Enable PQC in Dockerfiles

Author: shay23bra

Dockerfile.assisted-installer

@@ -21,6 +21,7 @@ RUN git rev-parse --short HEAD > /commit-reference.txt
 
 FROM registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:6fc28bcb6776e387d7a35a2056d9d2b985dc4e26031e98a2bd35a7137cd6fd71
 
+RUN microdnf install -y --disablerepo="*" --enablerepo="ubi-9-*" crypto-policies-scripts && update-crypto-policies --set DEFAULT:PQ && microdnf clean all
 RUN microdnf install -y util-linux-core && microdnf clean all
 
 COPY --from=builder /go/src/github.com/openshift/assisted-installer/build/installer /usr/bin/installer

Dockerfile.assisted-installer-build

@@ -25,6 +25,7 @@ RUN dnf install -y 'dnf-command(config-manager)' && \
         openssl-devel \
         gcc \
     && dnf clean all
+RUN update-crypto-policies --set DEFAULT:PQ
 
 ENV GOROOT=/usr/lib/golang
 ENV GOPATH=/opt/app-root/src/go

Dockerfile.assisted-installer-controller

@@ -22,6 +22,7 @@ RUN git rev-parse --short HEAD > /commit-reference.txt
 FROM registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:6fc28bcb6776e387d7a35a2056d9d2b985dc4e26031e98a2bd35a7137cd6fd71
 ARG TARGETPLATFORM
 
+RUN microdnf install -y --disablerepo="*" --enablerepo="ubi-9-*" crypto-policies-scripts && update-crypto-policies --set DEFAULT:PQ && microdnf clean all
 RUN microdnf install -y tar gzip rsync which procps-ng findutils && microdnf clean all
 
 # openshift clients

Dockerfile.assisted-installer-controller-downstream

@@ -14,7 +14,7 @@ COPY --chown=${USER_UID} . /app
 WORKDIR /app
 RUN CGO_ENABLED=1 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -o assisted-installer-controller src/main/assisted-installer-controller/assisted_installer_main.go
 
-FROM registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:6fc28bcb6776e387d7a35a2056d9d2b985dc4e26031e98a2bd35a7137cd6fd71
+FROM registry.redhat.io/ubi9/ubi-minimal-pqc:latest@sha256:3e009398a8aa8eec621393fbf308c5e622f174900e44e8d5fe224c637920924a
 ARG release=main
 ARG version=latest
 

Dockerfile.assisted-installer-controller-mce

@@ -17,7 +17,7 @@ WORKDIR /app
 
 RUN GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -tags strictfipsruntime -o assisted-installer-controller src/main/assisted-installer-controller/assisted_installer_main.go
 
-FROM registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:6fc28bcb6776e387d7a35a2056d9d2b985dc4e26031e98a2bd35a7137cd6fd71
+FROM registry.redhat.io/ubi9/ubi-minimal-pqc:latest@sha256:3e009398a8aa8eec621393fbf308c5e622f174900e44e8d5fe224c637920924a
 ARG release=main
 ARG version=latest
 

Dockerfile.assisted-installer-downstream

@@ -14,7 +14,7 @@ COPY --chown=${USER_UID} . /app
 WORKDIR /app
 RUN CGO_ENABLED=1 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -o installer src/main/main.go
 
-FROM registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:6fc28bcb6776e387d7a35a2056d9d2b985dc4e26031e98a2bd35a7137cd6fd71
+FROM registry.redhat.io/ubi9/ubi-minimal-pqc:latest@sha256:3e009398a8aa8eec621393fbf308c5e622f174900e44e8d5fe224c637920924a
 ARG release=main
 ARG version=latest
 

Dockerfile.assisted-installer-mce

@@ -17,7 +17,7 @@ WORKDIR /app
 
 RUN CGO_ENABLED=1 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -tags strictfipsruntime -o installer src/main/main.go
 
-FROM registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:6fc28bcb6776e387d7a35a2056d9d2b985dc4e26031e98a2bd35a7137cd6fd71
+FROM registry.redhat.io/ubi9/ubi-minimal-pqc:latest@sha256:3e009398a8aa8eec621393fbf308c5e622f174900e44e8d5fe224c637920924a
 ARG release=main
 ARG version=latest
 

renovate.json

@@ -87,6 +87,21 @@
             ],
             "depNameTemplate": "registry.access.redhat.com/ubi9/ubi-minimal",
             "datasourceTemplate": "docker"
+        },
+        {
+            "customType": "regex",
+            "fileMatch": [
+                "^Dockerfile\\.assisted-installer-mce$",
+                "^Dockerfile\\.assisted-installer-downstream$",
+                "^Dockerfile\\.assisted-installer-controller-mce$",
+                "^Dockerfile\\.assisted-installer-controller-downstream$"
+            ],
+            "matchStrings": [
+                "FROM registry.redhat.io/ubi9/ubi-minimal-pqc:(?<currentValue>[^@]+)@(?<currentDigest>sha256:[a-f0-9]+)\\n",
+                "FROM --platform=\\$BUILDPLATFORM registry.redhat.io/ubi9/ubi-minimal-pqc:(?<currentValue>[^@]+)@(?<currentDigest>sha256:[a-f0-9]+)\\n"
+            ],
+            "depNameTemplate": "registry.redhat.io/ubi9/ubi-minimal-pqc",
+            "datasourceTemplate": "docker"
         }
     ],
     "packageRules": [
@@ -155,7 +170,8 @@
         },
         {
             "matchPackageNames": [
-                "registry.access.redhat.com/ubi9/ubi-minimal"
+                "registry.access.redhat.com/ubi9/ubi-minimal",
+                "registry.redhat.io/ubi9/ubi-minimal-pqc"
             ],
             "groupName": "UBI Runtime Images",
             "addLabels": [
@@ -170,7 +186,8 @@
                 "docker"
             ],
             "matchPackageNames": [
-                "registry.access.redhat.com/ubi9/ubi-minimal"
+                "registry.access.redhat.com/ubi9/ubi-minimal",
+                "registry.redhat.io/ubi9/ubi-minimal-pqc"
             ],
             "enabled": false
         },