Skip to content

Update rpm package to have 256bit digests #1411

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Nov 6, 2025
+32 −3
Merged

Update rpm package to have 256bit digests #1411

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .dockerignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,3 @@
.git
/shared-*
release-v*/**
34 changes: 31 additions & 3 deletions deployments/container/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,35 @@ ARG VERSION="N/A"
ARG GIT_COMMIT="unknown"
RUN make PREFIX=/artifacts/bin cmd-nvidia-ctk-installer

# The rpmdigests stage updates the existing rpm packages to have 256bit digests.
# This is done using fpm.
FROM nvcr.io/nvidia/cuda:13.0.1-base-ubi9 AS rpmdigests

RUN dnf install -y \
rubygems \
ruby-devel \
yum-utils \
rpm-build \
&& gem install --no-document fpm

ARG ARTIFACTS_ROOT
COPY ${ARTIFACTS_ROOT}/centos7 /artifacts/packages/centos7-src

WORKDIR /artifacts/packages/centos7

# For each architecture from the source we find all packages and update the
# digests.
RUN for arch in $(ls /artifacts/packages/centos7-src/); do \
mkdir -p /artifacts/packages/centos7/${arch}; \
cd /artifacts/packages/centos7/${arch}; \
# For each package in the source folder we recreate a package to update
# the digests to 256-bit since we're running in a ubi9 container.
Copy link

@jgehrcke jgehrcke Nov 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hello! I got confused by the logic communicated by this sentence: we update the digests because we run in an ubi9 container?

Just glancing over this whole topic... is the following true?

We update the centos 7 RPM packages to contain 256 bit digests because of <some-reason-probably-compliance> and we do so by processing these RPM files in a UBI9 (rhel generation 9) container because only there we have the required tooling available.

This is for my own understanding, I am not asking to change the patch :).

Copy link
Member Author

@elezar elezar Nov 5, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When we originally build the packages, we do so in a centos7 container (for glibc reasons). The version of rpmbuild available in this container is:

# rpmbuild --version
RPM version 4.11.3

which only generates SHA1 and MD5 digests and does not support 256-bit digests.

According to https://stackoverflow.com/questions/71942026/add-sha256-digests-to-rpm-packages, support for SHA256 digests was added in 4.14.3 (although it may not have been the default).

What we do in this case is us an intermediate container (rpmdigests) based on nvcr.io/nvidia/cuda:13.0.1-base-ubi9 (currently) with:

# rpmbuild --version
RPM version 4.16.1.3

Use fpm to "recreate" the packages. What I assume happens is that fpm extracts the packages and creates new packages using rpmbuild. Since the version in the container supports SHA256 digests by default these new packages will include these. Note that the exising SHA1 and MD5 digests are maintained.

And yes, the reason that we do this is "compliance". There are programs like FIPS that require this and certain newer distributions (see #1307) also require this by default.

Copy link
Member Author

@elezar elezar Nov 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have updated the description with the motivation.

for src_package in $(ls /artifacts/packages/centos7-src/${arch}/*.rpm); do \
fpm -s rpm -t rpm ${src_package}; \
done; \
done; \
rm -rf /artifacts/packages/centos7-src

# The packaging stage collects the deb and rpm packages built for
# supported architectures.
FROM nvcr.io/nvidia/distroless/go:v3.2.0-dev AS packaging
Expand All @@ -62,9 +91,8 @@ SHELL ["/busybox/sh", "-c"]
RUN ln -s /busybox/sh /bin/sh

ARG ARTIFACTS_ROOT
COPY ${ARTIFACTS_ROOT} /artifacts/packages/

WORKDIR /artifacts
COPY ${ARTIFACTS_ROOT}/ubuntu18.04 /artifacts/packages/ubuntu18.04
COPY --from=rpmdigests /artifacts/packages/centos7 /artifacts/packages/centos7

# build-args are added to the manifest.txt file below.
ARG PACKAGE_VERSION
Expand Down