[t-lo]

6.0.0 is missing from Gentoo; our package keywords cause build breakage when trying to emerge podman.

Update: added update changelog and CVEs fixed; 2 critical, one high.

[Copilot]

🟡 Changes recommended

Invalid wildcarded lower-bound Portage atoms cause keyword overrides to be ignored, potentially leaving Podman dependencies keyword-masked and blocking the build.

1 open issue

• Remove invalid trailing wildcards from Portage atoms · New

What changed in this PR

Updates Flatcar’s Podman keyword overrides toward 6.1.4 to address build failures caused by Gentoo no longer providing 6.0.0.

Changes:

• Accepts Podman 6.1-series versions and adjusts dependency keyword ranges.
• Adds a changelog entry linking to the Podman 6.1.4 release.

File	Description
sdk_container/​src/​third_party/​coreos-overlay/​profiles/​coreos/​base/​package.accept_keywords	Updates Podman and dependency keyword overrides.
changelog/​updates/​2026-11-06-podman-6.1.4.md	Records the Podman 6.1.4 update.

_{Review effort: Balanced}

[t-lo]

@chewi

Copilot is right. Also, Krzesimir has traditionally kept these very specific with the aim of undoing them later.

I meant to use =app-containers/aardvark-dns-2.1*, will fix.

I'd argue to keep this to get automated patch level updates (and maybe work with comments in mask and allow_keywords in the future), particularly since we're testing podman in CI now.

[Copilot]

🟢 Approval recommended

No active review issues remain for the Podman keyword override and changelog updates.

1 open issue

• Remove invalid trailing wildcards from Portage atoms

_{Review effort: Balanced}

[krnowak]

Should get a security entry for CVE-2026-94603 (flatcar/Flatcar#2441).

[krnowak]

I normally don't use wildcard versions for accept keywords, but I think the exception can be made for container stuff, for which we probably want to have bleeding edge versions in Flatcar.

[Copilot]

🟡 Changes recommended

The security release notes contain a trailing empty advisory placeholder (,[]()), which should be removed so the entry lists only the three supplied advisories.

1 open issue

• Remove dangling empty advisory placeholder from release notes · New

1 resolved since last review

• Remove invalid trailing wildcards from Portage atoms

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The security changelog contains a trailing ,[]() placeholder that creates an empty advisory link and a dangling comma after the three CVEs.

No open issues 🎉

1 resolved since last review

• Remove dangling empty advisory placeholder from release notes

_{Review effort: Balanced}

[t-lo]

Should get a security entry for CVE-2026-94603 (flatcar/Flatcar#2441).

Done, thanks!

I normally don't use wildcard versions for accept keywords, but I think the exception can be made for container stuff, for which we probably want to have bleeding edge versions in Flatcar.

I think we can be more relaxed towards patch level changes in the future for ebuilds in gentoo. Trying to keep the manual work down to a minimum and automate more.

[Copilot]

🟢 Approval recommended

No active review issues were identified for the Podman 6.1.4 update.

No open issues 🎉

_{Review effort: Balanced}