From 53f54284aabf466d6f4884fdb6c7308b67878d77 Mon Sep 17 00:00:00 2001 From: "red-hat-konflux[bot]" <126015336+red-hat-konflux[bot]@users.noreply.github.com> Date: Sat, 28 Feb 2026 05:36:51 +0000 Subject: [PATCH 1/7] chore(deps): update quay.io/konflux-ci/hermeto docker tag to v0.47.0 Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com> --- .tekton/build-dm-verity-image-debug.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.tekton/build-dm-verity-image-debug.yaml b/.tekton/build-dm-verity-image-debug.yaml index 144ed8b1..aa6afa7c 100644 --- a/.tekton/build-dm-verity-image-debug.yaml +++ b/.tekton/build-dm-verity-image-debug.yaml @@ -64,7 +64,7 @@ spec: - use - $(params.SOURCE_ARTIFACT)=/var/workdir/source - name: download-rhel-image - image: quay.io/konflux-ci/hermeto:0.29.0@sha256:f577e0399953471df7a9826c1550aef83d28e8b35f76dd65a193441822b629ee + image: quay.io/konflux-ci/hermeto:0.47.0@sha256:22a12fb6220c21c2b4e4b4ea33dfdc4a0294dc3071ebcf30570604b54078f792 env: - name: REDHAT_OFFLINE_TOKEN valueFrom: From d592ed6f5e5605ffa561ca8c04a2b518ad5ba0a3 Mon Sep 17 00:00:00 2001 From: "red-hat-konflux[bot]" <126015336+red-hat-konflux[bot]@users.noreply.github.com> Date: Sat, 21 Feb 2026 05:05:06 +0000 Subject: [PATCH 2/7] chore(deps): update quay.io/konflux-ci/yq:latest docker digest to 466005c Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com> --- .tekton/build-dm-verity-image-debug.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.tekton/build-dm-verity-image-debug.yaml b/.tekton/build-dm-verity-image-debug.yaml index aa6afa7c..cce33aac 100644 --- a/.tekton/build-dm-verity-image-debug.yaml +++ b/.tekton/build-dm-verity-image-debug.yaml @@ -600,7 +600,7 @@ spec: mkdir -p /tmp/auth && select-oci-auth "$(cat "$(results.IMAGE_REFERENCE.path)")" > /tmp/auth/config.json DOCKER_CONFIG=/tmp/auth cosign attach sbom --sbom sbom.json --type "$SBOM_TYPE" "$(cat "$(results.IMAGE_REFERENCE.path)")" - name: report-sbom-url - image: quay.io/konflux-ci/yq:latest@sha256:15d0238843d954ee78c9c190705eb8b36f6e52c31434183c37d99a80841a635a + image: quay.io/konflux-ci/yq:latest@sha256:466005c667e6e9ea19fd4738275f71a13f89382f6233c581d5e952a41ccb3b42 script: | #!/bin/bash REPO=${OUTPUT_IMAGE%:*} From 04444e209ca283d8ee1efe1a1530c14fe6044148 Mon Sep 17 00:00:00 2001 From: "red-hat-konflux[bot]" <126015336+red-hat-konflux[bot]@users.noreply.github.com> Date: Sat, 28 Feb 2026 05:36:35 +0000 Subject: [PATCH 3/7] chore(deps): update quay.io/konflux-ci/mobster docker digest to a2feb71 Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com> --- .tekton/build-dm-verity-image-debug.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.tekton/build-dm-verity-image-debug.yaml b/.tekton/build-dm-verity-image-debug.yaml index cce33aac..1c1fb16c 100644 --- a/.tekton/build-dm-verity-image-debug.yaml +++ b/.tekton/build-dm-verity-image-debug.yaml @@ -571,7 +571,7 @@ spec: - mountPath: /activation-key name: activation-key - name: sbom-generate - image: quay.io/konflux-ci/mobster@sha256:45298b363ff4b96a084bf77a627b3e23471dcfb821eab55a3fa49a60f0ac43f3 + image: quay.io/konflux-ci/mobster@sha256:a2feb71e321a0164820fe7171e564242c75125d8b62d213d3ba3423cf8fa678b script: | #!/bin/bash set -euo pipefail From e33c42851f011994b35042599242fde99f196989 Mon Sep 17 00:00:00 2001 From: "red-hat-konflux[bot]" <126015336+red-hat-konflux[bot]@users.noreply.github.com> Date: Sat, 14 Feb 2026 05:00:36 +0000 Subject: [PATCH 4/7] chore(deps): update quay.io/konflux-ci/buildah-task:latest docker digest to 4c470b5 Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com> --- .tekton/build-dm-verity-image-debug.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.tekton/build-dm-verity-image-debug.yaml b/.tekton/build-dm-verity-image-debug.yaml index 1c1fb16c..82a18772 100644 --- a/.tekton/build-dm-verity-image-debug.yaml +++ b/.tekton/build-dm-verity-image-debug.yaml @@ -101,7 +101,7 @@ spec: curl -X GET "${download_url}" -H "Authorization: Bearer ${token}" --output "${filepath}" echo "${RHEL_IMAGE_CHECKSUM}" "${filepath}" | sha256sum --check - name: build - image: quay.io/konflux-ci/buildah-task:latest@sha256:b82d465a06c926882d02b721cf8a8476048711332749f39926a01089cf85a3f9 + image: quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709 computeResources: limits: memory: 512Mi From b7e22d3865b8c03ff9e762bc5f40910521f6118e Mon Sep 17 00:00:00 2001 From: "red-hat-konflux[bot]" <126015336+red-hat-konflux[bot]@users.noreply.github.com> Date: Sat, 17 Jan 2026 12:51:00 +0000 Subject: [PATCH 5/7] chore(deps): update quay.io/konflux-ci/build-trusted-artifacts:latest docker digest to 15d7dc8 Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com> --- .tekton/build-dm-verity-image-debug.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.tekton/build-dm-verity-image-debug.yaml b/.tekton/build-dm-verity-image-debug.yaml index 82a18772..21ca0188 100644 --- a/.tekton/build-dm-verity-image-debug.yaml +++ b/.tekton/build-dm-verity-image-debug.yaml @@ -59,7 +59,7 @@ spec: name: varlibcontainers steps: - name: use-trusted-artifact - image: quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:4689f88dd253bd1feebf57f1a76a5a751880f739000719cd662bbdc76990a7fd + image: quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:15d7dc86012e41b10d1eb37679ec03ee75c96436224fadd0938a49dc537aa4ad args: - use - $(params.SOURCE_ARTIFACT)=/var/workdir/source From aaecad6895b0d96dd780519f1e2701e7d4cdb688 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Julien=20Rop=C3=A9?= Date: Tue, 3 Mar 2026 18:44:46 +0100 Subject: [PATCH 6/7] build-dm-verity-task: update konflux references MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Copying the references received from Konflux on the Debug variant of the task. Signed-off-by: Julien Ropé --- .../0.1/build-dm-verity-image.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/task/build-dm-verity-image/0.1/build-dm-verity-image.yaml b/task/build-dm-verity-image/0.1/build-dm-verity-image.yaml index 85a04d45..effeed24 100644 --- a/task/build-dm-verity-image/0.1/build-dm-verity-image.yaml +++ b/task/build-dm-verity-image/0.1/build-dm-verity-image.yaml @@ -59,12 +59,12 @@ spec: name: varlibcontainers steps: - name: use-trusted-artifact - image: quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:4689f88dd253bd1feebf57f1a76a5a751880f739000719cd662bbdc76990a7fd + image: quay.io/konflux-ci/build-trusted-artifacts:latest@sha256:15d7dc86012e41b10d1eb37679ec03ee75c96436224fadd0938a49dc537aa4ad args: - use - $(params.SOURCE_ARTIFACT)=/var/workdir/source - name: download-rhel-image - image: quay.io/konflux-ci/hermeto:0.29.0@sha256:f577e0399953471df7a9826c1550aef83d28e8b35f76dd65a193441822b629ee + image: quay.io/konflux-ci/hermeto:0.47.0@sha256:22a12fb6220c21c2b4e4b4ea33dfdc4a0294dc3071ebcf30570604b54078f792 env: - name: REDHAT_OFFLINE_TOKEN valueFrom: @@ -101,7 +101,7 @@ spec: curl -X GET "${download_url}" -H "Authorization: Bearer ${token}" --output "${filepath}" echo "${RHEL_IMAGE_CHECKSUM}" "${filepath}" | sha256sum --check - name: build - image: quay.io/konflux-ci/buildah-task:latest@sha256:b82d465a06c926882d02b721cf8a8476048711332749f39926a01089cf85a3f9 + image: quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709 computeResources: limits: memory: 512Mi @@ -572,7 +572,7 @@ spec: - mountPath: /activation-key name: activation-key - name: sbom-generate - image: quay.io/konflux-ci/mobster@sha256:45298b363ff4b96a084bf77a627b3e23471dcfb821eab55a3fa49a60f0ac43f3 + image: quay.io/konflux-ci/mobster@sha256:a2feb71e321a0164820fe7171e564242c75125d8b62d213d3ba3423cf8fa678b script: | #!/bin/bash set -euo pipefail @@ -601,7 +601,7 @@ spec: mkdir -p /tmp/auth && select-oci-auth "$(cat "$(results.IMAGE_REFERENCE.path)")" > /tmp/auth/config.json DOCKER_CONFIG=/tmp/auth cosign attach sbom --sbom sbom.json --type "$SBOM_TYPE" "$(cat "$(results.IMAGE_REFERENCE.path)")" - name: report-sbom-url - image: quay.io/konflux-ci/yq:latest@sha256:15d0238843d954ee78c9c190705eb8b36f6e52c31434183c37d99a80841a635a + image: quay.io/konflux-ci/yq:latest@sha256:466005c667e6e9ea19fd4738275f71a13f89382f6233c581d5e952a41ccb3b42 script: | #!/bin/bash REPO=${OUTPUT_IMAGE%:*} From 83eb41ba8120eafcfba39e0b4c5ebcc3d5143d91 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Julien=20Rop=C3=A9?= Date: Tue, 10 Mar 2026 17:52:54 +0100 Subject: [PATCH 7/7] DNM: trying to understand why we get a build failure with the debug version MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Julien Ropé --- .tekton/build-dm-verity-image-debug.yaml | 2 +- task/build-dm-verity-image/0.1/build-dm-verity-image.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.tekton/build-dm-verity-image-debug.yaml b/.tekton/build-dm-verity-image-debug.yaml index 21ca0188..42eda68d 100644 --- a/.tekton/build-dm-verity-image-debug.yaml +++ b/.tekton/build-dm-verity-image-debug.yaml @@ -101,7 +101,7 @@ spec: curl -X GET "${download_url}" -H "Authorization: Bearer ${token}" --output "${filepath}" echo "${RHEL_IMAGE_CHECKSUM}" "${filepath}" | sha256sum --check - name: build - image: quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709 + image: quay.io/konflux-ci/buildah-task:latest@sha256:b82d465a06c926882d02b721cf8a8476048711332749f39926a01089cf85a3f9 computeResources: limits: memory: 512Mi diff --git a/task/build-dm-verity-image/0.1/build-dm-verity-image.yaml b/task/build-dm-verity-image/0.1/build-dm-verity-image.yaml index effeed24..d64468ae 100644 --- a/task/build-dm-verity-image/0.1/build-dm-verity-image.yaml +++ b/task/build-dm-verity-image/0.1/build-dm-verity-image.yaml @@ -101,7 +101,7 @@ spec: curl -X GET "${download_url}" -H "Authorization: Bearer ${token}" --output "${filepath}" echo "${RHEL_IMAGE_CHECKSUM}" "${filepath}" | sha256sum --check - name: build - image: quay.io/konflux-ci/buildah-task:latest@sha256:4c470b5a153c4acd14bf4f8731b5e36c61d7faafe09c2bf376bb81ce84aa5709 + image: quay.io/konflux-ci/buildah-task:latest@sha256:b82d465a06c926882d02b721cf8a8476048711332749f39926a01089cf85a3f9 computeResources: limits: memory: 512Mi