distro: add oscap packages to image

Since the oscap remediation stage in osbuild runs
the oscap package in `chroot`, it is necessary to
install the `openscap-scanner` package to the image
itself rather than the build root.

internal/distro/rhel8/distro.go

@@ -450,13 +450,11 @@ func (t *imageType) PackageSets(bp blueprint.Blueprint, options distro.ImageOpti
 		mergedSets[buildPkgsKey] = mergedSets[buildPkgsKey].Append(extraPkgs)
 	}
 
-	// if oscap customizations are enabled we need to add `openscap-scanner`
+	// if oscap customizations are enabled we need to add
-	// and `scap-security-guides` packages to build root
+	// `openscap-scanner` & `scap-security-guide` packages
+	// to build root
 	if bp.Customizations.GetOpenSCAP() != nil {
-		mergedSets[buildPkgsKey] = mergedSets[buildPkgsKey].Append(rpmmd.PackageSet{Include: []string{
+		bpPackages = append(bpPackages, "openscap-scanner", "scap-security-guide")
-			"openscap-scanner",
-			"scap-security-guide",
-		}})
 	}
 
 	// depsolve bp packages separately

internal/distro/rhel9/distro.go

@@ -386,13 +386,11 @@ func (t *imageType) PackageSets(bp blueprint.Blueprint, options distro.ImageOpti
 		mergedSets[buildPkgsKey] = mergedSets[buildPkgsKey].Append(extraPkgs)
 	}
 
-	// if oscap customizations are enabled we need to add `openscap-scanner`
+	// if oscap customizations are enabled we need to add
-	// and `scap-security-guides` packages to build root
+	// `openscap-scanner` & `scap-security-guide` packages
+	// to build root
 	if bp.Customizations.GetOpenSCAP() != nil {
-		mergedSets[buildPkgsKey] = mergedSets[buildPkgsKey].Append(rpmmd.PackageSet{Include: []string{
+		bpPackages = append(bpPackages, "openscap-scanner", "scap-security-guide")
-			"openscap-scanner",
-			"scap-security-guide",
-		}})
 	}
 
 	// depsolve bp packages separately

internal/manifest/os.go

@@ -155,6 +155,10 @@ func (p *OS) getPackageSetChain() []rpmmd.PackageSet {
 		packages = append(packages, fmt.Sprintf("selinux-policy-%s", p.SElinux))
 	}
 
+	if p.OpenSCAPConfig != nil {
+		packages = append(packages, "openscap-scanner", "scap-security-guide")
+	}
+
 	chain := []rpmmd.PackageSet{
 		{
 			Include:      append(packages, p.ExtraBasePackages...),
@@ -186,9 +190,6 @@ func (p *OS) getBuildPackages() []string {
 		packages = append(packages, "policycoreutils")
 		packages = append(packages, fmt.Sprintf("selinux-policy-%s", p.SElinux))
 	}
-	if p.OpenSCAPConfig != nil {
-		packages = append(packages, "openscap-scanner", "scap-security-guide")
-	}
 	return packages
 }
 

test/cases/oscap.sh

@@ -373,14 +373,6 @@ version = "0.0.1"
 modules = []
 groups = []
 
-[[ packages ]]
-name = "openscap-scanner"
-version = "*"
-
-[[ packages ]]
-name = "scap-security-guide"
-version = "*"
-
 [customizations.openscap]
 profile_id = "${PROFILE}"
 datastream = "${DATASTREAM}"