[rhoai-2.25] RHAIENG-6036: restore check-payload workbench FIPS waivers

[jiridanek]

Description

Restore the pre-#2513 check-payload excludes for workbench images so Build Notebooks / PR matrix stops failing FIPS on static binaries that 2.25 still ships.

What #2513 removed (incorrect for 2.25)

Main-oriented comments claimed py-spy is gone (exclude-dependencies) and pandoc is dynamic (pandoc-rhai). On rhoai-2.25:

• py-spy is still in datascience/pytorch/tensorflow/… pylock.toml → /opt/app-root/bin/py-spy fails ErrNotDynLinked
• GitHub pandoc still installed under /usr/local/pandoc/bin/pandoc (until #2550 RPM path)
• rstudio-server quarto tools (pandoc/typst/esbuild) still need the same rpm ignores

Restored

• [[rpm.rstudio-server.ignore]] blocks (pandoc, typst, esbuild)
• [[payload.python-311-container.ignore]] + [[ignore]] for /opt/app-root/bin/py-spy
• [[ignore]] for /usr/local/pandoc/bin/pandoc

Kept from #2513

• codeserver @anthropic-ai/sandbox-runtime seccomp dir ignores (covers #2500’s intent; that PR can close as superseded once this lands)
• AI Pipelines argoexec/launcher overrides
• valgrind, ripgrep

Independent of #2550 (PDF RPM) and #2534 (openblas).

How Has This Been Tested?

• https://github.com/red-hat-data-services/notebooks/actions/runs/29916258707

• Diff vs pre-Backport hermetic codeserver build to rhoai-2.25 #2513 config: restored workbench ignores match prior paths
• CI: Build Notebooks matrix — jupyter-minimal / datascience amd64 check-payload green (no pandoc / py-spy ErrNotDynLinked)
• codeserver still green with sandbox-runtime dir ignores

Self checklist:

• Ensure that you have run make test (gmake on macOS) before asking for review
• Changes to everything except Dockerfile.konflux files should be done in odh/notebooks and automatically synced to rhds/notebooks. For Konflux-specific changes, modify Dockerfile.konflux files directly in rhds/notebooks as these require special attention in the downstream repository and flow to the upcoming RHOAI release.

Merge criteria:

• The commits are squashed in a cohesive manner and have meaningful messages.
• Testing instructions have been added in the PR body (for PRs involving changes that are not immediately obvious).
• The developer has manually tested the changes and verified that the changes work

Made with Cursor

Summary by CodeRabbit

• Bug Fixes
  • Improved package validation for Quarto tools, including Pandoc, Typst, and esbuild.
  • Updated handling for Python tooling, including py-spy and Pandoc, reducing false validation failures during package checks.
  • Improved support for binaries with dynamic-linking, Go, CGO, cryptography, and symbol-related characteristics.

[coderabbitai]

📝 Walkthrough

Walkthrough

Changes

Payload check configuration

Layer / File(s)	Summary
Quarto binary waivers scripts/check-payload/config.toml	Adds temporary RStudio Server waivers for pandoc, typst, and esbuild payload-check errors.
Python binary waivers scripts/check-payload/config.toml	Adds Python 3.11 and local-scan ignores for py-spy and pandoc binaries.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: ysok

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly matches the main change: restoring check-payload FIPS waivers for workbench images.
Description check	✅ Passed	The description includes the required summary, testing section, checklist, and merge criteria, with relevant details filled in.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/rhoai-2.25-check-payload-waivers

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: ide-developer
Once this PR has been reviewed and has the lgtm label, please assign atheo89 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment