[rpms/containerd] epel10.2: Update to release v2.2.5

[rpms/containerd] epel10.2: Update to release v2.2.5

[Bradley G Smith]

            A new commit has been pushed.

            Repo   : rpms/containerd
            Branch : epel10.2
            Commit : e58fe0e47fc92b581e3880b28770e68addc5e9e5
            Author : Bradley G Smith <bradley.g.smith@gmail.com>
            Date   : 2026-06-28T12:23:56-07:00
            Stats  : +92/-44 in 3 file(s)
            URL    : https://src.fedoraproject.org/rpms/containerd/c/e58fe0e47fc92b581e3880b28770e68addc5e9e5?branch=epel10.2

            Log:
            Update to release v2.2.5

- Resolves: rhbz#2464270
- Resolves CVE-2026-50195
- Resolves CVE-2026-53488
- Resolves CVE-2026-53492
- Resolves CVE-2026-53489
- Resolves CVE-2026-47262

Signed-off-by: Bradley G Smith <bradley.g.smith@gmail.com>

---
diff --git a/containerd.spec b/containerd.spec
index eb494fb..f561d68 100644
--- a/containerd.spec
+++ b/containerd.spec
@@ -1,26 +1,27 @@
-# Generated by go2rpm 1.11.0
-%bcond_without check
+# Generated by go2rpm 1.19.0
+%bcond check 1
+
+# containerd granted permanent exception to Fedora Updates Policy
+# https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/#_exceptions
+# https://pagure.io/fesco/issue/3603
 
 # https://github.com/containerd/containerd
-%global goipath         github.com/containerd/containerd
-Version:                2.2.2
-%global tag             v%{gsub %{version} ~ -}
+%global goipath         github.com/containerd/containerd/v2
+Version:                2.2.5
+%{lua:
+    local version0 = rpm.expand("%{version}"):gsub("~", "-")
+    rpm.define("tag " .. "v" .. version0)
+    rpm.define("origversion " .. version0)
+}
 
 %gometa -L -f
 
-%global common_description %{expand:
-Containerd is an industry-standard container runtime with an emphasis on
-simplicity, robustness and portability. It is available as a daemon for Linux
-and Windows, which can manage the complete container lifecycle of its host
-system: image transfer and storage, container execution and supervision,
-low-level storage and network attachments, etc.}
 
 Name:           containerd
 Release:        %autorelease
 Summary:        An open and reliable container runtime
 
 # Generated by go-vendor-tools
-# SourceLicense:  Apache-2.0
 License:        Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND MIT AND MPL-2.0
 URL:            %{gourl}
 Source0:        %{gosource}
@@ -29,23 +30,23 @@ Source1:        %{archivename}-vendor.tar.bz2
 Source2:        go-vendor-tools.toml
 Source3:        containerd.toml
 
-Patch:          0001-Makefile-adjust-GO_LDFLAGS-quoting.patch
-
 BuildRequires:  /usr/bin/go-md2man
 BuildRequires:  btrfs-progs-devel
 BuildRequires:  go-vendor-tools
 BuildRequires:  make
 BuildRequires:  systemd-rpm-macros
 BuildRequires:  procps-ng
+BuildRequires:  git-core
+BuildRequires:  glibc-devel
 
-Requires:       runc
 
-%description %{common_description}
+%description
+An open and reliable container runtime.
 
 %prep
-%goprep -A
-%setup -q -T -D -a1 %{forgesetupargs}
-%autopatch -p1
+%goprep -p1
+tar -xf %{S:1}
+
 # Replace default bin directory
 sed -i "s|/usr/local/bin/containerd|/usr/bin/containerd|" containerd.service
 cp -p %{S:3} .
@@ -54,30 +55,79 @@ cp -p %{S:3} .
 %go_vendor_license_buildrequires -c %{S:2}
 
 %build
-GO_LDFLAGS="" GO_BUILDFLAGS=""
-%global makeflags %{expand:\\
-    DATADIR=%{_datadir} \\
-    DESTDIR=%{buildroot} \\
-    EXTRA_LDFLAGS=%{gobuild_ldflags_shescaped} \\
-    GO_BUILD_FLAGS=%{gobuild_baseflags_shescaped} \\
-    MANDIR=%{_mandir} \\
-    PREFIX=%{_prefix} \\
-    REVISION=%{release} \\
-    SHIM_CGO_ENABLED=1 \\
-    VERSION=%{gsub %{version} ~ -} \\
-}
-%make_build %{makeflags} binaries man
+%global gomodulesmode GO111MODULE=on
+
+# buildtag as set in MAKEFILE
+export GO_BUILDTAGS="urfave_cli_no_docs"
+
+# generate GO_LDFLAGS and drop go macro settings for version, tag, commit
+export GO_LDFLAGS=" -X %{goipath}/version.Version=%{version} -X %{goipath}/version.Revision=%{release} -X %{goipath}/version.Package=%{goipath} "
+%global currentgoldflags  %{nil}
+
+# commands to build
+for cmd in \
+   ctr \
+   containerd \
+   containerd-stress ; do
+  %gobuild -o %{gobuilddir}/bin/$cmd %{goipath}/cmd/$cmd
+done
+
+# create man pages
+# drop gen-manpages utility in temp ./man dir
+mkdir -p man
+GO_BUILDTAGS=""
+%gobuild -o man/gen-manpages %{goipath}/cmd/gen-manpages
+man/gen-manpages ctr.8        man
+man/gen-manpages containerd.8 man
+go-md2man -in "docs/man/containerd-config.8.md"      -out "man/containerd-config.8"
+go-md2man -in "docs/man/containerd-config.toml.5.md" -out "man/containerd-config.toml.5"
+rm man/gen-manpages
+
+# Drop: shim explicity build with static; mimic makefile settings
+# Build as standard pie
+# export CGO_ENABLED=0
+GO_BUILDTAGS="urfave_cli_no_docs no_grpc"
+# %%global __golang_extldflags -static-pie
+%gobuild -o %{gobuilddir}/bin/containerd-shim-runc-v2 %{goipath}/cmd/containerd-shim-runc-v2
+
+# GO_LDFLAGS="$GO_LDFLAGS -linkmode external -extldflags \"-static-pie\" -s -w"
+# go build \
+#    %%{gobuild_baseflags} \
+#    -ldflags  "$GO_LDFLAGS " \
+#    -o %%{gobuilddir}/bin/containerd-shim-runc-v2 \
+#    %%{goipath}/cmd/containerd-shim-runc-v2
+
+#  
+#    %%(echo -n %%{gobuild_ldflags}|sed 's/-linkmode=external //') " \
 
 %install
 %go_vendor_license_install -c %{S:2}
-%make_build %{makeflags} install install-man
-install -Dpm 0644 containerd.service -t %{buildroot}%{_unitdir}
-install -Dpm 0644 containerd.toml %{buildroot}%{_sysconfdir}/containerd/config.toml
+
+# binaries
+install -m 0755 -vd                     %{buildroot}%{_bindir}
+install -m 0755 -vp %{gobuilddir}/bin/* %{buildroot}%{_bindir}/
+
+# systemd service file
+install -d -m 0755 %{buildroot}%{_unitdir}
+install -p -m 0644 containerd.service %{buildroot}%{_unitdir}/containerd.service
+
+# /etc/containerd/config.toml
+install -d -m 0755 %{buildroot}%{_sysconfdir}/containerd
+install -p -m 0644 containerd.toml %{buildroot}%{_sysconfdir}/containerd/config.toml
+
+# man pages
+install -d -m 0755 %{buildroot}%{_mandir}/man5
+install -p -m 0644 man/containerd-config.toml.5 %{buildroot}%{_mandir}/man5
+
+install -d -m 0755 %{buildroot}%{_mandir}/man8
+install -p -m 0644 man/ctr.8                    %{buildroot}%{_mandir}/man8
+install -p -m 0644 man/containerd.8             %{buildroot}%{_mandir}/man8
+install -p -m 0644 man/containerd-config.8      %{buildroot}%{_mandir}/man8
 
 %check
 %go_vendor_license_check -c %{S:2}
+
 %if %{with check}
-# %%make_build %%{makeflags} test
 %global test_ignores %{shrink:
     %dnl tests below fail with create tmp file: open ... invalid argument
     -s "TestWriterTruncateRecoversFromIncompleteWrite"
@@ -109,7 +159,6 @@ install -Dpm 0644 containerd.toml %{buildroot}%{_sysconfdir}/containerd/config.t
 %systemd_postun_with_restart containerd.service
 
 %files -f %{go_vendor_license_filelist}
-%license vendor/modules.txt
 %doc ROADMAP.md ADOPTERS.md BUILDING.md README.md RELEASES.md SCOPE.md
 %{_bindir}/ctr
 %{_bindir}/containerd
@@ -123,6 +172,5 @@ install -Dpm 0644 containerd.toml %{buildroot}%{_sysconfdir}/containerd/config.t
 %config(noreplace) %{_sysconfdir}/containerd/config.toml
 %{_unitdir}/containerd.service
 
-
 %changelog
 %autochangelog

diff --git a/go-vendor-tools.toml b/go-vendor-tools.toml
index f72fa65..d59773e 100644
--- a/go-vendor-tools.toml
+++ b/go-vendor-tools.toml
@@ -24,10 +24,6 @@ sha256sum = "81205fa54813e578a0d361c671c21ae35ca5b1b575f39e82f5cdab68b8539a1d"
 expression = "BSD-3-Clause"
 
 [[licensing.licenses]]
-path = "vendor/go.yaml.in/yaml/v2/LICENSE.libyaml"
-sha256sum = "a94710b55e03b5285f77d048c5ba61bb9d6ee04a06c0eb90e68821e11b0c707a"
-expression = "MIT"
-[[licensing.licenses]]
 path = "vendor/github.com/cyphar/filepath-securejoin/LICENSE.BSD"
 sha256sum = "26be8a79415737dfe8edf1be62e71afeb8c770ed5a5605a06270d5701830f47c"
 expression = "BSD-3-Clause"
@@ -35,3 +31,7 @@ expression = "BSD-3-Clause"
 path = "vendor/github.com/cyphar/filepath-securejoin/LICENSE.MPL-2.0"
 sha256sum = "3f3d9e0024b1921b067d6f7f88deb4a60cbe7a78e76c64e3f1d7fc3b779b9d04"
 expression = "MPL-2.0"
+[[licensing.licenses]]
+path = "vendor/go.yaml.in/yaml/v2/LICENSE.libyaml"
+sha256sum = "a94710b55e03b5285f77d048c5ba61bb9d6ee04a06c0eb90e68821e11b0c707a"
+expression = "MIT"

diff --git a/sources b/sources
index 8d1c36c..ac77d87 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (containerd-2.2.2.tar.gz) = 4471047360cd1430a189829a74d605dbe89abe092f0e0ba53ad5954269f253c7c277b8097c5d12acb9e0592a39e50e1808c92e73596e3d2d97cf945f15063ca0
-SHA512 (containerd-2.2.2-vendor.tar.bz2) = 7341eeb2013bbfe4153caca6a522304d8f20c5203a4e3d602aac1700c0e65a23c387f12778b59e092abd1a7fb3885cc29ad66364f370f132fe783737097045bb
+SHA512 (containerd-2.2.5.tar.gz) = 5d658c8daa48e3b5369995847d15e3dae4367e7221a5a34115bb74723707053378a2d489b29e6f2742e04bdfc2362c02df34fcb403fc0adb144e19bd352d7741
+SHA512 (containerd-2.2.5-vendor.tar.bz2) = c59c6f58824f2a145ce5cc08207c23c477b4a33497366bc88bfb51ee9932c02e3f403ca5b1d796a257f846bbe7ea3bcc5cd02766dd53cf30766421f7b83d8464