[rpms/netavark] rawhide: Update to 2.0.0 upstream release

[Packit <hello@packit.dev>]

            A new commit has been pushed.

            Repo   : rpms/netavark
            Branch : rawhide
            Commit : ca6092592f116cc0b8506ac12b3cd6e4e2ad205d
            Author : Packit <hello@packit.dev>
            Date   : 2026-06-10T16:03:48+00:00
            Stats  : +275/-32 in 9 file(s)
            URL    : https://src.fedoraproject.org/rpms/netavark/c/ca6092592f116cc0b8506ac12b3cd6e4e2ad205d?branch=rawhide

            Log:
            Update to 2.0.0 upstream release

Upstream tag: v2.0.0
Upstream commit: dd456fba

Commit authored by Packit automation (https://packit.dev/)

---
diff --git a/.fmf/version b/.fmf/version
new file mode 100644
index 0000000..d00491f
--- /dev/null
+++ b/.fmf/version
@@ -0,0 +1 @@
+1

diff --git a/.gitignore b/.gitignore
index b159441..53e27e4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -63,3 +63,5 @@
 /netavark-v1.17.1-vendor.tar.gz
 /v1.17.2.tar.gz
 /netavark-v1.17.2-vendor.tar.gz
+/v2.0.0.tar.gz
+/netavark-v2.0.0-vendor.tar.gz

diff --git a/.packit.yaml b/.packit.yaml
index 07ecd3e..7c3e3da 100644
--- a/.packit.yaml
+++ b/.packit.yaml
@@ -5,6 +5,24 @@
 downstream_package_name: netavark
 upstream_tag_template: v{version}
 
+# These files get synced from upstream to downstream (Fedora / CentOS Stream) on every
+# propose-downstream job. This is done so tests maintained upstream can be run
+# downstream in Zuul CI and Bodhi.
+# Ref: https://packit.dev/docs/configuration#files_to_sync
+files_to_sync:
+  - src: plans/
+    dest: plans/
+    delete: true
+    mkpath: true
+  - src: test/tmt
+    dest: test/tmt
+    delete: true
+    mkpath: true
+  - src: .fmf/
+    dest: .fmf/
+    delete: true
+  - .packit.yaml
+
 packages:
   netavark-fedora:
     pkg_tool: fedpkg
@@ -12,6 +30,8 @@ packages:
   netavark-centos:
     pkg_tool: centpkg
     specfile_path: rpm/netavark.spec
+  netavark-eln:
+    specfile_path: rpm/netavark.spec
 
 srpm_build_deps:
   - cargo
@@ -28,12 +48,16 @@ jobs:
   - job: copr_build
     trigger: pull_request
     packages: [netavark-fedora]
-    notifications: &copr_build_failure_notification
-      failure_comment:
-        message: "Ephemeral COPR build failed. @containers/packit-build please check."
+    targets: &fedora_copr_targets
+      - fedora-all-x86_64
+      - fedora-all-aarch64
+    enable_net: true
+    osh_diff_scan_after_copr_build: false
+
+  - job: copr_build
+    trigger: pull_request
+    packages: [netavark-eln]
     targets:
-      fedora-all-x86_64: {}
-      fedora-all-aarch64: {}
       fedora-eln-x86_64:
         additional_repos:
           - "https://kojipkgs.fedoraproject.org/repos/eln-build/latest/x86_64/"
@@ -45,10 +69,7 @@ jobs:
   - job: copr_build
     trigger: pull_request
     packages: [netavark-centos]
-    notifications: *copr_build_failure_notification
-    targets:
-      - centos-stream-9-x86_64
-      - centos-stream-9-aarch64
+    targets: &centos_copr_targets
       - centos-stream-10-x86_64
       - centos-stream-10-aarch64
     enable_net: true
@@ -57,21 +78,84 @@ jobs:
   - job: copr_build
     trigger: commit
     packages: [netavark-fedora]
-    notifications:
-      failure_comment:
-        message: "podman-next COPR build failed. @containers/packit-build please check."
     branch: main
     owner: rhcontainerbot
     project: podman-next
     enable_net: true
 
+  # Tests on Fedora
+  - job: tests
+    trigger: pull_request
+    identifier: integration-fedora
+    packages: [netavark-fedora]
+    targets: *fedora_copr_targets
+    tmt_plan: "/plans/integration"
+    tf_extra_params: &tf_extra_params_fedora
+      environments:
+        - artifacts:
+          - type: repository-file
+            id: https://copr.fedorainfracloud.org/coprs/rhcontainerbot/podman-next/repo/fedora-$releasever/rhcontainerbot-podman-next-fedora-$releasever.repo
+
+  # Tests on CentOS Stream
+  - job: tests
+    trigger: pull_request
+    identifier: integration-centos
+    packages: [netavark-centos]
+    targets: *centos_copr_targets
+    tmt_plan: "/plans/integration"
+    tf_extra_params: &tf_extra_params_centos
+      environments:
+        - artifacts:
+          - type: repository-file
+            id: https://copr.fedorainfracloud.org/coprs/rhcontainerbot/podman-next/repo/centos-stream-$releasever/rhcontainerbot-podman-next-centos-stream-$releasever.repo
+
+  # Validate test (no RPM build needed, runs only on latest stable Fedora)
+  - job: tests
+    trigger: pull_request
+    identifier: validate
+    skip_build: true
+    targets:
+      - fedora-latest-stable-x86_64
+    tmt_plan: "/plans/validate"
+
+  # Unit tests (no RPM build needed, runs only on latest stable Fedora)
+  - job: tests
+    trigger: pull_request
+    identifier: unit
+    skip_build: true
+    targets:
+      - fedora-latest-stable-x86_64
+    tmt_plan: "/plans/unit"
+
+  # Podman tests on Fedora
+  - job: tests
+    trigger: pull_request
+    identifier: podman-fedora
+    packages: [netavark-fedora]
+    targets: *fedora_copr_targets
+    tmt_plan: "/plans/podman"
+    tf_extra_params: *tf_extra_params_fedora
+
+  # Podman tests on CentOS Stream
+  - job: tests
+    trigger: pull_request
+    identifier: podman-centos
+    packages: [netavark-centos]
+    targets: *centos_copr_targets
+    tmt_plan: "/plans/podman"
+    tf_extra_params: *tf_extra_params_centos
+
   # Sync to Fedora
+  # NOTE: Breaking changes related to Podman6 will only be shipped to Fedora
+  # Rawhide (to be Fedora 45) and newer.
+  # TODO: Update dist_git_branches as and when new Fedora releases are
+  # available.
   - job: propose_downstream
     trigger: release
     packages: [netavark-fedora]
     update_release: false
     dist_git_branches:
-      - fedora-all
+      - fedora-rawhide
 
   # Sync to CentOS Stream
   - job: propose_downstream

diff --git a/README.packit b/README.packit
index 46915dc..4e76cbe 100644
--- a/README.packit
+++ b/README.packit
@@ -1,3 +1,3 @@
 This repository is maintained by packit.
 https://packit.dev/
-The file was generated using packit 1.14.0.post1.dev6+g54773bdd6.
+The file was generated using packit 1.16.0.post1.dev8+g8a0482385.

diff --git a/netavark.spec b/netavark.spec
index 990fc00..3cdeca0 100644
--- a/netavark.spec
+++ b/netavark.spec
@@ -11,18 +11,15 @@
 %global debug_package %{nil}
 %endif
 
+# bats is available in Fedora official repos, needs EPEL on RHEL and CentOS
+# Stream
+%if %{defined fedora}
+%global distro_bats 1
+%endif
+
 # Minimum X.Y dep for aardvark-dns
 %define major_minor %((v=%{version}; echo ${v%.*}))
 
-# Set default firewall to nftables on CentOS Stream 10+, RHEL 10+, Fedora 41+
-# and default to iptables on all other environments
-# The `rhel` macro is defined on CentOS Stream, RHEL as well as Fedora ELN.
-%if (%{defined rhel} && 0%{?rhel} >= 10) || (%{defined fedora} && 0%{?fedora} >= 41)
-%define default_fw nftables
-%else
-%define default_fw iptables
-%endif
-
 Name: netavark
 # Set a different Epoch for copr builds
 %if %{defined copr_username}
@@ -30,7 +27,7 @@ Epoch: 102
 %else
 Epoch: 2
 %endif
-Version: 1.17.2
+Version: 2.0.0
 Release: %autorelease
 # The `AND` needs to be uppercase in the License for SPDX compatibility
 License: Apache-2.0 AND BSD-3-Clause AND MIT
@@ -49,11 +46,7 @@ BuildRequires: %{_bindir}/go-md2man
 # aardvark-dns and %%{name} are usually released in sync
 Requires: aardvark-dns >=  %{epoch}:%{major_minor}
 Provides: container-network-stack = 2
-%if "%{default_fw}" == "nftables"
 Requires: nftables
-%else
-Requires: iptables
-%endif
 BuildRequires: make
 BuildRequires: protobuf-c
 BuildRequires: protobuf-compiler
@@ -82,11 +75,36 @@ Its features include:
     including MACVLAN networks
 * All required firewall configuration to perform NAT and port
     forwarding as required for containers
-* Support for iptables, firewalld and nftables
+* Support for firewalld and nftables
 * Support for rootless containers
 * Support for IPv4 and IPv6
 * Support for container DNS resolution via aardvark-dns.
 
+# Only intended to be used for gating tests
+# End user usecases not supported
+%package tests
+Summary: Tests for %{name}
+Requires: %{name} = %{epoch}:%{version}-%{release}
+%if %{defined distro_bats}
+Requires: bats
+%else
+Recommends: bats
+%endif
+Requires: bind-utils
+Requires: dbus-daemon
+Requires: dnsmasq
+Requires: firewalld
+Requires: jq
+Requires: net-tools
+Requires: nftables
+Requires: nmap-ncat
+
+%description tests
+%{summary}
+
+This package contains integration tests for %{name}. Only intended to be used for
+gating tests. Not supported for end users / customers.
+
 %prep
 %autosetup -Sgit %{name}-%{version}
 # Following steps are only required on environments like koji which have no
@@ -102,19 +120,32 @@ tar fx %{SOURCE1}
 %endif
 
 %build
-NETAVARK_DEFAULT_FW=%{default_fw} %{__make} CARGO="%{__cargo}" build
+%{__make} CARGO="%{__cargo}" build
 %if (0%{?fedora} || 0%{?rhel} >= 10) && !%{defined copr_username}
 %cargo_license_summary
 %{cargo_license} > LICENSE.dependencies
 %cargo_vendor_manifest
 %endif
 
+# Build examples package for tests
+%{__make} CARGO="%{__cargo}" examples
+
 cd docs
 %{__make}
 
 %install
 %{__make} DESTDIR=%{buildroot} PREFIX=%{_prefix} install
 
+%{__install} -d -p %{buildroot}%{_datadir}/%{name}/{examples,test,test-dhcp}
+%{__cp} -rpav targets/release/examples/* %{buildroot}%{_datadir}/%{name}/examples
+%{__cp} -rpav test/* %{buildroot}%{_datadir}/%{name}/test
+%{__cp} -rpav test-dhcp/* %{buildroot}%{_datadir}/%{name}/test-dhcp
+%{__install} -D -m0755 bin/netavark-connection-tester %{buildroot}%{_bindir}/netavark-connection-tester
+%{__install} -D -m0755 bin/netavark-dhcp-proxy-client %{buildroot}%{_libexecdir}/podman/netavark-dhcp-proxy-client
+
+%{__rm} -rf %{buildroot}%{_datadir}/%{name}/test/tmt
+%{__rm} -rf %{buildroot}%{_datadir}/%{name}/test-dhcp/tmt
+
 %preun
 %systemd_preun %{name}-dhcp-proxy.service
 %systemd_preun %{name}-firewalld-reload.service
@@ -140,5 +171,16 @@ cd docs
 %{_unitdir}/%{name}-firewalld-reload.service
 %{_unitdir}/%{name}-nftables-reload.service
 
+%files tests
+%{_bindir}/netavark-connection-tester
+%{_libexecdir}/podman/netavark-dhcp-proxy-client
+%dir %{_datadir}/%{name}
+%dir %{_datadir}/%{name}/examples
+%dir %{_datadir}/%{name}/test
+%dir %{_datadir}/%{name}/test-dhcp
+%{_datadir}/%{name}/examples/*
+%{_datadir}/%{name}/test/*
+%{_datadir}/%{name}/test-dhcp/*
+
 %changelog
 %autochangelog

diff --git a/plans/main.fmf b/plans/main.fmf
new file mode 100644
index 0000000..880af98
--- /dev/null
+++ b/plans/main.fmf
@@ -0,0 +1,52 @@
+discover:
+    how: fmf
+execute:
+    how: tmt
+prepare:
+    - how: feature
+      epel: enabled
+      order: 10
+    - when: initiator == packit
+      how: shell
+      script: bash contrib/packit-tmt/update-deps.sh
+      order: 20
+
+finish:
+    how: shell
+    script: |
+        # Archive logs to TMT_PLAN_DATA for post-test analysis
+        mkdir -p "$TMT_PLAN_DATA/logs"
+
+        # Copy audit logs (SELinux denials, audit events)
+        if [ -f /var/log/audit/audit.log ]; then
+            cp /var/log/audit/audit.log "$TMT_PLAN_DATA/logs/"
+            echo "Audit logs copied to $TMT_PLAN_DATA/logs/audit.log"
+        else
+            echo "No audit log found at /var/log/audit/audit.log"
+        fi
+
+        # Capture full journal (current boot only)
+        journalctl -b --no-pager --all --output=short-precise &> "$TMT_PLAN_DATA/logs/journal.log"
+        echo "Journal output saved to $TMT_PLAN_DATA/logs/journal.log"
+
+        echo "All logs archived to $TMT_PLAN_DATA/logs/"
+
+/validate:
+    summary: Validate test
+    discover+:
+        test: /validate
+
+/unit:
+    summary: Unit tests
+    discover+:
+        test: /unit
+
+/integration:
+    summary: Integration tests
+    discover+:
+        test: /integration
+
+/podman:
+    summary: Podman tests
+    discover+:
+        test: /podman

diff --git a/sources b/sources
index 2bd8af6..b31a10d 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (v1.17.2.tar.gz) = bc3a38e26c2f6dba03ce74e671189a8c2b132e0820aa5740a04949fbb32ad33170e7816535503c6c394d14f93f8ae62dcd9da0cbe410984cee8070b1e3855430
-SHA512 (netavark-v1.17.2-vendor.tar.gz) = 2d34a237c540acd05590c09f07e57b1b0a765b746332cbc27337a4c31e2db4b92861629b1418a9c3990a0f25c659d537a8c7b7d2e63247fa3df39c092e80a59d
+SHA512 (v2.0.0.tar.gz) = b2b04a3784bea78a18d7277f93aff3ec8296c6f8b7e97a72e8871e89f9628a739fecaae0db44f379f932c1223a19e6907a7fe53ba5143f7f7742606590613f8c
+SHA512 (netavark-v2.0.0-vendor.tar.gz) = 125dcded2218e183020582c2bb1778667d812cb5009c6264fec14b0500329c493a57a01f0c72e1e2d7cc2cfef4462b0ccc68af1b4f745e35bddbcc1550835509

diff --git a/test/tmt/tmt/integration.sh b/test/tmt/tmt/integration.sh
new file mode 100644
index 0000000..83e4c56
--- /dev/null
+++ b/test/tmt/tmt/integration.sh
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+
+set -exo pipefail
+
+uname -r
+rpm -q aardvark-dns netavark netavark-tests
+
+# Run integration tests
+bats /usr/share/netavark/test
+
+# Run DHCP tests
+bats /usr/share/netavark/test-dhcp

diff --git a/test/tmt/tmt/main.fmf b/test/tmt/tmt/main.fmf
new file mode 100644
index 0000000..b343cac
--- /dev/null
+++ b/test/tmt/tmt/main.fmf
@@ -0,0 +1,50 @@
+/validate:
+    summary: Validate test
+    test: make -C ../.. validate
+    require:
+        - cargo
+        - clippy
+        - go-md2man
+        - make
+        - protobuf-c
+        - protobuf-compiler
+        - rustfmt
+    adjust:
+        enabled: false
+        when: initiator is not defined or initiator != packit
+
+/unit:
+    summary: Unit tests
+    test: make -C ../.. unit
+    require:
+        - cargo
+        - make
+        - protobuf-c
+        - protobuf-compiler
+    adjust:
+        enabled: false
+        when: initiator is not defined or initiator != packit
+
+/integration:
+    summary: Integration tests
+    test: bash integration.sh
+    environment:
+        NETAVARK: /usr/libexec/podman/netavark
+        NETAVARK_CONNECTION_TESTER: /usr/bin/netavark-connection-tester
+        NETAVARK_DHCP_PROXY_CLIENT: /usr/libexec/podman/netavark-dhcp-proxy-client
+        TEST_PLUGINS: /usr/share/netavark/examples
+    require:
+        - aardvark-dns
+        - netavark
+        - netavark-tests
+    duration: 10m
+
+/podman:
+    summary: Podman tests dependent on netavark
+    test: |
+        /usr/bin/bats -t /usr/share/podman/test/system/030-run.bats
+        /usr/bin/bats -t /usr/share/podman/test/system/075-exec.bats
+        /usr/bin/bats -t /usr/share/podman/test/system/500-networking.bats
+    require:
+        - podman-tests
+    duration: 15m