qt6-migration-pipeline/external-dependencies/AIRGAP-SUMMARY.md

Air-Gapped Environment Adaptation Summary

Overview

All 7 Dockerfiles in ./external-dependencies/ have been adapted for air-gapped environment deployment using internal infrastructure.

Adapted Dockerfiles

Package	Version	Status
ubuntu-26.04-build-container	base	✅ Adapted
qt6-framework	6.10.2	✅ Adapted
log4qt	2.0.0	✅ Adapted
grantlee	5.3.1	✅ Adapted
googletest	1.15.2	✅ Adapted
postgresql	16	✅ Adapted
kdreports	2.3.0	✅ Adapted

Air-Gap Configuration Applied

1. Internal Nexus Repositories

http://remote-repo.sl.defence-elec.de:8081/repository/ubuntu
http://remote-repo.sl.defence-elec.de:8081/repository/ubuntu-security

2. Proxy Configuration

HTTP_PROXY=http://10.198.80.130:3128
HTTPS_PROXY=http://10.198.80.130:3128
NO_PROXY=localhost,127.0.0.1,defence-elec.de,.defence-elec.de,sl.defence-elec.de,10.198.80.0/23,192.168.133.0/24,141.200.0.0/16,10.184.0.0/15,10.199.101.35,10.199.101.36,10.199.101.158

3. Harbor Registry for Base Images

harbor.sl.defence-elec.de/proxydockerhub/library/ubuntu:26.04

4. User Creation

• ctc: uid 1445, gid 1445, home: /shd/CTC/TOOLS
• rme: uid 1001, gid 1001, home: /home/rme

5. CA Certificates and Signing Keys

http://10.198.80.75/rme/SL-Netz.crt
http://10.198.80.75/rme/deb_and_rpm_signage_key.pub

6. Shell Configuration

SHELL ["/bin/bash", "-o", "pipefail", "-c"]

7. Labels Standardization

• Changed from maintainer to author (lowercase)
• Added project label
• Standardized format across all Dockerfiles

Changes Made to Each Dockerfile

Before (Public Environment)

FROM harbor.sl.defence-elec.de/proxydockerhub/library/ubuntu:26.04

LABEL maintainer="Legatus Team"
LABEL description="..."
LABEL version="..."

ENV DEBIAN_FRONTEND=noninteractive

ARG HTTP_PROXY=""
ARG HTTPS_PROXY=""
ARG NO_PROXY="localhost,127.0.0.1,.sl.defence-elec.de"

ENV http_proxy=${HTTP_PROXY}
ENV https_proxy=${HTTPS_PROXY}
ENV no_proxy=${NO_PROXY}

After (Air-Gapped Environment)

FROM harbor.sl.defence-elec.de/proxydockerhub/library/ubuntu:26.04

ARG RME_USERPASS=ctc
ARG RME_ADMINSRV=10.198.80.75
ARG RME_PROJECT=guez

# Proxy configuration for air-gapped environments
ARG http_proxy="http://10.198.80.130:3128"
ARG no_proxy="localhost,127.0.0.1,defence-elec.de,.defence-elec.de,sl.defence-elec.de,10.198.80.0/23,192.168.133.0/24,141.200.0.0/16,10.184.0.0/15,10.199.101.35,10.199.101.36,10.199.101.158"
ARG HTTP_PROXY=${http_proxy}
ARG https_proxy=${http_proxy}
ARG HTTPS_PROXY=${http_proxy}
ARG NO_PROXY=${no_proxy}

LABEL author="Legatus Team"
LABEL project=${RME_PROJECT}
LABEL version="..."
LABEL description="..."

ENV DEBIAN_FRONTEND=noninteractive

# OS and PATH configuration
ENV LANG=C.UTF-8 \
    LC_ALL=C.UTF-8

# Shell global auf Bash mit sicheren Pipes umstellen
SHELL ["/bin/bash", "-o", "pipefail", "-c"]

# Originale Repositories durch Nexus Proxies ersetzen
RUN echo : > /etc/apt/sources.list && \
    echo -e "Types: deb\n\
URIs: http://remote-repo.sl.defence-elec.de:8081/repository/ubuntu\n\
Suites: resolute resolute-updates resolute-backports\n\
Components: main restricted universe multiverse\n\
Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg\n\
\n\
Types: deb\n\
URIs: http://remote-repo.sl.defence-elec.de:8081/repository/ubuntu-security\n\
Suites: resolute-security\n\
Components: main restricted universe multiverse\n\
Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg" > /etc/apt/sources.list.d/ubuntu.sources

# Create users (install openssl first for password hashing)
RUN apt-get update && apt-get install -y openssl \
    && groupadd ctc -g 1445 || true \
    && groupadd rme -g 1001 || true \
    && useradd -d /shd/CTC/TOOLS -u 1445 -g ctc -m -p $(openssl passwd -5 ${RME_USERPASS}) ctc || true \
    && useradd -d /home/rme -u 1001 -g rme -m -p $(openssl passwd -5 ${RME_USERPASS}) rme || true \
    && rm -rf /var/lib/apt/lists/*

RUN curl -fsSL http://${RME_ADMINSRV}/rme/deb_and_rpm_signage_key.pub --output /etc/apt/keyrings/deb_and_rpm_signage_key.asc \
    && curl -fsSL http://${RME_ADMINSRV}/rme/SL-Netz.crt --output /usr/local/share/ca-certificates/SL-Netz.crt \
    && update-ca-certificates

Reference Documentation

• Reference Dockerfile: prompts/Dockerfile-ubuntu26-qt6_anpassung_tp.dockerfile
• Detailed Adaptation Guide: external-dependencies/qt6-framework/AIRGAP-ADAPTATION.md
• Dependency Inventory: external-dependencies/DEPENDENCIES-INVENTORY.md

Git Commits

1. 50e0485fe - Adapt remaining 5 Dockerfiles for air-gapped environment
2. Previous commits for qt6-framework and ubuntu-26.04-build-container

Verification

All Dockerfiles now contain:

• ✅ Internal Nexus APT repositories
• ✅ Proxy configuration with comprehensive no_proxy list
• ✅ User creation (ctc and rme)
• ✅ CA certificates installation
• ✅ APT signing keys
• ✅ Standardized labels (lowercase)
• ✅ Shell configuration with pipefail
• ✅ Harbor registry for base images

Next Steps

1. Build and test each Dockerfile in the air-gapped environment
2. Verify SBOM generation works with internal repositories
3. Update Jenkins pipeline configurations to use new Dockerfiles
4. Document any environment-specific adjustments needed

Environment Parameters

Parameter	Value
Nexus Repository	remote-repo.sl.defence-elec.de:8081
Proxy Server	10.198.80.130:3128
Admin Server	10.198.80.75
Harbor Registry	harbor.sl.defence-elec.de/proxydockerhub
PIP Index URL	http://remote-repo.sl.defence-elec.de:8081/repository/proxypipy/