Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package rootlesskit for openSUSE:Factory checked in at 2026-10-22 19:25:11 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/rootlesskit (Old) and /work/SRC/openSUSE:Factory/.rootlesskit.new.2252680 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "rootlesskit" Thu Oct 22 19:25:11 2026 rev:21 rq:1386941 version:3.3.0 Changes: -------- --- /work/SRC/openSUSE:Factory/rootlesskit/rootlesskit.changes 2026-09-23 14:35:24.432479061 +0200 +++ /work/SRC/openSUSE:Factory/.rootlesskit.new.2252680/rootlesskit.changes 2026-10-22 19:25:13.216579206 +0200 @@ -1,0 +2,17 @@ +Mon Oct 19 04:41:59 UTC 2026 - Yash Maurya <[email protected]> + +- Update to version 3.3.0: + * v3.3.0 + * pkg/api: replace github.com/gorilla/mux with stdlib + * chore(deps): bump golang.org/x/net to v0.60.0 + * Build(deps): Bump golang.org/x/sys from 0.48.0 to 0.49.0 + * pkg/httputil: configure HTTP transport timeouts + * port/builtin: probe source-ip-transparent backend in the detached netns + * CI: test source IP propagation of the builtin port driver + * api/client: add Close to Client + * cmd/rootlessctl: use command context + * fix: forward startup messages to logWriter + * fix(pasta): remove --stderr option + * v3.2.0+dev + +------------------------------------------------------------------- Old: ---- rootlesskit-3.2.0.tar.gz New: ---- rootlesskit-3.3.0.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ rootlesskit.spec ++++++ --- /var/tmp/diff_new_pack.SOvMY9/_old 2026-10-22 19:25:13.972611121 +0200 +++ /var/tmp/diff_new_pack.SOvMY9/_new 2026-10-22 19:25:13.975611248 +0200 @@ -17,7 +17,7 @@ Name: rootlesskit -Version: 3.2.0 +Version: 3.3.0 Release: 0 Summary: Linux-native fakeroot using user namespaces License: Apache-2.0 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.SOvMY9/_old 2026-10-22 19:25:14.006612556 +0200 +++ /var/tmp/diff_new_pack.SOvMY9/_new 2026-10-22 19:25:14.009612683 +0200 @@ -4,7 +4,7 @@ <param name="url">https://github.com/rootless-containers/rootlesskit.git</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">v3.2.0</param> + <param name="revision">v3.3.0</param> <param name="versionformat">@PARENT_TAG@</param> <param name="changesgenerate">enable</param> <param name="versionrewrite-pattern">v(.*)</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.SOvMY9/_old 2026-10-22 19:25:14.032613654 +0200 +++ /var/tmp/diff_new_pack.SOvMY9/_new 2026-10-22 19:25:14.035613781 +0200 @@ -1,6 +1,6 @@ <servicedata> <service name="tar_scm"> <param name="url">https://github.com/rootless-containers/rootlesskit.git</param> - <param name="changesrevision">f0cc012b20fd6039fc0b73e83051a521a4690a2e</param></service></servicedata> + <param name="changesrevision">888c3189e9cdf34dcdb19011e1c7c34eb94b5393</param></service></servicedata> (No newline at EOF) ++++++ rootlesskit-3.2.0.tar.gz -> rootlesskit-3.3.0.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rootlesskit-3.2.0/Dockerfile new/rootlesskit-3.3.0/Dockerfile --- old/rootlesskit-3.2.0/Dockerfile 2026-09-19 17:31:56.000000000 +0200 +++ new/rootlesskit-3.3.0/Dockerfile 2026-10-14 03:47:53.000000000 +0200 @@ -70,7 +70,8 @@ # systemd and uuid-runtime: for systemd-socket-activate used by integration-systemd-socket.sh # iptables: for Docker (dockerd-rootless itself still uses iptables). # nftables: for source-ip-transparent (rootlesskit's own builtin port driver). -RUN apt-get update && apt-get install -y iproute2 lxc iperf3 busybox sudo libcap2-bin curl bind9-dnsutils systemd uuid-runtime iptables nftables +# jq: for parsing `rootlessctl info --json` in integration-port-source-ip.sh +RUN apt-get update && apt-get install -y iproute2 lxc iperf3 busybox sudo libcap2-bin curl bind9-dnsutils systemd uuid-runtime iptables nftables jq COPY --from=idmap /usr/bin/newuidmap /usr/bin/newuidmap COPY --from=idmap /usr/bin/newgidmap /usr/bin/newgidmap RUN /sbin/setcap cap_setuid+eip /usr/bin/newuidmap && \ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rootlesskit-3.2.0/cmd/rootlessctl/info.go new/rootlesskit-3.3.0/cmd/rootlessctl/info.go --- old/rootlesskit-3.2.0/cmd/rootlessctl/info.go 2026-09-19 17:31:56.000000000 +0200 +++ new/rootlesskit-3.3.0/cmd/rootlessctl/info.go 2026-10-14 03:47:53.000000000 +0200 @@ -1,7 +1,6 @@ package main import ( - "context" "encoding/json" "fmt" @@ -22,12 +21,14 @@ } func infoAction(clicontext *cli.Context) error { + ctx := clicontext.Context w := clicontext.App.Writer c, err := newClient(clicontext) if err != nil { return err } - ctx := context.Background() + defer c.Close() + info, err := c.Info(ctx) if err != nil { return err diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rootlesskit-3.2.0/cmd/rootlessctl/port.go new/rootlesskit-3.3.0/cmd/rootlessctl/port.go --- old/rootlesskit-3.2.0/cmd/rootlessctl/port.go 2026-09-19 17:31:56.000000000 +0200 +++ new/rootlesskit-3.3.0/cmd/rootlessctl/port.go 2026-10-14 03:47:53.000000000 +0200 @@ -1,7 +1,6 @@ package main import ( - "context" "encoding/json" "errors" "fmt" @@ -29,12 +28,14 @@ } func listPortsAction(clicontext *cli.Context) error { + ctx := clicontext.Context c, err := newClient(clicontext) if err != nil { return err } + defer c.Close() + pm := c.PortManager() - ctx := context.Background() portStatuses, err := pm.ListPorts(ctx) if err != nil { return err @@ -79,6 +80,7 @@ } func addPortsAction(clicontext *cli.Context) error { + ctx := clicontext.Context if clicontext.NArg() < 1 { return errors.New("no port specified") } @@ -95,8 +97,9 @@ if err != nil { return err } + defer c.Close() + pm := c.PortManager() - ctx := context.Background() for _, sp := range portSpecs { portStatus, err := pm.AddPort(ctx, sp) if err != nil { @@ -123,6 +126,7 @@ } func removePortsAction(clicontext *cli.Context) error { + ctx := clicontext.Context if clicontext.NArg() < 1 { return errors.New("no ID specified") } @@ -138,8 +142,9 @@ if err != nil { return err } + defer c.Close() + pm := c.PortManager() - ctx := context.Background() for _, id := range ids { if err := pm.RemovePort(ctx, id); err != nil { return err diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rootlesskit-3.2.0/cmd/rootlesskit-docker-proxy/main.go new/rootlesskit-3.3.0/cmd/rootlesskit-docker-proxy/main.go --- old/rootlesskit-3.2.0/cmd/rootlesskit-docker-proxy/main.go 2026-09-19 17:31:56.000000000 +0200 +++ new/rootlesskit-3.3.0/cmd/rootlesskit-docker-proxy/main.go 2026-10-14 03:47:53.000000000 +0200 @@ -155,6 +155,7 @@ if err != nil { return fmt.Errorf("error while connecting to RootlessKit API socket: %w", err) } + defer c.Close() info, err := c.Info(context.Background()) if err != nil { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rootlesskit-3.2.0/go.mod new/rootlesskit-3.3.0/go.mod --- old/rootlesskit-3.2.0/go.mod 2026-09-19 17:31:56.000000000 +0200 +++ new/rootlesskit-3.3.0/go.mod 2026-10-14 03:47:53.000000000 +0200 @@ -8,7 +8,6 @@ github.com/containers/gvisor-tap-vsock v0.8.9 github.com/gofrs/flock v0.13.1 github.com/google/uuid v1.6.0 - github.com/gorilla/mux v1.8.1 github.com/inetaf/tcpproxy v0.0.0-20260515195445-c159a6051109 github.com/insomniacslk/dhcp v0.0.0-20260901064844-234b97448fae github.com/moby/sys/mountinfo v0.7.2 @@ -16,7 +15,7 @@ github.com/sirupsen/logrus v1.10.2 github.com/songgao/water v0.0.0-20200317203138-2b4b6d7c09d8 github.com/urfave/cli/v2 v2.27.7 - golang.org/x/sys v0.48.0 + golang.org/x/sys v0.49.0 gotest.tools/v3 v3.5.2 ) @@ -34,7 +33,7 @@ github.com/xrash/smetrics v0.0.0-20250705151800-55b8f293f342 // indirect golang.org/x/crypto v0.57.0 // indirect golang.org/x/mod v0.35.0 // indirect - golang.org/x/net v0.58.0 // indirect + golang.org/x/net v0.60.0 // indirect golang.org/x/sync v0.23.0 // indirect golang.org/x/time v0.13.0 // indirect golang.org/x/tools v0.43.0 // indirect diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rootlesskit-3.2.0/go.sum new/rootlesskit-3.3.0/go.sum --- old/rootlesskit-3.2.0/go.sum 2026-09-19 17:31:56.000000000 +0200 +++ new/rootlesskit-3.3.0/go.sum 2026-10-14 03:47:53.000000000 +0200 @@ -33,8 +33,6 @@ github.com/google/pprof v0.0.0-20250820193118-f64d9cf942d6/go.mod h1:I6V7YzU0XDpsHqbsyrghnFZLO1gwK6NPTNvmetQIk9U= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= -github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY= -github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ= github.com/inetaf/tcpproxy v0.0.0-20260515195445-c159a6051109 h1:H3ztMPCBcyG60Ks0plTncU3Vs6jIrxhn3nEThpMEpo4= github.com/inetaf/tcpproxy v0.0.0-20260515195445-c159a6051109/go.mod h1:Di7LXRyUcnvAcLicFhtM9/MlZl/TNgRSDHORM2c6CMI= github.com/insomniacslk/dhcp v0.0.0-20260901064844-234b97448fae h1:nXGg65fXsylSUTNNWwvHuQsXev7mhIzQTnZREPTbWzs= @@ -91,15 +89,15 @@ golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= -golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= -golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU= +golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= +golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk= golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= -golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= +golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA= +golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE= golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rootlesskit-3.2.0/hack/integration-port-source-ip.sh new/rootlesskit-3.3.0/hack/integration-port-source-ip.sh --- old/rootlesskit-3.2.0/hack/integration-port-source-ip.sh 1970-01-01 01:00:00.000000000 +0100 +++ new/rootlesskit-3.3.0/hack/integration-port-source-ip.sh 2026-10-14 03:47:53.000000000 +0200 @@ -0,0 +1,74 @@ +#!/bin/bash +# Test source IP propagation of the builtin port driver (--source-ip-transparent). +# https://github.com/rootless-containers/rootlesskit/issues/648 +source $(realpath $(dirname $0))/common.inc.sh + +ROOTLESSCTL="rootlessctl" + +# The source IP is not propagated for loopback addresses +nonloopback="$(hostname -I | awk '{print $1}')" + +# test_source_ip NET [ROOTLESSKIT ARGS...] +function test_source_ip() { + net="$1" + shift + rootlesskit_args="$@" + INFO "Testing net=\"${net}\" rootlesskit_args=\"${rootlesskit_args}\"" + tmp=$(mktemp -d) + state_dir=${tmp}/state + html_dir=${tmp}/html + mkdir -p ${html_dir}/cgi-bin + cat >${html_dir}/cgi-bin/ip <<'EOF' +#!/bin/sh +printf 'Content-Type: text/plain\r\n\r\n' +echo "${REMOTE_ADDR}" +EOF + chmod +x ${html_dir}/cgi-bin/ip + httpd="busybox httpd -f -v -p 80 -h ${html_dir}" + if echo "${rootlesskit_args}" | grep -q -- --detach-netns; then + # With --detach-netns, the child command runs in the host's network + # namespace, so the server has to enter the detached netns explicitly. + httpd="nsenter -n${state_dir}/netns ${httpd}" + fi + $ROOTLESSKIT \ + --state-dir=${state_dir} \ + --net=${net} \ + --disable-host-loopback \ + --copy-up=/etc \ + --port-driver=builtin \ + --debug \ + -p 0.0.0.0:8080:80/tcp \ + ${rootlesskit_args} \ + ${httpd} \ + 2>&1 & + pid=$! + sleep 2 + + set -x + $ROOTLESSCTL --socket=${state_dir}/api.sock info --json + backend=$($ROOTLESSCTL --socket=${state_dir}/api.sock info --json | jq -r '.portDriver.extra.sourceIPTransparentBackend') + # busybox httpd reports an IPv4 address in the IPv4-mapped IPv6 form, e.g., "[::ffff:172.17.0.2]" + remote_addr=$(curl -fsSL http://${nonloopback}:8080/cgi-bin/ip | sed -e 's/^\[//' -e 's/\]$//' -e 's/^::ffff://') + set +x + + kill -SIGTERM $(cat ${state_dir}/child_pid) || true + wait $pid >/dev/null 2>&1 || true + rm -rf $tmp + + if [ "${backend}" = "none" ] || [ "${backend}" = "null" ] || [ -z "${backend}" ]; then + ERROR "sourceIPTransparentBackend is \"${backend}\"" + exit 1 + fi + if [ "${remote_addr}" != "${nonloopback}" ]; then + ERROR "Expected REMOTE_ADDR to be \"${nonloopback}\", got \"${remote_addr}\"" + exit 1 + fi + INFO "OK: sourceIPTransparentBackend=\"${backend}\", REMOTE_ADDR=\"${remote_addr}\"" +} + +test_source_ip slirp4netns +test_source_ip slirp4netns --detach-netns +test_source_ip gvisor-tap-vsock +test_source_ip gvisor-tap-vsock --detach-netns + +INFO "===== PASSING =====" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rootlesskit-3.2.0/pkg/api/client/client.go new/rootlesskit-3.3.0/pkg/api/client/client.go --- old/rootlesskit-3.2.0/pkg/api/client/client.go 2026-09-19 17:31:56.000000000 +0200 +++ new/rootlesskit-3.3.0/pkg/api/client/client.go 2026-10-14 03:47:53.000000000 +0200 @@ -5,6 +5,7 @@ "context" "encoding/json" "fmt" + "io" "net/http" "github.com/rootless-containers/rootlesskit/v3/pkg/api" @@ -16,6 +17,9 @@ HTTPClient() *http.Client PortManager() port.Manager Info(context.Context) (*api.Info, error) + + // Close closes idle connections associated with the client. + Close() error } // New creates a client. @@ -36,6 +40,8 @@ } } +var _ io.Closer = (*client)(nil) + type client struct { *http.Client // version is always "v1" @@ -48,6 +54,12 @@ return c.Client } +// Close closes idle connections associated with the client. +func (c *client) Close() error { + c.Client.CloseIdleConnections() + return nil +} + func (c *client) PortManager() port.Manager { return &portManager{ client: c, diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rootlesskit-3.2.0/pkg/api/router/router.go new/rootlesskit-3.3.0/pkg/api/router/router.go --- old/rootlesskit-3.2.0/pkg/api/router/router.go 2026-09-19 17:31:56.000000000 +0200 +++ new/rootlesskit-3.3.0/pkg/api/router/router.go 2026-10-14 03:47:53.000000000 +0200 @@ -8,7 +8,6 @@ "net/http" "strconv" - "github.com/gorilla/mux" "github.com/rootless-containers/rootlesskit/v3/pkg/api" "github.com/rootless-containers/rootlesskit/v3/pkg/httputil" "github.com/rootless-containers/rootlesskit/v3/pkg/port" @@ -94,11 +93,7 @@ b.onPortDriverNil(w, r) return } - idStr, ok := mux.Vars(r)["id"] - if !ok { - httputil.WriteError(w, r, errors.New("id not specified"), http.StatusBadRequest) - return - } + idStr := r.PathValue("id") id, err := strconv.Atoi(idStr) if err != nil { httputil.WriteError(w, r, fmt.Errorf("bad id %s: %w", idStr, err), http.StatusBadRequest) @@ -144,10 +139,9 @@ w.Write(m) } -func AddRoutes(r *mux.Router, b *Backend) { - v1 := r.PathPrefix("/v1").Subrouter() - v1.Path("/ports").Methods("GET").HandlerFunc(b.GetPorts) - v1.Path("/ports").Methods("POST").HandlerFunc(b.PostPort) - v1.Path("/ports/{id}").Methods("DELETE").HandlerFunc(b.DeletePort) - v1.Path("/info").Methods("GET").HandlerFunc(b.GetInfo) +func AddRoutes(r *http.ServeMux, b *Backend) { + r.HandleFunc("GET /v1/ports", b.GetPorts) + r.HandleFunc("POST /v1/ports", b.PostPort) + r.HandleFunc("DELETE /v1/ports/{id}", b.DeletePort) + r.HandleFunc("GET /v1/info", b.GetInfo) } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rootlesskit-3.2.0/pkg/httputil/httputil.go new/rootlesskit-3.3.0/pkg/httputil/httputil.go --- old/rootlesskit-3.2.0/pkg/httputil/httputil.go 2026-09-19 17:31:56.000000000 +0200 +++ new/rootlesskit-3.3.0/pkg/httputil/httputil.go 2026-10-14 03:47:53.000000000 +0200 @@ -9,6 +9,7 @@ "net" "net/http" "os" + "time" ) // ErrorJSON is returned with "application/json" content type and non-2XX status code @@ -70,20 +71,34 @@ return nil } +// NewHTTPClient returns an HTTP client configured to communicate with the +// RootlessKit API over the Unix socket at socketPath. func NewHTTPClient(socketPath string) (*http.Client, error) { if _, err := os.Stat(socketPath); err != nil { return nil, err } return &http.Client{ + // Use the dial and idle connection timeouts from http.DefaultTransport. + // + // Other defaults are either TCP/TLS-specific or unnecessary for the + // local Unix socket connection. + // See https://github.com/golang/go/blob/go1.27.2/src/net/http/transport.go#L42-L58 Transport: &http.Transport{ - DialContext: func(ctx context.Context, _, _ string) (net.Conn, error) { - var d net.Dialer - return d.DialContext(ctx, "unix", socketPath) - }, + DialContext: unixDialContext(socketPath, &net.Dialer{ + Timeout: 30 * time.Second, + }), + IdleConnTimeout: 90 * time.Second, }, }, nil } +// unixDialContext returns a dial function that connects to socketPath using dialer. +func unixDialContext(socketPath string, dialer *net.Dialer) func(context.Context, string, string) (net.Conn, error) { + return func(ctx context.Context, _, _ string) (net.Conn, error) { + return dialer.DialContext(ctx, "unix", socketPath) + } +} + // WriteError writes an error. // WriteError sould not be used if an error may contain sensitive information and the client is not reliable. func WriteError(w http.ResponseWriter, r *http.Request, err error, ec int) { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rootlesskit-3.2.0/pkg/network/pasta/pasta.go new/rootlesskit-3.3.0/pkg/network/pasta/pasta.go --- old/rootlesskit-3.2.0/pkg/network/pasta/pasta.go 2026-09-19 17:31:56.000000000 +0200 +++ new/rootlesskit-3.3.0/pkg/network/pasta/pasta.go 2026-10-14 03:47:53.000000000 +0200 @@ -1,6 +1,8 @@ package pasta import ( + "bufio" + "bytes" "context" "errors" "fmt" @@ -164,7 +166,6 @@ } opts := []string{ - "--stderr", "--ns-ifname=" + d.ifname, "--mtu=" + strconv.Itoa(d.mtu), "--config-net", @@ -246,6 +247,10 @@ } return nil, common.Seq(cleanups), fmt.Errorf("executing %v: %w", cmd, err) } + s := bufio.NewScanner(bytes.NewReader(out)) + for s.Scan() { + fmt.Fprintln(d.logWriter, s.Text()) + } netmsg := messages.ParentInitNetworkDriverCompleted{ Dev: tap, diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rootlesskit-3.2.0/pkg/parent/parent.go new/rootlesskit-3.3.0/pkg/parent/parent.go --- old/rootlesskit-3.2.0/pkg/parent/parent.go 2026-09-19 17:31:56.000000000 +0200 +++ new/rootlesskit-3.3.0/pkg/parent/parent.go 2026-10-14 03:47:53.000000000 +0200 @@ -15,7 +15,6 @@ "syscall" "github.com/gofrs/flock" - "github.com/gorilla/mux" "github.com/rootless-containers/rootlesskit/v3/pkg/api/router" "github.com/rootless-containers/rootlesskit/v3/pkg/messages" "github.com/rootless-containers/rootlesskit/v3/pkg/network" @@ -503,7 +502,7 @@ } func listenServeAPI(socketPath string, backend *router.Backend) (apiCloser, error) { - r := mux.NewRouter() + r := http.NewServeMux() router.AddRoutes(r, backend) srv := &http.Server{Handler: r} err := os.RemoveAll(socketPath) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rootlesskit-3.2.0/pkg/port/builtin/child/child.go new/rootlesskit-3.3.0/pkg/port/builtin/child/child.go --- old/rootlesskit-3.2.0/pkg/port/builtin/child/child.go 2026-09-19 17:31:56.000000000 +0200 +++ new/rootlesskit-3.3.0/pkg/port/builtin/child/child.go 2026-10-14 03:47:53.000000000 +0200 @@ -82,11 +82,25 @@ // blocked. handleConnectInit waits on backendResolved before // reading resolvedBackend -- by that point the probe has had the // entire parent-side setup time to complete concurrently. + // + // The probe has to run in the same netns as the rule installation + // (see routine), i.e., in the detached netns if it is set. + // Otherwise the probe fails with EPERM, as the current netns is not + // owned by the current userns. d.backendResolved = make(chan struct{}) if d.sourceIPTransparent { go func() { - d.resolveBackendName() - close(d.backendResolved) + defer close(d.backendResolved) + if detachedNetNSPath == "" { + d.resolveBackendName() + return + } + if err := ns.WithNetNSPath(detachedNetNSPath, func(_ ns.NetNS) error { + d.resolveBackendName() + return nil + }); err != nil { + fmt.Fprintf(d.logWriter, "source IP transparent: failed to enter the detached netns %q: %v\n", detachedNetNSPath, err) + } }() } else { close(d.backendResolved) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rootlesskit-3.2.0/pkg/version/version.go new/rootlesskit-3.3.0/pkg/version/version.go --- old/rootlesskit-3.2.0/pkg/version/version.go 2026-09-19 17:31:56.000000000 +0200 +++ new/rootlesskit-3.3.0/pkg/version/version.go 2026-10-14 03:47:53.000000000 +0200 @@ -1,3 +1,3 @@ package version -const Version = "3.2.0" +const Version = "3.3.0" ++++++ vendor.tar.gz ++++++ ++++ 7746 lines of diff (skipped)
