[rpms/kiwi] f44: Rebase to 11.0.2

[rpms/kiwi] f44: Rebase to 11.0.2

[Neal Gompa]

A new commit has been pushed.

Repo   : rpms/kiwi
Branch : f44
Commit : 6fac75fadc27bbe882fe477209a6613479394cb6
Author : Neal Gompa <ngompa@fedoraproject.org>
Date   : 2026-09-17T11:38:54-04:00
Stats  : +52/-34 in 5 file(s)
URL    : https://src.fedoraproject.org/rpms/kiwi/c/6fac75fadc27bbe882fe477209a6613479394cb6?branch=f44

Log:
Rebase to 11.0.2

---
diff --git a/.gitignore b/.gitignore
index c737c11..29c7d2c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -88,3 +88,4 @@
 /kiwi-10.2.45.tar.gz
 /kiwi-10.3.0.tar.gz
 /kiwi-10.3.11.tar.gz
+/kiwi-11.0.2.tar.gz

diff --git a/1001-Use-buildah-by-default-for-OCI-image-builds.patch b/1001-Use-buildah-by-default-for-OCI-image-builds.patch
index d4361fa..705c5ae 100644
--- a/1001-Use-buildah-by-default-for-OCI-image-builds.patch
+++ b/1001-Use-buildah-by-default-for-OCI-image-builds.patch
@@ -1,4 +1,4 @@
-From 1cfd93d4b66932e9d74780f035e989d50b2e8033 Mon Sep 17 00:00:00 2001
+From 011373652b40bb5879bd01241a1d1b2f1ebc5483 Mon Sep 17 00:00:00 2001
 From: Igor Raits <igor.raits@gmail.com>
 Date: Sat, 6 May 2023 12:06:16 +0200
 Subject: [PATCH] Use buildah by default for OCI image builds
@@ -9,15 +9,15 @@ Subject: [PATCH] Use buildah by default for OCI image builds
  2 files changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/kiwi.yml b/kiwi.yml
-index 8acf6ba05..a88bfb389 100644
+index 0ef035b03..83c6fb533 100644
 --- a/kiwi.yml
 +++ b/kiwi.yml
-@@ -89,7 +89,7 @@
+@@ -86,7 +86,7 @@
  #  # Specify OCI archive tool which should be used on creation of
  #  # container archives for OCI compliant images, e.g docker
  #  # Possible values are umoci and buildah
--#  - archive_tool: umoci
-+#  - archive_tool: buildah
+-#  archive_tool: umoci
++#  archive_tool: buildah
  
  # Setup shasum size
  # shasum:

diff --git a/1002-Use-isomd5sum-by-default-for-tagging-ISO-files.patch b/1002-Use-isomd5sum-by-default-for-tagging-ISO-files.patch
index 450b21d..99fdc2d 100644
--- a/1002-Use-isomd5sum-by-default-for-tagging-ISO-files.patch
+++ b/1002-Use-isomd5sum-by-default-for-tagging-ISO-files.patch
@@ -1,4 +1,4 @@
-From c27d2c7f42a39aa901d19b0d822dbd3938911186 Mon Sep 17 00:00:00 2001
+From ac056d0db6afa3d4751b303770512a4b1a53ad91 Mon Sep 17 00:00:00 2001
 From: Neal Gompa <ngompa@fedoraproject.org>
 Date: Mon, 26 Aug 2024 07:36:29 -0400
 Subject: [PATCH] Use isomd5sum by default for tagging ISO files
@@ -9,15 +9,15 @@ Subject: [PATCH] Use isomd5sum by default for tagging ISO files
  2 files changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/kiwi.yml b/kiwi.yml
-index a88bfb389..0d94dab00 100644
+index 83c6fb533..d280b9a42 100644
 --- a/kiwi.yml
 +++ b/kiwi.yml
-@@ -81,7 +81,7 @@
- #  - tool_category: xorriso
+@@ -78,7 +78,7 @@
+ #  tool_category: xorriso
  #  # Specify media tag tool used to implant iso checksums
  #  # Possible values are checkmedia and isomd5sum
--#  - media_tag_tool: checkmedia
-+#  - media_tag_tool: isomd5sum
+-#  media_tag_tool: checkmedia
++#  media_tag_tool: isomd5sum
  
  
  # Setup process parameters for OCI toolchain

diff --git a/kiwi.spec b/kiwi.spec
index 868c011..1685667 100644
--- a/kiwi.spec
+++ b/kiwi.spec
@@ -14,7 +14,7 @@ and cloud systems like Xen, KVM, VMware, EC2 and more.
 
 
 Name:           kiwi
-Version:        10.3.11
+Version:        11.0.2
 Release:        1%{?dist}
 URL:            http://osinside.github.io/kiwi/
 Summary:        Flexible operating system image builder
@@ -468,12 +468,25 @@ for booting oem images built with KIWI and configured to use an
 embedded verity metadata block via the embed_verity_metadata
 type attribute.
 
+%package selinux
+Summary:        SELinux module for KIWI
+BuildArch:      noarch
+BuildRequires:  selinux-policy
+BuildRequires:  selinux-policy-devel
+BuildRequires:  make
+%{?selinux_requires}
+
+%description selinux
+This package provides the SELinux policy module to ensure kiwi
+runs properly under an environment with SELinux enabled.
+
 %package cli
 Summary:        Flexible operating system appliance image builder
 Provides:       kiwi-schema = 8.2
 # So we can reference it by the source package name while permitting this to be noarch
 Provides:       %{name} = %{version}-%{release}
 Requires:       python3-%{name} = %{version}-%{release}
+Requires:       (%{name}-selinux = %{version}-%{release} if selinux-policy)
 Requires:       bash-completion
 BuildArch:      noarch
 
@@ -483,12 +496,6 @@ BuildArch:      noarch
 %prep
 %autosetup -p1
 
-# Temporarily switch things back to docopt for everything but Fedora 41+
-# FIXME: Drop this hack as soon as we can...
-%if ! (0%{?fedora} >= 41 || 0%{?rhel} >= 10)
-sed -e 's/docopt-ng.*/docopt = ">=0.6.2"/' -i pyproject.toml
-%endif
-
 # Drop shebang for kiwi/xml_parse.py, as we don't intend to use it as an independent script
 sed -e "s|#!/usr/bin/env python||" -i kiwi/xml_parse.py
 
@@ -503,10 +510,12 @@ sed -e "s|#!/usr/bin/env python||" -i kiwi/xml_parse.py
 
 %pyproject_wheel
 
+# Build SELinux module
+make -C selinux SHARE="%{_datadir}" TARGETS="kiwi"
+
 # Build man pages
 make -C doc man
 
-
 %install
 # Required for some parts
 %set_build_flags
@@ -519,6 +528,9 @@ make buildroot=%{buildroot}/ install
 # Install dracut modules (yes, the slash is needed!)
 make buildroot=%{buildroot}/ install_dracut
 
+# Install SELinux module
+install -t %{buildroot}%{_datadir}/selinux/packages -Dpm 0644 selinux/kiwi.pp.bz2
+
 # Get rid of unnecessary doc files
 rm -rf %{buildroot}%{_docdir}/packages
 
@@ -540,25 +552,22 @@ done
 %fdupes %{buildroot}%{_sharedstatedir}/tftpboot
 %endif
 
+%pre selinux
+%selinux_relabel_pre
 
-%post cli
-if [ -x /usr/sbin/semanage -a -x /usr/sbin/restorecon ]; then
-    # file contexts
-    semanage fcontext --add --type install_exec_t        '%{_bindir}/kiwi'               2> /dev/null || :
-    semanage fcontext --add --type install_exec_t        '%{_bindir}/kiwi-ng(.*)'        2> /dev/null || :
-    restorecon -r %{_bindir}/kiwi %{_bindir}/kiwi-ng* || :
-fi
+%post selinux
+%selinux_modules_install %{_datadir}/selinux/packages/kiwi.pp.bz2
+%selinux_relabel_post
 
-%postun cli
+%posttrans selinux
+%selinux_relabel_post
+
+%postun selinux
+%selinux_modules_uninstall kiwi
 if [ $1 -eq 0 ]; then
-    if [ -x /usr/sbin/semanage ]; then
-        # file contexts
-        semanage fcontext --delete --type install_exec_t        '%{_bindir}/kiwi'               2> /dev/null || :
-        semanage fcontext --delete --type install_exec_t        '%{_bindir}/kiwi-ng(.*)'        2> /dev/null || :
-    fi
+    %selinux_relabel_post
 fi
 
-
 %if %{with check}
 %check
 pushd test/unit
@@ -578,6 +587,11 @@ popd
 %dir %{_datadir}/kiwi
 %{_datadir}/kiwi/xsl_to_v74/
 
+%files selinux
+%doc selinux/README.md
+%license LICENSE
+%{_datadir}/selinux/packages/kiwi.pp.bz2
+
 %files cli
 %{_bindir}/kiwi
 %{_bindir}/kiwi-ng
@@ -657,6 +671,9 @@ popd
 
 
 %changelog
+* Thu Sep 17 2026 Neal Gompa <ngompa@fedoraproject.org> - 11.0.2-1
+- Rebase to 11.0.2
+
 * Wed Aug 26 2026 Neal Gompa <ngompa@fedoraproject.org> - 10.3.11-1
 - Update to 10.3.11
 

diff --git a/sources b/sources
index 79402d7..e4281da 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (kiwi-10.3.11.tar.gz) = ec9a5e9ac7d167bf87e353b376bee2625379e456f679beb148e51a75a263f445722b6118c21e7261258da4aeea482ddb6ee83b4213d1dc8e0a94a3558371ae96
+SHA512 (kiwi-11.0.2.tar.gz) = 5deba0b912f85e9ca23bb55db4d1f650371ab1452ccaea3a25081c36692443d71556ddc0338b4e56d88f463d39da4007bfa32f705c62819effc9189bd626e5a6