podman-1.4.4-bp152.2.5

- Add patch for CVE-2019-10214. bsc#1144065
  + CVE-2019-10214.patch

- Remove fuse-overlayfs because it's (currently) an unsatisfied dependency on
  SLE (bsc#1143386)

- Update libpod.conf to use correct infra_command

- Update libpod.conf to use better versioned pause container

- Update libpod.conf to use official kubic pause container

- Update libpod.conf to match latest features set:
  detach_keys, lock_type, runtime_supports_json

- Add podman-remote varlink client
- Update podman to v1.4.4
  * Features
  - Podman now has greatly improved support for containers using multiple OCI
    runtimes. Containers now remember if they were created with a different
    runtime using --runtime and will always use that runtime
  - The cached and delegated options for volume mounts are now allowed for
    Docker compatability (#3340)
  - The podman diff command now supports the --latest flag
  * Bugfixes
  - Fixed a bug where rootless Podman would attempt to use the entire root
    configuration if no rootless configuration was present for the user,
    breaking rootless Podman for new installations
  - Fixed a bug where rootless Podman's pause process would block SIGTERM,
    preventing graceful system shutdown and hanging until the system's init
    send SIGKILL
  - Fixed a bug where running Podman as root with sudo -E would not work after
    running rootless Podman at least once
  - Fixed a bug where options for tmpfs volumes added with the --tmpfs flag
    were being ignored
  - Fixed a bug where images with no layers could not properly be displayed
    and removed by Podman
  - Fixed a bug where locks were not properly freed on failure to create a
    container or pod
  - Fixed a bug where podman cp on a single file would create a directory at
    the target and place the file in it (#3384)
  - Fixed a bug where podman inspect --format '{{.Mounts}}' would print a
    hexadecimal address instead of a container's mounts
  - Fixed a bug where rootless Podman would not add an entry to container's
    /etc/hosts files for their own hostname (#3405)
  - Fixed a bug where podman ps --sync would segfault (#3411)
  - Fixed a bug where podman generate kube would produce an invalid ports
    configuration (#3408)
  * Misc
  - Updated containers/storage to v1.12.13
  - Podman now performs much better on systems with heavy I/O load
  - The --cgroup-manager flag to podman now shows the correct default setting
    in help if the default was overridden by libpod.conf
  - For backwards compatability, setting --log-driver=json-file in podman run
    is now supported as an alias for --log-driver=k8s-file. This is considered
    deprecated, and json-file will be moved to a new implementation in the
    future ([#3363](https://github.com/containers/libpo\
    d/issues/3363))
  - Podman's default libpod.conf file now allows the crun OCI runtime to be
    used if it is installed

- Update podman to v1.4.2
  - Fixed a bug where Podman could not run containers using an older version of
    Systemd as init
  - Updated vendored Buildah to v1.9.0 to resolve a critical bug with
    Dockerfile RUN instructions
  - The error message for running podman kill on containers that are not
    running has been improved
  - Podman remote client can now log to a file if syslog is not available
  - The podman exec command now sets its error code differently based on
    whether the container does not exist, and the command in the container does
    not exist
  - The podman inspect command on containers now outputs Mounts JSON that matches
    that of docker inspect, only including user-specified volumes and
    differentiating bind mounts and named volumes
  - The podman inspect command now reports the path to a container's OCI spec
    with the OCIConfigPath key (only included when the container is initialized
    or running)
  - The podman run --mount command now supports the bind-nonrecursive option for
    bind mounts
  - Fixed a bug where podman play kube would fail to create containers due to an
    unspecified log driver
  - Fixed a bug where Podman would fail to build with musl libc
  - Fixed a bug where rootless Podman using slirp4netns networking in an
    environment with no nameservers on the host other than localhost would
    result in nonfunctional networking
  - Fixed a bug where podman import would not properly set environment
    variables, discarding their values and retaining only keys
  - Fixed a bug where Podman would fail to run when built with Apparmor support
    but run on systems without the Apparmor kernel module loaded
  - Remote Podman will now default the username it uses to log in to remote
    systems to the username of the current user
  - Podman now uses JSON logging with OCI runtimes that support it, allowing for
    better error reporting
  - Updated vendored containers/image to v2.0
- Update conmon to v0.3.0
  - Support OOM Monitor under cgroup V2
  - Add config binary and make target for configuring conmon with a go library
    for importing values

- update dependency for slirp4netns to 0.3.0 or newer

- Update podman to v1.4.0:
  - The podman checkpoint and podman restore commands can now be
    used to migrate containers between Podman installations on
    different systems
  - The podman cp command now supports a pause flag to pause
    containers while copying into them
  - The remote client now supports a configuration file for
    pre-configuring connections to remote Podman installations
  - Fixed CVE-2019-10152 - The podman cp command improperly
    dereferenced symlinks in host context
  - Fixed a bug where podman commit could improperly set
    environment variables that contained = characters
  - Fixed a bug where rootless Podman would sometimes fail to start
    containers with forwarded ports
  - Fixed a bug where podman version on the remote client could
    segfault
  - Fixed a bug where podman container runlabel would use
    /proc/self/exe instead of the path of the Podman command when
    printing the command being executed
  - Fixed a bug where filtering images by label did not work
  - Fixed a bug where specifying a bing mount or tmpfs mount over
    an image volume would cause a container to be unable to start
  - Fixed a bug where podman generate kube did not work with
    containers with named volumes
  - Fixed a bug where rootless Podman would receive permission
    denied errors accessing conmon.pid
  - Fixed a bug where podman cp with a folder specified as target
    would replace the folder, as opposed to copying into it
  - Fixed a bug where rootless Podman commands could double-unlock
    a lock, causing a crash
  - Fixed a bug where Podman incorrectly set tmpcopyup on /dev/
    mounts, causing errors when using the Kata containers runtime
  - Fixed a bug where podman exec would fail on older kernels
  - The podman commit command is now usable with the Podman remote
    client
  - The --signature-policy flag (used with several image-related
    commands) has been deprecated
  - The podman unshare command now defines two environment
    variables in the spawned shell: CONTAINERS_RUNROOT and
    CONTAINERS_GRAPHROOT, pointing to temporary and permanent
    storage for rootless containers
  - Updated vendored containers/storage and containers/image
    libraries with numerous bugfixes
  - Updated vendored Buildah to v1.8.3
  - Podman now requires Conmon v0.2.0
  - The podman cp command is now aliased as podman container cp
  - Rootless Podman will now default init_path using root Podman's
    configuration files (/etc/containers/libpod.conf and
    /usr/share/containers/libpod.conf) if not overridden in the
    rootless configuration

- Add fuse-overlayfs dependency to support overlay based rootless image
  manipulations

- Update podman to v1.3.2:
  - Fixed a bug where podman would fail to run if a volume was
    mounted over an image volume

- Update podman to v1.3.1:
  - The podman cp command can now read input redirected to STDIN, and output to
    STDOUT instead of a file, using - instead of an argument.
  - The Podman remote client now displays version information from both the
    client and server in podman version
  - The podman unshare command has been added, allowing easy entry into the
    user namespace set up by rootless Podman (allowing the removal of files
    created by rootless Podman, among other things)
  - Fixed a bug where Podman containers with the --rm flag were removing
    created volumes when they were automatically removed
  - Fixed a bug where container and pod locks were incorrectly marked as
    released after a system reboot, causing errors on container and pod removal
  - Fixed a bug where Podman pods could not be removed if any container in the
    pod encountered an error during removal
  - Fixed a bug where Podman pods run with the cgroupfs CGroup driver would
    encounter a race condition during removal, potentially failing to remove
    the pod CGroup
  - Fixed a bug where the podman container checkpoint and podman container
    restore commands were not visible in the remote client
  - Fixed a bug where podman remote ps --ns would not print the container's
    namespaces
  - Fixed a bug where removing stopped containers with healthchecks could cause
    an error
  - Fixed a bug where the default libpod.conf file was causing parsing errors
  - Fixed a bug where pod locks were not being freed when pods were removed,
    potentially leading to lock exhaustion
  - Fixed a bug where 'podman run' with SD_NOTIFY set could, on short-running
    containers, create an inconsistent state rendering the container unusable
  - The remote Podman client now uses the Varlink bridge to establish remote
    connections by default
- Update conmon to 0.2.0 and switched to containers/conmon upstream project

- Update `systemd-devel` to actually be `pkgconfig(libsystemd)` to allow OBS to
  shortcut through systemd-mini-devel

- Update podman to v1.3.0
  * Podman now supports container restart policies! The --restart-policy flag
    on podman create and podman run allows containers to be restarted after
    they exit. Please note that Podman cannot restart containers after a system
    reboot - for that, see our next feature
  * Podman podman generate systemd command was added to generate systemd unit
    files for managing Podman containers
  * The podman runlabel command now allows a $GLOBAL_OPTS variable, which will
    be populated by global options passed to the podman runlabel command,
    allowing custom storage configurations to be passed into containers run
    with runlabel
  * The podman play kube command now allows File and FileOrCreate volumes
  * The podman pod prune command was added to prune unused pods
  * Added the podman system migrate command to migrate containers using older
    configurations to allow their use by newer Libpod versions
  * Podman containers now forward proxy-related environment variables from the
    host into the container with the --http-proxy flag (enabled by default)
  * Read-only Podman containers can now create tmpfs filesystems on /tmp,
    /var/tmp, and /run with the --read-only-tmpfs flag (enabled by default)
  * The podman init command was added, performing all container pre-start tasks
    without starting the container to allow pre-run debugging
- Update conmon to cri-o v1.14.1
- Update libpod.conf to match latest feature set

- Update to podman 1.2.0
  * Podman now supports image healthchecks! The podman healthcheck run command was added to manually run healthchecks, and the status of a running healthcheck can be viewed via podman inspect
  * The podman events command was added to show a stream of significant events
  * The podman ps command now supports a --watch flag that will refresh its output on a given interval
  * The podman image tree command was added to show a tree representation of an image's layers
  * The podman logs command can now display logs for multiple containers at the same time
  * The podman exec command can now pass file descriptors to the process being executed in the container via the --preserve-fds option
  * The podman images command can now filter images by reference
  * The podman system df command was added to show disk usage by Podman
  * The --add-host option can now be used by containers sharing a network namespace
  * The podman cp command now has an --extract option to extract the contents of a Tar archive and copy them into the container, instead of copying the archive itself
  * Podman now allows manually specifying the path of the slirp4netns binary for rootless networking via the --network-cmd-path flag
  * Rootless Podman can now be used with a single UID and GID, without requiring a full 65536 UIDs/GIDs to be allocated in /etc/subuid and /etc/subgid
  * The podman runlabel command now supports the --replace option to replace containers using the name requested
  * Infrastructure containers for Podman pods will now attempt to use the image's CMD and ENTRYPOINT instead of a fixed command
  * The podman play kube command now supports the HostPath and VolumeMounts YAML fields
  * Added support to disable creation of resolv.conf or /etc/hosts in containers by specifying --dns=none and --no-hosts, respectively, to podman run and podman create
  * The podman version command now supports the {{ json . }} template (which outputs JSON)
  * Podman can now forward ports using the SCTP protocol
- Update conmon to cri-o 1.14.0
- Stop building for i586 (not supported by upstream, does not build)

- Change default libpod.conf configuration file: use the runtimes
  section to allow users to specify different OCI runtimes. This
  allows user to choose which runtime to use on a per container
  basis.

- Add 'apparmor-parser' to list of requires (boo#1123387)

- Scriptlets contain sh-compatible code, so drop -p /bin/bash.

- podman-cni-config: remove artificial conflicts with kubelet