The source container compliance team is requesting us to fix the rhpam-rhel8-operator image.

From an email discussion with Beatriz Couto, the solution is to stop using the lookaside cache - which creates the "sources" file in the dist-git repository.

When building the RHPAM operator image, we are adding the kie-cloud-operator.tar.gz (which is released on kie-cloud-operator GitHub) . I think one possible solution is to stop using the kie-cloud-operator.tar.gz and use the Cachito mechanism, something similar to what is done today for the Kogito Operator (see [1]).
 

[1] https://github.com/kiegroup/kogito-operator/blob/1.13.x/rhpam-image-prod.yaml#L16-L28