The source container compliance team is requesting us to fix the rhpam-kogito-builder-rhel8 image.

From an email discussion with bcouto@redhat.com, the solution is to remove the "sources" file as part of the dist-git repository.

The sources file is created during the cekit build and from what I understand the problem is that the 3 artifacts listed on that file come from:

•  graalvm-ce-java11-linux-amd64 and native-image-installable-svm-java11-linux-amd64: https://github.com/kiegroup/kogito-images/blob/1.13.x/modules/kogito-graalvm-installer/21.x-java-11/module.yaml#L16-L22
• apache-maven https://github.com/kiegroup/kogito-images/blob/1.13.x/modules/kogito-maven/3.8.x/module.yaml#L69-L72
   

My guess is to fix that issue, those 3 artifacts should have to be installed in the kogito-builder images using standard rpm way.