In response to this:

For KONFLUX-6210, clair needs access to a name and cpe label that it can use to look up the image in VEX statements.

This is enforced in release flow, and the release fails if required labels are not present.

 + name=cert-manager-istio-csr-1-18
 ++ jq -r '.metadata.labels // [] | .[] | select(.name == "cpe")
         | .value // empty'
 + cpe_label=cpe:/a:redhat:enterprise_linux:9::appstream
 + [[ -z cpe:/a:redhat:enterprise_linux:9::appstream ]]
 + [[ cpe:/a:redhat:enterprise_linux:9::appstream != \c\p\e\:\/\a\:\r\e\d\h\a\t\:\c\e\r\t\_\m\a\n\a\g\e\r\:\1\.\1\8\:\:\e\l\9 ]]
 + fail_or_warn 'Component '\''cert-manager-istio-csr-1-18'\'' '\''cpe'\'' label ('\''cpe:/a:redhat:enterprise_linux:9::appstream'\'') does not match' 'the single required CPE value from the data file ('\''cpe:/a:redhat:cert_manager:1.18::el9'\'').'
 + local 'msg=Component '\''cert-manager-istio-csr-1-18'\'' '\''cpe'\'' label ('\''cpe:/a:redhat:enterprise_linux:9::appstream'\'') does not match the single required CPE value from the data file ('\''cpe:/a:redhat:cert_manager:1.18::el9'\'').'
 + '[' true == true ']'
 + echo 'Error: Component '\''cert-manager-istio-csr-1-18'\'' '\''cpe'\'' label ('\''cpe:/a:redhat:enterprise_linux:9::appstream'\'') does not match the single required CPE value from the data file ('\''cpe:/a:redhat:cert_manager:1.18::el9'\'').'
 Error: Component 'cert-manager-istio-csr-1-18' 'cpe' label ('cpe:/a:redhat:enterprise_linux:9::appstream') does not match the single required CPE value from the data file ('cpe:/a:redhat:cert_manager:1.18::el9').

See also

• Add new rule data fields for image metadata release-engineering/rhtap-ec-policy#149
• https://gitlab.cee.redhat.com/releng/konflux-release-data/-/merge_requests/13312
• https://gitlab.cee.redhat.com/releng/konflux-release-data/-/merge_requests/13313

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

• OWNERS [bharath-b-rh]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment