From e0de4cdd57bbefe7c1acd4805d0fa8a94493c86c Mon Sep 17 00:00:00 2001 From: Gus Parvin Date: Thu, 18 Sep 2025 20:09:20 -0400 Subject: [PATCH] The MCE hypershift container needs changes to the exceptions in place The FIPS scans are failing in our konflux builds due to problems with the hypershift "extra" binaries. The current exceptions for these binaries is not correctly preventing the scanner from erroring on these binaries. Tested with the latest image from our MCE 2.18.3 release Refs: - https://issues.redhat.com/browse/ACM-24281 Signed-off-by: Gus Parvin Signed-off-by: yiraeChristineKim Co-authored-by: Cursor --- dist/releases/4.15/config.toml | 18 +++++++++++++++++- dist/releases/4.16/config.toml | 18 +++++++++++++++++- dist/releases/4.17/config.toml | 17 ++++++++++++++++- dist/releases/4.18/config.toml | 18 +++++++++++++++++- dist/releases/4.19/config.toml | 18 +++++++++++++++++- dist/releases/4.20/config.toml | 18 +++++++++++++++++- dist/releases/4.21/config.toml | 18 +++++++++++++++++- dist/releases/4.22/config.toml | 18 +++++++++++++++++- dist/releases/4.23/config.toml | 18 +++++++++++++++++- dist/releases/5.0/config.toml | 18 +++++++++++++++++- 10 files changed, 169 insertions(+), 10 deletions(-) diff --git a/dist/releases/4.15/config.toml b/dist/releases/4.15/config.toml index 3fd9ca58..ee508d8d 100644 --- a/dist/releases/4.15/config.toml +++ b/dist/releases/4.15/config.toml @@ -178,7 +178,23 @@ files = [ [[payload.multicluster-engine-hypershift-operator.ignore]] error = "ErrGoNotCgoEnabled" -files = ["/usr/bin/hcp-no-cgo", "/usr/bin/hypershift-no-cgo"] +files = ["/usr/bin/hcp", "/usr/bin/hcp-no-cgo", "/usr/bin/hypershift-no-cgo"] + +[[payload.multicluster-engine-hypershift-operator-container.ignore]] +error = "ErrGoMissingSymbols" +files = [ + "/usr/bin/hcp", + "/usr/bin/hcp-no-cgo", + "/usr/bin/hypershift-no-cgo", +] + +[[payload.multicluster-engine-hypershift-operator-container.ignore]] +error = "ErrNotDynLinked" +files = [ + "/usr/bin/hcp", + "/usr/bin/hcp-no-cgo", + "/usr/bin/hypershift-no-cgo", +] [[payload.virt-cdi-importer-rhel9-container.ignore]] error = "ErrGoNotCgoEnabled" diff --git a/dist/releases/4.16/config.toml b/dist/releases/4.16/config.toml index 6e35b026..50b8d257 100644 --- a/dist/releases/4.16/config.toml +++ b/dist/releases/4.16/config.toml @@ -462,7 +462,23 @@ files = ["/tools/opm-rhel8"] [[payload.multicluster-engine-hypershift-operator.ignore]] error = "ErrGoNotCgoEnabled" -files = ["/usr/bin/hcp-no-cgo", "/usr/bin/hypershift-no-cgo"] +files = ["/usr/bin/hcp", "/usr/bin/hcp-no-cgo", "/usr/bin/hypershift-no-cgo"] + +[[payload.multicluster-engine-hypershift-operator-container.ignore]] +error = "ErrGoMissingSymbols" +files = [ + "/usr/bin/hcp", + "/usr/bin/hcp-no-cgo", + "/usr/bin/hypershift-no-cgo", +] + +[[payload.multicluster-engine-hypershift-operator-container.ignore]] +error = "ErrNotDynLinked" +files = [ + "/usr/bin/hcp", + "/usr/bin/hcp-no-cgo", + "/usr/bin/hypershift-no-cgo", +] [[payload.virt-cdi-importer-rhel9-container.ignore]] error = "ErrGoNotCgoEnabled" diff --git a/dist/releases/4.17/config.toml b/dist/releases/4.17/config.toml index d6433af9..8fe360f5 100644 --- a/dist/releases/4.17/config.toml +++ b/dist/releases/4.17/config.toml @@ -453,8 +453,23 @@ files = ["/unpack"] # containers for QE testing. [[payload.multicluster-engine-hypershift-operator.ignore]] error = "ErrGoNotCgoEnabled" -files = ["/usr/bin/hcp-no-cgo", "/usr/bin/hypershift-no-cgo"] +files = ["/usr/bin/hcp", "/usr/bin/hcp-no-cgo", "/usr/bin/hypershift-no-cgo"] +[[payload.multicluster-engine-hypershift-operator-container.ignore]] +error = "ErrGoMissingSymbols" +files = [ + "/usr/bin/hcp", + "/usr/bin/hcp-no-cgo", + "/usr/bin/hypershift-no-cgo", +] + +[[payload.multicluster-engine-hypershift-operator-container.ignore]] +error = "ErrNotDynLinked" +files = [ + "/usr/bin/hcp", + "/usr/bin/hcp-no-cgo", + "/usr/bin/hypershift-no-cgo", +] [[payload.virt-cdi-importer-rhel9-container.ignore]] error = "ErrGoNotCgoEnabled" diff --git a/dist/releases/4.18/config.toml b/dist/releases/4.18/config.toml index 7cd63265..ea2bc444 100644 --- a/dist/releases/4.18/config.toml +++ b/dist/releases/4.18/config.toml @@ -451,7 +451,23 @@ files = ["/unpack"] [[payload.multicluster-engine-hypershift-operator.ignore]] error = "ErrGoNotCgoEnabled" -files = ["/usr/bin/hcp-no-cgo", "/usr/bin/hypershift-no-cgo"] +files = ["/usr/bin/hcp", "/usr/bin/hcp-no-cgo", "/usr/bin/hypershift-no-cgo"] + +[[payload.multicluster-engine-hypershift-operator-container.ignore]] +error = "ErrGoMissingSymbols" +files = [ + "/usr/bin/hcp", + "/usr/bin/hcp-no-cgo", + "/usr/bin/hypershift-no-cgo", +] + +[[payload.multicluster-engine-hypershift-operator-container.ignore]] +error = "ErrNotDynLinked" +files = [ + "/usr/bin/hcp", + "/usr/bin/hcp-no-cgo", + "/usr/bin/hypershift-no-cgo", +] [[payload.hco-bundle-registry-container.ignore]] error = "ErrNotDynLinked" diff --git a/dist/releases/4.19/config.toml b/dist/releases/4.19/config.toml index 09a6ac3b..8bc10a15 100644 --- a/dist/releases/4.19/config.toml +++ b/dist/releases/4.19/config.toml @@ -442,7 +442,23 @@ files = ["/unpack"] [[payload.multicluster-engine-hypershift-operator.ignore]] error = "ErrGoNotCgoEnabled" -files = ["/usr/bin/hcp-no-cgo", "/usr/bin/hypershift-no-cgo"] +files = ["/usr/bin/hcp", "/usr/bin/hcp-no-cgo", "/usr/bin/hypershift-no-cgo"] + +[[payload.multicluster-engine-hypershift-operator-container.ignore]] +error = "ErrGoMissingSymbols" +files = [ + "/usr/bin/hcp", + "/usr/bin/hcp-no-cgo", + "/usr/bin/hypershift-no-cgo", +] + +[[payload.multicluster-engine-hypershift-operator-container.ignore]] +error = "ErrNotDynLinked" +files = [ + "/usr/bin/hcp", + "/usr/bin/hcp-no-cgo", + "/usr/bin/hypershift-no-cgo", +] [[payload.multicluster-engine-hypershift-cli-container.ignore]] error = "ErrGoNotCgoEnabled" diff --git a/dist/releases/4.20/config.toml b/dist/releases/4.20/config.toml index 09a6ac3b..8bc10a15 100644 --- a/dist/releases/4.20/config.toml +++ b/dist/releases/4.20/config.toml @@ -442,7 +442,23 @@ files = ["/unpack"] [[payload.multicluster-engine-hypershift-operator.ignore]] error = "ErrGoNotCgoEnabled" -files = ["/usr/bin/hcp-no-cgo", "/usr/bin/hypershift-no-cgo"] +files = ["/usr/bin/hcp", "/usr/bin/hcp-no-cgo", "/usr/bin/hypershift-no-cgo"] + +[[payload.multicluster-engine-hypershift-operator-container.ignore]] +error = "ErrGoMissingSymbols" +files = [ + "/usr/bin/hcp", + "/usr/bin/hcp-no-cgo", + "/usr/bin/hypershift-no-cgo", +] + +[[payload.multicluster-engine-hypershift-operator-container.ignore]] +error = "ErrNotDynLinked" +files = [ + "/usr/bin/hcp", + "/usr/bin/hcp-no-cgo", + "/usr/bin/hypershift-no-cgo", +] [[payload.multicluster-engine-hypershift-cli-container.ignore]] error = "ErrGoNotCgoEnabled" diff --git a/dist/releases/4.21/config.toml b/dist/releases/4.21/config.toml index 6ff60781..fedd73bb 100644 --- a/dist/releases/4.21/config.toml +++ b/dist/releases/4.21/config.toml @@ -442,7 +442,23 @@ files = ["/unpack"] [[payload.multicluster-engine-hypershift-operator.ignore]] error = "ErrGoNotCgoEnabled" -files = ["/usr/bin/hcp-no-cgo", "/usr/bin/hypershift-no-cgo"] +files = ["/usr/bin/hcp", "/usr/bin/hcp-no-cgo", "/usr/bin/hypershift-no-cgo"] + +[[payload.multicluster-engine-hypershift-operator-container.ignore]] +error = "ErrGoMissingSymbols" +files = [ + "/usr/bin/hcp", + "/usr/bin/hcp-no-cgo", + "/usr/bin/hypershift-no-cgo", +] + +[[payload.multicluster-engine-hypershift-operator-container.ignore]] +error = "ErrNotDynLinked" +files = [ + "/usr/bin/hcp", + "/usr/bin/hcp-no-cgo", + "/usr/bin/hypershift-no-cgo", +] [[payload.multicluster-engine-hypershift-cli-container.ignore]] error = "ErrGoNotCgoEnabled" diff --git a/dist/releases/4.22/config.toml b/dist/releases/4.22/config.toml index b863c429..6f14d6de 100644 --- a/dist/releases/4.22/config.toml +++ b/dist/releases/4.22/config.toml @@ -447,7 +447,23 @@ files = ["/unpack"] [[payload.multicluster-engine-hypershift-operator.ignore]] error = "ErrGoNotCgoEnabled" -files = ["/usr/bin/hcp-no-cgo", "/usr/bin/hypershift-no-cgo"] +files = ["/usr/bin/hcp", "/usr/bin/hcp-no-cgo", "/usr/bin/hypershift-no-cgo"] + +[[payload.multicluster-engine-hypershift-operator-container.ignore]] +error = "ErrGoMissingSymbols" +files = [ + "/usr/bin/hcp", + "/usr/bin/hcp-no-cgo", + "/usr/bin/hypershift-no-cgo", +] + +[[payload.multicluster-engine-hypershift-operator-container.ignore]] +error = "ErrNotDynLinked" +files = [ + "/usr/bin/hcp", + "/usr/bin/hcp-no-cgo", + "/usr/bin/hypershift-no-cgo", +] [[payload.multicluster-engine-hypershift-cli-container.ignore]] error = "ErrGoNotCgoEnabled" diff --git a/dist/releases/4.23/config.toml b/dist/releases/4.23/config.toml index 563fa834..b0f9d577 100644 --- a/dist/releases/4.23/config.toml +++ b/dist/releases/4.23/config.toml @@ -447,7 +447,23 @@ files = ["/unpack"] [[payload.multicluster-engine-hypershift-operator.ignore]] error = "ErrGoNotCgoEnabled" -files = ["/usr/bin/hcp-no-cgo", "/usr/bin/hypershift-no-cgo"] +files = ["/usr/bin/hcp", "/usr/bin/hcp-no-cgo", "/usr/bin/hypershift-no-cgo"] + +[[payload.multicluster-engine-hypershift-operator-container.ignore]] +error = "ErrGoMissingSymbols" +files = [ + "/usr/bin/hcp", + "/usr/bin/hcp-no-cgo", + "/usr/bin/hypershift-no-cgo", +] + +[[payload.multicluster-engine-hypershift-operator-container.ignore]] +error = "ErrNotDynLinked" +files = [ + "/usr/bin/hcp", + "/usr/bin/hcp-no-cgo", + "/usr/bin/hypershift-no-cgo", +] [[payload.multicluster-engine-hypershift-cli-container.ignore]] error = "ErrGoNotCgoEnabled" diff --git a/dist/releases/5.0/config.toml b/dist/releases/5.0/config.toml index f42d3f5e..d8e8019c 100644 --- a/dist/releases/5.0/config.toml +++ b/dist/releases/5.0/config.toml @@ -447,7 +447,23 @@ files = ["/unpack"] [[payload.multicluster-engine-hypershift-operator.ignore]] error = "ErrGoNotCgoEnabled" -files = ["/usr/bin/hcp-no-cgo", "/usr/bin/hypershift-no-cgo"] +files = ["/usr/bin/hcp", "/usr/bin/hcp-no-cgo", "/usr/bin/hypershift-no-cgo"] + +[[payload.multicluster-engine-hypershift-operator-container.ignore]] +error = "ErrGoMissingSymbols" +files = [ + "/usr/bin/hcp", + "/usr/bin/hcp-no-cgo", + "/usr/bin/hypershift-no-cgo", +] + +[[payload.multicluster-engine-hypershift-operator-container.ignore]] +error = "ErrNotDynLinked" +files = [ + "/usr/bin/hcp", + "/usr/bin/hcp-no-cgo", + "/usr/bin/hypershift-no-cgo", +] [[payload.multicluster-engine-hypershift-cli-container.ignore]] error = "ErrGoNotCgoEnabled"