.gitignore

@@ -1 +1 @@
-SOURCES/0.0.7.tar.gz
+SOURCES/toolbox-0.0.99.3-vendored.tar.xz

.toolbox.metadata

@@ -1 +1 @@
-c4f1c5b9391558c4626c7bc5882afa9bbe095a9b SOURCES/0.0.7.tar.gz
+ae6e6ac18c0d350eeabe9392a37ddc70cd60b52f SOURCES/toolbox-0.0.99.3-vendored.tar.xz

SOURCES/toolbox-Add-migration-paths-for-coreos-toolbox-users.patch

@@ -0,0 +1,101 @@
+From 495760a8e4a193f8403d67e503b4b8156dc859a8 Mon Sep 17 00:00:00 2001
+From: Debarshi Ray <rishi@fedoraproject.org>
+Date: Wed, 18 Aug 2021 17:55:21 +0200
+Subject: [PATCH 1/2] cmd/run: Make sosreport work by setting the HOST
+ environment variable
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1940037
+---
+ src/cmd/run.go | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/cmd/run.go b/src/cmd/run.go
+index 5954eac55fad..ca363815d4c9 100644
+--- a/src/cmd/run.go
++++ b/src/cmd/run.go
+@@ -441,6 +441,7 @@ func constructExecArgs(container string,
+ 	execArgs = append(execArgs, detachKeys...)
+ 
+ 	execArgs = append(execArgs, []string{
++		"--env", "HOST=/run/host",
+ 		"--interactive",
+ 		"--tty",
+ 		"--user", currentUser.Username,
+-- 
+2.38.1
+
+
+From dc5b363ff4ea53aae11b0582688dc59935539b72 Mon Sep 17 00:00:00 2001
+From: Debarshi Ray <rishi@fedoraproject.org>
+Date: Fri, 10 Dec 2021 13:42:15 +0100
+Subject: [PATCH 2/2] test/system: Update to test the migration path for
+ coreos/toolbox users
+
+This reverts the changes to the tests made in commit
+411147988b730dabf8b9e761a5426e12d648f008 by restoring commit
+ca899c8a561f357ae32c6ba6813520fd8b682abb and the parts of commit
+3aeb7cf288319e35eb9c5e26ea18d97452462c1e that were removed.
+---
+ test/system/002-help.bats | 11 -----------
+ test/system/100-root.bats | 27 +++++++++++++++++++++++++++
+ 2 files changed, 27 insertions(+), 11 deletions(-)
+ create mode 100644 test/system/100-root.bats
+
+diff --git a/test/system/002-help.bats b/test/system/002-help.bats
+index 689f95e472a1..525d44431ee5 100644
+--- a/test/system/002-help.bats
++++ b/test/system/002-help.bats
+@@ -8,17 +8,6 @@ setup() {
+   _setup_environment
+ }
+ 
+-@test "help: Try to run toolbox with no command" {
+-  run $TOOLBOX
+-
+-  assert_failure
+-  assert_line --index 0 "Error: missing command"
+-  assert_line --index 1 "create    Create a new toolbox container"
+-  assert_line --index 2 "enter     Enter an existing toolbox container"
+-  assert_line --index 3 "list      List all existing toolbox containers and images"
+-  assert_line --index 4 "Run 'toolbox --help' for usage."
+-}
+-
+ @test "help: Run command 'help'" {
+   if ! command -v man 2>/dev/null; then
+     skip "Test works only if man is in PATH"
+diff --git a/test/system/100-root.bats b/test/system/100-root.bats
+new file mode 100644
+index 000000000000..32d87904213e
+--- /dev/null
++++ b/test/system/100-root.bats
+@@ -0,0 +1,27 @@
++#!/usr/bin/env bats
++
++load 'libs/bats-support/load'
++load 'libs/bats-assert/load'
++load 'libs/helpers'
++
++setup() {
++  _setup_environment
++  cleanup_containers
++}
++
++teardown() {
++  cleanup_containers
++}
++
++@test "root: Try to enter the default container with no containers created" {
++  run $TOOLBOX <<< "n"
++
++  assert_success
++  assert_line --index 0 "No toolbox containers found. Create now? [y/N] A container can be created later with the 'create' command."
++  assert_line --index 1 "Run 'toolbox --help' for usage."
++}
++
++# TODO: Write the test
++@test "root: Enter the default container when 1 non-default container is present" {
++  skip "Testing of entering toolboxes is not implemented"
++}
+-- 
+2.38.1
+

SOURCES/toolbox-Make-the-build-flags-match-RHEL-s-gobuild-for-PPC64.patch

@@ -0,0 +1,63 @@
+From 024cf19e52544814cdee80693a6dc12b5a92943c Mon Sep 17 00:00:00 2001
+From: Debarshi Ray <rishi@fedoraproject.org>
+Date: Mon, 29 Jun 2020 17:57:47 +0200
+Subject: [PATCH] build: Make the build flags match RHEL's %{gobuild} for PPC64
+
+The Go toolchain doesn't play well with passing compiler and linker
+flags via environment variables. The linker flags require a second
+level of quoting, which leaves the build system without a quote level
+to assign the flags to an environment variable like GOFLAGS.
+
+This is one reason why RHEL doesn't have a RPM macro with only the
+flags. The %{gobuild} RPM macro includes the entire 'go build ...'
+invocation.
+
+The Go toolchain also doesn't like the LDFLAGS environment variable as
+exported by RHEL's %{meson} RPM macro, and RHEL's RPM toolchain doesn't
+like the compressed DWARF data generated by the Go toolchain.
+
+Note that these flags are only meant for the "ppc64" CPU architecture,
+and should be kept updated to match RHEL's Go guidelines. Use
+'rpm --eval "%{gobuild}"' to expand the %{gobuild} macro.
+---
+ src/go-build-wrapper | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/src/go-build-wrapper b/src/go-build-wrapper
+index ef4aafc8b024..00d7e9fca0e0 100755
+--- a/src/go-build-wrapper
++++ b/src/go-build-wrapper
+@@ -32,9 +32,9 @@ if ! cd "$1"; then
+     exit 1
+ fi
+ 
+-tags=""
++tags="-tags rpm_crashtraceback,${BUILDTAGS:-}"
+ if $6; then
+-    tags="-tags migration_path_for_coreos_toolbox"
++    tags="$tags,migration_path_for_coreos_toolbox"
+ fi
+ 
+ if ! libc_dir=$("$4" --print-file-name=libc.so); then
+@@ -69,11 +69,16 @@ fi
+ 
+ dynamic_linker="/run/host$dynamic_linker_canonical_dirname/$dynamic_linker_basename"
+ 
++unset LDFLAGS
++
+ # shellcheck disable=SC2086
+ go build \
++        -compiler gc \
+         $tags \
+-        -trimpath \
+-        -ldflags "-extldflags '-Wl,-dynamic-linker,$dynamic_linker -Wl,-rpath,/run/host$libc_dir_canonical_dirname' -linkmode external -X github.com/containers/toolbox/pkg/version.currentVersion=$3" \
++        -ldflags "${LDFLAGS:-} -compressdwarf=false -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \n') -extldflags '-Wl,-z,relro -Wl,--as-needed  -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-dynamic-linker,$dynamic_linker -Wl,-rpath,/run/host$libc_dir_canonical_dirname' -linkmode external -X github.com/containers/toolbox/pkg/version.currentVersion=$3" \
++        -a \
++        -v \
++        -x \
+         -o "$2/toolbox"
+ 
+ exit "$?"
+-- 
+2.31.1
+

SOURCES/toolbox-Make-the-build-flags-match-RHEL-s-gobuild.patch

@@ -0,0 +1,64 @@
+From 89129bd096c8bfac4ff84fc19726898cc901c1fc Mon Sep 17 00:00:00 2001
+From: Debarshi Ray <rishi@fedoraproject.org>
+Date: Mon, 29 Jun 2020 17:57:47 +0200
+Subject: [PATCH] build: Make the build flags match RHEL's %{gobuild}
+
+The Go toolchain doesn't play well with passing compiler and linker
+flags via environment variables. The linker flags require a second
+level of quoting, which leaves the build system without a quote level
+to assign the flags to an environment variable like GOFLAGS.
+
+This is one reason why RHEL doesn't have a RPM macro with only the
+flags. The %{gobuild} RPM macro includes the entire 'go build ...'
+invocation.
+
+The Go toolchain also doesn't like the LDFLAGS environment variable as
+exported by RHEL's %{meson} RPM macro, and RHEL's RPM toolchain doesn't
+like the compressed DWARF data generated by the Go toolchain.
+
+Note that these flags are meant for every CPU architecture other than
+PPC64, and should be kept updated to match RHEL's Go guidelines. Use
+'rpm --eval "%{gobuild}"' to expand the %{gobuild} macro.
+---
+ src/go-build-wrapper | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/src/go-build-wrapper b/src/go-build-wrapper
+index ef4aafc8b024..e82e42ca8151 100755
+--- a/src/go-build-wrapper
++++ b/src/go-build-wrapper
+@@ -32,9 +32,9 @@ if ! cd "$1"; then
+     exit 1
+ fi
+ 
+-tags=""
++tags="-tags rpm_crashtraceback,${BUILDTAGS:-}"
+ if $6; then
+-    tags="-tags migration_path_for_coreos_toolbox"
++    tags="$tags,migration_path_for_coreos_toolbox"
+ fi
+ 
+ if ! libc_dir=$("$4" --print-file-name=libc.so); then
+@@ -69,11 +69,17 @@ fi
+ 
+ dynamic_linker="/run/host$dynamic_linker_canonical_dirname/$dynamic_linker_basename"
+ 
++unset LDFLAGS
++
+ # shellcheck disable=SC2086
+ go build \
++        -buildmode pie \
++        -compiler gc \
+         $tags \
+-        -trimpath \
+-        -ldflags "-extldflags '-Wl,-dynamic-linker,$dynamic_linker -Wl,-rpath,/run/host$libc_dir_canonical_dirname' -linkmode external -X github.com/containers/toolbox/pkg/version.currentVersion=$3" \
++        -ldflags "${LDFLAGS:-} -compressdwarf=false -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \n') -extldflags '-Wl,-z,relro -Wl,--as-needed  -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-dynamic-linker,$dynamic_linker -Wl,-rpath,/run/host$libc_dir_canonical_dirname' -linkmode external -X github.com/containers/toolbox/pkg/version.currentVersion=$3" \
++        -a \
++        -v \
++        -x \
+         -o "$2/toolbox"
+ 
+ exit "$?"
+-- 
+2.31.1
+

SOURCES/toolbox.conf

@@ -0,0 +1,17 @@
+[general]
+# Create a toolbox container for a different operating system distro than the
+# host. Cannot be used with 'image'.
+## distro = "fedora"
+
+# Create a toolbox container for a different operating system release than the
+# host. Cannot be used with 'image'.
+## release = "33"
+
+# Change the name of the image used to create the toolbox container. This is
+# useful for creating containers from custom-built images. Cannot be used with
+# 'distro' or 'release'.
+#
+# If the name does not contain a registry, the local image storage will be
+# consulted, and if it's not present there then it will be pulled from a
+# suitable remote registry.
+image = "registry.access.redhat.com/ubi8/toolbox:latest"

SPECS/rhcos-toolbox.spec

@@ -1,54 +0,0 @@
-Name:		toolbox
-Version:	0.0.7
-Release:	1%{?dist}
-Summary:	Script to launch privileged container with podman
-
-License:	ASL 2.0
-URL:		https://github.com/coreos/toolbox
-Source0:	https://github.com/coreos/%{name}/archive/%{version}.tar.gz
-Requires:	podman
-BuildArch:	noarch
-
-%description
-toolbox is a small script that launches a container to let
-you bring in your favorite debugging or admin tools.
-
-%define debug_package %{nil}
-
-%prep
-%autosetup
-
-%build
-# No building required
-
-%install
-rm -rf $RPM_BUILD_ROOT
-install -d $RPM_BUILD_ROOT/%{_bindir}
-install -m 755 rhcos-toolbox $RPM_BUILD_ROOT/%{_bindir}/toolbox
-
-%files
-%license LICENSE
-%doc README.md NOTICE
-%{_bindir}/toolbox
-
-
-%changelog
-* Tue Mar 24 2020 Jindrich Novy <jnovy@redhat.com> - 0.0.7-1
-- New upstream release 0.0.7
-- Resolves: #1816287
-
-* Fri Jun 14 2019 Yu Qi Zhang <jerzhang@redhat.com> - 0.0.4-1.el8
-- Update for rhel8.1 container-tools module
-
-* Tue May 21 2019 Steve Milner <smilner@redhat.com> - 0.0.4-1.rhaos4.2.el8
-- Add help switch per RHBZ#1684258
-- Spec fixes found by rpmlint
-
-* Thu May 2 2019 Micah Abbott <miabbott@redhat.com> - 0.0.3-1.rhaos4.1.el8
-- Use rhel8/support-tools
-
-* Sat Jan 26 2019 Yu Qi Zhang <jerzhang@redhat.com> - 0.0.2-1.rhaos4.1.el8
-- Add runlabel options and fix default image
-
-* Thu Sep 6 2018 Yu Qi Zhang <jerzhang@redhat.com> - 0.0.1-1.rhaos4.1.el8
-- Initial Specfile for Red Hat CoreOS Toolbox

SPECS/toolbox.spec

@@ -0,0 +1,218 @@
+%global __brp_check_rpaths %{nil}
+
+# RHEL's RPM toolchain doesn't like the compressed DWARF data generated by the
+# Go toolchain.
+%global _dwz_low_mem_die_limit 0
+%global _find_debuginfo_dwz_opts %{nil}
+
+Name:          toolbox
+Version:       0.0.99.3
+
+%global goipath github.com/containers/%{name}
+%gometa
+
+Release:       5%{?dist}
+Summary:       Tool for containerized command line environments on Linux
+
+License:       ASL 2.0
+URL:           https://containertoolbx.org/
+
+# https://github.com/containers/%%{name}/releases/download/%%{version}/%%{name}-%%{version}.tar.xz
+# A vendored tarball was created from the upstream tarball:
+# $ cd src
+# $ go mod vendor
+Source0:       %{name}-%{version}-vendored.tar.xz
+Source1:       %{name}.conf
+
+# https://bugzilla.redhat.com/show_bug.cgi?id=2033280
+Patch0:        toolbox-Unbreak-sorting-and-clearly-identify-copied-images-in-list.patch
+
+# RHEL specific
+Patch100:      toolbox-Make-the-build-flags-match-RHEL-s-gobuild.patch
+Patch101:      toolbox-Make-the-build-flags-match-RHEL-s-gobuild-for-PPC64.patch
+Patch102:      toolbox-Add-migration-paths-for-coreos-toolbox-users.patch
+
+# https://bugzilla.redhat.com/show_bug.cgi?id=1905383
+ExcludeArch:   %{ix86}
+
+BuildRequires: golang >= 1.19.1
+BuildRequires: /usr/bin/go-md2man
+BuildRequires: meson >= 0.58.0
+BuildRequires: pkgconfig(bash-completion)
+BuildRequires: systemd-rpm-macros
+
+Requires:      containers-common
+Requires:      podman >= 1.4.0
+
+
+%description
+Toolbox is a tool for Linux operating systems, which allows the use of
+containerized command line environments. It is built on top of Podman and
+other standard container technologies from OCI.
+
+
+%package       tests
+Summary:       Tests for %{name}
+
+Requires:      %{name}%{?_isa} = %{version}-%{release}
+Requires:      coreutils
+Requires:      gawk
+Requires:      grep
+Requires:      skopeo
+
+%description   tests
+The %{name}-tests package contains system tests for %{name}.
+
+
+%prep
+%setup -q
+
+%patch0 -p1
+
+%ifnarch ppc64
+%patch100 -p1
+%else
+%patch101 -p1
+%endif
+
+%patch102 -p1
+
+# %%gomkdir is absent from RHEL 8.
+GOBUILDDIR="$(pwd)/_build"
+GOSOURCEDIR="$(pwd)"
+if [[ ! -e "$GOBUILDDIR/bin" ]] ; then
+  install -m 0755 -vd "$GOBUILDDIR/bin"
+fi
+if [[ ! -e "$GOBUILDDIR/src/%{goipath}" ]] ; then
+  install -m 0755 -vd "$(dirname $GOBUILDDIR/src/%{goipath})"
+  ln -fs "$GOSOURCEDIR" "$GOBUILDDIR/src/%{goipath}"
+fi
+cd "$GOBUILDDIR/src/%{goipath}"
+
+
+%build
+export GO111MODULE=off
+GOBUILDDIR="$(pwd)/_build"
+export GOPATH="$GOBUILDDIR:%{gopath}"
+export CGO_CFLAGS="%{optflags} -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64"
+ln -s src/cmd cmd
+ln -s src/pkg pkg
+ln -s src/vendor vendor
+
+%meson \
+    --buildtype=plain \
+    -Dmigration_path_for_coreos_toolbox=true \
+    -Dprofile_dir=%{_sysconfdir}/profile.d \
+    -Dtmpfiles_dir=%{_tmpfilesdir}
+
+%meson_build
+
+
+%install
+%meson_install
+install -m0644 %{SOURCE1} %{buildroot}%{_sysconfdir}/containers/%{name}.conf
+
+
+%files
+%doc CODE-OF-CONDUCT.md NEWS README.md SECURITY.md
+%license COPYING
+%{_bindir}/%{name}
+%{_datadir}/bash-completion
+%{_mandir}/man1/%{name}.1*
+%{_mandir}/man1/%{name}-*.1*
+%config(noreplace) %{_sysconfdir}/containers/%{name}.conf
+%{_sysconfdir}/profile.d/%{name}.sh
+%{_tmpfilesdir}/%{name}.conf
+
+%files tests
+%{_datadir}/%{name}
+
+
+%changelog
+* Tue Dec 13 2022 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.3-5
+- Unbreak sorting and clearly identify copied images in 'list'
+Resolves: #2033280
+
+* Mon Nov 07 2022 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.3-4
+- Rebuild for CVE-2022-27664 and CVE-2022-32189
+Resolves: #2116767, #2126755
+
+* Mon Nov 07 2022 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.3-3
+- Rebuild for CVE-2022-1705, CVE-2022-30630, CVE-2022-30631 and CVE-2022-30632
+Resolves: #2111828
+
+* Mon Nov 07 2022 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.3-2
+- Update to 0.0.99.3
+- BuildRequire only systemd-rpm-macros as recommended by the Fedora packaging
+  guidelines
+- Update the Summary to match upstream
+- Update the URL to point to the website
+Resolves: #2047290
+
+* Wed May 11 2022 Jindrich Novy <jnovy@redhat.com> - 0.0.99.3-0.6
+- BuildRequires: /usr/bin/go-md2man
+- Related: #2061390
+
+* Fri Apr 08 2022 Jindrich Novy <jnovy@redhat.com> - 0.0.99.3-0.5
+- Related: #2061390
+
+* Mon Sep 20 2021 Jindrich Novy <jnovy@redhat.com> - 0.0.99.3-0.4
+- Switch to using the Toolbox-specific UBI image by default
+- Related: #2001445
+
+* Thu Sep 02 2021 Debarshi Ray <rishi@fedoraproject.org> - 0.0.99.3-0.3
+- Suggest a way forward if coreos/toolbox was used
+Resolves: #1998191, #2000914
+
+* Thu Aug 26 2021 Jindrich Novy <jnovy@redhat.com> - 0.0.99.3-0.2
+- Make sosreport work by setting the HOST environment variable
+- Related: #1934415
+
+* Wed Aug 11 2021 Jindrich Novy <jnovy@redhat.com> - 0.0.99.3-0.1
+- change release to 0.x so it is obvious it is devel version
+- Related: #1934415
+
+* Thu Aug 05 2021 Jindrich Novy <jnovy@redhat.com> - 0.0.99.3-1
+- Fix the build on CentOS Stream
+- Related: #1934415
+
+* Wed Jul 28 2021 Jindrich Novy <jnovy@redhat.com> - 0.0.99.2^1.git660b6970e998-1
+- Add support for configuration files
+Resolves: #1940082
+- Related: #1934415
+
+* Mon Jul 26 2021 Jindrich Novy <jnovy@redhat.com> - 0.0.99.2-4
+- Instead of offering to log into a registry, just mention 'podman login'
+- Related: #1934415
+
+* Sat Jul 10 2021 Jindrich Novy <jnovy@redhat.com> - 0.0.99.2-3
+- Expose the host's entire / in the container at /run/host
+- Related: #1934415
+
+* Mon Jul 05 2021 Jindrich Novy <jnovy@redhat.com> - 0.0.99.2-2
+- Actually apply the patch to make 'toolbox' create or fall back to a
+  container if possible
+- Support logging into a registry if necessary
+- Related: #1934415
+
+* Fri Jul 02 2021 Jindrich Novy <jnovy@redhat.com> - 0.0.99.2-1
+- Update to 0.0.99.2
+- Make 'toolbox' create or fall back to a container if possible
+Resolves: #1914687
+- Related: #1934415
+
+* Tue Jan 12 2021 Jindrich Novy <jnovy@redhat.com> - 0.0.99-1
+- Update to 0.0.99
+- Related: #1883490
+
+* Tue Jan 12 2021 Jindrich Novy <jnovy@redhat.com> - 0.0.98.1-3
+- remove bats as it's not present in RHEL
+- Related: #1883490
+
+* Mon Jan 11 2021 Jindrich Novy <jnovy@redhat.com> - 0.0.98.1-2
+- harden the toolbox binary
+- minor fixes
+- Related: #1883490
+
+* Fri Jan 08 2021 Debarshi Ray <rishi@fedoraproject.org> - 0.0.98.1-1
+- Rebase to github.com/containers/toolbox