Re: [meta-virtualization][wrynose][PATCH] crun: upgrade to 1.27.1

On Mon, May 25, 2026 at 9:03 AM Zhixiong Chi via lists.yoctoproject.org
<[email protected]> wrote:

> Bumping crun to version v1.27.1, which comprises the following commits:
>
>     3ec076b3 NEWS: tag 1.27.1
>     60b2e8f8 tests, podman: pin to 5.8
>     3010d29d tests: fix failure in user namespace
>     d6ffa244 krun: remove unused variable
>     1c5c2f7d linux: pass correct propagation to get_bind_mount
>     d97461f0 tests: add regression test for idmapped mount leak
>     59cfa8b8 Revert "linux: skip redundant MS_PRIVATE propagation mounts"
>     f1b70c0b tests: add subcgroup cleanup test
>     6177dd86 cgroup: fix recursive cgroup cleanup consuming caller's fd
>     6c58b0c6 fix -Wdiscarded-qualifiers warnings
>     acb904c6 krun: Build passt argv based on nitro variant
>     8199cbb2 krun: implement support for passt networking
>     7c2500df krun: ignore RAM configurations below 128MB
>     23f7d9f0 krun: consolidate configuration in configure_vm
>     04c19ac6 krun: process the vm configuration earlier
>     81c21e0d handlers: add new hook to close fds
>     d8813f3d .codespellrc: ignore passt
>     94d7f641 utils: fix apparmor profile not applied in user namespaces
>     805e6a44 libcrun: skip cgroup filesystem type check when cgroups are
> disabled
>     4c530d43 libcrun: fall back to bind mount for /dev/console on
> read-only file systems
>     a718a92c NEWS: tag 1.27
>     6220914d nix: generate git-version.h in buildPhase
>     9553f8b8 exec: strengthen -u value validation
>     1bd7f424 exec: fix CVE-2026-30892
>     5699da29 nix: fix zlib cross-compilation for s390x
>     237f8100 nix: remove global overlay to eliminate rebuild cascade
>     b37594dc release: use path: flake ref to avoid libgit2 safe.directory
>     aaa6056c release: seed /nix from container image when empty
>     c4e3fd22 linux: set MS_PRIVATE on detached mounts from get_bind_mount()
>     360621a3 Revert "container: skip sigaction reset in unblock_signals
> for the run path"
>     5d1b0284 nix: migrate to flakes
>     246a3367 nix: generate git-version.h in buildPhase
>     3e9986bc nix: bump nixos/nix image from 2.24.9 to 2.34.2
>     094c97f3 nix: update
>     195f664f seccomp_notify: tighten crun_make_error input
>     1d76be72 seccomp: tighten crun_make_error input
>     62d3e852 container: tighten crun_make_error input
>     254a8a75 linux: use open_tree+mount_setattr for device mounts
>     2d6f4c0e linux: use open_tree+move_mount for masked paths
>     45e62ce5 linux: use open_tree+mount_setattr for readonly paths
>     f53aa376 linux: use mount_setattr for readonly remounts in
> finalize_mounts
>     2dae2238 linux: skip redundant MS_PRIVATE propagation mounts
>     38e17199 container: skip sigaction reset in unblock_signals for the
> run path
>     4b66d8f0 cgroup: skip enable_controllers when joined via
> CLONE_INTO_CGROUP
>     a59b186b linux: validate run.oci.mount_context_type annotation value
>     16bd4e48 utils: do not use errno after success
>
> Signed-off-by: Zhixiong Chi <[email protected]>
> ---
>  recipes-containers/crun/crun_git.bb | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/recipes-containers/crun/crun_git.bb
> b/recipes-containers/crun/crun_git.bb
> index d2f7b63b..f4e489d5 100644
> --- a/recipes-containers/crun/crun_git.bb
> +++ b/recipes-containers/crun/crun_git.bb
> @@ -3,7 +3,7 @@ LICENSE = "GPL-2.0-only"
>  LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263"
>  PRIORITY = "optional"
>
> -SRCREV_crun = "393509db566bedea037d1599c5a58b896f5d3b01"
> +SRCREV_crun = "3ec076b3b6714ec2f1a10533cf18d5605a6de637"
>  SRCREV_libocispec = "8b07b619df73a113f7721f1c7ce24f2572b04cea"
>  SRCREV_ispec = "a4c6ade7bb82b316d45391f572727a63e268b252"
>  SRCREV_rspec = "6f7b71c2d216403715f7364ac88dec88d9da989c"
> @@ -19,7 +19,7 @@ SRC_URI = "git://
> github.com/containers/crun.git;branch=main;name=crun;protocol=h
>
> file://0002-libocispec-fix-array-items-parsing.patch;patchdir=libocispec \
>            "
>
> -PV = "1.26.0+git"
> +PV = "1.27.1+git"
>

I know I had mentioned that updates could be sent to released branches, but
these
simply won't be applied to that branch

bugfix only updates, or individual patches only.

master will continue to receive updates on a roughly monthly cadence.

Bruce



>
>  inherit autotools-brokensep pkgconfig features_check
>
> --
> 2.53.0
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#9809):
> https://lists.yoctoproject.org/g/meta-virtualization/message/9809
> Mute This Topic: https://lists.yoctoproject.org/mt/119480093/1050810
> Group Owner: [email protected]
> Unsubscribe: https://lists.yoctoproject.org/g/meta-virtualization/unsub [
> [email protected]]
> -=-=-=-=-=-=-=-=-=-=-=-
>
>

-- 
- Thou shalt not follow the NULL pointer, for chaos and madness await thee
at its end
- "Use the force Harry" - Gandalf, Star Trek II