[rpms/containerd] f43: Update to release v2.2.5

[rpms/containerd] f43: Update to release v2.2.5

[Bradley G Smith]

            A new commit has been pushed.

            Repo   : rpms/containerd
            Branch : f43
            Commit : d0d60e3672f45ed03fd2d3af30d8a37f64f30451
            Author : Bradley G Smith <bradley.g.smith@gmail.com>
            Date   : 2026-06-27T15:00:30-07:00
            Stats  : +110/-63 in 3 file(s)
            URL    : https://src.fedoraproject.org/rpms/containerd/c/d0d60e3672f45ed03fd2d3af30d8a37f64f30451?branch=f43

            Log:
            Update to release v2.2.5

- Resolves: rhbz#2464270
- Resolves CVE-2026-50195
- Resolves CVE-2026-53488
- Resolves CVE-2026-53492
- Resolves CVE-2026-53489
- Resolves CVE-2026-47262

---
diff --git a/containerd.spec b/containerd.spec
index df408fc..f561d68 100644
--- a/containerd.spec
+++ b/containerd.spec
@@ -1,26 +1,27 @@
-# Generated by go2rpm 1.11.0
-%bcond_without check
+# Generated by go2rpm 1.19.0
+%bcond check 1
+
+# containerd granted permanent exception to Fedora Updates Policy
+# https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/#_exceptions
+# https://pagure.io/fesco/issue/3603
 
 # https://github.com/containerd/containerd
-%global goipath         github.com/containerd/containerd
-Version:                2.1.7
-%global tag             v%{gsub %{version} ~ -}
+%global goipath         github.com/containerd/containerd/v2
+Version:                2.2.5
+%{lua:
+    local version0 = rpm.expand("%{version}"):gsub("~", "-")
+    rpm.define("tag " .. "v" .. version0)
+    rpm.define("origversion " .. version0)
+}
 
 %gometa -L -f
 
-%global common_description %{expand:
-Containerd is an industry-standard container runtime with an emphasis on
-simplicity, robustness and portability. It is available as a daemon for Linux
-and Windows, which can manage the complete container lifecycle of its host
-system: image transfer and storage, container execution and supervision,
-low-level storage and network attachments, etc.}
 
 Name:           containerd
 Release:        %autorelease
 Summary:        An open and reliable container runtime
 
 # Generated by go-vendor-tools
-# SourceLicense:  Apache-2.0
 License:        Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND MIT AND MPL-2.0
 URL:            %{gourl}
 Source0:        %{gosource}
@@ -29,23 +30,23 @@ Source1:        %{archivename}-vendor.tar.bz2
 Source2:        go-vendor-tools.toml
 Source3:        containerd.toml
 
-Patch:          0001-Makefile-adjust-GO_LDFLAGS-quoting.patch
-
 BuildRequires:  /usr/bin/go-md2man
 BuildRequires:  btrfs-progs-devel
 BuildRequires:  go-vendor-tools
 BuildRequires:  make
 BuildRequires:  systemd-rpm-macros
 BuildRequires:  procps-ng
+BuildRequires:  git-core
+BuildRequires:  glibc-devel
 
-Requires:       runc
 
-%description %{common_description}
+%description
+An open and reliable container runtime.
 
 %prep
-%goprep -A
-%setup -q -T -D -a1 %{forgesetupargs}
-%autopatch -p1
+%goprep -p1
+tar -xf %{S:1}
+
 # Replace default bin directory
 sed -i "s|/usr/local/bin/containerd|/usr/bin/containerd|" containerd.service
 cp -p %{S:3} .
@@ -54,50 +55,98 @@ cp -p %{S:3} .
 %go_vendor_license_buildrequires -c %{S:2}
 
 %build
-GO_LDFLAGS="" GO_BUILDFLAGS=""
-%global makeflags %{expand:\\
-    DATADIR=%{_datadir} \\
-    DESTDIR=%{buildroot} \\
-    EXTRA_LDFLAGS=%{gobuild_ldflags_shescaped} \\
-    GO_BUILD_FLAGS=%{gobuild_baseflags_shescaped} \\
-    MANDIR=%{_mandir} \\
-    PREFIX=%{_prefix} \\
-    REVISION=%{release} \\
-    SHIM_CGO_ENABLED=1 \\
-    VERSION=%{version} \\
-}
-%make_build %{makeflags} binaries man
+%global gomodulesmode GO111MODULE=on
+
+# buildtag as set in MAKEFILE
+export GO_BUILDTAGS="urfave_cli_no_docs"
+
+# generate GO_LDFLAGS and drop go macro settings for version, tag, commit
+export GO_LDFLAGS=" -X %{goipath}/version.Version=%{version} -X %{goipath}/version.Revision=%{release} -X %{goipath}/version.Package=%{goipath} "
+%global currentgoldflags  %{nil}
+
+# commands to build
+for cmd in \
+   ctr \
+   containerd \
+   containerd-stress ; do
+  %gobuild -o %{gobuilddir}/bin/$cmd %{goipath}/cmd/$cmd
+done
+
+# create man pages
+# drop gen-manpages utility in temp ./man dir
+mkdir -p man
+GO_BUILDTAGS=""
+%gobuild -o man/gen-manpages %{goipath}/cmd/gen-manpages
+man/gen-manpages ctr.8        man
+man/gen-manpages containerd.8 man
+go-md2man -in "docs/man/containerd-config.8.md"      -out "man/containerd-config.8"
+go-md2man -in "docs/man/containerd-config.toml.5.md" -out "man/containerd-config.toml.5"
+rm man/gen-manpages
+
+# Drop: shim explicity build with static; mimic makefile settings
+# Build as standard pie
+# export CGO_ENABLED=0
+GO_BUILDTAGS="urfave_cli_no_docs no_grpc"
+# %%global __golang_extldflags -static-pie
+%gobuild -o %{gobuilddir}/bin/containerd-shim-runc-v2 %{goipath}/cmd/containerd-shim-runc-v2
+
+# GO_LDFLAGS="$GO_LDFLAGS -linkmode external -extldflags \"-static-pie\" -s -w"
+# go build \
+#    %%{gobuild_baseflags} \
+#    -ldflags  "$GO_LDFLAGS " \
+#    -o %%{gobuilddir}/bin/containerd-shim-runc-v2 \
+#    %%{goipath}/cmd/containerd-shim-runc-v2
+
+#  
+#    %%(echo -n %%{gobuild_ldflags}|sed 's/-linkmode=external //') " \
 
 %install
 %go_vendor_license_install -c %{S:2}
-%make_build %{makeflags} install install-man
-install -Dpm 0644 containerd.service -t %{buildroot}%{_unitdir}
-install -Dpm 0644 containerd.toml %{buildroot}%{_sysconfdir}/containerd/config.toml
+
+# binaries
+install -m 0755 -vd                     %{buildroot}%{_bindir}
+install -m 0755 -vp %{gobuilddir}/bin/* %{buildroot}%{_bindir}/
+
+# systemd service file
+install -d -m 0755 %{buildroot}%{_unitdir}
+install -p -m 0644 containerd.service %{buildroot}%{_unitdir}/containerd.service
+
+# /etc/containerd/config.toml
+install -d -m 0755 %{buildroot}%{_sysconfdir}/containerd
+install -p -m 0644 containerd.toml %{buildroot}%{_sysconfdir}/containerd/config.toml
+
+# man pages
+install -d -m 0755 %{buildroot}%{_mandir}/man5
+install -p -m 0644 man/containerd-config.toml.5 %{buildroot}%{_mandir}/man5
+
+install -d -m 0755 %{buildroot}%{_mandir}/man8
+install -p -m 0644 man/ctr.8                    %{buildroot}%{_mandir}/man8
+install -p -m 0644 man/containerd.8             %{buildroot}%{_mandir}/man8
+install -p -m 0644 man/containerd-config.8      %{buildroot}%{_mandir}/man8
 
 %check
 %go_vendor_license_check -c %{S:2}
+
 %if %{with check}
-skiptest() {
-    for test in "$@"; do
-        awk -i inplace '/^func.*'"${test}"'\(/ { print; print "\tt.Skip(\"disabled failing test\")"; next}1' \
-            $(grep -rl "${test}")
-    done
+%global test_ignores %{shrink:
+    %dnl tests below fail with create tmp file: open ... invalid argument
+    -s "TestWriterTruncateRecoversFromIncompleteWrite"
+    -s "TestWriteReadEmptyFileTimestamp"
+    -s "TestWalkBlobs"
+    -s "TestContentWriter"
+    -s "TestContent"
+    -s "TestSkipNonDistributableBlobs"
+    -s "TestMetadataCollector"
+    -s "TestIngestLeased"
+    -s "TestContentLeased"
+    -s "TestContent"
+    -s "TestUsageCalculation"
+    %dnl integration tests need network
+    -t integration
+    %dnl api is a separate module
+    -d api
 }
-
-skiptest \
-    %dnl create tmp file - invalid argument
-    "TestSkipNonDistributableBlobs" \
-    "TestMetadataCollector" \
-    "TestIngestLeased" \
-    "TestContentLeased" \
-    "TestContent" \
-    "TestWriterTruncateRecoversFromIncompleteWrite" \
-    "TestWalkBlobs" \
-    "TestContentWriter" \
-    "TestWriteReadEmptyFileTimestamp" \
-    "TestUsageCalculation"
-
-%make_build %{makeflags} test
+%gocheck2 %{test_ignores}
 %endif
 
 %post
@@ -110,7 +159,6 @@ skiptest \
 %systemd_postun_with_restart containerd.service
 
 %files -f %{go_vendor_license_filelist}
-%license vendor/modules.txt
 %doc ROADMAP.md ADOPTERS.md BUILDING.md README.md RELEASES.md SCOPE.md
 %{_bindir}/ctr
 %{_bindir}/containerd
@@ -124,6 +172,5 @@ skiptest \
 %config(noreplace) %{_sysconfdir}/containerd/config.toml
 %{_unitdir}/containerd.service
 
-
 %changelog
 %autochangelog

diff --git a/go-vendor-tools.toml b/go-vendor-tools.toml
index 55f0687..d59773e 100644
--- a/go-vendor-tools.toml
+++ b/go-vendor-tools.toml
@@ -24,10 +24,6 @@ sha256sum = "81205fa54813e578a0d361c671c21ae35ca5b1b575f39e82f5cdab68b8539a1d"
 expression = "BSD-3-Clause"
 
 [[licensing.licenses]]
-path = "vendor/sigs.k8s.io/yaml/goyaml.v2/LICENSE.libyaml"
-sha256sum = "a94710b55e03b5285f77d048c5ba61bb9d6ee04a06c0eb90e68821e11b0c707a"
-expression = "MIT"
-[[licensing.licenses]]
 path = "vendor/github.com/cyphar/filepath-securejoin/LICENSE.BSD"
 sha256sum = "26be8a79415737dfe8edf1be62e71afeb8c770ed5a5605a06270d5701830f47c"
 expression = "BSD-3-Clause"
@@ -35,3 +31,7 @@ expression = "BSD-3-Clause"
 path = "vendor/github.com/cyphar/filepath-securejoin/LICENSE.MPL-2.0"
 sha256sum = "3f3d9e0024b1921b067d6f7f88deb4a60cbe7a78e76c64e3f1d7fc3b779b9d04"
 expression = "MPL-2.0"
+[[licensing.licenses]]
+path = "vendor/go.yaml.in/yaml/v2/LICENSE.libyaml"
+sha256sum = "a94710b55e03b5285f77d048c5ba61bb9d6ee04a06c0eb90e68821e11b0c707a"
+expression = "MIT"

diff --git a/sources b/sources
index d2b01b5..ac77d87 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (containerd-2.1.7.tar.gz) = bb5f8d03b269005bea54fabd603be1909496da8f4148c8cb2b720ac68cf5b205f81c0af3fdc8109ec661d3a65c117a94001910b8839540999e1e22430b94ef83
-SHA512 (containerd-2.1.7-vendor.tar.bz2) = d96a9d09bbb1347f4ceba5d3a828e604c6b010689f6570ed9bc138b63f85c144bb19fba86883a603ec253f2c96f0704be37dd1d295c1e1ca273f411de7a0d03c
+SHA512 (containerd-2.2.5.tar.gz) = 5d658c8daa48e3b5369995847d15e3dae4367e7221a5a34115bb74723707053378a2d489b29e6f2742e04bdfc2362c02df34fcb403fc0adb144e19bd352d7741
+SHA512 (containerd-2.2.5-vendor.tar.bz2) = c59c6f58824f2a145ce5cc08207c23c477b4a33497366bc88bfb51ee9932c02e3f403ca5b1d796a257f846bbe7ea3bcc5cd02766dd53cf30766421f7b83d8464