Changes needed for both Uniform Dockerfiles and required changes for …

…RHTAP EC

.github/workflows/cronjobs.yaml

@@ -30,71 +30,3 @@ jobs:
         if: ${{ env.NUM_OPEN_PRS == 0 }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-  check-upstream-shas:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out the upstream rekor repository
-        uses: actions/checkout@v2
-        with:
-          repository: sigstore/rekor
-          path: upstream-rekor
-          ref: main
-
-      - name: Get upstream shas
-        run: |
-          cd upstream-rekor
-          upstreamSHA=$(grep -o -m 1 'golang:[^@]\+@sha256:[a-f0-9]\{64\}' Dockerfile)
-          echo 'UPSTREAM_SHA='$upstreamSHA >> $GITHUB_ENV
-
-      - name: Pull down the midstream rekor repository
-        uses: actions/checkout@v2
-        with:
-          path: midstream-rekor
-          ref: main
-
-      - name: Get midstream shas
-        run: |
-          cd midstream-rekor
-          midstreamSHA=$(grep -o -m 1 'golang:[^@]\+@sha256:[a-f0-9]\{64\}' redhat/patches/0001-dockerfile.patch)
-          echo 'MIDSTREAM_SHA='$midstreamSHA >> $GITHUB_ENV
-
-      - name: Generate new patch file
-        if: ${{ env.UPSTREAM_SHA != env.MIDSTREAM_SHA }}
-        run: |
-          cd upstream-rekor
-          sed -i 's|${{ env.UPSTREAM_SHA }}|${{ env.CURRENT_REDHAT_IMAGE }}|g' Dockerfile
-          git diff > 0001-dockerfile.patch
-
-          cd ../midstream-rekor
-          git fetch origin
-          git checkout -B update-dockerfile.patch-file origin/main
-
-          cp -f ../upstream-rekor/0001-dockerfile.patch redhat/patches/
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Check for existing pull request
-        if: ${{ env.UPSTREAM_SHA != env.MIDSTREAM_SHA }}
-        run: |
-          cd midstream-rekor
-          openPRs="$(gh pr list --state open -H update-dockerfile.patch-file --json number | jq -r '.[].number' | wc -l)"
-          echo 'NUM_OPEN_PRS='$openPRs >> $GITHUB_ENV
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Configure git
-        run: |
-          git config --global user.email "${GITHUB_ACTOR}@users.noreply.github.com"
-          git config --global user.name "${GITHUB_ACTOR}"
-
-      - name: Create pull request
-        if: ${{ env.NUM_OPEN_PRS == 0 && env.UPSTREAM_SHA != env.MIDSTREAM_SHA }}
-        run: |
-          cd midstream-rekor
-          git add .
-          git commit -m "Update image in docker file"
-          git push -f origin update-dockerfile.patch-file
-          gh pr create --base main --head update-dockerfile.patch-file --title "Update patch file" --body "This is an automated pr to update the docker patch file"
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

redhat/overlays/DOckerfile.server → redhat/overlays/Dockerfile

@@ -13,7 +13,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM registry.access.redhat.com/ubi9/go-toolset@sha256:52ab391730a63945f61d93e8c913db4cc7a96f200de909cd525e2632055d9fa6 AS builder
+FROM registry.access.redhat.com/ubi9/go-toolset@sha256:e91cbbd0b659498d029dd43e050c8a009c403146bfba22cbebca8bcd0ee7925f AS builder
 ENV APP_ROOT=/opt/app-root
 ENV GOPATH=$APP_ROOT
 
@@ -31,7 +31,7 @@ RUN CGO_ENABLED=0 go build -gcflags "all=-N -l" -ldflags "${SERVER_LDFLAGS}" -o
 RUN go test -c -ldflags "${SERVER_LDFLAGS}" -cover -covermode=count -coverpkg=./... -o rekor-server_test ./cmd/rekor-server
 
 # Multi-Stage production build
-FROM registry.access.redhat.com/ubi9/go-toolset@sha256:52ab391730a63945f61d93e8c913db4cc7a96f200de909cd525e2632055d9fa6 as deploy
+FROM registry.access.redhat.com/ubi9/go-toolset@sha256:e91cbbd0b659498d029dd43e050c8a009c403146bfba22cbebca8bcd0ee7925f as deploy
 
 # Retrieve the binary from the previous stage
 COPY --from=builder /opt/app-root/src/rekor-server /usr/local/bin/rekor-server
@@ -40,12 +40,21 @@ COPY --from=builder /opt/app-root/src/rekor-server /usr/local/bin/rekor-server
 ENTRYPOINT ["rekor-server"]
 
 # debug compile options & debugger
-FROM deploy as debug
+FROM registry.access.redhat.com/ubi9/go-toolset@sha256:e91cbbd0b659498d029dd43e050c8a009c403146bfba22cbebca8bcd0ee7925f as debug
+COPY --from=deploy /usr/local/bin/rekor-server /usr/local/bin/rekor-server
 RUN go install github.com/go-delve/delve/cmd/dlv@v1.8.0
 
 # overwrite server and include debugger
 COPY --from=builder /opt/app-root/src/rekor-server_debug /usr/local/bin/rekor-server
 
-FROM deploy as test
+FROM registry.access.redhat.com/ubi9/go-toolset@sha256:e91cbbd0b659498d029dd43e050c8a009c403146bfba22cbebca8bcd0ee7925f as test
+
+LABEL description="Rekor aims to provide an immutable, tamper-resistant ledger of metadata generated within a software project’s supply chain."
+LABEL io.k8s.description="Rekor-Server provides a tamper resistant ledger."
+LABEL io.k8s.display-name="Rekor-Server container image for Red Hat Trusted Signer"
+LABEL io.openshift.tags="rekor-server trusted-signer"
+LABEL summary="Provides the rekor Server binary for running Rekor-Server"
+
+COPY --from=deploy /usr/local/bin/rekor-server /usr/local/bin/rekor-server
 # overwrite server with test build with code coverage
-COPY --from=builder /opt/app-root/src/rekor-server_test /usr/local/bin/rekor-server
+COPY --from=builder /opt/app-root/src/rekor-server_test /usr/local/bin/rekor-server