How does RH keep Podman 4.9 upto-date for security patches (CVEs) on RHEL8

[shismaha-te]

👋 Team, How does Red Hat make sure that podman4.9 will be upto-date for security patches (e.g. CVEs) on RHEL8 . IIUC, podman5 will never be released for RHEL8 (relevant comment). Does RHEL8 builds from https://github.com/containers/podman/tree/v4.9-rhel and this will be kept upto date for all CVEs?

[Luap99]

Just like any other package, security fixes are backport to older versions assuming they are still supported in RHEL.
And yes we generally use the upstream -rhel branches for builds in RHEL but that doesn't mean that there will not be any other patches or all of the branches are supported.

In general that is question that you should ask Red Hat and not upstream.

[shismaha-te]

@Luap99 Thanks for the response! The thing I am trying to understand is:

RHEL8 will not ship Podman5 ever. Currently they are on 4.9.4, We want to use same version for our other distributions and build from source. I know whatever rpm RHEL8 ships will be upto date on CVEs and RH makes sure that all security patches are back ported and upto date.

This is more of a question to upstream - which github branch I should use to build from source, so I can stay upto on CVEs?
Based on this comment I cannot use https://github.com/containers/podman/tree/v4.9 for building podman from source, as that would stop getting security patches backported after Fedora39 is EOL, which is next month (11/2024). Hence, I was wondering if I should be using https://github.com/containers/podman/tree/v4.9-rhel for building podman?

[Luap99]

yes 4.9-rhel should contain the real source as used in RHEL but that isn't something we would advertise as use for others as we would not support it outside of RHEL. Basically any code change there needs a RHEL bug. And we also would not announce if this version is EOL in RHEL and no longer supported.

But if a copy of RHEL is what you want sure this branch should work fine for you.

[shismaha-te]

Thank you @Luap99