-build-wrapper b/src/go-build-wrapper
+index c572d6dfb02b..d39764fda0c1 100755
+--- a/src/go-build-wrapper
++++ b/src/go-build-wrapper
+@@ -33,9 +33,9 @@ if ! cd "$1"; then
+     exit 1
+ fi
+ 
+-tags=""
++tags="-tags rpm_crashtraceback,${BUILDTAGS:-},libtrust_openssl"
+ if $7; then
+-    tags="-tags migration_path_for_coreos_toolbox"
++    tags="$tags,migration_path_for_coreos_toolbox"
+ fi
+ 
+ if ! libc_dir=$("$5" --print-file-name=libc.so); then
+@@ -70,11 +70,17 @@ fi
+ 
+ dynamic_linker="/run/host$dynamic_linker_canonical_dirname/$dynamic_linker_basename"
+ 
++unset LDFLAGS
++
+ # shellcheck disable=SC2086
+ go build \
++        -buildmode pie \
++        -compiler gc \
+         $tags \
+-        -trimpath \
+-        -ldflags "-extldflags '-Wl,-dynamic-linker,$dynamic_linker -Wl,-rpath,/run/host$libc_dir_canonical_dirname' -linkmode external -X github.com/containers/toolbox/pkg/version.currentVersion=$4" \
++        -ldflags "${LDFLAGS:-} -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \n') -compressdwarf=false -extldflags '-Wl,-z,relro -Wl,--as-needed -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -Wl,-dynamic-linker,$dynamic_linker -Wl,-rpath,/run/host$libc_dir_canonical_dirname' -linkmode external -X github.com/containers/toolbox/pkg/version.currentVersion=$4" \
++        -a \
++        -v \
++        -x \
+         -o "$2/$3"
+ 
+ exit "$?"
+-- 
+2.39.2
+

SOURCES/toolbox-cmd-initContainer-Be-aware-of-security-hardened-moun.patch

@@ -0,0 +1,76 @@
+From 1cc9e07b7c36fe9f9784b40b58f0a2a3694dd328 Mon Sep 17 00:00:00 2001
+From: Debarshi Ray <rishi@fedoraproject.org>
+Date: Thu, 13 Jul 2023 13:08:40 +0200
+Subject: [PATCH] cmd/initContainer: Be aware of security hardened mount points
+
+Sometimes locations such as /var/lib/flatpak, /var/lib/systemd/coredump
+and /var/log/journal sit on security hardened mount points that are
+marked as 'nosuid,nodev,noexec' [1].  In such cases, when Toolbx is used
+rootless, an attempt to bind mount these locations read-only at runtime
+with mount(8) fails because of permission problems:
+  # mount --rbind -o ro <source> <containerPath>
+  mount: <containerPath>: filesystem was mounted, but any subsequent
+      operation failed: Unknown error 5005.
+
+(Note that the above error message from mount(8) was subsequently
+improved to show something more meaningful than 'Unknown error' [2].)
+
+The problem is that 'init-container' is running inside the container's
+mount and user namespace, and the source paths were mounted inside the
+host's namespace with 'nosuid,nodev,noexec'.  The above mount(8) call
+tries to remove the 'nosuid,nodev,noexec' flags from the mount point and
+replace them with only 'ro', which is something that can't be done from
+a child namespace.
+
+Note that this doesn't fail when Toolbx is running as root.  This is
+because the container uses the host's user namespace and is able to
+remove the 'nosuid,nodev,noexec' flags from the mount point and replace
+them with only 'ro'.  Even though it doesn't fail, the flags shouldn't
+get replaced like that inside the container, because it removes the
+security hardening of those mount points.
+
+There's actually no benefit in bind mounting these paths as read-only.
+It was historically done this way 'just to be safe' because a user isn't
+expected to write to these locations from inside a container.  However,
+Toolbx doesn't intend to provide any heightened security beyond what's
+already available on the host.
+
+Hence, it's better to get out of the way and leave it to the permissions
+on the source location from the host operating system to guard the
+castle.  This is accomplished by not passing any file system options to
+mount(8) [1].
+
+Based on an idea from Si.
+
+[1] https://man7.org/linux/man-pages/man8/mount.8.html
+
+[2] util-linux commit 9420ca34dc8b6f0f
+    https://github.com/util-linux/util-linux/commit/9420ca34dc8b6f0f
+    https://github.com/util-linux/util-linux/pull/2376
+
+https://github.com/containers/toolbox/issues/911
+---
+ src/cmd/initContainer.go | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/src/cmd/initContainer.go b/src/cmd/initContainer.go
+index 222aa42e1036..41b825b33f58 100644
+--- a/src/cmd/initContainer.go
++++ b/src/cmd/initContainer.go
+@@ -62,10 +62,10 @@ var (
+ 		{"/run/udev/data", "/run/host/run/udev/data", ""},
+ 		{"/run/udev/tags", "/run/host/run/udev/tags", ""},
+ 		{"/tmp", "/run/host/tmp", "rslave"},
+-		{"/var/lib/flatpak", "/run/host/var/lib/flatpak", "ro"},
++		{"/var/lib/flatpak", "/run/host/var/lib/flatpak", ""},
+ 		{"/var/lib/libvirt", "/run/host/var/lib/libvirt", ""},
+-		{"/var/lib/systemd/coredump", "/run/host/var/lib/systemd/coredump", "ro"},
+-		{"/var/log/journal", "/run/host/var/log/journal", "ro"},
++		{"/var/lib/systemd/coredump", "/run/host/var/lib/systemd/coredump", ""},
++		{"/var/log/journal", "/run/host/var/log/journal", ""},
+ 		{"/var/mnt", "/run/host/var/mnt", "rslave"},
+ 	}
+ )
+-- 
+2.41.0
+

SPECS/toolbox.spec

@@ -1,59 +1,41 @@
 %global __brp_check_rpaths %{nil}
 
 Name:          toolbox
-Version:       0.1.1
+Version:       0.0.99.4
 
 %global goipath github.com/containers/%{name}
 
-%if 0%{?fedora}
+%if 0%{?rhel} == 9
-%gometa -f
-%endif
-
-%if 0%{?rhel}
-%if 0%{?rhel} <= 9
 %gometa
 %else
 %gometa -f
 %endif
-%endif
 
-%global toolbx_go 1.20
+Release:       6%{?dist}
+Summary:       Tool for containerized command line environments on Linux
 
-%if 0%{?fedora}
+License:       ASL 2.0
-%global toolbx_go 1.22.7
-%endif
-
-%if 0%{?rhel}
-%if 0%{?rhel} == 9
-%global toolbx_go 1.22.5
-%elif 0%{?rhel} == 10
-%global toolbx_go 1.22.5
-%elif 0%{?rhel} > 10
-%global toolbx_go 1.23.1
-%endif
-%endif
-
-Release:       1%{?dist}
-Summary:       Tool for interactive command line environments on Linux
-
-License:       Apache-2.0
 URL:           https://containertoolbx.org/
 Source0:       https://github.com/containers/%{name}/releases/download/%{version}/%{name}-%{version}-vendored.tar.xz
-
+%if 0%{?rhel}
-# RHEL specific
 Source1:       %{name}.conf
+%endif
 
-# Fedora specific
+# Upstream
-Patch100:      toolbox-Make-the-build-flags-match-Fedora.patch
+Patch0:        toolbox-Don-t-use-podman-1-when-generating-the-comp.patch
+Patch1:        toolbox-Don-t-validate-subordinate-IDs-when-generat.patch
+Patch2:        toolbox-cmd-initContainer-Be-aware-of-security-hardened-moun.patch
 
 # RHEL specific
-Patch200:      toolbox-Make-the-build-flags-match-RHEL-9.patch
+Patch100:      toolbox-Make-the-build-flags-match-RHEL-s-gobuild.patch
-Patch201:      toolbox-Make-the-build-flags-match-RHEL-10.patch
+Patch101:      toolbox-Make-the-build-flags-match-RHEL-s-gobuild-for-PPC64.patch
-Patch202:      toolbox-Add-migration-paths-for-coreos-toolbox-users.patch
+%if 0%{?rhel}
+Patch102:      toolbox-Add-migration-paths-for-coreos-toolbox-users.patch
+%endif
 
 BuildRequires: gcc
 BuildRequires: go-md2man
-BuildRequires: golang >= %{toolbx_go}
+BuildRequires: golang >= 1.20.10
 BuildRequires: meson >= 0.58.0
 BuildRequires: pkgconfig(bash-completion)
 BuildRequires: shadow-utils-subid-devel
@@ -61,53 +43,34 @@ BuildRequires: systemd
 BuildRequires: systemd-rpm-macros
 %if ! 0%{?rhel}
 BuildRequires: golang(github.com/HarryMichal/go-version) >= 1.0.1
-BuildRequires: golang-ipath(github.com/NVIDIA/go-nvlib) >= 0.6.1
-BuildRequires: golang-ipath(github.com/NVIDIA/go-nvml) >= 0.12.4.0
-BuildRequires: golang-ipath(github.com/NVIDIA/nvidia-container-toolkit) >= 1.16.2
 BuildRequires: golang(github.com/acobaugh/osrelease) >= 0.1.0
-BuildRequires: golang(github.com/briandowns/spinner) >= 1.18.0
+BuildRequires: golang(github.com/briandowns/spinner) >= 1.17.0
-BuildRequires: golang(github.com/docker/go-units) >= 0.5.0
+BuildRequires: golang(github.com/docker/go-units) >= 0.4.0
-BuildRequires: golang(github.com/fsnotify/fsnotify) >= 1.7.0
+BuildRequires: golang(github.com/fsnotify/fsnotify) >= 1.5.1
-BuildRequires: golang(github.com/go-logfmt/logfmt) >= 0.5.0
 BuildRequires: golang(github.com/godbus/dbus) >= 5.0.6
-BuildRequires: golang(github.com/google/renameio/v2) >= 2.0.0
+BuildRequires: golang(github.com/sirupsen/logrus) >= 1.8.1
-BuildRequires: golang(github.com/sirupsen/logrus) >= 1.9.3
 BuildRequires: golang(github.com/spf13/cobra) >= 1.3.0
 BuildRequires: golang(github.com/spf13/viper) >= 1.10.1
-BuildRequires: golang-ipath(golang.org/x/sys) >= 0.24.0
+BuildRequires: golang(golang.org/x/sys/unix)
-BuildRequires: golang(golang.org/x/text) >= 0.3.8
+BuildRequires: golang(golang.org/x/term)
-BuildRequires: golang-ipath(gopkg.in/yaml.v3) >= 3.0.1
-BuildRequires: golang-ipath(tags.cncf.io/container-device-interface) >= 0.8.0
 BuildRequires: pkgconfig(fish)
 # for tests
 # BuildRequires: codespell
-# BuildRequires: golang(github.com/stretchr/testify) >= 1.9.0
+# BuildRequires: golang(github.com/stretchr/testify) >= 1.7.0
 # BuildRequires: ShellCheck
 %endif
 
-Recommends:    skopeo
-%if ! 0%{?rhel}
-Recommends:    fuse-overlayfs
-%endif
-
 Requires:      containers-common
-Requires:      podman >= 1.6.4
+Requires:      podman >= 1.4.0
-Requires:      shadow-utils-subid%{?_isa}
 %if ! 0%{?rhel}
 Requires:      flatpak-session-helper
 %endif
 
 
 %description
-Toolbx is a tool for Linux, which allows the use of interactive command line
+Toolbox is a tool for Linux operating systems, which allows the use of
-environments for software development and troubleshooting the host operating
+containerized command line environments. It is built on top of Podman and
-system, without having to install software on the host. It is built on top of
+other standard container technologies from OCI.
-Podman and other standard container technologies from OCI.
-
-Toolbx environments have seamless access to the user's home directory, the
-Wayland and X11 sockets, networking (including Avahi), removable devices (like
-USB sticks), systemd journal, SSH agent, D-Bus, ulimits, /dev and the udev
-database, etc..
 
 
 %package       tests
@@ -115,43 +78,31 @@ Summary:       Tests for %{name}
 
 Requires:      %{name}%{?_isa} = %{version}-%{release}
 Requires:      coreutils
-Requires:      diffutils
+Requires:      gawk
-# for gdbus(1)
-Requires:      glib2
 Requires:      grep
-# for htpasswd(1)
-Requires:      httpd-tools
-Requires:      openssl
-Requires:      python3
 Requires:      skopeo
 %if ! 0%{?rhel}
-Requires:      bats >= 1.10.0
+Requires:      bats
 %endif
 
-
 %description   tests
 The %{name}-tests package contains system tests for %{name}.
 
 
 %prep
 %setup -q
+%patch0 -p1
+%patch1 -p1
+%patch2 -p1
 
-%if 0%{?fedora}
+%ifnarch ppc64
-%patch -P100 -p1
+%patch100 -p1
+%else
+%patch101 -p1
 %endif
 
 %if 0%{?rhel}
-%if 0%{?rhel} == 9
+%patch102 -p1
-%patch -P200 -p1
-%endif
-
-%if 0%{?rhel} >= 10
-%patch -P201 -p1
-%endif
-
-%if 0%{?rhel} <= 9
-%patch -P202 -p1
-%endif
 %endif
 
 %gomkdir -s %{_builddir}/%{extractdir}/src %{?rhel:-k}
@@ -165,9 +116,7 @@ export CGO_CFLAGS="%{optflags} -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_LARGEFILE64_
 %meson \
 %if 0%{?rhel}
     -Dfish_completions_dir=%{_datadir}/fish/vendor_completions.d \
-%if 0%{?rhel} <= 9
     -Dmigration_path_for_coreos_toolbox=true \
-%endif
 %endif
     -Dprofile_dir=%{_sysconfdir}/profile.d \
     -Dtmpfiles_dir=%{_tmpfilesdir} \
@@ -184,14 +133,12 @@ export CGO_CFLAGS="%{optflags} -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_LARGEFILE64_
 %meson_install
 
 %if 0%{?rhel}
-%if 0%{?rhel} <= 9
 install -m0644 %{SOURCE1} %{buildroot}%{_sysconfdir}/containers/%{name}.conf
 %endif
-%endif
 
 
 %files
-%doc CODE-OF-CONDUCT.md CONTRIBUTING.md GOALS.md NEWS README.md SECURITY.md
+%doc CODE-OF-CONDUCT.md NEWS README.md SECURITY.md
 %license COPYING %{?rhel:src/vendor/modules.txt}
 %{_bindir}/%{name}
 %{_datadir}/bash-completion
@@ -204,194 +151,160 @@ install -m0644 %{SOURCE1} %{buildroot}%{_sysconfdir}/containers/%{name}.conf
 %{_sysconfdir}/profile.d/%{name}.sh
 %{_tmpfilesdir}/%{name}.conf
 
-
 %files tests
 %{_datadir}/%{name}
 
 
 %changelog
-* Fri Nov 01 2024 Debarshi Ray <rishi@fedoraproject.org> - 0.1.1-1
+* Sat Oct 14 2023 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.4-6
-- Update to 0.1.1
+- Rebuild for CVE-2023-39325 and CVE-2023-44487
-Resolves: RHEL-61904
+Resolves: RHEL-12693
-
-* Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 0.0.99.6-2
-- Bump release for October 2024 mass rebuild:
-Resolves: RHEL-64018
-
-* Fri Oct 25 2024 MSVSphere Packaging Team <packager@msvsphere-os.ru> - 0.0.99.6-1
-- Rebuilt for MSVSphere 10
-
-* Fri Oct 04 2024 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.6-1
-- Update to 0.0.99.6
-Resolves: RHEL-61579
-
-* Fri Aug 09 2024 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.5-15
-- Rebuild for CVE-2024-24791
-Resolves: RHEL-47199
-
-* Thu Jul 11 2024 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.5-14
-- Silence 'rpminspect --tests=stack-prot'
-- Silence 'rpminspect --tests=annocheck' (part 2)
-Resolves: RHEL-33522
-
-* Mon Jun 24 2024 Troy Dawson <tdawson@redhat.com> - 0.0.99.5-13
-- Bump release for June 2024 mass rebuild
 
-* Tue May 07 2024 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.5-12
+* Fri Aug 11 2023 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.4-5
-- Rebuild for CVE-2024-24788
-Resolves: RHEL-35915
-
-* Tue May 07 2024 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.5-11
-- Unbreak the tests with Podman 5.0
-Resolves: RHEL-36170
-
-* Tue Mar 26 2024 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.5-10
-- Specify the golang versions for RHEL 9 and 10
-Resolves: RHEL-30245
-
-* Tue Mar 05 2024 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.5-9
-- Conditionalize the BuildRequires on golang
-Resolves: RHEL-30245
-
-* Tue Feb 27 2024 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.5-8
-- Unbreak Podman's downstream Fedora CI (part 2)
-- Backport some new upstream tests
-Resolves: RHEL-30245
-
-* Tue Feb 13 2024 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.5-7
-- Unbreak Podman's downstream Fedora CI
-- Update the BuildRequires on golang to reflect reality
-Resolves: RHEL-30245
-
-* Sun Feb 11 2024 Maxwell G <maxwell@gtmx.me> - 0.0.99.5-6
-- Rebuild for golang 1.22.0
-
-* Wed Feb 07 2024 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.5-5
-- Migrate to SPDX license
-
-* Sat Jan 27 2024 Fedora Release Engineering <releng@fedoraproject.org> - 0.0.99.5-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Thu Jan 11 2024 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.5-3
-- Drop 'Recommends: subscription-manager'
-
-* Tue Dec 19 2023 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.5-2
-- Drop the experience and support subpackages
-
-* Tue Dec 19 2023 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.5-1
-- Update to 0.0.99.5
-
-* Tue Dec 19 2023 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.4-10
-- Require openssl(1) for the system tests in the tests subpackage
-
-* Wed Dec 06 2023 Adam Williamson <awilliam@redhat.com> - 0.0.99.4-9
-- tests subpackage: require httpd-tools for htpasswd
-
-* Tue Dec 05 2023 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.4-8
-- Fix the conditionals for 'if RHEL <= 9'
-
-* Thu Nov 30 2023 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.4-7
-- Track the active container on Fedora Linux Asahi Remix
-
-* Thu Nov 09 2023 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.4-6
-- Drop the custom /etc/containers/toolbox.conf from RHEL 10 onwards
-
-* Mon Oct 02 2023 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.4-5
-- Drop github.com/coreos/toolbox compatibility from RHEL 10 onwards
-
-* Mon Oct 02 2023 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.4-4
 - Be aware of security hardened mount points
-- Simplify removing the user's password
+Resolves: #2222789
-
-* Sat Jul 22 2023 Fedora Release Engineering <releng@fedoraproject.org> - 0.0.99.4-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
-
-* Wed Mar 8 2023 Nieves Montero <nmontero@redhat.com> - 0.0.99.4-2
-- Sprinkle a debug log
 
-* Wed Feb 22 2023 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.4-1
+* Mon Aug 07 2023 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.4-4
-- Update to 0.0.99.4
+- Rebuild for CVE-2023-24539, CVE-2023-24540 and CVE-2023-29400
+Resolves: #2221850
 
-* Wed Feb 22 2023 Martin Jackson <mhjacks@swbell.net> - 0.0.99.3-12
+* Tue May 16 2023 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.4-3
-- Fix the ExclusiveArch
+- Rebuild for CVE-2022-41723, CVE-2023-24534, CVE-2023-24536 and
+  CVE-2023-24538
+Resolves: #2187337, #2187385, #2203706
 
-* Tue Feb 21 2023 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.3-11
+* Tue May 16 2023 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.4-2
-- Add ExclusiveArch to match Podman
+- Rebuild for CVE-2022-41724 and CVE-2022-41725
+Resolves: #2179968
 
-* Thu Feb 02 2023 Yaakov Selkowitz <yselkowi@redhat.com> - 0.0.99.3-10
+* Mon Apr 03 2023 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.4-1
-- Sync packaging changes from CentOS Stream
+- Update to 0.0.99.4
+Resolves: #2165742
 
-* Sat Jan 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 0.0.99.3-9
+* Mon Feb 06 2023 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.3-9
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+- Rebuild for CVE-2022-41717
+Resolves: #2164292
 
-* Thu Dec 22 2022 Yaakov Selkowitz <yselkowi@redhat.com> - 0.0.99.3-8
+* Mon Jan 30 2023 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.3-8
-- Use vendored dependencies for RHEL/ELN builds
+- Support RHEL 9 Toolbx containers
+Resolves: #2163752
 
-* Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 0.0.99.3-7
+* Tue Dec 13 2022 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.3-7
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+- Unbreak sorting and clearly identify copied images in 'list'
+Resolves: #2033282
 
-* Tue Jul 19 2022 Maxwell G <gotmax@e.email> - 0.0.99.3-6
+* Fri Oct 14 2022 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.3-6
-- Rebuild for CVE-2022-{1705,32148,30631,30633,28131,30635,30632,30630,1962} in
+- Rebuild for CVE-2022-27664 and CVE-2022-32189
-  golang
+Resolves: #2116786
 
-* Sat Jun 18 2022 Robert-André Mauchin <zebob.m@gmail.com> - 0.0.99.3-5
+* Tue Aug 16 2022 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.3-5
-- Rebuilt for CVE-2022-1996, CVE-2022-24675, CVE-2022-28327, CVE-2022-27191,
+- Rebuild for CVE-2022-1705, CVE-2022-30630, CVE-2022-30631 and CVE-2022-30632
-  CVE-2022-29526, CVE-2022-30629
+Resolves: #2111830
 
-* Sat Jan 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 0.0.99.3-4
+* Tue May 17 2022 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.3-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+- Bump the minimum required golang version for added reassurance
+Resolves: #2060769, #2089194
 
-* Sun Jan 09 2022 Ondřej Míchal <harrymichal@fedoraproject.org> - 0.0.99.3-3
+* Mon May 16 2022 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.3-3
-- Add upstream patch fixing doubled error messages
+- Rebuild for FIPS-mode memory leak in the Go toolchain
+Resolves: #2060769
 
-* Fri Dec 10 2021 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.3-2
+* Wed May 11 2022 Jindrich Novy <jnovy@redhat.com> - 0.0.99.3-2
-- BuildRequire only systemd-rpm-macros as recommended by the Fedora packaging
+- BuildRequires: /usr/bin/go-md2man
-  guidelines
+- Related: #2061316
 
 * Fri Dec 10 2021 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.3-1
 - Update to 0.0.99.3
-
+- BuildRequire only systemd-rpm-macros as recommended by the Fedora packaging
-* Mon Oct 25 2021 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.2^3.git075b9a8d2779-9
+  guidelines
-- Restore backwards compatibility with existing containers
+- Update the Summary to match upstream
-
+- Update the URL to point to the website
-* Fri Oct 22 2021 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.2^3.git075b9a8d2779-8
+Resolves: #2000807
-- Ensure that binaries are run against their build-time ABI
+
-
+* Wed Sep 22 2021 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.3-0.14.git660b6970e998
-* Mon Sep 13 2021 Oliver Gutiérrez <ogutierrez@fedoraproject.org> - 0.0.99.2^3.git075b9a8d2779-7
+- Suggest a way forward if coreos/toolbox was used
-- Rebuilt for gating tests
+Resolves: #2006802
-
+
-* Thu Sep 09 2021 Oliver Gutiérrez <ogutierrez@fedoraproject.org> - 0.0.99.2^3.git075b9a8d2779-6
+* Wed Sep 22 2021 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.3-0.13.git660b6970e998
-- Rebuilt for gating tests
+- Switch to using the Toolbox-specific UBI image by default
-
+Resolves: #2004563
-* Mon Aug 23 2021 Oliver Gutiérrez <ogutierrez@fedoraproject.org> - 0.0.99.2^3.git075b9a8d2779-5
+
-- Version bump to build and check fedora gating after fixing ansible playbooks
+* Thu Sep 16 2021 Oliver Gutiérrez <ogutierrez@redhat.com> - 0.0.99.3-0.12.git660b6970e998
-
+- Changed image for tests and tests parameters to fix gating
-* Fri Aug 20 2021 Oliver Gutiérrez <ogutierrez@fedoraproject.org> - 0.0.99.2^3.git075b9a8d2779-4
+  Related: #2000051
-- Version bump to build and check fedora gating
+
-
+* Thu Sep 16 2021 Oliver Gutiérrez <ogutierrez@redhat.com> - 0.0.99.3-0.11.git660b6970e998
-* Wed Aug 18 2021 Oliver Gutiérrez <ogutierrez@fedoraproject.org> - 0.0.99.2^3.git075b9a8d2779-3
+- Changed image for tests and added /etc/containers dir check
-- Added Fedora gating
+  Related: #2000051
-
+
-* Wed Aug 18 2021 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.2^3.git075b9a8d2779-2
+* Tue Sep 14 2021 Oliver Gutiérrez <ogutierrez@redhat.com> - 0.0.99.3-0.10.git660b6970e998
-- Require containers-common for ownership of %%{_sysconfdir}/containers
+- Added ability to force test system id and version id
-
+  Related: #2000051
-* Mon Aug 09 2021 Oliver Gutiérrez <ogutierrez@fedoraproject.org> - 0.0.99.2^3.git075b9a8d2779-1
+
-- Updated to 0.0.99.2^3.git075b9a8d2779 snapshot
+* Tue Sep 14 2021 Oliver Gutiérrez <ogutierrez@redhat.com> - 0.0.99.3-0.9.git660b6970e998
-
+- Fixed test roles and changed default image path
-* Thu Jul 29 2021 Oliver Gutiérrez <ogutierrez@fedoraproject.org> - 0.0.99.2^2.git40fbd377ed0b-1
+  Related: #2000051
-- Updated to 0.0.99.2^2.git40fbd377ed0b snapshot
+
-
+* Tue Sep 14 2021 Oliver Gutiérrez <ogutierrez@redhat.com> - 0.0.99.3-0.8.git660b6970e998
-* Wed Jul 28 2021 Oliver Gutiérrez <ogutierrez@fedoraproject.org> - 0.0.99.2^1.git9820550c82bb-1
+- Added default container image configuration for tests
-- Updated to 0.00.99.2^1.git9820550c82bb snapshot
+  Related: #2000051
-
+
-* Wed Jul 28 2021 Ondřej Míchal <harrymichal@seznam.cz> - 0.0.99.2-3
+* Fri Sep 03 2021 Oliver Gutiérrez <ogutierrez@redhat.com> - 0.0.99.3-0.7.git660b6970e998
-- Update dependencies of -tests subpackage
+- Added missing gating tests files and patch for tests
-
+  Related: #2000051
-* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 0.0.99.2-2
+
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+* Fri Sep 03 2021 Jindrich Novy <jnovy@redhat.com> - 0.0.99.3-0.6.git660b6970e998
-
+- re-add gating tests
-* Sat Jun 26 2021 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.2-1
+- Related: #2000051
-- Update to 0.0.99.2
+
+* Fri Sep 03 2021 Jindrich Novy <jnovy@redhat.com> - 0.0.99.3-0.5.git660b6970e998
+- Make sosreport work by setting the HOST environment variable
+- Related: #2000051
+
+* Mon Aug 30 2021 Oliver Gutiérrez <ogutierrez@redhat.com> - 0.0.99.3-0.4.git660b6970e998
+- Fixed gating tests bats version
+  Related: rhbz#1977343
+
+* Tue Aug 24 2021 Oliver Gutiérrez <ogutierrez@redhat.com> - 0.0.99.3-0.3.git660b6970e998
+- Rebuilt for gating checks
+  Related: rhbz#1977343
+
+* Tue Aug 10 2021 Mohan Boddu <mboddu@redhat.com> - 0.0.99.3-0.2.git660b6970e998
+- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
+  Related: rhbz#1991688
+
+* Mon Aug 02 2021 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.3-0.1.git660b6970e998
+- Fix the build on CentOS Stream
+Related: #1970747
+
+* Wed Jul 28 2021 Jindrich Novy <jnovy@redhat.com> - 0.0.99.2^1.git660b6970e998-1
+- Add support for configuration files
+- Related: #1970747
+
+* Sat Jul 10 2021 Jindrich Novy <jnovy@redhat.com> - 0.0.99.2-3
+- Expose the host's entire / in the container at /run/host
+- Resolves: #1977343
+
+* Mon Jul 05 2021 Jindrich Novy <jnovy@redhat.com> - 0.0.99.2-2
+- Actually apply the patch to make 'toolbox' create or fall back to a
+  container if possible
+- Support logging into a registry if necessary
+- Resolves: #1977343
+
+* Fri Jul 02 2021 Jindrich Novy <jnovy@redhat.com> - 0.0.99.2-1
+- update to 0.99.2
+- Resolves: #1977343
+
+* Tue Jun 22 2021 Mohan Boddu <mboddu@redhat.com> - 0.0.99.1-4
+- Rebuilt for RHEL 9 BETA for openssl 3.0
+  Related: rhbz#1971065
+
+* Thu Apr 29 2021 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.1-3
+- Fix FTBFS
+Resolves: #1912983
+
+* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 0.0.99.1-2
+- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
 
 * Tue Feb 23 2021 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.1-1
 - Update to 0.0.99.1