diff --git a/SOURCES/1000-podman-tests-drop-nmap-ncat-requirement.patch b/SOURCES/1000-podman-tests-drop-nmap-ncat-requirement.patch deleted file mode 100644 index 9a19009..0000000 --- a/SOURCES/1000-podman-tests-drop-nmap-ncat-requirement.patch +++ /dev/null @@ -1,54 +0,0 @@ -Drop nmap-ncat requirement -Orabug: 34117404 -Signed-Off-By: Tianyue.Lan@oracle.com - -Patch modified due to source changes. -Signed-Off-By: David Sloboda -Signed-off-by: Darren Archibald - -diff -Naur containers-podman-4c14019.orig/test/system/200-pod.bats containers-podman-4c14019/test/system/200-pod.bats ---- containers-podman-4c14019.orig/test/system/200-pod.bats 2024-02-02 15:23:30.000000000 -0800 -+++ containers-podman-4c14019/test/system/200-pod.bats 2024-04-03 08:34:05.071345783 -0700 -@@ -115,6 +115,9 @@ - - # CANNOT BE PARALLELIZED - uses naked ps - @test "podman pod - communicating between pods" { -+ if [[ ! -e /usr/bin/nc ]]; then -+ skip "skip podman pod - communicating between pods test, this test needs nc" -+ fi - podname=pod$(random_string) - run_podman 1 pod exists $podname - run_podman pod create --infra=true --name=$podname -@@ -210,6 +213,9 @@ - - # bats test_tags=ci:parallel - @test "podman pod create - hashtag AllTheOptions" { -+ if [[ ! -e /usr/bin/nc ]]; then -+ skip "Skip podman pod create - hashtag AllTheOptions test, this test needs nc" -+ fi - mac=$(random_mac) - add_host_ip=$(random_ip) - add_host_n=$(random_string | tr A-Z a-z).$(random_string | tr A-Z a-z).xyz -diff -Naur containers-podman-4c14019.orig/test/system/500-networking.bats containers-podman-4c14019/test/system/500-networking.bats ---- containers-podman-4c14019.orig/test/system/500-networking.bats 2024-02-02 15:23:30.000000000 -0800 -+++ containers-podman-4c14019/test/system/500-networking.bats 2024-04-03 08:37:14.230058067 -0700 -@@ -102,6 +102,9 @@ - # Issue #5466 - port-forwarding doesn't work with this option and -d - # FIXME: random_rfc1918_subnet is not parallel-safe - @test "podman networking: port with --userns=keep-id for rootless or --uidmap=* for rootful" { -+ if [[ ! -e /usr/bin/nc ]]; then -+ skip "skip podman networking: port with --userns=keep-id test, this test needs nc" -+ fi - skip_if_cgroupsv1 "run --uidmap fails on cgroups v1 (issue 15025, wontfix)" - for cidr in "" "$(random_rfc1918_subnet).0/24"; do - myport=$(random_free_port 52000-52999) -@@ -251,6 +254,9 @@ - # "network create" now works rootless, with the help of a special container - # FIXME: random_rfc1918_subnet is not parallel-safe - @test "podman network create" { -+ if [[ ! -e /usr/bin/nc ]]; then -+ skip "skip podman network create test, this test needs nc" -+ fi - myport=$(random_free_port) - - local mynetname=testnet-$(safename) diff --git a/SOURCES/1005-Rework-netavark-cni-choice-logic.patch b/SOURCES/1005-Rework-netavark-cni-choice-logic.patch deleted file mode 100644 index dd03d53..0000000 --- a/SOURCES/1005-Rework-netavark-cni-choice-logic.patch +++ /dev/null @@ -1,159 +0,0 @@ -From 78af56f13c262b846ef28a760f012205e4bd0069 Mon Sep 17 00:00:00 2001 -From: Alex Burmashev -Date: Fri, 29 May 2026 06:18:29 +0000 -Subject: [PATCH] Rework netavark/cni choice logic - -With the default podman logic on first podman command invocation -podman does: -- If there are CNI networks existing - choose CNI -- If there is no netavark binary - choose CNI -- If there are existing containers and container images - choose CNI -- Or choose netavark - -On OL9 + podman 5+ netavark is the default network engine. -For vast majority of systems podman correctly chooses netavark on first -invocation, since there are no CNI networks, netavark binary exists and -there are no containers or images on the system. -However, if you pre-seed the system with container images or, for -example, remove /var/lib/containers/storage/defaultNetworkBackend file, -podman on next start will incorrectly choose CNI as a network engine, -when CNI is not even installed. - -This patch reworks CNI/Netavark detection logic. -Now: -1) If there are CNI networks existing - choose CNI -2) If there is a CNI binary existing, we: - - check if there are containers and container images existing, and if - yes - choose CNI -// since CNI is not installed on OL by default, but optionally -available, we make an educated guess, that if someone has both CNI -specifically installed, and existing containers + container images, -likely that person could have relied on old CNI/Netavark detection logic and wants CNI to be default. -3) If netavark binary does not exist, we: - - check if there are containers and container images existing, and if - yes - choose CNI ( also old logic ) -4) Or choose netavark - -This would allow systems, that were pre-populated with container images -to correctly choose netavark by default and will also allow people who -REALLY need it to use CNI. For people already using CNI for whatever -reason, nothing will change. For fresh system nothing changes. - -JIRA: EVG-3769 - -Signed-off-by: Alex Burmashev -Reviewed-by: Laurence Rochfort ---- - .../common/libnetwork/network/interface.go | 7 +- - .../libnetwork/network/interface_cni.go | 70 ++++++++++++------- - 2 files changed, 50 insertions(+), 27 deletions(-) - -diff --git a/vendor/go.podman.io/common/libnetwork/network/interface.go b/vendor/go.podman.io/common/libnetwork/network/interface.go -index 51c1ae7..d4f77c4 100644 ---- a/vendor/go.podman.io/common/libnetwork/network/interface.go -+++ b/vendor/go.podman.io/common/libnetwork/network/interface.go -@@ -31,8 +31,11 @@ const ( - // It returns either the CNI or netavark backend depending on what is set in the config. - // If the backend is set to "" we will automatically assign the backend on the following conditions: - // 1. read ${graphroot}/defaultNetworkBackend --// 2. find netavark binary (if not installed use CNI) --// 3. check containers, images and CNI networks and if there are some we have an existing install and should continue to use CNI -+// 2. check CNI networks and if there are some we have an existing install and should continue to use CNI -+// 3. find CNI binary and if it exists: -+// 3.1 check containers, images and if there are some we have an existing install and should continue to use CNI -+// 4. find netavark binary and if not installed: -+// 4.1 check containers, images and if there are some we use CNI - // - // revive does not like the name because the package is already called network - // -diff --git a/vendor/go.podman.io/common/libnetwork/network/interface_cni.go b/vendor/go.podman.io/common/libnetwork/network/interface_cni.go -index 3de3a30..fbd50f4 100644 ---- a/vendor/go.podman.io/common/libnetwork/network/interface_cni.go -+++ b/vendor/go.podman.io/common/libnetwork/network/interface_cni.go -@@ -55,31 +55,6 @@ func getDefaultCNIConfigDir() (string, error) { - } - - func networkBackendFromStore(store storage.Store, conf *config.Config) (backend types.NetworkBackend, err error) { -- _, err = conf.FindHelperBinary("netavark", false) -- if err != nil { -- // if we cannot find netavark use CNI -- return types.CNI, nil -- } -- -- // If there are any containers then return CNI -- cons, err := store.Containers() -- if err != nil { -- return "", err -- } -- if len(cons) != 0 { -- return types.CNI, nil -- } -- -- // If there are any non ReadOnly images then return CNI -- imgs, err := store.Images() -- if err != nil { -- return "", err -- } -- for _, i := range imgs { -- if !i.ReadOnly { -- return types.CNI, nil -- } -- } - - // If there are CNI Networks then return CNI - cniInterface, err := getCniInterface(conf) -@@ -95,6 +70,51 @@ func networkBackendFromStore(store storage.Store, conf *config.Config) (backend - return types.CNI, nil - } - } -+ _, err = os.Stat("/usr/libexec/cni/vlan") -+ if err == nil { -+ // if we found CNI we check if we have containers and readonly images -+ // If there are any containers or readonly images then return CNI -+ cons, err := store.Containers() -+ if err != nil { -+ return "", err -+ } -+ if len(cons) != 0 { -+ return types.CNI, nil -+ } -+ // If there are any non ReadOnly images then return CNI -+ imgs, err := store.Images() -+ if err != nil { -+ return "", err -+ } -+ for _, i := range imgs { -+ if !i.ReadOnly { -+ return types.CNI, nil -+ } -+ } -+ } -+ -+ _, err = conf.FindHelperBinary("netavark", false) -+ if err != nil { -+ // if we cannot find netavark we check if we have containers and readonly images -+ // If there are any containers or readonly images then return CNI -+ cons, err := store.Containers() -+ if err != nil { -+ return "", err -+ } -+ if len(cons) != 0 { -+ return types.CNI, nil -+ } -+ // If there are any non ReadOnly images then return CNI -+ imgs, err := store.Images() -+ if err != nil { -+ return "", err -+ } -+ for _, i := range imgs { -+ if !i.ReadOnly { -+ return types.CNI, nil -+ } -+ } -+ } - return types.Netavark, nil - } - --- -2.47.3 - diff --git a/SPECS/podman.spec b/SPECS/podman.spec index 6a8e8ce..f88d0d3 100644 --- a/SPECS/podman.spec +++ b/SPECS/podman.spec @@ -14,7 +14,7 @@ GO111MODULE=off go build -buildmode pie -compiler gc -tags="rpm_crashtraceback $ Epoch: 6 Name: podman Version: 5.8.2 -Release: 4.0.1%{?dist} +Release: 4%{?dist} Summary: Manage Pods, Containers and Container Images License: Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND MIT AND MPL-2.0 URL: https://%{name}.io/ @@ -26,11 +26,6 @@ Source0: https://gitlab.cee.redhat.com/sustaining-engineering/container-tools/sr Source1: https://github.com/openSUSE/catatonit/archive/v%{cataver}.tar.gz #Source2: https://github.com/containers/dnsname/archive/v%%{dnsnamever}.tar.gz Source2: https://github.com/containers/dnsname/archive/%{commit_dnsname}/dnsname-%{shortcommit_dnsname}.tar.gz - -# Oracle Patches -Patch1000: 1000-podman-tests-drop-nmap-ncat-requirement.patch -Patch1005: 1005-Rework-netavark-cni-choice-logic.patch - # https://fedoraproject.org/wiki/PackagingDrafts/Go#Go_Language_Architectures ExclusiveArch: %{go_arches} Provides: %{name}-manpages = %{epoch}:%{version}-%{release} @@ -134,6 +129,7 @@ Summary: Tests for %{name} Requires: %{name} = %{epoch}:%{version}-%{release} # Fetch bats rpm if you can, else install any way available Recommends: bats +Requires: nmap-ncat Requires: httpd-tools Requires: jq Requires: socat @@ -381,11 +377,6 @@ fi %{_datadir}/%{name}/test %changelog -* Thu Jul 09 2026 EL Errata - 5.8.2-4.0.1 -- Rework CNI/Netavark detection logic [JIRA: EVG-3769] -- Rebuild on new golang to support experimental GODEBUG fipsnoenforceems -- Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] - * Wed Jul 08 2026 Jindrich Novy - 6:5.8.2-4 - bump to upstream commit a476c2b2 fixing CVE-2026-39835 CVE-2026-39829 CVE-2026-39832 CVE-2026-42508 CVE-2026-27136 CVE-2026-25681 CVE-2026-57231 and