Update container base images to rhel-els 9.6 by fontivan · Pull Request #619 · rh-ecosystem-edge/recert

fontivan · 2025-10-09T17:25:50Z

Update container base images to rhel-els 9.6
Re-run lockfile generation following rhel-els 9.6 update

Summary by CodeRabbit

Chores
- Upgraded container base images from RHEL 9.4 to 9.6 for build and runtime.
- Refreshed RPM lockfiles for aarch64 and x86_64 to 9.6 repositories.
- Updated key toolchain and runtime packages (e.g., cargo, gcc, glibc, rust, openssl/openssh, util-linux) to 9.6 equivalents.
- No changes to build steps or application behavior; entrypoint unchanged.
- Users can expect current security patches and improved compatibility with RHEL 9.6.

AI-attribution: AIA,Entirely human-created,v1.0 For more information on AI attribution statements, see: https://aiattribution.github.io/

coderabbitai · 2025-10-09T17:26:09Z

Walkthrough

RHEL base images in .konflux/Dockerfile were updated from 9.4 to 9.6. The build and runtime rpm lockfiles were migrated to RHEL 9.6 repositories for aarch64 and x86_64, updating package URLs, versions (evr), checksums, sizes, and sourcerpm metadata. No build logic or exported/public APIs changed.

Changes

Cohort / File(s)	Summary
Base image bump `.konflux/Dockerfile`	Updated both build and runtime FROM images from RHEL 9.4 to RHEL 9.6; no changes to commands, copy steps, or entrypoint logic.
Build lockfile updates (RHEL 9.6) `.konflux/lock-build/rpms.lock.yaml`	Migrated package sources to RHEL 9.6 appstream/baseos/codeready-builder for aarch64 and x86_64; refreshed metadata (url, evr, size, checksum, sourcerpm); notable version shifts include cargo and rust/llvm/gcc stacks.
Runtime lockfile updates (RHEL 9.6) `.konflux/lock-runtime/rpms.lock.yaml`	Switched runtime packages to RHEL 9.6 baseos streams for both arches; updated urls and metadata for core libs and tools (e.g., cracklib, util-linux, openssh, openssl, pam); removed EUS refs where applicable.

Sequence Diagram(s)

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

CNF-18558: Integrate rpm lockfile scripts #521 — Introduced Konflux rpm-lock workflow and artifacts; this PR updates those to RHEL 9.6.
CNF-19739: Add missing EUS repos to rpm lock configuration #580 — Adjusted Konflux lockfiles toward EUS repos; related to this PR’s repo/version realignment.
bootstrap recert over konflux #182 — Modified .konflux/Dockerfile repo handling; related to this PR’s base image updates.

Suggested labels

lgtm

Suggested reviewers

rauhersu
tsorya
mresvanis
omertuc

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title Check	✅ Passed	The title succinctly summarizes the primary change by stating that container base images are updated to RHEL-ELS 9.6, directly reflecting the Dockerfile modifications and the lockfile regeneration described in the PR.
Docstring Coverage	✅ Passed	No functions found in the changes. Docstring coverage check skipped.

✨ Finishing touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 1

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 715b8a1 and b296032.

📒 Files selected for processing (3)

.konflux/Dockerfile (2 hunks)
.konflux/lock-build/rpms.lock.yaml (1 hunks)
.konflux/lock-runtime/rpms.lock.yaml (1 hunks)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)

GitHub Check: Red Hat Konflux / recert-4-21-on-pull-request
GitHub Check: build

coderabbitai · 2025-10-09T17:28:59Z

.konflux/lock-build/rpms.lock.yaml

+  - url: https://cdn.redhat.com/content/dist/rhel9/9.6/x86_64/appstream/os/Packages/g/glibc-devel-2.34-168.el9_6.23.x86_64.rpm
+    repoid: rhel-9-for-x86_64-appstream-rpms
+    size: 34295
+    checksum: sha256:0fa11752abf8ee80658e10017c62f7c0301bcae4008e4716fe6f114a7b9e3977
+    name: glibc-devel
+    evr: 2.34-168.el9_6.23
+    sourcerpm: glibc-2.34-168.el9_6.23.src.rpm
+  - url: https://cdn.redhat.com/content/dist/rhel9/9.6/x86_64/appstream/os/Packages/g/glibc-headers-2.34-168.el9_6.23.x86_64.rpm


⚠️ Potential issue | 🟠 Major

Investigate incorrect rpm size metadata.

Line 209 records glibc-devel-2.34-168.el9_6.23.x86_64 with a size of only 34295, but the adjacent aarch64 build is ~563 020 bytes and the x86_64 rpm from the 9.6 repositories is likewise ~500–600 KB. This looks like a truncated value from the lockfile regeneration. Konflux uses these fields for integrity checks, so leaving this mismatch will likely break the locked build when the rpm is fetched. Please rerun the lockfile tooling (or manually correct the size/checksum tuple) before merging.

🤖 Prompt for AI Agents

.konflux/lock-build/rpms.lock.yaml around lines 207 to 214: the recorded size for glibc-devel-2.34-168.el9_6.23.x86_64 (34295) is incorrect and will fail integrity checks; rerun the konflux lockfile generation tool against the RHEL 9.6 x86_64 AppStream repo (or fetch the specific RPM directly) and update the size and checksum fields to the actual values for that RPM, ensuring the url, repoid, name and evr remain correct; after updating, re-run any local verification (e.g., checksum verify or a test fetch) to confirm the tuple is correct before committing.

fontivan · 2025-10-09T17:31:07Z

/cc @rauhersu

rauhersu · 2025-10-13T19:34:04Z

/lgtm
/approve

openshift-ci · 2025-10-13T19:34:12Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: fontivan, rauhersu

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [fontivan,rauhersu]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

rauhersu · 2025-10-13T19:43:15Z

/cherry-pick release-4.20

openshift-cherrypick-robot · 2025-10-13T19:43:24Z

@rauhersu: only rh-ecosystem-edge org members may request cherry picks. If you are already part of the org, make sure to change your membership to public. Otherwise you can still do the cherry-pick manually.

Details

In response to this:

/cherry-pick release-4.20

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

fontivan · 2025-10-14T12:39:24Z

/cherry-pick release-4.20

openshift-cherrypick-robot · 2025-10-14T12:40:07Z

@fontivan: #619 failed to apply on top of branch "release-4.20":

Applying: Update container base images to rhel-els 9.6
Using index info to reconstruct a base tree...
M	.konflux/Dockerfile
Falling back to patching base and 3-way merge...
No changes -- Patch already applied.
Applying: Re-run lockfile generation following rhel-els 9.6 update
Using index info to reconstruct a base tree...
M	.konflux/lock-build/rpms.lock.yaml
M	.konflux/lock-runtime/rpms.lock.yaml
Falling back to patching base and 3-way merge...
Auto-merging .konflux/lock-build/rpms.lock.yaml
CONFLICT (content): Merge conflict in .konflux/lock-build/rpms.lock.yaml
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config advice.mergeConflict false"
Patch failed at 0002 Re-run lockfile generation following rhel-els 9.6 update

Details

In response to this:

/cherry-pick release-4.20

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

fontivan · 2025-10-14T12:57:24Z

Backported via #620 instead of cherry pick

fontivan · 2025-10-15T12:49:14Z

/cherry-pick release-4.19

openshift-cherrypick-robot · 2025-10-15T12:49:55Z

@fontivan: #619 failed to apply on top of branch "release-4.19":

Applying: Update container base images to rhel-els 9.6
Using index info to reconstruct a base tree...
M	.konflux/Dockerfile
Falling back to patching base and 3-way merge...
Auto-merging .konflux/Dockerfile
CONFLICT (content): Merge conflict in .konflux/Dockerfile
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config advice.mergeConflict false"
Patch failed at 0001 Update container base images to rhel-els 9.6

Details

In response to this:

/cherry-pick release-4.19

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

fontivan added 2 commits October 9, 2025 13:23

Update container base images to rhel-els 9.6

76a863e

AI-attribution: AIA,Entirely human-created,v1.0 For more information on AI attribution statements, see: https://aiattribution.github.io/

Re-run lockfile generation following rhel-els 9.6 update

b296032

AI-attribution: AIA,Entirely human-created,v1.0 For more information on AI attribution statements, see: https://aiattribution.github.io/

openshift-ci bot requested review from rauhersu and tsorya October 9, 2025 17:25

openshift-ci bot added the approved label Oct 9, 2025

coderabbitai bot reviewed Oct 9, 2025

View reviewed changes

openshift-ci bot assigned rauhersu Oct 13, 2025

openshift-ci bot added the lgtm label Oct 13, 2025

openshift-merge-bot bot merged commit c0ccecf into rh-ecosystem-edge:main Oct 13, 2025
6 checks passed

This was referenced Nov 7, 2025

Update rpm lock alongside rhel-els image #689

Merged

CNF-18836 / CNF-20367: Reconfigure repo to allow mintmaker rpm updates to work with ubi9 images #716

Merged

coderabbitai bot mentioned this pull request Nov 18, 2025

CNF-18836 / CNF-20367: Use ubi for both builder and runtime #733

Merged

Conversation

fontivan commented Oct 9, 2025 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai bot commented Oct 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

Possibly related PRs

Suggested labels

Suggested reviewers

Pre-merge checks and finishing touches

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai bot Oct 9, 2025

Choose a reason for hiding this comment

Uh oh!

fontivan commented Oct 9, 2025

Uh oh!

rauhersu commented Oct 13, 2025

Uh oh!

openshift-ci bot commented Oct 13, 2025

Uh oh!

Uh oh!

rauhersu commented Oct 13, 2025

Uh oh!

openshift-cherrypick-robot commented Oct 13, 2025

Uh oh!

fontivan commented Oct 14, 2025

Uh oh!

openshift-cherrypick-robot commented Oct 14, 2025

Uh oh!

fontivan commented Oct 14, 2025

Uh oh!

fontivan commented Oct 15, 2025

Uh oh!

openshift-cherrypick-robot commented Oct 15, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

fontivan commented Oct 9, 2025 •

edited by coderabbitai bot

Loading

coderabbitai bot commented Oct 9, 2025 •

edited

Loading