Skip to content

fix: revert rpms.in.yaml to only include openssl - #2174

Merged
openshift-merge-bot[bot] merged 1 commit into
redhat-developer:mainfrom
polasudo:fix/revert-rpms-in-yaml-to-openssl-only
Jan 23, 2026
Merged

fix: revert rpms.in.yaml to only include openssl#2174
openshift-merge-bot[bot] merged 1 commit into
redhat-developer:mainfrom
polasudo:fix/revert-rpms-in-yaml-to-openssl-only

Conversation

@polasudo

@polasudo polasudo commented Jan 23, 2026

Copy link
Copy Markdown
Member

The rpm-lockfile-prototype tool automatically resolves dependencies, so we only need to specify the top-level package (openssl).

The previous commit (#2141) incorrectly included all dependencies.

The rpms.lock.yaml will be regenerated by the automated workflow.

Description

Which issue(s) does this PR fix or relate to

  • Fixes #issue_number

PR acceptance criteria

  • Tests
  • Documentation

How to test changes / Special notes to the reviewer

@rhdh-qodo-merge

rhdh-qodo-merge Bot commented Jan 23, 2026

Copy link
Copy Markdown 
ⓘ Your approaching your monthly quota for Qodo. Upgrade your plan

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 1 🔵⚪⚪⚪⚪
🔒 No security concerns identified
⚡ Recommended focus areas for review

📄 References
  1. redhat-developer/rhdh/rpms.in.yaml [164-232]
  2. redhat-developer/rhdh/rpms.in.yaml [1-8]
  3. redhat-developer/rhdh/rpms.in.yaml [234-287]
  4. redhat-developer/rhdh-operator/rpms.lock.yaml [42-48]
  5. redhat-developer/rhdh-operator/rpms.lock.yaml [63-69]
  6. redhat-developer/rhdh-operator/rpms.lock.yaml [49-62]
  7. redhat-developer/rhdh-operator/rpms.lock.yaml [117-128]
  8. redhat-developer/rhdh-operator/rpms.lock.yaml [1-20]

@rhdh-qodo-merge

rhdh-qodo-merge Bot commented Jan 23, 2026 •
edited
Loading

Copy link
Copy Markdown

PR Type

(Describe updated until commit 8cb4b01)

Bug fix

Description

  • Revert rpms.in.yaml to only specify openssl as top-level package

  • Remove 26 transitive dependencies that are auto-resolved by rpm-lockfile-prototype tool

  • Regenerate rpms.lock.yaml with only openssl and its direct dependencies

  • Simplify maintenance by eliminating unnecessary explicit dependency declarations

File Walkthrough
Relevant files
Bug fix
rpms.in.yaml
Remove transitive dependencies from package list                 

rpms.in.yaml

  • Removed 26 transitive dependency packages from the packages list
  • Kept only openssl as the top-level package declaration
  • Retained all repository configuration unchanged
  • Simplified package list from 27 to 1 entry
 +0/-26   
Configuration changes
rpms.lock.yaml
Regenerate lock file with openssl dependencies only           

rpms.lock.yaml

  • Removed 35 transitive dependency entries from x86_64 architecture
    packages
  • Kept only openssl, openssl-libs, and openssl-fips-provider packages
  • Removed python3, crypto-policies, expat, and libxcrypt related entries
  • Regenerated lock file to reflect only direct openssl dependencies
 +0/-99   

@rhdh-qodo-merge

rhdh-qodo-merge Bot commented Jan 23, 2026 •
edited
Loading

Copy link
Copy Markdown 
ⓘ Your approaching your monthly quota for Qodo. Upgrade your plan

PR Code Suggestions ✨

No code suggestions found for the PR.

@polasudo
fix: revert rpms.in.yaml to only include openssl
8cb4b01 
The rpm-lockfile-prototype tool automatically resolves dependencies,
so we only need to specify the top-level package (openssl).

The previous commit (redhat-developer#2141) incorrectly included all transitive
dependencies explicitly, which is unnecessary and harder to maintain.

The rpms.lock.yaml will be regenerated by the automated workflow.
@polasudo
polasudo force-pushed the fix/revert-rpms-in-yaml-to-openssl-only branch from da5ab25 to 8cb4b01 Compare January 23, 2026 15:41
@sonarqubecloud

sonarqubecloud Bot commented Jan 23, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@nickboldt
nickboldt marked this pull request as ready for review January 23, 2026 15:47
nickboldt
nickboldt approved these changes Jan 23, 2026
View reviewed changes

@nickboldt nickboldt left a comment •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

NOTE: this is re: https://issues.redhat.com/browse/RHIDP-11434 (missing from the PR desc)

@rhdh-qodo-merge

rhdh-qodo-merge Bot commented Jan 23, 2026

Copy link
Copy Markdown 
ⓘ Your approaching your monthly quota for Qodo. Upgrade your plan

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪
🔒 No security concerns identified
⚡ Recommended focus areas for review

Lockfile Consistency

The first packages entry for the openssl RPM appears to include only url, repoid, size, and checksum, while other package entries elsewhere in the lockfile include additional fields like name, evr, and sourcerpm. Confirm whether this abbreviated schema is valid for the lockfile consumer/tooling and won’t break parsing or downstream checks that expect the full metadata.

 
packages:
- url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/o/openssl-3.5.1-5.el9_7.x86_64.rpm
  repoid: ubi-9-for-x86_64-baseos-rpms
  size: 1555474
  checksum: sha256:3bfd7ceb59a554e40cb417e2b5b2d046be671ce49abc058328807049baf1134f
📄 References
  1. redhat-developer/rhdh/rpms.in.yaml [164-232]
  2. redhat-developer/rhdh/rpms.in.yaml [1-8]
  3. redhat-developer/rhdh/rpms.in.yaml [234-287]
  4. redhat-developer/rhdh/rpms.lock.yaml [4988-5005]
  5. redhat-developer/rhdh/rpms.lock.yaml [2947-2960]
  6. redhat-developer/rhdh/rpms.lock.yaml [609-615]
  7. redhat-developer/rhdh-operator/rpms.lock.yaml [49-62]
  8. redhat-developer/rhdh/rpms.lock.yaml [4964-4981]

@rhdh-qodo-merge

rhdh-qodo-merge Bot commented Jan 23, 2026

Copy link
Copy Markdown 
ⓘ Your approaching your monthly quota for Qodo. Upgrade your plan

PR Code Suggestions ✨

Explore these optional code suggestions:

CategorySuggestion                                                                                                                                    Impact
Possible issue
Re-add FIPS provider for compliance

Re-add the openssl-fips-provider package to rpms.in.yaml to align with the
stated requirement for FIPS support, as its removal could break FIPS compliance.

rpms.in.yaml [21-23]

     packages:
       # Required for FIPS support in the operator runtime
       - openssl
+      - openssl-fips-provider

[To ensure code accuracy, apply this suggestion manually]

Suggestion importance[1-10]: 9

__

Why: The suggestion correctly identifies a critical contradiction between the code comment indicating a requirement for FIPS support and the removal of the openssl-fips-provider package, which is essential for that functionality.

High
  • More

@kim-tsao

kim-tsao commented Jan 23, 2026

Copy link
Copy Markdown
Member

/lgtm

@openshift-ci

openshift-ci Bot commented Jan 23, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: kim-tsao, nickboldt

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-merge-bot
openshift-merge-bot Bot merged commit c7af0a9 into redhat-developer:main Jan 23, 2026
9 of 12 checks passed
@nickboldt

nickboldt commented Jan 23, 2026

Copy link
Copy Markdown
Member

/cherry-pick release-1.9

@openshift-cherrypick-robot

openshift-cherrypick-robot commented Jan 23, 2026

Copy link
Copy Markdown

@nickboldt: new pull request created: #2177

Details

In response to this:

/cherry-pick release-1.9

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-cherrypick-robot openshift-cherrypick-robot mentioned this pull request Jan 23, 2026
Merged
@rm3l rm3l mentioned this pull request Feb 23, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@nickboldt nickboldt nickboldt approved these changes
@gazarenkov gazarenkov Awaiting requested review from gazarenkov
@OpinionatedHeron OpinionatedHeron Awaiting requested review from OpinionatedHeron

Assignees

@nickboldt nickboldt

@kim-tsao kim-tsao

Labels

approved Bug fix lgtm Review effort 1/5 Review effort 2/5

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@polasudo @kim-tsao @nickboldt @openshift-cherrypick-robot