fix: resolve pyOpenSSL/cryptography build conflicts in AAP 2.5 EE

[shebistar]

Summary

Fixes the build-and-push (2.5) failure that is blocking all open PRs in this repo. The AAP 2.5 base image was updated and introduced two dependency conflicts that need to be resolved before subscription-manager is installed.

Root Cause

Two failures in openshift-virtualization-migration-ee-2.5/execution-environment.yml:

Failure 1 — subscription-manager install (prepend_base phase)

error: Could not depsolve transaction; 1 problem detected:
 Problem: package python3.12-pyOpenSSL-26.0.0-1.el9ap.noarch from @System requires
          python3.12-typing-extensions >= 4.9, but none of the providers can be installed
   - conflicting requests

The updated AAP 2.5 base image ships python3.12-pyOpenSSL-26.0.0 which requires typing-extensions >= 4.9. Something in subscription-manager's dependency tree conflicts with that. Because the cleanup $PKGMGR remove step ran after the install, the conflict was never cleared in time.

Failure 2 — cryptography uninstall (builder/assemble phase)

× Cannot uninstall cryptography 46.0.5
╰─> The package's contents are unknown: no RECORD file was found for cryptography.
hint: The package was installed by rpm.
Error: building at STEP "RUN /output/scripts/assemble": exit status 1

cryptography 46.0.5 in the new base image was installed via RPM. ansible-builder's assemble script tries to manage it through pip, which fails with no RECORD file.

Fix

In prepend_base, the $PKGMGR remove cleanup is moved before the subscription-manager install, and python3.12-pyOpenSSL + python3.12-cryptography are added to the removal list. Removing them via RPM (microdnf) first eliminates both conflicts before either subscription-manager or pip attempts to touch them.

-   - RUN if [...] microdnf install -y subscription-manager [...]
-   # The fix for rpds-py is included here:
-   - RUN $PKGMGR -y remove python3.12-typing-extensions ... || true
+   # Remove packages that conflict with subscription-manager and pip BEFORE installing
+   - RUN $PKGMGR -y remove python3.12-pyOpenSSL python3.12-cryptography python3.12-typing-extensions ... || true
+   - RUN if [...] microdnf install -y subscription-manager [...]

Files Changed

• openshift-virtualization-migration-ee-2.5/execution-environment.yml

Impact

This is the blocker for all other open PRs (#10, #11, #12, #13). Merging this first will unblock them. The 2.4 and 2.6 EE builds are not affected.

Test plan

• Verify build-and-push (2.5) passes in this PR's CI run
• Confirm subscription-manager registration succeeds when REDHAT_ORG and REDHAT_ACTIVATION_KEY are set
• Confirm all three EE versions (2.4, 2.5, 2.6) succeed after merge

Closes #14

Made with Cursor