Prevent incompatable upgrade of crypto-policies (#82475) (#82508)

An upgrade of crypto-policies is incompatible with libnss as it removes `/usr/bin/update-crypto-policies` being used. A follow-up issue has been created to track removing this pinning #82474 Signed-off-by: Tiago Costa <[email protected]> Signed-off-by: Tyler Smalley <[email protected]>
elastic · Nov 4, 2020 · 978d5c2 · 978d5c2
1 parent 5e8bc17
commit 978d5c2
Showing 1 changed file with 10 additions and 0 deletions.
diff --git a/src/dev/build/tasks/os_packages/docker_generator/templates/Dockerfile b/src/dev/build/tasks/os_packages/docker_generator/templates/Dockerfile
@@ -44,7 +44,17 @@ RUN find /usr/share/kibana -type d -exec chmod g+s {} \;
 FROM {{{baseOSImage}}}
 EXPOSE 5601
 
+{{#ubi}}
+  # https://github.com/rpm-software-management/microdnf/issues/50
+  RUN mkdir -p /run/user/$(id -u)
+
+  # crypto-policies not currently compatible with libnss :sadpanda:
+  RUN printf "[main]\nexclude=crypto-policies" >  /etc/dnf/dnf.conf
+{{/ubi}}
+
 RUN for iter in {1..10}; do \
+      # update microdnf to have exclusion feature for dnf configuration
+      {{packageManager}} update microdnf --setopt=tsflags=nodocs -y && \
       {{packageManager}} update --setopt=tsflags=nodocs -y && \
       {{packageManager}} install --setopt=tsflags=nodocs -y \
         fontconfig freetype shadow-utils libnss3.so {{#ubi}}findutils{{/ubi}} && \