| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: kubevirt1.9-virtctl | Distribution: openSUSE Tumbleweed |
| Version: 1.9.1 | Vendor: openSUSE |
| Release: 2.1 | Build date: Wed Oct 21 23:29:14 2026 |
| Group: System/Packages | Build host: reproducible |
| Size: 63844602 | Source RPM: kubevirt1.9-1.9.1-2.1.src.rpm |
| Packager: https://bugs.opensuse.org | |
| Url: https://github.com/kubevirt/kubevirt | |
| Summary: Client for managing kubevirt | |
The virtctl client is a command-line utility for managing container native virtualization resources
Apache-2.0
* Wed Oct 21 2026 Victor Carvalho <victor.carvalho@suse.com>
- Re-vendor the Go dependencies for the open security bugs:
* golang.org/x/net 0.60.0: CVE-2026-78669 (bsc#1285255) excessive CPU
from repeated HTTP/2 initial window changes; also CVE-2026-78659,
CVE-2026-78660, CVE-2026-78663 and CVE-2026-97032 fixed in that release
* Sun Oct 18 2026 Victor Carvalho <victor.carvalho@suse.com>
- Update to version 1.9.1:
* virt-template is pinned at v0.2.3
* several bug fixes, see
https://github.com/kubevirt/kubevirt/releases/tag/v1.9.1
- Drop 0001-Fix-VFIO-cdev-passthrough-on-kernels-without-CONFIG_VFIO.patch:
in 1.9.1.
- Drop 0002-use-safepath-when-dialing-the-migration-target-unix-sockets.patch
and 0003-tests-dial-migration-target-sockets-through-proc-root-layout.patch:
CVE-2026-13622 (bsc#1272840) is fixed in 1.9.1 by the final upstream
change, which also puts the migration source listener sockets
behind safepath.
- The tarball is v1.9.1 with the same go.mod/go.sum/vendor as the
1.9.0 package (golang.org/x/crypto v0.56.0, golang.org/x/net
v0.58.0, golang.org/x/text v0.41.0, google.golang.org/grpc v1.83.2,
google.golang.org/protobuf v1.36.11); upstream's module set is
unchanged between the two tags.
- Refresh disks-images-provider.yaml to the v1.9.1 release asset.
- Add 0005-Add-grace-period-for-Running-VMIs-when-domain-is-nil.patch:
when virt-handler restarts it briefly loses the launcher socket;
Scheduled VMIs already got a 3-minute grace period before being
marked Failed, Running VMIs were failed at once, so healthy VMs were
killed during upgrades (upstream release-1.9 commit 6a21e66f30).
- Add 0006-Notify-server-Make-event-chan-private.patch and
0007-Notify-server-Ignore-client-error.patch:
a watch error from one virt-launcher made virt-handler restart its
whole domain watcher, re-listing every domain on the node and
disrupting healthy VMs; log the error instead (upstream release-1.9
commits b428d219c5, 6ba8edb64c).
- Ship the testing manifests in the tests subpackage on SUSE Linux:
they were generated and installed only on Tumbleweed, together with
the release manifests, so virt-tests came without the
default-config.json, rbac-for-testing.yaml, uploadproxy-nodeport.yaml
and disks-images-provider.yaml it needs to run. The release manifests
and the manifests subpackage stay Tumbleweed-only.
* Wed Sep 09 2026 Victor Carvalho <victor.carvalho@suse.com>
- Security: re-vendor the bundled Go dependencies to the current fixed
versions (no upstream source changes; the tarball is v1.9.0 with
updated go.mod/go.sum/vendor only):
* golang.org/x/crypto v0.54.0 -> v0.56.0: CVE-2026-56854,
CVE-2026-56855, CVE-2026-78662 (bsc#1278574)
* google.golang.org/grpc v1.79.3 -> v1.83.2: CVE-2026-84303
(bsc#1279276), CVE-2026-84304 (bsc#1279184), CVE-2026-84445
(bsc#1278869; fixed in 1.83.2, 1.83.1 is still affected)
Carried along by the above, no separate advisory open against the
versions they replace: golang.org/x/net v0.57.0 -> v0.58.0,
golang.org/x/text v0.40.0 -> v0.41.0, google.golang.org/protobuf
v1.36.5 -> v1.36.11 in the staging modules.
- Add 0004-manifest-templator-apply-the-custom-image-flags-before-rendering-the-operator-deployment.patch:
the manifest templator rendered the virt-operator deployment before
applying its --virt-*-image flags, so custom images passed at build
time never reached the release manifests. With the fix the
virt-template image references are set through the templator instead
of post-processing the rendered manifest.
* Wed Sep 09 2026 Victor Carvalho <victor.carvalho@suse.com>
- Add 0001-Fix-VFIO-cdev-passthrough-on-kernels-without-CONFIG_VFIO.patch:
PCI host device passthrough left the virt-launcher pod stuck in
creation on kernels that expose the vfio-dev sysfs class but do not
create /dev/vfio/devices/* (no CONFIG_VFIO_DEVICE_CDEV): kubelet
failed with "lstat /dev/vfio/devices/vfio0: no such file or
directory". Verify the cdev node exists before adding it to the
device specs (upstream release-1.9 commit 7d045a56dd, kubevirt PR
18905, fixed after v1.9.0).
- Add 0002-use-safepath-when-dialing-the-migration-target-unix-sockets.patch:
CVE-2026-13622 (bsc#1272840) —
virt-handler dials the migration target unix sockets through
/proc/<pid>/root of the virt-launcher pod; resolve the socket path
with safepath and dial via ExecuteNoFollow so a symlink planted
inside the launcher filesystem cannot redirect the connection.
Unsupported target protocols are now rejected instead of dialed.
- Add 0003-tests-dial-migration-target-sockets-through-proc-root-layout.patch:
the migration-proxy unit tests dialed target sockets straight out of a
temporary directory, which is not below a /proc/<pid>/root and is
therefore refused by the resolution above; place those sockets under a
"root" directory so they keep the shape they have in production.
* Tue Sep 08 2026 Victor Carvalho <victor.carvalho@suse.com>
- Deploy virt-template from the images built from the virt-template0.2
package: the operator manifest now sets VIRT_TEMPLATE_APISERVER_IMAGE
and VIRT_TEMPLATE_CONTROLLER_IMAGE to virt-template-apiserver and
virt-template-controller at the version this release pins (v0.2.2).
virt-operator enables the Template feature gate by default since 1.9
and derived the virt-template references from its own registry, where
the images did not exist, so every deployment waited on two
ImagePullBackOff pods and never reported Available (bsc#1272604).
* Tue Aug 25 2026 Victor Carvalho <victor.carvalho@suse.com>
- Package the persistent-reservation helper's entrypoint script:
virt-operator runs the pr-helper container with the command
/entrypoint.sh, which symlinks the multipath socket into place and
then execs qemu-pr-helper. Only multipath.conf was installed, so the
container could not start and persistent reservation was
unavailable. The script is upstream in cmd/pr-helper/entrypoint.sh.
* Thu Aug 13 2026 Victor Carvalho <victor.carvalho@suse.com>
- Declare the parallel-minor exclusion: every subpackage now provides
and conflicts its unversioned kubevirt-<subpackage> name (kubevirt1.8
already provides these), so co-named binaries are a declared package
conflict instead of an undeclared file conflict. Required by the
openSUSE:Factory staging installcheck (the decline class of request
1370732).
* Sun Aug 09 2026 Victor Carvalho <victor.carvalho@suse.com>
- Security: re-vendor the bundled Go dependencies (no upstream source
changes; tarball rebuilt from v1.9.0 with updated go.mod/vendor) so
1.9 does not regress the dependency-CVE state already shipped in
kubevirt1.8. v1.9.0's pristine vendor tree predates those bumps:
* golang.org/x/net v0.49.0 -> v0.57.0: CVE-2025-47911 (bsc#1251420),
CVE-2025-58190 (bsc#1251615), CVE-2026-33814 (bsc#1265736),
CVE-2026-39821 (bsc#1266575), CVE-2026-25680, CVE-2026-25681,
CVE-2026-27136, CVE-2026-42502, CVE-2026-42506 (bsc#1267120)
* golang.org/x/crypto v0.47.0 -> v0.54.0: CVE-2026-39827,
CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831,
CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835,
CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598
(bsc#1266151)
* golang.org/x/text v0.33.0 -> v0.40.0: CVE-2026-56852 (bsc#1272000)
* Fri Jul 31 2026 Victor Toso de Carvalho <victor.carvalho@suse.com>
- Initial package kubevirt1.9: KubeVirt v1.9.0, the versioned fork of
the kubevirt1.8 packaging so multiple minor releases are maintained
in parallel (kubernetes1.33-style naming; each minor starts its own
changelog — the pre-fork history lives in kubevirt1.8).
Release notes: https://github.com/kubevirt/kubevirt/releases/tag/v1.9.0
- Both patches carried by kubevirt1.8 are contained in v1.9.0 and are
not needed here (CVE-2026-13201, bsc#1269093).
- New libvirt-hook-client binary, shipped in the virt-launcher
subpackage; the alpha plugin framework (cmd/plugin-sidecars) is not
packaged.
- BuildRequires golang(API) >= 1.26, following upstream go.mod.
- Drop the containers_meta OBS service subpackage carried over from
kubevirt1.8: its only consumer was the retired virt-*-container
image flow; the BCI-built images use replace_using_package_version.
- Note: upstream enables the virt-template component by default
(Template feature gate, Beta) and hardcodes its two images as
quay.io/kubevirt/virt-template-*:v0.2.2 — a deployment pulls these
from quay.io at runtime; packaging them as distro images is a
planned follow-up.
/usr/bin/virtctl /usr/share/doc/packages/kubevirt1.9-virtctl /usr/share/doc/packages/kubevirt1.9-virtctl/README.md /usr/share/licenses/kubevirt1.9-virtctl /usr/share/licenses/kubevirt1.9-virtctl/LICENSE
Generated by rpm2html 1.8.1
Fabrice Bellet, Tue Oct 27 22:43:50 2026