Work in progress

Signed-off-by: Hristo Marinov <hricky@fedoraproject.org>

build-antora-container/Containerfile

@@ -51,7 +51,9 @@ RUN --mount=type=cache,rw,target=/cache \
     npm cache clean --force
 EORUN
 
+
 # Original: FROM ${CHUNKAH_REPO}:${CHUNKAH_TAG} AS chunkah
+# 
 # Commented out (not deleted) rather than replaced outright, since it's the
 # simplest way to use chunkah again if this workaround is ever dropped:
 # chunkah's own image downgrade-installs an EL10-built rpm-sequoia so it can

build-fedocs-containers/Containerfile

@@ -26,7 +26,9 @@ ENV XDG_CACHE_HOME=/var/cache
 COPY ./build-fedocs-containers/fedocs.py /usr/local/bin/fedocs.py
 COPY ./build-fedocs-containers/run-fedocs.sh /usr/local/bin/run-fedocs.sh
 
+
 # Original: FROM ${CHUNKAH_REPO}:${CHUNKAH_TAG} AS chunkah
+# 
 # Commented out (not deleted) rather than replaced outright, since it's the
 # simplest way to use chunkah again if this workaround is ever dropped:
 # chunkah's own image downgrade-installs an EL10-built rpm-sequoia so it can

build-site-container/Containerfile

@@ -109,9 +109,49 @@ COPY --from=builder /antora/output/en-US /usr/share/nginx/html
 COPY build-site-container/run-site-preview.sh /usr/bin/
 
 
+# Original: FROM ${CHUNKAH_REPO}:${CHUNKAH_TAG} AS chunkah
+# 
+# Commented out (not deleted) rather than replaced outright, since it's the
+# simplest way to use chunkah again if this workaround is ever dropped:
+# chunkah's own image downgrade-installs an EL10-built rpm-sequoia so it can
+# read PQC signatures from EL10 target rootfs's (see coreos/chunkah commit
+# 0427ee2ab8668073eab836f9c9f1e94b9966e28d) — but that EL10 build assumes an
+# x86-64-v3/AVX2 CPU baseline and crashes with SIGILL on this host's CPU.
+# We only rechunk Fedora rootfs's, so we don't need PQC support: extract just
+# the chunkah binary and run it against a plain Fedora rootfs instead, which
+# uses the stock (Fedora-built) rpm-sequoia. Pinned to fedora-minimal:44 to
+# match the base chunkah's own Containerfile builds the binary against, to
+# avoid a glibc/openssl ABI mismatch (confirmed: fedora-minimal:45 fails with
+# a missing libssl.so.3, since the binary was linked against an older
+# OpenSSL). Revisit if/when upstream Fedora's rpm-sequoia gains PQC support
+# and chunkah drops this hack, or if we ever need to rechunk EL10 rootfs's.
+FROM ${CHUNKAH_TOOL_BASE_IMAGE} AS chunkah-tool
+
+ARG CHUNKAH_REPO=overridden
+ARG CHUNKAH_TAG=overridden
+
+RUN <<EORUN
+    set -xeuo pipefail
+    export FORCE_COLUMNS=134
+
+    dnf --refresh install --assumeyes --allowerasing \
+        --no-allow-downgrade --no-docs --setopt=tsflags=nodocs \
+        --setopt=install_weak_deps=False --best \
+        --exclude container-selinux \
+            openssl \
+            zlib
+
+    dnf clean all
+    rm --recursive --force /tmp/* /var/lib/dnf/* /var/cache/dnf/* /var/log/*
+EORUN
+
+COPY --from=${CHUNKAH_REPO}:${CHUNKAH_TAG} /usr/bin/chunkah /usr/bin/chunkah
+
+ENV CHUNKAH_ROOTFS=/chunkah
+
 # Rechunk
 # - Use more layers (128)
-FROM ${CHUNKAH_REPO}:${CHUNKAH_TAG} AS chunkah
+FROM chunkah-tool AS chunkah
 
 ARG CHUNKAH_TMP_OCIARCHIVE=overridden