fedora: set sysroot read-only only for Fedora 37+ iot-raw-image

internal/distro/fedora/images.go

@@ -2,8 +2,10 @@ package fedora
 
 import (
 	"math/rand"
+	"strings"
 
 	"github.com/osbuild/osbuild-composer/internal/blueprint"
+	"github.com/osbuild/osbuild-composer/internal/common"
 	"github.com/osbuild/osbuild-composer/internal/distro"
 	"github.com/osbuild/osbuild-composer/internal/image"
 	"github.com/osbuild/osbuild-composer/internal/manifest"
@@ -281,6 +283,12 @@ func iotRawImage(workload workload.Workload,
 	}
 	img := image.NewOSTreeRawImage(commit)
 
+	// Set sysroot read-only only for Fedora 37+
+	distro := t.Arch().Distro()
+	if strings.HasPrefix(distro.Name(), "fedora") && !common.VersionLessThan(distro.Releasever(), "37") {
+		img.SysrootReadOnly = true
+	}
+
 	img.Users = users.UsersFromBP(customizations.GetUsers())
 	img.Groups = users.GroupsFromBP(customizations.GetGroups())
 

test/data/manifests/fedora_35-aarch64-iot_raw_image-boot.json

@@ -1856,7 +1856,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": true,
+                  "readonly": false,
                   "bootloader": "none"
                 }
               }

test/data/manifests/fedora_35-x86_64-iot_raw_image-boot.json

@@ -1880,7 +1880,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": true,
+                  "readonly": false,
                   "bootloader": "none"
                 }
               }

test/data/manifests/fedora_36-aarch64-iot_raw_image-boot.json

@@ -2104,7 +2104,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": true,
+                  "readonly": false,
                   "bootloader": "none"
                 }
               }

test/data/manifests/fedora_36-x86_64-iot_raw_image-boot.json

@@ -2128,7 +2128,7 @@
               "repo": "/ostree/repo",
               "config": {
                 "sysroot": {
-                  "readonly": true,
+                  "readonly": false,
                   "bootloader": "none"
                 }
               }