diff --git a/SPECS/kata-containers/CVE-2026-50540.patch b/SPECS/kata-containers/CVE-2026-50540.patch deleted file mode 100644 index 258794e323b..00000000000 --- a/SPECS/kata-containers/CVE-2026-50540.patch +++ /dev/null @@ -1,226 +0,0 @@ -From e21ad69c7a9de089e37d0c72e7c1c63f1eda3ddf Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= -Date: Fri, 29 May 2026 09:13:19 +0200 -Subject: [PATCH] runtimes: remove config_path sandbox annotation override -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Stop accepting io.katacontainers.config_path so config selection comes -only from shim options, KATA_CONF_FILE, and defaults. - -Signed-off-by: Fabiano Fidêncio -Signed-off-by: Azure Linux Security Servicing Account -Upstream-reference: https://github.com/kata-containers/kata-containers/commit/03cc670076099530f4e1e9cb22849afdafb20f65.patch ---- - docs/how-to/how-to-set-sandbox-config-kata.md | 1 - - src/libs/kata-types/src/annotations/mod.rs | 6 ------ - src/runtime-rs/crates/runtimes/src/manager.rs | 11 ++++------- - src/runtime/README.md | 3 --- - src/runtime/pkg/containerd-shim-v2/create.go | 13 ++++++------- - .../pkg/containerd-shim-v2/create_test.go | 19 +++++-------------- - src/runtime/pkg/oci/utils.go | 4 ---- - .../pkg/annotations/annotations.go | 2 -- - 8 files changed, 15 insertions(+), 44 deletions(-) - -diff --git a/docs/how-to/how-to-set-sandbox-config-kata.md b/docs/how-to/how-to-set-sandbox-config-kata.md -index e0f6d1e6..5f6fc263 100644 ---- a/docs/how-to/how-to-set-sandbox-config-kata.md -+++ b/docs/how-to/how-to-set-sandbox-config-kata.md -@@ -16,7 +16,6 @@ There are several kinds of Kata configurations and they are listed below. - - | Key | Value Type | Comments | - |-------| ----- | ----- | --| `io.katacontainers.config_path` | string | Kata config file location that overrides the default config paths | - | `io.katacontainers.pkg.oci.bundle_path` | string | OCI bundle path | - | `io.katacontainers.pkg.oci.container_type`| string | OCI container type. Only accepts `pod_container` and `pod_sandbox` | - -diff --git a/src/libs/kata-types/src/annotations/mod.rs b/src/libs/kata-types/src/annotations/mod.rs -index 349a3a60..5c98ecb4 100644 ---- a/src/libs/kata-types/src/annotations/mod.rs -+++ b/src/libs/kata-types/src/annotations/mod.rs -@@ -39,7 +39,6 @@ pub const KATA_ANNO_CFG_PREFIX: &str = "io.katacontainers.config."; - /// Prefix for Kata container annotations - pub const KATA_ANNO_CONTAINER_PREFIX: &str = "io.katacontainers.container."; - /// The annotation key to fetch runtime configuration file. --pub const SANDBOX_CFG_PATH_KEY: &str = "io.katacontainers.config_path"; - - // OCI section - /// The annotation key to fetch the OCI configuration file path. -@@ -429,11 +428,6 @@ impl Annotation { - - // Miscellaneous annotations. - impl Annotation { -- /// Get the annotation of sandbox configuration file path. -- pub fn get_sandbox_config_path(&self) -> Option { -- self.get(SANDBOX_CFG_PATH_KEY) -- } -- - /// Get the annotation of bundle path. - pub fn get_bundle_path(&self) -> Option { - self.get(BUNDLE_PATH_KEY) -diff --git a/src/runtime-rs/crates/runtimes/src/manager.rs b/src/runtime-rs/crates/runtimes/src/manager.rs -index 213f14a2..f19b9b94 100644 ---- a/src/runtime-rs/crates/runtimes/src/manager.rs -+++ b/src/runtime-rs/crates/runtimes/src/manager.rs -@@ -801,19 +801,16 @@ impl Env for RootlessEnv { - } - - /// Config override ordering(high to low): --/// 1. podsandbox annotation --/// 2. environment variable --/// 3. shimv2 create task option --/// 4. If above three are not set, then get default path from DEFAULT_RUNTIME_CONFIGURATIONS -+/// 1. environment variable -+/// 2. shimv2 create task option -+/// 3. If above two are not set, then get default path from DEFAULT_RUNTIME_CONFIGURATIONS - /// in kata-containers/src/libs/kata-types/src/config/default.rs, in array order. - #[instrument] - fn load_config(an: &HashMap, option: &Option>) -> Result { - const KATA_CONF_FILE: &str = "KATA_CONF_FILE"; - let annotation = Annotation::new(an.clone()); - -- let config_path = if let Some(path) = annotation.get_sandbox_config_path() { -- path -- } else if let Ok(path) = std::env::var(KATA_CONF_FILE) { -+ let config_path = if let Ok(path) = std::env::var(KATA_CONF_FILE) { - path - } else if let Some(option) = option { - // Parse the containerd runtime options protobuf message to extract the config path. -diff --git a/src/runtime/README.md b/src/runtime/README.md -index d2290e20..2e36133e 100644 ---- a/src/runtime/README.md -+++ b/src/runtime/README.md -@@ -61,9 +61,6 @@ Each option has a comment explaining its use. - - The shimv2 runtime looks for its configuration in the following places (in order): - --- The `io.data containers.config.config_path` annotation specified -- in the OCI configuration file (`config.json` file) used to create the pod sandbox. -- - - The containerd - [shimv2](/docs/design/architecture/README.md#shim-v2-architecture) - options passed to the runtime. -diff --git a/src/runtime/pkg/containerd-shim-v2/create.go b/src/runtime/pkg/containerd-shim-v2/create.go -index 8e848ee8..17dad46c 100644 ---- a/src/runtime/pkg/containerd-shim-v2/create.go -+++ b/src/runtime/pkg/containerd-shim-v2/create.go -@@ -101,7 +101,7 @@ func create(ctx context.Context, s *service, r *taskAPI.CreateTaskRequest) (*con - disableOutput := noNeedForOutput(detach, ociSpec.Process.Terminal) - rootfs := filepath.Join(r.Bundle, "rootfs") - -- runtimeConfig, err := loadRuntimeConfig(s, r, ociSpec.Annotations) -+ runtimeConfig, err := loadRuntimeConfig(s, r) - if err != nil { - return nil, err - } -@@ -258,15 +258,14 @@ func loadSpec(r *taskAPI.CreateTaskRequest) (*specs.Spec, string, error) { - } - - // Config override ordering(high to low): --// 1. podsandbox annotation --// 2. shimv2 create task option --// 3. environment --func loadRuntimeConfig(s *service, r *taskAPI.CreateTaskRequest, anno map[string]string) (*oci.RuntimeConfig, error) { -+// 1. shimv2 create task option -+// 2. environment -+func loadRuntimeConfig(s *service, r *taskAPI.CreateTaskRequest) (*oci.RuntimeConfig, error) { - if s.config != nil { - return s.config, nil - } -- configPath := oci.GetSandboxConfigPath(anno) -- if configPath == "" && r.Options != nil { -+ configPath := "" -+ if r.Options != nil { - v, err := typeurl.UnmarshalAny(r.Options) - if err != nil { - return nil, err -diff --git a/src/runtime/pkg/containerd-shim-v2/create_test.go b/src/runtime/pkg/containerd-shim-v2/create_test.go -index 67530caf..5da89c9a 100644 ---- a/src/runtime/pkg/containerd-shim-v2/create_test.go -+++ b/src/runtime/pkg/containerd-shim-v2/create_test.go -@@ -23,7 +23,6 @@ import ( - "github.com/kata-containers/kata-containers/src/runtime/pkg/device/config" - ktu "github.com/kata-containers/kata-containers/src/runtime/pkg/katatestutils" - vc "github.com/kata-containers/kata-containers/src/runtime/virtcontainers" -- vcAnnotations "github.com/kata-containers/kata-containers/src/runtime/virtcontainers/pkg/annotations" - "github.com/kata-containers/kata-containers/src/runtime/virtcontainers/pkg/compatoci" - "github.com/kata-containers/kata-containers/src/runtime/virtcontainers/pkg/vcmock" - ) -@@ -393,11 +392,9 @@ func TestCreateLoadRuntimeConfig(t *testing.T) { - ctx: context.Background(), - } - r := &taskAPI.CreateTaskRequest{} -- anno := make(map[string]string) - - // set all to fake path - fakeConfig := "foobar" -- anno[vcAnnotations.SandboxConfigPathKey] = fakeConfig - option := &crioption.Options{ConfigPath: fakeConfig} - r.Options, err = protobuf.MarshalAnyToProto(option) - assert.NoError(err) -@@ -406,28 +403,22 @@ func TestCreateLoadRuntimeConfig(t *testing.T) { - defer os.Setenv("KATA_CONF_FILE", "") - - // fake config should fail -- _, err = loadRuntimeConfig(s, r, anno) -+ _, err = loadRuntimeConfig(s, r) - assert.Error(err) - -- // 1. podsandbox annotation -- anno[vcAnnotations.SandboxConfigPathKey] = config -- _, err = loadRuntimeConfig(s, r, anno) -- assert.NoError(err) -- anno[vcAnnotations.SandboxConfigPathKey] = "" -- -- // 2. shimv2 create task option -+ // 1. shimv2 create task option - option.ConfigPath = config - r.Options, err = protobuf.MarshalAnyToProto(option) - assert.NoError(err) -- _, err = loadRuntimeConfig(s, r, anno) -+ _, err = loadRuntimeConfig(s, r) - assert.NoError(err) - option.ConfigPath = "" - r.Options, err = protobuf.MarshalAnyToProto(option) - assert.NoError(err) - -- // 3. environment -+ // 2. environment - err = os.Setenv("KATA_CONF_FILE", config) - assert.NoError(err) -- _, err = loadRuntimeConfig(s, r, anno) -+ _, err = loadRuntimeConfig(s, r) - assert.NoError(err) - } -diff --git a/src/runtime/pkg/oci/utils.go b/src/runtime/pkg/oci/utils.go -index 250b3f51..b81873e1 100644 ---- a/src/runtime/pkg/oci/utils.go -+++ b/src/runtime/pkg/oci/utils.go -@@ -503,10 +503,6 @@ func ContainerType(spec specs.Spec) (vc.ContainerType, error) { - return vc.SingleContainer, nil - } - --func GetSandboxConfigPath(annotations map[string]string) string { -- return annotations[vcAnnotations.SandboxConfigPathKey] --} -- - // SandboxID determines the sandbox ID related to an OCI configuration. This function - // is expected to be called only when the container type is "PodContainer". - func SandboxID(spec specs.Spec) (string, error) { -diff --git a/src/runtime/virtcontainers/pkg/annotations/annotations.go b/src/runtime/virtcontainers/pkg/annotations/annotations.go -index 278e859b..5473e873 100644 ---- a/src/runtime/virtcontainers/pkg/annotations/annotations.go -+++ b/src/runtime/virtcontainers/pkg/annotations/annotations.go -@@ -20,8 +20,6 @@ const ( - - // ContainerTypeKey is the annotation key to fetch container type. - ContainerTypeKey = kataAnnotationsPrefix + "pkg.oci.container_type" -- -- SandboxConfigPathKey = kataAnnotationsPrefix + "config_path" - ) - - // Annotations related to Hypervisor configuration --- -2.45.4 - diff --git a/SPECS/kata-containers/CVE-2026-56852.patch b/SPECS/kata-containers/CVE-2026-56852.patch deleted file mode 100644 index ba2ad155488..00000000000 --- a/SPECS/kata-containers/CVE-2026-56852.patch +++ /dev/null @@ -1,184 +0,0 @@ -From aa7e2b9bfbd0fc432a3f42c79138e56c8126bbb1 Mon Sep 17 00:00:00 2001 -From: Damien Neil -Date: Tue, 14 Apr 2026 21:46:24 -0400 -Subject: [PATCH] unicode/norm: avoid infinite loop on invalid input - -Invalid characters are given a Properties with a size of 0. - -The nextComposed function can enter an infinite loop when -encountering an invalid character, since it advances -its input by the (possibly 0) character size. - -Rather than finding every place which might assume characters -have a non-zero size, change compInfo to return a size-1 -Properties for invalid characters and use the property flags -to record validity. - -Fixes golang/go#80142 - -Change-Id: Ie0791faefeddc1e8f671b0ed73f29e906a6a6964 -Reviewed-on: https://go-review.googlesource.com/c/text/+/794100 -LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com -Auto-Submit: Damien Neil -Reviewed-by: Neal Patel -Reviewed-by: Neal Patel -Signed-off-by: Azure Linux Security Servicing Account -Upstream-reference: https://github.com/golang/text/commit/5ae8e578e495731553eddba11b2d0e86c91a00ce.patch ---- - .../x/text/unicode/norm/forminfo.go | 9 ++++++++- - .../golang.org/x/text/unicode/norm/iter.go | 8 ++------ - .../x/text/unicode/norm/normalize.go | 20 +++++++++---------- - 3 files changed, 20 insertions(+), 17 deletions(-) - -diff --git a/src/runtime/vendor/golang.org/x/text/unicode/norm/forminfo.go b/src/runtime/vendor/golang.org/x/text/unicode/norm/forminfo.go ---- a/src/runtime/vendor/golang.org/x/text/unicode/norm/forminfo.go -+++ b/src/runtime/vendor/golang.org/x/text/unicode/norm/forminfo.go -@@ -121,8 +121,12 @@ - // - // When all 6 bits are zero, the character is inert, meaning it is never - // influenced by normalization. -+// -+// We set flags to 0x80 (high bit 7 unused in quick check data) to indicate an invalid rune. - type qcInfo uint8 - -+func (p Properties) isInvalid() bool { return p.flags == 0x80 } -+ - func (p Properties) isYesC() bool { return p.flags&0x10 == 0 } - func (p Properties) isYesD() bool { return p.flags&0x4 == 0 } - -@@ -247,6 +251,9 @@ - // to a Properties. See the comment at the top of the file - // for more information on the format. - func compInfo(v uint16, sz int) Properties { -+ if sz == 0 { -+ return Properties{flags: 0x80, size: 1} -+ } - if v == 0 { - return Properties{size: uint8(sz)} - } else if v >= 0x8000 { -@@ -254,7 +261,7 @@ - size: uint8(sz), - ccc: uint8(v), - tccc: uint8(v), -- flags: qcInfo(v >> 8), -+ flags: qcInfo(v>>8) & 0x3f, - } - if p.ccc > 0 || p.combinesBackward() { - p.nLead = uint8(p.flags & 0x3) -diff --git a/src/runtime/vendor/golang.org/x/text/unicode/norm/iter.go b/src/runtime/vendor/golang.org/x/text/unicode/norm/iter.go ---- a/src/runtime/vendor/golang.org/x/text/unicode/norm/iter.go -+++ b/src/runtime/vendor/golang.org/x/text/unicode/norm/iter.go -@@ -376,16 +376,12 @@ - goto doNorm - } - prevCC = i.info.tccc -- sz := int(i.info.size) -- if sz == 0 { -- sz = 1 // illegal rune: copy byte-by-byte -- } -- p := outp + sz -+ p := outp + int(i.info.size) - if p > len(i.buf) { - break - } - outp = p -- i.p += sz -+ i.p += int(i.info.size) - if i.p >= i.rb.nsrc { - i.setDone() - break -diff --git a/src/runtime/vendor/golang.org/x/text/unicode/norm/normalize.go b/src/runtime/vendor/golang.org/x/text/unicode/norm/normalize.go ---- a/src/runtime/vendor/golang.org/x/text/unicode/norm/normalize.go -+++ b/src/runtime/vendor/golang.org/x/text/unicode/norm/normalize.go -@@ -148,7 +148,7 @@ - // patched buffer and whether the decomposition is still in progress. - func patchTail(rb *reorderBuffer) bool { - info, p := lastRuneStart(&rb.f, rb.out) -- if p == -1 || info.size == 0 { -+ if p == -1 || info.isInvalid() { - return true - } - end := p + int(info.size) -@@ -225,7 +225,7 @@ - } - fd := &rb.f - if doMerge { -- var info Properties -+ info := Properties{flags: 0x80, size: 1} // invalid rune - if p < n { - info = fd.info(src, p) - if !info.BoundaryBefore() || info.nLeadingNonStarters() > 0 { -@@ -235,7 +235,7 @@ - p = decomposeSegment(rb, p, true) - } - } -- if info.size == 0 { -+ if info.isInvalid() { - rb.doFlush() - // Append incomplete UTF-8 encoding. - return src.appendSlice(rb.out, p, n) -@@ -314,7 +314,7 @@ - continue - } - info := f.info(src, i) -- if info.size == 0 { -+ if info.isInvalid() { - if atEOF { - // include incomplete runes - return n, true -@@ -379,7 +379,7 @@ - // CGJ insertion points correctly. Luckily it doesn't have to. - for { - info := fd.info(src, i) -- if info.size == 0 { -+ if info.isInvalid() { - return -1 - } - if s := ss.next(info); s != ssSuccess { -@@ -424,7 +424,7 @@ - } - fd := formTable[f] - info := fd.info(src, 0) -- if info.size == 0 { -+ if info.isInvalid() { - if atEOF { - return 1 - } -@@ -435,7 +435,7 @@ - - for i := int(info.size); i < nsrc; i += int(info.size) { - info = fd.info(src, i) -- if info.size == 0 { -+ if info.isInvalid() { - if atEOF { - return i - } -@@ -465,7 +465,7 @@ - if p == -1 { - return -1 - } -- if info.size == 0 { // ends with incomplete rune -+ if info.isInvalid() { // ends with incomplete rune - if p == 0 { // starts with incomplete rune - return -1 - } -@@ -504,7 +504,7 @@ - func decomposeSegment(rb *reorderBuffer, sp int, atEOF bool) int { - // Force one character to be consumed. - info := rb.f.info(rb.src, sp) -- if info.size == 0 { -+ if info.isInvalid() { - return 0 - } - if s := rb.ss.next(info); s == ssStarter { -@@ -528,7 +528,7 @@ - break - } - info = rb.f.info(rb.src, sp) -- if info.size == 0 { -+ if info.isInvalid() { - if !atEOF { - return int(iShortSrc) - } --- -2.45.4 diff --git a/SPECS/kata-containers/dbs-arch-cpuid-unsafe.patch b/SPECS/kata-containers/dbs-arch-cpuid-unsafe.patch deleted file mode 100644 index a647b6022d3..00000000000 --- a/SPECS/kata-containers/dbs-arch-cpuid-unsafe.patch +++ /dev/null @@ -1,110 +0,0 @@ -From: Saul Paredes -Subject: [PATCH] wrap x86 CPUID intrinsics in unsafe blocks for Rust <= 1.93 - -The x86 CPUID intrinsics (__cpuid, __cpuid_count, __get_cpuid_max) are -declared as `unsafe fn` on Rust toolchains up to and including 1.93, so -calling them without an `unsafe` block fails to compile with E0133 on -Azure Linux's Rust 1.90: - - error[E0133]: call to unsafe function `__cpuid` is unsafe and requires - unsafe function or block - -Wrap the affected call sites in `src/dragonball/dbs_arch` (dbs-arch) and -`src/libs/kata-sys-util` (kata-sys-util) in `unsafe {}` blocks. The -#[allow(unused_unsafe)] attributes keep the build clean under -`--deny warnings` on newer toolchains where the intrinsics are already safe. - -NOTE: This patch is only needed up to Rust 1.93. The x86 CPUID intrinsics -were made safe `fn`s in Rust 1.94, so this patch can be removed once the -Azure Linux Rust toolchain is updated to Rust 1.94 or newer. - -Signed-off-by: Saul Paredes ---- -diff --git a/src/dragonball/dbs_arch/src/x86_64/cpuid/brand_string.rs b/src/dragonball/dbs_arch/src/x86_64/cpuid/brand_string.rs -index 5dd04ffd6c..036f1bcb4b 100644 ---- a/src/dragonball/dbs_arch/src/x86_64/cpuid/brand_string.rs -+++ b/src/dragonball/dbs_arch/src/x86_64/cpuid/brand_string.rs -@@ -101,9 +101,10 @@ impl BrandString { - - /// Creates a brand string, initialized from the CPUID leaves 0x80000002 through 0x80000004 - /// of the host CPU. -+ #[allow(unused_unsafe)] - fn from_host_cpuid() -> Result { - let mut this = Self::new(); -- let mut cpuid_regs = host_cpuid(0x8000_0000); -+ let mut cpuid_regs = unsafe { host_cpuid(0x8000_0000) }; - - if cpuid_regs.eax < 0x8000_0004 { - // Brand string not supported by the host CPU -@@ -111,7 +112,7 @@ impl BrandString { - } - - for leaf in 0x8000_0002..=0x8000_0004 { -- cpuid_regs = host_cpuid(leaf); -+ cpuid_regs = unsafe { host_cpuid(leaf) }; - this.set_reg_for_leaf(leaf, Reg::Eax, cpuid_regs.eax); - this.set_reg_for_leaf(leaf, Reg::Ebx, cpuid_regs.ebx); - this.set_reg_for_leaf(leaf, Reg::Ecx, cpuid_regs.ecx); -diff --git a/src/dragonball/dbs_arch/src/x86_64/cpuid/common.rs b/src/dragonball/dbs_arch/src/x86_64/cpuid/common.rs -index 26e129cc5d..f220e1952f 100644 ---- a/src/dragonball/dbs_arch/src/x86_64/cpuid/common.rs -+++ b/src/dragonball/dbs_arch/src/x86_64/cpuid/common.rs -@@ -16,6 +16,7 @@ pub enum Error { - } - - /// Get CPUID value for (`function`, `count`). -+#[allow(unused_unsafe)] - pub fn get_cpuid(function: u32, count: u32) -> Result { - #[cfg(target_env = "sgx")] - { -@@ -25,7 +26,7 @@ pub fn get_cpuid(function: u32, count: u32) -> Result { - // TODO: replace with validation based on `has_cpuid()` when it becomes stable: - // https://doc.rust-lang.org/core/arch/x86/fn.has_cpuid.html - // this is safe because the host supports the `cpuid` instruction -- let max_function = __get_cpuid_max(function & leaf_0x80000000::LEAF_NUM).0; -+ let max_function = unsafe { __get_cpuid_max(function & leaf_0x80000000::LEAF_NUM).0 }; - if function > max_function { - return Err(Error::InvalidParameters(format!( - "Function not supported: 0x{function:x}", -@@ -33,7 +34,7 @@ pub fn get_cpuid(function: u32, count: u32) -> Result { - } - - // this is safe because the host supports the `cpuid` instruction -- let entry = __cpuid_count(function, count); -+ let entry = unsafe { __cpuid_count(function, count) }; - if entry.eax == 0 && entry.ebx == 0 && entry.ecx == 0 && entry.edx == 0 { - return Err(Error::InvalidParameters(format!("Invalid count: {count}"))); - } -diff --git a/src/libs/kata-sys-util/src/protection.rs b/src/libs/kata-sys-util/src/protection.rs -index 38a38009a5..aceb7b79c1 100644 ---- a/src/libs/kata-sys-util/src/protection.rs -+++ b/src/libs/kata-sys-util/src/protection.rs -@@ -91,6 +91,10 @@ pub fn available_guest_protection() -> Result - } - - #[cfg(target_arch = "x86_64")] -+// `unsafe` is required on Rust toolchains where the x86 CPUID intrinsics are -+// still `unsafe fn`s (<= 1.93), and unnecessary on newer toolchains where they -+// are safe; allow the resulting warning so it builds under `--deny warnings`. -+#[allow(unused_unsafe)] - pub fn arch_guest_protection( - sev_path: &str, - snp_path: &str, -@@ -126,7 +130,7 @@ pub fn arch_guest_protection( - // shouldn't hurt to double-check and have better logging if anything - // goes wrong. - -- let fn0 = x86_64::__cpuid(0); -+ let fn0 = unsafe { x86_64::__cpuid(0) }; - // The values in [ ebx, edx, ecx ] spell out "AuthenticAMD" when - // interpreted byte-wise as ASCII. No need to bother here with an - // actual conversion to string though. -@@ -139,7 +143,7 @@ pub fn arch_guest_protection( - } - - // AMD64 Architecture Prgrammer's Manual Fn8000_001f docs on pg. 640 -- let fn8000_001f = x86_64::__cpuid(0x8000_001f); -+ let fn8000_001f = unsafe { x86_64::__cpuid(0x8000_001f) }; - if fn8000_001f.eax & 0x10 == 0 { - return Err(ProtectionError::CheckFailed("SEV not supported".to_owned())); - } diff --git a/SPECS/kata-containers/kata-containers.signatures.json b/SPECS/kata-containers/kata-containers.signatures.json index 56d56af4a1b..c3f740b30ce 100644 --- a/SPECS/kata-containers/kata-containers.signatures.json +++ b/SPECS/kata-containers/kata-containers.signatures.json @@ -1,6 +1,6 @@ { "Signatures": { - "kata-containers-3.32.0.kata0.tar.gz": "933af57d9678c2ed4772aaa21527a714b017fddd4e8a7e64d127d71a62f800e1", - "kata-containers-3.32.0.kata1-cargo.tar.gz": "4b33cca659724770d8bcecfa3ed889f9030c6f4e92aea675f4ebc291ac281edf" + "kata-containers-4.1.0.kata0.tar.gz": "cb9c87900261baf5def36936e13ab8f34ce23853977cb4fa907d1f5d169941ad", + "kata-containers-4.1.0.kata0-cargo.tar.gz": "0cc03b12c970dc68f72ccc804b3e540d63ede145c308c58f478262aaa03d8a4d" } } diff --git a/SPECS/kata-containers/kata-containers.spec b/SPECS/kata-containers/kata-containers.spec index 86135d6475a..1787decfe60 100644 --- a/SPECS/kata-containers/kata-containers.spec +++ b/SPECS/kata-containers/kata-containers.spec @@ -1,23 +1,17 @@ %global debug_package %{nil} Name: kata-containers -Version: 3.32.0.kata0 -Release: 3%{?dist} +Version: 4.1.0.kata0 +Release: 1%{?dist} Summary: Kata Containers package developed for Pod Sandboxing on AKS License: ASL 2.0 URL: https://github.com/microsoft/kata-containers Vendor: Microsoft Corporation Distribution: Azure Linux Source0: https://github.com/microsoft/kata-containers/archive/refs/tags/%{version}.tar.gz#/%{name}-%{version}.tar.gz -# Todo: revert back to %{name}-${version}-cargo.tar.gz next release -# This is a temporary workaround so we can use a newer cargo tarball without having to make a new fork release -Source1: %{name}-3.32.0.kata1-cargo.tar.gz -# Only needed up to Rust 1.93; remove once the Rust toolchain is updated to 1.94 or newer. -Patch0: dbs-arch-cpuid-unsafe.patch -Patch1: CVE-2025-11065.patch -Patch2: CVE-2026-41602.patch -Patch3: CVE-2026-56852.patch -Patch4: CVE-2026-50540.patch +Source1: %{name}-%{version}-cargo.tar.gz +Patch0: CVE-2025-11065.patch +Patch1: CVE-2026-41602.patch BuildRequires: azurelinux-release BuildRequires: golang BuildRequires: protobuf-compiler @@ -52,19 +46,6 @@ pushd %{_builddir}/%{name}-%{version}/tools/osbuilder/node-builder/azure-linux %make_build package popd -pushd %{_builddir}/%{name}-%{version}/src/runtime/config -cp configuration-clh.toml configuration-clh-preview.toml -cp configuration-clh-debug.toml configuration-clh-preview-debug.toml -popd - -for config_file in \ - %{_builddir}/%{name}-%{version}/src/runtime/config/configuration-clh-preview.toml \ - %{_builddir}/%{name}-%{version}/src/runtime/config/configuration-clh-preview-debug.toml; do - sed -i 's|^\[hypervisor\.clh\]$|[factory]\nenable_template = true\ntemplate_path = "/run/vc/vm/template"\n\n[hypervisor.clh]|' "${config_file}" - sed -i 's|^shared_fs = "virtio-fs"$|shared_fs = "none"|' "${config_file}" - sed -i 's|^default_maxmemory = .*$|default_maxmemory = 2048|' "${config_file}" -done - %define kata_path /opt/kata-containers %define kata_bin %{_prefix}/local/bin %define kata_shim_bin %{_prefix}/local/bin @@ -76,10 +57,6 @@ pushd %{_builddir}/%{name}-%{version}/tools/osbuilder/node-builder/azure-linux START_SERVICES=no PREFIX=%{buildroot} %make_build deploy-package PREFIX=%{buildroot} %make_build deploy-package-tools popd -install -m 0644 \ - %{_builddir}/%{name}-%{version}/src/runtime/config/configuration-clh-preview.toml \ - %{_builddir}/%{name}-%{version}/src/runtime/config/configuration-clh-preview-debug.toml \ - %{buildroot}%{defaults_kata}/ %files %{kata_bin}/kata-collect-data.sh @@ -143,6 +120,12 @@ install -m 0644 \ %{tools_pkg}/tools/osbuilder/node-builder/azure-linux/agent-install/usr/lib/systemd/system/kata-agent.service %changelog +* Mon Aug 24 2026 CBL-Mariner Servicing Account - 4.1.0.kata0-1 +- Auto-upgrade to 4.1.0.kata0 +- Drop CVE-2026-56852 patch, fix is included in vendored golang.org/x/text v0.39.0 +- Drop CVE-2026-50540 patch, fix is included upstream in 4.1.0.kata0 +- Generate and install the preview configurations from the node-builder scripts + * Fri Aug 14 2026 Azure Linux Security Servicing Account - 3.32.0.kata0-3 - Patch for CVE-2026-50540 diff --git a/cgmanifest.json b/cgmanifest.json index 8b2feb34fc4..577e7fb5c45 100644 --- a/cgmanifest.json +++ b/cgmanifest.json @@ -8281,8 +8281,8 @@ "type": "other", "other": { "name": "kata-containers", - "version": "3.32.0.kata0", - "downloadUrl": "https://github.com/microsoft/kata-containers/archive/refs/tags/3.32.0.kata0.tar.gz" + "version": "4.1.0.kata0", + "downloadUrl": "https://github.com/microsoft/kata-containers/archive/refs/tags/4.1.0.kata0.tar.gz" } } },