Upgrade QEMU to 10.1.3 / fix tar+fcntl+openat2 issue on musl aarch64

[chadlwilson]

fixes #285
closes #283

This PR augments #283 in order to

• Upgrade QEMU to 10.1.3
• Bring in the latest upstream qemu patches from aports which fixes Failed to run tar on aarch64 when using QEMU compiled by tonistiigi/binfmt #285
  • see there for detail - TL;DR glibc compiled gnutar is broken via QEMU compiled for musl aarch64 after the fix for CVE-2025-45582
  • this issue is currently breaking buildkit/buildx cross-arch aarch64 builds of images such as almalinux:9/10 ubi:9/10 etc when using tar
  • QEMU upstream issue
  • aports/qemu patch in question for 3.23 is this one cherry-picked from this MR

None of the direct-execve patches have been altered from their 10.0 versions.

Testing

Tests/builds all passing on my fork at https://github.com/chadlwilson/binfmt/actions/runs/21826024785

Other Notes

(edit: this will be done in #293 instead)

As a side effect to make this happen

• Upgrades to Alpine 3.23 and go 1.25 (tests left as-is)
• Fixes an issue with bringing in crossarch busybox-static on Alpine 3.23
  • older approach no longer works and will give execve format error during busybox triggers, since apk tries to upgrade/replace all existing installs with the new arch; breaking the crossarch builder stage
  • uses an alternate apk --root to install the cross-arch busybox-static instead
• Upgrades golanglint-ci to v2 (used golangci-lint migrate to migrate config as-is)

[chadlwilson]

FWIW i tried upgrading the tests golang version and pkg dependencies but there is an issue with the scheduling tests that needs some work so I dropped it to keep this more focused

I also tried upgrading the main vendored dependencies which also worked fine but also left aside due to distracting from core goal.

[chadlwilson]

Any thoughts on this @tonistiigi or @crazy-max - now that the tests are all passing? 🙏

[ggjulio]

@tonistiigi @crazy-max ? 🙏

[crazy-max]

We should split Go and QEMU update. Opened #293 to first update to go 1.25 with also bake definition changes. I picked your patch for cross arch issue in BuildKit tests.

[chadlwilson]

We should split Go and QEMU update. Opened #293 to first update to go 1.25 with also bake definition changes. I picked your patch for cross arch issue in BuildKit tests.

@crazy-max OK, fair enough; have rebased now onto master with just the QEMU bits.

I thought I would need to have Alpine 3.23 images in use to safely pick an aports commit/patch that was from the 3.23-stable branch of QEMU. (in other words, I thought it was confusing to be using a set of aports qemu patches only on the 3.23 branch when this repo was still using Alpine 3.21). But the tests do seem to pass as least.

Since this repo seemed to not be getting much love, and the builds are quite time consuming, I did things together for expediency/safety, building on the other contributor's patch at #283 which had already bumped the versions; but seems Alpine 3.23/Go 1.25 aren't actually required to get the tests to pass.

Glad to just have some progress anyway.

[pbo-linaro]

@chadlwilson Happy to see you got an answer for this. Hopefully will be straightforward to merge the changes from here.
Thanks @crazy-max.

[crazy-max]

@chadlwilson #293 just got merged, can you rebase?

[chadlwilson]

@crazy-max done.

[crazy-max]

Thanks!

[ggjulio]

@crazy-max sorry for asking, but any ETA for the release ?

[chadlwilson]

There are -master tags on docker hub which you can try (and/or pin to hash) if you are installing binfmt rather than relying on the version embedded inside buildkit.

[ggjulio]

Master works fine. Il'l use master's digest until next new release. Ty!