From 5fdc57f9c5b3e7ac6b2fbbc9a318a0afc7b26eda Mon Sep 17 00:00:00 2001
From: Dheeraj Singh Jodha <djodha@redhat.com>
Date: Thu, 3 Sep 2026 16:16:49 +0530
Subject: [PATCH 1/5] Automate CPE label update in release branch setup script

The release-branch-pipeline-patch.sh script now also updates the name
and cpe labels in Dockerfile.dist, which were previously done as a
separate manual PR for each release branch. The CPE version is accepted
via the CPE_VERSION env var or an interactive prompt.

Ref: https://redhat.atlassian.net/browse/EC-2154

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 hack/release-branch-pipeline-patch.sh | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/hack/release-branch-pipeline-patch.sh b/hack/release-branch-pipeline-patch.sh
index a2cc9e0e2..e43a43798 100755
--- a/hack/release-branch-pipeline-patch.sh
+++ b/hack/release-branch-pipeline-patch.sh
@@ -91,6 +91,26 @@ EOT
 awk "$awk_query" <(git show main:$MAIN_PR_PIPELINE) > $RELEASE_PR_PIPELINE
 awk "$awk_query" <(git show main:$MAIN_PUSH_PIPELINE) > $RELEASE_PUSH_PIPELINE
 
+# Set the CPE and name labels in Dockerfile.dist for the release branch.
+# The CPE version is a Red Hat product version that doesn't necessarily follow
+# the Conforma version, so it must be provided explicitly.
+CPE_VERSION="${CPE_VERSION:-}"
+if [[ -z "$CPE_VERSION" ]]; then
+  read -rp "Enter the CPE version for this release (e.g. 1.5): " CPE_VERSION
+fi
+
+if [[ -z "$CPE_VERSION" ]]; then
+  echo "Error: CPE version is required"
+  exit 1
+fi
+
+sed -i'' -e "s|name=\"ec\"|name=\"rhtas/ec-rhel9\" \\\\\\n  cpe=\"cpe:/a:redhat:trusted_artifact_signer:${CPE_VERSION}::el9\"|" Dockerfile.dist
+
+echo "Updated Dockerfile.dist labels:"
+echo "  name=\"rhtas/ec-rhel9\""
+echo "  cpe=\"cpe:/a:redhat:trusted_artifact_signer:${CPE_VERSION}::el9\""
+echo ""
+
 echo "To review the new pipeline definitions:"
 echo "  vimdiff <(git show main:$MAIN_PR_PIPELINE) $RELEASE_PR_PIPELINE"
 echo "  vimdiff <(git show main:$MAIN_PUSH_PIPELINE) $RELEASE_PUSH_PIPELINE"
@@ -100,4 +120,4 @@ echo "  vimdiff <(git show release-v$OLD_VERSION:$OLD_RELEASE_PUSH_PIPELINE) $RE
 echo ""
 echo "If the above comparisons look good then you probably want to do this:"
 echo "  git rm $MAIN_PR_PIPELINE $MAIN_PUSH_PIPELINE"
-echo "  git add $RELEASE_PR_PIPELINE $RELEASE_PUSH_PIPELINE"
+echo "  git add $RELEASE_PR_PIPELINE $RELEASE_PUSH_PIPELINE Dockerfile.dist"

From c534ef8aff43465d0d46b091f361507c5f2080c0 Mon Sep 17 00:00:00 2001
From: Dheeraj Singh Jodha <djodha@redhat.com>
Date: Thu, 3 Sep 2026 16:24:24 +0530
Subject: [PATCH 2/5] Validate CPE_VERSION format before sed interpolation

Ensure CPE_VERSION matches MAJOR.MINOR format (digits and dot only)
before using it in the sed replacement, rejecting invalid values.

Ref: https://redhat.atlassian.net/browse/EC-2154

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 hack/release-branch-pipeline-patch.sh | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hack/release-branch-pipeline-patch.sh b/hack/release-branch-pipeline-patch.sh
index e43a43798..a88bc6904 100755
--- a/hack/release-branch-pipeline-patch.sh
+++ b/hack/release-branch-pipeline-patch.sh
@@ -104,6 +104,11 @@ if [[ -z "$CPE_VERSION" ]]; then
   exit 1
 fi
 
+if [[ ! "$CPE_VERSION" =~ ^[0-9]+\.[0-9]+$ ]]; then
+  echo "Error: CPE version must be in MAJOR.MINOR format (e.g. 1.5), got: ${CPE_VERSION}"
+  exit 1
+fi
+
 sed -i'' -e "s|name=\"ec\"|name=\"rhtas/ec-rhel9\" \\\\\\n  cpe=\"cpe:/a:redhat:trusted_artifact_signer:${CPE_VERSION}::el9\"|" Dockerfile.dist
 
 echo "Updated Dockerfile.dist labels:"

From 87c764eeb6393ec3765b5866f5fd6c118d2c3d13 Mon Sep 17 00:00:00 2001
From: Dheeraj Singh Jodha <djodha@redhat.com>
Date: Tue, 8 Sep 2026 18:01:24 +0530
Subject: [PATCH 3/5] Rename CPE_VERSION to TAS_VERSION for clarity

The version in the CPE string is the TAS (Trusted Artifact Signer)
product version, not the CPE version itself. Rename the variable
and user-facing messages accordingly.

Ref: https://redhat.atlassian.net/browse/EC-2154

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 hack/release-branch-pipeline-patch.sh | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/hack/release-branch-pipeline-patch.sh b/hack/release-branch-pipeline-patch.sh
index a88bc6904..01f2a3c63 100755
--- a/hack/release-branch-pipeline-patch.sh
+++ b/hack/release-branch-pipeline-patch.sh
@@ -92,28 +92,28 @@ awk "$awk_query" <(git show main:$MAIN_PR_PIPELINE) > $RELEASE_PR_PIPELINE
 awk "$awk_query" <(git show main:$MAIN_PUSH_PIPELINE) > $RELEASE_PUSH_PIPELINE
 
 # Set the CPE and name labels in Dockerfile.dist for the release branch.
-# The CPE version is a Red Hat product version that doesn't necessarily follow
+# The TAS (Trusted Artifact Signer) version doesn't necessarily follow
 # the Conforma version, so it must be provided explicitly.
-CPE_VERSION="${CPE_VERSION:-}"
-if [[ -z "$CPE_VERSION" ]]; then
-  read -rp "Enter the CPE version for this release (e.g. 1.5): " CPE_VERSION
+TAS_VERSION="${TAS_VERSION:-}"
+if [[ -z "$TAS_VERSION" ]]; then
+  read -rp "Enter the TAS version for this release (e.g. 1.5): " TAS_VERSION
 fi
 
-if [[ -z "$CPE_VERSION" ]]; then
-  echo "Error: CPE version is required"
+if [[ -z "$TAS_VERSION" ]]; then
+  echo "Error: TAS version is required"
   exit 1
 fi
 
-if [[ ! "$CPE_VERSION" =~ ^[0-9]+\.[0-9]+$ ]]; then
-  echo "Error: CPE version must be in MAJOR.MINOR format (e.g. 1.5), got: ${CPE_VERSION}"
+if [[ ! "$TAS_VERSION" =~ ^[0-9]+\.[0-9]+$ ]]; then
+  echo "Error: TAS version must be in MAJOR.MINOR format (e.g. 1.5), got: ${TAS_VERSION}"
   exit 1
 fi
 
-sed -i'' -e "s|name=\"ec\"|name=\"rhtas/ec-rhel9\" \\\\\\n  cpe=\"cpe:/a:redhat:trusted_artifact_signer:${CPE_VERSION}::el9\"|" Dockerfile.dist
+sed -i'' -e "s|name=\"ec\"|name=\"rhtas/ec-rhel9\" \\\\\\n  cpe=\"cpe:/a:redhat:trusted_artifact_signer:${TAS_VERSION}::el9\"|" Dockerfile.dist
 
 echo "Updated Dockerfile.dist labels:"
 echo "  name=\"rhtas/ec-rhel9\""
-echo "  cpe=\"cpe:/a:redhat:trusted_artifact_signer:${CPE_VERSION}::el9\""
+echo "  cpe=\"cpe:/a:redhat:trusted_artifact_signer:${TAS_VERSION}::el9\""
 echo ""
 
 echo "To review the new pipeline definitions:"

From e059e04eb538bb24f8e77f734a218eda45b0bbd7 Mon Sep 17 00:00:00 2001
From: Dheeraj Singh Jodha <djodha@redhat.com>
Date: Tue, 8 Sep 2026 18:22:42 +0530
Subject: [PATCH 4/5] Verify sed substitution succeeded in Dockerfile.dist

After the sed call, grep for the expected CPE string and fail with a
clear error if the pattern was not found. This catches re-runs where
the anchor pattern was already replaced, or cases where the label
format changed.

Ref: https://redhat.atlassian.net/browse/EC-2154

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 hack/release-branch-pipeline-patch.sh | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hack/release-branch-pipeline-patch.sh b/hack/release-branch-pipeline-patch.sh
index 01f2a3c63..066a98c25 100755
--- a/hack/release-branch-pipeline-patch.sh
+++ b/hack/release-branch-pipeline-patch.sh
@@ -111,6 +111,11 @@ fi
 
 sed -i'' -e "s|name=\"ec\"|name=\"rhtas/ec-rhel9\" \\\\\\n  cpe=\"cpe:/a:redhat:trusted_artifact_signer:${TAS_VERSION}::el9\"|" Dockerfile.dist
 
+grep -q "cpe:/a:redhat:trusted_artifact_signer:${TAS_VERSION}::el9" Dockerfile.dist || {
+  echo "Error: failed to update Dockerfile.dist labels (pattern not found — file may already be patched, or the label format changed)"
+  exit 1
+}
+
 echo "Updated Dockerfile.dist labels:"
 echo "  name=\"rhtas/ec-rhel9\""
 echo "  cpe=\"cpe:/a:redhat:trusted_artifact_signer:${TAS_VERSION}::el9\""

From 15626a8aa90ba9ba113d58d4097480d24f2692e5 Mon Sep 17 00:00:00 2001
From: Dheeraj Singh Jodha <djodha@redhat.com>
Date: Tue, 8 Sep 2026 18:23:56 +0530
Subject: [PATCH 5/5] Use portable sed -i and fix echo to match inserted form

Use sed -i.bak instead of sed -i'' for GNU/BSD sed portability, and
clean up the backup file after. Also add the continuation backslash
in the echo output so it matches the actual multi-line LABEL directive
written to Dockerfile.dist.

Ref: https://redhat.atlassian.net/browse/EC-2154

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 hack/release-branch-pipeline-patch.sh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hack/release-branch-pipeline-patch.sh b/hack/release-branch-pipeline-patch.sh
index 066a98c25..50ed7f716 100755
--- a/hack/release-branch-pipeline-patch.sh
+++ b/hack/release-branch-pipeline-patch.sh
@@ -109,7 +109,8 @@ if [[ ! "$TAS_VERSION" =~ ^[0-9]+\.[0-9]+$ ]]; then
   exit 1
 fi
 
-sed -i'' -e "s|name=\"ec\"|name=\"rhtas/ec-rhel9\" \\\\\\n  cpe=\"cpe:/a:redhat:trusted_artifact_signer:${TAS_VERSION}::el9\"|" Dockerfile.dist
+sed -i.bak -e "s|name=\"ec\"|name=\"rhtas/ec-rhel9\" \\\\\\n  cpe=\"cpe:/a:redhat:trusted_artifact_signer:${TAS_VERSION}::el9\"|" Dockerfile.dist
+rm -f Dockerfile.dist.bak
 
 grep -q "cpe:/a:redhat:trusted_artifact_signer:${TAS_VERSION}::el9" Dockerfile.dist || {
   echo "Error: failed to update Dockerfile.dist labels (pattern not found — file may already be patched, or the label format changed)"
@@ -117,7 +118,7 @@ grep -q "cpe:/a:redhat:trusted_artifact_signer:${TAS_VERSION}::el9" Dockerfile.d
 }
 
 echo "Updated Dockerfile.dist labels:"
-echo "  name=\"rhtas/ec-rhel9\""
+echo "  name=\"rhtas/ec-rhel9\" \\"
 echo "  cpe=\"cpe:/a:redhat:trusted_artifact_signer:${TAS_VERSION}::el9\""
 echo ""