Skip to content

[openshift-4.17] ART-17441: Build ose-machine-os-images hermetically#11119

Open
adobes1 wants to merge 1 commit into
openshift-eng:openshift-4.17from
adobes1:4.17-machine-os-images-hermetic
Open

[openshift-4.17] ART-17441: Build ose-machine-os-images hermetically#11119
adobes1 wants to merge 1 commit into
openshift-eng:openshift-4.17from
adobes1:4.17-machine-os-images-hermetic

Conversation

@adobes1

@adobes1 adobes1 commented Jun 9, 2026

Copy link
Copy Markdown
Contributor

Summary

ose-machine-os-images can't be built hermetically by default because fetch_image.sh downloads RHCOS ISO images at build time from an internal mirror.

This adds support for Cachi2 generic artifact prefetching. When the Cachi2 prefetch directory (/cachi2/output/deps/generic/) exists, fetch_image.sh copies ISOs from there instead of downloading them.

Changes

  • Switch RPM lockfile backend to rpm-lockfile-prototype
  • Add artifact_lockfile.resources with RHCOS ISO URLs matching the installer image
  • Remove network_mode: open

Switch to rpm-lockfile-prototype backend for automatic transitive RPM
dependency resolution. Add RHCOS ISO URLs as Cachi2 generic artifacts
so they are prefetched instead of downloaded at build time. Remove
network_mode: open.

ISO URLs sourced from the installer image's embedded stream JSON
(build 417.94.202601272318-0). Temporary url_pull added for testing.

rh-pre-commit.version: 2.3.2
rh-pre-commit.check-secrets: ENABLED
@openshift-ci

openshift-ci Bot commented Jun 9, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign adobes1 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@adobes1

adobes1 commented Jun 9, 2026

Copy link
Copy Markdown
Contributor Author

/hold Requires openshift/machine-os-images#101 to be merged first

@openshift-ci openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jun 9, 2026
@adobes1 adobes1 changed the title [openshift-4.17] Build ose-machine-os-images hermetically [openshift-4.17] ART-17441: Build ose-machine-os-images hermetically Jun 9, 2026
@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jun 9, 2026
@openshift-ci-robot

openshift-ci-robot commented Jun 9, 2026

Copy link
Copy Markdown

@adobes1: This pull request references ART-17441 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.17.z" version, but no target version was set.

Details

In response to this:

Summary

ose-machine-os-images can't be built hermetically by default because fetch_image.sh downloads RHCOS ISO images at build time from an internal mirror.

This adds support for Cachi2 generic artifact prefetching. When the Cachi2 prefetch directory (/cachi2/output/deps/generic/) exists, fetch_image.sh copies ISOs from there instead of downloading them.

Changes

  • Switch RPM lockfile backend to rpm-lockfile-prototype
  • Add artifact_lockfile.resources with RHCOS ISO URLs matching the installer image
  • Remove network_mode: open

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants