build: use external ssh configs, update ca cert

.env-example

@@ -16,11 +16,11 @@
 # you generally should not need to change any of these
 #DISCOVERY_CLI_GIT_URL=ssh://username@pkgs.devel.redhat.com/rpms/discovery-cli.git
 #DISCOVERY_CLI_GIT_REPO_PATH=/repos/discovery-cli
-#DISCOVERY_CLI_GIT_REMOTE_RELEASE_BRANCH_DEFAULT=remotes/origin/discovery-1-rhel-9
-#DISCOVERY_CLI_GIT_REMOTE_RELEASE_BRANCH_PREFIX=remotes/origin/discovery-
+#DISCOVERY_CLI_GIT_REMOTE_RELEASE_BRANCH_DEFAULT=remotes/origin/discovery-2-rhel-9
+#DISCOVERY_CLI_GIT_REMOTE_RELEASE_BRANCH_PREFIX=remotes/origin/discovery-2-
 
-# you *probably need* to set this to make git happy
-# try to `ssh pkgs.devel.redhat.com` and grab the value from `grep pkgs.devel.redhat.com ~/.ssh/known_hosts`
+# This is optional because the mounted .ssh config dir should have everything.
+# However, we still append this value, if set, to the known_hosts file.
 #KNOWN_HOSTS=
 
 # make it noisy!

.gitignore

@@ -1,2 +1,3 @@
 repos
 downstream_builder.egg-info
+ssh-config

Containerfile

@@ -4,11 +4,11 @@ RUN dnf install -y \
     krb5-workstation git man vim which chkconfig java-headless cargo packit \
     python3-pip python3-devel python3-setuptools \
     python3-rich python3-pyyaml \
-    && curl -L -o /etc/pki/ca-trust/source/anchors/RH-IT-Root-CA.crt https://certs.corp.redhat.com/certs/2015-IT-Root-CA.pem \
-    && curl -L -o /etc/pki/ca-trust/source/anchors/2022-IT-Root-CA.pem https://certs.corp.redhat.com/certs/2022-IT-Root-CA.pem \
+    && curl -L -o /etc/pki/ca-trust/source/anchors/Current-IT-Root-CAs.pem https://certs.corp.redhat.com/certs/Current-IT-Root-CAs.pem \
     && update-ca-trust \
     && curl -L -o /etc/yum.repos.d/rcm-tools-fedora.repo https://download.devel.redhat.com/rel-eng/RCMTOOLS/rcm-tools-fedora.repo \
     && dnf install -y rhpkg brewkoji \
+    && cp /etc/pki/ca-trust/source/anchors/Current-IT-Root-CAs.pem /etc/pki/brew/RH-IT-Root-CA.crt \
     && rm -f /etc/yum.repos.d/rcm-tools-fedora.repo \
     && dnf clean all
 

README.md

@@ -14,6 +14,18 @@ Optionally create a local directory for sharing repos and virtualenv cache (this
 mkdir repos
 ```
 
+Prepare your ssh configs to mount as a volume. This is REQUIRED for running with Red Hat's internal git and build servers. Please see the `unofficial-internal-documentation` for reference values. For security reasons, this public project does not include those values.
+
+```sh
+mkdir -p ./ssh-config
+# assuming a recent clone of unofficial-internal-documentation nearby
+cp ../unofficial-internal-documentation/reference/dist-git-ssh-configs/config ./ssh-config/config
+cp ../unofficial-internal-documentation/reference/dist-git-ssh-configs/known_hosts ./ssh-config/known_hosts
+chmod 640 ./ssh-config/config
+chmod 640 ./ssh-config/known_hosts
+```
+
+
 Optionally edit a `.env` file as needed:
 
 ```sh
@@ -29,15 +41,22 @@ podman build -f Containerfile -t downstream-builder:latest .
 
 Connect to the Red Hat VPN. This program communicates with several internal hosts and will fail without appropriate network access.
 
-Run it! Remove the `-v` or `--env-file` arguments if you do not wish to use the shared directory or env file.
+Run the container:
 
 ```sh
 podman run \
     -v "$PWD"/repos:/repos:Z \
+    -v "$PWD"/ssh-config:/home/builder/.ssh:Z \
     --rm -it \
     --env-file .env \
     downstream-builder:latest
-````
+```
+
+Some notes about this command:
+
+* You MAY remove the `repos` volume mount if you do not want to preserve the cloned repos, but you probably should keep these for sake of performance.
+* You MAY remove the `.env` file if you do not want to pass any personalized defaults.
+* You MUST include the `ssh-config` volume mount if you intend to build inside Red Hat's network. The base image itself does not include sufficient configs to communicate with the remote servers.
 
 When the container starts, it will ask you several questions with defaults populated by environment variables that may be loaded from your `.env` file. Assuming all goes well, when the requested build tasks complete, the script will dump you back into a `bash` shell (still inside the container) where you may complete any additional steps manually.
 

discobuilder/builder/cli.py

@@ -132,7 +132,7 @@ def show_next_steps_summary(with_scratch=True, release="rhel-9", target=None):
             Create a scratch build:
 
                 cd {config.DISCOVERY_CLI_GIT_REPO_PATH}
-                rhpkg build --release {release} --target={target} --scratch
+                rhpkg --release {release} build --target={target} --scratch
             """
         )
 
@@ -141,7 +141,7 @@ def show_next_steps_summary(with_scratch=True, release="rhel-9", target=None):
         Update the release branch and create the release build:
 
             cd {config.DISCOVERY_CLI_GIT_REPO_PATH}
-            git checkout discovery-1-{release}
+            git checkout discovery-2-{release}
             git rebase {config.PRIVATE_BRANCH_NAME}
             git push
             rhpkg build --scratch

discobuilder/builder/installer.py

@@ -153,7 +153,7 @@ def build_installer():
 
 def show_next_steps_summary(with_scratch=True, release="rhel-9", target=None):
     if not target:
-        target = f"discovery-1-{release}-candidate"
+        target = f"discovery-2-{release}-candidate"
 
     release_message = dedent(
         f"""
@@ -178,7 +178,7 @@ def show_next_steps_summary(with_scratch=True, release="rhel-9", target=None):
         Update the release branch and create the release build:
 
             cd {config.DISCOVERY_INSTALLER_GIT_REPO_PATH}
-            git checkout discovery-1-{release}
+            git checkout discovery-2-{release}
             git rebase {config.PRIVATE_BRANCH_NAME}
             git push
             rhpkg build --scratch

discobuilder/config.py

@@ -28,7 +28,7 @@
     "remotes/origin/discovery-2-rhel-9",
 )
 DISCOVERY_CLI_GIT_REMOTE_RELEASE_BRANCH_PREFIX = environ.get(
-    "DISCOVERY_CLI_GIT_REMOTE_RELEASE_BRANCH_PREFIX", "remotes/origin/discovery-"
+    "DISCOVERY_CLI_GIT_REMOTE_RELEASE_BRANCH_PREFIX", "remotes/origin/discovery-2-"
 )
 # discovery-installer is downstream repo for packaging quipucords-installer
 DISCOVERY_INSTALLER_GIT_URL = environ.get(