diff --git a/.dockerignore b/.dockerignore index db54a33..3505706 100644 --- a/.dockerignore +++ b/.dockerignore @@ -4,6 +4,9 @@ .venv build dist +.artifact-bundle +.artifact-inputs +.artifact-resolver docs security-results tests diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d1721c3..ef862e4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -41,6 +41,9 @@ jobs: - name: Run repository checks run: pre-commit run --all-files --show-diff-on-failure + - name: Validate artifact locks + run: python -m unittest tests.test_artifacts -v + - name: Audit GitHub Actions security uses: zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99 # v0.6.3 with: diff --git a/.gitignore b/.gitignore index af8de40..eb76244 100644 --- a/.gitignore +++ b/.gitignore @@ -32,3 +32,7 @@ security-results/ # Local container build output build/ dist/ +.artifact-inputs/ +.artifact-resolver/ +.artifact-bundle/ +.artifact-transfer/ diff --git a/CHANGELOG.md b/CHANGELOG.md index b6d03f5..61bc6df 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -76,6 +76,19 @@ but container releases use the upstream-derived format documented in cached package layer that predates the errata. The previously pinned `nginx-core` build had been superseded and was no longer resolvable, so the legacy pipeline was succeeding only from that cache. +- Approved the official NGINX stable channel, selected + `nginx-2:1.30.4-1.el9.ngx` for first-release implementation qualification, + and retired the completed source-selection item from the forward roadmap. +- Added reviewed AMD64 and ARM64 artifact locks for the selected NGINX RPM, + its complete UBI dependency closure, source RPMs, signing identities, and + base-image digests, with fail-closed validation and lock-update tooling. + The locks record the refreshed UBI 9.8 bases and therefore + `openssl-1:3.5.8-1.el9_8` from RHSA-2026:67165 and the + `systemd-0:252-67.el9_8.6` rebuild. +- Added atomic official and protected alternate-source acquisition for locked + artifact bundles, including exact inventory, digest, RPM signature, signer, + NEVRA, architecture, and lock-manifest verification without storing source + credentials or private trust material in the repository or image build. - Expanded logging guidance with a field-by-field explanation of `$request`, a sensitive ClickHouse example, and safer variable choices. - Defined a source-independent pipeline contract that downloads and verifies diff --git a/README.md b/README.md index d3ef836..d06fcd2 100644 --- a/README.md +++ b/README.md @@ -108,7 +108,7 @@ root filesystem, explicit `tmpfs` mounts, dropped capabilities, and - [NGINX RPM provenance](docs/RPM-PROVENANCE.md) records the exact Red Hat UBI package source, build path, trust checks, and local verification commands. - [NGINX package-source decision](docs/PACKAGE-SOURCE.md) compares the current - Red Hat RPM with the proposed official NGINX stable RPM and defines migration + Red Hat RPM with the selected official NGINX stable RPM and defines migration acceptance criteria. - [External artifact acquisition](docs/ARTIFACT-ACQUISITION.md) defines the pre-build download and verification process and hermetic image assembly @@ -152,6 +152,26 @@ python -m pip install --require-hashes --only-binary=:all: \ pre-commit run --all-files --show-diff-on-failure ``` +Validate the reviewed artifact locks and their negative cases with: + +```console +python -m unittest tests.test_artifacts -v +``` + +Acquire and verify the exact AMD64 RPM bundle from the official sources: + +```console +python scripts/artifacts.py acquire \ + --lock artifacts/locks/amd64.json \ + --output .artifact-bundle/amd64 +bash scripts/verify-rpm-bundle.sh \ + artifacts/locks/amd64.json .artifact-bundle/amd64 +``` + +The acquisition guide documents ARM64, optional source RPMs, and protected +alternate-source configuration. Python 3, RPM, and GnuPG are required for +preparation. + Build and exercise the current AMD64 development image with rootless Podman on native Linux or WSL2: diff --git a/artifacts/artifact-lock.schema.json b/artifacts/artifact-lock.schema.json new file mode 100644 index 0000000..cd0815c --- /dev/null +++ b/artifacts/artifact-lock.schema.json @@ -0,0 +1,110 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://github.com/datopsis/nginx-ubi/artifacts/artifact-lock.schema.json", + "title": "nginx-ubi artifact lock", + "type": "object", + "additionalProperties": false, + "required": [ + "schema_version", + "bundle_version", + "architecture", + "rpm_architecture", + "generated_at", + "nginx_version", + "nginx_rpm_version", + "base_images", + "signing_keys", + "packages", + "source_packages" + ], + "properties": { + "schema_version": { "const": 1 }, + "bundle_version": { "const": 1 }, + "architecture": { "enum": ["amd64", "arm64"] }, + "rpm_architecture": { "enum": ["x86_64", "aarch64"] }, + "generated_at": { "type": "string", "format": "date-time" }, + "nginx_version": { "type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$" }, + "nginx_rpm_version": { "type": "string", "minLength": 1 }, + "base_images": { + "type": "object", + "additionalProperties": false, + "required": ["builder", "runtime"], + "properties": { + "builder": { "$ref": "#/$defs/baseImage" }, + "runtime": { "$ref": "#/$defs/baseImage" } + } + }, + "signing_keys": { + "type": "array", + "minItems": 1, + "items": { "$ref": "#/$defs/key" } + }, + "packages": { + "type": "array", + "minItems": 1, + "items": { "$ref": "#/$defs/package" } + }, + "source_packages": { + "type": "array", + "minItems": 1, + "items": { "$ref": "#/$defs/sourcePackage" } + } + }, + "$defs": { + "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" }, + "baseImage": { + "type": "object", + "additionalProperties": false, + "required": ["reference", "digest", "platform"], + "properties": { + "reference": { "type": "string", "minLength": 1 }, + "digest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" }, + "platform": { "type": "string", "pattern": "^linux/(amd64|arm64)$" } + } + }, + "key": { + "type": "object", + "additionalProperties": false, + "required": ["id", "filename", "url", "sha256", "fingerprint"], + "properties": { + "id": { "type": "string", "pattern": "^[a-z0-9-]+$" }, + "filename": { "type": "string", "pattern": "^[A-Za-z0-9._-]+$" }, + "url": { "type": "string", "pattern": "^https://" }, + "sha256": { "$ref": "#/$defs/sha256" }, + "fingerprint": { "type": "string", "pattern": "^[A-F0-9]{40}$" } + } + }, + "package": { + "type": "object", + "additionalProperties": false, + "required": ["name", "epoch", "version", "release", "architecture", "nevra", "filename", "url", "repository", "size", "sha256", "signing_key_fingerprint", "source_rpm"], + "properties": { + "name": { "type": "string", "minLength": 1 }, + "epoch": { "type": "integer", "minimum": 0 }, + "version": { "type": "string", "minLength": 1 }, + "release": { "type": "string", "minLength": 1 }, + "architecture": { "type": "string", "minLength": 1 }, + "nevra": { "type": "string", "minLength": 1 }, + "filename": { "type": "string", "pattern": "^[A-Za-z0-9+_.-]+\\.rpm$" }, + "url": { "type": "string", "pattern": "^https://" }, + "repository": { "type": "string", "minLength": 1 }, + "size": { "type": "integer", "minimum": 1 }, + "sha256": { "$ref": "#/$defs/sha256" }, + "signing_key_fingerprint": { "type": "string", "pattern": "^[A-F0-9]{40}$" }, + "source_rpm": { "type": "string", "pattern": "^[A-Za-z0-9+_.-]+\\.src\\.rpm$" } + } + }, + "sourcePackage": { + "type": "object", + "additionalProperties": false, + "required": ["filename", "url", "repository", "size", "sha256"], + "properties": { + "filename": { "type": "string", "pattern": "^[A-Za-z0-9+_.-]+\\.src\\.rpm$" }, + "url": { "type": "string", "pattern": "^https://" }, + "repository": { "type": "string", "minLength": 1 }, + "size": { "type": "integer", "minimum": 1 }, + "sha256": { "$ref": "#/$defs/sha256" } + } + } + } +} diff --git a/artifacts/lock-inputs.json b/artifacts/lock-inputs.json new file mode 100644 index 0000000..bd301f6 --- /dev/null +++ b/artifacts/lock-inputs.json @@ -0,0 +1,47 @@ +{ + "schema_version": 1, + "bundle_version": 1, + "nginx_version": "1.30.4", + "nginx_rpm_version": "1.30.4-1.el9.ngx", + "ubi_release": "9.8", + "base_images": { + "builder": "registry.access.redhat.com/ubi9/ubi-minimal:9.8@sha256:e5161a7d7d99cf22e4f34b72e111211a399d956d9b0e8714da18e9c4c8151041", + "runtime": "registry.access.redhat.com/ubi9/ubi-micro:9.8@sha256:7a0454cbd9bd847e8f6a63b6f0254a6efbeb6e0ed71a5d824a4f6cccbe626650" + }, + "architectures": { + "amd64": { + "rpm_architecture": "x86_64", + "nginx_rpm": { + "sha256": "d9e44a6f68e230b0f2c2fd5a265b2e82ce47a19a04cb68bba7cddce690706568", + "url": "https://nginx.org/packages/rhel/9/x86_64/RPMS/nginx-1.30.4-1.el9.ngx.x86_64.rpm" + } + }, + "arm64": { + "rpm_architecture": "aarch64", + "nginx_rpm": { + "sha256": "7b26ea1724ab5276413fa702f95003e5517aed1b3e88c17012f79285df051ec3", + "url": "https://nginx.org/packages/rhel/9/aarch64/RPMS/nginx-1.30.4-1.el9.ngx.aarch64.rpm" + } + } + }, + "signing_keys": [ + { + "fingerprint": "8540A6F18833A80E9C1653A42FD21310B49F6B46", + "id": "nginx-signing", + "sha256": "55385da31d198fa6a5012d40ae98ecb272a6c4e8fffffba94719ffd3e87de37a", + "url": "https://nginx.org/keys/nginx_signing.key" + }, + { + "fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "id": "redhat-release", + "sha256": "d4b2543626bee31d9438d4a31731aae712c072893c7aed8854f16c42fafc742b", + "url": "https://security.access.redhat.com/data/fd431d51.txt" + }, + { + "fingerprint": "7E4624258C406535D56D6F135054E4A45A6340B3", + "id": "redhat-release-2", + "sha256": "d37ed8bd8bddb29983a38c6fde4e59d329e6a7c2ecbc702e929f0d05ae5eba59", + "url": "https://security.access.redhat.com/data/5a6340b3.txt" + } + ] +} diff --git a/artifacts/locks/amd64.json b/artifacts/locks/amd64.json new file mode 100644 index 0000000..2e2dc6e --- /dev/null +++ b/artifacts/locks/amd64.json @@ -0,0 +1,1646 @@ +{ + "schema_version": 1, + "bundle_version": 1, + "architecture": "amd64", + "rpm_architecture": "x86_64", + "generated_at": "2026-09-16T02:54:20Z", + "nginx_version": "1.30.4", + "nginx_rpm_version": "1.30.4-1.el9.ngx", + "base_images": { + "builder": { + "reference": "registry.access.redhat.com/ubi9/ubi-minimal:9.8@sha256:e5161a7d7d99cf22e4f34b72e111211a399d956d9b0e8714da18e9c4c8151041", + "digest": "sha256:e5161a7d7d99cf22e4f34b72e111211a399d956d9b0e8714da18e9c4c8151041", + "platform": "linux/amd64" + }, + "runtime": { + "reference": "registry.access.redhat.com/ubi9/ubi-micro:9.8@sha256:7a0454cbd9bd847e8f6a63b6f0254a6efbeb6e0ed71a5d824a4f6cccbe626650", + "digest": "sha256:7a0454cbd9bd847e8f6a63b6f0254a6efbeb6e0ed71a5d824a4f6cccbe626650", + "platform": "linux/amd64" + } + }, + "signing_keys": [ + { + "fingerprint": "8540A6F18833A80E9C1653A42FD21310B49F6B46", + "id": "nginx-signing", + "sha256": "55385da31d198fa6a5012d40ae98ecb272a6c4e8fffffba94719ffd3e87de37a", + "url": "https://nginx.org/keys/nginx_signing.key", + "filename": "nginx_signing.key" + }, + { + "fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "id": "redhat-release", + "sha256": "d4b2543626bee31d9438d4a31731aae712c072893c7aed8854f16c42fafc742b", + "url": "https://security.access.redhat.com/data/fd431d51.txt", + "filename": "fd431d51.txt" + }, + { + "fingerprint": "7E4624258C406535D56D6F135054E4A45A6340B3", + "id": "redhat-release-2", + "sha256": "d37ed8bd8bddb29983a38c6fde4e59d329e6a7c2ecbc702e929f0d05ae5eba59", + "url": "https://security.access.redhat.com/data/5a6340b3.txt", + "filename": "5a6340b3.txt" + } + ], + "packages": [ + { + "name": "acl", + "epoch": 0, + "version": "2.4.0", + "release": "1.el9_8", + "architecture": "x86_64", + "nevra": "acl-0:2.4.0-1.el9_8.x86_64", + "filename": "acl-2.4.0-1.el9_8.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/a/acl-2.4.0-1.el9_8.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 85269, + "sha256": "611da2c85401a2f26dba165c0be27b2e62fa71ceb5c392c8f5a9d30c31238d5b", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "acl-2.4.0-1.el9_8.src.rpm" + }, + { + "name": "alternatives", + "epoch": 0, + "version": "1.24", + "release": "2.el9", + "architecture": "x86_64", + "nevra": "alternatives-0:1.24-2.el9.x86_64", + "filename": "alternatives-1.24-2.el9.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/a/alternatives-1.24-2.el9.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 42874, + "sha256": "1c520b9bf7b592d936bb347a5107702e51678e160b88ecfbba6a30e35e47d24e", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "chkconfig-1.24-2.el9.src.rpm" + }, + { + "name": "audit-libs", + "epoch": 0, + "version": "3.1.5", + "release": "8.el9", + "architecture": "x86_64", + "nevra": "audit-libs-0:3.1.5-8.el9.x86_64", + "filename": "audit-libs-3.1.5-8.el9.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/a/audit-libs-3.1.5-8.el9.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 130600, + "sha256": "637ac2995ce1a6c222772b60f6bc6e6f2829355d2c88dfb1262fb76146d985ae", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "audit-3.1.5-8.el9.src.rpm" + }, + { + "name": "basesystem", + "epoch": 0, + "version": "11", + "release": "13.el9", + "architecture": "noarch", + "nevra": "basesystem-0:11-13.el9.noarch", + "filename": "basesystem-11-13.el9.noarch.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/b/basesystem-11-13.el9.noarch.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 8229, + "sha256": "f498b0813fa1a825d550e8e3a9e42255eabfa18e6fc96adfc6cc8fa7e16dd513", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "basesystem-11-13.el9.src.rpm" + }, + { + "name": "bash", + "epoch": 0, + "version": "5.1.8", + "release": "9.el9", + "architecture": "x86_64", + "nevra": "bash-0:5.1.8-9.el9.x86_64", + "filename": "bash-5.1.8-9.el9.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/b/bash-5.1.8-9.el9.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 1769540, + "sha256": "d3adf8b09aa0bf935c67aa12444e0ee02f70a82c2682bfb2b02bda0a989bb806", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "bash-5.1.8-9.el9.src.rpm" + }, + { + "name": "bzip2-libs", + "epoch": 0, + "version": "1.0.8", + "release": "11.el9", + "architecture": "x86_64", + "nevra": "bzip2-libs-0:1.0.8-11.el9.x86_64", + "filename": "bzip2-libs-1.0.8-11.el9.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/b/bzip2-libs-1.0.8-11.el9.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 46333, + "sha256": "948f763ed17672b8dd83356541e27a53ce97c6df38339c4416a188d452ca4d1e", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "bzip2-1.0.8-11.el9.src.rpm" + }, + { + "name": "ca-certificates", + "epoch": 0, + "version": "2025.2.80_v9.0.305", + "release": "91.el9", + "architecture": "noarch", + "nevra": "ca-certificates-0:2025.2.80_v9.0.305-91.el9.noarch", + "filename": "ca-certificates-2025.2.80_v9.0.305-91.el9.noarch.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/c/ca-certificates-2025.2.80_v9.0.305-91.el9.noarch.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 1072208, + "sha256": "0554bf65d573950e7d550a07bf7d0b3def85ca3b45a7fbde4cce7cadd9a476a7", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "ca-certificates-2025.2.80_v9.0.305-91.el9.src.rpm" + }, + { + "name": "coreutils", + "epoch": 0, + "version": "8.32", + "release": "41.el9_8.1", + "architecture": "x86_64", + "nevra": "coreutils-0:8.32-41.el9_8.1.x86_64", + "filename": "coreutils-8.32-41.el9_8.1.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/c/coreutils-8.32-41.el9_8.1.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 1222083, + "sha256": "374257c4cd69107333a7f524dd99579f3ea3ab842b66168eade0a3475fb6eea1", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "coreutils-8.32-41.el9_8.1.src.rpm" + }, + { + "name": "coreutils-common", + "epoch": 0, + "version": "8.32", + "release": "41.el9_8.1", + "architecture": "x86_64", + "nevra": "coreutils-common-0:8.32-41.el9_8.1.x86_64", + "filename": "coreutils-common-8.32-41.el9_8.1.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/c/coreutils-common-8.32-41.el9_8.1.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 2113503, + "sha256": "41f69eb8b2087feaa98d0228fb933b6fe8af20a4bf371cfef51e11cbd1f84b4e", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "coreutils-8.32-41.el9_8.1.src.rpm" + }, + { + "name": "cracklib", + "epoch": 0, + "version": "2.9.6", + "release": "28.el9", + "architecture": "x86_64", + "nevra": "cracklib-0:2.9.6-28.el9.x86_64", + "filename": "cracklib-2.9.6-28.el9.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/c/cracklib-2.9.6-28.el9.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 102444, + "sha256": "3b415381d4bd307686268ec42f646c7770f6a815de73a40a88aab7a7061b30a9", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "cracklib-2.9.6-28.el9.src.rpm" + }, + { + "name": "cracklib-dicts", + "epoch": 0, + "version": "2.9.6", + "release": "28.el9", + "architecture": "x86_64", + "nevra": "cracklib-dicts-0:2.9.6-28.el9.x86_64", + "filename": "cracklib-dicts-2.9.6-28.el9.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/c/cracklib-dicts-2.9.6-28.el9.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 3829431, + "sha256": "61c11d3c23b62016b9939f917bb7f7e03cba324eb4ad35b375387ce9f18e25a1", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "cracklib-2.9.6-28.el9.src.rpm" + }, + { + "name": "crypto-policies", + "epoch": 0, + "version": "20260224", + "release": "1.gitea0f072.el9_8", + "architecture": "noarch", + "nevra": "crypto-policies-0:20260224-1.gitea0f072.el9_8.noarch", + "filename": "crypto-policies-20260224-1.gitea0f072.el9_8.noarch.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/c/crypto-policies-20260224-1.gitea0f072.el9_8.noarch.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 98707, + "sha256": "a9ad86b8df75a7c9c29c6f6dd4b8f78cfa1f42b492eff0d11b82c457d37a7f9f", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "crypto-policies-20260224-1.gitea0f072.el9_8.src.rpm" + }, + { + "name": "dbus", + "epoch": 1, + "version": "1.12.20", + "release": "8.el9", + "architecture": "x86_64", + "nevra": "dbus-1:1.12.20-8.el9.x86_64", + "filename": "dbus-1.12.20-8.el9.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/d/dbus-1.12.20-8.el9.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 8073, + "sha256": "96b1daa4de0a635ab760a8431fb005022bb7cb48d2d1d3ec9a8adb1798c0e10e", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "dbus-1.12.20-8.el9.src.rpm" + }, + { + "name": "dbus-broker", + "epoch": 0, + "version": "28", + "release": "9.el9_8", + "architecture": "x86_64", + "nevra": "dbus-broker-0:28-9.el9_8.x86_64", + "filename": "dbus-broker-28-9.el9_8.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/d/dbus-broker-28-9.el9_8.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 180434, + "sha256": "2c3b853f8548394af581f487d3682e3e6a4fd27bb451088ce278c7f00af454db", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "dbus-broker-28-9.el9_8.src.rpm" + }, + { + "name": "dbus-common", + "epoch": 1, + "version": "1.12.20", + "release": "8.el9", + "architecture": "noarch", + "nevra": "dbus-common-1:1.12.20-8.el9.noarch", + "filename": "dbus-common-1.12.20-8.el9.noarch.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/d/dbus-common-1.12.20-8.el9.noarch.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 18551, + "sha256": "298f1cada3cbcef6713098b9925694a0e30e8566f7a5bdbd72384520cf6c8360", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "dbus-1.12.20-8.el9.src.rpm" + }, + { + "name": "expat", + "epoch": 0, + "version": "2.5.0", + "release": "6.el9_8.3", + "architecture": "x86_64", + "nevra": "expat-0:2.5.0-6.el9_8.3.x86_64", + "filename": "expat-2.5.0-6.el9_8.3.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/e/expat-2.5.0-6.el9_8.3.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 128577, + "sha256": "3c9c96529f94f84fc19c8039d8852269e1085d16b5af2933f44ff286dec66a35", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "expat-2.5.0-6.el9_8.3.src.rpm" + }, + { + "name": "filesystem", + "epoch": 0, + "version": "3.16", + "release": "5.el9", + "architecture": "x86_64", + "nevra": "filesystem-0:3.16-5.el9.x86_64", + "filename": "filesystem-3.16-5.el9.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/f/filesystem-3.16-5.el9.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 5003807, + "sha256": "9567592e6e32a9ebd45584cc4feb5d00812f143fcb2d8cd8b1d95108f4f66a2d", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "filesystem-3.16-5.el9.src.rpm" + }, + { + "name": "findutils", + "epoch": 1, + "version": "4.8.0", + "release": "7.el9", + "architecture": "x86_64", + "nevra": "findutils-1:4.8.0-7.el9.x86_64", + "filename": "findutils-4.8.0-7.el9.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/f/findutils-4.8.0-7.el9.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 563531, + "sha256": "a6328afea0a11647b7fb5c48436f0af6c795407bac0650676d3196dd47070de6", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "findutils-4.8.0-7.el9.src.rpm" + }, + { + "name": "glibc", + "epoch": 0, + "version": "2.34", + "release": "275.el9_8", + "architecture": "x86_64", + "nevra": "glibc-0:2.34-275.el9_8.x86_64", + "filename": "glibc-2.34-275.el9_8.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/g/glibc-2.34-275.el9_8.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 2083064, + "sha256": "7d2d420b97c05c09ee1e9bd881cb0725fe8d89688b933f411f278cb23210c65d", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "glibc-2.34-275.el9_8.src.rpm" + }, + { + "name": "glibc-common", + "epoch": 0, + "version": "2.34", + "release": "275.el9_8", + "architecture": "x86_64", + "nevra": "glibc-common-0:2.34-275.el9_8.x86_64", + "filename": "glibc-common-2.34-275.el9_8.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/g/glibc-common-2.34-275.el9_8.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 321585, + "sha256": "f23581b888783f576bd3a55503618a48f74f468fcfd4837bbd7a2d00fe7f3530", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "glibc-2.34-275.el9_8.src.rpm" + }, + { + "name": "glibc-minimal-langpack", + "epoch": 0, + "version": "2.34", + "release": "275.el9_8", + "architecture": "x86_64", + "nevra": "glibc-minimal-langpack-0:2.34-275.el9_8.x86_64", + "filename": "glibc-minimal-langpack-2.34-275.el9_8.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/g/glibc-minimal-langpack-2.34-275.el9_8.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 30913, + "sha256": "6cc48d78bf2ceacfa5b58633b648c564b66505f4677adea8eb663fe90acd76f2", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "glibc-2.34-275.el9_8.src.rpm" + }, + { + "name": "gmp", + "epoch": 1, + "version": "6.2.0", + "release": "13.el9", + "architecture": "x86_64", + "nevra": "gmp-1:6.2.0-13.el9.x86_64", + "filename": "gmp-6.2.0-13.el9.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/g/gmp-6.2.0-13.el9.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 326840, + "sha256": "d4529445e30b7eb9a8225b0539f70d26d585d7fe306296f948ea73114d1c171f", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "gmp-6.2.0-13.el9.src.rpm" + }, + { + "name": "grep", + "epoch": 0, + "version": "3.6", + "release": "5.el9", + "architecture": "x86_64", + "nevra": "grep-0:3.6-5.el9.x86_64", + "filename": "grep-3.6-5.el9.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/g/grep-3.6-5.el9.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 279174, + "sha256": "5556895ff1817066ca71b50785615e944b0fcc7e1c94c983087c7c691819623d", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "grep-3.6-5.el9.src.rpm" + }, + { + "name": "gzip", + "epoch": 0, + "version": "1.12", + "release": "2.el9_8", + "architecture": "x86_64", + "nevra": "gzip-0:1.12-2.el9_8.x86_64", + "filename": "gzip-1.12-2.el9_8.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/g/gzip-1.12-2.el9_8.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 172571, + "sha256": "a87bdcce45011f232758c01bd99c564b5f6b549d391646cc573a132d22604b85", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "gzip-1.12-2.el9_8.src.rpm" + }, + { + "name": "kmod-libs", + "epoch": 0, + "version": "28", + "release": "11.el9", + "architecture": "x86_64", + "nevra": "kmod-libs-0:28-11.el9.x86_64", + "filename": "kmod-libs-28-11.el9.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/k/kmod-libs-28-11.el9.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 63619, + "sha256": "f296bc24a1b8ba6c40ed73ba736be97ed78e4124b6dbdd8a0a25a9683d4ff1ce", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "kmod-28-11.el9.src.rpm" + }, + { + "name": "libacl", + "epoch": 0, + "version": "2.4.0", + "release": "1.el9_8", + "architecture": "x86_64", + "nevra": "libacl-0:2.4.0-1.el9_8.x86_64", + "filename": "libacl-2.4.0-1.el9_8.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/l/libacl-2.4.0-1.el9_8.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 31657, + "sha256": "a81fb7a4d7c946e9bd886ee3c471a4b5040dedbb8ffb2a388120b2094be93cc8", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "acl-2.4.0-1.el9_8.src.rpm" + }, + { + "name": "libattr", + "epoch": 0, + "version": "2.6.0", + "release": "1.el9_8", + "architecture": "x86_64", + "nevra": "libattr-0:2.6.0-1.el9_8.x86_64", + "filename": "libattr-2.6.0-1.el9_8.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/l/libattr-2.6.0-1.el9_8.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 23752, + "sha256": "9e37537f690c748f7f05faa80966072f118ec722e38ef332fe19cf22b087349f", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "attr-2.6.0-1.el9_8.src.rpm" + }, + { + "name": "libblkid", + "epoch": 0, + "version": "2.37.4", + "release": "25.el9", + "architecture": "x86_64", + "nevra": "libblkid-0:2.37.4-25.el9.x86_64", + "filename": "libblkid-2.37.4-25.el9.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/l/libblkid-2.37.4-25.el9.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 114192, + "sha256": "a858400abe83a7955ae509c920f835a950ea2cf1156916823c595a23ba46d536", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "util-linux-2.37.4-25.el9.src.rpm" + }, + { + "name": "libcap", + "epoch": 0, + "version": "2.48", + "release": "10.el9_8.1", + "architecture": "x86_64", + "nevra": "libcap-0:2.48-10.el9_8.1.x86_64", + "filename": "libcap-2.48-10.el9_8.1.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/l/libcap-2.48-10.el9_8.1.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 78928, + "sha256": "d4805439b10fa551b7535cf30ca28d4d5862132c9c429b2b31221bea7f43263a", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "libcap-2.48-10.el9_8.1.src.rpm" + }, + { + "name": "libcap-ng", + "epoch": 0, + "version": "0.8.2", + "release": "7.el9", + "architecture": "x86_64", + "nevra": "libcap-ng-0:0.8.2-7.el9.x86_64", + "filename": "libcap-ng-0.8.2-7.el9.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/l/libcap-ng-0.8.2-7.el9.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 36752, + "sha256": "ebddfc188d1ddbb0d6a238583cbc02dcb9fc0bd063a850b22d48980899976628", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "libcap-ng-0.8.2-7.el9.src.rpm" + }, + { + "name": "libdb", + "epoch": 0, + "version": "5.3.28", + "release": "57.el9_6", + "architecture": "x86_64", + "nevra": "libdb-0:5.3.28-57.el9_6.x86_64", + "filename": "libdb-5.3.28-57.el9_6.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/l/libdb-5.3.28-57.el9_6.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 755192, + "sha256": "3246e76f197e2b60eb470b9b55d3e0dda2301b029f295fed9c38ff70b87c5b6b", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "libdb-5.3.28-57.el9_6.src.rpm" + }, + { + "name": "libeconf", + "epoch": 0, + "version": "0.4.1", + "release": "7.el9_8", + "architecture": "x86_64", + "nevra": "libeconf-0:0.4.1-7.el9_8.x86_64", + "filename": "libeconf-0.4.1-7.el9_8.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/l/libeconf-0.4.1-7.el9_8.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 33179, + "sha256": "a570c5baaedeb1445bc2e4f3930b0a709411bbefbdbf463c3e006cbfc7018894", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "libeconf-0.4.1-7.el9_8.src.rpm" + }, + { + "name": "libfdisk", + "epoch": 0, + "version": "2.37.4", + "release": "25.el9", + "architecture": "x86_64", + "nevra": "libfdisk-0:2.37.4-25.el9.x86_64", + "filename": "libfdisk-2.37.4-25.el9.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/l/libfdisk-2.37.4-25.el9.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 161769, + "sha256": "1b861f267752e718ce696a80dcc06ef1dde8e9aa73fa2abed3775626d719c124", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "util-linux-2.37.4-25.el9.src.rpm" + }, + { + "name": "libffi", + "epoch": 0, + "version": "3.4.2", + "release": "8.el9", + "architecture": "x86_64", + "nevra": "libffi-0:3.4.2-8.el9.x86_64", + "filename": "libffi-3.4.2-8.el9.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/l/libffi-3.4.2-8.el9.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 40619, + "sha256": "dde0012a94c6f3825e605b095b15767d89c2b87a5da097348310d7e87721c645", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "libffi-3.4.2-8.el9.src.rpm" + }, + { + "name": "libgcc", + "epoch": 0, + "version": "11.5.0", + "release": "14.el9", + "architecture": "x86_64", + "nevra": "libgcc-0:11.5.0-14.el9.x86_64", + "filename": "libgcc-11.5.0-14.el9.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/l/libgcc-11.5.0-14.el9.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 87280, + "sha256": "77c66827ffc14df2f43612b26128b1fd58d5c9597d4d4e564aa239b161272872", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "gcc-11.5.0-14.el9.src.rpm" + }, + { + "name": "libgcrypt", + "epoch": 0, + "version": "1.10.0", + "release": "13.el9_8", + "architecture": "x86_64", + "nevra": "libgcrypt-0:1.10.0-13.el9_8.x86_64", + "filename": "libgcrypt-1.10.0-13.el9_8.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/l/libgcrypt-1.10.0-13.el9_8.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 523829, + "sha256": "c07cd9f613809195b8691d28fd2f3bff55b2a83b9c1cdf4a32c681e0e32dfafb", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "libgcrypt-1.10.0-13.el9_8.src.rpm" + }, + { + "name": "libgpg-error", + "epoch": 0, + "version": "1.42", + "release": "5.el9", + "architecture": "x86_64", + "nevra": "libgpg-error-0:1.42-5.el9.x86_64", + "filename": "libgpg-error-1.42-5.el9.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/l/libgpg-error-1.42-5.el9.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 225603, + "sha256": "8248e20d7a253aa9c0dc7dc3d56b42e1def4fd5753ce8e8b9e980aa664fc9068", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "libgpg-error-1.42-5.el9.src.rpm" + }, + { + "name": "libmount", + "epoch": 0, + "version": "2.37.4", + "release": "25.el9", + "architecture": "x86_64", + "nevra": "libmount-0:2.37.4-25.el9.x86_64", + "filename": "libmount-2.37.4-25.el9.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/l/libmount-2.37.4-25.el9.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 142467, + "sha256": "a9a2022eb9e39301bfcd3273573a108486b2b315c89247f147870016b2e9222c", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "util-linux-2.37.4-25.el9.src.rpm" + }, + { + "name": "libpwquality", + "epoch": 0, + "version": "1.4.4", + "release": "8.el9", + "architecture": "x86_64", + "nevra": "libpwquality-0:1.4.4-8.el9.x86_64", + "filename": "libpwquality-1.4.4-8.el9.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/l/libpwquality-1.4.4-8.el9.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 126104, + "sha256": "14b7ff2f7fdaf8ebec90261f4619ea7f7c3564c4de8483666de7ed4b1f49b66f", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "libpwquality-1.4.4-8.el9.src.rpm" + }, + { + "name": "libseccomp", + "epoch": 0, + "version": "2.5.2", + "release": "2.el9", + "architecture": "x86_64", + "nevra": "libseccomp-0:2.5.2-2.el9.x86_64", + "filename": "libseccomp-2.5.2-2.el9.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/l/libseccomp-2.5.2-2.el9.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 76200, + "sha256": "e2015f60dbe784330d5df43f3f05c68c307694600a636a1706bf86527cc82e82", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "libseccomp-2.5.2-2.el9.src.rpm" + }, + { + "name": "libselinux", + "epoch": 0, + "version": "3.6", + "release": "3.el9", + "architecture": "x86_64", + "nevra": "libselinux-0:3.6-3.el9.x86_64", + "filename": "libselinux-3.6-3.el9.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/l/libselinux-3.6-3.el9.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 89722, + "sha256": "ce1cc63a7212c39f5f2a35f719ee38d6418cf081ea78c9317f388d9f41e4a627", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "libselinux-3.6-3.el9.src.rpm" + }, + { + "name": "libsemanage", + "epoch": 0, + "version": "3.6", + "release": "5.el9_6", + "architecture": "x86_64", + "nevra": "libsemanage-0:3.6-5.el9_6.x86_64", + "filename": "libsemanage-3.6-5.el9_6.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/l/libsemanage-3.6-5.el9_6.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 123449, + "sha256": "7ac29f46714cd762f18a52e9807fd1766b0cf9e0388aa3d9befaabf8785a01e3", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "libsemanage-3.6-5.el9_6.src.rpm" + }, + { + "name": "libsepol", + "epoch": 0, + "version": "3.6", + "release": "3.el9", + "architecture": "x86_64", + "nevra": "libsepol-0:3.6-3.el9.x86_64", + "filename": "libsepol-3.6-3.el9.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/l/libsepol-3.6-3.el9.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 338766, + "sha256": "b98984b2bf42203964cc979ac157df090c63b89a0f5c6560ede01965531c8ffd", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "libsepol-3.6-3.el9.src.rpm" + }, + { + "name": "libsigsegv", + "epoch": 0, + "version": "2.13", + "release": "4.el9", + "architecture": "x86_64", + "nevra": "libsigsegv-0:2.13-4.el9.x86_64", + "filename": "libsigsegv-2.13-4.el9.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/l/libsigsegv-2.13-4.el9.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 30681, + "sha256": "24005c62017797b612d047a2af83a218633b32302a787fabd22e52230db6adc1", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "libsigsegv-2.13-4.el9.src.rpm" + }, + { + "name": "libsmartcols", + "epoch": 0, + "version": "2.37.4", + "release": "25.el9", + "architecture": "x86_64", + "nevra": "libsmartcols-0:2.37.4-25.el9.x86_64", + "filename": "libsmartcols-2.37.4-25.el9.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/l/libsmartcols-2.37.4-25.el9.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 68692, + "sha256": "c1da912799780b89cd44db4acc318ea4a83adba0d8d99aad1b877879f40dbd48", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "util-linux-2.37.4-25.el9.src.rpm" + }, + { + "name": "libtasn1", + "epoch": 0, + "version": "4.16.0", + "release": "10.el9_8", + "architecture": "x86_64", + "nevra": "libtasn1-0:4.16.0-10.el9_8.x86_64", + "filename": "libtasn1-4.16.0-10.el9_8.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/l/libtasn1-4.16.0-10.el9_8.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 81418, + "sha256": "f9473f322407f10205b0db98b89cf8f603e9c769e9977250734136df56cbb981", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "libtasn1-4.16.0-10.el9_8.src.rpm" + }, + { + "name": "libutempter", + "epoch": 0, + "version": "1.2.1", + "release": "6.el9", + "architecture": "x86_64", + "nevra": "libutempter-0:1.2.1-6.el9.x86_64", + "filename": "libutempter-1.2.1-6.el9.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/l/libutempter-1.2.1-6.el9.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 30354, + "sha256": "0f1df5e0d48c2ac9914bfffa7ed569cd58e42b17ba96bb3f7cf74d1e80de2597", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "libutempter-1.2.1-6.el9.src.rpm" + }, + { + "name": "libuuid", + "epoch": 0, + "version": "2.37.4", + "release": "25.el9", + "architecture": "x86_64", + "nevra": "libuuid-0:2.37.4-25.el9.x86_64", + "filename": "libuuid-2.37.4-25.el9.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/l/libuuid-2.37.4-25.el9.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 32757, + "sha256": "5694aafca42c707f85af66bba11d102f7636ee17f586466b3ff80254e995ed7b", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "util-linux-2.37.4-25.el9.src.rpm" + }, + { + "name": "libxcrypt", + "epoch": 0, + "version": "4.4.18", + "release": "3.el9", + "architecture": "x86_64", + "nevra": "libxcrypt-0:4.4.18-3.el9.x86_64", + "filename": "libxcrypt-4.4.18-3.el9.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/l/libxcrypt-4.4.18-3.el9.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 122599, + "sha256": "a50bb26a28ee7e6379c86b5b91285299b71569fa87ea968d800a56090b7a179d", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "libxcrypt-4.4.18-3.el9.src.rpm" + }, + { + "name": "libzstd", + "epoch": 0, + "version": "1.5.5", + "release": "1.el9", + "architecture": "x86_64", + "nevra": "libzstd-0:1.5.5-1.el9.x86_64", + "filename": "libzstd-1.5.5-1.el9.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/l/libzstd-1.5.5-1.el9.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 304135, + "sha256": "d8a149f0d8f217126642cc4b40199d631b940f7d227191cc2179f3158fd47f9e", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "zstd-1.5.5-1.el9.src.rpm" + }, + { + "name": "lz4-libs", + "epoch": 0, + "version": "1.9.3", + "release": "5.el9", + "architecture": "x86_64", + "nevra": "lz4-libs-0:1.9.3-5.el9.x86_64", + "filename": "lz4-libs-1.9.3-5.el9.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/l/lz4-libs-1.9.3-5.el9.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 70922, + "sha256": "9658da838021711f687cf283368664984bfb1c8b9176897d7d477a724a11a731", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "lz4-1.9.3-5.el9.src.rpm" + }, + { + "name": "ncurses-base", + "epoch": 0, + "version": "6.2", + "release": "12.20210508.el9", + "architecture": "noarch", + "nevra": "ncurses-base-0:6.2-12.20210508.el9.noarch", + "filename": "ncurses-base-6.2-12.20210508.el9.noarch.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/n/ncurses-base-6.2-12.20210508.el9.noarch.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 97840, + "sha256": "d62dfd41f9688efa2cf1ceedb96084c63e297fbdcfd1e72bc6757c730092b60c", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "ncurses-6.2-12.20210508.el9.src.rpm" + }, + { + "name": "ncurses-libs", + "epoch": 0, + "version": "6.2", + "release": "12.20210508.el9", + "architecture": "x86_64", + "nevra": "ncurses-libs-0:6.2-12.20210508.el9.x86_64", + "filename": "ncurses-libs-6.2-12.20210508.el9.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/n/ncurses-libs-6.2-12.20210508.el9.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 336270, + "sha256": "f3e1f8e59c7116278aa19b6705a1443f6307d4d6fbdde75a23d2f5d60636cb16", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "ncurses-6.2-12.20210508.el9.src.rpm" + }, + { + "name": "nginx", + "epoch": 2, + "version": "1.30.4", + "release": "1.el9.ngx", + "architecture": "x86_64", + "nevra": "nginx-2:1.30.4-1.el9.ngx.x86_64", + "filename": "nginx-1.30.4-1.el9.ngx.x86_64.rpm", + "url": "https://nginx.org/packages/rhel/9/x86_64/RPMS/nginx-1.30.4-1.el9.ngx.x86_64.rpm", + "repository": "nginx-stable", + "size": 1085929, + "sha256": "d9e44a6f68e230b0f2c2fd5a265b2e82ce47a19a04cb68bba7cddce690706568", + "signing_key_fingerprint": "8540A6F18833A80E9C1653A42FD21310B49F6B46", + "source_rpm": "nginx-1.30.4-1.el9.ngx.src.rpm" + }, + { + "name": "openssl", + "epoch": 1, + "version": "3.5.8", + "release": "1.el9_8", + "architecture": "x86_64", + "nevra": "openssl-1:3.5.8-1.el9_8.x86_64", + "filename": "openssl-3.5.8-1.el9_8.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/o/openssl-3.5.8-1.el9_8.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 1569041, + "sha256": "2e0d5017032a48c23d4efa43afbe98d45179365eaec16f38e93c271b7728a67a", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "openssl-3.5.8-1.el9_8.src.rpm" + }, + { + "name": "openssl-fips-provider", + "epoch": 0, + "version": "3.0.7", + "release": "11.el9_8", + "architecture": "x86_64", + "nevra": "openssl-fips-provider-0:3.0.7-11.el9_8.x86_64", + "filename": "openssl-fips-provider-3.0.7-11.el9_8.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/o/openssl-fips-provider-3.0.7-11.el9_8.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 14256, + "sha256": "c00860e9c5a1d90488aa2eb65fe41f62926b38c6b3669d331a8b97e4a60223ac", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "openssl-fips-provider-3.0.7-11.el9_8.src.rpm" + }, + { + "name": "openssl-fips-provider-so", + "epoch": 0, + "version": "3.0.7", + "release": "11.el9_8", + "architecture": "x86_64", + "nevra": "openssl-fips-provider-so-0:3.0.7-11.el9_8.x86_64", + "filename": "openssl-fips-provider-so-3.0.7-11.el9_8.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/o/openssl-fips-provider-so-3.0.7-11.el9_8.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 595008, + "sha256": "60d36ad3a67d6b00e67bb0a19c0902fbb2ecdd873cf7f280a3039d04a092790c", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "openssl-fips-provider-3.0.7-11.el9_8.src.rpm" + }, + { + "name": "openssl-libs", + "epoch": 1, + "version": "3.5.8", + "release": "1.el9_8", + "architecture": "x86_64", + "nevra": "openssl-libs-1:3.5.8-1.el9_8.x86_64", + "filename": "openssl-libs-3.5.8-1.el9_8.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/o/openssl-libs-3.5.8-1.el9_8.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 2430624, + "sha256": "3abe1f190415d91d4dc51db74cf2ad7e06b1e5ca5f63dac978fe58d8fd14e493", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "openssl-3.5.8-1.el9_8.src.rpm" + }, + { + "name": "p11-kit", + "epoch": 0, + "version": "0.26.4", + "release": "1.el9_8", + "architecture": "x86_64", + "nevra": "p11-kit-0:0.26.4-1.el9_8.x86_64", + "filename": "p11-kit-0.26.4-1.el9_8.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/p/p11-kit-0.26.4-1.el9_8.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 625862, + "sha256": "a00ba14bfd0fc5dd2818f605f2e0520b52ea4b36167504c2523f92a065c2bdaf", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "p11-kit-0.26.4-1.el9_8.src.rpm" + }, + { + "name": "p11-kit-trust", + "epoch": 0, + "version": "0.26.4", + "release": "1.el9_8", + "architecture": "x86_64", + "nevra": "p11-kit-trust-0:0.26.4-1.el9_8.x86_64", + "filename": "p11-kit-trust-0.26.4-1.el9_8.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/p/p11-kit-trust-0.26.4-1.el9_8.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 165521, + "sha256": "41b84ab0ee4cf914d570a3d648ed98b7de44cef73ea3dfa58ff5eebdec85f42a", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "p11-kit-0.26.4-1.el9_8.src.rpm" + }, + { + "name": "pam", + "epoch": 0, + "version": "1.5.1", + "release": "28.el9_8.1", + "architecture": "x86_64", + "nevra": "pam-0:1.5.1-28.el9_8.1.x86_64", + "filename": "pam-1.5.1-28.el9_8.1.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/p/pam-1.5.1-28.el9_8.1.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 645147, + "sha256": "9285aea93392dada0c8399b7d8a1c85ce7a6fdafd2fb5264727448549c15637c", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "pam-1.5.1-28.el9_8.1.src.rpm" + }, + { + "name": "pcre", + "epoch": 0, + "version": "8.44", + "release": "4.el9", + "architecture": "x86_64", + "nevra": "pcre-0:8.44-4.el9.x86_64", + "filename": "pcre-8.44-4.el9.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/p/pcre-8.44-4.el9.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 205261, + "sha256": "e9ddc7d57d4f6e7400b66bcc78b9bafc1f05630e3e0d2a14000bc907f429ddc4", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "pcre-8.44-4.el9.src.rpm" + }, + { + "name": "pcre2", + "epoch": 0, + "version": "10.40", + "release": "6.el9", + "architecture": "x86_64", + "nevra": "pcre2-0:10.40-6.el9.x86_64", + "filename": "pcre2-10.40-6.el9.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/p/pcre2-10.40-6.el9.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 241900, + "sha256": "75db1e5a50e7b1794d7ba18212d95cd2684559da9e7c52eee46490302c7f24dd", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "pcre2-10.40-6.el9.src.rpm" + }, + { + "name": "pcre2-syntax", + "epoch": 0, + "version": "10.40", + "release": "6.el9", + "architecture": "noarch", + "nevra": "pcre2-syntax-0:10.40-6.el9.noarch", + "filename": "pcre2-syntax-10.40-6.el9.noarch.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/p/pcre2-syntax-10.40-6.el9.noarch.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 147926, + "sha256": "d386b5e9b3a4b077b2ba143882e605750855dd3354f13c55fa12ed26908cb442", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "pcre2-10.40-6.el9.src.rpm" + }, + { + "name": "procps-ng", + "epoch": 0, + "version": "3.3.17", + "release": "14.el9", + "architecture": "x86_64", + "nevra": "procps-ng-0:3.3.17-14.el9.x86_64", + "filename": "procps-ng-3.3.17-14.el9.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/p/procps-ng-3.3.17-14.el9.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 361526, + "sha256": "506ad778f63821e8d9647ca8e0a3ff21b8af9c1666060d5200f9b26ee718333c", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "procps-ng-3.3.17-14.el9.src.rpm" + }, + { + "name": "readline", + "epoch": 0, + "version": "8.1", + "release": "4.el9", + "architecture": "x86_64", + "nevra": "readline-0:8.1-4.el9.x86_64", + "filename": "readline-8.1-4.el9.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/r/readline-8.1-4.el9.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 220174, + "sha256": "01bf315b3bc44c28515c4d33d49173b23d7979d2a09b7b15f749d434b60851e6", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "readline-8.1-4.el9.src.rpm" + }, + { + "name": "redhat-release", + "epoch": 0, + "version": "9.8", + "release": "1.0.el9", + "architecture": "x86_64", + "nevra": "redhat-release-0:9.8-1.0.el9.x86_64", + "filename": "redhat-release-9.8-1.0.el9.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/r/redhat-release-9.8-1.0.el9.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 61742, + "sha256": "8157ed988fc34dcfeb6429272959471edd5bde4ac212f26611fd54c180391758", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "redhat-release-9.8-1.0.el9.src.rpm" + }, + { + "name": "sed", + "epoch": 0, + "version": "4.8", + "release": "10.el9", + "architecture": "x86_64", + "nevra": "sed-0:4.8-10.el9.x86_64", + "filename": "sed-4.8-10.el9.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/s/sed-4.8-10.el9.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 317456, + "sha256": "45e246453dc9eb1bad6a71c6f349aad1b1b2e1bf3ec645b80f0ed04fe69c960e", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "sed-4.8-10.el9.src.rpm" + }, + { + "name": "setup", + "epoch": 0, + "version": "2.13.7", + "release": "10.el9", + "architecture": "noarch", + "nevra": "setup-0:2.13.7-10.el9.noarch", + "filename": "setup-2.13.7-10.el9.noarch.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/s/setup-2.13.7-10.el9.noarch.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 153791, + "sha256": "0891d395ce067121c28932534237ad1ce231f2bfa987411ad62e73a12d11eb6a", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "setup-2.13.7-10.el9.src.rpm" + }, + { + "name": "shadow-utils", + "epoch": 2, + "version": "4.9", + "release": "16.el9", + "architecture": "x86_64", + "nevra": "shadow-utils-2:4.9-16.el9.x86_64", + "filename": "shadow-utils-4.9-16.el9.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/s/shadow-utils-4.9-16.el9.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 1250179, + "sha256": "17294ee3fbc09c1b5cfc4114d3815cbd92584d6d70a6288e1dce2fda0a62dc59", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "shadow-utils-4.9-16.el9.src.rpm" + }, + { + "name": "systemd", + "epoch": 0, + "version": "252", + "release": "67.el9_8.6", + "architecture": "x86_64", + "nevra": "systemd-0:252-67.el9_8.6.x86_64", + "filename": "systemd-252-67.el9_8.6.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/s/systemd-252-67.el9_8.6.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 4383786, + "sha256": "025ffe42235a9d4d40138bab7511995392d2a50ba6912be97b47e634b15823b8", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "systemd-252-67.el9_8.6.src.rpm" + }, + { + "name": "systemd-libs", + "epoch": 0, + "version": "252", + "release": "67.el9_8.6", + "architecture": "x86_64", + "nevra": "systemd-libs-0:252-67.el9_8.6.x86_64", + "filename": "systemd-libs-252-67.el9_8.6.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/s/systemd-libs-252-67.el9_8.6.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 662007, + "sha256": "d491d7375ed820bf4fa0d5f6d80a6f1a72cfa6ff31e79dabf9288246061cf88e", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "systemd-252-67.el9_8.6.src.rpm" + }, + { + "name": "systemd-pam", + "epoch": 0, + "version": "252", + "release": "67.el9_8.6", + "architecture": "x86_64", + "nevra": "systemd-pam-0:252-67.el9_8.6.x86_64", + "filename": "systemd-pam-252-67.el9_8.6.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/s/systemd-pam-252-67.el9_8.6.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 258340, + "sha256": "eb780b309cd671d4b3bec7d3b31bf148179e527d7222663544470310f4cb43ee", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "systemd-252-67.el9_8.6.src.rpm" + }, + { + "name": "systemd-rpm-macros", + "epoch": 0, + "version": "252", + "release": "67.el9_8.6", + "architecture": "noarch", + "nevra": "systemd-rpm-macros-0:252-67.el9_8.6.noarch", + "filename": "systemd-rpm-macros-252-67.el9_8.6.noarch.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/s/systemd-rpm-macros-252-67.el9_8.6.noarch.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 40844, + "sha256": "974a0352427799559a3e90dcdb38200d767631452cca7717c5b0fbe7760df313", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "systemd-252-67.el9_8.6.src.rpm" + }, + { + "name": "tzdata", + "epoch": 0, + "version": "2026c", + "release": "1.el9_8", + "architecture": "noarch", + "nevra": "tzdata-0:2026c-1.el9_8.noarch", + "filename": "tzdata-2026c-1.el9_8.noarch.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/t/tzdata-2026c-1.el9_8.noarch.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 933286, + "sha256": "8d6196e02853c0900c3c2e2367665beffb62cb2d0ff5f465ea2d00848a9a35dc", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "tzdata-2026c-1.el9_8.src.rpm" + }, + { + "name": "util-linux", + "epoch": 0, + "version": "2.37.4", + "release": "25.el9", + "architecture": "x86_64", + "nevra": "util-linux-0:2.37.4-25.el9.x86_64", + "filename": "util-linux-2.37.4-25.el9.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/u/util-linux-2.37.4-25.el9.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 2382511, + "sha256": "35e0b73e574a7d8e93af0adf54adb2303f03423fd5761e357df86288f59d7933", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "util-linux-2.37.4-25.el9.src.rpm" + }, + { + "name": "util-linux-core", + "epoch": 0, + "version": "2.37.4", + "release": "25.el9", + "architecture": "x86_64", + "nevra": "util-linux-core-0:2.37.4-25.el9.x86_64", + "filename": "util-linux-core-2.37.4-25.el9.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/u/util-linux-core-2.37.4-25.el9.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 476811, + "sha256": "5575c8fc753d5a81022786dac33e172a6d1602ef41d247a58465754d3f952726", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "util-linux-2.37.4-25.el9.src.rpm" + }, + { + "name": "xz-libs", + "epoch": 0, + "version": "5.2.5", + "release": "8.el9_0", + "architecture": "x86_64", + "nevra": "xz-libs-0:5.2.5-8.el9_0.x86_64", + "filename": "xz-libs-5.2.5-8.el9_0.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/x/xz-libs-5.2.5-8.el9_0.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 96649, + "sha256": "de263f880a4394f04b5e84254ba0a88d781b5bd63665c9e028bc10351490c982", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "xz-5.2.5-8.el9_0.src.rpm" + }, + { + "name": "zlib", + "epoch": 0, + "version": "1.2.11", + "release": "40.el9", + "architecture": "x86_64", + "nevra": "zlib-0:1.2.11-40.el9.x86_64", + "filename": "zlib-1.2.11-40.el9.x86_64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/z/zlib-1.2.11-40.el9.x86_64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 95708, + "sha256": "baf95ffbf40ee014135f16fe33e343faf7ff1ca06509fd97cd988e6afeabf670", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "zlib-1.2.11-40.el9.src.rpm" + } + ], + "source_packages": [ + { + "filename": "acl-2.4.0-1.el9_8.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/a/acl-2.4.0-1.el9_8.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 609918, + "sha256": "b140deb68f46517b0093e18969d8fb42a17216064fb2ee5783e9316d786430db" + }, + { + "filename": "attr-2.6.0-1.el9_8.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/a/attr-2.6.0-1.el9_8.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 389805, + "sha256": "9bdd2e605e0ddc9818382bd95644594fa8b8eedfe08048303093db13cde9963c" + }, + { + "filename": "audit-3.1.5-8.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/a/audit-3.1.5-8.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 1275064, + "sha256": "e0a3e72c863512032e0ba95337db076fa5af9368d9a80529a9624afc8877401c" + }, + { + "filename": "basesystem-11-13.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/b/basesystem-11-13.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 9884, + "sha256": "5a4ed0779fc06f08115d6e06aa95486f1e1e251f8f9ddb6c7e14e811bb2e24ef" + }, + { + "filename": "bash-5.1.8-9.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/b/bash-5.1.8-9.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 10512850, + "sha256": "5d7bbbf2538361be1a11846602862c3a56809b3ea43b69b86bcf407538e9e260" + }, + { + "filename": "bzip2-1.0.8-11.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/b/bzip2-1.0.8-11.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 828199, + "sha256": "ba58283fc4ef85911f20a8e45ffa00497775858102d48f2a32ebf1010a1abefc" + }, + { + "filename": "ca-certificates-2025.2.80_v9.0.305-91.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/c/ca-certificates-2025.2.80_v9.0.305-91.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 711648, + "sha256": "d3193e155ddd297042a944729fe54c1b90c17bdbd1876fc68e4f66d7857f9e81" + }, + { + "filename": "chkconfig-1.24-2.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/c/chkconfig-1.24-2.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 214658, + "sha256": "b2618b278f5c8d6dacfae790c8c73b1fc1578b8f64011f325ced5a4a2e3b58bc" + }, + { + "filename": "coreutils-8.32-41.el9_8.1.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/c/coreutils-8.32-41.el9_8.1.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 5697510, + "sha256": "5852781d2fbb2c447c4425960f4fe30310870a0e4073363d2254047b785b5a9e" + }, + { + "filename": "cracklib-2.9.6-28.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/c/cracklib-2.9.6-28.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 6416053, + "sha256": "4708420bdde578448be8c06a6b608635743682f6370d7d45d7cae46842529fa0" + }, + { + "filename": "crypto-policies-20260224-1.gitea0f072.el9_8.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/c/crypto-policies-20260224-1.gitea0f072.el9_8.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 112905, + "sha256": "775d926429179caeade6af8dc7dea15a0bea49102c2592d5b712f996a329ec38" + }, + { + "filename": "dbus-1.12.20-8.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/d/dbus-1.12.20-8.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 2143916, + "sha256": "3fe74a2b4fb4485c93e974010d9376e30a63dfcc628bfd6c01837c27b4953912" + }, + { + "filename": "dbus-broker-28-9.el9_8.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/d/dbus-broker-28-9.el9_8.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 258866, + "sha256": "9ccbb440edb6826689fd5e0d650de4f08550c3c0f3b2732c54c1e99b0d361824" + }, + { + "filename": "expat-2.5.0-6.el9_8.3.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/e/expat-2.5.0-6.el9_8.3.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 8403095, + "sha256": "0cff2a2213384dc43eb1874bf6e77b2b8230be848f50387d8057e0e6cde3d392" + }, + { + "filename": "filesystem-3.16-5.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/f/filesystem-3.16-5.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 20486, + "sha256": "c795690df30c46e521372e2f649c995a2abc159b76c8ef6cd5da8a713ea17937" + }, + { + "filename": "findutils-4.8.0-7.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/f/findutils-4.8.0-7.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 2010585, + "sha256": "48bd4d4dd081120bcc6ab772b930a150f30b2fc89a4a14a24220383d24a30b3f" + }, + { + "filename": "gcc-11.5.0-14.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/g/gcc-11.5.0-14.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 81978017, + "sha256": "19dec462f2880508570ca42a82c2f76fbd95fcad8d3e3ff812e9ca50cdeb2d8f" + }, + { + "filename": "glibc-2.34-275.el9_8.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/g/glibc-2.34-275.el9_8.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 20442764, + "sha256": "bd7a453f66e13da24d073f53070c2d209fcd88ca2aaa24ab3b2f81cae198b46c" + }, + { + "filename": "gmp-6.2.0-13.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/g/gmp-6.2.0-13.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 2503825, + "sha256": "d0d8a795eea9ae555da63fbcfc3575425e86bb7e96d117b9ae2785b4f5e82f7c" + }, + { + "filename": "grep-3.6-5.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/g/grep-3.6-5.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 1620891, + "sha256": "81b14432ebe1645b74b57592f1dcde8fab15ec13632f483f72ff2407ed16c33e" + }, + { + "filename": "gzip-1.12-2.el9_8.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/g/gzip-1.12-2.el9_8.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 859023, + "sha256": "f28fcbe8f3de2ec7dcdb51b1f51f03f61d0afa18c9fef10d210f40ff0c71f3a0" + }, + { + "filename": "kmod-28-11.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/k/kmod-28-11.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 579198, + "sha256": "4f6fefbf0d004b23494fe18ccfff2b9151ea887a276c56a6f25ea597a250991c" + }, + { + "filename": "libcap-2.48-10.el9_8.1.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/l/libcap-2.48-10.el9_8.1.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 208035, + "sha256": "7f96d98c99f190b840985b3589183a3f1dc444e0932f256491b24d28c5031de3" + }, + { + "filename": "libcap-ng-0.8.2-7.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/l/libcap-ng-0.8.2-7.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 470599, + "sha256": "48bb098662e2f3e1dbb94e27e4e612bc6794fbb62708e1f1a431cc2480fcdb00" + }, + { + "filename": "libdb-5.3.28-57.el9_6.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/l/libdb-5.3.28-57.el9_6.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 35290920, + "sha256": "6a74a3d96bd4657659524050945e2a47e93779addf2de374a13e1baf32b4ab8d" + }, + { + "filename": "libeconf-0.4.1-7.el9_8.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/l/libeconf-0.4.1-7.el9_8.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 206886, + "sha256": "425009c96135f39ca7bdb8a6ea948187d052d339dd76235979439fbd169da331" + }, + { + "filename": "libffi-3.4.2-8.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/l/libffi-3.4.2-8.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 1367398, + "sha256": "2b384204cc70c8f23d3a86e5cc9f736306a7a91a72e282044e3b23f3fd831647" + }, + { + "filename": "libgcrypt-1.10.0-13.el9_8.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/l/libgcrypt-1.10.0-13.el9_8.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 3983873, + "sha256": "c2737830c577d7c45aefa3213d770be924617a46e6ab56824edec9b6341af8d4" + }, + { + "filename": "libgpg-error-1.42-5.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/l/libgpg-error-1.42-5.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 994101, + "sha256": "9586046fd9622e5e898f92a08821948bf0754a74ab343cc093ca21caae0352a6" + }, + { + "filename": "libpwquality-1.4.4-8.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/l/libpwquality-1.4.4-8.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 447225, + "sha256": "14fbf335e2c6f22b441a9750a69b7c41e197c4dd21adac701fd81f17660ee0b4" + }, + { + "filename": "libseccomp-2.5.2-2.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/l/libseccomp-2.5.2-2.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 653169, + "sha256": "43dd0fa2cd26306e2017704075e628bbe675c8731b17848df82f3b59337f1be8" + }, + { + "filename": "libselinux-3.6-3.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/l/libselinux-3.6-3.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 271153, + "sha256": "a08a84389665ef614eb6d9b06a53128eab89b650c799c0558f3ae04df97c4b13" + }, + { + "filename": "libsemanage-3.6-5.el9_6.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/l/libsemanage-3.6-5.el9_6.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 223978, + "sha256": "33e4ad8374bdaa1dd4b4a46b2b379d025590d80e5d666801aea4f437a9a6ccd9" + }, + { + "filename": "libsepol-3.6-3.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/l/libsepol-3.6-3.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 543960, + "sha256": "2dacf2f1c1f61562ccc5ad082939158745e5a4a572d135d4f8ff00f75e1e94df" + }, + { + "filename": "libsigsegv-2.13-4.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/l/libsigsegv-2.13-4.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 473267, + "sha256": "734651070d0113de033da80114b416931c4c0be21ce51f6b1c1641b1185c34f3" + }, + { + "filename": "libtasn1-4.16.0-10.el9_8.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/l/libtasn1-4.16.0-10.el9_8.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 1899881, + "sha256": "be5c3a993282ecde81ad5d00dd4e7b2c293e97e47d28709aa0ea7292b80ba610" + }, + { + "filename": "libutempter-1.2.1-6.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/l/libutempter-1.2.1-6.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 30093, + "sha256": "e48843d2734fefad084a86165860ea9575bdc53f63bb5845d8807ce9ccb4f914" + }, + { + "filename": "libxcrypt-4.4.18-3.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/l/libxcrypt-4.4.18-3.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 543970, + "sha256": "d18f72eb41ecd0370e2e47f1dc5774be54e9ff3b4dd333578017666c7c488f40" + }, + { + "filename": "lz4-1.9.3-5.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/l/lz4-1.9.3-5.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 333421, + "sha256": "44e9e079f0f30476a0d8d9849ef1cd940fcc37abee11f481d6043b184bd0cf14" + }, + { + "filename": "ncurses-6.2-12.20210508.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/n/ncurses-6.2-12.20210508.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 3586993, + "sha256": "cdb59ed3771a3a4f00e2ffca853f2de4aa887e3d5c3655317f2e2c03f461103f" + }, + { + "filename": "nginx-1.30.4-1.el9.ngx.src.rpm", + "url": "https://nginx.org/packages/rhel/9/SRPMS/nginx-1.30.4-1.el9.ngx.src.rpm", + "repository": "nginx-stable-source", + "size": 1348940, + "sha256": "c04bda3049ba9f850a61a64fa311990e58fcc76fd8df9e25bce15b6b4a645dc8" + }, + { + "filename": "openssl-3.5.8-1.el9_8.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/o/openssl-3.5.8-1.el9_8.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 53429735, + "sha256": "393e8694b8161826f67f149cd7dde6b63da96f02efc050fda651d265907f2c20" + }, + { + "filename": "openssl-fips-provider-3.0.7-11.el9_8.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/o/openssl-fips-provider-3.0.7-11.el9_8.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 28686020, + "sha256": "0b14c251cccb4506df185e78ec55cb49e14e7bcd8de19ad3f3246017b2120693" + }, + { + "filename": "p11-kit-0.26.4-1.el9_8.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/p/p11-kit-0.26.4-1.el9_8.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 1121232, + "sha256": "6f06a4f6812fce869528ff17ab002d655a8da18fc745eafa6c02594bb23dfeeb" + }, + { + "filename": "pam-1.5.1-28.el9_8.1.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/p/pam-1.5.1-28.el9_8.1.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 1142205, + "sha256": "fe61734fdb226915dff402bcd1ad2002e0fd7a4dad9042af65688804f428b30b" + }, + { + "filename": "pcre-8.44-4.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/p/pcre-8.44-4.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 1624356, + "sha256": "7edbd87b866a3f6e3df1426d660b902e063193d6186027bf99f6d77626a43817" + }, + { + "filename": "pcre2-10.40-6.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/p/pcre2-10.40-6.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 1789790, + "sha256": "a570f7192be555222aa3704882b9199fb013a84ad4d7dcf40a93d8de2ecf6e0a" + }, + { + "filename": "procps-ng-3.3.17-14.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/p/procps-ng-3.3.17-14.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 1054334, + "sha256": "acfd5c270ba5724a0f5f2a84cc47ee222d6a03095421fddbf6932375ec7d67f0" + }, + { + "filename": "readline-8.1-4.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/r/readline-8.1-4.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 3009702, + "sha256": "bc7a168b7275d1f9bd0f16b47029dd857ddce83fa80c3cb32eac63cb55f591f3" + }, + { + "filename": "redhat-release-9.8-1.0.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/r/redhat-release-9.8-1.0.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 85364, + "sha256": "6c3f4a1287fb76e05e49217a15a33b9c228a56fc06e96376afb37201bfbe32da" + }, + { + "filename": "sed-4.8-10.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/s/sed-4.8-10.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 1428416, + "sha256": "981073f2c251395b5ae42b7ff929f743260eea9738187fbb207042f11eae7ea7" + }, + { + "filename": "setup-2.13.7-10.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/s/setup-2.13.7-10.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 195940, + "sha256": "3acdbbd63bd77dd8b18210b9d597bd59ddf455ff728067638c54194ac3a8a32b" + }, + { + "filename": "shadow-utils-4.9-16.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/s/shadow-utils-4.9-16.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 1713058, + "sha256": "771a5ed07cdb690c75cd428a8113e2ee471270044e6cb8025d92c54e32c180ff" + }, + { + "filename": "systemd-252-67.el9_8.6.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/s/systemd-252-67.el9_8.6.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 45003976, + "sha256": "f535f4c20ed82f56cc7f4c86202e3cd582815f702bb0c24005a07a496ec94c97" + }, + { + "filename": "tzdata-2026c-1.el9_8.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/t/tzdata-2026c-1.el9_8.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 933774, + "sha256": "4cc10832b19807c03a30bd9317fb37dc811d2f13c11b1ed35af8d2efa481622f" + }, + { + "filename": "util-linux-2.37.4-25.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/u/util-linux-2.37.4-25.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 6291867, + "sha256": "6c788387cde9c0fde5481382f3f8416e3ecbcf09c908b409b6c63358b90a399f" + }, + { + "filename": "xz-5.2.5-8.el9_0.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/x/xz-5.2.5-8.el9_0.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 1168293, + "sha256": "bce98f3a307e75a8ac28f909e29b41d64b15461fa9ddf0bf4ef3c2f6de946b46" + }, + { + "filename": "zlib-1.2.11-40.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/z/zlib-1.2.11-40.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 561153, + "sha256": "e47b884c132983fd0cc40c761de72e1a34ada9ee395cfe50997f9fb9257669d8" + }, + { + "filename": "zstd-1.5.5-1.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/z/zstd-1.5.5-1.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 2378112, + "sha256": "922957570bae59b0a45bd9d96ce804c65c6c3260f50198f40804d95ffb0db65e" + } + ] +} diff --git a/artifacts/locks/arm64.json b/artifacts/locks/arm64.json new file mode 100644 index 0000000..4d45150 --- /dev/null +++ b/artifacts/locks/arm64.json @@ -0,0 +1,1646 @@ +{ + "schema_version": 1, + "bundle_version": 1, + "architecture": "arm64", + "rpm_architecture": "aarch64", + "generated_at": "2026-09-16T02:56:21Z", + "nginx_version": "1.30.4", + "nginx_rpm_version": "1.30.4-1.el9.ngx", + "base_images": { + "builder": { + "reference": "registry.access.redhat.com/ubi9/ubi-minimal:9.8@sha256:e5161a7d7d99cf22e4f34b72e111211a399d956d9b0e8714da18e9c4c8151041", + "digest": "sha256:e5161a7d7d99cf22e4f34b72e111211a399d956d9b0e8714da18e9c4c8151041", + "platform": "linux/arm64" + }, + "runtime": { + "reference": "registry.access.redhat.com/ubi9/ubi-micro:9.8@sha256:7a0454cbd9bd847e8f6a63b6f0254a6efbeb6e0ed71a5d824a4f6cccbe626650", + "digest": "sha256:7a0454cbd9bd847e8f6a63b6f0254a6efbeb6e0ed71a5d824a4f6cccbe626650", + "platform": "linux/arm64" + } + }, + "signing_keys": [ + { + "fingerprint": "8540A6F18833A80E9C1653A42FD21310B49F6B46", + "id": "nginx-signing", + "sha256": "55385da31d198fa6a5012d40ae98ecb272a6c4e8fffffba94719ffd3e87de37a", + "url": "https://nginx.org/keys/nginx_signing.key", + "filename": "nginx_signing.key" + }, + { + "fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "id": "redhat-release", + "sha256": "d4b2543626bee31d9438d4a31731aae712c072893c7aed8854f16c42fafc742b", + "url": "https://security.access.redhat.com/data/fd431d51.txt", + "filename": "fd431d51.txt" + }, + { + "fingerprint": "7E4624258C406535D56D6F135054E4A45A6340B3", + "id": "redhat-release-2", + "sha256": "d37ed8bd8bddb29983a38c6fde4e59d329e6a7c2ecbc702e929f0d05ae5eba59", + "url": "https://security.access.redhat.com/data/5a6340b3.txt", + "filename": "5a6340b3.txt" + } + ], + "packages": [ + { + "name": "acl", + "epoch": 0, + "version": "2.4.0", + "release": "1.el9_8", + "architecture": "aarch64", + "nevra": "acl-0:2.4.0-1.el9_8.aarch64", + "filename": "acl-2.4.0-1.el9_8.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/a/acl-2.4.0-1.el9_8.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 84537, + "sha256": "241864fdb68d73b5a63df6269ae0895aec7c08e723fb0506fe446c148c9dad3f", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "acl-2.4.0-1.el9_8.src.rpm" + }, + { + "name": "alternatives", + "epoch": 0, + "version": "1.24", + "release": "2.el9", + "architecture": "aarch64", + "nevra": "alternatives-0:1.24-2.el9.aarch64", + "filename": "alternatives-1.24-2.el9.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/a/alternatives-1.24-2.el9.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 42137, + "sha256": "6f7c0667ac015bc0d40836c9f55c73ebf65a209069f69aa8f58e6b4655c820a8", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "chkconfig-1.24-2.el9.src.rpm" + }, + { + "name": "audit-libs", + "epoch": 0, + "version": "3.1.5", + "release": "8.el9", + "architecture": "aarch64", + "nevra": "audit-libs-0:3.1.5-8.el9.aarch64", + "filename": "audit-libs-3.1.5-8.el9.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/a/audit-libs-3.1.5-8.el9.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 128901, + "sha256": "11880ec70b575841843cbee0853e03e50a0506321ea0a6f76c0c8145d79ae531", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "audit-3.1.5-8.el9.src.rpm" + }, + { + "name": "basesystem", + "epoch": 0, + "version": "11", + "release": "13.el9", + "architecture": "noarch", + "nevra": "basesystem-0:11-13.el9.noarch", + "filename": "basesystem-11-13.el9.noarch.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/b/basesystem-11-13.el9.noarch.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 8229, + "sha256": "f498b0813fa1a825d550e8e3a9e42255eabfa18e6fc96adfc6cc8fa7e16dd513", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "basesystem-11-13.el9.src.rpm" + }, + { + "name": "bash", + "epoch": 0, + "version": "5.1.8", + "release": "9.el9", + "architecture": "aarch64", + "nevra": "bash-0:5.1.8-9.el9.aarch64", + "filename": "bash-5.1.8-9.el9.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/b/bash-5.1.8-9.el9.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 1760045, + "sha256": "7dc1febec9c2fb184ed4407f8a188ab267b7e46b3534866f702c6266008ababa", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "bash-5.1.8-9.el9.src.rpm" + }, + { + "name": "bzip2-libs", + "epoch": 0, + "version": "1.0.8", + "release": "11.el9", + "architecture": "aarch64", + "nevra": "bzip2-libs-0:1.0.8-11.el9.aarch64", + "filename": "bzip2-libs-1.0.8-11.el9.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/b/bzip2-libs-1.0.8-11.el9.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 47655, + "sha256": "8267a866b9289ac4e4a92cb4642adcdeff97c2ed816ddda87ed5d5e9d9431a2f", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "bzip2-1.0.8-11.el9.src.rpm" + }, + { + "name": "ca-certificates", + "epoch": 0, + "version": "2025.2.80_v9.0.305", + "release": "91.el9", + "architecture": "noarch", + "nevra": "ca-certificates-0:2025.2.80_v9.0.305-91.el9.noarch", + "filename": "ca-certificates-2025.2.80_v9.0.305-91.el9.noarch.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/c/ca-certificates-2025.2.80_v9.0.305-91.el9.noarch.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 1072208, + "sha256": "0554bf65d573950e7d550a07bf7d0b3def85ca3b45a7fbde4cce7cadd9a476a7", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "ca-certificates-2025.2.80_v9.0.305-91.el9.src.rpm" + }, + { + "name": "coreutils", + "epoch": 0, + "version": "8.32", + "release": "41.el9_8.1", + "architecture": "aarch64", + "nevra": "coreutils-0:8.32-41.el9_8.1.aarch64", + "filename": "coreutils-8.32-41.el9_8.1.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/c/coreutils-8.32-41.el9_8.1.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 1175876, + "sha256": "22827aedd764c1ab706086965859e7f8fef0d719ac0b3d8735f6b8e53b0a13e9", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "coreutils-8.32-41.el9_8.1.src.rpm" + }, + { + "name": "coreutils-common", + "epoch": 0, + "version": "8.32", + "release": "41.el9_8.1", + "architecture": "aarch64", + "nevra": "coreutils-common-0:8.32-41.el9_8.1.aarch64", + "filename": "coreutils-common-8.32-41.el9_8.1.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/c/coreutils-common-8.32-41.el9_8.1.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 2115646, + "sha256": "b449955249a6d2da7369522a5ac2759919d36633e129ba88924057814906d5f5", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "coreutils-8.32-41.el9_8.1.src.rpm" + }, + { + "name": "cracklib", + "epoch": 0, + "version": "2.9.6", + "release": "28.el9", + "architecture": "aarch64", + "nevra": "cracklib-0:2.9.6-28.el9.aarch64", + "filename": "cracklib-2.9.6-28.el9.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/c/cracklib-2.9.6-28.el9.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 102026, + "sha256": "d85216b672a15e5dd8cc771b853e3b73e832034949ee23998d8403609fba00a2", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "cracklib-2.9.6-28.el9.src.rpm" + }, + { + "name": "cracklib-dicts", + "epoch": 0, + "version": "2.9.6", + "release": "28.el9", + "architecture": "aarch64", + "nevra": "cracklib-dicts-0:2.9.6-28.el9.aarch64", + "filename": "cracklib-dicts-2.9.6-28.el9.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/c/cracklib-dicts-2.9.6-28.el9.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 3829400, + "sha256": "807345f95c448cb58d4db8d059f76e4c139ef029887d59b431efd20db934745a", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "cracklib-2.9.6-28.el9.src.rpm" + }, + { + "name": "crypto-policies", + "epoch": 0, + "version": "20260224", + "release": "1.gitea0f072.el9_8", + "architecture": "noarch", + "nevra": "crypto-policies-0:20260224-1.gitea0f072.el9_8.noarch", + "filename": "crypto-policies-20260224-1.gitea0f072.el9_8.noarch.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/c/crypto-policies-20260224-1.gitea0f072.el9_8.noarch.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 98707, + "sha256": "a9ad86b8df75a7c9c29c6f6dd4b8f78cfa1f42b492eff0d11b82c457d37a7f9f", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "crypto-policies-20260224-1.gitea0f072.el9_8.src.rpm" + }, + { + "name": "dbus", + "epoch": 1, + "version": "1.12.20", + "release": "8.el9", + "architecture": "aarch64", + "nevra": "dbus-1:1.12.20-8.el9.aarch64", + "filename": "dbus-1.12.20-8.el9.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/d/dbus-1.12.20-8.el9.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 8025, + "sha256": "5178f638660d1699fb06caeeac91f41c07da59b500e94adf2653df892f2cbdf8", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "dbus-1.12.20-8.el9.src.rpm" + }, + { + "name": "dbus-broker", + "epoch": 0, + "version": "28", + "release": "9.el9_8", + "architecture": "aarch64", + "nevra": "dbus-broker-0:28-9.el9_8.aarch64", + "filename": "dbus-broker-28-9.el9_8.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/d/dbus-broker-28-9.el9_8.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 174219, + "sha256": "ffebc8de0cd9ed86122973be161b617aa46ce1e020f61f9e8e5a42246d4bd495", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "dbus-broker-28-9.el9_8.src.rpm" + }, + { + "name": "dbus-common", + "epoch": 1, + "version": "1.12.20", + "release": "8.el9", + "architecture": "noarch", + "nevra": "dbus-common-1:1.12.20-8.el9.noarch", + "filename": "dbus-common-1.12.20-8.el9.noarch.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/d/dbus-common-1.12.20-8.el9.noarch.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 18551, + "sha256": "298f1cada3cbcef6713098b9925694a0e30e8566f7a5bdbd72384520cf6c8360", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "dbus-1.12.20-8.el9.src.rpm" + }, + { + "name": "expat", + "epoch": 0, + "version": "2.5.0", + "release": "6.el9_8.3", + "architecture": "aarch64", + "nevra": "expat-0:2.5.0-6.el9_8.3.aarch64", + "filename": "expat-2.5.0-6.el9_8.3.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/e/expat-2.5.0-6.el9_8.3.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 122400, + "sha256": "df004398da989f75bae9267cfb0ad402ada6e6db46ebef0932c869894c013c08", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "expat-2.5.0-6.el9_8.3.src.rpm" + }, + { + "name": "filesystem", + "epoch": 0, + "version": "3.16", + "release": "5.el9", + "architecture": "aarch64", + "nevra": "filesystem-0:3.16-5.el9.aarch64", + "filename": "filesystem-3.16-5.el9.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/f/filesystem-3.16-5.el9.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 5003914, + "sha256": "484bc41109c49066cf350344150abe144e63263e0fafa0bf12c5a47f853e6a49", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "filesystem-3.16-5.el9.src.rpm" + }, + { + "name": "findutils", + "epoch": 1, + "version": "4.8.0", + "release": "7.el9", + "architecture": "aarch64", + "nevra": "findutils-1:4.8.0-7.el9.aarch64", + "filename": "findutils-4.8.0-7.el9.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/f/findutils-4.8.0-7.el9.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 564807, + "sha256": "158af4d5ecbd8b87f0da762ea1655bd4c86512071a95d8307eda3e0b3991105d", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "findutils-4.8.0-7.el9.src.rpm" + }, + { + "name": "glibc", + "epoch": 0, + "version": "2.34", + "release": "275.el9_8", + "architecture": "aarch64", + "nevra": "glibc-0:2.34-275.el9_8.aarch64", + "filename": "glibc-2.34-275.el9_8.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/g/glibc-2.34-275.el9_8.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 1813928, + "sha256": "e40a78100f731b5f5a1b235880a0aaad5b08bb32e6521e90535b7f4a94c6e9e9", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "glibc-2.34-275.el9_8.src.rpm" + }, + { + "name": "glibc-common", + "epoch": 0, + "version": "2.34", + "release": "275.el9_8", + "architecture": "aarch64", + "nevra": "glibc-common-0:2.34-275.el9_8.aarch64", + "filename": "glibc-common-2.34-275.el9_8.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/g/glibc-common-2.34-275.el9_8.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 312665, + "sha256": "24e1c7189d101531c526dd3cc1a42ab62d89f874824b54fb6b518ec24f190554", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "glibc-2.34-275.el9_8.src.rpm" + }, + { + "name": "glibc-minimal-langpack", + "epoch": 0, + "version": "2.34", + "release": "275.el9_8", + "architecture": "aarch64", + "nevra": "glibc-minimal-langpack-0:2.34-275.el9_8.aarch64", + "filename": "glibc-minimal-langpack-2.34-275.el9_8.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/g/glibc-minimal-langpack-2.34-275.el9_8.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 30881, + "sha256": "b1348c4c4fe3da979f342b0c27ff0d33a11688274a0b6708292d7750bbc8d853", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "glibc-2.34-275.el9_8.src.rpm" + }, + { + "name": "gmp", + "epoch": 1, + "version": "6.2.0", + "release": "13.el9", + "architecture": "aarch64", + "nevra": "gmp-1:6.2.0-13.el9.aarch64", + "filename": "gmp-6.2.0-13.el9.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/g/gmp-6.2.0-13.el9.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 275679, + "sha256": "df01d909e4613514b1844d6ca26d0bcdff8a659762e507188d04ed046fb0cec4", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "gmp-6.2.0-13.el9.src.rpm" + }, + { + "name": "grep", + "epoch": 0, + "version": "3.6", + "release": "5.el9", + "architecture": "aarch64", + "nevra": "grep-0:3.6-5.el9.aarch64", + "filename": "grep-3.6-5.el9.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/g/grep-3.6-5.el9.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 276244, + "sha256": "583a247a199901d44dc8a96d46010e15f6211f98f7c61ba089825155b0562520", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "grep-3.6-5.el9.src.rpm" + }, + { + "name": "gzip", + "epoch": 0, + "version": "1.12", + "release": "2.el9_8", + "architecture": "aarch64", + "nevra": "gzip-0:1.12-2.el9_8.aarch64", + "filename": "gzip-1.12-2.el9_8.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/g/gzip-1.12-2.el9_8.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 171305, + "sha256": "efafc848fdaa3a8e5e77baddc07abc7d800dc973efd44ecf492bc64dca4fabe6", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "gzip-1.12-2.el9_8.src.rpm" + }, + { + "name": "kmod-libs", + "epoch": 0, + "version": "28", + "release": "11.el9", + "architecture": "aarch64", + "nevra": "kmod-libs-0:28-11.el9.aarch64", + "filename": "kmod-libs-28-11.el9.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/k/kmod-libs-28-11.el9.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 62168, + "sha256": "58526b701eb3a72de98062c58b56524c35916a7b1191bb1a846da33be5a5f709", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "kmod-28-11.el9.src.rpm" + }, + { + "name": "libacl", + "epoch": 0, + "version": "2.4.0", + "release": "1.el9_8", + "architecture": "aarch64", + "nevra": "libacl-0:2.4.0-1.el9_8.aarch64", + "filename": "libacl-2.4.0-1.el9_8.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/l/libacl-2.4.0-1.el9_8.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 31468, + "sha256": "70ba010505e9805254f772c3dd9cd9e6176fc9e007e8c9be7204c44f85d8bbd2", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "acl-2.4.0-1.el9_8.src.rpm" + }, + { + "name": "libattr", + "epoch": 0, + "version": "2.6.0", + "release": "1.el9_8", + "architecture": "aarch64", + "nevra": "libattr-0:2.6.0-1.el9_8.aarch64", + "filename": "libattr-2.6.0-1.el9_8.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/l/libattr-2.6.0-1.el9_8.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 23276, + "sha256": "ec08036348dbe2ee41645bdb96eb485b9db5121ec0524258b0639426a22a49bc", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "attr-2.6.0-1.el9_8.src.rpm" + }, + { + "name": "libblkid", + "epoch": 0, + "version": "2.37.4", + "release": "25.el9", + "architecture": "aarch64", + "nevra": "libblkid-0:2.37.4-25.el9.aarch64", + "filename": "libblkid-2.37.4-25.el9.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/l/libblkid-2.37.4-25.el9.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 113931, + "sha256": "2c38ac06d3a267b62fc5ea4e149a25c4287c19157f4f18e0f7edea4787b27e15", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "util-linux-2.37.4-25.el9.src.rpm" + }, + { + "name": "libcap", + "epoch": 0, + "version": "2.48", + "release": "10.el9_8.1", + "architecture": "aarch64", + "nevra": "libcap-0:2.48-10.el9_8.1.aarch64", + "filename": "libcap-2.48-10.el9_8.1.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/l/libcap-2.48-10.el9_8.1.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 78021, + "sha256": "1ac3014c33b84d7a492b99d46d47940b096e034a3d5886e16ace7159724be012", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "libcap-2.48-10.el9_8.1.src.rpm" + }, + { + "name": "libcap-ng", + "epoch": 0, + "version": "0.8.2", + "release": "7.el9", + "architecture": "aarch64", + "nevra": "libcap-ng-0:0.8.2-7.el9.aarch64", + "filename": "libcap-ng-0.8.2-7.el9.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/l/libcap-ng-0.8.2-7.el9.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 36033, + "sha256": "dc4eae31749196c0043225c6749e7306ff71f081c09cbdb2fc98a561087c4474", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "libcap-ng-0.8.2-7.el9.src.rpm" + }, + { + "name": "libdb", + "epoch": 0, + "version": "5.3.28", + "release": "57.el9_6", + "architecture": "aarch64", + "nevra": "libdb-0:5.3.28-57.el9_6.aarch64", + "filename": "libdb-5.3.28-57.el9_6.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/l/libdb-5.3.28-57.el9_6.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 727417, + "sha256": "3a912b2a0a6226695a5773138ce5ce090c9fb155151dffe732b8d52e6dd22d63", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "libdb-5.3.28-57.el9_6.src.rpm" + }, + { + "name": "libeconf", + "epoch": 0, + "version": "0.4.1", + "release": "7.el9_8", + "architecture": "aarch64", + "nevra": "libeconf-0:0.4.1-7.el9_8.aarch64", + "filename": "libeconf-0.4.1-7.el9_8.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/l/libeconf-0.4.1-7.el9_8.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 32324, + "sha256": "8a5e117c2690c82835c6013f1fbac37b026f3e953fbffbd84c2f5ef6cf8df571", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "libeconf-0.4.1-7.el9_8.src.rpm" + }, + { + "name": "libfdisk", + "epoch": 0, + "version": "2.37.4", + "release": "25.el9", + "architecture": "aarch64", + "nevra": "libfdisk-0:2.37.4-25.el9.aarch64", + "filename": "libfdisk-2.37.4-25.el9.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/l/libfdisk-2.37.4-25.el9.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 156711, + "sha256": "af043918fc50ce5b3de50c48c3de0143140b692fbf639db6f259270c4211a776", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "util-linux-2.37.4-25.el9.src.rpm" + }, + { + "name": "libffi", + "epoch": 0, + "version": "3.4.2", + "release": "8.el9", + "architecture": "aarch64", + "nevra": "libffi-0:3.4.2-8.el9.aarch64", + "filename": "libffi-3.4.2-8.el9.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/l/libffi-3.4.2-8.el9.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 38554, + "sha256": "d33e180b97a603542cb6f1a78b1c3b0ce4af1bc59ee0bb32620c98a629726bc4", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "libffi-3.4.2-8.el9.src.rpm" + }, + { + "name": "libgcc", + "epoch": 0, + "version": "11.5.0", + "release": "14.el9", + "architecture": "aarch64", + "nevra": "libgcc-0:11.5.0-14.el9.aarch64", + "filename": "libgcc-11.5.0-14.el9.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/l/libgcc-11.5.0-14.el9.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 81211, + "sha256": "6923218fdef581189a4b51c7ba158083597f1c6df08cae021a1d90e9d61938a9", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "gcc-11.5.0-14.el9.src.rpm" + }, + { + "name": "libgcrypt", + "epoch": 0, + "version": "1.10.0", + "release": "13.el9_8", + "architecture": "aarch64", + "nevra": "libgcrypt-0:1.10.0-13.el9_8.aarch64", + "filename": "libgcrypt-1.10.0-13.el9_8.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/l/libgcrypt-1.10.0-13.el9_8.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 469908, + "sha256": "4a270fae0cf2f5ad846ce530664bbde72e798bb4a8196afb8fd2db93086c31c9", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "libgcrypt-1.10.0-13.el9_8.src.rpm" + }, + { + "name": "libgpg-error", + "epoch": 0, + "version": "1.42", + "release": "5.el9", + "architecture": "aarch64", + "nevra": "libgpg-error-0:1.42-5.el9.aarch64", + "filename": "libgpg-error-1.42-5.el9.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/l/libgpg-error-1.42-5.el9.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 222476, + "sha256": "aee968114aed0238eb26cff42ec9b0819ad32e2bac99aa8124d55b480806aca5", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "libgpg-error-1.42-5.el9.src.rpm" + }, + { + "name": "libmount", + "epoch": 0, + "version": "2.37.4", + "release": "25.el9", + "architecture": "aarch64", + "nevra": "libmount-0:2.37.4-25.el9.aarch64", + "filename": "libmount-2.37.4-25.el9.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/l/libmount-2.37.4-25.el9.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 140081, + "sha256": "152aee3abc8d97a37ff4ce2f5027d7e16e93ff2c77d25e900258da54e6fcc64e", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "util-linux-2.37.4-25.el9.src.rpm" + }, + { + "name": "libpwquality", + "epoch": 0, + "version": "1.4.4", + "release": "8.el9", + "architecture": "aarch64", + "nevra": "libpwquality-0:1.4.4-8.el9.aarch64", + "filename": "libpwquality-1.4.4-8.el9.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/l/libpwquality-1.4.4-8.el9.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 125712, + "sha256": "1657d94bbd79f93dc7a79d474316813bde681ce3a7f62f73314ec4d630e39349", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "libpwquality-1.4.4-8.el9.src.rpm" + }, + { + "name": "libseccomp", + "epoch": 0, + "version": "2.5.2", + "release": "2.el9", + "architecture": "aarch64", + "nevra": "libseccomp-0:2.5.2-2.el9.aarch64", + "filename": "libseccomp-2.5.2-2.el9.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/l/libseccomp-2.5.2-2.el9.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 76024, + "sha256": "fc1d5e93483d166ca7f2acb50c04c181db2f3e7b89dba8edc6b1e5f2b0f10619", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "libseccomp-2.5.2-2.el9.src.rpm" + }, + { + "name": "libselinux", + "epoch": 0, + "version": "3.6", + "release": "3.el9", + "architecture": "aarch64", + "nevra": "libselinux-0:3.6-3.el9.aarch64", + "filename": "libselinux-3.6-3.el9.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/l/libselinux-3.6-3.el9.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 89531, + "sha256": "3d7249adbf19206e319cd24acc2e01b0da39975aa3e5af73bdb6c6d438108fac", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "libselinux-3.6-3.el9.src.rpm" + }, + { + "name": "libsemanage", + "epoch": 0, + "version": "3.6", + "release": "5.el9_6", + "architecture": "aarch64", + "nevra": "libsemanage-0:3.6-5.el9_6.aarch64", + "filename": "libsemanage-3.6-5.el9_6.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/l/libsemanage-3.6-5.el9_6.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 120963, + "sha256": "233d8270827b9166ad11827599800d2a09284d29e73af09c7a12bae251a9463c", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "libsemanage-3.6-5.el9_6.src.rpm" + }, + { + "name": "libsepol", + "epoch": 0, + "version": "3.6", + "release": "3.el9", + "architecture": "aarch64", + "nevra": "libsepol-0:3.6-3.el9.aarch64", + "filename": "libsepol-3.6-3.el9.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/l/libsepol-3.6-3.el9.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 326966, + "sha256": "496ed9e2d7fac9704afe764eab4c2c43b4a47e8c229c14498dd19786f98f80c0", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "libsepol-3.6-3.el9.src.rpm" + }, + { + "name": "libsigsegv", + "epoch": 0, + "version": "2.13", + "release": "4.el9", + "architecture": "aarch64", + "nevra": "libsigsegv-0:2.13-4.el9.aarch64", + "filename": "libsigsegv-2.13-4.el9.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/l/libsigsegv-2.13-4.el9.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 30566, + "sha256": "0998ac158161c9d5f3b97c5dc6e35becd84da0ddc5d347a8af581ada529b3b5c", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "libsigsegv-2.13-4.el9.src.rpm" + }, + { + "name": "libsmartcols", + "epoch": 0, + "version": "2.37.4", + "release": "25.el9", + "architecture": "aarch64", + "nevra": "libsmartcols-0:2.37.4-25.el9.aarch64", + "filename": "libsmartcols-2.37.4-25.el9.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/l/libsmartcols-2.37.4-25.el9.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 67440, + "sha256": "1704e73a566c920796d877c7bc3e5a96ea0c0c4194109c7b085c1128c01856af", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "util-linux-2.37.4-25.el9.src.rpm" + }, + { + "name": "libtasn1", + "epoch": 0, + "version": "4.16.0", + "release": "10.el9_8", + "architecture": "aarch64", + "nevra": "libtasn1-0:4.16.0-10.el9_8.aarch64", + "filename": "libtasn1-4.16.0-10.el9_8.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/l/libtasn1-4.16.0-10.el9_8.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 80446, + "sha256": "322524934c9b1f0714d2299705dbd41ec93451078e8144babc88c51bd19f6e07", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "libtasn1-4.16.0-10.el9_8.src.rpm" + }, + { + "name": "libutempter", + "epoch": 0, + "version": "1.2.1", + "release": "6.el9", + "architecture": "aarch64", + "nevra": "libutempter-0:1.2.1-6.el9.aarch64", + "filename": "libutempter-1.2.1-6.el9.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/l/libutempter-1.2.1-6.el9.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 30505, + "sha256": "d352371cbb7d5bd0c53fc699df953c8c1f184b056690b3c4571e57a6634015c5", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "libutempter-1.2.1-6.el9.src.rpm" + }, + { + "name": "libuuid", + "epoch": 0, + "version": "2.37.4", + "release": "25.el9", + "architecture": "aarch64", + "nevra": "libuuid-0:2.37.4-25.el9.aarch64", + "filename": "libuuid-2.37.4-25.el9.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/l/libuuid-2.37.4-25.el9.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 32555, + "sha256": "4d7bb4144053a30067a82423fb6e88fd08c7a69bd256eb21b08c0e3f4dbbaee6", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "util-linux-2.37.4-25.el9.src.rpm" + }, + { + "name": "libxcrypt", + "epoch": 0, + "version": "4.4.18", + "release": "3.el9", + "architecture": "aarch64", + "nevra": "libxcrypt-0:4.4.18-3.el9.aarch64", + "filename": "libxcrypt-4.4.18-3.el9.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/l/libxcrypt-4.4.18-3.el9.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 127655, + "sha256": "f05030123425a5033bcca3f260313cafc199bc7bca57e9fb13c335bd087c35a7", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "libxcrypt-4.4.18-3.el9.src.rpm" + }, + { + "name": "libzstd", + "epoch": 0, + "version": "1.5.5", + "release": "1.el9", + "architecture": "aarch64", + "nevra": "libzstd-0:1.5.5-1.el9.aarch64", + "filename": "libzstd-1.5.5-1.el9.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/l/libzstd-1.5.5-1.el9.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 283159, + "sha256": "1229ed44dc7a68278682d7697c41d0abd7daedd242d90c6dc58a9aa6e76f9e6f", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "zstd-1.5.5-1.el9.src.rpm" + }, + { + "name": "lz4-libs", + "epoch": 0, + "version": "1.9.3", + "release": "5.el9", + "architecture": "aarch64", + "nevra": "lz4-libs-0:1.9.3-5.el9.aarch64", + "filename": "lz4-libs-1.9.3-5.el9.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/l/lz4-libs-1.9.3-5.el9.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 70696, + "sha256": "e1dbd2c38a65b135427c7c8fe988ea70dc95f7e26c4c8177b7dcb23925020015", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "lz4-1.9.3-5.el9.src.rpm" + }, + { + "name": "ncurses-base", + "epoch": 0, + "version": "6.2", + "release": "12.20210508.el9", + "architecture": "noarch", + "nevra": "ncurses-base-0:6.2-12.20210508.el9.noarch", + "filename": "ncurses-base-6.2-12.20210508.el9.noarch.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/n/ncurses-base-6.2-12.20210508.el9.noarch.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 97840, + "sha256": "d62dfd41f9688efa2cf1ceedb96084c63e297fbdcfd1e72bc6757c730092b60c", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "ncurses-6.2-12.20210508.el9.src.rpm" + }, + { + "name": "ncurses-libs", + "epoch": 0, + "version": "6.2", + "release": "12.20210508.el9", + "architecture": "aarch64", + "nevra": "ncurses-libs-0:6.2-12.20210508.el9.aarch64", + "filename": "ncurses-libs-6.2-12.20210508.el9.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/n/ncurses-libs-6.2-12.20210508.el9.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 324624, + "sha256": "b5dd452392d2f97bb050c9f5e5376998652c567dcbd8f035d26659b1b551b5c9", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "ncurses-6.2-12.20210508.el9.src.rpm" + }, + { + "name": "nginx", + "epoch": 2, + "version": "1.30.4", + "release": "1.el9.ngx", + "architecture": "aarch64", + "nevra": "nginx-2:1.30.4-1.el9.ngx.aarch64", + "filename": "nginx-1.30.4-1.el9.ngx.aarch64.rpm", + "url": "https://nginx.org/packages/rhel/9/aarch64/RPMS/nginx-1.30.4-1.el9.ngx.aarch64.rpm", + "repository": "nginx-stable", + "size": 1090392, + "sha256": "7b26ea1724ab5276413fa702f95003e5517aed1b3e88c17012f79285df051ec3", + "signing_key_fingerprint": "8540A6F18833A80E9C1653A42FD21310B49F6B46", + "source_rpm": "nginx-1.30.4-1.el9.ngx.src.rpm" + }, + { + "name": "openssl", + "epoch": 1, + "version": "3.5.8", + "release": "1.el9_8", + "architecture": "aarch64", + "nevra": "openssl-1:3.5.8-1.el9_8.aarch64", + "filename": "openssl-3.5.8-1.el9_8.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/o/openssl-3.5.8-1.el9_8.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 1546056, + "sha256": "1ef4001b9a9df4695c80e986d3c8ceb7900bb6925f86fde09d16aff9f8d733f5", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "openssl-3.5.8-1.el9_8.src.rpm" + }, + { + "name": "openssl-fips-provider", + "epoch": 0, + "version": "3.0.7", + "release": "11.el9_8", + "architecture": "aarch64", + "nevra": "openssl-fips-provider-0:3.0.7-11.el9_8.aarch64", + "filename": "openssl-fips-provider-3.0.7-11.el9_8.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/o/openssl-fips-provider-3.0.7-11.el9_8.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 14220, + "sha256": "158193d2f965db318148ec76e9347b530ac1f5379d849012c0a04d3c50cda478", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "openssl-fips-provider-3.0.7-11.el9_8.src.rpm" + }, + { + "name": "openssl-fips-provider-so", + "epoch": 0, + "version": "3.0.7", + "release": "11.el9_8", + "architecture": "aarch64", + "nevra": "openssl-fips-provider-so-0:3.0.7-11.el9_8.aarch64", + "filename": "openssl-fips-provider-so-3.0.7-11.el9_8.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/o/openssl-fips-provider-so-3.0.7-11.el9_8.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 529340, + "sha256": "22374a51f8a529dcfcf3b3ebbb2095103e0e811a28953535e5a62e26d1233301", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "openssl-fips-provider-3.0.7-11.el9_8.src.rpm" + }, + { + "name": "openssl-libs", + "epoch": 1, + "version": "3.5.8", + "release": "1.el9_8", + "architecture": "aarch64", + "nevra": "openssl-libs-1:3.5.8-1.el9_8.aarch64", + "filename": "openssl-libs-3.5.8-1.el9_8.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/o/openssl-libs-3.5.8-1.el9_8.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 2294194, + "sha256": "23134af6ea097b94d8261367db01f91604ef3b508654caf4f7399e5c142abcc8", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "openssl-3.5.8-1.el9_8.src.rpm" + }, + { + "name": "p11-kit", + "epoch": 0, + "version": "0.26.4", + "release": "1.el9_8", + "architecture": "aarch64", + "nevra": "p11-kit-0:0.26.4-1.el9_8.aarch64", + "filename": "p11-kit-0.26.4-1.el9_8.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/p/p11-kit-0.26.4-1.el9_8.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 589112, + "sha256": "b9391ea6618098782c9325ccda3c9ca8bc0f3b035bd4f113a793cea18026c75e", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "p11-kit-0.26.4-1.el9_8.src.rpm" + }, + { + "name": "p11-kit-trust", + "epoch": 0, + "version": "0.26.4", + "release": "1.el9_8", + "architecture": "aarch64", + "nevra": "p11-kit-trust-0:0.26.4-1.el9_8.aarch64", + "filename": "p11-kit-trust-0.26.4-1.el9_8.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/p/p11-kit-trust-0.26.4-1.el9_8.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 162392, + "sha256": "a57761123cd5836faf3d40251d16124557ffb452443bfa14cf59ac16e6c99970", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "p11-kit-0.26.4-1.el9_8.src.rpm" + }, + { + "name": "pam", + "epoch": 0, + "version": "1.5.1", + "release": "28.el9_8.1", + "architecture": "aarch64", + "nevra": "pam-0:1.5.1-28.el9_8.1.aarch64", + "filename": "pam-1.5.1-28.el9_8.1.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/p/pam-1.5.1-28.el9_8.1.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 642233, + "sha256": "12271815e3a5d35dbc4a8e1e3b52442b0d00b833816ef3a923da427a3bca561a", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "pam-1.5.1-28.el9_8.1.src.rpm" + }, + { + "name": "pcre", + "epoch": 0, + "version": "8.44", + "release": "4.el9", + "architecture": "aarch64", + "nevra": "pcre-0:8.44-4.el9.aarch64", + "filename": "pcre-8.44-4.el9.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/p/pcre-8.44-4.el9.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 187289, + "sha256": "099feef7e71b82cf0234e37d824fc81353d51dee55694e05181fa686ab50efae", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "pcre-8.44-4.el9.src.rpm" + }, + { + "name": "pcre2", + "epoch": 0, + "version": "10.40", + "release": "6.el9", + "architecture": "aarch64", + "nevra": "pcre2-0:10.40-6.el9.aarch64", + "filename": "pcre2-10.40-6.el9.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/p/pcre2-10.40-6.el9.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 224938, + "sha256": "29285f81cef68f73b4f8ff81ee8fdf4ceaa007933302119ed1615e4aa1091613", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "pcre2-10.40-6.el9.src.rpm" + }, + { + "name": "pcre2-syntax", + "epoch": 0, + "version": "10.40", + "release": "6.el9", + "architecture": "noarch", + "nevra": "pcre2-syntax-0:10.40-6.el9.noarch", + "filename": "pcre2-syntax-10.40-6.el9.noarch.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/p/pcre2-syntax-10.40-6.el9.noarch.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 147926, + "sha256": "d386b5e9b3a4b077b2ba143882e605750855dd3354f13c55fa12ed26908cb442", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "pcre2-10.40-6.el9.src.rpm" + }, + { + "name": "procps-ng", + "epoch": 0, + "version": "3.3.17", + "release": "14.el9", + "architecture": "aarch64", + "nevra": "procps-ng-0:3.3.17-14.el9.aarch64", + "filename": "procps-ng-3.3.17-14.el9.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/p/procps-ng-3.3.17-14.el9.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 363344, + "sha256": "a8c7514beb4c3cafa6341f43bbe285319d863b2893a34d91159dc8e90f615dd2", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "procps-ng-3.3.17-14.el9.src.rpm" + }, + { + "name": "readline", + "epoch": 0, + "version": "8.1", + "release": "4.el9", + "architecture": "aarch64", + "nevra": "readline-0:8.1-4.el9.aarch64", + "filename": "readline-8.1-4.el9.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/r/readline-8.1-4.el9.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 219015, + "sha256": "2ae424b368c6747124b51b205b9e11d74aeaff56b3de90e8cbd36012e0d17707", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "readline-8.1-4.el9.src.rpm" + }, + { + "name": "redhat-release", + "epoch": 0, + "version": "9.8", + "release": "1.0.el9", + "architecture": "aarch64", + "nevra": "redhat-release-0:9.8-1.0.el9.aarch64", + "filename": "redhat-release-9.8-1.0.el9.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/r/redhat-release-9.8-1.0.el9.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 61683, + "sha256": "fa7f1d93927c7f8c6f6563a8d221af659074f026e4b12cd74d456b0db1878164", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "redhat-release-9.8-1.0.el9.src.rpm" + }, + { + "name": "sed", + "epoch": 0, + "version": "4.8", + "release": "10.el9", + "architecture": "aarch64", + "nevra": "sed-0:4.8-10.el9.aarch64", + "filename": "sed-4.8-10.el9.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/s/sed-4.8-10.el9.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 315893, + "sha256": "b73d314a8ef322a690bb69c49cb0dbd9a5ff18d2ba6b2973e18d2c076a52b62a", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "sed-4.8-10.el9.src.rpm" + }, + { + "name": "setup", + "epoch": 0, + "version": "2.13.7", + "release": "10.el9", + "architecture": "noarch", + "nevra": "setup-0:2.13.7-10.el9.noarch", + "filename": "setup-2.13.7-10.el9.noarch.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/s/setup-2.13.7-10.el9.noarch.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 153791, + "sha256": "0891d395ce067121c28932534237ad1ce231f2bfa987411ad62e73a12d11eb6a", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "setup-2.13.7-10.el9.src.rpm" + }, + { + "name": "shadow-utils", + "epoch": 2, + "version": "4.9", + "release": "16.el9", + "architecture": "aarch64", + "nevra": "shadow-utils-2:4.9-16.el9.aarch64", + "filename": "shadow-utils-4.9-16.el9.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/s/shadow-utils-4.9-16.el9.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 1244527, + "sha256": "ccc46a8ea5f30d071e075ad53b5d39d191cfca4614090435528f2d2f944f88a2", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "shadow-utils-4.9-16.el9.src.rpm" + }, + { + "name": "systemd", + "epoch": 0, + "version": "252", + "release": "67.el9_8.6", + "architecture": "aarch64", + "nevra": "systemd-0:252-67.el9_8.6.aarch64", + "filename": "systemd-252-67.el9_8.6.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/s/systemd-252-67.el9_8.6.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 4135917, + "sha256": "758ae3df6d76cace670ce7af7caa557a7cf8807a2160ccb30c49f7d8ec018749", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "systemd-252-67.el9_8.6.src.rpm" + }, + { + "name": "systemd-libs", + "epoch": 0, + "version": "252", + "release": "67.el9_8.6", + "architecture": "aarch64", + "nevra": "systemd-libs-0:252-67.el9_8.6.aarch64", + "filename": "systemd-libs-252-67.el9_8.6.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/s/systemd-libs-252-67.el9_8.6.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 629233, + "sha256": "55e58c413ee69f19a69ba25905f96343076e21abe54cdff51f0d80e48be06769", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "systemd-252-67.el9_8.6.src.rpm" + }, + { + "name": "systemd-pam", + "epoch": 0, + "version": "252", + "release": "67.el9_8.6", + "architecture": "aarch64", + "nevra": "systemd-pam-0:252-67.el9_8.6.aarch64", + "filename": "systemd-pam-252-67.el9_8.6.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/s/systemd-pam-252-67.el9_8.6.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 247880, + "sha256": "736a6bbb73b0ef682ddfe356bb49578c2a8f17c6685ca762fcc1636003a4f5f3", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "systemd-252-67.el9_8.6.src.rpm" + }, + { + "name": "systemd-rpm-macros", + "epoch": 0, + "version": "252", + "release": "67.el9_8.6", + "architecture": "noarch", + "nevra": "systemd-rpm-macros-0:252-67.el9_8.6.noarch", + "filename": "systemd-rpm-macros-252-67.el9_8.6.noarch.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/s/systemd-rpm-macros-252-67.el9_8.6.noarch.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 40844, + "sha256": "974a0352427799559a3e90dcdb38200d767631452cca7717c5b0fbe7760df313", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "systemd-252-67.el9_8.6.src.rpm" + }, + { + "name": "tzdata", + "epoch": 0, + "version": "2026c", + "release": "1.el9_8", + "architecture": "noarch", + "nevra": "tzdata-0:2026c-1.el9_8.noarch", + "filename": "tzdata-2026c-1.el9_8.noarch.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/t/tzdata-2026c-1.el9_8.noarch.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 933286, + "sha256": "8d6196e02853c0900c3c2e2367665beffb62cb2d0ff5f465ea2d00848a9a35dc", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "tzdata-2026c-1.el9_8.src.rpm" + }, + { + "name": "util-linux", + "epoch": 0, + "version": "2.37.4", + "release": "25.el9", + "architecture": "aarch64", + "nevra": "util-linux-0:2.37.4-25.el9.aarch64", + "filename": "util-linux-2.37.4-25.el9.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/u/util-linux-2.37.4-25.el9.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 2390152, + "sha256": "3681bbe37d46309673f366135787f5713f0ef575e3cd413cd221af2512e3634b", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "util-linux-2.37.4-25.el9.src.rpm" + }, + { + "name": "util-linux-core", + "epoch": 0, + "version": "2.37.4", + "release": "25.el9", + "architecture": "aarch64", + "nevra": "util-linux-core-0:2.37.4-25.el9.aarch64", + "filename": "util-linux-core-2.37.4-25.el9.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/u/util-linux-core-2.37.4-25.el9.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 472949, + "sha256": "de7ad826dd42b383d93f6dc6b720a26d4cd4815d00c0f093c2e28037a8881424", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "util-linux-2.37.4-25.el9.src.rpm" + }, + { + "name": "xz-libs", + "epoch": 0, + "version": "5.2.5", + "release": "8.el9_0", + "architecture": "aarch64", + "nevra": "xz-libs-0:5.2.5-8.el9_0.aarch64", + "filename": "xz-libs-5.2.5-8.el9_0.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/x/xz-libs-5.2.5-8.el9_0.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 94569, + "sha256": "06931afb372ed4a6893e51558beaa6b0eab7adda0af93456fd99a081a8b80779", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "xz-5.2.5-8.el9_0.src.rpm" + }, + { + "name": "zlib", + "epoch": 0, + "version": "1.2.11", + "release": "40.el9", + "architecture": "aarch64", + "nevra": "zlib-0:1.2.11-40.el9.aarch64", + "filename": "zlib-1.2.11-40.el9.aarch64.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/z/zlib-1.2.11-40.el9.aarch64.rpm", + "repository": "ubi-9-baseos-rpms", + "size": 94454, + "sha256": "2e7f193e67235130c10f5579c2d2ec92e22e4098b6d12fb2855d93b1540c60f7", + "signing_key_fingerprint": "567E347AD0044ADE55BA8A5F199E2F91FD431D51", + "source_rpm": "zlib-1.2.11-40.el9.src.rpm" + } + ], + "source_packages": [ + { + "filename": "acl-2.4.0-1.el9_8.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/a/acl-2.4.0-1.el9_8.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 609918, + "sha256": "b140deb68f46517b0093e18969d8fb42a17216064fb2ee5783e9316d786430db" + }, + { + "filename": "attr-2.6.0-1.el9_8.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/a/attr-2.6.0-1.el9_8.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 389805, + "sha256": "9bdd2e605e0ddc9818382bd95644594fa8b8eedfe08048303093db13cde9963c" + }, + { + "filename": "audit-3.1.5-8.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/a/audit-3.1.5-8.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 1275064, + "sha256": "e0a3e72c863512032e0ba95337db076fa5af9368d9a80529a9624afc8877401c" + }, + { + "filename": "basesystem-11-13.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/b/basesystem-11-13.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 9884, + "sha256": "5a4ed0779fc06f08115d6e06aa95486f1e1e251f8f9ddb6c7e14e811bb2e24ef" + }, + { + "filename": "bash-5.1.8-9.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/b/bash-5.1.8-9.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 10512850, + "sha256": "5d7bbbf2538361be1a11846602862c3a56809b3ea43b69b86bcf407538e9e260" + }, + { + "filename": "bzip2-1.0.8-11.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/b/bzip2-1.0.8-11.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 828199, + "sha256": "ba58283fc4ef85911f20a8e45ffa00497775858102d48f2a32ebf1010a1abefc" + }, + { + "filename": "ca-certificates-2025.2.80_v9.0.305-91.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/c/ca-certificates-2025.2.80_v9.0.305-91.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 711648, + "sha256": "d3193e155ddd297042a944729fe54c1b90c17bdbd1876fc68e4f66d7857f9e81" + }, + { + "filename": "chkconfig-1.24-2.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/c/chkconfig-1.24-2.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 214658, + "sha256": "b2618b278f5c8d6dacfae790c8c73b1fc1578b8f64011f325ced5a4a2e3b58bc" + }, + { + "filename": "coreutils-8.32-41.el9_8.1.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/c/coreutils-8.32-41.el9_8.1.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 5697510, + "sha256": "5852781d2fbb2c447c4425960f4fe30310870a0e4073363d2254047b785b5a9e" + }, + { + "filename": "cracklib-2.9.6-28.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/c/cracklib-2.9.6-28.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 6416053, + "sha256": "4708420bdde578448be8c06a6b608635743682f6370d7d45d7cae46842529fa0" + }, + { + "filename": "crypto-policies-20260224-1.gitea0f072.el9_8.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/c/crypto-policies-20260224-1.gitea0f072.el9_8.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 112905, + "sha256": "775d926429179caeade6af8dc7dea15a0bea49102c2592d5b712f996a329ec38" + }, + { + "filename": "dbus-1.12.20-8.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/d/dbus-1.12.20-8.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 2143916, + "sha256": "3fe74a2b4fb4485c93e974010d9376e30a63dfcc628bfd6c01837c27b4953912" + }, + { + "filename": "dbus-broker-28-9.el9_8.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/d/dbus-broker-28-9.el9_8.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 258866, + "sha256": "9ccbb440edb6826689fd5e0d650de4f08550c3c0f3b2732c54c1e99b0d361824" + }, + { + "filename": "expat-2.5.0-6.el9_8.3.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/e/expat-2.5.0-6.el9_8.3.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 8403095, + "sha256": "0cff2a2213384dc43eb1874bf6e77b2b8230be848f50387d8057e0e6cde3d392" + }, + { + "filename": "filesystem-3.16-5.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/f/filesystem-3.16-5.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 20486, + "sha256": "c795690df30c46e521372e2f649c995a2abc159b76c8ef6cd5da8a713ea17937" + }, + { + "filename": "findutils-4.8.0-7.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/f/findutils-4.8.0-7.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 2010585, + "sha256": "48bd4d4dd081120bcc6ab772b930a150f30b2fc89a4a14a24220383d24a30b3f" + }, + { + "filename": "gcc-11.5.0-14.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/g/gcc-11.5.0-14.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 81978017, + "sha256": "19dec462f2880508570ca42a82c2f76fbd95fcad8d3e3ff812e9ca50cdeb2d8f" + }, + { + "filename": "glibc-2.34-275.el9_8.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/g/glibc-2.34-275.el9_8.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 20442764, + "sha256": "bd7a453f66e13da24d073f53070c2d209fcd88ca2aaa24ab3b2f81cae198b46c" + }, + { + "filename": "gmp-6.2.0-13.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/g/gmp-6.2.0-13.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 2503825, + "sha256": "d0d8a795eea9ae555da63fbcfc3575425e86bb7e96d117b9ae2785b4f5e82f7c" + }, + { + "filename": "grep-3.6-5.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/g/grep-3.6-5.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 1620891, + "sha256": "81b14432ebe1645b74b57592f1dcde8fab15ec13632f483f72ff2407ed16c33e" + }, + { + "filename": "gzip-1.12-2.el9_8.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/g/gzip-1.12-2.el9_8.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 859023, + "sha256": "f28fcbe8f3de2ec7dcdb51b1f51f03f61d0afa18c9fef10d210f40ff0c71f3a0" + }, + { + "filename": "kmod-28-11.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/k/kmod-28-11.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 579198, + "sha256": "4f6fefbf0d004b23494fe18ccfff2b9151ea887a276c56a6f25ea597a250991c" + }, + { + "filename": "libcap-2.48-10.el9_8.1.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/l/libcap-2.48-10.el9_8.1.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 208035, + "sha256": "7f96d98c99f190b840985b3589183a3f1dc444e0932f256491b24d28c5031de3" + }, + { + "filename": "libcap-ng-0.8.2-7.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/l/libcap-ng-0.8.2-7.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 470599, + "sha256": "48bb098662e2f3e1dbb94e27e4e612bc6794fbb62708e1f1a431cc2480fcdb00" + }, + { + "filename": "libdb-5.3.28-57.el9_6.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/l/libdb-5.3.28-57.el9_6.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 35290920, + "sha256": "6a74a3d96bd4657659524050945e2a47e93779addf2de374a13e1baf32b4ab8d" + }, + { + "filename": "libeconf-0.4.1-7.el9_8.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/l/libeconf-0.4.1-7.el9_8.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 206886, + "sha256": "425009c96135f39ca7bdb8a6ea948187d052d339dd76235979439fbd169da331" + }, + { + "filename": "libffi-3.4.2-8.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/l/libffi-3.4.2-8.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 1367398, + "sha256": "2b384204cc70c8f23d3a86e5cc9f736306a7a91a72e282044e3b23f3fd831647" + }, + { + "filename": "libgcrypt-1.10.0-13.el9_8.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/l/libgcrypt-1.10.0-13.el9_8.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 3983873, + "sha256": "c2737830c577d7c45aefa3213d770be924617a46e6ab56824edec9b6341af8d4" + }, + { + "filename": "libgpg-error-1.42-5.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/l/libgpg-error-1.42-5.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 994101, + "sha256": "9586046fd9622e5e898f92a08821948bf0754a74ab343cc093ca21caae0352a6" + }, + { + "filename": "libpwquality-1.4.4-8.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/l/libpwquality-1.4.4-8.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 447225, + "sha256": "14fbf335e2c6f22b441a9750a69b7c41e197c4dd21adac701fd81f17660ee0b4" + }, + { + "filename": "libseccomp-2.5.2-2.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/l/libseccomp-2.5.2-2.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 653169, + "sha256": "43dd0fa2cd26306e2017704075e628bbe675c8731b17848df82f3b59337f1be8" + }, + { + "filename": "libselinux-3.6-3.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/l/libselinux-3.6-3.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 271153, + "sha256": "a08a84389665ef614eb6d9b06a53128eab89b650c799c0558f3ae04df97c4b13" + }, + { + "filename": "libsemanage-3.6-5.el9_6.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/l/libsemanage-3.6-5.el9_6.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 223978, + "sha256": "33e4ad8374bdaa1dd4b4a46b2b379d025590d80e5d666801aea4f437a9a6ccd9" + }, + { + "filename": "libsepol-3.6-3.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/l/libsepol-3.6-3.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 543960, + "sha256": "2dacf2f1c1f61562ccc5ad082939158745e5a4a572d135d4f8ff00f75e1e94df" + }, + { + "filename": "libsigsegv-2.13-4.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/l/libsigsegv-2.13-4.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 473267, + "sha256": "734651070d0113de033da80114b416931c4c0be21ce51f6b1c1641b1185c34f3" + }, + { + "filename": "libtasn1-4.16.0-10.el9_8.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/l/libtasn1-4.16.0-10.el9_8.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 1899881, + "sha256": "be5c3a993282ecde81ad5d00dd4e7b2c293e97e47d28709aa0ea7292b80ba610" + }, + { + "filename": "libutempter-1.2.1-6.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/l/libutempter-1.2.1-6.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 30093, + "sha256": "e48843d2734fefad084a86165860ea9575bdc53f63bb5845d8807ce9ccb4f914" + }, + { + "filename": "libxcrypt-4.4.18-3.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/l/libxcrypt-4.4.18-3.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 543970, + "sha256": "d18f72eb41ecd0370e2e47f1dc5774be54e9ff3b4dd333578017666c7c488f40" + }, + { + "filename": "lz4-1.9.3-5.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/l/lz4-1.9.3-5.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 333421, + "sha256": "44e9e079f0f30476a0d8d9849ef1cd940fcc37abee11f481d6043b184bd0cf14" + }, + { + "filename": "ncurses-6.2-12.20210508.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/n/ncurses-6.2-12.20210508.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 3586993, + "sha256": "cdb59ed3771a3a4f00e2ffca853f2de4aa887e3d5c3655317f2e2c03f461103f" + }, + { + "filename": "nginx-1.30.4-1.el9.ngx.src.rpm", + "url": "https://nginx.org/packages/rhel/9/SRPMS/nginx-1.30.4-1.el9.ngx.src.rpm", + "repository": "nginx-stable-source", + "size": 1348940, + "sha256": "c04bda3049ba9f850a61a64fa311990e58fcc76fd8df9e25bce15b6b4a645dc8" + }, + { + "filename": "openssl-3.5.8-1.el9_8.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/o/openssl-3.5.8-1.el9_8.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 53429735, + "sha256": "393e8694b8161826f67f149cd7dde6b63da96f02efc050fda651d265907f2c20" + }, + { + "filename": "openssl-fips-provider-3.0.7-11.el9_8.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/o/openssl-fips-provider-3.0.7-11.el9_8.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 28686020, + "sha256": "0b14c251cccb4506df185e78ec55cb49e14e7bcd8de19ad3f3246017b2120693" + }, + { + "filename": "p11-kit-0.26.4-1.el9_8.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/p/p11-kit-0.26.4-1.el9_8.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 1121232, + "sha256": "6f06a4f6812fce869528ff17ab002d655a8da18fc745eafa6c02594bb23dfeeb" + }, + { + "filename": "pam-1.5.1-28.el9_8.1.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/p/pam-1.5.1-28.el9_8.1.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 1142205, + "sha256": "fe61734fdb226915dff402bcd1ad2002e0fd7a4dad9042af65688804f428b30b" + }, + { + "filename": "pcre-8.44-4.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/p/pcre-8.44-4.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 1624356, + "sha256": "7edbd87b866a3f6e3df1426d660b902e063193d6186027bf99f6d77626a43817" + }, + { + "filename": "pcre2-10.40-6.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/p/pcre2-10.40-6.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 1789790, + "sha256": "a570f7192be555222aa3704882b9199fb013a84ad4d7dcf40a93d8de2ecf6e0a" + }, + { + "filename": "procps-ng-3.3.17-14.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/p/procps-ng-3.3.17-14.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 1054334, + "sha256": "acfd5c270ba5724a0f5f2a84cc47ee222d6a03095421fddbf6932375ec7d67f0" + }, + { + "filename": "readline-8.1-4.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/r/readline-8.1-4.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 3009702, + "sha256": "bc7a168b7275d1f9bd0f16b47029dd857ddce83fa80c3cb32eac63cb55f591f3" + }, + { + "filename": "redhat-release-9.8-1.0.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/r/redhat-release-9.8-1.0.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 85364, + "sha256": "6c3f4a1287fb76e05e49217a15a33b9c228a56fc06e96376afb37201bfbe32da" + }, + { + "filename": "sed-4.8-10.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/s/sed-4.8-10.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 1428416, + "sha256": "981073f2c251395b5ae42b7ff929f743260eea9738187fbb207042f11eae7ea7" + }, + { + "filename": "setup-2.13.7-10.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/s/setup-2.13.7-10.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 195940, + "sha256": "3acdbbd63bd77dd8b18210b9d597bd59ddf455ff728067638c54194ac3a8a32b" + }, + { + "filename": "shadow-utils-4.9-16.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/s/shadow-utils-4.9-16.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 1713058, + "sha256": "771a5ed07cdb690c75cd428a8113e2ee471270044e6cb8025d92c54e32c180ff" + }, + { + "filename": "systemd-252-67.el9_8.6.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/s/systemd-252-67.el9_8.6.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 45003976, + "sha256": "f535f4c20ed82f56cc7f4c86202e3cd582815f702bb0c24005a07a496ec94c97" + }, + { + "filename": "tzdata-2026c-1.el9_8.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/t/tzdata-2026c-1.el9_8.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 933774, + "sha256": "4cc10832b19807c03a30bd9317fb37dc811d2f13c11b1ed35af8d2efa481622f" + }, + { + "filename": "util-linux-2.37.4-25.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/u/util-linux-2.37.4-25.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 6291867, + "sha256": "6c788387cde9c0fde5481382f3f8416e3ecbcf09c908b409b6c63358b90a399f" + }, + { + "filename": "xz-5.2.5-8.el9_0.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/x/xz-5.2.5-8.el9_0.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 1168293, + "sha256": "bce98f3a307e75a8ac28f909e29b41d64b15461fa9ddf0bf4ef3c2f6de946b46" + }, + { + "filename": "zlib-1.2.11-40.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/z/zlib-1.2.11-40.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 561153, + "sha256": "e47b884c132983fd0cc40c761de72e1a34ada9ee395cfe50997f9fb9257669d8" + }, + { + "filename": "zstd-1.5.5-1.el9.src.rpm", + "url": "https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/z/zstd-1.5.5-1.el9.src.rpm", + "repository": "ubi-9-baseos-source-rpms", + "size": 2378112, + "sha256": "922957570bae59b0a45bd9d96ce804c65c6c3260f50198f40804d95ffb0db65e" + } + ] +} diff --git a/docs/ARTIFACT-ACQUISITION.md b/docs/ARTIFACT-ACQUISITION.md index fc321ff..485c148 100644 --- a/docs/ARTIFACT-ACQUISITION.md +++ b/docs/ARTIFACT-ACQUISITION.md @@ -1,7 +1,9 @@ # External artifact acquisition -Status: required design for the first release; the current `Containerfile` -still resolves RPMs during the builder stage and must be migrated. +Status: reviewed architecture locks, lock-update tooling, and verified +official and alternate-source acquisition are implemented. The `Containerfile` +still resolves RPMs during the builder stage and must be migrated to consume +the verified bundle. ## Build contract @@ -54,7 +56,7 @@ An ordinary pull-request, `main`, or release build never selects "latest" and never recalculates the dependency closure. It downloads only entries already present in the merged lock. -An architecture-specific lock manifest will identify: +Each architecture-specific lock manifest identifies: - each base-image registry, repository, tag, and expected manifest digest; - NGINX channel, RPM name, epoch, version, release, and architecture; @@ -68,6 +70,45 @@ An architecture-specific lock manifest will identify: The lock manifest is reviewable repository content. Credentials, tokens, private CA keys, and internal secrets are not. +### Implemented lock set + +The reviewed lock inputs are in `artifacts/lock-inputs.json`; the JSON schema +is `artifacts/artifact-lock.schema.json`; and the rendered locks are +`artifacts/locks/amd64.json` and `artifacts/locks/arm64.json`. Each lock pins +the selected NGINX RPM, the complete 79-package installation closure, 59 +corresponding source RPMs, artifact sizes and SHA-256 values, the actual RPM +signer fingerprint, and the builder and runtime manifest-list digests. + +The two architectures have the same package-name and source-package sets. +Architecture-specific binary hashes and sizes remain separate. Identical +source RPM content is retained by URL and digest in both locks so either +architecture record is independently complete. + +Validate the reviewed inputs, both locks, and negative validation cases with: + +```console +python scripts/artifacts.py validate-inputs artifacts/lock-inputs.json +python scripts/artifacts.py validate-lock artifacts/locks/amd64.json \ + --inputs artifacts/lock-inputs.json +python scripts/artifacts.py validate-lock artifacts/locks/arm64.json \ + --inputs artifacts/lock-inputs.json +python -m unittest tests.test_artifacts -v +``` + +`scripts/fetch-lock-inputs.py`, `scripts/resolve-lock.sh`, and +`scripts/render-lock.py` implement the explicit lock-update path. The fetcher +admits only HTTPS URLs on approved public hosts and verifies the reviewed +SHA-256 before exposing an input. The resolver independently checks input +inventory, hashes, full signing-key fingerprints, RPM signatures, NEVRA, +architecture, dependency closure, and source-RPM signatures. The renderer +maps the observed RPM signing key ID to exactly one approved full fingerprint +and fails closed on malformed or inconsistent output. + +An ARM64 lock can be dependency-resolved with DNF's explicit `aarch64` mode +without executing an ARM binary. Native ARM64 assembly and runtime evidence is +still required before release and will independently exercise the lock on the +target architecture. + ### 2. Acquire locked files outside the build The CI runner downloads artifacts into an ephemeral staging directory. When a @@ -84,6 +125,22 @@ Base images are also pulled before assembly and checked against their expected manifest digests. The build uses the already-present local image and disables pulling. +Acquire the binary bundle for the native architecture from the official +publisher URLs and then perform RPM-level verification: + +```console +python scripts/artifacts.py acquire \ + --lock artifacts/locks/amd64.json \ + --output .artifact-bundle/amd64 +bash scripts/verify-rpm-bundle.sh \ + artifacts/locks/amd64.json .artifact-bundle/amd64 +``` + +Add `--include-sources` to both commands when preparing a redistribution and +source-compliance bundle. Acquisition is atomic and refuses to replace an +existing output directory. The published directory contains only the exact +locked inputs plus lock-bound key, RPM, and optional source manifests. + ### 3. Verify outside the build Before the artifact bundle is exposed to the build: @@ -142,6 +199,29 @@ A runner can reach a private source only when an approved network path exists. Otherwise the controlled workflow needs a hardened runner within that boundary or a separately approved artifact-transfer stage. +Pass an external JSON source map with `--source-map`. It must contain exactly +one HTTPS URL for every logical path required by the selected lock and bundle +mode: + +```json +{ + "schema_version": 1, + "artifacts": { + "keys/nginx_signing.key": "https://approved.example/keys/nginx_signing.key", + "rpms/example.rpm": "https://approved.example/rpms/example.rpm" + } +} +``` + +This abbreviated shape illustrates the interface; a real map must enumerate +the complete lock. URLs containing credentials, query strings, or fragments +are rejected. Redirects may remain only on the original HTTPS host. Use +`--token-env VARIABLE_NAME` to read a bearer token from the runner +environment and `--ca-bundle PATH` for externally provisioned CA trust. The +tool does not print source URLs or token values on download errors. Source +maps, credentials, and private CA material are protected runner inputs and +must not be committed or added to the build context. + ## Local development Local development uses the same preparation and assembly interface. A developer @@ -149,7 +229,7 @@ first prepares or receives a verified artifact bundle, then builds without network access. A cached but unverified file is not accepted merely because it is local. -The preparation tooling will provide actionable messages for missing source +The preparation tooling provides actionable messages for missing source configuration and will use the official public source by default. The artifact lock, verification semantics, and network-disabled assembly remain identical when an alternate source is deliberately selected. @@ -160,8 +240,11 @@ dependency. ## Required tests -The implementation is incomplete until automated tests demonstrate rejection -of: +Unit tests exercise schema, reviewed-input, digest, and inventory rejection +without downloads. + +The implementation is incomplete until automated tests additionally +demonstrate rejection of: - a modified RPM; - an RPM signed by an unapproved key; diff --git a/docs/CI.md b/docs/CI.md index 69dd3da..11f70cc 100644 --- a/docs/CI.md +++ b/docs/CI.md @@ -32,6 +32,9 @@ pre-commit run --all-files --show-diff-on-failure The configured hooks check text normalization, YAML and JSON syntax, merge markers, unsafe or broken symlinks, oversized files, private keys, shell code, container build files, GitHub Actions, and prohibited co-author trailers. +The lint job also runs `python -m unittest tests.test_artifacts -v` to validate +the reviewed lock inputs, both architecture locks, and fail-closed negative +cases without downloading artifacts. The `commit-msg` hook applies only after `pre-commit install` installs the configured hook types. CI separately evaluates repository files but cannot @@ -63,17 +66,19 @@ single canonical smoke implementation for local Podman and Linux CI, avoiding behavioral drift between platform-specific suites. Native AMD64 and ARM64 CI remains required before an image receives supported multi-architecture status. -## Planned external acquisition +## External acquisition -The current development build resolves RPMs from inside the builder stage. It -does not yet meet the first-release artifact-acquisition contract. +Reviewed AMD64 and ARM64 locks, explicit update tooling, and official and +alternate-source acquisition paths are in the repository. The acquisition and +verification tools check exact inventory, size, SHA-256, lock identity, RPM +signatures, approved signing fingerprints, NEVRA, architecture, and source-RPM +identity before a bundle is exposed to assembly. Unit tests cover atomic +publication and fail-closed inventory and source-map behavior without +downloading artifacts. -The replacement pipeline will separate a reviewed lock update from ordinary -CI. Normal jobs will download only the exact architecture-specific files in -the merged lock, verify their checksums, RPM signatures, signing fingerprints, -NEVRA, architecture, and bundle completeness, and preload digest-verified base -images. The image will then assemble from that local bundle with networking and -pulling disabled. +The current development build still resolves RPMs from inside the builder +stage. Migrating it to consume the verified bundle with networking and pulling +disabled remains the next step in the acquisition contract. The official public source is the default. An alternate approved source can be selected through protected CI configuration, but private endpoints, diff --git a/docs/PACKAGE-SOURCE.md b/docs/PACKAGE-SOURCE.md index b3c987d..70da890 100644 --- a/docs/PACKAGE-SOURCE.md +++ b/docs/PACKAGE-SOURCE.md @@ -1,26 +1,37 @@ # NGINX package-source decision -Status: proposed for the first release; the current image still uses the Red -Hat UBI AppStream RPM documented in [RPM provenance](RPM-PROVENANCE.md). +Status: official NGINX stable implemented for first-release qualification; +`nginx-2:1.30.4-1.el9.ngx` is the current qualification candidate. The +superseded Red Hat UBI AppStream development input remains documented in +[RPM provenance](RPM-PROVENANCE.md). ## Recommendation Use the official NGINX stable RPM repository for the first release while -retaining digest-pinned Red Hat UBI 9 Minimal and Micro base images. Pin one -exact NGINX RPM epoch, version, and release for each architecture. Do not track -the newest package implicitly during a release build. +retaining digest-pinned Red Hat UBI 9 Minimal and Micro base images. The +selected implementation candidate is `nginx-2:1.30.4-1.el9.ngx`. Pin this +exact epoch, version, and release independently for each architecture. Do not +track the newest package implicitly during an ordinary or release build. Package publication and package acquisition are separate decisions. NGINX remains the publisher even when an approved intermediary transfers the -unchanged, signed RPM. All downloading and verification will occur before the +unchanged, signed RPM. All downloading and verification occurs before the container build as defined in [External artifact acquisition](ARTIFACT-ACQUISITION.md). -As observed on 2026-09-08, the stable repository offers -`nginx-2:1.30.4-1.el9.ngx` for RHEL 9 on both `x86_64` and `aarch64`. This is an -observed development candidate, not yet the selected first-release version. -The exact candidate must be frozen only after its tests and vulnerability -review pass. +The selection was reviewed against authoritative NGINX sources on 2026-09-12. +The stable repositories publish `nginx-1.30.4-1.el9.ngx` for both `x86_64` +and `aarch64`, and publish the matching +`nginx-1.30.4-1.el9.ngx.src.rpm`. The official security-advisory index lists +1.30.4 as not vulnerable to its current 1.30-series advisories. This source +review selects the package for implementation and qualification; it does not +substitute for RPM signature verification, dependency locking, native runtime +tests, SBOM and scanner review, or final release-candidate evidence. + +The release workflow must recheck the advisory index and repository state +before freezing final inputs. A superseding stable package or new advisory +requires a reviewed lock update or an explicit, time-bounded acceptance; an +ordinary build must never follow that change automatically. Prefer stable over mainline for the initial release. Mainline provides features sooner but creates a faster qualification and update cadence. A mainline-only @@ -44,7 +55,7 @@ management. | Area | Red Hat UBI AppStream RPM | Official NGINX RPM | | --- | --- | --- | | Release cadence | RHEL module-stream lifecycle with Red Hat backports. | NGINX stable or mainline release cadence. | -| Current observed package | `nginx-core-2:1.26.3-9.module+el9.8.0+24599+8fde0ff7.3` | Stable candidate `nginx-2:1.30.4-1.el9.ngx`. | +| Package position | Current image: `nginx-core-2:1.26.3-9.module+el9.8.0+24599+8fde0ff7.3`. | Selected candidate: `nginx-2:1.30.4-1.el9.ngx`. | | Package trust | Red Hat repository metadata and release key. | NGINX repository and NGINX signing key. | | Platform statement | Packaged as part of UBI/RHEL content. | NGINX documents RHEL 9 packages for x86_64 and aarch64; this project must qualify them on UBI 9. | | Security maintenance | Red Hat errata and backported fixes. | New upstream NGINX package releases. | @@ -64,10 +75,17 @@ Implementation requires: 1. Choose official stable or mainline; stable is recommended. 2. Acquire the NGINX signing key outside the container build through a reviewed process, verify its full fingerprint, pin its checksum, and define - key-expiration and rotation handling. The official instructions currently - identify fingerprint - `573B FD6B 3D8F BC64 1079 A6AB ABF5 BD82 7BD9 BF62` and advise independent - authenticity verification. + key-expiration and rotation handling. The official key bundle observed on + 2026-09-12 has SHA-256 + `55385da31d198fa6a5012d40ae98ecb272a6c4e8fffffba94719ffd3e87de37a` + and contains three primary keys. The selected 1.30.4 RPMs are signed by + fingerprint `8540 A6F1 8833 A80E 9C16 53A4 2FD2 1310 B49F 6B46`; the + artifact locks accept that signer specifically. Do not infer approval of + every certificate in the downloaded bundle. The official installation + instructions also identify the older + `573B FD6B 3D8F BC64 1079 A6AB ABF5 BD82 7BD9 BF62` fingerprint, so key + rotation must compare the actual package signer with independently reviewed + NGINX key information. 3. Resolve and download the exact NGINX RPM and dependency closure outside the build through the configured approved artifact source. 4. Verify RPM signatures, fingerprints, checksums, NEVRA, architecture, and diff --git a/docs/ROADMAP.md b/docs/ROADMAP.md index ea11cca..79033c2 100644 --- a/docs/ROADMAP.md +++ b/docs/ROADMAP.md @@ -51,41 +51,30 @@ are separately approved. They must not delay the core first release. Work proceeds in this dependency order: -1. Approve the official NGINX stable channel and select the exact NGINX - first-release candidate. -2. Implement architecture-specific artifact locks and source-independent - acquisition driven by protected configuration. -3. Migrate the image to the exact official NGINX RPM and require +1. Migrate the image to the exact official NGINX RPM and require network-disabled, no-pull assembly from a verified local bundle. -4. Close rootless failure diagnostics, graceful lifecycle tests, and +2. Close rootless failure diagnostics, graceful lifecycle tests, and package/module inventory checks. -5. Qualify the minimum static, reverse-proxy, structured-logging, and TLS +3. Qualify the minimum static, reverse-proxy, structured-logging, and TLS profiles needed for the first supported image; keep additional profiles explicitly preview until their tests close. -6. Complete the repository policy files, support boundary, threat model, +4. Complete the repository policy files, support boundary, threat model, requirement analysis, control ownership, vulnerability policy, tailored SCAP evidence, and deployment cyber package needed for review. -7. Qualify standalone rootless Podman/Quadlet deployment, systemd lifecycle, +5. Qualify standalone rootless Podman/Quadlet deployment, systemd lifecycle, journald collection, controlled-network operation, and rollback on an exact supported Linux host. -8. Rehearse the multi-architecture publish, provenance, SBOM, signing, and +6. Rehearse the multi-architecture publish, provenance, SBOM, signing, and verification workflow from an untagged release candidate. -9. Freeze inputs, regenerate release-candidate evidence, approve findings, +7. Freeze inputs, regenerate release-candidate evidence, approve findings, create the immutable tag, publish by digest, and verify the release. -Steps 1 through 4 are the immediate engineering critical path. Steps 5 and 6 -can proceed in parallel only where they do not assume an unfrozen NGINX package -or module set. +Steps 1 and 2 are the immediate engineering critical path. Steps 3 and 4 can +proceed in parallel only where they do not assume an unfrozen NGINX package or +module set. ## Package 2: rootless minimal image -- [ ] Approve official NGINX stable as the package channel and select an exact - first-release candidate from authoritative sources. -- [ ] Add reviewed AMD64 and ARM64 artifact locks containing the complete RPM - closure, checksums, sizes, signatures, source RPMs, and base-image digests. -- [ ] Add official and alternate-source acquisition paths; keep private - endpoints, repository identifiers, credentials, and private CA material - outside this public repository and image build. - [ ] Make ordinary CI and local builds consume verified local bundles with build networking and image pulling disabled. - [ ] Add negative tests for tampered, unsigned, wrong-version, diff --git a/scripts/artifacts.py b/scripts/artifacts.py new file mode 100644 index 0000000..2d98a21 --- /dev/null +++ b/scripts/artifacts.py @@ -0,0 +1,632 @@ +#!/usr/bin/env python3 +"""Validate reviewed inputs and architecture-specific artifact locks.""" + +from __future__ import annotations + +import argparse +import hashlib +import json +import os +import re +import shutil +import ssl +import sys +import tempfile +import urllib.parse +import urllib.request +from pathlib import Path + + +ALLOWED_HOSTS = {"cdn-ubi.redhat.com", "nginx.org", "security.access.redhat.com"} +ARCHES = {"amd64": "x86_64", "arm64": "aarch64"} +BASE_PREFIXES = { + "builder": "registry.access.redhat.com/ubi9/ubi-minimal:", + "runtime": "registry.access.redhat.com/ubi9/ubi-micro:", +} +UBI_BINARY_REPOSITORIES = { + "ubi-9-appstream-rpms", + "ubi-9-baseos-rpms", + "ubi-9-codeready-builder-rpms", +} +UBI_SOURCE_REPOSITORIES = { + "ubi-9-appstream-source-rpms", + "ubi-9-baseos-source-rpms", + "ubi-9-codeready-builder-source-rpms", +} +SHA256_RE = re.compile(r"^[a-f0-9]{64}$") +DIGEST_RE = re.compile(r"^sha256:[a-f0-9]{64}$") +FINGERPRINT_RE = re.compile(r"^[A-F0-9]{40}$") +FILENAME_RE = re.compile(r"^[A-Za-z0-9+_.-]+$") + + +class LockError(ValueError): + """An input or lock violated the fail-closed contract.""" + + +def fail(message: str) -> None: + raise LockError(message) + + +def read_json(path: Path) -> dict: + try: + value = json.loads(path.read_text(encoding="utf-8")) + except (OSError, json.JSONDecodeError) as exc: + fail(f"cannot read valid JSON from {path}: {exc}") + if not isinstance(value, dict): + fail(f"{path} must contain one JSON object") + return value + + +def sha256_file(path: Path) -> str: + digest = hashlib.sha256() + with path.open("rb") as handle: + for block in iter(lambda: handle.read(1024 * 1024), b""): + digest.update(block) + return digest.hexdigest() + + +def require_keys(value: dict, fields: set[str], label: str) -> None: + missing = fields - value.keys() + extra = value.keys() - fields + if missing: + fail(f"{label} is missing fields: {', '.join(sorted(missing))}") + if extra: + fail(f"{label} has unexpected fields: {', '.join(sorted(extra))}") + + +def require_string(value: object, label: str) -> str: + if not isinstance(value, str) or not value: + fail(f"{label} must be a non-empty string") + return value + + +def require_sha256(value: object, label: str) -> str: + if not isinstance(value, str) or not SHA256_RE.fullmatch(value): + fail(f"{label} must be a lowercase SHA-256 value") + return value + + +def validate_url(value: object, label: str) -> str: + url = require_string(value, f"{label} URL") + parsed = urllib.parse.urlsplit(url) + if ( + parsed.scheme != "https" + or parsed.hostname not in ALLOWED_HOSTS + or parsed.username + or parsed.password + or parsed.query + or parsed.fragment + ): + fail(f"{label} has an unapproved URL: {url}") + return url + + +def validate_alternate_url(value: object, label: str) -> str: + url = require_string(value, f"{label} URL") + parsed = urllib.parse.urlsplit(url) + if ( + parsed.scheme != "https" + or not parsed.hostname + or parsed.username + or parsed.password + or parsed.query + or parsed.fragment + ): + fail(f"{label} must use an HTTPS URL without credentials, query, or fragment") + return url + + +def validate_base_reference(value: object, role: str) -> str: + reference = require_string(value, f"base image {role}") + if not reference.startswith(BASE_PREFIXES[role]) or "@sha256:" not in reference: + fail(f"base image {role} is not an approved digest-pinned UBI image") + if not DIGEST_RE.fullmatch(reference.rsplit("@", 1)[1]): + fail(f"base image {role} has an invalid digest") + return reference + + +def validate_keys(value: object) -> list[dict]: + if not isinstance(value, list) or not value: + fail("signing_keys must be a non-empty array") + ids: set[str] = set() + fingerprints: set[str] = set() + filenames: set[str] = set() + for item in value: + if not isinstance(item, dict): + fail("each signing key must be an object") + fields = {"id", "filename", "url", "sha256", "fingerprint"} + require_keys(item, fields, "signing key") + identifier = require_string(item["id"], "signing key id") + filename = require_string(item["filename"], "signing key filename") + fingerprint = require_string(item["fingerprint"], "signing key fingerprint") + if not FILENAME_RE.fullmatch(filename): + fail(f"unsafe signing key filename: {filename}") + if not FINGERPRINT_RE.fullmatch(fingerprint): + fail(f"invalid signing key fingerprint: {fingerprint}") + validate_url(item["url"], f"signing key {identifier}") + require_sha256(item["sha256"], f"signing key {identifier}") + if identifier in ids or fingerprint in fingerprints or filename in filenames: + fail("signing key ids, fingerprints, and filenames must be unique") + ids.add(identifier) + fingerprints.add(fingerprint) + filenames.add(filename) + if "8540A6F18833A80E9C1653A42FD21310B49F6B46" not in fingerprints: + fail("the approved full NGINX signing fingerprint is missing") + return value + + +def validate_inputs(path: Path) -> dict: + value = read_json(path) + fields = { + "schema_version", "bundle_version", "nginx_version", + "nginx_rpm_version", "ubi_release", "base_images", + "architectures", "signing_keys", + } + require_keys(value, fields, "lock inputs") + if value["schema_version"] != 1 or value["bundle_version"] != 1: + fail("only lock schema and bundle version 1 are supported") + require_string(value["nginx_version"], "NGINX version") + require_string(value["nginx_rpm_version"], "NGINX RPM version") + if value["ubi_release"] != "9.8": + fail("lock inputs must use the reviewed UBI release") + if not isinstance(value["base_images"], dict): + fail("base_images must be an object") + require_keys(value["base_images"], set(BASE_PREFIXES), "base images") + for role in BASE_PREFIXES: + validate_base_reference(value["base_images"][role], role) + if not isinstance(value["architectures"], dict) or set(value["architectures"]) != set(ARCHES): + fail("lock inputs must define exactly amd64 and arm64") + for architecture, rpm_architecture in ARCHES.items(): + entry = value["architectures"][architecture] + if not isinstance(entry, dict): + fail(f"architecture {architecture} must be an object") + require_keys(entry, {"rpm_architecture", "nginx_rpm"}, f"architecture {architecture}") + if entry["rpm_architecture"] != rpm_architecture: + fail(f"architecture {architecture} has the wrong RPM architecture") + seed = entry["nginx_rpm"] + if not isinstance(seed, dict): + fail(f"architecture {architecture} NGINX RPM must be an object") + require_keys(seed, {"url", "sha256"}, "NGINX seed") + url = validate_url(seed["url"], "NGINX seed") + require_sha256(seed["sha256"], "NGINX seed") + expected_suffix = f"nginx-{value['nginx_rpm_version']}.{rpm_architecture}.rpm" + if not url.endswith(f"/{expected_suffix}"): + fail(f"architecture {architecture} does not select the reviewed NGINX RPM") + input_keys = [] + for item in value["signing_keys"]: + if not isinstance(item, dict): + fail("each input signing key must be an object") + require_keys(item, {"id", "url", "sha256", "fingerprint"}, "input signing key") + rendered = dict(item) + rendered["filename"] = Path(urllib.parse.urlsplit(validate_url(item["url"], "signing key")).path).name + input_keys.append(rendered) + validate_keys(input_keys) + return value + + +def validate_lock(path: Path, inputs_path: Path | None = None) -> dict: + value = read_json(path) + fields = { + "schema_version", "bundle_version", "architecture", + "rpm_architecture", "generated_at", "nginx_version", + "nginx_rpm_version", "base_images", "signing_keys", "packages", + "source_packages", + } + require_keys(value, fields, "artifact lock") + if value["schema_version"] != 1 or value["bundle_version"] != 1: + fail("only lock schema and bundle version 1 are supported") + architecture = value["architecture"] + if architecture not in ARCHES or value["rpm_architecture"] != ARCHES[architecture]: + fail("lock architecture fields are inconsistent") + if not isinstance(value["generated_at"], str) or not value["generated_at"].endswith("Z"): + fail("generated_at must be a UTC date-time") + if not isinstance(value["base_images"], dict): + fail("base_images must be an object") + require_keys(value["base_images"], set(BASE_PREFIXES), "base images") + for role, base in value["base_images"].items(): + if not isinstance(base, dict): + fail(f"base image {role} must be an object") + require_keys(base, {"reference", "digest", "platform"}, f"base image {role}") + reference = validate_base_reference(base["reference"], role) + if base["digest"] != reference.rsplit("@", 1)[1]: + fail(f"base image {role} digest is inconsistent") + if base["platform"] != f"linux/{architecture}": + fail(f"base image {role} platform is inconsistent") + keys = validate_keys(value["signing_keys"]) + fingerprints = {item["fingerprint"] for item in keys} + packages = value["packages"] + if not isinstance(packages, list) or not packages: + fail("packages must be a non-empty array") + nevras: set[str] = set() + filenames: set[str] = set() + for package in packages: + validate_package(package, architecture, value, fingerprints) + if package["nevra"] in nevras or package["filename"] in filenames: + fail("package NEVRAs and filenames must be unique") + nevras.add(package["nevra"]) + filenames.add(package["filename"]) + if [item["nevra"] for item in packages] != sorted(nevras): + fail("packages must be sorted by NEVRA") + sources = value["source_packages"] + if not isinstance(sources, list) or not sources: + fail("source_packages must be a non-empty array") + source_files: set[str] = set() + for source in sources: + validate_source(source) + if source["filename"] in source_files: + fail("source package filenames must be unique") + source_files.add(source["filename"]) + if [item["filename"] for item in sources] != sorted(source_files): + fail("source_packages must be sorted by filename") + missing = {item["source_rpm"] for item in packages} - source_files + if missing: + fail(f"binary packages lack source records: {', '.join(sorted(missing))}") + nginx = [item for item in packages if item["name"] == "nginx"] + if len(nginx) != 1: + fail("lock must contain exactly one NGINX package") + if inputs_path is not None: + validate_lock_against_inputs(value, validate_inputs(inputs_path)) + return value + + +def validate_lock_against_inputs(lock: dict, inputs: dict) -> None: + for field in ("schema_version", "bundle_version", "nginx_version", "nginx_rpm_version"): + if lock[field] != inputs[field]: + fail(f"artifact lock {field} differs from reviewed inputs") + for role, reference in inputs["base_images"].items(): + if lock["base_images"][role]["reference"] != reference: + fail(f"artifact lock base image {role} differs from reviewed inputs") + architecture = lock["architecture"] + architecture_inputs = inputs["architectures"][architecture] + if lock["rpm_architecture"] != architecture_inputs["rpm_architecture"]: + fail("artifact lock RPM architecture differs from reviewed inputs") + nginx = next(item for item in lock["packages"] if item["name"] == "nginx") + seed = architecture_inputs["nginx_rpm"] + if nginx["url"] != seed["url"] or nginx["sha256"] != seed["sha256"]: + fail("artifact lock NGINX package differs from reviewed inputs") + expected_keys = { + (item["id"], item["url"], item["sha256"], item["fingerprint"]) + for item in inputs["signing_keys"] + } + actual_keys = { + (item["id"], item["url"], item["sha256"], item["fingerprint"]) + for item in lock["signing_keys"] + } + if actual_keys != expected_keys: + fail("artifact lock signing keys differ from reviewed inputs") + + +def validate_package(package: object, architecture: str, lock: dict, fingerprints: set[str]) -> None: + if not isinstance(package, dict): + fail("each package must be an object") + fields = {"name", "epoch", "version", "release", "architecture", "nevra", "filename", "url", "repository", "size", "sha256", "signing_key_fingerprint", "source_rpm"} + require_keys(package, fields, "package") + for field in ("name", "version", "release", "architecture", "nevra", "filename", "repository", "source_rpm"): + require_string(package[field], f"package {field}") + if not isinstance(package["epoch"], int) or package["epoch"] < 0: + fail("package epoch must be a non-negative integer") + if package["architecture"] not in {ARCHES[architecture], "noarch"}: + fail(f"package {package['nevra']} has the wrong architecture") + expected = f"{package['name']}-{package['epoch']}:{package['version']}-{package['release']}.{package['architecture']}" + if package["nevra"] != expected: + fail(f"package NEVRA is inconsistent: {package['nevra']}") + if not FILENAME_RE.fullmatch(package["filename"]) or not package["filename"].endswith(".rpm"): + fail(f"unsafe package filename: {package['filename']}") + url = validate_url(package["url"], f"package {package['nevra']}") + expected_filename = ( + f"{package['name']}-{package['version']}-{package['release']}." + f"{package['architecture']}.rpm" + ) + if package["filename"] != expected_filename or Path(urllib.parse.urlsplit(url).path).name != expected_filename: + fail(f"package filename is inconsistent: {package['filename']}") + if not isinstance(package["size"], int) or package["size"] < 1: + fail(f"package {package['nevra']} has an invalid size") + require_sha256(package["sha256"], f"package {package['nevra']}") + if package["signing_key_fingerprint"] not in fingerprints: + fail(f"package {package['nevra']} uses an unapproved signing key") + if not package["source_rpm"].endswith(".src.rpm"): + fail(f"package {package['nevra']} has an invalid source RPM") + host = urllib.parse.urlsplit(url).hostname + if package["name"] == "nginx": + expected_rpm = f"{lock['nginx_version']}-{package['release']}" + if package["epoch"] != 2 or expected_rpm != lock["nginx_rpm_version"]: + fail("NGINX package violates the selected version") + if package["repository"] != "nginx-stable" or host != "nginx.org": + fail("NGINX package has an inconsistent source") + elif package["repository"] not in UBI_BINARY_REPOSITORIES or host != "cdn-ubi.redhat.com": + fail(f"package {package['nevra']} has an inconsistent UBI source") + + +def validate_source(source: object) -> None: + if not isinstance(source, dict): + fail("each source package must be an object") + fields = {"filename", "url", "repository", "size", "sha256"} + require_keys(source, fields, "source package") + filename = require_string(source["filename"], "source package filename") + if not FILENAME_RE.fullmatch(filename) or not filename.endswith(".src.rpm"): + fail(f"unsafe source package filename: {filename}") + url = validate_url(source["url"], f"source package {filename}") + if Path(urllib.parse.urlsplit(url).path).name != filename: + fail(f"source package URL does not match its filename: {filename}") + repository = require_string(source["repository"], "source package repository") + if not isinstance(source["size"], int) or source["size"] < 1: + fail(f"source package {filename} has an invalid size") + require_sha256(source["sha256"], f"source package {filename}") + host = urllib.parse.urlsplit(url).hostname + if filename.startswith("nginx-"): + if repository != "nginx-stable-source" or host != "nginx.org": + fail(f"source package {filename} has an inconsistent NGINX source") + elif repository not in UBI_SOURCE_REPOSITORIES or host != "cdn-ubi.redhat.com": + fail(f"source package {filename} has an inconsistent UBI source") + + +def bundle_artifacts(lock: dict, include_sources: bool = False) -> dict[str, dict]: + artifacts = { + f"keys/{item['filename']}": { + "url": item["url"], "sha256": item["sha256"], "size": None, + } + for item in lock["signing_keys"] + } + artifacts.update({ + f"rpms/{item['filename']}": { + "url": item["url"], "sha256": item["sha256"], "size": item["size"], + } + for item in lock["packages"] + }) + if include_sources: + artifacts.update({ + f"srpms/{item['filename']}": { + "url": item["url"], "sha256": item["sha256"], "size": item["size"], + } + for item in lock["source_packages"] + }) + return artifacts + + +def manifest_contents(lock: dict, lock_sha256: str, include_sources: bool) -> dict[str, str]: + key_rows = ["filename\tfingerprint\tsha256"] + key_rows.extend( + f"{item['filename']}\t{item['fingerprint']}\t{item['sha256']}" + for item in lock["signing_keys"] + ) + rpm_rows = [ + "filename\tname\tepoch\tversion\trelease\tarchitecture\tsource_rpm\tfingerprint\tsha256" + ] + rpm_rows.extend( + "\t".join(str(value) for value in ( + item["filename"], item["name"], item["epoch"], item["version"], + item["release"], item["architecture"], item["source_rpm"], + item["signing_key_fingerprint"], item["sha256"], + )) + for item in lock["packages"] + ) + manifests = { + "LOCK-SHA256": f"{lock_sha256}\n", + "key-manifest.tsv": "\n".join(key_rows) + "\n", + "rpm-manifest.tsv": "\n".join(rpm_rows) + "\n", + } + if include_sources: + source_rows = ["filename\trepository\tsize\tsha256"] + source_rows.extend( + f"{item['filename']}\t{item['repository']}\t{item['size']}\t{item['sha256']}" + for item in lock["source_packages"] + ) + manifests["source-manifest.tsv"] = "\n".join(source_rows) + "\n" + return manifests + + +def rpm_manifest(lock: dict) -> str: + """Return the exact runtime RPM manifest embedded during assembly.""" + return manifest_contents(lock, "0" * 64, False)["rpm-manifest.tsv"] + + +def read_source_map(path: Path, expected: set[str]) -> tuple[dict[str, str], set[str]]: + value = read_json(path) + require_keys(value, {"schema_version", "artifacts"}, "alternate source map") + if value["schema_version"] != 1 or not isinstance(value["artifacts"], dict): + fail("alternate source map must use schema version 1 and an artifacts object") + actual = set(value["artifacts"]) + if actual != expected: + missing = expected - actual + extra = actual - expected + details = [] + if missing: + details.append(f"missing {len(missing)} artifact(s)") + if extra: + details.append(f"containing {len(extra)} unexpected artifact(s)") + fail("alternate source map does not exactly match the lock: " + " and ".join(details)) + urls = { + logical_path: validate_alternate_url(value["artifacts"][logical_path], logical_path) + for logical_path in sorted(expected) + } + hosts = {urllib.parse.urlsplit(url).hostname for url in urls.values()} + return urls, {host for host in hosts if host} + + +class ApprovedRedirectHandler(urllib.request.HTTPRedirectHandler): + def __init__(self, hosts: set[str]): + super().__init__() + self.hosts = hosts + + def redirect_request(self, request, file_pointer, code, message, headers, new_url): + parsed = urllib.parse.urlsplit(new_url) + original = urllib.parse.urlsplit(request.full_url) + if ( + parsed.scheme != "https" + or parsed.hostname not in self.hosts + or parsed.hostname != original.hostname + or parsed.username + or parsed.password + or parsed.query + or parsed.fragment + ): + fail("download redirect left the original approved HTTPS host") + return super().redirect_request(request, file_pointer, code, message, headers, new_url) + + +def download(url: str, destination: Path, hosts: set[str], context: ssl.SSLContext, + token: str | None) -> None: + headers = {"User-Agent": "nginx-ubi-artifact-acquirer/1"} + if token: + headers["Authorization"] = f"Bearer {token}" + opener = urllib.request.build_opener( + ApprovedRedirectHandler(hosts), urllib.request.HTTPSHandler(context=context) + ) + request = urllib.request.Request(url, headers=headers) + try: + with opener.open(request, timeout=60) as response, destination.open("wb") as output: + shutil.copyfileobj(response, output) + except LockError: + raise + except Exception as exc: + fail(f"download failed ({type(exc).__name__})") + + +def verify_file(path: Path, record: dict, logical_path: str) -> None: + if not path.is_file(): + fail(f"bundle is missing {logical_path}") + expected_size = record["size"] + if expected_size is not None and path.stat().st_size != expected_size: + fail(f"bundle artifact has the wrong size: {logical_path}") + if sha256_file(path) != record["sha256"]: + fail(f"bundle artifact has the wrong SHA-256: {logical_path}") + + +def verify_bundle(lock_path: Path, bundle: Path, include_sources: bool = False) -> None: + lock = validate_lock(lock_path) + artifacts = bundle_artifacts(lock, include_sources) + manifests = manifest_contents(lock, sha256_file(lock_path), include_sources) + expected_files = set(artifacts) | set(manifests) + expected_directories = { + Path(logical_path).parent.as_posix() + for logical_path in artifacts + if Path(logical_path).parent != Path(".") + } + if not bundle.is_dir(): + fail(f"bundle directory does not exist: {bundle}") + actual_files: set[str] = set() + for path in bundle.rglob("*"): + relative = path.relative_to(bundle).as_posix() + if path.is_symlink(): + fail(f"bundle contains a symbolic link: {relative}") + if path.is_file(): + actual_files.add(relative) + elif path.is_dir(): + if relative not in expected_directories: + fail(f"bundle contains an unexpected directory: {relative}") + else: + fail(f"bundle contains a non-regular entry: {relative}") + if actual_files != expected_files: + missing = expected_files - actual_files + extra = actual_files - expected_files + details = [] + if missing: + details.append(f"missing {len(missing)} file(s)") + if extra: + details.append(f"containing {len(extra)} unexpected file(s)") + fail("bundle inventory is not exact: " + " and ".join(details)) + for logical_path, record in artifacts.items(): + verify_file(bundle / logical_path, record, logical_path) + for filename, contents in manifests.items(): + try: + actual = (bundle / filename).read_text(encoding="utf-8") + except (OSError, UnicodeError) as exc: + fail(f"cannot read bundle manifest {filename}: {type(exc).__name__}") + if actual != contents: + fail(f"bundle manifest does not match the lock: {filename}") + + +def acquire_bundle(lock_path: Path, output: Path, include_sources: bool = False, + source_map: Path | None = None, token_env: str | None = None, + ca_bundle: Path | None = None) -> None: + lock = validate_lock(lock_path) + artifacts = bundle_artifacts(lock, include_sources) + if output.exists(): + fail(f"output already exists: {output}") + if token_env and source_map is None: + fail("authenticated acquisition requires an alternate source map") + token = None + if token_env: + token = os.environ.get(token_env) + if not token: + fail(f"credential environment variable is unset: {token_env}") + if ca_bundle is not None and not ca_bundle.is_file(): + fail("CA bundle does not exist or is not a file") + try: + context = ssl.create_default_context(cafile=str(ca_bundle) if ca_bundle else None) + except (OSError, ssl.SSLError): + fail("cannot load the configured CA bundle") + if source_map: + urls, hosts = read_source_map(source_map, set(artifacts)) + else: + urls = {path: record["url"] for path, record in artifacts.items()} + hosts = set(ALLOWED_HOSTS) + output.parent.mkdir(parents=True, exist_ok=True) + temporary = Path(tempfile.mkdtemp(prefix=f".{output.name}.", dir=output.parent)) + try: + for logical_path, record in artifacts.items(): + destination = temporary / logical_path + destination.parent.mkdir(parents=True, exist_ok=True) + download(urls[logical_path], destination, hosts, context, token) + verify_file(destination, record, logical_path) + for filename, contents in manifest_contents( + lock, sha256_file(lock_path), include_sources + ).items(): + (temporary / filename).write_text(contents, encoding="utf-8", newline="\n") + verify_bundle(lock_path, temporary, include_sources) + os.replace(temporary, output) + finally: + if temporary.exists(): + shutil.rmtree(temporary) + + +def main() -> int: + parser = argparse.ArgumentParser() + subparsers = parser.add_subparsers(dest="command", required=True) + inputs_parser = subparsers.add_parser("validate-inputs") + inputs_parser.add_argument("path", type=Path) + lock_parser = subparsers.add_parser("validate-lock") + lock_parser.add_argument("path", type=Path) + lock_parser.add_argument("--inputs", type=Path) + acquire_parser = subparsers.add_parser("acquire") + acquire_parser.add_argument("--lock", required=True, type=Path) + acquire_parser.add_argument("--output", required=True, type=Path) + acquire_parser.add_argument("--include-sources", action="store_true") + acquire_parser.add_argument("--source-map", type=Path) + acquire_parser.add_argument("--token-env") + acquire_parser.add_argument("--ca-bundle", type=Path) + verify_parser = subparsers.add_parser("verify-bundle") + verify_parser.add_argument("--lock", required=True, type=Path) + verify_parser.add_argument("--bundle", required=True, type=Path) + verify_parser.add_argument("--include-sources", action="store_true") + base_parser = subparsers.add_parser("base-reference") + base_parser.add_argument("lock", type=Path) + base_parser.add_argument("role", choices=sorted(BASE_PREFIXES)) + manifest_parser = subparsers.add_parser("rpm-manifest") + manifest_parser.add_argument("lock", type=Path) + arguments = parser.parse_args() + try: + if arguments.command == "validate-inputs": + validate_inputs(arguments.path) + elif arguments.command == "validate-lock": + validate_lock(arguments.path, arguments.inputs) + elif arguments.command == "acquire": + acquire_bundle( + arguments.lock, arguments.output, arguments.include_sources, + arguments.source_map, arguments.token_env, arguments.ca_bundle, + ) + elif arguments.command == "verify-bundle": + verify_bundle(arguments.lock, arguments.bundle, arguments.include_sources) + elif arguments.command == "base-reference": + lock = validate_lock(arguments.lock) + print(lock["base_images"][arguments.role]["reference"]) + else: + print(rpm_manifest(validate_lock(arguments.lock)), end="") + except LockError as exc: + print(f"artifact lock validation failed: {exc}", file=sys.stderr) + return 1 + return 0 + + +if __name__ == "__main__": + raise SystemExit(main()) diff --git a/scripts/fetch-lock-inputs.py b/scripts/fetch-lock-inputs.py new file mode 100644 index 0000000..6c4b5ca --- /dev/null +++ b/scripts/fetch-lock-inputs.py @@ -0,0 +1,72 @@ +#!/usr/bin/env python3 +"""Fetch only the reviewed key and NGINX RPM seeds for a lock update.""" + +from __future__ import annotations + +import argparse +import hashlib +import shutil +import tempfile +import urllib.parse +import urllib.request +from pathlib import Path + +from artifacts import LockError, validate_inputs, validate_url + + +class ApprovedRedirectHandler(urllib.request.HTTPRedirectHandler): + def redirect_request(self, req, fp, code, msg, headers, newurl): # noqa: ANN001 + validate_url(newurl, "redirect") + return super().redirect_request(req, fp, code, msg, headers, newurl) + + +def download(url: str, destination: Path, expected_sha256: str) -> None: + opener = urllib.request.build_opener(ApprovedRedirectHandler()) + request = urllib.request.Request(url, headers={"User-Agent": "nginx-ubi-lock-updater/1"}) + digest = hashlib.sha256() + with opener.open(request, timeout=30) as response, destination.open("wb") as output: + validate_url(response.geturl(), "final response") + for block in iter(lambda: response.read(1024 * 1024), b""): + digest.update(block) + output.write(block) + if digest.hexdigest() != expected_sha256: + raise LockError(f"SHA-256 mismatch for {destination.name}") + + +def main() -> int: + parser = argparse.ArgumentParser() + parser.add_argument("--inputs", required=True, type=Path) + parser.add_argument("--architecture", required=True, choices=("amd64", "arm64")) + parser.add_argument("--output", required=True, type=Path) + arguments = parser.parse_args() + inputs = validate_inputs(arguments.inputs) + if arguments.output.exists(): + raise LockError(f"refusing to overwrite existing directory: {arguments.output}") + arguments.output.parent.mkdir(parents=True, exist_ok=True) + temporary = Path(tempfile.mkdtemp(prefix=f".{arguments.output.name}-", dir=arguments.output.parent)) + try: + (temporary / "keys").mkdir() + (temporary / "rpms").mkdir() + key_rows = [] + for key in inputs["signing_keys"]: + filename = Path(urllib.parse.urlsplit(key["url"]).path).name + download(key["url"], temporary / "keys" / filename, key["sha256"]) + key_rows.append("\t".join((filename, key["fingerprint"], key["sha256"]))) + seed = inputs["architectures"][arguments.architecture]["nginx_rpm"] + filename = Path(urllib.parse.urlsplit(seed["url"]).path).name + download(seed["url"], temporary / "rpms" / filename, seed["sha256"]) + (temporary / "key-manifest.tsv").write_text( + "\n".join(sorted(key_rows)) + "\n", encoding="utf-8", newline="\n" + ) + (temporary / "rpm-seed-manifest.tsv").write_text( + f"{filename}\t{seed['sha256']}\n", encoding="utf-8", newline="\n" + ) + temporary.replace(arguments.output) + except Exception: + shutil.rmtree(temporary, ignore_errors=True) + raise + return 0 + + +if __name__ == "__main__": + raise SystemExit(main()) diff --git a/scripts/render-lock.py b/scripts/render-lock.py new file mode 100644 index 0000000..2658f66 --- /dev/null +++ b/scripts/render-lock.py @@ -0,0 +1,102 @@ +#!/usr/bin/env python3 +"""Render a deterministic artifact lock from a resolver inventory.""" + +from __future__ import annotations + +import argparse +import json +import urllib.parse +from datetime import datetime, timezone +from pathlib import Path + +from artifacts import LockError, validate_inputs, validate_lock + + +def read_tsv(path: Path, fields: list[str]) -> list[dict[str, str]]: + rows = [] + for number, line in enumerate(path.read_text(encoding="utf-8").splitlines(), 1): + values = line.split("\t") + if len(values) != len(fields): + raise LockError(f"{path}:{number} has {len(values)} fields; expected {len(fields)}") + rows.append(dict(zip(fields, values, strict=True))) + if not rows: + raise LockError(f"{path} is empty") + return rows + + +def fingerprint_for_key_id(keys: list[dict], key_id: str) -> str: + normalized = key_id.upper() + matches = [item["fingerprint"] for item in keys if item["fingerprint"].endswith(normalized)] + if len(matches) != 1: + raise LockError(f"RPM key ID {key_id} does not select exactly one approved fingerprint") + return matches[0] + + +def main() -> int: + parser = argparse.ArgumentParser() + parser.add_argument("--inputs", required=True, type=Path) + parser.add_argument("--architecture", required=True, choices=("amd64", "arm64")) + parser.add_argument("--binary-inventory", required=True, type=Path) + parser.add_argument("--source-inventory", required=True, type=Path) + parser.add_argument("--output", required=True, type=Path) + arguments = parser.parse_args() + + inputs = validate_inputs(arguments.inputs) + keys = [] + for item in inputs["signing_keys"]: + rendered = dict(item) + rendered["filename"] = Path(urllib.parse.urlsplit(item["url"]).path).name + keys.append(rendered) + keys.sort(key=lambda item: item["id"]) + + binary_fields = ["filename", "name", "epoch", "version", "release", "architecture", "source_rpm", "key_id", "repository", "url", "size", "sha256"] + packages = [] + for row in read_tsv(arguments.binary_inventory, binary_fields): + packages.append({ + "name": row["name"], "epoch": int(row["epoch"]), + "version": row["version"], "release": row["release"], + "architecture": row["architecture"], + "nevra": f"{row['name']}-{row['epoch']}:{row['version']}-{row['release']}.{row['architecture']}", + "filename": row["filename"], "url": row["url"], + "repository": row["repository"], "size": int(row["size"]), + "sha256": row["sha256"], + "signing_key_fingerprint": fingerprint_for_key_id(keys, row["key_id"]), + "source_rpm": row["source_rpm"], + }) + packages.sort(key=lambda item: item["nevra"]) + + source_fields = ["filename", "repository", "url", "size", "sha256"] + sources = [{ + "filename": row["filename"], "url": row["url"], + "repository": row["repository"], "size": int(row["size"]), + "sha256": row["sha256"], + } for row in read_tsv(arguments.source_inventory, source_fields)] + sources.sort(key=lambda item: item["filename"]) + + architecture = arguments.architecture + bases = {} + for role, reference in inputs["base_images"].items(): + bases[role] = { + "reference": reference, + "digest": reference.rsplit("@", 1)[1], + "platform": f"linux/{architecture}", + } + lock = { + "schema_version": inputs["schema_version"], + "bundle_version": inputs["bundle_version"], + "architecture": architecture, + "rpm_architecture": inputs["architectures"][architecture]["rpm_architecture"], + "generated_at": datetime.now(timezone.utc).replace(microsecond=0).isoformat().replace("+00:00", "Z"), + "nginx_version": inputs["nginx_version"], + "nginx_rpm_version": inputs["nginx_rpm_version"], + "base_images": bases, "signing_keys": keys, + "packages": packages, "source_packages": sources, + } + arguments.output.parent.mkdir(parents=True, exist_ok=True) + arguments.output.write_text(json.dumps(lock, indent=2) + "\n", encoding="utf-8", newline="\n") + validate_lock(arguments.output) + return 0 + + +if __name__ == "__main__": + raise SystemExit(main()) diff --git a/scripts/resolve-lock.sh b/scripts/resolve-lock.sh new file mode 100644 index 0000000..2dde996 --- /dev/null +++ b/scripts/resolve-lock.sh @@ -0,0 +1,160 @@ +#!/usr/bin/env bash +set -Eeuo pipefail +trap 'printf "resolver failed at line %s: %s\n" "${LINENO}" "${BASH_COMMAND}" >&2' ERR + +architecture=${1:?usage: resolve-lock.sh ARCHITECTURE INPUT_DIR OUTPUT_DIR} +input_dir=${2:?usage: resolve-lock.sh ARCHITECTURE INPUT_DIR OUTPUT_DIR} +output_dir=${3:?usage: resolve-lock.sh ARCHITECTURE INPUT_DIR OUTPUT_DIR} + +case "${architecture}" in + amd64) rpm_architecture=x86_64 ;; + arm64) rpm_architecture=aarch64 ;; + *) printf 'unsupported architecture: %s\n' "${architecture}" >&2; exit 1 ;; +esac + +test -d "${input_dir}/rpms" +test -d "${input_dir}/keys" +test -f "${input_dir}/key-manifest.tsv" +test -f "${input_dir}/rpm-seed-manifest.tsv" +test ! -e "${output_dir}" +mkdir -p "${output_dir}/rpms" "${output_dir}/srpms" + +# Resolution is an explicitly invoked, networked update operation. Ordinary +# builds consume the reviewed output lock and never run this script. +microdnf install -y dnf dnf-plugins-core gnupg2 >/dev/null + +expected_key_count=0 +while IFS=$'\t' read -r filename fingerprint sha256; do + test -f "${input_dir}/keys/${filename}" + printf '%s %s\n' "${sha256}" "${input_dir}/keys/${filename}" | sha256sum --check --status + gpg --batch --show-keys --with-colons --with-fingerprint \ + "${input_dir}/keys/${filename}" \ + | awk -F: '$1 == "fpr" { print $10 }' \ + | grep --fixed-strings --line-regexp "${fingerprint}" >/dev/null + expected_key_count=$((expected_key_count + 1)) +done <"${input_dir}/key-manifest.tsv" +actual_key_count=$(find "${input_dir}/keys" -maxdepth 1 -type f | wc -l) +test "${actual_key_count}" -eq "${expected_key_count}" + +expected_seed_count=0 +while IFS=$'\t' read -r filename sha256; do + test -f "${input_dir}/rpms/${filename}" + printf '%s %s\n' "${sha256}" "${input_dir}/rpms/${filename}" | sha256sum --check --status + expected_seed_count=$((expected_seed_count + 1)) +done <"${input_dir}/rpm-seed-manifest.tsv" +actual_seed_count=$(find "${input_dir}/rpms" -maxdepth 1 -type f -name '*.rpm' | wc -l) +test "${actual_seed_count}" -eq "${expected_seed_count}" + +rpm --import "${input_dir}"/keys/* +rpm --checksig "${input_dir}"/rpms/*.rpm + +mkdir -p /tmp/resolve-root +rpm --root /tmp/resolve-root --initdb +rpm --root /tmp/resolve-root --import "${input_dir}"/keys/* +dnf install -y \ + --forcearch="${rpm_architecture}" \ + --downloadonly \ + --downloaddir="${output_dir}/rpms" \ + --installroot=/tmp/resolve-root \ + --releasever=9 \ + --setopt=localpkg_gpgcheck=1 \ + --setopt=install_weak_deps=0 \ + --setopt=keepcache=0 \ + "${input_dir}"/rpms/*.rpm \ + ca-certificates tzdata +cp "${input_dir}"/rpms/*.rpm "${output_dir}/rpms/" + +query_format='%{repoid}|%{location}' +binary_inventory="${output_dir}/binary-inventory.tsv" +: >"${binary_inventory}" + +find_url() { + local spec=$1 + local mode=${2:-binary} + local result result_count + if test "${mode}" = source; then + result=$(dnf repoquery --forcearch="${rpm_architecture}" --disablerepo='*' \ + --enablerepo='ubi-9-*-source-rpms' \ + --qf "${query_format}" "${spec}") + else + result=$(dnf repoquery --forcearch="${rpm_architecture}" \ + --qf "${query_format}" "${spec}") + fi + result_count=$(printf '%s\n' "${result}" | sed '/^$/d' | wc -l) + if test "${result_count}" -ne 1; then + printf 'repository lookup for %s (%s) returned %s matches:\n%s\n' \ + "${spec}" "${mode}" "${result_count}" "${result}" >&2 + return 1 + fi + printf '%s\n' "${result}" +} + +while IFS= read -r rpm_path; do + metadata=$(rpm -qp --qf \ + '%{NAME}|%{EPOCHNUM}|%{VERSION}|%{RELEASE}|%{ARCH}|%{SOURCERPM}' \ + "${rpm_path}") + IFS='|' read -r name epoch version release package_arch source_rpm \ + <<<"${metadata}" + filename=$(basename "${rpm_path}") + if test "${name}" = nginx; then + repository=nginx-stable + url="https://nginx.org/packages/rhel/9/${rpm_architecture}/RPMS/${filename}" + else + spec="${name}-${epoch}:${version}-${release}.${package_arch}" + query=$(find_url "${spec}") + repository=${query%%|*} + location=${query#*|} + case "${repository}" in + ubi-9-baseos-rpms) component=baseos ;; + ubi-9-appstream-rpms) component=appstream ;; + ubi-9-codeready-builder-rpms) component=codeready-builder ;; + *) printf 'unexpected binary repository: %s\n' "${repository}" >&2; exit 1 ;; + esac + url="https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/${rpm_architecture}/${component}/os/${location}" + fi + signature=$(rpm -qp --qf \ + '%{SIGPGP:pgpsig}|%{SIGGPG:pgpsig}|%{RSAHEADER:pgpsig}|%{DSAHEADER:pgpsig}' \ + "${rpm_path}") + key_id=$(sed -n 's/.*[Kk]ey ID \([0-9A-Fa-f]*\).*/\1/p' <<<"${signature}" | head -n1) + test -n "${key_id}" + size=$(stat -c '%s' "${rpm_path}") + sha256=$(sha256sum "${rpm_path}" | cut -d' ' -f1) + printf '%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n' \ + "${filename}" "${name}" "${epoch}" "${version}" "${release}" \ + "${package_arch}" "${source_rpm}" "${key_id}" "${repository}" \ + "${url}" "${size}" "${sha256}" >>"${binary_inventory}" +done < <(find "${output_dir}/rpms" -maxdepth 1 -type f -name '*.rpm' | sort) + +cut -f7 "${binary_inventory}" | sort -u >"${output_dir}/source-names.txt" +source_inventory="${output_dir}/source-inventory.tsv" +: >"${source_inventory}" + +while IFS= read -r source_rpm; do + if [[ ${source_rpm} == nginx-* ]]; then + repository=nginx-stable-source + url="https://nginx.org/packages/rhel/9/SRPMS/${source_rpm}" + else + spec=${source_rpm%.rpm} + query=$(find_url "${spec}" source) + repository=${query%%|*} + location=${query#*|} + case "${repository}" in + ubi-9-baseos-source-rpms) component=baseos ;; + ubi-9-appstream-source-rpms) component=appstream ;; + ubi-9-codeready-builder-source-rpms) component=codeready-builder ;; + *) printf 'unexpected source repository: %s\n' "${repository}" >&2; exit 1 ;; + esac + url="https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/${rpm_architecture}/${component}/source/SRPMS/${location}" + fi + curl --fail --location --proto '=https' --retry 3 \ + --output "${output_dir}/srpms/${source_rpm}" "${url}" + rpm --checksig "${output_dir}/srpms/${source_rpm}" + size=$(stat -c '%s' "${output_dir}/srpms/${source_rpm}") + sha256=$(sha256sum "${output_dir}/srpms/${source_rpm}" | cut -d' ' -f1) + printf '%s\t%s\t%s\t%s\t%s\n' \ + "${source_rpm}" "${repository}" "${url}" "${size}" "${sha256}" \ + >>"${source_inventory}" +done <"${output_dir}/source-names.txt" + +sort -o "${binary_inventory}" "${binary_inventory}" +sort -o "${source_inventory}" "${source_inventory}" diff --git a/scripts/verify-rpm-bundle.sh b/scripts/verify-rpm-bundle.sh new file mode 100644 index 0000000..027bf5c --- /dev/null +++ b/scripts/verify-rpm-bundle.sh @@ -0,0 +1,65 @@ +#!/usr/bin/env bash +set -euo pipefail + +usage() { + echo "usage: $0 LOCK BUNDLE [--include-sources]" >&2 + exit 2 +} + +[[ $# -eq 2 || $# -eq 3 ]] || usage +lock=$1 +bundle=$2 +include_sources=${3:-} +[[ -z "${include_sources}" || "${include_sources}" == "--include-sources" ]] || usage + +script_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd) +verify_args=(verify-bundle --lock "${lock}" --bundle "${bundle}") +if [[ "${include_sources}" == "--include-sources" ]]; then + verify_args+=(--include-sources) +fi +"${PYTHON:-python3}" "${script_dir}/artifacts.py" "${verify_args[@]}" + +rpmdb=$(mktemp -d) +cleanup() { + rm -rf -- "${rpmdb}" +} +trap cleanup EXIT + +while IFS=$'\t' read -r filename fingerprint sha256; do + [[ "${filename}" == "filename" ]] && continue + gpg --batch --show-keys --with-colons "${bundle}/keys/${filename}" \ + | awk -F: -v expected="${fingerprint}" \ + '$1 == "fpr" && $10 == expected { found = 1 } END { exit !found }' || { + echo "signing key fingerprint mismatch: ${filename}" >&2 + exit 1 + } + echo "${sha256} ${bundle}/keys/${filename}" | sha256sum --check --status + rpm --define "_dbpath ${rpmdb}" --import "${bundle}/keys/${filename}" +done < "${bundle}/key-manifest.tsv" + +while IFS=$'\t' read -r filename name epoch version release architecture source_rpm fingerprint sha256; do + [[ "${filename}" == "filename" ]] && continue + package="${bundle}/rpms/${filename}" + echo "${sha256} ${package}" | sha256sum --check --status + rpm_signature=$(rpm -qp --queryformat \ + $'%{RSAHEADER:pgpsig}\n%{DSAHEADER:pgpsig}\n%{SIGPGP:pgpsig}\n%{SIGGPG:pgpsig}\n' \ + "${package}" 2>/dev/null) + grep -Eqi "key ID [[:xdigit:]]*${fingerprint: -8}" <<< "${rpm_signature}" || { + echo "RPM signer does not match the lock: ${filename}" >&2 + exit 1 + } + signature_result=$(rpm --define "_dbpath ${rpmdb}" --checksig "${package}") + grep -Eq ': digests signatures OK$' <<< "${signature_result}" || { + echo "RPM signature verification failed: ${filename}" >&2 + exit 1 + } + actual=$(rpm -qp --queryformat $'%{NAME}\t%{EPOCHNUM}\t%{VERSION}\t%{RELEASE}\t%{ARCH}\t%{SOURCERPM}' \ + "${package}" 2>/dev/null) + expected="${name}"$'\t'"${epoch}"$'\t'"${version}"$'\t'"${release}"$'\t'"${architecture}"$'\t'"${source_rpm}" + [[ "${actual}" == "${expected}" ]] || { + echo "RPM metadata does not match the lock: ${filename}" >&2 + exit 1 + } +done < "${bundle}/rpm-manifest.tsv" + +echo "verified locked RPM bundle: ${bundle}" diff --git a/tests/test_artifacts.py b/tests/test_artifacts.py new file mode 100644 index 0000000..d150646 --- /dev/null +++ b/tests/test_artifacts.py @@ -0,0 +1,308 @@ +from __future__ import annotations + +import copy +import json +import sys +import tempfile +import unittest +from pathlib import Path +from unittest import mock + +sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "scripts")) + +import artifacts # noqa: E402 + + +FINGERPRINT = "8540A6F18833A80E9C1653A42FD21310B49F6B46" +SHA = "0" * 64 + + +def valid_lock() -> dict: + digest = f"sha256:{'1' * 64}" + rpm_architecture = "x86_64" + package = { + "name": "nginx", + "epoch": 2, + "version": "1.30.4", + "release": "1.el9.ngx", + "architecture": rpm_architecture, + "nevra": "nginx-2:1.30.4-1.el9.ngx.x86_64", + "filename": "nginx-1.30.4-1.el9.ngx.x86_64.rpm", + "url": "https://nginx.org/packages/rhel/9/x86_64/RPMS/nginx-1.30.4-1.el9.ngx.x86_64.rpm", + "repository": "nginx-stable", + "size": 1, + "sha256": SHA, + "signing_key_fingerprint": FINGERPRINT, + "source_rpm": "nginx-1.30.4-1.el9.ngx.src.rpm", + } + return { + "schema_version": 1, + "bundle_version": 1, + "architecture": "amd64", + "rpm_architecture": rpm_architecture, + "generated_at": "2026-09-12T00:00:00Z", + "nginx_version": "1.30.4", + "nginx_rpm_version": "1.30.4-1.el9.ngx", + "base_images": { + role: { + "reference": f"registry.access.redhat.com/ubi9/{image}:9.8@{digest}", + "digest": digest, + "platform": "linux/amd64", + } + for role, image in (("builder", "ubi-minimal"), ("runtime", "ubi-micro")) + }, + "signing_keys": [{ + "id": "nginx-signing", + "filename": "nginx_signing.key", + "url": "https://nginx.org/keys/nginx_signing.key", + "sha256": SHA, + "fingerprint": FINGERPRINT, + }], + "packages": [package], + "source_packages": [{ + "filename": "nginx-1.30.4-1.el9.ngx.src.rpm", + "url": "https://nginx.org/packages/rhel/9/SRPMS/nginx-1.30.4-1.el9.ngx.src.rpm", + "repository": "nginx-stable-source", + "size": 1, + "sha256": SHA, + }], + } + + +class ArtifactLockTests(unittest.TestCase): + def setUp(self) -> None: + repository = Path(__file__).resolve().parents[1] + self.temporary = tempfile.TemporaryDirectory(dir=repository) + self.root = Path(self.temporary.name) + + def tearDown(self) -> None: + self.temporary.cleanup() + + def write_lock(self, value: dict) -> Path: + path = self.root / "lock.json" + path.write_text(json.dumps(value), encoding="utf-8") + return path + + def assert_rejected(self, value: dict) -> None: + with self.assertRaises(artifacts.LockError): + artifacts.validate_lock(self.write_lock(value)) + + def write_bundle(self, lock_path: Path, value: dict, include_sources: bool = False) -> Path: + bundle = self.root / "bundle" + key_bytes = b"k" + rpm_bytes = b"r" + source_bytes = b"s" + value["signing_keys"][0]["sha256"] = artifacts.hashlib.sha256(key_bytes).hexdigest() + value["packages"][0]["sha256"] = artifacts.hashlib.sha256(rpm_bytes).hexdigest() + value["source_packages"][0]["sha256"] = artifacts.hashlib.sha256(source_bytes).hexdigest() + lock_path.write_text(json.dumps(value), encoding="utf-8") + (bundle / "keys").mkdir(parents=True) + (bundle / "rpms").mkdir() + (bundle / "keys" / value["signing_keys"][0]["filename"]).write_bytes(key_bytes) + (bundle / "rpms" / value["packages"][0]["filename"]).write_bytes(rpm_bytes) + if include_sources: + (bundle / "srpms").mkdir() + (bundle / "srpms" / value["source_packages"][0]["filename"]).write_bytes(source_bytes) + manifests = artifacts.manifest_contents( + value, artifacts.sha256_file(lock_path), include_sources + ) + for filename, contents in manifests.items(): + (bundle / filename).write_text(contents, encoding="utf-8", newline="\n") + return bundle + + def test_valid_lock_is_accepted(self) -> None: + artifacts.validate_lock(self.write_lock(valid_lock())) + + def test_runtime_manifest_is_derived_from_the_validated_lock(self) -> None: + lock = artifacts.validate_lock(self.write_lock(valid_lock())) + manifest = artifacts.rpm_manifest(lock) + self.assertEqual( + manifest.splitlines(), + [ + "filename\tname\tepoch\tversion\trelease\tarchitecture\t" + "source_rpm\tfingerprint\tsha256", + "nginx-1.30.4-1.el9.ngx.x86_64.rpm\tnginx\t2\t1.30.4\t" + f"1.el9.ngx\tx86_64\tnginx-1.30.4-1.el9.ngx.src.rpm\t{FINGERPRINT}\t{SHA}", + ], + ) + + def test_repository_inputs_and_generated_locks_are_valid(self) -> None: + repository = Path(__file__).resolve().parents[1] + inputs = artifacts.validate_inputs(repository / "artifacts" / "lock-inputs.json") + for architecture in artifacts.ARCHES: + lock = artifacts.validate_lock(repository / "artifacts" / "locks" / f"{architecture}.json") + self.assertEqual(lock["nginx_version"], inputs["nginx_version"]) + self.assertEqual(lock["nginx_rpm_version"], inputs["nginx_rpm_version"]) + for role, reference in inputs["base_images"].items(): + self.assertEqual(lock["base_images"][role]["reference"], reference) + selected = inputs["architectures"][architecture]["nginx_rpm"] + nginx = next(item for item in lock["packages"] if item["name"] == "nginx") + self.assertEqual(nginx["url"], selected["url"]) + self.assertEqual(nginx["sha256"], selected["sha256"]) + expected_keys = { + (item["id"], item["url"], item["sha256"], item["fingerprint"]) + for item in inputs["signing_keys"] + } + actual_keys = { + (item["id"], item["url"], item["sha256"], item["fingerprint"]) + for item in lock["signing_keys"] + } + self.assertEqual(actual_keys, expected_keys) + + def test_malformed_and_unexpected_fields_fail_closed(self) -> None: + path = self.root / "bad.json" + path.write_text("{", encoding="utf-8") + with self.assertRaises(artifacts.LockError): + artifacts.validate_lock(path) + value = valid_lock() + value["unexpected"] = True + self.assert_rejected(value) + + def test_wrong_arch_version_nevra_source_and_base_are_rejected(self) -> None: + mutations = [] + value = valid_lock() + value["packages"][0]["architecture"] = "aarch64" + mutations.append(value) + value = valid_lock() + value["packages"][0]["version"] = "1.30.3" + mutations.append(value) + value = valid_lock() + value["packages"][0]["nevra"] = "wrong" + mutations.append(value) + value = valid_lock() + value["packages"][0]["source_rpm"] = "missing.src.rpm" + mutations.append(value) + value = valid_lock() + value["base_images"]["runtime"]["platform"] = "linux/arm64" + mutations.append(value) + value = valid_lock() + value["base_images"]["runtime"]["digest"] = f"sha256:{'2' * 64}" + mutations.append(value) + for mutation in mutations: + with self.subTest(mutation=mutation): + self.assert_rejected(mutation) + + def test_base_digest_drift_from_reviewed_inputs_is_rejected(self) -> None: + repository = Path(__file__).resolve().parents[1] + lock = json.loads( + (repository / "artifacts" / "locks" / "amd64.json").read_text(encoding="utf-8") + ) + changed_digest = f"sha256:{'2' * 64}" + lock["base_images"]["runtime"]["digest"] = changed_digest + prefix = lock["base_images"]["runtime"]["reference"].rsplit("@", 1)[0] + lock["base_images"]["runtime"]["reference"] = f"{prefix}@{changed_digest}" + lock_path = self.write_lock(lock) + with self.assertRaises(artifacts.LockError): + artifacts.validate_lock(lock_path, repository / "artifacts" / "lock-inputs.json") + + def test_duplicate_and_unapproved_signer_or_url_are_rejected(self) -> None: + value = valid_lock() + value["packages"].append(copy.deepcopy(value["packages"][0])) + self.assert_rejected(value) + value = valid_lock() + value["packages"][0]["signing_key_fingerprint"] = "A" * 40 + self.assert_rejected(value) + value = valid_lock() + value["packages"][0]["url"] = "https://example.invalid/package.rpm" + self.assert_rejected(value) + + def test_exact_bundle_is_accepted_with_or_without_sources(self) -> None: + for include_sources in (False, True): + with self.subTest(include_sources=include_sources): + lock_path = self.root / f"lock-{include_sources}.json" + bundle = self.write_bundle(lock_path, valid_lock(), include_sources) + artifacts.verify_bundle(lock_path, bundle, include_sources) + if bundle.exists(): + for path in sorted(bundle.rglob("*"), reverse=True): + if path.is_file(): + path.unlink() + else: + path.rmdir() + bundle.rmdir() + + def test_tampered_missing_unexpected_and_wrong_lock_bundles_fail_closed(self) -> None: + cases = ("tampered", "missing", "unexpected", "wrong-lock") + for case in cases: + with self.subTest(case=case): + lock_path = self.root / f"{case}.json" + value = valid_lock() + bundle = self.write_bundle(lock_path, value) + rpm = bundle / "rpms" / value["packages"][0]["filename"] + if case == "tampered": + rpm.write_bytes(b"x") + elif case == "missing": + rpm.unlink() + elif case == "unexpected": + (bundle / "unexpected").write_text("x", encoding="utf-8") + else: + lock_path.write_text(json.dumps({**value, "generated_at": "2026-09-13T00:00:00Z"}), encoding="utf-8") + with self.assertRaises(artifacts.LockError): + artifacts.verify_bundle(lock_path, bundle) + for path in sorted(bundle.rglob("*"), reverse=True): + if path.is_file(): + path.unlink() + else: + path.rmdir() + bundle.rmdir() + + def test_alternate_source_map_requires_an_exact_safe_mapping(self) -> None: + value = valid_lock() + expected = set(artifacts.bundle_artifacts(value)) + mapping = { + "schema_version": 1, + "artifacts": {path: f"https://mirror.example.test/{path}" for path in expected}, + } + path = self.root / "source-map.json" + path.write_text(json.dumps(mapping), encoding="utf-8") + urls, hosts = artifacts.read_source_map(path, expected) + self.assertEqual(set(urls), expected) + self.assertEqual(hosts, {"mirror.example.test"}) + + invalid = copy.deepcopy(mapping) + invalid["artifacts"].pop(next(iter(expected))) + path.write_text(json.dumps(invalid), encoding="utf-8") + with self.assertRaises(artifacts.LockError): + artifacts.read_source_map(path, expected) + + invalid = copy.deepcopy(mapping) + invalid["artifacts"]["unexpected"] = "https://mirror.example.test/unexpected" + path.write_text(json.dumps(invalid), encoding="utf-8") + with self.assertRaises(artifacts.LockError): + artifacts.read_source_map(path, expected) + + invalid = copy.deepcopy(mapping) + logical_path = next(iter(expected)) + invalid["artifacts"][logical_path] = "https://user:secret@mirror.example.test/file" + path.write_text(json.dumps(invalid), encoding="utf-8") + with self.assertRaises(artifacts.LockError): + artifacts.read_source_map(path, expected) + + def test_acquisition_publishes_only_a_complete_verified_bundle(self) -> None: + value = valid_lock() + value["signing_keys"][0]["sha256"] = artifacts.hashlib.sha256(b"k").hexdigest() + value["packages"][0]["sha256"] = artifacts.hashlib.sha256(b"r").hexdigest() + lock_path = self.write_lock(value) + output = self.root / "acquired" + + def fake_download(url, destination, hosts, context, token): + del url, hosts, context, token + destination.write_bytes(b"k" if destination.parent.name == "keys" else b"r") + + with mock.patch.object(artifacts, "download", side_effect=fake_download): + artifacts.acquire_bundle(lock_path, output) + artifacts.verify_bundle(lock_path, output) + self.assertEqual(list(self.root.glob(".acquired.*")), []) + + with self.assertRaises(artifacts.LockError): + artifacts.acquire_bundle(lock_path, output) + + failed_output = self.root / "failed" + with mock.patch.object(artifacts, "download", side_effect=artifacts.LockError("failed")): + with self.assertRaises(artifacts.LockError): + artifacts.acquire_bundle(lock_path, failed_output) + self.assertFalse(failed_output.exists()) + self.assertEqual(list(self.root.glob(".failed.*")), []) + + +if __name__ == "__main__": + unittest.main()