Re: [meta-virtualization][wrynose][PATCH] crun: upgrade to 1.27.1

On Tue, May 26, 2026 at 10:08 PM Chi, Zhixiong <[email protected]>
wrote:

>
> On 5/25/26 21:08, Bruce Ashfield wrote:
>
> *CAUTION: This email comes from a non Wind River email account!*
> Do not click links or open attachments unless you recognize the sender and
> know the content is safe.
>
>
> On Mon, May 25, 2026 at 9:03 AM Zhixiong Chi via lists.yoctoproject.org
> <https://urldefense.com/v3/__http://lists.yoctoproject.org__;!!AjveYdw8EvQ!cnA8qqQTA9nQEfoueNL-1Ttq4BRcQatPSL_wWjwgKTTRYIEFbA2cTnu76WbjWOFd_BshZp9xtYSCkhX7RHkrOX0GynnmDg$>
> <[email protected]> wrote:
>
>> Bumping crun to version v1.27.1, which comprises the following commits:
>>
>>     3ec076b3 NEWS: tag 1.27.1
>>     60b2e8f8 tests, podman: pin to 5.8
>>     3010d29d tests: fix failure in user namespace
>>     d6ffa244 krun: remove unused variable
>>     1c5c2f7d linux: pass correct propagation to get_bind_mount
>>     d97461f0 tests: add regression test for idmapped mount leak
>>     59cfa8b8 Revert "linux: skip redundant MS_PRIVATE propagation mounts"
>>     f1b70c0b tests: add subcgroup cleanup test
>>     6177dd86 cgroup: fix recursive cgroup cleanup consuming caller's fd
>>     6c58b0c6 fix -Wdiscarded-qualifiers warnings
>>     acb904c6 krun: Build passt argv based on nitro variant
>>     8199cbb2 krun: implement support for passt networking
>>     7c2500df krun: ignore RAM configurations below 128MB
>>     23f7d9f0 krun: consolidate configuration in configure_vm
>>     04c19ac6 krun: process the vm configuration earlier
>>     81c21e0d handlers: add new hook to close fds
>>     d8813f3d .codespellrc: ignore passt
>>     94d7f641 utils: fix apparmor profile not applied in user namespaces
>>     805e6a44 libcrun: skip cgroup filesystem type check when cgroups are
>> disabled
>>     4c530d43 libcrun: fall back to bind mount for /dev/console on
>> read-only file systems
>>     a718a92c NEWS: tag 1.27
>>     6220914d nix: generate git-version.h in buildPhase
>>     9553f8b8 exec: strengthen -u value validation
>>     1bd7f424 exec: fix CVE-2026-30892
>>     5699da29 nix: fix zlib cross-compilation for s390x
>>     237f8100 nix: remove global overlay to eliminate rebuild cascade
>>     b37594dc release: use path: flake ref to avoid libgit2 safe.directory
>> <https://urldefense.com/v3/__http://safe.directory__;!!AjveYdw8EvQ!cnA8qqQTA9nQEfoueNL-1Ttq4BRcQatPSL_wWjwgKTTRYIEFbA2cTnu76WbjWOFd_BshZp9xtYSCkhX7RHkrOX255E1T9Q$>
>>     aaa6056c release: seed /nix from container image when empty
>>     c4e3fd22 linux: set MS_PRIVATE on detached mounts from
>> get_bind_mount()
>>     360621a3 Revert "container: skip sigaction reset in unblock_signals
>> for the run path"
>>     5d1b0284 nix: migrate to flakes
>>     246a3367 nix: generate git-version.h in buildPhase
>>     3e9986bc nix: bump nixos/nix image from 2.24.9 to 2.34.2
>>     094c97f3 nix: update
>>     195f664f seccomp_notify: tighten crun_make_error input
>>     1d76be72 seccomp: tighten crun_make_error input
>>     62d3e852 container: tighten crun_make_error input
>>     254a8a75 linux: use open_tree+mount_setattr for device mounts
>>     2d6f4c0e linux: use open_tree+move_mount for masked paths
>>     45e62ce5 linux: use open_tree+mount_setattr for readonly paths
>>     f53aa376 linux: use mount_setattr for readonly remounts in
>> finalize_mounts
>>     2dae2238 linux: skip redundant MS_PRIVATE propagation mounts
>>     38e17199 container: skip sigaction reset in unblock_signals for the
>> run path
>>     4b66d8f0 cgroup: skip enable_controllers when joined via
>> CLONE_INTO_CGROUP
>>     a59b186b linux: validate run.oci.mount_context_type annotation value
>>     16bd4e48 utils: do not use errno after success
>>
>> Signed-off-by: Zhixiong Chi <[email protected]>
>> ---
>>  recipes-containers/crun/crun_git.bb
>> <https://urldefense.com/v3/__http://crun_git.bb__;!!AjveYdw8EvQ!cnA8qqQTA9nQEfoueNL-1Ttq4BRcQatPSL_wWjwgKTTRYIEFbA2cTnu76WbjWOFd_BshZp9xtYSCkhX7RHkrOX1s4OHFmA$>
>> | 4 ++--
>>  1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/recipes-containers/crun/crun_git.bb
>> <https://urldefense.com/v3/__http://crun_git.bb__;!!AjveYdw8EvQ!cnA8qqQTA9nQEfoueNL-1Ttq4BRcQatPSL_wWjwgKTTRYIEFbA2cTnu76WbjWOFd_BshZp9xtYSCkhX7RHkrOX1s4OHFmA$>
>> b/recipes-containers/crun/crun_git.bb
>> <https://urldefense.com/v3/__http://crun_git.bb__;!!AjveYdw8EvQ!cnA8qqQTA9nQEfoueNL-1Ttq4BRcQatPSL_wWjwgKTTRYIEFbA2cTnu76WbjWOFd_BshZp9xtYSCkhX7RHkrOX1s4OHFmA$>
>> index d2f7b63b..f4e489d5 100644
>> --- a/recipes-containers/crun/crun_git.bb
>> <https://urldefense.com/v3/__http://crun_git.bb__;!!AjveYdw8EvQ!cnA8qqQTA9nQEfoueNL-1Ttq4BRcQatPSL_wWjwgKTTRYIEFbA2cTnu76WbjWOFd_BshZp9xtYSCkhX7RHkrOX1s4OHFmA$>
>> +++ b/recipes-containers/crun/crun_git.bb
>> <https://urldefense.com/v3/__http://crun_git.bb__;!!AjveYdw8EvQ!cnA8qqQTA9nQEfoueNL-1Ttq4BRcQatPSL_wWjwgKTTRYIEFbA2cTnu76WbjWOFd_BshZp9xtYSCkhX7RHkrOX1s4OHFmA$>
>> @@ -3,7 +3,7 @@ LICENSE = "GPL-2.0-only"
>>  LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263"
>>  PRIORITY = "optional"
>>
>> -SRCREV_crun = "393509db566bedea037d1599c5a58b896f5d3b01"
>> +SRCREV_crun = "3ec076b3b6714ec2f1a10533cf18d5605a6de637"
>>  SRCREV_libocispec = "8b07b619df73a113f7721f1c7ce24f2572b04cea"
>>  SRCREV_ispec = "a4c6ade7bb82b316d45391f572727a63e268b252"
>>  SRCREV_rspec = "6f7b71c2d216403715f7364ac88dec88d9da989c"
>> @@ -19,7 +19,7 @@ SRC_URI = "git://
>> github.com/containers/crun.git;branch=main;name=crun;protocol=h
>> <https://urldefense.com/v3/__http://github.com/containers/crun.git;branch=main;name=crun;protocol=h__;!!AjveYdw8EvQ!cnA8qqQTA9nQEfoueNL-1Ttq4BRcQatPSL_wWjwgKTTRYIEFbA2cTnu76WbjWOFd_BshZp9xtYSCkhX7RHkrOX1a1kPdAw$>
>>
>> file://0002-libocispec-fix-array-items-parsing.patch;patchdir=libocispec
>> \
>>            "
>>
>> -PV = "1.26.0+git"
>> +PV = "1.27.1+git"
>>
>
> I know I had mentioned that updates could be sent to released branches,
> but these
> simply won't be applied to that branch
>
> bugfix only updates, or individual patches only.
>
> master will continue to receive updates on a roughly monthly cadence.
>
> Bruce
>
> Hi Bruce,
>
> As you know, the current SRCREV is inlcuded in tag 1.27, it's between 1.26
> and 1.27 changed by the last patch upgrading patch.
>
> $ git clone https://github.com/containers/crun.git
> $ cd crun
> $ git tag --contain 393509db566bedea037d1599c5a58b896f5d3b01
> 1.27
> 1.27.1
>
> and I know you have declared it in the patch comment as the version
> "1.26-160-g393509db".
>
> So in this patch, it's not a upgrading from 1.26 to 1.27 in the strict
> sense, perhaps we can regard it from 1.27 to 1.27.1 and most of these
> commits were bugfix.
>
> Could you please think about it again?
>

Thanks for digging into this — appreciate the careful look. I think there's
a subtle gap in the reasoning though, and I want to walk through it
because it matters for how we frame these bumps.

As you know (I'm including a bit of detail here that isn't news to anyone,
I'm just walking through the logic in case I have it wrong)

git tag --contains and git describe answer different questions:

- git tag --contains C asks "which tags have C as an ancestor?". The
answer naturally grows over time as new tags get cut. A given commit
"becomes" listed under 1.27, then 1.27.1, then 1.28, and so on — but
the commit itself hasn't changed; the tag landscape around it has.

- git describe C asks "what was the latest released version when this
commit was made?". That's stable. For 393509db it's
1.26-160-g393509db — meaning "1.26 plus 160 commits of unreleased
work on the way to whatever comes next". When I bumped to it, 1.27
didn't yet exist; the 1.27 tag was placed afterward, on a descendant
commit.

Recipe SRCREV pins are an identity claim about a state — they capture
what the project considered itself to be at that point. If we used the
tag --contains view, the same commit would equally count as "really
1.27", "really 1.27.1", and "really 1.28" depending on when you ran
the query, which makes "what version is this?" depend on what gets
released later. That's why I lean on git describe for these — it gives
a fixed answer regardless of when you ask.

So from where I sit, this bump moves us from a state in the 1.26 line
(one tag behind 1.27 at the time it was made) to a state in the 1.27
line, which is a minor-version cross and gets handled under stable-branch
rules accordingly — even if most of the intervening commits are bug
fixes.

That being said, if you can show me an audit of all the commits on
top of 1.26 -> 1.27 are 100% bug fixes, then I'd much rather do the
version bump versus taking them all as patches in the recipe.

Hope that helps explain the pushback; happy to keep talking it through
if I'm missing something.

Bruce

Thanks.
>
>
>
>
>>
>>  inherit autotools-brokensep pkgconfig features_check
>>
>> --
>> 2.53.0
>>
>>
>> -=-=-=-=-=-=-=-=-=-=-=-
>> Links: You receive all messages sent to this group.
>> View/Reply Online (#9809):
>> https://lists.yoctoproject.org/g/meta-virtualization/message/9809
>> <https://urldefense.com/v3/__https://lists.yoctoproject.org/g/meta-virtualization/message/9809__;!!AjveYdw8EvQ!cnA8qqQTA9nQEfoueNL-1Ttq4BRcQatPSL_wWjwgKTTRYIEFbA2cTnu76WbjWOFd_BshZp9xtYSCkhX7RHkrOX0a4U_SOg$>
>> Mute This Topic: https://lists.yoctoproject.org/mt/119480093/1050810
>> <https://urldefense.com/v3/__https://lists.yoctoproject.org/mt/119480093/1050810__;!!AjveYdw8EvQ!cnA8qqQTA9nQEfoueNL-1Ttq4BRcQatPSL_wWjwgKTTRYIEFbA2cTnu76WbjWOFd_BshZp9xtYSCkhX7RHkrOX2Gur5Ahg$>
>> Group Owner: [email protected]
>> Unsubscribe: https://lists.yoctoproject.org/g/meta-virtualization/unsub
>> <https://urldefense.com/v3/__https://lists.yoctoproject.org/g/meta-virtualization/unsub__;!!AjveYdw8EvQ!cnA8qqQTA9nQEfoueNL-1Ttq4BRcQatPSL_wWjwgKTTRYIEFbA2cTnu76WbjWOFd_BshZp9xtYSCkhX7RHkrOX2IP739BA$>
>> [[email protected]]
>> -=-=-=-=-=-=-=-=-=-=-=-
>>
>>
>
> --
> - Thou shalt not follow the NULL pointer, for chaos and madness await thee
> at its end
> - "Use the force Harry" - Gandalf, Star Trek II
>
>

-- 
- Thou shalt not follow the NULL pointer, for chaos and madness await thee
at its end
- "Use the force Harry" - Gandalf, Star Trek II