rpms/podman
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import Oracle_OSS podman-5.8.2-4.0.1.el9_8

Browse Source
This commit is contained in:
AlmaLinux RelEng Bot 2026-07-10 08:22:51 -04:00
parent eff850b7d5
commit 6dd3aa09ea
5 changed files with 233 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.gitignore vendored
View File

@ -1,3 +1,3 @@
SOURCES/dnsname-bdc4ab8.tar.gz
SOURCES/podman-5.8.2-5b263b5.tar.gz
SOURCES/podman-a476c2b2c35443a3db1a1668ac7b402eb1eb0619.tar.gz
SOURCES/v0.1.7.tar.gz

2
.podman.metadata
View File

@ -1,3 +1,3 @@
69fb828d3028f968e46420d58cc80bc59e446051 SOURCES/dnsname-bdc4ab8.tar.gz
f0df54b50a211329dae51ed5641a4d3b3e77ddfb SOURCES/podman-5.8.2-5b263b5.tar.gz
4271eba1e0f9df8630c55c41742b93fe3cbb65b6 SOURCES/podman-a476c2b2c35443a3db1a1668ac7b402eb1eb0619.tar.gz
94419a237f932ff2a79c91f6e3005034d9c367a5 SOURCES/v0.1.7.tar.gz

54
SOURCES/1000-podman-tests-drop-nmap-ncat-requirement.patch Normal file
View File

@ -0,0 +1,54 @@
Drop nmap-ncat requirement
Orabug: 34117404
Signed-Off-By: Tianyue.Lan@oracle.com
Patch modified due to source changes.
Signed-Off-By: David Sloboda <david.x.sloboda@oracle.com>
Signed-off-by: Darren Archibald <darren.archibald@oracle.com>
diff -Naur containers-podman-4c14019.orig/test/system/200-pod.bats containers-podman-4c14019/test/system/200-pod.bats
--- containers-podman-4c14019.orig/test/system/200-pod.bats 2024-02-02 15:23:30.000000000 -0800
+++ containers-podman-4c14019/test/system/200-pod.bats 2024-04-03 08:34:05.071345783 -0700
@@ -115,6 +115,9 @@
# CANNOT BE PARALLELIZED - uses naked ps
@test "podman pod - communicating between pods" {
+ if [[ ! -e /usr/bin/nc ]]; then
+ skip "skip podman pod - communicating between pods test, this test needs nc"
+ fi
podname=pod$(random_string)
run_podman 1 pod exists $podname
run_podman pod create --infra=true --name=$podname
@@ -210,6 +213,9 @@
# bats test_tags=ci:parallel
@test "podman pod create - hashtag AllTheOptions" {
+ if [[ ! -e /usr/bin/nc ]]; then
+ skip "Skip podman pod create - hashtag AllTheOptions test, this test needs nc"
+ fi
mac=$(random_mac)
add_host_ip=$(random_ip)
add_host_n=$(random_string | tr A-Z a-z).$(random_string | tr A-Z a-z).xyz
diff -Naur containers-podman-4c14019.orig/test/system/500-networking.bats containers-podman-4c14019/test/system/500-networking.bats
--- containers-podman-4c14019.orig/test/system/500-networking.bats 2024-02-02 15:23:30.000000000 -0800
+++ containers-podman-4c14019/test/system/500-networking.bats 2024-04-03 08:37:14.230058067 -0700
@@ -102,6 +102,9 @@
# Issue #5466 - port-forwarding doesn't work with this option and -d
# FIXME: random_rfc1918_subnet is not parallel-safe
@test "podman networking: port with --userns=keep-id for rootless or --uidmap=* for rootful" {
+ if [[ ! -e /usr/bin/nc ]]; then
+ skip "skip podman networking: port with --userns=keep-id test, this test needs nc"
+ fi
skip_if_cgroupsv1 "run --uidmap fails on cgroups v1 (issue 15025, wontfix)"
for cidr in "" "$(random_rfc1918_subnet).0/24"; do
myport=$(random_free_port 52000-52999)
@@ -251,6 +254,9 @@
# "network create" now works rootless, with the help of a special container
# FIXME: random_rfc1918_subnet is not parallel-safe
@test "podman network create" {
+ if [[ ! -e /usr/bin/nc ]]; then
+ skip "skip podman network create test, this test needs nc"
+ fi
myport=$(random_free_port)
local mynetname=testnet-$(safename)

159
SOURCES/1005-Rework-netavark-cni-choice-logic.patch Normal file
View File

@ -0,0 +1,159 @@
From 78af56f13c262b846ef28a760f012205e4bd0069 Mon Sep 17 00:00:00 2001
From: Alex Burmashev <alexander.burmashev@oracle.com>
Date: Fri, 29 May 2026 06:18:29 +0000
Subject: [PATCH] Rework netavark/cni choice logic
With the default podman logic on first podman command invocation
podman does:
- If there are CNI networks existing - choose CNI
- If there is no netavark binary - choose CNI
- If there are existing containers and container images - choose CNI
- Or choose netavark
On OL9 + podman 5+ netavark is the default network engine.
For vast majority of systems podman correctly chooses netavark on first
invocation, since there are no CNI networks, netavark binary exists and
there are no containers or images on the system.
However, if you pre-seed the system with container images or, for
example, remove /var/lib/containers/storage/defaultNetworkBackend file,
podman on next start will incorrectly choose CNI as a network engine,
when CNI is not even installed.
This patch reworks CNI/Netavark detection logic.
Now:
1) If there are CNI networks existing - choose CNI
2) If there is a CNI binary existing, we:
- check if there are containers and container images existing, and if
yes - choose CNI
// since CNI is not installed on OL by default, but optionally
available, we make an educated guess, that if someone has both CNI
specifically installed, and existing containers + container images,
likely that person could have relied on old CNI/Netavark detection logic and wants CNI to be default.
3) If netavark binary does not exist, we:
- check if there are containers and container images existing, and if
yes - choose CNI ( also old logic )
4) Or choose netavark
This would allow systems, that were pre-populated with container images
to correctly choose netavark by default and will also allow people who
REALLY need it to use CNI. For people already using CNI for whatever
reason, nothing will change. For fresh system nothing changes.
JIRA: EVG-3769
Signed-off-by: Alex Burmashev <alexander.burmashev@oracle.com>
Reviewed-by: Laurence Rochfort <laurence.rochfort@oracle.com>
---
.../common/libnetwork/network/interface.go | 7 +-
.../libnetwork/network/interface_cni.go | 70 ++++++++++++-------
2 files changed, 50 insertions(+), 27 deletions(-)
diff --git a/vendor/go.podman.io/common/libnetwork/network/interface.go b/vendor/go.podman.io/common/libnetwork/network/interface.go
index 51c1ae7..d4f77c4 100644
--- a/vendor/go.podman.io/common/libnetwork/network/interface.go
+++ b/vendor/go.podman.io/common/libnetwork/network/interface.go
@@ -31,8 +31,11 @@ const (
// It returns either the CNI or netavark backend depending on what is set in the config.
// If the backend is set to "" we will automatically assign the backend on the following conditions:
// 1. read ${graphroot}/defaultNetworkBackend
-// 2. find netavark binary (if not installed use CNI)
-// 3. check containers, images and CNI networks and if there are some we have an existing install and should continue to use CNI
+// 2. check CNI networks and if there are some we have an existing install and should continue to use CNI
+// 3. find CNI binary and if it exists:
+// 3.1 check containers, images and if there are some we have an existing install and should continue to use CNI
+// 4. find netavark binary and if not installed:
+// 4.1 check containers, images and if there are some we use CNI
//
// revive does not like the name because the package is already called network
//
diff --git a/vendor/go.podman.io/common/libnetwork/network/interface_cni.go b/vendor/go.podman.io/common/libnetwork/network/interface_cni.go
index 3de3a30..fbd50f4 100644
--- a/vendor/go.podman.io/common/libnetwork/network/interface_cni.go
+++ b/vendor/go.podman.io/common/libnetwork/network/interface_cni.go
@@ -55,31 +55,6 @@ func getDefaultCNIConfigDir() (string, error) {
}
func networkBackendFromStore(store storage.Store, conf *config.Config) (backend types.NetworkBackend, err error) {
- _, err = conf.FindHelperBinary("netavark", false)
- if err != nil {
- // if we cannot find netavark use CNI
- return types.CNI, nil
- }
-
- // If there are any containers then return CNI
- cons, err := store.Containers()
- if err != nil {
- return "", err
- }
- if len(cons) != 0 {
- return types.CNI, nil
- }
-
- // If there are any non ReadOnly images then return CNI
- imgs, err := store.Images()
- if err != nil {
- return "", err
- }
- for _, i := range imgs {
- if !i.ReadOnly {
- return types.CNI, nil
- }
- }
// If there are CNI Networks then return CNI
cniInterface, err := getCniInterface(conf)
@@ -95,6 +70,51 @@ func networkBackendFromStore(store storage.Store, conf *config.Config) (backend
return types.CNI, nil
}
}
+ _, err = os.Stat("/usr/libexec/cni/vlan")
+ if err == nil {
+ // if we found CNI we check if we have containers and readonly images
+ // If there are any containers or readonly images then return CNI
+ cons, err := store.Containers()
+ if err != nil {
+ return "", err
+ }
+ if len(cons) != 0 {
+ return types.CNI, nil
+ }
+ // If there are any non ReadOnly images then return CNI
+ imgs, err := store.Images()
+ if err != nil {
+ return "", err
+ }
+ for _, i := range imgs {
+ if !i.ReadOnly {
+ return types.CNI, nil
+ }
+ }
+ }
+
+ _, err = conf.FindHelperBinary("netavark", false)
+ if err != nil {
+ // if we cannot find netavark we check if we have containers and readonly images
+ // If there are any containers or readonly images then return CNI
+ cons, err := store.Containers()
+ if err != nil {
+ return "", err
+ }
+ if len(cons) != 0 {
+ return types.CNI, nil
+ }
+ // If there are any non ReadOnly images then return CNI
+ imgs, err := store.Images()
+ if err != nil {
+ return "", err
+ }
+ for _, i := range imgs {
+ if !i.ReadOnly {
+ return types.CNI, nil
+ }
+ }
+ }
return types.Netavark, nil
}
--
2.47.3

22
SPECS/podman.spec
View File

@ -5,7 +5,7 @@ GO111MODULE=off go build -buildmode pie -compiler gc -tags="rpm_crashtraceback $
%global import_path github.com/containers/podman
#%%global branch v5.6-rhel
%global commit0 5b263b5f5b48004a87caac44e67349a8266d9ef4
%global commit0 a476c2b2c35443a3db1a1668ac7b402eb1eb0619
%global shortcommit0 %(c=%{commit0}; echo ${c:0:7})
%global cataver 0.1.7
%global commit_dnsname bdc4ab85266ade865a7c398336e98721e62ef6b2
@ -14,18 +14,23 @@ GO111MODULE=off go build -buildmode pie -compiler gc -tags="rpm_crashtraceback $
Epoch: 6
Name: podman
Version: 5.8.2
Release: 3%{?dist}
Release: 4.0.1%{?dist}
Summary: Manage Pods, Containers and Container Images
License: Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND MIT AND MPL-2.0
URL: https://%{name}.io/
%if 0%{?branch:1}
Source0: https://%{import_path}/tarball/%{commit0}/%{branch}-%{shortcommit0}.tar.gz
%else
Source0: https://%{import_path}/archive/%{commit0}/%{name}-%{version}-%{shortcommit0}.tar.gz
Source0: https://gitlab.cee.redhat.com/sustaining-engineering/container-tools/src-git/%{name}/-/archive/%{commit0}/%{name}-%{commit0}.tar.gz
%endif
Source1: https://github.com/openSUSE/catatonit/archive/v%{cataver}.tar.gz
#Source2: https://github.com/containers/dnsname/archive/v%%{dnsnamever}.tar.gz
Source2: https://github.com/containers/dnsname/archive/%{commit_dnsname}/dnsname-%{shortcommit_dnsname}.tar.gz
# Oracle Patches
Patch1000: 1000-podman-tests-drop-nmap-ncat-requirement.patch
Patch1005: 1005-Rework-netavark-cni-choice-logic.patch
# https://fedoraproject.org/wiki/PackagingDrafts/Go#Go_Language_Architectures
ExclusiveArch: %{go_arches}
Provides: %{name}-manpages = %{epoch}:%{version}-%{release}
@ -129,7 +134,6 @@ Summary: Tests for %{name}
Requires: %{name} = %{epoch}:%{version}-%{release}
# Fetch bats rpm if you can, else install any way available
Recommends: bats
Requires: nmap-ncat
Requires: httpd-tools
Requires: jq
Requires: socat
@ -377,6 +381,16 @@ fi
%{_datadir}/%{name}/test
%changelog
* Thu Jul 09 2026 EL Errata <el-errata_ww@oracle.com> - 5.8.2-4.0.1
- Rework CNI/Netavark detection logic [JIRA: EVG-3769]
- Rebuild on new golang to support experimental GODEBUG fipsnoenforceems
- Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404]
* Wed Jul 08 2026 Jindrich Novy <jnovy@redhat.com> - 6:5.8.2-4
- bump to upstream commit a476c2b2 fixing CVE-2026-39835 CVE-2026-39829
CVE-2026-39832 CVE-2026-42508 CVE-2026-27136 CVE-2026-25681 CVE-2026-57231 and
podman-remote save regression
* Thu May 07 2026 Jindrich Novy <jnovy@redhat.com> - 6:5.8.2-3
- Rebuild for CVE-2026-32283
- Resolves: RHEL-167685