chore(deps): update konflux references

[red-hat-konflux-kflux-prd-rh03]

This PR contains the following updates:

Package	Type	Update	Change
quay.io/konflux-ci/tekton-catalog/task-apply-tags (source, changelog)	tekton-bundle	digest	6387614 → da0cff2
quay.io/konflux-ci/tekton-catalog/task-build-image-index (source, changelog)	tekton-bundle	patch	0.3 → 0.3.1
quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta (source, changelog)	tekton-bundle	minor	0.10 → 0.11.0
quay.io/konflux-ci/tekton-catalog/task-clair-scan (source, changelog)	tekton-bundle	digest	9ff424d → f5b4415
quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check (source, changelog)	tekton-bundle	digest	e78d0d3 → 0ccc688
quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks (source, changelog)	tekton-bundle	digest	2e5ebe0 → e438f31
quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta (source, changelog)	tekton-bundle	patch	0.2.4 → 0.2.5
quay.io/konflux-ci/tekton-catalog/task-init (source, changelog)	tekton-bundle	patch	0.4.2 → 0.4.3
quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta (source, changelog)	tekton-bundle	minor	0.4.1 → 0.7.1
quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta (source, changelog)	tekton-bundle	digest	e19d134 → 350a144
quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan (source, changelog)	tekton-bundle	digest	d5f8907 → 41ff593
quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta (source, changelog)	tekton-bundle	digest	f6a115e → d33d800
quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta (source, changelog)	tekton-bundle	digest	918327b → f4818f8
quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta (source, changelog)	tekton-bundle	digest	4961c44 → f31055c
quay.io/konflux-ci/tekton-catalog/task-show-sbom (source, changelog)	tekton-bundle	minor	0.1 → 0.3
quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta (source, changelog)	tekton-bundle	digest	2dd5b3e → 93f1df1

---

Release Notes

konflux-ci/build-pipeline-tasks (quay.io/konflux-ci/tekton-catalog/task-build-image-index)

v0.3.1

Fixed

• Export SBOM_SKIP_VALIDATION into the step environment so the create-sbom step honors the parameter.
  The parameter did nothing before. Now it works as expected.

konflux-ci/build-pipeline-tasks (quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta)

v0.11.0

Changed

• When scanning the built image with Syft, scans the image filesystem as
  a directory instead of scanning the the image as an OCI archive. This improves
  the scanning time, disk usage and may improve memory usage. More details in
  konflux-build-cli/docs/design/syft-image-scanning.md.
• The remote variants of this task now push the built image to the registry directly
  from the build VM instead of rsyncing the image back to the cluster first.
  For large images, this significantly reduces the time spent on network transfers.

Removed

• BREAKING: Removed the sbom-syft-generate step, SBOM generation now happens
  in the build step.
• BREAKING: Removed the push step, the push now happens in the build step.
• If you have step overrides configured for either of the two removed steps,
  the pipeline will fail with invalid StepOverride. See the migration guidance below.

Migration guidance

Buildah v0.11.0 comes with a migration script that will attempt to automatically
fix the step overrides in your PipelineRuns. In most cases, no manual action will
be needed. But there are cases that the script cannot handle:

1. Your PipelineRun references an external Pipeline. In this case, the migration
   script will never get a chance to run on the PipelineRun.
2. Your PipelineRun is multi-platform, SBOM generation needs more resources
   than the build itself and the remote VMs do not have sufficient resources.

If the migration script doesn't solve the problem, please follow the procedure below.

Manual procedure

If you have sbom-syft-generate or push step overrides in the .spec.taskRunSpecs
section in your PipelineRun, please remove them. In most cases, this should be all.

However, if you were previously requesting more resources for SBOM generation
than for the build step itself, there is a chance that the build will fail.
In this case, move the relevant overrides to the build step. The same technically
applies for the push step, but it's highly unlikely that pushing would require
more resources than the build.

For example:

 spec:
   taskRunSpecs:
     - pipelineTaskName: build-container
       stepSpecs:
-        - name: sbom-syft-generate
+        - name: build
           computeResources:
             requests:
               memory: 16Gi
             limits:
               memory: 16Gi

This will work for build steps that run in-cluster - single-platform builds
and typically also the amd64 builds in a multi-platform build setup.

For build steps that run on remote VMs, the overrides have no effect. In case
the build fails, please switch to a larger VM flavor (consult the documentation
of your particular Konflux deployment to see what's available).

For example:

 spec:
   params:
     - name: build-platforms
       value:
         - localhost
-        - linux/arm64
+        - linux-mxlarge/arm64

v0.10.7

Fixed

• Thanks to konflux-build-cli#208, the task now supports per-containerfile
  ignore files, same as buildah itself.
  • Previously, the task supported the .containerignore and .dockerignore files
    in the root of the context directory, but not the <containerfile>.containerignore
    and <containerfile>.dockerignore files.

v0.10.6

Fixed

• Attaching SBOM attestations using keyless signing. This stopped working between
  versions 0.10.4 and 0.10.5, when the upload-sbom step upgraded cosign to v3.
  • Cosign v3 wants to use a "signing config" JSON file instead of accepting
    service URLs directly as CLI flags. The konflux-ci/konflux-ci deployment
    of Konflux doesn't provide the config file in the TUF mirror. Fixed
    by setting --use-signing-config=false to still allow direct URLs.

Changed

• Consolidated all keyless signing code in the upload-sbom step.
  Previously, if keyless signing was enabled, the task would sign the image
  in the push step and then the SBOM in upload-sbom step. Now, it will sign both
  in the upload-sbom step. This has no practical impact, but enables a larger
  rework of the push step in the future.

v0.10.5

Added

• Added a new parameter RHSM_MOUNT_CA_CERTS to allow setting [konflux-build-cli]'s
  --rhsm-mount-ca-certs option.

konflux-ci/build-pipeline-tasks (quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta)

v0.7.1

• Hermeto release - https://github.com/hermetoproject/hermeto/releases/tag/0.60.1
• Fixes GHSA-rfhj-wcpf-9jcx
• Fixes GHSA-rpww-j58f-22xr
• Fixes GHSA-pxcg-wp85-mcrg
• Fixes GHSA-wx26-fvpq-v9rp

v0.7.0

• Hermeto release - https://github.com/hermetoproject/hermeto/releases/tag/0.60.0
• The .repo file for RPM dependencies is now named hermeto.repo instead of cachi2.repo

v0.6.0

• Hermeto release - https://github.com/hermetoproject/hermeto/releases/tag/0.59.0

v0.5.0

• Hermeto release - https://github.com/hermetoproject/hermeto/releases/tag/0.58.0

konflux-ci/build-definitions (quay.io/konflux-ci/tekton-catalog/task-show-sbom)

v0.3

Fixed

The migration script wasn't attached to the task bundle.

v0.2

Removed

The task show-sbom is deprecated. The migration script deletes it from the pipeline.

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • Between 02:00 AM and 04:59 AM, Monday through Friday (* 2-4 * * 1-5)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[openshift-ci]

Hi @red-hat-konflux-kflux-prd-rh03[bot]. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

@red-hat-konflux-kflux-prd-rh03[bot]: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci]

New changes are detected. LGTM label has been removed.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by: red-hat-konflux-kflux-prd-rh03[bot]

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment