[release-4.22] tree: add labels.json and security OCI labels for Clair scanning

Containerfile

@@ -1,16 +1,30 @@
 # This builds the final OCP/OKD node image on top of the base CoreOS image. For
 # instructions on how to build this, see `docs/building.md`.
 
-FROM quay.io/openshift-release-dev/ocp-v4.0-art-dev:c9s-coreos as build
+ARG IMAGE_FROM=overridden
+FROM ${IMAGE_FROM} as build
 ARG OPENSHIFT_CI=0
 RUN --mount=type=bind,target=/run/src --mount=type=secret,id=yumrepos,target=/etc/yum.repos.d/secret.repo /run/src/build-node-image.sh
 
 FROM build as metadata
+ARG IMAGE_NAME
+ARG IMAGE_CPE
+ARG TARGETARCH
 RUN --mount=type=bind,target=/run/src /run/src/scripts/generate-metadata
+RUN --mount=type=bind,target=/run/src /run/src/scripts/generate-labels
 
 FROM build
 COPY --from=metadata /usr/share/openshift /usr/share/openshift
+COPY --from=metadata /usr/share/buildinfo /usr/share/buildinfo
+ARG IMAGE_NAME
+ARG IMAGE_CPE
+ARG TARGETARCH
+ARG STREAM_CLASS
+LABEL name=${IMAGE_NAME}
+LABEL cpe=${IMAGE_CPE}
+LABEL architecture=${TARGETARCH}
 LABEL io.openshift.metalayer=true
+LABEL io.openshift.os.streamclass=${STREAM_CLASS}
 # Add a hack to get OpenShift tests working again because a
 # revert of the new architecture happened in
 # https://github.com/openshift/machine-config-operator/pull/5703

build-args-10.2-4.22.conf

@@ -0,0 +1,9 @@
+IMAGE_FROM=registry.ci.openshift.org/coreos/rhel-coreos-base:10.2
+
+# The streamclass is based on the rhel/centos major version. The
+# io.openshift.os.streamclass label is used by the MCO to later
+# select the right image stream when multiple major versions coexist.
+STREAM_CLASS=rhel-10
+
+IMAGE_NAME=openshift/ose-rhel-coreos-10
+IMAGE_CPE=cpe:/a:redhat:openshift:4.22::el10

build-args-9.8-4.22.conf

@@ -0,0 +1,9 @@
+IMAGE_FROM=registry.ci.openshift.org/coreos/rhel-coreos-base:9.8
+
+# The streamclass is based on the rhel/centos major version. The
+# io.openshift.os.streamclass label is used by the MCO to later
+# select the right image stream when multiple major versions coexist.
+STREAM_CLASS=rhel-9
+
+IMAGE_NAME=openshift/ose-rhel-coreos-9
+IMAGE_CPE=cpe:/a:redhat:openshift:4.22::el9

build-args-c10s-4.22.conf

@@ -0,0 +1,11 @@
+IMAGE_FROM=registry.ci.openshift.org/coreos/stream-coreos-base:10
+
+# The streamclass is based on the rhel/centos major version. The
+# io.openshift.os.streamclass label is used by the MCO to later
+# select the right image stream when multiple major versions coexist.
+#
+# Currently there are not multiple streams for OKD, but we maintain
+# this here for code symmetry with RHEL.
+STREAM_CLASS=centos-10
+
+# SCOS/OKD: no labels.json or OCI labels for name/cpe

docs/building.md

@@ -27,28 +27,29 @@ SCOS or RHCOS image (see building instructions in
 
 ## Building
 
-If the base image is SCOS, then the OKD node image is built (`stream-coreos`).
-If the base image is RHCOS, then the OCP node image is built (`rhel-coreos`).
-The default base image is SCOS.
+Each variant has a `build-args-*.conf` file that specifies the base image
+and metadata for that build. Choose the appropriate one for your target:
 
-To build SCOS:
+- `build-args-9.8-4.22.conf` — RHCOS on RHEL 9.8
+- `build-args-10.2-4.22.conf` — RHCOS on RHEL 10.2
+- `build-args-c10s-4.22.conf` — SCOS on CentOS Stream 10
 
-```
-podman build . --secret id=yumrepos,src=/path/to/all.repo \
-  -v /etc/pki/ca-trust:/etc/pki/ca-trust:ro \
-  --security-opt label=disable -t localhost/stream-coreos:4.21
-```
-
-To build RHCOS, the command is identical, but you must pass in the RHCOS base
-image using `--from`:
+To build:
 
 ```
-podman build --from quay.io/openshift-release-dev/ocp-v4.0-art-dev:rhel-9.6-coreos ...
+podman build . --build-arg-file build-args-c10s-4.22.conf \
+  --secret id=yumrepos,src=/path/to/all.repo \
+  -v /etc/pki/ca-trust:/etc/pki/ca-trust:ro \
+  --security-opt label=disable -t localhost/stream-coreos:4.22
 ```
 
-To build from a local OCI archive (e.g. from a cosa workdir), you can use the
-`oci-archive` transport:
+To override the base image (e.g. to use a locally built OCI archive),
+pass `--from`:
 
 ```
-podman build --from oci-archive:$(ls builds/latest/x86_64/*.ociarchive) ...
+podman build . --build-arg-file build-args-c10s-4.22.conf \
+  --from oci-archive:$(ls builds/latest/x86_64/*.ociarchive) \
+  --secret id=yumrepos,src=/path/to/all.repo \
+  -v /etc/pki/ca-trust:/etc/pki/ca-trust:ro \
+  --security-opt label=disable -t localhost/stream-coreos:4.22
 ```

extensions/Containerfile

@@ -27,6 +27,9 @@ sed "$ s/,$//") && echo "}") >> /usr/share/rpm-ostree/extensions.json
 FROM registry.access.redhat.com/ubi9/ubi:latest
 # Add a label so the extensions image can be identified
 LABEL io.openshift.os.extensions=true
+# Identify the stream this extensions image is related to
+ARG STREAM_CLASS
+LABEL io.openshift.os.streamclass=${STREAM_CLASS}
 # Copy in the extensions repo
 COPY --from=builder /usr/share/rpm-ostree/extensions/ /usr/share/rpm-ostree/extensions/
 # Make this the last layer, this is similar to the metalayer trick in the node

packages-openshift.yaml

@@ -8,7 +8,6 @@ conditional-include:
   - if:
     - osversion != "rhel-9.8"
     - osversion != "rhel-10.2"
-    - osversion != "centos-9"
     - osversion != "centos-10"
     include:
       repos: [ENOEXIST] # We want an error in this case
@@ -28,15 +27,6 @@ conditional-include:
         - rhel-10.2-early-kernel
         - rhel-10.2-fast-datapath
         - rhel-10.2-server-ose-4.22
-  - if: osversion == "centos-9"
-    include:
-      repos:
-        - c9s-baseos
-        - c9s-appstream
-        - c9s-sig-nfv
-        - c9s-sig-cloud-okd
-        # XXX: this shouldn't be here; see related XXX in build-node-image.sh
-        - rhel-9.8-server-ose-4.22-okd
   - if: osversion == "centos-10"
     include:
       repos:

scripts/generate-labels

@@ -0,0 +1,79 @@
+#!/usr/bin/python3 -u
+
+"""
+This script generates /usr/share/buildinfo/labels.json, which provides embedded
+metadata for security scanners that only have filesystem access (not OCI image
+metadata).
+
+For RHEL builds, IMAGE_NAME and IMAGE_CPE must be set (via build-args file).
+For non-RHEL builds (e.g. SCOS/OKD), no labels.json is written.
+"""
+
+import datetime
+import json
+import os
+import sys
+
+LABELS_FILE = "/usr/share/buildinfo/labels.json"
+
+
+def parse_os_release():
+    """Parse /etc/os-release into a dict."""
+    release = {}
+    with open('/etc/os-release') as f:
+        for line in f:
+            line = line.strip()
+            if not line or line.startswith('#'):
+                continue
+            k, v = line.split('=', 1)
+            release[k] = v.strip('"\'')
+    return release
+
+
+def main():
+    image_name = os.environ.get('IMAGE_NAME', '')
+    image_cpe = os.environ.get('IMAGE_CPE', '')
+    target_arch = os.environ.get('TARGETARCH', '')
+
+    os.makedirs(os.path.dirname(LABELS_FILE), exist_ok=True)
+
+    if not all([image_name, image_cpe, target_arch]):
+        os_release = parse_os_release()
+        if os_release.get('ID') == 'rhel':
+            print("error: IMAGE_NAME, IMAGE_CPE, and TARGETARCH must be set for RHEL builds",
+                  file=sys.stderr)
+            return 1
+        return
+
+    # Ideally the creation date we set here is consistent with the creation date
+    # of the OCI image itself. We'll get that once we're hermetic and we hook
+    # up SOURCE_DATE_EPOCH. So prepare for that eventuality, but for now just
+    # use the current time (which will be a few seconds different from the OCI
+    # timestamp, which is still fine for our purposes).
+    source_date_epoch = os.environ.get('SOURCE_DATE_EPOCH', '')
+    if source_date_epoch:
+        created = datetime.datetime.fromtimestamp(
+            int(source_date_epoch), tz=datetime.timezone.utc
+        ).strftime('%Y-%m-%dT%H:%M:%SZ')
+    else:
+        created = datetime.datetime.now(
+            tz=datetime.timezone.utc
+        ).strftime('%Y-%m-%dT%H:%M:%SZ')
+
+    # this schema is documented at:
+    # https://github.com/RedHatProductSecurity/security-data-guidelines/blob/main/schema/embedded_metadata.v1.schema.json
+    labels = {
+        'architecture': target_arch,
+        'cpe': image_cpe,
+        'name': image_name,
+        'org.opencontainers.image.created': created,
+    }
+
+    os.makedirs(os.path.dirname(LABELS_FILE), exist_ok=True)
+    with open(LABELS_FILE, encoding='utf-8', mode='w') as f:
+        json.dump(labels, f, sort_keys=True, indent=2)
+        f.write('\n')
+
+
+if __name__ == '__main__':
+    sys.exit(main())