From 6dd3aa09ea93a45e7ba8d40749742f75e405a740 Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Fri, 10 Jul 2026 08:22:51 -0400 Subject: [PATCH] import Oracle_OSS podman-5.8.2-4.0.1.el9_8 --- .gitignore | 2 +- .podman.metadata | 2 +- ...man-tests-drop-nmap-ncat-requirement.patch | 54 ++++++ ...005-Rework-netavark-cni-choice-logic.patch | 159 ++++++++++++++++++ SPECS/podman.spec | 22 ++- 5 files changed, 233 insertions(+), 6 deletions(-) create mode 100644 SOURCES/1000-podman-tests-drop-nmap-ncat-requirement.patch create mode 100644 SOURCES/1005-Rework-netavark-cni-choice-logic.patch diff --git a/.gitignore b/.gitignore index f8afd3e..b93f8e8 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,3 @@ SOURCES/dnsname-bdc4ab8.tar.gz -SOURCES/podman-5.8.2-5b263b5.tar.gz +SOURCES/podman-a476c2b2c35443a3db1a1668ac7b402eb1eb0619.tar.gz SOURCES/v0.1.7.tar.gz diff --git a/.podman.metadata b/.podman.metadata index 5b08890..da0e22d 100644 --- a/.podman.metadata +++ b/.podman.metadata @@ -1,3 +1,3 @@ 69fb828d3028f968e46420d58cc80bc59e446051 SOURCES/dnsname-bdc4ab8.tar.gz -f0df54b50a211329dae51ed5641a4d3b3e77ddfb SOURCES/podman-5.8.2-5b263b5.tar.gz +4271eba1e0f9df8630c55c41742b93fe3cbb65b6 SOURCES/podman-a476c2b2c35443a3db1a1668ac7b402eb1eb0619.tar.gz 94419a237f932ff2a79c91f6e3005034d9c367a5 SOURCES/v0.1.7.tar.gz diff --git a/SOURCES/1000-podman-tests-drop-nmap-ncat-requirement.patch b/SOURCES/1000-podman-tests-drop-nmap-ncat-requirement.patch new file mode 100644 index 0000000..9a19009 --- /dev/null +++ b/SOURCES/1000-podman-tests-drop-nmap-ncat-requirement.patch @@ -0,0 +1,54 @@ +Drop nmap-ncat requirement +Orabug: 34117404 +Signed-Off-By: Tianyue.Lan@oracle.com + +Patch modified due to source changes. +Signed-Off-By: David Sloboda +Signed-off-by: Darren Archibald + +diff -Naur containers-podman-4c14019.orig/test/system/200-pod.bats containers-podman-4c14019/test/system/200-pod.bats +--- containers-podman-4c14019.orig/test/system/200-pod.bats 2024-02-02 15:23:30.000000000 -0800 ++++ containers-podman-4c14019/test/system/200-pod.bats 2024-04-03 08:34:05.071345783 -0700 +@@ -115,6 +115,9 @@ + + # CANNOT BE PARALLELIZED - uses naked ps + @test "podman pod - communicating between pods" { ++ if [[ ! -e /usr/bin/nc ]]; then ++ skip "skip podman pod - communicating between pods test, this test needs nc" ++ fi + podname=pod$(random_string) + run_podman 1 pod exists $podname + run_podman pod create --infra=true --name=$podname +@@ -210,6 +213,9 @@ + + # bats test_tags=ci:parallel + @test "podman pod create - hashtag AllTheOptions" { ++ if [[ ! -e /usr/bin/nc ]]; then ++ skip "Skip podman pod create - hashtag AllTheOptions test, this test needs nc" ++ fi + mac=$(random_mac) + add_host_ip=$(random_ip) + add_host_n=$(random_string | tr A-Z a-z).$(random_string | tr A-Z a-z).xyz +diff -Naur containers-podman-4c14019.orig/test/system/500-networking.bats containers-podman-4c14019/test/system/500-networking.bats +--- containers-podman-4c14019.orig/test/system/500-networking.bats 2024-02-02 15:23:30.000000000 -0800 ++++ containers-podman-4c14019/test/system/500-networking.bats 2024-04-03 08:37:14.230058067 -0700 +@@ -102,6 +102,9 @@ + # Issue #5466 - port-forwarding doesn't work with this option and -d + # FIXME: random_rfc1918_subnet is not parallel-safe + @test "podman networking: port with --userns=keep-id for rootless or --uidmap=* for rootful" { ++ if [[ ! -e /usr/bin/nc ]]; then ++ skip "skip podman networking: port with --userns=keep-id test, this test needs nc" ++ fi + skip_if_cgroupsv1 "run --uidmap fails on cgroups v1 (issue 15025, wontfix)" + for cidr in "" "$(random_rfc1918_subnet).0/24"; do + myport=$(random_free_port 52000-52999) +@@ -251,6 +254,9 @@ + # "network create" now works rootless, with the help of a special container + # FIXME: random_rfc1918_subnet is not parallel-safe + @test "podman network create" { ++ if [[ ! -e /usr/bin/nc ]]; then ++ skip "skip podman network create test, this test needs nc" ++ fi + myport=$(random_free_port) + + local mynetname=testnet-$(safename) diff --git a/SOURCES/1005-Rework-netavark-cni-choice-logic.patch b/SOURCES/1005-Rework-netavark-cni-choice-logic.patch new file mode 100644 index 0000000..dd03d53 --- /dev/null +++ b/SOURCES/1005-Rework-netavark-cni-choice-logic.patch @@ -0,0 +1,159 @@ +From 78af56f13c262b846ef28a760f012205e4bd0069 Mon Sep 17 00:00:00 2001 +From: Alex Burmashev +Date: Fri, 29 May 2026 06:18:29 +0000 +Subject: [PATCH] Rework netavark/cni choice logic + +With the default podman logic on first podman command invocation +podman does: +- If there are CNI networks existing - choose CNI +- If there is no netavark binary - choose CNI +- If there are existing containers and container images - choose CNI +- Or choose netavark + +On OL9 + podman 5+ netavark is the default network engine. +For vast majority of systems podman correctly chooses netavark on first +invocation, since there are no CNI networks, netavark binary exists and +there are no containers or images on the system. +However, if you pre-seed the system with container images or, for +example, remove /var/lib/containers/storage/defaultNetworkBackend file, +podman on next start will incorrectly choose CNI as a network engine, +when CNI is not even installed. + +This patch reworks CNI/Netavark detection logic. +Now: +1) If there are CNI networks existing - choose CNI +2) If there is a CNI binary existing, we: + - check if there are containers and container images existing, and if + yes - choose CNI +// since CNI is not installed on OL by default, but optionally +available, we make an educated guess, that if someone has both CNI +specifically installed, and existing containers + container images, +likely that person could have relied on old CNI/Netavark detection logic and wants CNI to be default. +3) If netavark binary does not exist, we: + - check if there are containers and container images existing, and if + yes - choose CNI ( also old logic ) +4) Or choose netavark + +This would allow systems, that were pre-populated with container images +to correctly choose netavark by default and will also allow people who +REALLY need it to use CNI. For people already using CNI for whatever +reason, nothing will change. For fresh system nothing changes. + +JIRA: EVG-3769 + +Signed-off-by: Alex Burmashev +Reviewed-by: Laurence Rochfort +--- + .../common/libnetwork/network/interface.go | 7 +- + .../libnetwork/network/interface_cni.go | 70 ++++++++++++------- + 2 files changed, 50 insertions(+), 27 deletions(-) + +diff --git a/vendor/go.podman.io/common/libnetwork/network/interface.go b/vendor/go.podman.io/common/libnetwork/network/interface.go +index 51c1ae7..d4f77c4 100644 +--- a/vendor/go.podman.io/common/libnetwork/network/interface.go ++++ b/vendor/go.podman.io/common/libnetwork/network/interface.go +@@ -31,8 +31,11 @@ const ( + // It returns either the CNI or netavark backend depending on what is set in the config. + // If the backend is set to "" we will automatically assign the backend on the following conditions: + // 1. read ${graphroot}/defaultNetworkBackend +-// 2. find netavark binary (if not installed use CNI) +-// 3. check containers, images and CNI networks and if there are some we have an existing install and should continue to use CNI ++// 2. check CNI networks and if there are some we have an existing install and should continue to use CNI ++// 3. find CNI binary and if it exists: ++// 3.1 check containers, images and if there are some we have an existing install and should continue to use CNI ++// 4. find netavark binary and if not installed: ++// 4.1 check containers, images and if there are some we use CNI + // + // revive does not like the name because the package is already called network + // +diff --git a/vendor/go.podman.io/common/libnetwork/network/interface_cni.go b/vendor/go.podman.io/common/libnetwork/network/interface_cni.go +index 3de3a30..fbd50f4 100644 +--- a/vendor/go.podman.io/common/libnetwork/network/interface_cni.go ++++ b/vendor/go.podman.io/common/libnetwork/network/interface_cni.go +@@ -55,31 +55,6 @@ func getDefaultCNIConfigDir() (string, error) { + } + + func networkBackendFromStore(store storage.Store, conf *config.Config) (backend types.NetworkBackend, err error) { +- _, err = conf.FindHelperBinary("netavark", false) +- if err != nil { +- // if we cannot find netavark use CNI +- return types.CNI, nil +- } +- +- // If there are any containers then return CNI +- cons, err := store.Containers() +- if err != nil { +- return "", err +- } +- if len(cons) != 0 { +- return types.CNI, nil +- } +- +- // If there are any non ReadOnly images then return CNI +- imgs, err := store.Images() +- if err != nil { +- return "", err +- } +- for _, i := range imgs { +- if !i.ReadOnly { +- return types.CNI, nil +- } +- } + + // If there are CNI Networks then return CNI + cniInterface, err := getCniInterface(conf) +@@ -95,6 +70,51 @@ func networkBackendFromStore(store storage.Store, conf *config.Config) (backend + return types.CNI, nil + } + } ++ _, err = os.Stat("/usr/libexec/cni/vlan") ++ if err == nil { ++ // if we found CNI we check if we have containers and readonly images ++ // If there are any containers or readonly images then return CNI ++ cons, err := store.Containers() ++ if err != nil { ++ return "", err ++ } ++ if len(cons) != 0 { ++ return types.CNI, nil ++ } ++ // If there are any non ReadOnly images then return CNI ++ imgs, err := store.Images() ++ if err != nil { ++ return "", err ++ } ++ for _, i := range imgs { ++ if !i.ReadOnly { ++ return types.CNI, nil ++ } ++ } ++ } ++ ++ _, err = conf.FindHelperBinary("netavark", false) ++ if err != nil { ++ // if we cannot find netavark we check if we have containers and readonly images ++ // If there are any containers or readonly images then return CNI ++ cons, err := store.Containers() ++ if err != nil { ++ return "", err ++ } ++ if len(cons) != 0 { ++ return types.CNI, nil ++ } ++ // If there are any non ReadOnly images then return CNI ++ imgs, err := store.Images() ++ if err != nil { ++ return "", err ++ } ++ for _, i := range imgs { ++ if !i.ReadOnly { ++ return types.CNI, nil ++ } ++ } ++ } + return types.Netavark, nil + } + +-- +2.47.3 + diff --git a/SPECS/podman.spec b/SPECS/podman.spec index fd20854..6a8e8ce 100644 --- a/SPECS/podman.spec +++ b/SPECS/podman.spec @@ -5,7 +5,7 @@ GO111MODULE=off go build -buildmode pie -compiler gc -tags="rpm_crashtraceback $ %global import_path github.com/containers/podman #%%global branch v5.6-rhel -%global commit0 5b263b5f5b48004a87caac44e67349a8266d9ef4 +%global commit0 a476c2b2c35443a3db1a1668ac7b402eb1eb0619 %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) %global cataver 0.1.7 %global commit_dnsname bdc4ab85266ade865a7c398336e98721e62ef6b2 @@ -14,18 +14,23 @@ GO111MODULE=off go build -buildmode pie -compiler gc -tags="rpm_crashtraceback $ Epoch: 6 Name: podman Version: 5.8.2 -Release: 3%{?dist} +Release: 4.0.1%{?dist} Summary: Manage Pods, Containers and Container Images License: Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND MIT AND MPL-2.0 URL: https://%{name}.io/ %if 0%{?branch:1} Source0: https://%{import_path}/tarball/%{commit0}/%{branch}-%{shortcommit0}.tar.gz %else -Source0: https://%{import_path}/archive/%{commit0}/%{name}-%{version}-%{shortcommit0}.tar.gz +Source0: https://gitlab.cee.redhat.com/sustaining-engineering/container-tools/src-git/%{name}/-/archive/%{commit0}/%{name}-%{commit0}.tar.gz %endif Source1: https://github.com/openSUSE/catatonit/archive/v%{cataver}.tar.gz #Source2: https://github.com/containers/dnsname/archive/v%%{dnsnamever}.tar.gz Source2: https://github.com/containers/dnsname/archive/%{commit_dnsname}/dnsname-%{shortcommit_dnsname}.tar.gz + +# Oracle Patches +Patch1000: 1000-podman-tests-drop-nmap-ncat-requirement.patch +Patch1005: 1005-Rework-netavark-cni-choice-logic.patch + # https://fedoraproject.org/wiki/PackagingDrafts/Go#Go_Language_Architectures ExclusiveArch: %{go_arches} Provides: %{name}-manpages = %{epoch}:%{version}-%{release} @@ -129,7 +134,6 @@ Summary: Tests for %{name} Requires: %{name} = %{epoch}:%{version}-%{release} # Fetch bats rpm if you can, else install any way available Recommends: bats -Requires: nmap-ncat Requires: httpd-tools Requires: jq Requires: socat @@ -377,6 +381,16 @@ fi %{_datadir}/%{name}/test %changelog +* Thu Jul 09 2026 EL Errata - 5.8.2-4.0.1 +- Rework CNI/Netavark detection logic [JIRA: EVG-3769] +- Rebuild on new golang to support experimental GODEBUG fipsnoenforceems +- Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] + +* Wed Jul 08 2026 Jindrich Novy - 6:5.8.2-4 +- bump to upstream commit a476c2b2 fixing CVE-2026-39835 CVE-2026-39829 + CVE-2026-39832 CVE-2026-42508 CVE-2026-27136 CVE-2026-25681 CVE-2026-57231 and + podman-remote save regression + * Thu May 07 2026 Jindrich Novy - 6:5.8.2-3 - Rebuild for CVE-2026-32283 - Resolves: RHEL-167685