Merge pull request #2431 from jrobertboos/fix-cves-3

LCORE-3326: removed explicit package calls

Author: tisnik

.konflux/redhat.repo

@@ -39,3 +39,17 @@ metadata_expire = 86400
 enabled_metadata = 0
 sslclientkey = $SSL_CLIENT_KEY
 sslclientcert = $SSL_CLIENT_CERT
+
+[rhelai-3.4-for-rhel-9-$basearch-rpms]
+name = Red Hat Enterprise Linux AI (3.4) for RHEL 9 $basearch (RPMs)
+baseurl = https://cdn.redhat.com/content/dist/layered/rhel9/$basearch/rhelai/3.4/os
+enabled = 1
+gpgcheck = 1
+gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
+sslverify = 1
+sslcacert = /etc/rhsm/ca/redhat-uep.pem
+sslverifystatus = 1
+metadata_expire = 86400
+enabled_metadata = 0
+sslclientkey = $SSL_CLIENT_KEY
+sslclientcert = $SSL_CLIENT_CERT

.konflux/rpms.in.yaml

@@ -11,6 +11,7 @@ packages:
 upgradePackages:
   [
     libgcrypt,
+    thrift,
   ]
 contentOrigin:
   repofiles: ["./redhat.repo"]

.konflux/rpms.lock.yaml

@@ -4,6 +4,13 @@ lockfileVendor: redhat
 arches:
 - arch: aarch64
   packages:
+  - url: https://cdn.redhat.com/content/dist/layered/rhel9/aarch64/rhelai/3.4/os/Packages/t/thrift-0.15.0-6.el9ai.aarch64.rpm
+    repoid: rhelai-3.4-for-rhel-9-aarch64-rpms
+    size: 1446795
+    checksum: sha256:3daa6deb9e8ac711cb61c63a87c250ac5fe744a368408dddc540a7ddfb19675e
+    name: thrift
+    evr: 1:0.15.0-6.el9ai
+    sourcerpm: thrift-0.15.0-6.el9ai.src.rpm
   - url: https://cdn.redhat.com/content/eus/rhel9/9.6/aarch64/appstream/os/Packages/c/cargo-1.84.1-1.el9.aarch64.rpm
     repoid: rhel-9-for-aarch64-appstream-eus-rpms__9_DOT_6
     size: 7744425
@@ -85,6 +92,13 @@ arches:
   module_metadata: []
 - arch: x86_64
   packages:
+  - url: https://cdn.redhat.com/content/dist/layered/rhel9/x86_64/rhelai/3.4/os/Packages/t/thrift-0.15.0-6.el9ai.x86_64.rpm
+    repoid: rhelai-3.4-for-rhel-9-x86_64-rpms
+    size: 1657357
+    checksum: sha256:f4731d852b67a8b5b90f3f703ef6c29b2107e0686b5fda20095a929dc9d044ac
+    name: thrift
+    evr: 1:0.15.0-6.el9ai
+    sourcerpm: thrift-0.15.0-6.el9ai.src.rpm
   - url: https://cdn.redhat.com/content/eus/rhel9/9.6/x86_64/appstream/os/Packages/c/cargo-1.84.1-1.el9.x86_64.rpm
     repoid: rhel-9-for-x86_64-appstream-eus-rpms__9_DOT_6
     size: 8292467

deploy/lightspeed-stack/Containerfile

@@ -25,7 +25,7 @@ USER root
 # (dependency of autoevals, no pre-built binary wheels for linux on aarch64)
 # cmake and cargo are required by fastuuid, maturin
 RUN ${BUILDER_DNF_COMMAND} install -y --nodocs --setopt=keepcache=0 --setopt=tsflags=nodocs gcc gcc-c++ cmake cargo && \
-    ${BUILDER_DNF_COMMAND} update -y --nodocs --setopt=keepcache=0 --setopt=tsflags=nodocs gnutls libxslt openssl-fips-provider
+    ${BUILDER_DNF_COMMAND} update -y --nodocs --setopt=keepcache=0 --setopt=tsflags=nodocs
 
 # Install uv package manager
 RUN pip3.12 install "uv>=0.8.15"
@@ -119,7 +119,7 @@ USER root
 
 # Additional tools for derived images
 RUN ${RUNTIME_DNF_COMMAND} install -y --nodocs --setopt=keepcache=0 --setopt=tsflags=nodocs jq patch && \
-    ${RUNTIME_DNF_COMMAND} update -y --nodocs --setopt=keepcache=0 --setopt=tsflags=nodocs gnutls libxslt openssl-fips-provider
+    ${RUNTIME_DNF_COMMAND} update -y --nodocs --setopt=keepcache=0 --setopt=tsflags=nodocs
 
 # Create llama-stack directories for library mode
 RUN mkdir -p /opt/app-root/src/.llama/storage /opt/app-root/src/.llama/providers.d && \