-
Notifications
You must be signed in to change notification settings - Fork 129
Open
Description
Context
In jupyter/trustyai/ubi9-python-3.12/Dockerfile.konflux.cpu around line 254, the debugpy installation uses fragile TOML parsing and bypasses hash verification:
- Uses
grep -A1 '"debugpy"' ./pylock.toml | grep -Eo '\b[0-9\.]+\b'to extract version (brittle to TOML formatting changes) - Installs via
git+https://...which bypasses hash verification, inconsistent with--verify-hashesused elsewhere
Proposed Solution
Replace with Red Hat package repository installation:
- Use
https://packages.redhat.com/api/pypi/public-rhai/rhoai/3.4-EA1/cpu-ubi9/simple/debugpy/for CPU builds - Use
https://packages.redhat.com/api/pypi/public-rhai/rhoai/3.4-EA1/cuda12.9-ubi9/simple/debugpy/for CUDA builds
This will:
- Maintain hash verification
- Remove brittle grep parsing
- Stay consistent with
--verify-hashesposture
References
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels
Type
Projects
Status
๐ Backlog