fix: allow offline OCP version override

Makefile

@@ -91,7 +91,7 @@ pck-register: ## Register PCK certificates with Intel PCS (requires INTEL_PCS_AP
 ##@ Reference Value Collection
 
 .PHONY: collect-firmware-refvals
-collect-firmware-refvals: ## Collect firmware reference values (bare metal, default)
+collect-firmware-refvals: ## Collect bare-metal firmware values; set OCP_VERSION=x.y.z if oc is unavailable (e.g. airgap)
 	@scripts/collect_firmware_refvals.py --platform baremetal
 
 .PHONY: collect-azure-refvals

README.md

@@ -89,6 +89,7 @@ For air-gapped bare metal environments, see [`airgap/DEPLOY-RUNBOOK.md`](airgap/
 **Common:**
 
 - Tools on your workstation: `podman`, `yq`, `jq`, `skopeo`
+- Python 3.10+ with the shared script dependencies: `python3 -m pip install -r requirements.txt`
 - OpenShift pull secret saved at `~/pull-secret.json` (download from [console.redhat.com](https://console.redhat.com/openshift/downloads)), or point elsewhere via the `PULL_SECRET` environment variable
 - Fork the repository — ArgoCD reconciles cluster state against your fork, so changes must be pushed to your remote
 
@@ -97,9 +98,9 @@ For air-gapped bare metal environments, see [`airgap/DEPLOY-RUNBOOK.md`](airgap/
 These scripts generate the cryptographic material and attestation reference values needed by Trustee. Run them once before your first deployment.
 
 1. `make gen-secrets` — generates KBS key pairs, sealed-secrets signing keys, and copies `values-secret.yaml.template` to `~/values-secret-coco-pattern.yaml`
-2. Collect attestation reference values (requires `veritas` — `pip install "osc-veritas[snp]==0.1.3rc1"` —, `cosign` >= 2.0 for Azure, and `~/pull-secret.json` or `PULL_SECRET`). The OSC operator version is read from the pattern's own pinned values file (`clusterGroup.subscriptions.sandbox.csv`), not auto-detected from a live cluster — see `docs/firmware-reference-values.md`. By default this collects and merges reference values for **both TDX and SNP**:
+2. Collect attestation reference values (requires the shared Python dependencies above, `cosign` >= 2.0 for Azure, and `~/pull-secret.json` or `PULL_SECRET`). The OSC operator version is read from the pattern's own pinned values file (`clusterGroup.subscriptions.sandbox.csv`), not auto-detected from a live cluster — see `docs/firmware-reference-values.md`. By default this collects and merges reference values for **both TDX and SNP**:
    - **Azure:** `make collect-azure-refvals` — pulls PCR measurements from the dm-verity image via veritas. Saves to `~/.coco-pattern/measurements.json`.
-   - **Bare metal:** `make collect-firmware-refvals` — computes firmware measurements from OCP release artifacts via veritas. Saves to `~/.coco-pattern/firmware-reference-values.json`. `pcrStash` and `firmwareReferenceValues` are both enabled by default in `~/values-secret-coco-pattern.yaml`, so nothing needs to be uncommented — the collection script automatically writes an empty `{}` placeholder for the platform you're not using.
+   - **Bare metal:** `make collect-firmware-refvals` — computes firmware measurements from OCP release artifacts via veritas. Saves to `~/.coco-pattern/firmware-reference-values.json`. When collecting before cluster access is available, for example from a connected staging host preparing a disconnected deployment, set the target release explicitly: `OCP_VERSION=4.22.8 make collect-firmware-refvals`. `pcrStash` and `firmwareReferenceValues` are both enabled by default in `~/values-secret-coco-pattern.yaml`, so nothing needs to be uncommented — the collection script automatically writes an empty `{}` placeholder for the platform you're not using.
    - See [docs/firmware-reference-values.md](docs/firmware-reference-values.md) for detailed workflow and options.
 3. Review and customise `~/values-secret-coco-pattern.yaml` — this file is loaded into Vault and provides secrets to the pattern.
 

airgap/DEPLOY-RUNBOOK.md

@@ -27,8 +27,16 @@
 > **Skip this phase on repeat runs.** These steps configure the jump host infrastructure
 > (mirror registry, git server) that persists across deployments. Run once per jump host.
 >
-> **Prerequisites:** Internet access on the jump host, `podman` and `openssl`
-> installed, and `python3-passlib` or `httpd-tools` for `htpasswd`.
+> **Prerequisites:** Internet access on the jump host, Python 3.10+, `podman`
+> and `openssl` installed, and `python3-passlib` or `httpd-tools` for
+> `htpasswd`.
+
+Install the shared Python dependencies before starting the smart Git HTTP
+server or collecting reference values:
+
+```bash
+python3 -m pip install -r requirements.txt
+```
 
 ### 0-0: Set Site Variables
 

docs/firmware-reference-values.md

@@ -19,11 +19,10 @@ By default, `collect_firmware_refvals.py` collects reference values for **both T
 
 ## Prerequisites
 
-- `veritas` installed on the host: `pip install "osc-veritas[snp]==0.1.3rc1"`
-- Python 3 with PyYAML: `pip3 install pyyaml`
+- Python 3.10+ with the shared script dependencies: `python3 -m pip install -r requirements.txt` (includes `veritas`, Typer, Rich, and PyYAML)
 - `cosign` >= 2.0 — Azure only, used by veritas to verify the Red Hat dm-verity image signature: <https://docs.sigstore.dev/cosign/system_config/installation/>
 - OpenShift pull secret at `~/pull-secret.json` (override the location with the `PULL_SECRET` environment variable or `--pull-secret`)
-- For bare metal: OCP version of your cluster (auto-detected if `oc` is logged in, or pass `--ocp-version` explicitly)
+- For bare metal: OCP version of your cluster (auto-detected if `oc` is logged in, set `OCP_VERSION`, or pass `--ocp-version` explicitly)
 - For bare metal TDX: `tdx-measure` (`cargo install --git https://github.com/virtee/tdx-measure tdx-measure-cli`) — collection continues with a warning if absent, but TDX RTMR values will be incomplete
 
 **Why host-installed instead of the `coco-tools` container**: the container image (`quay.io/openshift_sandboxed_containers/coco-tools:0.5.1`) is pinned to an older veritas release that lacks `--skip-tlog`, which is needed to avoid the Azure verification failures described below. This is a deliberate, temporary deviation — see the tracking issue referenced in [Known Limitations](#known-limitations) for moving back to the container once a `coco-tools` release ships with a newer veritas.
@@ -58,8 +57,16 @@ base64-encoded map), not just a version stamp, and is now always passed to
 veritas explicitly.
 
 OCP version (bare metal only) is unaffected by this — there is no
-values-file pin for the exact OCP patch, so `--ocp-version` still falls
-back to live-cluster auto-detection, or can be passed explicitly.
+values-file pin for the exact OCP patch. It resolves in this order:
+
+1. `--ocp-version` (repeatable), if supplied.
+2. `OCP_VERSION`, if set.
+3. Live-cluster auto-detection through an authenticated `oc` session.
+
+Use `OCP_VERSION` when reference values are collected before a cluster is
+available, such as from a connected staging host preparing artifacts for a
+fully air-gapped environment. The variable accepts one OCP version; use the
+repeatable `--ocp-version` option when collecting for multiple versions.
 
 ## Collecting Reference Values
 
@@ -86,6 +93,10 @@ Veritas pulls the `osc-dm-verity-image` from the Red Hat registry, verifies its
 # Collect firmware values from OCP release artifacts
 make collect-firmware-refvals
 
+# Collect without an authenticated cluster connection (for example, from a
+# connected staging host preparing artifacts for a fully disconnected environment)
+OCP_VERSION=4.22.8 make collect-firmware-refvals
+
 # Or with explicit OCP version:
 ./scripts/collect_firmware_refvals.py --platform baremetal --ocp-version 4.20.18
 
@@ -107,8 +118,8 @@ Options:
   -o, --output <path>       Override output path
   -p, --pull-secret <path>  Pull secret file (default: ~/pull-secret.json,
                             override via PULL_SECRET env var)
-  -v, --ocp-version <ver>   OCP version (bare metal; repeatable; default:
-                            auto-detect from a live cluster)
+  -v, --ocp-version <ver>   OCP version (bare metal; repeatable; takes
+                             precedence over OCP_VERSION and auto-detection)
   --osc-version <ver>       OSC operator version (repeatable; default: read
                             from --values-file's pinned subscription CSV)
   --values-file <path>      Values file to read the pinned OSC version from

requirements.txt

@@ -0,0 +1,7 @@
+# Shared dependencies for all Python utilities in this repository.
+Jinja2
+osc-veritas[snp]==0.1.3rc1
+PyYAML
+pytest
+rich
+typer

rhdp/README.md

@@ -6,7 +6,7 @@ The scripts in this directory help users of that platform automate deployments.
 ## Prerequisites
 
 - `podman` installed and running (used by `pattern.sh` itself)
-- `veritas` installed on the host (used for reference value collection): `pip install "osc-veritas[snp]==0.1.3rc1"`
+- Python 3.10+ with the shared script dependencies: `python3 -m pip install -r requirements.txt`
 - `cosign` >= 2.0 (used by veritas for Azure image signature verification)
 - `yq`, `jq` installed
 - OpenShift pull secret (default: `~/pull-secret.json`, override with `PULL_SECRET` — see below)
@@ -40,7 +40,7 @@ export RESOURCEGROUP=
    3. The wrapper script **requires** an azure region code. This code SHOULD be the same as what was selected in RHDP.
    4. Optionally use `--prefix` for custom cluster naming: `bash ./rhdp/wrapper.sh --prefix dev1 eastasia`
 
-The wrapper handles: cluster provisioning, secret generation, PCR reference value collection (via veritas), and pattern installation.
+The wrapper installs the root `requirements.txt` with its selected Python interpreter, then handles cluster provisioning, secret generation, PCR reference value collection (via veritas), and pattern installation.
 
 ### Multi-Cluster Deployment (Hub and Spoke)
 

rhdp/rhdp-cluster-define.py

@@ -5,12 +5,11 @@
 import os
 import pathlib
 import shutil
-from typing import Dict, List, Optional
+from typing import Annotated, Dict, List, Optional
 
 import typer
 from jinja2 import Environment, FileSystemLoader, select_autoescape
 from rich import print as rprint
-from typing_extensions import Annotated
 
 
 def get_default_cluster_configs(prefix: str = "") -> List[Dict]:

rhdp/wrapper-cluster-only.sh

@@ -2,16 +2,23 @@
 #!/usr/bin/env bash
 set -e
 
-# Function to detect available python binary
+# Function to detect available Python 3 binary.
 get_python_cmd() {
-    if command -v python &> /dev/null; then
-        echo "python"
-    elif command -v python3 &> /dev/null; then
-        echo "python3"
+    local python_cmd
+    if command -v python3 &> /dev/null; then
+        python_cmd="python3"
+    elif command -v python &> /dev/null; then
+        python_cmd="python"
     else
         echo "ERROR: Neither python3 nor python is available" >&2
         exit 1
     fi
+
+    if ! "$python_cmd" -c 'import sys; raise SystemExit(sys.version_info < (3, 10))'; then
+        echo "ERROR: Python 3.10 or later is required" >&2
+        exit 1
+    fi
+    echo "$python_cmd"
 } 
 
 # Parse arguments
@@ -102,7 +109,8 @@ sleep 10
 echo "---------------------"
 echo "Installing python dependencies"
 echo "---------------------"
-pip install -r rhdp/requirements.txt
+PYTHON_CMD=$(get_python_cmd)
+"$PYTHON_CMD" -m pip install -r requirements.txt
 echo "---------------------"
 echo "requirements installed"
 echo "---------------------"
@@ -116,7 +124,6 @@ sleep 5
 echo "---------------------"
 echo "defining cluster"
 echo "---------------------"
-PYTHON_CMD=$(get_python_cmd)
 DEFINE_ARGS=()
 if [ "$RECREATE" = true ]; then
     DEFINE_ARGS+=(--recreate)

rhdp/wrapper-multicluster.sh

@@ -1,16 +1,23 @@
 #!/usr/bin/env bash
 set -e
 
-# Function to detect available python binary
+# Function to detect available Python 3 binary.
 get_python_cmd() {
-    if command -v python &> /dev/null; then
-        echo "python"
-    elif command -v python3 &> /dev/null; then
-        echo "python3"
+    local python_cmd
+    if command -v python3 &> /dev/null; then
+        python_cmd="python3"
+    elif command -v python &> /dev/null; then
+        python_cmd="python"
     else
         echo "ERROR: Neither python3 nor python is available" >&2
         exit 1
     fi
+
+    if ! "$python_cmd" -c 'import sys; raise SystemExit(sys.version_info < (3, 10))'; then
+        echo "ERROR: Python 3.10 or later is required" >&2
+        exit 1
+    fi
+    echo "$python_cmd"
 } 
 
 # Parse arguments
@@ -134,7 +141,8 @@ sleep 10
 echo "---------------------"
 echo "Installing python dependencies"
 echo "---------------------"
-pip install -r rhdp/requirements.txt
+PYTHON_CMD=$(get_python_cmd)
+"$PYTHON_CMD" -m pip install -r requirements.txt
 echo "---------------------"
 echo "requirements installed"
 echo "---------------------"
@@ -148,7 +156,6 @@ sleep 5
 echo "---------------------"
 echo "defining both clusters (hub and spoke)"
 echo "---------------------"
-PYTHON_CMD=$(get_python_cmd)
 DEFINE_ARGS=(--multicluster)
 if [ "$RECREATE" = true ]; then
     DEFINE_ARGS+=(--recreate)
@@ -447,4 +454,4 @@ fi
 
 echo "---------------------"
 echo "done"
-echo "---------------------"
+echo "---------------------"

rhdp/wrapper.sh

@@ -2,16 +2,23 @@
 #!/usr/bin/env bash
 set -e
 
-# Function to detect available python binary
+# Function to detect available Python 3 binary.
 get_python_cmd() {
-    if command -v python &> /dev/null; then
-        echo "python"
-    elif command -v python3 &> /dev/null; then
-        echo "python3"
+    local python_cmd
+    if command -v python3 &> /dev/null; then
+        python_cmd="python3"
+    elif command -v python &> /dev/null; then
+        python_cmd="python"
     else
         echo "ERROR: Neither python3 nor python is available" >&2
         exit 1
     fi
+
+    if ! "$python_cmd" -c 'import sys; raise SystemExit(sys.version_info < (3, 10))'; then
+        echo "ERROR: Python 3.10 or later is required" >&2
+        exit 1
+    fi
+    echo "$python_cmd"
 } 
 
 # Parse arguments
@@ -149,7 +156,8 @@ sleep 10
 echo "---------------------"
 echo "Installing python dependencies"
 echo "---------------------"
-pip install -r rhdp/requirements.txt
+PYTHON_CMD=$(get_python_cmd)
+"$PYTHON_CMD" -m pip install -r requirements.txt
 echo "---------------------"
 echo "requirements installed"
 echo "---------------------"
@@ -163,7 +171,6 @@ sleep 5
 echo "---------------------"
 echo "defining cluster"
 echo "---------------------"
-PYTHON_CMD=$(get_python_cmd)
 DEFINE_ARGS=()
 if [ -n "$PREFIX" ]; then
     DEFINE_ARGS+=(--prefix "${PREFIX}")
@@ -207,4 +214,3 @@ export KUBECONFIG="$(pwd)/${INSTALL_DIR}/auth/kubeconfig"
 echo "---------------------"
 echo "pattern install done"
 echo "---------------------"
-