tree: import changes from testing-devel at bac3ef53b6

.tekton/base/base/fedora-coreos.yaml

@@ -41,6 +41,10 @@ spec:
     - linux/ppc64le
   - name: clone-depth
     value: 50
+  - name: hermetic
+    value: true
+  - name: prefetch-input
+    value: '[{"type": "rpm", "path": "."}]'
   pipelineRef:
     params:
     - name: bundle

.tekton/base/on-pull-request/fedora-coreos-on-pull-request.yaml

@@ -41,6 +41,10 @@ spec:
     - linux/ppc64le
   - name: clone-depth
     value: 50
+  - name: hermetic
+    value: true
+  - name: prefetch-input
+    value: '[{"type": "rpm", "path": "."}]'
   - name: image-expires-after
     value: 5d
   pipelineRef:

.tekton/base/on-push/fedora-coreos-on-push.yaml

@@ -40,6 +40,10 @@ spec:
     - linux/ppc64le
   - name: clone-depth
     value: 50
+  - name: hermetic
+    value: true
+  - name: prefetch-input
+    value: '[{"type": "rpm", "path": "."}]'
   pipelineRef:
     params:
     - name: bundle

.tekton/branched/on-pull-request/fedora-coreos-branched-on-pull-request.yaml

@@ -42,6 +42,10 @@ spec:
     - linux/ppc64le
   - name: clone-depth
     value: 50
+  - name: hermetic
+    value: true
+  - name: prefetch-input
+    value: '[{"type": "rpm", "path": "."}]'
   - name: image-expires-after
     value: 5d
   pipelineRef:

.tekton/branched/on-push/fedora-coreos-branched-on-push.yaml

@@ -41,6 +41,10 @@ spec:
     - linux/ppc64le
   - name: clone-depth
     value: 50
+  - name: hermetic
+    value: true
+  - name: prefetch-input
+    value: '[{"type": "rpm", "path": "."}]'
   pipelineRef:
     params:
     - name: bundle

.tekton/next-devel/on-pull-request/fedora-coreos-next-devel-on-pull-request.yaml

@@ -42,6 +42,10 @@ spec:
     - linux/ppc64le
   - name: clone-depth
     value: 50
+  - name: hermetic
+    value: true
+  - name: prefetch-input
+    value: '[{"type": "rpm", "path": "."}]'
   - name: image-expires-after
     value: 5d
   pipelineRef:

.tekton/next-devel/on-push/fedora-coreos-next-devel-on-push.yaml

@@ -41,6 +41,10 @@ spec:
     - linux/ppc64le
   - name: clone-depth
     value: 50
+  - name: hermetic
+    value: true
+  - name: prefetch-input
+    value: '[{"type": "rpm", "path": "."}]'
   pipelineRef:
     params:
     - name: bundle

.tekton/next/on-pull-request/fedora-coreos-next-on-pull-request.yaml

@@ -42,6 +42,10 @@ spec:
     - linux/ppc64le
   - name: clone-depth
     value: 50
+  - name: hermetic
+    value: true
+  - name: prefetch-input
+    value: '[{"type": "rpm", "path": "."}]'
   - name: image-expires-after
     value: 5d
   pipelineRef:

.tekton/next/on-push/fedora-coreos-next-on-push.yaml

@@ -41,6 +41,10 @@ spec:
     - linux/ppc64le
   - name: clone-depth
     value: 50
+  - name: hermetic
+    value: true
+  - name: prefetch-input
+    value: '[{"type": "rpm", "path": "."}]'
   pipelineRef:
     params:
     - name: bundle

.tekton/rawhide/on-pull-request/fedora-coreos-rawhide-on-pull-request.yaml

@@ -42,6 +42,10 @@ spec:
     - linux/ppc64le
   - name: clone-depth
     value: 50
+  - name: hermetic
+    value: true
+  - name: prefetch-input
+    value: '[{"type": "rpm", "path": "."}]'
   - name: image-expires-after
     value: 5d
   pipelineRef:

.tekton/rawhide/on-push/fedora-coreos-rawhide-on-push.yaml

@@ -41,6 +41,10 @@ spec:
     - linux/ppc64le
   - name: clone-depth
     value: 50
+  - name: hermetic
+    value: true
+  - name: prefetch-input
+    value: '[{"type": "rpm", "path": "."}]'
   pipelineRef:
     params:
     - name: bundle

.tekton/stable/on-pull-request/fedora-coreos-stable-on-pull-request.yaml

@@ -42,6 +42,10 @@ spec:
     - linux/ppc64le
   - name: clone-depth
     value: 50
+  - name: hermetic
+    value: true
+  - name: prefetch-input
+    value: '[{"type": "rpm", "path": "."}]'
   - name: image-expires-after
     value: 5d
   pipelineRef:

.tekton/stable/on-push/fedora-coreos-stable-on-push.yaml

@@ -41,6 +41,10 @@ spec:
     - linux/ppc64le
   - name: clone-depth
     value: 50
+  - name: hermetic
+    value: true
+  - name: prefetch-input
+    value: '[{"type": "rpm", "path": "."}]'
   pipelineRef:
     params:
     - name: bundle

.tekton/testing-devel/on-pull-request/fedora-coreos-testing-devel-on-pull-request.yaml

@@ -42,6 +42,10 @@ spec:
     - linux/ppc64le
   - name: clone-depth
     value: 50
+  - name: hermetic
+    value: true
+  - name: prefetch-input
+    value: '[{"type": "rpm", "path": "."}]'
   - name: image-expires-after
     value: 5d
   pipelineRef:

.tekton/testing-devel/on-push/fedora-coreos-testing-devel-on-push.yaml

@@ -41,6 +41,10 @@ spec:
     - linux/ppc64le
   - name: clone-depth
     value: 50
+  - name: hermetic
+    value: true
+  - name: prefetch-input
+    value: '[{"type": "rpm", "path": "."}]'
   pipelineRef:
     params:
     - name: bundle

.tekton/testing/on-pull-request/fedora-coreos-testing-on-pull-request.yaml

@@ -42,6 +42,10 @@ spec:
     - linux/ppc64le
   - name: clone-depth
     value: 50
+  - name: hermetic
+    value: true
+  - name: prefetch-input
+    value: '[{"type": "rpm", "path": "."}]'
   - name: image-expires-after
     value: 5d
   pipelineRef:

.tekton/testing/on-push/fedora-coreos-testing-on-push.yaml

@@ -41,6 +41,10 @@ spec:
     - linux/ppc64le
   - name: clone-depth
     value: 50
+  - name: hermetic
+    value: true
+  - name: prefetch-input
+    value: '[{"type": "rpm", "path": "."}]'
   pipelineRef:
     params:
     - name: bundle

build-rootfs

@@ -21,6 +21,8 @@ import yaml
 ARCH = os.uname().machine
 SRCDIR = '/src'
 INPUTHASH = '/run/inputhash'
+HERMETIC_REPO = '/etc/yum.repos.d/cachi2.repo'
+IS_HERMETIC = os.path.exists(HERMETIC_REPO)
 
 
 def main():
@@ -51,8 +53,9 @@ def main():
         # NEVRAs to appear there. For lack of a generic solution for any repo
         # there, we only special-case the one place where we know we use this.
         if lockfile_repos == ['fedora-coreos-pool']:
-            modify_pool_repo(locked_nevras)
-            repos += lockfile_repos
+            if not IS_HERMETIC:
+                modify_pool_repo(locked_nevras)
+                repos += lockfile_repos
         elif len(lockfile_repos) > 0:
             raise Exception(f"unknown lockfile-repo found in {lockfile_repos}")
 
@@ -110,12 +113,15 @@ def inject_yumrepos():
         if os.path.basename(repo) == 'secret.repo':
             # this is a supported podman secret to inject repo files; see Containerfile
             continue
+        if repo == HERMETIC_REPO:
+            # this is the repo Konflux injects when hermetic build is enabled
+            continue
         os.unlink(repo)
 
     # and now inject our repos
-    for repo in glob.glob(f'{SRCDIR}/*.repo'):
-        shutil.copy(repo, "/etc/yum.repos.d")
-
+    if not IS_HERMETIC:
+        for repo in glob.glob(f'{SRCDIR}/*.repo'):
+            shutil.copy(repo, "/etc/yum.repos.d")
 
 def build_rootfs(
     target_rootfs, manifest_path, packages, locked_nevras,

buildroot-prep

@@ -8,8 +8,11 @@ set -euo pipefail
 arch=$(uname -m)
 . /etc/os-release
 
-cp /src/fedora-coreos-continuous.repo /etc/yum.repos.d
-
+# cachi2 is the repo Konflux injects when hermetic build is enabled and
+# is self-sufficient to pull all the required RPMs.
+if [ ! -f "/etc/yum.repos.d/cachi2.repo" ]; then
+    cp /src/fedora-coreos-continuous.repo /etc/yum.repos.d
+fi
 # NOTE: try to remove anything that queries repos here once it's no longer
 # needed so that we don't unnecessarily pay for repo metadata.