From 99fb5467e735efe1d7c162318da173173130ff4b Mon Sep 17 00:00:00 2001
From: fracappa <fcappa@redhat.com>
Date: Thu, 6 Aug 2026 15:15:11 +0200
Subject: [PATCH] fix: add rootless podman runtime setup to cryptoscan commands
 script

---
 ...t-microshift-rebase-cryptoscan-commands.sh | 27 +++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/ci-operator/step-registry/openshift/microshift/rebase/cryptoscan/openshift-microshift-rebase-cryptoscan-commands.sh b/ci-operator/step-registry/openshift/microshift/rebase/cryptoscan/openshift-microshift-rebase-cryptoscan-commands.sh
index 778ae1697fe73..bc9405dac9c1d 100755
--- a/ci-operator/step-registry/openshift/microshift/rebase/cryptoscan/openshift-microshift-rebase-cryptoscan-commands.sh
+++ b/ci-operator/step-registry/openshift/microshift/rebase/cryptoscan/openshift-microshift-rebase-cryptoscan-commands.sh
@@ -6,6 +6,33 @@ if [[ "$JOB_NAME" == rehearse* ]]; then
     export DRY_RUN=y
 fi
 
+# Setup rootless podman (mirrors nested-podman entrypoint.sh)
+if ! whoami &> /dev/null; then
+    if [ -w /etc/passwd ]; then
+        echo "${USER_NAME:-user}:x:$(id -u):0:${USER_NAME:-user} user:${HOME}:/bin/bash" >> /etc/passwd
+        echo "${USER_NAME:-user}:x:$(id -u):" >> /etc/group
+    fi
+fi
+PODMAN_USER=$(whoami)
+PODMAN_START_ID=$(( $(id -u)+1 ))
+PODMAN_END_ID=$(( 65536-PODMAN_START_ID ))
+echo "${PODMAN_USER}:${PODMAN_START_ID}:${PODMAN_END_ID}" > /etc/subuid
+echo "${PODMAN_USER}:${PODMAN_START_ID}:${PODMAN_END_ID}" > /etc/subgid
+
+mkdir -p "${HOME}/.config/containers"
+cat > "${HOME}/.config/containers/registries.conf" <<PODMAN_EOF
+unqualified-search-registries = [
+  "registry.access.redhat.com",
+  "registry.redhat.io",
+  "docker.io"
+]
+short-name-mode = "permissive"
+PODMAN_EOF
+cat > "${HOME}/.config/containers/storage.conf" <<PODMAN_EOF
+[storage]
+driver = "vfs"
+PODMAN_EOF
+
 export PATH="${HOME}/.local/bin:${PATH}"
 python3 -m ensurepip --upgrade
 pip3 install setuptools-rust cryptography pyyaml pygithub gitpython