From cd09bc6ca9694dea21d7cfb3b00742808ab0344f Mon Sep 17 00:00:00 2001
From: Tomasz Pasternak <tomasz@engflow.com>
Date: Mon, 19 Oct 2026 09:57:03 +0200
Subject: [PATCH 01/35] First GH actions setup

---
 .github/workflows/build.yml | 35 +++++++++++++++++++++++++++++++++++
 .gitmodules                 | 10 +++++-----
 2 files changed, 40 insertions(+), 5 deletions(-)
 create mode 100644 .github/workflows/build.yml

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 000000000..6ed4bc3b5
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,35 @@
+name: Build Sysbox Packages
+
+on:
+  push:
+    branches: [ "master", "main" ]
+  pull_request:
+    branches: [ "master", "main" ]
+  workflow_dispatch:
+
+jobs:
+  build:
+    name: Build Sysbox (Static / DEB)
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository and submodules
+        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a
+        with:
+          submodules: recursive
+          fetch-depth: 0
+
+      - name: Build Sysbox
+        run: |
+          make sysbox-static
+
+      - name: Locate generated .deb packages
+        run: |
+          find . -type f -name "*.deb" -ls
+
+      - name: Upload DEB artifacts
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
+        with:
+          name: sysbox-deb-packages
+          path: "**/*.deb"
+          if-no-files-found: error
diff --git a/.gitmodules b/.gitmodules
index a016477a4..6b3a2070a 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -6,16 +6,16 @@
 	url = ../sysbox-runc.git
 [submodule "sysbox-ipc"]
 	path = sysbox-ipc
-	url = ../sysbox-ipc.git
+	url = git@github.com:nestybox/sysbox-ipc
 [submodule "sysbox-mgr"]
 	path = sysbox-mgr
-	url = ../sysbox-mgr.git
+	url = git@github.com:nestybox/sysbox-mgr
 [submodule "sysbox-libs"]
 	path = sysbox-libs
-	url = ../sysbox-libs.git
+	url = git@github.com:nestybox/sysbox-libs
 [submodule "sysbox-pkgr"]
 	path = sysbox-pkgr
-	url = ../sysbox-pkgr.git
+	url = git@github.com:nestybox/sysbox-pkgr
 [submodule "sysbox-dockerfiles"]
 	path = sysbox-dockerfiles
-	url = ../dockerfiles.git
+	url = git@github.com:nestybox/dockerfiles

From f2f18fdf2857978f180ca2ba09c6f47148f7f1ab Mon Sep 17 00:00:00 2001
From: Tomasz Pasternak <tomasz@engflow.com>
Date: Mon, 19 Oct 2026 11:18:00 +0200
Subject: [PATCH 02/35] Update bazil path

---
 sysbox-fs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sysbox-fs b/sysbox-fs
index b3179b68d..0824acb62 160000
--- a/sysbox-fs
+++ b/sysbox-fs
@@ -1 +1 @@
-Subproject commit b3179b68daf7688847c290fba22d39320ca7bcba
+Subproject commit 0824acb6293a07f6c592bf8a2c6f70fb6fa4435a

From af50a3de551686e71abd420ab59dd91003702e71 Mon Sep 17 00:00:00 2001
From: Tomasz Pasternak <tomasz@engflow.com>
Date: Mon, 19 Oct 2026 12:02:15 +0200
Subject: [PATCH 03/35] Update sysbox-fs (avoid dubious ownoership error)

---
 sysbox-fs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sysbox-fs b/sysbox-fs
index 0824acb62..4096e51ba 160000
--- a/sysbox-fs
+++ b/sysbox-fs
@@ -1 +1 @@
-Subproject commit 0824acb6293a07f6c592bf8a2c6f70fb6fa4435a
+Subproject commit 4096e51ba130cbe19fec50ed097bf9baad0ec93d

From f5522a4e287bc6a31920ad68d0293555eaefc977 Mon Sep 17 00:00:00 2001
From: Tomasz Pasternak <tomasz@engflow.com>
Date: Mon, 19 Oct 2026 12:17:14 +0200
Subject: [PATCH 04/35] Fix dubious ownership in sysbox-mgr

---
 .github/workflows/build.yml |  1 +
 sysbox-mgr.patch            | 19 +++++++++++++++++++
 2 files changed, 20 insertions(+)
 create mode 100644 sysbox-mgr.patch

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 6ed4bc3b5..4af199a74 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -21,6 +21,7 @@ jobs:
 
       - name: Build Sysbox
         run: |
+          (cd sysbox-mgr && git apply ../sysbox-mgr.patch)
           make sysbox-static
 
       - name: Locate generated .deb packages
diff --git a/sysbox-mgr.patch b/sysbox-mgr.patch
new file mode 100644
index 000000000..2a780332d
--- /dev/null
+++ b/sysbox-mgr.patch
@@ -0,0 +1,19 @@
+diff --git a/Makefile b/Makefile
+index 8de0a67..80e1999 100644
+--- a/Makefile
++++ b/Makefile
+@@ -21,10 +21,10 @@ SYSMGR_GRPC_SRC := $(shell find $(SYSMGR_GRPC_DIR) 2>&1 | grep -E '.*\.(c|h|go|p
+ SYSLIB_DIR := ../sysbox-libs
+ SYSLIB_SRC := $(shell find $(SYSLIB_DIR) 2>&1 | grep -E '.*\.(c|h|go|proto)$$')
+ 
+-COMMIT_NO := $(shell git rev-parse HEAD 2> /dev/null || true)
+-COMMIT ?= $(if $(shell git status --porcelain --untracked-files=no),$(COMMIT_NO)-dirty,$(COMMIT_NO))
+-BUILT_AT := $(shell date)
+-BUILT_BY := $(shell git config user.name)
++COMMIT_NO := "unset"
++COMMIT ?= "unset"
++BUILT_AT := "unset"
++BUILT_BY := "unset"
+ 
+ LDFLAGS := -X 'main.edition=${EDITION}' -X main.version=${VERSION} \
+ 		-X main.commitId=$(COMMIT) -X 'main.builtAt=$(BUILT_AT)' \

From 31fbda217d9db6e7186ae4f99475d815354307fe Mon Sep 17 00:00:00 2001
From: Tomasz Pasternak <tomasz@engflow.com>
Date: Mon, 19 Oct 2026 12:29:47 +0200
Subject: [PATCH 05/35] Fix dubious ownership in sysbox-runc

---
 .github/workflows/build.yml |  1 +
 sysbox-runc.patch           | 19 +++++++++++++++++++
 2 files changed, 20 insertions(+)
 create mode 100644 sysbox-runc.patch

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 4af199a74..1c392d164 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -22,6 +22,7 @@ jobs:
       - name: Build Sysbox
         run: |
           (cd sysbox-mgr && git apply ../sysbox-mgr.patch)
+          (cd sysbox-runc && git apply ../sysbox-runc.patch)
           make sysbox-static
 
       - name: Locate generated .deb packages
diff --git a/sysbox-runc.patch b/sysbox-runc.patch
new file mode 100644
index 000000000..9306a5181
--- /dev/null
+++ b/sysbox-runc.patch
@@ -0,0 +1,19 @@
+diff --git a/Makefile b/Makefile
+index 1cb90bb9..647490d5 100644
+--- a/Makefile
++++ b/Makefile
+@@ -38,10 +38,10 @@ RUNC_IMAGE := runc_dev$(if $(GIT_BRANCH_CLEAN),:$(GIT_BRANCH_CLEAN))
+ NBOX := /root/nestybox
+ RUNC := $(NBOX)/sysbox-runc
+ 
+-COMMIT_NO := $(shell git rev-parse HEAD 2> /dev/null || true)
+-COMMIT ?= $(if $(shell git status --porcelain --untracked-files=no),$(COMMIT_NO)-dirty,$(COMMIT_NO))
+-BUILT_AT := $(shell date)
+-BUILT_BY := $(shell git config user.name)
++COMMIT_NO := "unset"
++COMMIT ?= "unset"
++BUILT_AT := "unset"
++BUILT_BY := "unset"
+ 
+ SYSIPC_DIR := ../sysbox-ipc
+ SYSIPC_SRC := $(shell find $(SYSIPC_DIR) 2>&1 | grep -E '.*\.(c|h|go|proto)$$')

From 677520afc586bfba1f6b49aa044959288e61c9f2 Mon Sep 17 00:00:00 2001
From: Tomasz Pasternak <tomasz@engflow.com>
Date: Mon, 19 Oct 2026 12:47:01 +0200
Subject: [PATCH 06/35] Try build on 26.04

---
 .github/workflows/build.yml      |   2 +-
 tests/Dockerfile.ubuntu-resolute | 226 +++++++++++++++++++++++++++++++
 2 files changed, 227 insertions(+), 1 deletion(-)
 create mode 100644 tests/Dockerfile.ubuntu-resolute

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1c392d164..288053bd0 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -10,7 +10,7 @@ on:
 jobs:
   build:
     name: Build Sysbox (Static / DEB)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
 
     steps:
       - name: Checkout repository and submodules
diff --git a/tests/Dockerfile.ubuntu-resolute b/tests/Dockerfile.ubuntu-resolute
new file mode 100644
index 000000000..a136ad21d
--- /dev/null
+++ b/tests/Dockerfile.ubuntu-resolute
@@ -0,0 +1,226 @@
+#
+# Sysbox Test Container Dockerfile (Ubuntu-Noble image)
+#
+# This Dockerfile creates the sysbox test container image. The image
+# contains all dependencies needed to build, run, and test sysbox.
+#
+# The image does not contain sysbox itself; the sysbox repo
+# must be bind mounted into the image. It can then be built,
+# installed, and executed within the container.
+#
+# The image must be run as a privileged container (i.e., docker run --privileged ...)
+# Refer to the sysbox Makefile test targets.
+#
+# This Dockerfile is based on a similar Dockerfile in the OCI runc
+# github repo, but adapted to sysbox testing.
+#
+# Instructions:
+#
+# docker build -t sysbox-test .
+#
+
+FROM ubuntu:noble
+
+# K8s version for k8s-in-docker (i.e., this should be equal or greater than the
+# version of K8s running inside the k8s-in-docker container).
+ARG k8s_version=v1.28
+ARG k8s_version_full=v1.28.2
+
+# CRI-O & crictl version for testing sysbox pods; should match K8s version.
+ARG crio_version=v1.28
+ARG crictl_version=v1.28.0
+
+# Desired platform architecture to build upon.
+ARG sys_arch
+ENV SYS_ARCH=${sys_arch}
+ARG target_arch
+ENV TARGET_ARCH=${target_arch}
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y \
+    acl \
+    build-essential \
+    gcc-x86-64-linux-gnu \
+    libc6-dev-amd64-cross \
+    linux-libc-dev-amd64-cross \
+    gcc-aarch64-linux-gnu \
+    libc6-dev-arm64-cross \
+    linux-libc-dev-arm64-cross \
+    gcc-arm-linux-gnueabi \
+    libc6-dev-armel-cross \
+    linux-libc-dev-armel-cross \
+    gcc-arm-linux-gnueabihf \
+    libc6-dev-armhf-cross \
+    linux-libc-dev-armhf-cross \
+    automake \
+    autoconf \
+    libtool \
+    procps \
+    psmisc \
+    nano \
+    less \
+    curl \
+    sudo \
+    gawk \
+    git \
+    iptables \
+    jq \
+    pkg-config \
+    libaio-dev \
+    libcap-dev \
+    libprotobuf-dev \
+    libnl-3-dev \
+    libnet-dev \
+    libseccomp2 \
+    libseccomp-dev \
+    protobuf-c-compiler \
+    protobuf-compiler \
+    python3 \
+    uidmap \
+    kmod \
+    unzip \
+    time \
+    net-tools \
+    lsb-release \
+    wget \
+    lsof \
+    iproute2 \
+    iputils-ping \
+    ca-certificates \
+    bc \
+    ssh-client \
+    shellcheck \
+    gperf \
+    # sysbox deps
+    fuse3 \
+    rsync \
+    bash-completion \
+    attr \
+    tree \
+    strace \
+    --no-install-recommends \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* \
+    && echo ". /etc/bash_completion" >> /etc/bash.bashrc \
+    && ssh-keygen -t rsa -N "" -f ~/.ssh/id_rsa \
+    && echo "    StrictHostKeyChecking accept-new" >> /etc/ssh/ssh_config
+
+# Install Golang
+RUN wget https://go.dev/dl/go1.24.9.linux-${sys_arch}.tar.gz && \
+    tar -C /usr/local -xzf go1.24.9.linux-${sys_arch}.tar.gz && \
+    /usr/local/go/bin/go env -w GONOSUMDB=/root/nestybox
+
+ENV GOPATH=/go
+ENV PATH=$GOPATH/bin:/usr/local/go/bin:$PATH
+RUN go env -w GONOSUMDB=/root/nestybox && \
+    mkdir -p "$GOPATH/src" "$GOPATH/bin" && \
+    chmod -R 777 "$GOPATH"
+
+# Add a dummy user for the rootless integration tests; needed by the
+# `git clone` operations below.
+RUN useradd -u2000 -m -d/home/rootless -s/bin/bash rootless
+
+# install bats
+RUN cd /tmp \
+    && git clone https://github.com/sstephenson/bats.git \
+    && cd bats \
+    && git reset --hard 03608115df2071fff4eaaff1605768c275e5f81f \
+    && ./install.sh /usr/local \
+    && rm -rf /tmp/bats
+
+# install protoc compiler for gRPC
+RUN if [ "$sys_arch" = "amd64" ] ; then arch_str="x86_64"; \
+    elif [ "$sys_arch" = "arm64" ]; then arch_str="aarch_64"; \
+    else echo "Unsupported platform: ${sys_arch}"; exit; fi \
+    && curl -LO https://github.com/protocolbuffers/protobuf/releases/download/v3.15.8/protoc-3.15.8-linux-${arch_str}.zip \
+    && unzip protoc-3.15.8-linux-${arch_str}.zip -d $HOME/.local \
+    && export PATH="$PATH:$HOME/.local/bin" \
+    && go install github.com/golang/protobuf/protoc-gen-go@latest \
+    && export PATH="$PATH:$(go env GOPATH)/bin"
+
+# Install Docker
+RUN curl -fsSL https://get.docker.com -o get-docker.sh \
+    && sh get-docker.sh
+ADD https://raw.githubusercontent.com/docker/docker-ce/master/components/cli/contrib/completion/bash/docker /etc/bash_completion.d/docker.sh
+
+# Go Dlv for debugging
+RUN go install github.com/go-delve/delve/cmd/dlv@latest
+
+# Install Kubectl for k8s-in-docker integration-testing. Notice that we are explicitly
+# stating the kubectl version to download, which should match the K8s release
+# deployed in the K8s-in-docker nodes (L2).
+RUN cd /tmp && curl -LO "https://dl.k8s.io/release/${k8s_version_full}/bin/linux/amd64/kubectl" \
+    && install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl \
+    && rm /tmp/kubectl
+
+# Install the upstream CRI-O so we get the cri-o binary plus all config files,
+# etc. Later we will replace the binary with our forked Nestybox CRI-O that
+# works with Sysbox.
+#
+# Instructions: https://cri-o.io/
+RUN apt-get update && apt-get install -y gpg software-properties-common
+RUN curl -fsSL https://download.opensuse.org/repositories/isv:/cri-o:/stable:/${crio_version}/deb/Release.key | gpg --dearmor -o /etc/apt/keyrings/cri-o-apt-keyring.gpg \
+    && echo "deb [signed-by=/etc/apt/keyrings/cri-o-apt-keyring.gpg] https://download.opensuse.org/repositories/isv:/cri-o:/stable:/${crio_version}/deb/ /" | tee /etc/apt/sources.list.d/cri-o.list \
+    && apt-get update \
+    && apt-get install -y cri-o
+
+# Build and install the Nestybox CRI-O (for testing deployment of pods with sysbox (aka "sysbox pods"))
+# NOTE: unlike prior Ubuntu distros, requires explicit CGO_LDFLAGS for lgpgme, lpgpg-error, and lassuan when building CRI-O.
+RUN apt-get update && apt-get install -y --no-install-recommends libgpgme-dev libgpg-error-dev libassuan-dev \
+    && mkdir -p /tmp/crio-build \
+    && git clone https://github.com/nestybox/cri-o.git /tmp/crio-build/cri-o \
+    && git -C /tmp/crio-build/cri-o checkout -b ${crio_version}-sysbox origin/${crio_version}-sysbox \
+    && export CGO_LDFLAGS="-lgpgme -lgpg-error -lassuan" && cd /tmp/crio-build/cri-o && make binaries \
+    && mv /usr/bin/crio /usr/bin/crio.orig \
+    && cp /tmp/crio-build/cri-o/bin/crio-static /usr/bin/crio \
+    && rm -rf /tmp/crio-build
+
+RUN wget https://github.com/kubernetes-sigs/cri-tools/releases/download/${crictl_version}/crictl-${crictl_version}-linux-${sys_arch}.tar.gz \
+    && sudo tar zxvf crictl-${crictl_version}-linux-${sys_arch}.tar.gz -C /usr/local/bin \
+    && rm -f crictl-${crictl_version}-linux-${sys_arch}.tar.gz
+
+# Container CNIs (needed by CRI-O)
+RUN curl -fsSL https://pkgs.k8s.io/core:/stable:/${k8s_version}/deb/Release.key | gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg \
+    && echo "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/${k8s_version}/deb/ /" | tee /etc/apt/sources.list.d/kubernetes.list \
+    && apt-get update \
+    && apt-get install kubernetes-cni
+
+# Dasel (for yaml, toml, json parsing) (https://github.com/TomWright/dasel)
+# Note: manually download Dasel v1 as our testContainerInit script does not yet support Dasel v2.
+RUN wget https://github.com/TomWright/dasel/releases/download/v1.27.2/dasel_linux_${sys_arch} &&  mv dasel_linux_${sys_arch} dasel && chmod +x dasel \
+    && mv ./dasel /usr/local/bin/dasel
+
+# K8s.io KinD
+RUN go install sigs.k8s.io/kind@v0.24.0
+
+# Use the old definition for SECCOMP_NOTIF_ID_VALID in /usr/include/linux/seccomp.h
+#
+# This is needed because the definition changed in the mainline kernel
+# on 06/2020 (from SECCOMP_IOR -> SECCOMP_IOW), and some distros we
+# support have picked it up in their latest releases / kernels
+# updates. The kernel change was backward compatible, so by using the
+# old definition, we are guaranteed it will work on kernels before and
+# after the change. On the other hand, if we were to use the new
+# definition, seccomp notify would fail when sysbox runs in old
+# kernels.
+RUN sed -i 's/^#define SECCOMP_IOCTL_NOTIF_ID_VALID[ \t]*SECCOMP_IOW(2, __u64)/#define SECCOMP_IOCTL_NOTIF_ID_VALID   SECCOMP_IOR(2, __u64)/g' /usr/include/linux/seccomp.h
+
+# Paketo buildpacks
+RUN add-apt-repository ppa:cncf-buildpacks/pack-cli \
+    && apt-get update \
+    && apt-get install -y pack-cli
+
+# sysbox env
+RUN useradd sysbox \
+    && mkdir -p /var/lib/sysboxfs
+
+# test scripts
+COPY scr/testContainerInit /usr/bin
+COPY scr/testContainerCleanup /usr/bin
+COPY scr/buildContainerInit /usr/bin
+COPY bin/userns_child_exec_${sys_arch} /usr/bin
+
+RUN mkdir -p /root/nestybox
+WORKDIR /root/nestybox/sysbox
+CMD ["/bin/bash"]

From 7b546406b0a80e764f37cc29bde112729ddccdce Mon Sep 17 00:00:00 2001
From: Tomasz Pasternak <tomasz@engflow.com>
Date: Mon, 19 Oct 2026 13:03:51 +0200
Subject: [PATCH 07/35] Show docker version

---
 .github/workflows/build.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 288053bd0..a67aacbcc 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -13,6 +13,9 @@ jobs:
     runs-on: ubuntu-26.04
 
     steps:
+      - name: Show versions
+        run: |
+          docker --version
       - name: Checkout repository and submodules
         uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a
         with:

From 81110aef7ab65fd21c5b615ce6cbff20098aa612 Mon Sep 17 00:00:00 2001
From: Tomasz Pasternak <tomasz@engflow.com>
Date: Mon, 19 Oct 2026 13:34:34 +0200
Subject: [PATCH 08/35] Adapt to new protobuf generation way

https://github.com/nestybox/sysbox-ipc/commit/08b9f76007621467e4aec877d365f90dfb65531b
---
 tests/Dockerfile.ubuntu-resolute | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/Dockerfile.ubuntu-resolute b/tests/Dockerfile.ubuntu-resolute
index a136ad21d..6bd914f10 100644
--- a/tests/Dockerfile.ubuntu-resolute
+++ b/tests/Dockerfile.ubuntu-resolute
@@ -137,6 +137,7 @@ RUN if [ "$sys_arch" = "amd64" ] ; then arch_str="x86_64"; \
     && unzip protoc-3.15.8-linux-${arch_str}.zip -d $HOME/.local \
     && export PATH="$PATH:$HOME/.local/bin" \
     && go install github.com/golang/protobuf/protoc-gen-go@latest \
+    && go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest \
     && export PATH="$PATH:$(go env GOPATH)/bin"
 
 # Install Docker

From 6ac20aca5d19e001c29740e20616a7d1799b52b4 Mon Sep 17 00:00:00 2001
From: Tomasz Pasternak <tomasz@engflow.com>
Date: Mon, 19 Oct 2026 14:15:44 +0200
Subject: [PATCH 09/35] Build deb on CI

---
 .github/workflows/build.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a67aacbcc..319da8398 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -26,7 +26,8 @@ jobs:
         run: |
           (cd sysbox-mgr && git apply ../sysbox-mgr.patch)
           (cd sysbox-runc && git apply ../sysbox-runc.patch)
-          make sysbox-static
+          # make sysbox-static
+          (cd sysbox-pkgr && make sysbox-deb ubuntu)
 
       - name: Locate generated .deb packages
         run: |

From 4e428336b735deb2e915ba2dc2d4c85b59931835 Mon Sep 17 00:00:00 2001
From: Tomasz Pasternak <tomasz@engflow.com>
Date: Mon, 19 Oct 2026 14:21:07 +0200
Subject: [PATCH 10/35] Build: Fix to jammy

---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 319da8398..2e99c9ac0 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -27,7 +27,7 @@ jobs:
           (cd sysbox-mgr && git apply ../sysbox-mgr.patch)
           (cd sysbox-runc && git apply ../sysbox-runc.patch)
           # make sysbox-static
-          (cd sysbox-pkgr && make sysbox-deb ubuntu)
+          (cd sysbox-pkgr && make sysbox-deb ubuntu-jammy)
 
       - name: Locate generated .deb packages
         run: |

From cd2da33e52d5e6e26fd41b56fa3d98d84e8c6195 Mon Sep 17 00:00:00 2001
From: Tomasz Pasternak <tomasz@engflow.com>
Date: Mon, 19 Oct 2026 14:31:04 +0200
Subject: [PATCH 11/35] Switch deb build to resolute

---
 .github/workflows/build.yml |   1 +
 sysbox-pkgr.patch           | 135 ++++++++++++++++++++++++++++++++++++
 2 files changed, 136 insertions(+)
 create mode 100644 sysbox-pkgr.patch

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 2e99c9ac0..e7af4dad4 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -26,6 +26,7 @@ jobs:
         run: |
           (cd sysbox-mgr && git apply ../sysbox-mgr.patch)
           (cd sysbox-runc && git apply ../sysbox-runc.patch)
+          (cd sysbox-pkgr && git apply ../sysbox-pkgr.patch)
           # make sysbox-static
           (cd sysbox-pkgr && make sysbox-deb ubuntu-jammy)
 
diff --git a/sysbox-pkgr.patch b/sysbox-pkgr.patch
new file mode 100644
index 000000000..b7710032d
--- /dev/null
+++ b/sysbox-pkgr.patch
@@ -0,0 +1,135 @@
+diff --git a/deb/Makefile b/deb/Makefile
+index 6875870..5a47761 100644
+--- a/deb/Makefile
++++ b/deb/Makefile
+@@ -11,6 +11,7 @@
+ 	ubuntu-bionic      \
+ 	ubuntu-focal       \
+ 	ubuntu-jammy       \
++	ubuntu-resolute    \
+ 	clean
+ 
+ SHELL:=/bin/bash
+@@ -31,7 +32,7 @@ endif
+ # that this is currently a requirement to build official Sysbox
+ # packages as only Impish (or later) carries ID-mapped mount support
+ # in the kernel and associated clibs.
+-RELEASE_BASELINE_IMAGE=ubuntu-jammy
++RELEASE_BASELINE_IMAGE=ubuntu-resolute
+ 
+ # Go version to utilize in building process.
+ GO_BASE_IMAGE=golang
+@@ -150,6 +151,13 @@ ubuntu-jammy: $(SOURCES)
+ 	$(DOCKER_RUN)
+ 	$(CHOWN) -R $(shell id -u):$(shell id -g) build/$(ARCH)/$@
+ 
++ubuntu-resolute: ## Build Ubuntu Resolute package
++ubuntu-resolute: $(SOURCES)
++	@echo "== Building packages for $@ =="
++	$(DOCKER_BUILD)
++	$(DOCKER_RUN)
++	$(CHOWN) -R $(shell id -u):$(shell id -g) build/$(ARCH)/$@
++
+ generic: ## Build generic deb package (release purposes)
+ generic: $(SOURCES)
+ 	@echo "== Building generic release package"
+diff --git a/deb/ubuntu-resolute/Dockerfile b/deb/ubuntu-resolute/Dockerfile
+new file mode 100644
+index 0000000..4059c61
+--- /dev/null
++++ b/deb/ubuntu-resolute/Dockerfile
+@@ -0,0 +1,94 @@
++ARG GO_IMAGE
++ARG BASE_IMAGE=ubuntu:resolute
++ARG DEBIAN_FRONTEND=noninteractive
++
++FROM ${GO_IMAGE} as golang
++
++FROM ${BASE_IMAGE}
++
++RUN echo 'debconf debconf/frontend select Noninteractive' | debconf-set-selections && \
++    apt-get update &&                            \
++    apt-get install -y --no-install-recommends   \
++    build-essential                              \
++    ca-certificates                              \
++    devscripts                                   \
++    equivs                                       \
++    git                                          \
++    wget                                         \
++    pkg-config                                   \
++    libnet-dev                                   \
++    libseccomp2                                  \
++    libseccomp-dev                               \
++    iproute2                                     \
++    kmod                                         \
++    curl                                         \
++    unzip &&                                     \
++    \
++    # Housekeeping
++    apt-get clean -y &&                          \
++    rm -rf                                       \
++    /var/cache/debconf/*                         \
++    /var/lib/apt/lists/*                         \
++    /var/log/*                                   \
++    /tmp/*                                       \
++    /var/tmp/*                                   \
++    /usr/share/doc/*                             \
++    /usr/share/man/*                             \
++    /usr/share/local/*
++
++ARG arch
++ENV ARCH=${arch}
++ENV GOPATH /go
++ENV PATH $PATH:/usr/local/go/bin:$GOPATH/bin:/root/.local/bin
++
++ARG DEB_FILES
++COPY ${DEB_FILES} /root/build-deb/debian
++RUN mk-build-deps -t "apt-get -o Debug::pkgProblemResolver=yes --no-install-recommends -y" -i /root/build-deb/debian/control
++
++ENV BASE_IMAGE=${BASE_IMAGE}
++ENV SYSBOX_RELEASE true
++
++COPY --from=golang /usr/local/go /usr/local/go
++
++# Let's explicitly set go-module feature to 'auto' mode (default as per Go 1.13) to avoid
++# potential changes to this feature's default mode in the future. Even though we are
++# relying on modules for the package's building process, we are enabling 'auto' mode to
++# allow 'go get' traditional behavior (fetch entire git repo). Notice that we need git's
++# metadata to allow a git-checkout operation further below.
++ENV GO111MODULE=auto
++RUN go env -w GONOSUMDB=github.com/nestybox
++
++# Install protoc compiler for gRPC.
++RUN if [ "${arch}" = "amd64" ]; then arch_str="x86_64"; \
++    elif [ "${arch}" = "arm64" ]; then arch_str="aarch_64"; \
++    else echo "Unsupported platform: ${arch}"; exit; fi \
++    && curl -LO https://github.com/protocolbuffers/protobuf/releases/download/v3.15.8/protoc-3.15.8-linux-${arch_str}.zip \
++    && unzip protoc-3.15.8-linux-${arch_str}.zip -d $HOME/.local \
++    && export PATH="$PATH:$HOME/.local/bin" \
++    && go install github.com/golang/protobuf/protoc-gen-go@latest \
++    && go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest \
++    && export PATH="$PATH:$(go env GOPATH)/bin"
++
++# Install Docker
++RUN curl -fsSL https://get.docker.com -o get-docker.sh \
++    && sh get-docker.sh
++ADD https://raw.githubusercontent.com/docker/docker-ce/master/components/cli/contrib/completion/bash/docker /etc/bash_completion.d/docker.sh
++
++# Use the old definition for SECCOMP_NOTIF_ID_VALID in /usr/include/linux/seccomp.h
++#
++# This is needed because the definition changed in the mainline kernel
++# on 06/2020 (from SECCOMP_IOR -> SECCOMP_IOW), and some distros we
++# support have picked it up in their latest releases / kernels
++# updates. The kernel change was backward compatible, so by using the
++# old definition, we are guaranteed it will work on kernels before and
++# after the change. On the other hand, if we were to use the new
++# definition, seccomp notify would fail when sysbox runs in old
++# kernels.
++RUN sed -i 's/^#define SECCOMP_IOCTL_NOTIF_ID_VALID[ \t]*SECCOMP_IOW(2, __u64)/#define SECCOMP_IOCTL_NOTIF_ID_VALID   SECCOMP_IOR(2, __u64)/g' /usr/include/linux/seccomp.h
++
++WORKDIR /root/build-deb
++COPY sources/ /sources
++COPY build-deb /root/build-deb/build-deb
++COPY changelog_convert.sh /root/build-deb/changelog_convert.sh
++
++ENTRYPOINT ["/root/build-deb/build-deb"]

From f6cfc8c744865ddf0c068638a8d61d474448a723 Mon Sep 17 00:00:00 2001
From: Tomasz Pasternak <tomasz@engflow.com>
Date: Mon, 19 Oct 2026 14:51:05 +0200
Subject: [PATCH 12/35] Switch to resolute

---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index e7af4dad4..a0a291306 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -28,7 +28,7 @@ jobs:
           (cd sysbox-runc && git apply ../sysbox-runc.patch)
           (cd sysbox-pkgr && git apply ../sysbox-pkgr.patch)
           # make sysbox-static
-          (cd sysbox-pkgr && make sysbox-deb ubuntu-jammy)
+          (cd sysbox-pkgr && make sysbox-deb ubuntu-resolute)
 
       - name: Locate generated .deb packages
         run: |

From 5d621d246771de855265424983250008b71116a2 Mon Sep 17 00:00:00 2001
From: Tomasz Pasternak <tomasz@engflow.com>
Date: Mon, 19 Oct 2026 14:56:54 +0200
Subject: [PATCH 13/35] update golang version to support the new grpc generator

---
 sysbox-pkgr.patch | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/sysbox-pkgr.patch b/sysbox-pkgr.patch
index b7710032d..21927c11a 100644
--- a/sysbox-pkgr.patch
+++ b/sysbox-pkgr.patch
@@ -1,5 +1,5 @@
 diff --git a/deb/Makefile b/deb/Makefile
-index 6875870..5a47761 100644
+index 6875870..dbfd1f3 100644
 --- a/deb/Makefile
 +++ b/deb/Makefile
 @@ -11,6 +11,7 @@
@@ -10,7 +10,7 @@ index 6875870..5a47761 100644
  	clean
  
  SHELL:=/bin/bash
-@@ -31,7 +32,7 @@ endif
+@@ -31,11 +32,11 @@ endif
  # that this is currently a requirement to build official Sysbox
  # packages as only Impish (or later) carries ID-mapped mount support
  # in the kernel and associated clibs.
@@ -19,6 +19,11 @@ index 6875870..5a47761 100644
  
  # Go version to utilize in building process.
  GO_BASE_IMAGE=golang
+-GO_VERSION:=1.22
++GO_VERSION:=1.26
+ GO_IMAGE=$(GO_BASE_IMAGE):$(GO_VERSION)
+ 
+ # Sysbox source-code locations.
 @@ -150,6 +151,13 @@ ubuntu-jammy: $(SOURCES)
  	$(DOCKER_RUN)
  	$(CHOWN) -R $(shell id -u):$(shell id -g) build/$(ARCH)/$@

From 1d3768c8af700cd41c0644ab395531acd007efbc Mon Sep 17 00:00:00 2001
From: Tomasz Pasternak <tomasz@engflow.com>
Date: Mon, 19 Oct 2026 15:29:39 +0200
Subject: [PATCH 14/35] converter patch

---
 .github/workflows/build.yml |  1 +
 changelog-converter.patch   | 27 +++++++++++++++++++++++++++
 2 files changed, 28 insertions(+)
 create mode 100644 changelog-converter.patch

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a0a291306..9ed6e565d 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -27,6 +27,7 @@ jobs:
           (cd sysbox-mgr && git apply ../sysbox-mgr.patch)
           (cd sysbox-runc && git apply ../sysbox-runc.patch)
           (cd sysbox-pkgr && git apply ../sysbox-pkgr.patch)
+          (cd sysbox-pkgr && git apply ../changelog-converter.patch)
           # make sysbox-static
           (cd sysbox-pkgr && make sysbox-deb ubuntu-resolute)
 
diff --git a/changelog-converter.patch b/changelog-converter.patch
new file mode 100644
index 000000000..3c445267b
--- /dev/null
+++ b/changelog-converter.patch
@@ -0,0 +1,27 @@
+diff --git a/deb/changelog_convert.sh b/deb/changelog_convert.sh
+index 036bde0..b6e1f6d 100755
+--- a/deb/changelog_convert.sh
++++ b/deb/changelog_convert.sh
+@@ -95,19 +95,9 @@ function print_tag_trailer() {
+     local tag=$1
+     local unreleased=$2
+ 
+-    local tag_author=""
+-    local tag_email=""
+-    local tag_date=""
+-
+-    if [[ "$unreleased" = true ]]; then
+-        tag_author=$(git config user.name)
+-        tag_email=$(git config user.email)
+-        tag_date=$(date --rfc-2822)
+-    else
+-        tag_author=$(git -C sysbox log -1 --format=%aN v$1)
+-        tag_email=$(git -C sysbox log -1 --format=%ae v$1)
+-        tag_date=$(git -C sysbox log -1 --format=%aD v$tag)
+-    fi
++    local tag_author="author"
++    local tag_email="author@localhost"
++    local tag_date=$(date --rfc-2822)
+ 
+     echo -e "\n -- ${tag_author} <${tag_email}>  ${tag_date}\n"
+ }

From bbc2c22daa0ccbe112738289d9bf7e8d4a27da50 Mon Sep 17 00:00:00 2001
From: Tomasz Pasternak <tomasz@engflow.com>
Date: Mon, 19 Oct 2026 16:02:38 +0200
Subject: [PATCH 15/35] Trick to work around always broken makefile

---
 .github/workflows/build.yml                 |  1 +
 trick-to-workarount-always-fail-setup.patch | 14 ++++++++++++++
 2 files changed, 15 insertions(+)
 create mode 100644 trick-to-workarount-always-fail-setup.patch

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 9ed6e565d..508163d55 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -28,6 +28,7 @@ jobs:
           (cd sysbox-runc && git apply ../sysbox-runc.patch)
           (cd sysbox-pkgr && git apply ../sysbox-pkgr.patch)
           (cd sysbox-pkgr && git apply ../changelog-converter.patch)
+          (cd sysbox-pkgr && git apply ../trick-to-workarount-always-fail-setup.patch)
           # make sysbox-static
           (cd sysbox-pkgr && make sysbox-deb ubuntu-resolute)
 
diff --git a/trick-to-workarount-always-fail-setup.patch b/trick-to-workarount-always-fail-setup.patch
new file mode 100644
index 000000000..02c827a61
--- /dev/null
+++ b/trick-to-workarount-always-fail-setup.patch
@@ -0,0 +1,14 @@
+diff --git a/Makefile b/Makefile
+index 2df228f..9b3e2aa 100644
+--- a/Makefile
++++ b/Makefile
+@@ -127,3 +127,9 @@ clean-ce-deb: ## Remove sysbox-ce DEB package
+ clean-ce-rpm: ## Remove sysbox-ce RPM package
+ 	$(eval export EDITION=ce)
+ 	$(MAKE) -C rpm --no-print-directory clean
++
++ubuntu-resolute:
++	echo "Maybe built"
++
++.PHONY: ubuntu-resolute
++

From b3b616ef0ab2941bcde079c225f55dcd4c0f1ad3 Mon Sep 17 00:00:00 2001
From: Tomasz Pasternak <tomasz@engflow.com>
Date: Tue, 20 Oct 2026 09:08:36 +0200
Subject: [PATCH 16/35] Run tests, too

---
 .github/workflows/build.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 508163d55..eb6ece9b7 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -22,6 +22,10 @@ jobs:
           submodules: recursive
           fetch-depth: 0
 
+      - name: Test Sysbox
+        run: |
+          make test
+
       - name: Build Sysbox
         run: |
           (cd sysbox-mgr && git apply ../sysbox-mgr.patch)

From f95c4b22554dff5ee7fadd8c30830a190a3a0540 Mon Sep 17 00:00:00 2001
From: Tomasz Pasternak <tomasz@engflow.com>
Date: Tue, 20 Oct 2026 09:46:42 +0200
Subject: [PATCH 17/35] Do not call Errorf with non-constant strings

---
 .github/workflows/build.yml       |  7 +--
 sysbox-mgr-dont-call-errorf.patch | 87 +++++++++++++++++++++++++++++++
 2 files changed, 91 insertions(+), 3 deletions(-)
 create mode 100644 sysbox-mgr-dont-call-errorf.patch

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index eb6ece9b7..9bb2e9bdf 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -24,16 +24,17 @@ jobs:
 
       - name: Test Sysbox
         run: |
+          (cd sysbox-mgr && git apply  ../sysbox-mgr-dont-call-errorf.patch)
+          (cd sysbox-mgr && git apply ../sysbox-mgr.patch)
+          (cd sysbox-runc && git apply ../sysbox-runc.patch)
+
           make test
 
       - name: Build Sysbox
         run: |
-          (cd sysbox-mgr && git apply ../sysbox-mgr.patch)
-          (cd sysbox-runc && git apply ../sysbox-runc.patch)
           (cd sysbox-pkgr && git apply ../sysbox-pkgr.patch)
           (cd sysbox-pkgr && git apply ../changelog-converter.patch)
           (cd sysbox-pkgr && git apply ../trick-to-workarount-always-fail-setup.patch)
-          # make sysbox-static
           (cd sysbox-pkgr && make sysbox-deb ubuntu-resolute)
 
       - name: Locate generated .deb packages
diff --git a/sysbox-mgr-dont-call-errorf.patch b/sysbox-mgr-dont-call-errorf.patch
new file mode 100644
index 000000000..a9fb81e8d
--- /dev/null
+++ b/sysbox-mgr-dont-call-errorf.patch
@@ -0,0 +1,87 @@
+diff --git a/utils_test.go b/utils_test.go
+index 5776272..05b3bb7 100644
+--- a/utils_test.go
++++ b/utils_test.go
+@@ -232,7 +232,7 @@ user2:165536:65536
+ sysbox:231072:268435456
+ `
+ 	if err := testConfigSubidRangeHelper(subidFilePre, subidFilePost, 268435456, 100000, 600100000); err != nil {
+-		t.Errorf(err.Error())
++		t.Error(err.Error())
+ 	}
+ 
+ 	// at beginning of range
+@@ -241,7 +241,7 @@ sysbox:231072:268435456
+ user2:165536:65536`
+ 
+ 	if err := testConfigSubidRangeHelper(subidFilePre, subidFilePost, 65536, 100000, 600100000); err != nil {
+-		t.Errorf(err.Error())
++		t.Error(err.Error())
+ 	}
+ 
+ 	// in the middle of range
+@@ -252,13 +252,13 @@ sysbox:165536:65536
+ user2:231072:65536`
+ 
+ 	if err := testConfigSubidRangeHelper(subidFilePre, subidFilePost, 65536, 100000, 600100000); err != nil {
+-		t.Errorf(err.Error())
++		t.Error(err.Error())
+ 	}
+ 
+ 	// not enought ids
+ 	subidFilePre = `user1:100000:65536`
+ 	if err := testConfigSubidRangeHelper(subidFilePre, subidFilePost, 600034465, 100000, 600100000); err == nil {
+-		t.Errorf("configSubidRange(): expected alloc error, got no error")
++		t.Error("configSubidRange(): expected alloc error, got no error")
+ 	}
+ 
+ 	// do not disturb existing sysbox entry
+@@ -269,7 +269,7 @@ user3:296608:65536`
+ 	subidFilePost = subidFilePre
+ 
+ 	if err := testConfigSubidRangeHelper(subidFilePre, subidFilePost, 65536, 100000, 600100000); err != nil {
+-		t.Errorf(err.Error())
++		t.Error(err.Error())
+ 	}
+ 
+ 	// replace redundant sysbox entries with one entry
+@@ -283,7 +283,7 @@ user3:165536:65536
+ sysbox:231072,65536`
+ 
+ 	if err := testConfigSubidRangeHelper(subidFilePre, subidFilePost, 65536, 100000, 600100000); err != nil {
+-		t.Errorf(err.Error())
++		t.Error(err.Error())
+ 	}
+ }
+ 
+@@ -338,7 +338,7 @@ some data
+ 
+ 	want := []uint64{100000, 600100000, 100000, 2147483648}
+ 	if err := testGetSubidLimitsHelper(fileData, want); err != nil {
+-		t.Errorf(err.Error())
++		t.Error(err.Error())
+ 	}
+ 
+ 	// login.defs file without uid(gid) limits
+@@ -348,7 +348,7 @@ some data
+ 
+ 	want = []uint64{100000, 4294967295, 100000, 4294967295}
+ 	if err := testGetSubidLimitsHelper(fileData, want); err != nil {
+-		t.Errorf(err.Error())
++		t.Error(err.Error())
+ 	}
+ }
+ 
+diff --git a/volMgr/volMgr_test.go b/volMgr/volMgr_test.go
+index dad573e..6bbb182 100644
+--- a/volMgr/volMgr_test.go
++++ b/volMgr/volMgr_test.go
+@@ -191,7 +191,7 @@ func TestCreateVol(t *testing.T) {
+ 
+ 	// create the volume and verify all is good
+ 	if _, err := testCreateVolWork(id, hostDir, rootfs, mountpoint, uid, gid, false); err != nil {
+-		t.Errorf(err.Error())
++		t.Error(err.Error())
+ 	}
+ }
+ 

From fe373b12946966862cf9d53cc9142e2d3741f5a8 Mon Sep 17 00:00:00 2001
From: Tomasz Pasternak <tomasz@engflow.com>
Date: Tue, 20 Oct 2026 10:09:52 +0200
Subject: [PATCH 18/35] Install libseccomp for tests

---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 9bb2e9bdf..c5c6315e1 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -27,7 +27,7 @@ jobs:
           (cd sysbox-mgr && git apply  ../sysbox-mgr-dont-call-errorf.patch)
           (cd sysbox-mgr && git apply ../sysbox-mgr.patch)
           (cd sysbox-runc && git apply ../sysbox-runc.patch)
-
+          sudo apt update && sudo apt install libseccomp-dev
           make test
 
       - name: Build Sysbox

From 75c0e8016cca2e44eb115704abf14450db940928 Mon Sep 17 00:00:00 2001
From: Tomasz Pasternak <tomasz@engflow.com>
Date: Tue, 20 Oct 2026 10:33:15 +0200
Subject: [PATCH 19/35] Show versions

---
 .github/workflows/build.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index c5c6315e1..1cebc9bf8 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -15,7 +15,10 @@ jobs:
     steps:
       - name: Show versions
         run: |
+          echo "Docker"
           docker --version
+          echo "uname"
+          uname -a
       - name: Checkout repository and submodules
         uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a
         with:
@@ -27,7 +30,6 @@ jobs:
           (cd sysbox-mgr && git apply  ../sysbox-mgr-dont-call-errorf.patch)
           (cd sysbox-mgr && git apply ../sysbox-mgr.patch)
           (cd sysbox-runc && git apply ../sysbox-runc.patch)
-          sudo apt update && sudo apt install libseccomp-dev
           make test
 
       - name: Build Sysbox

From 37a140af41f9098d04743158059313e6985111b5 Mon Sep 17 00:00:00 2001
From: Tomasz Pasternak <tomasz@engflow.com>
Date: Tue, 20 Oct 2026 11:10:26 +0200
Subject: [PATCH 20/35] Disable test-runc, as it requires Debian 11 images

---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 39f47341e..63f73e71c 100644
--- a/Makefile
+++ b/Makefile
@@ -373,7 +373,7 @@ DOCKER_STOP := docker stop -t0 sysbox-test
 ##@ Testing targets
 
 test: ## Run all sysbox test suites
-test: test-fs test-mgr test-runc test-sysbox-libs test-sysbox test-sysbox-systemd
+test: test-fs test-mgr test-sysbox-libs test-sysbox test-sysbox-systemd
 
 test-sysbox: ## Run sysbox integration tests
 test-sysbox: test-prereq test-img

From 639e3fec2b4957e61c47774019b21688532813ab Mon Sep 17 00:00:00 2001
From: Tomasz Pasternak <tomasz@engflow.com>
Date: Tue, 20 Oct 2026 11:46:30 +0200
Subject: [PATCH 21/35] Disable apparmor fusermount3 for CI tests

---
 .github/workflows/build.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1cebc9bf8..14e900239 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -30,6 +30,8 @@ jobs:
           (cd sysbox-mgr && git apply  ../sysbox-mgr-dont-call-errorf.patch)
           (cd sysbox-mgr && git apply ../sysbox-mgr.patch)
           (cd sysbox-runc && git apply ../sysbox-runc.patch)
+          sudo apt update && sudo apt install apparmor-utils
+          sudo aa-complain fusermount3 # makes sense only in isolated enviroment, do not copy to bundles
           make test
 
       - name: Build Sysbox

From c8ac0426039175f7be955904251f3aecea9535d8 Mon Sep 17 00:00:00 2001
From: Tomasz Pasternak <tomasz@engflow.com>
Date: Tue, 20 Oct 2026 15:01:34 +0200
Subject: [PATCH 22/35] Split test and build into independent jobs (as tests
 fail)

---
 .github/workflows/build.yml | 31 ++++++++++++++++++++++++-------
 1 file changed, 24 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 14e900239..7de55e779 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -8,10 +8,9 @@ on:
   workflow_dispatch:
 
 jobs:
-  build:
-    name: Build Sysbox (Static / DEB)
+  test:
+    name: Test Sysbox
     runs-on: ubuntu-26.04
-
     steps:
       - name: Show versions
         run: |
@@ -19,6 +18,7 @@ jobs:
           docker --version
           echo "uname"
           uname -a
+
       - name: Checkout repository and submodules
         uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a
         with:
@@ -27,13 +27,30 @@ jobs:
 
       - name: Test Sysbox
         run: |
-          (cd sysbox-mgr && git apply  ../sysbox-mgr-dont-call-errorf.patch)
+          (cd sysbox-mgr && git apply ../sysbox-mgr-dont-call-errorf.patch)
           (cd sysbox-mgr && git apply ../sysbox-mgr.patch)
           (cd sysbox-runc && git apply ../sysbox-runc.patch)
-          sudo apt update && sudo apt install apparmor-utils
-          sudo aa-complain fusermount3 # makes sense only in isolated enviroment, do not copy to bundles
+          sudo apt update && sudo apt install -y apparmor-utils
+          sudo aa-complain fusermount3 # makes sense only in isolated environment, do not copy to bundles
           make test
 
+  build:
+    name: Build Sysbox (DEB)
+    runs-on: ubuntu-26.04
+    steps:
+      - name: Show versions
+        run: |
+          echo "Docker"
+          docker --version
+          echo "uname"
+          uname -a
+
+      - name: Checkout repository and submodules
+        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a
+        with:
+          submodules: recursive
+          fetch-depth: 0
+
       - name: Build Sysbox
         run: |
           (cd sysbox-pkgr && git apply ../sysbox-pkgr.patch)
@@ -50,4 +67,4 @@ jobs:
         with:
           name: sysbox-deb-packages
           path: "**/*.deb"
-          if-no-files-found: error
+          if-no-files-found: error
\ No newline at end of file

From 09c0344d1012d596a62dbb7a0e711335acf0ca1e Mon Sep 17 00:00:00 2001
From: Tomasz Pasternak <tomasz@engflow.com>
Date: Tue, 20 Oct 2026 15:10:43 +0200
Subject: [PATCH 23/35] Less generic artifacts path

---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 7de55e779..47e91e3f5 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -66,5 +66,5 @@ jobs:
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         with:
           name: sysbox-deb-packages
-          path: "**/*.deb"
+          path: "sysbox-pkgr/deb/build/*/*/sysbox-ce_*.linux_*.deb"
           if-no-files-found: error
\ No newline at end of file

From 44281b16e63d4308d4421d2b5aa38a07ea64df55 Mon Sep 17 00:00:00 2001
From: Tomasz Pasternak <tomasz@engflow.com>
Date: Tue, 20 Oct 2026 16:11:12 +0200
Subject: [PATCH 24/35] Annotate places that require maintainer and copyright
 info update

---
 .github/workflows/build.yml      |  1 +
 pkgr-copyright-and-license.patch | 42 ++++++++++++++++++++++++++++++++
 2 files changed, 43 insertions(+)
 create mode 100644 pkgr-copyright-and-license.patch

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 47e91e3f5..993d3c0e2 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -56,6 +56,7 @@ jobs:
           (cd sysbox-pkgr && git apply ../sysbox-pkgr.patch)
           (cd sysbox-pkgr && git apply ../changelog-converter.patch)
           (cd sysbox-pkgr && git apply ../trick-to-workarount-always-fail-setup.patch)
+          (cd sysbox-pkgr && git apply ../pkgr-copyright-and-license.patch)
           (cd sysbox-pkgr && make sysbox-deb ubuntu-resolute)
 
       - name: Locate generated .deb packages
diff --git a/pkgr-copyright-and-license.patch b/pkgr-copyright-and-license.patch
new file mode 100644
index 000000000..0cad3f282
--- /dev/null
+++ b/pkgr-copyright-and-license.patch
@@ -0,0 +1,42 @@
+diff --git a/deb/sysbox-ce/control b/deb/sysbox-ce/control
+index 8cc5766..3088556 100644
+--- a/deb/sysbox-ce/control
++++ b/deb/sysbox-ce/control
+@@ -1,12 +1,11 @@
+ Source: sysbox-ce
+ Section: admin
+ Priority: optional
+-Maintainer: Nestybox <contact@nestybox.com>
++Maintainer: unset <unset@localhost>
+ Build-Depends: debhelper (>= 10~),
+                bash,
+ Standards-Version: 4.1.4
+-Homepage: nestybox.com
+-Vcs-Git: git://github.com/nestybox/sysbox.git
++Homepage: unset
+ 
+ Package: sysbox-ce
+ Architecture: linux-any
+@@ -19,7 +18,4 @@ Depends: ${shlibs:Depends},
+          lsb-release,
+          rsync,
+          iptables
+-Description: Sysbox Community Edition (CE) is a next-generation container runtime,
+- developed by Nestybox, that enables deployment of containers that are capable of
+- running not just micro-services, but also system software such as Docker, Kubernetes,
+- Systemd, etc., inside the container, easily and securely.
+\ No newline at end of file
++Description: 
+\ No newline at end of file
+diff --git a/deb/sysbox-ce/copyright b/deb/sysbox-ce/copyright
+index b4d8d5d..f5696ed 100644
+--- a/deb/sysbox-ce/copyright
++++ b/deb/sysbox-ce/copyright
+@@ -10,3 +10,7 @@ Disclaimer:
+ Files: *
+ Copyright: 2019-2022 Nestybox Inc.  All rights reserved.
+ License: Apache License, Version 2.0.
++
++Files: 
++Copyright: 2026 <unset-yet>.  All rights reserved.
++License: Apache License, Version 2.0.

From 48e1aabac4d4ab713338cfcb55d856364a7d2b24 Mon Sep 17 00:00:00 2001
From: Tomasz Pasternak <tomasz@engflow.com>
Date: Tue, 20 Oct 2026 16:28:34 +0200
Subject: [PATCH 25/35] Print deb info after run

---
 .github/workflows/build.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 993d3c0e2..62a8ff205 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -63,6 +63,10 @@ jobs:
         run: |
           find . -type f -name "*.deb" -ls
 
+      - name: Info for deb artifacts
+        run: |
+          dpkg --info sysbox-pkgr/deb/build/*/*/sysbox-ce_*.linux_*.deb
+
       - name: Upload DEB artifacts
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         with:

From 314ea4fecd6e15fa47a5776e3207f63d8769de64 Mon Sep 17 00:00:00 2001
From: Tomasz Pasternak <tomasz@engflow.com>
Date: Tue, 20 Oct 2026 16:58:37 +0200
Subject: [PATCH 26/35] Don't upload artfiacts

---
 .github/workflows/build.yml | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 62a8ff205..93e40fbe1 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -65,11 +65,4 @@ jobs:
 
       - name: Info for deb artifacts
         run: |
-          dpkg --info sysbox-pkgr/deb/build/*/*/sysbox-ce_*.linux_*.deb
-
-      - name: Upload DEB artifacts
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
-        with:
-          name: sysbox-deb-packages
-          path: "sysbox-pkgr/deb/build/*/*/sysbox-ce_*.linux_*.deb"
-          if-no-files-found: error
\ No newline at end of file
+          dpkg --info sysbox-pkgr/deb/build/*/*/sysbox-ce_*.linux_*.deb
\ No newline at end of file

From 6c6306d16e90473bc33f79346b412b93a3313665 Mon Sep 17 00:00:00 2001
From: Tomasz Pasternak <tomasz@engflow.com>
Date: Wed, 21 Oct 2026 12:42:50 +0200
Subject: [PATCH 27/35] Version override and print

---
 .github/workflows/build.yml     | 18 +++++++++++++++++-
 VERSION_OVERRIDE                |  1 +
 pkgr-apply-custom-changes.patch | 14 ++++++++++++++
 3 files changed, 32 insertions(+), 1 deletion(-)
 create mode 100644 VERSION_OVERRIDE
 create mode 100644 pkgr-apply-custom-changes.patch

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 93e40fbe1..a05ece084 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -57,6 +57,7 @@ jobs:
           (cd sysbox-pkgr && git apply ../changelog-converter.patch)
           (cd sysbox-pkgr && git apply ../trick-to-workarount-always-fail-setup.patch)
           (cd sysbox-pkgr && git apply ../pkgr-copyright-and-license.patch)
+          (cd sysbox-pkgr && git apply ../pkgr-apply-custom-changes.patch)
           (cd sysbox-pkgr && make sysbox-deb ubuntu-resolute)
 
       - name: Locate generated .deb packages
@@ -65,4 +66,19 @@ jobs:
 
       - name: Info for deb artifacts
         run: |
-          dpkg --info sysbox-pkgr/deb/build/*/*/sysbox-ce_*.linux_*.deb
\ No newline at end of file
+          dpkg --info sysbox-pkgr/deb/build/*/*/sysbox-ce_*.linux_*.deb
+
+      - name: Verify deb artifact versions
+        run: |
+          # Locate the package
+          DEB_FILE=$(ls sysbox-pkgr/deb/build/*/*/sysbox-ce_*.linux_*.deb | head -n 1)
+
+          # 1. Unpack deb into a temporary directory
+          EXTRACT_DIR="./extracted_deb"
+          mkdir -p "$EXTRACT_DIR"
+          dpkg-deb -extract "$DEB_FILE" "$EXTRACT_DIR"
+
+          # 2. Run the apps with --version
+          "$EXTRACT_DIR/usr/bin/sysbox-fs" --version
+          "$EXTRACT_DIR/usr/bin/sysbox-runc" --version
+          "$EXTRACT_DIR/usr/bin/sysbox-mgr" --version
\ No newline at end of file
diff --git a/VERSION_OVERRIDE b/VERSION_OVERRIDE
new file mode 100644
index 000000000..288a7fb3e
--- /dev/null
+++ b/VERSION_OVERRIDE
@@ -0,0 +1 @@
+0.7.1-custom
\ No newline at end of file
diff --git a/pkgr-apply-custom-changes.patch b/pkgr-apply-custom-changes.patch
new file mode 100644
index 000000000..96d0d04a8
--- /dev/null
+++ b/pkgr-apply-custom-changes.patch
@@ -0,0 +1,14 @@
+diff --git a/Makefile b/Makefile
+index 2df228f..583dea1 100644
+--- a/Makefile
++++ b/Makefile
+@@ -80,6 +80,9 @@ sysbox-ce-repo:
+ sources/sysbox:
+ 	@printf "\n*** Cloning sysbox-ce superproject repository to $(CE_SOURCES) ***\n\n"
+ 	@git clone --recursive https://github.com/nestybox/sysbox.git sources/sysbox
++	(cd sources/sysbox/sysbox-mgr && git apply ../../../../sysbox-mgr-dont-call-errorf.patch)
++	cp ../VERSION_OVERRIDE sources/sysbox/VERSION
++
+ 
+ ##@ Testing targets
+ 

From 5c7ff59b46b28a96ef78464e9c9e532bfb91b591 Mon Sep 17 00:00:00 2001
From: Tomasz Pasternak <tomasz@engflow.com>
Date: Wed, 21 Oct 2026 12:53:37 +0200
Subject: [PATCH 28/35] Release workflow

---
 .github/workflows/release.yml | 75 +++++++++++++++++++++++++++++++++++
 1 file changed, 75 insertions(+)
 create mode 100644 .github/workflows/release.yml

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 000000000..f0a1e0232
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,75 @@
+name: Release Sysbox
+
+on:
+  push:
+    tags:
+      - 'v*-test'
+
+permissions:
+  contents: write
+
+jobs:
+  build:
+    name: Build Sysbox (DEB)
+    runs-on: ubuntu-26.04
+    steps:
+      - name: Show versions
+        run: |
+          echo "Docker"
+          docker --version
+          echo "uname"
+          uname -a
+
+      - name: Checkout repository and submodules
+        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a
+        with:
+          submodules: recursive
+          fetch-depth: 0
+
+      - name: Verify release branch
+        run: |
+          echo "Verifying that tag '${{ github.ref_name }}' belongs to a release-* branch..."
+          git fetch --no-tags --depth=1 origin '+refs/heads/*:refs/remotes/origin/*'
+          
+          if ! git branch -r --contains HEAD | grep -E '^\s*origin/release-'; then
+            echo "::error::Tag '${{ github.ref_name }}' was not created on a branch prefixed with 'release-'."
+            echo "Branches containing this commit:"
+            git branch -r --contains HEAD
+            exit 1
+          fi
+          
+          echo "Tag '${{ github.ref_name }}' verified on a valid release branch."
+
+      - name: Build Sysbox
+        run: |
+          (cd sysbox-pkgr && git apply ../sysbox-pkgr.patch)
+          (cd sysbox-pkgr && git apply ../changelog-converter.patch)
+          (cd sysbox-pkgr && git apply ../trick-to-workarount-always-fail-setup.patch)
+          (cd sysbox-pkgr && git apply ../pkgr-copyright-and-license.patch)
+          (cd sysbox-pkgr && make sysbox-deb ubuntu-resolute)
+
+      - name: Locate generated .deb packages
+        run: |
+          find . -type f -name "*.deb" -ls
+
+      - name: Info for deb artifacts
+        run: |
+          dpkg --info sysbox-pkgr/deb/build/*/*/sysbox-ce_*.linux_*.deb
+
+      - name: Generate deb checksum
+        run: |
+          mkdir -p release-assets
+          for pkg in sysbox-pkgr/deb/build/*/*/sysbox-ce_*.linux_*.deb; do
+            (cd "$(dirname "$pkg")" && sha256sum "$(basename "$pkg")") >> release-assets/SHA256SUMS
+          done
+          echo "Generated Checksums:"
+          cat release-assets/SHA256SUMS
+
+      - name: Create GitHub Release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release create "${{ github.ref_name }}" \
+            release-assets/SHA256SUMS \
+            --title "${{ github.ref_name }}" \
+            --prerelease
\ No newline at end of file

From 6f97274e2d84d43c8c1b2537192a4234dbf10acc Mon Sep 17 00:00:00 2001
From: Tomasz Pasternak <tomasz@engflow.com>
Date: Wed, 21 Oct 2026 13:03:08 +0200
Subject: [PATCH 29/35] Fix deb extraction

---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a05ece084..34504b3bf 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -76,7 +76,7 @@ jobs:
           # 1. Unpack deb into a temporary directory
           EXTRACT_DIR="./extracted_deb"
           mkdir -p "$EXTRACT_DIR"
-          dpkg-deb -extract "$DEB_FILE" "$EXTRACT_DIR"
+          dpkg-deb --extract "$DEB_FILE" "$EXTRACT_DIR"
 
           # 2. Run the apps with --version
           "$EXTRACT_DIR/usr/bin/sysbox-fs" --version

From dad4235e92907e443b3c85820d3f04701986dc87 Mon Sep 17 00:00:00 2001
From: Tomasz Pasternak <tomasz@engflow.com>
Date: Wed, 21 Oct 2026 13:36:01 +0200
Subject: [PATCH 30/35] Apply patch not to fail on git rev parse

---
 pkgr-apply-custom-changes.patch |  2 +-
 sysbox-fs.patch                 | 13 +++++++++++++
 2 files changed, 14 insertions(+), 1 deletion(-)
 create mode 100644 sysbox-fs.patch

diff --git a/pkgr-apply-custom-changes.patch b/pkgr-apply-custom-changes.patch
index 96d0d04a8..44a1f21b8 100644
--- a/pkgr-apply-custom-changes.patch
+++ b/pkgr-apply-custom-changes.patch
@@ -6,7 +6,7 @@ index 2df228f..583dea1 100644
  sources/sysbox:
  	@printf "\n*** Cloning sysbox-ce superproject repository to $(CE_SOURCES) ***\n\n"
  	@git clone --recursive https://github.com/nestybox/sysbox.git sources/sysbox
-+	(cd sources/sysbox/sysbox-mgr && git apply ../../../../sysbox-mgr-dont-call-errorf.patch)
++	(cd sources/sysbox/sysbox-mgr && git apply ../../../../sysbox-mgr-dont-call-errorf.patch) && (cd sources/sysbox/sysbox-fs && git apply ../../../../sysbox-fs.patch)
 +	cp ../VERSION_OVERRIDE sources/sysbox/VERSION
 +
  
diff --git a/sysbox-fs.patch b/sysbox-fs.patch
new file mode 100644
index 000000000..5a99c2ce2
--- /dev/null
+++ b/sysbox-fs.patch
@@ -0,0 +1,13 @@
+diff --git a/Makefile b/Makefile
+index b2c2de8..d969a4e 100644
+--- a/Makefile
++++ b/Makefile
+@@ -30,7 +30,7 @@ LIBSPIDMON_SRC := $(shell find $(LIBPIDMON_DIR) 2>&1 | grep -E '.*\.(go)')
+ NSENTER_DIR := ../sysbox-runc/libcontainer/nsenter
+ NSENTER_SRC := $(shell find $(NSENTER_DIR) 2>&1 | grep -E '.*\.(c|h|go)')
+ 
+-COMMIT_NO := $(shell git rev-parse HEAD 2> /dev/null || true)
++COMMIT_NO := $(shell git rev-parse HEAD 2> /dev/null)
+ COMMIT ?= $(if $(shell git status --porcelain --untracked-files=no),$(COMMIT_NO)-dirty,$(COMMIT_NO))
+ BUILT_AT := $(shell date)
+ BUILT_BY := $(shell git config user.name)

From d4d8a1f7c27db0d386e6043fb05617b21299309b Mon Sep 17 00:00:00 2001
From: Tomasz Pasternak <tomasz@engflow.com>
Date: Wed, 21 Oct 2026 14:29:46 +0200
Subject: [PATCH 31/35] try false

---
 sysbox-fs.patch | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sysbox-fs.patch b/sysbox-fs.patch
index 5a99c2ce2..18d884b90 100644
--- a/sysbox-fs.patch
+++ b/sysbox-fs.patch
@@ -7,7 +7,7 @@ index b2c2de8..d969a4e 100644
  NSENTER_SRC := $(shell find $(NSENTER_DIR) 2>&1 | grep -E '.*\.(c|h|go)')
  
 -COMMIT_NO := $(shell git rev-parse HEAD 2> /dev/null || true)
-+COMMIT_NO := $(shell git rev-parse HEAD 2> /dev/null)
++COMMIT_NO := $(shell false && git rev-parse HEAD 2> /dev/null)
  COMMIT ?= $(if $(shell git status --porcelain --untracked-files=no),$(COMMIT_NO)-dirty,$(COMMIT_NO))
  BUILT_AT := $(shell date)
  BUILT_BY := $(shell git config user.name)

From 55b6cdfa9c214b3ce8213567c6ff76221ff1a9db Mon Sep 17 00:00:00 2001
From: Tomasz Pasternak <tomasz@engflow.com>
Date: Wed, 21 Oct 2026 14:38:58 +0200
Subject: [PATCH 32/35] fixed commit no to verify

---
 sysbox-fs.patch | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sysbox-fs.patch b/sysbox-fs.patch
index 18d884b90..341c7bab0 100644
--- a/sysbox-fs.patch
+++ b/sysbox-fs.patch
@@ -7,7 +7,7 @@ index b2c2de8..d969a4e 100644
  NSENTER_SRC := $(shell find $(NSENTER_DIR) 2>&1 | grep -E '.*\.(c|h|go)')
  
 -COMMIT_NO := $(shell git rev-parse HEAD 2> /dev/null || true)
-+COMMIT_NO := $(shell false && git rev-parse HEAD 2> /dev/null)
++COMMIT_NO := "abcdef"
  COMMIT ?= $(if $(shell git status --porcelain --untracked-files=no),$(COMMIT_NO)-dirty,$(COMMIT_NO))
  BUILT_AT := $(shell date)
  BUILT_BY := $(shell git config user.name)

From 784bee7a467845a77ab39be8637965940a76c248 Mon Sep 17 00:00:00 2001
From: Tomasz Pasternak <tomasz@engflow.com>
Date: Wed, 21 Oct 2026 16:52:00 +0200
Subject: [PATCH 33/35] apply patch in a buggy makefile setup

---
 .github/workflows/build.yml     | 2 ++
 pkgr-apply-custom-changes.patch | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 34504b3bf..a75bb1fab 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -58,6 +58,8 @@ jobs:
           (cd sysbox-pkgr && git apply ../trick-to-workarount-always-fail-setup.patch)
           (cd sysbox-pkgr && git apply ../pkgr-copyright-and-license.patch)
           (cd sysbox-pkgr && git apply ../pkgr-apply-custom-changes.patch)
+          (cd sysbox-pkgr && make sources/sysbox)
+          (cd sysbox-pkgr/sources/sysbox/sysbox-fs && git apply ../../../../sysbox-fs.patch)
           (cd sysbox-pkgr && make sysbox-deb ubuntu-resolute)
 
       - name: Locate generated .deb packages
diff --git a/pkgr-apply-custom-changes.patch b/pkgr-apply-custom-changes.patch
index 44a1f21b8..96d0d04a8 100644
--- a/pkgr-apply-custom-changes.patch
+++ b/pkgr-apply-custom-changes.patch
@@ -6,7 +6,7 @@ index 2df228f..583dea1 100644
  sources/sysbox:
  	@printf "\n*** Cloning sysbox-ce superproject repository to $(CE_SOURCES) ***\n\n"
  	@git clone --recursive https://github.com/nestybox/sysbox.git sources/sysbox
-+	(cd sources/sysbox/sysbox-mgr && git apply ../../../../sysbox-mgr-dont-call-errorf.patch) && (cd sources/sysbox/sysbox-fs && git apply ../../../../sysbox-fs.patch)
++	(cd sources/sysbox/sysbox-mgr && git apply ../../../../sysbox-mgr-dont-call-errorf.patch)
 +	cp ../VERSION_OVERRIDE sources/sysbox/VERSION
 +
  

From bb4c32e4dcddd973fb9d1273ee12cce66728d3e5 Mon Sep 17 00:00:00 2001
From: Tomasz Pasternak <tomasz@engflow.com>
Date: Wed, 21 Oct 2026 17:17:02 +0200
Subject: [PATCH 34/35] Don't mount gitconfig

---
 .github/workflows/build.yml   |  1 +
 pkgr-no-gitconfig-mount.patch | 20 ++++++++++++++++++++
 sysbox-fs.patch               |  4 ++--
 3 files changed, 23 insertions(+), 2 deletions(-)
 create mode 100644 pkgr-no-gitconfig-mount.patch

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a75bb1fab..ce221a9ed 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -58,6 +58,7 @@ jobs:
           (cd sysbox-pkgr && git apply ../trick-to-workarount-always-fail-setup.patch)
           (cd sysbox-pkgr && git apply ../pkgr-copyright-and-license.patch)
           (cd sysbox-pkgr && git apply ../pkgr-apply-custom-changes.patch)
+          (cd sysbox-pkgr && git apply ../pkgr-no-gitconfig-mount.patch)
           (cd sysbox-pkgr && make sources/sysbox)
           (cd sysbox-pkgr/sources/sysbox/sysbox-fs && git apply ../../../../sysbox-fs.patch)
           (cd sysbox-pkgr && make sysbox-deb ubuntu-resolute)
diff --git a/pkgr-no-gitconfig-mount.patch b/pkgr-no-gitconfig-mount.patch
new file mode 100644
index 000000000..e461a3fe8
--- /dev/null
+++ b/pkgr-no-gitconfig-mount.patch
@@ -0,0 +1,20 @@
+diff --git a/deb/Makefile b/deb/Makefile
+index 6875870..ea033a6 100644
+--- a/deb/Makefile
++++ b/deb/Makefile
+@@ -73,7 +73,6 @@ DOCKER_RUN=docker run --privileged --rm -i    \
+ 	-e EDITION                                \
+ 	-v $(CURDIR)/build/$(ARCH)/$@:/build      \
+ 	-v $(GOPATH)/pkg/mod:/go/pkg/mod          \
+-	-v $(HOME)/.gitconfig:/root/.gitconfig:ro \
+ 	-v /lib/modules/$(KERNEL_REL):/lib/modules/$(KERNEL_REL):ro \
+ 	-v /usr/src/$(HEADERS):/usr/src/$(HEADERS):ro \
+ 	-v /usr/src/$(HEADERS_BASE):/usr/src/$(HEADERS_BASE):ro \
+@@ -90,7 +89,6 @@ DOCKER_RUN_RELEASE=docker run --privileged --rm -i               \
+ 	-e EDITION                                                   \
+ 	-v $(CURDIR)/build/$(ARCH)/$(RELEASE_BASELINE_IMAGE):/build  \
+ 	-v $(GOPATH)/pkg/mod:/go/pkg/mod                             \
+-	-v $(HOME)/.gitconfig:/root/.gitconfig:ro                    \
+ 	-v /lib/modules/$(KERNEL_REL):/lib/modules/$(KERNEL_REL):ro  \
+ 	-v /usr/src/$(HEADERS):/usr/src/$(HEADERS):ro                \
+ 	-v /usr/src/$(HEADERS_BASE):/usr/src/$(HEADERS_BASE):ro      \
diff --git a/sysbox-fs.patch b/sysbox-fs.patch
index 341c7bab0..e76f5633d 100644
--- a/sysbox-fs.patch
+++ b/sysbox-fs.patch
@@ -1,5 +1,5 @@
 diff --git a/Makefile b/Makefile
-index b2c2de8..d969a4e 100644
+index b2c2de8..32f8f40 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -30,7 +30,7 @@ LIBSPIDMON_SRC := $(shell find $(LIBPIDMON_DIR) 2>&1 | grep -E '.*\.(go)')
@@ -7,7 +7,7 @@ index b2c2de8..d969a4e 100644
  NSENTER_SRC := $(shell find $(NSENTER_DIR) 2>&1 | grep -E '.*\.(c|h|go)')
  
 -COMMIT_NO := $(shell git rev-parse HEAD 2> /dev/null || true)
-+COMMIT_NO := "abcdef"
++COMMIT_NO := $(shell git rev-parse HEAD)
  COMMIT ?= $(if $(shell git status --porcelain --untracked-files=no),$(COMMIT_NO)-dirty,$(COMMIT_NO))
  BUILT_AT := $(shell date)
  BUILT_BY := $(shell git config user.name)

From 4cebb1b50c2754474c5f4b969a36be18b10d7e0e Mon Sep 17 00:00:00 2001
From: Tomasz Pasternak <tomasz@engflow.com>
Date: Thu, 22 Oct 2026 11:06:01 +0200
Subject: [PATCH 35/35] Set gitconfig and switch build to generic

---
 .github/workflows/build.yml                 |  4 ++--
 pkgr-no-gitconfig-mount.patch               | 20 --------------------
 trick-to-workarount-always-fail-setup.patch |  4 ++--
 3 files changed, 4 insertions(+), 24 deletions(-)
 delete mode 100644 pkgr-no-gitconfig-mount.patch

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index ce221a9ed..41176064e 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -58,10 +58,10 @@ jobs:
           (cd sysbox-pkgr && git apply ../trick-to-workarount-always-fail-setup.patch)
           (cd sysbox-pkgr && git apply ../pkgr-copyright-and-license.patch)
           (cd sysbox-pkgr && git apply ../pkgr-apply-custom-changes.patch)
-          (cd sysbox-pkgr && git apply ../pkgr-no-gitconfig-mount.patch)
+          git config --global user.name "Unset"
           (cd sysbox-pkgr && make sources/sysbox)
           (cd sysbox-pkgr/sources/sysbox/sysbox-fs && git apply ../../../../sysbox-fs.patch)
-          (cd sysbox-pkgr && make sysbox-deb ubuntu-resolute)
+          (cd sysbox-pkgr && make sysbox-deb generic)
 
       - name: Locate generated .deb packages
         run: |
diff --git a/pkgr-no-gitconfig-mount.patch b/pkgr-no-gitconfig-mount.patch
deleted file mode 100644
index e461a3fe8..000000000
--- a/pkgr-no-gitconfig-mount.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-diff --git a/deb/Makefile b/deb/Makefile
-index 6875870..ea033a6 100644
---- a/deb/Makefile
-+++ b/deb/Makefile
-@@ -73,7 +73,6 @@ DOCKER_RUN=docker run --privileged --rm -i    \
- 	-e EDITION                                \
- 	-v $(CURDIR)/build/$(ARCH)/$@:/build      \
- 	-v $(GOPATH)/pkg/mod:/go/pkg/mod          \
--	-v $(HOME)/.gitconfig:/root/.gitconfig:ro \
- 	-v /lib/modules/$(KERNEL_REL):/lib/modules/$(KERNEL_REL):ro \
- 	-v /usr/src/$(HEADERS):/usr/src/$(HEADERS):ro \
- 	-v /usr/src/$(HEADERS_BASE):/usr/src/$(HEADERS_BASE):ro \
-@@ -90,7 +89,6 @@ DOCKER_RUN_RELEASE=docker run --privileged --rm -i               \
- 	-e EDITION                                                   \
- 	-v $(CURDIR)/build/$(ARCH)/$(RELEASE_BASELINE_IMAGE):/build  \
- 	-v $(GOPATH)/pkg/mod:/go/pkg/mod                             \
--	-v $(HOME)/.gitconfig:/root/.gitconfig:ro                    \
- 	-v /lib/modules/$(KERNEL_REL):/lib/modules/$(KERNEL_REL):ro  \
- 	-v /usr/src/$(HEADERS):/usr/src/$(HEADERS):ro                \
- 	-v /usr/src/$(HEADERS_BASE):/usr/src/$(HEADERS_BASE):ro      \
diff --git a/trick-to-workarount-always-fail-setup.patch b/trick-to-workarount-always-fail-setup.patch
index 02c827a61..c166816b9 100644
--- a/trick-to-workarount-always-fail-setup.patch
+++ b/trick-to-workarount-always-fail-setup.patch
@@ -7,8 +7,8 @@ index 2df228f..9b3e2aa 100644
  	$(eval export EDITION=ce)
  	$(MAKE) -C rpm --no-print-directory clean
 +
-+ubuntu-resolute:
++generic:
 +	echo "Maybe built"
 +
-+.PHONY: ubuntu-resolute
++.PHONY: generic 
 +