The ubi8-micro base image doesn't include extracted CA certificates at
/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem. This path exists in
ubi8-minimal but not in ubi8-micro.

Solution: Use the same pattern as konflux.Dockerfile - add a
package_installer stage that installs ca-certificates to /out/ using
dnf --installroot. This generates the extracted CA bundle which is then
copied to the final scratch image.

Build pattern:
1. ubi-micro-base: Reference ubi8-micro for rpmdb preservation
2. package_installer: Install ca-certificates to /out/
3. final (scratch): Copy roxctl + CA bundle

Tested locally - build succeeds and roxctl works correctly.

The ca-certificates package is already in rpms.in.yaml for Konflux builds.

Fixes build error:
  "/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem": not found

Related: https://issues.redhat.com/browse/ROX-33561

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

The rpms.in.yaml was updated to include ca-certificates for the roxctl
konflux build, but rpms.lock.yaml was not regenerated. This caused Konflux
builds to fail because cachi2 couldn't find the prefetched ca-certificates
package and its dependencies.

Changes:
- Regenerated lockfile for all architectures (aarch64, ppc64le, s390x, x86_64)
- Updated package versions to latest available (security updates):
  - postgresql: 15.15 → 15.17
  - python3.12: 3.12.12-1 → 3.12.12-2
  - curl: 7.61.1-34.el8_10.9 → 7.61.1-34.el8_10.10
  - brotli: 1.0.6-3 → 1.0.6-4
  - And other dependency updates

Generated using: ../collector/regenerate-rpms-lockfile.sh

This fixes the Konflux build error:
  "Unable to read consumer identity" when trying to install ca-certificates

Related: https://issues.redhat.com/browse/ROX-33561

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Signed-off-by: Tomasz Janiszewski <tomek@redhat.com>

The root cause of the 'Could not resolve host: cdn-ubi.redhat.com' error was that
roxctl's Konflux build was missing RPM prefetch configuration. When cachi2 performs
RPM prefetch (type: rpm), it sets up /etc/yum.repos.d/ to point to its local cache.
Without RPM prefetch, dnf falls back to the UBI repos copied from ubi-micro which
point to cdn-ubi.redhat.com.

Changed roxctl-build.yaml prefetch-input from:
  value: '{"type": "gomod", "path": "."}'

To (matching main-build.yaml pattern):
  value: |
    [
      { "type": "gomod", "path": "." },
      { "type": "rpm", "path": "." }
    ]

This aligns with:
- main-build.yaml: uses npm + gomod + rpm prefetch
- collector: uses rpm prefetch only

The --setopt=reposdir=/etc/yum.repos.d flag works correctly once RPM prefetch
sets up the cachi2 repos.

Partially generated by AI.

Add ACTIVATION_KEY parameter to prefetch-dependencies task to fix SSL
certificate verification errors when downloading RPMs from cdn.redhat.com.

The subscription-manager-activation-key-prod secret provides the credentials
needed for accessing Red Hat CDN during hermetic RPM prefetch.

Also added dev-package-managers: true parameter as required for RPM prefetching.

Fixes: FetchError: ClientConnectorCertificateError during RPM download

Partially generated by AI.