sync install script for Almalinux 8 and 9

Author: arnej27959

build/almalinux-8/include/install-build-dependencies.sh

@@ -65,19 +65,6 @@ dnf -y install \
     time \
     valgrind
 
-# Install recent aws CLI
-curl -sSLf "https://awscli.amazonaws.com/awscli-exe-linux-$(arch).zip" -o "awscliv2.zip"
-unzip -q awscliv2.zip
-./aws/install
-rm -rf aws awscliv2.zip
-
-# Install session manager
-if [ "$(arch)" = x86_64 ]; then
-    dnf install -y https://s3.amazonaws.com/session-manager-downloads/plugin/latest/linux_64bit/session-manager-plugin.rpm
-else
-    dnf install -y https://s3.amazonaws.com/session-manager-downloads/plugin/latest/linux_arm64/session-manager-plugin.rpm
-fi
-
 GIT_REPO="https://github.com/vespa-engine/vespa"
 
 # Change git reference for a specific version of the vespa.spec file. Use a tag or SHA to allow for reproducible builds.
@@ -94,18 +81,6 @@ sed -e '/^BuildRequires:/d' \
 # Install vespa build and runtime dependencies
 dnf builddep --nobest -y vespa.spec vesparun.spec
 rm -f vespa.spec vesparun.spec
-gcc_version=$(rpm -qa | sed -ne "s/vespa-toolset-\([0-9][0-9]\)-meta.*/\1/p")
-
-#  Install extra compiler tools
-dnf -y install \
-    clang \
-    "gcc-toolset-$gcc_version-libasan-devel" \
-    "gcc-toolset-$gcc_version-libtsan-devel" \
-    "gcc-toolset-$gcc_version-libubsan-devel"
-
-# shellcheck disable=SC1091
-. /opt/rh/gcc-toolset/enable
-/usr/lib/rpm/redhat/redhat-annobin-plugin-select.sh
 
 # Install Ruby in build image that is required for running system test in PR jobs for both Vespa and system tests
 dnf -y module enable ruby:3.1
@@ -129,6 +104,18 @@ dnf -y install \
 # Compile two rubygems
 gem install ffi libxml-ruby
 
+#  Install extra compiler tools
+gcc_version=$(rpm -qa | sed -ne "s/vespa-toolset-\([0-9][0-9]\)-meta.*/\1/p")
+dnf -y install \
+    clang \
+    "gcc-toolset-$gcc_version-libasan-devel" \
+    "gcc-toolset-$gcc_version-libtsan-devel" \
+    "gcc-toolset-$gcc_version-libubsan-devel"
+
+# shellcheck disable=SC1091
+. /opt/rh/gcc-toolset/enable
+/usr/lib/rpm/redhat/redhat-annobin-plugin-select.sh
+
 printf '%s\n' \
        '# for cmake, ccache, protobuf etc:' \
        'export PATH="/opt/vespa-deps/bin:${PATH}"'              >  /etc/profile.d/enable-vespa-deps.sh
@@ -137,6 +124,19 @@ printf '%s\n'  "* soft nproc 102400"   "* hard nproc 102400"    > /etc/security/
 printf '%s\n'  "* soft core 0"         "* hard core unlimited"  > /etc/security/limits.d/99-coredumps.conf
 printf '%s\n'  "* soft nofile 262144"  "* hard nofile 262144"   > /etc/security/limits.d/99-nofile.conf
 
+# Install recent aws CLI
+curl -sSLf "https://awscli.amazonaws.com/awscli-exe-linux-$(arch).zip" -o "awscliv2.zip"
+unzip -q awscliv2.zip
+./aws/install
+rm -rf aws awscliv2.zip
+
+# Install session manager
+if [ "$(arch)" = x86_64 ]; then
+    dnf install -y https://s3.amazonaws.com/session-manager-downloads/plugin/latest/linux_64bit/session-manager-plugin.rpm
+else
+    dnf install -y https://s3.amazonaws.com/session-manager-downloads/plugin/latest/linux_arm64/session-manager-plugin.rpm
+fi
+
 # Install docker client  to avoid doing this in all pipelines.
 dnf config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
 dnf -y install docker-ce docker-ce-cli containerd.io

build/almalinux-9/include/install-build-dependencies.sh

@@ -165,7 +165,8 @@ echo "✍️ Installing cosign version ${COSIGN_VERSION}"
 dnf install -y "https://github.com/sigstore/cosign/releases/download/v${COSIGN_VERSION}/cosign-${COSIGN_VERSION}-1.$(arch).rpm"
 
 TRIVY_VERSION=$(curl -sSL https://api.github.com/repos/aquasecurity/trivy/releases/latest |  jq -re '.tag_name|sub("^v";"")')
-KUBECTL_VERSION="1.31.1"
+KUBECTL_VERSION="1.34.3"
+echo "⎈ Installing trivy version ${TRIVY_VERSION} and kubectl version ${KUBECTL_VERSION}"
 if [ "$(arch)" = x86_64 ]; then
   dnf install -y "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.rpm"
   curl -L -o /usr/local/bin/kubectl "https://dl.k8s.io/release/v${KUBECTL_VERSION}/bin/linux/amd64/kubectl"
@@ -176,13 +177,18 @@ fi
 
 chmod 755 /usr/local/bin/kubectl
 
+# Install helm for package management in Kubernetes
+/include/get_helm.sh --version 3.19.4
+
 # Install crane for image management
-GOPATH=/usr/local go install github.com/google/go-containerregistry/cmd/crane@v0.20.2
+GOPATH=/usr/local go install github.com/google/go-containerregistry/cmd/crane@v0.20.7
 
 # Install siad for Buildkite provider
-ATHENZ_VERSION="1.11.65"
+# FIXME @marlon remove hardcoded version and fetch latest after updating usage
+ATHENZ_VERSION="1.11.67"
+echo "🔑 Installing athenz version ${ATHENZ_VERSION} and building siad for buildkite"
 curl -Lf -O https://github.com/AthenZ/athenz/archive/refs/tags/v${ATHENZ_VERSION}.tar.gz
-tar zxvf v${ATHENZ_VERSION}.tar.gz
+tar zxf v${ATHENZ_VERSION}.tar.gz
 (
   cd "/athenz-${ATHENZ_VERSION}/provider/buildkite/sia-buildkite"
   GOTOOLCHAIN=auto /usr/bin/go build -v ./cmd/siad
@@ -197,9 +203,6 @@ dnf install -y python3-pip
 curl -L -o /usr/local/bin/factory-command "https://raw.githubusercontent.com/vespa-engine/vespa/refs/heads/master/.buildkite/factory-command.sh"
 chmod 755 /usr/local/bin/factory-command
 
-# Install helm for package management in Kubernetes
-/include/get_helm.sh --version 3.17.0
-
 # Cleanup
 dnf clean all --enablerepo='*'
 rm -rf /var/cache/yum