# SPDX-License-Identifier: Apache-2.0
%global commit 6485c3fbdfe28172ced5d6aed49554cf494967db
%global go_commit 30a83191d380204266349f4f58521134f0f73e52
%global go_version 1.26.3
%global selinuxtype targeted
# The sandbox re-executes without an ELF interpreter in its isolated root.
# Retain upstream's static Go executables; a PIE build fails at runtime.
%global gocompilerflags -buildmode exe -compiler gc
%global gobuild_ldflags ${GO_LDFLAGS-} -B gobuildid -compressdwarf=false -linkmode=internal
# Only the two freestanding C helpers omit build IDs, as required upstream.
# The prewarmer must fit in 4096 bytes. Check all other build IDs below.
%global _missing_build_ids_terminate_build 0

Name:           golang-gvisor
Version:        20260928.0
Release:        2%{?dist}
Summary:        OCI container runtime with a user-space kernel
License:        Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND MIT
URL:            https://gvisor.dev/
# This upstream-generated Go source tree corresponds exactly to Source3.
Source0:        https://codeload.github.com/google/gvisor/tar.gz/%{go_commit}#/gvisor-%{go_commit}.tar.gz
# Generated with Fedora go-vendor-tools; contains source dependencies only.
Source1:        %{name}-%{version}-vendor.tar.gz
Source2:        go-vendor-tools.toml
# Original C/assembly/BPF sources omitted by the generated Go export.
Source3:        https://codeload.github.com/google/gvisor/tar.gz/%{commit}#/gvisor-%{commit}.tar.gz
Source4:        source-release.py
Source5:        upstream.json
Source6:        prepare-go-source.py
Source7:        build-native.sh
Source8:        runsc-kvm
Source9:        50-gvisor.conf
Source10:       gvisor.cil
Source11:       README.md
# Backport upstream's compatibility fix for Fedora 45/Rawhide's Go 1.27.
Patch0:         grpc-go127.patch

ExclusiveArch:  x86_64 aarch64
BuildRequires:  go-vendor-tools
BuildRequires:  go-rpm-macros
BuildRequires:  golang >= %{go_version}
BuildRequires:  gcc
BuildRequires:  gcc-c++
BuildRequires:  binutils
BuildRequires:  clang
BuildRequires:  libbpf-devel
%ifarch x86_64
# clang -target bpf selects glibc's 32-bit header stubs.
BuildRequires:  glibc-devel(x86-32)
%endif
BuildRequires:  python3
BuildRequires:  python3-pyelftools
BuildRequires:  patch
BuildRequires:  selinux-policy-devel
Requires:       %{name}-selinux = %{version}-%{release}
Provides:       runsc = %{version}-%{release}

%description
gVisor is an OCI container runtime that runs applications inside a user-space
kernel. This package includes runsc and its matching helper directory, plus
Podman runtime entries for system-call interception and KVM.

%package containerd
Summary:        Containerd shim for the gVisor runtime
Requires:       %{name}%{?_isa} = %{version}-%{release}

%description containerd
The containerd shim compiled from the same gVisor source release.

%package selinux
Summary:        SELinux file labels for gVisor
BuildArch:      noarch
Requires:       container-selinux
Requires:       selinux-policy-targeted
Requires(postun): policycoreutils
Requires(posttrans): policycoreutils
%{?selinux_requires_min}

%description selinux
Labels gVisor executables with Fedora's existing container runtime type.
This policy supplies file contexts and does not add access rules.

%prep
python3 %{SOURCE4} verify --pin %{SOURCE5} --archive %{SOURCE0} --master-archive %{SOURCE3}
%setup -q -n gvisor-%{go_commit}
# Reject new embedded binaries and regenerate every known one from source.
python3 %{SOURCE6} --pin %{SOURCE5} --master-archive %{SOURCE3} .
# The vendor archive may include go.mod/go.sum changes from go mod tidy.
tar -xzf %{SOURCE1}
%patch -P0 -p1
install -m0644 %{SOURCE11} RPM-README.md

%generate_buildrequires
%go_vendor_license_buildrequires -c %{SOURCE2}

%build
export CGO_ENABLED=0 GO111MODULE=on GOTOOLCHAIN=local GOPROXY=off GOSUMDB=off
export GOCACHE="$PWD/.gocache"
export GO_LDFLAGS="-X gvisor.dev/gvisor/runsc/version.version=release-%{version}"
bash %{SOURCE7} "$PWD/.rpm-native" "$PWD"
# Rebuild the checkpoint gofer before embedding it in the runtime fallback.
%gobuild -mod=vendor -p=%{_smp_build_ncpus} -o release/gvisor-bin/checkpointgofer ./runsc/checkpointgofer/cmd
cp release/gvisor-bin/checkpointgofer runsc/checkpointgofer/checkpointgofer.bin
%gobuild -mod=vendor -p=%{_smp_build_ncpus} -o release/runsc ./runsc
%gobuild -mod=vendor -p=%{_smp_build_ncpus} -o release/containerd-shim-runsc-v1 ./shim
%gobuild -mod=vendor -p=%{_smp_build_ncpus} -o release/gvisor-bin/gvisor_sentry ./runsc/cmd/sentry
%gobuild -mod=vendor -p=%{_smp_build_ncpus} -o release/gvisor-bin/runsc-metric-server ./runsc/cmd/metricserver

%install
install -d -m0755 %{buildroot}%{_libexecdir}/gvisor/gvisor-bin
install -pm0755 release/runsc %{buildroot}%{_libexecdir}/gvisor/runsc
cp -a release/gvisor-bin/. %{buildroot}%{_libexecdir}/gvisor/gvisor-bin/
install -Dpm0755 release/containerd-shim-runsc-v1 %{buildroot}%{_bindir}/containerd-shim-runsc-v1
install -Dpm0755 %{SOURCE8} %{buildroot}%{_bindir}/runsc-kvm
ln -s ../libexec/gvisor/runsc %{buildroot}%{_bindir}/runsc
install -Dpm0644 %{SOURCE9} %{buildroot}%{_datadir}/containers/containers.conf.d/50-gvisor.conf
install -Dpm0644 %{SOURCE10} %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}/gvisor.cil
%go_vendor_license_install -c %{SOURCE2}

%check
test "$(%{buildroot}%{_libexecdir}/gvisor/runsc --version | sed -n 's/^runsc version //p')" = "release-%{version}"
# RPM's debug extraction and stripping have already run by this stage.
for helper in checkpointgofer gvisor-sentry-prewarmer gvisor_sentry runsc-fd-parking runsc-metric-server; do
    test -x %{buildroot}%{_libexecdir}/gvisor/gvisor-bin/$helper
done
test "$(find release/gvisor-bin -type f | wc -l)" -ge 5
test "$(stat -c %%s %{buildroot}%{_libexecdir}/gvisor/gvisor-bin/gvisor-sentry-prewarmer)" -le 4096
# Limit the missing-build-ID exception to the two known upstream C helpers.
find %{buildroot}%{_libexecdir}/gvisor -type f > runtime-files.list
echo %{buildroot}%{_bindir}/containerd-shim-runsc-v1 >> runtime-files.list
: > runtime-build-ids.list
while IFS= read -r binary; do
    case "$binary" in
        */gvisor-bin/gvisor-sentry-prewarmer|*/gvisor-bin/runsc-fd-parking) continue ;;
    esac
    build_id=$(readelf -n "$binary" | sed -n 's/.*Build ID: //p')
    test -n "$build_id"
    echo "$build_id" >> runtime-build-ids.list
done < runtime-files.list
test "$(sort -u runtime-build-ids.list | wc -l)" = "$(wc -l < runtime-build-ids.list)"
python3 -c 'import tomllib; tomllib.load(open("%{SOURCE9}", "rb"))'
bash -n %{SOURCE8}

export CGO_ENABLED=0 GO111MODULE=on GOTOOLCHAIN=local GOPROXY=off GOSUMDB=off
export GOCACHE="$PWD/.gocache"
%gotest -mod=vendor ./pkg/binary ./pkg/fspath
%go_vendor_license_check -c %{SOURCE2}

%post selinux
%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/gvisor.cil

%postun selinux
%selinux_modules_uninstall -s %{selinuxtype} gvisor

%posttrans selinux
if selinuxenabled; then
    restorecon -R %{_libexecdir}/gvisor %{_bindir}/runsc %{_bindir}/runsc-kvm 2>/dev/null || :
fi

%files -f %{go_vendor_license_filelist}
%doc RPM-README.md
%{_bindir}/runsc
%{_bindir}/runsc-kvm
%{_libexecdir}/gvisor/
%dir %{_datadir}/containers
%dir %{_datadir}/containers/containers.conf.d
%{_datadir}/containers/containers.conf.d/50-gvisor.conf

%files containerd
%{_bindir}/containerd-shim-runsc-v1

%files selinux
%license LICENSE
%{_datadir}/selinux/packages/%{selinuxtype}/gvisor.cil

%changelog
* Wed Oct 07 2026 gVisor RPM maintainers - 20260928.0-2
- Backport upstream gRPC HTTP/2 compatibility for Fedora's Go 1.27.

* Wed Oct 07 2026 gVisor RPM maintainers - 20260928.0-1
- Update the retired golang-gvisor runtime using Fedora's Go toolchain.
- Rebuild every embedded native input and ship the complete helper directory.