Skip to content

chore(base-image): Migrate Konflux builds to UBI9/RHEL9 #2562

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
davdhacs wants to merge 3 commits into
base: master
Choose a base branch
from
+79 −73
Open

chore(base-image): Migrate Konflux builds to UBI9/RHEL9 #2562

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1a70218
chore(build): Migrate scanner images to UBI9/RHEL9
davdhacs Feb 18, 2026
b3addf3
fix: Add update-ca-trust workaround for unprivileged containers
davdhacs Feb 18, 2026
46d33f6
empty commit
davdhacs Feb 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .tekton/scanner-build.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,7 @@ spec:
- name: extra-labels
value:
# X.Y in the cpe label must be adjusted for every version stream.
- "cpe=cpe:/a:redhat:advanced_cluster_security:X.Y::el8"
- "cpe=cpe:/a:redhat:advanced_cluster_security:X.Y::el9"

workspaces:
- name: git-auth
Expand Down
2 changes: 1 addition & 1 deletion .tekton/scanner-db-build.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ spec:
- name: extra-labels
value:
# X.Y in the cpe label must be adjusted for every version stream.
- "cpe=cpe:/a:redhat:advanced_cluster_security:X.Y::el8"
- "cpe=cpe:/a:redhat:advanced_cluster_security:X.Y::el9"

workspaces:
- name: git-auth
Expand Down
2 changes: 1 addition & 1 deletion .tekton/scanner-db-slim-build.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ spec:
- name: extra-labels
value:
# X.Y in the cpe label must be adjusted for every version stream.
- "cpe=cpe:/a:redhat:advanced_cluster_security:X.Y::el8"
- "cpe=cpe:/a:redhat:advanced_cluster_security:X.Y::el9"

workspaces:
- name: git-auth
Expand Down
2 changes: 1 addition & 1 deletion .tekton/scanner-slim-build.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,7 @@ spec:
- name: extra-labels
value:
# X.Y in the cpe label must be adjusted for every version stream.
- "cpe=cpe:/a:redhat:advanced_cluster_security:X.Y::el8"
- "cpe=cpe:/a:redhat:advanced_cluster_security:X.Y::el9"

workspaces:
- name: git-auth
Expand Down
4 changes: 2 additions & 2 deletions image/db/rhel/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
ARG RPMS_REGISTRY=registry.access.redhat.com
ARG RPMS_BASE_IMAGE=ubi8
ARG RPMS_BASE_IMAGE=ubi9
ARG RPMS_BASE_TAG=latest

ARG BASE_REGISTRY=registry.access.redhat.com
ARG BASE_IMAGE=ubi8-minimal
ARG BASE_IMAGE=ubi9-minimal
ARG BASE_TAG=latest

FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG} AS extracted_bundle
Expand Down
4 changes: 2 additions & 2 deletions image/db/rhel/Dockerfile.slim
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
ARG RPMS_REGISTRY=registry.access.redhat.com
ARG RPMS_BASE_IMAGE=ubi8
ARG RPMS_BASE_IMAGE=ubi9
ARG RPMS_BASE_TAG=latest

ARG BASE_REGISTRY=registry.access.redhat.com
ARG BASE_IMAGE=ubi8-minimal
ARG BASE_IMAGE=ubi9-minimal
ARG BASE_TAG=latest

FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG} AS extracted_bundle
Expand Down
6 changes: 3 additions & 3 deletions image/db/rhel/konflux.Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM registry.redhat.io/rhel8/postgresql-15:latest@sha256:94182920a14a5175523d40c1bdf1168eaabbb6b494eda0519d3a87916ba937d6 AS scanner-db-common
FROM registry.redhat.io/rhel9/postgresql-15:latest@sha256:cba1417b7e8a5b55289aa951c48dc940c72ebea5380045f32cd8faba41937f9b AS scanner-db-common

ARG SCANNER_TAG
RUN if [[ "$SCANNER_TAG" == "" ]]; then >&2 echo "error: required SCANNER_TAG arg is unset"; exit 6; fi
Expand Down Expand Up @@ -57,7 +57,7 @@ FROM scanner-db-common AS scanner-db-slim
LABEL \
com.redhat.component="rhacs-scanner-db-slim-container" \
io.k8s.display-name="scanner-db-slim" \
name="advanced-cluster-security/rhacs-scanner-db-slim-rhel8"
name="advanced-cluster-security/rhacs-scanner-db-slim-rhel9"

ENV ROX_SLIM_MODE="true"

Expand All @@ -67,7 +67,7 @@ FROM scanner-db-common AS scanner-db
LABEL \
com.redhat.component="rhacs-scanner-db-container" \
io.k8s.display-name="scanner-db" \
name="advanced-cluster-security/rhacs-scanner-db-rhel8"
name="advanced-cluster-security/rhacs-scanner-db-rhel9"

COPY --chown=0:0 .konflux/scanner-data/blob-pg-definitions.sql.gz \
/docker-entrypoint-initdb.d/definitions.sql.gz
2 changes: 1 addition & 1 deletion image/db/rhel/scripts/download.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ set -euo pipefail

# If this is updated, be sure to update PG_MAJOR in the Dockerfile and the signature file.
postgres_major=15
pg_rhel_major=8
pg_rhel_major=9

arch="$(uname -m)"
dnf_list_args=()
Expand Down
2 changes: 1 addition & 1 deletion image/scanner/rhel/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
ARG BASE_REGISTRY=registry.access.redhat.com
ARG BASE_IMAGE=ubi8-minimal
ARG BASE_IMAGE=ubi9-minimal
ARG BASE_TAG=latest

FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG} AS extracted_bundle
Expand Down
2 changes: 1 addition & 1 deletion image/scanner/rhel/Dockerfile.slim
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
ARG BASE_REGISTRY=registry.access.redhat.com
ARG BASE_IMAGE=ubi8-minimal
ARG BASE_IMAGE=ubi9-minimal
ARG BASE_TAG=latest

FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG} AS extracted_bundle
Expand Down
10 changes: 5 additions & 5 deletions image/scanner/rhel/konflux.Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# Compiling scanner binaries and staging repo2cpe and genesis manifests
FROM brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_8_golang_1.25@sha256:aa03597ee8c7594ffecef5cbb6a0f059d362259d2a41225617b27ec912a3d0d3 AS builder
FROM brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_golang_1.25@sha256:bd531796aacb86e4f97443797262680fbf36ca048717c00b6f4248465e1a7c0c AS builder

ARG SCANNER_TAG
RUN if [[ "$SCANNER_TAG" == "" ]]; then >&2 echo "error: required SCANNER_TAG arg is unset"; exit 6; fi
Expand Down Expand Up @@ -28,7 +28,7 @@ COPY .konflux/scanner-data/blob-genesis_manifests.json image/scanner/dump/genesi


# Common base for scanner slim and full
FROM registry.access.redhat.com/ubi8-minimal:latest@sha256:48adecc91f276734fa51987bc2203a31db9ba87a512c436c0a3fcac53135378d AS scanner-common
FROM registry.access.redhat.com/ubi9-minimal:latest@sha256:c7d44146f826037f6873d99da479299b889473492d3c1ab8af86f08af04ec8a0 AS scanner-common

ARG SCANNER_TAG

Expand Down Expand Up @@ -59,7 +59,7 @@ COPY --chown=65534:65534 --from=builder /src/image/scanner/dump/genesis_manifest

COPY LICENSE /licenses/LICENSE

RUN microdnf install xz && \
RUN microdnf install -y xz && \
microdnf clean all && \
# (Optional) Remove line below to keep package management utilities
# We don't uninstall rpm because scanner uses it to get packages installed in scanned images.
Expand All @@ -85,7 +85,7 @@ FROM scanner-common AS scanner-slim
LABEL \
com.redhat.component="rhacs-scanner-slim-container" \
io.k8s.display-name="scanner-slim" \
name="advanced-cluster-security/rhacs-scanner-slim-rhel8"
name="advanced-cluster-security/rhacs-scanner-slim-rhel9"

ENV ROX_SLIM_MODE="true"

Expand All @@ -96,7 +96,7 @@ FROM scanner-common AS scanner
LABEL \
com.redhat.component="rhacs-scanner-container" \
io.k8s.display-name="scanner" \
name="advanced-cluster-security/rhacs-scanner-rhel8"
name="advanced-cluster-security/rhacs-scanner-rhel9"

ENV NVD_DEFINITIONS_DIR="/nvd_definitions"
ENV K8S_DEFINITIONS_DIR="/k8s_definitions"
Expand Down
4 changes: 3 additions & 1 deletion image/scanner/scripts/import-additional-cas
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,4 +19,6 @@ copy_existing /usr/local/share/ca-certificates
# Copy the custom trusted CA bundles injected by the Openshift Network Operator.
copy_existing /etc/pki/injected-ca-trust

update-ca-trust extract
# The -o flag is required for running as an unprivileged user in containers.
# See: https://bugzilla.redhat.com/show_bug.cgi?id=2241240
update-ca-trust extract -o /etc/pki/ca-trust/extracted
Copy link

@mclasmeier mclasmeier Mar 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd like to understand this better.
Is this path /etc/pki/ca-trust/extracted referenced somewhere? Is it defaulted to somewhere?

Copy link
Contributor

@BradLugo BradLugo Mar 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it's self-referential: https://src.fedoraproject.org/rpms/ca-certificates/blob/rawhide/f/update-ca-trust#_129-138

Copy link
Author

@davdhacs davdhacs Mar 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/etc/pki/ca-trust/extracted is the default. We're re-setting it to get the non-root user operation of setting a -o path.
Here you can see it hardcoded in the version of update-ca-trust in ubi9-minimal: https://pkgs.devel.redhat.com/cgit/rpms/ca-certificates/tree/update-ca-trust?h=rhel-9.4.0#n10
And this explains why we need to use the -o arg: https://pkgs.devel.redhat.com/cgit/rpms/ca-certificates/tree/update-ca-trust?h=rhel-9.4.0#n88
long-version:
In UBI8, the update-ca-trust trust extract execution did not change the permissions on the files it wrote. In the version in UBI9, the directory-hash output was added and write permissions are removed when it is written.
The -o(USER_DEST) arg was added to allow running as non-root because it does a chmod +/- around adding links into the directory-hash directory: https://src.fedoraproject.org/rpms/ca-certificates/pull-request/8#request_diff
Looking forward in https://src.fedoraproject.org/rpms/ca-certificates/c/7dc60cb it was reworked but changes it so the symlinks are only added when the USER_DIR is not specified (so we will still need the -o arg if the ca-certificates package updates are backported).

Copy link
Author

@davdhacs davdhacs Mar 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

example usage: here this path is in the search paths for golang ssl: https://go.dev/src/crypto/x509/root_linux.go

Copy link
Author

@davdhacs davdhacs Mar 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

more information in the man page, https://www.linux.org/docs/man8/update-ca-trust.html

Copy link
Author

@davdhacs davdhacs Mar 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Far future / TODO: The cert setup could be re-worked for these images so that it does not rely on update-ca-trust to add custom certs. Maybe that part isn't needed anymore, but I think that reaches outside of the scope of upgrading to UBI9. There was discussion about init container instead of the double-run that sensor and scanner do, and there are other options especially when we eventually switch to the golang built-in ssl.

2 changes: 1 addition & 1 deletion image/scanner/scripts/restore-all-dir-contents
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,4 +4,4 @@ set -euo pipefail

[ -d /.init-dirs ] || exit 0

cp -rfP /.init-dirs/* /
cp --recursive --no-dereference --no-clobber /.init-dirs/* /
5 changes: 4 additions & 1 deletion image/scanner/scripts/trust-root-ca
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,4 +6,7 @@ CA_PATH="/run/secrets/stackrox.io/certs/ca.pem"

# For RHEL
cp "${CA_PATH}" /etc/pki/ca-trust/source/anchors/root-ca.pem
update-ca-trust

# The -o flag is required for running as an unprivileged user in containers.
# See: https://bugzilla.redhat.com/show_bug.cgi?id=2241240
update-ca-trust extract -o /etc/pki/ca-trust/extracted
2 changes: 1 addition & 1 deletion image/vulnerabilities/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
ARG BASE_REGISTRY=registry.access.redhat.com
ARG BASE_IMAGE=ubi8-minimal
ARG BASE_IMAGE=ubi9-minimal
ARG BASE_TAG=latest

FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG}
Expand Down
88 changes: 44 additions & 44 deletions rpms.lock.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,69 +4,69 @@ lockfileVendor: redhat
arches:
- arch: aarch64
packages:
- url: https://cdn.redhat.com/content/dist/rhel8/8/aarch64/baseos/os/Packages/x/xz-5.2.4-4.el8_6.aarch64.rpm
repoid: rhel-8-for-aarch64-baseos-rpms
size: 156276
checksum: sha256:342a2504cb34c9a5c1d43906f534cb1f3bf1de58ac517d575cff57053d04ab00
- url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/os/Packages/x/xz-5.2.5-8.el9_0.aarch64.rpm
repoid: rhel-9-for-aarch64-baseos-rpms
size: 235798
checksum: sha256:26ac21be6c1e396c7bcbaa9d4786e3275e996d9d78c01f75bbbc6962e6c9bef7
name: xz
evr: 5.2.4-4.el8_6
sourcerpm: xz-5.2.4-4.el8_6.src.rpm
evr: 5.2.5-8.el9_0
sourcerpm: xz-5.2.5-8.el9_0.src.rpm
source:
- url: https://cdn.redhat.com/content/dist/rhel8/8/aarch64/baseos/source/SRPMS/Packages/x/xz-5.2.4-4.el8_6.src.rpm
repoid: rhel-8-for-aarch64-baseos-source-rpms
size: 1077113
checksum: sha256:7914b320eefa2db6dad68e5f01e99f8e661072a1f13acb3d19cba8c1295ae40a
- url: https://cdn.redhat.com/content/dist/rhel9/9/aarch64/baseos/source/SRPMS/Packages/x/xz-5.2.5-8.el9_0.src.rpm
repoid: rhel-9-for-aarch64-baseos-source-rpms
size: 1168293
checksum: sha256:bce98f3a307e75a8ac28f909e29b41d64b15461fa9ddf0bf4ef3c2f6de946b46
name: xz
evr: 5.2.4-4.el8_6
evr: 5.2.5-8.el9_0
module_metadata: []
- arch: ppc64le
packages:
- url: https://cdn.redhat.com/content/dist/rhel8/8/ppc64le/baseos/os/Packages/x/xz-5.2.4-4.el8_6.ppc64le.rpm
repoid: rhel-8-for-ppc64le-baseos-rpms
size: 162264
checksum: sha256:80d2fc754452ae52b3b36504e5cceb5cd5435a97999351402ae7a28298592a01
- url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/os/Packages/x/xz-5.2.5-8.el9_0.ppc64le.rpm
repoid: rhel-9-for-ppc64le-baseos-rpms
size: 243215
checksum: sha256:44cd014634f8a5cb83aff336500b0f2e3bec156a34e7da09e0ae6ef4b5e26467
name: xz
evr: 5.2.4-4.el8_6
sourcerpm: xz-5.2.4-4.el8_6.src.rpm
evr: 5.2.5-8.el9_0
sourcerpm: xz-5.2.5-8.el9_0.src.rpm
source:
- url: https://cdn.redhat.com/content/dist/rhel8/8/ppc64le/baseos/source/SRPMS/Packages/x/xz-5.2.4-4.el8_6.src.rpm
repoid: rhel-8-for-ppc64le-baseos-source-rpms
size: 1077113
checksum: sha256:7914b320eefa2db6dad68e5f01e99f8e661072a1f13acb3d19cba8c1295ae40a
- url: https://cdn.redhat.com/content/dist/rhel9/9/ppc64le/baseos/source/SRPMS/Packages/x/xz-5.2.5-8.el9_0.src.rpm
repoid: rhel-9-for-ppc64le-baseos-source-rpms
size: 1168293
checksum: sha256:bce98f3a307e75a8ac28f909e29b41d64b15461fa9ddf0bf4ef3c2f6de946b46
name: xz
evr: 5.2.4-4.el8_6
evr: 5.2.5-8.el9_0
module_metadata: []
- arch: s390x
packages:
- url: https://cdn.redhat.com/content/dist/rhel8/8/s390x/baseos/os/Packages/x/xz-5.2.4-4.el8_6.s390x.rpm
repoid: rhel-8-for-s390x-baseos-rpms
size: 155012
checksum: sha256:7fb678077d965dd6aeb09df28ce05cba9c22e4110d4b52f1ee43986beb87a5ff
- url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/os/Packages/x/xz-5.2.5-8.el9_0.s390x.rpm
repoid: rhel-9-for-s390x-baseos-rpms
size: 234632
checksum: sha256:c06f44e6fb5a0a1fbf3c052d065b6336c3d17cedbc796260cf0c097b98326906
name: xz
evr: 5.2.4-4.el8_6
sourcerpm: xz-5.2.4-4.el8_6.src.rpm
evr: 5.2.5-8.el9_0
sourcerpm: xz-5.2.5-8.el9_0.src.rpm
source:
- url: https://cdn.redhat.com/content/dist/rhel8/8/s390x/baseos/source/SRPMS/Packages/x/xz-5.2.4-4.el8_6.src.rpm
repoid: rhel-8-for-s390x-baseos-source-rpms
size: 1077113
checksum: sha256:7914b320eefa2db6dad68e5f01e99f8e661072a1f13acb3d19cba8c1295ae40a
- url: https://cdn.redhat.com/content/dist/rhel9/9/s390x/baseos/source/SRPMS/Packages/x/xz-5.2.5-8.el9_0.src.rpm
repoid: rhel-9-for-s390x-baseos-source-rpms
size: 1168293
checksum: sha256:bce98f3a307e75a8ac28f909e29b41d64b15461fa9ddf0bf4ef3c2f6de946b46
name: xz
evr: 5.2.4-4.el8_6
evr: 5.2.5-8.el9_0
module_metadata: []
- arch: x86_64
packages:
- url: https://cdn.redhat.com/content/dist/rhel8/8/x86_64/baseos/os/Packages/x/xz-5.2.4-4.el8_6.x86_64.rpm
repoid: rhel-8-for-x86_64-baseos-rpms
size: 156884
checksum: sha256:fa4ceb20dbf23e9408a6446fefc4b709bc85e0bc563ca423569bbe08ecee2c5e
- url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/os/Packages/x/xz-5.2.5-8.el9_0.x86_64.rpm
repoid: rhel-9-for-x86_64-baseos-rpms
size: 235693
checksum: sha256:f16d17c26a241400586ddc3d734ce863e3f19d433881ec640a47bedf0dafd07b
name: xz
evr: 5.2.4-4.el8_6
sourcerpm: xz-5.2.4-4.el8_6.src.rpm
evr: 5.2.5-8.el9_0
sourcerpm: xz-5.2.5-8.el9_0.src.rpm
source:
- url: https://cdn.redhat.com/content/dist/rhel8/8/x86_64/baseos/source/SRPMS/Packages/x/xz-5.2.4-4.el8_6.src.rpm
repoid: rhel-8-for-x86_64-baseos-source-rpms
size: 1077113
checksum: sha256:7914b320eefa2db6dad68e5f01e99f8e661072a1f13acb3d19cba8c1295ae40a
- url: https://cdn.redhat.com/content/dist/rhel9/9/x86_64/baseos/source/SRPMS/Packages/x/xz-5.2.5-8.el9_0.src.rpm
repoid: rhel-9-for-x86_64-baseos-source-rpms
size: 1168293
checksum: sha256:bce98f3a307e75a8ac28f909e29b41d64b15461fa9ddf0bf4ef3c2f6de946b46
name: xz
evr: 5.2.4-4.el8_6
evr: 5.2.5-8.el9_0
module_metadata: []
13 changes: 7 additions & 6 deletions rpms.rhel.repo
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
[rhel-8-for-$basearch-baseos-rpms]
name = Red Hat Enterprise Linux 8 for $basearch - BaseOS (RPMs)
baseurl = https://cdn.redhat.com/content/dist/rhel8/8/$basearch/baseos/os
[rhel-9-for-$basearch-baseos-rpms]
name = Red Hat Enterprise Linux 9 for $basearch - BaseOS (RPMs)
baseurl = https://cdn.redhat.com/content/dist/rhel9/9/$basearch/baseos/os
enabled = 1
gpgcheck = 1
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
Expand All @@ -12,9 +12,9 @@ sslverifystatus = 1
metadata_expire = 86400
enabled_metadata = 1

[rhel-8-for-$basearch-baseos-source-rpms]
name = Red Hat Enterprise Linux 8 for $basearch - BaseOS (Source RPMs)
baseurl = https://cdn.redhat.com/content/dist/rhel8/8/$basearch/baseos/source/SRPMS
[rhel-9-for-$basearch-baseos-source-rpms]
name = Red Hat Enterprise Linux 9 for $basearch - BaseOS (Source RPMs)
baseurl = https://cdn.redhat.com/content/dist/rhel9/9/$basearch/baseos/source/SRPMS
enabled = 1
gpgcheck = 1
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
Expand All @@ -25,3 +25,4 @@ sslclientcert = $SSL_CLIENT_CERT
sslverifystatus = 1
metadata_expire = 86400
enabled_metadata = 0