Re: [meta-virtualization] Podman version mismatch

On Tue, Apr 28, 2026 at 8:24 AM <[email protected]> wrote:

>
> > Bruce Ashfield <[email protected]> hat am 28.04.2026 13:23 CEST
> geschrieben:
> >
> >
> >
> >
> >
> > On Tue, Apr 28, 2026 at 7:15 AM Bruce Ashfield via
> lists.yoctoproject.org (http://lists.yoctoproject.org) <bruce.ashfield=
> [email protected]> wrote:
> > >
> > >
> > >
> > > On Tue, Apr 28, 2026 at 2:11 AM Peter Marko via lists.yoctoproject.org
> (http://lists.yoctoproject.org) <peter.marko=
> [email protected]> wrote:
> > > > meta-virtualization has hardly any recipe which fetches exactly git
> tag.
> > > >  So things like this are unfortunately expected.
> > > >  In the past I have sent couple updates to mailing list to use real
> versions, but without success, so I gave up.
> > > >
> > >
> > > Thanks for the encouragement of the 10+ years of
> maintaining meta-virtualization!
> > >
> > > The reason they aren't exact git tags or exact releases is that those
> hashes stay valid
> > > for such a short time that it simply isn't worth it. And there's
> certaining no value in
> > > constantly bouncing the files through _<version>.bb and the _git.bb (
> http://git.bb) every time I
> > > move off an exact release tag.
> > >
> > > Maintaining all this many recipes, that move this quickly by stacking
> patches on to
> > > languages that don't patch all that way would simply be chaos.
> > >
> > > Patrick: there's nothing wrong with script that was intentional on the
> version.
> > >
> >
> > In this case, I looked a bit more closely, upstream is doing something
> different
> > which did in fact make the script report a different version than the
> version in
> > the code:
> >
> > build4 [/home/bruc...git/libpod]> git describe --tags
> > v5.8.2-5-g88c5aaeec6
> > build4 [/home/bruc...git/libpod]> git describe
> > v5.8.2-5-g88c5aaeec6
> >
> >
> > Which is what my script uses to pick up the base version. But the top
> commit
> > on the 5.8 branch:
> >
> > commit 88c5aaeec667af94c4fe3a5c2c7a42f8cf308b93 (from
> 28d04eeb8ec047464c35cc6fbe766ca63b49d338) (HEAD -> v5.8, origin/v5.8)
> > Merge: 28d04eeb8e 7a47175665
> > Author: Paul Holzinger <[email protected]>
> > Date: Wed Apr 15 12:01:24 2026 +0200
> >
> >  Merge pull request #28510 from podmanbot/bump-5.8.3-dev
> >
> >  Bump Podman to v5.8.3-dev
> >
> > :100644 100644 9aba2b5c22 39273508b8 M version/rawversion/version.go
> >
> > Which is of course what the build is picking up.
> >
> > I'll have to add a condition to the upgrade tests to pick that up,
> and/or see
> > if I can put it into the scripting logic (it just won't hold across all
> the languages
> > that are used, so it'll be a bit fiddly).
> >
> > For now, I've manually updated the recipe to match the golang version.
> >
> > Thanks for catching that!
> >
> > Bruce
> >
>
> Thanks for having a closer look. I have no opinion on the reporting but
> for me it would be important the version from the recipe matches the
> version from the sources.
>
>
It's updated now. Let me know if I screwed it up again by sending a patch,

The git hashes and discovery are in the end the most important part of
discovery and scanning, so that's the priority. Versions can be manipulated
(or wrong, as we've seen), so they need to be validated against the source.

I've added a basic unit test to the layer to check versions in the recipes,
versus reported versions.

Bruce



> Patrick
>
> >
> > > Which would be easier in your scenario ? (and by your scenario, I mean
> me changing
> > > the version reporting in the recipe.
> >
> >
> > >
> > > - adding the -dev into the PV
> > > - injecting the "base" version into the build via -X (or whatever
> mechanism the
> > > buld needs) ?
> > >
> > > Bruce
> > >
> > >
> > > > Having the coming regulations in mind (requiring accurate sbom and
> cve tracking), I'd recommend everyone using meta-virtualization to just
> copy any used recipe, correct git hash and update crates.inc.
> > >
> > > > Peter
> > > >
> > > >  > -----Original Message-----
> > > >  > From: [email protected] <meta-
> > > >  > [email protected]> On Behalf Of Patrick
> Vogelaar via
> > > >  > lists.yoctoproject.org (http://lists.yoctoproject.org)
> > > >  > Sent: Tuesday, April 28, 2026 7:19 AM
> > > >  > To: [email protected]
> > > >  > Subject: [meta-virtualization] Podman version mismatch
> > > >  >
> > > >  > Hi,
> > > >  >
> > > >  > I gave the newly upgraded podman recipe a try but it seems that
> there is still a
> > > >  > version mismatch.
> > > >  > PV = "5.8.2" but: podman -v
> > > >  > podman version 5.8.3-dev
> > > >  >
> > > >  > Do you want me to send a patch or do you want to have a look at
> your update
> > > >  > script?
> > > >  >
> > > >  > Patrick
> > > >
> > > >
> > > >
> > > >
> > >
> > >
> > > --
> > >
> > > - Thou shalt not follow the NULL pointer, for chaos and madness await
> thee at its end
> > > - "Use the force Harry" - Gandalf, Star Trek II
> > >
> > >
> > >  -=-=-=-=-=-=-=-=-=-=-=-
> > >  Links: You receive all messages sent to this group.
> > >  View/Reply Online (#9756):
> https://lists.yoctoproject.org/g/meta-virtualization/message/9756
> > >  Mute This Topic: https://lists.yoctoproject.org/mt/119043966/1050810
> > >  Group Owner: [email protected]
> > >  Unsubscribe:
> https://lists.yoctoproject.org/g/meta-virtualization/unsub [
> [email protected]]
> > >  -=-=-=-=-=-=-=-=-=-=-=-
> > >
> > >
> >
> >
> > --
> >
> > - Thou shalt not follow the NULL pointer, for chaos and madness await
> thee at its end
> > - "Use the force Harry" - Gandalf, Star Trek II
> >
>


-- 
- Thou shalt not follow the NULL pointer, for chaos and madness await thee
at its end
- "Use the force Harry" - Gandalf, Star Trek II