Skip to content

Commit d03ab5b

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #277 from smith-xyz/gh-272
fix: skipped os scan errors for certified distributions
2 parents 1c35419 + 70b37fd commit d03ab5b

File tree

18 files changed

+360
-47
lines changed

18 files changed

+360
-47
lines changed

‎config.toml‎

Lines changed: 23 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,16 @@
1-
certified_distributions = []
1+
certified_distributions = [
2+
"Red Hat Enterprise Linux release 8.4 (Ootpa)",
3+
"Red Hat Enterprise Linux release 8.5 (Ootpa)",
4+
"Red Hat Enterprise Linux release 8.6 (Ootpa)",
5+
"Red Hat Enterprise Linux release 8.7 (Ootpa)",
6+
"Red Hat Enterprise Linux release 8.9 (Ootpa)",
7+
"Red Hat Enterprise Linux release 8.10 (Ootpa)",
8+
"Red Hat Enterprise Linux release 9.0 (Plow)",
9+
"Red Hat Enterprise Linux release 9.2 (Plow)",
10+
"Red Hat Enterprise Linux release 9.4 (Plow)",
11+
"Red Hat Enterprise Linux release 9.5 (Plow)",
12+
"Red Hat Enterprise Linux release 9.6 (Plow)",
13+
]
214

315
# List of directories to ignore. This is a prefix match,
416
# i.e. everything under a matched directory is ignored.
@@ -132,16 +144,16 @@ files = ["/usr/lib/dracut/modules.d/30ignition/ignition"]
132144
[[rpm.valgrind.ignore]]
133145
error = "ErrNotDynLinked"
134146
files = [
135-
"/usr/libexec/valgrind/cachegrind-amd64-linux",
136-
"/usr/libexec/valgrind/callgrind-amd64-linux",
137-
"/usr/libexec/valgrind/dhat-amd64-linux",
138-
"/usr/libexec/valgrind/drd-amd64-linux",
139-
"/usr/libexec/valgrind/exp-bbv-amd64-linux",
140-
"/usr/libexec/valgrind/helgrind-amd64-linux",
141-
"/usr/libexec/valgrind/lackey-amd64-linux",
142-
"/usr/libexec/valgrind/massif-amd64-linux",
143-
"/usr/libexec/valgrind/memcheck-amd64-linux",
144-
"/usr/libexec/valgrind/none-amd64-linux"
147+
"/usr/libexec/valgrind/cachegrind-amd64-linux",
148+
"/usr/libexec/valgrind/callgrind-amd64-linux",
149+
"/usr/libexec/valgrind/dhat-amd64-linux",
150+
"/usr/libexec/valgrind/drd-amd64-linux",
151+
"/usr/libexec/valgrind/exp-bbv-amd64-linux",
152+
"/usr/libexec/valgrind/helgrind-amd64-linux",
153+
"/usr/libexec/valgrind/lackey-amd64-linux",
154+
"/usr/libexec/valgrind/massif-amd64-linux",
155+
"/usr/libexec/valgrind/memcheck-amd64-linux",
156+
"/usr/libexec/valgrind/none-amd64-linux",
145157
]
146158

147159
[[payload.openshift-enterprise-pod-container.ignore]]

‎dist/releases/4.12/config.toml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,12 @@
1+
# RHCOS transport image - ignore OS certification check
2+
# The rhel-coreos tag is used to transport the base OS image that OpenShift nodes run on.
3+
# This image doesn't have typical component metadata and isn't a layered product.
4+
# The RHCOS team uses OpenShift releases as a transport mechanism for this base OS.
5+
# This issue was resolved in OpenShift 4.19+ but affects earlier versions.
6+
[[tag.rhel-coreos.ignore]]
7+
error = "ErrOSNotCertified"
8+
tags = ["rhel-coreos"]
9+
110
[[payload.openshift-enterprise-operator-sdk-container.ignore]]
211
error = "ErrGoMissingSymbols"
312
files = ["/usr/lib/golang/pkg/tool/linux_amd64/cgo"]

‎dist/releases/4.13/config.toml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,12 @@
1+
# RHCOS transport image - ignore OS certification check
2+
# The rhel-coreos tag is used to transport the base OS image that OpenShift nodes run on.
3+
# This image doesn't have typical component metadata and isn't a layered product.
4+
# The RHCOS team uses OpenShift releases as a transport mechanism for this base OS.
5+
# This issue was resolved in OpenShift 4.19+ but affects earlier versions.
6+
[[tag.rhel-coreos.ignore]]
7+
error = "ErrOSNotCertified"
8+
tags = ["rhel-coreos"]
9+
110
[[payload.ose-network-interface-bond-cni-container.ignore]]
211
error = "ErrLibcryptoSoMissing"
312
files = [

‎dist/releases/4.14/config.toml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,12 @@
1+
# RHCOS transport image - ignore OS certification check
2+
# The rhel-coreos tag is used to transport the base OS image that OpenShift nodes run on.
3+
# This image doesn't have typical component metadata and isn't a layered product.
4+
# The RHCOS team uses OpenShift releases as a transport mechanism for this base OS.
5+
# This issue was resolved in OpenShift 4.19+ but affects earlier versions.
6+
[[tag.rhel-coreos.ignore]]
7+
error = "ErrOSNotCertified"
8+
tags = ["rhel-coreos"]
9+
110
[[payload.ose-network-interface-bond-cni-container.ignore]]
211
error = "ErrLibcryptoSoMissing"
312
files = ["/bondcni/bond", "/bondcni/rhel9/bond"]

‎dist/releases/4.15/config.toml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,12 @@
1+
# RHCOS transport image - ignore OS certification check
2+
# The rhel-coreos tag is used to transport the base OS image that OpenShift nodes run on.
3+
# This image doesn't have typical component metadata and isn't a layered product.
4+
# The RHCOS team uses OpenShift releases as a transport mechanism for this base OS.
5+
# This issue was resolved in OpenShift 4.19+ but affects earlier versions.
6+
[[tag.rhel-coreos.ignore]]
7+
error = "ErrOSNotCertified"
8+
tags = ["rhel-coreos"]
9+
110
[[payload.ose-network-interface-bond-cni-container.ignore]]
211
error = "ErrLibcryptoSoMissing"
312
files = ["/bondcni/bond", "/bondcni/rhel9/bond"]

‎dist/releases/4.16/config.toml‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,16 @@
1-
certified_distributions = [
2-
"Red Hat Enterprise Linux release 9.2 (Plow)",
3-
"Red Hat Enterprise Linux release 9.4 (Plow)",
4-
"Red Hat Enterprise Linux release 9.6 (Plow)",
5-
"Red Hat Enterprise Linux release 8.10 (Ootpa)",
6-
]
7-
81
[[payload.ubi9-container.ignore]]
92
error = "ErrOSNotCertified"
103
tags = ["rhel-coreos-extensions"]
114

5+
# RHCOS transport image - ignore OS certification check
6+
# The rhel-coreos tag is used to transport the base OS image that OpenShift nodes run on.
7+
# This image doesn't have typical component metadata and isn't a layered product.
8+
# The RHCOS team uses OpenShift releases as a transport mechanism for this base OS.
9+
# This issue was resolved in OpenShift 4.19+ but affects earlier versions.
10+
[[tag.rhel-coreos.ignore]]
11+
error = "ErrOSNotCertified"
12+
tags = ["rhel-coreos"]
13+
1214
[[payload.ose-network-interface-bond-cni-container.ignore]]
1315
error = "ErrLibcryptoSoMissing"
1416
files = ["/bondcni/bond", "/bondcni/rhel9/bond"]

‎dist/releases/4.17/config.toml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,12 @@
1+
# RHCOS transport image - ignore OS certification check
2+
# The rhel-coreos tag is used to transport the base OS image that OpenShift nodes run on.
3+
# This image doesn't have typical component metadata and isn't a layered product.
4+
# The RHCOS team uses OpenShift releases as a transport mechanism for this base OS.
5+
# This issue was resolved in OpenShift 4.19+ but affects earlier versions.
6+
[[tag.rhel-coreos.ignore]]
7+
error = "ErrOSNotCertified"
8+
tags = ["rhel-coreos"]
9+
110
[[payload.ose-network-interface-bond-cni-container.ignore]]
211
error = "ErrLibcryptoSoMissing"
312
files = ["/bondcni/bond", "/bondcni/rhel9/bond"]

‎dist/releases/4.18/config.toml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,12 @@
1+
# RHCOS transport image - ignore OS certification check
2+
# The rhel-coreos tag is used to transport the base OS image that OpenShift nodes run on.
3+
# This image doesn't have typical component metadata and isn't a layered product.
4+
# The RHCOS team uses OpenShift releases as a transport mechanism for this base OS.
5+
# This issue was resolved in OpenShift 4.19+ but affects earlier versions.
6+
[[tag.rhel-coreos.ignore]]
7+
error = "ErrOSNotCertified"
8+
tags = ["rhel-coreos"]
9+
110
[[payload.ose-network-interface-bond-cni-container.ignore]]
211
error = "ErrLibcryptoSoMissing"
312
files = ["/bondcni/bond", "/bondcni/rhel9/bond"]

‎internal/scan/scan.go‎

Lines changed: 3 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -370,23 +370,14 @@ func walkDirScan(ctx context.Context, cfg *types.Config, tag *v1.TagReference, c
370370
results := types.NewScanResults()
371371

372372
certifiedDistributions := cfg.GetCertifiedDistributions()
373-
if len(certifiedDistributions) > 0 {
373+
374+
if len(certifiedDistributions) > 0 && !cfg.ShouldIgnoreOSValidation(tag, component, types.ErrOSNotCertified) {
374375
// Check the operating system release against a known list of certified
375376
// distributions. Here we're primarily concerned about warning against
376377
// operating systems that haven't been certified, yet.
377378
osInfo := validations.ValidateOS(cfg, mountPath)
378379
osScanResult := types.NewScanResult().SetOS(osInfo).SetComponent(component).SetTag(tag)
379-
if component != nil && osScanResult.Error != nil {
380-
if i, ok := cfg.PayloadIgnores[component.Component]; ok {
381-
if tag != nil {
382-
if !i.ErrIgnores.IgnoreTag(tag.Name, osScanResult.Error.Error) {
383-
results.Append(osScanResult)
384-
}
385-
}
386-
}
387-
} else {
388-
results.Append(osScanResult)
389-
}
380+
results.Append(osScanResult)
390381
}
391382

392383
// does the image contain openssl

0 commit comments

Comments
 (0)