packages/utils/oci-runtime-tools, branch master

oci-runtime-tools: carry the pending validation fixes

2026-10-20T19:03:57Z

Most cgroup tests fail on OpenWrt because the test suite can only read cgroup v1, and several assertions contradict the runtime-spec or depend on the test host. Carry the fixes pending upstream in opencontainers/runtime-tools until they are merged: #812 (cgroup v2 reader), #813 (lifecycle assertions), #814 (pids limit by value), #816 (device rules checked from inside the container), #820 (misc_props process), #821 (blkio rules on an existing block device) and #822 (RLIMIT_NOFILE read from a child process). The default seccomp profile of the test configurations lists only the 32-bit time syscalls. On 32-bit targets the Go runtime of runtimetest uses futex_time64 on Linux 5.1 and later, which the profile denies, so runtimetest crashes inside every container and most tests report nothing on i386. Add a patch allowing the time64 variant of every syscall the profile already allows. Signed-off-by: Daniel Golle

oci-runtime-tools: skip the version check for oci-runtime-tests

2026-08-23T22:37:55Z

runtimetest and the ~60 validation/*.go binaries oci-runtime-tests installs are OCI compliance tests, not user-facing tools, and none of them has a version flag. Probing one runs the test it implements instead: CI's generic check reported 58 of 60 missing the version string and failed the build, and the one it did run tried to read rootfs-386.tar.gz relative to the probe's working directory rather than /usr/libexec/oci-runtime-test, so it also failed outright. Add a test.sh: skip oci-runtime-tests outright, since none of its binaries can report a version, and keep the generic check for oci-runtime-tool by replicating it directly now that --version reports the right string. Signed-off-by: Daniel Golle

oci-runtime-tools: report the real version string

2026-08-23T22:37:55Z

main.version was linked to PKG_SOURCE_VERSION, the upstream commit hash, rather than PKG_VERSION, the human-readable string everything else (the tarball name, the package version, CI's own version probe) actually means by "version". oci-runtime-tool --version therefore printed the commit hash twice (", commit: ") and never the string 1.3.0.20260316, which is what CI's generic runtime test greps stdout for, so the check failed on every push regardless of this PR's actual content. gitCommit stays on PKG_SOURCE_VERSION, since that is genuinely what it is; only version was wrong. Signed-off-by: Daniel Golle

oci-runtime-tools: depend on 'unshare'

2026-08-23T22:37:55Z

Some of the tests require 'unshare' on the host. Select it. Signed-off-by: Daniel Golle

oci-runtime-tools: install the test rootfs archives on x86

2026-08-23T22:37:55Z

The install recipe guarded both archives with CONFIG_x86, a symbol OpenWrt never defines: the target symbol is CONFIG_TARGET_x86 and the architecture symbols are CONFIG_i386 and CONFIG_x86_64. No archive was therefore packaged and every validation test stopped at "rootfs-amd64.tar.gz: Cannot open". Key each archive off the architecture symbol that matches it, i686 included, so the package's own architecture guard and the archive it installs cannot disagree. The choice moves out of the install recipe, since a conditional inside a define has to start at the beginning of the line to be a directive at all, which leaves no way to indent it as the packaging guidelines ask for. Signed-off-by: Daniel Golle

oci-runtime-tools: build runtimetest statically

2026-08-23T22:37:55Z

runtimetest is copied into the validation bundle, whose rootfs carries a static busybox and no dynamic loader, so the dynamically linked binary the generic Go recipe produces fails to execute and every validation test that inspects the container from the inside aborts. Build that one command again as the static binary upstream's own runtimetest target produces. Upstream gets there by asking the external linker for a static link, while disabling cgo reaches the same result without fighting the -linkmode external that the generic Go recipe would otherwise impose. Signed-off-by: Daniel Golle

oci-runtime-tools: update to GIT HEAD of 2026-03-16

2026-05-14T22:48:22Z

Update PKG_SOURCE_VERSION to 8a4db579f5c88af5a0d036fad34bddc9c1f703f3 (latest upstream main). oci-runtime-tools is a rolling release without versioned upstream releases. The new commit brings updated runtime-spec dependencies and bug fixes accumulated since November 2024. Link: https://github.com/opencontainers/runtime-tools/compare/f7e3563b...8a4db579 Signed-off-by: Daniel Golle

oci-runtime-tools: update to GIT HEAD of 2024-11-08

2025-02-10T19:19:16Z

Bumps OCI runtime spec to version 1.1.0. Signed-off-by: Daniel Golle

oci-runtime-tools: Make version apk compatible

2024-11-23T06:40:15Z

Adjust version to be compatible with apk semantic rules. Signed-off-by: Hannu Nyman

treewide: remove AUTORELEASE

2023-04-21T20:46:58Z

Automatically compute and substitute current values for all $(AUTORELEASE) instances as this feature is deprecated and shouldn't be used. The following temporary change was made to the core: diff --git a/rules.mk b/rules.mk index 57d7995d4fa8..f16367de87a8 100644 --- a/rules.mk +++ b/rules.mk @@ -429,7 +429,7 @@ endef abi_version_str = $(subst -,,$(subst _,,$(subst .,,$(1)))) COMMITCOUNT = $(if $(DUMP),0,$(call commitcount)) -AUTORELEASE = $(if $(DUMP),0,$(call commitcount,1)) +AUTORELEASE = $(if $(DUMP),0,$(shell sed -i "s/\$$(AUTORELEASE)/$(call commitcount,1)/" $(CURDIR)/Makefile)) all: FORCE: ; And this command used to fix affected packages: for i in $(cd feeds/packages; git grep -l PKG_RELEASE:=.*AUTORELEASE | \ sed 's^.*/$[^/]*$/Makefile^\1^';); do make package/$i/download done Signed-off-by: Paul Fertser