%define gobuild(o:) %{expand:
  %global _dwz_low_mem_die_limit 0
  %ifnarch ppc64
  go build -buildmode pie -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "${LDFLAGS:-}%{?currentgoldflags} -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -extldflags '-Wl,-z,relro  -Wl,-z,now' -compressdwarf=false" -a -v -x %{?**}; 
  %else
  go build                -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "${LDFLAGS:-}%{?currentgoldflags} -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -extldflags '-Wl,-z,relro  -Wl,-z,now' -compressdwarf=false" -a -v -x %{?**};
  %endif
}

%global with_debug 1

%if 0%{?with_debug}
%global _find_debuginfo_dwz_opts %{nil}
%global _dwz_low_mem_die_limit 0
%else
%global debug_package   %{nil}
%endif

%global provider github
%global provider_tld com
%global project containers
# https://github.com/containers/buildah
%global import_path %{provider}.%{provider_tld}/%{project}/%{name}
%global git0 https://%{import_path}

Name:           buildah
Version:        1.26.1
Release:        4
Summary:        A command line tool used for creating OCI Images
License:        ASL 2.0 and BSD and MIT and MPLv2.0
URL:            https://%{name}.io
Source:         %{git0}/archive/v%{version}.tar.gz
Source1:        https://github.com/cpuguy83/go-md2man/archive/v1.0.10.tar.gz
Patch1:         0001-CVE-2023-39325.patch
Patch2:         0002-CVE-2023-48795.patch
Patch3:         0003-CVE-2022-41723.patch
Patch4:         0004-CVE-2024-1753.patch
Patch5:         0005-CVE-2022-2990.patch
BuildRequires:  device-mapper-devel git-core golang >= 1.17.3-33 glib2-devel glibc-static gpgme-devel libassuan-devel
BuildRequires:  make ostree-devel btrfs-progs-devel libseccomp-static
Requires:       containers-common netavark iptables nftables libseccomp >= 2.4.1-0
Suggests:       containernetworking-plugins >= 0.9.1-1 cpp qemu-user-static
# awk '{print "Provides: bundled(golang("$1")) = "$2}' go.mod | sort | uniq | sed -e 's/-/_/g' -e '/bundled(golang())/d' -e '/bundled(golang(go\|module\|replace\|require))/d'
Provides:       bundled(golang(github.com/containerd/containerd)) = v1.5.9
Provides:       bundled(golang(github.com/containernetworking/cni)) = v1.0.1
Provides:       bundled(golang(github.com/containers/common)) = v0.47.4
Provides:       bundled(golang(github.com/containers/image/v5)) = v5.19.1
Provides:       bundled(golang(github.com/containers/ocicrypt)) = v1.1.2
Provides:       bundled(golang(github.com/containers/storage)) = v1.38.2
Provides:       bundled(golang(github.com/docker/distribution)) = v2.8.0+incompatible
Provides:       bundled(golang(github.com/docker/docker)) = v20.10.12+incompatible
Provides:       bundled(golang(github.com/docker/go_units)) = v0.4.0
Provides:       bundled(golang(github.com/docker/libnetwork)) = v0.8.0_dev.2.0.20190625141545_5a177b73e316
Provides:       bundled(golang(github.com/fsouza/go_dockerclient)) = v1.7.8
Provides:       bundled(golang(github.com/ghodss/yaml)) = v1.0.0
Provides:       bundled(golang(github.com/hashicorp/go_multierror)) = v1.1.1
Provides:       bundled(golang(github.com/ishidawataru/sctp)) = v0.0.0_20210226210310_f2269e66cdee
Provides:       bundled(golang(github.com/konsorten/go_windows_terminal_sequences)) = v1.0.3
Provides:       bundled(golang(github.com/mattn/go_shellwords)) = v1.0.12
Provides:       bundled(golang(github.com/onsi/ginkgo)) = v1.16.5
Provides:       bundled(golang(github.com/onsi/gomega)) = v1.18.1
Provides:       bundled(golang(github.com/opencontainers/go_digest)) = v1.0.0
Provides:       bundled(golang(github.com/opencontainers/image_spec)) = v1.0.3_0.20211202193544_a5463b7f9c84
Provides:       bundled(golang(github.com/opencontainers/runc)) = v1.1.0
Provides:       bundled(golang(github.com/opencontainers/runtime_spec)) = v1.0.3_0.20210326190908_1c3f411f0417
Provides:       bundled(golang(github.com/opencontainers/runtime_tools)) = v0.9.0
Provides:       bundled(golang(github.com/opencontainers/selinux)) = v1.10.0
Provides:       bundled(golang(github.com/openshift/imagebuilder)) = v1.2.2
Provides:       bundled(golang(github.com/pkg/errors)) = v0.9.1
Provides:       bundled(golang(github.com/seccomp/libseccomp_golang)) = v0.9.2_0.20210429002308_3879420cc921
Provides:       bundled(golang(github.com/sirupsen/logrus)) = v1.8.1
Provides:       bundled(golang(github.com/spf13/cobra)) = v1.3.0
Provides:       bundled(golang(github.com/spf13/pflag)) = v1.0.5
Provides:       bundled(golang(github.com/stretchr/testify)) = v1.7.0
Provides:       bundled(golang(github.com/syndtr/gocapability)) = v0.0.0_20200815063812_42c35b437635

%description
The %{name} package provides a command line tool which can be used to
* create a working container from scratch
or
* create a working container from an image as a starting point
* mount/umount a working container's root file system for manipulation
* save container's root file system layer to create a new image
* delete a working container or an image

%prep
%autosetup -Sgit -n %{name}-%{version}
tar -xf %SOURCE1

%build
GO_MD2MAN_PATH="$(pwd)%{_bindir}"
mkdir -p _buildgo2man/bin $GO_MD2MAN_PATH
cd go-md2man-*
go build -mod=vendor -o ../_buildgo2man/bin/go-md2man .
cp ../_buildgo2man/bin/go-md2man $GO_MD2MAN_PATH/go-md2man
export PATH=$GO_MD2MAN_PATH:$PATH
cd -

%set_build_flags
export GO111MODULE=on
export GOFLAGS=-mod=vendor
export GOPATH=$(pwd)/_build:$(pwd)
export CGO_CFLAGS=$CFLAGS
# These extra flags present in $CFLAGS have been skipped for now as they break the build
CGO_CFLAGS=$(echo $CGO_CFLAGS | sed 's/-flto=auto//g')
CGO_CFLAGS=$(echo $CGO_CFLAGS | sed 's/-Wp,D_GLIBCXX_ASSERTIONS//g')
CGO_CFLAGS=$(echo $CGO_CFLAGS | sed 's/-specs=\/usr\/lib\/rpm\/redhat\/redhat-annobin-cc1//g')

%ifarch x86_64
export CGO_CFLAGS+=" -m64 -mtune=generic -fcf-protection=full"
%endif

mkdir _build
pushd _build
mkdir -p src/%{provider}.%{provider_tld}/%{project}
ln -s $(dirs +1 -l) src/%{import_path}
popd

export CNI_VERSION=`grep '^# github.com/containernetworking/cni ' vendor/modules.txt | sed 's,.* ,,'`
export LDFLAGS="-X main.buildInfo=`date +%s` -X main.cniVersion=${CNI_VERSION}"

export BUILDTAGS='seccomp selinux'
%gobuild -o bin/%{name} %{import_path}/cmd/%{name}
GOMD2MAN=go-md2man %{__make} -C docs

%install
export GOPATH=$(pwd)/_build:$(pwd):%{gopath}
make DESTDIR=%{buildroot} PREFIX=%{_prefix} install install.completions
make DESTDIR=%{buildroot} PREFIX=%{_prefix} -C docs install

#define license tag if not already defined
%{!?_licensedir:%global license %doc}

%files
%license LICENSE
%doc README.md
%{_bindir}/%{name}
%{_mandir}/man1/%{name}*
%dir %{_datadir}/bash-completion
%dir %{_datadir}/bash-completion/completions
%{_datadir}/bash-completion/completions/%{name}

%changelog
* Wed Dec 25 2024 Jianmin <jianmin@iscas.ac.cn> - 1.26.1-4
- fix CVE-2024-1753 and CVE-2022-2990

* Mon Dec 23 2024 Jianmin <jianmin@iscas.ac.cn> - 1.26.1-3
- fix CVE-2023-39325, CVE-2022-41723 and CVE-2023-48795

* Thu Dec 19 2024 Jianmin <jianmin@iscas.ac.cn> - 1.26.1-2
- Rebuild on Go 1.17.3-33 to fix CVE-2023-24534 CVE-2023-24536 CVE-2023-24537 CVE-2023-24538 CVE-2023-29406 CVE-2022-41715 CVE-2024-24791 CVE-2021-34558 and CVE-2022-1962

* Mon Jun 20 2022 fushanqing <fushanqing@kylinos.cn> - 1.26.1-1
- Initial package
