[jira-autofix]

Summary

Remove an unused prefetched Z3 source archive from the Konflux gateway image build. The locked z3-sys dependency builds through z3-src, so the old Dockerfile override has no effect.

Related Issue

RHAI-4526

Changes

• Remove the Z3 4.16.0 entry from the gateway generic fetcher.
• Remove the Z3 version, archive extraction, and obsolete build override from the gateway Dockerfile.

Testing

• Parsed the gateway fetcher YAML and checked its four remaining artifacts.
• Checked the gateway build RUN shell syntax, retained vendored-z3 feature, and ran git diff --check.
• Local Konflux gateway build stopped before prefetch because hermeto is unavailable; PR CI must run the image build and smoke check.
• Published gateway SBOM and CVE scan verification is a separate manual follow-up.

Summary by CodeRabbit

• Chores
  • Updated the gateway build process so it no longer extracts or references a prefetched Z3 source archive. The existing build command and package, feature, version, and metadata checks remain in place. This change affects build configuration only; no end-user-facing functionality is changed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: a0c8dd47-11b7-4319-a5a7-ae61580b4c10

📥 Commits

Reviewing files that changed from the base of the PR and between 2ea0abc and aa83209.

📒 Files selected for processing (2)

• deploy/docker/Dockerfile.konflux.gateway
• deploy/konflux/gateway/generic-fetcher.yaml

💤 Files with no reviewable changes (1)

• deploy/konflux/gateway/generic-fetcher.yaml

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 10 remain after this review.

---

📝 Walkthrough

Walkthrough

The generic fetcher configuration no longer includes the Z3 4.16.0 source archive. The gateway Docker build no longer extracts a prefetched Z3 archive or sets Z3_SYS_BUNDLED_DIR_OVERRIDE. It proceeds to the existing cargo auditable build command after version handling.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~8 minutes

Merge Risk: ⚪ Minimal · up to aa832

The gateway retains its vendored Z3 source through its locked Cargo dependency. No actionable merge-blocking issue was found; CI should still validate the image build.

🚥 Pre-merge checks | ✅ 10

✅ Passed checks (10 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the Konflux gateway fix and removal of the unused Z3 prefetch, which matches the main changes.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Contribution Quality And Spam Detection	✅ Passed	The PR does not meet the two-signal threshold. The diff is a focused cleanup in two related Konflux files: it removes the unused Z3 archive and override, while retaining the vendored-z3 feature. The…
No Hardcoded Secrets	✅ Passed	No hardcoded secret was introduced. The pull request only adds the Dockerfile build command and removes the Z3 archive configuration. Added lines contain no API key, token, password, private-key marke…
No Weak Cryptography	✅ Passed	PASS. The pull request only removes the Z3 archive prefetch, extraction, and override. The added build lines contain no banned primitive, custom cryptography, or secret comparison. The remaining `sha2…
No Injection Vectors	✅ Passed	PASS. The PR only removes the Z3 archive and the Z3_SYS_BUNDLED_DIR_OVERRIDE assignment, then runs a static cargo auditable build command. The remaining Dockerfile variable expansions use quoted, …
No Privileged Containers	✅ Passed	PASS. The pull request changes only the gateway Dockerfile build command and the generic fetcher artifact list. The diff adds no privileged: true, host namespace settings, SYS_ADMIN, `allowPrivile…
No Sensitive Data In Logs	✅ Passed	The pull request changes only Docker build commands and a fetcher artifact list. It adds no logging statement and removes the Z3 archive extraction and override. The remaining echo commands are pre-…

---

_{Comment @coderabbitai help to get the list of available commands.}