rpms/netavark

Fork 0

Policy review: blocked upstream update: netavark 1.17.1 → 2.0.0 #3

New issue

Open

opened 2026-06-11 03:14:22 +03:00 by sbelikov · 0 comments

sbelikov commented

2026-06-11 03:14:22 +03:00

Owner

Policy review: blocked upstream update: `netavark` `1.17.1` → `2.0.0`

Package

Package: netavark
RPM name: netavark
Branch: niceos-5.2
Current EVR: 1:1.17.1-1
Update class: major
Compare method: python_rpm
Update policy: leaf
Risk tags: github-upstream, network-facing

Upstream

Upstream type: github
Upstream project: containers/netavark
Upstream URL: github.com — netavark
Detected version: 2.0.0
Tag/release: v2.0.0
Source: github_release_latest
Published: 2026-06-10T16:02:21Z
Release URL: github.com — v2.0.0
Source URL: api.github.com — v2.0.0
Pre-release: False

Signals

Security-relevant keywords detected: False
Policy blocked: True
Policy reason: package policy/risk requires manual review (leaf, github-upstream,network-facing)
Labels: ai-summary, bot, needs-policy-decision, policy/blocked, policy/major-blocked, priority/high, update/major, upstream-update, upstream/github

NiceOS policy decision

This upstream update is blocked by NiceOS policy. Do not update automatically.

Blocked upstream updates require explicit maintainer review. For pinned upstream series, only versions within the allowed series should be used automatically; cross-series updates require ABI/API compatibility review, reverse-dependency impact analysis and controlled rebuild planning.

NiceSOFT AI preliminary stability analysis

1. Краткий вывод

Пакет netavark был обновлен на версию 2.0.0, включая бreaking changes в сетевых режимах, требующих совместимости с podman 6.0 и buildah 1.44. Риск для NAIOS.OS: medium (network-facing, critical changes).

2. Риск для НАЙС.ОС

Medium

Изменения в сетевых режимах (strict isolation) требуют настройки isolate=false в конфигурации.
Нужно проверить совместимость с текущими инструментами (podman/buildah).

3. Security/CVE

Нет признаков security/CVE в входных данных.

4. ABI/API риск

High

Изменения в сетевых режимах (bridge driver, mtu, outbound_addr4/6) могут повлиять на ABI/ABI-совместимость.
Нужен ручной анализ для проверки влияния на патчи и BuildRequires.

5. Риск для RPM-сборки

Потенциальные проблемы с патчами (например, изменение поведения сетевых режимов).
Нужно проверить совместимость с текущими spec-файлами и BuildRequires.

6. Проверки мейнтейнера

Проверить совместимость с podman/buildah (включая isolate=false).
Проверить изменения в сетевых режимах (bridge, mtu, outbound_addr4/6).
Проверить влияние на патчи и BuildRequires.

7. Рекомендация

blocked manual review
Основание: высокий риск из-за бreaking changes, требующих специальной настройки и совместимости с поддерживаемыми инструментами.

8. Основание рекомендации

Версия 2.0.0 включает критические изменения в сетевых режимах, требующие специальной настройки и совместимости с поддерживаемыми инструментами (podman/buildah). Пакет блокируется из-за высокого риска и требует ручной проверки.

Источники, найденные web_search

Upstream release notes / description

This is major release with breaking changes. It is required for podman 6.0 and buildah 1.44 and only supported to be used with them together. Packagers need to ensure they update the versions in sync.

Removed iptables support
The bridge network driver now defaults to strict isolation mode, this means different networks can no longer talk to each by default. To restore the previous behavior the network must set the isolate=false option. (podman-container-tools/podman#27349)
The macvlan network driver now use a default mtu of 99. (podman-container-tools/podman#23984)
Added network create support, podman now calls netavark create to create a network config.
The bridge network driver now supports the outbound_addr4 and outbound_addr6 options to specify the outgoing NAT source address.
Netavark now supports assigning multiple static ip addresses per subnet.
The MSRV has been bumped to v1.88.
Dependency updates.

NiceOS maintainer checklist

Confirm that the detected version is a stable upstream release.
Check upstream changelog for security fixes, ABI/API changes and build-system changes.
Check ABI/API compatibility and reverse dependencies.
Download source into NiceOS lookaside storage.
Update Version and related fields in SPECS/*.spec only if policy allows it.
Regenerate SOURCES/sources.lock.json, manifests, metadata and SBOM.
Build SRPM/RPM in a clean NiceOS buildroot.
Run package smoke tests.
Link PR/build logs and close this issue after update or triage.

Bot metadata

Tool: niceos_upstream_monitor.py 2.1.3-local-websearch-github-release-pages
Generated at: 2026-07-26T00:14:45Z

# Policy review: blocked upstream update: `netavark` `1.17.1` → `2.0.0` ## Package - Package: `netavark` - RPM name: `netavark` - Branch: `niceos-5.2` - Current EVR: `1:1.17.1-1` - Update class: `major` - Compare method: `python_rpm` - Update policy: `leaf` - Risk tags: `github-upstream, network-facing` ## Upstream - Upstream type: `github` - Upstream project: `containers/netavark` - Upstream URL: <a href="https://github.com/containers/netavark" target="_blank" rel="noopener noreferrer">github.com — netavark</a> - Detected version: `2.0.0` - Tag/release: `v2.0.0` - Source: `github_release_latest` - Published: `2026-06-10T16:02:21Z` - Release URL: <a href="https://github.com/containers/netavark/releases/tag/v2.0.0" target="_blank" rel="noopener noreferrer">github.com — v2.0.0</a> - Source URL: <a href="https://api.github.com/repos/containers/netavark/tarball/v2.0.0" target="_blank" rel="noopener noreferrer">api.github.com — v2.0.0</a> - Pre-release: `False` ## Signals - Security-relevant keywords detected: `False` - Policy blocked: `True` - Policy reason: `package policy/risk requires manual review (leaf, github-upstream,network-facing)` - Labels: `ai-summary, bot, needs-policy-decision, policy/blocked, policy/major-blocked, priority/high, update/major, upstream-update, upstream/github` ## NiceOS policy decision **This upstream update is blocked by NiceOS policy. Do not update automatically.** Blocked upstream updates require explicit maintainer review. For pinned upstream series, only versions within the allowed series should be used automatically; cross-series updates require ABI/API compatibility review, reverse-dependency impact analysis and controlled rebuild planning. ## NiceSOFT AI preliminary stability analysis ### 1. Краткий вывод Пакет netavark был обновлен на версию 2.0.0, включая бreaking changes в сетевых режимах, требующих совместимости с podman 6.0 и buildah 1.44. Риск для NAIOS.OS: medium (network-facing, critical changes). ### 2. Риск для НАЙС.ОС **Medium** - Изменения в сетевых режимах (strict isolation) требуют настройки `isolate=false` в конфигурации. - Нужно проверить совместимость с текущими инструментами (podman/buildah). ### 3. Security/CVE Нет признаков security/CVE в входных данных. ### 4. ABI/API риск **High** - Изменения в сетевых режимах (bridge driver, mtu, outbound_addr4/6) могут повлиять на ABI/ABI-совместимость. - Нужен ручной анализ для проверки влияния на патчи и BuildRequires. ### 5. Риск для RPM-сборки - Потенциальные проблемы с патчами (например, изменение поведения сетевых режимов). - Нужно проверить совместимость с текущими spec-файлами и BuildRequires. ### 6. Проверки мейнтейнера - Проверить совместимость с podman/buildah (включая `isolate=false`). - Проверить изменения в сетевых режимах (bridge, mtu, outbound_addr4/6). - Проверить влияние на патчи и BuildRequires. ### 7. Рекомендация **blocked manual review** **Основание:** высокий риск из-за бreaking changes, требующих специальной настройки и совместимости с поддерживаемыми инструментами. ### 8. Основание рекомендации Версия 2.0.0 включает критические изменения в сетевых режимах, требующие специальной настройки и совместимости с поддерживаемыми инструментами (podman/buildah). Пакет блокируется из-за высокого риска и требует ручной проверки. ### Источники, найденные web_search 1. <a href="https://github.com/containers/netavark/releases/tag/v2.0.0" target="_blank" rel="noopener noreferrer">GitHub release API: containers/netavark v2.0.0</a> 2. <a href="https://github.com/containers/netavark/tree/v2.0.0" target="_blank" rel="noopener noreferrer">GitHub tag page: containers/netavark v2.0.0</a> 3. <a href="https://github.com/containers/netavark/releases" target="_blank" rel="noopener noreferrer">GitHub releases page: containers/netavark</a> 4. <a href="https://github.com/containers/netavark/compare/v1.17.1...v2.0.0" target="_blank" rel="noopener noreferrer">GitHub compare page: containers/netavark v1.17.1...v2.0.0</a> 5. <a href="https://www.gotokyo.org/jp/index.html" target="_blank" rel="noopener noreferrer">東京の観光公式サイトGO TOKYO</a> 6. <a href="https://lib.rs/crates/netavark" target="_blank" rel="noopener noreferrer">Netavark — Rust utility // Lib.rs</a> 7. <a href="https://www.metro.tokyo.lg.jp/" target="_blank" rel="noopener noreferrer">都庁総合ホームページ</a> 8. <a href="https://packages.gentoo.org/packages/app-containers/netavark" target="_blank" rel="noopener noreferrer">app-containers/netavark - Gentoo Packages</a> 9. <a href="https://calculator.com/" target="_blank" rel="noopener noreferrer">...calculate anything, anytime, anywhere. | calculator.com</a> ## Upstream release notes / description This is major release with breaking changes. It is required for podman 6.0 and buildah 1.44 and only supported to be used with them together. Packagers need to ensure they update the versions in sync. * Removed iptables support * The bridge network driver now defaults to strict isolation mode, this means different networks can no longer talk to each by default. To restore the previous behavior the network must set the `isolate=false` option. (<a href="https://github.com/podman-container-tools/podman/issues/27349" target="_blank" rel="noopener noreferrer">podman-container-tools/podman#27349</a>) * The macvlan network driver now use a default mtu of 99. (<a href="https://github.com/podman-container-tools/podman/issues/23984" target="_blank" rel="noopener noreferrer">podman-container-tools/podman#23984</a>) * Added network create support, podman now calls netavark create to create a network config. * The bridge network driver now supports the `outbound_addr4` and `outbound_addr6` options to specify the outgoing NAT source address. * Netavark now supports assigning multiple static ip addresses per subnet. * The MSRV has been bumped to v1.88. * Dependency updates. ## NiceOS maintainer checklist - [ ] Confirm that the detected version is a stable upstream release. - [ ] Check upstream changelog for security fixes, ABI/API changes and build-system changes. - [ ] Check ABI/API compatibility and reverse dependencies. - [ ] Download source into NiceOS lookaside storage. - [ ] Update `Version` and related fields in `SPECS/*.spec` only if policy allows it. - [ ] Regenerate `SOURCES/sources.lock.json`, manifests, metadata and SBOM. - [ ] Build SRPM/RPM in a clean NiceOS buildroot. - [ ] Run package smoke tests. - [ ] Link PR/build logs and close this issue after update or triage. ## Bot metadata - Tool: `niceos_upstream_monitor.py 2.1.3-local-websearch-github-release-pages` - Generated at: `2026-07-26T00:14:45Z`

sbelikov added the

needs-policy-decision

labels

2026-06-11 03:14:22 +03:00