Hermetic next

.agents/skills/sync-operator-submodule/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: sync-operator-submodule
+description: >
+  Update the operator submodule to the latest upstream commit, refresh the
+  drift-cache copy of its Containerfile, and apply the resulting diff to the
+  root-level Containerfile. Use whenever the upstream operator repo has new
+  commits that should be pulled into this repo.
+---
+
+# Sync operator submodule
+
+## Steps
+
+1. **Update the submodule** to the latest commit on its tracked branch:
+
+   ```
+   git submodule update --init operator
+   git -C operator fetch origin main
+   git -C operator checkout <new-sha>   # or: git -C operator pull origin main
+   ```
+
+2. **Identify what changed** between the old and new submodule commits:
+
+   ```
+   git -C operator diff <old-sha>..<new-sha> -- Containerfile
+   ```
+
+3. **Copy the updated Containerfile into drift-cache/**:
+
+   ```
+   cp operator/Containerfile drift-cache/Containerfile
+   ```
+
+4. **Apply the same diff to the root-level `Containerfile`.** It mirrors the submodule
+   one (`operator/Containerfile`) but with `operator/` path prefixes on `COPY`
+   instructions, downstream base images, per-component `LABEL` blocks on each
+   distribution stage, no `--mount=type=cache` clauses, and a pinned
+   `REFERENCE_VALUES_COMMIT` in the `compute-pcrs-data` stage instead of the upstream
+   `cargo metadata` lookup. Translate the diff hunks accordingly.
+
+5. **Verify** that `drift-cache/Containerfile` matches `operator/Containerfile` exactly
+   and that the root-level `Containerfile` contains all the same logic changes (adapted
+   for its path layout and downstream modifications).

.claude

@@ -0,0 +1 @@
+.agents

.gitignore

@@ -0,0 +1,4 @@
+target/
+tests/config/crd/
+tests/lib/src/kopium/
+tests/target/

.gitmodules

@@ -5,3 +5,6 @@
 [submodule "drift-detection"]
 	path = drift-detection
 	url = https://github.com/arewm/drift-detection
+[submodule "reference-values"]
+	path = reference-values
+	url = https://github.com/trusted-execution-clusters/reference-values

.konflux/buildroot/rpms.in.yaml

@@ -0,0 +1,21 @@
+# Input for rpm-lockfile-prototype -> .konflux/buildroot/rpms.lock.yaml, consumed by
+# cachi2 rpm prefetch for Containerfile.buildroot (base: ubi9/go-toolset).
+# Resolve against the go-toolset base so rust-toolset & friends are found:
+#   rpm-lockfile-prototype --image registry.access.redhat.com/ubi9/go-toolset:latest \
+#     --outfile .konflux/buildroot/rpms.lock.yaml .konflux/buildroot/rpms.in.yaml
+contentOrigin:
+  repofiles:
+    - /etc/yum.repos.d/ubi.repo
+arches:
+  - x86_64
+packages:
+  - rust-toolset
+  - cargo
+  - rustfmt
+  - gcc
+  - gcc-c++
+  - make
+  - git
+  - jq
+  - openssl-devel
+  - pkgconfig

.konflux/buildroot/rpms.lock.yaml

@@ -0,0 +1,57 @@
+---
+lockfileVersion: 1
+lockfileVendor: redhat
+arches:
+- arch: x86_64
+  packages:
+  - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/appstream/os/Packages/c/cargo-1.92.0-1.el9.x86_64.rpm
+    repoid: ubi-9-appstream-rpms
+    size: 9100626
+    checksum: sha256:3c4afc2cb56734d01aaaaa8d0c317688f6fe143ad239079342f4fe9b631ded0f
+    name: cargo
+    evr: 1.92.0-1.el9
+    sourcerpm: rust-1.92.0-1.el9.src.rpm
+  - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/appstream/os/Packages/o/oniguruma-6.9.6-1.el9.5.x86_64.rpm
+    repoid: ubi-9-appstream-rpms
+    size: 226331
+    checksum: sha256:6c884cc2216e5b4699ebd8cde27b39e99532520b367f645ed6cc660d081916dc
+    name: oniguruma
+    evr: 6.9.6-1.el9.5
+    sourcerpm: oniguruma-6.9.6-1.el9.5.src.rpm
+  - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/appstream/os/Packages/r/rust-1.92.0-1.el9.x86_64.rpm
+    repoid: ubi-9-appstream-rpms
+    size: 31511504
+    checksum: sha256:fbc70b11f38999206d70a104789d1f7f21ca9f9090c7a73d6db337bff4f5205b
+    name: rust
+    evr: 1.92.0-1.el9
+    sourcerpm: rust-1.92.0-1.el9.src.rpm
+  - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/appstream/os/Packages/r/rust-std-static-1.92.0-1.el9.x86_64.rpm
+    repoid: ubi-9-appstream-rpms
+    size: 42991765
+    checksum: sha256:d286394aaa75a796a06db130d2a980bee8e6ab4cbaa38a3b84e12379fbae4671
+    name: rust-std-static
+    evr: 1.92.0-1.el9
+    sourcerpm: rust-1.92.0-1.el9.src.rpm
+  - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/appstream/os/Packages/r/rust-toolset-1.92.0-1.el9.noarch.rpm
+    repoid: ubi-9-appstream-rpms
+    size: 20406
+    checksum: sha256:7c8e4a695621948712693b395c7f099c443e26fea634924760334fe3f627cc5c
+    name: rust-toolset
+    evr: 1.92.0-1.el9
+    sourcerpm: rust-1.92.0-1.el9.src.rpm
+  - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/appstream/os/Packages/r/rustfmt-1.92.0-1.el9.x86_64.rpm
+    repoid: ubi-9-appstream-rpms
+    size: 2068695
+    checksum: sha256:ca55f1c6162b3dca6621c049c524366dc8a361ece26910d82f87db9c0ad9a2e3
+    name: rustfmt
+    evr: 1.92.0-1.el9
+    sourcerpm: rust-1.92.0-1.el9.src.rpm
+  - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/j/jq-1.6-19.el9_8.2.x86_64.rpm
+    repoid: ubi-9-baseos-rpms
+    size: 197453
+    checksum: sha256:9793a39a4746a09ba89c3d9ccc70150ac6c878286deee26d7e3aabede4666417
+    name: jq
+    evr: 1.6-19.el9_8.2
+    sourcerpm: jq-1.6-19.el9_8.2.src.rpm
+  source: []
+  module_metadata: []

.konflux/bundle/rpms.in.yaml

@@ -0,0 +1,12 @@
+# Input for rpm-lockfile-prototype -> .konflux/bundle/rpms.lock.yaml, consumed by cachi2
+# rpm prefetch for Containerfile.bundle (base: ubi9/ubi). Regenerate:
+#   (in a ubi9/ubi container) rpm-lockfile-prototype --local-system rpms.in.yaml
+contentOrigin:
+  repofiles:
+    - /etc/yum.repos.d/ubi.repo
+arches:
+  - x86_64
+packages:
+  - git
+  - make
+  - golang