Distgen migration for Ruby containers

2.5/Dockerfile.rhel8

@@ -1,50 +1,38 @@
-FROM ubi8/s2i-base
-
 # This image provides a Ruby environment you can use to run your Ruby
 # applications.
+FROM ubi8/s2i-base
 
 EXPOSE 8080
 
-ENV RUBY_MAJOR_VERSION=2 \
-    RUBY_MINOR_VERSION=5
-
-ENV RUBY_VERSION="${RUBY_MAJOR_VERSION}.${RUBY_MINOR_VERSION}" \
-    RUBY_SCL_NAME_VERSION="${RUBY_MAJOR_VERSION}${RUBY_MINOR_VERSION}"
+ENV RUBY_VERSION="2.5"
 
-ENV RUBY_SCL="ruby-${RUBY_SCL_NAME_VERSION}" \
-    IMAGE_NAME="ubi8/ruby-${RUBY_SCL_NAME_VERSION}" \
-    SUMMARY="Platform for building and running Ruby $RUBY_VERSION applications" \
-    DESCRIPTION="Ruby $RUBY_VERSION available as container is a base platform for \
-building and running various Ruby $RUBY_VERSION applications and frameworks. \
+ENV RUBY_SCL="ruby-25" \
+    IMAGE_NAME="ubi8/ruby-25" \
+    SUMMARY="Platform for building and running Ruby 2.5 applications." \
+    DESCRIPTION="Ruby 2.5 available as container is a base platform for \
+building and running various Ruby 2.5 applications and frameworks. \
 Ruby is the interpreted scripting language for quick and easy object-oriented programming. \
 It has many features to process text files and to do system management tasks (as in Perl). \
 It is simple, straight-forward, and extensible."
 
 LABEL summary="$SUMMARY" \
       description="$DESCRIPTION" \
       io.k8s.description="$DESCRIPTION" \
-      io.k8s.display-name="Ruby ${RUBY_VERSION}" \
+      io.k8s.display-name="Ruby 2.5" \
       io.openshift.expose-services="8080:http" \
-      io.openshift.tags="builder,ruby,ruby${RUBY_SCL_NAME_VERSION},${RUBY_SCL}" \
-      com.redhat.component="${RUBY_SCL}-container" \
-      name="${IMAGE_NAME}" \
+      io.openshift.tags="builder,ruby,ruby25,ruby-25" \
+      com.redhat.component="ruby-25-container" \
+      name="ubi8/ruby-25" \
       version="1" \
       com.redhat.license_terms="https://www.redhat.com/en/about/red-hat-end-user-license-agreements#UBI" \
       usage="s2i build https://github.com/sclorg/s2i-ruby-container.git \
 --context-dir=${RUBY_VERSION}/test/puma-test-app/ ${IMAGE_NAME} ruby-sample-app" \
       maintainer="SoftwareCollections.org <sclorg@redhat.com>"
 
-RUN yum -y module enable ruby:$RUBY_VERSION && \
-    INSTALL_PKGS=" \
-    libffi-devel \
-    ruby \
-    ruby-devel \
-    rubygem-rake \
-    rubygem-bundler \
-    redhat-rpm-config \
-    " && \
-    yum install -y --setopt=tsflags=nodocs ${INSTALL_PKGS} && \
-    yum -y clean all --enablerepo='*' && \
+RUN INSTALL_PKGS="ruby ruby-devel rubygem-rake rubygem-bundler redhat-rpm-config libffi-devel" && \
+    dnf module enable -y ruby:2.5 && \
+    dnf install -y --setopt=tsflags=nodocs ${INSTALL_PKGS} && \
+    dnf -y clean all --enablerepo='*' && \
     ruby -v | grep -qe "^ruby $RUBY_VERSION\." && echo "Found VERSION $RUBY_VERSION" && \
     rpm -V ${INSTALL_PKGS}
 

2.5/README.md

@@ -1,8 +1,10 @@
 Ruby 2.5 container image
 ========================
 This container image includes Ruby 2.5 as a [S2I](https://github.com/openshift/source-to-image) base image for your Ruby 2.5 applications.
-Only the RHEL8 based builder image is available.
-The RHEL images are available in the [Red Hat Container Catalog](https://access.redhat.com/containers/).
+Users can choose between RHEL, CentOS Stream and Fedora based builder images.
+The RHEL images are available in the [Red Hat Container Catalog](https://access.redhat.com/containers/),
+the CentOS Stream images are available on [Quay.io](https://quay.io/organization/sclorg),
+and the Fedora images are available in [Quay.io](https://quay.io/organization/fedora).
 The resulting image can be run using [podman](https://github.com/containers/libpod).
 
 Note: while the examples in this README are calling `podman`, you can replace any such calls by `docker` with the same arguments
@@ -16,7 +18,7 @@ Ruby is the interpreted scripting language for quick and easy object-oriented pr
 It has many features to process text files and to do system management tasks (as in Perl).
 It is simple, straight-forward, and extensible.
 
-This container image includes a npm utility, so users can use it to install JavaScript
+This container image includes an npm utility, so users can use it to install JavaScript
 modules for their web applications. There is no guarantee for any specific npm or nodejs
 version, that is included in the image; those versions can be changed anytime and
 the nodejs itself is included just to make the npm work.
@@ -25,7 +27,7 @@ See [the Red Hat Enterprise Linux Application Streams Life Cycle page](https://a
 
 Usage in Openshift
 ------------------
-For this, we will assume that you are using the `ubi8/ruby-25 image`, available via `ruby:2.5` imagestream tag in Openshift.
+For this, we will assume that you are using the `registry.access.redhat.com/ubi8/ruby-25` image, available via `ruby:2.5` imagestream tag in Openshift.
 Building a simple [ruby-sample-app](https://github.com/sclorg/s2i-ruby-container/tree/master/2.5/test/puma-test-app) application
 in Openshift can be achieved with the following step:
 
@@ -41,7 +43,7 @@ $ oc exec <pod> -- curl 127.0.0.1:8080
 
 Source-to-Image framework and scripts
 -------------------------------------
-This image supports the [Source-to-Image](https://docs.openshift.com/container-platform/4.14/openshift_images/create-images.html#images-create-s2i_create-images)
+This image supports the [Source-to-Image](https://docs.openshift.com/container-platform/4.4/builds/build-strategies.html#images-create-s2i_build-strategies)
 (S2I) strategy in OpenShift. The Source-to-Image is an OpenShift framework
 which makes it easy to write images that take application source code as
 an input, use a builder image like this Ruby container image, and produce
@@ -64,10 +66,10 @@ To use the Ruby image in a Dockerfile, follow these steps:
 #### 1. Pull a base builder image to build on
 
 ```
-podman pull ubi8/ruby-25
+podman pull registry.access.redhat.com/ubi8/ruby-25
 ```
 
-An RHEL8 image `ubi8/ruby-25` is used in this example.
+The `registry.access.redhat.com/ubi8/ruby-25` container image is used in this example.
 
 #### 2. Pull and application code
 
@@ -89,7 +91,7 @@ For all these three parts, users can use the Source-to-Image scripts inside the
 
 ##### 3.1 To use the Source-to-Image scripts and build an image using a Dockerfile, create a Dockerfile with this content:
 ```
-FROM ubi8/ruby-25
+FROM registry.access.redhat.com/ubi8/ruby-25
 
 # Add application sources to a directory that the assemble scriptexpects them
 # and set permissions so that the container runs without root access
@@ -110,7 +112,7 @@ CMD /usr/libexec/s2i/run
 The s2i scripts are used to set-up and run common Ruby applications. More information about the scripts can be found in [Source-to-Image](#source-to-image-framework-and-scripts) section.
 ##### 3.2 To use your own setup, create a Dockerfile with this content:
 ```
-FROM ubi8/ruby-25
+FROM registry.access.redhat.com/ubi8/ruby-25
 
 USER 0
 ADD app-src ./
@@ -225,4 +227,6 @@ See also
 --------
 Dockerfile and other sources are available on https://github.com/sclorg/s2i-ruby-container.
 In that repository you also can find another versions of Ruby environment Dockerfiles.
-The Dockerfile for RHEL8 is called `Dockerfile.rhel8`.
+Dockerfile for RHEL8 is called `Dockerfile.rhel8`, for RHEL9 it's `Dockerfile.rhel9`,
+for CentOS Stream 9 it's `Dockerfile.c9s`, for CentOS Stream 10 it's `Dockerfile.c10s`,
+and the Fedora Dockerfile is called `Dockerfile.fedora`.

2.5/s2i/bin/assemble

@@ -42,11 +42,11 @@ if [ -f Gemfile ]; then
   else
     BUNDLE_WITHOUT=${BUNDLE_WITHOUT:-"development:test"}
   fi
-  
+
   if [ -n "$BUNDLE_WITHOUT" ]; then
     ADDTL_BUNDLE_ARGS+=" --without $BUNDLE_WITHOUT"
   fi
-  
+
   echo "---> Running 'bundle install ${ADDTL_BUNDLE_ARGS}' ..."
   bundle install --path ./bundle ${ADDTL_BUNDLE_ARGS}
 

2.5/test/examples/from-dockerfile/Dockerfile

@@ -1,7 +1,6 @@
-FROM ubi8/ruby-25
+FROM registry.access.redhat.com/ubi8/ruby-25
 
 ADD --chown=default:root app-src ./
-
 RUN bundle install --path bundle
 
 CMD exec bundle exec "rackup -P /tmp/rack.pid --host 0.0.0.0 --port 8080"

2.5/test/test-fips/Gemfile

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+source 'https://rubygems.org'
+
+gem 'sinatra'
+
+gem 'rackup'
+
+# Use webrick for simple HTTP transport.
+# this is not a production grade server, but gets the job done for the
+# purpose of just sending something over for a request.
+# Additionally there is an option to add SSL later here.
+gem 'webrick'

2.5/test/test-fips/app.rb

@@ -0,0 +1,72 @@
+require 'sinatra'
+require 'openssl'
+
+set :server, 'webrick'
+set :bind, '0.0.0.0'
+set :port, 8080
+
+MESSAGE = "My secret text\n".freeze
+
+get '/symmetric/aes-256-cbc' do
+  fips_state = OpenSSL.fips_mode ? 'enabled' : 'disabled'
+  # This should pass with and without FIPS.
+  cipher = OpenSSL::Cipher.new('aes-256-cfb')
+  cipher.encrypt
+  cipher.random_key
+  cipher.random_iv
+  enc = cipher.update(MESSAGE) + cipher.final
+  return 200, enc
+rescue => e
+  return 409, "Unexpected failure with aes-256-cbc, fips #{fips_state}, #{e.inspect}\nBacktrace:\n#{e.backtrace}\n"
+end
+
+get '/symmetric/des-ede-cbc' do
+  status = 200
+  fips_state = OpenSSL.fips_mode ? 'enabled' : 'disabled'
+
+  cipher = OpenSSL::Cipher.new('des-ede-cbc')
+  cipher.encrypt
+  # This fails in FIPS only once we try to get a key for the 3DES.
+  cipher.random_key
+  cipher.random_iv
+  cipher.update(MESSAGE) + cipher.final
+rescue OpenSSL::Cipher::CipherError => e
+  return status, "Failed with fips #{fips_state} #{e.inspect}\n" if OpenSSL.fips_mode
+
+  return 500, "Failed with fips #{fips_state} #{e.inspect}\nBacktrace:\n#{e.backtrace}\n"
+rescue => e
+  return 409, "Unexpected failure with des-ede-cbc, fips #{fips_state}, #{e.inspect}\nBacktrace:\n#{e.backtrace}\n"
+end
+
+get '/hash/sha256' do
+  status = 200
+
+  fips_state = OpenSSL.fips_mode ? 'enabled' : 'disabled'
+  message = "SHA256 succeeded, fips is #{fips_state}"
+
+  OpenSSL::Digest.digest('SHA256', MESSAGE)
+
+  return status, message
+rescue => e
+  return 409, "Unexpected failure with SHA256, fips #{fips_state}, #{e.inspect}\nBacktrace:\n#{e.backtrace}\n"
+end
+
+get '/hash/md5' do
+  status = 200
+
+  fips_state = OpenSSL.fips_mode ? 'enabled' : 'disabled'
+  message = "MD5 succeeded, fips is #{fips_state}"
+
+  OpenSSL::Digest.digest('MD5', MESSAGE)
+
+  # FIPS is on, but this passed, that shouldn't be the case.
+  status = 500 if OpenSSL.fips_mode
+
+  return status, message
+rescue OpenSSL::Digest::DigestError => e
+  return status, "Failed with fips #{fips_state} #{e.inspect}\n" if OpenSSL.fips_mode
+
+  return 500, "Failed with fips #{fips_state} #{e.inspect}\nBacktrace:\n#{e.backtrace}\n"
+rescue => e
+  return 409, "Unexpected failure with MD5, fips #{fips_state}, #{e.inspect}\nBacktrace:\n#{e.backtrace}\n"
+end

2.5/test/test-fips/config.ru

@@ -0,0 +1,2 @@
+require './app'
+run Sinatra::Application