Merge remote-tracking branch 'upstream/main' into remove-crypto-polic…

…ies-symlinks
aws · Sep 20, 2023 · bbf1aba · bbf1aba
2 parents e92f356 + 2fea89e
commit bbf1aba
Show file tree

Hide file tree

Showing 6 changed files with 6 additions and 6 deletions.
diff --git a/EKS_DISTRO_TAG_FILE.yaml b/EKS_DISTRO_TAG_FILE.yaml
@@ -44,7 +44,7 @@ al2023:
   eks-distro-minimal-base: 2023-08-24-1692903666.2023
   eks-distro-minimal-base-nonroot: 2023-08-24-1692903666.2023
   eks-distro-minimal-base-glibc: 2023-08-24-1692903666.2023
-  eks-distro-minimal-base-iptables: null
+  eks-distro-minimal-base-iptables: 2023-08-24-1692903666.2023
   eks-distro-minimal-base-docker-client: 2023-08-24-1692903666.2023
   eks-distro-minimal-base-csi: 2023-09-08-1694199666.2023
   eks-distro-minimal-base-csi-ebs: 2023-08-24-1692903666.2023

diff --git a/eks-distro-base/Dockerfile.minimal-base b/eks-distro-base/Dockerfile.minimal-base
@@ -67,7 +67,7 @@ ENV CA_CERTIFICATES_SCRIPTLET_REQS="/usr/bin/p11-kit /usr/bin/trust /usr/share/p
 
 # there is a circular dep between ca-certs and openssl, we do not include openssl in the base
 # and can safely remove these symlinks
-ENV CLEANUP_UNNECESSARY_FILES="/usr/lib/debug/usr/.dwz /etc/ssl/ct_log_list.cnf /etc/ssl/openssl.cnf"
+ENV CLEANUP_UNNECESSARY_FILES="/usr/lib/debug/usr/.dwz /etc/ssl/ct_log_list.cnf /etc/ssl/openssl.cnf /etc/pki/tls/fips_local.cnf"
 
 RUN set -x && \
     export OUTPUT_DEBUG_LOG=${OUTPUT_DEBUG_LOG} && \

diff --git a/eks-distro-base/Dockerfile.minimal-base-git b/eks-distro-base/Dockerfile.minimal-base-git
@@ -93,7 +93,7 @@ COPY scripts/ /usr/bin
 # cyrus-sasl-lib is installed for the libs, but it also includes these bins sasldblistusers2 saslpasswd2 libsasldb cyrusbdb2current
 # which are not needed
 # /etc/krb5.conf.d/crypto-policies is a broken symlink which is not needed
-ENV CLEANUP_UNNECESSARY_FILES="/usr/sbin/sasldblistusers2 /usr/sbin/saslpasswd2 /usr/lib64/sasl2/libsasldb* /usr/bin/cyrusbdb2current /usr/lib64/libkrad* /etc/krb5.conf.d/crypto-policies /usr/lib64/libsystemd.so.* /etc/crypto-policies/back-ends"
+ENV CLEANUP_UNNECESSARY_FILES="/usr/sbin/sasldblistusers2 /usr/sbin/saslpasswd2 /usr/lib64/sasl2/libsasldb* /usr/bin/cyrusbdb2current /usr/lib64/libkrad* /etc/krb5.conf.d/crypto-policies /usr/lib64/libsystemd.so.* /etc/pki/tls/fips_local.cnf"
 
 RUN set -x && \
     export OUTPUT_DEBUG_LOG=${OUTPUT_DEBUG_LOG} && \

diff --git a/eks-distro-base/Dockerfile.minimal-base-haproxy b/eks-distro-base/Dockerfile.minimal-base-haproxy
@@ -51,7 +51,7 @@ RUN set -x && \
 COPY scripts/ /usr/bin
 
 # libkrad installed with rpm with required deps but not needed by haproxy and missing deps
-ENV CLEANUP_UNNECESSARY_FILES="/usr/lib64/libkrad*"
+ENV CLEANUP_UNNECESSARY_FILES="/usr/lib64/libkrad* /etc/pki/tls/fips_local.cnf"
 
 RUN set -x && \
     export OUTPUT_DEBUG_LOG=${OUTPUT_DEBUG_LOG} && \

diff --git a/eks-distro-base/Dockerfile.minimal-base-nginx b/eks-distro-base/Dockerfile.minimal-base-nginx
@@ -31,7 +31,7 @@ COPY scripts/ /usr/bin
 
 # cleanup broken symlinks from nginx package
 # libssl2k installed with openssl but not needed by nginx and missing deps
-ENV CLEANUP_UNNECESSARY_FILES="/usr/share/nginx/html/icons/poweredby.png /usr/lib64/libssl.so.1.0.2k /usr/lib64/libssl.so.10"
+ENV CLEANUP_UNNECESSARY_FILES="/usr/share/nginx/html/icons/poweredby.png /usr/lib64/libssl.so.1.0.2k /usr/lib64/libssl.so.10 /etc/pki/tls/fips_local.cnf"
 
 RUN set -x && \
     export OUTPUT_DEBUG_LOG=${OUTPUT_DEBUG_LOG} && \

diff --git a/eks-distro-base/Dockerfile.minimal-base-python b/eks-distro-base/Dockerfile.minimal-base-python
@@ -219,7 +219,7 @@ RUN set -x && \
     # /etc/krb5.conf.d/crypto-policies is a broken symlink which is not needed
     # libkrad installed with rpm with required deps but not needed by haproxy and missing deps
     if [ "${IS_COMPILER}" = "false" ]; then \
-        export CLEANUP_UNNECESSARY_FILES="/etc/krb5.conf.d/crypto-policies /usr/lib64/libkrad*"; \
+        export CLEANUP_UNNECESSARY_FILES="/etc/krb5.conf.d/crypto-policies /usr/lib64/libkrad* /etc/pki/tls/fips_local.cnf"; \
     else \
         if [ ! -L $NEWROOT/usr/bin/pip ]; then \
             ln -s pip3 $NEWROOT/usr/bin/pip; \