From 5069f35b9dfd99ca7696e63e439aaf4bca99bea7 Mon Sep 17 00:00:00 2001
From: Florent Benoit <fbenoit@redhat.com>
Date: Fri, 18 Sep 2026 10:28:22 +0200
Subject: [PATCH] chore(vm): bump libkrun to v1.19.4 and libkrunfw to v5.6.1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The libkrun and libkrunfw projects moved from the containers/ GitHub
org to libkrun/. Update all clone URLs and version pins accordingly.

libkrun v1.19.4 introduces krun_add_virtiofs4 with a permissions
semantics parameter, enabling correct file ownership mapping on
host-to-guest bind mounts — required for issue #2585.

- libkrun: v1.17.4 → v1.19.4 (libkrun/libkrun)
- libkrunfw: 463f717b → v5.6.1 (libkrun/libkrunfw)
- Centralise LIBKRUN_REF in pins.env instead of hardcoding in each
  build script
- Source pins.env in the macOS build script for consistency with the
  Linux build script
- Remove the init/init make target step — since libkrun/libkrun@05c4eb7
  the init blob moved into the init_blob crate and is built by cargo

Ref: https://github.com/NVIDIA/OpenShell/issues/2585
Signed-off-by: Florent Benoit <fbenoit@redhat.com>
---
 crates/openshell-driver-vm/runtime/pins.env | 11 ++++++++---
 tasks/scripts/vm/build-libkrun-macos.sh     |  9 +++++++--
 tasks/scripts/vm/build-libkrun.sh           | 12 ++++--------
 3 files changed, 19 insertions(+), 13 deletions(-)

diff --git a/crates/openshell-driver-vm/runtime/pins.env b/crates/openshell-driver-vm/runtime/pins.env
index 9977eddcc1..5595394b54 100644
--- a/crates/openshell-driver-vm/runtime/pins.env
+++ b/crates/openshell-driver-vm/runtime/pins.env
@@ -34,6 +34,11 @@ COMMUNITY_SANDBOX_IMAGE="${COMMUNITY_SANDBOX_IMAGE:-ghcr.io/nvidia/openshell-com
 UMOCI_VERSION="${UMOCI_VERSION:-v0.6.0}"
 
 # ── libkrunfw upstream (commit-pinned) ─────────────────────────────────
-# Repo: https://github.com/containers/libkrunfw
-# Pinned: 2026-03-27 (main branch HEAD at time of pinning)
-LIBKRUNFW_REF="${LIBKRUNFW_REF:-463f717bbdd916e1352a025b6fb2456e882b0b39}"
+# Repo: https://github.com/libkrun/libkrunfw
+# Pinned: v5.6.1 (2026-09-16)
+LIBKRUNFW_REF="${LIBKRUNFW_REF:-617938cf2ae9a3a0e5696d23a5d6252cd7a1ef4f}"
+
+# ── libkrun upstream (commit-pinned) ──────────────────────────────────
+# Repo: https://github.com/libkrun/libkrun
+# Pinned: v1.19.4 (2026-09-16)
+LIBKRUN_REF="${LIBKRUN_REF:-728df8125077d0db44265f6e997c72b81b65c015}"
diff --git a/tasks/scripts/vm/build-libkrun-macos.sh b/tasks/scripts/vm/build-libkrun-macos.sh
index 339a736663..f560a19ba8 100755
--- a/tasks/scripts/vm/build-libkrun-macos.sh
+++ b/tasks/scripts/vm/build-libkrun-macos.sh
@@ -31,6 +31,10 @@
 set -euo pipefail
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)"
+
+# Source pinned dependency versions.
+source "${ROOT}/crates/openshell-driver-vm/runtime/pins.env" 2>/dev/null || true
+
 BUILD_DIR="${ROOT}/target/libkrun-build"
 OUTPUT_DIR="${BUILD_DIR}"
 BREW_PREFIX="$(brew --prefix 2>/dev/null || echo /opt/homebrew)"
@@ -149,11 +153,12 @@ echo "    Built: libkrunfw.${ABI_VERSION}.dylib ($(du -sh "${OUTPUT_DIR}/libkrun
 
 # ── Clone libkrun ───────────────────────────────────────────────────────
 
-LIBKRUN_REF="${LIBKRUN_REF:-e5922f6}"
+# LIBKRUN_REF is sourced from pins.env; env-var override still works.
+LIBKRUN_REF="${LIBKRUN_REF:-728df8125077d0db44265f6e997c72b81b65c015}"
 
 if [ ! -d libkrun ]; then
     echo "==> Cloning libkrun..."
-    git clone https://github.com/containers/libkrun.git
+    git clone https://github.com/libkrun/libkrun.git
 fi
 
 echo "==> Checking out ${LIBKRUN_REF}..."
diff --git a/tasks/scripts/vm/build-libkrun.sh b/tasks/scripts/vm/build-libkrun.sh
index e204dc0829..bd40f2f1d5 100755
--- a/tasks/scripts/vm/build-libkrun.sh
+++ b/tasks/scripts/vm/build-libkrun.sh
@@ -134,7 +134,7 @@ ensure_python3_with_pyelftools_for_libkrunfw
 
 if [ ! -d libkrunfw ]; then
   echo "    Cloning libkrunfw (pinned: ${LIBKRUNFW_REF:-HEAD})..."
-  git clone https://github.com/containers/libkrunfw.git
+  git clone https://github.com/libkrun/libkrunfw.git
 fi
 
 cd libkrunfw
@@ -405,11 +405,12 @@ echo "==> Building libkrun..."
 ensure_cargo_for_libkrun
 ensure_libclang_for_libkrun
 
-LIBKRUN_REF="${LIBKRUN_REF:-v1.17.4}"
+# LIBKRUN_REF is sourced from pins.env (line 32); env-var override still works.
+LIBKRUN_REF="${LIBKRUN_REF:-728df8125077d0db44265f6e997c72b81b65c015}"
 
 if [ ! -d libkrun ]; then
   echo "    Cloning libkrun..."
-  git clone https://github.com/containers/libkrun.git
+  git clone https://github.com/libkrun/libkrun.git
 fi
 
 cd libkrun
@@ -420,11 +421,6 @@ if [ -n "${LIBKRUN_REF:-}" ]; then
   git checkout "${LIBKRUN_REF}" 2>/dev/null || git checkout "origin/${LIBKRUN_REF}" 2>/dev/null || true
 fi
 
-if [ -f init/Makefile ] || grep -q 'init/init' Makefile 2>/dev/null; then
-  echo "    Building init/init binary..."
-  make init/init
-fi
-
 echo "    Building libkrun with NET=1 BLK=1..."
 cargo build --release --features blk --features net --target-dir="$(pwd)/target"