COS-4051: tree: add labels.json and security OCI labels for Clair scanning#1919
Conversation
OKD doesn't care about this anymore and we don't either. So this is essentially dead code. Nuke all c9s-related bits. Assisted-by: OpenCode (Claude Opus 4.6)
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
|
Let's hold this until coreos/fedora-coreos-pipeline#1325 and coreos/coreos-assembler#4512 are merged. Also, this does imply that for ART to build the node image in Konflux, AIUI doozer would have to learn about build arg files when calling out to Konflux. cc @joepvd in case you have concerns there. |
openshift-ci
Bot
added
the
approved
|
OK filed https://redhat.atlassian.net/browse/ART-14812 for the ART side of this. I didn't hear a "no, we don't want to support this" from Joep. :) |
jlebon
force-pushed
the
pr/build-args-sec
branch
from
f90e601 to
26d3f03
Compare
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
|
Requirements for this have merged now so I think we're unblocked on this! |
|
Asked my agent to build all of RHCOS 9.8, RHCOS 10.2 and SCOS 10, and to give a final report of all values. Here it is. RHCOS 9.8OCI Labels:
{
"architecture": "amd64",
"cpe": "cpe:/a:redhat:openshift:4.22::el9",
"name": "openshift/ose-rhel-coreos-9",
"org.opencontainers.image.created": "2026-04-21T20:11:58Z"
}RHCOS 10.2OCI Labels:
{
"architecture": "amd64",
"cpe": "cpe:/a:redhat:openshift:4.22::el10",
"name": "openshift/ose-rhel-coreos-10",
"org.opencontainers.image.created": "2026-04-21T20:15:24Z"
}SCOS (CentOS Stream 10)OCI Labels:
|
|
So yeah, the |
As part of container-first reporting (KONFLUX-6210), security scanners like Clair expect metadata at the OCI level (as labels) _and_ in the rootfs itself (as a JSON file at `/usr/share/buildinfo/labels.json`). To accommodate this, each variant now has a `build-args-*.conf` file that specifies the image name and CPE, but also while we're here, the image `FROM` to use which nicely cleans up the building docs. For the architecture, we use buildah's built-in `TARGETARCH`. This is only relevant on OCP, not OKD. So skip it there. Once we start building the node image through Konflux, this should in theory no longer be necessary because the Konflux pipeline itself automatically adds this information (though there's still details there to figure out on where that information comes from/whether it's correct). Closes: https://redhat.atlassian.net/browse/COS-4051 Assisted-by: OpenCode (Claude Opus 4.6)
jlebon
force-pushed
the
pr/build-args-sec
branch
from
26d3f03 to
53c2138
Compare
|
OK right, CI is failing here because OpenShift CI doesn't know about the build args. And looking at ci-operator, it looks like it doesn't support build args files. Sigh. The OpenShift CI vs Konflux thing is really awkward. Anyway, just hacking around this for now by hardcoding values for ci-operator in openshift/release#78212. Not great, I know... |
In openshift/os#1919, we're changing the openshift/os Containerfile to use ARG IMAGE_FROM=overridden instead of a hardcoded FROM, and to require IMAGE_NAME/IMAGE_CPE build args for RHCOS builds. So we need to adapt the `as` substitution here accordingly. Unfortunately, ci-operator (but really, Builds v1) doesn't support build args files so here we're just hardcoding values for the parameter for CI to build. This is something we'd be able to fix once CI also uses Konflux. Yes, the literal `${IMAGE_FROM}` is intended because the substitution needs to match against the raw string in the Dockerfile AIUI. Keep the old value too so that we can merge this PR and not break openshift/os CI before merging openshift/os#1919. Assisted-by: OpenCode (Claude Opus 4.6)
In openshift/os#1919, we're changing the openshift/os Containerfile to use ARG IMAGE_FROM=overridden instead of a hardcoded FROM, and to require IMAGE_NAME/IMAGE_CPE build args for RHCOS builds. So we need to adapt the `as` substitution here accordingly. Unfortunately, ci-operator (but really, Builds v1) doesn't support build args files so here we're just hardcoding values for the parameter for CI to build. This is something we'd be able to fix once CI also uses Konflux. Yes, the literal `${IMAGE_FROM}` is intended because the substitution needs to match against the raw string in the Dockerfile AIUI. Keep the old value too so that we can merge this PR and not break openshift/os CI before merging openshift/os#1919. Assisted-by: OpenCode (Claude Opus 4.6)
|
/retest |
…shift#78212) In openshift/os#1919, we're changing the openshift/os Containerfile to use ARG IMAGE_FROM=overridden instead of a hardcoded FROM, and to require IMAGE_NAME/IMAGE_CPE build args for RHCOS builds. So we need to adapt the `as` substitution here accordingly. Unfortunately, ci-operator (but really, Builds v1) doesn't support build args files so here we're just hardcoding values for the parameter for CI to build. This is something we'd be able to fix once CI also uses Konflux. Yes, the literal `${IMAGE_FROM}` is intended because the substitution needs to match against the raw string in the Dockerfile AIUI. Keep the old value too so that we can merge this PR and not break openshift/os CI before merging openshift/os#1919. Assisted-by: OpenCode (Claude Opus 4.6)
|
/retest |
Base RHCOS 9.8 image is ahead of 9.8 CI repos |
|
/retest |
|
OK, still hitting the openssl-libs mismatch due to CI repos being stale. And looking at: it looks like it's 14 days old? Whereas we always compose with the latest 9.8 nightly. |
|
I think the actual CI issue here comes from openshift-eng/ocp-build-data#9980 (comment) |
|
Building the extensions image locally with the same pulp stage repo used as a source for the CI reposync, it does succeed and finds So yeah, I think it is a sync issue. |
|
/retest-required |
…shift#78212) In openshift/os#1919, we're changing the openshift/os Containerfile to use ARG IMAGE_FROM=overridden instead of a hardcoded FROM, and to require IMAGE_NAME/IMAGE_CPE build args for RHCOS builds. So we need to adapt the `as` substitution here accordingly. Unfortunately, ci-operator (but really, Builds v1) doesn't support build args files so here we're just hardcoding values for the parameter for CI to build. This is something we'd be able to fix once CI also uses Konflux. Yes, the literal `${IMAGE_FROM}` is intended because the substitution needs to match against the raw string in the Dockerfile AIUI. Keep the old value too so that we can merge this PR and not break openshift/os CI before merging openshift/os#1919. Assisted-by: OpenCode (Claude Opus 4.6)
jlebon
force-pushed
the
pr/build-args-sec
branch
from
aa7049c to
509f23c
Compare
ART is no longer populating the 98 repo currently. To get pre-release content, we need to use the 9 repo directly.
jlebon
force-pushed
the
pr/build-args-sec
branch
from
509f23c to
d0be268
Compare
jlebon
changed the title
labels.json and security OCI labels for Clair scanninglabels.json and security OCI labels for Clair scanning
openshift-ci-robot
added
the
jira/valid-reference
|
@jlebon: This pull request references COS-4051 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
OK, CI is passing! 🎉 This is ready for final review now. |
dustymabe
left a comment
dustymabe
left a comment
There was a problem hiding this comment.
/lgtm
we should update branching docs somewhere regarding this change.
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: dustymabe, jlebon The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/verified by #1919 (comment) |
openshift-ci-robot
added
the
verified
|
@jlebon: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@jlebon: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/cherrypick release-4.22 |
|
@jlebon: new pull request created: #1933 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
…shift#78212) In openshift/os#1919, we're changing the openshift/os Containerfile to use ARG IMAGE_FROM=overridden instead of a hardcoded FROM, and to require IMAGE_NAME/IMAGE_CPE build args for RHCOS builds. So we need to adapt the `as` substitution here accordingly. Unfortunately, ci-operator (but really, Builds v1) doesn't support build args files so here we're just hardcoding values for the parameter for CI to build. This is something we'd be able to fix once CI also uses Konflux. Yes, the literal `${IMAGE_FROM}` is intended because the substitution needs to match against the raw string in the Dockerfile AIUI. Keep the old value too so that we can merge this PR and not break openshift/os CI before merging openshift/os#1919. Assisted-by: OpenCode (Claude Opus 4.6)
5 participants
As part of container-first reporting (KONFLUX-6210), security scanners like Clair expect metadata at the OCI level (as labels) and in the rootfs itself (as a JSON file at
/usr/share/buildinfo/labels.json).To accommodate this, each variant now has a
build-args-*.conffile that specifies the image name and CPE, but also while we're here, the imageFROMto use which nicely cleans up the building docs. For the architecture, we use buildah's built-inTARGETARCH.This is only relevant on OCP, not OKD. So skip it there.
Once we start building the node image through Konflux, this should in theory no longer be necessary because the Konflux pipeline itself automatically adds this information (though there's still details there to figure out on where that information comes from/whether it's correct).
Closes: https://redhat.atlassian.net/browse/COS-4051
Assisted-by: OpenCode (Claude Opus 4.6)