runc (1.3.6+ds1-1ubuntu1) stonking; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - d/control: add non default pkg.runc.with-bin Build-Profiles to runc
      binary package.
    - d/golang-github-opencontainers-runc-dev.docs: install NOTICE file to be
      compliant with the Apache 2 license
    - d/tests/control: remove integration and checkpoint autopkgtest.
      Since they depend on the runc binary package which is not provided by
      this source package by default.

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Mon, 24 Aug 2026 14:59:53 +0200

runc (1.3.6+ds1-1) unstable; urgency=medium

  * New upstream release
  * Fixes CVE-2026-41579: a malicious image with a /dev symlink could
    cause limited host filesystem integrity violations (Closes: #1140000)
  * Fix a regression in v1.3.0 that could result in a stuck `runc exec`
    or `runc run` when the container process runs for a short time
  * Reuse a single read-only tmpfs when masking directories, reducing
    tmpfs superblock churn (relevant for Kubernetes per-CPU sysfs masks)
  * debian/clean: clean up generated man pages so that the source
    package can be built again after a successful build (Closes: #1046528)
  * Bump Standards Version, drop Priority: optional

 -- Reinhard Tartler <siretart@tauware.de>  Thu, 06 Aug 2026 13:33:30 +0200

runc (1.3.5+ds1-1ubuntu1) stonking; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - d/control: add non default pkg.runc.with-bin Build-Profiles to runc
      binary package.
    - d/golang-github-opencontainers-runc-dev.docs: install NOTICE file to be
      compliant with the Apache 2 license
    - d/tests/control: remove integration and checkpoint autopkgtest.
      Since they depend on the runc binary package which is not provided by
      this source package by default.

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Mon, 04 May 2026 17:08:19 +0200

runc (1.3.5+ds1-1) unstable; urgency=medium

  * New upstream release
  * filepath-securejoin 0.5.2 no longer caches a successful openat2 test
    and falls back to the O_PATH resolver when openat2 is denied by a
    seccomp profile (Closes: #1121245)

 -- Reinhard Tartler <siretart@tauware.de>  Sun, 29 Mar 2026 20:51:52 -0400

runc (1.3.3+ds1-2ubuntu1) resolute; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - d/control: add non default pkg.runc.with-bin Build-Profiles to runc
      binary package.
    - d/golang-github-opencontainers-runc-dev.docs: install NOTICE file to be
      compliant with the Apache 2 license
    - d/tests/control: remove integration and checkpoint autopkgtest.
      Since they depend on the runc binary package which is not provided by
      this source package by default.

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Wed, 19 Nov 2025 16:57:40 +0100

runc (1.3.3+ds1-2) unstable; urgency=medium

  * Upload to unstable
  * debian/control: Drop redundant Rules-Requires-Root

 -- Reinhard Tartler <siretart@tauware.de>  Sun, 16 Nov 2025 11:28:16 -0500

runc (1.3.3+ds1-1) experimental; urgency=medium

  * New upstream release:
    - Fixes CVE-2025-31133, CVE-2025-52565, CVE-2025-52881,
      Closes: #1120140
  * refresh patches
  * debian/control:
    - tighten dependency on containerd/console
    - build against golang-github-cyphar-filepath-securejoin-dev 0.5
  * debian/copyright: clarify licensing terms of this package
  * Backport upstream patches:
    - libct: use manager.AddPid to add exec to cgroup

 -- Reinhard Tartler <siretart@tauware.de>  Sat, 15 Nov 2025 18:28:40 -0500

runc (1.3.2+ds1-1) unstable; urgency=medium

  * New upstream release, important changes:
    - Removed pre-emptive warning for runc pause/unpause as unprivileged user.
    - Improved error messages for mount flag conflicts.
    - Improved runc version output for non-make builds.
    - Container processes no longer inherit runc's CPU affinity; now based
      on cpuset cgroup and system restrictions.
    - Fixed rootfs propagation for "shared" or "unbindable" modes.
    - Closed seccomp agent connection to prevent resource leaks.
    - Improved "runc delete" and "runc stop" to handle interrupted "runc
      create" setups.
    - Prevented "runc update" from clearing intelRdt state.
    - Removed /proc/net/dev from permitted procfs overmount list.
    - Improved cgroup v1 CPU shares to v2 CPU weight conversion.
    - Fixed occasional "cgroup.freeze: no such device" error in "runc state".
    - Fixed memory limit rounding on ppc64 systems.

 -- Reinhard Tartler <siretart@tauware.de>  Sat, 01 Nov 2025 19:14:48 -0400

runc (1.3.0+ds1-4) unstable; urgency=medium

  * Add breaks to older versions containers/{common,buildah}, podman
  * Unbreak GetDevices() when running inside incus

 -- Reinhard Tartler <siretart@tauware.de>  Fri, 19 Sep 2025 15:01:29 -0400

runc (1.3.0+ds1-3) unstable; urgency=medium

  * Team upload.
  * Upload to unstable

 -- Reinhard Tartler <siretart@tauware.de>  Thu, 18 Sep 2025 06:20:45 -0400

runc (1.3.0+ds1-2) experimental; urgency=medium

  * Team upload.
  * Fix FTBFS on mips64el
  * Bump Standards-Version
  * Reviewed and silenced seveal Lintian warnings
  * Use Static-Built-Using instead of Built-Using field

 -- Reinhard Tartler <siretart@tauware.de>  Mon, 15 Sep 2025 14:20:42 -0400

runc (1.3.0+ds1-1) experimental; urgency=medium

  * Team upload.
  * Build against golang-github-cilium-ebpf in experimental
  * Contains commit 81707abd33d2ddebcd8ceeb08dfc01bf86d8badd, Closes: #1071269
  * Contains commit 77cae9addc0c7c9ef52513b4e46b2e6485e4e469, Closes: #1076814

 -- Reinhard Tartler <siretart@tauware.de>  Sun, 14 Sep 2025 16:31:05 -0400

runc (1.1.15+ds1-2ubuntu1) plucky; urgency=medium

  * Merge from Debian unstable. Remaining changes:
    - d/control: add non default pkg.runc.with-bin Build-Profiles to runc
      binary package.
    - d/golang-github-opencontainers-runc-dev.docs: install NOTICE file to be
      compliant with the Apache 2 license
    - d/tests/control: remove integration and checkpoint autopkgtest.
      Since they depend on the runc binary package which is not provided by
      this source package by default.

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Sat, 08 Feb 2025 17:31:27 +0100

runc (1.1.15+ds1-2) unstable; urgency=medium

  * Team upload.

  [ zhangdandan <zhangdandan@loongson.cn> ]
  * Fix loongarch64 support (Closes: #1095452)

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Sat, 08 Feb 2025 17:15:23 +0100

runc (1.1.15+ds1-1ubuntu1) plucky; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - d/control: add non default pkg.runc.with-bin Build-Profiles to runc
      binary package.
    - d/golang-github-opencontainers-runc-dev.docs: install NOTICE file to be
      compliant with the Apache 2 license
    - d/tests/control: remove integration and checkpoint autopkgtest.
      Since they depend on the runc binary package which is not provided by
      this source package by default.

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Sat, 09 Nov 2024 20:17:28 +0100

runc (1.1.15+ds1-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 1.1.15 (Closes: #1078220)
    + CVE-2024-45310: creating empty files or directories in arbitrary
      locations in the host filesystem (Closes: #1082865)

 -- Jochen Sprickerhof <jspricke@debian.org>  Mon, 04 Nov 2024 10:45:12 +0100

runc (1.1.12+ds1-5.1ubuntu1) plucky; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - d/control: add non default pkg.runc.with-bin Build-Profiles to runc
      binary package.
    - d/golang-github-opencontainers-runc-dev.docs: install NOTICE file to be
      compliant with the Apache 2 license
    - d/tests/control: remove integration and checkpoint autopkgtest.
      Since they depend on the runc binary package which is not provided by
      this source package by default.

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Wed, 30 Oct 2024 17:49:22 +0100

runc (1.1.12+ds1-5.1) unstable; urgency=medium

  * Non-maintainer upload.

  [ chenguoqi <chenguoqi@loongson.cn> ]
  * d/p/0013-loong64-support.patch
    - add patch to support loongarch64 (Closes: #1069166)

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Tue, 08 Oct 2024 11:08:22 +0200

runc (1.1.12+ds1-5ubuntu1) oracular; urgency=medium

   * Merge with Debian unstable. Remaining changes:
    - d/control: add non default pkg.runc.with-bin Build-Profiles to runc
      binary package.
    - d/golang-github-opencontainers-runc-dev.docs: install NOTICE file to be
      compliant with the Apache 2 license
    - d/tests/control: remove integration and checkpoint autopkgtest.
      Since they depend on the runc binary package which is not provided by
      this source package by default.

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Tue, 20 Aug 2024 08:33:00 +0200

runc (1.1.12+ds1-5) unstable; urgency=medium

  * Team upload.
  * Upload to unstable

 -- Reinhard Tartler <siretart@tauware.de>  Sat, 17 Aug 2024 07:19:43 -0400

runc (1.1.12+ds1-4) experimental; urgency=medium

  * Team upload.
  * Fix FTBFS on arm64, armel, Closes: #1070415

 -- Reinhard Tartler <siretart@tauware.de>  Thu, 08 Aug 2024 11:01:19 -0400

runc (1.1.12+ds1-3) experimental; urgency=medium

  * Team upload.
  * Compile against go-criu v7

 -- Reinhard Tartler <siretart@tauware.de>  Thu, 08 Aug 2024 08:18:21 -0400

runc (1.1.12+ds1-2ubuntu1) noble; urgency=medium

  * Merge with Debian unstable (LP: #2060890). Remaining changes:
    - d/control: add non default pkg.runc.with-bin Build-Profiles to runc
      binary package.
    - d/golang-github-opencontainers-runc-dev.docs: install NOTICE file to be
      compliant with the Apache 2 license
    - d/tests/control: remove integration and checkpoint autopkgtest.
      Since they depend on the runc binary package which is not provided by
      this source package by default.
   * Dropped changes (replaced by non default Build-Profiles):
    - d/control: remove the binary paragraph for runc.
    - d/golang-github-opencontainers-runc-dev.install: remove this file, it
      is causing a FTBFS, no need to have it in place, the library files are
      already installed correctly without it.
    - d/runc.*: remove all packaging related files associated to the
      runc binary package
    - d/rules: no need to generate manpages after build
    - d/rules: remove runc binary from the binary package

 -- Shengjing Zhu <shengjing.zhu@canonical.com>  Tue, 02 Apr 2024 17:26:37 +0800

runc (1.1.12+ds1-2) unstable; urgency=medium

  * Team upload
  * Add pkgconf to Build-Depends

 -- Shengjing Zhu <zhsj@debian.org>  Tue, 27 Feb 2024 18:01:32 +0800

runc (1.1.12+ds1-1ubuntu1) noble; urgency=medium

  * Merge with Debian unstable.
  * Remaining changes:
    - d/control: remove the binary paragraph for runc.
    - d/golang-github-opencontainers-runc-dev.docs: install NOTICE file to
      be compliant with the Apache 2 license.
    - d/golang-github-opencontainers-runc-dev.install: remove this file, it
      is causing a FTBFS, no need to have it in place, the library files are
      already installed correctly without it.
    - d/runc.*: remove all packaging related files associated to the
      runc binary package
    - d/rules: no need to generate manpages after build
    - d/rules: remove runc binary from the binary package
    - d/tests/{checkpoint,integration}: remove since they depend on the
      runc binary package which is not provided by this source package
      anymore
  * Dropped changes:
    - d/p/0001-Fix-File-to-Close.patch: Fix File to Close
    - d/p/0002-init-verify-after-chdir-that-cwd-is-inside-the-conta.patch:
      init: verify after chdir that cwd is inside the container
    - d/p/0003-setns-init-do-explicit-lookup-of-execve-argument-ear.patch:
      setns init: do explicit lookup of execve argument early
    - d/p/0004-init-close-internal-fds-before-execve.patch: init: close
      internal fds before execve
    - d/p/0005-cgroup-plug-leaks-of-sys-fs-cgroup-handle.patch: cgroup:
      plug leaks of /sys/fs/cgroup handle
    - d/p/0006-libcontainer-mark-all-non-stdio-fds-O_CLOEXEC-before.patch:
      ibcontainer: mark all non-stdio fds O_CLOEXEC before spawning init
    [ Incorporated by upstream. ]

 -- Nishit Majithia <nishit.majithia@canonical.com>  Wed, 07 Feb 2024 13:26:27 +0530

runc (1.1.12+ds1-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.1.12+ds1
    + CVE-2024-21626: several container breakouts due to internally leaked fds

 -- Shengjing Zhu <zhsj@debian.org>  Fri, 02 Feb 2024 21:20:26 +0800

runc (1.1.10+ds1-1ubuntu2) noble; urgency=medium

  * SECURITY UPDATE: container escape vulnerability
    - d/p/0001-Fix-File-to-Close.patch: Fix File to Close
    - d/p/0002-init-verify-after-chdir-that-cwd-is-inside-the-conta.patch:
      init: verify after chdir that cwd is inside the container
    - d/p/0003-setns-init-do-explicit-lookup-of-execve-argument-ear.patch:
      setns init: do explicit lookup of execve argument early
    - d/p/0004-init-close-internal-fds-before-execve.patch: init: close
      internal fds before execve
    - d/p/0005-cgroup-plug-leaks-of-sys-fs-cgroup-handle.patch: cgroup:
      plug leaks of /sys/fs/cgroup handle
    - d/p/0006-libcontainer-mark-all-non-stdio-fds-O_CLOEXEC-before.patch:
      ibcontainer: mark all non-stdio fds O_CLOEXEC before spawning init
    - CVE-2024-21626

 -- Nishit Majithia <nishit.majithia@canonical.com>  Wed, 24 Jan 2024 16:41:53 +0530

runc (1.1.10+ds1-1ubuntu1) noble; urgency=medium

  * Merge from Debian unstable (LP: #2022390). Make src:runc follow Debian and
    src:runc-app is going to ship the application with vendorized dependencies
    so we can keep updating just the application across all supported releases.
  * Added changes:
    - d/control: remove the binary paragraph for runc.
    - d/runc.*: remove all packaging related files associated to the
      runc binary package
    - d/tests/{checkpoint,integration}: remove since they depend on the
      runc binary package which is not provided by this source package
      anymore.
    - d/golang-github-opencontainers-runc-dev.install: remove this file, it
      is causing a FTBFS, no need to have it in place, the library files are
      already installed correctly without it.
    - d/rules: no need to generate manpages after build.
    - d/rules: remove runc binary from the binary package
    - d/golang-github-opencontainers-runc-dev.docs: install NOTICE file to
      be compliant with the Apache 2 license.

 -- Lucas Kanashiro <kanashiro@ubuntu.com>  Thu, 11 Jan 2024 19:43:18 -0300

runc (1.1.10+ds1-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.1.10+ds1
  * Bump golang-github-mrunalp-fileutils-dev to 0.5.1
  * Move criu test to isolation-machine

 -- Shengjing Zhu <zhsj@debian.org>  Sun, 05 Nov 2023 15:26:18 +0800

runc (1.1.5+ds1-5) unstable; urgency=medium

  * Team Upload
  * Rebuild against golang-github-urfave-cli_1.22.14-1, Closes: #1055059
  * Bug fix: "Fails to build source after successful build", thanks to
    Lucas Nussbaum, Closes: #1046528

 -- Reinhard Tartler <siretart@tauware.de>  Tue, 31 Oct 2023 08:32:10 -0400

runc (1.1.5+ds1-4) unstable; urgency=medium

  * debian/tests/control: restrict criu dependency to amd64, arm64, armhf

 -- Reinhard Tartler <siretart@tauware.de>  Wed, 25 Oct 2023 18:09:09 -0400

runc (1.1.5+ds1-3) unstable; urgency=medium

  * Team upload
  * Bump standards version

 -- Reinhard Tartler <siretart@tauware.de>  Tue, 24 Oct 2023 18:14:00 -0400

runc (1.1.5+ds1-2) experimental; urgency=medium

  * Team upload.
  * compile against go-criu 6

 -- Reinhard Tartler <siretart@tauware.de>  Sun, 22 Oct 2023 19:29:15 -0400

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog golang-github-opencontainers-runc-dev`.
