From d255e02432f1ae164f7c924ac97110adca28bd6c Mon Sep 17 00:00:00 2001 From: JR Boos Date: Wed, 26 Aug 2026 17:02:09 -0400 Subject: [PATCH 1/2] Update Konflux base images to 3.5.1 and refresh RPM lockfile --- .konflux/build-args-konflux.conf | 4 +- .konflux/redhat.repo | 14 +++ .konflux/rpms.in.yaml | 3 +- .konflux/rpms.lock.yaml | 24 ++--- scripts/generate-rpm-lock.sh | 161 +++++++++++++++++++++++++++++++ 5 files changed, 191 insertions(+), 15 deletions(-) create mode 100755 scripts/generate-rpm-lock.sh diff --git a/.konflux/build-args-konflux.conf b/.konflux/build-args-konflux.conf index 76e3aed7a..02915eeb5 100644 --- a/.konflux/build-args-konflux.conf +++ b/.konflux/build-args-konflux.conf @@ -1,4 +1,4 @@ -BUILDER_BASE_IMAGE=quay.io/aipcc/base-images/cpu:3.5.0-1786384816 +BUILDER_BASE_IMAGE=quay.io/aipcc/base-images/cpu:3.5.1-1787661100 BUILDER_DNF_COMMAND=dnf -RUNTIME_BASE_IMAGE=quay.io/aipcc/base-images/cpu:3.5.0-1786384816 +RUNTIME_BASE_IMAGE=quay.io/aipcc/base-images/cpu:3.5.1-1787661100 RUNTIME_DNF_COMMAND=dnf diff --git a/.konflux/redhat.repo b/.konflux/redhat.repo index bbfd4f589..234ce69b7 100644 --- a/.konflux/redhat.repo +++ b/.konflux/redhat.repo @@ -42,3 +42,17 @@ enabled_metadata = 0 sslclientkey = $SSL_CLIENT_KEY sslclientcert = $SSL_CLIENT_CERT excludepkgs=*.i686 + +[rhelai-3.5-for-rhel-9-$basearch-rpms] +name = Red Hat Enterprise Linux AI (3.5) for RHEL 9 $basearch (RPMs) +baseurl = https://cdn.redhat.com/content/dist/layered/rhel9/$basearch/rhelai/3.5/os +enabled = 1 +gpgcheck = 1 +gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release +sslverify = 1 +sslcacert = /etc/rhsm/ca/redhat-uep.pem +sslverifystatus = 1 +metadata_expire = 86400 +enabled_metadata = 0 +sslclientkey = $SSL_CLIENT_KEY +sslclientcert = $SSL_CLIENT_CERT \ No newline at end of file diff --git a/.konflux/rpms.in.yaml b/.konflux/rpms.in.yaml index 2818f244e..2fa7d1470 100644 --- a/.konflux/rpms.in.yaml +++ b/.konflux/rpms.in.yaml @@ -10,7 +10,8 @@ packages: upgradePackages: [ libxslt, - libgcrypt, + libarchive, + python3-urllib3, ] contentOrigin: repofiles: ["./redhat.repo"] diff --git a/.konflux/rpms.lock.yaml b/.konflux/rpms.lock.yaml index b6ce17b4f..5cfaa7ad2 100644 --- a/.konflux/rpms.lock.yaml +++ b/.konflux/rpms.lock.yaml @@ -74,13 +74,13 @@ arches: name: info evr: 6.7-15.el9 sourcerpm: texinfo-6.7-15.el9.src.rpm - - url: https://cdn.redhat.com/content/eus/rhel9/9.6/aarch64/baseos/os/Packages/l/libgcrypt-1.10.0-11.el9_6.1.aarch64.rpm + - url: https://cdn.redhat.com/content/eus/rhel9/9.6/aarch64/baseos/os/Packages/p/python3-urllib3-1.26.5-6.el9_6.2.noarch.rpm repoid: rhel-9-for-aarch64-baseos-eus-rpms__9_DOT_6 - size: 463379 - checksum: sha256:ca4492eea2902aa597ddc8f9859f5312f2d4e9beafe94b188c014df6f8bbc91f - name: libgcrypt - evr: 1.10.0-11.el9_6.1 - sourcerpm: libgcrypt-1.10.0-11.el9_6.1.src.rpm + size: 223128 + checksum: sha256:177899cd61996a1a459f23508428fe8be31d174cf998c624155e13137a10a4e9 + name: python3-urllib3 + evr: 1.26.5-6.el9_6.2 + sourcerpm: python-urllib3-1.26.5-6.el9_6.2.src.rpm source: [] module_metadata: [] - arch: x86_64 @@ -155,12 +155,12 @@ arches: name: info evr: 6.7-15.el9 sourcerpm: texinfo-6.7-15.el9.src.rpm - - url: https://cdn.redhat.com/content/eus/rhel9/9.6/x86_64/baseos/os/Packages/l/libgcrypt-1.10.0-11.el9_6.1.x86_64.rpm + - url: https://cdn.redhat.com/content/eus/rhel9/9.6/x86_64/baseos/os/Packages/p/python3-urllib3-1.26.5-6.el9_6.2.noarch.rpm repoid: rhel-9-for-x86_64-baseos-eus-rpms__9_DOT_6 - size: 517430 - checksum: sha256:57bb13f2d7b44dafd7ecd20924a5be434223c567ddf5322c8c2d89c800df6d0e - name: libgcrypt - evr: 1.10.0-11.el9_6.1 - sourcerpm: libgcrypt-1.10.0-11.el9_6.1.src.rpm + size: 223128 + checksum: sha256:177899cd61996a1a459f23508428fe8be31d174cf998c624155e13137a10a4e9 + name: python3-urllib3 + evr: 1.26.5-6.el9_6.2 + sourcerpm: python-urllib3-1.26.5-6.el9_6.2.src.rpm source: [] module_metadata: [] diff --git a/scripts/generate-rpm-lock.sh b/scripts/generate-rpm-lock.sh new file mode 100755 index 000000000..c9bb1fbea --- /dev/null +++ b/scripts/generate-rpm-lock.sh @@ -0,0 +1,161 @@ +#!/bin/bash + +set -e + +DEFAULT_BASE_IMAGE="registry.redhat.io/rhai/base-image-cpu-rhel9:3.3" +BUILD_ARGS_FILE="build.args" +INPUT_FILE="rpms.in.yaml" +OUTPUT_FILE="rpms.lock.yaml" +CONTAINER_IMAGE="registry.access.redhat.com/ubi9/ubi" +REDHAT_REPO_FILE=".konflux/redhat.repo" +#CUDA_REPO_FILE=".konflux/cuda/cuda.repo" + +if command -v podman &>/dev/null; then + CONTAINER_RUNTIME="podman" +elif command -v docker &>/dev/null; then + CONTAINER_RUNTIME="docker" +else + echo "Error: Neither podman nor docker found. Please install one of them." + exit 1 +fi + +if [[ -f "$BUILD_ARGS_FILE" ]]; then + EXTRACTED_BASE_IMAGE=$(grep "^BUILDER_BASE_IMAGE=" "$BUILD_ARGS_FILE" | cut -d'=' -f2) + if [[ -n "$EXTRACTED_BASE_IMAGE" ]]; then + BASE_IMAGE="$EXTRACTED_BASE_IMAGE" + echo "Using base image from $BUILD_ARGS_FILE: $BASE_IMAGE" + else + BASE_IMAGE="$DEFAULT_BASE_IMAGE" + echo "BUILDER_BASE_IMAGE not found in $BUILD_ARGS_FILE, using default: $BASE_IMAGE" + fi +else + BASE_IMAGE="$DEFAULT_BASE_IMAGE" + echo "$BUILD_ARGS_FILE not found, using default base image: $BASE_IMAGE" +fi + +usage() { + echo "Usage: $0 -a ACTIVATION_KEY -g ORG_ID [-i BASE_IMAGE] [-f INPUT_FILE] [-O OUTPUT_FILE]" + echo "" + echo "Required:" + echo " -a ACTIVATION_KEY Red Hat activation key for subscription-manager" + echo " -g ORG_ID Red Hat organization ID for subscription-manager" + echo "" + echo "Options:" + echo " -i BASE_IMAGE Base container image for rpm-lockfile-prototype (default: $BASE_IMAGE)" + echo " -f INPUT_FILE Input RPM specification file (default: $INPUT_FILE)" + echo " -O OUTPUT_FILE Output lock file (default: $OUTPUT_FILE)" + echo " -h Show this help message" + echo "" + echo "Environment variables:" + echo " REGISTRY_USERNAME Username for registry authentication (skopeo login)" + echo " REGISTRY_PASSWORD Password for registry authentication (skopeo login)" + exit 1 +} + +ACTIVATION_KEY="" +ORG_ID="" + +while getopts "a:g:i:f:O:h" opt; do + case $opt in + a) ACTIVATION_KEY="$OPTARG" ;; + g) ORG_ID="$OPTARG" ;; + i) BASE_IMAGE="$OPTARG" ;; + f) INPUT_FILE="$OPTARG" ;; + O) OUTPUT_FILE="$OPTARG" ;; + h) usage ;; + *) usage ;; + esac +done + +if [[ -z "$ACTIVATION_KEY" || -z "$ORG_ID" ]]; then + echo "Error: Both activation key (-a) and organization ID (-g) are required." + usage +fi + +if [[ ! -f "$INPUT_FILE" ]]; then + echo "Error: Input file '$INPUT_FILE' not found." + exit 1 +fi + +if [[ ! -f "$REDHAT_REPO_FILE" ]]; then + echo "Error: Red Hat repo file '$REDHAT_REPO_FILE' not found." + exit 1 +fi + +echo "Using BASE_IMAGE: $BASE_IMAGE" +echo "Using INPUT_FILE: $INPUT_FILE" +echo "Using OUTPUT_FILE: $OUTPUT_FILE" +echo "Using CONTAINER_IMAGE: $CONTAINER_IMAGE" +echo "Using CONTAINER_RUNTIME: $CONTAINER_RUNTIME" + +CONTAINER_NAME="rpm-lockfile-generator-$$" +WORKDIR="/workdir" + +cleanup() { + echo "Cleaning up container..." + $CONTAINER_RUNTIME rm -f "$CONTAINER_NAME" 2>/dev/null || true +} +trap cleanup EXIT + +echo "Starting container..." +$CONTAINER_RUNTIME run -d --name "$CONTAINER_NAME" "$CONTAINER_IMAGE" sleep infinity + +echo "Registering system with subscription-manager..." +$CONTAINER_RUNTIME exec "$CONTAINER_NAME" subscription-manager register \ + --activationkey="$ACTIVATION_KEY" \ + --org="$ORG_ID" + +echo "Listing enabled repos" +$CONTAINER_RUNTIME exec "$CONTAINER_NAME" subscription-manager repos --list-enabled + +#echo "Listing ruby-libs" +#$CONTAINER_RUNTIME exec "$CONTAINER_NAME" dnf repoquery --repo=rhel-9-for-x86_64-appstream-eus-rpms ruby-libs --latest-limit=1 + +echo "Disabling rhel-9-for-x86_64-appstream-eus-rpms repo" +#$CONTAINER_RUNTIME exec "$CONTAINER_NAME" subscription-manager repos --disable=rhel-9-for-x86_64-appstream-eus-rpms --disable=codeready-builder-for-rhel-9-x86_64-eus-rpms + +echo "Installing packages..." +$CONTAINER_RUNTIME exec "$CONTAINER_NAME" dnf install -y skopeo git make python3-pip + +if [[ -n "$REGISTRY_USERNAME" && -n "$REGISTRY_PASSWORD" ]]; then + echo "Logging into registry with skopeo..." + REGISTRY_HOST=$(echo "$BASE_IMAGE" | cut -d'/' -f1) + $CONTAINER_RUNTIME exec "$CONTAINER_NAME" skopeo login "$REGISTRY_HOST" \ + --username "$REGISTRY_USERNAME" \ + --password "$REGISTRY_PASSWORD" +fi + +echo "Installing rpm-lockfile-prototype..." +$CONTAINER_RUNTIME exec "$CONTAINER_NAME" python3 -m pip install --user \ + https://github.com/konflux-ci/rpm-lockfile-prototype/archive/refs/tags/v0.24.0.tar.gz + +echo "Copying registry auth into container..." +AUTH_JSON="/run/user/$(id -u)/containers/auth.json" +[[ -f "$AUTH_JSON" ]] || AUTH_JSON="$HOME/.config/containers/auth.json" +if [[ -f "$AUTH_JSON" ]]; then + $CONTAINER_RUNTIME exec "$CONTAINER_NAME" mkdir -p /root/.config/containers + $CONTAINER_RUNTIME cp "$AUTH_JSON" "$CONTAINER_NAME:/root/.config/containers/auth.json" +fi + +echo "Creating workdir and copying files..." +$CONTAINER_RUNTIME exec "$CONTAINER_NAME" mkdir -p "$WORKDIR" +$CONTAINER_RUNTIME cp "$INPUT_FILE" "$CONTAINER_NAME:$WORKDIR/$(basename "$INPUT_FILE")" +$CONTAINER_RUNTIME cp "$REDHAT_REPO_FILE" "$CONTAINER_NAME:$WORKDIR/$(basename "$REDHAT_REPO_FILE")" +#$CONTAINER_RUNTIME cp "$CUDA_REPO_FILE" "$CONTAINER_NAME:$WORKDIR/$(basename "$CUDA_REPO_FILE")" + +echo "Running rpm-lockfile-prototype..." +$CONTAINER_RUNTIME exec -w "$WORKDIR" "$CONTAINER_NAME" bash -c ' + DNF_VAR_SSL_CLIENT_KEY=$(find /etc/pki/entitlement -type f -name "*key.pem" | head -1) + export DNF_VAR_SSL_CLIENT_KEY + DNF_VAR_SSL_CLIENT_CERT="${DNF_VAR_SSL_CLIENT_KEY//-key/}" + export DNF_VAR_SSL_CLIENT_CERT + /root/.local/bin/rpm-lockfile-prototype \ + --image "'"$BASE_IMAGE"'" \ + --outfile "'"$OUTPUT_FILE"'" \ + "'"$(basename "$INPUT_FILE")"'" +' + +echo "Copying output file from container..." +$CONTAINER_RUNTIME cp "$CONTAINER_NAME:$WORKDIR/$OUTPUT_FILE" "$OUTPUT_FILE" + +echo "Successfully generated $OUTPUT_FILE" From 5e3d38da632f8da9d176eff8a34e7e0c8d5af0fb Mon Sep 17 00:00:00 2001 From: JR Boos Date: Wed, 26 Aug 2026 17:11:21 -0400 Subject: [PATCH 2/2] Add libxslt to Konflux RPM lockfile and repo configuration --- .konflux/redhat.repo | 18 +++++++++++++++++- .konflux/rpms.lock.yaml | 14 ++++++++++++++ 2 files changed, 31 insertions(+), 1 deletion(-) diff --git a/.konflux/redhat.repo b/.konflux/redhat.repo index 234ce69b7..c551b0e43 100644 --- a/.konflux/redhat.repo +++ b/.konflux/redhat.repo @@ -55,4 +55,20 @@ sslverifystatus = 1 metadata_expire = 86400 enabled_metadata = 0 sslclientkey = $SSL_CLIENT_KEY -sslclientcert = $SSL_CLIENT_CERT \ No newline at end of file +sslclientcert = $SSL_CLIENT_CERT + +[rhel-9-for-$basearch-appstream-rpms__9_DOT_7] +name = Red Hat Enterprise Linux 9 for $basearch - AppStream (RPMs) +baseurl = https://cdn.redhat.com/content/dist/rhel9/9.7/$basearch/appstream/os +enabled = 1 +gpgcheck = 1 +gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release +sslverify = 1 +sslcacert = /etc/rhsm/ca/redhat-uep.pem +sslverifystatus = 1 +metadata_expire = 86400 +enabled_metadata = 0 +sslclientkey = $SSL_CLIENT_KEY +sslclientcert = $SSL_CLIENT_CERT +includepkgs=libxslt* +excludepkgs=*.i686 \ No newline at end of file diff --git a/.konflux/rpms.lock.yaml b/.konflux/rpms.lock.yaml index 5cfaa7ad2..dc87d4f75 100644 --- a/.konflux/rpms.lock.yaml +++ b/.konflux/rpms.lock.yaml @@ -4,6 +4,13 @@ lockfileVendor: redhat arches: - arch: aarch64 packages: + - url: https://cdn.redhat.com/content/dist/rhel9/9.7/aarch64/appstream/os/Packages/l/libxslt-1.1.34-14.el9_7.1.aarch64.rpm + repoid: rhel-9-for-aarch64-appstream-rpms__9_DOT_7 + size: 251669 + checksum: sha256:2b1fc002c4f57960df438791f7dfb5d4defa964f1afc73c3556451bc7f5ea01c + name: libxslt + evr: 1.1.34-14.el9_7.1 + sourcerpm: libxslt-1.1.34-14.el9_7.1.src.rpm - url: https://cdn.redhat.com/content/eus/rhel9/9.6/aarch64/appstream/os/Packages/c/cargo-1.84.1-1.el9.aarch64.rpm repoid: rhel-9-for-aarch64-appstream-eus-rpms__9_DOT_6 size: 7744425 @@ -85,6 +92,13 @@ arches: module_metadata: [] - arch: x86_64 packages: + - url: https://cdn.redhat.com/content/dist/rhel9/9.7/x86_64/appstream/os/Packages/l/libxslt-1.1.34-14.el9_7.1.x86_64.rpm + repoid: rhel-9-for-x86_64-appstream-rpms__9_DOT_7 + size: 254259 + checksum: sha256:d92873a046c78ae6837d8b23deecbfa1d6376b81bf587382e89ed345c1d5bad5 + name: libxslt + evr: 1.1.34-14.el9_7.1 + sourcerpm: libxslt-1.1.34-14.el9_7.1.src.rpm - url: https://cdn.redhat.com/content/eus/rhel9/9.6/x86_64/appstream/os/Packages/c/cargo-1.84.1-1.el9.x86_64.rpm repoid: rhel-9-for-x86_64-appstream-eus-rpms__9_DOT_6 size: 8292467