LCORE-1611: Upgrade Base Image (CVE FREE BUT HACK)

.konflux/build-args-konflux.conf

@@ -1,4 +1,4 @@
-BUILDER_BASE_IMAGE=quay.io/aipcc/base-images/cpu:3.5.0-1786384816
+BUILDER_BASE_IMAGE=quay.io/aipcc/base-images/cpu:3.5.1-1787661100
 BUILDER_DNF_COMMAND=dnf
-RUNTIME_BASE_IMAGE=quay.io/aipcc/base-images/cpu:3.5.0-1786384816
+RUNTIME_BASE_IMAGE=quay.io/aipcc/base-images/cpu:3.5.1-1787661100
 RUNTIME_DNF_COMMAND=dnf

.konflux/redhat.repo

@@ -42,3 +42,33 @@ enabled_metadata = 0
 sslclientkey = $SSL_CLIENT_KEY
 sslclientcert = $SSL_CLIENT_CERT
 excludepkgs=*.i686
+
+[rhelai-3.5-for-rhel-9-$basearch-rpms]
+name = Red Hat Enterprise Linux AI (3.5) for RHEL 9 $basearch (RPMs)
+baseurl = https://cdn.redhat.com/content/dist/layered/rhel9/$basearch/rhelai/3.5/os
+enabled = 1
+gpgcheck = 1
+gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
+sslverify = 1
+sslcacert = /etc/rhsm/ca/redhat-uep.pem
+sslverifystatus = 1
+metadata_expire = 86400
+enabled_metadata = 0
+sslclientkey = $SSL_CLIENT_KEY
+sslclientcert = $SSL_CLIENT_CERT
+
+[rhel-9-for-$basearch-appstream-rpms__9_DOT_7]
+name = Red Hat Enterprise Linux 9 for $basearch - AppStream (RPMs)
+baseurl = https://cdn.redhat.com/content/dist/rhel9/9.7/$basearch/appstream/os
+enabled = 1
+gpgcheck = 1
+gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
+sslverify = 1
+sslcacert = /etc/rhsm/ca/redhat-uep.pem
+sslverifystatus = 1
+metadata_expire = 86400
+enabled_metadata = 0
+sslclientkey = $SSL_CLIENT_KEY
+sslclientcert = $SSL_CLIENT_CERT
+includepkgs=libxslt*
+excludepkgs=*.i686

.konflux/rpms.in.yaml

@@ -10,7 +10,8 @@ packages:
 upgradePackages:
   [
     libxslt,
-    libgcrypt,
+    libarchive,
+    python3-urllib3,
   ]
 contentOrigin:
   repofiles: ["./redhat.repo"]

.konflux/rpms.lock.yaml

@@ -4,6 +4,13 @@ lockfileVendor: redhat
 arches:
 - arch: aarch64
   packages:
+  - url: https://cdn.redhat.com/content/dist/rhel9/9.7/aarch64/appstream/os/Packages/l/libxslt-1.1.34-14.el9_7.1.aarch64.rpm
+    repoid: rhel-9-for-aarch64-appstream-rpms__9_DOT_7
+    size: 251669
+    checksum: sha256:2b1fc002c4f57960df438791f7dfb5d4defa964f1afc73c3556451bc7f5ea01c
+    name: libxslt
+    evr: 1.1.34-14.el9_7.1
+    sourcerpm: libxslt-1.1.34-14.el9_7.1.src.rpm
   - url: https://cdn.redhat.com/content/eus/rhel9/9.6/aarch64/appstream/os/Packages/c/cargo-1.84.1-1.el9.aarch64.rpm
     repoid: rhel-9-for-aarch64-appstream-eus-rpms__9_DOT_6
     size: 7744425
@@ -74,17 +81,24 @@ arches:
     name: info
     evr: 6.7-15.el9
     sourcerpm: texinfo-6.7-15.el9.src.rpm
-  - url: https://cdn.redhat.com/content/eus/rhel9/9.6/aarch64/baseos/os/Packages/l/libgcrypt-1.10.0-11.el9_6.1.aarch64.rpm
+  - url: https://cdn.redhat.com/content/eus/rhel9/9.6/aarch64/baseos/os/Packages/p/python3-urllib3-1.26.5-6.el9_6.2.noarch.rpm
     repoid: rhel-9-for-aarch64-baseos-eus-rpms__9_DOT_6
-    size: 463379
-    checksum: sha256:ca4492eea2902aa597ddc8f9859f5312f2d4e9beafe94b188c014df6f8bbc91f
-    name: libgcrypt
-    evr: 1.10.0-11.el9_6.1
-    sourcerpm: libgcrypt-1.10.0-11.el9_6.1.src.rpm
+    size: 223128
+    checksum: sha256:177899cd61996a1a459f23508428fe8be31d174cf998c624155e13137a10a4e9
+    name: python3-urllib3
+    evr: 1.26.5-6.el9_6.2
+    sourcerpm: python-urllib3-1.26.5-6.el9_6.2.src.rpm
   source: []
   module_metadata: []
 - arch: x86_64
   packages:
+  - url: https://cdn.redhat.com/content/dist/rhel9/9.7/x86_64/appstream/os/Packages/l/libxslt-1.1.34-14.el9_7.1.x86_64.rpm
+    repoid: rhel-9-for-x86_64-appstream-rpms__9_DOT_7
+    size: 254259
+    checksum: sha256:d92873a046c78ae6837d8b23deecbfa1d6376b81bf587382e89ed345c1d5bad5
+    name: libxslt
+    evr: 1.1.34-14.el9_7.1
+    sourcerpm: libxslt-1.1.34-14.el9_7.1.src.rpm
   - url: https://cdn.redhat.com/content/eus/rhel9/9.6/x86_64/appstream/os/Packages/c/cargo-1.84.1-1.el9.x86_64.rpm
     repoid: rhel-9-for-x86_64-appstream-eus-rpms__9_DOT_6
     size: 8292467
@@ -155,12 +169,12 @@ arches:
     name: info
     evr: 6.7-15.el9
     sourcerpm: texinfo-6.7-15.el9.src.rpm
-  - url: https://cdn.redhat.com/content/eus/rhel9/9.6/x86_64/baseos/os/Packages/l/libgcrypt-1.10.0-11.el9_6.1.x86_64.rpm
+  - url: https://cdn.redhat.com/content/eus/rhel9/9.6/x86_64/baseos/os/Packages/p/python3-urllib3-1.26.5-6.el9_6.2.noarch.rpm
     repoid: rhel-9-for-x86_64-baseos-eus-rpms__9_DOT_6
-    size: 517430
-    checksum: sha256:57bb13f2d7b44dafd7ecd20924a5be434223c567ddf5322c8c2d89c800df6d0e
-    name: libgcrypt
-    evr: 1.10.0-11.el9_6.1
-    sourcerpm: libgcrypt-1.10.0-11.el9_6.1.src.rpm
+    size: 223128
+    checksum: sha256:177899cd61996a1a459f23508428fe8be31d174cf998c624155e13137a10a4e9
+    name: python3-urllib3
+    evr: 1.26.5-6.el9_6.2
+    sourcerpm: python-urllib3-1.26.5-6.el9_6.2.src.rpm
   source: []
   module_metadata: []

scripts/generate-rpm-lock.sh

@@ -0,0 +1,161 @@
+#!/bin/bash
+
+set -e
+
+DEFAULT_BASE_IMAGE="registry.redhat.io/rhai/base-image-cpu-rhel9:3.3"
+BUILD_ARGS_FILE="build.args"
+INPUT_FILE="rpms.in.yaml"
+OUTPUT_FILE="rpms.lock.yaml"
+CONTAINER_IMAGE="registry.access.redhat.com/ubi9/ubi"
+REDHAT_REPO_FILE=".konflux/redhat.repo"
+#CUDA_REPO_FILE=".konflux/cuda/cuda.repo"
+
+if command -v podman &>/dev/null; then
+    CONTAINER_RUNTIME="podman"
+elif command -v docker &>/dev/null; then
+    CONTAINER_RUNTIME="docker"
+else
+    echo "Error: Neither podman nor docker found. Please install one of them."
+    exit 1
+fi
+
+if [[ -f "$BUILD_ARGS_FILE" ]]; then
+    EXTRACTED_BASE_IMAGE=$(grep "^BUILDER_BASE_IMAGE=" "$BUILD_ARGS_FILE" | cut -d'=' -f2)
+    if [[ -n "$EXTRACTED_BASE_IMAGE" ]]; then
+        BASE_IMAGE="$EXTRACTED_BASE_IMAGE"
+        echo "Using base image from $BUILD_ARGS_FILE: $BASE_IMAGE"
+    else
+        BASE_IMAGE="$DEFAULT_BASE_IMAGE"
+        echo "BUILDER_BASE_IMAGE not found in $BUILD_ARGS_FILE, using default: $BASE_IMAGE"
+    fi
+else
+    BASE_IMAGE="$DEFAULT_BASE_IMAGE"
+    echo "$BUILD_ARGS_FILE not found, using default base image: $BASE_IMAGE"
+fi
+
+usage() {
+    echo "Usage: $0 -a ACTIVATION_KEY -g ORG_ID [-i BASE_IMAGE] [-f INPUT_FILE] [-O OUTPUT_FILE]"
+    echo ""
+    echo "Required:"
+    echo "  -a ACTIVATION_KEY  Red Hat activation key for subscription-manager"
+    echo "  -g ORG_ID          Red Hat organization ID for subscription-manager"
+    echo ""
+    echo "Options:"
+    echo "  -i BASE_IMAGE      Base container image for rpm-lockfile-prototype (default: $BASE_IMAGE)"
+    echo "  -f INPUT_FILE      Input RPM specification file (default: $INPUT_FILE)"
+    echo "  -O OUTPUT_FILE     Output lock file (default: $OUTPUT_FILE)"
+    echo "  -h                 Show this help message"
+    echo ""
+    echo "Environment variables:"
+    echo "  REGISTRY_USERNAME  Username for registry authentication (skopeo login)"
+    echo "  REGISTRY_PASSWORD  Password for registry authentication (skopeo login)"
+    exit 1
+}
+
+ACTIVATION_KEY=""
+ORG_ID=""
+
+while getopts "a:g:i:f:O:h" opt; do
+    case $opt in
+        a) ACTIVATION_KEY="$OPTARG" ;;
+        g) ORG_ID="$OPTARG" ;;
+        i) BASE_IMAGE="$OPTARG" ;;
+        f) INPUT_FILE="$OPTARG" ;;
+        O) OUTPUT_FILE="$OPTARG" ;;
+        h) usage ;;
+        *) usage ;;
+    esac
+done
+
+if [[ -z "$ACTIVATION_KEY" || -z "$ORG_ID" ]]; then
+    echo "Error: Both activation key (-a) and organization ID (-g) are required."
+    usage
+fi
+
+if [[ ! -f "$INPUT_FILE" ]]; then
+    echo "Error: Input file '$INPUT_FILE' not found."
+    exit 1
+fi
+
+if [[ ! -f "$REDHAT_REPO_FILE" ]]; then
+    echo "Error: Red Hat repo file '$REDHAT_REPO_FILE' not found."
+    exit 1
+fi
+
+echo "Using BASE_IMAGE: $BASE_IMAGE"
+echo "Using INPUT_FILE: $INPUT_FILE"
+echo "Using OUTPUT_FILE: $OUTPUT_FILE"
+echo "Using CONTAINER_IMAGE: $CONTAINER_IMAGE"
+echo "Using CONTAINER_RUNTIME: $CONTAINER_RUNTIME"
+
+CONTAINER_NAME="rpm-lockfile-generator-$$"
+WORKDIR="/workdir"
+
+cleanup() {
+    echo "Cleaning up container..."
+    $CONTAINER_RUNTIME rm -f "$CONTAINER_NAME" 2>/dev/null || true
+}
+trap cleanup EXIT
+
+echo "Starting container..."
+$CONTAINER_RUNTIME run -d --name "$CONTAINER_NAME" "$CONTAINER_IMAGE" sleep infinity
+
+echo "Registering system with subscription-manager..."
+$CONTAINER_RUNTIME exec "$CONTAINER_NAME" subscription-manager register \
+    --activationkey="$ACTIVATION_KEY" \
+    --org="$ORG_ID"
+
+echo "Listing enabled repos"
+$CONTAINER_RUNTIME exec "$CONTAINER_NAME" subscription-manager repos --list-enabled
+
+#echo "Listing ruby-libs"
+#$CONTAINER_RUNTIME exec "$CONTAINER_NAME" dnf repoquery --repo=rhel-9-for-x86_64-appstream-eus-rpms ruby-libs --latest-limit=1
+
+echo "Disabling rhel-9-for-x86_64-appstream-eus-rpms repo"
+#$CONTAINER_RUNTIME exec "$CONTAINER_NAME" subscription-manager repos --disable=rhel-9-for-x86_64-appstream-eus-rpms --disable=codeready-builder-for-rhel-9-x86_64-eus-rpms
+
+echo "Installing packages..."
+$CONTAINER_RUNTIME exec "$CONTAINER_NAME" dnf install -y skopeo git make python3-pip
+
+if [[ -n "$REGISTRY_USERNAME" && -n "$REGISTRY_PASSWORD" ]]; then
+    echo "Logging into registry with skopeo..."
+    REGISTRY_HOST=$(echo "$BASE_IMAGE" | cut -d'/' -f1)
+    $CONTAINER_RUNTIME exec "$CONTAINER_NAME" skopeo login "$REGISTRY_HOST" \
+        --username "$REGISTRY_USERNAME" \
+        --password "$REGISTRY_PASSWORD"
+fi
+
+echo "Installing rpm-lockfile-prototype..."
+$CONTAINER_RUNTIME exec "$CONTAINER_NAME" python3 -m pip install --user \
+    https://github.com/konflux-ci/rpm-lockfile-prototype/archive/refs/tags/v0.24.0.tar.gz
+
+echo "Copying registry auth into container..."
+AUTH_JSON="/run/user/$(id -u)/containers/auth.json"
+[[ -f "$AUTH_JSON" ]] || AUTH_JSON="$HOME/.config/containers/auth.json"
+if [[ -f "$AUTH_JSON" ]]; then
+    $CONTAINER_RUNTIME exec "$CONTAINER_NAME" mkdir -p /root/.config/containers
+    $CONTAINER_RUNTIME cp "$AUTH_JSON" "$CONTAINER_NAME:/root/.config/containers/auth.json"
+fi
+
+echo "Creating workdir and copying files..."
+$CONTAINER_RUNTIME exec "$CONTAINER_NAME" mkdir -p "$WORKDIR"
+$CONTAINER_RUNTIME cp "$INPUT_FILE" "$CONTAINER_NAME:$WORKDIR/$(basename "$INPUT_FILE")"
+$CONTAINER_RUNTIME cp "$REDHAT_REPO_FILE" "$CONTAINER_NAME:$WORKDIR/$(basename "$REDHAT_REPO_FILE")"
+#$CONTAINER_RUNTIME cp "$CUDA_REPO_FILE" "$CONTAINER_NAME:$WORKDIR/$(basename "$CUDA_REPO_FILE")"
+
+echo "Running rpm-lockfile-prototype..."
+$CONTAINER_RUNTIME exec -w "$WORKDIR" "$CONTAINER_NAME" bash -c '
+    DNF_VAR_SSL_CLIENT_KEY=$(find /etc/pki/entitlement -type f -name "*key.pem" | head -1)
+    export DNF_VAR_SSL_CLIENT_KEY
+    DNF_VAR_SSL_CLIENT_CERT="${DNF_VAR_SSL_CLIENT_KEY//-key/}"
+    export DNF_VAR_SSL_CLIENT_CERT
+    /root/.local/bin/rpm-lockfile-prototype \
+        --image "'"$BASE_IMAGE"'" \
+        --outfile "'"$OUTPUT_FILE"'" \
+        "'"$(basename "$INPUT_FILE")"'"
+'
+
+echo "Copying output file from container..."
+$CONTAINER_RUNTIME cp "$CONTAINER_NAME:$WORKDIR/$OUTPUT_FILE" "$OUTPUT_FILE"
+
+echo "Successfully generated $OUTPUT_FILE"