k3s/1.32.0.1 package update

[octo-sts]

[debasishbsws]

The test is failing on the following command:

strings $(which k3s) | grep -q "libseccomp"

Previously, this command produced the following output:

$ strings $(which k3s) | grep "libseccomp"
2025/01/21 17:11:29 INFO dep    github.com/seccomp/libseccomp-golang    v0.10.0    h1:aA4bp+/Zzi0BnWZ2F1wgNBs5gTpm+na2rWM6M9YjLpY=
github.com/seccomp/libseccomp-golang.init
github.com/seccomp/libseccomp-golang._Cfunc_get_major_version
github.com/seccomp/libseccomp-golang._Cfunc_get_micro_version
github.com/seccomp/libseccomp-golang._Cfunc_get_minor_version
github.com/seccomp/libseccomp-golang._Cfunc_seccomp_api_get
github.com/seccomp/libseccomp-golang.init.0
github.com/seccomp/libseccomp-golang.getAPI
/var/cache/melange/gomodcache/github.com/seccomp/libseccomp-golang@v0.10.0/seccomp_internal.go
/var/cache/melange/gomodcache/github.com/seccomp/libseccomp-golang@v0.10.0/seccomp.go
dep    github.com/seccomp/libseccomp-golang    v0.10.0    h1:aA4bp+/Zzi0BnWZ2F1wgNBs5gTpm+na2rWM6M9YjLpY=

Currently, we're setting STATIC_BUILD=true before running ./scripts/build, which should configure everything as per the script. However, it seems like the new version isn't building with the required libseccomp bindings.

...
if [ -n "${DEBUG}" ]; then
  GCFLAGS="-N -l"
else
  LDFLAGS="-w -s"
fi

STATIC="
    -extldflags '-static -lm -ldl -lz -lpthread'
"
TAGS="ctrd apparmor seccomp netcgo osusergo providerless urfave_cli_no_docs"
RUNC_TAGS="apparmor seccomp"
RUNC_STATIC="static"

if [ ${OS} = windows ]; then
    TAGS="ctrd netcgo osusergo providerless"
fi

if [ "$SELINUX" = "true" ]; then
    TAGS="$TAGS selinux"
    RUNC_TAGS="$RUNC_TAGS selinux"
fi

if [ "$STATIC_BUILD" != "true" ]; then
    STATIC="
"
    RUNC_STATIC=""
else
    TAGS="static_build libsqlite3 $TAGS"
fi

if [ -n "${GOCOVER}" ]; then
    BLDFLAGS="-cover"
    TAGS="cover $TAGS"
fi

mkdir -p bin
...

[joshrwolf]

I'm not convinced this bump didn't decouple libseccomp as a dependency, so simply checking the go build tags fixes the test, but we might just be able to remove the test entirely OR we're no longer building with libseccomp-static

checking this out now...

[joshrwolf]

alright looks like the upstream binary no longer includes libseccomp, so I think these new tests are good and at least protect us from messing up the build flags!