non-redhat-rpms

Non-Red Hat RPMs

Identify non-Red Hat-signed RPM packages in container images or on the local machine for compliance and supply-chain auditing.

Agent Instructions

Local vs container scan

If the user asks to scan "this machine", "the host", "localhost", or similar, run the script with -l. No image URL, tags, or network access are needed:

./scripts/find_non_redhat_rpms.sh -l

For container image scans, follow the sections below.

Image URL defaults

When the user requests a scan of an image without specifying the full URL:

• Default registry: quay.io
• Default repositories (in priority order): rhoai, then opendatahub
• Try quay.io/rhoai/<image> first. If the image is not found there, try quay.io/opendatahub/<image>.
• If the user provides a registry (e.g. registry.redhat.io) or repository (e.g. opendatahub), use those instead of the defaults.

The script automatically resolves component names: if a repository is not found, it tries appending -rhel9 (e.g. odh-dashboard resolves to odh-dashboard-rhel9). Pass the user's input as-is and let the script handle the resolution.

For example, if the user says "scan odh-dashboard", run the script against quay.io/rhoai/odh-dashboard. The script will find that the repo doesn't exist and automatically try quay.io/rhoai/odh-dashboard-rhel9. If quay.io/rhoai/ fails entirely, try quay.io/opendatahub/ as the repository.

Large image confirmation

The script always displays the compressed image size before pulling. For images exceeding 1 GB it prints a WARNING: line to stderr.

When the tag is known before running the script, pre-check the size to decide whether to ask the user first:

skopeo inspect --override-arch amd64 "docker://<image>:<tag>" | jq '[.LayersData[].Size] | add'

If the total exceeds 1 GB (1073741824 bytes), stop and ask the user for confirmation in the chat before proceeding. Only run the script with -y after the user confirms. Do not repeat the size in your response — the script already displays it in its output.