From 6df63097b32f0ffa2ca0278aafee815fdc685c3a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jiri=20Dan=C4=9Bk?= <jdanek@redhat.com>
Date: Tue, 4 Aug 2026 22:01:29 +0200
Subject: [PATCH 1/3] fix(s390x): install zeromq-devel from rhelai-3.0 for
 pyzmq builds

Enable rhelai-3.0-for-rhel-9-s390x-rpms on AIPCC bases so pyzmq links
system libzmq instead of bundling it. Keep -Dundefined=64 as a fallback
when zeromq-devel is unavailable on UBI-only GHA builds.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .../ubi9-python-3.12/Dockerfile.konflux.cpu       | 11 +++++++++--
 .../ubi9-python-3.12/Dockerfile.konflux.cpu       | 15 +++++++++++++--
 2 files changed, 22 insertions(+), 4 deletions(-)

diff --git a/jupyter/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu b/jupyter/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu
index 0fb46bbee2..aa60e1727d 100644
--- a/jupyter/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu
+++ b/jupyter/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu
@@ -73,6 +73,10 @@ set -Eeuxo pipefail
 echo "Building for architecture: ${TARGETARCH}"
 if [ "$TARGETARCH" = "s390x" ]; then
     PACKAGES="perl mesa-libGL skopeo gcc gcc-c++ make openssl-devel autoconf automake libtool cmake python3-devel pybind11-devel openblas-devel unixODBC-devel"
+    if [ -f /etc/yum.repos.d/redhat.repo ] && grep -q '^\[rhelai-3.0-for-rhel-9-s390x-rpms\]' /etc/yum.repos.d/redhat.repo; then
+        subscription-manager repos --enable=rhelai-3.0-for-rhel-9-s390x-rpms
+        PACKAGES="$PACKAGES zeromq-devel"
+    fi
 else
     PACKAGES="perl mesa-libGL skopeo"
 fi
@@ -406,9 +410,12 @@ RUN --mount=type=cache,target=/root/.cache/pip \
     # RHOAIENG-58277: Meson 1.11.0 breaks pandas 2.3.3 source builds
     echo "meson<1.11" > build_constraints.txt && \
     if [ "$TARGETARCH" = "ppc64le" ] || [ "$TARGETARCH" = "s390x" ]; then \
-        # We need special flags and environment variables when building packages
+        BUILD_CFLAGS="-O3" && \
+        if [ "$TARGETARCH" = "s390x" ] && ! pkg-config --exists libzmq 2>/dev/null; then \
+            BUILD_CFLAGS="-O3 -Dundefined=64"; \
+        fi && \
         GRPC_PYTHON_BUILD_SYSTEM_OPENSSL=1 \
-        CFLAGS="-O3" CXXFLAGS="-O3" \
+        CFLAGS="$BUILD_CFLAGS" CXXFLAGS="$BUILD_CFLAGS" \
         uv pip install --strict --no-deps --no-cache --no-config --no-progress \
             --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match \
             --build-constraint build_constraints.txt \
diff --git a/runtimes/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu b/runtimes/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu
index a1e8b6c181..dbaf17dd03 100644
--- a/runtimes/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu
+++ b/runtimes/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu
@@ -48,6 +48,11 @@ PACKAGES="perl mesa-libGL skopeo libxcrypt-compat"
 # Additional dev tools only for s390x
 if [ "$TARGETARCH" = "s390x" ]; then
     PACKAGES="$PACKAGES gcc gcc-c++ make openssl-devel autoconf automake libtool cmake python3-devel pybind11-devel openblas-devel unixODBC-devel openssl zlib-devel"
+    # RH-signed zeromq-devel is in rhelai-3.0 (AIPCC base redhat.repo), not UBI AppStream/EPEL.
+    if [ -f /etc/yum.repos.d/redhat.repo ] && grep -q '^\[rhelai-3.0-for-rhel-9-s390x-rpms\]' /etc/yum.repos.d/redhat.repo; then
+        subscription-manager repos --enable=rhelai-3.0-for-rhel-9-s390x-rpms
+        PACKAGES="$PACKAGES zeromq-devel"
+    fi
 fi
 if [ "$TARGETARCH" = "ppc64le" ]; then
     PACKAGES="$PACKAGES git gcc-toolset-13 make wget unzip rust cargo unixODBC-devel cmake ninja-build"
@@ -423,9 +428,15 @@ if [ "$TARGETARCH" = "ppc64le" ]; then
     export LD_LIBRARY_PATH=/usr/local/lib64:/usr/local/lib:/usr/lib64:/usr/lib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}
     uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --build-constraint build_constraints.txt --requirements=./pylock.toml
 elif [ "$TARGETARCH" = "s390x" ]; then
-    # For s390x, we need special flags and environment variables for building packages
+    # For s390x, we need special flags and environment variables for building packages.
+    # When zeromq-devel is unavailable (UBI-only GHA builds), pyzmq bundles libzmq and needs
+    # -Dundefined=64 under qemu-user; do not wipe that via a bare CFLAGS=-O3 override.
+    S390X_BUILD_CFLAGS="-O3"
+    if ! pkg-config --exists libzmq 2>/dev/null; then
+        S390X_BUILD_CFLAGS="-O3 -Dundefined=64"
+    fi
     GRPC_PYTHON_BUILD_SYSTEM_OPENSSL=1 \
-    CFLAGS="-O3" CXXFLAGS="-O3" \
+    CFLAGS="$S390X_BUILD_CFLAGS" CXXFLAGS="$S390X_BUILD_CFLAGS" \
     uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --build-constraint build_constraints.txt --requirements=./pylock.toml
 else
     # This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`,

From 213feeafdb4cc7e9864e76a1a8a40df3f22a467c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jiri=20Dan=C4=9Bk?= <jdanek@redhat.com>
Date: Tue, 4 Aug 2026 22:05:15 +0200
Subject: [PATCH 2/3] fix(s390x): enable rhelai-3.0 repo before installing
 zeromq-devel

Drop the pkg-config CFLAGS fallback; subscribed GHA/AIPCC builds always
have entitlements. Use subscription-manager refresh plus repos --enable
so dnf can see rhelai-3.0 before installing zeromq-devel.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .../ubi9-python-3.12/Dockerfile.konflux.cpu   | 13 ++++---------
 .../ubi9-python-3.12/Dockerfile.konflux.cpu   | 19 ++++++-------------
 2 files changed, 10 insertions(+), 22 deletions(-)

diff --git a/jupyter/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu b/jupyter/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu
index aa60e1727d..cf80e636c5 100644
--- a/jupyter/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu
+++ b/jupyter/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu
@@ -73,10 +73,9 @@ set -Eeuxo pipefail
 echo "Building for architecture: ${TARGETARCH}"
 if [ "$TARGETARCH" = "s390x" ]; then
     PACKAGES="perl mesa-libGL skopeo gcc gcc-c++ make openssl-devel autoconf automake libtool cmake python3-devel pybind11-devel openblas-devel unixODBC-devel"
-    if [ -f /etc/yum.repos.d/redhat.repo ] && grep -q '^\[rhelai-3.0-for-rhel-9-s390x-rpms\]' /etc/yum.repos.d/redhat.repo; then
-        subscription-manager repos --enable=rhelai-3.0-for-rhel-9-s390x-rpms
-        PACKAGES="$PACKAGES zeromq-devel"
-    fi
+    subscription-manager refresh
+    subscription-manager repos --enable=rhelai-3.0-for-rhel-9-s390x-rpms
+    PACKAGES="$PACKAGES zeromq-devel"
 else
     PACKAGES="perl mesa-libGL skopeo"
 fi
@@ -410,12 +409,8 @@ RUN --mount=type=cache,target=/root/.cache/pip \
     # RHOAIENG-58277: Meson 1.11.0 breaks pandas 2.3.3 source builds
     echo "meson<1.11" > build_constraints.txt && \
     if [ "$TARGETARCH" = "ppc64le" ] || [ "$TARGETARCH" = "s390x" ]; then \
-        BUILD_CFLAGS="-O3" && \
-        if [ "$TARGETARCH" = "s390x" ] && ! pkg-config --exists libzmq 2>/dev/null; then \
-            BUILD_CFLAGS="-O3 -Dundefined=64"; \
-        fi && \
         GRPC_PYTHON_BUILD_SYSTEM_OPENSSL=1 \
-        CFLAGS="$BUILD_CFLAGS" CXXFLAGS="$BUILD_CFLAGS" \
+        CFLAGS="-O3" CXXFLAGS="-O3" \
         uv pip install --strict --no-deps --no-cache --no-config --no-progress \
             --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match \
             --build-constraint build_constraints.txt \
diff --git a/runtimes/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu b/runtimes/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu
index dbaf17dd03..041fad17bf 100644
--- a/runtimes/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu
+++ b/runtimes/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu
@@ -48,11 +48,10 @@ PACKAGES="perl mesa-libGL skopeo libxcrypt-compat"
 # Additional dev tools only for s390x
 if [ "$TARGETARCH" = "s390x" ]; then
     PACKAGES="$PACKAGES gcc gcc-c++ make openssl-devel autoconf automake libtool cmake python3-devel pybind11-devel openblas-devel unixODBC-devel openssl zlib-devel"
-    # RH-signed zeromq-devel is in rhelai-3.0 (AIPCC base redhat.repo), not UBI AppStream/EPEL.
-    if [ -f /etc/yum.repos.d/redhat.repo ] && grep -q '^\[rhelai-3.0-for-rhel-9-s390x-rpms\]' /etc/yum.repos.d/redhat.repo; then
-        subscription-manager repos --enable=rhelai-3.0-for-rhel-9-s390x-rpms
-        PACKAGES="$PACKAGES zeromq-devel"
-    fi
+    # RH-signed zeromq-devel is in rhelai-3.0 (not UBI AppStream/EPEL). Export repos before dnf.
+    subscription-manager refresh
+    subscription-manager repos --enable=rhelai-3.0-for-rhel-9-s390x-rpms
+    PACKAGES="$PACKAGES zeromq-devel"
 fi
 if [ "$TARGETARCH" = "ppc64le" ]; then
     PACKAGES="$PACKAGES git gcc-toolset-13 make wget unzip rust cargo unixODBC-devel cmake ninja-build"
@@ -428,15 +427,9 @@ if [ "$TARGETARCH" = "ppc64le" ]; then
     export LD_LIBRARY_PATH=/usr/local/lib64:/usr/local/lib:/usr/lib64:/usr/lib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}
     uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --build-constraint build_constraints.txt --requirements=./pylock.toml
 elif [ "$TARGETARCH" = "s390x" ]; then
-    # For s390x, we need special flags and environment variables for building packages.
-    # When zeromq-devel is unavailable (UBI-only GHA builds), pyzmq bundles libzmq and needs
-    # -Dundefined=64 under qemu-user; do not wipe that via a bare CFLAGS=-O3 override.
-    S390X_BUILD_CFLAGS="-O3"
-    if ! pkg-config --exists libzmq 2>/dev/null; then
-        S390X_BUILD_CFLAGS="-O3 -Dundefined=64"
-    fi
+    # For s390x, we need special flags and environment variables for building packages
     GRPC_PYTHON_BUILD_SYSTEM_OPENSSL=1 \
-    CFLAGS="$S390X_BUILD_CFLAGS" CXXFLAGS="$S390X_BUILD_CFLAGS" \
+    CFLAGS="-O3" CXXFLAGS="-O3" \
     uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --build-constraint build_constraints.txt --requirements=./pylock.toml
 else
     # This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`,

From 72345ba3ce5109b6ba9e5c2c79cd0bc5d9d1277a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jiri=20Dan=C4=9Bk?= <jdanek@redhat.com>
Date: Tue, 4 Aug 2026 22:07:35 +0200
Subject: [PATCH 3/3] refactor(s390x): use bash arrays for PACKAGES in
 datascience Dockerfiles

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .../ubi9-python-3.12/Dockerfile.konflux.cpu        | 10 +++++-----
 .../ubi9-python-3.12/Dockerfile.konflux.cpu        | 14 +++++++-------
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/jupyter/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu b/jupyter/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu
index cf80e636c5..40544a868c 100644
--- a/jupyter/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu
+++ b/jupyter/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu
@@ -72,15 +72,15 @@ RUN --mount=type=cache,target=/var/cache/dnf /bin/bash <<'EOF'
 set -Eeuxo pipefail
 echo "Building for architecture: ${TARGETARCH}"
 if [ "$TARGETARCH" = "s390x" ]; then
-    PACKAGES="perl mesa-libGL skopeo gcc gcc-c++ make openssl-devel autoconf automake libtool cmake python3-devel pybind11-devel openblas-devel unixODBC-devel"
+    PACKAGES=(perl mesa-libGL skopeo gcc gcc-c++ make openssl-devel autoconf automake libtool cmake python3-devel pybind11-devel openblas-devel unixODBC-devel)
     subscription-manager refresh
     subscription-manager repos --enable=rhelai-3.0-for-rhel-9-s390x-rpms
-    PACKAGES="$PACKAGES zeromq-devel"
+    PACKAGES+=(zeromq-devel)
 else
-    PACKAGES="perl mesa-libGL skopeo"
+    PACKAGES=(perl mesa-libGL skopeo)
 fi
-echo "Installing: $PACKAGES"
-dnf install -y $PACKAGES
+echo "Installing: ${PACKAGES[*]}"
+dnf install -y "${PACKAGES[@]}"
 dnf clean all && rm -rf /var/cache/yum
 EOF
 
diff --git a/runtimes/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu b/runtimes/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu
index 041fad17bf..166f0f7402 100644
--- a/runtimes/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu
+++ b/runtimes/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu
@@ -44,21 +44,21 @@ EOF
 RUN --mount=type=cache,target=/var/cache/dnf /bin/bash <<'EOF'
 set -Eeuxo pipefail
 echo "Building for architecture: ${TARGETARCH}"
-PACKAGES="perl mesa-libGL skopeo libxcrypt-compat"
+PACKAGES=(perl mesa-libGL skopeo libxcrypt-compat)
 # Additional dev tools only for s390x
 if [ "$TARGETARCH" = "s390x" ]; then
-    PACKAGES="$PACKAGES gcc gcc-c++ make openssl-devel autoconf automake libtool cmake python3-devel pybind11-devel openblas-devel unixODBC-devel openssl zlib-devel"
+    PACKAGES+=(gcc gcc-c++ make openssl-devel autoconf automake libtool cmake python3-devel pybind11-devel openblas-devel unixODBC-devel openssl zlib-devel)
     # RH-signed zeromq-devel is in rhelai-3.0 (not UBI AppStream/EPEL). Export repos before dnf.
     subscription-manager refresh
     subscription-manager repos --enable=rhelai-3.0-for-rhel-9-s390x-rpms
-    PACKAGES="$PACKAGES zeromq-devel"
+    PACKAGES+=(zeromq-devel)
 fi
 if [ "$TARGETARCH" = "ppc64le" ]; then
-    PACKAGES="$PACKAGES git gcc-toolset-13 make wget unzip rust cargo unixODBC-devel cmake ninja-build"
+    PACKAGES+=(git gcc-toolset-13 make wget unzip rust cargo unixODBC-devel cmake ninja-build)
 fi
-if [ -n "$PACKAGES" ]; then
-    echo "Installing: $PACKAGES"
-    dnf install -y $PACKAGES
+if [ ${#PACKAGES[@]} -gt 0 ]; then
+    echo "Installing: ${PACKAGES[*]}"
+    dnf install -y "${PACKAGES[@]}"
     dnf clean all && rm -rf /var/cache/yum
 fi
 EOF