Ceph CVE Fixes - Removing "jaegertracing/opentelemetry-cpp" as it was not being built

[cyberbandya007]

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

• The toolchain has been rebuilt successfully (or no changes were made to it)
• The toolchain/worker package manifests are up-to-date
• Any updated packages successfully build (or no packages were changed)
• Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
• Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• All package sources are available
• cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
• LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
• All source files have up-to-date hashes in the *.signatures.json files
• sudo make go-tidy-all and sudo make go-test-coverage pass
• Documentation has been updated to match any changes to the build system
• Ready to merge

---

Summary

Removing the opentelemetry-cpp module from the ceph package as it is not being built.

Change Log

• CVE-2022-24735
• CVE-2022-24736
• CVE-2021-44647
• CVE-2020-24371
• CVE-2014-5461
• CVE-2021-43519
• CVE-2021-44964
• CVE-2024-31755

Does this affect the toolchain?

NO

Links to CVEs

• https://nvd.nist.gov/vuln/detail/CVE-2022-24735
• https://nvd.nist.gov/vuln/detail/CVE-2022-24736

Test Methodology

• Pipeline build id: Buddy Build 717542

[cyberbandya007]

As per the discussion with Jon, since we are not building this subsystem, removing them from the package before build time to confirm the CVE fixes.

The following log in the rpmbuild also confirms that this sybsystem was not getting built -

time="2025-01-10T23:49:18Z" level=debug msg="-- exclude following files under src: .js;.css;.tox;python-common/build;erasure-code/jerasure/jerasure;erasure-code/jerasure/gf-complete;rocksdb;googletest;spdk;xxHash;isa-l;zstd;crypto/isa-l/isa-l_crypto;blkin;dmclock;seastar;fmt;c-ares;spawn;pybind/mgr/rook/rook-client-python;s3select;libkmip;arrow;utf8proc;jaegertracing/opentelemetry-cpp"

[jslobodzian]

What CVE's is this fixing? Best Practice is to state this in the PR Commit title and explain the implementation details in the commit details section.

[jslobodzian]

and then close out the PR's that are not needed so it's clear on our end which ones to take.