Conversation
Signed-off-by: Ilya Buziuk <ibuziuk@redhat.com>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: ibuziuk The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughWalkthroughUBI9 and UBI10 now install Azure CLI on supported architectures, skip unsupported architectures, clean package caches, and generate ChangesAzure CLI support
Estimated code review effort: 2 (Simple) | ~10 minutes Sequence Diagram(s)sequenceDiagram
participant DockerBuild
participant MicrosoftRepository
participant Dnf
DockerBuild->>MicrosoftRepository: Import RPM key and configure repository
DockerBuild->>Dnf: Install azure-cli on amd64 or arm64
DockerBuild->>Dnf: Clean package caches
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@universal/ubi10/Dockerfile`:
- Around line 520-523: Update the Azure CLI installation block to use the RHEL
10 Microsoft signing key before installing the repository package, or remove the
explicit key import if packages-microsoft-prod.rpm reliably installs the newer
key. Ensure the subsequent dnf install of azure-cli uses the RHEL 10 repository
configuration.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 84e403fa-08a3-4dd9-8e1b-9ebe8a3dbbc0
📒 Files selected for processing (2)
universal/ubi10/Dockerfileuniversal/ubi9/Dockerfile
| # Azure CLI installation for amd64 and arm64 | ||
| rpm --import https://packages.microsoft.com/keys/microsoft.asc | ||
| dnf install -y https://packages.microsoft.com/config/rhel/10/packages-microsoft-prod.rpm | ||
| dnf install -y azure-cli |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
for key in \
https://packages.microsoft.com/keys/microsoft.asc \
https://packages.microsoft.com/keys/microsoft-2025.asc \
https://packages.microsoft.com/rhel/10/prod/repodata/repomd.xml.key
do
echo "== ${key} =="
curl -fsSL "${key}" | gpg --show-keys --with-colons | awk -F: '$1=="pub" {print}'
doneRepository: devfile/developer-images
Length of output: 291
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
echo "Dockerfile context:"
sed -n '510,530p' universal/ubi10/Dockerfile
echo
echo "Check package availability:"
command -v curl || true
command -v rpm || true
command -v gpg || true
echo
echo "Public key fetch and fingerprint headers without local gpg:"
for key in \
https://packages.microsoft.com/keys/microsoft.asc \
https://packages.microsoft.com/keys/microsoft-2025.asc \
https://packages.microsoft.com/rhel/10/prod/repodata/repomd.xml.key
do
echo "== ${key} =="
curl -fsSL "${key}" | od -An -tx1 -N256 | tr -d ' \n' | sed 's/^/'"${key}"': /'
echo
done
echo
echo "Fetch Microsoft Rhel 10 repo RPM metadata key and inspect with rpm if available:"
rm -f /tmp/microsoft-rhel-10.gpg
curl -fsSL https://packages.microsoft.com/rhel/10/prod/repodata/repomd.xml.key -o /tmp/microsoft-rhel10-repomd.xml.key
if command -v rpm >/dev/null 2>&1; then
rpm -qip /tmp/microsoft-rhel10-repomd.xml.key 2>/dev/null || true
else
echo "rpm not available"
fiRepository: devfile/developer-images
Length of output: 1042
🌐 Web query:
Microsoft Azure CLI RHEL 10 install DNF microsoft.asc microsoft-2025.asc
💡 Result:
To install the Azure CLI on Red Hat Enterprise Linux (RHEL) 10, you must use the Microsoft repository key specifically designated for repositories created after April 2025, which is microsoft-2025.asc [1][2]. As of July 2026, the official installation process involves the following steps [3][4]: 1. Import the correct Microsoft repository GPG key for RHEL 10 [3][4]: sudo rpm --import https://packages.microsoft.com/keys/microsoft-2025.asc 2. Install the Microsoft repository configuration package for RHEL 10 to enable the required package source [3]: sudo dnf install -y https://packages.microsoft.com/config/rhel/10/packages-microsoft-prod.rpm 3. Install the Azure CLI package using dnf [3][4]: sudo dnf install azure-cli Regarding the GPG keys: - microsoft-2025.asc: This is the required key for RHEL 10 repositories [1][2]. It corresponds to the public key fingerprint AA86 F75E 427A 19DD 3334 6403 EE4D 7792 F748 182B [1][2]. - microsoft.asc: This is the original key used for older distributions (e.g., RHEL 9 and earlier) created before May 2025 and should not be used for RHEL 10 [1][2]. Always prefer using the configuration package (packages-microsoft-prod.rpm) from https://packages.microsoft.com/config/rhel/10/ to ensure the repository is configured with the correct GPG key and base URLs automatically [1].
Citations:
- 1: https://learn.microsoft.com/en-us/linux/packages
- 2: https://github.com/microsoft/linux-package-repositories/
- 3: https://learn.microsoft.com/en-us/cli/azure/install-azure-cli-linux?view=azure-cli-latest
- 4: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html-single/deploying_and_managing_rhel_on_microsoft_azure/index
🌐 Web query:
packages.microsoft.com github RHEL 10 packages-microsoft-prod RPM GPG key
💡 Result:
RHEL 10 is supported by Microsoft's Linux package repositories [1][2]. Unlike earlier RHEL versions, RHEL 10 requires a newer GPG signing key due to updated security requirements [3][2]. Repository Configuration Microsoft provides a specific repository configuration package for RHEL 10. You can download and install it using the following commands: # Download the RHEL 10 repository configuration package curl -sSL -O https://packages.microsoft.com/config/rhel/10/packages-microsoft-prod.rpm # Install the repository configuration package sudo rpm -i packages-microsoft-prod.rpm GPG Keys for RHEL 10 RHEL 10 packages are signed with a newer Microsoft GPG key (RSA-4096), which is distinct from the older microsoft.asc key used for RHEL 8 and RHEL 9 [3][2]. 1. New RHEL 10 Key: The key for RHEL 10 is typically imported automatically when using the repository configuration package above. If you need to import it manually, it is available at: https://packages.microsoft.com/rhel/10/prod/repodata/repomd.xml.key 2. Legacy Key: The legacy key (microsoft.asc) is still required for certain products (such as Microsoft Edge) that have not yet migrated to the new signing infrastructure [3]. - Legacy Key URL: https://packages.microsoft.com/keys/microsoft.asc - Command: sudo rpm --import https://packages.microsoft.com/keys/microsoft.asc Key Details for Verification - New GPG Public Key (for repositories created after April 2025): - URL: https://packages.microsoft.com/keys/microsoft-2025.asc - Fingerprint: AA86 F75E 427A 19DD 3334 6403 EE4D 7792 F748 182B [4][5] For further details on repository structure, you can browse the official RHEL 10 repository index at https://packages.microsoft.com/rhel/10/prod/ [6].
Citations:
- 1: https://learn.microsoft.com/en-us/entra/identity/devices/whats-new-linux
- 2: Prepare for CentOS/RHEL 10 release microsoft/linux-package-repositories#213
- 3: https://github.com/MicrosoftDocs/entra-docs/blob/main/docs/identity/devices/whats-new-linux.md
- 4: https://learn.microsoft.com/en-us/linux/packages
- 5: https://github.com/microsoft/linux-package-repositories
- 6: https://packages.microsoft.com/rhel/10/prod/
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
echo "Fetch keys with HTTP headers/length:"
for key in \
https://packages.microsoft.com/keys/microsoft.asc \
https://packages.microsoft.com/keys/microsoft-2025.asc \
https://packages.microsoft.com/rhel/10/prod/repodata/repomd.xml.key
do
echo "== ${key} =="
(timeout 20 curl -sSIL "${key}" || true | sed -n '1,20p')
(timeout 20 curl -fsSL "${key}" >/tmp/key.bin 2>/tmp/key.err && wc -c /tmp/key.bin && hexdump -C /tmp/key.bin | sed -n '1,20p') || echo "curl failed: $(cat /tmp/key.err)"
echo
done
echo "Locate related documentation/config in repo for expected signature keys:"
rg -n "microsoft-(2025|asc)|packages-microsoft-prod|rpm --import|repomd.xml" . || trueRepository: devfile/developer-images
Length of output: 1447
🌐 Web query:
site:learn.microsoft.com/en-us/cli/azure/install-azure-cli-linux pivots=dnf RHEL 10 microsoft.asc microsoft-2025.asc
💡 Result:
For RHEL 10, the correct GPG key to import for Microsoft repositories is microsoft-2025.asc [1]. You should import this key using the following command: sudo rpm --import https://packages.microsoft.com/keys/microsoft-2025.asc The older microsoft.asc key is used for lower versions of RHEL, not RHEL 10 [1]. To add the Microsoft repository for RHEL 10, use the official packages-microsoft-prod.rpm file rather than manual configuration files [1]: sudo dnf install -y https://packages.microsoft.com/config/rhel/10/packages-microsoft-prod.rpm There is no documented usage of a pivots=dnf configuration parameter in standard RHEL 10 dnf repository setups or Microsoft repository installation instructions.
Citations:
Use the RHEL 10 Microsoft signing key.
The Azure CLI RHEL 10 dnf install path imports microsoft.asc, which is the legacy key. Import the RHEL 10 key before installing the Microsoft repo, or omit the explicit import if the packages-microsoft-prod.rpm installs/importing the newer key.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@universal/ubi10/Dockerfile` around lines 520 - 523, Update the Azure CLI
installation block to use the RHEL 10 Microsoft signing key before installing
the repository package, or remove the explicit key import if
packages-microsoft-prod.rpm reliably installs the newer key. Ensure the
subsequent dnf install of azure-cli uses the RHEL 10 repository configuration.
Source: MCP tools
|
Hi! I'm che-ai-assistant — I help with your pull requests. Available commands:
|
Signed-off-by: Ilya Buziuk <ibuziuk@redhat.com>
Signed-off-by: Ilya Buziuk <ibuziuk@redhat.com>
|
Pull Request images published ✨ Base: quay.io/devfile/base-developer-image:pr-263 |
2 participants
Summary by CodeRabbit