Update youki to 0.7.0 and download the static musl build (#13564)

Add the 0.6.0 and 0.7.0 checksums, drop 0.4.x, and move youki back
into the blocking molecule matrix. The seccomp bug behind the old
FIXME (youki#3479) is fixed in 0.7.0.

The 0.7.0 gnu tarball is linked against glibc 2.39, because cross-rs
moved its base image to Ubuntu 24.04 and youki installs cross from
git. It does not run on EL9, Amazon Linux 2023, Ubuntu 22.04 or
Debian 12, and it needs libseccomp on the host.

The musl tarball is static, has the same default features and no
runtime requirements. It is the build upstream recommends in its
setup docs.

Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>

.gitlab-ci/molecule.yml

@@ -32,6 +32,7 @@ molecule:
       - container-engine/cri-o
       - container-engine/gvisor
       - container-engine/kata-containers
+      - container-engine/youki
       - adduser
       - bastion_ssh_config
       - bootstrap_os
@@ -46,6 +47,4 @@ molecule_full:
   extends: molecule
   parallel:
     matrix:
-    - ROLE:
-      # FIXME: until youki release 0.6.1
-      - container-engine/youki
+    - ROLE: []

roles/kubespray_defaults/defaults/main/download.yml

@@ -165,7 +165,7 @@ crio_download_url: "{{ storage_googleapis_url }}/cri-o/artifacts/cri-o.{{ image_
 helm_download_url: "{{ get_helm_url }}/helm-v{{ helm_version }}-linux-{{ image_arch }}.tar.gz"
 runc_download_url: "{{ github_url }}/opencontainers/runc/releases/download/v{{ runc_version }}/runc.{{ image_arch }}"
 crun_download_url: "{{ github_url }}/containers/crun/releases/download/{{ crun_version }}/crun-{{ crun_version }}-linux-{{ image_arch }}"
-youki_download_url: "{{ github_url }}/youki-dev/youki/releases/download/v{{ youki_version }}/youki-{{ youki_version }}-{{ ansible_facts['architecture'] }}-gnu.tar.gz"
+youki_download_url: "{{ github_url }}/youki-dev/youki/releases/download/v{{ youki_version }}/youki-{{ youki_version }}-{{ ansible_facts['architecture'] }}-musl.tar.gz"
 kata_containers_download_url: "{{ github_url }}/kata-containers/kata-containers/releases/download/{{ kata_containers_version }}/kata-static-{{ kata_containers_version }}-{{ image_arch }}.tar.zst"
 # gVisor only supports amd64 and uses x86_64 to in the download link
 gvisor_runsc_download_url: "{{ storage_googleapis_url }}/gvisor/releases/release/{{ gvisor_version }}/{{ ansible_facts['architecture'] }}/runsc"

roles/kubespray_defaults/vars/main/checksums.yml

@@ -819,27 +819,27 @@ crun_checksums:
     '1.16': sha256:fc7199a2faac1ca0e3e58dee4dd369b9065aa0d95f3257d8803e521213f1bd9b
 youki_checksums:
   amd64:
-    0.5.7: sha256:10077b1a4f013990a416acf15e6b397cf64b5d62008516a9711abc22730d8203
-    0.5.6: sha256:c372ad70d4107174064225848e686e84ddb597cb44ac7a540e0c47a86e6e6081
-    0.5.5: sha256:7a6844c2e529daa54c6d7558572269508faa26e3b14b5440f9502c413fef558c
-    0.5.4: sha256:69709a8739c868071e8e7e4bdcbcab41b28524c2adb2f0af0c1a4d6ba4691ae0
-    0.5.3: sha256:173b8998cd0abf22e38e36611b34cc19a16431b353dd893e3d988cfc77b4e6ac
-    0.5.2: sha256:361c7187939eab02039fa4289d33158fe4bf4d21ab8cc7139ace8f52081524ba
-    0.5.1: sha256:554dea487dcb54b34fff003fc047458cecf073337d20b77e69c22918c2986aaf
-    0.5.0: sha256:d7ec0cd5f69ecd96b41df13cc38a970ab217aa9c4b2262ca4843a68595975d91
-    0.4.1: sha256:6f7ea3651b284a808f344ad40f9f8315b3b02b76a3ee6c6af7bfff65753284c9
-    0.4.0: sha256:7cf3ae3d1be19a731378b289000cb36ba9cedcbff8a0cabe38edb782e8c55f72
+    0.7.0: sha256:a211a16b6b1a985f8ca61bba9a30b9ae40352d04dd7eca04cdecfe7b98b47038
+    0.6.0: sha256:fe692a0bcaa5e4ef9b06fb50a92d37c4e8779169f68373d09c6b2668cd39c1d8
+    0.5.7: sha256:a9003472a6e959f345db8e48371a335ab98fae53a5e71a4339b5fe54f0691f60
+    0.5.6: sha256:f7cbbb78415106c40297adbd4b4e1f0037b663140dd8950f128250e74357b5c5
+    0.5.5: sha256:af4c89a4a9ce5704be6a227c996b035f08da2e80f3c189bc0ae054438e0e34d5
+    0.5.4: sha256:95859e85834b86a99ed867dda4326dc1b01b0a0a09061cb2b06ce0ab63709239
+    0.5.3: sha256:087ae98517bc6033ed48a2a8b3eb71b63b2b612e065639893d7ce02fb53aec02
+    0.5.2: sha256:481eadb82a02c7974f476bc4678feb26426bc84abcb991174b1579b74a25b8d0
+    0.5.1: sha256:273684688f8d71327b237a568bfc9e396105220683d65b80425ec7734f59bd2a
+    0.5.0: sha256:e4f129b95cf8fba720d7e9aedb5013b5b66647251325c15e599f4ae8a68c68ba
   arm64:
-    0.5.7: sha256:d51990751e796391254c36d40f05b0624017cb544284f9721a645d05747b3d84
-    0.5.6: sha256:df078232fd5e4af822be2d35e0614715dfa781a3e5790b66b71d1d89a2247692
-    0.5.5: sha256:83069dd0ac11dca04f5a2376f27538f86ae5304db0ba148b20d342afe62d6069
-    0.5.4: sha256:2a8d55a7127c751d088ab9ef989496b700afde414296139d5461606527869c42
-    0.5.3: sha256:a15dfe9a1eec2d595b9a972a8a0fa1a919ee3d3523e77ca8c22099bfadf7e88d
-    0.5.2: sha256:8df7e4898088e6fcf942f2e145b0a50c1ad81f5109044e48897c0af9bb3f83e6
-    0.5.1: sha256:ed8e2f5ac03553d0a8ac641339a9f94f42baee652e2afdc1afae08529807a796
-    0.5.0: sha256:1e504e01caf396e8ab87de24bcdde0adaf6251ff2a3dcd0d8622cba0132caadc
-    0.4.1: sha256:c954397353340a013d77d63cda9b074e5f1de57e06fe6f8d44f508b5dc03c998
-    0.4.0: sha256:0d897debaee98a937188317304a9caafb0da5bf798717aefedf113c108f73263
+    0.7.0: sha256:b96c05c2c82f1d20a74b611188fa120894c50a6128f73856bb371604ecb69bd0
+    0.6.0: sha256:eb4d0e6e28ab9bd391ae84f3b9408821fc68dc8976f8b2a721f8ae5caeadb462
+    0.5.7: sha256:b3002d9d39b04f797e783745f92cffec9e0caa464254be98aa0b4dfc184f0233
+    0.5.6: sha256:e3d16fc2d894d357f663afbedd76e80ba5b5dce13586a8a7a5a1e72d498a8e07
+    0.5.5: sha256:9bea06fbdab98a1ef0662f9ec78c52e52248c810d0804342adf3c03b4209b0cf
+    0.5.4: sha256:7d20449550e58e6c3c34be6c35f971c9f41cf73c9fe869c59c21781943187637
+    0.5.3: sha256:237346a6b5ee8e500465a605bdb888dbe3b96278468b00e421a49eeb4fd3a239
+    0.5.2: sha256:d21717321d9dcc109cb21d3f75fec90c525d84de1cf2b7550fea25495d4f4d1f
+    0.5.1: sha256:812de17f73d7d526b9b0bd7dab584ce9734a4380a87b2e78a8662e65ceb901c6
+    0.5.0: sha256:8d4115c7e30b5309b6eca969d59f248bb0a8254d0ad1bc922cde4a20b2955bbd
 kata_containers_binary_checksums:
   amd64:
     3.32.0: sha256:1449ecea50bd91fa73a94648db195d18950fe869ba4b1f12d05f55f1fa7c1b01

scripts/component_hash_update/src/component_hash_update/components.py

@@ -96,7 +96,7 @@ infos = {
         "graphql_id": "R_kgDOHQ6J9w",
     },
     "youki": {
-        "url": "https://github.com/youki-dev/youki/releases/download/v{version}/youki-{version}-{alt_arch}-gnu.tar.gz",
+        "url": "https://github.com/youki-dev/youki/releases/download/v{version}/youki-{version}-{alt_arch}-musl.tar.gz",
         "binary": True,
         "graphql_id": "R_kgDOFPvgPg",
     },