gsc build fails for redhat distro

[uwe-albert-ibm]

we are calling "gsc build " using configuration "Distro:auto" (since "Distro:redat/ubi9.4" failed) and gsc fails with the error:

Downloading metadata...
error: cannot update repo 'rhel-9-for-x86_64-baseos-rpms': Cannot download repomd.xml: Cannot download repodata/repomd.xml: All mirrors were tried; Last error: Curl error (60): SSL peer certificate or SSH remote key was not OK for https://cdn.redhat.com/customer/Library/content/dist/rhel9/9/x86_64/baseos/os/repodata/repomd.xml [SSL certificate problem: self-signed certificate in certificate chain]

(here is full log
Building unsigned graminized Docker image gsc-idbroker-nevisauth-unsigned from original application image idbroker-nevisauth...
Warning: Duplicate key loader.env.PATH. Concatenating values from <merged ./manifest.properties and redhat/ubi-minimal/entrypoint.manifest.template> and <idbroker-nevisauth image env>.
Step 1/30 : FROM redhat/ubi9-minimal:9.6 AS gramine

---> e43c1a24fb37
Step 2/30 : COPY redhat.repo /etc/yum.repos.d/

---> ea5155221acc
Step 3/30 : COPY pki/entitlement/ /etc/pki/entitlement/

---> c5a9e2467396
Step 4/30 : COPY redhat-uep.pem /etc/rhsm/ca/

---> afdea01efec8
Step 5/30 : RUN rm -rf /etc/rhsm-host && microdnf install -y subscription-manager && rpm -ivh https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm && subscription-manager repos --enable codeready-builder-for-rhel-9-x86_64-rpms && microdnf install -y autoconf bison cmake elfutils-libelf-devel flex gawk gcc-c++ git httpd kernel-headers libevent-devel make nasm ncurses-devel ninja-build openssl-devel patch pkg-config protobuf-c-compiler protobuf-c-devel protobuf-compiler protobuf-devel python3 python3-cryptography python3-pip python3-protobuf python3-voluptuous rpm-build && /usr/bin/python3 -B -m pip install 'tomli>=1.1.0' 'tomli-w>=0.4.0' 'meson>=0.56,!=1.2.*'

---> Running in 7f4c9e7b66ff
Downloading metadata...
Downloading metadata...
Downloading metadata...
Downloading metadata...
error: cannot update repo 'rhel-9-for-x86_64-baseos-rpms': Cannot download repomd.xml: Cannot download repodata/repomd.xml: All mirrors were tried; Last error: Curl error (60): SSL peer certificate or SSH remote key was not OK for https://cdn.redhat.com/customer/Library/content/dist/rhel9/9/x86_64/baseos/os/repodata/repomd.xml [SSL certificate problem: self-signed certificate in certificate chain]

Failed to build unsigned graminized Docker image gsc-idbroker-nevisauth-unsigned.
)

Can you please help us ?
Many thanks in advance !

Uwe Albert

[uwe-albert-ibm]

@DukeDavis12 Hi you solved our previous issue using PR 238 . Can you please help us with this red hat issue as well ? Many thanks in advance ! Best regards Uwe

[uwe-albert-ibm]

when using "Distro:redhat/ubi9:9.4" we get the error:

Building unsigned graminized Docker image gsc-idbroker-nevisauth-unsigned from original application image idbroker-nevisauth...
Warning: Duplicate key loader.env.PATH. Concatenating values from <merged ./manifest.properties and redhat/ubi/entrypoint.manifest.template> and <idbroker-nevisauth image env>.
Step 1/37 : FROM redhat/ubi9:9.4 AS gramine

---> 769453be7412
Step 2/37 : COPY redhat.repo /etc/yum.repos.d/

---> 6c46b0242943
Step 3/37 : COPY pki/entitlement/ /etc/pki/entitlement/

---> 2ebb636689e3
Step 4/37 : COPY redhat-uep.pem /etc/rhsm/ca/

---> 7ff35ec4d83c
Step 5/37 : RUN rm -rf /etc/rhsm-host && subscription-manager repos --enable codeready-builder-for-rhel-9-x86_64-rpms && dnf install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm && dnf update -y && dnf install -y autoconf bison cmake elfutils-libelf-devel flex gawk gcc-c++ git httpd kernel-headers libevent-devel make nasm ncurses-devel ninja-build openssl-devel patch pkg-config protobuf-c-compiler protobuf-c-devel protobuf-compiler protobuf-devel python3 python3-cryptography python3-pip python3-protobuf python3-voluptuous rpm-build && /usr/bin/python3 -B -m pip install 'tomli>=1.1.0' 'tomli-w>=0.4.0' 'meson>=0.56,!=1.2.*'

---> Running in f8295af8e8d0
System certificates corrupted. Please reregister.

[anjalirai-intel]

@uwe-albert-ibm GSC requires host RHEL system to be subscribed via subscription-manager. In your logs as you can see System certificates corrupted. Please reregister., Can you check registration on your system and try to register it

[uwe-albert-ibm]

@anjalirai-intel : Many thanks ! I ll check and report.

[uwe-albert-ibm]

@anjalirai-intel : Hi state is as follows:

• host system was already registered
• when calling "subscription-manager repos --enable codeready-builder-for-rhel-9-x86_64-rpms" locally it works
• whereas within Dockerfile "subscription-manager repos --enable codeready-builder-for-rhel-9-x86_64-rpms" fails with error above (... Please reregister)

Sorry for the fuss, but I am confused . What is your recommendation please ?

[anjalirai-intel]

@anjalirai-intel : Hi state is as follows:

• host system was already registered
• when calling "subscription-manager repos --enable codeready-builder-for-rhel-9-x86_64-rpms" locally it works
• whereas within Dockerfile "subscription-manager repos --enable codeready-builder-for-rhel-9-x86_64-rpms" fails with error above (... Please reregister)

Sorry for the fuss, but I am confused . What is your recommendation please ?

Can you share your host system os details

[anjalirai-intel]

@uwe-albert-ibm Can you try to re-register once again

[uwe-albert-ibm]

@anjalirai-intel sure , here is one piece
[root@sekidp-runner03 ubi]# cat /etc/os-release
NAME="Red Hat Enterprise Linux"
VERSION="9.4 (Plow)"
ID="rhel"
ID_LIKE="fedora"
VERSION_ID="9.4"
PLATFORM_ID="platform:el9"
PRETTY_NAME="Red Hat Enterprise Linux 9.4 (Plow)"
ANSI_COLOR="0;31"
LOGO="fedora-logo-icon"
CPE_NAME="cpe:/o:redhat:enterprise_linux:9::baseos"
HOME_URL="https://www.redhat.com/"
DOCUMENTATION_URL="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9"
BUG_REPORT_URL="https://issues.redhat.com/"

REDHAT_BUGZILLA_PRODUCT="Red Hat Enterprise Linux 9"
REDHAT_BUGZILLA_PRODUCT_VERSION=9.4
REDHAT_SUPPORT_PRODUCT="Red Hat Enterprise Linux"
REDHAT_SUPPORT_PRODUCT_VERSION="9.4"

here is another
uname -a
Linux sekidp-runner03 5.14.0-427.66.1.el9_4.x86_64 #1 SMP PREEMPT_DYNAMIC Sun Apr 20 15:36:45 EDT 2025 x86_64 x86_64 x86_64 GNU/Linux

[uwe-albert-ibm]

@uwe-albert-ibm Can you try to re-register once again

I dont know cause it is a managed environment , I will try and let you know

[uwe-albert-ibm]

@anjalirai-intel : Hi state is as follows:

• host system was already registered
• when calling "subscription-manager repos --enable codeready-builder-for-rhel-9-x86_64-rpms" locally it works
• whereas within Dockerfile "subscription-manager repos --enable codeready-builder-for-rhel-9-x86_64-rpms" fails with error above (... Please reregister)

Sorry for the fuss, but I am confused . What is your recommendation please ?

Can you share your host system os details

@anjalirai-intel sure , here is one piece
[root@sekidp-runner03 ubi]# cat /etc/os-release
NAME="Red Hat Enterprise Linux"
VERSION="9.4 (Plow)"
ID="rhel"
ID_LIKE="fedora"
VERSION_ID="9.4"
PLATFORM_ID="platform:el9"
PRETTY_NAME="Red Hat Enterprise Linux 9.4 (Plow)"
ANSI_COLOR="0;31"
LOGO="fedora-logo-icon"
CPE_NAME="cpe:/o:redhat:enterprise_linux:9::baseos"
HOME_URL="https://www.redhat.com/"
DOCUMENTATION_URL="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9"
BUG_REPORT_URL="https://issues.redhat.com/"

REDHAT_BUGZILLA_PRODUCT="Red Hat Enterprise Linux 9"
REDHAT_BUGZILLA_PRODUCT_VERSION=9.4
REDHAT_SUPPORT_PRODUCT="Red Hat Enterprise Linux"
REDHAT_SUPPORT_PRODUCT_VERSION="9.4"

here is another
uname -a
Linux sekidp-runner03 5.14.0-427.66.1.el9_4.x86_64 #1 SMP PREEMPT_DYNAMIC Sun Apr 20 15:36:45 EDT 2025 x86_64 x86_64 x86_64 GNU/Linux

[anjalirai-intel]

@uwe-albert-ibm It is probably a RHEL System issue, you can try suggestion mentioned in this url System registration fails with error System certificates corrupted. Please reregister on content host registering to Red Hat Satellite 6

[uwe-albert-ibm]

@uwe-albert-ibm It is probably a RHEL System issue, you can try suggestion mentioned in this url System registration fails with error System certificates corrupted. Please reregister on content host registering to Red Hat Satellite 6

@anjalirai-intel many thanks for investigating. I ll try and report

[uwe-albert-ibm]

@anjalirai-intel : Hi , we checked for re-registration and figured out that it is using an IBM managed subscription as it is a VSI running on ibm cloud and we cant reregister. May be you have any other idea for solving our issue ?

[uwe-albert-ibm]

@anjalirai-intel Hi , I have executed a re-registration on the RHEL host machine which reported successful, but the error remains. Two question sfrom my end please: Since when does GSC support red-hat ? And would it be a mitigation to use distro "centos" instead of red-hat/ubi ?
Many thanks in advance !

[anjalirai-intel]

@anjalirai-intel Hi , I have executed a re-registration on the RHEL host machine which reported successful, but the error remains. Two question sfrom my end please: Since when does GSC support red-hat ? And would it be a mitigation to use distro "centos" instead of red-hat/ubi ? Many thanks in advance !

@uwe-albert-ibm It's been 2 years since GSC support RHEL.

Adding @sahason @DukeDavis12 for better clarification