non-redhat-rpms

Name: non-redhat-rpms
Author: opendatahub-io

36stars74forks

How to install non-redhat-rpms?

opendatahub-io/ai-helpers/non-redhat-rpms

$npx -y skills add opendatahub-io/ai-helpers --skill non-redhat-rpms

Installs into the current project.

Summary

Use this skill to identify non-Red Hat RPM packages installed in container images or on the local machine. For containers, pulls images across multiple architectures and release tags; for local scans, inspects the host directly. Extracts RPM signing metadata and reports packages

Files · 1

View on GitHub

SKILL.md

1	# Non-Red Hat RPMs
2
3	Identify non-Red Hat-signed RPM packages in container images or on the local
4	machine for compliance and supply-chain auditing.
5
6	## Agent Instructions
7
8	### Local vs container scan
9
10	If the user asks to scan "this machine", "the host", "localhost", or similar,
11	run the script with `-l`. No image URL, tags, or network access are needed:
12
13	```bash
14	./scripts/find_non_redhat_rpms.sh -l
15	```
16
17	For container image scans, follow the sections below.
18
19	### Image URL defaults
20
21	When the user requests a scan of an image without specifying the full URL:
22
23	- Default registry: `quay.io`
24	- Default repositories (in priority order): `rhoai`, then `opendatahub`
25	- Try `quay.io/rhoai/<image>` first. If the image is not found there, try
26	`quay.io/opendatahub/<image>`.
27	- If the user provides a registry (e.g. `registry.redhat.io`) or repository
28	(e.g. `opendatahub`), use those instead of the defaults.
29
30	The script automatically resolves component names: if a repository is not
31	found, it tries appending `-rhel9` (e.g. `odh-dashboard` resolves to
32	`odh-dashboard-rhel9`). Pass the user's input as-is and let the script
33	handle the resolution.
34
35	For example, if the user says "scan odh-dashboard", run the script against
36	`quay.io/rhoai/odh-dashboard`. The script will find that the repo doesn't
37	exist and automatically try `quay.io/rhoai/odh-dashboard-rhel9`.
38	If `quay.io/rhoai/` fails entirely, try `quay.io/opendatahub/` as the
39	repository.
40
41	### Large image confirmation
42
43	The script always displays the compressed image size before pulling. For
44	images exceeding 1 GB it prints a `WARNING:` line to stderr.
45
46	When the tag is known before running the script, pre-check the size to
47	decide whether to ask the user first:
48
49	```bash
50	skopeo inspect --override-arch amd64 "docker://<image>:<tag>" \| jq '[.LayersData[].Size] \| add'
51	```
52
53	If the total exceeds 1 GB (1073741824 bytes), **stop and ask the user for
54	confirmation in the chat** before proceeding. Only run the script with `-y`
55	after the user confirms. Do not repeat the size in your response — the
56	script already displays it in its output.
57
58	### Tag selection
59
60	When the user does not specify a tag, discover available tags before running
61	the script so you can offer a choice:
62
63	```bash
64	skopeo list-tags "docker://<image>" \| jq -r '.Tags[]' \
65	\| grep -E '^rhoai-[0-9]+\.[0-9]+(-[a-z]+\.[0-9]+)?$' \| sort -V
66	```
67
68	If there are multiple release tags (stable and/or early access), present
69	them to the user and let them pick which tag to scan. Show the highest
70	stable tag and the highest EA tag as the recommended options, for example:
71
72	> Available tags for odh-dashboard-rhel9:
73	> - rhoai-3.4 (stable)
74	> - rhoai-3.5-ea.2 (early access)
75	>
76	> Which tag would you like to scan?
77
78	If the user does not have a preference, default to the most recent tag
79	-- typically the highest-version early access tag (e.g. `rhoai-3.5-ea.2`
80	over `rhoai-3.4`), since compliance scans are usually run against the
81	newest, not-yet-released builds. The script's `discover_tags` already
82	selects the highest version, preferring stable over EA only within the
83	same version. Then run the script with the chosen tag as a positional
84	argument.
85
86	### Multi-image scans
87
88	When scanning multiple images, batch tag-discovery and size-check commands
89	into a single shell call using a loop (with `&` / `wait` for
90	parallelism). This avoids prompting the user to approve a separate custom
91	command for every image:
92
93	```bash
94	for img in img-a img-b img-c; do
95	(skopeo list-tags "docker://quay.io/rhoai/${img}" 2>/dev/null \
96	\| jq -r '.Tags[]' \
97	\| grep -E '^rhoai-[0-9]+\.[0-9]+(-[a-z]+\.[0-9]+)?$' \| sort -V \
98	\| awk -v name="$img" '{print name": "$0}') &
99	done
100	wait
101	```
102
103	The same approach applies to size pre-checks — one shell call, one
104	approval.
105
106	For the actual scan, use the script's built-in parallelism with `-q`
107	(quiet mode suppresses podman progress bars) and `PARALLEL=N`:
108
109	```bash
110	PARALLEL=4 ./scripts/find_non_redhat_rpms.sh -q -y -f images.input rhoai-3.5-ea.2
111	```
112
113	Each image is processed in its own subshell with isolated output files,
114	so results are clean and not interleaved. Always use `-q` with
115	`PARALLEL` to avoid garbled terminal output from concurrent podman pulls.
116
117	### Results presentation
118
119	Always present scan results as a markdown table, never a

People who liked this also viewed

6 picks

Type

non-redhat-rpms

36stars74forks

View on GitHub

How to install non-redhat-rpms?

opendatahub-io/ai-helpers/non-redhat-rpms

$npx -y skills add opendatahub-io/ai-helpers --skill non-redhat-rpms

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Non-Red Hat RPMs
2
3	Identify non-Red Hat-signed RPM packages in container images or on the local
4	machine for compliance and supply-chain auditing.
5
6	## Agent Instructions
7
8	### Local vs container scan
9
10	If the user asks to scan "this machine", "the host", "localhost", or similar,
11	run the script with `-l`. No image URL, tags, or network access are needed:
12
13	```bash
14	./scripts/find_non_redhat_rpms.sh -l
15	```
16
17	For container image scans, follow the sections below.
18
19	### Image URL defaults
20
21	When the user requests a scan of an image without specifying the full URL:
22
23	- Default registry: `quay.io`
24	- Default repositories (in priority order): `rhoai`, then `opendatahub`
25	- Try `quay.io/rhoai/<image>` first. If the image is not found there, try
26	`quay.io/opendatahub/<image>`.
27	- If the user provides a registry (e.g. `registry.redhat.io`) or repository
28	(e.g. `opendatahub`), use those instead of the defaults.
29
30	The script automatically resolves component names: if a repository is not
31	found, it tries appending `-rhel9` (e.g. `odh-dashboard` resolves to
32	`odh-dashboard-rhel9`). Pass the user's input as-is and let the script
33	handle the resolution.
34
35	For example, if the user says "scan odh-dashboard", run the script against
36	`quay.io/rhoai/odh-dashboard`. The script will find that the repo doesn't
37	exist and automatically try `quay.io/rhoai/odh-dashboard-rhel9`.
38	If `quay.io/rhoai/` fails entirely, try `quay.io/opendatahub/` as the
39	repository.
40
41	### Large image confirmation
42
43	The script always displays the compressed image size before pulling. For
44	images exceeding 1 GB it prints a `WARNING:` line to stderr.
45
46	When the tag is known before running the script, pre-check the size to
47	decide whether to ask the user first:
48
49	```bash
50	skopeo inspect --override-arch amd64 "docker://<image>:<tag>" \| jq '[.LayersData[].Size] \| add'
51	```
52
53	If the total exceeds 1 GB (1073741824 bytes), **stop and ask the user for
54	confirmation in the chat** before proceeding. Only run the script with `-y`
55	after the user confirms. Do not repeat the size in your response — the
56	script already displays it in its output.
57
58	### Tag selection
59
60	When the user does not specify a tag, discover available tags before running
61	the script so you can offer a choice:
62
63	```bash
64	skopeo list-tags "docker://<image>" \| jq -r '.Tags[]' \
65	\| grep -E '^rhoai-[0-9]+\.[0-9]+(-[a-z]+\.[0-9]+)?$' \| sort -V
66	```
67
68	If there are multiple release tags (stable and/or early access), present
69	them to the user and let them pick which tag to scan. Show the highest
70	stable tag and the highest EA tag as the recommended options, for example:
71
72	> Available tags for odh-dashboard-rhel9:
73	> - rhoai-3.4 (stable)
74	> - rhoai-3.5-ea.2 (early access)
75	>
76	> Which tag would you like to scan?
77
78	If the user does not have a preference, default to the most recent tag
79	-- typically the highest-version early access tag (e.g. `rhoai-3.5-ea.2`
80	over `rhoai-3.4`), since compliance scans are usually run against the
81	newest, not-yet-released builds. The script's `discover_tags` already
82	selects the highest version, preferring stable over EA only within the
83	same version. Then run the script with the chosen tag as a positional
84	argument.
85
86	### Multi-image scans
87
88	When scanning multiple images, batch tag-discovery and size-check commands
89	into a single shell call using a loop (with `&` / `wait` for
90	parallelism). This avoids prompting the user to approve a separate custom
91	command for every image:
92
93	```bash
94	for img in img-a img-b img-c; do
95	(skopeo list-tags "docker://quay.io/rhoai/${img}" 2>/dev/null \
96	\| jq -r '.Tags[]' \
97	\| grep -E '^rhoai-[0-9]+\.[0-9]+(-[a-z]+\.[0-9]+)?$' \| sort -V \
98	\| awk -v name="$img" '{print name": "$0}') &
99	done
100	wait
101	```
102
103	The same approach applies to size pre-checks — one shell call, one
104	approval.
105
106	For the actual scan, use the script's built-in parallelism with `-q`
107	(quiet mode suppresses podman progress bars) and `PARALLEL=N`:
108
109	```bash
110	PARALLEL=4 ./scripts/find_non_redhat_rpms.sh -q -y -f images.input rhoai-3.5-ea.2
111	```
112
113	Each image is processed in its own subshell with isolated output files,
114	so results are clean and not interleaved. Always use `-q` with
115	`PARALLEL` to avoid garbled terminal output from concurrent podman pulls.
116
117	### Results presentation
118
119	Always present scan results as a markdown table, never a

People who liked this also viewed

6 picks

Type