From a19307f50297150dcfa6c9048fa8e51c9e6b1b85 Mon Sep 17 00:00:00 2001
From: Zifei Tong <zifeitong@gmail.com>
Date: Fri, 5 Sep 2025 18:50:01 -0700
Subject: [PATCH 1/2] Fix podman build "newer" pull policy

It's currently ignored.

Fixes: #22845

Signed-off-by: Zifei Tong <zifeitong@gmail.com>
---
 cmd/podman/common/build.go | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/cmd/podman/common/build.go b/cmd/podman/common/build.go
index d0a5b623e0..a792961df5 100644
--- a/cmd/podman/common/build.go
+++ b/cmd/podman/common/build.go
@@ -324,6 +324,10 @@ func buildFlagsWrapperToOptions(c *cobra.Command, contextDir string, flags *Buil
 		pullPolicy = buildahDefine.PullNever
 	}
 
+	if strings.EqualFold(strings.TrimSpace(flags.Pull), "newer") {
+		pullPolicy = buildahDefine.PullIfNewer
+	}
+
 	var cleanTmpFile bool
 	flags.Authfile, cleanTmpFile = buildahUtil.MirrorToTempFileIfPathIsDescriptor(flags.Authfile)
 	if cleanTmpFile {

From 58e99d605c9a58537a22c66f33615df2b43ac34b Mon Sep 17 00:00:00 2001
From: Zifei Tong <zifeitong@gmail.com>
Date: Tue, 9 Sep 2025 13:16:00 -0700
Subject: [PATCH 2/2] Add system test

Signed-off-by: Zifei Tong <zifeitong@gmail.com>
---
 test/system/070-build.bats | 56 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 56 insertions(+)

diff --git a/test/system/070-build.bats b/test/system/070-build.bats
index 7fcf5c87f3..ecf4f79b42 100644
--- a/test/system/070-build.bats
+++ b/test/system/070-build.bats
@@ -6,6 +6,7 @@
 
 load helpers
 load helpers.network
+load helpers.registry
 
 @test "podman build - basic test" {
     rand_filename=$(random_string 20)
@@ -951,6 +952,61 @@ EOF
        "--pull-never fails with expected error message"
 }
 
+@test "podman build --pull=newer" {
+    skip_if_remote "tests depend on start_registry which does not work with podman-remote"
+    start_registry
+
+    local registry=localhost:${PODMAN_LOGIN_REGISTRY_PORT}
+    local image_for_test=$registry/i-$(safename):$(random_string)
+    local authfile=$PODMAN_TMPDIR/authfile.json
+    local tmpdir=$PODMAN_TMPDIR/build-test
+
+    run_podman login --authfile=$authfile \
+        --tls-verify=false \
+        --username ${PODMAN_LOGIN_USER} \
+        --password ${PODMAN_LOGIN_PASS} \
+        $registry
+
+    # Generate a test image and push it to the registry.
+    # For safety in parallel runs, test image must be isolated
+    # from $IMAGE. A simple add-tag will not work. (#23756)
+    run_podman create -q $IMAGE true
+    local tmpcid=$output
+    run_podman commit -q $tmpcid $image_for_test
+    run_podman rm $tmpcid
+    run_podman image push --tls-verify=false --authfile=$authfile $image_for_test
+
+    local tmpdir=$PODMAN_TMPDIR/build-test
+    mkdir -p $tmpdir
+
+    # Now build using $image_for_test
+    cat >$tmpdir/Containerfile <<EOF
+FROM $image_for_test
+EOF
+
+    # Build the image
+    run_podman build $tmpdir --pull=newer --tls-verify=false --authfile=$authfile
+    is "$output" ".*pull" "pull seen in log"
+    is "$output" ".*COMMIT" "COMMIT seen in log"
+
+    # Build again
+    run_podman build $tmpdir --pull=newer --tls-verify=false --authfile=$authfile
+    assert "$output" !~ "pull" "should not pull the image again"
+
+    # Now refresh the remote image
+    run_podman create -q $IMAGE true
+    local tmpcid=$output
+    run_podman commit -q $tmpcid $image_for_test
+    run_podman rm $tmpcid
+    run_podman image push --tls-verify=false --authfile=$authfile $image_for_test
+
+    # Build one more time
+    run_podman build $tmpdir --pull=newer --tls-verify=false --authfile=$authfile
+    is "$output" ".*pull" "pull seen in log"
+
+    run_podman image rm --ignore $image_for_test
+}
+
 @test "podman build --logfile test" {
     tmpdir=$PODMAN_TMPDIR/build-test
     mkdir -p $tmpdir