3.2 Bind base and deps in source

You now own lw-student/spring-boot-lw-poc on Gitea. In this module, carry the evidence from Tracks 1 and 2 into that application’s Dockerfile and pom.xml, then push the two changes. Continue in the Showroom terminal.

Before starting, complete the verified mirror in Track 1 and the dependency comparison in module 2.2. You need the published destination pull spec and the selected version in ~/lightwell-dependencies/pom.xml.

Why this control exists

A digest identifies the base image you verified. An exact Maven version identifies the dependency you selected from the workshop advisory. Recording both in application source lets a reviewer see which inputs you intend the build to consume.

Verified Track 1 destination maps to the runtime Dockerfile FROM and Track 2 version maps to the default POM property while Renovate pins remain unchanged
Figure 1. Two evidence sources become two committed file changes; building the image comes later.

Use the destination pull spec from Track 1, including its registry host, hi/openjdk path, and index digest. hummingbird-mirror is the Nexus repository name, not a segment of the image path. The build stage stays on UBI here; you change the runtime stage.

The seed also contains a stale lightwell-pins.properties file for the Renovate exercise. That file is a separate record: updating it does not rewrite the Dockerfile or the POM. Leave it unchanged until module 3.3.

Learning objectives

By the end of this module, you will be able to:

  • Retrieve the verified destination pull spec from Track 1’s report.

  • Replace the runtime base image with that digest-pinned destination.

  • Apply Track 2’s exact version to the application’s default Maven property.

  • Compare the two-file diff and verify that the commit reached Gitea.

The seeded tree

Clone only on your first attempt. On a return visit, continue in /home/lab-user/lightwell-workspace/spring-boot-lw-poc and inspect git status before editing; do not delete existing work. Clone student_repo_url from ConfigMap lab-gitea in namespace gitea. On your first attempt, expect the prepared application to have a runtime FROM naming ubi9/openjdk-21-runtime, a default commons.lang3.version of 3.14.0, and a lightwell-pins.properties file showing 3.14.0.rhlw-00000 and an all-zero Hummingbird digest. On a return visit, your committed edits may already be present; compare them with the Review criteria rather than resetting them.

Clone the student app
export STUDENT_USER=student
: "${REPO_URL:=$(oc -n gitea get configmap lab-gitea -o jsonpath='{.data.student_repo_url}')}"
bash /usr/local/libexec/lab-git-setup.sh
mkdir -p /home/lab-user/lightwell-workspace
git clone "${REPO_URL}" /home/lab-user/lightwell-workspace/spring-boot-lw-poc
cd /home/lab-user/lightwell-workspace/spring-boot-lw-poc
grep -n FROM Dockerfile
grep commons.lang3.version pom.xml | head -20
cat lightwell-pins.properties

Read destination_pullspec from ConfigMap report-02-hummingbird-mirror in namespace lw-poc-validate. Use it only when the report status is verified and the value is present. This is the complete internal image reference approved by your Track 1 workflow; you do not need to assemble it from separate host and digest fields.

The command clears any value left by an earlier attempt before reading the report. Success prints DEST_PULLSPEC= followed by the approved reference. If it prints an error, stop and correct the Track 1 result before editing the Dockerfile.

Read the verified destination
unset DEST_PULLSPEC
if MIRROR_STATUS="$(oc -n lw-poc-validate get configmap report-02-hummingbird-mirror -o jsonpath='{.data.status}')" &&
   [ "$MIRROR_STATUS" = verified ] &&
   VERIFIED_DEST="$(oc -n lw-poc-validate get configmap report-02-hummingbird-mirror -o jsonpath='{.data.destination_pullspec}')" &&
   [ -n "$VERIFIED_DEST" ]; then
  DEST_PULLSPEC="$VERIFIED_DEST"
  printf 'DEST_PULLSPEC=%s\n' "$DEST_PULLSPEC"
else
  printf '%s\n' 'ERROR: no verified destination is available. Complete or repair Track 1 before continuing.' >&2
fi
unset VERIFIED_DEST MIRROR_STATUS

Here you record the verified Nexus Route pull spec in source. Track 4 later retargets the runtime FROM to an internal ImageStream before enforcing build egress restrictions.

Exercise

Bind the verified runtime image

Open /home/lab-user/lightwell-workspace/spring-boot-lw-poc/Dockerfile in your terminal editor. Use the exact value printed as DEST_PULLSPEC; do not reconstruct it from a sample host or a tag.

Change the runtime stage FROM. Leave the AS build line on UBI. The runtime line is the dest host, the path hi/openjdk, and the digest from DEST_PULLSPEC. Keep the image path hi/openjdk; do not insert the administrative Nexus repository name hummingbird-mirror into that path. The runtime image reference must exactly match DEST_PULLSPEC, including its index digest.

The example below identifies the two stages. Replace <verified destination pull spec> with the complete value printed above; do not paste the placeholder or the literal text $DEST_PULLSPEC into the Dockerfile. Preserve the instructions between and after the FROM lines.

Runtime FROM change only (illustrative diff)
 FROM registry.access.redhat.com/ubi9/openjdk-21:1.21 AS build
 ...
-FROM registry.access.redhat.com/ubi9/openjdk-21-runtime:1.21
+FROM <verified destination pull spec>

Bind the selected dependency version

Open /home/lab-user/lightwell-workspace/spring-boot-lw-poc/pom.xml. Find the first, top-level <properties> block, outside any <profile>.

Change the default <commons.lang3.version> in pom.xml to 3.14.0.rhlw-00001. Use the version you verified in ~/lightwell-dependencies/pom.xml; keep the application POM and edit only its default property. You already resolved that version from Nexus in 2.2. This commit records your selected version in application source. Changing only a profile that is never activated leaves the default on 3.14.0.

The generated lightwell-validated profile selects the repository without overriding this version. If you reuse an older generated repository, remove its profile-level commons.lang3.version override first; an active profile otherwise takes precedence over the default. Track 4 also checks the effective Maven dependency graph before building.

Your edit belongs in the project’s top-level <properties> block, not a similarly named property inside <profiles>. Keep the rest of the POM intact.

Default Maven property change (excerpt)
-    <commons.lang3.version>3.14.0</commons.lang3.version>
+    <commons.lang3.version>3.14.0.rhlw-00001</commons.lang3.version>

Leave lightwell-pins.properties as the seed wrote it. The Dockerfile’s existing -Dcommons.lang3.version=3.14.0 build override is also left for Track 4. This module records the intended inputs in source; it does not build or prove the final image.

Inspect and publish your changes

Before staging, compare your edits. Expect one changed runtime FROM and one changed default Maven property. The AS build line and lightwell-pins.properties should be unchanged.

cd /home/lab-user/lightwell-workspace/spring-boot-lw-poc
git --no-pager diff -- Dockerfile pom.xml lightwell-pins.properties

Set the author identity on this clone and refresh Showroom’s credential helper. The helper keeps the lab password in the terminal user’s home, separate from repository configuration. Read Git authentication and cleanup before sharing diagnostics. On a return visit, the repair option removes credentials from an old origin only when it matches the expected student repository; it refuses to overwrite a different remote.

Set author and refresh Git authentication
cd /home/lab-user/lightwell-workspace/spring-boot-lw-poc
git config user.name student
git config user.email student@workshop.local
REPO_URL="$(oc -n gitea get configmap lab-gitea -o jsonpath='{.data.student_repo_url}')"
bash /usr/local/libexec/lab-git-setup.sh --repair-origin "$REPO_URL"
git remote -v

Before committing, confirm that the staged changes contain only Dockerfile and pom.xml. After pushing, verify the remote commit in the Review below.

Commit the runtime FROM and the default version
cd /home/lab-user/lightwell-workspace/spring-boot-lw-poc
git add Dockerfile pom.xml
git status --short
git --no-pager diff --cached
git commit -m "Bind dest Hummingbird runtime and Lightwell default version"
git push origin HEAD

Review

Fetch the remote and compare commit IDs. HEAD and origin/main should be identical after your push. Inspect origin/main so the evidence comes from the remote branch rather than uncommitted local files. The runtime FROM must match DEST_PULLSPEC, the default property must be 3.14.0.rhlw-00001, and the properties file should retain its seed values.

cd /home/lab-user/lightwell-workspace/spring-boot-lw-poc
git fetch origin
git rev-parse HEAD origin/main
git show origin/main:Dockerfile | grep -E '^FROM '
git show origin/main:pom.xml | awk '/<properties>/ { found = 1 } found { print } found && /<\/properties>/ { exit }'
git show origin/main:lightwell-pins.properties

Explain where the destination digest and the selected version came from. If the commit IDs differ, resolve the failed push before continuing. If only a profile contains the new version, correct the default property and push again.

Compare the expected inputs and the committed values side by side. Read the mirror report again so the comparison does not depend on a shell variable from an earlier session.

cd /home/lab-user/lightwell-workspace/spring-boot-lw-poc
printf '\nExpected runtime image from Track 1:\n'
oc -n lw-poc-validate get configmap report-02-hummingbird-mirror \
  -o jsonpath='status={.data.status}{"\n"}destination={.data.destination_pullspec}{"\n"}'
printf '\nCommitted runtime FROM:\n'
git show origin/main:Dockerfile | grep -E '^FROM ' | tail -1
printf '\nSelected default version from Track 2:\n'
awk '/<properties>/ { found = 1 } found { print } found && /<\/properties>/ { exit }' ~/lightwell-dependencies/pom.xml
printf '\nCommitted default version:\n'
git show origin/main:pom.xml | awk '/<properties>/ { found = 1 } found { print } found && /<\/properties>/ { exit }'

Require mirror status verified and an exact match between its destination and the image after the runtime FROM. In both POM property blocks, commons.lang3.version must be 3.14.0.rhlw-00001, the version selected from the workshop advisory. A UBI runtime, a sample host, or a version changed only inside a profile needs correction. An error or missing value is not a match.

Keep the pushed commit hash and these comparisons in your notes. Continue when the remote values match and lightwell-pins.properties still contains the seed values for module 3.3. There is no validation Job or report token to submit. Reading the existing Track 1 report retrieves your mirror evidence; it does not run a Job.

Official documentation

Carry the result into module 3.3

Keep this clone for the Renovate review. These edits declare the intended inputs; they do not prove that an image has been built with them. The seeded build command still has a Maven version override and public fetches. Track 4 removes those and enforces the build path before producing an image.

Key takeaways

  • The student repository now declares the verified Hummingbird destination and the exact version from the workshop advisory.

  • A Clearinghouse GAV would change that same default property.

  • lightwell-pins.properties is still the bot’s work in the next module.