fix: ee-2.5 build fails — pyOpenSSL/cryptography conflict in AAP 2.5 base image

Problem

The build-and-push (2.5) job fails on every PR with two errors caused by a recent update to the registry.redhat.io/ansible-automation-platform-25/ee-minimal-rhel9:latest base image.

Error 1 — subscription-manager install (prepend_base phase)

error: Could not depsolve transaction; 1 problem detected:
 Problem: package python3.12-pyOpenSSL-26.0.0-1.el9ap.noarch from @System requires python3.12-typing-extensions >= 4.9, but none of the providers can be installed
   - conflicting requests
   - problem with installed package python3.12-pyOpenSSL-26.0.0-1.el9ap.noarch

The AAP 2.5 base image now ships python3.12-pyOpenSSL-26.0.0 which requires python3.12-typing-extensions >= 4.9. When subscription-manager is installed, something in its dependency tree creates a conflict with that requirement. Because the $PKGMGR remove cleanup step currently runs after the subscription-manager install, the conflicting package is still present when microdnf tries to resolve deps.

Error 2 — cryptography uninstall (assemble/builder phase)

× Cannot uninstall cryptography 46.0.5
╰─> The package's contents are unknown: no RECORD file was found for cryptography.
hint: The package was installed by rpm.
Error: building at STEP "RUN /output/scripts/assemble": exit status 1

cryptography 46.0.5 in the AAP 2.5 base image was installed via RPM. Ansible Builder's assemble script tries to manage it through pip, which fails because there is no pip RECORD file for an RPM-installed package.

Root Cause

Both errors share the same root cause: the RUN $PKGMGR -y remove ... cleanup step runs after the subscription-manager install step. Moving it before, and adding python3.12-pyOpenSSL and python3.12-cryptography to the removal list, resolves both conflicts.

Proposed Fix

In openshift-virtualization-migration-ee-2.5/execution-environment.yml, reorder prepend_base steps and extend the remove list:

prepend_base:
  - ARG REDHAT_ORG
  - ARG REDHAT_ACTIVATION_KEY
  # Remove packages that conflict with subscription-manager and pip dependency
  # management due to updates in the AAP 2.5 base image.
  - RUN $PKGMGR -y remove python3.12-pyOpenSSL python3.12-cryptography python3.12-typing-extensions python3.12-referencing python3.12-jsonschema python3.12-rpds-py python3.12-ansible-compat python3.12-jsonschema-specifications ansible-lint || true
  - RUN if [[ ! -z "$REDHAT_ORG" ]] && [[ ! -z "$REDHAT_ACTIVATION_KEY" ]]; then microdnf install -y subscription-manager && subscription-manager register --org $REDHAT_ORG --activationkey $REDHAT_ACTIVATION_KEY; else echo "Skipping Subscribing Build"; fi
  - RUN $PYCMD -m pip install --upgrade pip setuptools

Files to Change

• openshift-virtualization-migration-ee-2.5/execution-environment.yml

Open openshift-virtualization-migration-ee-2.5/execution-environment.yml and inspect the prepend_base steps. Move the package-removal step before subscription-manager installation and include the packages listed in the issue. Run the build-and-push (2.5) job; done means the image build completes without the dependency-resolution or cryptography uninstall errors.