Hello community, here is the log from the commit of package docker for openSUSE:Factory checked in at 2017-05-23 10:18:53 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/docker (Old) and /work/SRC/openSUSE:Factory/.docker.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "docker" Tue May 23 10:18:53 2017 rev:54 rq:495655 version:17.04.0_ce Changes: -------- --- /work/SRC/openSUSE:Factory/docker/docker.changes 2017-04-17 10:26:35.327855973 +0200 +++ /work/SRC/openSUSE:Factory/.docker.new/docker.changes 2017-05-23 10:18:59.332239279 +0200 @@ -1,0 +2,63 @@ +Wed May 17 14:41:29 UTC 2017 - asarai@suse.com + +- Fix bsc#1037607 which was causing read-only issues on Kubic, this is a + backport of https://github.com/moby/moby/pull/33250. + + bsc1037607-0001-apparmor-make-pkg-aaparser-work-on-read-only-root.patch + +------------------------------------------------------------------- +Wed May 10 13:54:44 UTC 2017 - asarai@suse.com + +- Add a partial fix for boo#1038493. +- Fixed bsc#1037436 where execids were being leaked due to bad error handling. + This is a backport of https://github.com/docker/cli/pull/52. + + bsc1037436-0001-client-check-tty-before-creating-exec-job.patch + +------------------------------------------------------------------- +Thu May 4 19:03:40 UTC 2017 - jmassaguerpla@suse.com + +- Fix golang requirements in the subpackages + +------------------------------------------------------------------- +Mon May 1 07:57:35 UTC 2017 - fcastelli@suse.com + +- Update golang build requirements to use golang(API) symbol: this is + needed to solve a conflict between multiple versions of Go being available + +------------------------------------------------------------------- +Tue Apr 18 15:38:11 UTC 2017 - jmassaguerpla@suse.com + +- Fix secrets-0002-SUSE-implement-SUSE-container-secrets.patch: + substitute docker/distribution/digest by opencontainers/digest + +------------------------------------------------------------------- +Thu Apr 13 14:34:35 UTC 2017 - jmassaguerpla@suse.com + +- Update to version 17.04.0-ce (fix bsc#1034053 ) + +- Patches removed because have been merged into this version: + * pr31549-cmd-docker-fix-TestDaemonCommand.patch + * pr31773-daemon-also-ensureDefaultApparmorProfile-in-exec-pat.patch +- Patches rebased: + * integration-cli-fix-TestInfoEnsureSucceeds.patch +- Build man pages for all archs (bsc#953182) +- Containers cannot resolve DNS if docker host uses 127.0.0.1 as resolver (bsc#1034063) + +see /usr/share/doc/packages/docker/CHANGELOG.md + +------------------------------------------------------------------- +Wed Apr 12 09:54:18 UTC 2017 - jmassaguerpla@suse.com + +- Make sure this is being built with go 1.7 + +------------------------------------------------------------------- +Wed Apr 12 09:14:35 UTC 2017 - jmassaguerpla@suse.com + +- remove the go_arches macro because we are using go1.7 which + is available in all archs + +- remove gcc specific patches + * gcc-go-patches.patch + * netlink_netns_powerpc.patch + * boltdb_bolt_add_brokenUnaligned.patch + +------------------------------------------------------------------- Old: ---- boltdb_bolt_add_brokenUnaligned.patch docker-1.13.0.tar.xz gcc-go-patches.patch netlink_netns_powerpc.patch pr31549-cmd-docker-fix-TestDaemonCommand.patch pr31773-daemon-also-ensureDefaultApparmorProfile-in-exec-pat.patch New: ---- bsc1037436-0001-client-check-tty-before-creating-exec-job.patch bsc1037607-0001-apparmor-make-pkg-aaparser-work-on-read-only-root.patch docker-17.04.0_ce.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ docker.spec ++++++ --- /var/tmp/diff_new_pack.O87KAV/_old 2017-05-23 10:19:00.300102830 +0200 +++ /var/tmp/diff_new_pack.O87KAV/_new 2017-05-23 10:19:00.304102266 +0200 @@ -17,26 +17,12 @@ # nodebuginfo -# Check if go_arches is defined in the project configuration -# Otherwise, define it here -# In order to define it in the project configuration, see -# -# https://en.opensuse.org/openSUSE:Build%20Service%20prjconf#Macros -# -# The Macros tag is the one that defines the go_arches variable to be used -# in the spec file. -# The "define" one is to help the specfile parser of the buildservice -# to see what packages are being built. You also want to define it here -# for keeping things consistent. - -%{!?go_arches: %global go_arches %ix86 x86_64 aarch64 ppc64le} - %global docker_store %{_localstatedir}/lib/docker %global docker_migration_testfile %{docker_store}/.suse-image-migration-v1to2-complete %global docker_migration_warnfile %{docker_store}/docker-update-message.txt %define docker_graph %{docker_store}/graph %define git_version 78d1802 -%define version_unconverted 1.13.0 +%define version_unconverted 17.04.0_ce %define __arch_install_post export NO_BRP_STRIP_DEBUG=true # When upgrading to a new version requires the service not to be restarted # Due to a long migration process update last_migration_version to the new version @@ -44,7 +30,7 @@ # 1.10.1 %global last_migration_version 1.10.1 Name: docker -Version: 1.13.0 +Version: 17.04.0_ce Release: 0 Summary: The Linux container runtime License: Apache-2.0 @@ -60,10 +46,6 @@ Source9: docker-update-message.txt Source10: tests.sh Source11: docker_service_helper.sh -# Fixes for architecture-specific issues (gcc-go). -Patch100: gcc-go-patches.patch -Patch102: netlink_netns_powerpc.patch -Patch103: boltdb_bolt_add_brokenUnaligned.patch # SUSE-FEATURE: Adds the /run/secrets mountpoint inside all Docker containers # which is not snapshotted when images are committed. Note that if you modify # this patch, please also modify the patch in the suse-secrets-v<version> @@ -72,8 +54,10 @@ Patch201: secrets-0002-SUSE-implement-SUSE-container-secrets.patch # PATCH-FIX-UPSTREAM: Backports. Patch300: integration-cli-fix-TestInfoEnsureSucceeds.patch -Patch301: pr31549-cmd-docker-fix-TestDaemonCommand.patch -Patch302: pr31773-daemon-also-ensureDefaultApparmorProfile-in-exec-pat.patch +# PATCH-FIX-UPSTREAM: Backport of https://github.com/docker/cli/pull/52 (bsc#1037436). +Patch400: bsc1037436-0001-client-check-tty-before-creating-exec-job.patch +# PATCH-FIX-UPSTREAM: Backport of https://github.com/moby/moby/pull/33250 (bsc#1037607). +Patch401: bsc1037607-0001-apparmor-make-pkg-aaparser-work-on-read-only-root.patch BuildRequires: audit BuildRequires: bash-completion BuildRequires: ca-certificates @@ -97,13 +81,13 @@ Requires: apparmor-parser Requires: bridge-utils Requires: ca-certificates-mozilla -Requires: docker-libnetwork = 0.0.0+git20161019.0f53435 +Requires: docker-libnetwork = 0.0.0+git20170119.7b2b1fe # Containerd and runC are required as they are the only currently supported # execdrivers of Docker. NOTE: The version pinning here matches upstream's # Dockerfile to ensure that we don't use a slightly incompatible version of # runC or containerd (which would be bad). -Requires: containerd = 0.2.5+gitr608_03e5862 -Requires: runc = 0.1.1+gitr2942_2f7393a +Requires: containerd = 0.2.5+gitr639_422e31c +Requires: runc = 0.1.1+gitr2947_9c2d8d1 # Provides mkfs.ext4 - used by Docker when devicemapper storage driver is used Requires: e2fsprogs Requires: git-core >= 1.7 @@ -124,12 +108,9 @@ Conflicts: lxc < 1.0 BuildRoot: %{_tmppath}/%{name}-%{version}-build ExcludeArch: %ix86 s390 ppc -%ifarch %{go_arches} -BuildRequires: go >= 1.5 +# Make sure we build with go 1.7 BuildRequires: go-go-md2man -%else -BuildRequires: gcc6-go >= 6.1 -%endif +BuildRequires: golang(API) = 1.7 %description Docker complements LXC with a high-level API which operates at the process @@ -169,15 +150,12 @@ Requires: bash-completion Requires: device-mapper-devel >= 1.2.68 Requires: glibc-devel-static +# Make sure we require go 1.7 Requires: libapparmor-devel Requires: libbtrfs-devel >= 3.8 Requires: procps Requires: sqlite3-devel -%ifarch %{go_arches} -Requires: go >= 1.4 -%else -Requires: gcc6-go >= 6.1 -%endif +Requires: golang(API) = 1.7 %description test Test package for docker. It contains the source code and the tests. @@ -190,25 +168,13 @@ %patch200 -p1 %patch201 -p1 %endif -%ifnarch %{go_arches} -%patch100 -p1 -%patch102 -p1 -%patch103 -p1 -%endif %patch300 -p1 -%patch301 -p1 -%patch302 -p1 +%patch400 -p1 +%patch401 -p1 cp %{SOURCE7} . cp %{SOURCE10} . %build -%ifnarch %{go_arches} -tmphack=/tmp/dirty-hack -[ -e $tmphack ] && rm -rf $tmphack -mkdir $tmphack -ln -s %{_bindir}/go-6 $tmphack/go -export PATH=$tmphack:$PATH -%endif BUILDTAGS="exclude_graphdriver_aufs apparmor selinux pkcs11" %if 0%{?with_libseccomp} @@ -226,16 +192,15 @@ export AUTO_GOPATH=1 export DOCKER_BUILDTAGS="$BUILDTAGS" export DOCKER_GITCOMMIT=%{git_version} +# Until boo#1038493 is fixed properly we need to do this hack to get the +# compiled-into-the-binary GOROOT. +export GOROOT="$(GOROOT= go env GOROOT)" EOF ) > docker_build_env . ./docker_build_env -%ifarch %{go_arches} ./hack/make.sh dynbinary man/md2man-all.sh -%else -./hack/make.sh dyngccgo -%endif # build the tests binary GOPATH=$(pwd)/vendor:$(pwd)/.gopath/ go test \ @@ -246,7 +211,6 @@ # otherwise the resulting package will have extra requires rm -rf hack/make/.build-deb -%ifarch %go_arches %check . ./docker_build_env @@ -304,18 +268,12 @@ %endif go test -cover -ldflags -w -tags "$DOCKER_BUILDTAGS" -a -test.timeout=10m $PKG_LIST -%endif %install install -d %{buildroot}%{go_contribdir} install -d %{buildroot}%{_bindir} -%ifarch %{go_arches} install -D -m755 bundles/latest/dynbinary-client/%{name} %{buildroot}/%{_bindir}/%{name} install -D -m755 bundles/latest/dynbinary-daemon/%{name}d %{buildroot}/%{_bindir}/%{name}d -%else -install -D -m755 bundles/latest/dyngccgo/%{name} %{buildroot}/%{_bindir}/%{name} -install -D -m755 bundles/latest/dyngccgo/%{name}d %{buildroot}/%{_bindir}/%{name}d -%endif install -d %{buildroot}/%{_prefix}/lib/docker install -Dd -m 0755 \ %{buildroot}%{_sysconfdir}/init.d \ @@ -356,7 +314,6 @@ # sysconfig file install -D -m 644 %{SOURCE4} %{buildroot}%{_localstatedir}/adm/fillup-templates/sysconfig.docker -%ifarch %{go_arches} # install manpages install -d %{buildroot}%{_mandir}/man1 install -p -m 644 man/man1/*.1 %{buildroot}%{_mandir}/man1 @@ -364,7 +321,6 @@ install -p -m 644 man/man5/Dockerfile.5 %{buildroot}%{_mandir}/man5 install -d %{buildroot}%{_mandir}/man8 install -p -m 644 man/man8/*.8 %{buildroot}%{_mandir}/man8 -%endif install -D -m 0644 %{SOURCE9} %{buildroot}%{docker_migration_warnfile} @@ -424,7 +380,7 @@ %files %defattr(-,root,root) -%doc README.md LICENSE README_SUSE.md +%doc README.md LICENSE README_SUSE.md CHANGELOG.md %{_bindir}/docker %{_bindir}/dockerd %{_sbindir}/rcdocker @@ -434,12 +390,10 @@ %{_udevrulesdir}/80-%{name}.rules %{_localstatedir}/adm/fillup-templates/sysconfig.docker %{_localstatedir}/lib/docker/ -%ifarch %{go_arches} %{_mandir}/man1/docker-*.1%{ext_man} %{_mandir}/man1/docker.1%{ext_man} %{_mandir}/man5/Dockerfile.5%{ext_man} %{_mandir}/man8/dockerd.8%{ext_man} -%endif %files bash-completion %defattr(-,root,root) ++++++ _service ++++++ --- /var/tmp/diff_new_pack.O87KAV/_old 2017-05-23 10:19:00.380091554 +0200 +++ /var/tmp/diff_new_pack.O87KAV/_new 2017-05-23 10:19:00.380091554 +0200 @@ -3,8 +3,8 @@ <param name="url">https://github.com/docker/docker.git</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="versionformat">1.13.0</param> - <param name="revision">v1.13.0</param> + <param name="versionformat">17.04.0_ce</param> + <param name="revision">v17.04.0-ce</param> </service> <service name="recompress" mode="disabled"> <param name="file">docker-*.tar</param> ++++++ bsc1037436-0001-client-check-tty-before-creating-exec-job.patch ++++++
From c117441b1a74affb013a42ee8225d69ecfaf4d72 Mon Sep 17 00:00:00 2001 From: Aleksa Sarai
Date: Tue, 9 May 2017 23:31:46 +1000 Subject: [PATCH] client: check tty before creating exec job
This is necessary in order to avoid execId leaks in the case where a
`docker exec -it` is run without a terminal available for the client.
You can reproduce this issue by running the following command many
times.
% nohup docker exec -it some_container true
The container `some_container` will have execIDs that will never
normally be cleaned up (because the client died before they were
started).
In addition, this patch adds a docker-inspect step to ensure that we
give "container does not exist" errors consistently.
[SUSE: Fixes bsc#1037436.]
Signed-off-by: Valentin Rothberg
From 9783e1791fc438751b327023b0cd7d392e54084f Mon Sep 17 00:00:00 2001 From: Aleksa Sarai
Date: Thu, 18 May 2017 00:02:00 +1000 Subject: [PATCH] apparmor: make pkg/aaparser work on read-only root
This is necessary because normally `apparmor_parser -r` will try to
create a temporary directory on the host (which is not allowed if the
host has a rootfs). However, the -K option bypasses saving things to the
cache (which avoids this issue).
% apparmor_parser -r /tmp/docker-profile
mkstemp: Read-only file system
% apparmor_parser -Kr /tmp/docker-profile
%
In addition, add extra information to the ensureDefaultAppArmorProfile
errors so that problems like this are easier to debug.
Fixes: 2f7596aaef3a ("apparmor: do not save profile to /etc/apparmor.d")
Signed-off-by: Aleksa Sarai