split: replace internal packages with images library

Remove all the internal package that are now in the
github.com/osbuild/images package and vendor it.

A new function in internal/blueprint/ converts from an osbuild-composer
blueprint to an images blueprint.  This is necessary for keeping the
blueprint implementation in both packages.  In the future, the images
package will change the blueprint (and most likely rename it) and it
will only be part of the osbuild-composer internals and interface.  The
Convert() function will be responsible for converting the blueprint into
the new configuration object.

vendor/github.com/osbuild/images/pkg/distro/distro.go

@@ -0,0 +1,161 @@
+package distro
+
+import (
+	"github.com/osbuild/images/pkg/blueprint"
+	"github.com/osbuild/images/pkg/disk"
+	"github.com/osbuild/images/pkg/manifest"
+	"github.com/osbuild/images/pkg/ostree"
+	"github.com/osbuild/images/pkg/rhsm/facts"
+	"github.com/osbuild/images/pkg/rpmmd"
+	"github.com/osbuild/images/pkg/subscription"
+)
+
+type BootMode uint64
+
+const (
+	BOOT_NONE BootMode = iota
+	BOOT_LEGACY
+	BOOT_UEFI
+	BOOT_HYBRID
+)
+
+func (m BootMode) String() string {
+	switch m {
+	case BOOT_NONE:
+		return "none"
+	case BOOT_LEGACY:
+		return "legacy"
+	case BOOT_UEFI:
+		return "uefi"
+	case BOOT_HYBRID:
+		return "hybrid"
+	default:
+		panic("invalid boot mode")
+	}
+}
+
+// A Distro represents composer's notion of what a given distribution is.
+type Distro interface {
+	// Returns the name of the distro.
+	Name() string
+
+	// Returns the release version of the distro. This is used in repo
+	// files on the host system and required for the subscription support.
+	Releasever() string
+
+	// Returns the module platform id of the distro. This is used by DNF
+	// for modularity support.
+	ModulePlatformID() string
+
+	// Returns the ostree reference template
+	OSTreeRef() string
+
+	// Returns a sorted list of the names of the architectures this distro
+	// supports.
+	ListArches() []string
+
+	// Returns an object representing the given architecture as support
+	// by this distro.
+	GetArch(arch string) (Arch, error)
+}
+
+// An Arch represents a given distribution's support for a given architecture.
+type Arch interface {
+	// Returns the name of the architecture.
+	Name() string
+
+	// Returns a sorted list of the names of the image types this architecture
+	// supports.
+	ListImageTypes() []string
+
+	// Returns an object representing a given image format for this architecture,
+	// on this distro.
+	GetImageType(imageType string) (ImageType, error)
+
+	// Returns the parent distro
+	Distro() Distro
+}
+
+// An ImageType represents a given distribution's support for a given Image Type
+// for a given architecture.
+type ImageType interface {
+	// Returns the name of the image type.
+	Name() string
+
+	// Returns the parent architecture
+	Arch() Arch
+
+	// Returns the canonical filename for the image type.
+	Filename() string
+
+	// Retrns the MIME-type for the image type.
+	MIMEType() string
+
+	// Returns the default OSTree ref for the image type.
+	OSTreeRef() string
+
+	// Returns the proper image size for a given output format. If the input size
+	// is 0 the default value for the format will be returned.
+	Size(size uint64) uint64
+
+	// Returns the corresponding partion type ("gpt", "dos") or "" the image type
+	// has no partition table. Only support for RHEL 8.5+
+	PartitionType() string
+
+	// Returns the corresponding boot mode ("legacy", "uefi", "hybrid") or "none"
+	BootMode() BootMode
+
+	// Returns the names of the pipelines that set up the build environment (buildroot).
+	BuildPipelines() []string
+
+	// Returns the names of the pipelines that create the image.
+	PayloadPipelines() []string
+
+	// Returns the package set names safe to install custom packages via custom repositories.
+	PayloadPackageSets() []string
+
+	// Returns named arrays of package set names which should be depsolved in a chain.
+	PackageSetsChains() map[string][]string
+
+	// Returns the names of the stages that will produce the build output.
+	Exports() []string
+
+	// Returns an osbuild manifest, containing the sources and pipeline necessary
+	// to build an image, given output format with all packages and customizations
+	// specified in the given blueprint; it also returns any warnings (e.g.
+	// deprecation notices) generated by the manifest.
+	// The packageSpecSets must be labelled in the same way as the originating PackageSets.
+	Manifest(bp *blueprint.Blueprint, options ImageOptions, repos []rpmmd.RepoConfig, seed int64) (*manifest.Manifest, []string, error)
+}
+
+// The ImageOptions specify options for a specific image build
+type ImageOptions struct {
+	Size         uint64
+	OSTree       *ostree.ImageOptions
+	Subscription *subscription.ImageOptions
+	Facts        *facts.ImageOptions
+}
+
+type BasePartitionTableMap map[string]disk.PartitionTable
+
+// Fallbacks: When a new method is added to an interface to provide to provide
+// information that isn't available for older implementations, the older
+// methods should return a fallback/default value by calling the appropriate
+// function from below.
+// Example: Exports() simply returns "assembler" for older image type
+// implementations that didn't produce v1 manifests that have named pipelines.
+func BuildPipelinesFallback() []string {
+	return []string{"build"}
+}
+
+func PayloadPipelinesFallback() []string {
+	return []string{"os", "assembler"}
+}
+
+func ExportsFallback() []string {
+	return []string{"assembler"}
+}
+
+func PayloadPackageSets() []string {
+	return []string{}
+}

vendor/github.com/osbuild/images/pkg/distro/distro_test_common/distro_test_common.go

@@ -0,0 +1,623 @@
+package distro_test_common
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/osbuild/images/internal/common"
+	"github.com/osbuild/images/internal/dnfjson"
+	"github.com/osbuild/images/pkg/blueprint"
+	"github.com/osbuild/images/pkg/container"
+	"github.com/osbuild/images/pkg/distro"
+	"github.com/osbuild/images/pkg/distroregistry"
+	"github.com/osbuild/images/pkg/manifest"
+	"github.com/osbuild/images/pkg/ostree"
+	"github.com/osbuild/images/pkg/rhsm/facts"
+	"github.com/osbuild/images/pkg/rpmmd"
+)
+
+const RandomTestSeed = 0
+
+func TestDistro_Manifest(t *testing.T, pipelinePath string, prefix string, registry *distroregistry.Registry, depsolvePkgSets bool, dnfCacheDir, dnfJsonPath string) {
+	assert := assert.New(t)
+	fileNames, err := filepath.Glob(filepath.Join(pipelinePath, prefix))
+	assert.NoErrorf(err, "Could not read pipelines directory '%s': %v", pipelinePath, err)
+	require.Greaterf(t, len(fileNames), 0, "No pipelines found in %s for %s", pipelinePath, prefix)
+	for _, fileName := range fileNames {
+		type repository struct {
+			BaseURL     string   `json:"baseurl,omitempty"`
+			Metalink    string   `json:"metalink,omitempty"`
+			MirrorList  string   `json:"mirrorlist,omitempty"`
+			GPGKey      string   `json:"gpgkey,omitempty"`
+			CheckGPG    bool     `json:"check_gpg,omitempty"`
+			PackageSets []string `json:"package-sets,omitempty"`
+		}
+		type ostreeOptions struct {
+			Ref    string `json:"ref"`
+			URL    string `json:"url"`
+			Parent string `json:"parent"`
+			RHSM   bool   `json:"rhsm"`
+		}
+		type composeRequest struct {
+			Distro       string               `json:"distro"`
+			Arch         string               `json:"arch"`
+			ImageType    string               `json:"image-type"`
+			Repositories []repository         `json:"repositories"`
+			Blueprint    *blueprint.Blueprint `json:"blueprint"`
+			OSTree       ostreeOptions        `json:"ostree"`
+		}
+		var tt struct {
+			ComposeRequest  *composeRequest                `json:"compose-request"`
+			PackageSpecSets map[string][]rpmmd.PackageSpec `json:"rpmmd"`
+			Manifest        manifest.OSBuildManifest       `json:"manifest,omitempty"`
+			Containers      map[string][]container.Spec    `json:"containers,omitempty"`
+			OSTreeCommits   map[string][]ostree.CommitSpec `json:"ostree-commits,omitempty"`
+		}
+		file, err := os.ReadFile(fileName)
+		assert.NoErrorf(err, "Could not read test-case '%s': %v", fileName, err)
+		err = json.Unmarshal([]byte(file), &tt)
+		assert.NoErrorf(err, "Could not parse test-case '%s': %v", fileName, err)
+		if tt.ComposeRequest == nil || tt.ComposeRequest.Blueprint == nil {
+			t.Logf("Skipping '%s'.", fileName)
+			continue
+		}
+
+		repos := make([]rpmmd.RepoConfig, len(tt.ComposeRequest.Repositories))
+		for i, repo := range tt.ComposeRequest.Repositories {
+			var urls []string
+			if repo.BaseURL != "" {
+				urls = []string{repo.BaseURL}
+			}
+			var keys []string
+			if repo.GPGKey != "" {
+				keys = []string{repo.GPGKey}
+			}
+			repos[i] = rpmmd.RepoConfig{
+				Name:        fmt.Sprintf("repo-%d", i),
+				BaseURLs:    urls,
+				Metalink:    repo.Metalink,
+				MirrorList:  repo.MirrorList,
+				GPGKeys:     keys,
+				CheckGPG:    common.ToPtr(repo.CheckGPG),
+				PackageSets: repo.PackageSets,
+			}
+		}
+		t.Run(path.Base(fileName), func(t *testing.T) {
+			require.NoError(t, err)
+			d := registry.GetDistro(tt.ComposeRequest.Distro)
+			if d == nil {
+				t.Errorf("unknown distro: %v", tt.ComposeRequest.Distro)
+				return
+			}
+			arch, err := d.GetArch(tt.ComposeRequest.Arch)
+			if err != nil {
+				t.Errorf("unknown arch: %v", tt.ComposeRequest.Arch)
+				return
+			}
+			imageType, err := arch.GetImageType(tt.ComposeRequest.ImageType)
+			if err != nil {
+				t.Errorf("unknown image type: %v", tt.ComposeRequest.ImageType)
+				return
+			}
+
+			ostreeOptions := &ostree.ImageOptions{
+				ImageRef:  tt.ComposeRequest.OSTree.Ref,
+				ParentRef: tt.ComposeRequest.OSTree.Parent,
+				URL:       tt.ComposeRequest.OSTree.URL,
+				RHSM:      tt.ComposeRequest.OSTree.RHSM,
+			}
+
+			options := distro.ImageOptions{
+				Size:   imageType.Size(0),
+				OSTree: ostreeOptions,
+				Facts: &facts.ImageOptions{
+					APIType: facts.TEST_APITYPE,
+				},
+			}
+
+			var imgPackageSpecSets map[string][]rpmmd.PackageSpec
+			// depsolve the image's package set to catch changes in the image's default package set.
+			// downside is that this takes long time
+			if depsolvePkgSets {
+				require.NotEmptyf(t, dnfCacheDir, "DNF cache directory path must be provided when chosen to depsolve image package sets")
+				require.NotEmptyf(t, dnfJsonPath, "path to 'dnf-json' must be provided when chosen to depsolve image package sets")
+				imgPackageSpecSets = getImageTypePkgSpecSets(
+					imageType,
+					*tt.ComposeRequest.Blueprint,
+					options,
+					repos,
+					dnfCacheDir,
+					dnfJsonPath,
+				)
+			} else {
+				imgPackageSpecSets = tt.PackageSpecSets
+			}
+
+			manifest, _, err := imageType.Manifest(tt.ComposeRequest.Blueprint, options, repos, RandomTestSeed)
+			if err != nil {
+				t.Errorf("distro.Manifest() error = %v", err)
+				return
+			}
+
+			got, err := manifest.Serialize(imgPackageSpecSets, tt.Containers, tt.OSTreeCommits)
+
+			if (err == nil && tt.Manifest == nil) || (err != nil && tt.Manifest != nil) {
+				t.Errorf("distro.Manifest() error = %v", err)
+				return
+			}
+			if tt.Manifest != nil {
+				var expected, actual interface{}
+				err = json.Unmarshal(tt.Manifest, &expected)
+				require.NoError(t, err)
+				err = json.Unmarshal(got, &actual)
+				require.NoError(t, err)
+
+				diff := cmp.Diff(expected, actual)
+				require.Emptyf(t, diff, "Distro: %s\nArch: %s\nImage type: %s\nTest case file: %s\n", d.Name(), arch.Name(), imageType.Name(), fileName)
+			}
+		})
+	}
+}
+
+func getImageTypePkgSpecSets(imageType distro.ImageType, bp blueprint.Blueprint, options distro.ImageOptions, repos []rpmmd.RepoConfig, cacheDir, dnfJsonPath string) map[string][]rpmmd.PackageSpec {
+	manifest, _, err := imageType.Manifest(&bp, options, repos, 0)
+	if err != nil {
+		panic("Could not generate manifest for package sets: " + err.Error())
+	}
+	imgPackageSets := manifest.GetPackageSetChains()
+
+	solver := dnfjson.NewSolver(imageType.Arch().Distro().ModulePlatformID(),
+		imageType.Arch().Distro().Releasever(),
+		imageType.Arch().Name(),
+		imageType.Arch().Distro().Name(),
+		cacheDir)
+	solver.SetDNFJSONPath(dnfJsonPath)
+	depsolvedSets := make(map[string][]rpmmd.PackageSpec)
+	for name, packages := range imgPackageSets {
+		res, err := solver.Depsolve(packages)
+		if err != nil {
+			panic("Could not depsolve: " + err.Error())
+		}
+		depsolvedSets[name] = res
+	}
+
+	return depsolvedSets
+}
+
+func isOSTree(imgType distro.ImageType) bool {
+	return imgType.OSTreeRef() != ""
+}
+
+var knownKernels = []string{"kernel", "kernel-debug", "kernel-rt"}
+
+// Returns the number of known kernels in the package list
+func kernelCount(imgType distro.ImageType, bp blueprint.Blueprint) int {
+	ostreeOptions := &ostree.ImageOptions{
+		URL: "https://example.com", // required by some image types
+	}
+	manifest, _, err := imgType.Manifest(&bp, distro.ImageOptions{OSTree: ostreeOptions}, nil, 0)
+	if err != nil {
+		panic(err)
+	}
+	sets := manifest.GetPackageSetChains()
+
+	// Use a map to count unique kernels in a package set. If the same kernel
+	// name appears twice, it will only be installed once, so we only count it
+	// once.
+	kernels := make(map[string]bool)
+	for _, name := range []string{
+		// payload package set names
+		"os", "ostree-tree", "anaconda-tree",
+		"packages", "installer",
+	} {
+		for _, pset := range sets[name] {
+			for _, pkg := range pset.Include {
+				for _, kernel := range knownKernels {
+					if kernel == pkg {
+						kernels[kernel] = true
+					}
+				}
+			}
+			if len(kernels) > 0 {
+				// BUG: some RHEL image types contain both 'packages'
+				// and 'installer' even though only 'installer' is used
+				// this counts the kernel package twice. None of these
+				// sets should appear more than once, so return the count
+				// for the first package set that has at least one kernel.
+				return len(kernels)
+			}
+		}
+	}
+	return len(kernels)
+}
+
+func TestDistro_KernelOption(t *testing.T, d distro.Distro) {
+	skipList := map[string]bool{
+		// Ostree installers and raw images download a payload to embed or
+		// deploy.  The kernel is part of the payload so it doesn't appear in
+		// the image type's package lists.
+		"iot-installer":             true,
+		"edge-installer":            true,
+		"edge-simplified-installer": true,
+		"iot-raw-image":             true,
+		"edge-raw-image":            true,
+		"edge-ami":                  true,
+
+		// the tar image type is a minimal image type which is not expected to
+		// be usable without a blueprint (see commit 83a63aaf172f556f6176e6099ffaa2b5357b58f5).
+		"tar": true,
+
+		// containers don't have kernels
+		"container": true,
+
+		// image installer on Fedora doesn't support kernel customizations
+		// on RHEL we support kernel name
+		// TODO: Remove when we unify the allowed options
+		"image-installer": true,
+		"live-installer":  true,
+	}
+
+	{ // empty blueprint: all image types should just have the default kernel
+		for _, archName := range d.ListArches() {
+			arch, err := d.GetArch(archName)
+			assert.NoError(t, err)
+			for _, typeName := range arch.ListImageTypes() {
+				if skipList[typeName] {
+					continue
+				}
+				imgType, err := arch.GetImageType(typeName)
+				assert.NoError(t, err)
+				nk := kernelCount(imgType, blueprint.Blueprint{})
+
+				if nk != 1 {
+					assert.Fail(t, fmt.Sprintf("%s Kernel count", d.Name()),
+						"Image type %s (arch %s) specifies %d Kernel packages", typeName, archName, nk)
+				}
+			}
+		}
+	}
+
+	{ // kernel in blueprint: the specified kernel replaces the default
+		for _, kernelName := range []string{"kernel", "kernel-debug"} {
+			bp := blueprint.Blueprint{
+				Customizations: &blueprint.Customizations{
+					Kernel: &blueprint.KernelCustomization{
+						Name: kernelName,
+					},
+				},
+			}
+			for _, archName := range d.ListArches() {
+				arch, err := d.GetArch(archName)
+				assert.NoError(t, err)
+				for _, typeName := range arch.ListImageTypes() {
+					if typeName != "image-installer" {
+						continue
+					}
+					if typeName != "live-installer" {
+						continue
+					}
+					if skipList[typeName] {
+						continue
+					}
+					imgType, err := arch.GetImageType(typeName)
+					assert.NoError(t, err)
+					nk := kernelCount(imgType, bp)
+
+					// ostree image types should have only one kernel
+					// other image types should have at least 1
+					if nk < 1 || (nk != 1 && isOSTree(imgType)) {
+						assert.Fail(t, fmt.Sprintf("%s Kernel count", d.Name()),
+							"Image type %s (arch %s) specifies %d Kernel packages", typeName, archName, nk)
+					}
+				}
+			}
+		}
+	}
+}
+
+func TestDistro_OSTreeOptions(t *testing.T, d distro.Distro) {
+	// test that ostree parameters are properly resolved by image functions that should support them
+	typesWithParent := map[string]bool{ // image types that support specifying a parent commit
+		"edge-commit":    true,
+		"edge-container": true,
+		"iot-commit":     true,
+		"iot-container":  true,
+	}
+
+	typesWithPayload := map[string]bool{
+		"edge-ami":                  true,
+		"edge-installer":            true,
+		"edge-raw-image":            true,
+		"edge-simplified-installer": true,
+		"iot-ami":                   true,
+		"iot-installer":             true,
+		"iot-raw-image":             true,
+		"iot-simplified-installer":  true,
+	}
+
+	assert := assert.New(t)
+
+	{ // empty options: payload ref should equal default
+		for _, archName := range d.ListArches() {
+			arch, err := d.GetArch(archName)
+			assert.NoError(err)
+			for _, typeName := range arch.ListImageTypes() {
+				bp := &blueprint.Blueprint{}
+				if strings.HasSuffix(typeName, "simplified-installer") {
+					// simplified installers require installation device
+					bp = &blueprint.Blueprint{
+						Customizations: &blueprint.Customizations{
+							InstallationDevice: "/dev/sda42",
+						},
+					}
+				}
+				imgType, err := arch.GetImageType(typeName)
+				assert.NoError(err)
+
+				ostreeOptions := ostree.ImageOptions{}
+				if typesWithPayload[typeName] {
+					// payload types require URL
+					ostreeOptions.URL = "https://example.com/repo"
+				}
+				options := distro.ImageOptions{OSTree: &ostreeOptions}
+
+				m, _, err := imgType.Manifest(bp, options, nil, 0)
+				assert.NoError(err)
+
+				nrefs := 0
+				// If a manifest returns an ostree source spec, the ref should
+				// match the default.
+				for _, commits := range m.GetOSTreeSourceSpecs() {
+					for _, commit := range commits {
+						assert.Equal(options.OSTree.URL, commit.URL, "url does not match expected for image type %q\n", typeName)
+						assert.Equal(imgType.OSTreeRef(), commit.Ref, "ref does not match expected for image type %q\n", typeName)
+						nrefs++
+					}
+				}
+				nexpected := 0
+				if typesWithPayload[typeName] {
+					// image types with payload should return a ref
+					nexpected = 1
+				}
+				assert.Equal(nexpected, nrefs, "incorrect ref count for image type %q\n", typeName)
+			}
+		}
+	}
+
+	{ // ImageRef set: should be returned as payload ref - no parent for commits and containers
+		for _, archName := range d.ListArches() {
+			arch, err := d.GetArch(archName)
+			assert.NoError(err)
+			for _, typeName := range arch.ListImageTypes() {
+				bp := &blueprint.Blueprint{}
+				if strings.HasSuffix(typeName, "simplified-installer") {
+					// simplified installers require installation device
+					bp = &blueprint.Blueprint{
+						Customizations: &blueprint.Customizations{
+							InstallationDevice: "/dev/sda42",
+						},
+					}
+				}
+
+				imgType, err := arch.GetImageType(typeName)
+				assert.NoError(err)
+
+				ostreeOptions := ostree.ImageOptions{
+					ImageRef: "test/x86_64/01",
+				}
+				if typesWithPayload[typeName] {
+					// payload types require URL
+					ostreeOptions.URL = "https://example.com/repo"
+				}
+				options := distro.ImageOptions{OSTree: &ostreeOptions}
+				m, _, err := imgType.Manifest(bp, options, nil, 0)
+				assert.NoError(err)
+
+				nrefs := 0
+				// if a manifest returns an ostree source spec, the ref should
+				// match the default
+				for _, commits := range m.GetOSTreeSourceSpecs() {
+					for _, commit := range commits {
+						assert.Equal(options.OSTree.URL, commit.URL, "url does not match expected for image type %q\n", typeName)
+						assert.Equal(options.OSTree.ImageRef, commit.Ref, "ref does not match expected for image type %q\n", typeName)
+						nrefs++
+					}
+				}
+				nexpected := 0
+				if typesWithPayload[typeName] {
+					// image types with payload should return a ref
+					nexpected = 1
+				}
+				assert.Equal(nexpected, nrefs, "incorrect ref count for image type %q\n", typeName)
+			}
+		}
+	}
+
+	{ // URL always specified: should add a parent to image types that support it and the ref should match the option
+		for _, archName := range d.ListArches() {
+			arch, err := d.GetArch(archName)
+			assert.NoError(err)
+			for _, typeName := range arch.ListImageTypes() {
+				bp := &blueprint.Blueprint{}
+				if strings.HasSuffix(typeName, "simplified-installer") {
+					// simplified installers require installation device
+					bp = &blueprint.Blueprint{
+						Customizations: &blueprint.Customizations{
+							InstallationDevice: "/dev/sda42",
+						},
+					}
+				}
+
+				imgType, err := arch.GetImageType(typeName)
+				assert.NoError(err)
+
+				ostreeOptions := ostree.ImageOptions{
+					ImageRef: "test/x86_64/01",
+					URL:      "https://example.com/repo",
+				}
+				options := distro.ImageOptions{OSTree: &ostreeOptions}
+				m, _, err := imgType.Manifest(bp, options, nil, 0)
+				assert.NoError(err)
+
+				nrefs := 0
+				for _, commits := range m.GetOSTreeSourceSpecs() {
+					for _, commit := range commits {
+						assert.Equal(options.OSTree.URL, commit.URL, "url does not match expected for image type %q\n", typeName)
+						assert.Equal(options.OSTree.ImageRef, commit.Ref, "ref does not match expected for image type %q\n", typeName)
+						nrefs++
+					}
+				}
+				nexpected := 0
+				if typesWithPayload[typeName] || typesWithParent[typeName] {
+					// image types with payload or parent should return a ref
+					nexpected = 1
+				}
+				assert.Equal(nexpected, nrefs, "incorrect ref count for image type %q\n", typeName)
+			}
+		}
+	}
+
+	{ // URL and parent ref always specified: payload ref should be default - parent ref should match option
+		for _, archName := range d.ListArches() {
+			arch, err := d.GetArch(archName)
+			assert.NoError(err)
+			for _, typeName := range arch.ListImageTypes() {
+				bp := &blueprint.Blueprint{}
+				if strings.HasSuffix(typeName, "simplified-installer") {
+					// simplified installers require installation device
+					bp = &blueprint.Blueprint{
+						Customizations: &blueprint.Customizations{
+							InstallationDevice: "/dev/sda42",
+						},
+					}
+				}
+
+				imgType, err := arch.GetImageType(typeName)
+				assert.NoError(err)
+
+				ostreeOptions := ostree.ImageOptions{
+					ParentRef: "test/x86_64/01",
+					URL:       "https://example.com/repo",
+				}
+				options := distro.ImageOptions{OSTree: &ostreeOptions}
+				m, _, err := imgType.Manifest(bp, options, nil, 0)
+				assert.NoError(err)
+
+				nrefs := 0
+				for _, commits := range m.GetOSTreeSourceSpecs() {
+					for _, commit := range commits {
+						assert.Equal(options.OSTree.URL, commit.URL, "url does not match expected for image type %q\n", typeName)
+						if typesWithPayload[typeName] {
+							// payload ref should fall back to default
+							assert.Equal(imgType.OSTreeRef(), commit.Ref, "ref does not match expected for image type %q\n", typeName)
+						} else if typesWithParent[typeName] {
+							// parent ref should match option
+							assert.Equal(options.OSTree.ParentRef, commit.Ref, "ref does not match expected for image type %q\n", typeName)
+						} else {
+							// image type requires ostree commit but isn't specified: this shouldn't happen
+							panic(fmt.Sprintf("image type %q requires ostree commit but is not covered by test", typeName))
+						}
+						nrefs++
+					}
+				}
+				nexpected := 0
+				if typesWithPayload[typeName] || typesWithParent[typeName] {
+					// image types with payload or parent should return a ref
+					nexpected = 1
+				}
+				assert.Equal(nexpected, nrefs, "incorrect ref count for image type %q\n", typeName)
+			}
+		}
+	}
+
+	{ // All options set: all refs should match the corresponding option
+		for _, archName := range d.ListArches() {
+			arch, err := d.GetArch(archName)
+			assert.NoError(err)
+			for _, typeName := range arch.ListImageTypes() {
+				bp := &blueprint.Blueprint{}
+				if strings.HasSuffix(typeName, "simplified-installer") {
+					// simplified installers require installation device
+					bp = &blueprint.Blueprint{
+						Customizations: &blueprint.Customizations{
+							InstallationDevice: "/dev/sda42",
+						},
+					}
+				}
+
+				imgType, err := arch.GetImageType(typeName)
+				assert.NoError(err)
+
+				ostreeOptions := ostree.ImageOptions{
+					ImageRef:  "test/x86_64/01",
+					ParentRef: "test/x86_64/02",
+					URL:       "https://example.com/repo",
+				}
+				options := distro.ImageOptions{OSTree: &ostreeOptions}
+				m, _, err := imgType.Manifest(bp, options, nil, 0)
+				assert.NoError(err)
+
+				nrefs := 0
+				for _, commits := range m.GetOSTreeSourceSpecs() {
+					for _, commit := range commits {
+						assert.Equal(options.OSTree.URL, commit.URL, "url does not match expected for image type %q\n", typeName)
+						if typesWithPayload[typeName] {
+							// payload ref should match image ref
+							assert.Equal(options.OSTree.ImageRef, commit.Ref, "ref does not match expected for image type %q\n", typeName)
+						} else if typesWithParent[typeName] {
+							// parent ref should match option
+							assert.Equal(options.OSTree.ParentRef, commit.Ref, "ref does not match expected for image type %q\n", typeName)
+						} else {
+							// image type requires ostree commit but isn't specified: this shouldn't happen
+							panic(fmt.Sprintf("image type %q requires ostree commit but is not covered by test", typeName))
+						}
+						nrefs++
+					}
+				}
+				nexpected := 0
+				if typesWithPayload[typeName] || typesWithParent[typeName] {
+					// image types with payload or parent should return a ref
+					nexpected = 1
+				}
+				assert.Equal(nexpected, nrefs, "incorrect ref count for image type %q\n", typeName)
+			}
+		}
+	}
+
+	{ // Parent set without URL: always causes error
+		for _, archName := range d.ListArches() {
+			arch, err := d.GetArch(archName)
+			assert.NoError(err)
+			for _, typeName := range arch.ListImageTypes() {
+				bp := &blueprint.Blueprint{}
+				if strings.HasSuffix(typeName, "simplified-installer") {
+					// simplified installers require installation device
+					bp = &blueprint.Blueprint{
+						Customizations: &blueprint.Customizations{
+							InstallationDevice: "/dev/sda42",
+						},
+					}
+				}
+
+				imgType, err := arch.GetImageType(typeName)
+				assert.NoError(err)
+
+				ostreeOptions := ostree.ImageOptions{
+					ParentRef: "test/x86_64/02",
+				}
+				options := distro.ImageOptions{OSTree: &ostreeOptions}
+				_, _, err = imgType.Manifest(bp, options, nil, 0)
+				assert.Error(err)
+			}
+		}
+	}
+}

vendor/github.com/osbuild/images/pkg/distro/fedora/distro.go

@@ -0,0 +1,722 @@
+package fedora
+
+import (
+	"errors"
+	"fmt"
+	"sort"
+	"strconv"
+
+	"github.com/osbuild/images/internal/common"
+	"github.com/osbuild/images/internal/environment"
+	"github.com/osbuild/images/internal/oscap"
+	"github.com/osbuild/images/pkg/distro"
+	"github.com/osbuild/images/pkg/platform"
+	"github.com/osbuild/images/pkg/rpmmd"
+	"github.com/osbuild/images/pkg/runner"
+)
+
+const (
+	// package set names
+
+	// main/common os image package set name
+	osPkgsKey = "os"
+
+	// container package set name
+	containerPkgsKey = "container"
+
+	// installer package set name
+	installerPkgsKey = "installer"
+
+	// blueprint package set name
+	blueprintPkgsKey = "blueprint"
+
+	//Kernel options for ami, qcow2, openstack, vhd and vmdk types
+	defaultKernelOptions = "ro no_timer_check console=ttyS0,115200n8 biosdevname=0 net.ifnames=0"
+)
+
+var (
+	oscapProfileAllowList = []oscap.Profile{
+		oscap.Ospp,
+		oscap.PciDss,
+		oscap.Standard,
+	}
+
+	// Services
+	iotServices = []string{
+		"NetworkManager.service",
+		"firewalld.service",
+		"rngd.service",
+		"sshd.service",
+		"zezere_ignition.timer",
+		"zezere_ignition_banner.service",
+		"greenboot-grub2-set-counter",
+		"greenboot-grub2-set-success",
+		"greenboot-healthcheck",
+		"greenboot-rpm-ostree-grub2-check-fallback",
+		"greenboot-status",
+		"greenboot-task-runner",
+		"redboot-auto-reboot",
+		"redboot-task-runner",
+		"parsec",
+		"dbus-parsec",
+	}
+
+	// Image Definitions
+	imageInstallerImgType = imageType{
+		name:        "image-installer",
+		nameAliases: []string{"fedora-image-installer"},
+		filename:    "installer.iso",
+		mimeType:    "application/x-iso9660-image",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey:        minimalrpmPackageSet,
+			installerPkgsKey: imageInstallerPackageSet,
+		},
+		bootable:         true,
+		bootISO:          true,
+		rpmOstree:        false,
+		image:            imageInstallerImage,
+		buildPipelines:   []string{"build"},
+		payloadPipelines: []string{"anaconda-tree", "rootfs-image", "efiboot-tree", "os", "bootiso-tree", "bootiso"},
+		exports:          []string{"bootiso"},
+	}
+
+	liveInstallerImgType = imageType{
+		name:        "live-installer",
+		nameAliases: []string{},
+		filename:    "live-installer.iso",
+		mimeType:    "application/x-iso9660-image",
+		packageSets: map[string]packageSetFunc{
+			installerPkgsKey: liveInstallerPackageSet,
+		},
+		bootable:         true,
+		bootISO:          true,
+		rpmOstree:        false,
+		image:            liveInstallerImage,
+		buildPipelines:   []string{"build"},
+		payloadPipelines: []string{"anaconda-tree", "rootfs-image", "efiboot-tree", "bootiso-tree", "bootiso"},
+		exports:          []string{"bootiso"},
+	}
+
+	iotCommitImgType = imageType{
+		name:        "iot-commit",
+		nameAliases: []string{"fedora-iot-commit"},
+		filename:    "commit.tar",
+		mimeType:    "application/x-tar",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey: iotCommitPackageSet,
+		},
+		defaultImageConfig: &distro.ImageConfig{
+			EnabledServices: iotServices,
+		},
+		rpmOstree:        true,
+		image:            iotCommitImage,
+		buildPipelines:   []string{"build"},
+		payloadPipelines: []string{"os", "ostree-commit", "commit-archive"},
+		exports:          []string{"commit-archive"},
+	}
+
+	iotOCIImgType = imageType{
+		name:        "iot-container",
+		nameAliases: []string{"fedora-iot-container"},
+		filename:    "container.tar",
+		mimeType:    "application/x-tar",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey: iotCommitPackageSet,
+			containerPkgsKey: func(t *imageType) rpmmd.PackageSet {
+				return rpmmd.PackageSet{}
+			},
+		},
+		defaultImageConfig: &distro.ImageConfig{
+			EnabledServices: iotServices,
+		},
+		rpmOstree:        true,
+		bootISO:          false,
+		image:            iotContainerImage,
+		buildPipelines:   []string{"build"},
+		payloadPipelines: []string{"os", "ostree-commit", "container-tree", "container"},
+		exports:          []string{"container"},
+	}
+
+	iotInstallerImgType = imageType{
+		name:        "iot-installer",
+		nameAliases: []string{"fedora-iot-installer"},
+		filename:    "installer.iso",
+		mimeType:    "application/x-iso9660-image",
+		packageSets: map[string]packageSetFunc{
+			installerPkgsKey: iotInstallerPackageSet,
+		},
+		defaultImageConfig: &distro.ImageConfig{
+			Locale:          common.ToPtr("en_US.UTF-8"),
+			EnabledServices: iotServices,
+		},
+		rpmOstree:        true,
+		bootISO:          true,
+		image:            iotInstallerImage,
+		buildPipelines:   []string{"build"},
+		payloadPipelines: []string{"anaconda-tree", "rootfs-image", "efiboot-tree", "bootiso-tree", "bootiso"},
+		exports:          []string{"bootiso"},
+	}
+
+	iotRawImgType = imageType{
+		name:        "iot-raw-image",
+		nameAliases: []string{"fedora-iot-raw-image"},
+		filename:    "image.raw.xz",
+		compression: "xz",
+		mimeType:    "application/xz",
+		packageSets: map[string]packageSetFunc{},
+		defaultImageConfig: &distro.ImageConfig{
+			Locale: common.ToPtr("en_US.UTF-8"),
+		},
+		defaultSize:         4 * common.GibiByte,
+		rpmOstree:           true,
+		bootable:            true,
+		image:               iotRawImage,
+		buildPipelines:      []string{"build"},
+		payloadPipelines:    []string{"ostree-deployment", "image", "xz"},
+		exports:             []string{"xz"},
+		basePartitionTables: iotBasePartitionTables,
+
+		// Passing an empty map into the required partition sizes disables the
+		// default partition sizes normally set so our `basePartitionTables` can
+		// override them (and make them smaller, in this case).
+		requiredPartitionSizes: map[string]uint64{},
+	}
+
+	qcow2ImgType = imageType{
+		name:     "qcow2",
+		filename: "disk.qcow2",
+		mimeType: "application/x-qemu-disk",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey: qcow2CommonPackageSet,
+		},
+		defaultImageConfig: &distro.ImageConfig{
+			DefaultTarget: common.ToPtr("multi-user.target"),
+			EnabledServices: []string{
+				"cloud-init.service",
+				"cloud-config.service",
+				"cloud-final.service",
+				"cloud-init-local.service",
+			},
+		},
+		kernelOptions:       defaultKernelOptions,
+		bootable:            true,
+		defaultSize:         5 * common.GibiByte,
+		image:               liveImage,
+		buildPipelines:      []string{"build"},
+		payloadPipelines:    []string{"os", "image", "qcow2"},
+		exports:             []string{"qcow2"},
+		basePartitionTables: defaultBasePartitionTables,
+	}
+
+	vhdImgType = imageType{
+		name:     "vhd",
+		filename: "disk.vhd",
+		mimeType: "application/x-vhd",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey: vhdCommonPackageSet,
+		},
+		defaultImageConfig: &distro.ImageConfig{
+			Locale: common.ToPtr("en_US.UTF-8"),
+			EnabledServices: []string{
+				"sshd",
+			},
+			DefaultTarget: common.ToPtr("multi-user.target"),
+			DisabledServices: []string{
+				"proc-sys-fs-binfmt_misc.mount",
+				"loadmodules.service",
+			},
+		},
+		kernelOptions:       defaultKernelOptions,
+		bootable:            true,
+		defaultSize:         2 * common.GibiByte,
+		image:               liveImage,
+		buildPipelines:      []string{"build"},
+		payloadPipelines:    []string{"os", "image", "vpc"},
+		exports:             []string{"vpc"},
+		basePartitionTables: defaultBasePartitionTables,
+		environment:         &environment.Azure{},
+	}
+
+	vmdkDefaultImageConfig = &distro.ImageConfig{
+		Locale: common.ToPtr("en_US.UTF-8"),
+		EnabledServices: []string{
+			"cloud-init.service",
+			"cloud-config.service",
+			"cloud-final.service",
+			"cloud-init-local.service",
+		},
+	}
+
+	vmdkImgType = imageType{
+		name:     "vmdk",
+		filename: "disk.vmdk",
+		mimeType: "application/x-vmdk",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey: vmdkCommonPackageSet,
+		},
+		defaultImageConfig:  vmdkDefaultImageConfig,
+		kernelOptions:       defaultKernelOptions,
+		bootable:            true,
+		defaultSize:         2 * common.GibiByte,
+		image:               liveImage,
+		buildPipelines:      []string{"build"},
+		payloadPipelines:    []string{"os", "image", "vmdk"},
+		exports:             []string{"vmdk"},
+		basePartitionTables: defaultBasePartitionTables,
+	}
+
+	ovaImgType = imageType{
+		name:     "ova",
+		filename: "image.ova",
+		mimeType: "application/ovf",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey: vmdkCommonPackageSet,
+		},
+		defaultImageConfig:  vmdkDefaultImageConfig,
+		kernelOptions:       defaultKernelOptions,
+		bootable:            true,
+		defaultSize:         2 * common.GibiByte,
+		image:               liveImage,
+		buildPipelines:      []string{"build"},
+		payloadPipelines:    []string{"os", "image", "vmdk", "ovf", "archive"},
+		exports:             []string{"archive"},
+		basePartitionTables: defaultBasePartitionTables,
+	}
+
+	containerImgType = imageType{
+		name:     "container",
+		filename: "container.tar",
+		mimeType: "application/x-tar",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey: containerPackageSet,
+		},
+		defaultImageConfig: &distro.ImageConfig{
+			NoSElinux:   common.ToPtr(true),
+			ExcludeDocs: common.ToPtr(true),
+			Locale:      common.ToPtr("C.UTF-8"),
+			Timezone:    common.ToPtr("Etc/UTC"),
+		},
+		image:            containerImage,
+		bootable:         false,
+		buildPipelines:   []string{"build"},
+		payloadPipelines: []string{"os", "container"},
+		exports:          []string{"container"},
+	}
+
+	minimalrawImgType = imageType{
+		name:     "minimal-raw",
+		filename: "raw.img",
+		mimeType: "application/disk",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey: minimalrpmPackageSet,
+		},
+		rpmOstree:           false,
+		kernelOptions:       defaultKernelOptions,
+		bootable:            true,
+		defaultSize:         2 * common.GibiByte,
+		image:               liveImage,
+		buildPipelines:      []string{"build"},
+		payloadPipelines:    []string{"os", "image"},
+		exports:             []string{"image"},
+		basePartitionTables: defaultBasePartitionTables,
+	}
+)
+
+type distribution struct {
+	name               string
+	product            string
+	osVersion          string
+	releaseVersion     string
+	modulePlatformID   string
+	ostreeRefTmpl      string
+	isolabelTmpl       string
+	runner             runner.Runner
+	arches             map[string]distro.Arch
+	defaultImageConfig *distro.ImageConfig
+}
+
+// Fedora based OS image configuration defaults
+var defaultDistroImageConfig = &distro.ImageConfig{
+	Timezone: common.ToPtr("UTC"),
+	Locale:   common.ToPtr("en_US"),
+}
+
+func getDistro(version int) distribution {
+	return distribution{
+		name:               fmt.Sprintf("fedora-%d", version),
+		product:            "Fedora",
+		osVersion:          strconv.Itoa(version),
+		releaseVersion:     strconv.Itoa(version),
+		modulePlatformID:   fmt.Sprintf("platform:f%d", version),
+		ostreeRefTmpl:      fmt.Sprintf("fedora/%d/%%s/iot", version),
+		isolabelTmpl:       fmt.Sprintf("Fedora-%d-BaseOS-%%s", version),
+		runner:             &runner.Fedora{Version: uint64(version)},
+		defaultImageConfig: defaultDistroImageConfig,
+	}
+}
+
+func (d *distribution) Name() string {
+	return d.name
+}
+
+func (d *distribution) Releasever() string {
+	return d.releaseVersion
+}
+
+func (d *distribution) ModulePlatformID() string {
+	return d.modulePlatformID
+}
+
+func (d *distribution) OSTreeRef() string {
+	return d.ostreeRefTmpl
+}
+
+func (d *distribution) ListArches() []string {
+	archNames := make([]string, 0, len(d.arches))
+	for name := range d.arches {
+		archNames = append(archNames, name)
+	}
+	sort.Strings(archNames)
+	return archNames
+}
+
+func (d *distribution) GetArch(name string) (distro.Arch, error) {
+	arch, exists := d.arches[name]
+	if !exists {
+		return nil, errors.New("invalid architecture: " + name)
+	}
+	return arch, nil
+}
+
+func (d *distribution) addArches(arches ...architecture) {
+	if d.arches == nil {
+		d.arches = map[string]distro.Arch{}
+	}
+
+	// Do not make copies of architectures, as opposed to image types,
+	// because architecture definitions are not used by more than a single
+	// distro definition.
+	for idx := range arches {
+		d.arches[arches[idx].name] = &arches[idx]
+	}
+}
+
+func (d *distribution) getDefaultImageConfig() *distro.ImageConfig {
+	return d.defaultImageConfig
+}
+
+type architecture struct {
+	distro           *distribution
+	name             string
+	imageTypes       map[string]distro.ImageType
+	imageTypeAliases map[string]string
+}
+
+func (a *architecture) Name() string {
+	return a.name
+}
+
+func (a *architecture) ListImageTypes() []string {
+	itNames := make([]string, 0, len(a.imageTypes))
+	for name := range a.imageTypes {
+		itNames = append(itNames, name)
+	}
+	sort.Strings(itNames)
+	return itNames
+}
+
+func (a *architecture) GetImageType(name string) (distro.ImageType, error) {
+	t, exists := a.imageTypes[name]
+	if !exists {
+		aliasForName, exists := a.imageTypeAliases[name]
+		if !exists {
+			return nil, errors.New("invalid image type: " + name)
+		}
+		t, exists = a.imageTypes[aliasForName]
+		if !exists {
+			panic(fmt.Sprintf("image type '%s' is an alias to a non-existing image type '%s'", name, aliasForName))
+		}
+	}
+	return t, nil
+}
+
+func (a *architecture) addImageTypes(platform platform.Platform, imageTypes ...imageType) {
+	if a.imageTypes == nil {
+		a.imageTypes = map[string]distro.ImageType{}
+	}
+	for idx := range imageTypes {
+		it := imageTypes[idx]
+		it.arch = a
+		it.platform = platform
+		a.imageTypes[it.name] = &it
+		for _, alias := range it.nameAliases {
+			if a.imageTypeAliases == nil {
+				a.imageTypeAliases = map[string]string{}
+			}
+			if existingAliasFor, exists := a.imageTypeAliases[alias]; exists {
+				panic(fmt.Sprintf("image type alias '%s' for '%s' is already defined for another image type '%s'", alias, it.name, existingAliasFor))
+			}
+			a.imageTypeAliases[alias] = it.name
+		}
+	}
+}
+
+func (a *architecture) Distro() distro.Distro {
+	return a.distro
+}
+
+// New creates a new distro object, defining the supported architectures and image types
+func NewF37() distro.Distro {
+	return newDistro(37)
+}
+func NewF38() distro.Distro {
+	return newDistro(38)
+}
+func NewF39() distro.Distro {
+	return newDistro(39)
+}
+
+func newDistro(version int) distro.Distro {
+	rd := getDistro(version)
+
+	// Architecture definitions
+	x86_64 := architecture{
+		name:   platform.ARCH_X86_64.String(),
+		distro: &rd,
+	}
+
+	aarch64 := architecture{
+		name:   platform.ARCH_AARCH64.String(),
+		distro: &rd,
+	}
+
+	ociImgType := qcow2ImgType
+	ociImgType.name = "oci"
+
+	amiImgType := qcow2ImgType
+	amiImgType.name = "ami"
+	amiImgType.filename = "image.raw"
+	amiImgType.mimeType = "application/octet-stream"
+	amiImgType.payloadPipelines = []string{"os", "image"}
+	amiImgType.exports = []string{"image"}
+	amiImgType.environment = &environment.EC2{}
+
+	openstackImgType := qcow2ImgType
+	openstackImgType.name = "openstack"
+
+	x86_64.addImageTypes(
+		&platform.X86{
+			BIOS:       true,
+			UEFIVendor: "fedora",
+			BasePlatform: platform.BasePlatform{
+				ImageFormat: platform.FORMAT_QCOW2,
+				QCOW2Compat: "1.1",
+			},
+		},
+		qcow2ImgType,
+		ociImgType,
+	)
+	x86_64.addImageTypes(
+		&platform.X86{
+			BIOS:       true,
+			UEFIVendor: "fedora",
+			BasePlatform: platform.BasePlatform{
+				ImageFormat: platform.FORMAT_QCOW2,
+			},
+		},
+		openstackImgType,
+	)
+	x86_64.addImageTypes(
+		&platform.X86{
+			BIOS:       true,
+			UEFIVendor: "fedora",
+			BasePlatform: platform.BasePlatform{
+				ImageFormat: platform.FORMAT_VHD,
+			},
+		},
+		vhdImgType,
+	)
+	x86_64.addImageTypes(
+		&platform.X86{
+			BIOS:       true,
+			UEFIVendor: "fedora",
+			BasePlatform: platform.BasePlatform{
+				ImageFormat: platform.FORMAT_VMDK,
+			},
+		},
+		vmdkImgType,
+	)
+	x86_64.addImageTypes(
+		&platform.X86{
+			BIOS:       true,
+			UEFIVendor: "fedora",
+			BasePlatform: platform.BasePlatform{
+				ImageFormat: platform.FORMAT_OVA,
+			},
+		},
+		ovaImgType,
+	)
+	x86_64.addImageTypes(
+		&platform.X86{
+			BIOS:       true,
+			UEFIVendor: "fedora",
+			BasePlatform: platform.BasePlatform{
+				ImageFormat: platform.FORMAT_RAW,
+			},
+		},
+		amiImgType,
+	)
+	x86_64.addImageTypes(
+		&platform.X86{},
+		containerImgType,
+	)
+	x86_64.addImageTypes(
+		&platform.X86{
+			BasePlatform: platform.BasePlatform{
+				FirmwarePackages: []string{
+					"microcode_ctl", // ??
+					"iwl1000-firmware",
+					"iwl100-firmware",
+					"iwl105-firmware",
+					"iwl135-firmware",
+					"iwl2000-firmware",
+					"iwl2030-firmware",
+					"iwl3160-firmware",
+					"iwl5000-firmware",
+					"iwl5150-firmware",
+					"iwl6000-firmware",
+					"iwl6050-firmware",
+				},
+			},
+			BIOS:       true,
+			UEFIVendor: "fedora",
+		},
+		iotOCIImgType,
+		iotCommitImgType,
+		iotInstallerImgType,
+		imageInstallerImgType,
+		liveInstallerImgType,
+	)
+	x86_64.addImageTypes(
+		&platform.X86{
+			BasePlatform: platform.BasePlatform{
+				ImageFormat: platform.FORMAT_RAW,
+			},
+			BIOS:       false,
+			UEFIVendor: "fedora",
+		},
+		iotRawImgType,
+	)
+	aarch64.addImageTypes(
+		&platform.Aarch64{
+			UEFIVendor: "fedora",
+			BasePlatform: platform.BasePlatform{
+				ImageFormat: platform.FORMAT_RAW,
+			},
+		},
+		amiImgType,
+	)
+	aarch64.addImageTypes(
+		&platform.Aarch64{
+			UEFIVendor: "fedora",
+			BasePlatform: platform.BasePlatform{
+				ImageFormat: platform.FORMAT_QCOW2,
+				QCOW2Compat: "1.1",
+			},
+		},
+		qcow2ImgType,
+		ociImgType,
+	)
+	aarch64.addImageTypes(
+		&platform.Aarch64{
+			UEFIVendor: "fedora",
+			BasePlatform: platform.BasePlatform{
+				ImageFormat: platform.FORMAT_QCOW2,
+			},
+		},
+		openstackImgType,
+	)
+	aarch64.addImageTypes(
+		&platform.Aarch64{},
+		containerImgType,
+	)
+	aarch64.addImageTypes(
+		&platform.Aarch64{
+			BasePlatform: platform.BasePlatform{
+				FirmwarePackages: []string{
+					"uboot-images-armv8", // ??
+					"bcm283x-firmware",
+					"arm-image-installer", // ??
+				},
+			},
+			UEFIVendor: "fedora",
+		},
+		iotCommitImgType,
+		iotOCIImgType,
+		iotInstallerImgType,
+		imageInstallerImgType,
+		liveInstallerImgType,
+	)
+	aarch64.addImageTypes(
+		&platform.Aarch64_IoT{
+			BasePlatform: platform.BasePlatform{
+				ImageFormat: platform.FORMAT_RAW,
+			},
+			UEFIVendor: "fedora",
+			BootFiles: [][2]string{
+				{"/usr/lib/ostree-boot/efi/bcm2710-rpi-2-b.dtb", "/boot/efi/"},
+				{"/usr/lib/ostree-boot/efi/bcm2710-rpi-3-b-plus.dtb", "/boot/efi/"},
+				{"/usr/lib/ostree-boot/efi/bcm2710-rpi-3-b.dtb", "/boot/efi/"},
+				{"/usr/lib/ostree-boot/efi/bcm2710-rpi-cm3.dtb", "/boot/efi/"},
+				{"/usr/lib/ostree-boot/efi/bcm2710-rpi-zero-2-w.dtb", "/boot/efi/"},
+				{"/usr/lib/ostree-boot/efi/bcm2710-rpi-zero-2.dtb", "/boot/efi/"},
+				{"/usr/lib/ostree-boot/efi/bcm2711-rpi-4-b.dtb", "/boot/efi/"},
+				{"/usr/lib/ostree-boot/efi/bcm2711-rpi-400.dtb", "/boot/efi/"},
+				{"/usr/lib/ostree-boot/efi/bcm2711-rpi-cm4.dtb", "/boot/efi/"},
+				{"/usr/lib/ostree-boot/efi/bcm2711-rpi-cm4s.dtb", "/boot/efi/"},
+				{"/usr/lib/ostree-boot/efi/bootcode.bin", "/boot/efi/"},
+				{"/usr/lib/ostree-boot/efi/config.txt", "/boot/efi/config.txt"},
+				{"/usr/lib/ostree-boot/efi/fixup.dat", "/boot/efi/"},
+				{"/usr/lib/ostree-boot/efi/fixup4.dat", "/boot/efi/"},
+				{"/usr/lib/ostree-boot/efi/fixup4cd.dat", "/boot/efi/"},
+				{"/usr/lib/ostree-boot/efi/fixup4db.dat", "/boot/efi/"},
+				{"/usr/lib/ostree-boot/efi/fixup4x.dat", "/boot/efi/"},
+				{"/usr/lib/ostree-boot/efi/fixup_cd.dat", "/boot/efi/"},
+				{"/usr/lib/ostree-boot/efi/fixup_db.dat", "/boot/efi/"},
+				{"/usr/lib/ostree-boot/efi/fixup_x.dat", "/boot/efi/"},
+				{"/usr/lib/ostree-boot/efi/overlays", "/boot/efi/"},
+				{"/usr/share/uboot/rpi_arm64/u-boot.bin", "/boot/efi/rpi-u-boot.bin"},
+				{"/usr/lib/ostree-boot/efi/start.elf", "/boot/efi/"},
+				{"/usr/lib/ostree-boot/efi/start4.elf", "/boot/efi/"},
+				{"/usr/lib/ostree-boot/efi/start4cd.elf", "/boot/efi/"},
+				{"/usr/lib/ostree-boot/efi/start4db.elf", "/boot/efi/"},
+				{"/usr/lib/ostree-boot/efi/start4x.elf", "/boot/efi/"},
+				{"/usr/lib/ostree-boot/efi/start_cd.elf", "/boot/efi/"},
+				{"/usr/lib/ostree-boot/efi/start_db.elf", "/boot/efi/"},
+				{"/usr/lib/ostree-boot/efi/start_x.elf", "/boot/efi/"},
+			},
+		},
+		iotRawImgType,
+	)
+	x86_64.addImageTypes(
+		&platform.X86{
+			UEFIVendor: "fedora",
+			BasePlatform: platform.BasePlatform{
+				ImageFormat: platform.FORMAT_RAW,
+			},
+		},
+		minimalrawImgType,
+	)
+	aarch64.addImageTypes(
+		&platform.Aarch64{
+			UEFIVendor: "fedora",
+			BasePlatform: platform.BasePlatform{
+				ImageFormat: platform.FORMAT_RAW,
+			},
+		},
+		minimalrawImgType,
+	)
+
+	rd.addArches(x86_64, aarch64)
+	return &rd
+}

vendor/github.com/osbuild/images/pkg/distro/fedora/images.go

@@ -0,0 +1,532 @@
+package fedora
+
+import (
+	"fmt"
+	"math/rand"
+	"strings"
+
+	"github.com/osbuild/images/internal/common"
+	"github.com/osbuild/images/internal/oscap"
+	"github.com/osbuild/images/internal/users"
+	"github.com/osbuild/images/internal/workload"
+	"github.com/osbuild/images/pkg/blueprint"
+	"github.com/osbuild/images/pkg/container"
+	"github.com/osbuild/images/pkg/distro"
+	"github.com/osbuild/images/pkg/image"
+	"github.com/osbuild/images/pkg/manifest"
+	"github.com/osbuild/images/pkg/osbuild"
+	"github.com/osbuild/images/pkg/ostree"
+	"github.com/osbuild/images/pkg/rpmmd"
+)
+
+// HELPERS
+
+func osCustomizations(
+	t *imageType,
+	osPackageSet rpmmd.PackageSet,
+	containers []container.SourceSpec,
+	c *blueprint.Customizations) manifest.OSCustomizations {
+
+	imageConfig := t.getDefaultImageConfig()
+
+	osc := manifest.OSCustomizations{}
+
+	if t.bootable || t.rpmOstree {
+		osc.KernelName = c.GetKernel().Name
+
+		var kernelOptions []string
+		if t.kernelOptions != "" {
+			kernelOptions = append(kernelOptions, t.kernelOptions)
+		}
+		if bpKernel := c.GetKernel(); bpKernel.Append != "" {
+			kernelOptions = append(kernelOptions, bpKernel.Append)
+		}
+		osc.KernelOptionsAppend = kernelOptions
+	}
+
+	osc.ExtraBasePackages = osPackageSet.Include
+	osc.ExcludeBasePackages = osPackageSet.Exclude
+	osc.ExtraBaseRepos = osPackageSet.Repositories
+
+	osc.Containers = containers
+
+	osc.GPGKeyFiles = imageConfig.GPGKeyFiles
+	if imageConfig.ExcludeDocs != nil {
+		osc.ExcludeDocs = *imageConfig.ExcludeDocs
+	}
+
+	if !t.bootISO {
+		// don't put users and groups in the payload of an installer
+		// add them via kickstart instead
+		osc.Groups = users.GroupsFromBP(c.GetGroups())
+		osc.Users = users.UsersFromBP(c.GetUsers())
+	}
+
+	osc.EnabledServices = imageConfig.EnabledServices
+	osc.DisabledServices = imageConfig.DisabledServices
+	if imageConfig.DefaultTarget != nil {
+		osc.DefaultTarget = *imageConfig.DefaultTarget
+	}
+
+	if fw := c.GetFirewall(); fw != nil {
+		options := osbuild.FirewallStageOptions{
+			Ports: fw.Ports,
+		}
+
+		if fw.Services != nil {
+			options.EnabledServices = fw.Services.Enabled
+			options.DisabledServices = fw.Services.Disabled
+		}
+		osc.Firewall = &options
+	}
+
+	language, keyboard := c.GetPrimaryLocale()
+	if language != nil {
+		osc.Language = *language
+	} else if imageConfig.Locale != nil {
+		osc.Language = *imageConfig.Locale
+	}
+	if keyboard != nil {
+		osc.Keyboard = keyboard
+	} else if imageConfig.Keyboard != nil {
+		osc.Keyboard = &imageConfig.Keyboard.Keymap
+	}
+
+	if hostname := c.GetHostname(); hostname != nil {
+		osc.Hostname = *hostname
+	} else {
+		osc.Hostname = "localhost.localdomain"
+	}
+
+	timezone, ntpServers := c.GetTimezoneSettings()
+	if timezone != nil {
+		osc.Timezone = *timezone
+	} else if imageConfig.Timezone != nil {
+		osc.Timezone = *imageConfig.Timezone
+	}
+
+	if len(ntpServers) > 0 {
+		for _, server := range ntpServers {
+			osc.NTPServers = append(osc.NTPServers, osbuild.ChronyConfigServer{Hostname: server})
+		}
+	} else if imageConfig.TimeSynchronization != nil {
+		osc.NTPServers = imageConfig.TimeSynchronization.Servers
+	}
+
+	// Relabel the tree, unless the `NoSElinux` flag is explicitly set to `true`
+	if imageConfig.NoSElinux == nil || imageConfig.NoSElinux != nil && !*imageConfig.NoSElinux {
+		osc.SElinux = "targeted"
+	}
+
+	if oscapConfig := c.GetOpenSCAP(); oscapConfig != nil {
+		if t.rpmOstree {
+			panic("unexpected oscap options for ostree image type")
+		}
+		var datastream = oscapConfig.DataStream
+		if datastream == "" {
+			datastream = oscap.DefaultFedoraDatastream()
+		}
+		osc.OpenSCAPConfig = osbuild.NewOscapRemediationStageOptions(
+			osbuild.OscapConfig{
+				Datastream: datastream,
+				ProfileID:  oscapConfig.ProfileID,
+			},
+		)
+	}
+
+	var err error
+	osc.Directories, err = blueprint.DirectoryCustomizationsToFsNodeDirectories(c.GetDirectories())
+	if err != nil {
+		// In theory this should never happen, because the blueprint directory customizations
+		// should have been validated before this point.
+		panic(fmt.Sprintf("failed to convert directory customizations to fs node directories: %v", err))
+	}
+
+	osc.Files, err = blueprint.FileCustomizationsToFsNodeFiles(c.GetFiles())
+	if err != nil {
+		// In theory this should never happen, because the blueprint file customizations
+		// should have been validated before this point.
+		panic(fmt.Sprintf("failed to convert file customizations to fs node files: %v", err))
+	}
+
+	customRepos, err := c.GetRepositories()
+	if err != nil {
+		// This shouldn't happen and since the repos
+		// should have already been validated
+		panic(fmt.Sprintf("failed to get custom repos: %v", err))
+	}
+
+	// This function returns a map of filename and corresponding yum repos
+	// and a list of fs node files for the inline gpg keys so we can save
+	// them to disk. This step also swaps the inline gpg key with the path
+	// to the file in the os file tree
+	yumRepos, gpgKeyFiles, err := blueprint.RepoCustomizationsToRepoConfigAndGPGKeyFiles(customRepos)
+	if err != nil {
+		panic(fmt.Sprintf("failed to convert inline gpgkeys to fs node files: %v", err))
+	}
+
+	// add the gpg key files to the list of files to be added to the tree
+	if len(gpgKeyFiles) > 0 {
+		osc.Files = append(osc.Files, gpgKeyFiles...)
+	}
+
+	for filename, repos := range yumRepos {
+		osc.YUMRepos = append(osc.YUMRepos, osbuild.NewYumReposStageOptions(filename, repos))
+	}
+
+	osc.ShellInit = imageConfig.ShellInit
+
+	osc.Grub2Config = imageConfig.Grub2Config
+	osc.Sysconfig = imageConfig.Sysconfig
+	osc.SystemdLogind = imageConfig.SystemdLogind
+	osc.CloudInit = imageConfig.CloudInit
+	osc.Modprobe = imageConfig.Modprobe
+	osc.DracutConf = imageConfig.DracutConf
+	osc.SystemdUnit = imageConfig.SystemdUnit
+	osc.Authselect = imageConfig.Authselect
+	osc.SELinuxConfig = imageConfig.SELinuxConfig
+	osc.Tuned = imageConfig.Tuned
+	osc.Tmpfilesd = imageConfig.Tmpfilesd
+	osc.PamLimitsConf = imageConfig.PamLimitsConf
+	osc.Sysctld = imageConfig.Sysctld
+	osc.DNFConfig = imageConfig.DNFConfig
+	osc.SshdConfig = imageConfig.SshdConfig
+	osc.AuthConfig = imageConfig.Authconfig
+	osc.PwQuality = imageConfig.PwQuality
+
+	return osc
+}
+
+// IMAGES
+
+func liveImage(workload workload.Workload,
+	t *imageType,
+	customizations *blueprint.Customizations,
+	options distro.ImageOptions,
+	packageSets map[string]rpmmd.PackageSet,
+	containers []container.SourceSpec,
+	rng *rand.Rand) (image.ImageKind, error) {
+
+	img := image.NewLiveImage()
+	img.Platform = t.platform
+	img.OSCustomizations = osCustomizations(t, packageSets[osPkgsKey], containers, customizations)
+	img.Environment = t.environment
+	img.Workload = workload
+	// TODO: move generation into LiveImage
+	pt, err := t.getPartitionTable(customizations.GetFilesystems(), options, rng)
+	if err != nil {
+		return nil, err
+	}
+	img.PartitionTable = pt
+
+	img.Filename = t.Filename()
+
+	return img, nil
+}
+
+func containerImage(workload workload.Workload,
+	t *imageType,
+	c *blueprint.Customizations,
+	options distro.ImageOptions,
+	packageSets map[string]rpmmd.PackageSet,
+	containers []container.SourceSpec,
+	rng *rand.Rand) (image.ImageKind, error) {
+	img := image.NewBaseContainer()
+
+	img.Platform = t.platform
+	img.OSCustomizations = osCustomizations(t, packageSets[osPkgsKey], containers, c)
+	img.Environment = t.environment
+	img.Workload = workload
+
+	img.Filename = t.Filename()
+
+	return img, nil
+}
+
+func liveInstallerImage(workload workload.Workload,
+	t *imageType,
+	customizations *blueprint.Customizations,
+	options distro.ImageOptions,
+	packageSets map[string]rpmmd.PackageSet,
+	containers []container.SourceSpec,
+	rng *rand.Rand) (image.ImageKind, error) {
+
+	img := image.NewAnacondaLiveInstaller()
+
+	distro := t.Arch().Distro()
+
+	// If the live installer is generated for Fedora 39 or higher then we enable the web ui
+	// kernel options. This is a temporary thing as the check for this should really lie with
+	// anaconda and their `liveinst` script to determine which frontend to start.
+	if common.VersionLessThan(distro.Releasever(), "39") {
+		img.AdditionalKernelOpts = []string{}
+	} else {
+		img.AdditionalKernelOpts = []string{"inst.webui"}
+	}
+
+	img.Platform = t.platform
+	img.Workload = workload
+	img.ExtraBasePackages = packageSets[installerPkgsKey]
+
+	d := t.arch.distro
+
+	img.ISOLabelTempl = d.isolabelTmpl
+	img.Product = d.product
+	img.OSName = "fedora"
+	img.OSVersion = d.osVersion
+	img.Release = fmt.Sprintf("%s %s", d.product, d.osVersion)
+
+	img.Filename = t.Filename()
+
+	return img, nil
+}
+
+func imageInstallerImage(workload workload.Workload,
+	t *imageType,
+	customizations *blueprint.Customizations,
+	options distro.ImageOptions,
+	packageSets map[string]rpmmd.PackageSet,
+	containers []container.SourceSpec,
+	rng *rand.Rand) (image.ImageKind, error) {
+
+	img := image.NewAnacondaTarInstaller()
+
+	// Enable anaconda-webui for Fedora > 38
+	distro := t.Arch().Distro()
+	if strings.HasPrefix(distro.Name(), "fedora") && !common.VersionLessThan(distro.Releasever(), "38") {
+		img.AdditionalAnacondaModules = []string{
+			"org.fedoraproject.Anaconda.Modules.Security",
+			"org.fedoraproject.Anaconda.Modules.Timezone",
+			"org.fedoraproject.Anaconda.Modules.Localization",
+		}
+		img.AdditionalKernelOpts = []string{"inst.webui", "inst.webui.remote"}
+	}
+	img.AdditionalAnacondaModules = append(img.AdditionalAnacondaModules, "org.fedoraproject.Anaconda.Modules.Users")
+
+	img.Platform = t.platform
+	img.Workload = workload
+	img.OSCustomizations = osCustomizations(t, packageSets[osPkgsKey], containers, customizations)
+	img.ExtraBasePackages = packageSets[installerPkgsKey]
+	img.Users = users.UsersFromBP(customizations.GetUsers())
+	img.Groups = users.GroupsFromBP(customizations.GetGroups())
+
+	img.SquashfsCompression = "lz4"
+
+	d := t.arch.distro
+
+	img.ISOLabelTempl = d.isolabelTmpl
+	img.Product = d.product
+	img.OSName = "fedora"
+	img.OSVersion = d.osVersion
+	img.Release = fmt.Sprintf("%s %s", d.product, d.osVersion)
+
+	img.Filename = t.Filename()
+
+	return img, nil
+}
+
+func iotCommitImage(workload workload.Workload,
+	t *imageType,
+	customizations *blueprint.Customizations,
+	options distro.ImageOptions,
+	packageSets map[string]rpmmd.PackageSet,
+	containers []container.SourceSpec,
+	rng *rand.Rand) (image.ImageKind, error) {
+
+	parentCommit, commitRef := makeOSTreeParentCommit(options.OSTree, t.OSTreeRef())
+	img := image.NewOSTreeArchive(commitRef)
+
+	img.Platform = t.platform
+	img.OSCustomizations = osCustomizations(t, packageSets[osPkgsKey], containers, customizations)
+	img.Environment = t.environment
+	img.Workload = workload
+	img.OSTreeParent = parentCommit
+	img.OSVersion = t.arch.distro.osVersion
+	img.Filename = t.Filename()
+
+	return img, nil
+}
+
+func iotContainerImage(workload workload.Workload,
+	t *imageType,
+	customizations *blueprint.Customizations,
+	options distro.ImageOptions,
+	packageSets map[string]rpmmd.PackageSet,
+	containers []container.SourceSpec,
+	rng *rand.Rand) (image.ImageKind, error) {
+
+	parentCommit, commitRef := makeOSTreeParentCommit(options.OSTree, t.OSTreeRef())
+	img := image.NewOSTreeContainer(commitRef)
+
+	img.Platform = t.platform
+	img.OSCustomizations = osCustomizations(t, packageSets[osPkgsKey], containers, customizations)
+	img.ContainerLanguage = img.OSCustomizations.Language
+	img.Environment = t.environment
+	img.Workload = workload
+	img.OSTreeParent = parentCommit
+	img.OSVersion = t.arch.distro.osVersion
+	img.ExtraContainerPackages = packageSets[containerPkgsKey]
+	img.Filename = t.Filename()
+
+	return img, nil
+}
+
+func iotInstallerImage(workload workload.Workload,
+	t *imageType,
+	customizations *blueprint.Customizations,
+	options distro.ImageOptions,
+	packageSets map[string]rpmmd.PackageSet,
+	containers []container.SourceSpec,
+	rng *rand.Rand) (image.ImageKind, error) {
+
+	d := t.arch.distro
+
+	commit, err := makeOSTreePayloadCommit(options.OSTree, t.OSTreeRef())
+	if err != nil {
+		return nil, fmt.Errorf("%s: %s", t.Name(), err.Error())
+	}
+
+	img := image.NewAnacondaOSTreeInstaller(commit)
+
+	img.Platform = t.platform
+	img.ExtraBasePackages = packageSets[installerPkgsKey]
+	img.Users = users.UsersFromBP(customizations.GetUsers())
+	img.Groups = users.GroupsFromBP(customizations.GetGroups())
+	img.AdditionalAnacondaModules = []string{
+		"org.fedoraproject.Anaconda.Modules.Timezone",
+		"org.fedoraproject.Anaconda.Modules.Localization",
+		"org.fedoraproject.Anaconda.Modules.Users",
+	}
+
+	img.SquashfsCompression = "lz4"
+
+	img.ISOLabelTempl = d.isolabelTmpl
+	img.Product = d.product
+	img.Variant = "IoT"
+	img.OSName = "fedora"
+	img.OSVersion = d.osVersion
+	img.Release = fmt.Sprintf("%s %s", d.product, d.osVersion)
+
+	img.Filename = t.Filename()
+
+	return img, nil
+}
+
+func iotRawImage(workload workload.Workload,
+	t *imageType,
+	customizations *blueprint.Customizations,
+	options distro.ImageOptions,
+	packageSets map[string]rpmmd.PackageSet,
+	containers []container.SourceSpec,
+	rng *rand.Rand) (image.ImageKind, error) {
+
+	commit, err := makeOSTreePayloadCommit(options.OSTree, t.OSTreeRef())
+	if err != nil {
+		return nil, fmt.Errorf("%s: %s", t.Name(), err.Error())
+	}
+
+	img := image.NewOSTreeRawImage(commit)
+
+	// Set sysroot read-only only for Fedora 37+
+	distro := t.Arch().Distro()
+	if strings.HasPrefix(distro.Name(), "fedora") && !common.VersionLessThan(distro.Releasever(), "37") {
+		img.SysrootReadOnly = true
+	}
+
+	img.Users = users.UsersFromBP(customizations.GetUsers())
+	img.Groups = users.GroupsFromBP(customizations.GetGroups())
+
+	img.Directories, err = blueprint.DirectoryCustomizationsToFsNodeDirectories(customizations.GetDirectories())
+	if err != nil {
+		return nil, err
+	}
+	img.Files, err = blueprint.FileCustomizationsToFsNodeFiles(customizations.GetFiles())
+	if err != nil {
+		return nil, err
+	}
+
+	// "rw" kernel option is required when /sysroot is mounted read-only to
+	// keep stateful parts of the filesystem writeable (/var/ and /etc)
+	img.KernelOptionsAppend = []string{"modprobe.blacklist=vc4", "rw"}
+	img.Keyboard = "us"
+	img.Locale = "C.UTF-8"
+
+	img.Platform = t.platform
+	img.Workload = workload
+
+	img.Remote = ostree.Remote{
+		Name:        "fedora-iot",
+		URL:         "https://ostree.fedoraproject.org/iot",
+		ContentURL:  "mirrorlist=https://ostree.fedoraproject.org/iot/mirrorlist",
+		GPGKeyPaths: []string{"/etc/pki/rpm-gpg/"},
+	}
+	img.OSName = "fedora-iot"
+
+	// TODO: move generation into LiveImage
+	pt, err := t.getPartitionTable(customizations.GetFilesystems(), options, rng)
+	if err != nil {
+		return nil, err
+	}
+	img.PartitionTable = pt
+
+	img.Filename = t.Filename()
+	img.Compression = t.compression
+
+	return img, nil
+}
+
+// Create an ostree SourceSpec to define an ostree parent commit using the user
+// options and the default ref for the image type.  Additionally returns the
+// ref to be used for the new commit to be created.
+func makeOSTreeParentCommit(options *ostree.ImageOptions, defaultRef string) (*ostree.SourceSpec, string) {
+	commitRef := defaultRef
+	if options == nil {
+		// nothing to do
+		return nil, commitRef
+	}
+	if options.ImageRef != "" {
+		// user option overrides default commit ref
+		commitRef = options.ImageRef
+	}
+
+	var parentCommit *ostree.SourceSpec
+	if options.URL == "" {
+		// no parent
+		return nil, commitRef
+	}
+
+	// ostree URL specified: set source spec for parent commit
+	parentRef := options.ParentRef
+	if parentRef == "" {
+		// parent ref not set: use image ref
+		parentRef = commitRef
+
+	}
+	parentCommit = &ostree.SourceSpec{
+		URL:  options.URL,
+		Ref:  parentRef,
+		RHSM: options.RHSM,
+	}
+	return parentCommit, commitRef
+}
+
+// Create an ostree SourceSpec to define an ostree payload using the user options and the default ref for the image type.
+func makeOSTreePayloadCommit(options *ostree.ImageOptions, defaultRef string) (ostree.SourceSpec, error) {
+	if options == nil || options.URL == "" {
+		// this should be caught by checkOptions() in distro, but it's good
+		// to guard against it here as well
+		return ostree.SourceSpec{}, fmt.Errorf("ostree commit URL required")
+	}
+
+	commitRef := defaultRef
+	if options.ImageRef != "" {
+		// user option overrides default commit ref
+		commitRef = options.ImageRef
+	}
+
+	return ostree.SourceSpec{
+		URL:  options.URL,
+		Ref:  commitRef,
+		RHSM: options.RHSM,
+	}, nil
+}

vendor/github.com/osbuild/images/pkg/distro/fedora/imagetype.go

@@ -0,0 +1,342 @@
+package fedora
+
+import (
+	"fmt"
+	"math/rand"
+	"strings"
+
+	"github.com/osbuild/images/internal/common"
+	"github.com/osbuild/images/internal/environment"
+	"github.com/osbuild/images/internal/oscap"
+	"github.com/osbuild/images/internal/pathpolicy"
+	"github.com/osbuild/images/internal/workload"
+	"github.com/osbuild/images/pkg/blueprint"
+	"github.com/osbuild/images/pkg/container"
+	"github.com/osbuild/images/pkg/disk"
+	"github.com/osbuild/images/pkg/distro"
+	"github.com/osbuild/images/pkg/image"
+	"github.com/osbuild/images/pkg/manifest"
+	"github.com/osbuild/images/pkg/ostree"
+	"github.com/osbuild/images/pkg/platform"
+	"github.com/osbuild/images/pkg/rpmmd"
+	"golang.org/x/exp/slices"
+)
+
+type imageFunc func(workload workload.Workload, t *imageType, customizations *blueprint.Customizations, options distro.ImageOptions, packageSets map[string]rpmmd.PackageSet, containers []container.SourceSpec, rng *rand.Rand) (image.ImageKind, error)
+
+type packageSetFunc func(t *imageType) rpmmd.PackageSet
+
+type imageType struct {
+	arch               *architecture
+	platform           platform.Platform
+	environment        environment.Environment
+	workload           workload.Workload
+	name               string
+	nameAliases        []string
+	filename           string
+	compression        string
+	mimeType           string
+	packageSets        map[string]packageSetFunc
+	defaultImageConfig *distro.ImageConfig
+	kernelOptions      string
+	defaultSize        uint64
+	buildPipelines     []string
+	payloadPipelines   []string
+	exports            []string
+	image              imageFunc
+
+	// bootISO: installable ISO
+	bootISO bool
+	// rpmOstree: iot/ostree
+	rpmOstree bool
+	// bootable image
+	bootable bool
+	// List of valid arches for the image type
+	basePartitionTables    distro.BasePartitionTableMap
+	requiredPartitionSizes map[string]uint64
+}
+
+func (t *imageType) Name() string {
+	return t.name
+}
+
+func (t *imageType) Arch() distro.Arch {
+	return t.arch
+}
+
+func (t *imageType) Filename() string {
+	return t.filename
+}
+
+func (t *imageType) MIMEType() string {
+	return t.mimeType
+}
+
+func (t *imageType) OSTreeRef() string {
+	d := t.arch.distro
+	if t.rpmOstree {
+		return fmt.Sprintf(d.ostreeRefTmpl, t.arch.Name())
+	}
+	return ""
+}
+
+func (t *imageType) Size(size uint64) uint64 {
+	// Microsoft Azure requires vhd images to be rounded up to the nearest MB
+	if t.name == "vhd" && size%common.MebiByte != 0 {
+		size = (size/common.MebiByte + 1) * common.MebiByte
+	}
+	if size == 0 {
+		size = t.defaultSize
+	}
+	return size
+}
+
+func (t *imageType) BuildPipelines() []string {
+	return t.buildPipelines
+}
+
+func (t *imageType) PayloadPipelines() []string {
+	return t.payloadPipelines
+}
+
+func (t *imageType) PayloadPackageSets() []string {
+	return []string{blueprintPkgsKey}
+}
+
+func (t *imageType) PackageSetsChains() map[string][]string {
+	return make(map[string][]string)
+}
+
+func (t *imageType) Exports() []string {
+	if len(t.exports) > 0 {
+		return t.exports
+	}
+	return []string{"assembler"}
+}
+
+func (t *imageType) BootMode() distro.BootMode {
+	if t.platform.GetUEFIVendor() != "" && t.platform.GetBIOSPlatform() != "" {
+		return distro.BOOT_HYBRID
+	} else if t.platform.GetUEFIVendor() != "" {
+		return distro.BOOT_UEFI
+	} else if t.platform.GetBIOSPlatform() != "" || t.platform.GetZiplSupport() {
+		return distro.BOOT_LEGACY
+	}
+	return distro.BOOT_NONE
+}
+
+func (t *imageType) getPartitionTable(
+	mountpoints []blueprint.FilesystemCustomization,
+	options distro.ImageOptions,
+	rng *rand.Rand,
+) (*disk.PartitionTable, error) {
+	basePartitionTable, exists := t.basePartitionTables[t.arch.Name()]
+	if !exists {
+		return nil, fmt.Errorf("unknown arch: " + t.arch.Name())
+	}
+
+	imageSize := t.Size(options.Size)
+
+	lvmify := !t.rpmOstree
+
+	return disk.NewPartitionTable(&basePartitionTable, mountpoints, imageSize, lvmify, t.requiredPartitionSizes, rng)
+}
+
+func (t *imageType) getDefaultImageConfig() *distro.ImageConfig {
+	// ensure that image always returns non-nil default config
+	imageConfig := t.defaultImageConfig
+	if imageConfig == nil {
+		imageConfig = &distro.ImageConfig{}
+	}
+	return imageConfig.InheritFrom(t.arch.distro.getDefaultImageConfig())
+
+}
+
+func (t *imageType) PartitionType() string {
+	basePartitionTable, exists := t.basePartitionTables[t.arch.Name()]
+	if !exists {
+		return ""
+	}
+
+	return basePartitionTable.Type
+}
+
+func (t *imageType) Manifest(bp *blueprint.Blueprint,
+	options distro.ImageOptions,
+	repos []rpmmd.RepoConfig,
+	seed int64) (*manifest.Manifest, []string, error) {
+
+	warnings, err := t.checkOptions(bp, options)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	// merge package sets that appear in the image type with the package sets
+	// of the same name from the distro and arch
+	staticPackageSets := make(map[string]rpmmd.PackageSet)
+
+	for name, getter := range t.packageSets {
+		staticPackageSets[name] = getter(t)
+	}
+
+	// amend with repository information and collect payload repos
+	payloadRepos := make([]rpmmd.RepoConfig, 0)
+	for _, repo := range repos {
+		if len(repo.PackageSets) > 0 {
+			// only apply the repo to the listed package sets
+			for _, psName := range repo.PackageSets {
+				if slices.Contains(t.PayloadPackageSets(), psName) {
+					payloadRepos = append(payloadRepos, repo)
+				}
+				ps := staticPackageSets[psName]
+				ps.Repositories = append(ps.Repositories, repo)
+				staticPackageSets[psName] = ps
+			}
+		}
+	}
+
+	w := t.workload
+	if w == nil {
+		cw := &workload.Custom{
+			BaseWorkload: workload.BaseWorkload{
+				Repos: payloadRepos,
+			},
+			Packages: bp.GetPackagesEx(false),
+		}
+		if services := bp.Customizations.GetServices(); services != nil {
+			cw.Services = services.Enabled
+			cw.DisabledServices = services.Disabled
+		}
+		w = cw
+	}
+
+	containerSources := make([]container.SourceSpec, len(bp.Containers))
+	for idx := range bp.Containers {
+		containerSources[idx] = container.SourceSpec(bp.Containers[idx])
+	}
+
+	source := rand.NewSource(seed)
+	// math/rand is good enough in this case
+	/* #nosec G404 */
+	rng := rand.New(source)
+
+	img, err := t.image(w, t, bp.Customizations, options, staticPackageSets, containerSources, rng)
+	if err != nil {
+		return nil, nil, err
+	}
+	mf := manifest.New()
+	mf.Distro = manifest.DISTRO_FEDORA
+	_, err = img.InstantiateManifest(&mf, repos, t.arch.distro.runner, rng)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return &mf, warnings, err
+}
+
+// checkOptions checks the validity and compatibility of options and customizations for the image type.
+// Returns ([]string, error) where []string, if non-nil, will hold any generated warnings (e.g. deprecation notices).
+func (t *imageType) checkOptions(bp *blueprint.Blueprint, options distro.ImageOptions) ([]string, error) {
+
+	customizations := bp.Customizations
+
+	// we do not support embedding containers on ostree-derived images, only on commits themselves
+	if len(bp.Containers) > 0 && t.rpmOstree && (t.name != "iot-commit" && t.name != "iot-container") {
+		return nil, fmt.Errorf("embedding containers is not supported for %s on %s", t.name, t.arch.distro.name)
+	}
+
+	ostreeURL := ""
+	if options.OSTree != nil {
+		if options.OSTree.ParentRef != "" && options.OSTree.URL == "" {
+			// specifying parent ref also requires URL
+			return nil, ostree.NewParameterComboError("ostree parent ref specified, but no URL to retrieve it")
+		}
+		ostreeURL = options.OSTree.URL
+	}
+
+	if t.bootISO && t.rpmOstree {
+		// ostree-based ISOs require a URL from which to pull a payload commit
+		if ostreeURL == "" {
+			return nil, fmt.Errorf("boot ISO image type %q requires specifying a URL from which to retrieve the OSTree commit", t.name)
+		}
+	}
+
+	if t.name == "iot-raw-image" {
+		allowed := []string{"User", "Group", "Directories", "Files", "Services"}
+		if err := customizations.CheckAllowed(allowed...); err != nil {
+			return nil, fmt.Errorf("unsupported blueprint customizations found for image type %q: (allowed: %s)", t.name, strings.Join(allowed, ", "))
+		}
+		// TODO: consider additional checks, such as those in "edge-simplified-installer" in RHEL distros
+	}
+
+	// BootISO's have limited support for customizations.
+	// TODO: Support kernel name selection for image-installer
+	if t.bootISO {
+		if t.name == "iot-installer" || t.name == "image-installer" {
+			allowed := []string{"User", "Group"}
+			if err := customizations.CheckAllowed(allowed...); err != nil {
+				return nil, fmt.Errorf("unsupported blueprint customizations found for boot ISO image type %q: (allowed: %s)", t.name, strings.Join(allowed, ", "))
+			}
+		} else if t.name == "live-installer" {
+			allowed := []string{}
+			if err := customizations.CheckAllowed(allowed...); err != nil {
+				return nil, fmt.Errorf("unsupported blueprint customizations found for boot ISO image type %q: (allowed: None)", t.name)
+			}
+		}
+	}
+
+	if kernelOpts := customizations.GetKernel(); kernelOpts.Append != "" && t.rpmOstree {
+		return nil, fmt.Errorf("kernel boot parameter customizations are not supported for ostree types")
+	}
+
+	mountpoints := customizations.GetFilesystems()
+
+	if mountpoints != nil && t.rpmOstree {
+		return nil, fmt.Errorf("Custom mountpoints are not supported for ostree types")
+	}
+
+	err := blueprint.CheckMountpointsPolicy(mountpoints, pathpolicy.MountpointPolicies)
+	if err != nil {
+		return nil, err
+	}
+
+	if osc := customizations.GetOpenSCAP(); osc != nil {
+		supported := oscap.IsProfileAllowed(osc.ProfileID, oscapProfileAllowList)
+		if !supported {
+			return nil, fmt.Errorf(fmt.Sprintf("OpenSCAP unsupported profile: %s", osc.ProfileID))
+		}
+		if t.rpmOstree {
+			return nil, fmt.Errorf("OpenSCAP customizations are not supported for ostree types")
+		}
+		if osc.ProfileID == "" {
+			return nil, fmt.Errorf("OpenSCAP profile cannot be empty")
+		}
+	}
+
+	// Check Directory/File Customizations are valid
+	dc := customizations.GetDirectories()
+	fc := customizations.GetFiles()
+
+	err = blueprint.ValidateDirFileCustomizations(dc, fc)
+	if err != nil {
+		return nil, err
+	}
+
+	err = blueprint.CheckDirectoryCustomizationsPolicy(dc, pathpolicy.CustomDirectoriesPolicies)
+	if err != nil {
+		return nil, err
+	}
+
+	err = blueprint.CheckFileCustomizationsPolicy(fc, pathpolicy.CustomFilesPolicies)
+	if err != nil {
+		return nil, err
+	}
+
+	// check if repository customizations are valid
+	_, err = customizations.GetRepositories()
+	if err != nil {
+		return nil, err
+	}
+
+	return nil, nil
+}

vendor/github.com/osbuild/images/pkg/distro/fedora/package_sets.go

@@ -0,0 +1,541 @@
+package fedora
+
+// This file defines package sets that are used by more than one image type.
+
+import (
+	"fmt"
+	"strconv"
+
+	"github.com/osbuild/images/internal/common"
+	"github.com/osbuild/images/pkg/platform"
+	"github.com/osbuild/images/pkg/rpmmd"
+)
+
+func qcow2CommonPackageSet(t *imageType) rpmmd.PackageSet {
+	return rpmmd.PackageSet{
+		Include: []string{
+			"@Fedora Cloud Server",
+			"chrony", // not mentioned in the kickstart, anaconda pulls it when setting the timezone
+			"langpacks-en",
+			"qemu-guest-agent",
+		},
+		Exclude: []string{
+			"dracut-config-rescue",
+			"firewalld",
+			"geolite2-city",
+			"geolite2-country",
+			"plymouth",
+		},
+	}
+}
+
+func vhdCommonPackageSet(t *imageType) rpmmd.PackageSet {
+	ps := rpmmd.PackageSet{
+		Include: []string{
+			"@core",
+			"chrony",
+			"langpacks-en",
+			"net-tools",
+			"ntfsprogs",
+			"libxcrypt-compat",
+			"initscripts",
+			"glibc-all-langpacks",
+		},
+		Exclude: []string{
+			"dracut-config-rescue",
+			"geolite2-city",
+			"geolite2-country",
+			"zram-generator-defaults",
+		},
+	}
+
+	return ps
+}
+
+func vmdkCommonPackageSet(t *imageType) rpmmd.PackageSet {
+	ps := rpmmd.PackageSet{
+		Include: []string{
+			"@Fedora Cloud Server",
+			"chrony",
+			"systemd-udev",
+			"langpacks-en",
+			"open-vm-tools",
+		},
+		Exclude: []string{
+			"dracut-config-rescue",
+			"etables",
+			"firewalld",
+			"geolite2-city",
+			"geolite2-country",
+			"gobject-introspection",
+			"plymouth",
+			"zram-generator-defaults",
+			"grubby-deprecated",
+			"extlinux-bootloader",
+		},
+	}
+
+	return ps
+}
+
+// fedora iot commit OS package set
+func iotCommitPackageSet(t *imageType) rpmmd.PackageSet {
+	ps := rpmmd.PackageSet{
+		Include: []string{
+			"fedora-release-iot",
+			"glibc",
+			"glibc-minimal-langpack",
+			"nss-altfiles",
+			"sssd-client",
+			"libsss_sudo",
+			"shadow-utils",
+			"dracut-network",
+			"polkit",
+			"lvm2",
+			"cryptsetup",
+			"pinentry",
+			"keyutils",
+			"cracklib-dicts",
+			"e2fsprogs",
+			"xfsprogs",
+			"dosfstools",
+			"gnupg2",
+			"basesystem",
+			"python3",
+			"bash",
+			"xz",
+			"gzip",
+			"coreutils",
+			"which",
+			"curl",
+			"firewalld",
+			"iptables",
+			"NetworkManager",
+			"NetworkManager-wifi",
+			"NetworkManager-wwan",
+			"wpa_supplicant",
+			"iwd",
+			"tpm2-pkcs11",
+			"dnsmasq",
+			"traceroute",
+			"hostname",
+			"iproute",
+			"iputils",
+			"openssh-clients",
+			"openssh-server",
+			"passwd",
+			"policycoreutils",
+			"procps-ng",
+			"rootfiles",
+			"rpm",
+			"smartmontools-selinux",
+			"setup",
+			"shadow-utils",
+			"sudo",
+			"systemd",
+			"util-linux",
+			"vim-minimal",
+			"less",
+			"tar",
+			"fwupd",
+			"usbguard",
+			"greenboot",
+			"ignition",
+			"zezere-ignition",
+			"rsync",
+			"attr",
+			"ima-evm-utils",
+			"bash-completion",
+			"tmux",
+			"screen",
+			"policycoreutils-python-utils",
+			"setools-console",
+			"audit",
+			"rng-tools",
+			"chrony",
+			"bluez",
+			"bluez-libs",
+			"bluez-mesh",
+			"kernel-tools",
+			"libgpiod-utils",
+			"podman",
+			"container-selinux",
+			"skopeo",
+			"criu",
+			"slirp4netns",
+			"fuse-overlayfs",
+			"clevis",
+			"clevis-dracut",
+			"clevis-luks",
+			"clevis-pin-tpm2",
+			"parsec",
+			"dbus-parsec",
+			"iwl7260-firmware",
+			"iwlax2xx-firmware",
+			"greenboot-default-health-checks",
+		},
+	}
+
+	return ps
+
+}
+
+// INSTALLER PACKAGE SET
+
+func installerPackageSet(t *imageType) rpmmd.PackageSet {
+	ps := rpmmd.PackageSet{
+		Include: []string{
+			"anaconda-dracut",
+			"curl",
+			"dracut-config-generic",
+			"dracut-network",
+			"hostname",
+			"iwl100-firmware",
+			"iwl1000-firmware",
+			"iwl105-firmware",
+			"iwl135-firmware",
+			"iwl2000-firmware",
+			"iwl2030-firmware",
+			"iwl3160-firmware",
+			"iwl5000-firmware",
+			"iwl5150-firmware",
+			"iwl6050-firmware",
+			"iwl7260-firmware",
+			"kernel",
+			"less",
+			"nfs-utils",
+			"openssh-clients",
+			"ostree",
+			"plymouth",
+			"rng-tools",
+			"rpcbind",
+			"selinux-policy-targeted",
+			"systemd",
+			"tar",
+			"xfsprogs",
+			"xz",
+		},
+	}
+
+	return ps
+}
+
+func anacondaPackageSet(t *imageType) rpmmd.PackageSet {
+
+	// common installer packages
+	ps := installerPackageSet(t)
+
+	ps = ps.Append(rpmmd.PackageSet{
+		Include: []string{
+			"aajohan-comfortaa-fonts",
+			"abattis-cantarell-fonts",
+			"alsa-firmware",
+			"alsa-tools-firmware",
+			"anaconda",
+			"anaconda-dracut",
+			"anaconda-install-env-deps",
+			"anaconda-widgets",
+			"audit",
+			"bind-utils",
+			"bitmap-fangsongti-fonts",
+			"bzip2",
+			"cryptsetup",
+			"curl",
+			"dbus-x11",
+			"dejavu-sans-fonts",
+			"dejavu-sans-mono-fonts",
+			"device-mapper-persistent-data",
+			"dmidecode",
+			"dnf",
+			"dracut-config-generic",
+			"dracut-network",
+			"efibootmgr",
+			"ethtool",
+			"fcoe-utils",
+			"ftp",
+			"gdb-gdbserver",
+			"gdisk",
+			"glibc-all-langpacks",
+			"gnome-kiosk",
+			"google-noto-sans-cjk-ttc-fonts",
+			"grub2-tools",
+			"grub2-tools-extra",
+			"grub2-tools-minimal",
+			"grubby",
+			"gsettings-desktop-schemas",
+			"hdparm",
+			"hexedit",
+			"hostname",
+			"initscripts",
+			"ipmitool",
+			"iwl1000-firmware",
+			"iwl100-firmware",
+			"iwl105-firmware",
+			"iwl135-firmware",
+			"iwl2000-firmware",
+			"iwl2030-firmware",
+			"iwl3160-firmware",
+			"iwl5000-firmware",
+			"iwl5150-firmware",
+			"iwl6000g2a-firmware",
+			"iwl6000g2b-firmware",
+			"iwl6050-firmware",
+			"iwl7260-firmware",
+			"jomolhari-fonts",
+			"kacst-farsi-fonts",
+			"kacst-qurn-fonts",
+			"kbd",
+			"kbd-misc",
+			"kdump-anaconda-addon",
+			"kernel",
+			"khmeros-base-fonts",
+			"less",
+			"libblockdev-lvm-dbus",
+			"libibverbs",
+			"libreport-plugin-bugzilla",
+			"libreport-plugin-reportuploader",
+			"librsvg2",
+			"linux-firmware",
+			"lldpad",
+			"lohit-assamese-fonts",
+			"lohit-bengali-fonts",
+			"lohit-devanagari-fonts",
+			"lohit-gujarati-fonts",
+			"lohit-gurmukhi-fonts",
+			"lohit-kannada-fonts",
+			"lohit-odia-fonts",
+			"lohit-tamil-fonts",
+			"lohit-telugu-fonts",
+			"lsof",
+			"madan-fonts",
+			"mtr",
+			"mt-st",
+			"net-tools",
+			"nfs-utils",
+			"nmap-ncat",
+			"nm-connection-editor",
+			"nss-tools",
+			"openssh-clients",
+			"openssh-server",
+			"oscap-anaconda-addon",
+			"ostree",
+			"pciutils",
+			"perl-interpreter",
+			"pigz",
+			"plymouth",
+			"python3-pyatspi",
+			"rdma-core",
+			"rit-meera-new-fonts",
+			"rng-tools",
+			"rpcbind",
+			"rpm-ostree",
+			"rsync",
+			"rsyslog",
+			"selinux-policy-targeted",
+			"sg3_utils",
+			"sil-abyssinica-fonts",
+			"sil-padauk-fonts",
+			"sil-scheherazade-new-fonts",
+			"smartmontools",
+			"spice-vdagent",
+			"strace",
+			"systemd",
+			"tar",
+			"thai-scalable-waree-fonts",
+			"tigervnc-server-minimal",
+			"tigervnc-server-module",
+			"udisks2",
+			"udisks2-iscsi",
+			"usbutils",
+			"vim-minimal",
+			"volume_key",
+			"wget",
+			"xfsdump",
+			"xfsprogs",
+			"xorg-x11-drivers",
+			"xorg-x11-fonts-misc",
+			"xorg-x11-server-Xorg",
+			"xorg-x11-xauth",
+			"metacity",
+			"xrdb",
+			"xz",
+		},
+	})
+
+	if common.VersionLessThan(t.arch.distro.osVersion, "39") {
+		ps = ps.Append(rpmmd.PackageSet{
+			Include: []string{
+				"lklug-fonts", // orphaned, unavailable in F39
+			},
+		})
+	}
+
+	switch t.Arch().Name() {
+	case platform.ARCH_X86_64.String():
+		ps = ps.Append(rpmmd.PackageSet{
+			Include: []string{
+				"biosdevname",
+				"dmidecode",
+				"grub2-tools-efi",
+				"memtest86+",
+			},
+		})
+
+	case platform.ARCH_AARCH64.String():
+		ps = ps.Append(rpmmd.PackageSet{
+			Include: []string{
+				"dmidecode",
+			},
+		})
+
+	default:
+		panic(fmt.Sprintf("unsupported arch: %s", t.Arch().Name()))
+	}
+
+	return ps
+}
+
+func iotInstallerPackageSet(t *imageType) rpmmd.PackageSet {
+	// include anaconda packages
+	ps := anacondaPackageSet(t)
+
+	releasever := t.Arch().Distro().Releasever()
+	version, err := strconv.Atoi(releasever)
+	if err != nil {
+		panic("cannot convert releasever to int: " + err.Error())
+	}
+
+	if version >= 38 {
+		ps = ps.Append(rpmmd.PackageSet{
+			Include: []string{
+				"fedora-release-iot",
+			},
+		})
+	}
+
+	return ps
+}
+
+func liveInstallerPackageSet(t *imageType) rpmmd.PackageSet {
+	ps := rpmmd.PackageSet{
+		Include: []string{
+			"@workstation-product-environment",
+			"@anaconda-tools",
+			"anaconda-install-env-deps",
+			"anaconda-live",
+			"anaconda-dracut",
+			"dracut-live",
+			"glibc-all-langpacks",
+			"kernel",
+			"kernel-modules",
+			"kernel-modules-extra",
+			"livesys-scripts",
+			"rng-tools",
+			"rdma-core",
+			"gnome-kiosk",
+		},
+		Exclude: []string{
+			"@dial-up",
+			"@input-methods",
+			"@standard",
+			"device-mapper-multipath",
+			"fcoe-utils",
+			"gfs2-utils",
+			"reiserfs-utils",
+		},
+	}
+
+	// We want to generate a preview image when rawhide is built
+	if !common.VersionLessThan(t.arch.distro.osVersion, "39") {
+		ps = ps.Append(rpmmd.PackageSet{
+			Include: []string{
+				"anaconda-webui",
+			},
+		})
+	}
+
+	return ps
+}
+
+func imageInstallerPackageSet(t *imageType) rpmmd.PackageSet {
+	ps := anacondaPackageSet(t)
+
+	releasever := t.Arch().Distro().Releasever()
+	version, err := strconv.Atoi(releasever)
+	if err != nil {
+		panic("cannot convert releasever to int: " + err.Error())
+	}
+
+	// We want to generate a preview image when rawhide is built
+	if version >= 38 {
+		ps = ps.Append(rpmmd.PackageSet{
+			Include: []string{
+				"anaconda-webui",
+			},
+		})
+	}
+
+	return ps
+}
+
+func containerPackageSet(t *imageType) rpmmd.PackageSet {
+	ps := rpmmd.PackageSet{
+		Include: []string{
+			"bash",
+			"coreutils",
+			"dnf-yum",
+			"dnf",
+			"fedora-release-container",
+			"fedora-repos-modular",
+			"glibc-minimal-langpack",
+			"rootfiles",
+			"rpm",
+			"sudo",
+			"tar",
+			"util-linux-core",
+			"vim-minimal",
+		},
+		Exclude: []string{
+			"crypto-policies-scripts",
+			"dbus-broker",
+			"deltarpm",
+			"dosfstools",
+			"e2fsprogs",
+			"elfutils-debuginfod-client",
+			"fuse-libs",
+			"gawk-all-langpacks",
+			"glibc-gconv-extra",
+			"glibc-langpack-en",
+			"gnupg2-smime",
+			"grubby",
+			"kernel-core",
+			"kernel-debug-core",
+			"kernel",
+			"langpacks-en_GB",
+			"langpacks-en",
+			"libss",
+			"libxcrypt-compat",
+			"nano",
+			"openssl-pkcs11",
+			"pinentry",
+			"python3-unbound",
+			"shared-mime-info",
+			"sssd-client",
+			"sudo-python-plugin",
+			"systemd",
+			"trousers",
+			"whois-nls",
+			"xkeyboard-config",
+		},
+	}
+
+	return ps
+}
+
+func minimalrpmPackageSet(t *imageType) rpmmd.PackageSet {
+	return rpmmd.PackageSet{
+		Include: []string{
+			"@core",
+		},
+	}
+}

vendor/github.com/osbuild/images/pkg/distro/fedora/partition_tables.go

@@ -0,0 +1,202 @@
+package fedora
+
+import (
+	"github.com/osbuild/images/internal/common"
+	"github.com/osbuild/images/pkg/disk"
+	"github.com/osbuild/images/pkg/distro"
+	"github.com/osbuild/images/pkg/platform"
+)
+
+var defaultBasePartitionTables = distro.BasePartitionTableMap{
+	platform.ARCH_X86_64.String(): disk.PartitionTable{
+		UUID: "D209C89E-EA5E-4FBD-B161-B461CCE297E0",
+		Type: "gpt",
+		Partitions: []disk.Partition{
+			{
+				Size:     1 * common.MebiByte, // 1MB
+				Bootable: true,
+				Type:     disk.BIOSBootPartitionGUID,
+				UUID:     disk.BIOSBootPartitionUUID,
+			},
+			{
+				Size: 200 * common.MebiByte, // 200 MB
+				Type: disk.EFISystemPartitionGUID,
+				UUID: disk.EFISystemPartitionUUID,
+				Payload: &disk.Filesystem{
+					Type:         "vfat",
+					UUID:         disk.EFIFilesystemUUID,
+					Mountpoint:   "/boot/efi",
+					Label:        "EFI-SYSTEM",
+					FSTabOptions: "defaults,uid=0,gid=0,umask=077,shortname=winnt",
+					FSTabFreq:    0,
+					FSTabPassNo:  2,
+				},
+			},
+			{
+				Size: 500 * common.MebiByte, // 500 MB
+				Type: disk.FilesystemDataGUID,
+				UUID: disk.FilesystemDataUUID,
+				Payload: &disk.Filesystem{
+					Type:         "ext4",
+					Mountpoint:   "/boot",
+					Label:        "boot",
+					FSTabOptions: "defaults",
+					FSTabFreq:    0,
+					FSTabPassNo:  0,
+				},
+			},
+			{
+				Size: 2 * common.GibiByte, // 2GiB
+				Type: disk.FilesystemDataGUID,
+				UUID: disk.RootPartitionUUID,
+				Payload: &disk.Filesystem{
+					Type:         "ext4",
+					Label:        "root",
+					Mountpoint:   "/",
+					FSTabOptions: "defaults",
+					FSTabFreq:    0,
+					FSTabPassNo:  0,
+				},
+			},
+		},
+	},
+	platform.ARCH_AARCH64.String(): disk.PartitionTable{
+		UUID: "D209C89E-EA5E-4FBD-B161-B461CCE297E0",
+		Type: "gpt",
+		Partitions: []disk.Partition{
+			{
+				Size: 200 * common.MebiByte, // 200 MB
+				Type: disk.EFISystemPartitionGUID,
+				UUID: disk.EFISystemPartitionUUID,
+				Payload: &disk.Filesystem{
+					Type:         "vfat",
+					UUID:         disk.EFIFilesystemUUID,
+					Mountpoint:   "/boot/efi",
+					Label:        "EFI-SYSTEM",
+					FSTabOptions: "defaults,uid=0,gid=0,umask=077,shortname=winnt",
+					FSTabFreq:    0,
+					FSTabPassNo:  2,
+				},
+			},
+			{
+				Size: 500 * common.MebiByte, // 500 MB
+				Type: disk.FilesystemDataGUID,
+				UUID: disk.FilesystemDataUUID,
+				Payload: &disk.Filesystem{
+					Type:         "ext4",
+					Mountpoint:   "/boot",
+					Label:        "boot",
+					FSTabOptions: "defaults",
+					FSTabFreq:    0,
+					FSTabPassNo:  0,
+				},
+			},
+			{
+				Size: 2 * common.GibiByte, // 2GiB
+				Type: disk.FilesystemDataGUID,
+				UUID: disk.RootPartitionUUID,
+				Payload: &disk.Filesystem{
+					Type:         "ext4",
+					Label:        "root",
+					Mountpoint:   "/",
+					FSTabOptions: "defaults",
+					FSTabFreq:    0,
+					FSTabPassNo:  0,
+				},
+			},
+		},
+	},
+}
+
+var iotBasePartitionTables = distro.BasePartitionTableMap{
+	platform.ARCH_X86_64.String(): disk.PartitionTable{
+		UUID: "D209C89E-EA5E-4FBD-B161-B461CCE297E0",
+		Type: "gpt",
+		Partitions: []disk.Partition{
+			{
+				Size: 501 * common.MebiByte, // 501 MiB
+				Type: disk.EFISystemPartitionGUID,
+				UUID: disk.EFISystemPartitionUUID,
+				Payload: &disk.Filesystem{
+					Type:         "vfat",
+					UUID:         disk.EFIFilesystemUUID,
+					Mountpoint:   "/boot/efi",
+					Label:        "EFI-SYSTEM",
+					FSTabOptions: "umask=0077,shortname=winnt",
+					FSTabFreq:    0,
+					FSTabPassNo:  2,
+				},
+			},
+			{
+				Size: 1 * common.GibiByte, // 1 GiB
+				Type: disk.FilesystemDataGUID,
+				UUID: disk.FilesystemDataUUID,
+				Payload: &disk.Filesystem{
+					Type:         "ext4",
+					Mountpoint:   "/boot",
+					Label:        "boot",
+					FSTabOptions: "defaults",
+					FSTabFreq:    1,
+					FSTabPassNo:  2,
+				},
+			},
+			{
+				Size: 2569 * common.MebiByte, // 2.5 GiB
+				Type: disk.FilesystemDataGUID,
+				UUID: disk.RootPartitionUUID,
+				Payload: &disk.Filesystem{
+					Type:         "ext4",
+					Label:        "root",
+					Mountpoint:   "/",
+					FSTabOptions: "defaults",
+					FSTabFreq:    1,
+					FSTabPassNo:  1,
+				},
+			},
+		},
+	},
+	platform.ARCH_AARCH64.String(): disk.PartitionTable{
+		UUID: "0xc1748067",
+		Type: "dos",
+		Partitions: []disk.Partition{
+			{
+				Size:     501 * common.MebiByte, // 501 MiB
+				Type:     "06",
+				Bootable: true,
+				Payload: &disk.Filesystem{
+					Type:         "vfat",
+					UUID:         disk.EFIFilesystemUUID,
+					Mountpoint:   "/boot/efi",
+					Label:        "EFI-SYSTEM",
+					FSTabOptions: "umask=0077,shortname=winnt",
+					FSTabFreq:    0,
+					FSTabPassNo:  2,
+				},
+			},
+			{
+				Size: 1 * common.GibiByte, // 1 GiB
+				Type: "83",
+				Payload: &disk.Filesystem{
+					Type:         "ext4",
+					Mountpoint:   "/boot",
+					Label:        "boot",
+					FSTabOptions: "defaults",
+					FSTabFreq:    1,
+					FSTabPassNo:  2,
+				},
+			},
+			{
+				Size: 2569 * common.MebiByte, // 2.5 GiB
+				Type: "83",
+				Payload: &disk.Filesystem{
+					Type:         "ext4",
+					Label:        "root",
+					Mountpoint:   "/",
+					FSTabOptions: "defaults",
+					FSTabFreq:    1,
+					FSTabPassNo:  1,
+				},
+			},
+		},
+	},
+}

vendor/github.com/osbuild/images/pkg/distro/image_config.go

@@ -0,0 +1,89 @@
+package distro
+
+import (
+	"fmt"
+	"reflect"
+
+	"github.com/osbuild/images/internal/shell"
+	"github.com/osbuild/images/pkg/osbuild"
+	"github.com/osbuild/images/pkg/subscription"
+)
+
+// ImageConfig represents a (default) configuration applied to the image
+type ImageConfig struct {
+	Timezone            *string
+	TimeSynchronization *osbuild.ChronyStageOptions
+	Locale              *string
+	Keyboard            *osbuild.KeymapStageOptions
+	EnabledServices     []string
+	DisabledServices    []string
+	DefaultTarget       *string
+	Sysconfig           []*osbuild.SysconfigStageOptions
+
+	// List of files from which to import GPG keys into the RPM database
+	GPGKeyFiles []string
+
+	// Disable SELinux labelling
+	NoSElinux *bool
+
+	// Do not use. Forces auto-relabelling on first boot.
+	// See https://github.com/osbuild/osbuild/commit/52cb27631b587c1df177cd17625c5b473e1e85d2
+	SELinuxForceRelabel *bool
+
+	// Disable documentation
+	ExcludeDocs *bool
+
+	ShellInit []shell.InitFile
+
+	// for RHSM configuration, we need to potentially distinguish the case
+	// when the user want the image to be subscribed on first boot and when not
+	RHSMConfig          map[subscription.RHSMStatus]*osbuild.RHSMStageOptions
+	SystemdLogind       []*osbuild.SystemdLogindStageOptions
+	CloudInit           []*osbuild.CloudInitStageOptions
+	Modprobe            []*osbuild.ModprobeStageOptions
+	DracutConf          []*osbuild.DracutConfStageOptions
+	SystemdUnit         []*osbuild.SystemdUnitStageOptions
+	Authselect          *osbuild.AuthselectStageOptions
+	SELinuxConfig       *osbuild.SELinuxConfigStageOptions
+	Tuned               *osbuild.TunedStageOptions
+	Tmpfilesd           []*osbuild.TmpfilesdStageOptions
+	PamLimitsConf       []*osbuild.PamLimitsConfStageOptions
+	Sysctld             []*osbuild.SysctldStageOptions
+	DNFConfig           []*osbuild.DNFConfigStageOptions
+	SshdConfig          *osbuild.SshdConfigStageOptions
+	Authconfig          *osbuild.AuthconfigStageOptions
+	PwQuality           *osbuild.PwqualityConfStageOptions
+	WAAgentConfig       *osbuild.WAAgentConfStageOptions
+	Grub2Config         *osbuild.GRUB2Config
+	DNFAutomaticConfig  *osbuild.DNFAutomaticConfigStageOptions
+	YumConfig           *osbuild.YumConfigStageOptions
+	YUMRepos            []*osbuild.YumReposStageOptions
+	Firewall            *osbuild.FirewallStageOptions
+	UdevRules           *osbuild.UdevRulesStageOptions
+	GCPGuestAgentConfig *osbuild.GcpGuestAgentConfigOptions
+}
+
+// InheritFrom inherits unset values from the provided parent configuration and
+// returns a new structure instance, which is a result of the inheritance.
+func (c *ImageConfig) InheritFrom(parentConfig *ImageConfig) *ImageConfig {
+	finalConfig := ImageConfig(*c)
+	if parentConfig != nil {
+		// iterate over all struct fields and copy unset values from the parent
+		for i := 0; i < reflect.TypeOf(*c).NumField(); i++ {
+			fieldName := reflect.TypeOf(*c).Field(i).Name
+			field := reflect.ValueOf(&finalConfig).Elem().FieldByName(fieldName)
+
+			// Only container types or pointer are supported.
+			// The reason is that with basic types, we can't distinguish between unset value and zero value.
+			if kind := field.Kind(); kind != reflect.Ptr && kind != reflect.Slice && kind != reflect.Map {
+				panic(fmt.Sprintf("unsupported field type: %s (only container types or pointer are supported)",
+					field.Kind()))
+			}
+
+			if field.IsNil() {
+				field.Set(reflect.ValueOf(parentConfig).Elem().FieldByName(fieldName))
+			}
+		}
+	}
+	return &finalConfig
+}

vendor/github.com/osbuild/images/pkg/distro/rhel7/azure.go

@@ -0,0 +1,384 @@
+package rhel7
+
+import (
+	"github.com/osbuild/images/internal/common"
+	"github.com/osbuild/images/pkg/disk"
+	"github.com/osbuild/images/pkg/distro"
+	"github.com/osbuild/images/pkg/osbuild"
+	"github.com/osbuild/images/pkg/platform"
+	"github.com/osbuild/images/pkg/rpmmd"
+	"github.com/osbuild/images/pkg/subscription"
+)
+
+var azureRhuiImgType = imageType{
+	name:        "azure-rhui",
+	filename:    "disk.vhd.xz",
+	mimeType:    "application/xz",
+	compression: "xz",
+	packageSets: map[string]packageSetFunc{
+		osPkgsKey: azureRhuiCommonPackageSet,
+	},
+	packageSetChains: map[string][]string{
+		osPkgsKey: {osPkgsKey, blueprintPkgsKey},
+	},
+	defaultImageConfig:  azureDefaultImgConfig,
+	kernelOptions:       "ro crashkernel=auto console=tty1 console=ttyS0 earlyprintk=ttyS0 rootdelay=300 scsi_mod.use_blk_mq=y",
+	bootable:            true,
+	defaultSize:         64 * common.GibiByte,
+	image:               liveImage,
+	buildPipelines:      []string{"build"},
+	payloadPipelines:    []string{"os", "image", "vpc", "xz"},
+	exports:             []string{"xz"},
+	basePartitionTables: azureRhuiBasePartitionTables,
+}
+
+var azureDefaultImgConfig = &distro.ImageConfig{
+	Timezone: common.ToPtr("Etc/UTC"),
+	Locale:   common.ToPtr("en_US.UTF-8"),
+	GPGKeyFiles: []string{
+		"/etc/pki/rpm-gpg/RPM-GPG-KEY-microsoft-azure-release",
+		"/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release",
+	},
+	SELinuxForceRelabel: common.ToPtr(true),
+	Authconfig:          &osbuild.AuthconfigStageOptions{},
+	Sysconfig: []*osbuild.SysconfigStageOptions{
+		{
+			Kernel: &osbuild.SysconfigKernelOptions{
+				UpdateDefault: true,
+				DefaultKernel: "kernel-core",
+			},
+			Network: &osbuild.SysconfigNetworkOptions{
+				Networking: true,
+				NoZeroConf: true,
+			},
+		},
+	},
+	EnabledServices: []string{
+		"cloud-config",
+		"cloud-final",
+		"cloud-init-local",
+		"cloud-init",
+		"firewalld",
+		"NetworkManager",
+		"sshd",
+		"waagent",
+	},
+	SshdConfig: &osbuild.SshdConfigStageOptions{
+		Config: osbuild.SshdConfigConfig{
+			ClientAliveInterval: common.ToPtr(180),
+		},
+	},
+	Modprobe: []*osbuild.ModprobeStageOptions{
+		{
+			Filename: "blacklist-amdgpu.conf",
+			Commands: osbuild.ModprobeConfigCmdList{
+				osbuild.NewModprobeConfigCmdBlacklist("amdgpu"),
+			},
+		},
+		{
+			Filename: "blacklist-intel-cstate.conf",
+			Commands: osbuild.ModprobeConfigCmdList{
+				osbuild.NewModprobeConfigCmdBlacklist("intel_cstate"),
+			},
+		},
+		{
+			Filename: "blacklist-floppy.conf",
+			Commands: osbuild.ModprobeConfigCmdList{
+				osbuild.NewModprobeConfigCmdBlacklist("floppy"),
+			},
+		},
+		{
+			Filename: "blacklist-nouveau.conf",
+			Commands: osbuild.ModprobeConfigCmdList{
+				osbuild.NewModprobeConfigCmdBlacklist("nouveau"),
+				osbuild.NewModprobeConfigCmdBlacklist("lbm-nouveau"),
+			},
+		},
+		{
+			Filename: "blacklist-skylake-edac.conf",
+			Commands: osbuild.ModprobeConfigCmdList{
+				osbuild.NewModprobeConfigCmdBlacklist("skx_edac"),
+			},
+		},
+	},
+	CloudInit: []*osbuild.CloudInitStageOptions{
+		{
+			Filename: "06_logging_override.cfg",
+			Config: osbuild.CloudInitConfigFile{
+				Output: &osbuild.CloudInitConfigOutput{
+					All: common.ToPtr("| tee -a /var/log/cloud-init-output.log"),
+				},
+			},
+		},
+		{
+			Filename: "10-azure-kvp.cfg",
+			Config: osbuild.CloudInitConfigFile{
+				Reporting: &osbuild.CloudInitConfigReporting{
+					Logging: &osbuild.CloudInitConfigReportingHandlers{
+						Type: "log",
+					},
+					Telemetry: &osbuild.CloudInitConfigReportingHandlers{
+						Type: "hyperv",
+					},
+				},
+			},
+		},
+		{
+			Filename: "91-azure_datasource.cfg",
+			Config: osbuild.CloudInitConfigFile{
+				Datasource: &osbuild.CloudInitConfigDatasource{
+					Azure: &osbuild.CloudInitConfigDatasourceAzure{
+						ApplyNetworkConfig: false,
+					},
+				},
+				DatasourceList: []string{
+					"Azure",
+				},
+			},
+		},
+	},
+	PwQuality: &osbuild.PwqualityConfStageOptions{
+		Config: osbuild.PwqualityConfConfig{
+			Minlen:   common.ToPtr(6),
+			Minclass: common.ToPtr(3),
+			Dcredit:  common.ToPtr(0),
+			Ucredit:  common.ToPtr(0),
+			Lcredit:  common.ToPtr(0),
+			Ocredit:  common.ToPtr(0),
+		},
+	},
+	WAAgentConfig: &osbuild.WAAgentConfStageOptions{
+		Config: osbuild.WAAgentConfig{
+			RDFormat:     common.ToPtr(false),
+			RDEnableSwap: common.ToPtr(false),
+		},
+	},
+	RHSMConfig: map[subscription.RHSMStatus]*osbuild.RHSMStageOptions{
+		subscription.RHSMConfigNoSubscription: {
+			YumPlugins: &osbuild.RHSMStageOptionsDnfPlugins{
+				SubscriptionManager: &osbuild.RHSMStageOptionsDnfPlugin{
+					Enabled: false,
+				},
+			},
+			SubMan: &osbuild.RHSMStageOptionsSubMan{
+				Rhsmcertd: &osbuild.SubManConfigRHSMCERTDSection{
+					AutoRegistration: common.ToPtr(true),
+				},
+				Rhsm: &osbuild.SubManConfigRHSMSection{
+					ManageRepos: common.ToPtr(false),
+				},
+			},
+		},
+		subscription.RHSMConfigWithSubscription: {
+			SubMan: &osbuild.RHSMStageOptionsSubMan{
+				Rhsmcertd: &osbuild.SubManConfigRHSMCERTDSection{
+					AutoRegistration: common.ToPtr(true),
+				},
+				// do not disable the redhat.repo management if the user
+				// explicitly request the system to be subscribed
+			},
+		},
+	},
+	Grub2Config: &osbuild.GRUB2Config{
+		TerminalInput:  []string{"serial", "console"},
+		TerminalOutput: []string{"serial", "console"},
+		Serial:         "serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1",
+		Timeout:        10,
+	},
+	UdevRules: &osbuild.UdevRulesStageOptions{
+		Filename: "/etc/udev/rules.d/68-azure-sriov-nm-unmanaged.rules",
+		Rules: osbuild.UdevRules{
+			osbuild.UdevRuleComment{
+				Comment: []string{
+					"Accelerated Networking on Azure exposes a new SRIOV interface to the VM.",
+					"This interface is transparently bonded to the synthetic interface,",
+					"so NetworkManager should just ignore any SRIOV interfaces.",
+				},
+			},
+			osbuild.NewUdevRule(
+				[]osbuild.UdevKV{
+					{K: "SUBSYSTEM", O: "==", V: "net"},
+					{K: "DRIVERS", O: "==", V: "hv_pci"},
+					{K: "ACTION", O: "==", V: "add"},
+					{K: "ENV", A: "NM_UNMANAGED", O: "=", V: "1"},
+				},
+			),
+		},
+	},
+	YumConfig: &osbuild.YumConfigStageOptions{
+		Config: &osbuild.YumConfigConfig{
+			HttpCaching: common.ToPtr("packages"),
+		},
+		Plugins: &osbuild.YumConfigPlugins{
+			Langpacks: &osbuild.YumConfigPluginsLangpacks{
+				Locales: []string{"en_US.UTF-8"},
+			},
+		},
+	},
+	DefaultTarget: common.ToPtr("multi-user.target"),
+}
+
+func azureRhuiCommonPackageSet(t *imageType) rpmmd.PackageSet {
+	ps := rpmmd.PackageSet{
+		Include: []string{
+			"@base",
+			"@core",
+			"authconfig",
+			"bpftool",
+			"bzip2",
+			"chrony",
+			"cloud-init",
+			"cloud-utils-growpart",
+			"dracut-config-generic",
+			"dracut-norescue",
+			"efibootmgr",
+			"firewalld",
+			"gdisk",
+			"grub2-efi-x64",
+			"grub2-pc",
+			"grub2",
+			"hyperv-daemons",
+			"kernel",
+			"lvm2",
+			"redhat-release-eula",
+			"redhat-support-tool",
+			"rh-dotnetcore11",
+			"rhn-setup",
+			"rhui-azure-rhel7",
+			"rsync",
+			"shim-x64",
+			"tar",
+			"tcpdump",
+			"WALinuxAgent",
+			"yum-rhn-plugin",
+			"yum-utils",
+		},
+		Exclude: []string{
+			"dracut-config-rescue",
+			"mariadb-libs",
+			"NetworkManager-config-server",
+			"postfix",
+		},
+	}
+
+	if t.arch.distro.isRHEL() {
+		ps = ps.Append(rpmmd.PackageSet{
+			Include: []string{
+				"insights-client",
+			},
+		})
+	}
+
+	return ps
+}
+
+var azureRhuiBasePartitionTables = distro.BasePartitionTableMap{
+	platform.ARCH_X86_64.String(): disk.PartitionTable{
+		UUID: "D209C89E-EA5E-4FBD-B161-B461CCE297E0",
+		Type: "gpt",
+		Size: 64 * common.GibiByte,
+		Partitions: []disk.Partition{
+			{
+				Size: 500 * common.MebiByte,
+				Type: disk.EFISystemPartitionGUID,
+				UUID: disk.EFISystemPartitionUUID,
+				Payload: &disk.Filesystem{
+					Type:         "vfat",
+					UUID:         disk.EFIFilesystemUUID,
+					Mountpoint:   "/boot/efi",
+					FSTabOptions: "defaults,uid=0,gid=0,umask=077,shortname=winnt",
+					FSTabFreq:    0,
+					FSTabPassNo:  2,
+				},
+			},
+			{
+				Size: 500 * common.MebiByte,
+				Type: disk.FilesystemDataGUID,
+				UUID: disk.FilesystemDataUUID,
+				Payload: &disk.Filesystem{
+					Type:         "xfs",
+					Mountpoint:   "/boot",
+					FSTabOptions: "defaults",
+					FSTabFreq:    0,
+					FSTabPassNo:  0,
+				},
+			},
+			{
+				Size:     2 * common.MebiByte,
+				Bootable: true,
+				Type:     disk.BIOSBootPartitionGUID,
+				UUID:     disk.BIOSBootPartitionUUID,
+			},
+			{
+				Type: disk.LVMPartitionGUID,
+				UUID: disk.RootPartitionUUID,
+				Payload: &disk.LVMVolumeGroup{
+					Name:        "rootvg",
+					Description: "built with lvm2 and osbuild",
+					LogicalVolumes: []disk.LVMLogicalVolume{
+						{
+							Size: 1 * common.GibiByte,
+							Name: "homelv",
+							Payload: &disk.Filesystem{
+								Type:         "xfs",
+								Label:        "home",
+								Mountpoint:   "/home",
+								FSTabOptions: "defaults",
+								FSTabFreq:    0,
+								FSTabPassNo:  0,
+							},
+						},
+						{
+							Size: 2 * common.GibiByte,
+							Name: "rootlv",
+							Payload: &disk.Filesystem{
+								Type:         "xfs",
+								Label:        "root",
+								Mountpoint:   "/",
+								FSTabOptions: "defaults",
+								FSTabFreq:    0,
+								FSTabPassNo:  0,
+							},
+						},
+						{
+							Size: 2 * common.GibiByte,
+							Name: "tmplv",
+							Payload: &disk.Filesystem{
+								Type:         "xfs",
+								Label:        "tmp",
+								Mountpoint:   "/tmp",
+								FSTabOptions: "defaults",
+								FSTabFreq:    0,
+								FSTabPassNo:  0,
+							},
+						},
+						{
+							Size: 10 * common.GibiByte,
+							Name: "usrlv",
+							Payload: &disk.Filesystem{
+								Type:         "xfs",
+								Label:        "usr",
+								Mountpoint:   "/usr",
+								FSTabOptions: "defaults",
+								FSTabFreq:    0,
+								FSTabPassNo:  0,
+							},
+						},
+						{
+							Size: 10 * common.GibiByte, // firedrill: 8 GB
+							Name: "varlv",
+							Payload: &disk.Filesystem{
+								Type:         "xfs",
+								Label:        "var",
+								Mountpoint:   "/var",
+								FSTabOptions: "defaults",
+								FSTabFreq:    0,
+								FSTabPassNo:  0,
+							},
+						},
+					},
+				},
+			},
+		},
+	},
+}

vendor/github.com/osbuild/images/pkg/distro/rhel7/distro.go

@@ -0,0 +1,235 @@
+package rhel7
+
+import (
+	"errors"
+	"fmt"
+	"sort"
+	"strings"
+
+	"github.com/osbuild/images/internal/common"
+	"github.com/osbuild/images/pkg/distro"
+	"github.com/osbuild/images/pkg/osbuild"
+	"github.com/osbuild/images/pkg/platform"
+	"github.com/osbuild/images/pkg/runner"
+)
+
+const (
+	// package set names
+
+	// main/common os image package set name
+	osPkgsKey = "os"
+
+	// blueprint package set name
+	blueprintPkgsKey = "blueprint"
+)
+
+// RHEL-based OS image configuration defaults
+var defaultDistroImageConfig = &distro.ImageConfig{
+	Timezone: common.ToPtr("America/New_York"),
+	Locale:   common.ToPtr("en_US.UTF-8"),
+	GPGKeyFiles: []string{
+		"/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release",
+	},
+	Sysconfig: []*osbuild.SysconfigStageOptions{
+		{
+			Kernel: &osbuild.SysconfigKernelOptions{
+				UpdateDefault: true,
+				DefaultKernel: "kernel",
+			},
+			Network: &osbuild.SysconfigNetworkOptions{
+				Networking: true,
+				NoZeroConf: true,
+			},
+		},
+	},
+}
+
+// distribution objects without the arches > image types
+var distroMap = map[string]distribution{
+	"rhel-7": {
+		name:               "rhel-7",
+		product:            "Red Hat Enterprise Linux",
+		osVersion:          "7.9",
+		nick:               "Maipo",
+		releaseVersion:     "7",
+		modulePlatformID:   "platform:el7",
+		vendor:             "redhat",
+		runner:             &runner.RHEL{Major: uint64(7), Minor: uint64(9)},
+		defaultImageConfig: defaultDistroImageConfig,
+	},
+}
+
+// --- Distribution ---
+type distribution struct {
+	name               string
+	product            string
+	nick               string
+	osVersion          string
+	releaseVersion     string
+	modulePlatformID   string
+	vendor             string
+	runner             runner.Runner
+	arches             map[string]distro.Arch
+	defaultImageConfig *distro.ImageConfig
+}
+
+func (d *distribution) Name() string {
+	return d.name
+}
+
+func (d *distribution) Releasever() string {
+	return d.releaseVersion
+}
+
+func (d *distribution) ModulePlatformID() string {
+	return d.modulePlatformID
+}
+
+func (d *distribution) OSTreeRef() string {
+	return "" // not supported
+}
+
+func (d *distribution) ListArches() []string {
+	archNames := make([]string, 0, len(d.arches))
+	for name := range d.arches {
+		archNames = append(archNames, name)
+	}
+	sort.Strings(archNames)
+	return archNames
+}
+
+func (d *distribution) GetArch(name string) (distro.Arch, error) {
+	arch, exists := d.arches[name]
+	if !exists {
+		return nil, errors.New("invalid architecture: " + name)
+	}
+	return arch, nil
+}
+
+func (d *distribution) addArches(arches ...architecture) {
+	if d.arches == nil {
+		d.arches = map[string]distro.Arch{}
+	}
+
+	// Do not make copies of architectures, as opposed to image types,
+	// because architecture definitions are not used by more than a single
+	// distro definition.
+	for idx := range arches {
+		d.arches[arches[idx].name] = &arches[idx]
+	}
+}
+
+func (d *distribution) isRHEL() bool {
+	return strings.HasPrefix(d.name, "rhel")
+}
+
+func (d *distribution) getDefaultImageConfig() *distro.ImageConfig {
+	return d.defaultImageConfig
+}
+
+// --- Architecture ---
+
+type architecture struct {
+	distro           *distribution
+	name             string
+	imageTypes       map[string]distro.ImageType
+	imageTypeAliases map[string]string
+}
+
+func (a *architecture) Name() string {
+	return a.name
+}
+
+func (a *architecture) ListImageTypes() []string {
+	itNames := make([]string, 0, len(a.imageTypes))
+	for name := range a.imageTypes {
+		itNames = append(itNames, name)
+	}
+	sort.Strings(itNames)
+	return itNames
+}
+
+func (a *architecture) GetImageType(name string) (distro.ImageType, error) {
+	t, exists := a.imageTypes[name]
+	if !exists {
+		aliasForName, exists := a.imageTypeAliases[name]
+		if !exists {
+			return nil, errors.New("invalid image type: " + name)
+		}
+		t, exists = a.imageTypes[aliasForName]
+		if !exists {
+			panic(fmt.Sprintf("image type '%s' is an alias to a non-existing image type '%s'", name, aliasForName))
+		}
+	}
+	return t, nil
+}
+
+func (a *architecture) addImageTypes(platform platform.Platform, imageTypes ...imageType) {
+	if a.imageTypes == nil {
+		a.imageTypes = map[string]distro.ImageType{}
+	}
+	for idx := range imageTypes {
+		it := imageTypes[idx]
+		it.arch = a
+		it.platform = platform
+		a.imageTypes[it.name] = &it
+		for _, alias := range it.nameAliases {
+			if a.imageTypeAliases == nil {
+				a.imageTypeAliases = map[string]string{}
+			}
+			if existingAliasFor, exists := a.imageTypeAliases[alias]; exists {
+				panic(fmt.Sprintf("image type alias '%s' for '%s' is already defined for another image type '%s'", alias, it.name, existingAliasFor))
+			}
+			a.imageTypeAliases[alias] = it.name
+		}
+	}
+}
+
+func (a *architecture) Distro() distro.Distro {
+	return a.distro
+}
+
+// New creates a new distro object, defining the supported architectures and image types
+func New() distro.Distro {
+	return newDistro("rhel-7")
+}
+
+func newDistro(distroName string) distro.Distro {
+
+	rd := distroMap[distroName]
+
+	// Architecture definitions
+	x86_64 := architecture{
+		name:   platform.ARCH_X86_64.String(),
+		distro: &rd,
+	}
+
+	x86_64.addImageTypes(
+		&platform.X86{
+			BIOS:       true,
+			UEFIVendor: rd.vendor,
+			BasePlatform: platform.BasePlatform{
+				ImageFormat: platform.FORMAT_QCOW2,
+				QCOW2Compat: "0.10",
+			},
+		},
+		qcow2ImgType,
+	)
+
+	x86_64.addImageTypes(
+		&platform.X86{
+			BIOS:       true,
+			UEFIVendor: rd.vendor,
+			BasePlatform: platform.BasePlatform{
+				ImageFormat: platform.FORMAT_VHD,
+			},
+		},
+		azureRhuiImgType,
+	)
+
+	rd.addArches(
+		x86_64,
+	)
+
+	return &rd
+}

vendor/github.com/osbuild/images/pkg/distro/rhel7/images.go

@@ -0,0 +1,250 @@
+package rhel7
+
+import (
+	"fmt"
+	"math/rand"
+
+	"github.com/osbuild/images/internal/common"
+	"github.com/osbuild/images/internal/users"
+	"github.com/osbuild/images/internal/workload"
+	"github.com/osbuild/images/pkg/blueprint"
+	"github.com/osbuild/images/pkg/container"
+	"github.com/osbuild/images/pkg/distro"
+	"github.com/osbuild/images/pkg/image"
+	"github.com/osbuild/images/pkg/manifest"
+	"github.com/osbuild/images/pkg/osbuild"
+	"github.com/osbuild/images/pkg/platform"
+	"github.com/osbuild/images/pkg/rpmmd"
+)
+
+func osCustomizations(
+	t *imageType,
+	osPackageSet rpmmd.PackageSet,
+	options distro.ImageOptions,
+	containers []container.SourceSpec,
+	c *blueprint.Customizations,
+) manifest.OSCustomizations {
+
+	imageConfig := t.getDefaultImageConfig()
+
+	osc := manifest.OSCustomizations{}
+
+	if t.bootable {
+		osc.KernelName = c.GetKernel().Name
+
+		var kernelOptions []string
+		if t.kernelOptions != "" {
+			kernelOptions = append(kernelOptions, t.kernelOptions)
+		}
+		if bpKernel := c.GetKernel(); bpKernel.Append != "" {
+			kernelOptions = append(kernelOptions, bpKernel.Append)
+		}
+		osc.KernelOptionsAppend = kernelOptions
+		if t.platform.GetArch() != platform.ARCH_S390X {
+			osc.KernelOptionsBootloader = true
+		}
+	}
+
+	osc.ExtraBasePackages = osPackageSet.Include
+	osc.ExcludeBasePackages = osPackageSet.Exclude
+	osc.ExtraBaseRepos = osPackageSet.Repositories
+
+	osc.Containers = containers
+
+	osc.GPGKeyFiles = imageConfig.GPGKeyFiles
+	if imageConfig.ExcludeDocs != nil {
+		osc.ExcludeDocs = *imageConfig.ExcludeDocs
+	}
+
+	// don't put users and groups in the payload of an installer
+	// add them via kickstart instead
+	osc.Groups = users.GroupsFromBP(c.GetGroups())
+	osc.Users = users.UsersFromBP(c.GetUsers())
+
+	osc.EnabledServices = imageConfig.EnabledServices
+	osc.DisabledServices = imageConfig.DisabledServices
+	if imageConfig.DefaultTarget != nil {
+		osc.DefaultTarget = *imageConfig.DefaultTarget
+	}
+
+	osc.Firewall = imageConfig.Firewall
+	if fw := c.GetFirewall(); fw != nil {
+		options := osbuild.FirewallStageOptions{
+			Ports: fw.Ports,
+		}
+
+		if fw.Services != nil {
+			options.EnabledServices = fw.Services.Enabled
+			options.DisabledServices = fw.Services.Disabled
+		}
+		if fw.Zones != nil {
+			for _, z := range fw.Zones {
+				options.Zones = append(options.Zones, osbuild.FirewallZone{
+					Name:    *z.Name,
+					Sources: z.Sources,
+				})
+			}
+		}
+		osc.Firewall = &options
+	}
+
+	language, keyboard := c.GetPrimaryLocale()
+	if language != nil {
+		osc.Language = *language
+	} else if imageConfig.Locale != nil {
+		osc.Language = *imageConfig.Locale
+	}
+	if keyboard != nil {
+		osc.Keyboard = keyboard
+	} else if imageConfig.Keyboard != nil {
+		osc.Keyboard = &imageConfig.Keyboard.Keymap
+		if imageConfig.Keyboard.X11Keymap != nil {
+			osc.X11KeymapLayouts = imageConfig.Keyboard.X11Keymap.Layouts
+		}
+	}
+
+	if hostname := c.GetHostname(); hostname != nil {
+		osc.Hostname = *hostname
+	}
+
+	timezone, ntpServers := c.GetTimezoneSettings()
+	if timezone != nil {
+		osc.Timezone = *timezone
+	} else if imageConfig.Timezone != nil {
+		osc.Timezone = *imageConfig.Timezone
+	}
+
+	if len(ntpServers) > 0 {
+		for _, server := range ntpServers {
+			osc.NTPServers = append(osc.NTPServers, osbuild.ChronyConfigServer{Hostname: server})
+		}
+	} else if imageConfig.TimeSynchronization != nil {
+		osc.NTPServers = imageConfig.TimeSynchronization.Servers
+		osc.LeapSecTZ = imageConfig.TimeSynchronization.LeapsecTz
+	}
+
+	// Relabel the tree, unless the `NoSElinux` flag is explicitly set to `true`
+	if imageConfig.NoSElinux == nil || imageConfig.NoSElinux != nil && !*imageConfig.NoSElinux {
+		osc.SElinux = "targeted"
+		osc.SELinuxForceRelabel = imageConfig.SELinuxForceRelabel
+	}
+
+	if oscapConfig := c.GetOpenSCAP(); oscapConfig != nil {
+		osc.OpenSCAPConfig = osbuild.NewOscapRemediationStageOptions(
+			osbuild.OscapConfig{
+				Datastream: oscapConfig.DataStream,
+				ProfileID:  oscapConfig.ProfileID,
+			},
+		)
+	}
+
+	if t.arch.distro.isRHEL() && options.Facts != nil {
+		osc.FactAPIType = &options.Facts.APIType
+	}
+
+	var err error
+	osc.Directories, err = blueprint.DirectoryCustomizationsToFsNodeDirectories(c.GetDirectories())
+	if err != nil {
+		// In theory this should never happen, because the blueprint directory customizations
+		// should have been validated before this point.
+		panic(fmt.Sprintf("failed to convert directory customizations to fs node directories: %v", err))
+	}
+
+	osc.Files, err = blueprint.FileCustomizationsToFsNodeFiles(c.GetFiles())
+	if err != nil {
+		// In theory this should never happen, because the blueprint file customizations
+		// should have been validated before this point.
+		panic(fmt.Sprintf("failed to convert file customizations to fs node files: %v", err))
+	}
+
+	// set yum repos first, so it doesn't get overridden by
+	// imageConfig.YUMRepos
+	osc.YUMRepos = imageConfig.YUMRepos
+
+	customRepos, err := c.GetRepositories()
+	if err != nil {
+		// This shouldn't happen and since the repos
+		// should have already been validated
+		panic(fmt.Sprintf("failed to get custom repos: %v", err))
+	}
+
+	// This function returns a map of filename and corresponding yum repos
+	// and a list of fs node files for the inline gpg keys so we can save
+	// them to disk. This step also swaps the inline gpg key with the path
+	// to the file in the os file tree
+	yumRepos, gpgKeyFiles, err := blueprint.RepoCustomizationsToRepoConfigAndGPGKeyFiles(customRepos)
+	if err != nil {
+		panic(fmt.Sprintf("failed to convert inline gpgkeys to fs node files: %v", err))
+	}
+
+	// add the gpg key files to the list of files to be added to the tree
+	if len(gpgKeyFiles) > 0 {
+		osc.Files = append(osc.Files, gpgKeyFiles...)
+	}
+
+	for filename, repos := range yumRepos {
+		osc.YUMRepos = append(osc.YUMRepos, osbuild.NewYumReposStageOptions(filename, repos))
+	}
+
+	osc.ShellInit = imageConfig.ShellInit
+
+	osc.Grub2Config = imageConfig.Grub2Config
+	osc.Sysconfig = imageConfig.Sysconfig
+	osc.SystemdLogind = imageConfig.SystemdLogind
+	osc.CloudInit = imageConfig.CloudInit
+	osc.Modprobe = imageConfig.Modprobe
+	osc.DracutConf = imageConfig.DracutConf
+	osc.SystemdUnit = imageConfig.SystemdUnit
+	osc.Authselect = imageConfig.Authselect
+	osc.SELinuxConfig = imageConfig.SELinuxConfig
+	osc.Tuned = imageConfig.Tuned
+	osc.Tmpfilesd = imageConfig.Tmpfilesd
+	osc.PamLimitsConf = imageConfig.PamLimitsConf
+	osc.Sysctld = imageConfig.Sysctld
+	osc.DNFConfig = imageConfig.DNFConfig
+	osc.DNFAutomaticConfig = imageConfig.DNFAutomaticConfig
+	osc.YUMConfig = imageConfig.YumConfig
+	osc.SshdConfig = imageConfig.SshdConfig
+	osc.AuthConfig = imageConfig.Authconfig
+	osc.PwQuality = imageConfig.PwQuality
+	osc.RHSMConfig = imageConfig.RHSMConfig
+	osc.Subscription = options.Subscription
+	osc.WAAgentConfig = imageConfig.WAAgentConfig
+	osc.UdevRules = imageConfig.UdevRules
+	osc.GCPGuestAgentConfig = imageConfig.GCPGuestAgentConfig
+
+	return osc
+}
+
+func liveImage(workload workload.Workload,
+	t *imageType,
+	customizations *blueprint.Customizations,
+	options distro.ImageOptions,
+	packageSets map[string]rpmmd.PackageSet,
+	containers []container.SourceSpec,
+	rng *rand.Rand) (image.ImageKind, error) {
+
+	img := image.NewLiveImage()
+	img.Platform = t.platform
+	img.OSCustomizations = osCustomizations(t, packageSets[osPkgsKey], options, containers, customizations)
+	img.Environment = t.environment
+	img.Workload = workload
+	img.Compression = t.compression
+	img.PartTool = osbuild.PTSgdisk     // all RHEL 7 images should use sgdisk
+	img.ForceSize = common.ToPtr(false) // RHEL 7 qemu vpc subformat does not support force_size
+	img.NoBLS = true                    // RHEL 7 grub does not support BLS
+	img.OSProduct = t.arch.distro.product
+	img.OSVersion = t.arch.distro.osVersion
+	img.OSNick = t.arch.distro.nick
+
+	// TODO: move generation into LiveImage
+	pt, err := t.getPartitionTable(customizations.GetFilesystems(), options, rng)
+	if err != nil {
+		return nil, err
+	}
+	img.PartitionTable = pt
+
+	img.Filename = t.Filename()
+
+	return img, nil
+}

vendor/github.com/osbuild/images/pkg/distro/rhel7/imagetype.go

@@ -0,0 +1,285 @@
+package rhel7
+
+import (
+	"fmt"
+	"math/rand"
+
+	"github.com/osbuild/images/internal/environment"
+	"github.com/osbuild/images/internal/pathpolicy"
+	"github.com/osbuild/images/internal/workload"
+	"github.com/osbuild/images/pkg/blueprint"
+	"github.com/osbuild/images/pkg/container"
+	"github.com/osbuild/images/pkg/disk"
+	"github.com/osbuild/images/pkg/distro"
+	"github.com/osbuild/images/pkg/image"
+	"github.com/osbuild/images/pkg/manifest"
+	"github.com/osbuild/images/pkg/platform"
+	"github.com/osbuild/images/pkg/rpmmd"
+	"golang.org/x/exp/slices"
+)
+
+type packageSetFunc func(t *imageType) rpmmd.PackageSet
+
+type imageFunc func(workload workload.Workload, t *imageType, customizations *blueprint.Customizations, options distro.ImageOptions, packageSets map[string]rpmmd.PackageSet, containers []container.SourceSpec, rng *rand.Rand) (image.ImageKind, error)
+
+type imageType struct {
+	arch               *architecture
+	platform           platform.Platform
+	environment        environment.Environment
+	workload           workload.Workload
+	name               string
+	nameAliases        []string
+	filename           string
+	compression        string // TODO: remove from image definition and make it a transport option
+	mimeType           string
+	packageSets        map[string]packageSetFunc
+	packageSetChains   map[string][]string
+	defaultImageConfig *distro.ImageConfig
+	kernelOptions      string
+	defaultSize        uint64
+	buildPipelines     []string
+	payloadPipelines   []string
+	exports            []string
+	image              imageFunc
+
+	// bootable image
+	bootable bool
+	// List of valid arches for the image type
+	basePartitionTables distro.BasePartitionTableMap
+}
+
+func (t *imageType) Name() string {
+	return t.name
+}
+
+func (t *imageType) Arch() distro.Arch {
+	return t.arch
+}
+
+func (t *imageType) Filename() string {
+	return t.filename
+}
+
+func (t *imageType) MIMEType() string {
+	return t.mimeType
+}
+
+func (t *imageType) OSTreeRef() string {
+	// Not supported
+	return ""
+}
+
+func (t *imageType) Size(size uint64) uint64 {
+	if size == 0 {
+		size = t.defaultSize
+	}
+	return size
+}
+
+func (t *imageType) BuildPipelines() []string {
+	return t.buildPipelines
+}
+
+func (t *imageType) PayloadPipelines() []string {
+	return t.payloadPipelines
+}
+
+func (t *imageType) PayloadPackageSets() []string {
+	return []string{blueprintPkgsKey}
+}
+
+func (t *imageType) PackageSetsChains() map[string][]string {
+	return t.packageSetChains
+}
+
+func (t *imageType) Exports() []string {
+	if len(t.exports) == 0 {
+		panic(fmt.Sprintf("programming error: no exports for '%s'", t.name))
+	}
+	return t.exports
+}
+
+func (t *imageType) BootMode() distro.BootMode {
+	if t.platform.GetUEFIVendor() != "" && t.platform.GetBIOSPlatform() != "" {
+		return distro.BOOT_HYBRID
+	} else if t.platform.GetUEFIVendor() != "" {
+		return distro.BOOT_UEFI
+	} else if t.platform.GetBIOSPlatform() != "" || t.platform.GetZiplSupport() {
+		return distro.BOOT_LEGACY
+	}
+	return distro.BOOT_NONE
+}
+
+func (t *imageType) getPartitionTable(
+	mountpoints []blueprint.FilesystemCustomization,
+	options distro.ImageOptions,
+	rng *rand.Rand,
+) (*disk.PartitionTable, error) {
+	archName := t.arch.Name()
+
+	basePartitionTable, exists := t.basePartitionTables[archName]
+
+	if !exists {
+		return nil, fmt.Errorf("unknown arch: " + archName)
+	}
+
+	imageSize := t.Size(options.Size)
+
+	return disk.NewPartitionTable(&basePartitionTable, mountpoints, imageSize, true, nil, rng)
+}
+
+func (t *imageType) getDefaultImageConfig() *distro.ImageConfig {
+	// ensure that image always returns non-nil default config
+	imageConfig := t.defaultImageConfig
+	if imageConfig == nil {
+		imageConfig = &distro.ImageConfig{}
+	}
+	return imageConfig.InheritFrom(t.arch.distro.getDefaultImageConfig())
+
+}
+
+func (t *imageType) PartitionType() string {
+	archName := t.arch.Name()
+	basePartitionTable, exists := t.basePartitionTables[archName]
+	if !exists {
+		return ""
+	}
+
+	return basePartitionTable.Type
+}
+
+func (t *imageType) Manifest(bp *blueprint.Blueprint,
+	options distro.ImageOptions,
+	repos []rpmmd.RepoConfig,
+	seed int64) (*manifest.Manifest, []string, error) {
+
+	warnings, err := t.checkOptions(bp, options)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	// merge package sets that appear in the image type with the package sets
+	// of the same name from the distro and arch
+	staticPackageSets := make(map[string]rpmmd.PackageSet)
+
+	for name, getter := range t.packageSets {
+		staticPackageSets[name] = getter(t)
+	}
+
+	// amend with repository information and collect payload repos
+	payloadRepos := make([]rpmmd.RepoConfig, 0)
+	for _, repo := range repos {
+		if len(repo.PackageSets) > 0 {
+			// only apply the repo to the listed package sets
+			for _, psName := range repo.PackageSets {
+				if slices.Contains(t.PayloadPackageSets(), psName) {
+					payloadRepos = append(payloadRepos, repo)
+				}
+				ps := staticPackageSets[psName]
+				ps.Repositories = append(ps.Repositories, repo)
+				staticPackageSets[psName] = ps
+			}
+		}
+	}
+
+	w := t.workload
+	if w == nil {
+		cw := &workload.Custom{
+			BaseWorkload: workload.BaseWorkload{
+				Repos: payloadRepos,
+			},
+			Packages: bp.GetPackagesEx(false),
+		}
+		if services := bp.Customizations.GetServices(); services != nil {
+			cw.Services = services.Enabled
+			cw.DisabledServices = services.Disabled
+		}
+		w = cw
+	}
+
+	containerSources := make([]container.SourceSpec, len(bp.Containers))
+	for idx := range bp.Containers {
+		containerSources[idx] = container.SourceSpec(bp.Containers[idx])
+	}
+
+	source := rand.NewSource(seed)
+	// math/rand is good enough in this case
+	/* #nosec G404 */
+	rng := rand.New(source)
+
+	if t.image == nil {
+		return nil, nil, nil
+	}
+	img, err := t.image(w, t, bp.Customizations, options, staticPackageSets, containerSources, rng)
+	if err != nil {
+		return nil, nil, err
+	}
+	mf := manifest.New()
+	mf.Distro = manifest.DISTRO_EL7
+	_, err = img.InstantiateManifest(&mf, repos, t.arch.distro.runner, rng)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return &mf, warnings, err
+}
+
+// checkOptions checks the validity and compatibility of options and customizations for the image type.
+// Returns ([]string, error) where []string, if non-nil, will hold any generated warnings (e.g. deprecation notices).
+func (t *imageType) checkOptions(bp *blueprint.Blueprint, options distro.ImageOptions) ([]string, error) {
+	customizations := bp.Customizations
+	// holds warnings (e.g. deprecation notices)
+	var warnings []string
+	if t.workload != nil {
+		// For now, if an image type defines its own workload, don't allow any
+		// user customizations.
+		// Soon we will have more workflows and each will define its allowed
+		// set of customizations.  The current set of customizations defined in
+		// the blueprint spec corresponds to the Custom workflow.
+		if customizations != nil {
+			return warnings, fmt.Errorf("image type %q does not support customizations", t.name)
+		}
+	}
+
+	if len(bp.Containers) > 0 {
+		return warnings, fmt.Errorf("embedding containers is not supported for %s on %s", t.name, t.arch.distro.name)
+	}
+
+	mountpoints := customizations.GetFilesystems()
+
+	err := blueprint.CheckMountpointsPolicy(mountpoints, pathpolicy.MountpointPolicies)
+	if err != nil {
+		return warnings, err
+	}
+
+	if osc := customizations.GetOpenSCAP(); osc != nil {
+		return warnings, fmt.Errorf(fmt.Sprintf("OpenSCAP unsupported os version: %s", t.arch.distro.osVersion))
+	}
+
+	// Check Directory/File Customizations are valid
+	dc := customizations.GetDirectories()
+	fc := customizations.GetFiles()
+
+	err = blueprint.ValidateDirFileCustomizations(dc, fc)
+	if err != nil {
+		return warnings, err
+	}
+
+	err = blueprint.CheckDirectoryCustomizationsPolicy(dc, pathpolicy.CustomDirectoriesPolicies)
+	if err != nil {
+		return warnings, err
+	}
+
+	err = blueprint.CheckFileCustomizationsPolicy(fc, pathpolicy.CustomFilesPolicies)
+	if err != nil {
+		return warnings, err
+	}
+
+	// check if repository customizations are valid
+	_, err = customizations.GetRepositories()
+	if err != nil {
+		return warnings, err
+	}
+
+	return warnings, nil
+}

vendor/github.com/osbuild/images/pkg/distro/rhel7/package_sets.go

@@ -0,0 +1,15 @@
+package rhel7
+
+import (
+	"github.com/osbuild/images/pkg/rpmmd"
+)
+
+// packages that are only in some (sub)-distributions
+func distroSpecificPackageSet(t *imageType) rpmmd.PackageSet {
+	if t.arch.distro.isRHEL() {
+		return rpmmd.PackageSet{
+			Include: []string{"insights-client"},
+		}
+	}
+	return rpmmd.PackageSet{}
+}

vendor/github.com/osbuild/images/pkg/distro/rhel7/partition_tables.go

@@ -0,0 +1,65 @@
+package rhel7
+
+import (
+	"github.com/osbuild/images/internal/common"
+	"github.com/osbuild/images/pkg/disk"
+	"github.com/osbuild/images/pkg/distro"
+	"github.com/osbuild/images/pkg/platform"
+)
+
+// ////////// Partition table //////////
+
+var defaultBasePartitionTables = distro.BasePartitionTableMap{
+	platform.ARCH_X86_64.String(): disk.PartitionTable{
+		UUID: "D209C89E-EA5E-4FBD-B161-B461CCE297E0",
+		Type: "gpt",
+		Partitions: []disk.Partition{
+			{
+				Size:     1 * common.MebiByte, // 1MB
+				Bootable: true,
+				Type:     disk.BIOSBootPartitionGUID,
+				UUID:     disk.BIOSBootPartitionUUID,
+			},
+			{
+				Size: 200 * common.MebiByte, // 200 MB
+				Type: disk.EFISystemPartitionGUID,
+				UUID: disk.EFISystemPartitionUUID,
+				Payload: &disk.Filesystem{
+					Type:         "vfat",
+					UUID:         disk.EFIFilesystemUUID,
+					Mountpoint:   "/boot/efi",
+					Label:        "EFI-SYSTEM",
+					FSTabOptions: "defaults,uid=0,gid=0,umask=077,shortname=winnt",
+					FSTabFreq:    0,
+					FSTabPassNo:  2,
+				},
+			},
+			{
+				Size: 500 * common.MebiByte, // 500 MB
+				Type: disk.FilesystemDataGUID,
+				UUID: disk.FilesystemDataUUID,
+				Payload: &disk.Filesystem{
+					Type:         "xfs",
+					Mountpoint:   "/boot",
+					Label:        "boot",
+					FSTabOptions: "defaults",
+					FSTabFreq:    0,
+					FSTabPassNo:  0,
+				},
+			},
+			{
+				Size: 2 * common.GibiByte, // 2GiB
+				Type: disk.FilesystemDataGUID,
+				UUID: disk.RootPartitionUUID,
+				Payload: &disk.Filesystem{
+					Type:         "xfs",
+					Label:        "root",
+					Mountpoint:   "/",
+					FSTabOptions: "defaults",
+					FSTabFreq:    0,
+					FSTabPassNo:  0,
+				},
+			},
+		},
+	},
+}

vendor/github.com/osbuild/images/pkg/distro/rhel7/qcow2.go

@@ -0,0 +1,126 @@
+package rhel7
+
+import (
+	"github.com/osbuild/images/internal/common"
+	"github.com/osbuild/images/pkg/distro"
+	"github.com/osbuild/images/pkg/osbuild"
+	"github.com/osbuild/images/pkg/rpmmd"
+	"github.com/osbuild/images/pkg/subscription"
+)
+
+var qcow2ImgType = imageType{
+	name:          "qcow2",
+	filename:      "disk.qcow2",
+	mimeType:      "application/x-qemu-disk",
+	kernelOptions: "console=tty0 console=ttyS0,115200n8 no_timer_check net.ifnames=0 crashkernel=auto",
+	packageSets: map[string]packageSetFunc{
+		osPkgsKey: qcow2CommonPackageSet,
+	},
+	defaultImageConfig:  qcow2DefaultImgConfig,
+	bootable:            true,
+	defaultSize:         10 * common.GibiByte,
+	image:               liveImage,
+	buildPipelines:      []string{"build"},
+	payloadPipelines:    []string{"os", "image", "qcow2"},
+	exports:             []string{"qcow2"},
+	basePartitionTables: defaultBasePartitionTables,
+}
+
+var qcow2DefaultImgConfig = &distro.ImageConfig{
+	DefaultTarget:       common.ToPtr("multi-user.target"),
+	SELinuxForceRelabel: common.ToPtr(true),
+	Sysconfig: []*osbuild.SysconfigStageOptions{
+		{
+			Kernel: &osbuild.SysconfigKernelOptions{
+				UpdateDefault: true,
+				DefaultKernel: "kernel",
+			},
+			Network: &osbuild.SysconfigNetworkOptions{
+				Networking: true,
+				NoZeroConf: true,
+			},
+			NetworkScripts: &osbuild.NetworkScriptsOptions{
+				IfcfgFiles: map[string]osbuild.IfcfgFile{
+					"eth0": {
+						Device:    "eth0",
+						Bootproto: osbuild.IfcfgBootprotoDHCP,
+						OnBoot:    common.ToPtr(true),
+						Type:      osbuild.IfcfgTypeEthernet,
+						UserCtl:   common.ToPtr(true),
+						PeerDNS:   common.ToPtr(true),
+						IPv6Init:  common.ToPtr(false),
+					},
+				},
+			},
+		},
+	},
+	RHSMConfig: map[subscription.RHSMStatus]*osbuild.RHSMStageOptions{
+		subscription.RHSMConfigNoSubscription: {
+			YumPlugins: &osbuild.RHSMStageOptionsDnfPlugins{
+				ProductID: &osbuild.RHSMStageOptionsDnfPlugin{
+					Enabled: false,
+				},
+				SubscriptionManager: &osbuild.RHSMStageOptionsDnfPlugin{
+					Enabled: false,
+				},
+			},
+		},
+	},
+}
+
+func qcow2CommonPackageSet(t *imageType) rpmmd.PackageSet {
+	ps := rpmmd.PackageSet{
+		Include: []string{
+			"@core",
+			"kernel",
+			"nfs-utils",
+			"yum-utils",
+
+			"cloud-init",
+			//"ovirt-guest-agent-common",
+			"rhn-setup",
+			"yum-rhn-plugin",
+			"cloud-utils-growpart",
+			"dracut-config-generic",
+			"tar",
+			"tcpdump",
+			"rsync",
+		},
+		Exclude: []string{
+			"biosdevname",
+			"dracut-config-rescue",
+			"iprutils",
+			"NetworkManager-team",
+			"NetworkManager-tui",
+			"NetworkManager",
+			"plymouth",
+
+			"aic94xx-firmware",
+			"alsa-firmware",
+			"alsa-lib",
+			"alsa-tools-firmware",
+			"ivtv-firmware",
+			"iwl1000-firmware",
+			"iwl100-firmware",
+			"iwl105-firmware",
+			"iwl135-firmware",
+			"iwl2000-firmware",
+			"iwl2030-firmware",
+			"iwl3160-firmware",
+			"iwl3945-firmware",
+			"iwl4965-firmware",
+			"iwl5000-firmware",
+			"iwl5150-firmware",
+			"iwl6000-firmware",
+			"iwl6000g2a-firmware",
+			"iwl6000g2b-firmware",
+			"iwl6050-firmware",
+			"iwl7260-firmware",
+			"libertas-sd8686-firmware",
+			"libertas-sd8787-firmware",
+			"libertas-usb8388-firmware",
+		},
+	}.Append(distroSpecificPackageSet(t))
+
+	return ps
+}

vendor/github.com/osbuild/images/pkg/distro/rhel8/ami.go

@@ -0,0 +1,511 @@
+package rhel8
+
+import (
+	"github.com/osbuild/images/internal/common"
+	"github.com/osbuild/images/pkg/distro"
+	"github.com/osbuild/images/pkg/osbuild"
+	"github.com/osbuild/images/pkg/rpmmd"
+	"github.com/osbuild/images/pkg/subscription"
+)
+
+func amiImgTypeX86_64(rd distribution) imageType {
+	it := imageType{
+		name:     "ami",
+		filename: "image.raw",
+		mimeType: "application/octet-stream",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey: ec2CommonPackageSet,
+		},
+		defaultImageConfig:  defaultAMIImageConfigX86_64(rd),
+		kernelOptions:       "console=ttyS0,115200n8 console=tty0 net.ifnames=0 rd.blacklist=nouveau nvme_core.io_timeout=4294967295 crashkernel=auto",
+		bootable:            true,
+		defaultSize:         10 * common.GibiByte,
+		image:               liveImage,
+		buildPipelines:      []string{"build"},
+		payloadPipelines:    []string{"os", "image"},
+		exports:             []string{"image"},
+		basePartitionTables: ec2BasePartitionTables,
+	}
+
+	return it
+}
+
+func ec2ImgTypeX86_64(rd distribution) imageType {
+	basePartitionTables := ec2BasePartitionTables
+	// use legacy partition tables for RHEL 8.8 and older
+	if common.VersionLessThan(rd.osVersion, "8.9") {
+		basePartitionTables = ec2LegacyBasePartitionTables
+	}
+
+	it := imageType{
+		name:        "ec2",
+		filename:    "image.raw.xz",
+		mimeType:    "application/xz",
+		compression: "xz",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey: rhelEc2PackageSet,
+		},
+		defaultImageConfig:  defaultEc2ImageConfigX86_64(rd),
+		kernelOptions:       "console=ttyS0,115200n8 console=tty0 net.ifnames=0 rd.blacklist=nouveau nvme_core.io_timeout=4294967295 crashkernel=auto",
+		bootable:            true,
+		defaultSize:         10 * common.GibiByte,
+		image:               liveImage,
+		buildPipelines:      []string{"build"},
+		payloadPipelines:    []string{"os", "image", "xz"},
+		exports:             []string{"xz"},
+		basePartitionTables: basePartitionTables,
+	}
+	return it
+}
+
+func ec2HaImgTypeX86_64(rd distribution) imageType {
+	basePartitionTables := ec2BasePartitionTables
+	// use legacy partition tables for RHEL 8.8 and older
+	if common.VersionLessThan(rd.osVersion, "8.9") {
+		basePartitionTables = ec2LegacyBasePartitionTables
+	}
+
+	it := imageType{
+		name:        "ec2-ha",
+		filename:    "image.raw.xz",
+		mimeType:    "application/xz",
+		compression: "xz",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey: rhelEc2HaPackageSet,
+		},
+		defaultImageConfig:  defaultEc2ImageConfigX86_64(rd),
+		kernelOptions:       "console=ttyS0,115200n8 console=tty0 net.ifnames=0 rd.blacklist=nouveau nvme_core.io_timeout=4294967295 crashkernel=auto",
+		bootable:            true,
+		defaultSize:         10 * common.GibiByte,
+		image:               liveImage,
+		buildPipelines:      []string{"build"},
+		payloadPipelines:    []string{"os", "image", "xz"},
+		exports:             []string{"xz"},
+		basePartitionTables: basePartitionTables,
+	}
+	return it
+}
+
+func amiImgTypeAarch64(rd distribution) imageType {
+	it := imageType{
+		name:     "ami",
+		filename: "image.raw",
+		mimeType: "application/octet-stream",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey: ec2CommonPackageSet,
+		},
+		defaultImageConfig:  defaultAMIImageConfig(rd),
+		kernelOptions:       "console=ttyS0,115200n8 console=tty0 net.ifnames=0 rd.blacklist=nouveau nvme_core.io_timeout=4294967295 iommu.strict=0 crashkernel=auto",
+		bootable:            true,
+		defaultSize:         10 * common.GibiByte,
+		image:               liveImage,
+		buildPipelines:      []string{"build"},
+		payloadPipelines:    []string{"os", "image"},
+		exports:             []string{"image"},
+		basePartitionTables: ec2BasePartitionTables,
+	}
+	return it
+}
+
+func ec2ImgTypeAarch64(rd distribution) imageType {
+	basePartitionTables := ec2BasePartitionTables
+	// use legacy partition tables for RHEL 8.8 and older
+	if common.VersionLessThan(rd.osVersion, "8.9") {
+		basePartitionTables = ec2LegacyBasePartitionTables
+	}
+
+	it := imageType{
+		name:        "ec2",
+		filename:    "image.raw.xz",
+		mimeType:    "application/xz",
+		compression: "xz",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey: rhelEc2PackageSet,
+		},
+		defaultImageConfig:  defaultEc2ImageConfig(rd),
+		kernelOptions:       "console=ttyS0,115200n8 console=tty0 net.ifnames=0 rd.blacklist=nouveau nvme_core.io_timeout=4294967295 iommu.strict=0 crashkernel=auto",
+		bootable:            true,
+		defaultSize:         10 * common.GibiByte,
+		image:               liveImage,
+		buildPipelines:      []string{"build"},
+		payloadPipelines:    []string{"os", "image", "xz"},
+		exports:             []string{"xz"},
+		basePartitionTables: basePartitionTables,
+	}
+	return it
+}
+
+func ec2SapImgTypeX86_64(rd distribution) imageType {
+	basePartitionTables := ec2BasePartitionTables
+	// use legacy partition tables for RHEL 8.8 and older
+	if common.VersionLessThan(rd.osVersion, "8.9") {
+		basePartitionTables = ec2LegacyBasePartitionTables
+	}
+
+	it := imageType{
+		name:        "ec2-sap",
+		filename:    "image.raw.xz",
+		mimeType:    "application/xz",
+		compression: "xz",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey: rhelEc2SapPackageSet,
+		},
+		defaultImageConfig:  defaultEc2SapImageConfigX86_64(rd),
+		kernelOptions:       "console=ttyS0,115200n8 console=tty0 net.ifnames=0 rd.blacklist=nouveau nvme_core.io_timeout=4294967295 crashkernel=auto processor.max_cstate=1 intel_idle.max_cstate=1",
+		bootable:            true,
+		defaultSize:         10 * common.GibiByte,
+		image:               liveImage,
+		buildPipelines:      []string{"build"},
+		payloadPipelines:    []string{"os", "image", "xz"},
+		exports:             []string{"xz"},
+		basePartitionTables: basePartitionTables,
+	}
+	return it
+}
+
+// default EC2 images config (common for all architectures)
+func baseEc2ImageConfig() *distro.ImageConfig {
+	return &distro.ImageConfig{
+		Timezone: common.ToPtr("UTC"),
+		TimeSynchronization: &osbuild.ChronyStageOptions{
+			Servers: []osbuild.ChronyConfigServer{
+				{
+					Hostname: "169.254.169.123",
+					Prefer:   common.ToPtr(true),
+					Iburst:   common.ToPtr(true),
+					Minpoll:  common.ToPtr(4),
+					Maxpoll:  common.ToPtr(4),
+				},
+			},
+			// empty string will remove any occurrences of the option from the configuration
+			LeapsecTz: common.ToPtr(""),
+		},
+		Keyboard: &osbuild.KeymapStageOptions{
+			Keymap: "us",
+			X11Keymap: &osbuild.X11KeymapOptions{
+				Layouts: []string{"us"},
+			},
+		},
+		EnabledServices: []string{
+			"sshd",
+			"NetworkManager",
+			"nm-cloud-setup.service",
+			"nm-cloud-setup.timer",
+			"cloud-init",
+			"cloud-init-local",
+			"cloud-config",
+			"cloud-final",
+			"reboot.target",
+		},
+		DefaultTarget: common.ToPtr("multi-user.target"),
+		Sysconfig: []*osbuild.SysconfigStageOptions{
+			{
+				Kernel: &osbuild.SysconfigKernelOptions{
+					UpdateDefault: true,
+					DefaultKernel: "kernel",
+				},
+				Network: &osbuild.SysconfigNetworkOptions{
+					Networking: true,
+					NoZeroConf: true,
+				},
+				NetworkScripts: &osbuild.NetworkScriptsOptions{
+					IfcfgFiles: map[string]osbuild.IfcfgFile{
+						"eth0": {
+							Device:    "eth0",
+							Bootproto: osbuild.IfcfgBootprotoDHCP,
+							OnBoot:    common.ToPtr(true),
+							Type:      osbuild.IfcfgTypeEthernet,
+							UserCtl:   common.ToPtr(true),
+							PeerDNS:   common.ToPtr(true),
+							IPv6Init:  common.ToPtr(false),
+						},
+					},
+				},
+			},
+		},
+		RHSMConfig: map[subscription.RHSMStatus]*osbuild.RHSMStageOptions{
+			subscription.RHSMConfigNoSubscription: {
+				// RHBZ#1932802
+				SubMan: &osbuild.RHSMStageOptionsSubMan{
+					Rhsmcertd: &osbuild.SubManConfigRHSMCERTDSection{
+						AutoRegistration: common.ToPtr(true),
+					},
+					Rhsm: &osbuild.SubManConfigRHSMSection{
+						ManageRepos: common.ToPtr(false),
+					},
+				},
+			},
+			subscription.RHSMConfigWithSubscription: {
+				// RHBZ#1932802
+				SubMan: &osbuild.RHSMStageOptionsSubMan{
+					Rhsmcertd: &osbuild.SubManConfigRHSMCERTDSection{
+						AutoRegistration: common.ToPtr(true),
+					},
+					// do not disable the redhat.repo management if the user
+					// explicitly request the system to be subscribed
+				},
+			},
+		},
+		SystemdLogind: []*osbuild.SystemdLogindStageOptions{
+			{
+				Filename: "00-getty-fixes.conf",
+				Config: osbuild.SystemdLogindConfigDropin{
+
+					Login: osbuild.SystemdLogindConfigLoginSection{
+						NAutoVTs: common.ToPtr(0),
+					},
+				},
+			},
+		},
+		CloudInit: []*osbuild.CloudInitStageOptions{
+			{
+				Filename: "00-rhel-default-user.cfg",
+				Config: osbuild.CloudInitConfigFile{
+					SystemInfo: &osbuild.CloudInitConfigSystemInfo{
+						DefaultUser: &osbuild.CloudInitConfigDefaultUser{
+							Name: "ec2-user",
+						},
+					},
+				},
+			},
+		},
+		Modprobe: []*osbuild.ModprobeStageOptions{
+			{
+				Filename: "blacklist-nouveau.conf",
+				Commands: osbuild.ModprobeConfigCmdList{
+					osbuild.NewModprobeConfigCmdBlacklist("nouveau"),
+				},
+			},
+			// COMPOSER-1807
+			{
+				Filename: "blacklist-amdgpu.conf",
+				Commands: osbuild.ModprobeConfigCmdList{
+					osbuild.NewModprobeConfigCmdBlacklist("amdgpu"),
+				},
+			},
+		},
+		DracutConf: []*osbuild.DracutConfStageOptions{
+			{
+				Filename: "sgdisk.conf",
+				Config: osbuild.DracutConfigFile{
+					Install: []string{"sgdisk"},
+				},
+			},
+		},
+		SystemdUnit: []*osbuild.SystemdUnitStageOptions{
+			// RHBZ#1822863
+			{
+				Unit:   "nm-cloud-setup.service",
+				Dropin: "10-rh-enable-for-ec2.conf",
+				Config: osbuild.SystemdServiceUnitDropin{
+					Service: &osbuild.SystemdUnitServiceSection{
+						Environment: "NM_CLOUD_SETUP_EC2=yes",
+					},
+				},
+			},
+		},
+		Authselect: &osbuild.AuthselectStageOptions{
+			Profile: "sssd",
+		},
+		SshdConfig: &osbuild.SshdConfigStageOptions{
+			Config: osbuild.SshdConfigConfig{
+				PasswordAuthentication: common.ToPtr(false),
+			},
+		},
+	}
+}
+
+func defaultEc2ImageConfig(rd distribution) *distro.ImageConfig {
+	ic := baseEc2ImageConfig()
+	if rd.isRHEL() && common.VersionLessThan(rd.osVersion, "9.1") {
+		ic = appendRHSM(ic)
+		// Disable RHSM redhat.repo management
+		rhsmConf := ic.RHSMConfig[subscription.RHSMConfigNoSubscription]
+		rhsmConf.SubMan.Rhsm = &osbuild.SubManConfigRHSMSection{ManageRepos: common.ToPtr(false)}
+		ic.RHSMConfig[subscription.RHSMConfigNoSubscription] = rhsmConf
+	}
+	// The RHSM configuration should not be applied since 8.7, but it is instead done by installing the redhat-cloud-client-configuration package.
+	// See COMPOSER-1804 for more information.
+	rhel87PlusEc2ImageConfigOverride := &distro.ImageConfig{
+		RHSMConfig: map[subscription.RHSMStatus]*osbuild.RHSMStageOptions{},
+	}
+	if !common.VersionLessThan(rd.osVersion, "8.7") {
+		ic = rhel87PlusEc2ImageConfigOverride.InheritFrom(ic)
+	}
+
+	return ic
+}
+
+// default AMI (EC2 BYOS) images config
+func defaultAMIImageConfig(rd distribution) *distro.ImageConfig {
+	ic := defaultEc2ImageConfig(rd)
+	if rd.isRHEL() {
+		// defaultAMIImageConfig() adds the rhsm options only for RHEL < 9.1
+		// Add it unconditionally for AMI
+		ic = appendRHSM(ic)
+	}
+	return ic
+}
+
+func defaultEc2ImageConfigX86_64(rd distribution) *distro.ImageConfig {
+	ic := defaultEc2ImageConfig(rd)
+	return appendEC2DracutX86_64(ic)
+}
+
+func defaultAMIImageConfigX86_64(rd distribution) *distro.ImageConfig {
+	ic := defaultAMIImageConfig(rd).InheritFrom(defaultEc2ImageConfigX86_64(rd))
+	return appendEC2DracutX86_64(ic)
+}
+
+func defaultEc2SapImageConfigX86_64(rd distribution) *distro.ImageConfig {
+	// default EC2-SAP image config (x86_64)
+	return sapImageConfig(rd).InheritFrom(defaultEc2ImageConfigX86_64(rd))
+}
+
+// common package set for RHEL (BYOS/RHUI) and CentOS Stream images
+func ec2CommonPackageSet(t *imageType) rpmmd.PackageSet {
+	return rpmmd.PackageSet{
+		Include: []string{
+			"@core",
+			"authselect-compat",
+			"chrony",
+			"cloud-init",
+			"cloud-utils-growpart",
+			"dhcp-client",
+			"dracut-config-generic",
+			"dracut-norescue",
+			"gdisk",
+			"grub2",
+			"langpacks-en",
+			"NetworkManager",
+			"NetworkManager-cloud-setup",
+			"redhat-release",
+			"redhat-release-eula",
+			"rsync",
+			"tar",
+			"yum-utils",
+		},
+		Exclude: []string{
+			"aic94xx-firmware",
+			"alsa-firmware",
+			"alsa-tools-firmware",
+			"biosdevname",
+			"firewalld",
+			"iprutils",
+			"ivtv-firmware",
+			"iwl1000-firmware",
+			"iwl100-firmware",
+			"iwl105-firmware",
+			"iwl135-firmware",
+			"iwl2000-firmware",
+			"iwl2030-firmware",
+			"iwl3160-firmware",
+			"iwl3945-firmware",
+			"iwl4965-firmware",
+			"iwl5000-firmware",
+			"iwl5150-firmware",
+			"iwl6000-firmware",
+			"iwl6000g2a-firmware",
+			"iwl6000g2b-firmware",
+			"iwl6050-firmware",
+			"iwl7260-firmware",
+			"libertas-sd8686-firmware",
+			"libertas-sd8787-firmware",
+			"libertas-usb8388-firmware",
+			"plymouth",
+			// RHBZ#2075815
+			"qemu-guest-agent",
+		},
+	}.Append(distroSpecificPackageSet(t))
+}
+
+// common rhel ec2 RHUI image package set
+func rhelEc2CommonPackageSet(t *imageType) rpmmd.PackageSet {
+	ps := ec2CommonPackageSet(t)
+	// Include "redhat-cloud-client-configuration" on 8.7+ (COMPOSER-1804)
+	if !common.VersionLessThan(t.arch.distro.osVersion, "8.7") {
+		ps.Include = append(ps.Include, "redhat-cloud-client-configuration")
+	}
+	return ps
+}
+
+// rhel-ec2 image package set
+func rhelEc2PackageSet(t *imageType) rpmmd.PackageSet {
+	ec2PackageSet := rhelEc2CommonPackageSet(t)
+	ec2PackageSet.Include = append(ec2PackageSet.Include, "rh-amazon-rhui-client")
+	ec2PackageSet.Exclude = append(ec2PackageSet.Exclude, "alsa-lib")
+	return ec2PackageSet
+}
+
+// rhel-ha-ec2 image package set
+func rhelEc2HaPackageSet(t *imageType) rpmmd.PackageSet {
+	ec2HaPackageSet := rhelEc2CommonPackageSet(t)
+	ec2HaPackageSet.Include = append(ec2HaPackageSet.Include,
+		"fence-agents-all",
+		"pacemaker",
+		"pcs",
+		"rh-amazon-rhui-client-ha",
+	)
+	ec2HaPackageSet.Exclude = append(ec2HaPackageSet.Exclude, "alsa-lib")
+	return ec2HaPackageSet
+}
+
+// rhel-sap-ec2 image package set
+// Includes the common ec2 package set, the common SAP packages, and
+// the amazon rhui sap package
+func rhelEc2SapPackageSet(t *imageType) rpmmd.PackageSet {
+	return rpmmd.PackageSet{
+		Include: []string{
+			"rh-amazon-rhui-client-sap-bundle-e4s",
+		},
+	}.Append(rhelEc2CommonPackageSet(t)).Append(SapPackageSet(t))
+}
+
+// Add RHSM config options to ImageConfig.
+// Used for RHEL distros.
+func appendRHSM(ic *distro.ImageConfig) *distro.ImageConfig {
+	rhsm := &distro.ImageConfig{
+		RHSMConfig: map[subscription.RHSMStatus]*osbuild.RHSMStageOptions{
+			subscription.RHSMConfigNoSubscription: {
+				// RHBZ#1932802
+				SubMan: &osbuild.RHSMStageOptionsSubMan{
+					Rhsmcertd: &osbuild.SubManConfigRHSMCERTDSection{
+						AutoRegistration: common.ToPtr(true),
+					},
+					// Don't disable RHSM redhat.repo management on the AMI
+					// image, which is BYOS and does not use RHUI for content.
+					// Otherwise subscribing the system manually after booting
+					// it would result in empty redhat.repo. Without RHUI, such
+					// system would have no way to get Red Hat content, but
+					// enable the repo management manually, which would be very
+					// confusing.
+				},
+			},
+			subscription.RHSMConfigWithSubscription: {
+				// RHBZ#1932802
+				SubMan: &osbuild.RHSMStageOptionsSubMan{
+					Rhsmcertd: &osbuild.SubManConfigRHSMCERTDSection{
+						AutoRegistration: common.ToPtr(true),
+					},
+					// do not disable the redhat.repo management if the user
+					// explicitly request the system to be subscribed
+				},
+			},
+		},
+	}
+	return rhsm.InheritFrom(ic)
+}
+
+func appendEC2DracutX86_64(ic *distro.ImageConfig) *distro.ImageConfig {
+	ic.DracutConf = append(ic.DracutConf,
+		&osbuild.DracutConfStageOptions{
+			Filename: "ec2.conf",
+			Config: osbuild.DracutConfigFile{
+				AddDrivers: []string{
+					"nvme",
+					"xen-blkfront",
+				},
+			},
+		})
+	return ic
+}

vendor/github.com/osbuild/images/pkg/distro/rhel8/arch.go

@@ -0,0 +1,73 @@
+package rhel8
+
+import (
+	"errors"
+	"fmt"
+	"sort"
+
+	"github.com/osbuild/images/pkg/distro"
+	"github.com/osbuild/images/pkg/platform"
+)
+
+type architecture struct {
+	distro           *distribution
+	name             string
+	imageTypes       map[string]distro.ImageType
+	imageTypeAliases map[string]string
+}
+
+func (a *architecture) Name() string {
+	return a.name
+}
+
+func (a *architecture) ListImageTypes() []string {
+	itNames := make([]string, 0, len(a.imageTypes))
+	for name := range a.imageTypes {
+		itNames = append(itNames, name)
+	}
+	sort.Strings(itNames)
+	return itNames
+}
+
+func (a *architecture) GetImageType(name string) (distro.ImageType, error) {
+	t, exists := a.imageTypes[name]
+	if !exists {
+		aliasForName, exists := a.imageTypeAliases[name]
+		if !exists {
+			return nil, errors.New("invalid image type: " + name)
+		}
+		t, exists = a.imageTypes[aliasForName]
+		if !exists {
+			panic(fmt.Sprintf("image type '%s' is an alias to a non-existing image type '%s'", name, aliasForName))
+		}
+	}
+	return t, nil
+}
+
+func (a *architecture) addImageTypes(platform platform.Platform, imageTypes ...imageType) {
+	if a.imageTypes == nil {
+		a.imageTypes = map[string]distro.ImageType{}
+	}
+	for idx := range imageTypes {
+		it := imageTypes[idx]
+		if _, e := a.imageTypes[it.name]; e {
+			panic("already added: " + it.name)
+		}
+		it.arch = a
+		it.platform = platform
+		a.imageTypes[it.name] = &it
+		for _, alias := range it.nameAliases {
+			if a.imageTypeAliases == nil {
+				a.imageTypeAliases = map[string]string{}
+			}
+			if existingAliasFor, exists := a.imageTypeAliases[alias]; exists {
+				panic(fmt.Sprintf("image type alias '%s' for '%s' is already defined for another image type '%s'", alias, it.name, existingAliasFor))
+			}
+			a.imageTypeAliases[alias] = it.name
+		}
+	}
+}
+
+func (a *architecture) Distro() distro.Distro {
+	return a.distro
+}

vendor/github.com/osbuild/images/pkg/distro/rhel8/azure.go

@@ -0,0 +1,722 @@
+package rhel8
+
+import (
+	"github.com/osbuild/images/internal/common"
+	"github.com/osbuild/images/internal/shell"
+	"github.com/osbuild/images/pkg/disk"
+	"github.com/osbuild/images/pkg/distro"
+	"github.com/osbuild/images/pkg/osbuild"
+	"github.com/osbuild/images/pkg/platform"
+	"github.com/osbuild/images/pkg/rpmmd"
+	"github.com/osbuild/images/pkg/subscription"
+)
+
+const defaultAzureKernelOptions = "ro crashkernel=auto console=tty1 console=ttyS0 earlyprintk=ttyS0 rootdelay=300"
+
+func azureRhuiImgType() imageType {
+	return imageType{
+		name:        "azure-rhui",
+		filename:    "disk.vhd.xz",
+		mimeType:    "application/xz",
+		compression: "xz",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey: azureRhuiPackageSet,
+		},
+		defaultImageConfig:  defaultAzureRhuiImageConfig.InheritFrom(defaultVhdImageConfig()),
+		kernelOptions:       defaultAzureKernelOptions,
+		bootable:            true,
+		defaultSize:         64 * common.GibiByte,
+		image:               liveImage,
+		buildPipelines:      []string{"build"},
+		payloadPipelines:    []string{"os", "image", "vpc", "xz"},
+		exports:             []string{"xz"},
+		basePartitionTables: azureRhuiBasePartitionTables,
+	}
+}
+
+func azureSapRhuiImgType(rd distribution) imageType {
+	return imageType{
+		name:        "azure-sap-rhui",
+		filename:    "disk.vhd.xz",
+		mimeType:    "application/xz",
+		compression: "xz",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey: azureSapPackageSet,
+		},
+		defaultImageConfig:  defaultAzureRhuiImageConfig.InheritFrom(sapAzureImageConfig(rd)),
+		kernelOptions:       defaultAzureKernelOptions,
+		bootable:            true,
+		defaultSize:         64 * common.GibiByte,
+		image:               liveImage,
+		buildPipelines:      []string{"build"},
+		payloadPipelines:    []string{"os", "image", "vpc", "xz"},
+		exports:             []string{"xz"},
+		basePartitionTables: azureRhuiBasePartitionTables,
+	}
+}
+
+func azureByosImgType() imageType {
+	return imageType{
+		name:     "vhd",
+		filename: "disk.vhd",
+		mimeType: "application/x-vhd",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey: azurePackageSet,
+		},
+		defaultImageConfig:  defaultAzureByosImageConfig.InheritFrom(defaultVhdImageConfig()),
+		kernelOptions:       defaultAzureKernelOptions,
+		bootable:            true,
+		defaultSize:         4 * common.GibiByte,
+		image:               liveImage,
+		buildPipelines:      []string{"build"},
+		payloadPipelines:    []string{"os", "image", "vpc"},
+		exports:             []string{"vpc"},
+		basePartitionTables: defaultBasePartitionTables,
+	}
+}
+
+// Azure non-RHEL image type
+func azureImgType() imageType {
+	return imageType{
+		name:     "vhd",
+		filename: "disk.vhd",
+		mimeType: "application/x-vhd",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey: azurePackageSet,
+		},
+		defaultImageConfig:  defaultVhdImageConfig(),
+		kernelOptions:       defaultAzureKernelOptions,
+		bootable:            true,
+		defaultSize:         4 * common.GibiByte,
+		image:               liveImage,
+		buildPipelines:      []string{"build"},
+		payloadPipelines:    []string{"os", "image", "vpc"},
+		exports:             []string{"vpc"},
+		basePartitionTables: defaultBasePartitionTables,
+	}
+}
+
+func azureEap7RhuiImgType() imageType {
+	return imageType{
+		name:        "azure-eap7-rhui",
+		workload:    eapWorkload(),
+		filename:    "disk.vhd.xz",
+		mimeType:    "application/xz",
+		compression: "xz",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey: azureEapPackageSet,
+		},
+		defaultImageConfig:  defaultAzureEapImageConfig.InheritFrom(defaultAzureRhuiImageConfig.InheritFrom(defaultAzureImageConfig)),
+		kernelOptions:       defaultAzureKernelOptions,
+		bootable:            true,
+		defaultSize:         64 * common.GibiByte,
+		image:               liveImage,
+		buildPipelines:      []string{"build"},
+		payloadPipelines:    []string{"os", "image", "vpc", "xz"},
+		exports:             []string{"xz"},
+		basePartitionTables: azureRhuiBasePartitionTables,
+	}
+}
+
+// PACKAGE SETS
+
+// Common Azure image package set
+func azureCommonPackageSet(t *imageType) rpmmd.PackageSet {
+	ps := rpmmd.PackageSet{
+		Include: []string{
+			"@Server",
+			"NetworkManager",
+			"NetworkManager-cloud-setup",
+			"WALinuxAgent",
+			"bzip2",
+			"cloud-init",
+			"cloud-utils-growpart",
+			"cryptsetup-reencrypt",
+			"dracut-config-generic",
+			"dracut-norescue",
+			"efibootmgr",
+			"gdisk",
+			"hyperv-daemons",
+			"kernel",
+			"kernel-core",
+			"kernel-modules",
+			"langpacks-en",
+			"lvm2",
+			"nvme-cli",
+			"patch",
+			"rng-tools",
+			"selinux-policy-targeted",
+			"uuid",
+			"yum-utils",
+		},
+		Exclude: []string{
+			"NetworkManager-config-server",
+			"aic94xx-firmware",
+			"alsa-firmware",
+			"alsa-sof-firmware",
+			"alsa-tools-firmware",
+			"biosdevname",
+			"bolt",
+			"buildah",
+			"cockpit-podman",
+			"containernetworking-plugins",
+			"dnf-plugin-spacewalk",
+			"dracut-config-rescue",
+			"glibc-all-langpacks",
+			"iprutils",
+			"ivtv-firmware",
+			"iwl100-firmware",
+			"iwl1000-firmware",
+			"iwl105-firmware",
+			"iwl135-firmware",
+			"iwl2000-firmware",
+			"iwl2030-firmware",
+			"iwl3160-firmware",
+			"iwl3945-firmware",
+			"iwl4965-firmware",
+			"iwl5000-firmware",
+			"iwl5150-firmware",
+			"iwl6000-firmware",
+			"iwl6000g2a-firmware",
+			"iwl6000g2b-firmware",
+			"iwl6050-firmware",
+			"iwl7260-firmware",
+			"libertas-sd8686-firmware",
+			"libertas-sd8787-firmware",
+			"libertas-usb8388-firmware",
+			"plymouth",
+			"podman",
+			"python3-dnf-plugin-spacewalk",
+			"python3-hwdata",
+			"python3-rhnlib",
+			"rhn-check",
+			"rhn-client-tools",
+			"rhn-setup",
+			"rhnlib",
+			"rhnsd",
+			"usb_modeswitch",
+		},
+	}.Append(distroSpecificPackageSet(t))
+
+	if t.arch.distro.isRHEL() {
+		ps.Append(rpmmd.PackageSet{
+			Include: []string{
+				"insights-client",
+				"rhc",
+			},
+		})
+	}
+
+	return ps
+}
+
+// Azure BYOS image package set
+func azurePackageSet(t *imageType) rpmmd.PackageSet {
+	return rpmmd.PackageSet{
+		Include: []string{
+			"firewalld",
+		},
+		Exclude: []string{
+			"alsa-lib",
+		},
+	}.Append(azureCommonPackageSet(t))
+}
+
+// Azure RHUI image package set
+func azureRhuiPackageSet(t *imageType) rpmmd.PackageSet {
+	return rpmmd.PackageSet{
+		Include: []string{
+			"firewalld",
+			"rhui-azure-rhel8",
+		},
+		Exclude: []string{
+			"alsa-lib",
+		},
+	}.Append(azureCommonPackageSet(t))
+}
+
+// Azure SAP image package set
+// Includes the common azure package set, the common SAP packages, and
+// the azure rhui sap package.
+func azureSapPackageSet(t *imageType) rpmmd.PackageSet {
+	return rpmmd.PackageSet{
+		Include: []string{
+			"firewalld",
+			"rhui-azure-rhel8-sap-ha",
+		},
+	}.Append(azureCommonPackageSet(t)).Append(SapPackageSet(t))
+}
+
+func azureEapPackageSet(t *imageType) rpmmd.PackageSet {
+	return rpmmd.PackageSet{
+		Include: []string{
+			"rhui-azure-rhel8",
+		},
+		Exclude: []string{
+			"firewalld",
+		},
+	}.Append(azureCommonPackageSet(t))
+}
+
+// PARTITION TABLES
+
+var azureRhuiBasePartitionTables = distro.BasePartitionTableMap{
+	platform.ARCH_X86_64.String(): disk.PartitionTable{
+		UUID: "D209C89E-EA5E-4FBD-B161-B461CCE297E0",
+		Type: "gpt",
+		Size: 64 * common.GibiByte,
+		Partitions: []disk.Partition{
+			{
+				Size: 500 * common.MebiByte,
+				Type: disk.EFISystemPartitionGUID,
+				UUID: disk.EFISystemPartitionUUID,
+				Payload: &disk.Filesystem{
+					Type:         "vfat",
+					UUID:         disk.EFIFilesystemUUID,
+					Mountpoint:   "/boot/efi",
+					FSTabOptions: "defaults,uid=0,gid=0,umask=077,shortname=winnt",
+					FSTabFreq:    0,
+					FSTabPassNo:  2,
+				},
+			},
+			{
+				Size: 500 * common.MebiByte,
+				Type: disk.FilesystemDataGUID,
+				UUID: disk.FilesystemDataUUID,
+				Payload: &disk.Filesystem{
+					Type:         "xfs",
+					Mountpoint:   "/boot",
+					FSTabOptions: "defaults",
+					FSTabFreq:    0,
+					FSTabPassNo:  0,
+				},
+			},
+			{
+				Size:     2 * common.MebiByte,
+				Bootable: true,
+				Type:     disk.BIOSBootPartitionGUID,
+				UUID:     disk.BIOSBootPartitionUUID,
+			},
+			{
+				Type: disk.LVMPartitionGUID,
+				UUID: disk.RootPartitionUUID,
+				Payload: &disk.LVMVolumeGroup{
+					Name:        "rootvg",
+					Description: "built with lvm2 and osbuild",
+					LogicalVolumes: []disk.LVMLogicalVolume{
+						{
+							Size: 1 * common.GibiByte,
+							Name: "homelv",
+							Payload: &disk.Filesystem{
+								Type:         "xfs",
+								Label:        "home",
+								Mountpoint:   "/home",
+								FSTabOptions: "defaults",
+								FSTabFreq:    0,
+								FSTabPassNo:  0,
+							},
+						},
+						{
+							Size: 2 * common.GibiByte,
+							Name: "rootlv",
+							Payload: &disk.Filesystem{
+								Type:         "xfs",
+								Label:        "root",
+								Mountpoint:   "/",
+								FSTabOptions: "defaults",
+								FSTabFreq:    0,
+								FSTabPassNo:  0,
+							},
+						},
+						{
+							Size: 2 * common.GibiByte,
+							Name: "tmplv",
+							Payload: &disk.Filesystem{
+								Type:         "xfs",
+								Label:        "tmp",
+								Mountpoint:   "/tmp",
+								FSTabOptions: "defaults",
+								FSTabFreq:    0,
+								FSTabPassNo:  0,
+							},
+						},
+						{
+							Size: 10 * common.GibiByte,
+							Name: "usrlv",
+							Payload: &disk.Filesystem{
+								Type:         "xfs",
+								Label:        "usr",
+								Mountpoint:   "/usr",
+								FSTabOptions: "defaults",
+								FSTabFreq:    0,
+								FSTabPassNo:  0,
+							},
+						},
+						{
+							Size: 10 * common.GibiByte,
+							Name: "varlv",
+							Payload: &disk.Filesystem{
+								Type:         "xfs",
+								Label:        "var",
+								Mountpoint:   "/var",
+								FSTabOptions: "defaults",
+								FSTabFreq:    0,
+								FSTabPassNo:  0,
+							},
+						},
+					},
+				},
+			},
+		},
+	},
+	platform.ARCH_AARCH64.String(): disk.PartitionTable{
+		UUID: "D209C89E-EA5E-4FBD-B161-B461CCE297E0",
+		Type: "gpt",
+		Size: 64 * common.GibiByte,
+		Partitions: []disk.Partition{
+			{
+				Size: 500 * common.MebiByte,
+				Type: disk.EFISystemPartitionGUID,
+				UUID: disk.EFISystemPartitionUUID,
+				Payload: &disk.Filesystem{
+					Type:         "vfat",
+					UUID:         disk.EFIFilesystemUUID,
+					Mountpoint:   "/boot/efi",
+					FSTabOptions: "defaults,uid=0,gid=0,umask=077,shortname=winnt",
+					FSTabFreq:    0,
+					FSTabPassNo:  2,
+				},
+			},
+			{
+				Size: 500 * common.MebiByte,
+				Type: disk.FilesystemDataGUID,
+				UUID: disk.FilesystemDataUUID,
+				Payload: &disk.Filesystem{
+					Type:         "xfs",
+					Mountpoint:   "/boot",
+					FSTabOptions: "defaults",
+					FSTabFreq:    0,
+					FSTabPassNo:  0,
+				},
+			},
+			{
+				Type: disk.LVMPartitionGUID,
+				UUID: disk.RootPartitionUUID,
+				Payload: &disk.LVMVolumeGroup{
+					Name:        "rootvg",
+					Description: "built with lvm2 and osbuild",
+					LogicalVolumes: []disk.LVMLogicalVolume{
+						{
+							Size: 1 * common.GibiByte,
+							Name: "homelv",
+							Payload: &disk.Filesystem{
+								Type:         "xfs",
+								Label:        "home",
+								Mountpoint:   "/home",
+								FSTabOptions: "defaults",
+								FSTabFreq:    0,
+								FSTabPassNo:  0,
+							},
+						},
+						{
+							Size: 2 * common.GibiByte,
+							Name: "rootlv",
+							Payload: &disk.Filesystem{
+								Type:         "xfs",
+								Label:        "root",
+								Mountpoint:   "/",
+								FSTabOptions: "defaults",
+								FSTabFreq:    0,
+								FSTabPassNo:  0,
+							},
+						},
+						{
+							Size: 2 * common.GibiByte,
+							Name: "tmplv",
+							Payload: &disk.Filesystem{
+								Type:         "xfs",
+								Label:        "tmp",
+								Mountpoint:   "/tmp",
+								FSTabOptions: "defaults",
+								FSTabFreq:    0,
+								FSTabPassNo:  0,
+							},
+						},
+						{
+							Size: 10 * common.GibiByte,
+							Name: "usrlv",
+							Payload: &disk.Filesystem{
+								Type:         "xfs",
+								Label:        "usr",
+								Mountpoint:   "/usr",
+								FSTabOptions: "defaults",
+								FSTabFreq:    0,
+								FSTabPassNo:  0,
+							},
+						},
+						{
+							Size: 10 * common.GibiByte,
+							Name: "varlv",
+							Payload: &disk.Filesystem{
+								Type:         "xfs",
+								Label:        "var",
+								Mountpoint:   "/var",
+								FSTabOptions: "defaults",
+								FSTabFreq:    0,
+								FSTabPassNo:  0,
+							},
+						},
+					},
+				},
+			},
+		},
+	},
+}
+
+var defaultAzureImageConfig = &distro.ImageConfig{
+	Timezone: common.ToPtr("Etc/UTC"),
+	Locale:   common.ToPtr("en_US.UTF-8"),
+	Keyboard: &osbuild.KeymapStageOptions{
+		Keymap: "us",
+		X11Keymap: &osbuild.X11KeymapOptions{
+			Layouts: []string{"us"},
+		},
+	},
+	Sysconfig: []*osbuild.SysconfigStageOptions{
+		{
+			Kernel: &osbuild.SysconfigKernelOptions{
+				UpdateDefault: true,
+				DefaultKernel: "kernel-core",
+			},
+			Network: &osbuild.SysconfigNetworkOptions{
+				Networking: true,
+				NoZeroConf: true,
+			},
+		},
+	},
+	EnabledServices: []string{
+		"nm-cloud-setup.service",
+		"nm-cloud-setup.timer",
+		"sshd",
+		"systemd-resolved",
+		"waagent",
+	},
+	SshdConfig: &osbuild.SshdConfigStageOptions{
+		Config: osbuild.SshdConfigConfig{
+			ClientAliveInterval: common.ToPtr(180),
+		},
+	},
+	Modprobe: []*osbuild.ModprobeStageOptions{
+		{
+			Filename: "blacklist-amdgpu.conf",
+			Commands: osbuild.ModprobeConfigCmdList{
+				osbuild.NewModprobeConfigCmdBlacklist("amdgpu"),
+			},
+		},
+		{
+			Filename: "blacklist-intel-cstate.conf",
+			Commands: osbuild.ModprobeConfigCmdList{
+				osbuild.NewModprobeConfigCmdBlacklist("intel_cstate"),
+			},
+		},
+		{
+			Filename: "blacklist-floppy.conf",
+			Commands: osbuild.ModprobeConfigCmdList{
+				osbuild.NewModprobeConfigCmdBlacklist("floppy"),
+			},
+		},
+		{
+			Filename: "blacklist-nouveau.conf",
+			Commands: osbuild.ModprobeConfigCmdList{
+				osbuild.NewModprobeConfigCmdBlacklist("nouveau"),
+				osbuild.NewModprobeConfigCmdBlacklist("lbm-nouveau"),
+			},
+		},
+		{
+			Filename: "blacklist-skylake-edac.conf",
+			Commands: osbuild.ModprobeConfigCmdList{
+				osbuild.NewModprobeConfigCmdBlacklist("skx_edac"),
+			},
+		},
+	},
+	CloudInit: []*osbuild.CloudInitStageOptions{
+		{
+			Filename: "10-azure-kvp.cfg",
+			Config: osbuild.CloudInitConfigFile{
+				Reporting: &osbuild.CloudInitConfigReporting{
+					Logging: &osbuild.CloudInitConfigReportingHandlers{
+						Type: "log",
+					},
+					Telemetry: &osbuild.CloudInitConfigReportingHandlers{
+						Type: "hyperv",
+					},
+				},
+			},
+		},
+		{
+			Filename: "91-azure_datasource.cfg",
+			Config: osbuild.CloudInitConfigFile{
+				Datasource: &osbuild.CloudInitConfigDatasource{
+					Azure: &osbuild.CloudInitConfigDatasourceAzure{
+						ApplyNetworkConfig: false,
+					},
+				},
+				DatasourceList: []string{
+					"Azure",
+				},
+			},
+		},
+	},
+	PwQuality: &osbuild.PwqualityConfStageOptions{
+		Config: osbuild.PwqualityConfConfig{
+			Minlen:   common.ToPtr(6),
+			Minclass: common.ToPtr(3),
+			Dcredit:  common.ToPtr(0),
+			Ucredit:  common.ToPtr(0),
+			Lcredit:  common.ToPtr(0),
+			Ocredit:  common.ToPtr(0),
+		},
+	},
+	WAAgentConfig: &osbuild.WAAgentConfStageOptions{
+		Config: osbuild.WAAgentConfig{
+			RDFormat:     common.ToPtr(false),
+			RDEnableSwap: common.ToPtr(false),
+		},
+	},
+	Grub2Config: &osbuild.GRUB2Config{
+		TerminalInput:  []string{"serial", "console"},
+		TerminalOutput: []string{"serial", "console"},
+		Serial:         "serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1",
+		Timeout:        10,
+	},
+	UdevRules: &osbuild.UdevRulesStageOptions{
+		Filename: "/etc/udev/rules.d/68-azure-sriov-nm-unmanaged.rules",
+		Rules: osbuild.UdevRules{
+			osbuild.UdevRuleComment{
+				Comment: []string{
+					"Accelerated Networking on Azure exposes a new SRIOV interface to the VM.",
+					"This interface is transparently bonded to the synthetic interface,",
+					"so NetworkManager should just ignore any SRIOV interfaces.",
+				},
+			},
+			osbuild.NewUdevRule(
+				[]osbuild.UdevKV{
+					{K: "SUBSYSTEM", O: "==", V: "net"},
+					{K: "DRIVERS", O: "==", V: "hv_pci"},
+					{K: "ACTION", O: "==", V: "add"},
+					{K: "ENV", A: "NM_UNMANAGED", O: "=", V: "1"},
+				},
+			),
+		},
+	},
+	SystemdUnit: []*osbuild.SystemdUnitStageOptions{
+		{
+			Unit:   "nm-cloud-setup.service",
+			Dropin: "10-rh-enable-for-azure.conf",
+			Config: osbuild.SystemdServiceUnitDropin{
+				Service: &osbuild.SystemdUnitServiceSection{
+					Environment: "NM_CLOUD_SETUP_AZURE=yes",
+				},
+			},
+		},
+	},
+	DefaultTarget: common.ToPtr("multi-user.target"),
+}
+
+// Diff of the default Image Config compare to the `defaultAzureImageConfig`
+var defaultAzureByosImageConfig = &distro.ImageConfig{
+	GPGKeyFiles: []string{
+		"/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release",
+	},
+	RHSMConfig: map[subscription.RHSMStatus]*osbuild.RHSMStageOptions{
+		subscription.RHSMConfigNoSubscription: {
+			SubMan: &osbuild.RHSMStageOptionsSubMan{
+				Rhsmcertd: &osbuild.SubManConfigRHSMCERTDSection{
+					AutoRegistration: common.ToPtr(true),
+				},
+				// Don't disable RHSM redhat.repo management on the GCE
+				// image, which is BYOS and does not use RHUI for content.
+				// Otherwise subscribing the system manually after booting
+				// it would result in empty redhat.repo. Without RHUI, such
+				// system would have no way to get Red Hat content, but
+				// enable the repo management manually, which would be very
+				// confusing.
+			},
+		},
+		subscription.RHSMConfigWithSubscription: {
+			SubMan: &osbuild.RHSMStageOptionsSubMan{
+				Rhsmcertd: &osbuild.SubManConfigRHSMCERTDSection{
+					AutoRegistration: common.ToPtr(true),
+				},
+				// do not disable the redhat.repo management if the user
+				// explicitly request the system to be subscribed
+			},
+		},
+	},
+}
+
+// Diff of the default Image Config compare to the `defaultAzureImageConfig`
+var defaultAzureRhuiImageConfig = &distro.ImageConfig{
+	GPGKeyFiles: []string{
+		"/etc/pki/rpm-gpg/RPM-GPG-KEY-microsoft-azure-release",
+		"/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release",
+	},
+	RHSMConfig: map[subscription.RHSMStatus]*osbuild.RHSMStageOptions{
+		subscription.RHSMConfigNoSubscription: {
+			DnfPlugins: &osbuild.RHSMStageOptionsDnfPlugins{
+				SubscriptionManager: &osbuild.RHSMStageOptionsDnfPlugin{
+					Enabled: false,
+				},
+			},
+			SubMan: &osbuild.RHSMStageOptionsSubMan{
+				Rhsmcertd: &osbuild.SubManConfigRHSMCERTDSection{
+					AutoRegistration: common.ToPtr(true),
+				},
+				Rhsm: &osbuild.SubManConfigRHSMSection{
+					ManageRepos: common.ToPtr(false),
+				},
+			},
+		},
+		subscription.RHSMConfigWithSubscription: {
+			SubMan: &osbuild.RHSMStageOptionsSubMan{
+				Rhsmcertd: &osbuild.SubManConfigRHSMCERTDSection{
+					AutoRegistration: common.ToPtr(true),
+				},
+				// do not disable the redhat.repo management if the user
+				// explicitly request the system to be subscribed
+			},
+		},
+	},
+}
+
+const wildflyPath = "/opt/rh/eap7/root/usr/share/wildfly"
+
+var defaultAzureEapImageConfig = &distro.ImageConfig{
+	// shell env vars for EAP
+	ShellInit: []shell.InitFile{
+		{
+			Filename: "eap_env.sh",
+			Variables: []shell.EnvironmentVariable{
+				{
+					Key:   "EAP_HOME",
+					Value: wildflyPath,
+				},
+				{
+					Key:   "JBOSS_HOME",
+					Value: wildflyPath,
+				},
+			},
+		},
+	},
+}
+
+func defaultVhdImageConfig() *distro.ImageConfig {
+	imageConfig := &distro.ImageConfig{
+		EnabledServices: append(defaultAzureImageConfig.EnabledServices, "firewalld"),
+	}
+	return imageConfig.InheritFrom(defaultAzureImageConfig)
+}
+
+func sapAzureImageConfig(rd distribution) *distro.ImageConfig {
+	return sapImageConfig(rd).InheritFrom(defaultVhdImageConfig())
+}

vendor/github.com/osbuild/images/pkg/distro/rhel8/bare_metal.go

@@ -0,0 +1,302 @@
+package rhel8
+
+import (
+	"fmt"
+
+	"github.com/osbuild/images/pkg/platform"
+	"github.com/osbuild/images/pkg/rpmmd"
+)
+
+func imageInstaller() imageType {
+	return imageType{
+		name:     "image-installer",
+		filename: "installer.iso",
+		mimeType: "application/x-iso9660-image",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey:        bareMetalPackageSet,
+			installerPkgsKey: anacondaPackageSet,
+		},
+		rpmOstree:        false,
+		bootISO:          true,
+		bootable:         true,
+		image:            imageInstallerImage,
+		buildPipelines:   []string{"build"},
+		payloadPipelines: []string{"anaconda-tree", "rootfs-image", "efiboot-tree", "os", "bootiso-tree", "bootiso"},
+		exports:          []string{"bootiso"},
+	}
+}
+
+func tarImgType() imageType {
+	return imageType{
+		name:     "tar",
+		filename: "root.tar.xz",
+		mimeType: "application/x-tar",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey: func(t *imageType) rpmmd.PackageSet {
+				return rpmmd.PackageSet{
+					Include: []string{"policycoreutils", "selinux-policy-targeted"},
+					Exclude: []string{"rng-tools"},
+				}
+			},
+		},
+		image:            tarImage,
+		buildPipelines:   []string{"build"},
+		payloadPipelines: []string{"os", "archive"},
+		exports:          []string{"archive"},
+	}
+}
+
+func bareMetalPackageSet(t *imageType) rpmmd.PackageSet {
+	ps := rpmmd.PackageSet{
+		Include: []string{
+			"@core",
+			"authselect-compat",
+			"chrony",
+			"cockpit-system",
+			"cockpit-ws",
+			"dhcp-client",
+			"dnf",
+			"dnf-utils",
+			"dosfstools",
+			"dracut-norescue",
+			"iwl1000-firmware",
+			"iwl100-firmware",
+			"iwl105-firmware",
+			"iwl135-firmware",
+			"iwl2000-firmware",
+			"iwl2030-firmware",
+			"iwl3160-firmware",
+			"iwl3945-firmware",
+			"iwl4965-firmware",
+			"iwl5000-firmware",
+			"iwl5150-firmware",
+			"iwl6000-firmware",
+			"iwl6000g2a-firmware",
+			"iwl6000g2b-firmware",
+			"iwl6050-firmware",
+			"iwl7260-firmware",
+			"lvm2",
+			"net-tools",
+			"NetworkManager",
+			"nfs-utils",
+			"oddjob",
+			"oddjob-mkhomedir",
+			"policycoreutils",
+			"psmisc",
+			"python3-jsonschema",
+			"qemu-guest-agent",
+			"redhat-release",
+			"redhat-release-eula",
+			"rsync",
+			"selinux-policy-targeted",
+			"tar",
+			"tcpdump",
+			"yum",
+		},
+		Exclude: nil,
+	}.Append(distroSpecificPackageSet(t))
+
+	// Ensure to not pull in subscription-manager on non-RHEL distro
+	if t.arch.distro.isRHEL() {
+		ps = ps.Append(rpmmd.PackageSet{
+			Include: []string{
+				"subscription-manager-cockpit",
+			},
+		})
+	}
+
+	return ps
+}
+
+func installerPackageSet(t *imageType) rpmmd.PackageSet {
+	ps := rpmmd.PackageSet{
+		Include: []string{
+			"anaconda-dracut",
+			"curl",
+			"dracut-config-generic",
+			"dracut-network",
+			"hostname",
+			"iwl100-firmware",
+			"iwl1000-firmware",
+			"iwl105-firmware",
+			"iwl135-firmware",
+			"iwl2000-firmware",
+			"iwl2030-firmware",
+			"iwl3160-firmware",
+			"iwl5000-firmware",
+			"iwl5150-firmware",
+			"iwl6000-firmware",
+			"iwl6050-firmware",
+			"iwl7260-firmware",
+			"kernel",
+			"less",
+			"nfs-utils",
+			"openssh-clients",
+			"ostree",
+			"plymouth",
+			"prefixdevname",
+			"rng-tools",
+			"rpcbind",
+			"selinux-policy-targeted",
+			"systemd",
+			"tar",
+			"xfsprogs",
+			"xz",
+		},
+	}
+
+	switch t.arch.Name() {
+	case platform.ARCH_X86_64.String():
+		ps = ps.Append(rpmmd.PackageSet{
+			Include: []string{
+				"biosdevname",
+			},
+		})
+	}
+
+	return ps
+}
+
+func anacondaPackageSet(t *imageType) rpmmd.PackageSet {
+
+	// common installer packages
+	ps := installerPackageSet(t)
+
+	ps = ps.Append(rpmmd.PackageSet{
+		Include: []string{
+			"aajohan-comfortaa-fonts",
+			"abattis-cantarell-fonts",
+			"alsa-firmware",
+			"alsa-tools-firmware",
+			"anaconda",
+			"anaconda-install-env-deps",
+			"anaconda-widgets",
+			"audit",
+			"bind-utils",
+			"bitmap-fangsongti-fonts",
+			"bzip2",
+			"cryptsetup",
+			"dbus-x11",
+			"dejavu-sans-fonts",
+			"dejavu-sans-mono-fonts",
+			"device-mapper-persistent-data",
+			"dnf",
+			"dump",
+			"ethtool",
+			"fcoe-utils",
+			"ftp",
+			"gdb-gdbserver",
+			"gdisk",
+			"gfs2-utils",
+			"glibc-all-langpacks",
+			"google-noto-sans-cjk-ttc-fonts",
+			"gsettings-desktop-schemas",
+			"hdparm",
+			"hexedit",
+			"initscripts",
+			"ipmitool",
+			"iwl3945-firmware",
+			"iwl4965-firmware",
+			"iwl6000g2a-firmware",
+			"iwl6000g2b-firmware",
+			"jomolhari-fonts",
+			"kacst-farsi-fonts",
+			"kacst-qurn-fonts",
+			"kbd",
+			"kbd-misc",
+			"kdump-anaconda-addon",
+			"khmeros-base-fonts",
+			"libblockdev-lvm-dbus",
+			"libertas-sd8686-firmware",
+			"libertas-sd8787-firmware",
+			"libertas-usb8388-firmware",
+			"libertas-usb8388-olpc-firmware",
+			"libibverbs",
+			"libreport-plugin-bugzilla",
+			"libreport-plugin-reportuploader",
+			"libreport-rhel-anaconda-bugzilla",
+			"librsvg2",
+			"linux-firmware",
+			"lklug-fonts",
+			"lldpad",
+			"lohit-assamese-fonts",
+			"lohit-bengali-fonts",
+			"lohit-devanagari-fonts",
+			"lohit-gujarati-fonts",
+			"lohit-gurmukhi-fonts",
+			"lohit-kannada-fonts",
+			"lohit-odia-fonts",
+			"lohit-tamil-fonts",
+			"lohit-telugu-fonts",
+			"lsof",
+			"madan-fonts",
+			"metacity",
+			"mtr",
+			"mt-st",
+			"net-tools",
+			"nmap-ncat",
+			"nm-connection-editor",
+			"nss-tools",
+			"openssh-server",
+			"oscap-anaconda-addon",
+			"pciutils",
+			"perl-interpreter",
+			"pigz",
+			"python3-pyatspi",
+			"rdma-core",
+			"redhat-release-eula",
+			"rpm-ostree",
+			"rsync",
+			"rsyslog",
+			"sg3_utils",
+			"sil-abyssinica-fonts",
+			"sil-padauk-fonts",
+			"sil-scheherazade-fonts",
+			"smartmontools",
+			"smc-meera-fonts",
+			"spice-vdagent",
+			"strace",
+			"system-storage-manager",
+			"thai-scalable-waree-fonts",
+			"tigervnc-server-minimal",
+			"tigervnc-server-module",
+			"udisks2",
+			"udisks2-iscsi",
+			"usbutils",
+			"vim-minimal",
+			"volume_key",
+			"wget",
+			"xfsdump",
+			"xorg-x11-drivers",
+			"xorg-x11-fonts-misc",
+			"xorg-x11-server-utils",
+			"xorg-x11-server-Xorg",
+			"xorg-x11-xauth",
+		},
+	})
+
+	ps = ps.Append(anacondaBootPackageSet(t))
+
+	switch t.arch.Name() {
+	case platform.ARCH_X86_64.String():
+		ps = ps.Append(rpmmd.PackageSet{
+			Include: []string{
+				"biosdevname",
+				"dmidecode",
+				"memtest86+",
+			},
+		})
+
+	case platform.ARCH_AARCH64.String():
+		ps = ps.Append(rpmmd.PackageSet{
+			Include: []string{
+				"dmidecode",
+			},
+		})
+
+	default:
+		panic(fmt.Sprintf("unsupported arch: %s", t.arch.Name()))
+	}
+
+	return ps
+}

vendor/github.com/osbuild/images/pkg/distro/rhel8/distro.go

@@ -0,0 +1,506 @@
+package rhel8
+
+import (
+	"errors"
+	"fmt"
+	"sort"
+	"strings"
+
+	"github.com/osbuild/images/internal/common"
+	"github.com/osbuild/images/internal/oscap"
+	"github.com/osbuild/images/pkg/distro"
+	"github.com/osbuild/images/pkg/osbuild"
+	"github.com/osbuild/images/pkg/platform"
+	"github.com/osbuild/images/pkg/runner"
+)
+
+var (
+	// rhel8 allow all
+	oscapProfileAllowList = []oscap.Profile{
+		oscap.AnssiBp28Enhanced,
+		oscap.AnssiBp28High,
+		oscap.AnssiBp28Intermediary,
+		oscap.AnssiBp28Minimal,
+		oscap.Cis,
+		oscap.CisServerL1,
+		oscap.CisWorkstationL1,
+		oscap.CisWorkstationL2,
+		oscap.Cui,
+		oscap.E8,
+		oscap.Hippa,
+		oscap.IsmO,
+		oscap.Ospp,
+		oscap.PciDss,
+		oscap.Stig,
+		oscap.StigGui,
+	}
+)
+
+type distribution struct {
+	name               string
+	product            string
+	osVersion          string
+	releaseVersion     string
+	modulePlatformID   string
+	vendor             string
+	ostreeRefTmpl      string
+	isolabelTmpl       string
+	runner             runner.Runner
+	arches             map[string]distro.Arch
+	defaultImageConfig *distro.ImageConfig
+}
+
+// RHEL-based OS image configuration defaults
+var defaultDistroImageConfig = &distro.ImageConfig{
+	Timezone: common.ToPtr("America/New_York"),
+	Locale:   common.ToPtr("en_US.UTF-8"),
+	Sysconfig: []*osbuild.SysconfigStageOptions{
+		{
+			Kernel: &osbuild.SysconfigKernelOptions{
+				UpdateDefault: true,
+				DefaultKernel: "kernel",
+			},
+			Network: &osbuild.SysconfigNetworkOptions{
+				Networking: true,
+				NoZeroConf: true,
+			},
+		},
+	},
+}
+
+func (d *distribution) Name() string {
+	return d.name
+}
+
+func (d *distribution) Releasever() string {
+	return d.releaseVersion
+}
+
+func (d *distribution) ModulePlatformID() string {
+	return d.modulePlatformID
+}
+
+func (d *distribution) OSTreeRef() string {
+	return d.ostreeRefTmpl
+}
+
+func (d *distribution) ListArches() []string {
+	archNames := make([]string, 0, len(d.arches))
+	for name := range d.arches {
+		archNames = append(archNames, name)
+	}
+	sort.Strings(archNames)
+	return archNames
+}
+
+func (d *distribution) GetArch(name string) (distro.Arch, error) {
+	arch, exists := d.arches[name]
+	if !exists {
+		return nil, errors.New("invalid architecture: " + name)
+	}
+	return arch, nil
+}
+
+func (d *distribution) addArches(arches ...architecture) {
+	if d.arches == nil {
+		d.arches = map[string]distro.Arch{}
+	}
+
+	// Do not make copies of architectures, as opposed to image types,
+	// because architecture definitions are not used by more than a single
+	// distro definition.
+	for idx := range arches {
+		d.arches[arches[idx].name] = &arches[idx]
+	}
+}
+
+func (d *distribution) isRHEL() bool {
+	return strings.HasPrefix(d.name, "rhel")
+}
+
+func (d *distribution) getDefaultImageConfig() *distro.ImageConfig {
+	return d.defaultImageConfig
+}
+
+// New creates a new distro object, defining the supported architectures and image types
+func New() distro.Distro {
+	// default minor: create default minor version (current GA) and rename it
+	d := newDistro("rhel", 7)
+	d.name = "rhel-8"
+	return d
+
+}
+
+func NewRHEL84() distro.Distro {
+	return newDistro("rhel", 4)
+}
+
+func NewRHEL85() distro.Distro {
+	return newDistro("rhel", 5)
+}
+
+func NewRHEL86() distro.Distro {
+	return newDistro("rhel", 6)
+}
+
+func NewRHEL87() distro.Distro {
+	return newDistro("rhel", 7)
+}
+
+func NewRHEL88() distro.Distro {
+	return newDistro("rhel", 8)
+}
+
+func NewRHEL89() distro.Distro {
+	return newDistro("rhel", 9)
+}
+
+func NewCentos() distro.Distro {
+	return newDistro("centos", 0)
+}
+
+func newDistro(name string, minor int) *distribution {
+	var rd distribution
+	switch name {
+	case "rhel":
+		rd = distribution{
+			name:               fmt.Sprintf("rhel-8%d", minor),
+			product:            "Red Hat Enterprise Linux",
+			osVersion:          fmt.Sprintf("8.%d", minor),
+			releaseVersion:     "8",
+			modulePlatformID:   "platform:el8",
+			vendor:             "redhat",
+			ostreeRefTmpl:      "rhel/8/%s/edge",
+			isolabelTmpl:       fmt.Sprintf("RHEL-8-%d-0-BaseOS-%%s", minor),
+			runner:             &runner.RHEL{Major: uint64(8), Minor: uint64(minor)},
+			defaultImageConfig: defaultDistroImageConfig,
+		}
+	case "centos":
+		rd = distribution{
+			name:               "centos-8",
+			product:            "CentOS Stream",
+			osVersion:          "8-stream",
+			releaseVersion:     "8",
+			modulePlatformID:   "platform:el8",
+			vendor:             "centos",
+			ostreeRefTmpl:      "centos/8/%s/edge",
+			isolabelTmpl:       "CentOS-Stream-8-%s-dvd",
+			runner:             &runner.CentOS{Version: uint64(8)},
+			defaultImageConfig: defaultDistroImageConfig,
+		}
+	default:
+		panic(fmt.Sprintf("unknown distro name: %s", name))
+	}
+
+	// Architecture definitions
+	x86_64 := architecture{
+		name:   platform.ARCH_X86_64.String(),
+		distro: &rd,
+	}
+
+	aarch64 := architecture{
+		name:   platform.ARCH_AARCH64.String(),
+		distro: &rd,
+	}
+
+	ppc64le := architecture{
+		distro: &rd,
+		name:   platform.ARCH_PPC64LE.String(),
+	}
+	s390x := architecture{
+		distro: &rd,
+		name:   platform.ARCH_S390X.String(),
+	}
+
+	ociImgType := qcow2ImgType(rd)
+	ociImgType.name = "oci"
+
+	x86_64.addImageTypes(
+		&platform.X86{
+			BIOS:       true,
+			UEFIVendor: rd.vendor,
+			BasePlatform: platform.BasePlatform{
+				ImageFormat: platform.FORMAT_QCOW2,
+				QCOW2Compat: "0.10",
+			},
+		},
+		qcow2ImgType(rd),
+		ociImgType,
+	)
+
+	x86_64.addImageTypes(
+		&platform.X86{
+			BIOS:       true,
+			UEFIVendor: rd.vendor,
+			BasePlatform: platform.BasePlatform{
+				ImageFormat: platform.FORMAT_QCOW2,
+			},
+		},
+		openstackImgType(),
+	)
+
+	ec2X86Platform := &platform.X86{
+		BIOS:       true,
+		UEFIVendor: rd.vendor,
+		BasePlatform: platform.BasePlatform{
+			ImageFormat: platform.FORMAT_RAW,
+		},
+	}
+	x86_64.addImageTypes(
+		ec2X86Platform,
+		amiImgTypeX86_64(rd),
+	)
+
+	bareMetalX86Platform := &platform.X86{
+		BasePlatform: platform.BasePlatform{
+			FirmwarePackages: []string{
+				"microcode_ctl", // ??
+				"iwl1000-firmware",
+				"iwl100-firmware",
+				"iwl105-firmware",
+				"iwl135-firmware",
+				"iwl2000-firmware",
+				"iwl2030-firmware",
+				"iwl3160-firmware",
+				"iwl5000-firmware",
+				"iwl5150-firmware",
+				"iwl6050-firmware",
+			},
+		},
+		BIOS:       true,
+		UEFIVendor: rd.vendor,
+	}
+
+	x86_64.addImageTypes(
+		bareMetalX86Platform,
+		edgeOCIImgType(rd),
+		edgeCommitImgType(rd),
+		edgeInstallerImgType(rd),
+		imageInstaller(),
+	)
+
+	gceX86Platform := &platform.X86{
+		UEFIVendor: rd.vendor,
+		BasePlatform: platform.BasePlatform{
+			ImageFormat: platform.FORMAT_GCE,
+		},
+	}
+
+	x86_64.addImageTypes(
+		gceX86Platform,
+		gceImgType(rd),
+	)
+
+	x86_64.addImageTypes(
+		&platform.X86{
+			BIOS:       true,
+			UEFIVendor: rd.vendor,
+			BasePlatform: platform.BasePlatform{
+				ImageFormat: platform.FORMAT_VMDK,
+			},
+		},
+		vmdkImgType(),
+	)
+
+	x86_64.addImageTypes(
+		&platform.X86{
+			BIOS:       true,
+			UEFIVendor: rd.vendor,
+			BasePlatform: platform.BasePlatform{
+				ImageFormat: platform.FORMAT_OVA,
+			},
+		},
+		ovaImgType(),
+	)
+
+	x86_64.addImageTypes(
+		&platform.X86{},
+		tarImgType(),
+	)
+
+	aarch64.addImageTypes(
+		&platform.Aarch64{
+			UEFIVendor: rd.vendor,
+			BasePlatform: platform.BasePlatform{
+				ImageFormat: platform.FORMAT_QCOW2,
+				QCOW2Compat: "0.10",
+			},
+		},
+		qcow2ImgType(rd),
+	)
+
+	aarch64.addImageTypes(
+		&platform.Aarch64{
+			UEFIVendor: rd.vendor,
+			BasePlatform: platform.BasePlatform{
+				ImageFormat: platform.FORMAT_QCOW2,
+			},
+		},
+		openstackImgType(),
+	)
+
+	aarch64.addImageTypes(
+		&platform.Aarch64{},
+		tarImgType(),
+	)
+
+	bareMetalAarch64Platform := &platform.Aarch64{
+		BasePlatform: platform.BasePlatform{},
+		UEFIVendor:   rd.vendor,
+	}
+
+	aarch64.addImageTypes(
+		bareMetalAarch64Platform,
+		edgeOCIImgType(rd),
+		edgeCommitImgType(rd),
+		edgeInstallerImgType(rd),
+		imageInstaller(),
+	)
+
+	rawAarch64Platform := &platform.Aarch64{
+		UEFIVendor: rd.vendor,
+		BasePlatform: platform.BasePlatform{
+			ImageFormat: platform.FORMAT_RAW,
+		},
+	}
+
+	aarch64.addImageTypes(
+		rawAarch64Platform,
+		amiImgTypeAarch64(rd),
+	)
+
+	ppc64le.addImageTypes(
+		&platform.PPC64LE{
+			BIOS: true,
+			BasePlatform: platform.BasePlatform{
+				ImageFormat: platform.FORMAT_QCOW2,
+				QCOW2Compat: "0.10",
+			},
+		},
+		qcow2ImgType(rd),
+	)
+
+	ppc64le.addImageTypes(
+		&platform.PPC64LE{},
+		tarImgType(),
+	)
+
+	s390x.addImageTypes(
+		&platform.S390X{
+			Zipl: true,
+			BasePlatform: platform.BasePlatform{
+				ImageFormat: platform.FORMAT_QCOW2,
+				QCOW2Compat: "0.10",
+			},
+		},
+		qcow2ImgType(rd),
+	)
+
+	s390x.addImageTypes(
+		&platform.S390X{},
+		tarImgType(),
+	)
+
+	azureX64Platform := &platform.X86{
+		BIOS:       true,
+		UEFIVendor: rd.vendor,
+		BasePlatform: platform.BasePlatform{
+			ImageFormat: platform.FORMAT_VHD,
+		},
+	}
+
+	azureAarch64Platform := &platform.Aarch64{
+		UEFIVendor: rd.vendor,
+		BasePlatform: platform.BasePlatform{
+			ImageFormat: platform.FORMAT_VHD,
+		},
+	}
+
+	rawUEFIx86Platform := &platform.X86{
+		BasePlatform: platform.BasePlatform{
+			ImageFormat: platform.FORMAT_RAW,
+		},
+		BIOS:       false,
+		UEFIVendor: rd.vendor,
+	}
+
+	if rd.isRHEL() {
+		if !common.VersionLessThan(rd.osVersion, "8.6") {
+			// image types only available on 8.6 and later on RHEL
+			// These edge image types require FDO which aren't available on older versions
+			x86_64.addImageTypes(
+				bareMetalX86Platform,
+				edgeRawImgType(),
+			)
+
+			x86_64.addImageTypes(
+				rawUEFIx86Platform,
+				edgeSimplifiedInstallerImgType(rd),
+			)
+
+			azureEap := azureEap7RhuiImgType()
+			x86_64.addImageTypes(azureX64Platform, azureEap)
+
+			aarch64.addImageTypes(
+				rawAarch64Platform,
+				edgeRawImgType(),
+				edgeSimplifiedInstallerImgType(rd),
+			)
+
+			// The Azure image types require hyperv-daemons which isn't available on older versions
+			aarch64.addImageTypes(azureAarch64Platform, azureRhuiImgType(), azureByosImgType())
+		}
+
+		// add azure to RHEL distro only
+		x86_64.addImageTypes(azureX64Platform, azureRhuiImgType(), azureByosImgType(), azureSapRhuiImgType(rd))
+
+		// keep the RHEL EC2 x86_64 images before 8.9 BIOS-only for backward compatibility
+		if common.VersionLessThan(rd.osVersion, "8.9") {
+			ec2X86Platform = &platform.X86{
+				BIOS: true,
+				BasePlatform: platform.BasePlatform{
+					ImageFormat: platform.FORMAT_RAW,
+				},
+			}
+		}
+
+		// add ec2 image types to RHEL distro only
+		x86_64.addImageTypes(ec2X86Platform, ec2ImgTypeX86_64(rd), ec2HaImgTypeX86_64(rd))
+		aarch64.addImageTypes(rawAarch64Platform, ec2ImgTypeAarch64(rd))
+
+		if rd.osVersion != "8.5" {
+			// NOTE: RHEL 8.5 is going away and these image types require some
+			// work to get working, so we just disable them here until the
+			// whole distro gets deleted
+			x86_64.addImageTypes(ec2X86Platform, ec2SapImgTypeX86_64(rd))
+		}
+
+		// add GCE RHUI image to RHEL only
+		x86_64.addImageTypes(gceX86Platform, gceRhuiImgType(rd))
+
+		// add s390x to RHEL distro only
+		rd.addArches(s390x)
+	} else {
+		x86_64.addImageTypes(
+			bareMetalX86Platform,
+			edgeRawImgType(),
+		)
+
+		x86_64.addImageTypes(
+			rawUEFIx86Platform,
+			edgeSimplifiedInstallerImgType(rd),
+		)
+
+		x86_64.addImageTypes(azureX64Platform, azureImgType())
+
+		aarch64.addImageTypes(
+			rawAarch64Platform,
+			edgeRawImgType(),
+			edgeSimplifiedInstallerImgType(rd),
+		)
+
+		aarch64.addImageTypes(azureAarch64Platform, azureImgType())
+	}
+	rd.addArches(x86_64, aarch64, ppc64le)
+	return &rd
+}

vendor/github.com/osbuild/images/pkg/distro/rhel8/edge.go

@@ -0,0 +1,381 @@
+package rhel8
+
+import (
+	"fmt"
+
+	"github.com/osbuild/images/internal/common"
+	"github.com/osbuild/images/pkg/distro"
+	"github.com/osbuild/images/pkg/platform"
+	"github.com/osbuild/images/pkg/rpmmd"
+)
+
+func edgeCommitImgType(rd distribution) imageType {
+	it := imageType{
+		name:        "edge-commit",
+		nameAliases: []string{"rhel-edge-commit"},
+		filename:    "commit.tar",
+		mimeType:    "application/x-tar",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey: edgeCommitPackageSet,
+		},
+		defaultImageConfig: &distro.ImageConfig{
+			EnabledServices: edgeServices(rd),
+		},
+		rpmOstree:        true,
+		image:            edgeCommitImage,
+		buildPipelines:   []string{"build"},
+		payloadPipelines: []string{"os", "ostree-commit", "commit-archive"},
+		exports:          []string{"commit-archive"},
+	}
+	return it
+}
+
+func edgeOCIImgType(rd distribution) imageType {
+	it := imageType{
+		name:        "edge-container",
+		nameAliases: []string{"rhel-edge-container"},
+		filename:    "container.tar",
+		mimeType:    "application/x-tar",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey: edgeCommitPackageSet,
+			containerPkgsKey: func(t *imageType) rpmmd.PackageSet {
+				return rpmmd.PackageSet{
+					Include: []string{"nginx"},
+				}
+			},
+		},
+		defaultImageConfig: &distro.ImageConfig{
+			EnabledServices: edgeServices(rd),
+		},
+		rpmOstree:        true,
+		bootISO:          false,
+		image:            edgeContainerImage,
+		buildPipelines:   []string{"build"},
+		payloadPipelines: []string{"os", "ostree-commit", "container-tree", "container"},
+		exports:          []string{"container"},
+	}
+	return it
+}
+
+func edgeRawImgType() imageType {
+	it := imageType{
+		name:                "edge-raw-image",
+		nameAliases:         []string{"rhel-edge-raw-image"},
+		filename:            "image.raw.xz",
+		compression:         "xz",
+		mimeType:            "application/xz",
+		packageSets:         nil,
+		defaultSize:         10 * common.GibiByte,
+		rpmOstree:           true,
+		bootable:            true,
+		bootISO:             false,
+		image:               edgeRawImage,
+		buildPipelines:      []string{"build"},
+		payloadPipelines:    []string{"ostree-deployment", "image", "xz"},
+		exports:             []string{"xz"},
+		basePartitionTables: edgeBasePartitionTables,
+	}
+	return it
+}
+
+func edgeInstallerImgType(rd distribution) imageType {
+	it := imageType{
+		name:        "edge-installer",
+		nameAliases: []string{"rhel-edge-installer"},
+		filename:    "installer.iso",
+		mimeType:    "application/x-iso9660-image",
+		packageSets: map[string]packageSetFunc{
+			// TODO: non-arch-specific package set handling for installers
+			// This image type requires build packages for installers and
+			// ostree/edge.  For now we only have x86-64 installer build
+			// package sets defined.  When we add installer build package sets
+			// for other architectures, this will need to be moved to the
+			// architecture and the merging will happen in the PackageSets()
+			// method like the other sets.
+			installerPkgsKey: edgeInstallerPackageSet,
+		},
+		defaultImageConfig: &distro.ImageConfig{
+			EnabledServices: edgeServices(rd),
+		},
+		rpmOstree:        true,
+		bootISO:          true,
+		image:            edgeInstallerImage,
+		buildPipelines:   []string{"build"},
+		payloadPipelines: []string{"anaconda-tree", "rootfs-image", "efiboot-tree", "bootiso-tree", "bootiso"},
+		exports:          []string{"bootiso"},
+	}
+	return it
+}
+
+func edgeSimplifiedInstallerImgType(rd distribution) imageType {
+	it := imageType{
+		name:        "edge-simplified-installer",
+		nameAliases: []string{"rhel-edge-simplified-installer"},
+		filename:    "simplified-installer.iso",
+		mimeType:    "application/x-iso9660-image",
+		packageSets: map[string]packageSetFunc{
+			// TODO: non-arch-specific package set handling for installers
+			// This image type requires build packages for installers and
+			// ostree/edge.  For now we only have x86-64 installer build
+			// package sets defined.  When we add installer build package sets
+			// for other architectures, this will need to be moved to the
+			// architecture and the merging will happen in the PackageSets()
+			// method like the other sets.
+			installerPkgsKey: edgeSimplifiedInstallerPackageSet,
+		},
+		defaultImageConfig: &distro.ImageConfig{
+			EnabledServices: edgeServices(rd),
+		},
+		defaultSize:         10 * common.GibiByte,
+		rpmOstree:           true,
+		bootable:            true,
+		bootISO:             true,
+		image:               edgeSimplifiedInstallerImage,
+		buildPipelines:      []string{"build"},
+		payloadPipelines:    []string{"ostree-deployment", "image", "xz", "coi-tree", "efiboot-tree", "bootiso-tree", "bootiso"},
+		exports:             []string{"bootiso"},
+		basePartitionTables: edgeBasePartitionTables,
+	}
+	return it
+}
+
+// edge commit OS package set
+func edgeCommitPackageSet(t *imageType) rpmmd.PackageSet {
+	ps := rpmmd.PackageSet{
+		Include: []string{
+			"attr",
+			"audit",
+			"basesystem",
+			"bash",
+			"bash-completion",
+			"chrony",
+			"clevis",
+			"clevis-dracut",
+			"clevis-luks",
+			"container-selinux",
+			"coreutils",
+			"criu",
+			"cryptsetup",
+			"curl",
+			"dnsmasq",
+			"dosfstools",
+			"dracut-config-generic",
+			"dracut-network",
+			"e2fsprogs",
+			"firewalld",
+			"fuse-overlayfs",
+			"fwupd",
+			"glibc",
+			"glibc-minimal-langpack",
+			"gnupg2",
+			"greenboot",
+			"gzip",
+			"hostname",
+			"ima-evm-utils",
+			"iproute",
+			"iptables",
+			"iputils",
+			"keyutils",
+			"less",
+			"lvm2",
+			"NetworkManager",
+			"NetworkManager-wifi",
+			"NetworkManager-wwan",
+			"nss-altfiles",
+			"openssh-clients",
+			"openssh-server",
+			"passwd",
+			"pinentry",
+			"platform-python",
+			"podman",
+			"policycoreutils",
+			"policycoreutils-python-utils",
+			"polkit",
+			"procps-ng",
+			"redhat-release",
+			"rootfiles",
+			"rpm",
+			"rpm-ostree",
+			"rsync",
+			"selinux-policy-targeted",
+			"setools-console",
+			"setup",
+			"shadow-utils",
+			"shadow-utils",
+			"skopeo",
+			"slirp4netns",
+			"sudo",
+			"systemd",
+			"tar",
+			"tmux",
+			"traceroute",
+			"usbguard",
+			"util-linux",
+			"vim-minimal",
+			"wpa_supplicant",
+			"xz",
+		},
+		Exclude: []string{"rng-tools"},
+	}
+
+	switch t.arch.Name() {
+	case platform.ARCH_X86_64.String():
+		ps = ps.Append(x8664EdgeCommitPackageSet(t))
+
+	case platform.ARCH_AARCH64.String():
+		ps = ps.Append(aarch64EdgeCommitPackageSet(t))
+	}
+
+	if t.arch.distro.isRHEL() && common.VersionLessThan(t.arch.distro.osVersion, "8.6") {
+		ps = ps.Append(rpmmd.PackageSet{
+			Include: []string{
+				"greenboot-grub2",
+				"greenboot-reboot",
+				"greenboot-rpm-ostree-grub2",
+				"greenboot-status",
+			},
+		})
+	} else {
+		// 8.6+ and CS8
+		ps = ps.Append(rpmmd.PackageSet{
+			Include: []string{
+				"fdo-client",
+				"fdo-owner-cli",
+				"greenboot-default-health-checks",
+				"sos",
+			},
+		})
+	}
+
+	return ps
+
+}
+
+func x8664EdgeCommitPackageSet(t *imageType) rpmmd.PackageSet {
+	return rpmmd.PackageSet{
+		Include: []string{
+			"efibootmgr",
+			"grub2",
+			"grub2-efi-x64",
+			"iwl1000-firmware",
+			"iwl100-firmware",
+			"iwl105-firmware",
+			"iwl135-firmware",
+			"iwl2000-firmware",
+			"iwl2030-firmware",
+			"iwl3160-firmware",
+			"iwl5000-firmware",
+			"iwl5150-firmware",
+			"iwl6000-firmware",
+			"iwl6050-firmware",
+			"iwl7260-firmware",
+			"microcode_ctl",
+			"shim-x64",
+		},
+		Exclude: nil,
+	}
+}
+
+func aarch64EdgeCommitPackageSet(t *imageType) rpmmd.PackageSet {
+	return rpmmd.PackageSet{
+		Include: []string{
+			"efibootmgr",
+			"grub2-efi-aa64",
+			"iwl7260-firmware",
+			"shim-aa64",
+		},
+		Exclude: nil,
+	}
+}
+
+func edgeInstallerPackageSet(t *imageType) rpmmd.PackageSet {
+	return anacondaPackageSet(t)
+}
+
+func edgeSimplifiedInstallerPackageSet(t *imageType) rpmmd.PackageSet {
+	// common installer packages
+	ps := installerPackageSet(t)
+
+	ps = ps.Append(rpmmd.PackageSet{
+		Include: []string{
+			"attr",
+			"basesystem",
+			"binutils",
+			"bsdtar",
+			"clevis-dracut",
+			"clevis-luks",
+			"cloud-utils-growpart",
+			"coreos-installer",
+			"coreos-installer-dracut",
+			"coreutils",
+			"device-mapper-multipath",
+			"dnsmasq",
+			"dosfstools",
+			"dracut-live",
+			"e2fsprogs",
+			"fcoe-utils",
+			"fdo-init",
+			"gzip",
+			"ima-evm-utils",
+			"iproute",
+			"iptables",
+			"iputils",
+			"iscsi-initiator-utils",
+			"keyutils",
+			"lldpad",
+			"lvm2",
+			"passwd",
+			"policycoreutils",
+			"policycoreutils-python-utils",
+			"procps-ng",
+			"redhat-logos",
+			"rootfiles",
+			"setools-console",
+			"sudo",
+			"traceroute",
+			"util-linux",
+		},
+		Exclude: nil,
+	})
+
+	switch t.arch.Name() {
+
+	case platform.ARCH_X86_64.String():
+		ps = ps.Append(x8664EdgeCommitPackageSet(t))
+	case platform.ARCH_AARCH64.String():
+		ps = ps.Append(aarch64EdgeCommitPackageSet(t))
+
+	default:
+		panic(fmt.Sprintf("unsupported arch: %s", t.arch.Name()))
+	}
+
+	return ps
+}
+
+func edgeServices(rd distribution) []string {
+	// Common Services
+	var edgeServices = []string{"NetworkManager.service", "firewalld.service", "sshd.service"}
+
+	if rd.osVersion == "8.4" {
+		// greenboot services aren't enabled by default in 8.4
+		edgeServices = append(edgeServices,
+			"greenboot-grub2-set-counter",
+			"greenboot-grub2-set-success",
+			"greenboot-healthcheck",
+			"greenboot-rpm-ostree-grub2-check-fallback",
+			"greenboot-status",
+			"greenboot-task-runner",
+			"redboot-auto-reboot",
+			"redboot-task-runner")
+
+	}
+
+	if !(rd.isRHEL() && common.VersionLessThan(rd.osVersion, "8.6")) {
+		// enable fdo-client only on RHEL 8.6+ and CS8
+
+		// TODO(runcom): move fdo-client-linuxapp.service to presets?
+		edgeServices = append(edgeServices, "fdo-client-linuxapp.service")
+	}
+
+	return edgeServices
+}

vendor/github.com/osbuild/images/pkg/distro/rhel8/gce.go

@@ -0,0 +1,299 @@
+package rhel8
+
+import (
+	"github.com/osbuild/images/internal/common"
+	"github.com/osbuild/images/pkg/distro"
+	"github.com/osbuild/images/pkg/osbuild"
+	"github.com/osbuild/images/pkg/rpmmd"
+	"github.com/osbuild/images/pkg/subscription"
+)
+
+const gceKernelOptions = "net.ifnames=0 biosdevname=0 scsi_mod.use_blk_mq=Y crashkernel=auto console=ttyS0,38400n8d"
+
+func gceImgType(rd distribution) imageType {
+	return imageType{
+		name:     "gce",
+		filename: "image.tar.gz",
+		mimeType: "application/gzip",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey: gcePackageSet,
+		},
+		defaultImageConfig: defaultGceByosImageConfig(rd),
+		kernelOptions:      gceKernelOptions,
+		bootable:           true,
+		defaultSize:        20 * common.GibiByte,
+		image:              liveImage,
+		buildPipelines:     []string{"build"},
+		payloadPipelines:   []string{"os", "image", "archive"},
+		exports:            []string{"archive"},
+		// TODO: the base partition table still contains the BIOS boot partition, but the image is UEFI-only
+		basePartitionTables: defaultBasePartitionTables,
+	}
+}
+
+func gceRhuiImgType(rd distribution) imageType {
+	return imageType{
+		name:     "gce-rhui",
+		filename: "image.tar.gz",
+		mimeType: "application/gzip",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey: gceRhuiPackageSet,
+		},
+		defaultImageConfig: defaultGceRhuiImageConfig(rd),
+		kernelOptions:      gceKernelOptions,
+		bootable:           true,
+		defaultSize:        20 * common.GibiByte,
+		image:              liveImage,
+		buildPipelines:     []string{"build"},
+		payloadPipelines:   []string{"os", "image", "archive"},
+		exports:            []string{"archive"},
+		// TODO: the base partition table still contains the BIOS boot partition, but the image is UEFI-only
+		basePartitionTables: defaultBasePartitionTables,
+	}
+}
+
+func defaultGceByosImageConfig(rd distribution) *distro.ImageConfig {
+	ic := &distro.ImageConfig{
+		Timezone: common.ToPtr("UTC"),
+		TimeSynchronization: &osbuild.ChronyStageOptions{
+			Servers: []osbuild.ChronyConfigServer{{Hostname: "metadata.google.internal"}},
+		},
+		Firewall: &osbuild.FirewallStageOptions{
+			DefaultZone: "trusted",
+		},
+		EnabledServices: []string{
+			"sshd",
+			"rngd",
+			"dnf-automatic.timer",
+		},
+		DisabledServices: []string{
+			"sshd-keygen@",
+			"reboot.target",
+		},
+		DefaultTarget: common.ToPtr("multi-user.target"),
+		Locale:        common.ToPtr("en_US.UTF-8"),
+		Keyboard: &osbuild.KeymapStageOptions{
+			Keymap: "us",
+		},
+		DNFConfig: []*osbuild.DNFConfigStageOptions{
+			{
+				Config: &osbuild.DNFConfig{
+					Main: &osbuild.DNFConfigMain{
+						IPResolve: "4",
+					},
+				},
+			},
+		},
+		DNFAutomaticConfig: &osbuild.DNFAutomaticConfigStageOptions{
+			Config: &osbuild.DNFAutomaticConfig{
+				Commands: &osbuild.DNFAutomaticConfigCommands{
+					ApplyUpdates: common.ToPtr(true),
+					UpgradeType:  osbuild.DNFAutomaticUpgradeTypeSecurity,
+				},
+			},
+		},
+		YUMRepos: []*osbuild.YumReposStageOptions{
+			{
+				Filename: "google-cloud.repo",
+				Repos: []osbuild.YumRepository{
+					{
+						Id:           "google-compute-engine",
+						Name:         "Google Compute Engine",
+						BaseURLs:     []string{"https://packages.cloud.google.com/yum/repos/google-compute-engine-el8-x86_64-stable"},
+						Enabled:      common.ToPtr(true),
+						GPGCheck:     common.ToPtr(true),
+						RepoGPGCheck: common.ToPtr(false),
+						GPGKey: []string{
+							"https://packages.cloud.google.com/yum/doc/yum-key.gpg",
+							"https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg",
+						},
+					},
+				},
+			},
+		},
+		SshdConfig: &osbuild.SshdConfigStageOptions{
+			Config: osbuild.SshdConfigConfig{
+				PasswordAuthentication: common.ToPtr(false),
+				ClientAliveInterval:    common.ToPtr(420),
+				PermitRootLogin:        osbuild.PermitRootLoginValueNo,
+			},
+		},
+		Sysconfig: []*osbuild.SysconfigStageOptions{
+			{
+				Kernel: &osbuild.SysconfigKernelOptions{
+					DefaultKernel: "kernel-core",
+					UpdateDefault: true,
+				},
+			},
+		},
+		Modprobe: []*osbuild.ModprobeStageOptions{
+			{
+				Filename: "blacklist-floppy.conf",
+				Commands: osbuild.ModprobeConfigCmdList{
+					osbuild.NewModprobeConfigCmdBlacklist("floppy"),
+				},
+			},
+		},
+		GCPGuestAgentConfig: &osbuild.GcpGuestAgentConfigOptions{
+			ConfigScope: osbuild.GcpGuestAgentConfigScopeDistro,
+			Config: &osbuild.GcpGuestAgentConfig{
+				InstanceSetup: &osbuild.GcpGuestAgentConfigInstanceSetup{
+					SetBotoConfig: common.ToPtr(false),
+				},
+			},
+		},
+	}
+	if rd.osVersion == "8.4" {
+		// NOTE(akoutsou): these are enabled in the package preset, but for
+		// some reason do not get enabled on 8.4.
+		// the reason is unknown and deeply mysterious
+		ic.EnabledServices = append(ic.EnabledServices,
+			"google-oslogin-cache.timer",
+			"google-guest-agent.service",
+			"google-shutdown-scripts.service",
+			"google-startup-scripts.service",
+			"google-osconfig-agent.service",
+		)
+	}
+
+	if rd.isRHEL() {
+		ic.RHSMConfig = map[subscription.RHSMStatus]*osbuild.RHSMStageOptions{
+			subscription.RHSMConfigNoSubscription: {
+				SubMan: &osbuild.RHSMStageOptionsSubMan{
+					Rhsmcertd: &osbuild.SubManConfigRHSMCERTDSection{
+						AutoRegistration: common.ToPtr(true),
+					},
+					// Don't disable RHSM redhat.repo management on the GCE
+					// image, which is BYOS and does not use RHUI for content.
+					// Otherwise subscribing the system manually after booting
+					// it would result in empty redhat.repo. Without RHUI, such
+					// system would have no way to get Red Hat content, but
+					// enable the repo management manually, which would be very
+					// confusing.
+				},
+			},
+			subscription.RHSMConfigWithSubscription: {
+				SubMan: &osbuild.RHSMStageOptionsSubMan{
+					Rhsmcertd: &osbuild.SubManConfigRHSMCERTDSection{
+						AutoRegistration: common.ToPtr(true),
+					},
+					// do not disable the redhat.repo management if the user
+					// explicitly request the system to be subscribed
+				},
+			},
+		}
+	}
+	return ic
+}
+
+func defaultGceRhuiImageConfig(rd distribution) *distro.ImageConfig {
+	ic := &distro.ImageConfig{
+		RHSMConfig: map[subscription.RHSMStatus]*osbuild.RHSMStageOptions{
+			subscription.RHSMConfigNoSubscription: {
+				SubMan: &osbuild.RHSMStageOptionsSubMan{
+					Rhsmcertd: &osbuild.SubManConfigRHSMCERTDSection{
+						AutoRegistration: common.ToPtr(true),
+					},
+					Rhsm: &osbuild.SubManConfigRHSMSection{
+						ManageRepos: common.ToPtr(false),
+					},
+				},
+			},
+			subscription.RHSMConfigWithSubscription: {
+				SubMan: &osbuild.RHSMStageOptionsSubMan{
+					Rhsmcertd: &osbuild.SubManConfigRHSMCERTDSection{
+						AutoRegistration: common.ToPtr(true),
+					},
+					// do not disable the redhat.repo management if the user
+					// explicitly request the system to be subscribed
+				},
+			},
+		},
+	}
+	ic = ic.InheritFrom(defaultGceByosImageConfig(rd))
+	return ic
+}
+
+// common GCE image
+func gceCommonPackageSet(t *imageType) rpmmd.PackageSet {
+	return rpmmd.PackageSet{
+		Include: []string{
+			"@core",
+			"langpacks-en", // not in Google's KS
+			"acpid",
+			"dhcp-client",
+			"dnf-automatic",
+			"net-tools",
+			//"openssh-server", included in core
+			"python3",
+			"rng-tools",
+			"tar",
+			"vim",
+
+			// GCE guest tools
+			"google-compute-engine",
+			"google-osconfig-agent",
+			"gce-disk-expand",
+
+			// Not explicitly included in GCP kickstart, but present on the image
+			// for time synchronization
+			"chrony",
+			"timedatex",
+			// EFI
+			"grub2-tools-efi",
+		},
+		Exclude: []string{
+			"alsa-utils",
+			"b43-fwcutter",
+			"dmraid",
+			"eject",
+			"gpm",
+			"irqbalance",
+			"microcode_ctl",
+			"smartmontools",
+			"aic94xx-firmware",
+			"atmel-firmware",
+			"b43-openfwwf",
+			"bfa-firmware",
+			"ipw2100-firmware",
+			"ipw2200-firmware",
+			"ivtv-firmware",
+			"iwl100-firmware",
+			"iwl1000-firmware",
+			"iwl3945-firmware",
+			"iwl4965-firmware",
+			"iwl5000-firmware",
+			"iwl5150-firmware",
+			"iwl6000-firmware",
+			"iwl6000g2a-firmware",
+			"iwl6050-firmware",
+			"kernel-firmware",
+			"libertas-usb8388-firmware",
+			"ql2100-firmware",
+			"ql2200-firmware",
+			"ql23xx-firmware",
+			"ql2400-firmware",
+			"ql2500-firmware",
+			"rt61pci-firmware",
+			"rt73usb-firmware",
+			"xorg-x11-drv-ati-firmware",
+			"zd1211-firmware",
+			// RHBZ#2075815
+			"qemu-guest-agent",
+		},
+	}.Append(distroSpecificPackageSet(t))
+}
+
+// GCE BYOS image
+func gcePackageSet(t *imageType) rpmmd.PackageSet {
+	return gceCommonPackageSet(t)
+}
+
+// GCE RHUI image
+func gceRhuiPackageSet(t *imageType) rpmmd.PackageSet {
+	return rpmmd.PackageSet{
+		Include: []string{
+			"google-rhui-client-rhel8",
+		},
+	}.Append(gceCommonPackageSet(t))
+}

vendor/github.com/osbuild/images/pkg/distro/rhel8/images.go

@@ -0,0 +1,573 @@
+package rhel8
+
+import (
+	"fmt"
+	"math/rand"
+
+	"github.com/osbuild/images/internal/fdo"
+	"github.com/osbuild/images/internal/ignition"
+	"github.com/osbuild/images/internal/oscap"
+	"github.com/osbuild/images/internal/users"
+	"github.com/osbuild/images/internal/workload"
+	"github.com/osbuild/images/pkg/blueprint"
+	"github.com/osbuild/images/pkg/container"
+	"github.com/osbuild/images/pkg/distro"
+	"github.com/osbuild/images/pkg/image"
+	"github.com/osbuild/images/pkg/manifest"
+	"github.com/osbuild/images/pkg/osbuild"
+	"github.com/osbuild/images/pkg/ostree"
+	"github.com/osbuild/images/pkg/platform"
+	"github.com/osbuild/images/pkg/rpmmd"
+)
+
+func osCustomizations(
+	t *imageType,
+	osPackageSet rpmmd.PackageSet,
+	options distro.ImageOptions,
+	containers []container.SourceSpec,
+	c *blueprint.Customizations,
+) manifest.OSCustomizations {
+
+	imageConfig := t.getDefaultImageConfig()
+
+	osc := manifest.OSCustomizations{}
+
+	if t.bootable || t.rpmOstree {
+		osc.KernelName = c.GetKernel().Name
+
+		var kernelOptions []string
+		if t.kernelOptions != "" {
+			kernelOptions = append(kernelOptions, t.kernelOptions)
+		}
+		if bpKernel := c.GetKernel(); bpKernel.Append != "" {
+			kernelOptions = append(kernelOptions, bpKernel.Append)
+		}
+		osc.KernelOptionsAppend = kernelOptions
+		if t.platform.GetArch() != platform.ARCH_S390X {
+			osc.KernelOptionsBootloader = true
+		}
+	}
+
+	osc.ExtraBasePackages = osPackageSet.Include
+	osc.ExcludeBasePackages = osPackageSet.Exclude
+	osc.ExtraBaseRepos = osPackageSet.Repositories
+
+	osc.Containers = containers
+
+	osc.GPGKeyFiles = imageConfig.GPGKeyFiles
+	if imageConfig.ExcludeDocs != nil {
+		osc.ExcludeDocs = *imageConfig.ExcludeDocs
+	}
+
+	if !t.bootISO {
+		// don't put users and groups in the payload of an installer
+		// add them via kickstart instead
+		osc.Groups = users.GroupsFromBP(c.GetGroups())
+		osc.Users = users.UsersFromBP(c.GetUsers())
+	}
+
+	osc.EnabledServices = imageConfig.EnabledServices
+	osc.DisabledServices = imageConfig.DisabledServices
+	if imageConfig.DefaultTarget != nil {
+		osc.DefaultTarget = *imageConfig.DefaultTarget
+	}
+
+	osc.Firewall = imageConfig.Firewall
+	if fw := c.GetFirewall(); fw != nil {
+		options := osbuild.FirewallStageOptions{
+			Ports: fw.Ports,
+		}
+
+		if fw.Services != nil {
+			options.EnabledServices = fw.Services.Enabled
+			options.DisabledServices = fw.Services.Disabled
+		}
+		if fw.Zones != nil {
+			for _, z := range fw.Zones {
+				options.Zones = append(options.Zones, osbuild.FirewallZone{
+					Name:    *z.Name,
+					Sources: z.Sources,
+				})
+			}
+		}
+		osc.Firewall = &options
+	}
+
+	language, keyboard := c.GetPrimaryLocale()
+	if language != nil {
+		osc.Language = *language
+	} else if imageConfig.Locale != nil {
+		osc.Language = *imageConfig.Locale
+	}
+	if keyboard != nil {
+		osc.Keyboard = keyboard
+	} else if imageConfig.Keyboard != nil {
+		osc.Keyboard = &imageConfig.Keyboard.Keymap
+		if imageConfig.Keyboard.X11Keymap != nil {
+			osc.X11KeymapLayouts = imageConfig.Keyboard.X11Keymap.Layouts
+		}
+	}
+
+	if hostname := c.GetHostname(); hostname != nil {
+		osc.Hostname = *hostname
+	}
+
+	timezone, ntpServers := c.GetTimezoneSettings()
+	if timezone != nil {
+		osc.Timezone = *timezone
+	} else if imageConfig.Timezone != nil {
+		osc.Timezone = *imageConfig.Timezone
+	}
+
+	if len(ntpServers) > 0 {
+		for _, server := range ntpServers {
+			osc.NTPServers = append(osc.NTPServers, osbuild.ChronyConfigServer{Hostname: server})
+		}
+	} else if imageConfig.TimeSynchronization != nil {
+		osc.NTPServers = imageConfig.TimeSynchronization.Servers
+		osc.LeapSecTZ = imageConfig.TimeSynchronization.LeapsecTz
+	}
+
+	// Relabel the tree, unless the `NoSElinux` flag is explicitly set to `true`
+	if imageConfig.NoSElinux == nil || imageConfig.NoSElinux != nil && !*imageConfig.NoSElinux {
+		osc.SElinux = "targeted"
+	}
+
+	if oscapConfig := c.GetOpenSCAP(); oscapConfig != nil {
+		if t.rpmOstree {
+			panic("unexpected oscap options for ostree image type")
+		}
+		var datastream = oscapConfig.DataStream
+		if datastream == "" {
+			datastream = oscap.DefaultRHEL8Datastream(t.arch.distro.isRHEL())
+		}
+		osc.OpenSCAPConfig = osbuild.NewOscapRemediationStageOptions(
+			osbuild.OscapConfig{
+				Datastream: datastream,
+				ProfileID:  oscapConfig.ProfileID,
+			},
+		)
+	}
+
+	if t.arch.distro.isRHEL() && options.Facts != nil {
+		osc.FactAPIType = &options.Facts.APIType
+	}
+
+	var err error
+	osc.Directories, err = blueprint.DirectoryCustomizationsToFsNodeDirectories(c.GetDirectories())
+	if err != nil {
+		// In theory this should never happen, because the blueprint directory customizations
+		// should have been validated before this point.
+		panic(fmt.Sprintf("failed to convert directory customizations to fs node directories: %v", err))
+	}
+
+	osc.Files, err = blueprint.FileCustomizationsToFsNodeFiles(c.GetFiles())
+	if err != nil {
+		// In theory this should never happen, because the blueprint file customizations
+		// should have been validated before this point.
+		panic(fmt.Sprintf("failed to convert file customizations to fs node files: %v", err))
+	}
+
+	// set yum repos first, so it doesn't get overridden by
+	// imageConfig.YUMRepos
+	osc.YUMRepos = imageConfig.YUMRepos
+
+	customRepos, err := c.GetRepositories()
+	if err != nil {
+		// This shouldn't happen and since the repos
+		// should have already been validated
+		panic(fmt.Sprintf("failed to get custom repos: %v", err))
+	}
+
+	// This function returns a map of filename and corresponding yum repos
+	// and a list of fs node files for the inline gpg keys so we can save
+	// them to disk. This step also swaps the inline gpg key with the path
+	// to the file in the os file tree
+	yumRepos, gpgKeyFiles, err := blueprint.RepoCustomizationsToRepoConfigAndGPGKeyFiles(customRepos)
+	if err != nil {
+		panic(fmt.Sprintf("failed to convert inline gpgkeys to fs node files: %v", err))
+	}
+
+	// add the gpg key files to the list of files to be added to the tree
+	if len(gpgKeyFiles) > 0 {
+		osc.Files = append(osc.Files, gpgKeyFiles...)
+	}
+
+	for filename, repos := range yumRepos {
+		osc.YUMRepos = append(osc.YUMRepos, osbuild.NewYumReposStageOptions(filename, repos))
+	}
+
+	osc.ShellInit = imageConfig.ShellInit
+
+	osc.Grub2Config = imageConfig.Grub2Config
+	osc.Sysconfig = imageConfig.Sysconfig
+	osc.SystemdLogind = imageConfig.SystemdLogind
+	osc.CloudInit = imageConfig.CloudInit
+	osc.Modprobe = imageConfig.Modprobe
+	osc.DracutConf = imageConfig.DracutConf
+	osc.SystemdUnit = imageConfig.SystemdUnit
+	osc.Authselect = imageConfig.Authselect
+	osc.SELinuxConfig = imageConfig.SELinuxConfig
+	osc.Tuned = imageConfig.Tuned
+	osc.Tmpfilesd = imageConfig.Tmpfilesd
+	osc.PamLimitsConf = imageConfig.PamLimitsConf
+	osc.Sysctld = imageConfig.Sysctld
+	osc.DNFConfig = imageConfig.DNFConfig
+	osc.DNFAutomaticConfig = imageConfig.DNFAutomaticConfig
+	osc.SshdConfig = imageConfig.SshdConfig
+	osc.AuthConfig = imageConfig.Authconfig
+	osc.PwQuality = imageConfig.PwQuality
+	osc.RHSMConfig = imageConfig.RHSMConfig
+	osc.Subscription = options.Subscription
+	osc.WAAgentConfig = imageConfig.WAAgentConfig
+	osc.UdevRules = imageConfig.UdevRules
+	osc.GCPGuestAgentConfig = imageConfig.GCPGuestAgentConfig
+
+	return osc
+}
+
+func liveImage(workload workload.Workload,
+	t *imageType,
+	customizations *blueprint.Customizations,
+	options distro.ImageOptions,
+	packageSets map[string]rpmmd.PackageSet,
+	containers []container.SourceSpec,
+	rng *rand.Rand) (image.ImageKind, error) {
+
+	img := image.NewLiveImage()
+	img.Platform = t.platform
+	img.OSCustomizations = osCustomizations(t, packageSets[osPkgsKey], options, containers, customizations)
+	img.Environment = t.environment
+	img.Workload = workload
+	img.Compression = t.compression
+	// TODO: move generation into LiveImage
+	pt, err := t.getPartitionTable(customizations.GetFilesystems(), options, rng)
+	if err != nil {
+		return nil, err
+	}
+	img.PartitionTable = pt
+
+	img.Filename = t.Filename()
+
+	return img, nil
+}
+
+func imageInstallerImage(workload workload.Workload,
+	t *imageType,
+	customizations *blueprint.Customizations,
+	options distro.ImageOptions,
+	packageSets map[string]rpmmd.PackageSet,
+	containers []container.SourceSpec,
+	rng *rand.Rand) (image.ImageKind, error) {
+
+	img := image.NewAnacondaTarInstaller()
+
+	img.Platform = t.platform
+	img.Workload = workload
+	img.OSCustomizations = osCustomizations(t, packageSets[osPkgsKey], options, containers, customizations)
+	img.ExtraBasePackages = packageSets[installerPkgsKey]
+	img.Users = users.UsersFromBP(customizations.GetUsers())
+	img.Groups = users.GroupsFromBP(customizations.GetGroups())
+
+	img.AdditionalDracutModules = []string{"prefixdevname", "prefixdevname-tools"}
+	img.AdditionalAnacondaModules = []string{"org.fedoraproject.Anaconda.Modules.Users"}
+
+	img.SquashfsCompression = "xz"
+
+	// put the kickstart file in the root of the iso
+	img.ISORootKickstart = true
+
+	d := t.arch.distro
+
+	img.ISOLabelTempl = d.isolabelTmpl
+	img.Product = d.product
+	img.OSName = "redhat"
+	img.OSVersion = d.osVersion
+	img.Release = fmt.Sprintf("%s %s", d.product, d.osVersion)
+
+	img.Filename = t.Filename()
+
+	return img, nil
+}
+
+func tarImage(workload workload.Workload,
+	t *imageType,
+	customizations *blueprint.Customizations,
+	options distro.ImageOptions,
+	packageSets map[string]rpmmd.PackageSet,
+	containers []container.SourceSpec,
+	rng *rand.Rand) (image.ImageKind, error) {
+
+	img := image.NewArchive()
+	img.Platform = t.platform
+	img.OSCustomizations = osCustomizations(t, packageSets[osPkgsKey], options, containers, customizations)
+	img.Environment = t.environment
+	img.Workload = workload
+
+	img.Filename = t.Filename()
+
+	return img, nil
+
+}
+
+func edgeCommitImage(workload workload.Workload,
+	t *imageType,
+	customizations *blueprint.Customizations,
+	options distro.ImageOptions,
+	packageSets map[string]rpmmd.PackageSet,
+	containers []container.SourceSpec,
+	rng *rand.Rand) (image.ImageKind, error) {
+
+	parentCommit, commitRef := makeOSTreeParentCommit(options.OSTree, t.OSTreeRef())
+	img := image.NewOSTreeArchive(commitRef)
+
+	img.Platform = t.platform
+	img.OSCustomizations = osCustomizations(t, packageSets[osPkgsKey], options, containers, customizations)
+	img.Environment = t.environment
+	img.Workload = workload
+	img.OSTreeParent = parentCommit
+	img.OSVersion = t.arch.distro.osVersion
+	img.Filename = t.Filename()
+
+	return img, nil
+}
+
+func edgeContainerImage(workload workload.Workload,
+	t *imageType,
+	customizations *blueprint.Customizations,
+	options distro.ImageOptions,
+	packageSets map[string]rpmmd.PackageSet,
+	containers []container.SourceSpec,
+	rng *rand.Rand) (image.ImageKind, error) {
+
+	parentCommit, commitRef := makeOSTreeParentCommit(options.OSTree, t.OSTreeRef())
+	img := image.NewOSTreeContainer(commitRef)
+
+	img.Platform = t.platform
+	img.OSCustomizations = osCustomizations(t, packageSets[osPkgsKey], options, containers, customizations)
+	img.ContainerLanguage = img.OSCustomizations.Language
+	img.Environment = t.environment
+	img.Workload = workload
+	img.OSTreeParent = parentCommit
+	img.OSVersion = t.arch.distro.osVersion
+	img.ExtraContainerPackages = packageSets[containerPkgsKey]
+	img.Filename = t.Filename()
+
+	return img, nil
+}
+
+func edgeInstallerImage(workload workload.Workload,
+	t *imageType,
+	customizations *blueprint.Customizations,
+	options distro.ImageOptions,
+	packageSets map[string]rpmmd.PackageSet,
+	containers []container.SourceSpec,
+	rng *rand.Rand) (image.ImageKind, error) {
+
+	d := t.arch.distro
+
+	commit, err := makeOSTreePayloadCommit(options.OSTree, t.OSTreeRef())
+	if err != nil {
+		return nil, fmt.Errorf("%s: %s", t.Name(), err.Error())
+	}
+
+	img := image.NewAnacondaOSTreeInstaller(commit)
+
+	img.Platform = t.platform
+	img.ExtraBasePackages = packageSets[installerPkgsKey]
+	img.Users = users.UsersFromBP(customizations.GetUsers())
+	img.Groups = users.GroupsFromBP(customizations.GetGroups())
+
+	img.SquashfsCompression = "xz"
+	img.AdditionalDracutModules = []string{"prefixdevname", "prefixdevname-tools"}
+
+	if len(img.Users)+len(img.Groups) > 0 {
+		// only enable the users module if needed
+		img.AdditionalAnacondaModules = []string{"org.fedoraproject.Anaconda.Modules.Users"}
+	}
+
+	img.ISOLabelTempl = d.isolabelTmpl
+	img.Product = d.product
+	img.Variant = "edge"
+	img.OSName = "rhel"
+	img.OSVersion = d.osVersion
+	img.Release = fmt.Sprintf("%s %s", d.product, d.osVersion)
+
+	img.Filename = t.Filename()
+
+	return img, nil
+}
+
+func edgeRawImage(workload workload.Workload,
+	t *imageType,
+	customizations *blueprint.Customizations,
+	options distro.ImageOptions,
+	packageSets map[string]rpmmd.PackageSet,
+	containers []container.SourceSpec,
+	rng *rand.Rand) (image.ImageKind, error) {
+
+	commit, err := makeOSTreePayloadCommit(options.OSTree, t.OSTreeRef())
+	if err != nil {
+		return nil, fmt.Errorf("%s: %s", t.Name(), err.Error())
+	}
+
+	img := image.NewOSTreeRawImage(commit)
+
+	img.Users = users.UsersFromBP(customizations.GetUsers())
+	img.Groups = users.GroupsFromBP(customizations.GetGroups())
+
+	img.KernelOptionsAppend = []string{"modprobe.blacklist=vc4"}
+	// TODO: move to image config
+	img.Keyboard = "us"
+	img.Locale = "C.UTF-8"
+
+	img.Platform = t.platform
+	img.Workload = workload
+	img.Remote = ostree.Remote{
+		Name:       "rhel-edge",
+		URL:        options.OSTree.URL,
+		ContentURL: options.OSTree.ContentURL,
+	}
+	img.OSName = "redhat"
+
+	// TODO: move generation into LiveImage
+	pt, err := t.getPartitionTable(customizations.GetFilesystems(), options, rng)
+	if err != nil {
+		return nil, err
+	}
+	img.PartitionTable = pt
+
+	img.Filename = t.Filename()
+	img.Compression = t.compression
+
+	return img, nil
+}
+
+func edgeSimplifiedInstallerImage(workload workload.Workload,
+	t *imageType,
+	customizations *blueprint.Customizations,
+	options distro.ImageOptions,
+	packageSets map[string]rpmmd.PackageSet,
+	containers []container.SourceSpec,
+	rng *rand.Rand) (image.ImageKind, error) {
+
+	commit, err := makeOSTreePayloadCommit(options.OSTree, t.OSTreeRef())
+	if err != nil {
+		return nil, fmt.Errorf("%s: %s", t.Name(), err.Error())
+	}
+
+	rawImg := image.NewOSTreeRawImage(commit)
+
+	rawImg.Users = users.UsersFromBP(customizations.GetUsers())
+	rawImg.Groups = users.GroupsFromBP(customizations.GetGroups())
+
+	rawImg.KernelOptionsAppend = []string{"modprobe.blacklist=vc4"}
+	rawImg.Keyboard = "us"
+	rawImg.Locale = "C.UTF-8"
+
+	rawImg.Platform = t.platform
+	rawImg.Workload = workload
+	rawImg.Remote = ostree.Remote{
+		Name:       "rhel-edge",
+		URL:        options.OSTree.URL,
+		ContentURL: options.OSTree.ContentURL,
+	}
+	rawImg.OSName = "redhat"
+
+	// TODO: move generation into LiveImage
+	pt, err := t.getPartitionTable(customizations.GetFilesystems(), options, rng)
+	if err != nil {
+		return nil, err
+	}
+	rawImg.PartitionTable = pt
+
+	rawImg.Filename = t.Filename()
+
+	img := image.NewOSTreeSimplifiedInstaller(rawImg, customizations.InstallationDevice)
+	img.ExtraBasePackages = packageSets[installerPkgsKey]
+	// img.Workload = workload
+	img.Platform = t.platform
+	img.Filename = t.Filename()
+	if bpFDO := customizations.GetFDO(); bpFDO != nil {
+		img.FDO = fdo.FromBP(*bpFDO)
+	}
+	// ignition configs from blueprint
+	if bpIgnition := customizations.GetIgnition(); bpIgnition != nil {
+		if bpIgnition.FirstBoot != nil {
+			img.IgnitionFirstBoot = ignition.FirstbootOptionsFromBP(*bpIgnition.FirstBoot)
+		}
+		if bpIgnition.Embedded != nil {
+			var err error
+			img.IgnitionEmbedded, err = ignition.EmbeddedOptionsFromBP(*bpIgnition.Embedded)
+			if err != nil {
+				return nil, err
+			}
+		}
+	}
+
+	d := t.arch.distro
+	img.ISOLabelTempl = d.isolabelTmpl
+	img.Product = d.product
+	img.Variant = "edge"
+	img.OSName = "redhat"
+	img.OSVersion = d.osVersion
+	img.AdditionalDracutModules = []string{"prefixdevname", "prefixdevname-tools"}
+
+	return img, nil
+}
+
+// Create an ostree SourceSpec to define an ostree parent commit using the user
+// options and the default ref for the image type.  Additionally returns the
+// ref to be used for the new commit to be created.
+func makeOSTreeParentCommit(options *ostree.ImageOptions, defaultRef string) (*ostree.SourceSpec, string) {
+	commitRef := defaultRef
+	if options == nil {
+		// nothing to do
+		return nil, commitRef
+	}
+	if options.ImageRef != "" {
+		// user option overrides default commit ref
+		commitRef = options.ImageRef
+	}
+
+	var parentCommit *ostree.SourceSpec
+	if options.URL == "" {
+		// no parent
+		return nil, commitRef
+	}
+
+	// ostree URL specified: set source spec for parent commit
+	parentRef := options.ParentRef
+	if parentRef == "" {
+		// parent ref not set: use image ref
+		parentRef = commitRef
+
+	}
+	parentCommit = &ostree.SourceSpec{
+		URL:  options.URL,
+		Ref:  parentRef,
+		RHSM: options.RHSM,
+	}
+	return parentCommit, commitRef
+}
+
+// Create an ostree SourceSpec to define an ostree payload using the user options and the default ref for the image type.
+func makeOSTreePayloadCommit(options *ostree.ImageOptions, defaultRef string) (ostree.SourceSpec, error) {
+	if options == nil || options.URL == "" {
+		// this should be caught by checkOptions() in distro, but it's good
+		// to guard against it here as well
+		return ostree.SourceSpec{}, fmt.Errorf("ostree commit URL required")
+	}
+
+	commitRef := defaultRef
+	if options.ImageRef != "" {
+		// user option overrides default commit ref
+		commitRef = options.ImageRef
+	}
+
+	return ostree.SourceSpec{
+		URL:  options.URL,
+		Ref:  commitRef,
+		RHSM: options.RHSM,
+	}, nil
+}

vendor/github.com/osbuild/images/pkg/distro/rhel8/imagetype.go

@@ -0,0 +1,418 @@
+package rhel8
+
+import (
+	"fmt"
+	"log"
+	"math/rand"
+	"strings"
+
+	"golang.org/x/exp/slices"
+
+	"github.com/osbuild/images/internal/common"
+	"github.com/osbuild/images/internal/environment"
+	"github.com/osbuild/images/internal/oscap"
+	"github.com/osbuild/images/internal/pathpolicy"
+	"github.com/osbuild/images/internal/workload"
+	"github.com/osbuild/images/pkg/blueprint"
+	"github.com/osbuild/images/pkg/container"
+	"github.com/osbuild/images/pkg/disk"
+	"github.com/osbuild/images/pkg/distro"
+	"github.com/osbuild/images/pkg/image"
+	"github.com/osbuild/images/pkg/manifest"
+	"github.com/osbuild/images/pkg/ostree"
+	"github.com/osbuild/images/pkg/platform"
+	"github.com/osbuild/images/pkg/rpmmd"
+)
+
+const (
+	// package set names
+
+	// main/common os image package set name
+	osPkgsKey = "os"
+
+	// container package set name
+	containerPkgsKey = "container"
+
+	// installer package set name
+	installerPkgsKey = "installer"
+
+	// blueprint package set name
+	blueprintPkgsKey = "blueprint"
+)
+
+type imageFunc func(workload workload.Workload, t *imageType, customizations *blueprint.Customizations, options distro.ImageOptions, packageSets map[string]rpmmd.PackageSet, containers []container.SourceSpec, rng *rand.Rand) (image.ImageKind, error)
+
+type packageSetFunc func(t *imageType) rpmmd.PackageSet
+
+type imageType struct {
+	arch               *architecture
+	platform           platform.Platform
+	environment        environment.Environment
+	workload           workload.Workload
+	name               string
+	nameAliases        []string
+	filename           string
+	compression        string // TODO: remove from image definition and make it a transport option
+	mimeType           string
+	packageSets        map[string]packageSetFunc
+	defaultImageConfig *distro.ImageConfig
+	kernelOptions      string
+	defaultSize        uint64
+	buildPipelines     []string
+	payloadPipelines   []string
+	exports            []string
+	image              imageFunc
+
+	// bootISO: installable ISO
+	bootISO bool
+	// rpmOstree: edge/ostree
+	rpmOstree bool
+	// bootable image
+	bootable bool
+	// List of valid arches for the image type
+	basePartitionTables distro.BasePartitionTableMap
+}
+
+func (t *imageType) Name() string {
+	return t.name
+}
+
+func (t *imageType) Arch() distro.Arch {
+	return t.arch
+}
+
+func (t *imageType) Filename() string {
+	return t.filename
+}
+
+func (t *imageType) MIMEType() string {
+	return t.mimeType
+}
+
+func (t *imageType) OSTreeRef() string {
+	d := t.arch.distro
+	if t.rpmOstree {
+		return fmt.Sprintf(d.ostreeRefTmpl, t.Arch().Name())
+	}
+	return ""
+}
+
+func (t *imageType) Size(size uint64) uint64 {
+	// Microsoft Azure requires vhd images to be rounded up to the nearest MB
+	if t.name == "vhd" && size%common.MebiByte != 0 {
+		size = (size/common.MebiByte + 1) * common.MebiByte
+	}
+	if size == 0 {
+		size = t.defaultSize
+	}
+	return size
+}
+
+func (t *imageType) BuildPipelines() []string {
+	return t.buildPipelines
+}
+
+func (t *imageType) PayloadPipelines() []string {
+	return t.payloadPipelines
+}
+
+func (t *imageType) PayloadPackageSets() []string {
+	return []string{blueprintPkgsKey}
+}
+
+func (t *imageType) PackageSetsChains() map[string][]string {
+	return nil
+}
+
+func (t *imageType) Exports() []string {
+	if len(t.exports) > 0 {
+		return t.exports
+	}
+	return []string{"assembler"}
+}
+
+func (t *imageType) BootMode() distro.BootMode {
+	if t.platform.GetUEFIVendor() != "" && t.platform.GetBIOSPlatform() != "" {
+		return distro.BOOT_HYBRID
+	} else if t.platform.GetUEFIVendor() != "" {
+		return distro.BOOT_UEFI
+	} else if t.platform.GetBIOSPlatform() != "" || t.platform.GetZiplSupport() {
+		return distro.BOOT_LEGACY
+	}
+	return distro.BOOT_NONE
+}
+
+func (t *imageType) getPartitionTable(
+	mountpoints []blueprint.FilesystemCustomization,
+	options distro.ImageOptions,
+	rng *rand.Rand,
+) (*disk.PartitionTable, error) {
+	archName := t.arch.Name()
+
+	basePartitionTable, exists := t.basePartitionTables[archName]
+
+	if !exists {
+		return nil, fmt.Errorf("no partition table defined for architecture %q for image type %q", archName, t.Name())
+	}
+
+	imageSize := t.Size(options.Size)
+
+	lvmify := !t.rpmOstree
+
+	return disk.NewPartitionTable(&basePartitionTable, mountpoints, imageSize, lvmify, nil, rng)
+}
+
+func (t *imageType) getDefaultImageConfig() *distro.ImageConfig {
+	// ensure that image always returns non-nil default config
+	imageConfig := t.defaultImageConfig
+	if imageConfig == nil {
+		imageConfig = &distro.ImageConfig{}
+	}
+	return imageConfig.InheritFrom(t.arch.distro.getDefaultImageConfig())
+
+}
+
+func (t *imageType) PartitionType() string {
+	archName := t.arch.Name()
+	basePartitionTable, exists := t.basePartitionTables[archName]
+	if !exists {
+		return ""
+	}
+
+	return basePartitionTable.Type
+}
+
+func (t *imageType) Manifest(bp *blueprint.Blueprint,
+	options distro.ImageOptions,
+	repos []rpmmd.RepoConfig,
+	seed int64) (*manifest.Manifest, []string, error) {
+
+	warnings, err := t.checkOptions(bp, options)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	// merge package sets that appear in the image type with the package sets
+	// of the same name from the distro and arch
+	staticPackageSets := make(map[string]rpmmd.PackageSet)
+
+	for name, getter := range t.packageSets {
+		staticPackageSets[name] = getter(t)
+	}
+
+	// amend with repository information and collect payload repos
+	payloadRepos := make([]rpmmd.RepoConfig, 0)
+	for _, repo := range repos {
+		if len(repo.PackageSets) > 0 {
+			// only apply the repo to the listed package sets
+			for _, psName := range repo.PackageSets {
+				if slices.Contains(t.PayloadPackageSets(), psName) {
+					payloadRepos = append(payloadRepos, repo)
+				}
+				ps := staticPackageSets[psName]
+				ps.Repositories = append(ps.Repositories, repo)
+				staticPackageSets[psName] = ps
+			}
+		}
+	}
+
+	w := t.workload
+	if w == nil {
+		cw := &workload.Custom{
+			BaseWorkload: workload.BaseWorkload{
+				Repos: payloadRepos,
+			},
+			Packages: bp.GetPackagesEx(false),
+		}
+		if services := bp.Customizations.GetServices(); services != nil {
+			cw.Services = services.Enabled
+			cw.DisabledServices = services.Disabled
+		}
+		w = cw
+	}
+
+	containerSources := make([]container.SourceSpec, len(bp.Containers))
+	for idx := range bp.Containers {
+		containerSources[idx] = container.SourceSpec(bp.Containers[idx])
+	}
+
+	source := rand.NewSource(seed)
+	// math/rand is good enough in this case
+	/* #nosec G404 */
+	rng := rand.New(source)
+
+	if t.image == nil {
+		return nil, nil, nil
+	}
+	img, err := t.image(w, t, bp.Customizations, options, staticPackageSets, containerSources, rng)
+	if err != nil {
+		return nil, nil, err
+	}
+	mf := manifest.New()
+	mf.Distro = manifest.DISTRO_EL8
+	_, err = img.InstantiateManifest(&mf, repos, t.arch.distro.runner, rng)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return &mf, warnings, err
+}
+
+// checkOptions checks the validity and compatibility of options and customizations for the image type.
+// Returns ([]string, error) where []string, if non-nil, will hold any generated warnings (e.g. deprecation notices).
+func (t *imageType) checkOptions(bp *blueprint.Blueprint, options distro.ImageOptions) ([]string, error) {
+	customizations := bp.Customizations
+	// holds warnings (e.g. deprecation notices)
+	var warnings []string
+	if t.workload != nil {
+		// For now, if an image type defines its own workload, don't allow any
+		// user customizations.
+		// Soon we will have more workflows and each will define its allowed
+		// set of customizations.  The current set of customizations defined in
+		// the blueprint spec corresponds to the Custom workflow.
+		if customizations != nil {
+			return warnings, fmt.Errorf("image type %q does not support customizations", t.name)
+		}
+	}
+	// we do not support embedding containers on ostree-derived images, only on commits themselves
+	if len(bp.Containers) > 0 && t.rpmOstree && (t.name != "edge-commit" && t.name != "edge-container") {
+		return warnings, fmt.Errorf("embedding containers is not supported for %s on %s", t.name, t.arch.distro.name)
+	}
+
+	ostreeURL := ""
+	if options.OSTree != nil {
+		if options.OSTree.ParentRef != "" && options.OSTree.URL == "" {
+			// specifying parent ref also requires URL
+			return nil, ostree.NewParameterComboError("ostree parent ref specified, but no URL to retrieve it")
+		}
+		ostreeURL = options.OSTree.URL
+	}
+
+	if t.bootISO && t.rpmOstree {
+		// ostree-based ISOs require a URL from which to pull a payload commit
+		if ostreeURL == "" {
+			return warnings, fmt.Errorf("boot ISO image type %q requires specifying a URL from which to retrieve the OSTree commit", t.name)
+		}
+
+		if t.name == "edge-simplified-installer" {
+			allowed := []string{"InstallationDevice", "FDO", "User", "Group"}
+			if err := customizations.CheckAllowed(allowed...); err != nil {
+				return warnings, fmt.Errorf("unsupported blueprint customizations found for boot ISO image type %q: (allowed: %s)", t.name, strings.Join(allowed, ", "))
+			}
+			if customizations.GetInstallationDevice() == "" {
+				return warnings, fmt.Errorf("boot ISO image type %q requires specifying an installation device to install to", t.name)
+			}
+			//making fdo optional so that simplified installer can be composed w/o the FDO section in the blueprint
+			if customizations.GetFDO() != nil {
+				if customizations.GetFDO().ManufacturingServerURL == "" {
+					return warnings, fmt.Errorf("boot ISO image type %q requires specifying FDO.ManufacturingServerURL configuration to install to", t.name)
+				}
+				var diunSet int
+				if customizations.GetFDO().DiunPubKeyHash != "" {
+					diunSet++
+				}
+				if customizations.GetFDO().DiunPubKeyInsecure != "" {
+					diunSet++
+				}
+				if customizations.GetFDO().DiunPubKeyRootCerts != "" {
+					diunSet++
+				}
+				if diunSet != 1 {
+					return warnings, fmt.Errorf("boot ISO image type %q requires specifying one of [FDO.DiunPubKeyHash,FDO.DiunPubKeyInsecure,FDO.DiunPubKeyRootCerts] configuration to install to", t.name)
+				}
+			}
+		} else if t.name == "edge-installer" {
+			allowed := []string{"User", "Group"}
+			if err := customizations.CheckAllowed(allowed...); err != nil {
+				return warnings, fmt.Errorf("unsupported blueprint customizations found for boot ISO image type %q: (allowed: %s)", t.name, strings.Join(allowed, ", "))
+			}
+		}
+	}
+
+	if t.name == "edge-raw-image" {
+		// ostree-based bootable images require a URL from which to pull a payload commit
+		if ostreeURL == "" {
+			return warnings, fmt.Errorf("edge raw images require specifying a URL from which to retrieve the OSTree commit")
+		}
+
+		allowed := []string{"User", "Group"}
+		if err := customizations.CheckAllowed(allowed...); err != nil {
+			return warnings, fmt.Errorf("unsupported blueprint customizations found for image type %q: (allowed: %s)", t.name, strings.Join(allowed, ", "))
+		}
+		// TODO: consider additional checks, such as those in "edge-simplified-installer"
+	}
+
+	// warn that user & group customizations on edge-commit, edge-container are deprecated
+	// TODO(edge): directly error if these options are provided when rhel-9.5's time arrives
+	if t.name == "edge-commit" || t.name == "edge-container" {
+		if customizations.GetUsers() != nil {
+			w := fmt.Sprintf("Please note that user customizations on %q image type are deprecated and will be removed in the near future\n", t.name)
+			log.Print(w)
+			warnings = append(warnings, w)
+		}
+		if customizations.GetGroups() != nil {
+			w := fmt.Sprintf("Please note that group customizations on %q image type are deprecated and will be removed in the near future\n", t.name)
+			log.Print(w)
+			warnings = append(warnings, w)
+		}
+	}
+
+	if kernelOpts := customizations.GetKernel(); kernelOpts.Append != "" && t.rpmOstree && (!t.bootable || t.bootISO) {
+		return warnings, fmt.Errorf("kernel boot parameter customizations are not supported for ostree types")
+	}
+
+	mountpoints := customizations.GetFilesystems()
+
+	if mountpoints != nil && t.rpmOstree {
+		return warnings, fmt.Errorf("Custom mountpoints are not supported for ostree types")
+	}
+
+	err := blueprint.CheckMountpointsPolicy(mountpoints, pathpolicy.MountpointPolicies)
+	if err != nil {
+		return warnings, err
+	}
+
+	if osc := customizations.GetOpenSCAP(); osc != nil {
+		// only add support for RHEL 8.7 and above.
+		if common.VersionLessThan(t.arch.distro.osVersion, "8.7") {
+			return warnings, fmt.Errorf(fmt.Sprintf("OpenSCAP unsupported os version: %s", t.arch.distro.osVersion))
+		}
+		supported := oscap.IsProfileAllowed(osc.ProfileID, oscapProfileAllowList)
+		if !supported {
+			return warnings, fmt.Errorf(fmt.Sprintf("OpenSCAP unsupported profile: %s", osc.ProfileID))
+		}
+		if t.rpmOstree {
+			return warnings, fmt.Errorf("OpenSCAP customizations are not supported for ostree types")
+		}
+		if osc.ProfileID == "" {
+			return warnings, fmt.Errorf("OpenSCAP profile cannot be empty")
+		}
+	}
+
+	// Check Directory/File Customizations are valid
+	dc := customizations.GetDirectories()
+	fc := customizations.GetFiles()
+
+	err = blueprint.ValidateDirFileCustomizations(dc, fc)
+	if err != nil {
+		return warnings, err
+	}
+
+	err = blueprint.CheckDirectoryCustomizationsPolicy(dc, pathpolicy.CustomDirectoriesPolicies)
+	if err != nil {
+		return warnings, err
+	}
+
+	err = blueprint.CheckFileCustomizationsPolicy(fc, pathpolicy.CustomFilesPolicies)
+	if err != nil {
+		return warnings, err
+	}
+
+	// check if repository customizations are valid
+	_, err = customizations.GetRepositories()
+	if err != nil {
+		return warnings, err
+	}
+
+	return warnings, nil
+}

vendor/github.com/osbuild/images/pkg/distro/rhel8/package_sets.go

@@ -0,0 +1,75 @@
+package rhel8
+
+// This file defines package sets that are used by more than one image type.
+
+import (
+	"fmt"
+
+	"github.com/osbuild/images/pkg/platform"
+	"github.com/osbuild/images/pkg/rpmmd"
+)
+
+// installer boot package sets, needed for booting and
+// also in the build host
+
+func anacondaBootPackageSet(t *imageType) rpmmd.PackageSet {
+	ps := rpmmd.PackageSet{}
+
+	grubCommon := rpmmd.PackageSet{
+		Include: []string{
+			"grub2-tools",
+			"grub2-tools-extra",
+			"grub2-tools-minimal",
+		},
+	}
+
+	efiCommon := rpmmd.PackageSet{
+		Include: []string{
+			"efibootmgr",
+		},
+	}
+
+	switch t.arch.Name() {
+	case platform.ARCH_X86_64.String():
+		ps = ps.Append(grubCommon)
+		ps = ps.Append(efiCommon)
+		ps = ps.Append(rpmmd.PackageSet{
+			Include: []string{
+				"grub2-efi-ia32-cdboot",
+				"grub2-efi-x64",
+				"grub2-efi-x64-cdboot",
+				"grub2-pc",
+				"grub2-pc-modules",
+				"shim-ia32",
+				"shim-x64",
+				"syslinux",
+				"syslinux-nonlinux",
+			},
+		})
+	case platform.ARCH_AARCH64.String():
+		ps = ps.Append(grubCommon)
+		ps = ps.Append(efiCommon)
+		ps = ps.Append(rpmmd.PackageSet{
+			Include: []string{
+				"grub2-efi-aa64-cdboot",
+				"grub2-efi-aa64",
+				"shim-aa64",
+			},
+		})
+
+	default:
+		panic(fmt.Sprintf("unsupported arch: %s", t.arch.Name()))
+	}
+
+	return ps
+}
+
+// packages that are only in some (sub)-distributions
+func distroSpecificPackageSet(t *imageType) rpmmd.PackageSet {
+	if t.arch.distro.isRHEL() {
+		return rpmmd.PackageSet{
+			Include: []string{"insights-client"},
+		}
+	}
+	return rpmmd.PackageSet{}
+}

vendor/github.com/osbuild/images/pkg/distro/rhel8/partition_tables.go

@@ -0,0 +1,425 @@
+package rhel8
+
+import (
+	"github.com/osbuild/images/internal/common"
+	"github.com/osbuild/images/pkg/disk"
+	"github.com/osbuild/images/pkg/distro"
+	"github.com/osbuild/images/pkg/platform"
+)
+
+var defaultBasePartitionTables = distro.BasePartitionTableMap{
+	platform.ARCH_X86_64.String(): disk.PartitionTable{
+		UUID: "D209C89E-EA5E-4FBD-B161-B461CCE297E0",
+		Type: "gpt",
+		Partitions: []disk.Partition{
+			{
+				Size:     1 * common.MebiByte,
+				Bootable: true,
+				Type:     disk.BIOSBootPartitionGUID,
+				UUID:     disk.BIOSBootPartitionUUID,
+			},
+			{
+				Size: 100 * common.MebiByte,
+				Type: disk.EFISystemPartitionGUID,
+				UUID: disk.EFISystemPartitionUUID,
+				Payload: &disk.Filesystem{
+					Type:         "vfat",
+					UUID:         disk.EFIFilesystemUUID,
+					Mountpoint:   "/boot/efi",
+					FSTabOptions: "defaults,uid=0,gid=0,umask=077,shortname=winnt",
+					FSTabFreq:    0,
+					FSTabPassNo:  2,
+				},
+			},
+			{
+				Size: 2 * common.GibiByte, // 2 GiB
+				Type: disk.FilesystemDataGUID,
+				UUID: disk.RootPartitionUUID,
+				Payload: &disk.Filesystem{
+					Type:         "xfs",
+					Label:        "root",
+					Mountpoint:   "/",
+					FSTabOptions: "defaults",
+					FSTabFreq:    0,
+					FSTabPassNo:  0,
+				},
+			},
+		},
+	},
+	platform.ARCH_AARCH64.String(): disk.PartitionTable{
+		UUID: "D209C89E-EA5E-4FBD-B161-B461CCE297E0",
+		Type: "gpt",
+		Partitions: []disk.Partition{
+			{
+				Size: 100 * common.MebiByte,
+				Type: disk.EFISystemPartitionGUID,
+				UUID: disk.EFISystemPartitionUUID,
+				Payload: &disk.Filesystem{
+					Type:         "vfat",
+					UUID:         disk.EFIFilesystemUUID,
+					Mountpoint:   "/boot/efi",
+					FSTabOptions: "defaults,uid=0,gid=0,umask=077,shortname=winnt",
+					FSTabFreq:    0,
+					FSTabPassNo:  2,
+				},
+			},
+			{
+				Size: 2 * common.GibiByte, // 2 GiB
+				Type: disk.FilesystemDataGUID,
+				UUID: disk.RootPartitionUUID,
+				Payload: &disk.Filesystem{
+					Type:         "xfs",
+					Label:        "root",
+					Mountpoint:   "/",
+					FSTabOptions: "defaults",
+					FSTabFreq:    0,
+					FSTabPassNo:  0,
+				},
+			},
+		},
+	},
+	platform.ARCH_PPC64LE.String(): disk.PartitionTable{
+		UUID: "0x14fc63d2",
+		Type: "dos",
+		Partitions: []disk.Partition{
+			{
+				Size:     4 * common.MebiByte,
+				Type:     "41",
+				Bootable: true,
+			},
+			{
+				Size: 2 * common.GibiByte, // 2 GiB
+				Payload: &disk.Filesystem{
+					Type:         "xfs",
+					Mountpoint:   "/",
+					FSTabOptions: "defaults",
+					FSTabFreq:    0,
+					FSTabPassNo:  0,
+				},
+			},
+		},
+	},
+	platform.ARCH_S390X.String(): disk.PartitionTable{
+		UUID: "0x14fc63d2",
+		Type: "dos",
+		Partitions: []disk.Partition{
+			{
+				Size:     2 * common.GibiByte, // 2 GiB
+				Bootable: true,
+				Payload: &disk.Filesystem{
+					Type:         "xfs",
+					Mountpoint:   "/",
+					FSTabOptions: "defaults",
+					FSTabFreq:    0,
+					FSTabPassNo:  0,
+				},
+			},
+		},
+	},
+}
+
+var ec2BasePartitionTables = distro.BasePartitionTableMap{
+	platform.ARCH_X86_64.String(): disk.PartitionTable{
+		UUID: "D209C89E-EA5E-4FBD-B161-B461CCE297E0",
+		Type: "gpt",
+		Partitions: []disk.Partition{
+			{
+				Size:     1 * common.MebiByte,
+				Bootable: true,
+				Type:     disk.BIOSBootPartitionGUID,
+				UUID:     disk.BIOSBootPartitionUUID,
+			},
+			{
+				Size: 200 * common.MebiByte,
+				Type: disk.EFISystemPartitionGUID,
+				UUID: disk.EFISystemPartitionUUID,
+				Payload: &disk.Filesystem{
+					Type:         "vfat",
+					UUID:         disk.EFIFilesystemUUID,
+					Mountpoint:   "/boot/efi",
+					Label:        "EFI-SYSTEM",
+					FSTabOptions: "defaults,uid=0,gid=0,umask=077,shortname=winnt",
+					FSTabFreq:    0,
+					FSTabPassNo:  2,
+				},
+			},
+			{
+				Size: 500 * common.MebiByte,
+				Type: disk.XBootLDRPartitionGUID,
+				UUID: disk.FilesystemDataUUID,
+				Payload: &disk.Filesystem{
+					Type:         "xfs",
+					Mountpoint:   "/boot",
+					Label:        "boot",
+					FSTabOptions: "defaults",
+					FSTabFreq:    0,
+					FSTabPassNo:  0,
+				},
+			},
+			{
+				Size: 2 * common.GibiByte,
+				Type: disk.FilesystemDataGUID,
+				UUID: disk.RootPartitionUUID,
+				Payload: &disk.Filesystem{
+					Type:         "xfs",
+					Label:        "root",
+					Mountpoint:   "/",
+					FSTabOptions: "defaults",
+					FSTabFreq:    0,
+					FSTabPassNo:  0,
+				},
+			},
+		},
+	},
+	platform.ARCH_AARCH64.String(): disk.PartitionTable{
+		UUID: "D209C89E-EA5E-4FBD-B161-B461CCE297E0",
+		Type: "gpt",
+		Partitions: []disk.Partition{
+			{
+				Size: 200 * common.MebiByte,
+				Type: disk.EFISystemPartitionGUID,
+				UUID: disk.EFISystemPartitionUUID,
+				Payload: &disk.Filesystem{
+					Type:         "vfat",
+					UUID:         disk.EFIFilesystemUUID,
+					Mountpoint:   "/boot/efi",
+					Label:        "EFI-SYSTEM",
+					FSTabOptions: "defaults,uid=0,gid=0,umask=077,shortname=winnt",
+					FSTabFreq:    0,
+					FSTabPassNo:  2,
+				},
+			},
+			{
+				Size: 500 * common.MebiByte,
+				Type: disk.XBootLDRPartitionGUID,
+				UUID: disk.FilesystemDataUUID,
+				Payload: &disk.Filesystem{
+					Type:         "xfs",
+					Mountpoint:   "/boot",
+					Label:        "boot",
+					FSTabOptions: "defaults",
+					FSTabFreq:    0,
+					FSTabPassNo:  0,
+				},
+			},
+			{
+				Size: 2 * common.GibiByte,
+				Type: disk.FilesystemDataGUID,
+				UUID: disk.RootPartitionUUID,
+				Payload: &disk.Filesystem{
+					Type:         "xfs",
+					Label:        "root",
+					Mountpoint:   "/",
+					FSTabOptions: "defaults",
+					FSTabFreq:    0,
+					FSTabPassNo:  0,
+				},
+			},
+		},
+	},
+}
+
+// ec2LegacyBasePartitionTables is the partition table layout for RHEL EC2
+// images prior to 8.9. It is used for backwards compatibility.
+var ec2LegacyBasePartitionTables = distro.BasePartitionTableMap{
+	platform.ARCH_X86_64.String(): disk.PartitionTable{
+		UUID: "D209C89E-EA5E-4FBD-B161-B461CCE297E0",
+		Type: "gpt",
+		Partitions: []disk.Partition{
+			{
+				Size:     1 * common.MebiByte,
+				Bootable: true,
+				Type:     disk.BIOSBootPartitionGUID,
+				UUID:     disk.BIOSBootPartitionUUID,
+			},
+			{
+				Size: 2 * common.GibiByte, // 2 GiB
+				Type: disk.FilesystemDataGUID,
+				UUID: disk.RootPartitionUUID,
+				Payload: &disk.Filesystem{
+					Type:         "xfs",
+					Label:        "root",
+					Mountpoint:   "/",
+					FSTabOptions: "defaults",
+					FSTabFreq:    0,
+					FSTabPassNo:  0,
+				},
+			},
+		},
+	},
+	platform.ARCH_AARCH64.String(): disk.PartitionTable{
+		UUID: "D209C89E-EA5E-4FBD-B161-B461CCE297E0",
+		Type: "gpt",
+		Partitions: []disk.Partition{
+			{
+				Size: 200 * common.MebiByte,
+				Type: disk.EFISystemPartitionGUID,
+				UUID: disk.EFISystemPartitionUUID,
+				Payload: &disk.Filesystem{
+					Type:         "vfat",
+					UUID:         disk.EFIFilesystemUUID,
+					Mountpoint:   "/boot/efi",
+					FSTabOptions: "defaults,uid=0,gid=0,umask=077,shortname=winnt",
+					FSTabFreq:    0,
+					FSTabPassNo:  2,
+				},
+			},
+			{
+				Size: 512 * common.MebiByte,
+				Type: disk.FilesystemDataGUID,
+				UUID: disk.FilesystemDataUUID,
+				Payload: &disk.Filesystem{
+					Type:         "xfs",
+					Mountpoint:   "/boot",
+					FSTabOptions: "defaults",
+					FSTabFreq:    0,
+					FSTabPassNo:  0,
+				},
+			},
+			{
+				Size: 2 * common.GibiByte, // 2 GiB
+				Type: disk.FilesystemDataGUID,
+				UUID: disk.RootPartitionUUID,
+				Payload: &disk.Filesystem{
+					Type:         "xfs",
+					Label:        "root",
+					Mountpoint:   "/",
+					FSTabOptions: "defaults",
+					FSTabFreq:    0,
+					FSTabPassNo:  0,
+				},
+			},
+		},
+	},
+}
+
+var edgeBasePartitionTables = distro.BasePartitionTableMap{
+	platform.ARCH_X86_64.String(): disk.PartitionTable{
+		UUID: "D209C89E-EA5E-4FBD-B161-B461CCE297E0",
+		Type: "gpt",
+		Partitions: []disk.Partition{
+			{
+				Size:     1 * common.MebiByte,
+				Bootable: true,
+				Type:     disk.BIOSBootPartitionGUID,
+				UUID:     disk.BIOSBootPartitionUUID,
+			},
+			{
+				Size: 127 * common.MebiByte, // 127 MB
+				Type: disk.EFISystemPartitionGUID,
+				UUID: disk.EFISystemPartitionUUID,
+				Payload: &disk.Filesystem{
+					Type:         "vfat",
+					UUID:         disk.EFIFilesystemUUID,
+					Mountpoint:   "/boot/efi",
+					Label:        "EFI-SYSTEM",
+					FSTabOptions: "defaults,uid=0,gid=0,umask=077,shortname=winnt",
+					FSTabFreq:    0,
+					FSTabPassNo:  2,
+				},
+			},
+			{
+				Size: 384 * common.MebiByte, // 384 MB
+				Type: disk.FilesystemDataGUID,
+				UUID: disk.FilesystemDataUUID,
+				Payload: &disk.Filesystem{
+					Type:         "xfs",
+					Mountpoint:   "/boot",
+					Label:        "boot",
+					FSTabOptions: "defaults",
+					FSTabFreq:    1,
+					FSTabPassNo:  1,
+				},
+			},
+			{
+				Size: 2 * common.GibiByte, // 2 GiB
+				Type: disk.FilesystemDataGUID,
+				UUID: disk.RootPartitionUUID,
+				Payload: &disk.LUKSContainer{
+					Label:      "crypt_root",
+					Cipher:     "cipher_null",
+					Passphrase: "osbuild",
+					PBKDF: disk.Argon2id{
+						Memory:      32,
+						Iterations:  4,
+						Parallelism: 1,
+					},
+					Clevis: &disk.ClevisBind{
+						Pin:              "null",
+						Policy:           "{}",
+						RemovePassphrase: true,
+					},
+					Payload: &disk.Filesystem{
+						Type:         "xfs",
+						Label:        "root",
+						Mountpoint:   "/",
+						FSTabOptions: "defaults",
+						FSTabFreq:    0,
+						FSTabPassNo:  0,
+					},
+				},
+			},
+		},
+	},
+	platform.ARCH_AARCH64.String(): disk.PartitionTable{
+		UUID: "D209C89E-EA5E-4FBD-B161-B461CCE297E0",
+		Type: "gpt",
+		Partitions: []disk.Partition{
+			{
+				Size: 127 * common.MebiByte, // 127 MB
+				Type: disk.EFISystemPartitionGUID,
+				UUID: disk.EFISystemPartitionUUID,
+				Payload: &disk.Filesystem{
+					Type:         "vfat",
+					UUID:         disk.EFIFilesystemUUID,
+					Mountpoint:   "/boot/efi",
+					Label:        "EFI-SYSTEM",
+					FSTabOptions: "defaults,uid=0,gid=0,umask=077,shortname=winnt",
+					FSTabFreq:    0,
+					FSTabPassNo:  2,
+				},
+			},
+			{
+				Size: 384 * common.MebiByte, // 384 MB
+				Type: disk.FilesystemDataGUID,
+				UUID: disk.FilesystemDataUUID,
+				Payload: &disk.Filesystem{
+					Type:         "xfs",
+					Mountpoint:   "/boot",
+					Label:        "boot",
+					FSTabOptions: "defaults",
+					FSTabFreq:    1,
+					FSTabPassNo:  1,
+				},
+			},
+			{
+				Size: 2 * common.GibiByte, // 2 GiB
+				Type: disk.FilesystemDataGUID,
+				UUID: disk.RootPartitionUUID,
+				Payload: &disk.LUKSContainer{
+					Label:      "crypt_root",
+					Cipher:     "cipher_null",
+					Passphrase: "osbuild",
+					PBKDF: disk.Argon2id{
+						Memory:      32,
+						Iterations:  4,
+						Parallelism: 1,
+					},
+					Clevis: &disk.ClevisBind{
+						Pin:              "null",
+						Policy:           "{}",
+						RemovePassphrase: true,
+					},
+					Payload: &disk.Filesystem{
+						Type:         "xfs",
+						Label:        "root",
+						Mountpoint:   "/",
+						FSTabOptions: "defaults",
+						FSTabFreq:    0,
+						FSTabPassNo:  0,
+					},
+				},
+			},
+		},
+	},
+}

vendor/github.com/osbuild/images/pkg/distro/rhel8/qcow2.go

@@ -0,0 +1,168 @@
+package rhel8
+
+import (
+	"github.com/osbuild/images/internal/common"
+	"github.com/osbuild/images/pkg/distro"
+	"github.com/osbuild/images/pkg/osbuild"
+	"github.com/osbuild/images/pkg/rpmmd"
+	"github.com/osbuild/images/pkg/subscription"
+)
+
+func qcow2ImgType(rd distribution) imageType {
+	it := imageType{
+		name:          "qcow2",
+		filename:      "disk.qcow2",
+		mimeType:      "application/x-qemu-disk",
+		kernelOptions: "console=tty0 console=ttyS0,115200n8 no_timer_check net.ifnames=0 crashkernel=auto",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey: qcow2CommonPackageSet,
+		},
+		defaultImageConfig: &distro.ImageConfig{
+			DefaultTarget: common.ToPtr("multi-user.target"),
+		},
+		bootable:            true,
+		defaultSize:         10 * common.GibiByte,
+		image:               liveImage,
+		buildPipelines:      []string{"build"},
+		payloadPipelines:    []string{"os", "image", "qcow2"},
+		exports:             []string{"qcow2"},
+		basePartitionTables: defaultBasePartitionTables,
+	}
+
+	if rd.isRHEL() {
+		it.defaultImageConfig.RHSMConfig = map[subscription.RHSMStatus]*osbuild.RHSMStageOptions{
+			subscription.RHSMConfigNoSubscription: {
+				DnfPlugins: &osbuild.RHSMStageOptionsDnfPlugins{
+					ProductID: &osbuild.RHSMStageOptionsDnfPlugin{
+						Enabled: false,
+					},
+					SubscriptionManager: &osbuild.RHSMStageOptionsDnfPlugin{
+						Enabled: false,
+					},
+				},
+			},
+		}
+	}
+
+	return it
+}
+
+func openstackImgType() imageType {
+	return imageType{
+		name:     "openstack",
+		filename: "disk.qcow2",
+		mimeType: "application/x-qemu-disk",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey: openstackCommonPackageSet,
+		},
+		kernelOptions:       "ro net.ifnames=0",
+		bootable:            true,
+		defaultSize:         4 * common.GibiByte,
+		image:               liveImage,
+		buildPipelines:      []string{"build"},
+		payloadPipelines:    []string{"os", "image", "qcow2"},
+		exports:             []string{"qcow2"},
+		basePartitionTables: defaultBasePartitionTables,
+	}
+}
+
+func qcow2CommonPackageSet(t *imageType) rpmmd.PackageSet {
+	ps := rpmmd.PackageSet{
+		Include: []string{
+			"@core",
+			"authselect-compat",
+			"chrony",
+			"cloud-init",
+			"cloud-utils-growpart",
+			"cockpit-system",
+			"cockpit-ws",
+			"dhcp-client",
+			"dnf",
+			"dnf-utils",
+			"dosfstools",
+			"dracut-norescue",
+			"net-tools",
+			"NetworkManager",
+			"nfs-utils",
+			"oddjob",
+			"oddjob-mkhomedir",
+			"psmisc",
+			"python3-jsonschema",
+			"qemu-guest-agent",
+			"redhat-release",
+			"redhat-release-eula",
+			"rsync",
+			"tar",
+			"tcpdump",
+			"yum",
+		},
+		Exclude: []string{
+			"aic94xx-firmware",
+			"alsa-firmware",
+			"alsa-lib",
+			"alsa-tools-firmware",
+			"biosdevname",
+			"dnf-plugin-spacewalk",
+			"dracut-config-rescue",
+			"fedora-release",
+			"fedora-repos",
+			"firewalld",
+			"fwupd",
+			"iprutils",
+			"ivtv-firmware",
+			"iwl1000-firmware",
+			"iwl100-firmware",
+			"iwl105-firmware",
+			"iwl135-firmware",
+			"iwl2000-firmware",
+			"iwl2030-firmware",
+			"iwl3160-firmware",
+			"iwl3945-firmware",
+			"iwl4965-firmware",
+			"iwl5000-firmware",
+			"iwl5150-firmware",
+			"iwl6000-firmware",
+			"iwl6000g2a-firmware",
+			"iwl6000g2b-firmware",
+			"iwl6050-firmware",
+			"iwl7260-firmware",
+			"langpacks-*",
+			"langpacks-en",
+			"langpacks-en",
+			"libertas-sd8686-firmware",
+			"libertas-sd8787-firmware",
+			"libertas-usb8388-firmware",
+			"nss",
+			"plymouth",
+			"rng-tools",
+			"udisks2",
+		},
+	}.Append(distroSpecificPackageSet(t))
+
+	// Ensure to not pull in subscription-manager on non-RHEL distro
+	if t.arch.distro.isRHEL() {
+		ps = ps.Append(rpmmd.PackageSet{
+			Include: []string{
+				"subscription-manager-cockpit",
+			},
+		})
+	}
+
+	return ps
+}
+
+func openstackCommonPackageSet(t *imageType) rpmmd.PackageSet {
+	return rpmmd.PackageSet{
+		Include: []string{
+			// Defaults
+			"@Core", "langpacks-en",
+
+			// From the lorax kickstart
+			"selinux-policy-targeted", "cloud-init", "qemu-guest-agent",
+			"spice-vdagent",
+		},
+		Exclude: []string{
+			"dracut-config-rescue", "rng-tools",
+		},
+	}
+}

vendor/github.com/osbuild/images/pkg/distro/rhel8/sap.go

@@ -0,0 +1,174 @@
+package rhel8
+
+import (
+	"github.com/osbuild/images/internal/common"
+	"github.com/osbuild/images/pkg/distro"
+	"github.com/osbuild/images/pkg/osbuild"
+	"github.com/osbuild/images/pkg/rpmmd"
+)
+
+// sapImageConfig returns the SAP specific ImageConfig data
+func sapImageConfig(rd distribution) *distro.ImageConfig {
+	return &distro.ImageConfig{
+		SELinuxConfig: &osbuild.SELinuxConfigStageOptions{
+			State: osbuild.SELinuxStatePermissive,
+		},
+		// RHBZ#1960617
+		Tuned: osbuild.NewTunedStageOptions("sap-hana"),
+		// RHBZ#1959979
+		Tmpfilesd: []*osbuild.TmpfilesdStageOptions{
+			osbuild.NewTmpfilesdStageOptions("sap.conf",
+				[]osbuild.TmpfilesdConfigLine{
+					{
+						Type: "x",
+						Path: "/tmp/.sap*",
+					},
+					{
+						Type: "x",
+						Path: "/tmp/.hdb*lock",
+					},
+					{
+						Type: "x",
+						Path: "/tmp/.trex*lock",
+					},
+				},
+			),
+		},
+		// RHBZ#1959963
+		PamLimitsConf: []*osbuild.PamLimitsConfStageOptions{
+			osbuild.NewPamLimitsConfStageOptions("99-sap.conf",
+				[]osbuild.PamLimitsConfigLine{
+					{
+						Domain: "@sapsys",
+						Type:   osbuild.PamLimitsTypeHard,
+						Item:   osbuild.PamLimitsItemNofile,
+						Value:  osbuild.PamLimitsValueInt(1048576),
+					},
+					{
+						Domain: "@sapsys",
+						Type:   osbuild.PamLimitsTypeSoft,
+						Item:   osbuild.PamLimitsItemNofile,
+						Value:  osbuild.PamLimitsValueInt(1048576),
+					},
+					{
+						Domain: "@dba",
+						Type:   osbuild.PamLimitsTypeHard,
+						Item:   osbuild.PamLimitsItemNofile,
+						Value:  osbuild.PamLimitsValueInt(1048576),
+					},
+					{
+						Domain: "@dba",
+						Type:   osbuild.PamLimitsTypeSoft,
+						Item:   osbuild.PamLimitsItemNofile,
+						Value:  osbuild.PamLimitsValueInt(1048576),
+					},
+					{
+						Domain: "@sapsys",
+						Type:   osbuild.PamLimitsTypeHard,
+						Item:   osbuild.PamLimitsItemNproc,
+						Value:  osbuild.PamLimitsValueUnlimited,
+					},
+					{
+						Domain: "@sapsys",
+						Type:   osbuild.PamLimitsTypeSoft,
+						Item:   osbuild.PamLimitsItemNproc,
+						Value:  osbuild.PamLimitsValueUnlimited,
+					},
+					{
+						Domain: "@dba",
+						Type:   osbuild.PamLimitsTypeHard,
+						Item:   osbuild.PamLimitsItemNproc,
+						Value:  osbuild.PamLimitsValueUnlimited,
+					},
+					{
+						Domain: "@dba",
+						Type:   osbuild.PamLimitsTypeSoft,
+						Item:   osbuild.PamLimitsItemNproc,
+						Value:  osbuild.PamLimitsValueUnlimited,
+					},
+				},
+			),
+		},
+		// RHBZ#1959962
+		Sysctld: []*osbuild.SysctldStageOptions{
+			osbuild.NewSysctldStageOptions("sap.conf",
+				[]osbuild.SysctldConfigLine{
+					{
+						Key:   "kernel.pid_max",
+						Value: "4194304",
+					},
+					{
+						Key:   "vm.max_map_count",
+						Value: "2147483647",
+					},
+				},
+			),
+		},
+		// E4S/EUS
+		DNFConfig: []*osbuild.DNFConfigStageOptions{
+			osbuild.NewDNFConfigStageOptions(
+				[]osbuild.DNFVariable{
+					{
+						Name:  "releasever",
+						Value: rd.osVersion,
+					},
+				},
+				nil,
+			),
+		},
+	}
+}
+
+func SapPackageSet(t *imageType) rpmmd.PackageSet {
+	packageSet := rpmmd.PackageSet{
+		Include: []string{
+			// RHBZ#2074107
+			"@Server",
+			// SAP System Roles
+			// https://access.redhat.com/sites/default/files/attachments/rhel_system_roles_for_sap_1.pdf
+			"rhel-system-roles-sap",
+			// RHBZ#1959813
+			"bind-utils",
+			"compat-sap-c++-9",
+			"compat-sap-c++-10", // RHBZ#2074114
+			"nfs-utils",
+			"tcsh",
+			// RHBZ#1959955
+			"uuidd",
+			// RHBZ#1959923
+			"cairo",
+			"expect",
+			"graphviz",
+			"gtk2",
+			"iptraf-ng",
+			"krb5-workstation",
+			"libaio",
+			"libatomic",
+			"libcanberra-gtk2",
+			"libicu",
+			"libpng12",
+			"libtool-ltdl",
+			"lm_sensors",
+			"net-tools",
+			"numactl",
+			"PackageKit-gtk3-module",
+			"xorg-x11-xauth",
+			// RHBZ#1960617
+			"tuned-profiles-sap-hana",
+			// RHBZ#1961168
+			"libnsl",
+		},
+	}
+
+	if common.VersionLessThan(t.arch.distro.osVersion, "8.6") {
+		packageSet = packageSet.Append(rpmmd.PackageSet{
+			Include: []string{"ansible"},
+		})
+	} else {
+		// 8.6+ and CS8 (image type does not exist on 8.5)
+		packageSet = packageSet.Append(rpmmd.PackageSet{
+			Include: []string{"ansible-core"}, // RHBZ#2077356
+		})
+	}
+	return packageSet
+}

vendor/github.com/osbuild/images/pkg/distro/rhel8/vmdk.go

@@ -0,0 +1,64 @@
+package rhel8
+
+import (
+	"github.com/osbuild/images/internal/common"
+	"github.com/osbuild/images/pkg/rpmmd"
+)
+
+const vmdkKernelOptions = "ro net.ifnames=0"
+
+func vmdkImgType() imageType {
+	return imageType{
+		name:     "vmdk",
+		filename: "disk.vmdk",
+		mimeType: "application/x-vmdk",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey: vmdkCommonPackageSet,
+		},
+		kernelOptions:       vmdkKernelOptions,
+		bootable:            true,
+		defaultSize:         4 * common.GibiByte,
+		image:               liveImage,
+		buildPipelines:      []string{"build"},
+		payloadPipelines:    []string{"os", "image", "vmdk"},
+		exports:             []string{"vmdk"},
+		basePartitionTables: defaultBasePartitionTables,
+	}
+}
+
+func ovaImgType() imageType {
+	return imageType{
+		name:     "ova",
+		filename: "image.ova",
+		mimeType: "application/ovf",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey: vmdkCommonPackageSet,
+		},
+		kernelOptions:       vmdkKernelOptions,
+		bootable:            true,
+		defaultSize:         4 * common.GibiByte,
+		image:               liveImage,
+		buildPipelines:      []string{"build"},
+		payloadPipelines:    []string{"os", "image", "vmdk", "ovf", "archive"},
+		exports:             []string{"archive"},
+		basePartitionTables: defaultBasePartitionTables,
+	}
+}
+
+func vmdkCommonPackageSet(t *imageType) rpmmd.PackageSet {
+	return rpmmd.PackageSet{
+		Include: []string{
+			"@core",
+			"chrony",
+			"cloud-init",
+			"firewalld",
+			"langpacks-en",
+			"open-vm-tools",
+			"selinux-policy-targeted",
+		},
+		Exclude: []string{
+			"dracut-config-rescue",
+			"rng-tools",
+		},
+	}
+}

vendor/github.com/osbuild/images/pkg/distro/rhel8/workloads.go

@@ -0,0 +1,26 @@
+package rhel8
+
+import "github.com/osbuild/images/internal/workload"
+
+// rhel8Workload is a RHEL-8-specific implementation of the workload interface
+// for internal workload variants.
+type rhel8Workload struct {
+	workload.BaseWorkload
+	packages []string
+}
+
+func (w rhel8Workload) GetPackages() []string {
+	return w.packages
+}
+
+func eapWorkload() workload.Workload {
+	w := rhel8Workload{}
+	w.packages = []string{
+		"java-1.8.0-openjdk",
+		"java-1.8.0-openjdk-devel",
+		"eap7-wildfly",
+		"eap7-artemis-native-wildfly",
+	}
+
+	return &w
+}

vendor/github.com/osbuild/images/pkg/distro/rhel9/ami.go

@@ -0,0 +1,475 @@
+package rhel9
+
+import (
+	"github.com/osbuild/images/internal/common"
+	"github.com/osbuild/images/pkg/distro"
+	"github.com/osbuild/images/pkg/osbuild"
+	"github.com/osbuild/images/pkg/rpmmd"
+	"github.com/osbuild/images/pkg/subscription"
+)
+
+const amiKernelOptions = "console=ttyS0,115200n8 console=tty0 net.ifnames=0 rd.blacklist=nouveau nvme_core.io_timeout=4294967295"
+
+var (
+	amiImgTypeX86_64 = imageType{
+		name:     "ami",
+		filename: "image.raw",
+		mimeType: "application/octet-stream",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey: ec2CommonPackageSet,
+		},
+		kernelOptions:       amiKernelOptions,
+		bootable:            true,
+		defaultSize:         10 * common.GibiByte,
+		image:               liveImage,
+		buildPipelines:      []string{"build"},
+		payloadPipelines:    []string{"os", "image"},
+		exports:             []string{"image"},
+		basePartitionTables: defaultBasePartitionTables,
+	}
+
+	ec2ImgTypeX86_64 = imageType{
+		name:        "ec2",
+		filename:    "image.raw.xz",
+		mimeType:    "application/xz",
+		compression: "xz",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey: rhelEc2PackageSet,
+		},
+		kernelOptions:       amiKernelOptions,
+		bootable:            true,
+		defaultSize:         10 * common.GibiByte,
+		image:               liveImage,
+		buildPipelines:      []string{"build"},
+		payloadPipelines:    []string{"os", "image", "xz"},
+		exports:             []string{"xz"},
+		basePartitionTables: defaultBasePartitionTables,
+	}
+
+	ec2HaImgTypeX86_64 = imageType{
+		name:        "ec2-ha",
+		filename:    "image.raw.xz",
+		mimeType:    "application/xz",
+		compression: "xz",
+		packageSets: map[string]packageSetFunc{
+			buildPkgsKey: ec2BuildPackageSet,
+			osPkgsKey:    rhelEc2HaPackageSet,
+		},
+		kernelOptions:       amiKernelOptions,
+		bootable:            true,
+		defaultSize:         10 * common.GibiByte,
+		image:               liveImage,
+		buildPipelines:      []string{"build"},
+		payloadPipelines:    []string{"os", "image", "xz"},
+		exports:             []string{"xz"},
+		basePartitionTables: defaultBasePartitionTables,
+	}
+
+	amiImgTypeAarch64 = imageType{
+		name:     "ami",
+		filename: "image.raw",
+		mimeType: "application/octet-stream",
+		packageSets: map[string]packageSetFunc{
+			buildPkgsKey: ec2BuildPackageSet,
+			osPkgsKey:    ec2CommonPackageSet,
+		},
+		kernelOptions:       "console=ttyS0,115200n8 console=tty0 net.ifnames=0 rd.blacklist=nouveau nvme_core.io_timeout=4294967295 iommu.strict=0",
+		bootable:            true,
+		defaultSize:         10 * common.GibiByte,
+		image:               liveImage,
+		buildPipelines:      []string{"build"},
+		payloadPipelines:    []string{"os", "image"},
+		exports:             []string{"image"},
+		basePartitionTables: defaultBasePartitionTables,
+	}
+
+	ec2ImgTypeAarch64 = imageType{
+		name:        "ec2",
+		filename:    "image.raw.xz",
+		mimeType:    "application/xz",
+		compression: "xz",
+		packageSets: map[string]packageSetFunc{
+			buildPkgsKey: ec2BuildPackageSet,
+			osPkgsKey:    rhelEc2PackageSet,
+		},
+		kernelOptions:       "console=ttyS0,115200n8 console=tty0 net.ifnames=0 rd.blacklist=nouveau nvme_core.io_timeout=4294967295 iommu.strict=0",
+		bootable:            true,
+		defaultSize:         10 * common.GibiByte,
+		image:               liveImage,
+		buildPipelines:      []string{"build"},
+		payloadPipelines:    []string{"os", "image", "xz"},
+		exports:             []string{"xz"},
+		basePartitionTables: defaultBasePartitionTables,
+	}
+
+	ec2SapImgTypeX86_64 = imageType{
+		name:        "ec2-sap",
+		filename:    "image.raw.xz",
+		mimeType:    "application/xz",
+		compression: "xz",
+		packageSets: map[string]packageSetFunc{
+			buildPkgsKey: ec2BuildPackageSet,
+			osPkgsKey:    rhelEc2SapPackageSet,
+		},
+		kernelOptions:       "console=ttyS0,115200n8 console=tty0 net.ifnames=0 rd.blacklist=nouveau nvme_core.io_timeout=4294967295 processor.max_cstate=1 intel_idle.max_cstate=1",
+		bootable:            true,
+		defaultSize:         10 * common.GibiByte,
+		image:               liveImage,
+		buildPipelines:      []string{"build"},
+		payloadPipelines:    []string{"os", "image", "xz"},
+		exports:             []string{"xz"},
+		basePartitionTables: defaultBasePartitionTables,
+	}
+)
+
+// default EC2 images config (common for all architectures)
+func baseEc2ImageConfig() *distro.ImageConfig {
+	return &distro.ImageConfig{
+		Locale:   common.ToPtr("en_US.UTF-8"),
+		Timezone: common.ToPtr("UTC"),
+		TimeSynchronization: &osbuild.ChronyStageOptions{
+			Servers: []osbuild.ChronyConfigServer{
+				{
+					Hostname: "169.254.169.123",
+					Prefer:   common.ToPtr(true),
+					Iburst:   common.ToPtr(true),
+					Minpoll:  common.ToPtr(4),
+					Maxpoll:  common.ToPtr(4),
+				},
+			},
+			// empty string will remove any occurrences of the option from the configuration
+			LeapsecTz: common.ToPtr(""),
+		},
+		Keyboard: &osbuild.KeymapStageOptions{
+			Keymap: "us",
+			X11Keymap: &osbuild.X11KeymapOptions{
+				Layouts: []string{"us"},
+			},
+		},
+		EnabledServices: []string{
+			"sshd",
+			"NetworkManager",
+			"nm-cloud-setup.service",
+			"nm-cloud-setup.timer",
+			"cloud-init",
+			"cloud-init-local",
+			"cloud-config",
+			"cloud-final",
+			"reboot.target",
+			"tuned",
+		},
+		DefaultTarget: common.ToPtr("multi-user.target"),
+		Sysconfig: []*osbuild.SysconfigStageOptions{
+			{
+				Kernel: &osbuild.SysconfigKernelOptions{
+					UpdateDefault: true,
+					DefaultKernel: "kernel",
+				},
+				Network: &osbuild.SysconfigNetworkOptions{
+					Networking: true,
+					NoZeroConf: true,
+				},
+				NetworkScripts: &osbuild.NetworkScriptsOptions{
+					IfcfgFiles: map[string]osbuild.IfcfgFile{
+						"eth0": {
+							Device:    "eth0",
+							Bootproto: osbuild.IfcfgBootprotoDHCP,
+							OnBoot:    common.ToPtr(true),
+							Type:      osbuild.IfcfgTypeEthernet,
+							UserCtl:   common.ToPtr(true),
+							PeerDNS:   common.ToPtr(true),
+							IPv6Init:  common.ToPtr(false),
+						},
+					},
+				},
+			},
+		},
+		SystemdLogind: []*osbuild.SystemdLogindStageOptions{
+			{
+				Filename: "00-getty-fixes.conf",
+				Config: osbuild.SystemdLogindConfigDropin{
+
+					Login: osbuild.SystemdLogindConfigLoginSection{
+						NAutoVTs: common.ToPtr(0),
+					},
+				},
+			},
+		},
+		CloudInit: []*osbuild.CloudInitStageOptions{
+			{
+				Filename: "00-rhel-default-user.cfg",
+				Config: osbuild.CloudInitConfigFile{
+					SystemInfo: &osbuild.CloudInitConfigSystemInfo{
+						DefaultUser: &osbuild.CloudInitConfigDefaultUser{
+							Name: "ec2-user",
+						},
+					},
+				},
+			},
+		},
+		Modprobe: []*osbuild.ModprobeStageOptions{
+			{
+				Filename: "blacklist-nouveau.conf",
+				Commands: osbuild.ModprobeConfigCmdList{
+					osbuild.NewModprobeConfigCmdBlacklist("nouveau"),
+				},
+			},
+			{
+				Filename: "blacklist-amdgpu.conf",
+				Commands: osbuild.ModprobeConfigCmdList{
+					osbuild.NewModprobeConfigCmdBlacklist("amdgpu"),
+				},
+			},
+		},
+		// COMPOSER-1807
+		DracutConf: []*osbuild.DracutConfStageOptions{
+			{
+				Filename: "sgdisk.conf",
+				Config: osbuild.DracutConfigFile{
+					Install: []string{"sgdisk"},
+				},
+			},
+		},
+		SystemdUnit: []*osbuild.SystemdUnitStageOptions{
+			// RHBZ#1822863
+			{
+				Unit:   "nm-cloud-setup.service",
+				Dropin: "10-rh-enable-for-ec2.conf",
+				Config: osbuild.SystemdServiceUnitDropin{
+					Service: &osbuild.SystemdUnitServiceSection{
+						Environment: "NM_CLOUD_SETUP_EC2=yes",
+					},
+				},
+			},
+		},
+		Authselect: &osbuild.AuthselectStageOptions{
+			Profile: "sssd",
+		},
+		SshdConfig: &osbuild.SshdConfigStageOptions{
+			Config: osbuild.SshdConfigConfig{
+				PasswordAuthentication: common.ToPtr(false),
+			},
+		},
+	}
+}
+
+func defaultEc2ImageConfig(osVersion string, rhsm bool) *distro.ImageConfig {
+	ic := baseEc2ImageConfig()
+	if rhsm && common.VersionLessThan(osVersion, "9.1") {
+		ic = appendRHSM(ic)
+		// Disable RHSM redhat.repo management
+		rhsmConf := ic.RHSMConfig[subscription.RHSMConfigNoSubscription]
+		rhsmConf.SubMan.Rhsm = &osbuild.SubManConfigRHSMSection{ManageRepos: common.ToPtr(false)}
+		ic.RHSMConfig[subscription.RHSMConfigNoSubscription] = rhsmConf
+	}
+	return ic
+}
+
+// default AMI (EC2 BYOS) images config
+func defaultAMIImageConfig(osVersion string, rhsm bool) *distro.ImageConfig {
+	ic := defaultEc2ImageConfig(osVersion, rhsm)
+	if rhsm {
+		// defaultAMIImageConfig() adds the rhsm options only for RHEL < 9.1
+		// Add it unconditionally for AMI
+		ic = appendRHSM(ic)
+	}
+	return ic
+}
+
+func defaultEc2ImageConfigX86_64(osVersion string, rhsm bool) *distro.ImageConfig {
+	ic := defaultEc2ImageConfig(osVersion, rhsm)
+	return appendEC2DracutX86_64(ic)
+}
+
+func defaultAMIImageConfigX86_64(osVersion string, rhsm bool) *distro.ImageConfig {
+	ic := defaultAMIImageConfig(osVersion, rhsm).InheritFrom(defaultEc2ImageConfigX86_64(osVersion, rhsm))
+	return appendEC2DracutX86_64(ic)
+}
+
+// common ec2 image build package set
+func ec2BuildPackageSet(t *imageType) rpmmd.PackageSet {
+	return distroBuildPackageSet(t).Append(
+		rpmmd.PackageSet{
+			Include: []string{
+				"python3-pyyaml",
+			},
+		})
+}
+
+func ec2CommonPackageSet(t *imageType) rpmmd.PackageSet {
+	return rpmmd.PackageSet{
+		Include: []string{
+			"authselect-compat",
+			"chrony",
+			"cloud-init",
+			"cloud-utils-growpart",
+			"dhcp-client",
+			"yum-utils",
+			"dracut-config-generic",
+			"gdisk",
+			"grub2",
+			"langpacks-en",
+			"NetworkManager-cloud-setup",
+			"redhat-release",
+			"redhat-release-eula",
+			"rsync",
+			"tar",
+		},
+		Exclude: []string{
+			"aic94xx-firmware",
+			"alsa-firmware",
+			"alsa-tools-firmware",
+			"biosdevname",
+			"iprutils",
+			"ivtv-firmware",
+			"libertas-sd8787-firmware",
+			"plymouth",
+			// RHBZ#2064087
+			"dracut-config-rescue",
+			// RHBZ#2075815
+			"qemu-guest-agent",
+		},
+	}.Append(coreOsCommonPackageSet(t)).Append(distroSpecificPackageSet(t))
+}
+
+// common rhel ec2 RHUI image package set
+func rhelEc2CommonPackageSet(t *imageType) rpmmd.PackageSet {
+	ps := ec2CommonPackageSet(t)
+	// Include "redhat-cloud-client-configuration" on 9.1+ (COMPOSER-1805)
+	if !common.VersionLessThan(t.arch.distro.osVersion, "9.1") {
+		ps.Include = append(ps.Include, "redhat-cloud-client-configuration")
+	}
+	return ps
+}
+
+// rhel-ec2 image package set
+func rhelEc2PackageSet(t *imageType) rpmmd.PackageSet {
+	ec2PackageSet := rhelEc2CommonPackageSet(t)
+	ec2PackageSet = ec2PackageSet.Append(rpmmd.PackageSet{
+		Include: []string{
+			"rh-amazon-rhui-client",
+		},
+		Exclude: []string{
+			"alsa-lib",
+		},
+	})
+	return ec2PackageSet
+}
+
+// rhel-ha-ec2 image package set
+func rhelEc2HaPackageSet(t *imageType) rpmmd.PackageSet {
+	ec2HaPackageSet := rhelEc2CommonPackageSet(t)
+	ec2HaPackageSet = ec2HaPackageSet.Append(rpmmd.PackageSet{
+		Include: []string{
+			"fence-agents-all",
+			"pacemaker",
+			"pcs",
+			"rh-amazon-rhui-client-ha",
+		},
+		Exclude: []string{
+			"alsa-lib",
+		},
+	})
+	return ec2HaPackageSet
+}
+
+// rhel-sap-ec2 image package set
+// Includes the common ec2 package set, the common SAP packages, and
+// the amazon rhui sap package
+func rhelEc2SapPackageSet(t *imageType) rpmmd.PackageSet {
+	return rpmmd.PackageSet{
+		Include: []string{
+			"rh-amazon-rhui-client-sap-bundle-e4s",
+		},
+	}.Append(rhelEc2CommonPackageSet(t)).Append(SapPackageSet(t))
+}
+
+func mkEc2ImgTypeX86_64(osVersion string, rhsm bool) imageType {
+	it := ec2ImgTypeX86_64
+	ic := defaultEc2ImageConfigX86_64(osVersion, rhsm)
+	it.defaultImageConfig = ic
+	return it
+}
+
+func mkAMIImgTypeX86_64(osVersion string, rhsm bool) imageType {
+	it := amiImgTypeX86_64
+	ic := defaultAMIImageConfigX86_64(osVersion, rhsm)
+	it.defaultImageConfig = ic
+	return it
+}
+
+func mkEC2SapImgTypeX86_64(osVersion string, rhsm bool) imageType {
+	it := ec2SapImgTypeX86_64
+	it.defaultImageConfig = sapImageConfig(osVersion).InheritFrom(defaultEc2ImageConfigX86_64(osVersion, rhsm))
+	return it
+}
+
+func mkEc2HaImgTypeX86_64(osVersion string, rhsm bool) imageType {
+	it := ec2HaImgTypeX86_64
+	ic := defaultEc2ImageConfigX86_64(osVersion, rhsm)
+	it.defaultImageConfig = ic
+	return it
+}
+
+func mkAMIImgTypeAarch64(osVersion string, rhsm bool) imageType {
+	it := amiImgTypeAarch64
+	ic := defaultAMIImageConfig(osVersion, rhsm)
+	it.defaultImageConfig = ic
+	return it
+}
+
+func mkEC2ImgTypeAarch64(osVersion string, rhsm bool) imageType {
+	it := ec2ImgTypeAarch64
+	ic := defaultEc2ImageConfig(osVersion, rhsm)
+	it.defaultImageConfig = ic
+	return it
+}
+
+// Add RHSM config options to ImageConfig.
+// Used for RHEL distros.
+func appendRHSM(ic *distro.ImageConfig) *distro.ImageConfig {
+	rhsm := &distro.ImageConfig{
+		RHSMConfig: map[subscription.RHSMStatus]*osbuild.RHSMStageOptions{
+			subscription.RHSMConfigNoSubscription: {
+				// RHBZ#1932802
+				SubMan: &osbuild.RHSMStageOptionsSubMan{
+					Rhsmcertd: &osbuild.SubManConfigRHSMCERTDSection{
+						AutoRegistration: common.ToPtr(true),
+					},
+					// Don't disable RHSM redhat.repo management on the AMI
+					// image, which is BYOS and does not use RHUI for content.
+					// Otherwise subscribing the system manually after booting
+					// it would result in empty redhat.repo. Without RHUI, such
+					// system would have no way to get Red Hat content, but
+					// enable the repo management manually, which would be very
+					// confusing.
+				},
+			},
+			subscription.RHSMConfigWithSubscription: {
+				// RHBZ#1932802
+				SubMan: &osbuild.RHSMStageOptionsSubMan{
+					Rhsmcertd: &osbuild.SubManConfigRHSMCERTDSection{
+						AutoRegistration: common.ToPtr(true),
+					},
+					// do not disable the redhat.repo management if the user
+					// explicitly request the system to be subscribed
+				},
+			},
+		},
+	}
+	return rhsm.InheritFrom(ic)
+}
+
+func appendEC2DracutX86_64(ic *distro.ImageConfig) *distro.ImageConfig {
+	ic.DracutConf = append(ic.DracutConf,
+		&osbuild.DracutConfStageOptions{
+			Filename: "ec2.conf",
+			Config: osbuild.DracutConfigFile{
+				AddDrivers: []string{
+					"nvme",
+					"xen-blkfront",
+				},
+			},
+		})
+	return ic
+}

vendor/github.com/osbuild/images/pkg/distro/rhel9/arch.go

@@ -0,0 +1,70 @@
+package rhel9
+
+import (
+	"errors"
+	"fmt"
+	"sort"
+
+	"github.com/osbuild/images/pkg/distro"
+	"github.com/osbuild/images/pkg/platform"
+)
+
+type architecture struct {
+	distro           *distribution
+	name             string
+	imageTypes       map[string]distro.ImageType
+	imageTypeAliases map[string]string
+}
+
+func (a *architecture) Name() string {
+	return a.name
+}
+
+func (a *architecture) ListImageTypes() []string {
+	itNames := make([]string, 0, len(a.imageTypes))
+	for name := range a.imageTypes {
+		itNames = append(itNames, name)
+	}
+	sort.Strings(itNames)
+	return itNames
+}
+
+func (a *architecture) GetImageType(name string) (distro.ImageType, error) {
+	t, exists := a.imageTypes[name]
+	if !exists {
+		aliasForName, exists := a.imageTypeAliases[name]
+		if !exists {
+			return nil, errors.New("invalid image type: " + name)
+		}
+		t, exists = a.imageTypes[aliasForName]
+		if !exists {
+			panic(fmt.Sprintf("image type '%s' is an alias to a non-existing image type '%s'", name, aliasForName))
+		}
+	}
+	return t, nil
+}
+
+func (a *architecture) addImageTypes(platform platform.Platform, imageTypes ...imageType) {
+	if a.imageTypes == nil {
+		a.imageTypes = map[string]distro.ImageType{}
+	}
+	for idx := range imageTypes {
+		it := imageTypes[idx]
+		it.arch = a
+		it.platform = platform
+		a.imageTypes[it.name] = &it
+		for _, alias := range it.nameAliases {
+			if a.imageTypeAliases == nil {
+				a.imageTypeAliases = map[string]string{}
+			}
+			if existingAliasFor, exists := a.imageTypeAliases[alias]; exists {
+				panic(fmt.Sprintf("image type alias '%s' for '%s' is already defined for another image type '%s'", alias, it.name, existingAliasFor))
+			}
+			a.imageTypeAliases[alias] = it.name
+		}
+	}
+}
+
+func (a *architecture) Distro() distro.Distro {
+	return a.distro
+}

vendor/github.com/osbuild/images/pkg/distro/rhel9/azure.go

@@ -0,0 +1,596 @@
+package rhel9
+
+import (
+	"github.com/osbuild/images/internal/common"
+	"github.com/osbuild/images/pkg/disk"
+	"github.com/osbuild/images/pkg/distro"
+	"github.com/osbuild/images/pkg/osbuild"
+	"github.com/osbuild/images/pkg/platform"
+	"github.com/osbuild/images/pkg/rpmmd"
+	"github.com/osbuild/images/pkg/subscription"
+)
+
+var (
+	// Azure non-RHEL image type
+	azureImgType = imageType{
+		name:     "vhd",
+		filename: "disk.vhd",
+		mimeType: "application/x-vhd",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey: azurePackageSet,
+		},
+		defaultImageConfig:  defaultAzureImageConfig,
+		kernelOptions:       defaultAzureKernelOptions,
+		bootable:            true,
+		defaultSize:         4 * common.GibiByte,
+		image:               liveImage,
+		buildPipelines:      []string{"build"},
+		payloadPipelines:    []string{"os", "image", "vpc"},
+		exports:             []string{"vpc"},
+		basePartitionTables: defaultBasePartitionTables,
+	}
+
+	// Azure BYOS image type
+	azureByosImgType = imageType{
+		name:     "vhd",
+		filename: "disk.vhd",
+		mimeType: "application/x-vhd",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey: azurePackageSet,
+		},
+		defaultImageConfig:  defaultAzureByosImageConfig.InheritFrom(defaultAzureImageConfig),
+		kernelOptions:       defaultAzureKernelOptions,
+		bootable:            true,
+		defaultSize:         4 * common.GibiByte,
+		image:               liveImage,
+		buildPipelines:      []string{"build"},
+		payloadPipelines:    []string{"os", "image", "vpc"},
+		exports:             []string{"vpc"},
+		basePartitionTables: defaultBasePartitionTables,
+	}
+
+	// Azure RHUI image type
+	azureRhuiImgType = imageType{
+		name:        "azure-rhui",
+		filename:    "disk.vhd.xz",
+		mimeType:    "application/xz",
+		compression: "xz",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey: azureRhuiPackageSet,
+		},
+		defaultImageConfig:  defaultAzureRhuiImageConfig.InheritFrom(defaultAzureImageConfig),
+		kernelOptions:       defaultAzureKernelOptions,
+		bootable:            true,
+		defaultSize:         64 * common.GibiByte,
+		image:               liveImage,
+		buildPipelines:      []string{"build"},
+		payloadPipelines:    []string{"os", "image", "vpc", "xz"},
+		exports:             []string{"xz"},
+		basePartitionTables: azureRhuiBasePartitionTables,
+	}
+)
+
+// PACKAGE SETS
+
+// Common Azure image package set
+func azureCommonPackageSet(t *imageType) rpmmd.PackageSet {
+	ps := rpmmd.PackageSet{
+		Include: []string{
+			"@Server",
+			"bzip2",
+			"cloud-init",
+			"cloud-utils-growpart",
+			"dracut-config-generic",
+			"efibootmgr",
+			"gdisk",
+			"hyperv-daemons",
+			"kernel-core",
+			"kernel-modules",
+			"kernel",
+			"langpacks-en",
+			"lvm2",
+			"NetworkManager",
+			"NetworkManager-cloud-setup",
+			"nvme-cli",
+			"patch",
+			"rng-tools",
+			"selinux-policy-targeted",
+			"uuid",
+			"WALinuxAgent",
+			"yum-utils",
+		},
+		Exclude: []string{
+			"aic94xx-firmware",
+			"alsa-firmware",
+			"alsa-lib",
+			"alsa-sof-firmware",
+			"alsa-tools-firmware",
+			"biosdevname",
+			"bolt",
+			"buildah",
+			"cockpit-podman",
+			"containernetworking-plugins",
+			"dnf-plugin-spacewalk",
+			"dracut-config-rescue",
+			"glibc-all-langpacks",
+			"iprutils",
+			"ivtv-firmware",
+			"iwl100-firmware",
+			"iwl1000-firmware",
+			"iwl105-firmware",
+			"iwl135-firmware",
+			"iwl2000-firmware",
+			"iwl2030-firmware",
+			"iwl3160-firmware",
+			"iwl3945-firmware",
+			"iwl4965-firmware",
+			"iwl5000-firmware",
+			"iwl5150-firmware",
+			"iwl6000-firmware",
+			"iwl6000g2a-firmware",
+			"iwl6000g2b-firmware",
+			"iwl6050-firmware",
+			"iwl7260-firmware",
+			"libertas-sd8686-firmware",
+			"libertas-sd8787-firmware",
+			"libertas-usb8388-firmware",
+			"NetworkManager-config-server",
+			"plymouth",
+			"podman",
+			"python3-dnf-plugin-spacewalk",
+			"python3-hwdata",
+			"python3-rhnlib",
+			"rhn-check",
+			"rhn-client-tools",
+			"rhn-setup",
+			"rhnlib",
+			"rhnsd",
+			"usb_modeswitch",
+		},
+	}.Append(distroSpecificPackageSet(t))
+
+	if t.arch.distro.isRHEL() {
+		ps.Append(rpmmd.PackageSet{
+			Include: []string{
+				"rhc",
+			},
+		})
+	}
+
+	return ps
+}
+
+// Azure BYOS image package set
+func azurePackageSet(t *imageType) rpmmd.PackageSet {
+	return azureCommonPackageSet(t)
+}
+
+// Azure RHUI image package set
+func azureRhuiPackageSet(t *imageType) rpmmd.PackageSet {
+	return rpmmd.PackageSet{
+		Include: []string{
+			"rhui-azure-rhel9",
+		},
+	}.Append(azureCommonPackageSet(t))
+}
+
+// PARTITION TABLES
+
+var azureRhuiBasePartitionTables = distro.BasePartitionTableMap{
+	platform.ARCH_X86_64.String(): disk.PartitionTable{
+		UUID: "D209C89E-EA5E-4FBD-B161-B461CCE297E0",
+		Type: "gpt",
+		Size: 64 * common.GibiByte,
+		Partitions: []disk.Partition{
+			{
+				Size: 500 * common.MebiByte,
+				Type: disk.EFISystemPartitionGUID,
+				UUID: disk.EFISystemPartitionUUID,
+				Payload: &disk.Filesystem{
+					Type:         "vfat",
+					UUID:         disk.EFIFilesystemUUID,
+					Mountpoint:   "/boot/efi",
+					FSTabOptions: "defaults,uid=0,gid=0,umask=077,shortname=winnt",
+					FSTabFreq:    0,
+					FSTabPassNo:  2,
+				},
+			},
+			{
+				Size: 500 * common.MebiByte,
+				Type: disk.FilesystemDataGUID,
+				UUID: disk.FilesystemDataUUID,
+				Payload: &disk.Filesystem{
+					Type:         "xfs",
+					Mountpoint:   "/boot",
+					FSTabOptions: "defaults",
+					FSTabFreq:    0,
+					FSTabPassNo:  0,
+				},
+			},
+			{
+				Size:     2 * common.MebiByte,
+				Bootable: true,
+				Type:     disk.BIOSBootPartitionGUID,
+				UUID:     disk.BIOSBootPartitionUUID,
+			},
+			{
+				Type: disk.LVMPartitionGUID,
+				UUID: disk.RootPartitionUUID,
+				Payload: &disk.LVMVolumeGroup{
+					Name:        "rootvg",
+					Description: "built with lvm2 and osbuild",
+					LogicalVolumes: []disk.LVMLogicalVolume{
+						{
+							Size: 1 * common.GibiByte,
+							Name: "homelv",
+							Payload: &disk.Filesystem{
+								Type:         "xfs",
+								Label:        "home",
+								Mountpoint:   "/home",
+								FSTabOptions: "defaults",
+								FSTabFreq:    0,
+								FSTabPassNo:  0,
+							},
+						},
+						{
+							Size: 2 * common.GibiByte,
+							Name: "rootlv",
+							Payload: &disk.Filesystem{
+								Type:         "xfs",
+								Label:        "root",
+								Mountpoint:   "/",
+								FSTabOptions: "defaults",
+								FSTabFreq:    0,
+								FSTabPassNo:  0,
+							},
+						},
+						{
+							Size: 2 * common.GibiByte,
+							Name: "tmplv",
+							Payload: &disk.Filesystem{
+								Type:         "xfs",
+								Label:        "tmp",
+								Mountpoint:   "/tmp",
+								FSTabOptions: "defaults",
+								FSTabFreq:    0,
+								FSTabPassNo:  0,
+							},
+						},
+						{
+							Size: 10 * common.GibiByte,
+							Name: "usrlv",
+							Payload: &disk.Filesystem{
+								Type:         "xfs",
+								Label:        "usr",
+								Mountpoint:   "/usr",
+								FSTabOptions: "defaults",
+								FSTabFreq:    0,
+								FSTabPassNo:  0,
+							},
+						},
+						{
+							Size: 10 * common.GibiByte,
+							Name: "varlv",
+							Payload: &disk.Filesystem{
+								Type:         "xfs",
+								Label:        "var",
+								Mountpoint:   "/var",
+								FSTabOptions: "defaults",
+								FSTabFreq:    0,
+								FSTabPassNo:  0,
+							},
+						},
+					},
+				},
+			},
+		},
+	},
+	platform.ARCH_AARCH64.String(): disk.PartitionTable{
+		UUID: "D209C89E-EA5E-4FBD-B161-B461CCE297E0",
+		Type: "gpt",
+		Size: 64 * common.GibiByte,
+		Partitions: []disk.Partition{
+			{
+				Size: 500 * common.MebiByte,
+				Type: disk.EFISystemPartitionGUID,
+				UUID: disk.EFISystemPartitionUUID,
+				Payload: &disk.Filesystem{
+					Type:         "vfat",
+					UUID:         disk.EFIFilesystemUUID,
+					Mountpoint:   "/boot/efi",
+					FSTabOptions: "defaults,uid=0,gid=0,umask=077,shortname=winnt",
+					FSTabFreq:    0,
+					FSTabPassNo:  2,
+				},
+			},
+			{
+				Size: 500 * common.MebiByte,
+				Type: disk.FilesystemDataGUID,
+				UUID: disk.FilesystemDataUUID,
+				Payload: &disk.Filesystem{
+					Type:         "xfs",
+					Mountpoint:   "/boot",
+					FSTabOptions: "defaults",
+					FSTabFreq:    0,
+					FSTabPassNo:  0,
+				},
+			},
+			{
+				Type: disk.LVMPartitionGUID,
+				UUID: disk.RootPartitionUUID,
+				Payload: &disk.LVMVolumeGroup{
+					Name:        "rootvg",
+					Description: "built with lvm2 and osbuild",
+					LogicalVolumes: []disk.LVMLogicalVolume{
+						{
+							Size: 1 * common.GibiByte,
+							Name: "homelv",
+							Payload: &disk.Filesystem{
+								Type:         "xfs",
+								Label:        "home",
+								Mountpoint:   "/home",
+								FSTabOptions: "defaults",
+								FSTabFreq:    0,
+								FSTabPassNo:  0,
+							},
+						},
+						{
+							Size: 2 * common.GibiByte,
+							Name: "rootlv",
+							Payload: &disk.Filesystem{
+								Type:         "xfs",
+								Label:        "root",
+								Mountpoint:   "/",
+								FSTabOptions: "defaults",
+								FSTabFreq:    0,
+								FSTabPassNo:  0,
+							},
+						},
+						{
+							Size: 2 * common.GibiByte,
+							Name: "tmplv",
+							Payload: &disk.Filesystem{
+								Type:         "xfs",
+								Label:        "tmp",
+								Mountpoint:   "/tmp",
+								FSTabOptions: "defaults",
+								FSTabFreq:    0,
+								FSTabPassNo:  0,
+							},
+						},
+						{
+							Size: 10 * common.GibiByte,
+							Name: "usrlv",
+							Payload: &disk.Filesystem{
+								Type:         "xfs",
+								Label:        "usr",
+								Mountpoint:   "/usr",
+								FSTabOptions: "defaults",
+								FSTabFreq:    0,
+								FSTabPassNo:  0,
+							},
+						},
+						{
+							Size: 10 * common.GibiByte,
+							Name: "varlv",
+							Payload: &disk.Filesystem{
+								Type:         "xfs",
+								Label:        "var",
+								Mountpoint:   "/var",
+								FSTabOptions: "defaults",
+								FSTabFreq:    0,
+								FSTabPassNo:  0,
+							},
+						},
+					},
+				},
+			},
+		},
+	},
+}
+
+var defaultAzureKernelOptions = "ro console=tty1 console=ttyS0 earlyprintk=ttyS0 rootdelay=300"
+
+var defaultAzureImageConfig = &distro.ImageConfig{
+	Timezone: common.ToPtr("Etc/UTC"),
+	Locale:   common.ToPtr("en_US.UTF-8"),
+	Keyboard: &osbuild.KeymapStageOptions{
+		Keymap: "us",
+		X11Keymap: &osbuild.X11KeymapOptions{
+			Layouts: []string{"us"},
+		},
+	},
+	Sysconfig: []*osbuild.SysconfigStageOptions{
+		{
+			Kernel: &osbuild.SysconfigKernelOptions{
+				UpdateDefault: true,
+				DefaultKernel: "kernel-core",
+			},
+			Network: &osbuild.SysconfigNetworkOptions{
+				Networking: true,
+				NoZeroConf: true,
+			},
+		},
+	},
+	EnabledServices: []string{
+		"firewalld",
+		"nm-cloud-setup.service",
+		"nm-cloud-setup.timer",
+		"sshd",
+		"waagent",
+	},
+	SshdConfig: &osbuild.SshdConfigStageOptions{
+		Config: osbuild.SshdConfigConfig{
+			ClientAliveInterval: common.ToPtr(180),
+		},
+	},
+	Modprobe: []*osbuild.ModprobeStageOptions{
+		{
+			Filename: "blacklist-amdgpu.conf",
+			Commands: osbuild.ModprobeConfigCmdList{
+				osbuild.NewModprobeConfigCmdBlacklist("amdgpu"),
+			},
+		},
+		{
+			Filename: "blacklist-floppy.conf",
+			Commands: osbuild.ModprobeConfigCmdList{
+				osbuild.NewModprobeConfigCmdBlacklist("floppy"),
+			},
+		},
+		{
+			Filename: "blacklist-nouveau.conf",
+			Commands: osbuild.ModprobeConfigCmdList{
+				osbuild.NewModprobeConfigCmdBlacklist("nouveau"),
+				osbuild.NewModprobeConfigCmdBlacklist("lbm-nouveau"),
+			},
+		},
+	},
+	CloudInit: []*osbuild.CloudInitStageOptions{
+		{
+			Filename: "10-azure-kvp.cfg",
+			Config: osbuild.CloudInitConfigFile{
+				Reporting: &osbuild.CloudInitConfigReporting{
+					Logging: &osbuild.CloudInitConfigReportingHandlers{
+						Type: "log",
+					},
+					Telemetry: &osbuild.CloudInitConfigReportingHandlers{
+						Type: "hyperv",
+					},
+				},
+			},
+		},
+		{
+			Filename: "91-azure_datasource.cfg",
+			Config: osbuild.CloudInitConfigFile{
+				Datasource: &osbuild.CloudInitConfigDatasource{
+					Azure: &osbuild.CloudInitConfigDatasourceAzure{
+						ApplyNetworkConfig: false,
+					},
+				},
+				DatasourceList: []string{
+					"Azure",
+				},
+			},
+		},
+	},
+	PwQuality: &osbuild.PwqualityConfStageOptions{
+		Config: osbuild.PwqualityConfConfig{
+			Minlen:   common.ToPtr(6),
+			Minclass: common.ToPtr(3),
+			Dcredit:  common.ToPtr(0),
+			Ucredit:  common.ToPtr(0),
+			Lcredit:  common.ToPtr(0),
+			Ocredit:  common.ToPtr(0),
+		},
+	},
+	WAAgentConfig: &osbuild.WAAgentConfStageOptions{
+		Config: osbuild.WAAgentConfig{
+			RDFormat:     common.ToPtr(false),
+			RDEnableSwap: common.ToPtr(false),
+		},
+	},
+	Grub2Config: &osbuild.GRUB2Config{
+		TerminalInput:  []string{"serial", "console"},
+		TerminalOutput: []string{"serial", "console"},
+		Serial:         "serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1",
+		Timeout:        10,
+	},
+	UdevRules: &osbuild.UdevRulesStageOptions{
+		Filename: "/etc/udev/rules.d/68-azure-sriov-nm-unmanaged.rules",
+		Rules: osbuild.UdevRules{
+			osbuild.UdevRuleComment{
+				Comment: []string{
+					"Accelerated Networking on Azure exposes a new SRIOV interface to the VM.",
+					"This interface is transparently bonded to the synthetic interface,",
+					"so NetworkManager should just ignore any SRIOV interfaces.",
+				},
+			},
+			osbuild.NewUdevRule(
+				[]osbuild.UdevKV{
+					{K: "SUBSYSTEM", O: "==", V: "net"},
+					{K: "DRIVERS", O: "==", V: "hv_pci"},
+					{K: "ACTION", O: "==", V: "add"},
+					{K: "ENV", A: "NM_UNMANAGED", O: "=", V: "1"},
+				},
+			),
+		},
+	},
+	SystemdUnit: []*osbuild.SystemdUnitStageOptions{
+		{
+			Unit:   "nm-cloud-setup.service",
+			Dropin: "10-rh-enable-for-azure.conf",
+			Config: osbuild.SystemdServiceUnitDropin{
+				Service: &osbuild.SystemdUnitServiceSection{
+					Environment: "NM_CLOUD_SETUP_AZURE=yes",
+				},
+			},
+		},
+	},
+	DefaultTarget: common.ToPtr("multi-user.target"),
+}
+
+// Diff of the default Image Config compare to the `defaultAzureImageConfig`
+var defaultAzureByosImageConfig = &distro.ImageConfig{
+	GPGKeyFiles: []string{
+		"/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release",
+	},
+	RHSMConfig: map[subscription.RHSMStatus]*osbuild.RHSMStageOptions{
+		subscription.RHSMConfigNoSubscription: {
+			SubMan: &osbuild.RHSMStageOptionsSubMan{
+				Rhsmcertd: &osbuild.SubManConfigRHSMCERTDSection{
+					AutoRegistration: common.ToPtr(true),
+				},
+				// Don't disable RHSM redhat.repo management on the GCE
+				// image, which is BYOS and does not use RHUI for content.
+				// Otherwise subscribing the system manually after booting
+				// it would result in empty redhat.repo. Without RHUI, such
+				// system would have no way to get Red Hat content, but
+				// enable the repo management manually, which would be very
+				// confusing.
+			},
+		},
+		subscription.RHSMConfigWithSubscription: {
+			SubMan: &osbuild.RHSMStageOptionsSubMan{
+				Rhsmcertd: &osbuild.SubManConfigRHSMCERTDSection{
+					AutoRegistration: common.ToPtr(true),
+				},
+				// do not disable the redhat.repo management if the user
+				// explicitly request the system to be subscribed
+			},
+		},
+	},
+}
+
+// Diff of the default Image Config compare to the `defaultAzureImageConfig`
+var defaultAzureRhuiImageConfig = &distro.ImageConfig{
+	GPGKeyFiles: []string{
+		"/etc/pki/rpm-gpg/RPM-GPG-KEY-microsoft-azure-release",
+		"/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release",
+	},
+	RHSMConfig: map[subscription.RHSMStatus]*osbuild.RHSMStageOptions{
+		subscription.RHSMConfigNoSubscription: {
+			DnfPlugins: &osbuild.RHSMStageOptionsDnfPlugins{
+				SubscriptionManager: &osbuild.RHSMStageOptionsDnfPlugin{
+					Enabled: false,
+				},
+			},
+			SubMan: &osbuild.RHSMStageOptionsSubMan{
+				Rhsmcertd: &osbuild.SubManConfigRHSMCERTDSection{
+					AutoRegistration: common.ToPtr(true),
+				},
+				Rhsm: &osbuild.SubManConfigRHSMSection{
+					ManageRepos: common.ToPtr(false),
+				},
+			},
+		},
+		subscription.RHSMConfigWithSubscription: {
+			SubMan: &osbuild.RHSMStageOptionsSubMan{
+				Rhsmcertd: &osbuild.SubManConfigRHSMCERTDSection{
+					AutoRegistration: common.ToPtr(true),
+				},
+				// do not disable the redhat.repo management if the user
+				// explicitly request the system to be subscribed
+			},
+		},
+	},
+}

vendor/github.com/osbuild/images/pkg/distro/rhel9/bare_metal.go

@@ -0,0 +1,317 @@
+package rhel9
+
+import (
+	"fmt"
+
+	"github.com/osbuild/images/pkg/platform"
+	"github.com/osbuild/images/pkg/rpmmd"
+)
+
+var (
+	tarImgType = imageType{
+		name:     "tar",
+		filename: "root.tar.xz",
+		mimeType: "application/x-tar",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey: func(t *imageType) rpmmd.PackageSet {
+				return rpmmd.PackageSet{
+					Include: []string{"policycoreutils", "selinux-policy-targeted"},
+					Exclude: []string{"rng-tools"},
+				}
+			},
+		},
+		image:            tarImage,
+		buildPipelines:   []string{"build"},
+		payloadPipelines: []string{"os", "archive"},
+		exports:          []string{"archive"},
+	}
+
+	imageInstaller = imageType{
+		name:     "image-installer",
+		filename: "installer.iso",
+		mimeType: "application/x-iso9660-image",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey:        bareMetalPackageSet,
+			installerPkgsKey: anacondaPackageSet,
+		},
+		rpmOstree:        false,
+		bootISO:          true,
+		bootable:         true,
+		image:            imageInstallerImage,
+		buildPipelines:   []string{"build"},
+		payloadPipelines: []string{"anaconda-tree", "rootfs-image", "efiboot-tree", "os", "bootiso-tree", "bootiso"},
+		exports:          []string{"bootiso"},
+	}
+)
+
+func bareMetalPackageSet(t *imageType) rpmmd.PackageSet {
+	ps := rpmmd.PackageSet{
+		Include: []string{
+			"authselect-compat",
+			"chrony",
+			"cockpit-system",
+			"cockpit-ws",
+			"dhcp-client",
+			"dnf-utils",
+			"dosfstools",
+			"firewalld",
+			"iwl1000-firmware",
+			"iwl100-firmware",
+			"iwl105-firmware",
+			"iwl135-firmware",
+			"iwl2000-firmware",
+			"iwl2030-firmware",
+			"iwl3160-firmware",
+			"iwl5000-firmware",
+			"iwl5150-firmware",
+			"iwl6000g2a-firmware",
+			"iwl6000g2b-firmware",
+			"iwl6050-firmware",
+			"iwl7260-firmware",
+			"lvm2",
+			"net-tools",
+			"nfs-utils",
+			"oddjob",
+			"oddjob-mkhomedir",
+			"policycoreutils",
+			"psmisc",
+			"python3-jsonschema",
+			"qemu-guest-agent",
+			"redhat-release",
+			"redhat-release-eula",
+			"rsync",
+			"tar",
+			"tcpdump",
+		},
+	}.Append(coreOsCommonPackageSet(t)).Append(distroBuildPackageSet(t))
+
+	// Ensure to not pull in subscription-manager on non-RHEL distro
+	if t.arch.distro.isRHEL() {
+		ps = ps.Append(rpmmd.PackageSet{
+			Include: []string{
+				"subscription-manager-cockpit",
+			},
+		})
+	}
+
+	return ps
+}
+
+func installerPackageSet(t *imageType) rpmmd.PackageSet {
+	ps := rpmmd.PackageSet{
+		Include: []string{
+			"anaconda-dracut",
+			"curl",
+			"dracut-config-generic",
+			"dracut-network",
+			"hostname",
+			"iwl100-firmware",
+			"iwl1000-firmware",
+			"iwl105-firmware",
+			"iwl135-firmware",
+			"iwl2000-firmware",
+			"iwl2030-firmware",
+			"iwl3160-firmware",
+			"iwl5000-firmware",
+			"iwl5150-firmware",
+			"iwl6050-firmware",
+			"iwl7260-firmware",
+			"kernel",
+			"less",
+			"nfs-utils",
+			"openssh-clients",
+			"ostree",
+			"plymouth",
+			"prefixdevname",
+			"rng-tools",
+			"rpcbind",
+			"selinux-policy-targeted",
+			"systemd",
+			"tar",
+			"xfsprogs",
+			"xz",
+		},
+	}
+
+	switch t.arch.Name() {
+	case platform.ARCH_X86_64.String():
+		ps = ps.Append(rpmmd.PackageSet{
+			Include: []string{
+				"biosdevname",
+			},
+		})
+	}
+
+	return ps
+}
+
+func anacondaPackageSet(t *imageType) rpmmd.PackageSet {
+
+	// common installer packages
+	ps := installerPackageSet(t)
+
+	ps = ps.Append(rpmmd.PackageSet{
+		Include: []string{
+			"aajohan-comfortaa-fonts",
+			"abattis-cantarell-fonts",
+			"alsa-firmware",
+			"alsa-tools-firmware",
+			"anaconda",
+			"anaconda-dracut",
+			"anaconda-install-env-deps",
+			"anaconda-widgets",
+			"audit",
+			"bind-utils",
+			"bitmap-fangsongti-fonts",
+			"bzip2",
+			"cryptsetup",
+			"curl",
+			"dbus-x11",
+			"dejavu-sans-fonts",
+			"dejavu-sans-mono-fonts",
+			"device-mapper-persistent-data",
+			"dmidecode",
+			"dnf",
+			"dracut-config-generic",
+			"dracut-network",
+			"efibootmgr",
+			"ethtool",
+			"fcoe-utils",
+			"ftp",
+			"gdb-gdbserver",
+			"gdisk",
+			"glibc-all-langpacks",
+			"gnome-kiosk",
+			"google-noto-sans-cjk-ttc-fonts",
+			"grub2-tools",
+			"grub2-tools-extra",
+			"grub2-tools-minimal",
+			"grubby",
+			"gsettings-desktop-schemas",
+			"hdparm",
+			"hexedit",
+			"hostname",
+			"initscripts",
+			"ipmitool",
+			"iwl1000-firmware",
+			"iwl100-firmware",
+			"iwl105-firmware",
+			"iwl135-firmware",
+			"iwl2000-firmware",
+			"iwl2030-firmware",
+			"iwl3160-firmware",
+			"iwl5000-firmware",
+			"iwl5150-firmware",
+			"iwl6000g2a-firmware",
+			"iwl6000g2b-firmware",
+			"iwl6050-firmware",
+			"iwl7260-firmware",
+			"jomolhari-fonts",
+			"kacst-farsi-fonts",
+			"kacst-qurn-fonts",
+			"kbd",
+			"kbd-misc",
+			"kdump-anaconda-addon",
+			"kernel",
+			"khmeros-base-fonts",
+			"less",
+			"libblockdev-lvm-dbus",
+			"libibverbs",
+			"libreport-plugin-bugzilla",
+			"libreport-plugin-reportuploader",
+			"librsvg2",
+			"linux-firmware",
+			"lklug-fonts",
+			"lldpad",
+			"lohit-assamese-fonts",
+			"lohit-bengali-fonts",
+			"lohit-devanagari-fonts",
+			"lohit-gujarati-fonts",
+			"lohit-gurmukhi-fonts",
+			"lohit-kannada-fonts",
+			"lohit-odia-fonts",
+			"lohit-tamil-fonts",
+			"lohit-telugu-fonts",
+			"lsof",
+			"madan-fonts",
+			"mtr",
+			"mt-st",
+			"net-tools",
+			"nfs-utils",
+			"nmap-ncat",
+			"nm-connection-editor",
+			"nss-tools",
+			"openssh-clients",
+			"openssh-server",
+			"oscap-anaconda-addon",
+			"ostree",
+			"pciutils",
+			"perl-interpreter",
+			"pigz",
+			"plymouth",
+			"prefixdevname",
+			"python3-pyatspi",
+			"rdma-core",
+			"redhat-release-eula",
+			"rng-tools",
+			"rpcbind",
+			"rpm-ostree",
+			"rsync",
+			"rsyslog",
+			"selinux-policy-targeted",
+			"sg3_utils",
+			"sil-abyssinica-fonts",
+			"sil-padauk-fonts",
+			"sil-scheherazade-fonts",
+			"smartmontools",
+			"smc-meera-fonts",
+			"spice-vdagent",
+			"strace",
+			"systemd",
+			"tar",
+			"thai-scalable-waree-fonts",
+			"tigervnc-server-minimal",
+			"tigervnc-server-module",
+			"udisks2",
+			"udisks2-iscsi",
+			"usbutils",
+			"vim-minimal",
+			"volume_key",
+			"wget",
+			"xfsdump",
+			"xfsprogs",
+			"xorg-x11-drivers",
+			"xorg-x11-fonts-misc",
+			"xorg-x11-server-utils",
+			"xorg-x11-server-Xorg",
+			"xorg-x11-xauth",
+			"xz",
+		},
+	})
+
+	ps = ps.Append(anacondaBootPackageSet(t))
+
+	switch t.arch.Name() {
+	case platform.ARCH_X86_64.String():
+		ps = ps.Append(rpmmd.PackageSet{
+			Include: []string{
+				"biosdevname",
+				"dmidecode",
+				"grub2-tools-efi",
+				"memtest86+",
+			},
+		})
+
+	case platform.ARCH_AARCH64.String():
+		ps = ps.Append(rpmmd.PackageSet{
+			Include: []string{
+				"dmidecode",
+			},
+		})
+
+	default:
+		panic(fmt.Sprintf("unsupported arch: %s", t.arch.Name()))
+	}
+
+	return ps
+}

vendor/github.com/osbuild/images/pkg/distro/rhel9/distro.go

@@ -0,0 +1,463 @@
+package rhel9
+
+import (
+	"errors"
+	"fmt"
+	"sort"
+	"strings"
+
+	"github.com/osbuild/images/internal/common"
+	"github.com/osbuild/images/internal/oscap"
+	"github.com/osbuild/images/pkg/distro"
+	"github.com/osbuild/images/pkg/osbuild"
+	"github.com/osbuild/images/pkg/platform"
+	"github.com/osbuild/images/pkg/runner"
+)
+
+var (
+	// rhel9 & cs9 share the same list
+	// of allowed profiles so a single
+	// allow list can be used
+	oscapProfileAllowList = []oscap.Profile{
+		oscap.AnssiBp28Enhanced,
+		oscap.AnssiBp28High,
+		oscap.AnssiBp28Intermediary,
+		oscap.AnssiBp28Minimal,
+		oscap.Cis,
+		oscap.CisServerL1,
+		oscap.CisWorkstationL1,
+		oscap.CisWorkstationL2,
+		oscap.Cui,
+		oscap.E8,
+		oscap.Hippa,
+		oscap.IsmO,
+		oscap.Ospp,
+		oscap.PciDss,
+		oscap.Stig,
+		oscap.StigGui,
+	}
+)
+
+type distribution struct {
+	name               string
+	product            string
+	osVersion          string
+	releaseVersion     string
+	modulePlatformID   string
+	vendor             string
+	ostreeRefTmpl      string
+	isolabelTmpl       string
+	runner             runner.Runner
+	arches             map[string]distro.Arch
+	defaultImageConfig *distro.ImageConfig
+}
+
+// CentOS- and RHEL-based OS image configuration defaults
+var defaultDistroImageConfig = &distro.ImageConfig{
+	Timezone: common.ToPtr("America/New_York"),
+	Locale:   common.ToPtr("C.UTF-8"),
+	Sysconfig: []*osbuild.SysconfigStageOptions{
+		{
+			Kernel: &osbuild.SysconfigKernelOptions{
+				UpdateDefault: true,
+				DefaultKernel: "kernel",
+			},
+			Network: &osbuild.SysconfigNetworkOptions{
+				Networking: true,
+				NoZeroConf: true,
+			},
+		},
+	},
+}
+
+func (d *distribution) Name() string {
+	return d.name
+}
+
+func (d *distribution) Releasever() string {
+	return d.releaseVersion
+}
+
+func (d *distribution) ModulePlatformID() string {
+	return d.modulePlatformID
+}
+
+func (d *distribution) OSTreeRef() string {
+	return d.ostreeRefTmpl
+}
+
+func (d *distribution) ListArches() []string {
+	archNames := make([]string, 0, len(d.arches))
+	for name := range d.arches {
+		archNames = append(archNames, name)
+	}
+	sort.Strings(archNames)
+	return archNames
+}
+
+func (d *distribution) GetArch(name string) (distro.Arch, error) {
+	arch, exists := d.arches[name]
+	if !exists {
+		return nil, errors.New("invalid architecture: " + name)
+	}
+	return arch, nil
+}
+
+func (d *distribution) addArches(arches ...architecture) {
+	if d.arches == nil {
+		d.arches = map[string]distro.Arch{}
+	}
+
+	// Do not make copies of architectures, as opposed to image types,
+	// because architecture definitions are not used by more than a single
+	// distro definition.
+	for idx := range arches {
+		d.arches[arches[idx].name] = &arches[idx]
+	}
+}
+
+func (d *distribution) isRHEL() bool {
+	return strings.HasPrefix(d.name, "rhel")
+}
+
+func (d *distribution) getDefaultImageConfig() *distro.ImageConfig {
+	return d.defaultImageConfig
+}
+
+func New() distro.Distro {
+	// default minor: create default minor version (current GA) and rename it
+	d := newDistro("rhel", 1)
+	d.name = "rhel-9"
+	return d
+}
+
+func NewCentOS9() distro.Distro {
+	return newDistro("centos", 0)
+}
+
+func NewRHEL90() distro.Distro {
+	return newDistro("rhel", 0)
+}
+
+func NewRHEL91() distro.Distro {
+	return newDistro("rhel", 1)
+}
+
+func NewRHEL92() distro.Distro {
+	return newDistro("rhel", 2)
+}
+
+func NewRHEL93() distro.Distro {
+	return newDistro("rhel", 3)
+}
+
+func newDistro(name string, minor int) *distribution {
+	var rd distribution
+	switch name {
+	case "rhel":
+		rd = distribution{
+			name:               fmt.Sprintf("rhel-9%d", minor),
+			product:            "Red Hat Enterprise Linux",
+			osVersion:          fmt.Sprintf("9.%d", minor),
+			releaseVersion:     "9",
+			modulePlatformID:   "platform:el9",
+			vendor:             "redhat",
+			ostreeRefTmpl:      "rhel/9/%s/edge",
+			isolabelTmpl:       fmt.Sprintf("RHEL-9-%d-0-BaseOS-%%s", minor),
+			runner:             &runner.RHEL{Major: uint64(9), Minor: uint64(minor)},
+			defaultImageConfig: defaultDistroImageConfig,
+		}
+	case "centos":
+		rd = distribution{
+			name:               "centos-9",
+			product:            "CentOS Stream",
+			osVersion:          "9-stream",
+			releaseVersion:     "9",
+			modulePlatformID:   "platform:el9",
+			vendor:             "centos",
+			ostreeRefTmpl:      "centos/9/%s/edge",
+			isolabelTmpl:       "CentOS-Stream-9-BaseOS-%s",
+			runner:             &runner.CentOS{Version: uint64(9)},
+			defaultImageConfig: defaultDistroImageConfig,
+		}
+	default:
+		panic(fmt.Sprintf("unknown distro name: %s", name))
+	}
+
+	// Architecture definitions
+	x86_64 := architecture{
+		name:   platform.ARCH_X86_64.String(),
+		distro: &rd,
+	}
+
+	aarch64 := architecture{
+		name:   platform.ARCH_AARCH64.String(),
+		distro: &rd,
+	}
+
+	ppc64le := architecture{
+		distro: &rd,
+		name:   platform.ARCH_PPC64LE.String(),
+	}
+
+	s390x := architecture{
+		distro: &rd,
+		name:   platform.ARCH_S390X.String(),
+	}
+
+	qcow2ImgType := mkQcow2ImgType(rd)
+	ociImgType := qcow2ImgType
+	ociImgType.name = "oci"
+
+	x86_64.addImageTypes(
+		&platform.X86{
+			BIOS:       true,
+			UEFIVendor: rd.vendor,
+			BasePlatform: platform.BasePlatform{
+				ImageFormat: platform.FORMAT_QCOW2,
+				QCOW2Compat: "1.1",
+			},
+		},
+		qcow2ImgType,
+		ociImgType,
+	)
+
+	x86_64.addImageTypes(
+		&platform.X86{
+			BIOS:       true,
+			UEFIVendor: rd.vendor,
+			BasePlatform: platform.BasePlatform{
+				ImageFormat: platform.FORMAT_QCOW2,
+			},
+		},
+		openstackImgType,
+	)
+
+	azureX64Platform := &platform.X86{
+		BIOS:       true,
+		UEFIVendor: rd.vendor,
+		BasePlatform: platform.BasePlatform{
+			ImageFormat: platform.FORMAT_VHD,
+		},
+	}
+
+	azureAarch64Platform := &platform.Aarch64{
+		UEFIVendor: rd.vendor,
+		BasePlatform: platform.BasePlatform{
+			ImageFormat: platform.FORMAT_VHD,
+		},
+	}
+
+	x86_64.addImageTypes(
+		&platform.X86{
+			BIOS:       true,
+			UEFIVendor: rd.vendor,
+			BasePlatform: platform.BasePlatform{
+				ImageFormat: platform.FORMAT_VMDK,
+			},
+		},
+		vmdkImgType,
+	)
+
+	x86_64.addImageTypes(
+		&platform.X86{
+			BIOS:       true,
+			UEFIVendor: rd.vendor,
+			BasePlatform: platform.BasePlatform{
+				ImageFormat: platform.FORMAT_OVA,
+			},
+		},
+		ovaImgType,
+	)
+
+	ec2X86Platform := &platform.X86{
+		BIOS:       true,
+		UEFIVendor: rd.vendor,
+		BasePlatform: platform.BasePlatform{
+			ImageFormat: platform.FORMAT_RAW,
+		},
+	}
+	x86_64.addImageTypes(
+		ec2X86Platform,
+		mkAMIImgTypeX86_64(rd.osVersion, rd.isRHEL()),
+	)
+
+	gceX86Platform := &platform.X86{
+		UEFIVendor: rd.vendor,
+		BasePlatform: platform.BasePlatform{
+			ImageFormat: platform.FORMAT_GCE,
+		},
+	}
+	x86_64.addImageTypes(
+		gceX86Platform,
+		mkGCEImageType(rd.isRHEL()),
+	)
+
+	x86_64.addImageTypes(
+		&platform.X86{
+			BasePlatform: platform.BasePlatform{
+				FirmwarePackages: []string{
+					"microcode_ctl", // ??
+					"iwl1000-firmware",
+					"iwl100-firmware",
+					"iwl105-firmware",
+					"iwl135-firmware",
+					"iwl2000-firmware",
+					"iwl2030-firmware",
+					"iwl3160-firmware",
+					"iwl5000-firmware",
+					"iwl5150-firmware",
+					"iwl6050-firmware",
+				},
+			},
+			BIOS:       true,
+			UEFIVendor: rd.vendor,
+		},
+		edgeOCIImgType,
+		edgeCommitImgType,
+		edgeInstallerImgType,
+		edgeRawImgType,
+		imageInstaller,
+		edgeAMIImgType,
+	)
+
+	x86_64.addImageTypes(
+		&platform.X86{
+			BasePlatform: platform.BasePlatform{
+				ImageFormat: platform.FORMAT_RAW,
+			},
+			BIOS:       false,
+			UEFIVendor: rd.vendor,
+		},
+		edgeSimplifiedInstallerImgType,
+	)
+
+	x86_64.addImageTypes(
+		&platform.X86{},
+		tarImgType,
+	)
+
+	aarch64.addImageTypes(
+		&platform.Aarch64{
+			UEFIVendor: rd.vendor,
+			BasePlatform: platform.BasePlatform{
+				ImageFormat: platform.FORMAT_QCOW2,
+			},
+		},
+		openstackImgType,
+	)
+
+	aarch64.addImageTypes(
+		&platform.Aarch64{},
+		tarImgType,
+	)
+
+	aarch64.addImageTypes(
+		&platform.Aarch64{
+			BasePlatform: platform.BasePlatform{},
+			UEFIVendor:   rd.vendor,
+		},
+		edgeCommitImgType,
+		edgeOCIImgType,
+		edgeInstallerImgType,
+		edgeSimplifiedInstallerImgType,
+		imageInstaller,
+		edgeAMIImgType,
+	)
+	aarch64.addImageTypes(
+		&platform.Aarch64{
+			BasePlatform: platform.BasePlatform{
+				ImageFormat: platform.FORMAT_RAW,
+			},
+			UEFIVendor: rd.vendor,
+		},
+		edgeRawImgType,
+	)
+
+	aarch64.addImageTypes(
+		&platform.Aarch64{
+			UEFIVendor: rd.vendor,
+			BasePlatform: platform.BasePlatform{
+				ImageFormat: platform.FORMAT_QCOW2,
+				QCOW2Compat: "1.1",
+			},
+		},
+		qcow2ImgType,
+	)
+	aarch64.addImageTypes(
+		&platform.Aarch64{
+			UEFIVendor: rd.vendor,
+			BasePlatform: platform.BasePlatform{
+				ImageFormat: platform.FORMAT_RAW,
+			},
+		},
+		mkAMIImgTypeAarch64(rd.osVersion, rd.isRHEL()),
+	)
+
+	ppc64le.addImageTypes(
+		&platform.PPC64LE{
+			BIOS: true,
+			BasePlatform: platform.BasePlatform{
+				ImageFormat: platform.FORMAT_QCOW2,
+				QCOW2Compat: "1.1",
+			},
+		},
+		qcow2ImgType,
+	)
+	ppc64le.addImageTypes(
+		&platform.PPC64LE{},
+		tarImgType,
+	)
+
+	s390x.addImageTypes(
+		&platform.S390X{
+			Zipl: true,
+			BasePlatform: platform.BasePlatform{
+				ImageFormat: platform.FORMAT_QCOW2,
+				QCOW2Compat: "1.1",
+			},
+		},
+		qcow2ImgType,
+	)
+	s390x.addImageTypes(
+		&platform.S390X{},
+		tarImgType,
+	)
+
+	if rd.isRHEL() {
+		// add azure to RHEL distro only
+		x86_64.addImageTypes(azureX64Platform, azureRhuiImgType, azureByosImgType)
+		aarch64.addImageTypes(azureAarch64Platform, azureRhuiImgType, azureByosImgType)
+
+		// keep the RHEL EC2 x86_64 images before 9.3 BIOS-only for backward compatibility
+		if common.VersionLessThan(rd.osVersion, "9.3") {
+			ec2X86Platform = &platform.X86{
+				BIOS: true,
+				BasePlatform: platform.BasePlatform{
+					ImageFormat: platform.FORMAT_RAW,
+				},
+			}
+		}
+
+		// add ec2 image types to RHEL distro only
+		x86_64.addImageTypes(ec2X86Platform, mkEc2ImgTypeX86_64(rd.osVersion, rd.isRHEL()), mkEc2HaImgTypeX86_64(rd.osVersion, rd.isRHEL()), mkEC2SapImgTypeX86_64(rd.osVersion, rd.isRHEL()))
+
+		aarch64.addImageTypes(
+			&platform.Aarch64{
+				UEFIVendor: rd.vendor,
+				BasePlatform: platform.BasePlatform{
+					ImageFormat: platform.FORMAT_RAW,
+				},
+			},
+			mkEC2ImgTypeAarch64(rd.osVersion, rd.isRHEL()),
+		)
+
+		// add GCE RHUI image to RHEL only
+		x86_64.addImageTypes(gceX86Platform, mkGCERHUIImageType(rd.isRHEL()))
+	} else {
+		x86_64.addImageTypes(azureX64Platform, azureImgType)
+		aarch64.addImageTypes(azureAarch64Platform, azureImgType)
+	}
+	rd.addArches(x86_64, aarch64, ppc64le, s390x)
+	return &rd
+}

vendor/github.com/osbuild/images/pkg/distro/rhel9/edge.go

@@ -0,0 +1,511 @@
+package rhel9
+
+import (
+	"fmt"
+
+	"github.com/osbuild/images/internal/common"
+	"github.com/osbuild/images/internal/environment"
+	"github.com/osbuild/images/pkg/disk"
+	"github.com/osbuild/images/pkg/distro"
+	"github.com/osbuild/images/pkg/platform"
+	"github.com/osbuild/images/pkg/rpmmd"
+)
+
+var (
+	// Image Definitions
+	edgeCommitImgType = imageType{
+		name:        "edge-commit",
+		nameAliases: []string{"rhel-edge-commit"},
+		filename:    "commit.tar",
+		mimeType:    "application/x-tar",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey: edgeCommitPackageSet,
+		},
+		defaultImageConfig: &distro.ImageConfig{
+			EnabledServices: edgeServices,
+		},
+		rpmOstree:        true,
+		image:            edgeCommitImage,
+		buildPipelines:   []string{"build"},
+		payloadPipelines: []string{"os", "ostree-commit", "commit-archive"},
+		exports:          []string{"commit-archive"},
+	}
+
+	edgeOCIImgType = imageType{
+		name:        "edge-container",
+		nameAliases: []string{"rhel-edge-container"},
+		filename:    "container.tar",
+		mimeType:    "application/x-tar",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey: edgeCommitPackageSet,
+			containerPkgsKey: func(t *imageType) rpmmd.PackageSet {
+				return rpmmd.PackageSet{
+					Include: []string{"nginx"}, // FIXME: this has no effect
+				}
+			},
+		},
+		defaultImageConfig: &distro.ImageConfig{
+			EnabledServices: edgeServices,
+		},
+		rpmOstree:        true,
+		bootISO:          false,
+		image:            edgeContainerImage,
+		buildPipelines:   []string{"build"},
+		payloadPipelines: []string{"os", "ostree-commit", "container-tree", "container"},
+		exports:          []string{"container"},
+	}
+
+	edgeRawImgType = imageType{
+		name:        "edge-raw-image",
+		nameAliases: []string{"rhel-edge-raw-image"},
+		filename:    "image.raw.xz",
+		compression: "xz",
+		mimeType:    "application/xz",
+		packageSets: nil,
+		defaultImageConfig: &distro.ImageConfig{
+			Locale: common.ToPtr("en_US.UTF-8"),
+		},
+		defaultSize:         10 * common.GibiByte,
+		rpmOstree:           true,
+		bootable:            true,
+		bootISO:             false,
+		image:               edgeRawImage,
+		buildPipelines:      []string{"build"},
+		payloadPipelines:    []string{"ostree-deployment", "image", "xz"},
+		exports:             []string{"xz"},
+		basePartitionTables: edgeBasePartitionTables,
+	}
+
+	edgeInstallerImgType = imageType{
+		name:        "edge-installer",
+		nameAliases: []string{"rhel-edge-installer"},
+		filename:    "installer.iso",
+		mimeType:    "application/x-iso9660-image",
+		packageSets: map[string]packageSetFunc{
+			// TODO: non-arch-specific package set handling for installers
+			// This image type requires build packages for installers and
+			// ostree/edge.  For now we only have x86-64 installer build
+			// package sets defined.  When we add installer build package sets
+			// for other architectures, this will need to be moved to the
+			// architecture and the merging will happen in the PackageSets()
+			// method like the other sets.
+			installerPkgsKey: edgeInstallerPackageSet,
+		},
+		defaultImageConfig: &distro.ImageConfig{
+			Locale:          common.ToPtr("en_US.UTF-8"),
+			EnabledServices: edgeServices,
+		},
+		rpmOstree:        true,
+		bootISO:          true,
+		image:            edgeInstallerImage,
+		buildPipelines:   []string{"build"},
+		payloadPipelines: []string{"anaconda-tree", "rootfs-image", "efiboot-tree", "bootiso-tree", "bootiso"},
+		exports:          []string{"bootiso"},
+	}
+
+	edgeSimplifiedInstallerImgType = imageType{
+		name:        "edge-simplified-installer",
+		nameAliases: []string{"rhel-edge-simplified-installer"},
+		filename:    "simplified-installer.iso",
+		mimeType:    "application/x-iso9660-image",
+		packageSets: map[string]packageSetFunc{
+			// TODO: non-arch-specific package set handling for installers
+			// This image type requires build packages for installers and
+			// ostree/edge.  For now we only have x86-64 installer build
+			// package sets defined.  When we add installer build package sets
+			// for other architectures, this will need to be moved to the
+			// architecture and the merging will happen in the PackageSets()
+			// method like the other sets.
+			installerPkgsKey: edgeSimplifiedInstallerPackageSet,
+		},
+		defaultImageConfig: &distro.ImageConfig{
+			EnabledServices: edgeServices,
+		},
+		defaultSize:         10 * common.GibiByte,
+		rpmOstree:           true,
+		bootable:            true,
+		bootISO:             true,
+		image:               edgeSimplifiedInstallerImage,
+		buildPipelines:      []string{"build"},
+		payloadPipelines:    []string{"ostree-deployment", "image", "xz", "coi-tree", "efiboot-tree", "bootiso-tree", "bootiso"},
+		exports:             []string{"bootiso"},
+		basePartitionTables: edgeBasePartitionTables,
+	}
+
+	edgeAMIImgType = imageType{
+		name:        "edge-ami",
+		filename:    "image.raw",
+		mimeType:    "application/octet-stream",
+		packageSets: nil,
+
+		defaultImageConfig: &distro.ImageConfig{
+			Locale: common.ToPtr("en_US.UTF-8"),
+		},
+		defaultSize:         10 * common.GibiByte,
+		rpmOstree:           true,
+		bootable:            true,
+		bootISO:             false,
+		image:               edgeRawImage,
+		buildPipelines:      []string{"build"},
+		payloadPipelines:    []string{"ostree-deployment", "image"},
+		exports:             []string{"image"},
+		basePartitionTables: edgeBasePartitionTables,
+		environment:         &environment.EC2{},
+	}
+
+	// Shared Services
+	edgeServices = []string{
+		// TODO(runcom): move fdo-client-linuxapp.service to presets?
+		"NetworkManager.service", "firewalld.service", "sshd.service", "fdo-client-linuxapp.service",
+	}
+
+	// Partition tables
+	edgeBasePartitionTables = distro.BasePartitionTableMap{
+		platform.ARCH_X86_64.String(): disk.PartitionTable{
+			UUID: "D209C89E-EA5E-4FBD-B161-B461CCE297E0",
+			Type: "gpt",
+			Partitions: []disk.Partition{
+				{
+					Size:     1 * common.MebiByte, // 1MB
+					Bootable: true,
+					Type:     disk.BIOSBootPartitionGUID,
+					UUID:     disk.BIOSBootPartitionUUID,
+				},
+				{
+					Size: 127 * common.MebiByte, // 127 MB
+					Type: disk.EFISystemPartitionGUID,
+					UUID: disk.EFISystemPartitionUUID,
+					Payload: &disk.Filesystem{
+						Type:         "vfat",
+						UUID:         disk.EFIFilesystemUUID,
+						Mountpoint:   "/boot/efi",
+						Label:        "EFI-SYSTEM",
+						FSTabOptions: "defaults,uid=0,gid=0,umask=077,shortname=winnt",
+						FSTabFreq:    0,
+						FSTabPassNo:  2,
+					},
+				},
+				{
+					Size: 384 * common.MebiByte, // 384 MB
+					Type: disk.XBootLDRPartitionGUID,
+					UUID: disk.FilesystemDataUUID,
+					Payload: &disk.Filesystem{
+						Type:         "xfs",
+						Mountpoint:   "/boot",
+						Label:        "boot",
+						FSTabOptions: "defaults",
+						FSTabFreq:    1,
+						FSTabPassNo:  1,
+					},
+				},
+				{
+					Type: disk.FilesystemDataGUID,
+					UUID: disk.RootPartitionUUID,
+					Payload: &disk.LUKSContainer{
+						Label:      "crypt_root",
+						Cipher:     "cipher_null",
+						Passphrase: "osbuild",
+						PBKDF: disk.Argon2id{
+							Memory:      32,
+							Iterations:  4,
+							Parallelism: 1,
+						},
+						Clevis: &disk.ClevisBind{
+							Pin:              "null",
+							Policy:           "{}",
+							RemovePassphrase: true,
+						},
+						Payload: &disk.LVMVolumeGroup{
+							Name:        "rootvg",
+							Description: "built with lvm2 and osbuild",
+							LogicalVolumes: []disk.LVMLogicalVolume{
+								{
+									Size: 9 * 1024 * 1024 * 1024, // 9 GB
+									Name: "rootlv",
+									Payload: &disk.Filesystem{
+										Type:         "xfs",
+										Label:        "root",
+										Mountpoint:   "/",
+										FSTabOptions: "defaults",
+										FSTabFreq:    0,
+										FSTabPassNo:  0,
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+		platform.ARCH_AARCH64.String(): disk.PartitionTable{
+			UUID: "D209C89E-EA5E-4FBD-B161-B461CCE297E0",
+			Type: "gpt",
+			Partitions: []disk.Partition{
+				{
+					Size: 127 * common.MebiByte, // 127 MB
+					Type: disk.EFISystemPartitionGUID,
+					UUID: disk.EFISystemPartitionUUID,
+					Payload: &disk.Filesystem{
+						Type:         "vfat",
+						UUID:         disk.EFIFilesystemUUID,
+						Mountpoint:   "/boot/efi",
+						Label:        "EFI-SYSTEM",
+						FSTabOptions: "defaults,uid=0,gid=0,umask=077,shortname=winnt",
+						FSTabFreq:    0,
+						FSTabPassNo:  2,
+					},
+				},
+				{
+					Size: 384 * common.MebiByte, // 384 MB
+					Type: disk.XBootLDRPartitionGUID,
+					UUID: disk.FilesystemDataUUID,
+					Payload: &disk.Filesystem{
+						Type:         "xfs",
+						Mountpoint:   "/boot",
+						Label:        "boot",
+						FSTabOptions: "defaults",
+						FSTabFreq:    1,
+						FSTabPassNo:  1,
+					},
+				},
+				{
+					Type: disk.FilesystemDataGUID,
+					UUID: disk.RootPartitionUUID,
+					Payload: &disk.LUKSContainer{
+						Label:      "crypt_root",
+						Cipher:     "cipher_null",
+						Passphrase: "osbuild",
+						PBKDF: disk.Argon2id{
+							Memory:      32,
+							Iterations:  4,
+							Parallelism: 1,
+						},
+						Clevis: &disk.ClevisBind{
+							Pin:              "null",
+							Policy:           "{}",
+							RemovePassphrase: true,
+						},
+						Payload: &disk.LVMVolumeGroup{
+							Name:        "rootvg",
+							Description: "built with lvm2 and osbuild",
+							LogicalVolumes: []disk.LVMLogicalVolume{
+								{
+									Size: 9 * 1024 * 1024 * 1024, // 9 GB
+									Name: "rootlv",
+									Payload: &disk.Filesystem{
+										Type:         "xfs",
+										Label:        "root",
+										Mountpoint:   "/",
+										FSTabOptions: "defaults",
+										FSTabFreq:    0,
+										FSTabPassNo:  0,
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+)
+
+// Package Sets
+
+// edge commit OS package set
+func edgeCommitPackageSet(t *imageType) rpmmd.PackageSet {
+	ps := rpmmd.PackageSet{
+		Include: []string{
+			"redhat-release",
+			"glibc",
+			"glibc-minimal-langpack",
+			"nss-altfiles",
+			"dracut-config-generic",
+			"dracut-network",
+			"basesystem",
+			"bash",
+			"platform-python",
+			"shadow-utils",
+			"chrony",
+			"setup",
+			"shadow-utils",
+			"sudo",
+			"systemd",
+			"coreutils",
+			"util-linux",
+			"curl",
+			"vim-minimal",
+			"rpm",
+			"rpm-ostree",
+			"polkit",
+			"lvm2",
+			"cryptsetup",
+			"pinentry",
+			"e2fsprogs",
+			"dosfstools",
+			"keyutils",
+			"gnupg2",
+			"attr",
+			"xz",
+			"gzip",
+			"firewalld",
+			"iptables",
+			"NetworkManager",
+			"NetworkManager-wifi",
+			"NetworkManager-wwan",
+			"wpa_supplicant",
+			"dnsmasq",
+			"traceroute",
+			"hostname",
+			"iproute",
+			"iputils",
+			"openssh-clients",
+			"procps-ng",
+			"rootfiles",
+			"openssh-server",
+			"passwd",
+			"policycoreutils",
+			"policycoreutils-python-utils",
+			"selinux-policy-targeted",
+			"setools-console",
+			"less",
+			"tar",
+			"rsync",
+			"usbguard",
+			"bash-completion",
+			"tmux",
+			"ima-evm-utils",
+			"audit",
+			"podman",
+			"containernetworking-plugins", // required for cni networks but not a hard dependency of podman >= 4.2.0 (rhbz#2123210)
+			"container-selinux",
+			"skopeo",
+			"criu",
+			"slirp4netns",
+			"fuse-overlayfs",
+			"clevis",
+			"clevis-dracut",
+			"clevis-luks",
+			"greenboot",
+			"greenboot-default-health-checks",
+			"fdo-client",
+			"fdo-owner-cli",
+			"sos",
+		},
+		Exclude: []string{
+			"rng-tools",
+		},
+	}
+
+	switch t.arch.Name() {
+	case platform.ARCH_X86_64.String():
+		ps = ps.Append(x8664EdgeCommitPackageSet(t))
+
+	case platform.ARCH_AARCH64.String():
+		ps = ps.Append(aarch64EdgeCommitPackageSet(t))
+	}
+
+	if !common.VersionLessThan(t.arch.distro.osVersion, "9.2") || !common.VersionLessThan(t.arch.distro.osVersion, "9-stream") {
+		ps.Include = append(ps.Include, "ignition", "ignition-edge", "ssh-key-dir")
+	}
+
+	return ps
+
+}
+
+func x8664EdgeCommitPackageSet(t *imageType) rpmmd.PackageSet {
+	return rpmmd.PackageSet{
+		Include: []string{
+			"grub2",
+			"grub2-efi-x64",
+			"efibootmgr",
+			"shim-x64",
+			"microcode_ctl",
+			"iwl1000-firmware",
+			"iwl100-firmware",
+			"iwl105-firmware",
+			"iwl135-firmware",
+			"iwl2000-firmware",
+			"iwl2030-firmware",
+			"iwl3160-firmware",
+			"iwl5000-firmware",
+			"iwl5150-firmware",
+			"iwl6050-firmware",
+			"iwl7260-firmware",
+		},
+	}
+}
+
+func aarch64EdgeCommitPackageSet(t *imageType) rpmmd.PackageSet {
+	return rpmmd.PackageSet{
+		Include: []string{
+			"grub2-efi-aa64",
+			"efibootmgr",
+			"shim-aa64",
+			"iwl7260-firmware",
+		},
+	}
+}
+
+func edgeInstallerPackageSet(t *imageType) rpmmd.PackageSet {
+	return anacondaPackageSet(t)
+}
+
+func edgeSimplifiedInstallerPackageSet(t *imageType) rpmmd.PackageSet {
+	// common installer packages
+	ps := installerPackageSet(t)
+
+	ps = ps.Append(rpmmd.PackageSet{
+		Include: []string{
+			"attr",
+			"basesystem",
+			"binutils",
+			"bsdtar",
+			"clevis-dracut",
+			"clevis-luks",
+			"cloud-utils-growpart",
+			"coreos-installer",
+			"coreos-installer-dracut",
+			"coreutils",
+			"device-mapper-multipath",
+			"dnsmasq",
+			"dosfstools",
+			"dracut-live",
+			"e2fsprogs",
+			"fcoe-utils",
+			"fdo-init",
+			"gzip",
+			"ima-evm-utils",
+			"iproute",
+			"iptables",
+			"iputils",
+			"iscsi-initiator-utils",
+			"keyutils",
+			"lldpad",
+			"lvm2",
+			"passwd",
+			"policycoreutils",
+			"policycoreutils-python-utils",
+			"procps-ng",
+			"redhat-logos",
+			"rootfiles",
+			"setools-console",
+			"sudo",
+			"traceroute",
+			"util-linux",
+		},
+	})
+
+	switch t.arch.Name() {
+
+	case platform.ARCH_X86_64.String():
+		ps = ps.Append(x8664EdgeCommitPackageSet(t))
+	case platform.ARCH_AARCH64.String():
+		ps = ps.Append(aarch64EdgeCommitPackageSet(t))
+
+	default:
+		panic(fmt.Sprintf("unsupported arch: %s", t.arch.Name()))
+	}
+
+	return ps
+}

vendor/github.com/osbuild/images/pkg/distro/rhel9/gce.go

@@ -0,0 +1,300 @@
+package rhel9
+
+import (
+	"github.com/osbuild/images/internal/common"
+	"github.com/osbuild/images/pkg/distro"
+	"github.com/osbuild/images/pkg/osbuild"
+	"github.com/osbuild/images/pkg/rpmmd"
+	"github.com/osbuild/images/pkg/subscription"
+)
+
+const gceKernelOptions = "net.ifnames=0 biosdevname=0 scsi_mod.use_blk_mq=Y console=ttyS0,38400n8d"
+
+var (
+	gceImgType = imageType{
+		name:     "gce",
+		filename: "image.tar.gz",
+		mimeType: "application/gzip",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey: gcePackageSet,
+		},
+		kernelOptions:    gceKernelOptions,
+		bootable:         true,
+		defaultSize:      20 * common.GibiByte,
+		image:            liveImage,
+		buildPipelines:   []string{"build"},
+		payloadPipelines: []string{"os", "image", "archive"},
+		exports:          []string{"archive"},
+		// TODO: the base partition table still contains the BIOS boot partition, but the image is UEFI-only
+		basePartitionTables: defaultBasePartitionTables,
+	}
+
+	gceRhuiImgType = imageType{
+		name:     "gce-rhui",
+		filename: "image.tar.gz",
+		mimeType: "application/gzip",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey: gceRhuiPackageSet,
+		},
+		kernelOptions:    gceKernelOptions,
+		bootable:         true,
+		defaultSize:      20 * common.GibiByte,
+		image:            liveImage,
+		buildPipelines:   []string{"build"},
+		payloadPipelines: []string{"os", "image", "archive"},
+		exports:          []string{"archive"},
+		// TODO: the base partition table still contains the BIOS boot partition, but the image is UEFI-only
+		basePartitionTables: defaultBasePartitionTables,
+	}
+)
+
+func mkGCEImageType(rhsm bool) imageType {
+	it := gceImgType
+	it.defaultImageConfig = baseGCEImageConfig(rhsm)
+	return it
+}
+
+func mkGCERHUIImageType(rhsm bool) imageType {
+	it := gceRhuiImgType
+	it.defaultImageConfig = defaultGceRhuiImageConfig(rhsm)
+	return it
+}
+
+func baseGCEImageConfig(rhsm bool) *distro.ImageConfig {
+	ic := &distro.ImageConfig{
+		Timezone: common.ToPtr("UTC"),
+		TimeSynchronization: &osbuild.ChronyStageOptions{
+			Servers: []osbuild.ChronyConfigServer{{Hostname: "metadata.google.internal"}},
+		},
+		Firewall: &osbuild.FirewallStageOptions{
+			DefaultZone: "trusted",
+		},
+		EnabledServices: []string{
+			"sshd",
+			"rngd",
+			"dnf-automatic.timer",
+		},
+		DisabledServices: []string{
+			"sshd-keygen@",
+			"reboot.target",
+		},
+		DefaultTarget: common.ToPtr("multi-user.target"),
+		Locale:        common.ToPtr("en_US.UTF-8"),
+		Keyboard: &osbuild.KeymapStageOptions{
+			Keymap: "us",
+		},
+		DNFConfig: []*osbuild.DNFConfigStageOptions{
+			{
+				Config: &osbuild.DNFConfig{
+					Main: &osbuild.DNFConfigMain{
+						IPResolve: "4",
+					},
+				},
+			},
+		},
+		DNFAutomaticConfig: &osbuild.DNFAutomaticConfigStageOptions{
+			Config: &osbuild.DNFAutomaticConfig{
+				Commands: &osbuild.DNFAutomaticConfigCommands{
+					ApplyUpdates: common.ToPtr(true),
+					UpgradeType:  osbuild.DNFAutomaticUpgradeTypeSecurity,
+				},
+			},
+		},
+		YUMRepos: []*osbuild.YumReposStageOptions{
+			{
+				Filename: "google-cloud.repo",
+				Repos: []osbuild.YumRepository{
+					{
+						Id:       "google-compute-engine",
+						Name:     "Google Compute Engine",
+						BaseURLs: []string{"https://packages.cloud.google.com/yum/repos/google-compute-engine-el9-x86_64-stable"},
+						Enabled:  common.ToPtr(true),
+						// TODO: enable GPG check once Google stops using SHA-1 in their keys
+						// https://issuetracker.google.com/issues/223626963
+						GPGCheck:     common.ToPtr(false),
+						RepoGPGCheck: common.ToPtr(false),
+						GPGKey: []string{
+							"https://packages.cloud.google.com/yum/doc/yum-key.gpg",
+							"https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg",
+						},
+					},
+				},
+			},
+		},
+		SshdConfig: &osbuild.SshdConfigStageOptions{
+			Config: osbuild.SshdConfigConfig{
+				PasswordAuthentication: common.ToPtr(false),
+				ClientAliveInterval:    common.ToPtr(420),
+				PermitRootLogin:        osbuild.PermitRootLoginValueNo,
+			},
+		},
+		Sysconfig: []*osbuild.SysconfigStageOptions{
+			{
+				Kernel: &osbuild.SysconfigKernelOptions{
+					DefaultKernel: "kernel-core",
+					UpdateDefault: true,
+				},
+			},
+		},
+		Modprobe: []*osbuild.ModprobeStageOptions{
+			{
+				Filename: "blacklist-floppy.conf",
+				Commands: osbuild.ModprobeConfigCmdList{
+					osbuild.NewModprobeConfigCmdBlacklist("floppy"),
+				},
+			},
+		},
+		GCPGuestAgentConfig: &osbuild.GcpGuestAgentConfigOptions{
+			ConfigScope: osbuild.GcpGuestAgentConfigScopeDistro,
+			Config: &osbuild.GcpGuestAgentConfig{
+				InstanceSetup: &osbuild.GcpGuestAgentConfigInstanceSetup{
+					SetBotoConfig: common.ToPtr(false),
+				},
+			},
+		},
+	}
+
+	if rhsm {
+		ic.RHSMConfig = map[subscription.RHSMStatus]*osbuild.RHSMStageOptions{
+			subscription.RHSMConfigNoSubscription: {
+				SubMan: &osbuild.RHSMStageOptionsSubMan{
+					Rhsmcertd: &osbuild.SubManConfigRHSMCERTDSection{
+						AutoRegistration: common.ToPtr(true),
+					},
+					// Don't disable RHSM redhat.repo management on the GCE
+					// image, which is BYOS and does not use RHUI for content.
+					// Otherwise subscribing the system manually after booting
+					// it would result in empty redhat.repo. Without RHUI, such
+					// system would have no way to get Red Hat content, but
+					// enable the repo management manually, which would be very
+					// confusing.
+				},
+			},
+			subscription.RHSMConfigWithSubscription: {
+				SubMan: &osbuild.RHSMStageOptionsSubMan{
+					Rhsmcertd: &osbuild.SubManConfigRHSMCERTDSection{
+						AutoRegistration: common.ToPtr(true),
+					},
+					// do not disable the redhat.repo management if the user
+					// explicitly request the system to be subscribed
+				},
+			},
+		}
+	}
+	return ic
+}
+
+func defaultGceRhuiImageConfig(rhsm bool) *distro.ImageConfig {
+	ic := &distro.ImageConfig{
+		RHSMConfig: map[subscription.RHSMStatus]*osbuild.RHSMStageOptions{
+			subscription.RHSMConfigNoSubscription: {
+				SubMan: &osbuild.RHSMStageOptionsSubMan{
+					Rhsmcertd: &osbuild.SubManConfigRHSMCERTDSection{
+						AutoRegistration: common.ToPtr(true),
+					},
+					Rhsm: &osbuild.SubManConfigRHSMSection{
+						ManageRepos: common.ToPtr(false),
+					},
+				},
+			},
+			subscription.RHSMConfigWithSubscription: {
+				SubMan: &osbuild.RHSMStageOptionsSubMan{
+					Rhsmcertd: &osbuild.SubManConfigRHSMCERTDSection{
+						AutoRegistration: common.ToPtr(true),
+					},
+					// do not disable the redhat.repo management if the user
+					// explicitly request the system to be subscribed
+				},
+			},
+		},
+	}
+	return ic.InheritFrom(baseGCEImageConfig(rhsm))
+}
+
+func gceCommonPackageSet(t *imageType) rpmmd.PackageSet {
+	ps := rpmmd.PackageSet{
+		Include: []string{
+			"langpacks-en", // not in Google's KS
+			"acpid",
+			"dhcp-client",
+			"dnf-automatic",
+			"net-tools",
+			//"openssh-server", included in core
+			"python3",
+			"rng-tools",
+			"tar",
+			"vim",
+
+			// GCE guest tools
+			"google-compute-engine",
+			"google-osconfig-agent",
+			"gce-disk-expand",
+
+			// Not explicitly included in GCP kickstart, but present on the image
+			// for time synchronization
+			"chrony",
+			"timedatex",
+			// EFI
+			"grub2-tools-efi",
+			"firewalld", // not pulled in any more as on RHEL-8
+		},
+		Exclude: []string{
+			"alsa-utils",
+			"b43-fwcutter",
+			"dmraid",
+			"eject",
+			"gpm",
+			"irqbalance",
+			"microcode_ctl",
+			"smartmontools",
+			"aic94xx-firmware",
+			"atmel-firmware",
+			"b43-openfwwf",
+			"bfa-firmware",
+			"ipw2100-firmware",
+			"ipw2200-firmware",
+			"ivtv-firmware",
+			"iwl100-firmware",
+			"iwl1000-firmware",
+			"iwl3945-firmware",
+			"iwl4965-firmware",
+			"iwl5000-firmware",
+			"iwl5150-firmware",
+			"iwl6000-firmware",
+			"iwl6000g2a-firmware",
+			"iwl6050-firmware",
+			"kernel-firmware",
+			"libertas-usb8388-firmware",
+			"ql2100-firmware",
+			"ql2200-firmware",
+			"ql23xx-firmware",
+			"ql2400-firmware",
+			"ql2500-firmware",
+			"rt61pci-firmware",
+			"rt73usb-firmware",
+			"xorg-x11-drv-ati-firmware",
+			"zd1211-firmware",
+			// RHBZ#2075815
+			"qemu-guest-agent",
+		},
+	}.Append(coreOsCommonPackageSet(t)).Append(distroSpecificPackageSet(t))
+
+	// Some excluded packages are part of the @core group package set returned
+	// by coreOsCommonPackageSet(). Ensure that the conflicting packages are
+	// returned from the list of `Include` packages.
+	return ps.ResolveConflictsExclude()
+}
+
+// GCE BYOS image
+func gcePackageSet(t *imageType) rpmmd.PackageSet {
+	return gceCommonPackageSet(t)
+}
+
+// GCE RHUI image
+func gceRhuiPackageSet(t *imageType) rpmmd.PackageSet {
+	return rpmmd.PackageSet{
+		Include: []string{
+			"google-rhui-client-rhel9",
+		},
+	}.Append(gceCommonPackageSet(t))
+}

vendor/github.com/osbuild/images/pkg/distro/rhel9/images.go

@@ -0,0 +1,627 @@
+package rhel9
+
+import (
+	"fmt"
+	"math/rand"
+
+	"github.com/osbuild/images/internal/common"
+	"github.com/osbuild/images/internal/fdo"
+	"github.com/osbuild/images/internal/ignition"
+	"github.com/osbuild/images/internal/oscap"
+	"github.com/osbuild/images/internal/users"
+	"github.com/osbuild/images/internal/workload"
+	"github.com/osbuild/images/pkg/blueprint"
+	"github.com/osbuild/images/pkg/container"
+	"github.com/osbuild/images/pkg/distro"
+	"github.com/osbuild/images/pkg/image"
+	"github.com/osbuild/images/pkg/manifest"
+	"github.com/osbuild/images/pkg/osbuild"
+	"github.com/osbuild/images/pkg/ostree"
+	"github.com/osbuild/images/pkg/rpmmd"
+)
+
+func osCustomizations(
+	t *imageType,
+	osPackageSet rpmmd.PackageSet,
+	options distro.ImageOptions,
+	containers []container.SourceSpec,
+	c *blueprint.Customizations,
+) manifest.OSCustomizations {
+
+	imageConfig := t.getDefaultImageConfig()
+
+	osc := manifest.OSCustomizations{}
+
+	if t.bootable || t.rpmOstree {
+		osc.KernelName = c.GetKernel().Name
+
+		var kernelOptions []string
+		if t.kernelOptions != "" {
+			kernelOptions = append(kernelOptions, t.kernelOptions)
+		}
+		if bpKernel := c.GetKernel(); bpKernel.Append != "" {
+			kernelOptions = append(kernelOptions, bpKernel.Append)
+		}
+		osc.KernelOptionsAppend = kernelOptions
+	}
+
+	osc.ExtraBasePackages = osPackageSet.Include
+	osc.ExcludeBasePackages = osPackageSet.Exclude
+	osc.ExtraBaseRepos = osPackageSet.Repositories
+
+	osc.Containers = containers
+
+	osc.GPGKeyFiles = imageConfig.GPGKeyFiles
+	if imageConfig.ExcludeDocs != nil {
+		osc.ExcludeDocs = *imageConfig.ExcludeDocs
+	}
+
+	if !t.bootISO {
+		// don't put users and groups in the payload of an installer
+		// add them via kickstart instead
+		osc.Groups = users.GroupsFromBP(c.GetGroups())
+		osc.Users = users.UsersFromBP(c.GetUsers())
+	}
+
+	osc.EnabledServices = imageConfig.EnabledServices
+	osc.DisabledServices = imageConfig.DisabledServices
+	if imageConfig.DefaultTarget != nil {
+		osc.DefaultTarget = *imageConfig.DefaultTarget
+	}
+
+	osc.Firewall = imageConfig.Firewall
+	if fw := c.GetFirewall(); fw != nil {
+		options := osbuild.FirewallStageOptions{
+			Ports: fw.Ports,
+		}
+
+		if fw.Services != nil {
+			options.EnabledServices = fw.Services.Enabled
+			options.DisabledServices = fw.Services.Disabled
+		}
+		if fw.Zones != nil {
+			for _, z := range fw.Zones {
+				options.Zones = append(options.Zones, osbuild.FirewallZone{
+					Name:    *z.Name,
+					Sources: z.Sources,
+				})
+			}
+		}
+		osc.Firewall = &options
+	}
+
+	language, keyboard := c.GetPrimaryLocale()
+	if language != nil {
+		osc.Language = *language
+	} else if imageConfig.Locale != nil {
+		osc.Language = *imageConfig.Locale
+	}
+	if keyboard != nil {
+		osc.Keyboard = keyboard
+	} else if imageConfig.Keyboard != nil {
+		osc.Keyboard = &imageConfig.Keyboard.Keymap
+		if imageConfig.Keyboard.X11Keymap != nil {
+			osc.X11KeymapLayouts = imageConfig.Keyboard.X11Keymap.Layouts
+		}
+	}
+
+	if hostname := c.GetHostname(); hostname != nil {
+		osc.Hostname = *hostname
+	}
+
+	timezone, ntpServers := c.GetTimezoneSettings()
+	if timezone != nil {
+		osc.Timezone = *timezone
+	} else if imageConfig.Timezone != nil {
+		osc.Timezone = *imageConfig.Timezone
+	}
+
+	if len(ntpServers) > 0 {
+		for _, server := range ntpServers {
+			osc.NTPServers = append(osc.NTPServers, osbuild.ChronyConfigServer{Hostname: server})
+		}
+	} else if imageConfig.TimeSynchronization != nil {
+		osc.NTPServers = imageConfig.TimeSynchronization.Servers
+		osc.LeapSecTZ = imageConfig.TimeSynchronization.LeapsecTz
+	}
+
+	// Relabel the tree, unless the `NoSElinux` flag is explicitly set to `true`
+	if imageConfig.NoSElinux == nil || imageConfig.NoSElinux != nil && !*imageConfig.NoSElinux {
+		osc.SElinux = "targeted"
+	}
+
+	if oscapConfig := c.GetOpenSCAP(); oscapConfig != nil {
+		if t.rpmOstree {
+			panic("unexpected oscap options for ostree image type")
+		}
+		var datastream = oscapConfig.DataStream
+		if datastream == "" {
+			datastream = oscap.DefaultRHEL9Datastream(t.arch.distro.isRHEL())
+		}
+		osc.OpenSCAPConfig = osbuild.NewOscapRemediationStageOptions(
+			osbuild.OscapConfig{
+				Datastream: datastream,
+				ProfileID:  oscapConfig.ProfileID,
+			},
+		)
+	}
+
+	if t.arch.distro.isRHEL() && options.Facts != nil {
+		osc.FactAPIType = &options.Facts.APIType
+	}
+
+	var err error
+	osc.Directories, err = blueprint.DirectoryCustomizationsToFsNodeDirectories(c.GetDirectories())
+	if err != nil {
+		// In theory this should never happen, because the blueprint directory customizations
+		// should have been validated before this point.
+		panic(fmt.Sprintf("failed to convert directory customizations to fs node directories: %v", err))
+	}
+
+	osc.Files, err = blueprint.FileCustomizationsToFsNodeFiles(c.GetFiles())
+	if err != nil {
+		// In theory this should never happen, because the blueprint file customizations
+		// should have been validated before this point.
+		panic(fmt.Sprintf("failed to convert file customizations to fs node files: %v", err))
+	}
+
+	// set yum repos first, so it doesn't get overridden by
+	// imageConfig.YUMRepos
+	osc.YUMRepos = imageConfig.YUMRepos
+
+	customRepos, err := c.GetRepositories()
+	if err != nil {
+		// This shouldn't happen and since the repos
+		// should have already been validated
+		panic(fmt.Sprintf("failed to get custom repos: %v", err))
+	}
+
+	// This function returns a map of filename and corresponding yum repos
+	// and a list of fs node files for the inline gpg keys so we can save
+	// them to disk. This step also swaps the inline gpg key with the path
+	// to the file in the os file tree
+	yumRepos, gpgKeyFiles, err := blueprint.RepoCustomizationsToRepoConfigAndGPGKeyFiles(customRepos)
+	if err != nil {
+		panic(fmt.Sprintf("failed to convert inline gpgkeys to fs node files: %v", err))
+	}
+
+	// add the gpg key files to the list of files to be added to the tree
+	if len(gpgKeyFiles) > 0 {
+		osc.Files = append(osc.Files, gpgKeyFiles...)
+	}
+
+	for filename, repos := range yumRepos {
+		osc.YUMRepos = append(osc.YUMRepos, osbuild.NewYumReposStageOptions(filename, repos))
+	}
+
+	osc.ShellInit = imageConfig.ShellInit
+
+	osc.Grub2Config = imageConfig.Grub2Config
+	osc.Sysconfig = imageConfig.Sysconfig
+	osc.SystemdLogind = imageConfig.SystemdLogind
+	osc.CloudInit = imageConfig.CloudInit
+	osc.Modprobe = imageConfig.Modprobe
+	osc.DracutConf = imageConfig.DracutConf
+	osc.SystemdUnit = imageConfig.SystemdUnit
+	osc.Authselect = imageConfig.Authselect
+	osc.SELinuxConfig = imageConfig.SELinuxConfig
+	osc.Tuned = imageConfig.Tuned
+	osc.Tmpfilesd = imageConfig.Tmpfilesd
+	osc.PamLimitsConf = imageConfig.PamLimitsConf
+	osc.Sysctld = imageConfig.Sysctld
+	osc.DNFConfig = imageConfig.DNFConfig
+	osc.DNFAutomaticConfig = imageConfig.DNFAutomaticConfig
+	osc.SshdConfig = imageConfig.SshdConfig
+	osc.AuthConfig = imageConfig.Authconfig
+	osc.PwQuality = imageConfig.PwQuality
+	osc.RHSMConfig = imageConfig.RHSMConfig
+	osc.Subscription = options.Subscription
+	osc.WAAgentConfig = imageConfig.WAAgentConfig
+	osc.UdevRules = imageConfig.UdevRules
+	osc.GCPGuestAgentConfig = imageConfig.GCPGuestAgentConfig
+
+	return osc
+}
+
+func liveImage(workload workload.Workload,
+	t *imageType,
+	customizations *blueprint.Customizations,
+	options distro.ImageOptions,
+	packageSets map[string]rpmmd.PackageSet,
+	containers []container.SourceSpec,
+	rng *rand.Rand) (image.ImageKind, error) {
+
+	img := image.NewLiveImage()
+	img.Platform = t.platform
+	img.OSCustomizations = osCustomizations(t, packageSets[osPkgsKey], options, containers, customizations)
+	img.Environment = t.environment
+	img.Workload = workload
+	img.Compression = t.compression
+	// TODO: move generation into LiveImage
+	pt, err := t.getPartitionTable(customizations.GetFilesystems(), options, rng)
+	if err != nil {
+		return nil, err
+	}
+	img.PartitionTable = pt
+
+	img.Filename = t.Filename()
+
+	return img, nil
+}
+
+func edgeCommitImage(workload workload.Workload,
+	t *imageType,
+	customizations *blueprint.Customizations,
+	options distro.ImageOptions,
+	packageSets map[string]rpmmd.PackageSet,
+	containers []container.SourceSpec,
+	rng *rand.Rand) (image.ImageKind, error) {
+
+	parentCommit, commitRef := makeOSTreeParentCommit(options.OSTree, t.OSTreeRef())
+	img := image.NewOSTreeArchive(commitRef)
+
+	img.Platform = t.platform
+	img.OSCustomizations = osCustomizations(t, packageSets[osPkgsKey], options, containers, customizations)
+	img.Environment = t.environment
+	img.Workload = workload
+	img.OSTreeParent = parentCommit
+	img.OSVersion = t.arch.distro.osVersion
+	img.Filename = t.Filename()
+
+	if !common.VersionLessThan(t.arch.distro.osVersion, "9.2") || t.arch.distro.osVersion == "9-stream" {
+		img.OSCustomizations.EnabledServices = append(img.OSCustomizations.EnabledServices, "ignition-firstboot-complete.service", "coreos-ignition-write-issues.service")
+	}
+	img.Environment = t.environment
+	img.Workload = workload
+
+	img.OSVersion = t.arch.distro.osVersion
+
+	img.Filename = t.Filename()
+
+	return img, nil
+}
+
+func edgeContainerImage(workload workload.Workload,
+	t *imageType,
+	customizations *blueprint.Customizations,
+	options distro.ImageOptions,
+	packageSets map[string]rpmmd.PackageSet,
+	containers []container.SourceSpec,
+	rng *rand.Rand) (image.ImageKind, error) {
+
+	parentCommit, commitRef := makeOSTreeParentCommit(options.OSTree, t.OSTreeRef())
+	img := image.NewOSTreeContainer(commitRef)
+
+	img.Platform = t.platform
+	img.OSCustomizations = osCustomizations(t, packageSets[osPkgsKey], options, containers, customizations)
+	img.ContainerLanguage = img.OSCustomizations.Language
+	img.Environment = t.environment
+	img.Workload = workload
+	img.OSTreeParent = parentCommit
+	img.OSVersion = t.arch.distro.osVersion
+	img.ExtraContainerPackages = packageSets[containerPkgsKey]
+	img.Filename = t.Filename()
+
+	if !common.VersionLessThan(t.arch.distro.osVersion, "9.2") || t.arch.distro.osVersion == "9-stream" {
+		img.OSCustomizations.EnabledServices = append(img.OSCustomizations.EnabledServices, "ignition-firstboot-complete.service", "coreos-ignition-write-issues.service")
+	}
+
+	return img, nil
+}
+
+func edgeInstallerImage(workload workload.Workload,
+	t *imageType,
+	customizations *blueprint.Customizations,
+	options distro.ImageOptions,
+	packageSets map[string]rpmmd.PackageSet,
+	containers []container.SourceSpec,
+	rng *rand.Rand) (image.ImageKind, error) {
+
+	d := t.arch.distro
+
+	commit, err := makeOSTreePayloadCommit(options.OSTree, t.OSTreeRef())
+	if err != nil {
+		return nil, fmt.Errorf("%s: %s", t.Name(), err.Error())
+	}
+
+	img := image.NewAnacondaOSTreeInstaller(commit)
+
+	img.Platform = t.platform
+	img.ExtraBasePackages = packageSets[installerPkgsKey]
+	img.Users = users.UsersFromBP(customizations.GetUsers())
+	img.Groups = users.GroupsFromBP(customizations.GetGroups())
+
+	img.SquashfsCompression = "xz"
+	img.AdditionalDracutModules = []string{
+		"nvdimm", // non-volatile DIMM firmware (provides nfit, cuse, and nd_e820)
+		"prefixdevname",
+		"prefixdevname-tools",
+	}
+	img.AdditionalDrivers = []string{"cuse", "ipmi_devintf", "ipmi_msghandler"}
+
+	if len(img.Users)+len(img.Groups) > 0 {
+		// only enable the users module if needed
+		img.AdditionalAnacondaModules = []string{"org.fedoraproject.Anaconda.Modules.Users"}
+	}
+
+	img.ISOLabelTempl = d.isolabelTmpl
+	img.Product = d.product
+	img.Variant = "edge"
+	img.OSName = "rhel"
+	img.OSVersion = d.osVersion
+	img.Release = fmt.Sprintf("%s %s", d.product, d.osVersion)
+
+	img.Filename = t.Filename()
+
+	return img, nil
+}
+
+func edgeRawImage(workload workload.Workload,
+	t *imageType,
+	customizations *blueprint.Customizations,
+	options distro.ImageOptions,
+	packageSets map[string]rpmmd.PackageSet,
+	containers []container.SourceSpec,
+	rng *rand.Rand) (image.ImageKind, error) {
+
+	commit, err := makeOSTreePayloadCommit(options.OSTree, t.OSTreeRef())
+	if err != nil {
+		return nil, fmt.Errorf("%s: %s", t.Name(), err.Error())
+	}
+
+	img := image.NewOSTreeRawImage(commit)
+
+	if !common.VersionLessThan(t.arch.distro.osVersion, "9.2") || t.arch.distro.osVersion == "9-stream" {
+		img.Ignition = true
+	}
+
+	img.Users = users.UsersFromBP(customizations.GetUsers())
+	img.Groups = users.GroupsFromBP(customizations.GetGroups())
+
+	// "rw" kernel option is required when /sysroot is mounted read-only to
+	// keep stateful parts of the filesystem writeable (/var/ and /etc)
+	img.KernelOptionsAppend = []string{"modprobe.blacklist=vc4"}
+	img.Keyboard = "us"
+	img.Locale = "C.UTF-8"
+	if !common.VersionLessThan(t.arch.distro.osVersion, "9.2") || t.arch.distro.osVersion == "9-stream" {
+		img.SysrootReadOnly = true
+		img.KernelOptionsAppend = append(img.KernelOptionsAppend, "rw")
+	}
+
+	img.Platform = t.platform
+	img.Workload = workload
+	img.Remote = ostree.Remote{
+		Name:       "rhel-edge",
+		URL:        options.OSTree.URL,
+		ContentURL: options.OSTree.ContentURL,
+	}
+	img.OSName = "redhat"
+
+	if bpIgnition := customizations.GetIgnition(); bpIgnition != nil && bpIgnition.FirstBoot != nil && bpIgnition.FirstBoot.ProvisioningURL != "" {
+		img.KernelOptionsAppend = append(img.KernelOptionsAppend, "ignition.config.url="+bpIgnition.FirstBoot.ProvisioningURL)
+	}
+
+	// 92+ only
+	if kopts := customizations.GetKernel(); kopts != nil && kopts.Append != "" {
+		img.KernelOptionsAppend = append(img.KernelOptionsAppend, kopts.Append)
+	}
+
+	// TODO: move generation into LiveImage
+	pt, err := t.getPartitionTable(customizations.GetFilesystems(), options, rng)
+	if err != nil {
+		return nil, err
+	}
+	img.PartitionTable = pt
+
+	img.Filename = t.Filename()
+	img.Compression = t.compression
+
+	return img, nil
+}
+
+func edgeSimplifiedInstallerImage(workload workload.Workload,
+	t *imageType,
+	customizations *blueprint.Customizations,
+	options distro.ImageOptions,
+	packageSets map[string]rpmmd.PackageSet,
+	containers []container.SourceSpec,
+	rng *rand.Rand) (image.ImageKind, error) {
+
+	commit, err := makeOSTreePayloadCommit(options.OSTree, t.OSTreeRef())
+	if err != nil {
+		return nil, fmt.Errorf("%s: %s", t.Name(), err.Error())
+	}
+
+	rawImg := image.NewOSTreeRawImage(commit)
+	if !common.VersionLessThan(t.arch.distro.osVersion, "9.2") || t.arch.distro.osVersion == "9-stream" {
+		rawImg.Ignition = true
+	}
+
+	rawImg.Users = users.UsersFromBP(customizations.GetUsers())
+	rawImg.Groups = users.GroupsFromBP(customizations.GetGroups())
+
+	// "rw" kernel option is required when /sysroot is mounted read-only to
+	// keep stateful parts of the filesystem writeable (/var/ and /etc)
+	rawImg.KernelOptionsAppend = []string{"modprobe.blacklist=vc4"}
+	rawImg.Keyboard = "us"
+	rawImg.Locale = "C.UTF-8"
+	if !common.VersionLessThan(t.arch.distro.osVersion, "9.2") || t.arch.distro.osVersion == "9-stream" {
+		rawImg.SysrootReadOnly = true
+		rawImg.KernelOptionsAppend = append(rawImg.KernelOptionsAppend, "rw")
+	}
+
+	rawImg.Platform = t.platform
+	rawImg.Workload = workload
+	rawImg.Remote = ostree.Remote{
+		Name:       "rhel-edge",
+		URL:        options.OSTree.URL,
+		ContentURL: options.OSTree.ContentURL,
+	}
+	rawImg.OSName = "redhat"
+
+	// TODO: move generation into LiveImage
+	pt, err := t.getPartitionTable(customizations.GetFilesystems(), options, rng)
+	if err != nil {
+		return nil, err
+	}
+	rawImg.PartitionTable = pt
+
+	rawImg.Filename = t.Filename()
+
+	if bpIgnition := customizations.GetIgnition(); bpIgnition != nil && bpIgnition.FirstBoot != nil && bpIgnition.FirstBoot.ProvisioningURL != "" {
+		rawImg.KernelOptionsAppend = append(rawImg.KernelOptionsAppend, "ignition.config.url="+bpIgnition.FirstBoot.ProvisioningURL)
+	}
+
+	// 92+ only
+	if kopts := customizations.GetKernel(); kopts != nil && kopts.Append != "" {
+		rawImg.KernelOptionsAppend = append(rawImg.KernelOptionsAppend, kopts.Append)
+	}
+
+	img := image.NewOSTreeSimplifiedInstaller(rawImg, customizations.InstallationDevice)
+	img.ExtraBasePackages = packageSets[installerPkgsKey]
+	// img.Workload = workload
+	img.Platform = t.platform
+	img.Filename = t.Filename()
+	if bpFDO := customizations.GetFDO(); bpFDO != nil {
+		img.FDO = fdo.FromBP(*bpFDO)
+	}
+	// ignition configs from blueprint
+	if bpIgnition := customizations.GetIgnition(); bpIgnition != nil {
+		if bpIgnition.Embedded != nil {
+			var err error
+			img.IgnitionEmbedded, err = ignition.EmbeddedOptionsFromBP(*bpIgnition.Embedded)
+			if err != nil {
+				return nil, err
+			}
+		}
+	}
+
+	d := t.arch.distro
+	img.ISOLabelTempl = d.isolabelTmpl
+	img.Product = d.product
+	img.Variant = "edge"
+	img.OSName = "redhat"
+	img.OSVersion = d.osVersion
+	img.AdditionalDracutModules = []string{"prefixdevname", "prefixdevname-tools"}
+
+	return img, nil
+}
+
+func imageInstallerImage(workload workload.Workload,
+	t *imageType,
+	customizations *blueprint.Customizations,
+	options distro.ImageOptions,
+	packageSets map[string]rpmmd.PackageSet,
+	containers []container.SourceSpec,
+	rng *rand.Rand) (image.ImageKind, error) {
+
+	img := image.NewAnacondaTarInstaller()
+
+	img.Platform = t.platform
+	img.Workload = workload
+	img.OSCustomizations = osCustomizations(t, packageSets[osPkgsKey], options, containers, customizations)
+	img.ExtraBasePackages = packageSets[installerPkgsKey]
+	img.Users = users.UsersFromBP(customizations.GetUsers())
+	img.Groups = users.GroupsFromBP(customizations.GetGroups())
+
+	img.AdditionalDracutModules = []string{
+		"nvdimm", // non-volatile DIMM firmware (provides nfit, cuse, and nd_e820)
+		"prefixdevname",
+		"prefixdevname-tools",
+	}
+	img.AdditionalDrivers = []string{"cuse", "ipmi_devintf", "ipmi_msghandler"}
+	img.AdditionalAnacondaModules = []string{"org.fedoraproject.Anaconda.Modules.Users"}
+
+	img.SquashfsCompression = "xz"
+
+	// put the kickstart file in the root of the iso
+	img.ISORootKickstart = true
+
+	d := t.arch.distro
+
+	img.ISOLabelTempl = d.isolabelTmpl
+	img.Product = d.product
+	img.OSName = "redhat"
+	img.OSVersion = d.osVersion
+	img.Release = fmt.Sprintf("%s %s", d.product, d.osVersion)
+
+	img.Filename = t.Filename()
+
+	return img, nil
+}
+
+func tarImage(workload workload.Workload,
+	t *imageType,
+	customizations *blueprint.Customizations,
+	options distro.ImageOptions,
+	packageSets map[string]rpmmd.PackageSet,
+	containers []container.SourceSpec,
+	rng *rand.Rand) (image.ImageKind, error) {
+
+	img := image.NewArchive()
+	img.Platform = t.platform
+	img.OSCustomizations = osCustomizations(t, packageSets[osPkgsKey], options, containers, customizations)
+	img.Environment = t.environment
+	img.Workload = workload
+
+	img.Filename = t.Filename()
+
+	return img, nil
+
+}
+
+// Create an ostree SourceSpec to define an ostree parent commit using the user
+// options and the default ref for the image type.  Additionally returns the
+// ref to be used for the new commit to be created.
+func makeOSTreeParentCommit(options *ostree.ImageOptions, defaultRef string) (*ostree.SourceSpec, string) {
+	commitRef := defaultRef
+	if options == nil {
+		// nothing to do
+		return nil, commitRef
+	}
+	if options.ImageRef != "" {
+		// user option overrides default commit ref
+		commitRef = options.ImageRef
+	}
+
+	var parentCommit *ostree.SourceSpec
+	if options.URL == "" {
+		// no parent
+		return nil, commitRef
+	}
+
+	// ostree URL specified: set source spec for parent commit
+	parentRef := options.ParentRef
+	if parentRef == "" {
+		// parent ref not set: use image ref
+		parentRef = commitRef
+
+	}
+	parentCommit = &ostree.SourceSpec{
+		URL:  options.URL,
+		Ref:  parentRef,
+		RHSM: options.RHSM,
+	}
+	return parentCommit, commitRef
+}
+
+// Create an ostree SourceSpec to define an ostree payload using the user options and the default ref for the image type.
+func makeOSTreePayloadCommit(options *ostree.ImageOptions, defaultRef string) (ostree.SourceSpec, error) {
+	if options == nil || options.URL == "" {
+		// this should be caught by checkOptions() in distro, but it's good
+		// to guard against it here as well
+		return ostree.SourceSpec{}, fmt.Errorf("ostree commit URL required")
+	}
+
+	commitRef := defaultRef
+	if options.ImageRef != "" {
+		// user option overrides default commit ref
+		commitRef = options.ImageRef
+	}
+
+	return ostree.SourceSpec{
+		URL:  options.URL,
+		Ref:  commitRef,
+		RHSM: options.RHSM,
+	}, nil
+}

vendor/github.com/osbuild/images/pkg/distro/rhel9/imagetype.go

@@ -0,0 +1,429 @@
+package rhel9
+
+import (
+	"fmt"
+	"log"
+	"math/rand"
+	"strings"
+
+	"golang.org/x/exp/slices"
+
+	"github.com/osbuild/images/internal/common"
+	"github.com/osbuild/images/internal/environment"
+	"github.com/osbuild/images/internal/oscap"
+	"github.com/osbuild/images/internal/pathpolicy"
+	"github.com/osbuild/images/internal/workload"
+	"github.com/osbuild/images/pkg/blueprint"
+	"github.com/osbuild/images/pkg/container"
+	"github.com/osbuild/images/pkg/disk"
+	"github.com/osbuild/images/pkg/distro"
+	"github.com/osbuild/images/pkg/image"
+	"github.com/osbuild/images/pkg/manifest"
+	"github.com/osbuild/images/pkg/ostree"
+	"github.com/osbuild/images/pkg/platform"
+	"github.com/osbuild/images/pkg/rpmmd"
+)
+
+const (
+	// package set names
+
+	// build package set name
+	buildPkgsKey = "build"
+
+	// main/common os image package set name
+	osPkgsKey = "os"
+
+	// container package set name
+	containerPkgsKey = "container"
+
+	// installer package set name
+	installerPkgsKey = "installer"
+
+	// blueprint package set name
+	blueprintPkgsKey = "blueprint"
+)
+
+type imageFunc func(workload workload.Workload, t *imageType, customizations *blueprint.Customizations, options distro.ImageOptions, packageSets map[string]rpmmd.PackageSet, containers []container.SourceSpec, rng *rand.Rand) (image.ImageKind, error)
+
+type packageSetFunc func(t *imageType) rpmmd.PackageSet
+
+type imageType struct {
+	arch               *architecture
+	platform           platform.Platform
+	environment        environment.Environment
+	workload           workload.Workload
+	name               string
+	nameAliases        []string
+	filename           string
+	compression        string // TODO: remove from image definition and make it a transport option
+	mimeType           string
+	packageSets        map[string]packageSetFunc
+	defaultImageConfig *distro.ImageConfig
+	kernelOptions      string
+	defaultSize        uint64
+	buildPipelines     []string
+	payloadPipelines   []string
+	exports            []string
+	image              imageFunc
+
+	// bootISO: installable ISO
+	bootISO bool
+	// rpmOstree: edge/ostree
+	rpmOstree bool
+	// bootable image
+	bootable bool
+	// List of valid arches for the image type
+	basePartitionTables distro.BasePartitionTableMap
+}
+
+func (t *imageType) Name() string {
+	return t.name
+}
+
+func (t *imageType) Arch() distro.Arch {
+	return t.arch
+}
+
+func (t *imageType) Filename() string {
+	return t.filename
+}
+
+func (t *imageType) MIMEType() string {
+	return t.mimeType
+}
+
+func (t *imageType) OSTreeRef() string {
+	d := t.arch.distro
+	if t.rpmOstree {
+		return fmt.Sprintf(d.ostreeRefTmpl, t.Arch().Name())
+	}
+	return ""
+}
+
+func (t *imageType) Size(size uint64) uint64 {
+	// Microsoft Azure requires vhd images to be rounded up to the nearest MB
+	if t.name == "vhd" && size%common.MebiByte != 0 {
+		size = (size/common.MebiByte + 1) * common.MebiByte
+	}
+	if size == 0 {
+		size = t.defaultSize
+	}
+	return size
+}
+
+func (t *imageType) BuildPipelines() []string {
+	return t.buildPipelines
+}
+
+func (t *imageType) PayloadPipelines() []string {
+	return t.payloadPipelines
+}
+
+func (t *imageType) PayloadPackageSets() []string {
+	return []string{blueprintPkgsKey}
+}
+
+func (t *imageType) PackageSetsChains() map[string][]string {
+	return nil
+}
+
+func (t *imageType) Exports() []string {
+	if len(t.exports) > 0 {
+		return t.exports
+	}
+	return []string{"assembler"}
+}
+
+func (t *imageType) BootMode() distro.BootMode {
+	if t.platform.GetUEFIVendor() != "" && t.platform.GetBIOSPlatform() != "" {
+		return distro.BOOT_HYBRID
+	} else if t.platform.GetUEFIVendor() != "" {
+		return distro.BOOT_UEFI
+	} else if t.platform.GetBIOSPlatform() != "" || t.platform.GetZiplSupport() {
+		return distro.BOOT_LEGACY
+	}
+	return distro.BOOT_NONE
+}
+
+func (t *imageType) getPartitionTable(
+	mountpoints []blueprint.FilesystemCustomization,
+	options distro.ImageOptions,
+	rng *rand.Rand,
+) (*disk.PartitionTable, error) {
+	archName := t.arch.Name()
+
+	basePartitionTable, exists := t.basePartitionTables[archName]
+
+	if !exists {
+		return nil, fmt.Errorf("no partition table defined for architecture %q for image type %q", archName, t.Name())
+	}
+
+	imageSize := t.Size(options.Size)
+
+	lvmify := !t.rpmOstree
+
+	return disk.NewPartitionTable(&basePartitionTable, mountpoints, imageSize, lvmify, nil, rng)
+}
+
+func (t *imageType) getDefaultImageConfig() *distro.ImageConfig {
+	// ensure that image always returns non-nil default config
+	imageConfig := t.defaultImageConfig
+	if imageConfig == nil {
+		imageConfig = &distro.ImageConfig{}
+	}
+	return imageConfig.InheritFrom(t.arch.distro.getDefaultImageConfig())
+
+}
+
+func (t *imageType) PartitionType() string {
+	archName := t.arch.Name()
+	basePartitionTable, exists := t.basePartitionTables[archName]
+	if !exists {
+		return ""
+	}
+
+	return basePartitionTable.Type
+}
+
+func (t *imageType) Manifest(bp *blueprint.Blueprint,
+	options distro.ImageOptions,
+	repos []rpmmd.RepoConfig,
+	seed int64) (*manifest.Manifest, []string, error) {
+
+	warnings, err := t.checkOptions(bp, options)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	// merge package sets that appear in the image type with the package sets
+	// of the same name from the distro and arch
+	staticPackageSets := make(map[string]rpmmd.PackageSet)
+
+	for name, getter := range t.packageSets {
+		staticPackageSets[name] = getter(t)
+	}
+
+	// amend with repository information and collect payload repos
+	payloadRepos := make([]rpmmd.RepoConfig, 0)
+	for _, repo := range repos {
+		if len(repo.PackageSets) > 0 {
+			// only apply the repo to the listed package sets
+			for _, psName := range repo.PackageSets {
+				if slices.Contains(t.PayloadPackageSets(), psName) {
+					payloadRepos = append(payloadRepos, repo)
+				}
+				ps := staticPackageSets[psName]
+				ps.Repositories = append(ps.Repositories, repo)
+				staticPackageSets[psName] = ps
+			}
+		}
+	}
+
+	w := t.workload
+	if w == nil {
+		cw := &workload.Custom{
+			BaseWorkload: workload.BaseWorkload{
+				Repos: payloadRepos,
+			},
+			Packages: bp.GetPackagesEx(false),
+		}
+		if services := bp.Customizations.GetServices(); services != nil {
+			cw.Services = services.Enabled
+			cw.DisabledServices = services.Disabled
+		}
+		w = cw
+	}
+
+	containerSources := make([]container.SourceSpec, len(bp.Containers))
+	for idx := range bp.Containers {
+		containerSources[idx] = container.SourceSpec(bp.Containers[idx])
+	}
+
+	source := rand.NewSource(seed)
+	// math/rand is good enough in this case
+	/* #nosec G404 */
+	rng := rand.New(source)
+
+	img, err := t.image(w, t, bp.Customizations, options, staticPackageSets, containerSources, rng)
+	if err != nil {
+		return nil, nil, err
+	}
+	mf := manifest.New()
+	mf.Distro = manifest.DISTRO_EL9
+	_, err = img.InstantiateManifest(&mf, repos, t.arch.distro.runner, rng)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return &mf, warnings, err
+}
+
+// checkOptions checks the validity and compatibility of options and customizations for the image type.
+// Returns ([]string, error) where []string, if non-nil, will hold any generated warnings (e.g. deprecation notices).
+func (t *imageType) checkOptions(bp *blueprint.Blueprint, options distro.ImageOptions) ([]string, error) {
+
+	customizations := bp.Customizations
+
+	// holds warnings (e.g. deprecation notices)
+	var warnings []string
+	if t.workload != nil {
+		// For now, if an image type defines its own workload, don't allow any
+		// user customizations.
+		// Soon we will have more workflows and each will define its allowed
+		// set of customizations.  The current set of customizations defined in
+		// the blueprint spec corresponds to the Custom workflow.
+		if customizations != nil {
+			return warnings, fmt.Errorf("image type %q does not support customizations", t.name)
+		}
+	}
+
+	// we do not support embedding containers on ostree-derived images, only on commits themselves
+	if len(bp.Containers) > 0 && t.rpmOstree && (t.name != "edge-commit" && t.name != "edge-container") {
+		return warnings, fmt.Errorf("embedding containers is not supported for %s on %s", t.name, t.arch.distro.name)
+	}
+
+	ostreeURL := ""
+	if options.OSTree != nil {
+		if options.OSTree.ParentRef != "" && options.OSTree.URL == "" {
+			// specifying parent ref also requires URL
+			return nil, ostree.NewParameterComboError("ostree parent ref specified, but no URL to retrieve it")
+		}
+		ostreeURL = options.OSTree.URL
+	}
+
+	if t.bootISO && t.rpmOstree {
+		// ostree-based ISOs require a URL from which to pull a payload commit
+		if ostreeURL == "" {
+			return warnings, fmt.Errorf("boot ISO image type %q requires specifying a URL from which to retrieve the OSTree commit", t.name)
+		}
+
+		if t.name == "edge-simplified-installer" {
+			allowed := []string{"InstallationDevice", "FDO", "Ignition", "Kernel", "User", "Group"}
+			if err := customizations.CheckAllowed(allowed...); err != nil {
+				return warnings, fmt.Errorf("unsupported blueprint customizations found for boot ISO image type %q: (allowed: %s)", t.name, strings.Join(allowed, ", "))
+			}
+			if customizations.GetInstallationDevice() == "" {
+				return warnings, fmt.Errorf("boot ISO image type %q requires specifying an installation device to install to", t.name)
+			}
+
+			// FDO is optional, but when specified has some restrictions
+			if customizations.GetFDO() != nil {
+				if customizations.GetFDO().ManufacturingServerURL == "" {
+					return warnings, fmt.Errorf("boot ISO image type %q requires specifying FDO.ManufacturingServerURL configuration to install to when using FDO", t.name)
+				}
+				var diunSet int
+				if customizations.GetFDO().DiunPubKeyHash != "" {
+					diunSet++
+				}
+				if customizations.GetFDO().DiunPubKeyInsecure != "" {
+					diunSet++
+				}
+				if customizations.GetFDO().DiunPubKeyRootCerts != "" {
+					diunSet++
+				}
+				if diunSet != 1 {
+					return warnings, fmt.Errorf("boot ISO image type %q requires specifying one of [FDO.DiunPubKeyHash,FDO.DiunPubKeyInsecure,FDO.DiunPubKeyRootCerts] configuration to install to when using FDO", t.name)
+				}
+			}
+
+			// ignition is optional, we might be using FDO
+			if customizations.GetIgnition() != nil {
+				if customizations.GetIgnition().Embedded != nil && customizations.GetIgnition().FirstBoot != nil {
+					return warnings, fmt.Errorf("both ignition embedded and firstboot configurations found")
+				}
+				if customizations.GetIgnition().FirstBoot != nil && customizations.GetIgnition().FirstBoot.ProvisioningURL == "" {
+					return warnings, fmt.Errorf("ignition.firstboot requires a provisioning url")
+				}
+			}
+		} else if t.name == "edge-installer" {
+			allowed := []string{"User", "Group"}
+			if err := customizations.CheckAllowed(allowed...); err != nil {
+				return warnings, fmt.Errorf("unsupported blueprint customizations found for boot ISO image type %q: (allowed: %s)", t.name, strings.Join(allowed, ", "))
+			}
+		}
+	}
+
+	if t.name == "edge-raw-image" || t.name == "edge-ami" {
+		// ostree-based bootable images require a URL from which to pull a payload commit
+		if ostreeURL == "" {
+			return warnings, fmt.Errorf("%q images require specifying a URL from which to retrieve the OSTree commit", t.name)
+		}
+
+		allowed := []string{"Ignition", "Kernel", "User", "Group"}
+		if err := customizations.CheckAllowed(allowed...); err != nil {
+			return warnings, fmt.Errorf("unsupported blueprint customizations found for image type %q: (allowed: %s)", t.name, strings.Join(allowed, ", "))
+		}
+		// TODO: consider additional checks, such as those in "edge-simplified-installer"
+	}
+
+	// warn that user & group customizations on edge-commit, edge-container are deprecated
+	// TODO(edge): directly error if these options are provided when rhel-9.5's time arrives
+	if t.name == "edge-commit" || t.name == "edge-container" {
+		if customizations.GetUsers() != nil {
+			w := fmt.Sprintf("Please note that user customizations on %q image type are deprecated and will be removed in the near future\n", t.name)
+			log.Print(w)
+			warnings = append(warnings, w)
+		}
+		if customizations.GetGroups() != nil {
+			w := fmt.Sprintf("Please note that group customizations on %q image type are deprecated and will be removed in the near future\n", t.name)
+			log.Print(w)
+			warnings = append(warnings, w)
+		}
+	}
+
+	if kernelOpts := customizations.GetKernel(); kernelOpts.Append != "" && t.rpmOstree && t.name != "edge-raw-image" && t.name != "edge-simplified-installer" {
+		return warnings, fmt.Errorf("kernel boot parameter customizations are not supported for ostree types")
+	}
+
+	mountpoints := customizations.GetFilesystems()
+
+	if mountpoints != nil && t.rpmOstree {
+		return warnings, fmt.Errorf("Custom mountpoints are not supported for ostree types")
+	}
+
+	err := blueprint.CheckMountpointsPolicy(mountpoints, pathpolicy.MountpointPolicies)
+	if err != nil {
+		return warnings, err
+	}
+
+	if osc := customizations.GetOpenSCAP(); osc != nil {
+		if t.arch.distro.osVersion == "9.0" {
+			return warnings, fmt.Errorf(fmt.Sprintf("OpenSCAP unsupported os version: %s", t.arch.distro.osVersion))
+		}
+		if !oscap.IsProfileAllowed(osc.ProfileID, oscapProfileAllowList) {
+			return warnings, fmt.Errorf(fmt.Sprintf("OpenSCAP unsupported profile: %s", osc.ProfileID))
+		}
+		if t.rpmOstree {
+			return warnings, fmt.Errorf("OpenSCAP customizations are not supported for ostree types")
+		}
+		if osc.ProfileID == "" {
+			return warnings, fmt.Errorf("OpenSCAP profile cannot be empty")
+		}
+	}
+
+	// Check Directory/File Customizations are valid
+	dc := customizations.GetDirectories()
+	fc := customizations.GetFiles()
+
+	err = blueprint.ValidateDirFileCustomizations(dc, fc)
+	if err != nil {
+		return warnings, err
+	}
+	err = blueprint.CheckDirectoryCustomizationsPolicy(dc, pathpolicy.CustomDirectoriesPolicies)
+	if err != nil {
+		return warnings, err
+	}
+
+	err = blueprint.CheckFileCustomizationsPolicy(fc, pathpolicy.CustomFilesPolicies)
+	if err != nil {
+		return warnings, err
+	}
+
+	// check if repository customizations are valid
+	_, err = customizations.GetRepositories()
+	if err != nil {
+		return warnings, err
+	}
+
+	return warnings, nil
+}

vendor/github.com/osbuild/images/pkg/distro/rhel9/package_sets.go

@@ -0,0 +1,247 @@
+package rhel9
+
+// This file defines package sets that are used by more than one image type.
+
+import (
+	"fmt"
+
+	"github.com/osbuild/images/pkg/platform"
+	"github.com/osbuild/images/pkg/rpmmd"
+)
+
+// BUILD PACKAGE SETS
+
+// distro-wide build package set
+func distroBuildPackageSet(t *imageType) rpmmd.PackageSet {
+	ps := rpmmd.PackageSet{
+		Include: []string{
+			"dnf",
+			"dosfstools",
+			"e2fsprogs",
+			"glibc",
+			"lorax-templates-generic",
+			"lorax-templates-rhel",
+			"lvm2",
+			"policycoreutils",
+			"python3-iniparse",
+			"qemu-img",
+			"selinux-policy-targeted",
+			"systemd",
+			"tar",
+			"xfsprogs",
+			"xz",
+		},
+	}
+
+	switch t.arch.Name() {
+
+	case platform.ARCH_X86_64.String():
+		ps = ps.Append(x8664BuildPackageSet(t))
+
+	case platform.ARCH_PPC64LE.String():
+		ps = ps.Append(ppc64leBuildPackageSet(t))
+	}
+
+	return ps
+}
+
+// x86_64 build package set
+func x8664BuildPackageSet(t *imageType) rpmmd.PackageSet {
+	return rpmmd.PackageSet{
+		Include: []string{
+			"grub2-pc",
+		},
+	}
+}
+
+// ppc64le build package set
+func ppc64leBuildPackageSet(t *imageType) rpmmd.PackageSet {
+	return rpmmd.PackageSet{
+		Include: []string{
+			"grub2-ppc64le",
+			"grub2-ppc64le-modules",
+		},
+	}
+}
+
+// installer boot package sets, needed for booting and
+// also in the build host
+func anacondaBootPackageSet(t *imageType) rpmmd.PackageSet {
+	ps := rpmmd.PackageSet{}
+
+	grubCommon := rpmmd.PackageSet{
+		Include: []string{
+			"grub2-tools",
+			"grub2-tools-extra",
+			"grub2-tools-minimal",
+		},
+	}
+
+	efiCommon := rpmmd.PackageSet{
+		Include: []string{
+			"efibootmgr",
+		},
+	}
+
+	switch t.arch.Name() {
+	case platform.ARCH_X86_64.String():
+		ps = ps.Append(grubCommon)
+		ps = ps.Append(efiCommon)
+		ps = ps.Append(rpmmd.PackageSet{
+			Include: []string{
+				"grub2-efi-x64",
+				"grub2-efi-x64-cdboot",
+				"grub2-pc",
+				"grub2-pc-modules",
+				"shim-x64",
+				"syslinux",
+				"syslinux-nonlinux",
+			},
+		})
+	case platform.ARCH_AARCH64.String():
+		ps = ps.Append(grubCommon)
+		ps = ps.Append(efiCommon)
+		ps = ps.Append(rpmmd.PackageSet{
+			Include: []string{
+				"grub2-efi-aa64-cdboot",
+				"grub2-efi-aa64",
+				"shim-aa64",
+			},
+		})
+
+	default:
+		panic(fmt.Sprintf("unsupported arch: %s", t.arch.Name()))
+	}
+
+	return ps
+}
+
+// OS package sets
+
+// Replacement of the previously used @core package group
+func coreOsCommonPackageSet(t *imageType) rpmmd.PackageSet {
+	ps := rpmmd.PackageSet{
+		Include: []string{
+			"audit",
+			"basesystem",
+			"bash",
+			"coreutils",
+			"cronie",
+			"crypto-policies",
+			"crypto-policies-scripts",
+			"curl",
+			"dnf",
+			"yum",
+			"e2fsprogs",
+			"filesystem",
+			"glibc",
+			"grubby",
+			"hostname",
+			"iproute",
+			"iproute-tc",
+			"iputils",
+			"kbd",
+			"kexec-tools",
+			"less",
+			"logrotate",
+			"man-db",
+			"ncurses",
+			"openssh-clients",
+			"openssh-server",
+			"p11-kit",
+			"parted",
+			"passwd",
+			"policycoreutils",
+			"procps-ng",
+			"rootfiles",
+			"rpm",
+			"rpm-plugin-audit",
+			"rsyslog",
+			"selinux-policy-targeted",
+			"setup",
+			"shadow-utils",
+			"sssd-common",
+			"sssd-kcm",
+			"sudo",
+			"systemd",
+			"tuned",
+			"util-linux",
+			"vim-minimal",
+			"xfsprogs",
+			"authselect",
+			"prefixdevname",
+			"dnf-plugins-core",
+			"NetworkManager",
+			"NetworkManager-team",
+			"NetworkManager-tui",
+			"libsysfs",
+			"linux-firmware",
+			"lshw",
+			"lsscsi",
+			"kernel-tools",
+			"sg3_utils",
+			"sg3_utils-libs",
+			"python3-libselinux",
+		},
+	}
+
+	// Do not include this in the distroSpecificPackageSet for now,
+	// because it includes 'insights-client' which is not installed
+	// by default on all RHEL images (although it would probably make sense).
+	if t.arch.distro.isRHEL() {
+		ps = ps.Append(rpmmd.PackageSet{
+			Include: []string{
+				"subscription-manager",
+			},
+		})
+	}
+
+	switch t.arch.Name() {
+	case platform.ARCH_X86_64.String():
+		ps = ps.Append(rpmmd.PackageSet{
+			Include: []string{
+				"irqbalance",
+				"microcode_ctl",
+			},
+		})
+
+	case platform.ARCH_AARCH64.String():
+		ps = ps.Append(rpmmd.PackageSet{
+			Include: []string{
+				"irqbalance",
+			},
+		})
+
+	case platform.ARCH_PPC64LE.String():
+		ps = ps.Append(rpmmd.PackageSet{
+			Include: []string{
+				"irqbalance",
+				"opal-prd",
+				"ppc64-diag-rtas",
+				"powerpc-utils-core",
+				"lsvpd",
+			},
+		})
+
+	case platform.ARCH_S390X.String():
+		ps = ps.Append(rpmmd.PackageSet{
+			Include: []string{
+				"s390utils-core",
+			},
+		})
+	}
+
+	return ps
+}
+
+// packages that are only in some (sub)-distributions
+func distroSpecificPackageSet(t *imageType) rpmmd.PackageSet {
+	if t.arch.distro.isRHEL() {
+		return rpmmd.PackageSet{
+			Include: []string{
+				"insights-client",
+			},
+		}
+	}
+	return rpmmd.PackageSet{}
+}

vendor/github.com/osbuild/images/pkg/distro/rhel9/partition_tables.go

@@ -0,0 +1,169 @@
+package rhel9
+
+import (
+	"github.com/osbuild/images/internal/common"
+	"github.com/osbuild/images/pkg/disk"
+	"github.com/osbuild/images/pkg/distro"
+	"github.com/osbuild/images/pkg/platform"
+)
+
+var defaultBasePartitionTables = distro.BasePartitionTableMap{
+	platform.ARCH_X86_64.String(): disk.PartitionTable{
+		UUID: "D209C89E-EA5E-4FBD-B161-B461CCE297E0",
+		Type: "gpt",
+		Partitions: []disk.Partition{
+			{
+				Size:     1 * common.MebiByte, // 1MB
+				Bootable: true,
+				Type:     disk.BIOSBootPartitionGUID,
+				UUID:     disk.BIOSBootPartitionUUID,
+			},
+			{
+				Size: 200 * common.MebiByte, // 200 MB
+				Type: disk.EFISystemPartitionGUID,
+				UUID: disk.EFISystemPartitionUUID,
+				Payload: &disk.Filesystem{
+					Type:         "vfat",
+					UUID:         disk.EFIFilesystemUUID,
+					Mountpoint:   "/boot/efi",
+					Label:        "EFI-SYSTEM",
+					FSTabOptions: "defaults,uid=0,gid=0,umask=077,shortname=winnt",
+					FSTabFreq:    0,
+					FSTabPassNo:  2,
+				},
+			},
+			{
+				Size: 500 * common.MebiByte, // 500 MB
+				Type: disk.XBootLDRPartitionGUID,
+				UUID: disk.FilesystemDataUUID,
+				Payload: &disk.Filesystem{
+					Type:         "xfs",
+					Mountpoint:   "/boot",
+					Label:        "boot",
+					FSTabOptions: "defaults",
+					FSTabFreq:    0,
+					FSTabPassNo:  0,
+				},
+			},
+			{
+				Size: 2 * common.GibiByte, // 2GiB
+				Type: disk.FilesystemDataGUID,
+				UUID: disk.RootPartitionUUID,
+				Payload: &disk.Filesystem{
+					Type:         "xfs",
+					Label:        "root",
+					Mountpoint:   "/",
+					FSTabOptions: "defaults",
+					FSTabFreq:    0,
+					FSTabPassNo:  0,
+				},
+			},
+		},
+	},
+	platform.ARCH_AARCH64.String(): disk.PartitionTable{
+		UUID: "D209C89E-EA5E-4FBD-B161-B461CCE297E0",
+		Type: "gpt",
+		Partitions: []disk.Partition{
+			{
+				Size: 200 * common.MebiByte, // 200 MB
+				Type: disk.EFISystemPartitionGUID,
+				UUID: disk.EFISystemPartitionUUID,
+				Payload: &disk.Filesystem{
+					Type:         "vfat",
+					UUID:         disk.EFIFilesystemUUID,
+					Mountpoint:   "/boot/efi",
+					Label:        "EFI-SYSTEM",
+					FSTabOptions: "defaults,uid=0,gid=0,umask=077,shortname=winnt",
+					FSTabFreq:    0,
+					FSTabPassNo:  2,
+				},
+			},
+			{
+				Size: 500 * common.MebiByte, // 500 MB
+				Type: disk.XBootLDRPartitionGUID,
+				UUID: disk.FilesystemDataUUID,
+				Payload: &disk.Filesystem{
+					Type:         "xfs",
+					Mountpoint:   "/boot",
+					Label:        "boot",
+					FSTabOptions: "defaults",
+					FSTabFreq:    0,
+					FSTabPassNo:  0,
+				},
+			},
+			{
+				Size: 2 * common.GibiByte, // 2GiB
+				Type: disk.FilesystemDataGUID,
+				UUID: disk.RootPartitionUUID,
+				Payload: &disk.Filesystem{
+					Type:         "xfs",
+					Label:        "root",
+					Mountpoint:   "/",
+					FSTabOptions: "defaults",
+					FSTabFreq:    0,
+					FSTabPassNo:  0,
+				},
+			},
+		},
+	},
+	platform.ARCH_PPC64LE.String(): disk.PartitionTable{
+		UUID: "0x14fc63d2",
+		Type: "dos",
+		Partitions: []disk.Partition{
+			{
+				Size:     4 * common.MebiByte,
+				Type:     "41",
+				Bootable: true,
+			},
+			{
+				Size: 500 * common.MebiByte, // 500 MB
+				Payload: &disk.Filesystem{
+					Type:         "xfs",
+					Mountpoint:   "/boot",
+					Label:        "boot",
+					FSTabOptions: "defaults",
+					FSTabFreq:    0,
+					FSTabPassNo:  0,
+				},
+			},
+			{
+				Size: 2 * common.GibiByte, // 2GiB
+				Payload: &disk.Filesystem{
+					Type:         "xfs",
+					Mountpoint:   "/",
+					FSTabOptions: "defaults",
+					FSTabFreq:    0,
+					FSTabPassNo:  0,
+				},
+			},
+		},
+	},
+	platform.ARCH_S390X.String(): disk.PartitionTable{
+		UUID: "0x14fc63d2",
+		Type: "dos",
+		Partitions: []disk.Partition{
+			{
+				Size: 500 * common.MebiByte, // 500 MB
+				Payload: &disk.Filesystem{
+					Type:         "xfs",
+					Mountpoint:   "/boot",
+					Label:        "boot",
+					FSTabOptions: "defaults",
+					FSTabFreq:    0,
+					FSTabPassNo:  0,
+				},
+			},
+			{
+				Size:     2 * common.GibiByte, // 2GiB
+				Bootable: true,
+				Payload: &disk.Filesystem{
+					Type:         "xfs",
+					Mountpoint:   "/",
+					FSTabOptions: "defaults",
+					FSTabFreq:    0,
+					FSTabPassNo:  0,
+				},
+			},
+		},
+	},
+}

vendor/github.com/osbuild/images/pkg/distro/rhel9/qcow2.go

@@ -0,0 +1,173 @@
+package rhel9
+
+import (
+	"github.com/osbuild/images/internal/common"
+	"github.com/osbuild/images/pkg/distro"
+	"github.com/osbuild/images/pkg/osbuild"
+	"github.com/osbuild/images/pkg/platform"
+	"github.com/osbuild/images/pkg/rpmmd"
+	"github.com/osbuild/images/pkg/subscription"
+)
+
+var (
+	openstackImgType = imageType{
+		name:     "openstack",
+		filename: "disk.qcow2",
+		mimeType: "application/x-qemu-disk",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey: openstackCommonPackageSet,
+		},
+		defaultImageConfig: &distro.ImageConfig{
+			Locale: common.ToPtr("en_US.UTF-8"),
+		},
+		kernelOptions:       "ro net.ifnames=0",
+		bootable:            true,
+		defaultSize:         4 * common.GibiByte,
+		image:               liveImage,
+		buildPipelines:      []string{"build"},
+		payloadPipelines:    []string{"os", "image", "qcow2"},
+		exports:             []string{"qcow2"},
+		basePartitionTables: defaultBasePartitionTables,
+	}
+)
+
+func qcow2CommonPackageSet(t *imageType) rpmmd.PackageSet {
+	ps := rpmmd.PackageSet{
+		Include: []string{
+			"authselect-compat",
+			"chrony",
+			"cloud-init",
+			"cloud-utils-growpart",
+			"cockpit-system",
+			"cockpit-ws",
+			"dnf-utils",
+			"dosfstools",
+			"nfs-utils",
+			"oddjob",
+			"oddjob-mkhomedir",
+			"psmisc",
+			"python3-jsonschema",
+			"qemu-guest-agent",
+			"redhat-release",
+			"redhat-release-eula",
+			"rsync",
+			"tar",
+			"tcpdump",
+		},
+		Exclude: []string{
+			"aic94xx-firmware",
+			"alsa-firmware",
+			"alsa-lib",
+			"alsa-tools-firmware",
+			"biosdevname",
+			"dnf-plugin-spacewalk",
+			"fedora-release",
+			"fedora-repos",
+			"iprutils",
+			"ivtv-firmware",
+			"langpacks-*",
+			"langpacks-en",
+			"libertas-sd8787-firmware",
+			"nss",
+			"plymouth",
+			"rng-tools",
+			"udisks2",
+		},
+	}.Append(coreOsCommonPackageSet(t)).Append(distroSpecificPackageSet(t))
+
+	// Ensure to not pull in subscription-manager on non-RHEL distro
+	if t.arch.distro.isRHEL() {
+		ps = ps.Append(rpmmd.PackageSet{
+			Include: []string{
+				"subscription-manager-cockpit",
+			},
+		})
+	}
+
+	return ps
+}
+
+func openstackCommonPackageSet(t *imageType) rpmmd.PackageSet {
+	ps := rpmmd.PackageSet{
+		Include: []string{
+			// Defaults
+			"langpacks-en",
+			"firewalld",
+
+			// From the lorax kickstart
+			"cloud-init",
+			"qemu-guest-agent",
+			"spice-vdagent",
+		},
+		Exclude: []string{
+			"rng-tools",
+		},
+	}.Append(coreOsCommonPackageSet(t))
+
+	if t.arch.Name() == platform.ARCH_X86_64.String() {
+		ps = ps.Append(rpmmd.PackageSet{
+			Include: []string{
+				// packages below used to come from @core group and were not excluded
+				// they may not be needed at all, but kept them here to not need
+				// to exclude them instead in all other images
+				"iwl100-firmware",
+				"iwl105-firmware",
+				"iwl135-firmware",
+				"iwl1000-firmware",
+				"iwl2000-firmware",
+				"iwl2030-firmware",
+				"iwl3160-firmware",
+				"iwl5000-firmware",
+				"iwl5150-firmware",
+				"iwl6000g2a-firmware",
+				"iwl6050-firmware",
+				"iwl7260-firmware",
+			},
+		})
+	}
+
+	return ps
+}
+
+func qcowImageConfig(d distribution) *distro.ImageConfig {
+	ic := &distro.ImageConfig{
+		DefaultTarget: common.ToPtr("multi-user.target"),
+	}
+	if d.isRHEL() {
+		ic.RHSMConfig = map[subscription.RHSMStatus]*osbuild.RHSMStageOptions{
+			subscription.RHSMConfigNoSubscription: {
+				DnfPlugins: &osbuild.RHSMStageOptionsDnfPlugins{
+					ProductID: &osbuild.RHSMStageOptionsDnfPlugin{
+						Enabled: false,
+					},
+					SubscriptionManager: &osbuild.RHSMStageOptionsDnfPlugin{
+						Enabled: false,
+					},
+				},
+			},
+		}
+
+	}
+	return ic
+}
+
+func mkQcow2ImgType(d distribution) imageType {
+	it := imageType{
+		name:          "qcow2",
+		filename:      "disk.qcow2",
+		mimeType:      "application/x-qemu-disk",
+		kernelOptions: "console=tty0 console=ttyS0,115200n8 no_timer_check net.ifnames=0",
+		packageSets: map[string]packageSetFunc{
+			osPkgsKey: qcow2CommonPackageSet,
+		},
+		bootable:            true,
+		defaultSize:         10 * common.GibiByte,
+		image:               liveImage,
+		buildPipelines:      []string{"build"},
+		payloadPipelines:    []string{"os", "image", "qcow2"},
+		exports:             []string{"qcow2"},
+		basePartitionTables: defaultBasePartitionTables,
+	}
+	it.defaultImageConfig = qcowImageConfig(d)
+	return it
+}

vendor/github.com/osbuild/images/pkg/distro/rhel9/sap.go

@@ -0,0 +1,176 @@
+package rhel9
+
+import (
+	"github.com/osbuild/images/pkg/distro"
+	"github.com/osbuild/images/pkg/osbuild"
+	"github.com/osbuild/images/pkg/rpmmd"
+)
+
+// sapImageConfig returns the SAP specific ImageConfig data
+func sapImageConfig(osVersion string) *distro.ImageConfig {
+	return &distro.ImageConfig{
+		SELinuxConfig: &osbuild.SELinuxConfigStageOptions{
+			State: osbuild.SELinuxStatePermissive,
+		},
+		// RHBZ#1960617
+		Tuned: osbuild.NewTunedStageOptions("sap-hana"),
+		// RHBZ#1959979
+		Tmpfilesd: []*osbuild.TmpfilesdStageOptions{
+			osbuild.NewTmpfilesdStageOptions("sap.conf",
+				[]osbuild.TmpfilesdConfigLine{
+					{
+						Type: "x",
+						Path: "/tmp/.sap*",
+					},
+					{
+						Type: "x",
+						Path: "/tmp/.hdb*lock",
+					},
+					{
+						Type: "x",
+						Path: "/tmp/.trex*lock",
+					},
+				},
+			),
+		},
+		// RHBZ#1959963
+		PamLimitsConf: []*osbuild.PamLimitsConfStageOptions{
+			osbuild.NewPamLimitsConfStageOptions("99-sap.conf",
+				[]osbuild.PamLimitsConfigLine{
+					{
+						Domain: "@sapsys",
+						Type:   osbuild.PamLimitsTypeHard,
+						Item:   osbuild.PamLimitsItemNofile,
+						Value:  osbuild.PamLimitsValueInt(1048576),
+					},
+					{
+						Domain: "@sapsys",
+						Type:   osbuild.PamLimitsTypeSoft,
+						Item:   osbuild.PamLimitsItemNofile,
+						Value:  osbuild.PamLimitsValueInt(1048576),
+					},
+					{
+						Domain: "@dba",
+						Type:   osbuild.PamLimitsTypeHard,
+						Item:   osbuild.PamLimitsItemNofile,
+						Value:  osbuild.PamLimitsValueInt(1048576),
+					},
+					{
+						Domain: "@dba",
+						Type:   osbuild.PamLimitsTypeSoft,
+						Item:   osbuild.PamLimitsItemNofile,
+						Value:  osbuild.PamLimitsValueInt(1048576),
+					},
+					{
+						Domain: "@sapsys",
+						Type:   osbuild.PamLimitsTypeHard,
+						Item:   osbuild.PamLimitsItemNproc,
+						Value:  osbuild.PamLimitsValueUnlimited,
+					},
+					{
+						Domain: "@sapsys",
+						Type:   osbuild.PamLimitsTypeSoft,
+						Item:   osbuild.PamLimitsItemNproc,
+						Value:  osbuild.PamLimitsValueUnlimited,
+					},
+					{
+						Domain: "@dba",
+						Type:   osbuild.PamLimitsTypeHard,
+						Item:   osbuild.PamLimitsItemNproc,
+						Value:  osbuild.PamLimitsValueUnlimited,
+					},
+					{
+						Domain: "@dba",
+						Type:   osbuild.PamLimitsTypeSoft,
+						Item:   osbuild.PamLimitsItemNproc,
+						Value:  osbuild.PamLimitsValueUnlimited,
+					},
+				},
+			),
+		},
+		// RHBZ#1959962
+		Sysctld: []*osbuild.SysctldStageOptions{
+			osbuild.NewSysctldStageOptions("sap.conf",
+				[]osbuild.SysctldConfigLine{
+					{
+						Key:   "kernel.pid_max",
+						Value: "4194304",
+					},
+					{
+						Key:   "vm.max_map_count",
+						Value: "2147483647",
+					},
+				},
+			),
+		},
+		// E4S/EUS
+		DNFConfig: []*osbuild.DNFConfigStageOptions{
+			osbuild.NewDNFConfigStageOptions(
+				[]osbuild.DNFVariable{
+					{
+						Name:  "releasever",
+						Value: osVersion,
+					},
+				},
+				nil,
+			),
+		},
+	}
+}
+
+func SapPackageSet(t *imageType) rpmmd.PackageSet {
+	return rpmmd.PackageSet{
+		Include: []string{
+			// RHBZ#2076763
+			"@Server",
+			// SAP System Roles
+			// https://access.redhat.com/sites/default/files/attachments/rhel_system_roles_for_sap_1.pdf
+			"ansible-core",
+			"rhel-system-roles-sap",
+			// RHBZ#1959813
+			"bind-utils",
+			"nfs-utils",
+			"tcsh",
+			// RHBZ#1959955
+			"uuidd",
+			// RHBZ#1959923
+			"cairo",
+			"expect",
+			"graphviz",
+			"gtk2",
+			"iptraf-ng",
+			"krb5-workstation",
+			"libaio",
+			"libatomic",
+			"libcanberra-gtk2",
+			"libicu",
+			"libtool-ltdl",
+			"lm_sensors",
+			"net-tools",
+			"numactl",
+			"PackageKit-gtk3-module",
+			"xorg-x11-xauth",
+			// RHBZ#1960617
+			"tuned-profiles-sap-hana",
+			// RHBZ#1961168
+			"libnsl",
+		},
+		Exclude: []string{
+			// COMPOSER-1829
+			"firewalld",
+			"iwl1000-firmware",
+			"iwl100-firmware",
+			"iwl105-firmware",
+			"iwl135-firmware",
+			"iwl2000-firmware",
+			"iwl2030-firmware",
+			"iwl3160-firmware",
+			"iwl5000-firmware",
+			"iwl5150-firmware",
+			"iwl6000g2a-firmware",
+			"iwl6000g2b-firmware",
+			"iwl6050-firmware",
+			"iwl7260-firmware",
+		},
+	}
+}

vendor/github.com/osbuild/images/pkg/distro/rhel9/vmdk.go

@@ -0,0 +1,89 @@
+package rhel9
+
+import (
+	"github.com/osbuild/images/internal/common"
+	"github.com/osbuild/images/pkg/distro"
+	"github.com/osbuild/images/pkg/platform"
+	"github.com/osbuild/images/pkg/rpmmd"
+)
+
+const vmdkKernelOptions = "ro net.ifnames=0"
+
+var vmdkImgType = imageType{
+	name:     "vmdk",
+	filename: "disk.vmdk",
+	mimeType: "application/x-vmdk",
+	packageSets: map[string]packageSetFunc{
+		osPkgsKey: vmdkCommonPackageSet,
+	},
+	defaultImageConfig: &distro.ImageConfig{
+		Locale: common.ToPtr("en_US.UTF-8"),
+	},
+	kernelOptions:       vmdkKernelOptions,
+	bootable:            true,
+	defaultSize:         4 * common.GibiByte,
+	image:               liveImage,
+	buildPipelines:      []string{"build"},
+	payloadPipelines:    []string{"os", "image", "vmdk"},
+	exports:             []string{"vmdk"},
+	basePartitionTables: defaultBasePartitionTables,
+}
+
+var ovaImgType = imageType{
+	name:     "ova",
+	filename: "image.ova",
+	mimeType: "application/ovf",
+	packageSets: map[string]packageSetFunc{
+		osPkgsKey: vmdkCommonPackageSet,
+	},
+	defaultImageConfig: &distro.ImageConfig{
+		Locale: common.ToPtr("en_US.UTF-8"),
+	},
+	kernelOptions:       vmdkKernelOptions,
+	bootable:            true,
+	defaultSize:         4 * common.GibiByte,
+	image:               liveImage,
+	buildPipelines:      []string{"build"},
+	payloadPipelines:    []string{"os", "image", "vmdk", "ovf", "archive"},
+	exports:             []string{"archive"},
+	basePartitionTables: defaultBasePartitionTables,
+}
+
+func vmdkCommonPackageSet(t *imageType) rpmmd.PackageSet {
+	ps := rpmmd.PackageSet{
+		Include: []string{
+			"chrony",
+			"cloud-init",
+			"firewalld",
+			"langpacks-en",
+			"open-vm-tools",
+		},
+		Exclude: []string{
+			"rng-tools",
+		},
+	}.Append(coreOsCommonPackageSet(t))
+
+	if t.arch.Name() == platform.ARCH_X86_64.String() {
+		ps = ps.Append(rpmmd.PackageSet{
+			Include: []string{
+				// packages below used to come from @core group and were not excluded
+				// they may not be needed at all, but kept them here to not need
+				// to exclude them instead in all other images
+				"iwl100-firmware",
+				"iwl105-firmware",
+				"iwl135-firmware",
+				"iwl1000-firmware",
+				"iwl2000-firmware",
+				"iwl2030-firmware",
+				"iwl3160-firmware",
+				"iwl5000-firmware",
+				"iwl5150-firmware",
+				"iwl6000g2a-firmware",
+				"iwl6050-firmware",
+				"iwl7260-firmware",
+			},
+		})
+	}
+
+	return ps
+}

vendor/github.com/osbuild/images/pkg/distro/test_distro/distro.go

@@ -0,0 +1,435 @@
+package test_distro
+
+import (
+	"crypto/sha256"
+	"errors"
+	"fmt"
+	"sort"
+
+	dnfjson_mock "github.com/osbuild/images/internal/mocks/dnfjson"
+	"github.com/osbuild/images/pkg/blueprint"
+	"github.com/osbuild/images/pkg/container"
+	"github.com/osbuild/images/pkg/distro"
+	"github.com/osbuild/images/pkg/distroregistry"
+	"github.com/osbuild/images/pkg/manifest"
+	"github.com/osbuild/images/pkg/ostree"
+	"github.com/osbuild/images/pkg/rpmmd"
+)
+
+const (
+	// package set names
+
+	// build package set name
+	buildPkgsKey = "build"
+
+	// main/common os image package set name
+	osPkgsKey = "os"
+
+	// blueprint package set name
+	blueprintPkgsKey = "blueprint"
+)
+
+type TestDistro struct {
+	name             string
+	releasever       string
+	modulePlatformID string
+	ostreeRef        string
+	arches           map[string]distro.Arch
+}
+
+type TestArch struct {
+	distribution *TestDistro
+	name         string
+	imageTypes   map[string]distro.ImageType
+}
+
+type TestImageType struct {
+	architecture *TestArch
+	name         string
+}
+
+const (
+	TestDistroName              = "test-distro"
+	TestDistro2Name             = "test-distro-2"
+	TestDistroReleasever        = "1"
+	TestDistro2Releasever       = "2"
+	TestDistroModulePlatformID  = "platform:test"
+	TestDistro2ModulePlatformID = "platform:test-2"
+
+	TestArchName  = "test_arch"
+	TestArch2Name = "test_arch2"
+	TestArch3Name = "test_arch3"
+
+	TestImageTypeName   = "test_type"
+	TestImageType2Name  = "test_type2"
+	TestImageTypeOSTree = "test_ostree_type"
+
+	// added for cloudapi tests
+	TestImageTypeAmi            = "ami"
+	TestImageTypeGce            = "gce"
+	TestImageTypeVhd            = "vhd"
+	TestImageTypeEdgeCommit     = "rhel-edge-commit"
+	TestImageTypeEdgeInstaller  = "rhel-edge-installer"
+	TestImageTypeImageInstaller = "image-installer"
+	TestImageTypeQcow2          = "qcow2"
+	TestImageTypeVmdk           = "vmdk"
+)
+
+// TestDistro
+
+func (d *TestDistro) Name() string {
+	return d.name
+}
+
+func (d *TestDistro) Releasever() string {
+	return d.releasever
+}
+
+func (d *TestDistro) ModulePlatformID() string {
+	return d.modulePlatformID
+}
+
+func (d *TestDistro) OSTreeRef() string {
+	return d.ostreeRef
+}
+
+func (d *TestDistro) ListArches() []string {
+	archs := make([]string, 0, len(d.arches))
+	for name := range d.arches {
+		archs = append(archs, name)
+	}
+	sort.Strings(archs)
+	return archs
+}
+
+func (d *TestDistro) GetArch(arch string) (distro.Arch, error) {
+	a, exists := d.arches[arch]
+	if !exists {
+		return nil, errors.New("invalid arch: " + arch)
+	}
+	return a, nil
+}
+
+func (d *TestDistro) addArches(arches ...*TestArch) {
+	if d.arches == nil {
+		d.arches = map[string]distro.Arch{}
+	}
+
+	for _, a := range arches {
+		a.distribution = d
+		d.arches[a.Name()] = a
+	}
+}
+
+// TestArch
+
+func (a *TestArch) Name() string {
+	return a.name
+}
+
+func (a *TestArch) Distro() distro.Distro {
+	return a.distribution
+}
+
+func (a *TestArch) ListImageTypes() []string {
+	formats := make([]string, 0, len(a.imageTypes))
+	for name := range a.imageTypes {
+		formats = append(formats, name)
+	}
+	sort.Strings(formats)
+	return formats
+}
+
+func (a *TestArch) GetImageType(imageType string) (distro.ImageType, error) {
+	t, exists := a.imageTypes[imageType]
+	if !exists {
+		return nil, errors.New("invalid image type: " + imageType)
+	}
+
+	return t, nil
+}
+
+func (a *TestArch) addImageTypes(imageTypes ...TestImageType) {
+	if a.imageTypes == nil {
+		a.imageTypes = map[string]distro.ImageType{}
+	}
+	for idx := range imageTypes {
+		it := imageTypes[idx]
+		it.architecture = a
+		a.imageTypes[it.Name()] = &it
+	}
+}
+
+// TestImageType
+
+func (t *TestImageType) Name() string {
+	return t.name
+}
+
+func (t *TestImageType) Arch() distro.Arch {
+	return t.architecture
+}
+
+func (t *TestImageType) Filename() string {
+	return "test.img"
+}
+
+func (t *TestImageType) MIMEType() string {
+	return "application/x-test"
+}
+
+func (t *TestImageType) OSTreeRef() string {
+	if t.name == TestImageTypeEdgeCommit || t.name == TestImageTypeEdgeInstaller || t.name == TestImageTypeOSTree {
+		return t.architecture.distribution.OSTreeRef()
+	}
+	return ""
+}
+
+func (t *TestImageType) Size(size uint64) uint64 {
+	return 0
+}
+
+func (t *TestImageType) PartitionType() string {
+	return ""
+}
+
+func (t *TestImageType) BootMode() distro.BootMode {
+	return distro.BOOT_HYBRID
+}
+
+func (t *TestImageType) BuildPipelines() []string {
+	return distro.BuildPipelinesFallback()
+}
+
+func (t *TestImageType) PayloadPipelines() []string {
+	return distro.PayloadPipelinesFallback()
+}
+
+func (t *TestImageType) PayloadPackageSets() []string {
+	return []string{blueprintPkgsKey}
+}
+
+func (t *TestImageType) PackageSetsChains() map[string][]string {
+	return map[string][]string{
+		osPkgsKey: {osPkgsKey, blueprintPkgsKey},
+	}
+}
+
+func (t *TestImageType) Exports() []string {
+	return distro.ExportsFallback()
+}
+
+func (t *TestImageType) Manifest(b *blueprint.Blueprint, options distro.ImageOptions, repos []rpmmd.RepoConfig, seed int64) (*manifest.Manifest, []string, error) {
+	var bpPkgs []string
+	if b != nil {
+		mountpoints := b.Customizations.GetFilesystems()
+
+		invalidMountpoints := []string{}
+		for _, m := range mountpoints {
+			if m.Mountpoint != "/" {
+				invalidMountpoints = append(invalidMountpoints, m.Mountpoint)
+			}
+		}
+
+		if len(invalidMountpoints) > 0 {
+			return nil, nil, fmt.Errorf("The following custom mountpoints are not supported %+q", invalidMountpoints)
+		}
+
+		bpPkgs = b.GetPackages()
+	}
+
+	var ostreeSources []ostree.SourceSpec
+	if defaultRef := t.OSTreeRef(); defaultRef != "" {
+		// ostree image type
+		ostreeSource := ostree.SourceSpec{ // init with default
+			Ref: defaultRef,
+		}
+		if ostreeOptions := options.OSTree; ostreeOptions != nil {
+			// handle the parameter combo error like we do in distros
+			if ostreeOptions.ParentRef != "" && ostreeOptions.URL == "" {
+				// specifying parent ref also requires URL
+				return nil, nil, ostree.NewParameterComboError("ostree parent ref specified, but no URL to retrieve it")
+			}
+			if ostreeOptions.ImageRef != "" { // override with ref from image options
+				ostreeSource.Ref = ostreeOptions.ImageRef
+			}
+			if ostreeOptions.ParentRef != "" { // override with parent ref
+				ostreeSource.Ref = ostreeOptions.ParentRef
+			}
+			// copy any other options that might be specified
+			ostreeSource.URL = options.OSTree.URL
+			ostreeSource.RHSM = options.OSTree.RHSM
+		}
+		ostreeSources = []ostree.SourceSpec{ostreeSource}
+	}
+
+	buildPackages := []rpmmd.PackageSet{{
+		Include: []string{
+			"dep-package1",
+			"dep-package2",
+			"dep-package3",
+		},
+		Repositories: repos,
+	}}
+	osPackages := []rpmmd.PackageSet{
+		{
+			Include:      bpPkgs,
+			Repositories: repos,
+		},
+		{
+			Include: []string{
+				"dep-package1",
+				"dep-package2",
+				"dep-package3",
+			},
+			Repositories: repos,
+		},
+	}
+
+	m := &manifest.Manifest{}
+
+	manifest.NewContentTest(m, buildPkgsKey, buildPackages, nil, nil)
+	manifest.NewContentTest(m, osPkgsKey, osPackages, nil, ostreeSources)
+
+	return m, nil, nil
+}
+
+// newTestDistro returns a new instance of TestDistro with the
+// given name and modulePlatformID.
+//
+// It contains two architectures "test_arch" and "test_arch2".
+// "test_arch" contains one image type "test_type".
+// "test_arch2" contains two image types "test_type" and "test_type2".
+func newTestDistro(name, modulePlatformID, releasever string) *TestDistro {
+	td := TestDistro{
+		name:             name,
+		releasever:       releasever,
+		modulePlatformID: modulePlatformID,
+		ostreeRef:        "test/13/x86_64/edge",
+	}
+
+	ta1 := TestArch{
+		name: TestArchName,
+	}
+
+	ta2 := TestArch{
+		name: TestArch2Name,
+	}
+
+	ta3 := TestArch{
+		name: TestArch3Name,
+	}
+
+	it1 := TestImageType{
+		name: TestImageTypeName,
+	}
+
+	it2 := TestImageType{
+		name: TestImageType2Name,
+	}
+
+	it3 := TestImageType{
+		name: TestImageTypeAmi,
+	}
+
+	it4 := TestImageType{
+		name: TestImageTypeVhd,
+	}
+
+	it5 := TestImageType{
+		name: TestImageTypeEdgeCommit,
+	}
+
+	it6 := TestImageType{
+		name: TestImageTypeEdgeInstaller,
+	}
+
+	it7 := TestImageType{
+		name: TestImageTypeImageInstaller,
+	}
+
+	it8 := TestImageType{
+		name: TestImageTypeQcow2,
+	}
+
+	it9 := TestImageType{
+		name: TestImageTypeVmdk,
+	}
+
+	it10 := TestImageType{
+		name: TestImageTypeGce,
+	}
+
+	it11 := TestImageType{
+		name: TestImageTypeOSTree,
+	}
+
+	ta1.addImageTypes(it1, it11)
+	ta2.addImageTypes(it1, it2)
+	ta3.addImageTypes(it3, it4, it5, it6, it7, it8, it9, it10)
+
+	td.addArches(&ta1, &ta2, &ta3)
+
+	return &td
+}
+
+// New returns new instance of TestDistro named "test-distro".
+func New() *TestDistro {
+	return newTestDistro(TestDistroName, TestDistroModulePlatformID, TestDistroReleasever)
+}
+
+func NewRegistry() *distroregistry.Registry {
+	td := New()
+	registry, err := distroregistry.New(td, td)
+	if err != nil {
+		panic(err)
+	}
+
+	// Override the host's architecture name with the test's name
+	registry.SetHostArchName(TestArchName)
+	return registry
+}
+
+// New2 returns new instance of TestDistro named "test-distro-2".
+func New2() *TestDistro {
+	return newTestDistro(TestDistro2Name, TestDistro2ModulePlatformID, TestDistro2Releasever)
+}
+
+// ResolveContent transforms content source specs into resolved specs for serialization.
+// For packages, it uses the dnfjson_mock.BaseDeps() every time, but retains
+// the map keys from the input.
+// For ostree commits it hashes the URL+Ref to create a checksum.
+func ResolveContent(pkgs map[string][]rpmmd.PackageSet, containers map[string][]container.SourceSpec, commits map[string][]ostree.SourceSpec) (map[string][]rpmmd.PackageSpec, map[string][]container.Spec, map[string][]ostree.CommitSpec) {
+
+	pkgSpecs := make(map[string][]rpmmd.PackageSpec, len(pkgs))
+	for name := range pkgs {
+		pkgSpecs[name] = dnfjson_mock.BaseDeps()
+	}
+
+	containerSpecs := make(map[string][]container.Spec, len(containers))
+	for name := range containers {
+		containerSpecs[name] = make([]container.Spec, len(containers[name]))
+		for idx := range containers[name] {
+			containerSpecs[name][idx] = container.Spec{
+				Source:    containers[name][idx].Source,
+				TLSVerify: containers[name][idx].TLSVerify,
+				LocalName: containers[name][idx].Name,
+			}
+		}
+	}
+
+	commitSpecs := make(map[string][]ostree.CommitSpec, len(commits))
+	for name := range commits {
+		commitSpecs[name] = make([]ostree.CommitSpec, len(commits[name]))
+		for idx := range commits[name] {
+			commitSpecs[name][idx] = ostree.CommitSpec{
+				Ref:      commits[name][idx].Ref,
+				URL:      commits[name][idx].URL,
+				Checksum: fmt.Sprintf("%x", sha256.Sum256([]byte(commits[name][idx].URL+commits[name][idx].Ref))),
+			}
+			fmt.Printf("Test distro spec: %+v\n", commitSpecs[name][idx])
+		}
+	}
+
+	return pkgSpecs, containerSpecs, commitSpecs
+}