Repository: osbuild/osbuild-composer
Pull request #3972 (2024-02-22 16:21:44)

Enable masked systemd services in cloudapi (HMS-3661)
This pull request includes:
This PR adds support for `masked` systemd services via the cloud API.

- [ ] adequate testing for the new functionality or fixed issue
- [ ] adequate documentation informing people about the change such as
  - [ ] submit a PR for the [guides](https://github.com/osbuild/guides) repository if this PR changed any behavior described there: https://www.osbuild.org/guides/

Depends on:
https://github.com/osbuild/images/pull/464

<!--
Thanks for proposing a change to osbuild-composer!

Please don't remove the above check list. These are things that each pull
request must have before it is merged. It helps maintainers to not forget
anything.

If the reason for ticking any of the boxes is ambiguous, please add a short
note explaining why.

In addition, if this pull request fixes a downstream issue, please refer to
test/README.md and add these additional items:

- [ ] 1st commit of any `rhbz#` related PR contains bug reproducer; CI reports FAIL or
- [ ] PR contains automated tests for new functionality and
- [ ] QE has approved reproducer/new tests and
- [ ] Subsequent commits provide bug fixes without modifying the reproducer; CI reports PASS and
- [ ] QE approves this PR; RHBZ status is set to `MODIFIED + Verified=Tested`

Information regarding our GitLab pipeline (Schutzbot):

CI will not be ran automatically if WIP label is applied or the PR is in DRAFT state, instead only
a link will be provided to the pipeline which can then be triggered manually if desired. To run the
CI automatically either switch the PR to ready or apply WIP+test label.

Outside contributors need manual approval from one of the osbuild-composer maintainers.

Schutzbot will only be triggered if all Tests jobs in GitHub workflow succeed.
-->


thozza: Converted to draft, since it needs the change to land in `images` first.

Patch:
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index 93531e2cc..71154ce5b 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -3,7 +3,8 @@ This pull request includes:
 
 - [ ] adequate testing for the new functionality or fixed issue
 - [ ] adequate documentation informing people about the change such as
-  - [ ] submit a PR for the [guides](https://github.com/osbuild/guides) repository if this PR changed any behavior described there: https://www.osbuild.org/guides/
+  - [ ] submit a PR for the READMEs [listed here](https://github.com/osbuild/osbuild.github.io/blob/main/readme-list)
+  - [ ] submit a PR for the [osbuild.org website](https://github.com/osbuild/osbuild.github.io/) repository if this PR changed any behavior not covered by the automatically updated READMEs
 
 <!--
 Thanks for proposing a change to osbuild-composer!
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 39fb2a227..f0b26e2a4 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -3,7 +3,7 @@
 First of all, thank you for taking the time to contribute to osbuild-composer.
 In this document you will find information that can help you with your
 contribution.
-For more information feel free to read our [developer guide](https://www.osbuild.org/guides/developer-guide/developer-guide.html).
+For more information feel free to read our [developer guide](https://www.osbuild.org/docs/developer-guide/index).
 
 ### Running from sources
 
diff --git a/cmd/osbuild-worker/jobimpl-container-resolve.go b/cmd/osbuild-worker/jobimpl-container-resolve.go
index 05af551f3..2ea8cb2c1 100644
--- a/cmd/osbuild-worker/jobimpl-container-resolve.go
+++ b/cmd/osbuild-worker/jobimpl-container-resolve.go
@@ -32,7 +32,7 @@ func (impl *ContainerResolveJobImpl) Run(job worker.Job) error {
 	resolver.AuthFilePath = impl.AuthFilePath
 
 	for _, s := range args.Specs {
-		resolver.Add(container.SourceSpec{s.Source, s.Name, nil, s.TLSVerify, nil, nil})
+		resolver.Add(container.SourceSpec{s.Source, s.Name, nil, s.TLSVerify, false})
 	}
 
 	specs, err := resolver.Finish()
diff --git a/go.mod b/go.mod
index f571516f5..d65f08602 100644
--- a/go.mod
+++ b/go.mod
@@ -16,7 +16,7 @@ require (
 	github.com/Azure/go-autorest/autorest v0.11.29
 	github.com/Azure/go-autorest/autorest/azure/auth v0.5.12
 	github.com/BurntSushi/toml v1.3.2
-	github.com/aws/aws-sdk-go v1.50.24
+	github.com/aws/aws-sdk-go v1.50.27
 	github.com/coreos/go-semver v0.3.1
 	github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf
 	github.com/deepmap/oapi-codegen v1.8.2
@@ -26,7 +26,7 @@ require (
 	github.com/golang-jwt/jwt/v4 v4.5.0
 	github.com/google/go-cmp v0.6.0
 	github.com/google/uuid v1.6.0
-	github.com/gophercloud/gophercloud v1.9.0
+	github.com/gophercloud/gophercloud v1.10.0
 	github.com/hashicorp/go-retryablehttp v0.7.5
 	github.com/jackc/pgtype v1.14.1
 	github.com/jackc/pgx/v4 v4.18.1
@@ -36,7 +36,7 @@ require (
 	github.com/labstack/gommon v0.4.2
 	github.com/openshift-online/ocm-sdk-go v0.1.398
 	github.com/oracle/oci-go-sdk/v54 v54.0.0
-	github.com/osbuild/images v0.40.0
+	github.com/osbuild/images v0.41.0
 	github.com/osbuild/osbuild-composer/pkg/splunk_logger v0.0.0-20231117174845-e969a9dc3cd1
 	github.com/osbuild/pulp-client v0.1.0
 	github.com/prometheus/client_golang v1.18.0
@@ -50,7 +50,7 @@ require (
 	golang.org/x/oauth2 v0.17.0
 	golang.org/x/sync v0.6.0
 	golang.org/x/sys v0.17.0
-	google.golang.org/api v0.166.0
+	google.golang.org/api v0.167.0
 )
 
 require (
diff --git a/go.sum b/go.sum
index 5996751f2..e51e61a55 100644
--- a/go.sum
+++ b/go.sum
@@ -76,8 +76,8 @@ github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d/go.mod h1:asat6
 github.com/asaskevich/govalidator v0.0.0-20200907205600-7a23bdc65eef/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
-github.com/aws/aws-sdk-go v1.50.24 h1:3o2Pg7mOoVL0jv54vWtuafoZqAeEXLhm1tltWA2GcEw=
-github.com/aws/aws-sdk-go v1.50.24/go.mod h1:LF8svs817+Nz+DmiMQKTO3ubZ/6IaTpq3TjupRn3Eqk=
+github.com/aws/aws-sdk-go v1.50.27 h1:96ifhrSuja+AzdP3W/T2337igqVQ2FcSIJYkk+0rCeA=
+github.com/aws/aws-sdk-go v1.50.27/go.mod h1:LF8svs817+Nz+DmiMQKTO3ubZ/6IaTpq3TjupRn3Eqk=
 github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuPk=
 github.com/aymerick/douceur v0.2.0/go.mod h1:wlT5vV2O3h55X9m7iVYN0TBM0NH/MmbLnd30/FjWUq4=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
@@ -307,8 +307,8 @@ github.com/googleapis/enterprise-certificate-proxy v0.3.2 h1:Vie5ybvEvT75RniqhfF
 github.com/googleapis/enterprise-certificate-proxy v0.3.2/go.mod h1:VLSiSSBs/ksPL8kq3OBOQ6WRI2QnaFynd1DCjZ62+V0=
 github.com/googleapis/gax-go/v2 v2.12.1 h1:9F8GV9r9ztXyAi00gsMQHNoF51xPZm8uj1dpYt2ZETM=
 github.com/googleapis/gax-go/v2 v2.12.1/go.mod h1:61M8vcyyXR2kqKFxKrfA22jaA8JGF7Dc8App1U3H6jc=
-github.com/gophercloud/gophercloud v1.9.0 h1:zKvmHOmHuaZlnx9d2DJpEgbMxrGt/+CJ/bKOKQh9Xzo=
-github.com/gophercloud/gophercloud v1.9.0/go.mod h1:aAVqcocTSXh2vYFZ1JTvx4EQmfgzxRcNupUfxZbBNDM=
+github.com/gophercloud/gophercloud v1.10.0 h1:watRMsaMDlSLuLkpLeLSQ87yvcuwIajNg6A5uLcjoIU=
+github.com/gophercloud/gophercloud v1.10.0/go.mod h1:aAVqcocTSXh2vYFZ1JTvx4EQmfgzxRcNupUfxZbBNDM=
 github.com/gorilla/css v1.0.0 h1:BQqNyPTi50JCFMTw/b67hByjMVXZRwGha6wxVGkeihY=
 github.com/gorilla/css v1.0.0/go.mod h1:Dn721qIggHpt4+EFCcTLTU/vk5ySda2ReITrtgBl60c=
 github.com/gorilla/mux v1.8.0 h1:i40aqfkR1h2SlN9hojwV5ZA91wcXFOvkdNIeFDP5koI=
@@ -503,8 +503,8 @@ github.com/openshift-online/ocm-sdk-go v0.1.398 h1:6C1mDcPxzG4jSduOaWixTTI5gSEO+
 github.com/openshift-online/ocm-sdk-go v0.1.398/go.mod h1:tke8vKcE7eHKyRbkJv6qo4ljo919zhx04uyQTcgF5cQ=
 github.com/oracle/oci-go-sdk/v54 v54.0.0 h1:CDLjeSejv2aDpElAJrhKpi6zvT/zhZCZuXchUUZ+LS4=
 github.com/oracle/oci-go-sdk/v54 v54.0.0/go.mod h1:+t+yvcFGVp+3ZnztnyxqXfQDsMlq8U25faBLa+mqCMc=
-github.com/osbuild/images v0.40.0 h1:aVlg1+0CiVY6ViuEAMjEIBXvXfTtbKGHHIgQ8N95YWE=
-github.com/osbuild/images v0.40.0/go.mod h1:RyfQIjcdjGQ+wKcqLCd5KrCixO0xsDRaDYCgorPFVXk=
+github.com/osbuild/images v0.41.0 h1:KYQnk00oubMr3QlUd2P9UAunZu8FQUrG8g8R3IbNqEI=
+github.com/osbuild/images v0.41.0/go.mod h1:aBpF8Dc2e9MnZSwlAFGEDKHAHzHAqRqyXRWP4HV5Gyo=
 github.com/osbuild/osbuild-composer/pkg/splunk_logger v0.0.0-20231117174845-e969a9dc3cd1 h1:UFEJIcPa46W8gtWgOYzriRKYyy1t6SWL0BI7fPTuVvc=
 github.com/osbuild/osbuild-composer/pkg/splunk_logger v0.0.0-20231117174845-e969a9dc3cd1/go.mod h1:z+WA+dX6qMwc7fqY5jCzESDIlg4WR2sBQezxsoXv9Ik=
 github.com/osbuild/pulp-client v0.1.0 h1:L0C4ezBJGTamN3BKdv+rKLuq/WxXJbsFwz/Hj7aEmJ8=
@@ -816,8 +816,8 @@ golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 h1:+cNy6SZtPcJQH3LJVLOSmiC7MMxXNOb3PU/VUEz+EhU=
-google.golang.org/api v0.166.0 h1:6m4NUwrZYhAaVIHZWxaKjw1L1vNAjtMwORmKRyEEo24=
-google.golang.org/api v0.166.0/go.mod h1:4FcBc686KFi7QI/U51/2GKKevfZMpM17sCdibqe/bSA=
+google.golang.org/api v0.167.0 h1:CKHrQD1BLRii6xdkatBDXyKzM0mkawt2QP+H3LtPmSE=
+google.golang.org/api v0.167.0/go.mod h1:4FcBc686KFi7QI/U51/2GKKevfZMpM17sCdibqe/bSA=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.6.8 h1:IhEN5q69dyKagZPYMSdIjS2HqprW324FRQZJcGqPAsM=
diff --git a/internal/blueprint/blueprint.go b/internal/blueprint/blueprint.go
index a5e0bdb10..600247f11 100644
--- a/internal/blueprint/blueprint.go
+++ b/internal/blueprint/blueprint.go
@@ -48,9 +48,8 @@ type Container struct {
 	Source string `json:"source,omitempty" toml:"source"`
 	Name   string `json:"name,omitempty" toml:"name,omitempty"`
 
-	TLSVerify           *bool   `json:"tls-verify,omitempty" toml:"tls-verify,omitempty"`
-	ContainersTransport *string `json:"containers-transport,omitempty" toml:"containers-transport,omitempty"`
-	StoragePath         *string `json:"source-path,omitempty" toml:"source-path,omitempty"`
+	TLSVerify    *bool `json:"tls-verify,omitempty" toml:"tls-verify,omitempty"`
+	LocalStorage bool  `json:"local-storage,omitempty" toml:"local-storage,omitempty"`
 }
 
 // DeepCopy returns a deep copy of the blueprint
diff --git a/internal/blueprint/customizations.go b/internal/blueprint/customizations.go
index 770413450..ccee534aa 100644
--- a/internal/blueprint/customizations.go
+++ b/internal/blueprint/customizations.go
@@ -109,6 +109,7 @@ type FirewallServicesCustomization struct {
 type ServicesCustomization struct {
 	Enabled  []string `json:"enabled,omitempty" toml:"enabled,omitempty"`
 	Disabled []string `json:"disabled,omitempty" toml:"disabled,omitempty"`
+	Masked   []string `json:"masked,omitempty" toml:"masked,omitempty"`
 }
 
 type OpenSCAPCustomization struct {
diff --git a/internal/cloudapi/v2/compose.go b/internal/cloudapi/v2/compose.go
index 3f5551b41..f31256f86 100644
--- a/internal/cloudapi/v2/compose.go
+++ b/internal/cloudapi/v2/compose.go
@@ -176,6 +176,10 @@ func (request *ComposeRequest) GetCustomizationsFromBlueprintRequest() (*bluepri
 			servicesCustomization.Disabled = make([]string, len(*rbpc.Services.Disabled))
 			copy(servicesCustomization.Disabled, *rbpc.Services.Disabled)
 		}
+		if rbpc.Services.Masked != nil {
+			servicesCustomization.Masked = make([]string, len(*rbpc.Services.Masked))
+			copy(servicesCustomization.Masked, *rbpc.Services.Masked)
+		}
 		c.Services = servicesCustomization
 	}
 
@@ -657,6 +661,10 @@ func (request *ComposeRequest) GetBlueprintFromCustomizations() (blueprint.Bluep
 			servicesCustomization.Disabled = make([]string, len(*request.Customizations.Services.Disabled))
 			copy(servicesCustomization.Disabled, *request.Customizations.Services.Disabled)
 		}
+		if request.Customizations.Services.Masked != nil {
+			servicesCustomization.Masked = make([]string, len(*request.Customizations.Services.Masked))
+			copy(servicesCustomization.Masked, *request.Customizations.Services.Masked)
+		}
 		bp.Customizations.Services = servicesCustomization
 	}
 
diff --git a/internal/cloudapi/v2/openapi.v2.gen.go b/internal/cloudapi/v2/openapi.v2.gen.go
index 3e82c6706..cfba08d29 100644
--- a/internal/cloudapi/v2/openapi.v2.gen.go
+++ b/internal/cloudapi/v2/openapi.v2.gen.go
@@ -994,6 +994,9 @@ type Services struct {
 
 	// List of services to enable by default
 	Enabled *[]string `json:"enabled,omitempty"`
+
+	// List of services to mask by default
+	Masked *[]string `json:"masked,omitempty"`
 }
 
 // Subscription defines model for Subscription.
@@ -1337,177 +1340,177 @@ func RegisterHandlersWithBaseURL(router EchoRouter, si ServerInterface, baseURL
 // Base64 encoded, gzipped, json marshaled Swagger object
 var swaggerSpec = []string{
 
-	"H4sIAAAAAAAC/+x9eXPbOJb4V0Fpuyrdv+g+bDlVXbuyfMm3LdmOPUp5IBIiYZEAA4CS5d5891/hIEVK",
-	"1JW4e3pmM39MxyKOhwe8h3fjj5xF/YASRATPffojF0AGfSQQM385SP7XRtxiOBCYktyn3DV0EMDERq+5",
-	"fA69Qj/wUKr5GHohyn3KVXLfvuVzWPb5GiI2zeVzBPryi2qZz3HLRT6UXcQ0kL9zwTBxVDeO3zLmvgz9",
-	"AWKADgEWyOcAE4Cg5QIzYBKaaIAYmnJ5KTyq7Sp4vkUf1dCth+5hu9r2KEFtiT6uJoK2jSWY0LtmNEBM",
-	"YAnIEHoc5XNB4qc/cgw5aj0LE+Vz3IUMPU+wcJ+hZdHQbIxZWe7TP3KVaq3e2Nlt7pUr1dyXfE5hInMs",
-	"8wNkDE7V2hn6GmKGbDmMgeFL3IwOXpAlZD+9vrvAo9C+Uqjn373AGPAcCgsTxEWhksv/lcvO5ziBAXep",
-	"eNa7nYTJnxair4tQZSMsG9Z1aOwKKEJNJSlEQR+nIYI+LpStZq28u1fb3W009hp2fZCFsS1RPLcYOW9+",
-	"zRno1n7kCAThwMOWJuEhDD0Rt0uTdGcIOBJAUKA+g1+Fi4DpAhTx/pYHEHiUOHlAB8OQW1AgG9zdnvcJ",
-	"5oAhETKC7CLoCA7Qa4AZlEMDHzuuAAMEOKUEMSBcSMCQMkCFixgI1dr6REDmIMGLfdInM1gEC5GclruU",
-	"CcTkbCAxGYDE7hOcnhBzIGHn0EcAcjWV/Ds5HZjNNtuiAaUeguTHN3Wz7Vx2FEPmZbPi5BSyUeb4byFD",
-	"P3JcsA8dFFPoHNeXGKVDhU2NR2QD1UFuOvBDrvY5JPhrKK8m1dDBY0QAQ5yGzELAYTQMimqL5SRys6iP",
-	"hTxJQ0Z91UUuFHEh951BYlMfUILAAHJkA0oABHd3nQOAeZ84iCAmj6HeyBRDUYBlUaxHLSjM9qYXeG6+",
-	"RIsMGB1jucgI/GcFfh5MXMSQaqJmkccz9Gy1+AgvkMhuDuYCMQXfCZ3IE+1hLgD0PBCBwT/1iStEwD+V",
-	"Sja1eNHHFqOcDkXRon4JkULIS5aHS1Dubcmwuv8eYzT5Xf1UsDxc8KBAXPwXfIt44bOc6Dme5INCuYQ4",
-	"+kminlABeIAsPMTIzgMs5I82skMrtSFL8DCPdEkeKJTHKZtRJvuuPl3p47IBuudB6dHQguTWDHOsZsy6",
-	"7sJBDMIztheB6hxIkJLNvgOYOmrYzUHVKsBBtV6o1yu1wl7ZahR2KtVaeQc1y3uomgWdQAQSsQIuCYRu",
-	"tBlU5ggOMbHVXmsKVTwDXFMmoLfJWYzOocBjVLAxQ5agbFoahsSGPiICenzha8Glk4KgBTl1QYM8h6SG",
-	"tYuGjcFOoWLVhoW6DcsFuFOtFsqD8k65Wtuzd+3dtZx3hrHFvV04gWv45zL+nOaQm7CcOSATA2SBsO+F",
-	"KGCYiC05t0WJgJgYnSF9XNrRN306uDwFyB9I9k3kLesieSigByATQ2hJISyW635haJj7lPuv0kxFKRkh",
-	"vBSPmyXvWSEX1MdvML6HVg0VL7ud7vZtTlDJEDRtzAWji6vuSQlGfsODUJGuoCDkKJYILK00FEFnCDw0",
-	"FAD5gZiqTy7lok/0wGCCPU9REl+k7SGyKYOF2l4WAatzxrNUN2skiVR/l2AN5H3JBfQ8ZG+KfDOKZm4Z",
-	"+PepHRolLD19iwDoYSMaBXoUnpdCldxLW/08gNZoApnNFZaggAPsYTFVq98GuizAItpZwFcEy1KM/Siu",
-	"sqAZI8YzpYEW4MgfIwZMC0CU1pva/t3ibnG3vJbk1xN7e4FYtiD9iM3iLNQdzD5K7FkMQRFLZzHV423I",
-	"PhpymoXPoU3X9T86uFItcebxPJI/vxeoMYLlqJngytmmXCA/Qx6Ushodglkb4EvZKqCYiASI3wWMmTQT",
-	"pCymcUjgwEPgqHPdBT61UabiMsQMTaDnbQGJ6RCxq+VYmHGr7Va9lEFJJputabQpGWInZIjH3Fg1zOCx",
-	"2CE4uhlWQdGJ2inbk2IfitaebTTG1hptJ9kB6A55YIWMISK8KaDEm8rbYRh68eWCbAcVOPYDTwnXhYhl",
-	"MSCXMHeLlGw0LnEbZi1whBhBazf0TLcy6o2H1rU/162+5XM0QIRbMNj4yFwFiHTbrWvNsZlQaMXEeVan",
-	"MmloyMFQ0II39nPz1oYu8pAlgCsFUn1Lj4zgGl228cjILoIP0UAf9Hd5izM4ASHxEOd9IpT0CxlSmiJl",
-	"wKcMpWgVS8EdWy6wIEdS+I3HOb+/KIIPamzoTeCU90nIEZe/5wGSyuvERYoFmSkIBehVMJgcvwg+MDj5",
-	"AFRPCVkMPu+TrEGWwGnECxL6ypAAJ7l8TuMvRuWXTN0qoBwvuwFuE18l+U4YFkj+o4SEVZqGflH1L9ql",
-	"NK81qv0lFUiiGAr5jUdIEEoeAlCAQYg9Gwjso+Lm8kF8nGLoMm8TjpiktrXDdaN2sg93R2i6nJFx7oIR",
-	"mvJNQe12T85QJnRyzW+UrKW2XtTuWz4XcsSWwya//sjNcsezhPFvq0QPdTNmSD9afleX37rbWO/7nFAC",
-	"BczWRCTkEWdVo0MOAg/KkdGrWCpILw6mbpb5kSBwsC1pCxrrgbk5ZtyWUWVmpgRdDXOf/rEoiMa/YCKQ",
-	"IxH6RcvTWW4YxHzMpXzIgR4gvgIURJgAagmoLgYfihQg5Z16PWu5ARRulgwsXBBra156TYqU/an5fWHE",
-	"7EN3NSHai5PGXxjhT/Z6J/TNCcRqhV/WncqZXJY+Wj4m2X4p+WtyPUZowwQMpgLx5DKqlfpuvVnbqTfz",
-	"udeCQwsGlBATsVPX+lPEltOKfmkM2VqJP9E5H8O7ZsEz0W2l7D8vLetuNrCM0KSNmwt+AMoEX8531Gfw",
-	"q1QIKROAQeIg/puyYgaMCmpRT7ElKS0k0fiPXLX6SVhBLp9rls0/sA8D9c/t3EMbcvpowUmOL3mrNs5s",
-	"wiyjEZ5Ur+2YZSz8LBxKye+4YAj62boto/JEGmveIjYg9qj6Yw3wEQC9uMMCbc1mWnngEhfvwmIGkKOQ",
-	"eWmczkggshFaNikyZLtQ2wctzdxLNuaixFzkNUvN0mtz53mnXpIjUl6ivJTL5wwv/JQLGc60fM6dDaR0",
-	"nyTmUjqPh5aaFJzAsVxkjbK7OoGjBIHkKtcCs2QHfSSgh8koG1M+ZowyXtT2ooBRuR1FypxS1O+/pRD2",
-	"e2RPqvbDcrm6A5nl/q4xuAHa9CQe5mIRiBgG+bloISIoV/P/N0Meghz93izo45uYGcr/36nrXxR8+5Cj",
-	"q+4msCjr07NLxRC/ZtsluNxUDlRLyLCYSp4tUOIOVa6+6JQuc9YtNycxTOWwiY/xjaRl5ufVx4Nzb4wY",
-	"Hk6zPs9bdddQ2525gbcx66yxezpZngEtE2E7MnZKvRNBO7oVI90sn4GRZebKlnZa0SGYAZ+wBkDb1i5B",
-	"KS0ImhRZZ0dQNa9sQusuzbII9MwEHziQDUDsWchWmTOkfyn1a2e4FP5TEg3nbgHZ1UajsgdarVarXbt8",
-	"g+2K93TQqVz2Dhvyt84lOz47ZBeP+OPFxd0kPIG3rVP/9px23m6H1a8HVfug8Vbe772Wdl6zYFp0GMjl",
-	"VLLFP84nlGW5fYxf0jQAXEB5bU+wcMEvO7/kwS+NX/JSdvulOvgl1nIHCHBBmVTWeJ9AAhCx2DQQyI5H",
-	"KoIrqZtOcEI5HiAglMxva7FwJqL3SdwvSZPJMBKkBZl5/6qDCVAfzfHMlFWzjrUkn+851ZsaYpNRRPvU",
-	"VudnJuGuupAzopCUupD85RbxgBITn+R5G4x6pSC7RUPEELGQkqrn/FB2+jhVqjVUb+zsFlBzb1CoVO1a",
-	"AdYbO4V6dWen0ajXy+VyOcW3Q+UUW+OryuJq8epmLrLvX9Sq9ilHnJ5W47Nj/wdhUi/pnDr8XRelvIzK",
-	"NJMp3xgQ0sqPJBs2hBb641sWax7RF7zWEElfsFpLttvTALQSFReQ4CHi4l3x4ScH/XFkzKt78eirV4YE",
-	"jOwi77UwKqU29GxR38ciM1LgVxdy97eIV8odEMA0z3+HE05LA5hYXmhLUe3y8P62taUjLkbEBtpXAn+3",
-	"OjJorRxFqNDhj7MdmvNG53OD2M/+5du85DVI+uA3srtt7/DO8HMnfNVpjiR1qUIz0/2hqIrN8LLSByIb",
-	"Rzic77y5/jw/zPeyiQUqSiEgse3vcc9kcUcej7t2udEllE91RVsibTZKFs42hEeibjbQZn1SiLxXodjz",
-	"yDcDpRe4mp3p4Q6lVplhD0ECYmVBmNeZU0oY5JnazeLtGTdeAECvRxKM8Zvw0LIQl2sZQuyFTIqZASKS",
-	"W8kFJQT/uOECYc1CWxZWtiI6ciHCJIq7iWPploYl6tikLO+NOcaR7Xc2aBTFkzbPqqBDNi2an5RlRs36",
-	"SUAnUwPz+PNMz1201zPqgd55F6g2eIityMIYT6rCdNdpyGaBmdJ3tKQfCV1dsS3xfhh9xkrHQ815YylX",
-	"UkomqqCToZtCZ8sZdLRmpsy4DjcJXrhNgIhjrod5G4z8PZIMIiFmIcZ3thhKTHymPmPZ2p+JYJ6zU98c",
-	"XGYHD8/h5msIp0VMS/7URLKWzH58WoG1+djofLTkzNOmbt4NzJ9/E+unslA9O4GTbaXSnyNzVnabHzKg",
-	"GnPKTwvpn24hfTfjJufe84+aLn8oJC0djfpewaTPqwMdDlVYRrJNKsRxFuoOMAFpab0Iei7iqE9SvZOR",
-	"n/K2tVHAqTdGJrpfMIzGKB6/CFoxgrxpXoWl8NnnmTEOjk2CAPYDyoQeWzLGfy5EZPxzZunsE8N9Z1xz",
-	"M7zOs7sM9M5FEP5LogA39N1tEsa38VDrg/BWjtC57m4TdRc5HlOUtcry/rcKvUuGuv+MyPsbROSlA/Fm",
-	"VpuEcz6gXDgM8e1c8T+j+v4WUX0BnEo5+V9y6SkC2vjm65OIyK66AAuOvKFKIJ3qwQhViYFwDLGngpij",
-	"1jpykFEqAGV9AsnUpGlKRCcNlioKRarqvymYo4mfORIcDDHy7GjMheVgDrBDKItyNzZinH9CUGIiHWlt",
-	"v2TbHwgz3Pxa3TxscHbrLw8ZjEWW74kbRISHDD0HkEXVEFYnLh+q9iCKTwW6I0hINAC94qTemAwA2SCw",
-	"cLYaHV0YBxWaIENs/0uiC2dgrQwx3G00vi/EMOlhX4gztDH7zjDDOWzGIYYm4vA9kLlprGFsuHwvq7Jl",
-	"9nAxQy1pC5U9YCLjNCOaezOjqKWzQEzzuYGzDbdqyedG/d1s2ap1hgU9Yisb8ReN6nVeND1UNuRSW9gy",
-	"MrJzcGVEQ0DJgEK2LkbSxs/+0HnW6H6WQDz70HqWrGrJvuKQPAfh4HmEps8u5O76VphwZIVsg/Hk2X+2",
-	"kAnbXDQfQBJKHhoqYOWVhNjz0uIBC4df6S7bIbSro2njDCTAkVB51fMMPLY1rePcOgBMVWuYGzuXaU5e",
-	"XMXfP3b9T7zP1tjff8bN/9+Jm18TLv/87xYv/7w0YD7biPIzaH7LoPlvK1DbTYz6XViNwFIeSp23Shmw",
-	"dcRvxrXLEzdGZsZWYrzZKAl8CuQRJLbDXeqeWjerbpyedCjkxhERbFn+aynen6I0hi2Qvo+JDWAcoUuQ",
-	"mFA2AtrZquNzgdQJ5b8YklBZAggGh0NsKa90nwiXchT3iOvsqGsZCYGJE195cqSsCzPblkgSBjvZMw/w",
-	"QqWFaFplKIBB4EmlUdl+4upTs0mXOM1XkGg0fHS3KPU4sVvpXv2wXK5Zuo/6N/pHSf/mQz7Sv3z5X/3L",
-	"Rautf/hfHHAkPulf1b/17+tde1ln4bh9/SNO8EFojZBYbjuFREsP8r7t9lqXB63bA9AVlEEHAcuDnIN9",
-	"NURxvp6S+aNgZlgai5R9FHou0mreXIRE7AGRTFNVdLNBm/pBKBA4JA4mxt1R7JNeXNxGDTRXbmqChWvk",
-	"u+P2NTD+w7yxD2KuLFlpO5UayxQEm3ljVDmQVGGkuA5Vn3wwNUNYAQa4oLc8DLGtd/xDJMmY6aRYIFJQ",
-	"b1OnalaEbBGVcon6e6LyT7ymyNqadC8l8Cup3uBTFXaLUQnl39hWo0dlooqgixCIXd4eDe2iQ6ljAku4",
-	"PjqqWlAprjZlCnylq0upEIPQE7hgII8rUVke5YiLSEgz9Ed+NUWgouOpD2bc7TeJZkvyLgJgKKgPBbag",
-	"503nkYzCLUodZrMRgxe1bhA1l/CqUdInOev4quNZ7JNDaLnRIVFYN35SAGNMxYKlmUZ5J4rgXkGghWEO",
-	"IEOf+gSAAvgghc1PfyAfYg/b3z58Ai0C1F8A2jZDnGtVgqGAIa7Ul3guSw4B5pZVBEeUAYO9PPgAPWyh",
-	"/0kEE30ompnN/djS/baEQU9thlg2tz8tKHtwAQbB/8Ag4AEVRcd0ivokQVKay7bYMOuPappJuOZQYPuY",
-	"8Ewc2NSHmHz6Q/9XTqjIE3RDLBDQv4JfA4Z9yKa/LU7ueXrCKIHG3LRQmL7zGJmR3gcpUn2Ygymb6lYf",
-	"zagOnGYOKpcEkmmfRPjtz8mu6sAtnIpcLIxG52HTzcsZPfXTIppz+ZxBcPLHP6XYanzvvl/dL3U3y/Gf",
-	"5zMMILcQsSERhQGD2C7UyrVGpbZWSUoMl19XRuw4Uv23EB5WJ5QZtqSNAzOjyq800MP/lplUtr6U5NyA",
-	"319MqZNwPG8hQUfd1uiCKtLS1vrCJm7tw6i9DhDgYkCp2LTzUdwhU0hcmGPr4JwhdjYxMKt2q3B9lFzZ",
-	"FiBkxgheMzrGXPudwd3t+UahfpnQJSPUtwMMMsvFAlnC2GhnRBsHmS0RfPXPG0SB96aB9gnq1I21bv5u",
-	"T7bKKPPyHq7M2C5kbJLlBauvsRGpReZj21ARPLiIRHV6y8nSk7IDlherjwn2Q79PbDRUleUG00Q7Jdek",
-	"L5d6da++t7Nb3dtZZmTS4vozDTbKsUhrUrPupvxvtmwt51TisplE6SpKcA08NF9AGCiJTm4E0IvkfQIB",
-	"RwFkkjma1jaSGpcWdtUFiwUHdEKiKYrgwozfJzYeKg+TiOaQWsQESe2Yz8CIvhkeqoodj5QpgKE+4WGg",
-	"b/wtXN4aVz017tqLNEUlKQKYO6VfImpcdq2iyAm3cfpC7EvaOn3DJD7Ex2CzAdJZiHOdtyDE+XFWIjhK",
-	"v0ijb6tMh3xORU7of2qg9b+jssQmHWKBnSWYVGIqOJHTwAkvuLDA3BCbvxL/5DCI/3zTwOgKxQgGu6kv",
-	"6T8S/VSQVpycZv6K4kLND3HglpQclfHUseIBHMnzY4lM/TfVAVNRkPcVHHjpoeWHeGL9R/rj/CgMTmbz",
-	"UJEZWpbL5zw8TkOguCL0CjoOiFoS6jEPpBo/+1eBjmEun5twL3OLzuIQtG2utkAejQx3mfpdKpVO6COj",
-	"2KrIG0qFitRnQMe8qbRByRo9TNLODUK5L34fUmahVdnvy6VAM0GcFj4bWn8p2GgQOpulTJyZBLTvSB6Z",
-	"TXuk48zbHg3twj7kS2w0KjI83bNarpbLe+XdYjnT7qA8tdkx8CP6gjMC4OXPbjjYJHUA8tG8tlGvZsnl",
-	"ibKnMzhq64vbG/BnU5nNnY04w8qXJXsT5TrPK1jyzjL5YkTlsi4ECBBNnbrlsuGXXTWKHW6CnawzFQVN",
-	"pIeUV+6SUrYOWhKabySuxS+CCuhlfZrDgpo0H7/eoh9N0Z3zS2Mo8qq6vfcjtmUVx/rM4Rit92L3XMxj",
-	"MyiWupU/SElA2mC5f9c5P3g+v2q3zrut+0OAyBgzSnQZ8T4ZQ4a19yhyR8jDl/AqcTiWukKimrMyD3re",
-	"tAgkCOppCim/2WiMPBrIgZX9mRJvmtdWX23+mAUnahbEljwOMbcXCZwsxTnaUiHVndaooyM0VSEti1y1",
-	"K+VCzVJ1E+DBKQ3TLvQwM+nRg8QJs5O/I0uoDmZeKMScNz5kJlsRBAbIoj7iwFi+8qqGvlTIiPquLJiA",
-	"I4sSG5o8soSJCZHnu27xrndUaP6ob+2q3dnuzC8f4U95scNod5/+yEigQURk6skt9Q6K8mwolxpHIh8T",
-	"mzztQyQsVxKGGaUIOlI2Qcb6+c+Qef+UHaT2ZrSLfJ9oV0kq50WpPiZXX9HMEj+cDlLJCJmBRI6FsIrq",
-	"habsAPjV7PUnUK7ulOuDqg130F6jPrBr9UFz0KzCZq2BGnB3164OdsrDIfwtr0MrBgwSyy14eIQAizNj",
-	"Z+MxF3mztDspLv425w1YbJF9sQ8XU/A36OZyfz1zPEACMV8qi2DiIoMa7WJIPTXhQwIdxMCvFiS2hwJM",
-	"fgPYRkRgMdXP4OjzpTymUGkCC0WzQJsSHvqIAUseLpW9O5/ZBDmwPCxJM93GRaRP4rMUnwPJNaODtaQm",
-	"1+ZxaPNRlQuE4JqtWLS6ZN+8S67krIRyc5GqGTJpc2mxv79NNb/FARZg5SorQxsJN4+OCMn39Mva4aj2",
-	"/rtlc0ev85hyJIJG11ARHGEPAcejg4Fxw8aWkHyfIKcIPqjkGu4W/t+HOb4g/DCzcNfS9wGujN07fh9g",
-	"BVzRCxMDD5KRbNUnOps5IXdEw6SemwAP2LMt9RCDujGj5ZjV1IuVSnFhKbViDX6/GT31rsR7bFrquYvF",
-	"uDhIoBIDCoJSj/8w3MkaO4um3cwzjAK65MvS9NuE4reo4WHHtxvLPhEoloX/RhbkVWdwzQM42gS3VCPL",
-	"ayTEMH6ReAu9QEshPxR4AjnKjr/cN1+0HB6XeDFi++yqyq0qbD5dUdZcpZlonVC/9KbM6pGsoSoSLtHC",
-	"n41TWA6+WrWew3O82syDOIfQZXKjStnfSHiMW2ZNd7sZjlLqRLFPWgLIM6HFdcO6PpjCBx/y4MMsF179",
-	"ZXLwP4DZGlQEQ58M0MzfrDidSn/TI/qaa6Xd0ZTZOsohYMhCtpLgsM73i1/tk/NKyWRAx5kBZ4kKDX9d",
-	"YYatCzFsFv/uBI6prZJ+fm52+GPZa4m4NSvSMOe7vT6WWmCcxSfZzywzUIVLpaXFFGMuyP/tHx53LsH1",
-	"8TW4vts/77TB2eEj2D+/ap+pz33SJ/5N53L/uGV1Lbp/2Do4HzYfT0bo7XQH2t7F42QXHh93vFPoiebp",
-	"S/W1tF89++h2hp3w9VgE9y+7qE/Ob52Du92dF9hrBPcHDf/o4rQWjBBBtyWr53/9ejO6nN5w93OV3nye",
-	"HL7ddQeV9uVFe9g+dkafmzfVPnl7GrGO1WZH5ZvqhJ0NPBja7t1HfA9J64D7lebj4Vc+aLTuaru2uGMX",
-	"tZtH+8HZu/34GV8P75u3fXK2/9Ir18b3+1f2RZc/1vbOYZvsdILK1Thodg5pqYMO7x8rX/321XULnpUH",
-	"pye1cOjU2yEa8Y+9bp9Mbh56qH3+Gj6d71xdfKZX12eT8cXN8HXgVD4fNMfhU/lMvJSsy5PqKwzLrz5v",
-	"hXsnpwEaja+ub1+9Ppl+FS/TpyGj9xgdTYPJkzO+mQhCLpolp3sYlk7ve+yx3Kj6h3e93bY12K2PrJOj",
-	"3tHwYuSR0XGpT8rDu3rrFjbK9ZPa60t5JAaoNj6zrj/T66vwbP+en3TH5fLd8WNreo3C6cfmrnVXejx0",
-	"L3ZHte792Uuf7KDOkzPFF1fliVd5PD64PbNCbzLie62PoTdyKrQ3qPPam/80vi7vHtPe60O9+gLPGg/d",
-	"j5fuE0J90twpf6b37sCqnAXdjy/DJ/rC2aF4al4P7p4+Po6PmrcBsx9a7OVkcDqqnga3Z63XnvvKb1p8",
-	"3z2u9En5PHytPsCL/bJT7TSurQv7tGR9faHlpmWxl/3PIX59YLiBw72Lz0Hza6807L5d+tzuOKRZ+vp0",
-	"1ie4eRN6w3B3N/zqPpQmojoQBAvnln99cV8vwpfHu/rToO6OxFHTPbsrff68W69+dc8bZ5PWbeumtd8n",
-	"4uDo+Onhdmz5h87ZwUXlrNtqPvn3o0Ht1D3vXVTOP+9P4UPFtYjXin63Tk7H0L9/sduNcZ9YvvUR35xe",
-	"7e9f7LdbrfoRPjxEJzs+c49OdsN7fnN+cVEtPzasJ5e8PjaPWr6iofbxpHnUnow6fbI/6Rwf3dDTdou3",
-	"9/cf263JYfvEOWwf1VuttjO6mfX+ePnYKu3uPwaON+22nh5P3JfpmdsnpY/Dnbfr4f14cFItH36tjTq7",
-	"V0f7l2Vy/vnj/l3FD8fdj197Ybf2cM72a37tOPREcHZ7eHp2LvzG4UGfVNjx2+cW7VWmwd5jp3neOrAv",
-	"2u2r6UvrhdOHu+bu413Y/lgakBfWQ7fV89ur9nB63d7dedhrNvDVfZ/4je7HAb85mOy2q+fMs1sX9YuD",
-	"kE6fKl0sjuFT/ezm/F587B3CSh3zx+5x++WN7l4/Nu9rp1ejRrlPnK8PTrN6WRr41cO37m6vWXs4PBhU",
-	"vPFLveONX53O1zPkVCpvnx9fffbYfTo9bQ/Hb8OP3mV3J3x1Tvrk5bV0Wp56T9VzPDhmO8et1vRq7+6B",
-	"tZ66k+5F+dB66TUnh23yOuoehNOv/sPkfny5/zk87Nw3r1DtsU8u8F1leHrZ5PbuQcCPXhsXHz/b5ILc",
-	"dD+esJfe9dlBzX9gXssmhz3XfrxvvjyNggf3YMprpb09dNUn7qjMzsm0/HI5GcFwWMJ3zStr5/P4YvRy",
-	"fntx6jTu9u7Ppqfhw4N4m3wmLxeXjYfbo/2vZ3X+RP2Liz4ZikHvpPKxMR3cPpRatfH+AL7ePlTF7t3b",
-	"5Yv1hkbdp0MMzy/3zksn1mm7c1u5OWruNKsHdss7PNqz+2RUdW7wY/emBeFp+fS09XYyvh3dnp6fO2fV",
-	"x5tHfHJ5P62K2un0aMgZ9BuTbvvhauheo870fL/3dNonYxZcetcDNOS9vcZub1jdv+yEztsTazfuXw+6",
-	"Z6Mn59at3B+Pu50b0p6+jW6mO4d31a/XAX5o7Eke5V53Pj+xM2qd1c7Ou3sl/HZ607v1xMtF6/c++f16",
-	"2NvtE3W7HF4erLp6llSfoAw9c+5lX9I/ixCtL9O+0nb1XmXbkyn8mYq+HC/SpXWev7IAJqQiyKVAw4GS",
-	"8hNhrap8QJ/8GuAAeZig3zJLCSwENkZV3+iW5TLe1+iXtuuBJWa9DfMjzdNF26lymaJky7Zjr0LkHzYF",
-	"2WEoXMrwG7KfR2jKF5PsNqqv3uo+YDG6OqnfNXfrhzbfvyNTMagNJuNbxznxbrzB42dvl1TK470lZecy",
-	"c/XudFX6WP3RwdrmCSh5pNK2CNvHZH3YGVceUImnLIVs4/Spd0iDAoNpovp5RrG6qDaRnc2JSEd3qbxL",
-	"ftRaaMhQBV7wLYHJPNpzBTXmbD2WwGOdDG+OcypilyOLIVHQDwHEPDIuvJ8BnVQUnzM1zkWFcwO+iwnH",
-	"jivS6FmWxkuZA0ki0zEZalAv16r1bFfEBq/+xzbMoQedKDeHuZbOFtNhQon87CidBnqcmro6Zuc56JgV",
-	"zbHVZWtKJ6wnS7LOtrUoOWsCsWvxOkenKbzl589ECobEBic2J4u6e4liLFs4daNua9y6RAQaqhUuWCIC",
-	"EDVKXWDlIqFMuAXoI4YtWAwo9YpEBFKAyOVzlVWft7rxkgVplhvoo1b5iCcoTnHXa6dY7l23dAjlOSOb",
-	"BfcsGinJdONnGuYDQtf26da267KQvrd2jtmL45t2WVItd123jPiPdV0WnOfrOiyzJX/7ks15IqHOwWNE",
-	"MqJlVZoa5tFz9gxBT9elUln0YBAKsLhJOvhYBRxIeumTjL3X4SHAR5AYpzj0PJDREOiTx/sEMqQZnxba",
-	"FuaFcVvDJceYKiePNnpKgPuEhR7SdbcYGlKG8mCCgAvHcWKkOs1A5fTJ1Q0QgBMY1YPAAmBOPog+CSjn",
-	"2ESr+PhV+WR9KCxXW1/NfgBBHSVqSqYc084ye3QiqHqbp0/m4lo3JqkNe8wn5mxBUBv2yK6wvDFtbNh+",
-	"iVdAlcjYPhA5DmXeJOvAhHbrtINlZd+N6yg6BF/mjsuWoccsJGRZfHEq0nzhFG69oB9MCsj2oM0N+WXp",
-	"RbQ8TrrIa3GAchQOnYwpphYuGoahE1wlAkMvKJq0kEzUbf+K2Ky26A89y7UgRf+tHs3azEesxE4rZFhM",
-	"u/IwaATtI8g0VgfqX0eRiHn60JNComophVfdLh5Vyv65b9+UMD+kWXF4OrdVUGN3UNGGOiJAp8DwoooP",
-	"t5B5GkovN9cKoOUiUFXxw0pAju1Tk8mkCNVnZRQyfXnpvNM+vOweFqrFctEVvqeFNKFQdtXdV9ObJAoG",
-	"VBI3gAFOuIg/5apR6VH54VOuViwXKzldU0ehqWR5lCBe+gPb39S5yiozcIy0C1ZzFVVwABhWAChTMZoe",
-	"ElHld/0qAoxCN6PLXj8tk7CTUKZCNGepQypTEFMCFBNCNrKLyfpnHVuDknykSsWoQR8JJVr/I+OZnCjH",
-	"KQJeUOCoQgeYKN1QuJFn/VP0HkV04rSSoxnMn/KW1Bc5m35DTG1GtVxOBAma4H7P+A9LL6Z83Ayglddf",
-	"AkvqOKcxk8SJPCL1d5zapPIsTtohWsiKgnqxraeu/PlTt0JVLmqElCkOa0D07LU/f/Y7MrOmyRMYICbP",
-	"BojPtoak/ldAMiJ0Qua2oPFX7P4dQa+Bij0DKj0MUEuVdrZTLFxRccS8//FF0ggPfR+yqUnkSzIhxbzi",
-	"86TGKUV/qEJPWc9jtHWGMwQETaKueRBQuXSsNBGLEm6qqSiD2Bix6OF8rvi9UWkQtKIaZJglFRy+yLiu",
-	"KRfRS4KaySAuojcJ34fi069pfUtfn5KZfVvgN5X3nr1jZ229+QhcyPXrlsj+lzEdNnvi6ifn+cl5NuQ8",
-	"hmlkcZr3Ep62kJciHK4RlFLvrG0kKsUD/x8TllKYyjhBabz8FJh+sq1/U4FpKf/SimBSasqQX5LPIW/E",
-	"TxLM6m/ERf4E2Wv+oem/WvrKepY640ipgn1oMqsRNUAqoUy/b5fN1wR6FSVVDTkNzzxqN+Ze9feaIIs2",
-	"v6VubYmWVHXEFQTgmfzl77nFh5hg7iYucbDyDsdidnXrfFXlgvCRgAATfYYxJQAOaChM1DAPPbHqmlfp",
-	"1z8v+bWXvHnGOpM05BGIi1hq71WsIGICCNVvxVihB5mp2gd+FS4NHdf4j067V5e/Ff/jCOlYVWh0Isde",
-	"dMqzyCj1JPdKWopbbkBOt0iEjHCV1hC/aCmBUTq4YWfRM5aKv5siPnFjiyrCistgmO2LihhBAZLmWPM6",
-	"pQ4ShCR6rbIQDVdsrCDF2VPnP+lxLT3OkLWEKFPbvUCY/5m0liaPDYgukR63mubitG9Jcgt0puvHoldo",
-	"idRFxBT5IRvYSFeVoSlai03/qvrXKsqI4PxJGOsJI35NfwldRFu5DV38VFJ/Kql/NyV1gTdl8Ts1eFKm",
-	"WGAxs1eQFphL1spmTUqq5s6ySI9EO1WU508l/dkask57/B6AQcZPMvvXkJk+6P9+RDZ7UAJ6HoiDzaLT",
-	"NCOz9RZtSHTQA7HiwFAN2ay+/mAK1NWZTaib24+Qaf5Dt37tL77Dl26l+gCSv/2k4p9UvA0Vo8UTJCk3",
-	"DvJZfkNemSY/eO7n468WFmpAUbxAauVyiOjFr39DuWTlcr7FWQ9ZXOzCPBRA7dDSr1vElRbTIWAwwEVV",
-	"xMbFQ51uAgNc0oVOleUBsUL0SklpXFXSylxgmoAOJs6qCbiADvrBacxr3OYhg3iadeN8+fb/AwAA///g",
-	"CkGgDrcAAA==",
+	"H4sIAAAAAAAC/+x9eXPbtrb4V8HodSbtL9oXW85M5z1Z3uTdlmzHvsr4QiREwiIBBgAly3357r/BQoqU",
+	"qC1xe3vvS/9oLBLLwSHOwdnxR86ifkAJIoLnPv2RCyCDPhKImV8Okv/aiFsMBwJTkvuUu4YOApjY6DWX",
+	"z6FX6AceSjUfQy9EuU+5Su7bt3wOyz5fQ8SmuXyOQF++US3zOW65yIeyi5gG8jkXDBNHdeP4LWPuy9Af",
+	"IAboEGCBfA4wAQhaLjADJqGJBoihKZeXwqParoLnW/RSDd166B62q22PEtSW6ONqImjbWIIJvWtGA8QE",
+	"loAMocdRPhckHv2RY8hR61mYKJ/jLmToeYKF+wwti4bmw5iV5T79I1ep1uqNnd3mXrlSzX3J5xQmMscy",
+	"DyBjcKrWztDXEDNky2EMDF/iZnTwgiwh++n13QUehfaVQj3/7gXGgOdQWJggLgqVXP6vXHY+xwkMuEvF",
+	"s/7aSZj8aSF6uwhVNsKyYV2Hxq6AItRUkkIU9HEaIujjQtlq1sq7e7Xd3UZjr2HXB1kY2xLFc4uR8+bX",
+	"7IFu7Ue2QBAOPGxpEh7C0BNxuzRJd4aAIwEEBeo1+FW4CJguQBHvb3kAgUeJkwd0MAy5BQWywd3teZ9g",
+	"DhgSISPILoKO4AC9BphBOTTwseMKMECAU0oQA8KFBAwpA1S4iIFQra1PBGQOErzYJ30yg0WwEMlpuUuZ",
+	"QEzOBhKTAUjsPsHpCTEHEnYOfQQgV1PJ38npwGy22ScaUOohSH78o272OZdtxZB52aw4OYVslDn+W8jQ",
+	"j2wX7EMHxRQ6x/UlRulQYVPjEdlAdZAfHfghV985JPhrKI8m1dDBY0QAQ5yGzELAYTQMiuoTy0nkx6I+",
+	"FnInDRn1VRe5UMSF/O4MEpv6gBIEBpAjG1ACILi76xwAzPvEQQQxuQ31h0wxFAVYFsV61ILCfN70As/N",
+	"m2iRAaNjLBcZgf+swM+DiYsYUk3ULHJ7hp6tFh/hBRLZzcFcIKbgO6ETuaM9zAWAngciMPinPnGFCPin",
+	"UsmmFi/62GKU06EoWtQvIVIIecnycAnKb1syrO6/xxhNflePCpaHCx4UiIv/gm8RL3yWEz3Hk3xQKJcQ",
+	"R48k6gkVgAfIwkOM7DzAQj60kR1aqQ+yBA/zSJfkgUK5nbIZZbLv6t2V3i4boHselB4NLUhuzTDHasas",
+	"4y4cxCA8Y3sRqM6BBCnZ7DuAqaOG3RxUrQIcVOuFer1SK+yVrUZhp1KtlXdQs7yHqlnQCUQgESvgkkDo",
+	"RptBZbbgEBNbfWtNoYpngGvKBPQ22YvRPhR4jAo2ZsgSlE1Lw5DY0EdEQI8vvC24dFIQtCCnLmiQ55DU",
+	"sHbRsDHYKVSs2rBQt2G5AHeq1UJ5UN4pV2t79q69u5bzzjC2+G0XduAa/rmMP6c55CYsZw7IxABZIOx7",
+	"IQoYJmJLzm1RIiAmRmdIb5d29E7vDi53AfIHkn0Tecq6SG4K6AHIxBBaUgiL5bpfGBrmPuX+qzRTUUpG",
+	"CC/F42bJe1bIBfXxG4zPoVVDxctup7t9mxNUMgRNG3PB6OKqe1KCke/wIFSkKygIOYolAksrDUXQGQIP",
+	"DQVAfiCm6pVLuegTPTCYYM9TlMQXaXuIbMpgobaXRcBqn/Es1c0aSSLV7yVYA3lecgE9D9mbIt+Moplb",
+	"Bv59aodGCUtP3yIAetiIRoEeheelUCW/pa0eD6A1mkBmc4UlKOAAe1hM1eq3gS4LsIh2FvAVwbIUYz+K",
+	"qyxoxojxTGmgBTjyx4gB0wIQpfWmPv9ucbe4W15L8uuJvb1ALFuQfsRmcRbqDmYvJfYshqCIpbOY6vE2",
+	"ZB8NOc3C59Cm6/ofHVypljhzex7Jx+8FaoxgOWomuHK2KRfIz5AHpaxGh2DWBvhStgooJiIB4ncBYybN",
+	"BCmLaRwSOPAQOOpcd4FPbZSpuAwxQxPoeVtAYjpE7Go5FmbcartVL2VQkslmaxptSobYCRniMTdWDTN4",
+	"LHYIjk6GVVB0onbK9qTYh6K1ZxuNsbVG20l2ALpDHlghY4gIbwoo8abydBiGXny4INtBBY79wFPCdSFi",
+	"WQzIJcydIiUbjUvchlkLHCFG0NoPeqZbGfXGQ+van+tW3/I5GiDCLRhsvGWuAkS67da15thMKLRi4jyr",
+	"XZk0NORgKGjBG/u5eWtDF3nIEsCVAqk+pUdGcI0O23hkZBfBh2igD/q9PMUZnICQeIjzPhFK+oUMKU2R",
+	"MuBThlK0iqXgji0XWJAjKfzG45zfXxTBBzU29CZwyvsk5IjL53mApPI6cZFiQWYKQgF6FQwmxy+CDwxO",
+	"PgDVU0IWg8/7JGuQJXAa8YKEvjIkwEkun9P4i1H5JVO3CijHy06A28RbSb4ThgWSf5SQsErT0C+q/kW7",
+	"lOa1RrW/pAJJFEMh3/EICULJQwAKMAixZwOBfVTcXD6It1MMXeZpwhGT1LZ2uG7UTvbh7ghNlzMyzl0w",
+	"QlO+Kajd7skZyoROrvmNkrXU1ovafcvnQo7Yctjk2x85We54ljD+bZXooU7GDOlHy+/q8Ft3GuvvPieU",
+	"QAGzNREJecRZ1eiQg8CDcmT0KpYK0ouDqZNlfiQIHGxL2oLGemBOjhm3ZVSZmSlBV8Pcp38sCqLxE0wE",
+	"ciRCv2h5OssNg5iPuZQPOdADxEeAgggTQC0B1cHgQ5ECpLxTr2ctN4DCzZKBhQtibc1Lr0mRsj81zxdG",
+	"zN50VxOivThp/IUR/mSvd0LfnECsVvhl3a6cyWXpreVjku2Xkk+T6zFCGyZgMBWIJ5dRrdR3683aTr2Z",
+	"z70WHFowoISYiJ261p8itpxW9EtjyNZK/InO+RjeNQueiW4rZf95aVl3s4FlhCZt3FzwA1Am+HK+o16D",
+	"X6VCSJkADBIH8d+UFTNgVFCLeootSWkhicZ/5KrVT8IKcvlcs2z+wD4M1J/buYc25PTRgpMcX/JWbZzZ",
+	"hFlGIzypXtsxy1j4WdiUkt9xwRD0s3VbRuWONNa8RWxA7FH1Yw3wEQC9uMMCbc1mWrnhEgfvwmIGkKOQ",
+	"eWmczkggshFaNikyZLtQ2wctzdxLNuaixFzkNUvN0mtz53mnXpIjUl6ivJTL5wwv/JQLGc60fM7tDaR0",
+	"nyTmUjqPh5aaFJzAsVxkjbK7OoGjBIHkKtcCs+QL+khAD5NRNqZ8zBhlvKjtRQGj8nMUKXNKUb//lkLY",
+	"75E9qdoPy+XqDmSW+7vG4AZo05N4mItFIGIY5OuihYigXM3/3wx5CHL0e7Ogt29iZij/v1PXTxR8+5Cj",
+	"q+4msCjr07NLxRC/ZtsluPyoHKiWkGExlTxboMQZqlx90S5d5qxbbk5imMphEy/jE0nLzM+rtwfn3hgx",
+	"PJxmvZ636q6htjtzAm9j1llj93SyPANaJsJ2ZOyUeieCdnQqRrpZPgMjy8yVLe20okMwAz5hDYC2rV2C",
+	"UloQNCmyzragal7ZhNZdmmUR6JkJPnAgG4DYs5CtMmdI/1Lq185wKfynJBrO3QKyq41GZQ+0Wq1Wu3b5",
+	"BtsV7+mgU7nsHTbks84lOz47ZBeP+OPFxd0kPIG3rVP/9px23m6H1a8HVfug8Vbe772Wdl6zYFp0GMjl",
+	"VLLFP84nlGW5fYxf0jQAXEB5bE+wcMEvO7/kwS+NX/JSdvulOvgl1nIHCHBBmVTWeJ9AAhCx2DQQyI5H",
+	"KoIrqZtOcEI5HiAglMxva7FwJqL3SdwvSZPJMBKkBZl5/6qDCVAvzfbMlFWztrUkn+/Z1ZsaYpNRRPvU",
+	"VvtnJuGuOpAzopCUupB8cot4QImJT/K8DUa9UpDdoiFiiFhISdVzfig7vZ0q1RqqN3Z2C6i5NyhUqnat",
+	"AOuNnUK9urPTaNTr5XK5nOLboXKKrfFVZXG1eHUzF9n3L2pV+5QjTk+r8dmx/4MwqZd0Th3+rotSXkZl",
+	"msmUbwwIaeVHkg0bQgv98S2LNY/oC15riKQvWK0l2+1pAFqJigtI8BBx8a748JOD/jgy5tW9ePTVK0MC",
+	"RnaR91oYlVIberao72ORGSnwqwu5+1vEK+UXEMA0z3+HE05LA5hYXmhLUe3y8P62taUjLkbEBtpXAn+3",
+	"OjJorRxFqNDhj7MvNOeNzucGsZ/9y7d5yWuQ9MFvZHfb3uGd4edO+KrTHEnqUoVmpvtDURWb4WWlD0Q2",
+	"jnA433lz/Xl+mO9lEwtUlEJA4rO/xzmTxR15PO7a5UaHUD7VFW2JtNkoWTjbEB6JutlAm/VJIfJehWLP",
+	"I98MlF7ganamhzuUWmWGPQQJiJUFYV5nTilhkGdqN4unZ9x4AQC9Hkkwxm/CQ8tCXK5lCLEXMilmBohI",
+	"biUXlBD844YLhDULbVlY2YroyIUIkyjuJo6lWxqWqGOTsrw3ZhtHtt/ZoFEUT9o8q4IO2bRoHinLjJr1",
+	"k4BOpgbm8eeZnrtor2fUA73zLlBt8BBbkYUxnlSF6a7TkM0CM6XvaEk/Erq64rPE38PoM1Y6HmrOG0u5",
+	"klIyUQWdDN0UOlvOoKM1M2XGdbhJ8MJtAkQcczzM22Dk80gyiISYhRjf2WIoMfGZeo9la38mgnnOTn1z",
+	"cJkdPDyHm68hnBYxLflTE8laMt/j0wqszcdG56MlZ+42dfJuYP78m1g/lYXq2QmcbCuVfh2Zs7Lb/JAB",
+	"1ZhTflpI/3QL6bsZNzn3nn/UdPlDIWnpaNT3CiZ9Xh3ocKjCMpJtUiGOs1B3gAlIS+tF0HMRR32S6p2M",
+	"/JSnrY0CTr0xMtH9gmE0RvH4RdCKEeRN8yoshc9ez4xxcGwSBLAfUCb02JIx/nMhIuOfM0tnnxjuO+Oa",
+	"m+F1nt1loHcugvBfEgW4oe9ukzC+jYdaH4S3coTOdXebqLvI8ZiirFWW979V6F0y1P1nRN7fICIvHYg3",
+	"s9oknPMB5cJhiG/niv8Z1fe3iOoL4FTKyf+SQ08R0MYnX59ERHbVBVhw5A1VAulUD0aoSgyEY4g9FcQc",
+	"tdaRg4xSASjrE0imJk1TIjppsFRRKFJV/03BHE38zJHgYIiRZ0djLiwHc4AdQlmUu7ER4/wTghIT6Uhr",
+	"+yXb/kCY4ebH6uZhg7NTf3nIYCyyfE/cICI8ZOg5gCyqhrA6cflQtQdRfCrQHUFCogHoFSf1xmQAyAaB",
+	"hbPV6OjCOKjQBBli+18SXTgDa2WI4W6j8X0hhkkP+0KcoY3Zd4YZzmEzDjE0EYfvgcxNYw1jw+V7WZUt",
+	"8w0XM9SStlDZAyYyTjOiuTczilo6C8Q0nxs423Crlnxu1N/Nlq1aZ1jQI7ayEX/RqF7nRdNDZUMutYUt",
+	"IyM7B1dGNASUDChk62IkbfzsD51nje5nCcSzD61nyaqWfFcckucgHDyP0PTZhdxd3woTjqyQbTCe3PvP",
+	"FjJhm4vmA0hCyUNDBaw8khB7Xlo8YGHzK91lO4R2dTRtnIEEOBIqr3qegce2pnWcWweAqWoNc2PnMs3J",
+	"i6v4+8eu/4nn2Rr7+8+4+f87cfNrwuWf/93i5Z+XBsxnG1F+Bs1vGTT/bQVqu4lRvwurEVjKQ6nzVikD",
+	"to74zTh2eeLEyMzYSow3GyWBT4E8gsR2uEudU+tm1Y3Tkw6F/HBEBFuW/1qK96cojWELpO9jYgMYR+gS",
+	"JCaUjYB2tur4XCB1QvkXQxIqSwDB4HCILeWV7hPhUo7iHnGdHXUsIyEwceIjT46UdWBm2xJJwmAne+YB",
+	"Xqi0EE2rDAUwCDypNCrbT1x9ajbpEqf5ChKNho/OFqUeJ75Wulc/LJdrlu6j/kb/KOlnPuQj/eTL/+on",
+	"F622fvC/OOBIfNJP1d/6+XrXXtZeOG5f/4gTfBBaIySW204h0dKDPG+7vdblQev2AHQFZdBBwPIg52Bf",
+	"DVGcr6dkfhTMDEtjkbK3Qs9FWs2bi5CIPSCSaaqKbjZoUz8IBQKHxMHEuDuKfdKLi9uogebKTU2wcI18",
+	"d9y+BsZ/mDf2QcyVJSttp1JjmYJgM2+MKgeSKowU16Hqkw+mZggrwAAX9CcPQ2zrL/4hkmTMdFIsECmo",
+	"t6lTNStCtohKuUT9PlH5J15TZG1NupcS+JVUb/CpCrvFqITyN7bV6FGZqCLoIgRil7dHQ7voUOqYwBKu",
+	"t46qFlSKq02ZAl/p6lIqxCD0BC4YyONKVJZHOeIiEtIM/ZFfTRGoaHvqjRl3+02i2ZK8iwAYCupDgS3o",
+	"edN5JKNwi1KH2WzE4EWtG0TNJbxqlPROztq+ansW++QQWm60SRTWjZ8UwBhTsWBpplHeiSK4VxBoYZgD",
+	"yNCnPgGgAD5IYfPTH8iH2MP2tw+fQIsA9QtA22aIc61KMBQwxJX6Es9lySHA3LKK4IgyYLCXBx+ghy30",
+	"P4lgog9FM7M5H1u635Yw6KnNEMvm9qcFZQ8uwCD4HxgEPKCi6JhOUZ8kSEpz2RYbZv1RTTMJ1xwKbB8T",
+	"nokDm/oQk09/6H/lhIo8QTfEAgH9FPwaMOxDNv1tcXLP0xNGCTTmpIXC9J3HyIz0PkiR6sMcTNlUt3pr",
+	"RnXgNHNQuSSQTPskwm9/TnZVG25hV+RiYTTaD5t+vJzRUz8tojmXzxkEJx/+KcVW43P3/ep+qbNZjv88",
+	"n2EAuYWIDYkoDBjEdqFWrjUqtbVKUmK4/LoyYseR6r+F8LA6ocywJW0cmBlVfqWBHv63zKSy9aUk5wb8",
+	"/mJKnYTjeQsJOuq2RhdUkZa21hc2cWsfRu11gAAXA0rFpp2P4g6ZQuLCHFsH5wyxs4mBWbVbheuj5Mq2",
+	"ACEzRvCa0THm2u8M7m7PNwr1y4QuGaG+HWCQWS4WyBLGRjsj2jjIbIngqx9vEAXemwbaJ6hTN9a6+bs9",
+	"2SqjzMt7uDJju5CxSZYXrL7GRqQWmY9tQ0Xw4CIS1ektJ0tPyg5YHqw+JtgP/T6x0VBVlhtME+2UXJM+",
+	"XOrVvfrezm51b2eZkUmL68802CjHIq1Jzbqb8r/ZsrWcU4nLZhKlqyjBNfDQfAFhoCQ6+SGAXiTvEwg4",
+	"CiCTzNG0tpHUuLSwqw5YLDigExJNUQQXZvw+sfFQeZhENIfUIiZIasd8Bkb0zvBQVex4pEwBDPUJDwN9",
+	"4m/h8ta46qlx1x6kKSpJEcDcLv0SUeOyYxVFTriN0xdiX9LW6Rsm8SHeBpsNkM5CnOu8BSHOj7MSwVH6",
+	"RRp9W2U65HMqckL/qYHWf0dliU06xAI7SzCpxFRwIqeBE15wYYG5ITa/En9yGMQ/3zQwukIxgsFu6k36",
+	"R6KfCtKKk9PMrygu1DyIA7ek5KiMp44VD+BInh9LZOrfVAdMRUGeV3DgpYeWL+KJ9Y/0y/lRGJzM5qEi",
+	"M7Qsl895eJyGQHFF6BV0HBC1JNRjHkg1fvZXgY5hLp+bcC/zE53FIWjbHG2B3BoZ7jL1XCqVTugjo9iq",
+	"yBtKhYrUZ0DHvKm0QckaPUzSzg1CuS9+H1JmoVXZ78ulQDNBnBY+G1q/KdhoEDqbpUycmQS070gemU17",
+	"pOPM2x4N7cI+5EtsNCoyPN2zWq6Wy3vl3WI50+6gPLXZMfAj+oIzAuDlYzccbJI6APloXtuoV7Pk8kTZ",
+	"0xkctfXF7Q34s6nMx52NOMPKlyXfJsp1nlew5Jll8sWIymVdCBAgmjp1y2XDLztqFDvcBDtZeyoKmkgP",
+	"KY/cJaVsHbQkNN9IXItvBBXQy3o1hwU1aT6+vUVfmqI755fGUORVdXvvR2zLKo71mcMxWu/F7rmYx2ZQ",
+	"LHUrf5CSgLTBcv+uc37wfH7Vbp13W/eHAJExZpToMuJ9MoYMa+9R5I6Qmy/hVeJwLHWFRDVnZR70vGkR",
+	"SBDU1RRSfrPRGHk0kAMr+zMl3jSvrb7a/DELTtQsiC25HGLuWyRwshTnaEuFVHdao46O0FSFtCxy1a6U",
+	"CzVL1U2AB6c0TLvQw8ykRw8SJ8xO/o4soTqYeaEQc974kJlsRRAYIIv6iANj+cqrGvpSISPqvbJgAo4s",
+	"Smxo8sgSJiZEnu+6xbveUaH5o761q3Znuz2/fIQ/5cYOo919+iMjgQYRkaknt9Q9KMqzoVxqHIl8TGxy",
+	"tw+RsFxJGGaUIuhI2QQZ6+c/Q+b9U3aQ2pvRLvJ9ol0lqZwXpfqYXH1FM0v8cDpIJSNkBhI5FsIqqhea",
+	"sgPgV/OtP4FydadcH1RtuIP2GvWBXasPmoNmFTZrDdSAu7t2dbBTHg7hb3kdWjFgkFhuwcMjBFicGTsb",
+	"j7nIm6XdSXHxtzlvwGKL7IN9uJiCv0E3l/vrmeMBEoj5UlkEExcZ1GgXQ+qqCR8S6CAGfrUgsT0UYPIb",
+	"wDYiAoupvgZH7y/lMYVKE1gomgXalPDQRwxYcnOp7N35zCbIgeVhSZrpNi4ifRLvpXgfSK4ZbawlNbk2",
+	"j0Obj6pcIATXfIpFq0v2ybvkSM5KKDcHqZohkzaXFvv721TzWxxgAVausjK0kXDz6IiQfE+/rC8c1d5/",
+	"t2zu6HYeU45E0OgYKoIj7CHgeHQwMG7Y2BKS7xPkFMEHlVzD3cL/+zDHF4QfZhbuWno/wJWxe8f3A6yA",
+	"K7phYuBBMpKt+kRnMyfkjmiY1HUT4AF7tqUuYlAnZrQcs5p6sVIpLiylVqzB7zejp+6VeI+PlrruYjEu",
+	"DhKoxICCoNTjPwx3ssbOomk3cw+jgC55szT9NqH4LWp42PHtxrJXBIpl4b+RBXnVHlxzAY42wS3VyPIa",
+	"CTGMXyTeQi/QUsgPBZ5AjrLjL/fNGy2HxyVejNg+O6pyqwqbT1eUNVdpJlon1De9KbN6JGuoioRLtPBn",
+	"4xSWg69WrefwHK82cyPOIXSZ3KhS9jcSHuOWWdPdboajlDpR7JOWAHJPaHHdsK4PpvDBhzz4MMuFV79M",
+	"Dv4HMFuDimDokwGa+ZsVp1Ppb3pEX3OttDuaMltHOQQMWchWEhzW+X7xrX1yXimZDOg4M+AsUaHhryvM",
+	"sHUhhs3i353AMbVV0tfPzTZ/LHstEbdmRRrmfLfXx1ILjLP4JPuZZQaqcKm0tJhizAX53/7hcecSXB9f",
+	"g+u7/fNOG5wdPoL986v2mXrdJ33i33Qu949bVtei+4etg/Nh8/FkhN5Od6DtXTxOduHxccc7hZ5onr5U",
+	"X0v71bOPbmfYCV+PRXD/sov65PzWObjb3XmBvUZwf9Dwjy5Oa8EIEXRbsnr+1683o8vpDXc/V+nN58nh",
+	"2113UGlfXrSH7WNn9Ll5U+2Tt6cR61htdlS+qU7Y2cCDoe3efcT3kLQOuF9pPh5+5YNG6662a4s7dlG7",
+	"ebQfnL3bj5/x9fC+edsnZ/svvXJtfL9/ZV90+WNt7xy2yU4nqFyNg2bnkJY66PD+sfLVb19dt+BZeXB6",
+	"UguHTr0dohH/2Ov2yeTmoYfa56/h0/nO1cVnenV9Nhlf3AxfB07l80FzHD6Vz8RLybo8qb7CsPzq81a4",
+	"d3IaoNH46vr21euT6VfxMn0aMnqP0dE0mDw545uJIOSiWXK6h2Hp9L7HHsuNqn9419ttW4Pd+sg6Oeod",
+	"DS9GHhkdl/qkPLyrt25ho1w/qb2+lEdigGrjM+v6M72+Cs/27/lJd1wu3x0/tqbXKJx+bO5ad6XHQ/di",
+	"d1Tr3p+99MkO6jw5U3xxVZ54lcfjg9szK/QmI77X+hh6I6dCe4M6r735T+Pr8u4x7b0+1Ksv8Kzx0P14",
+	"6T4h1CfNnfJneu8OrMpZ0P34MnyiL5wdiqfm9eDu6ePj+Kh5GzD7ocVeTgano+ppcHvWeu25r/ymxffd",
+	"40qflM/D1+oDvNgvO9VO49q6sE9L1tcXWm5aFnvZ/xzi1weGGzjcu/gcNL/2SsPu26XP7Y5DmqWvT2d9",
+	"gps3oTcMd3fDr+5DaSKqA0GwcG751xf39SJ8ebyrPw3q7kgcNd2zu9Lnz7v16lf3vHE2ad22blr7fSIO",
+	"jo6fHm7Hln/onB1cVM66reaTfz8a1E7d895F5fzz/hQ+VFyLeK3ouXVyOob+/Yvdboz7xPKtj/jm9Gp/",
+	"/2K/3WrVj/DhITrZ8Zl7dLIb3vOb84uLavmxYT255PWxedTyFQ21jyfNo/Zk1OmT/Unn+OiGnrZbvL2/",
+	"/9huTQ7bJ85h+6jearWd0c2s98fLx1Zpd/8xcLxpt/X0eOK+TM/cPil9HO68XQ/vx4OTavnwa23U2b06",
+	"2r8sk/PPH/fvKn447n782gu7tYdztl/za8ehJ4Kz28PTs3PhNw4P+qTCjt8+t2ivMg32HjvN89aBfdFu",
+	"X01fWi+cPtw1dx/vwvbH0oC8sB66rZ7fXrWH0+v27s7DXrOBr+77xG90Pw74zcFkt109Z57duqhfHIR0",
+	"+lTpYnEMn+pnN+f34mPvEFbqmD92j9svb3T3+rF5Xzu9GjXKfeJ8fXCa1cvSwK8evnV3e83aw+HBoOKN",
+	"X+odb/zqdL6eIadSefv8+Oqzx+7T6Wl7OH4bfvQuuzvhq3PSJy+vpdPy1HuqnuPBMds5brWmV3t3D6z1",
+	"1J10L8qH1kuvOTlsk9dR9yCcfvUfJvfjy/3P4WHnvnmFao99coHvKsPTyya3dw8CfvTauPj42SYX5Kb7",
+	"8YS99K7PDmr+A/NaNjnsufbjffPlaRQ8uAdTXivt7aGrPnFHZXZOpuWXy8kIhsMSvmteWTufxxejl/Pb",
+	"i1Oncbd3fzY9DR8exNvkM3m5uGw83B7tfz2r8yfqX1z0yVAMeieVj43p4Pah1KqN9wfw9fahKnbv3i5f",
+	"rDc06j4dYnh+uXdeOrFO253bys1Rc6dZPbBb3uHRnt0no6pzgx+7Ny0IT8unp623k/Ht6Pb0/Nw5qz7e",
+	"POKTy/tpVdROp0dDzqDfmHTbD1dD9xp1puf7vafTPhmz4NK7HqAh7+01dnvD6v5lJ3Tenli7cf960D0b",
+	"PTm3buX+eNzt3JD29G10M905vKt+vQ7wQ2NP8ij3uvP5iZ1R66x2dt7dK+G305verSdeLlq/98nv18Pe",
+	"bp+o0+Xw8mDV0bOk+gRl6JlzL/uQ/lmEaH2Z9pW2q/cq255M4c9U9OV4kS6t8/yVBTAhFUEuBRoOlJSf",
+	"CGtV5QP65NcAB8jDBP2WWUpgIbAxqvpGtyyX8b5Gv7RdDywx622YH2muLtpOlcsUJVu2HXsVIv+wKcgO",
+	"Q+FSht+Q/TxCU76YZLdRffVW9wGL0dVJ/a65Wz+0+f4dmYpBbTAZ3zrOiXfjDR4/e7ukUh7vLSk7l5mr",
+	"d6er0sfqjw7WNldAyS2VtkXYPibrw8648oBKPGUpZBunT71DGhQYTBPVzzOK1UW1iexsTkQ6ukvlXfKj",
+	"1kJDhirwgm8NjA/5aFNYZNu1kOiMsW2xkkljc5U95oxOlsBjnZVv6CoVOsyRxZAo6BsJYmYd3wCQAZ3U",
+	"WJ8zVd9FzXeDAwATjh1XpLGzLJ+YMgeSRMplMuahXq5V69k+EWs9d4yNqUMPOlGSEHMtnbam45USieJR",
+	"Xg/0ODUFfswW5KBjVjTH35etKZ05n6wNO/usRcniE4hdi9c5hpHCW35+T6RgSHzgxMfJYjO9RFWYLbzL",
+	"Ubc1/mUiAg3VCl8wEQGIGqVO0nKRUCbcAvQRwxYsBpR6RSICKcnk8rnKqtdbHb3JyjjLPQVRq3zEEhSb",
+	"uOu1U7z/rls6hHKfkc2ijBatpWS68X0R85Gpa/t0a9t1WcgjXDvH7OrzTbssKdu7rltGIMq6Lgte/HUd",
+	"lhm1v33J5jyRdOngMSIZYbsqXw7z6F59hqCnC2SpdH4wCAVY/Eg6ClpFPkh66ZOMb6/jVICPIDHeeeh5",
+	"IKMh0DuP9wlkSDM+LT0uzAvjtoZLjjFV3iZtfZUA9wkLPaQLgDE0pAzlwQQBF47jDE21m4FKLpSrGyAA",
+	"JzAqTIEFwJx8EH0SUM6xCZvx8atyDvtQWK42A5vvAQR1lMwrmXJMO8sM44no7m3uYJkLsN2YpDbsMZ8h",
+	"tAVBbdgju9TzxrSxYfsl7glVq2P7iOg4pnqT9AcTY67zH5bVnzc+rGgTfJnbLlvGQLOQkGWBzqmQ94Vd",
+	"uPWCfjA7IduVNzfkl6UH0fKA7SKvxZHSUVx2MriZWrhoGIbOtJUIDL2gaPJTMlG3/XVmsyKnP3Q/2IIU",
+	"/be6vWszZ7USO62QYTHtys2gEbSPINNYHai/jiIR8/ShJ4VE1VIKr7pdPKqU/XPfvilhfkizAgJ1kq2g",
+	"xgCiwh51aILOxeFFFahuIXNHlV5urhVAy0WgqgKZlYAcG8omk0kRqtfKOmX68tJ5p3142T0sVIvloit8",
+	"TwtpQqHsqruvpjfZHAyobHIAA5zwVX/KVaMaqPLFp1ytWC5Wcrq4j0JTyfIoQbz0B7a/qX2VVe/gGGlf",
+	"sOYqqvIBMKwAUKaCRT0kohL0+noGGMWQRoe9vuMmYbChTMWKznKYVMoipgQoJoRsZBeThdg6tgYleVuW",
+	"CpaDPhJKtP5Hxn09UbJVBLygwFEVFzBRuqFwIxf/p+hijGjHaSVHM5g/5VKrL3I2fZmZ+hjVcjkRrWiy",
+	"DDzjyCy9mDp2M4BWHn8JLKntnMZMEidyi9TfcWqTU7Q4aYdoISuKLsa2nrry50/dClXdqhFSNkGsAdGz",
+	"1/782e/IzKwnd2CAmNwbIN7bGpL6XwHJiNAJmfsEjb/i698R9BqoIDig8tQAtVSNaTvFwhUVR8z7H18k",
+	"jfDQ9yGbmozCJBNSzCveT2qcUvRDVZzKuqejrVOtISBoEnXNg4DKpWOliViUcFPWRVnDxohFN/hzxe+N",
+	"SoOgFRVDwyyp4PBFxnVNuYiuNNRMBnERXY74PhSfvtbrW/r4lMzs2wK/qbz37B0769Obl8CFXF+ziex/",
+	"GdNhs7u2fnKen5xnQ85jmEYWp3kv4WkLeSnC4RpBKXXh20aiUjzw/zFhKYWpjB2UxstPgekn2/o3FZiW",
+	"8i+tCCalpgz5JXkv80b8JMGs/kZc5E+QveZvvP6rpa+s+7EztpSqHIgms2JVA6Qy2/RFe9l8TaBXUVJl",
+	"mdPwzKN2Y+5Vf68JsmjzW+rUlmhJlWlcQQCeSaT+nlN8iAnmbuIQByvPcCxmR7dOnFUuCB8JCDDRexhT",
+	"AuCAhsKEL/PQE6uOeZUH/vOQX3vIm/u0M0lDboG4mqb2XsUKIiaAUH1pjRV6kJnygeBX4dLQcY3/6LR7",
+	"dflb8T+OkI5VqUgncuxFuzyLjFJ3g6+kpbjlBuR0i0TICFf5FfHVmhIYpYMbdhbdp6n4u6kmFDe2qCKs",
+	"uB6H+XxRNSUoQNIca67J1NGKkETXZhai4YqNFaQ4u3P9Jz2upccZspYQZepzLxDmfyatpcljA6JL5Omt",
+	"prk4/1yS3AKd6UK26BVaInUQMUV+yAY20uVtaIrWYtO/KkO2ijIiOH8SxnrCiK/1X0IX0afchi5+Kqk/",
+	"ldS/m5K6wJuy+J0aPClTLLCY2XVMC8wla2WzJiVV/GdZpEeinaoO9KeS/mwNWbs9vpjAIOMnmf1ryExv",
+	"9H8/IpvdbAE9D8TBZtFumpHZeos2JDrogVhxYKiGbFbofzAF6ujMJtTN7UfINP+hU7/2F5/hSz+legGS",
+	"z35S8U8q3oaK0eIOkpQbB/ksPyGvTJMf3Pfz8VcLCzWgKF4gtXI5RHT12L+hXLJyOd/irIcsLnZhbiyg",
+	"dmjpazbiko/pEDAY4KKqpuPioU43gQEu6YqryvKAWCG6LqU0rippZS4wTUAHE2fVBFxAB/3gNOZacHOj",
+	"QjzNunG+fPv/AQAA//+t7x7Xl7cAAA==",
 }
 
 // GetSwagger returns the content of the embedded swagger specification file
diff --git a/internal/cloudapi/v2/openapi.v2.yml b/internal/cloudapi/v2/openapi.v2.yml
index 47e5402b0..d83b89bbd 100644
--- a/internal/cloudapi/v2/openapi.v2.yml
+++ b/internal/cloudapi/v2/openapi.v2.yml
@@ -1819,6 +1819,13 @@ components:
           items:
             type: string
             example: "firewalld"
+        masked:
+          description: List of services to mask by default
+          type: array
+          minItems: 1
+          items:
+            type: string
+            example: "telnetd"
     Timezone:
       type: object
       description: Timezone configuration
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/version.go b/vendor/github.com/aws/aws-sdk-go/aws/version.go
index a1b1509c5..f7ab62a80 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/version.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/version.go
@@ -5,4 +5,4 @@ package aws
 const SDKName = "aws-sdk-go"
 
 // SDKVersion is the version of this SDK
-const SDKVersion = "1.50.24"
+const SDKVersion = "1.50.27"
diff --git a/vendor/github.com/gophercloud/gophercloud/CHANGELOG.md b/vendor/github.com/gophercloud/gophercloud/CHANGELOG.md
index e10078ade..3d99d01ff 100644
--- a/vendor/github.com/gophercloud/gophercloud/CHANGELOG.md
+++ b/vendor/github.com/gophercloud/gophercloud/CHANGELOG.md
@@ -1,3 +1,13 @@
+## v1.10.0 (2024-02-27)
+
+* [GH-2893](https://github.com/gophercloud/gophercloud/pull/2893) [v1] authentication: Add WithContext functions
+* [GH-2894](https://github.com/gophercloud/gophercloud/pull/2894) [v1] pager: Add WithContext functions
+* [GH-2899](https://github.com/gophercloud/gophercloud/pull/2899) [v1] Authenticate with a clouds.yaml
+* [GH-2917](https://github.com/gophercloud/gophercloud/pull/2917) [v1] Add ParseOption type to made clouds.Parse() more usable for optional With* funcs
+* [GH-2924](https://github.com/gophercloud/gophercloud/pull/2924) [v1] build(deps): bump EmilienM/devstack-action from 0.11 to 0.14
+* [GH-2933](https://github.com/gophercloud/gophercloud/pull/2933) [v1]  Fix AllowReauth reauthentication
+* [GH-2950](https://github.com/gophercloud/gophercloud/pull/2950) [v1] compute: Use volumeID, not attachmentID for volume attachments
+
 ## v1.9.0 (2024-02-02)
 
 New features and improvements:
diff --git a/vendor/github.com/gophercloud/gophercloud/openstack/client.go b/vendor/github.com/gophercloud/gophercloud/openstack/client.go
index 81c907c35..acaa02be4 100644
--- a/vendor/github.com/gophercloud/gophercloud/openstack/client.go
+++ b/vendor/github.com/gophercloud/gophercloud/openstack/client.go
@@ -1,6 +1,7 @@
 package openstack
 
 import (
+	"context"
 	"fmt"
 	"reflect"
 	"strings"
@@ -23,20 +24,18 @@ const (
 	v3 = "v3"
 )
 
-/*
-NewClient prepares an unauthenticated ProviderClient instance.
-Most users will probably prefer using the AuthenticatedClient function
-instead.
-
-This is useful if you wish to explicitly control the version of the identity
-service that's used for authentication explicitly, for example.
-
-A basic example of using this would be:
-
-	ao, err := openstack.AuthOptionsFromEnv()
-	provider, err := openstack.NewClient(ao.IdentityEndpoint)
-	client, err := openstack.NewIdentityV3(provider, gophercloud.EndpointOpts{})
-*/
+// NewClient prepares an unauthenticated ProviderClient instance.
+// Most users will probably prefer using the AuthenticatedClient function
+// instead.
+//
+// This is useful if you wish to explicitly control the version of the identity
+// service that's used for authentication explicitly, for example.
+//
+// A basic example of using this would be:
+//
+//	ao, err := openstack.AuthOptionsFromEnv()
+//	provider, err := openstack.NewClient(ao.IdentityEndpoint)
+//	client, err := openstack.NewIdentityV3(provider, gophercloud.EndpointOpts{})
 func NewClient(endpoint string) (*gophercloud.ProviderClient, error) {
 	base, err := utils.BaseEndpoint(endpoint)
 	if err != nil {
@@ -54,42 +53,45 @@ func NewClient(endpoint string) (*gophercloud.ProviderClient, error) {
 	return p, nil
 }
 
-/*
-AuthenticatedClient logs in to an OpenStack cloud found at the identity endpoint
-specified by the options, acquires a token, and returns a Provider Client
-instance that's ready to operate.
-
-If the full path to a versioned identity endpoint was specified  (example:
-http://example.com:5000/v3), that path will be used as the endpoint to query.
-
-If a versionless endpoint was specified (example: http://example.com:5000/),
-the endpoint will be queried to determine which versions of the identity service
-are available, then chooses the most recent or most supported version.
-
-Example:
-
-	ao, err := openstack.AuthOptionsFromEnv()
-	provider, err := openstack.AuthenticatedClient(ao)
-	client, err := openstack.NewNetworkV2(provider, gophercloud.EndpointOpts{
-		Region: os.Getenv("OS_REGION_NAME"),
-	})
-*/
-func AuthenticatedClient(options gophercloud.AuthOptions) (*gophercloud.ProviderClient, error) {
+// AuthenticatedClientWithContext logs in to an OpenStack cloud found at the identity endpoint
+// specified by the options, acquires a token, and returns a Provider Client
+// instance that's ready to operate.
+//
+// If the full path to a versioned identity endpoint was specified  (example:
+// http://example.com:5000/v3), that path will be used as the endpoint to query.
+//
+// If a versionless endpoint was specified (example: http://example.com:5000/),
+// the endpoint will be queried to determine which versions of the identity service
+// are available, then chooses the most recent or most supported version.
+//
+// Example:
+//
+//	ao, err := openstack.AuthOptionsFromEnv()
+//	provider, err := openstack.AuthenticatedClientWithContext(ctx, ao)
+//	client, err := openstack.NewNetworkV2(provider, gophercloud.EndpointOpts{
+//		Region: os.Getenv("OS_REGION_NAME"),
+//	})
+func AuthenticatedClientWithContext(ctx context.Context, options gophercloud.AuthOptions) (*gophercloud.ProviderClient, error) {
 	client, err := NewClient(options.IdentityEndpoint)
 	if err != nil {
 		return nil, err
 	}
 
-	err = Authenticate(client, options)
+	err = AuthenticateWithContext(ctx, client, options)
 	if err != nil {
 		return nil, err
 	}
 	return client, nil
 }
 
-// Authenticate or re-authenticate against the most recent identity service
-// supported at the provided endpoint.
-func Authenticate(client *gophercloud.ProviderClient, options gophercloud.AuthOptions) error {
+// AuthenticatedClient is a compatibility wrapper around AuthenticatedClientWithContext
+func AuthenticatedClient(options gophercloud.AuthOptions) (*gophercloud.ProviderClient, error) {
+	return AuthenticatedClientWithContext(context.Background(), options)
+}
+
+// AuthenticateWithContext authenticates or re-authenticates against the most
+// recent identity service supported at the provided endpoint.
+func AuthenticateWithContext(ctx context.Context, client *gophercloud.ProviderClient, options gophercloud.AuthOptions) error {
 	versions := []*utils.Version{
 		{ID: v2, Priority: 20, Suffix: "/v2.0/"},
 		{ID: v3, Priority: 30, Suffix: "/v3/"},
@@ -102,21 +104,31 @@ func Authenticate(client *gophercloud.ProviderClient, options gophercloud.AuthOp
 
 	switch chosen.ID {
 	case v2:
-		return v2auth(client, endpoint, options, gophercloud.EndpointOpts{})
+		return v2auth(ctx, client, endpoint, options, gophercloud.EndpointOpts{})
 	case v3:
-		return v3auth(client, endpoint, &options, gophercloud.EndpointOpts{})
+		return v3auth(ctx, client, endpoint, &options, gophercloud.EndpointOpts{})
 	default:
 		// The switch statement must be out of date from the versions list.
 		return fmt.Errorf("Unrecognized identity version: %s", chosen.ID)
 	}
 }
 
-// AuthenticateV2 explicitly authenticates against the identity v2 endpoint.
+// Authenticate is a compatibility wrapper around AuthenticateWithContext.
+func Authenticate(client *gophercloud.ProviderClient, options gophercloud.AuthOptions) error {
+	return AuthenticateWithContext(context.Background(), client, options)
+}
+
+// AuthenticateV2WithContext explicitly authenticates against the identity v2 endpoint.
+func AuthenticateV2WithContext(ctx context.Context, client *gophercloud.ProviderClient, options gophercloud.AuthOptions, eo gophercloud.EndpointOpts) error {
+	return v2auth(ctx, client, "", options, eo)
+}
+
+// AuthenticateV2 is a compatibility wrapper around AuthenticateV2WithContext.
 func AuthenticateV2(client *gophercloud.ProviderClient, options gophercloud.AuthOptions, eo gophercloud.EndpointOpts) error {
-	return v2auth(client, "", options, eo)
+	return AuthenticateV2WithContext(context.Background(), client, options, eo)
 }
 
-func v2auth(client *gophercloud.ProviderClient, endpoint string, options gophercloud.AuthOptions, eo gophercloud.EndpointOpts) error {
+func v2auth(ctx context.Context, client *gophercloud.ProviderClient, endpoint string, options gophercloud.AuthOptions, eo gophercloud.EndpointOpts) error {
 	v2Client, err := NewIdentityV2(client, eo)
 	if err != nil {
 		return err
@@ -136,7 +148,7 @@ func v2auth(client *gophercloud.ProviderClient, endpoint string, options gopherc
 		TokenID:          options.TokenID,
 	}
 
-	result := tokens2.Create(v2Client, v2Opts)
+	result := tokens2.CreateWithContext(ctx, v2Client, v2Opts)
 
 	err = client.SetTokenAndAuthResult(result)
 	if err != nil {
@@ -159,7 +171,7 @@ func v2auth(client *gophercloud.ProviderClient, endpoint string, options gopherc
 		tao := options
 		tao.AllowReauth = false
 		client.ReauthFunc = func() error {
-			err := v2auth(&tac, endpoint, tao, eo)
+			err := v2auth(context.Background(), &tac, endpoint, tao, eo)
 			if err != nil {
 				return err
 			}
@@ -174,12 +186,17 @@ func v2auth(client *gophercloud.ProviderClient, endpoint string, options gopherc
 	return nil
 }
 
-// AuthenticateV3 explicitly authenticates against the identity v3 service.
+// AuthenticateV3WithContext explicitly authenticates against the identity v3 service.
+func AuthenticateV3WithContext(ctx context.Context, client *gophercloud.ProviderClient, options tokens3.AuthOptionsBuilder, eo gophercloud.EndpointOpts) error {
+	return v3auth(ctx, client, "", options, eo)
+}
+
+// AuthenticateV3 is a compatibility wrapper around AuthenticateV3WithContext
 func AuthenticateV3(client *gophercloud.ProviderClient, options tokens3.AuthOptionsBuilder, eo gophercloud.EndpointOpts) error {
-	return v3auth(client, "", options, eo)
+	return AuthenticateV3WithContext(context.Background(), client, options, eo)
 }
 
-func v3auth(client *gophercloud.ProviderClient, endpoint string, opts tokens3.AuthOptionsBuilder, eo gophercloud.EndpointOpts) error {
+func v3auth(ctx context.Context, client *gophercloud.ProviderClient, endpoint string, opts tokens3.AuthOptionsBuilder, eo gophercloud.EndpointOpts) error {
 	// Override the generated service endpoint with the one returned by the version endpoint.
 	v3Client, err := NewIdentityV3(client, eo)
 	if err != nil {
@@ -229,11 +246,11 @@ func v3auth(client *gophercloud.ProviderClient, endpoint string, opts tokens3.Au
 		var result tokens3.CreateResult
 		switch opts.(type) {
 		case *ec2tokens.AuthOptions:
-			result = ec2tokens.Create(v3Client, opts)
+			result = ec2tokens.CreateWithContext(ctx, v3Client, opts)
 		case *oauth1.AuthOptions:
-			result = oauth1.Create(v3Client, opts)
+			result = oauth1.CreateWithContext(ctx, v3Client, opts)
 		default:
-			result = tokens3.Create(v3Client, opts)
+			result = tokens3.CreateWithContext(ctx, v3Client, opts)
 		}
 
 		err = client.SetTokenAndAuthResult(result)
@@ -277,7 +294,7 @@ func v3auth(client *gophercloud.ProviderClient, endpoint string, opts tokens3.Au
 			tao = opts
 		}
 		client.ReauthFunc = func() error {
-			err := v3auth(&tac, endpoint, tao, eo)
+			err := v3auth(context.Background(), &tac, endpoint, tao, eo)
 			if err != nil {
 				return err
 			}
diff --git a/vendor/github.com/gophercloud/gophercloud/openstack/identity/v2/tokens/requests.go b/vendor/github.com/gophercloud/gophercloud/openstack/identity/v2/tokens/requests.go
index 84f16c3fc..67c04fced 100644
--- a/vendor/github.com/gophercloud/gophercloud/openstack/identity/v2/tokens/requests.go
+++ b/vendor/github.com/gophercloud/gophercloud/openstack/identity/v2/tokens/requests.go
@@ -1,6 +1,10 @@
 package tokens
 
-import "github.com/gophercloud/gophercloud"
+import (
+	"context"
+
+	"github.com/gophercloud/gophercloud"
+)
 
 // PasswordCredentialsV2 represents the required options to authenticate
 // with a username and password.
@@ -77,17 +81,17 @@ func (opts AuthOptions) ToTokenV2CreateMap() (map[string]interface{}, error) {
 	return b, nil
 }
 
-// Create authenticates to the identity service and attempts to acquire a Token.
+// CreateWithContext authenticates to the identity service and attempts to acquire a Token.
 // Generally, rather than interact with this call directly, end users should
 // call openstack.AuthenticatedClient(), which abstracts all of the gory details
 // about navigating service catalogs and such.
-func Create(client *gophercloud.ServiceClient, auth AuthOptionsBuilder) (r CreateResult) {
+func CreateWithContext(ctx context.Context, client *gophercloud.ServiceClient, auth AuthOptionsBuilder) (r CreateResult) {
 	b, err := auth.ToTokenV2CreateMap()
 	if err != nil {
 		r.Err = err
 		return
 	}
-	resp, err := client.Post(CreateURL(client), b, &r.Body, &gophercloud.RequestOpts{
+	resp, err := client.PostWithContext(ctx, CreateURL(client), b, &r.Body, &gophercloud.RequestOpts{
 		OkCodes:     []int{200, 203},
 		OmitHeaders: []string{"X-Auth-Token"},
 	})
@@ -95,11 +99,21 @@ func Create(client *gophercloud.ServiceClient, auth AuthOptionsBuilder) (r Creat
 	return
 }
 
-// Get validates and retrieves information for user's token.
-func Get(client *gophercloud.ServiceClient, token string) (r GetResult) {
+// Create is a compatibility wrapper around CreateWithContext
+func Create(client *gophercloud.ServiceClient, auth AuthOptionsBuilder) (r CreateResult) {
+	return CreateWithContext(context.Background(), client, auth)
+}
+
+// GetWithContext validates and retrieves information for user's token.
+func GetWithContext(ctx context.Context, client *gophercloud.ServiceClient, token string) (r GetResult) {
 	resp, err := client.Get(GetURL(client, token), &r.Body, &gophercloud.RequestOpts{
 		OkCodes: []int{200, 203},
 	})
 	_, r.Header, r.Err = gophercloud.ParseResponse(resp, err)
 	return
 }
+
+// Get is a compatibility wrapper around GetWithContext
+func Get(client *gophercloud.ServiceClient, token string) (r GetResult) {
+	return GetWithContext(context.Background(), client, token)
+}
diff --git a/vendor/github.com/gophercloud/gophercloud/openstack/identity/v3/extensions/ec2tokens/requests.go b/vendor/github.com/gophercloud/gophercloud/openstack/identity/v3/extensions/ec2tokens/requests.go
index 32ba0e621..b5b5350c5 100644
--- a/vendor/github.com/gophercloud/gophercloud/openstack/identity/v3/extensions/ec2tokens/requests.go
+++ b/vendor/github.com/gophercloud/gophercloud/openstack/identity/v3/extensions/ec2tokens/requests.go
@@ -1,6 +1,7 @@
 package ec2tokens
 
 import (
+	"context"
 	"crypto/hmac"
 	"crypto/sha1"
 	"crypto/sha256"
@@ -287,8 +288,8 @@ func (opts *AuthOptions) ToTokenV3CreateMap(map[string]interface{}) (map[string]
 	return b, nil
 }
 
-// Create authenticates and either generates a new token from EC2 credentials
-func Create(c *gophercloud.ServiceClient, opts tokens.AuthOptionsBuilder) (r tokens.CreateResult) {
+// CreateWithContext authenticates and either generates a new token from EC2 credentials
+func CreateWithContext(ctx context.Context, c *gophercloud.ServiceClient, opts tokens.AuthOptionsBuilder) (r tokens.CreateResult) {
 	b, err := opts.ToTokenV3CreateMap(nil)
 	if err != nil {
 		r.Err = err
@@ -298,7 +299,7 @@ func Create(c *gophercloud.ServiceClient, opts tokens.AuthOptionsBuilder) (r tok
 	// delete "token" element, since it is used in s3tokens
 	deleteBodyElements(b, "token")
 
-	resp, err := c.Post(ec2tokensURL(c), b, &r.Body, &gophercloud.RequestOpts{
+	resp, err := c.PostWithContext(ctx, ec2tokensURL(c), b, &r.Body, &gophercloud.RequestOpts{
 		MoreHeaders: map[string]string{"X-Auth-Token": ""},
 		OkCodes:     []int{200},
 	})
@@ -306,9 +307,15 @@ func Create(c *gophercloud.ServiceClient, opts tokens.AuthOptionsBuilder) (r tok
 	return
 }
 
-// ValidateS3Token authenticates an S3 request using EC2 credentials. Doesn't
-// generate a new token ID, but returns a tokens.CreateResult.
-func ValidateS3Token(c *gophercloud.ServiceClient, opts tokens.AuthOptionsBuilder) (r tokens.CreateResult) {
+// Create is a compatibility wrapper around CreateWithContext
+func Create(c *gophercloud.ServiceClient, opts tokens.AuthOptionsBuilder) (r tokens.CreateResult) {
+	return CreateWithContext(context.Background(), c, opts)
+}
+
+// ValidateS3TokenWithContext authenticates an S3 request using EC2
+// credentials. Doesn't generate a new token ID, but returns a
+// tokens.CreateResult.
+func ValidateS3TokenWithContext(ctx context.Context, c *gophercloud.ServiceClient, opts tokens.AuthOptionsBuilder) (r tokens.CreateResult) {
 	b, err := opts.ToTokenV3CreateMap(nil)
 	if err != nil {
 		r.Err = err
@@ -318,7 +325,7 @@ func ValidateS3Token(c *gophercloud.ServiceClient, opts tokens.AuthOptionsBuilde
 	// delete unused element, since it is used in ec2tokens only
 	deleteBodyElements(b, "body_hash", "headers", "host", "params", "path", "verb")
 
-	resp, err := c.Post(s3tokensURL(c), b, &r.Body, &gophercloud.RequestOpts{
+	resp, err := c.PostWithContext(ctx, s3tokensURL(c), b, &r.Body, &gophercloud.RequestOpts{
 		MoreHeaders: map[string]string{"X-Auth-Token": ""},
 		OkCodes:     []int{200},
 	})
@@ -326,6 +333,11 @@ func ValidateS3Token(c *gophercloud.ServiceClient, opts tokens.AuthOptionsBuilde
 	return
 }
 
+// ValidateS3Token is a compatibility wrapper around ValidateS3TokenWithContext
+func ValidateS3Token(c *gophercloud.ServiceClient, opts tokens.AuthOptionsBuilder) (r tokens.CreateResult) {
+	return ValidateS3TokenWithContext(context.Background(), c, opts)
+}
+
 // The following are small helper functions used to help build the signature.
 
 // sumHMAC1 is a func to implement the HMAC SHA1 signature method.
diff --git a/vendor/github.com/gophercloud/gophercloud/openstack/identity/v3/extensions/oauth1/requests.go b/vendor/github.com/gophercloud/gophercloud/openstack/identity/v3/extensions/oauth1/requests.go
index 028b5a45b..992105632 100644
--- a/vendor/github.com/gophercloud/gophercloud/openstack/identity/v3/extensions/oauth1/requests.go
+++ b/vendor/github.com/gophercloud/gophercloud/openstack/identity/v3/extensions/oauth1/requests.go
@@ -1,6 +1,7 @@
 package oauth1
 
 import (
+	"context"
 	"crypto/hmac"
 	"crypto/sha1"
 	"encoding/base64"
@@ -133,9 +134,9 @@ func (opts AuthOptions) ToTokenV3CreateMap(map[string]interface{}) (map[string]i
 	return gophercloud.BuildRequestBody(req, "")
 }
 
-// Create authenticates and either generates a new OpenStack token from an
-// OAuth1 token.
-func Create(client *gophercloud.ServiceClient, opts tokens.AuthOptionsBuilder) (r tokens.CreateResult) {
+// CreateWithContext authenticates and either generates a new OpenStack token
+// from an OAuth1 token.
+func CreateWithContext(ctx context.Context, client *gophercloud.ServiceClient, opts tokens.AuthOptionsBuilder) (r tokens.CreateResult) {
 	b, err := opts.ToTokenV3CreateMap(nil)
 	if err != nil {
 		r.Err = err
@@ -153,7 +154,7 @@ func Create(client *gophercloud.ServiceClient, opts tokens.AuthOptionsBuilder) (
 		return
 	}
 
-	resp, err := client.Post(authURL(client), b, &r.Body, &gophercloud.RequestOpts{
+	resp, err := client.PostWithContext(ctx, authURL(client), b, &r.Body, &gophercloud.RequestOpts{
 		MoreHeaders: h,
 		OkCodes:     []int{201},
 	})
@@ -161,6 +162,11 @@ func Create(client *gophercloud.ServiceClient, opts tokens.AuthOptionsBuilder) (
 	return
 }
 
+// Create is a compatibility wrapper around CreateWithContext.
+func Create(client *gophercloud.ServiceClient, opts tokens.AuthOptionsBuilder) (r tokens.CreateResult) {
+	return CreateWithContext(context.Background(), client, opts)
+}
+
 // CreateConsumerOptsBuilder allows extensions to add additional parameters to
 // the CreateConsumer request.
 type CreateConsumerOptsBuilder interface {
@@ -178,27 +184,37 @@ func (opts CreateConsumerOpts) ToOAuth1CreateConsumerMap() (map[string]interface
 	return gophercloud.BuildRequestBody(opts, "consumer")
 }
 
-// Create creates a new Consumer.
-func CreateConsumer(client *gophercloud.ServiceClient, opts CreateConsumerOptsBuilder) (r CreateConsumerResult) {
+// CreateConsumerWithContext creates a new Consumer.
+func CreateConsumerWithContext(ctx context.Context, client *gophercloud.ServiceClient, opts CreateConsumerOptsBuilder) (r CreateConsumerResult) {
 	b, err := opts.ToOAuth1CreateConsumerMap()
 	if err != nil {
 		r.Err = err
 		return
 	}
-	resp, err := client.Post(consumersURL(client), b, &r.Body, &gophercloud.RequestOpts{
+	resp, err := client.PostWithContext(ctx, consumersURL(client), b, &r.Body, &gophercloud.RequestOpts{
 		OkCodes: []int{201},
 	})
 	_, r.Header, r.Err = gophercloud.ParseResponse(resp, err)
 	return
 }
 
-// Delete deletes a Consumer.
-func DeleteConsumer(client *gophercloud.ServiceClient, id string) (r DeleteConsumerResult) {
-	resp, err := client.Delete(consumerURL(client, id), nil)
+// CreateConsumer is a compatibility wrapper around CreateConsumerWithContext.
+func CreateConsumer(client *gophercloud.ServiceClient, opts CreateConsumerOptsBuilder) (r CreateConsumerResult) {
+	return CreateConsumerWithContext(context.Background(), client, opts)
+}
+
+// DeleteConsumerWithContext deletes a Consumer.
+func DeleteConsumerWithContext(ctx context.Context, client *gophercloud.ServiceClient, id string) (r DeleteConsumerResult) {
+	resp, err := client.DeleteWithContext(ctx, consumerURL(client, id), nil)
 	_, r.Header, r.Err = gophercloud.ParseResponse(resp, err)
 	return
 }
 
+// DeleteConsumer is a compatibility wrapper around DeleteConsumerWithContext.
+func DeleteConsumer(client *gophercloud.ServiceClient, id string) (r DeleteConsumerResult) {
+	return DeleteConsumerWithContext(context.Background(), client, id)
+}
+
 // List enumerates Consumers.
 func ListConsumers(client *gophercloud.ServiceClient) pagination.Pager {
 	return pagination.NewPager(client, consumersURL(client), func(r pagination.PageResult) pagination.Page {
@@ -206,13 +222,18 @@ func ListConsumers(client *gophercloud.ServiceClient) pagination.Pager {
 	})
 }
 
-// GetConsumer retrieves details on a single Consumer by ID.
-func GetConsumer(client *gophercloud.ServiceClient, id string) (r GetConsumerResult) {
-	resp, err := client.Get(consumerURL(client, id), &r.Body, nil)
+// GetConsumerWithContext retrieves details on a single Consumer by ID.
+func GetConsumerWithContext(ctx context.Context, client *gophercloud.ServiceClient, id string) (r GetConsumerResult) {
+	resp, err := client.GetWithContext(ctx, consumerURL(client, id), &r.Body, nil)
 	_, r.Header, r.Err = gophercloud.ParseResponse(resp, err)
 	return
 }
 
+// GetConsumer is a compatibility wrapper around GetConsumerWithContext.
+func GetConsumer(client *gophercloud.ServiceClient, id string) (r GetConsumerResult) {
+	return GetConsumerWithContext(context.Background(), client, id)
+}
+
 // UpdateConsumerOpts provides options used to update a consumer.
 type UpdateConsumerOpts struct {
 	// Description is the consumer description.
@@ -225,20 +246,25 @@ func (opts UpdateConsumerOpts) ToOAuth1UpdateConsumerMap() (map[string]interface
 	return gophercloud.BuildRequestBody(opts, "consumer")
 }
 
-// UpdateConsumer updates an existing Consumer.
-func UpdateConsumer(client *gophercloud.ServiceClient, id string, opts UpdateConsumerOpts) (r UpdateConsumerResult) {
+// UpdateConsumerWithContext updates an existing Consumer.
+func UpdateConsumerWithContext(ctx context.Context, client *gophercloud.ServiceClient, id string, opts UpdateConsumerOpts) (r UpdateConsumerResult) {
 	b, err := opts.ToOAuth1UpdateConsumerMap()
 	if err != nil {
 		r.Err = err
 		return
 	}
-	resp, err := client.Patch(consumerURL(client, id), b, &r.Body, &gophercloud.RequestOpts{
+	resp, err := client.PatchWithContext(ctx, consumerURL(client, id), b, &r.Body, &gophercloud.RequestOpts{
 		OkCodes: []int{200},
 	})
 	_, r.Header, r.Err = gophercloud.ParseResponse(resp, err)
 	return
 }
 
+// UpdateConsumer is a compatibility wrapper around UpdateConsumerWithContext.
+func UpdateConsumer(client *gophercloud.ServiceClient, id string, opts UpdateConsumerOpts) (r UpdateConsumerResult) {
+	return UpdateConsumerWithContext(context.Background(), client, id, opts)
+}
+
 // RequestTokenOptsBuilder allows extensions to add additional parameters to the
 // RequestToken request.
 type RequestTokenOptsBuilder interface {
@@ -297,15 +323,15 @@ func (opts RequestTokenOpts) ToOAuth1RequestTokenHeaders(method, u string) (map[
 	return h, nil
 }
 
-// RequestToken requests an unauthorized OAuth1 Token.
-func RequestToken(client *gophercloud.ServiceClient, opts RequestTokenOptsBuilder) (r TokenResult) {
+// RequestTokenWithContext requests an unauthorized OAuth1 Token.
+func RequestTokenWithContext(ctx context.Context, client *gophercloud.ServiceClient, opts RequestTokenOptsBuilder) (r TokenResult) {
 	h, err := opts.ToOAuth1RequestTokenHeaders("POST", requestTokenURL(client))
 	if err != nil {
 		r.Err = err
 		return
 	}
 
-	resp, err := client.Post(requestTokenURL(client), nil, nil, &gophercloud.RequestOpts{
+	resp, err := client.PostWithContext(ctx, requestTokenURL(client), nil, nil, &gophercloud.RequestOpts{
 		MoreHeaders:      h,
 		OkCodes:          []int{201},
 		KeepResponseBody: true,
@@ -323,6 +349,11 @@ func RequestToken(client *gophercloud.ServiceClient, opts RequestTokenOptsBuilde
 	return
 }
 
+// RequestToken is a compatibility wrapper around RequestTokenWithContext.
+func RequestToken(client *gophercloud.ServiceClient, opts RequestTokenOptsBuilder) (r TokenResult) {
+	return RequestTokenWithContext(context.Background(), client, opts)
+}
+
 // AuthorizeTokenOptsBuilder allows extensions to add additional parameters to
 // the AuthorizeToken request.
 type AuthorizeTokenOptsBuilder interface {
@@ -351,20 +382,25 @@ func (opts AuthorizeTokenOpts) ToOAuth1AuthorizeTokenMap() (map[string]interface
 	return gophercloud.BuildRequestBody(opts, "")
 }
 
-// AuthorizeToken authorizes an unauthorized consumer token.
-func AuthorizeToken(client *gophercloud.ServiceClient, id string, opts AuthorizeTokenOptsBuilder) (r AuthorizeTokenResult) {
+// AuthorizeTokenWithContext authorizes an unauthorized consumer token.
+func AuthorizeTokenWithContext(ctx context.Context, client *gophercloud.ServiceClient, id string, opts AuthorizeTokenOptsBuilder) (r AuthorizeTokenResult) {
 	b, err := opts.ToOAuth1AuthorizeTokenMap()
 	if err != nil {
 		r.Err = err
 		return
 	}
-	resp, err := client.Put(authorizeTokenURL(client, id), b, &r.Body, &gophercloud.RequestOpts{
+	resp, err := client.PutWithContext(ctx, authorizeTokenURL(client, id), b, &r.Body, &gophercloud.RequestOpts{
 		OkCodes: []int{200},
 	})
 	_, r.Header, r.Err = gophercloud.ParseResponse(resp, err)
 	return
 }
 
+// AuthorizeToken is a compatibility wrapper around AuthorizeTokenWithContext.
+func AuthorizeToken(client *gophercloud.ServiceClient, id string, opts AuthorizeTokenOptsBuilder) (r AuthorizeTokenResult) {
+	return AuthorizeTokenWithContext(context.Background(), client, id, opts)
+}
+
 // CreateAccessTokenOptsBuilder allows extensions to add additional parameters
 // to the CreateAccessToken request.
 type CreateAccessTokenOptsBuilder interface {
@@ -425,15 +461,15 @@ func (opts CreateAccessTokenOpts) ToOAuth1CreateAccessTokenHeaders(method, u str
 	return headers, nil
 }
 
-// CreateAccessToken creates a new OAuth1 Access Token
-func CreateAccessToken(client *gophercloud.ServiceClient, opts CreateAccessTokenOptsBuilder) (r TokenResult) {
+// CreateAccessTokenWithContext creates a new OAuth1 Access Token
+func CreateAccessTokenWithContext(ctx context.Context, client *gophercloud.ServiceClient, opts CreateAccessTokenOptsBuilder) (r TokenResult) {
 	h, err := opts.ToOAuth1CreateAccessTokenHeaders("POST", createAccessTokenURL(client))
 	if err != nil {
 		r.Err = err
 		return
 	}
 
-	resp, err := client.Post(createAccessTokenURL(client), nil, nil, &gophercloud.RequestOpts{
+	resp, err := client.PostWithContext(ctx, createAccessTokenURL(client), nil, nil, &gophercloud.RequestOpts{
 		MoreHeaders:      h,
 		OkCodes:          []int{201},
 		KeepResponseBody: true,
@@ -451,20 +487,35 @@ func CreateAccessToken(client *gophercloud.ServiceClient, opts CreateAccessToken
 	return
 }
 
-// GetAccessToken retrieves details on a single OAuth1 access token by an ID.
-func GetAccessToken(client *gophercloud.ServiceClient, userID string, id string) (r GetAccessTokenResult) {
-	resp, err := client.Get(userAccessTokenURL(client, userID, id), &r.Body, nil)
+// CreateAccessToken is a compatibility wrapper around CreateAccessTokenWithContext.
+func CreateAccessToken(client *gophercloud.ServiceClient, opts CreateAccessTokenOptsBuilder) (r TokenResult) {
+	return CreateAccessTokenWithContext(context.Background(), client, opts)
+}
+
+// GetAccessTokenWithContext retrieves details on a single OAuth1 access token by an ID.
+func GetAccessTokenWithContext(ctx context.Context, client *gophercloud.ServiceClient, userID string, id string) (r GetAccessTokenResult) {
+	resp, err := client.GetWithContext(ctx, userAccessTokenURL(client, userID, id), &r.Body, nil)
 	_, r.Header, r.Err = gophercloud.ParseResponse(resp, err)
 	return
 }
 
-// RevokeAccessToken revokes an OAuth1 access token.
-func RevokeAccessToken(client *gophercloud.ServiceClient, userID string, id string) (r RevokeAccessTokenResult) {
-	resp, err := client.Delete(userAccessTokenURL(client, userID, id), nil)
+// GetAccessToken is a compatibility wrapper around GetAccessTokenWithContext.
+func GetAccessToken(client *gophercloud.ServiceClient, userID string, id string) (r GetAccessTokenResult) {
+	return GetAccessTokenWithContext(context.Background(), client, userID, id)
+}
+
+// RevokeAccessTokenWithContext revokes an OAuth1 access token.
+func RevokeAccessTokenWithContext(ctx context.Context, client *gophercloud.ServiceClient, userID string, id string) (r RevokeAccessTokenResult) {
+	resp, err := client.DeleteWithContext(ctx, userAccessTokenURL(client, userID, id), nil)
 	_, r.Header, r.Err = gophercloud.ParseResponse(resp, err)
 	return
 }
 
+// RevokeAccessToken is a compatibility wrapper around RevokeAccessTokenWithContext.
+func RevokeAccessToken(client *gophercloud.ServiceClient, userID string, id string) (r RevokeAccessTokenResult) {
+	return RevokeAccessTokenWithContext(context.Background(), client, userID, id)
+}
+
 // ListAccessTokens enumerates authorized access tokens.
 func ListAccessTokens(client *gophercloud.ServiceClient, userID string) pagination.Pager {
 	url := userAccessTokensURL(client, userID)
@@ -481,14 +532,19 @@ func ListAccessTokenRoles(client *gophercloud.ServiceClient, userID string, id s
 	})
 }
 
-// GetAccessTokenRole retrieves details on a single OAuth1 access token role by
+// GetAccessTokenRoleWithContext retrieves details on a single OAuth1 access token role by
 // an ID.
-func GetAccessTokenRole(client *gophercloud.ServiceClient, userID string, id string, roleID string) (r GetAccessTokenRoleResult) {
-	resp, err := client.Get(userAccessTokenRoleURL(client, userID, id, roleID), &r.Body, nil)
+func GetAccessTokenRoleWithContext(ctx context.Context, client *gophercloud.ServiceClient, userID string, id string, roleID string) (r GetAccessTokenRoleResult) {
+	resp, err := client.GetWithContext(ctx, userAccessTokenRoleURL(client, userID, id, roleID), &r.Body, nil)
 	_, r.Header, r.Err = gophercloud.ParseResponse(resp, err)
 	return
 }
 
+// GetAccessTokenRole is a compatibility wrapper around GetAccessTokenRoleWithContext.
+func GetAccessTokenRole(client *gophercloud.ServiceClient, userID string, id string, roleID string) (r GetAccessTokenRoleResult) {
+	return GetAccessTokenRoleWithContext(context.Background(), client, userID, id, roleID)
+}
+
 // The following are small helper functions used to help build the signature.
 
 // buildOAuth1QueryString builds a URLEncoded parameters string specific for
diff --git a/vendor/github.com/gophercloud/gophercloud/openstack/identity/v3/tokens/requests.go b/vendor/github.com/gophercloud/gophercloud/openstack/identity/v3/tokens/requests.go
index 1af55d813..d5b2fe83f 100644
--- a/vendor/github.com/gophercloud/gophercloud/openstack/identity/v3/tokens/requests.go
+++ b/vendor/github.com/gophercloud/gophercloud/openstack/identity/v3/tokens/requests.go
@@ -1,6 +1,10 @@
 package tokens
 
-import "github.com/gophercloud/gophercloud"
+import (
+	"context"
+
+	"github.com/gophercloud/gophercloud"
+)
 
 // Scope allows a created token to be limited to a specific domain or project.
 type Scope struct {
@@ -119,9 +123,9 @@ func subjectTokenHeaders(subjectToken string) map[string]string {
 	}
 }
 
-// Create authenticates and either generates a new token, or changes the Scope
+// CreateWithContext authenticates and either generates a new token, or changes the Scope
 // of an existing token.
-func Create(c *gophercloud.ServiceClient, opts AuthOptionsBuilder) (r CreateResult) {
+func CreateWithContext(ctx context.Context, c *gophercloud.ServiceClient, opts AuthOptionsBuilder) (r CreateResult) {
 	scope, err := opts.ToTokenV3ScopeMap()
 	if err != nil {
 		r.Err = err
@@ -134,16 +138,21 @@ func Create(c *gophercloud.ServiceClient, opts AuthOptionsBuilder) (r CreateResu
 		return
 	}
 
-	resp, err := c.Post(tokenURL(c), b, &r.Body, &gophercloud.RequestOpts{
+	resp, err := c.PostWithContext(ctx, tokenURL(c), b, &r.Body, &gophercloud.RequestOpts{
 		OmitHeaders: []string{"X-Auth-Token"},
 	})
 	_, r.Header, r.Err = gophercloud.ParseResponse(resp, err)
 	return
 }
 
-// Get validates and retrieves information about another token.
-func Get(c *gophercloud.ServiceClient, token string) (r GetResult) {
-	resp, err := c.Get(tokenURL(c), &r.Body, &gophercloud.RequestOpts{
+// Create is a compatibility wrapper around CreateWithContext
+func Create(c *gophercloud.ServiceClient, opts AuthOptionsBuilder) (r CreateResult) {
+	return CreateWithContext(context.Background(), c, opts)
+}
+
+// GetGetWithContext validates and retrieves information about another token.
+func GetWithContext(ctx context.Context, c *gophercloud.ServiceClient, token string) (r GetResult) {
+	resp, err := c.GetWithContext(ctx, tokenURL(c), &r.Body, &gophercloud.RequestOpts{
 		MoreHeaders: subjectTokenHeaders(token),
 		OkCodes:     []int{200, 203},
 	})
@@ -151,9 +160,14 @@ func Get(c *gophercloud.ServiceClient, token string) (r GetResult) {
 	return
 }
 
-// Validate determines if a specified token is valid or not.
-func Validate(c *gophercloud.ServiceClient, token string) (bool, error) {
-	resp, err := c.Head(tokenURL(c), &gophercloud.RequestOpts{
+// Get is a compatibility wrapper around GetWithContext
+func Get(c *gophercloud.ServiceClient, token string) (r GetResult) {
+	return GetWithContext(context.Background(), c, token)
+}
+
+// ValidateWithContext determines if a specified token is valid or not.
+func ValidateWithContext(ctx context.Context, c *gophercloud.ServiceClient, token string) (bool, error) {
+	resp, err := c.HeadWithContext(ctx, tokenURL(c), &gophercloud.RequestOpts{
 		MoreHeaders: subjectTokenHeaders(token),
 		OkCodes:     []int{200, 204, 404},
 	})
@@ -164,11 +178,21 @@ func Validate(c *gophercloud.ServiceClient, token string) (bool, error) {
 	return resp.StatusCode == 200 || resp.StatusCode == 204, nil
 }
 
-// Revoke immediately makes specified token invalid.
-func Revoke(c *gophercloud.ServiceClient, token string) (r RevokeResult) {
-	resp, err := c.Delete(tokenURL(c), &gophercloud.RequestOpts{
+// Validate is a compatibility wrapper around ValidateWithContext
+func Validate(c *gophercloud.ServiceClient, token string) (bool, error) {
+	return ValidateWithContext(context.Background(), c, token)
+}
+
+// RevokeWithContext immediately makes specified token invalid.
+func RevokeWithContext(ctx context.Context, c *gophercloud.ServiceClient, token string) (r RevokeResult) {
+	resp, err := c.DeleteWithContext(ctx, tokenURL(c), &gophercloud.RequestOpts{
 		MoreHeaders: subjectTokenHeaders(token),
 	})
 	_, r.Header, r.Err = gophercloud.ParseResponse(resp, err)
 	return
 }
+
+// Revoke is a compatibility wrapper around RevokeWithContext
+func Revoke(c *gophercloud.ServiceClient, token string) (r RevokeResult) {
+	return RevokeWithContext(context.Background(), c, token)
+}
diff --git a/vendor/github.com/gophercloud/gophercloud/pagination/http.go b/vendor/github.com/gophercloud/gophercloud/pagination/http.go
index 7845cda13..13b392523 100644
--- a/vendor/github.com/gophercloud/gophercloud/pagination/http.go
+++ b/vendor/github.com/gophercloud/gophercloud/pagination/http.go
@@ -1,6 +1,7 @@
 package pagination
 
 import (
+	"context"
 	"encoding/json"
 	"io/ioutil"
 	"net/http"
@@ -52,11 +53,16 @@ func PageResultFromParsed(resp *http.Response, body interface{}) PageResult {
 	}
 }
 
-// Request performs an HTTP request and extracts the http.Response from the result.
-func Request(client *gophercloud.ServiceClient, headers map[string]string, url string) (*http.Response, error) {
-	return client.Get(url, nil, &gophercloud.RequestOpts{
+// RequestWithContext performs an HTTP request and extracts the http.Response from the result.
+func RequestWithContext(ctx context.Context, client *gophercloud.ServiceClient, headers map[string]string, url string) (*http.Response, error) {
+	return client.GetWithContext(ctx, url, nil, &gophercloud.RequestOpts{
 		MoreHeaders:      headers,
 		OkCodes:          []int{200, 204, 300},
 		KeepResponseBody: true,
 	})
 }
+
+// Request is a compatibility wrapper around RequestWithContext.
+func Request(client *gophercloud.ServiceClient, headers map[string]string, url string) (*http.Response, error) {
+	return RequestWithContext(context.Background(), client, headers, url)
+}
diff --git a/vendor/github.com/gophercloud/gophercloud/pagination/pager.go b/vendor/github.com/gophercloud/gophercloud/pagination/pager.go
index 1dec2703e..8bc668080 100644
--- a/vendor/github.com/gophercloud/gophercloud/pagination/pager.go
+++ b/vendor/github.com/gophercloud/gophercloud/pagination/pager.go
@@ -1,6 +1,7 @@
 package pagination
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	"net/http"
@@ -69,8 +70,8 @@ func (p Pager) WithPageCreator(createPage func(r PageResult) Page) Pager {
 	}
 }
 
-func (p Pager) fetchNextPage(url string) (Page, error) {
-	resp, err := Request(p.client, p.Headers, url)
+func (p Pager) fetchNextPage(ctx context.Context, url string) (Page, error) {
+	resp, err := RequestWithContext(ctx, p.client, p.Headers, url)
 	if err != nil {
 		return nil, err
 	}
@@ -83,9 +84,10 @@ func (p Pager) fetchNextPage(url string) (Page, error) {
 	return p.createPage(remembered), nil
 }
 
-// EachPage iterates over each page returned by a Pager, yielding one at a time to a handler function.
-// Return "false" from the handler to prematurely stop iterating.
-func (p Pager) EachPage(handler func(Page) (bool, error)) error {
+// EachPageWithContext iterates over each page returned by a Pager, yielding
+// one at a time to a handler function. Return "false" from the handler to
+// prematurely stop iterating.
+func (p Pager) EachPageWithContext(ctx context.Context, handler func(context.Context, Page) (bool, error)) error {
 	if p.Err != nil {
 		return p.Err
 	}
@@ -99,7 +101,7 @@ func (p Pager) EachPage(handler func(Page) (bool, error)) error {
 			p.firstPage = nil
 		} else {
 			var err error
-			currentPage, err = p.fetchNextPage(currentURL)
+			currentPage, err = p.fetchNextPage(ctx, currentURL)
 			if err != nil {
 				return err
 			}
@@ -113,7 +115,7 @@ func (p Pager) EachPage(handler func(Page) (bool, error)) error {
 			return nil
 		}
 
-		ok, err := handler(currentPage)
+		ok, err := handler(ctx, currentPage)
 		if err != nil {
 			return err
 		}
@@ -131,9 +133,16 @@ func (p Pager) EachPage(handler func(Page) (bool, error)) error {
 	}
 }
 
-// AllPages returns all the pages from a `List` operation in a single page,
+// EachPage is a compatibility wrapper around EachPageWithContext.
+func (p Pager) EachPage(handler func(Page) (bool, error)) error {
+	return p.EachPageWithContext(context.Background(), func(_ context.Context, p Page) (bool, error) {
+		return handler(p)
+	})
+}
+
+// AllPagesWithContext returns all the pages from a `List` operation in a single page,
 // allowing the user to retrieve all the pages at once.
-func (p Pager) AllPages() (Page, error) {
+func (p Pager) AllPagesWithContext(ctx context.Context) (Page, error) {
 	if p.Err != nil {
 		return nil, p.Err
 	}
@@ -143,7 +152,7 @@ func (p Pager) AllPages() (Page, error) {
 	var body reflect.Value
 
 	// Grab a first page to ascertain the page body type.
-	firstPage, err := p.fetchNextPage(p.initialURL)
+	firstPage, err := p.fetchNextPage(ctx, p.initialURL)
 	if err != nil {
 		return nil, err
 	}
@@ -252,3 +261,8 @@ func (p Pager) AllPages() (Page, error) {
 	// `Extract*` methods will work.
 	return page.Elem().Interface().(Page), err
 }
+
+// AllPages is a compatibility wrapper around AllPagesWithContext.
+func (p Pager) AllPages() (Page, error) {
+	return p.AllPagesWithContext(context.Background())
+}
diff --git a/vendor/github.com/gophercloud/gophercloud/provider_client.go b/vendor/github.com/gophercloud/gophercloud/provider_client.go
index 5cb5e150f..64787e533 100644
--- a/vendor/github.com/gophercloud/gophercloud/provider_client.go
+++ b/vendor/github.com/gophercloud/gophercloud/provider_client.go
@@ -16,7 +16,7 @@ import (
 
 // DefaultUserAgent is the default User-Agent string set in the request header.
 const (
-	DefaultUserAgent         = "gophercloud/v1.9.0"
+	DefaultUserAgent         = "gophercloud/v1.10.0"
 	DefaultMaxBackoffRetries = 60
 )
 
diff --git a/vendor/github.com/osbuild/images/internal/common/distro.go b/vendor/github.com/osbuild/images/internal/common/distro.go
index 54fc2b05b..6c156712f 100644
--- a/vendor/github.com/osbuild/images/internal/common/distro.go
+++ b/vendor/github.com/osbuild/images/internal/common/distro.go
@@ -26,3 +26,7 @@ func VersionLessThan(a, b string) bool {
 
 	return aV.LessThan(bV)
 }
+
+func VersionGreaterThanOrEqual(a, b string) bool {
+	return !VersionLessThan(a, b)
+}
diff --git a/vendor/github.com/osbuild/images/pkg/blueprint/blueprint.go b/vendor/github.com/osbuild/images/pkg/blueprint/blueprint.go
index 5929a4d93..6fdf205f6 100644
--- a/vendor/github.com/osbuild/images/pkg/blueprint/blueprint.go
+++ b/vendor/github.com/osbuild/images/pkg/blueprint/blueprint.go
@@ -1,13 +1,6 @@
 // Package blueprint contains primitives for representing weldr blueprints
 package blueprint
 
-import "fmt"
-
-const (
-	dockerTransport            = "docker"
-	containersStorageTransport = "containers-storage"
-)
-
 // A Blueprint is a high-level description of an image.
 type Blueprint struct {
 	Name           string          `json:"name" toml:"name"`
@@ -36,12 +29,11 @@ type Group struct {
 }
 
 type Container struct {
-	Source string `json:"source,omitempty" toml:"source"`
+	Source string `json:"source" toml:"source"`
 	Name   string `json:"name,omitempty" toml:"name,omitempty"`
 
-	TLSVerify           *bool   `json:"tls-verify,omitempty" toml:"tls-verify,omitempty"`
-	ContainersTransport *string `json:"containers-transport,omitempty" toml:"containers-transport,omitempty"`
-	StoragePath         *string `json:"source-path,omitempty" toml:"source-path,omitempty"`
+	TLSVerify    *bool `json:"tls-verify,omitempty" toml:"tls-verify,omitempty"`
+	LocalStorage bool  `json:"local-storage,omitempty" toml:"local-storage,omitempty"`
 }
 
 // packages, modules, and groups all resolve to rpm packages right now. This
@@ -79,31 +71,3 @@ func (p Package) ToNameVersion() string {
 
 	return p.Name + "-" + p.Version
 }
-
-func (c Container) Validate() error {
-	if c.StoragePath != nil {
-		if c.ContainersTransport == nil {
-			// error out here, but realistically we could also just
-			// set the transport instead
-			return fmt.Errorf("Cannot specify storage location %s without a transport", *c.StoragePath)
-		}
-
-		if *c.ContainersTransport != containersStorageTransport {
-			return fmt.Errorf(
-				"Incompatible transport %s for storage location %s, only containers-storage transport is supported",
-				*c.ContainersTransport,
-				*c.StoragePath,
-			)
-		}
-	}
-
-	if c.ContainersTransport == nil {
-		return nil
-	}
-
-	if *c.ContainersTransport != dockerTransport && *c.ContainersTransport != containersStorageTransport {
-		return fmt.Errorf("Unknown containers-transport: %s", *c.ContainersTransport)
-	}
-
-	return nil
-}
diff --git a/vendor/github.com/osbuild/images/pkg/blueprint/customizations.go b/vendor/github.com/osbuild/images/pkg/blueprint/customizations.go
index f49d30a1d..7750bb5c5 100644
--- a/vendor/github.com/osbuild/images/pkg/blueprint/customizations.go
+++ b/vendor/github.com/osbuild/images/pkg/blueprint/customizations.go
@@ -108,6 +108,7 @@ type FirewallServicesCustomization struct {
 type ServicesCustomization struct {
 	Enabled  []string `json:"enabled,omitempty" toml:"enabled,omitempty"`
 	Disabled []string `json:"disabled,omitempty" toml:"disabled,omitempty"`
+	Masked   []string `json:"masked,omitempty" toml:"masked,omitempty"`
 }
 
 type OpenSCAPCustomization struct {
diff --git a/vendor/github.com/osbuild/images/pkg/container/client.go b/vendor/github.com/osbuild/images/pkg/container/client.go
index 4ec66d5ba..06b739d91 100644
--- a/vendor/github.com/osbuild/images/pkg/container/client.go
+++ b/vendor/github.com/osbuild/images/pkg/container/client.go
@@ -35,9 +35,6 @@ import (
 const (
 	DefaultUserAgent  = "osbuild-composer/1.0"
 	DefaultPolicyPath = "/etc/containers/policy.json"
-
-	containersStorageTransport = "containers-storage"
-	dockerTransport            = "docker"
 )
 
 // GetDefaultAuthFile returns the authentication file to use for the
@@ -344,32 +341,17 @@ func (m RawManifest) Digest() (digest.Digest, error) {
 	return manifest.Digest(m.Data)
 }
 
-func getImageRef(target reference.Named, transport string, storagePath string) (types.ImageReference, error) {
-	switch transport {
-	case "", dockerTransport:
-		ref, err := docker.NewReference(target)
-		if err != nil {
-			return nil, err
-		}
-		return ref, nil
-	case containersStorageTransport:
-		var storage string
-		if storagePath != "" {
-			storage = fmt.Sprintf("[overlay@%s]", storagePath)
-		}
-		ref, err := alltransports.ParseImageName(fmt.Sprintf("%s:%s%s", transport, storage, target.Name()))
-		if err != nil {
-			return nil, err
-		}
-		return ref, nil
-	default:
-		return nil, fmt.Errorf("Unknown containers-transport: %s", transport)
+func getImageRef(target reference.Named, local bool) (types.ImageReference, error) {
+	if local {
+		return alltransports.ParseImageName(fmt.Sprintf("containers-storage:%s", target))
 	}
+
+	return docker.NewReference(target)
 }
 
 // GetManifest fetches the raw manifest data from the server. If digest is not empty
 // it will override any given tag for the Client's Target.
-func (cl *Client) GetManifest(ctx context.Context, digest digest.Digest, container *SourceSpec) (r RawManifest, err error) {
+func (cl *Client) GetManifest(ctx context.Context, digest digest.Digest, local bool) (r RawManifest, err error) {
 	target := cl.Target
 
 	if digest != "" {
@@ -382,17 +364,7 @@ func (cl *Client) GetManifest(ctx context.Context, digest digest.Digest, contain
 		target = t
 	}
 
-	var transport string
-	if container != nil && container.ContainersTransport != nil {
-		transport = *container.ContainersTransport
-	}
-
-	var storagePath string
-	if container != nil && container.StoragePath != nil {
-		storagePath = *container.StoragePath
-	}
-
-	ref, err := getImageRef(target, transport, storagePath)
+	ref, err := getImageRef(target, local)
 	if err != nil {
 		return
 	}
@@ -438,7 +410,7 @@ func (cl *Client) resolveManifestList(ctx context.Context, list manifestList) (r
 		return resolvedIds{}, err
 	}
 
-	raw, err := cl.GetManifest(ctx, digest, nil)
+	raw, err := cl.GetManifest(ctx, digest, false)
 	if err != nil {
 		return resolvedIds{}, fmt.Errorf("error getting manifest: %w", err)
 	}
@@ -522,10 +494,9 @@ func (cl *Client) resolveRawManifest(ctx context.Context, rm RawManifest) (resol
 // which is the digest of the configuration object. It uses the architecture and
 // variant specified via SetArchitectureChoice or the corresponding defaults for
 // the host.
-func (cl *Client) Resolve(ctx context.Context, name string, container *SourceSpec) (Spec, error) {
-
-	raw, err := cl.GetManifest(ctx, "", container)
+func (cl *Client) Resolve(ctx context.Context, name string, local bool) (Spec, error) {
 
+	raw, err := cl.GetManifest(ctx, "", local)
 	if err != nil {
 		return Spec{}, fmt.Errorf("error getting manifest: %w", err)
 	}
@@ -535,13 +506,6 @@ func (cl *Client) Resolve(ctx context.Context, name string, container *SourceSpe
 		return Spec{}, err
 	}
 
-	var transport *string
-	var location *string
-	if container != nil {
-		transport = container.ContainersTransport
-		location = container.StoragePath
-	}
-
 	spec := NewSpec(
 		cl.Target,
 		ids.Manifest,
@@ -549,8 +513,7 @@ func (cl *Client) Resolve(ctx context.Context, name string, container *SourceSpe
 		cl.GetTLSVerify(),
 		ids.ListManifest.String(),
 		name,
-		transport,
-		location,
+		local,
 	)
 
 	return spec, nil
diff --git a/vendor/github.com/osbuild/images/pkg/container/resolver.go b/vendor/github.com/osbuild/images/pkg/container/resolver.go
index 58469bca8..4645d4845 100644
--- a/vendor/github.com/osbuild/images/pkg/container/resolver.go
+++ b/vendor/github.com/osbuild/images/pkg/container/resolver.go
@@ -23,12 +23,11 @@ type Resolver struct {
 }
 
 type SourceSpec struct {
-	Source              string
-	Name                string
-	Digest              *string
-	TLSVerify           *bool
-	ContainersTransport *string
-	StoragePath         *string
+	Source    string
+	Name      string
+	Digest    *string
+	TLSVerify *bool
+	Local     bool
 }
 
 func NewResolver(arch string) *Resolver {
@@ -55,7 +54,7 @@ func (r *Resolver) Add(spec SourceSpec) {
 	}
 
 	go func() {
-		spec, err := client.Resolve(r.ctx, spec.Name, &spec)
+		spec, err := client.Resolve(r.ctx, spec.Name, spec.Local)
 		if err != nil {
 			err = fmt.Errorf("'%s': %w", spec.Source, err)
 		}
diff --git a/vendor/github.com/osbuild/images/pkg/container/spec.go b/vendor/github.com/osbuild/images/pkg/container/spec.go
index 4a74a6ae2..1cf10a7ba 100644
--- a/vendor/github.com/osbuild/images/pkg/container/spec.go
+++ b/vendor/github.com/osbuild/images/pkg/container/spec.go
@@ -11,31 +11,29 @@ import (
 // at the Source via Digest and ImageID. The latter one
 // should remain the same in the target image as well.
 type Spec struct {
-	Source              string  // does not include the manifest digest
-	Digest              string  // digest of the manifest at the Source
-	TLSVerify           *bool   // controls TLS verification
-	ImageID             string  // container image identifier
-	LocalName           string  // name to use inside the image
-	ListDigest          string  // digest of the list manifest at the Source (optional)
-	ContainersTransport *string // the type of transport used for the container
-	StoragePath         *string // location of the local containers-storage
+	Source       string // does not include the manifest digest
+	Digest       string // digest of the manifest at the Source
+	TLSVerify    *bool  // controls TLS verification
+	ImageID      string // container image identifier
+	LocalName    string // name to use inside the image
+	ListDigest   string // digest of the list manifest at the Source (optional)
+	LocalStorage bool
 }
 
 // NewSpec creates a new Spec from the essential information.
 // It also converts is the transition point from container
 // specific types (digest.Digest) to generic types (string).
-func NewSpec(source reference.Named, digest, imageID digest.Digest, tlsVerify *bool, listDigest string, localName string, transport *string, storagePath *string) Spec {
+func NewSpec(source reference.Named, digest, imageID digest.Digest, tlsVerify *bool, listDigest string, localName string, localStorage bool) Spec {
 	if localName == "" {
 		localName = source.String()
 	}
 	return Spec{
-		Source:              source.Name(),
-		Digest:              digest.String(),
-		TLSVerify:           tlsVerify,
-		ImageID:             imageID.String(),
-		LocalName:           localName,
-		ListDigest:          listDigest,
-		ContainersTransport: transport,
-		StoragePath:         storagePath,
+		Source:       source.Name(),
+		Digest:       digest.String(),
+		TLSVerify:    tlsVerify,
+		ImageID:      imageID.String(),
+		LocalName:    localName,
+		ListDigest:   listDigest,
+		LocalStorage: localStorage,
 	}
 }
diff --git a/vendor/github.com/osbuild/images/pkg/distro/fedora/distro.go b/vendor/github.com/osbuild/images/pkg/distro/fedora/distro.go
index 743ab48a7..1fce5931c 100644
--- a/vendor/github.com/osbuild/images/pkg/distro/fedora/distro.go
+++ b/vendor/github.com/osbuild/images/pkg/distro/fedora/distro.go
@@ -818,58 +818,56 @@ func newDistro(version int) distro.Distro {
 		minimalrawImgType,
 	)
 
-	if !common.VersionLessThan(rd.Releasever(), "38") {
-		// iot simplified installer was introduced in F38
-		x86_64.addImageTypes(
-			&platform.X86{
-				BasePlatform: platform.BasePlatform{
-					ImageFormat: platform.FORMAT_RAW,
-					FirmwarePackages: []string{
-						"grub2-efi-x64",
-						"grub2-efi-x64-cdboot",
-						"grub2-tools",
-						"grub2-tools-minimal",
-						"efibootmgr",
-						"shim-x64",
-						"brcmfmac-firmware",
-						"iwlwifi-dvm-firmware",
-						"iwlwifi-mvm-firmware",
-						"realtek-firmware",
-						"microcode_ctl",
-					},
+	// iot simplified installer was introduced in F38
+	x86_64.addImageTypes(
+		&platform.X86{
+			BasePlatform: platform.BasePlatform{
+				ImageFormat: platform.FORMAT_RAW,
+				FirmwarePackages: []string{
+					"grub2-efi-x64",
+					"grub2-efi-x64-cdboot",
+					"grub2-tools",
+					"grub2-tools-minimal",
+					"efibootmgr",
+					"shim-x64",
+					"brcmfmac-firmware",
+					"iwlwifi-dvm-firmware",
+					"iwlwifi-mvm-firmware",
+					"realtek-firmware",
+					"microcode_ctl",
 				},
-				BIOS:       false,
-				UEFIVendor: "fedora",
 			},
-			iotSimplifiedInstallerImgType,
-		)
+			BIOS:       false,
+			UEFIVendor: "fedora",
+		},
+		iotSimplifiedInstallerImgType,
+	)
 
-		aarch64.addImageTypes(
-			&platform.Aarch64{
-				BasePlatform: platform.BasePlatform{
-					FirmwarePackages: []string{
-						"arm-image-installer",
-						"bcm283x-firmware",
-						"grub2-efi-aa64",
-						"grub2-efi-aa64-cdboot",
-						"grub2-tools",
-						"grub2-tools-minimal",
-						"efibootmgr",
-						"shim-aa64",
-						"brcmfmac-firmware",
-						"iwlwifi-dvm-firmware",
-						"iwlwifi-mvm-firmware",
-						"realtek-firmware",
-						"uboot-images-armv8",
-					},
+	aarch64.addImageTypes(
+		&platform.Aarch64{
+			BasePlatform: platform.BasePlatform{
+				FirmwarePackages: []string{
+					"arm-image-installer",
+					"bcm283x-firmware",
+					"grub2-efi-aa64",
+					"grub2-efi-aa64-cdboot",
+					"grub2-tools",
+					"grub2-tools-minimal",
+					"efibootmgr",
+					"shim-aa64",
+					"brcmfmac-firmware",
+					"iwlwifi-dvm-firmware",
+					"iwlwifi-mvm-firmware",
+					"realtek-firmware",
+					"uboot-images-armv8",
 				},
-				UEFIVendor: "fedora",
 			},
-			iotSimplifiedInstallerImgType,
-		)
-	}
+			UEFIVendor: "fedora",
+		},
+		iotSimplifiedInstallerImgType,
+	)
 
-	if !common.VersionLessThan(rd.Releasever(), "39") {
+	if common.VersionGreaterThanOrEqual(rd.Releasever(), "39") {
 		// bootc was introduced in F39
 		x86_64.addImageTypes(
 			&platform.X86{
diff --git a/vendor/github.com/osbuild/images/pkg/distro/fedora/images.go b/vendor/github.com/osbuild/images/pkg/distro/fedora/images.go
index c92b9c72f..bb2ce6759 100644
--- a/vendor/github.com/osbuild/images/pkg/distro/fedora/images.go
+++ b/vendor/github.com/osbuild/images/pkg/distro/fedora/images.go
@@ -69,6 +69,7 @@ func osCustomizations(
 
 	osc.EnabledServices = imageConfig.EnabledServices
 	osc.DisabledServices = imageConfig.DisabledServices
+	osc.MaskedServices = imageConfig.MaskedServices
 	if imageConfig.DefaultTarget != nil {
 		osc.DefaultTarget = *imageConfig.DefaultTarget
 	}
@@ -353,9 +354,8 @@ func imageInstallerImage(workload workload.Workload,
 		img.UnattendedKickstart = instCust.Unattended
 	}
 
-	// Enable anaconda-webui for Fedora > 38
 	distro := t.Arch().Distro()
-	if !common.VersionLessThan(distro.Releasever(), "38") {
+	if common.VersionGreaterThanOrEqual(distro.Releasever(), "39") {
 		img.AdditionalAnacondaModules = []string{
 			"org.fedoraproject.Anaconda.Modules.Security",
 			"org.fedoraproject.Anaconda.Modules.Timezone",
@@ -369,8 +369,6 @@ func imageInstallerImage(workload workload.Workload,
 			// time since they might be running headless and a UI is
 			// unnecessary.
 			img.AdditionalKernelOpts = []string{"inst.text", "inst.noninteractive"}
-		} else {
-			img.AdditionalKernelOpts = []string{"inst.webui", "inst.webui.remote"}
 		}
 	}
 	img.AdditionalAnacondaModules = append(img.AdditionalAnacondaModules, "org.fedoraproject.Anaconda.Modules.Users")
@@ -412,23 +410,23 @@ func iotCommitImage(workload workload.Workload,
 
 	img.Platform = t.platform
 	img.OSCustomizations = osCustomizations(t, packageSets[osPkgsKey], containers, bp.Customizations)
-	if !common.VersionLessThan(d.Releasever(), "38") {
-		// see https://github.com/ostreedev/ostree/issues/2840
-		img.OSCustomizations.Presets = []osbuild.Preset{
-			{
-				Name:  "ignition-firstboot-complete.service",
-				State: osbuild.StateEnable,
-			},
-			{
-				Name:  "coreos-ignition-write-issues.service",
-				State: osbuild.StateEnable,
-			},
-			{
-				Name:  "fdo-client-linuxapp.service",
-				State: osbuild.StateEnable,
-			},
-		}
+
+	// see https://github.com/ostreedev/ostree/issues/2840
+	img.OSCustomizations.Presets = []osbuild.Preset{
+		{
+			Name:  "ignition-firstboot-complete.service",
+			State: osbuild.StateEnable,
+		},
+		{
+			Name:  "coreos-ignition-write-issues.service",
+			State: osbuild.StateEnable,
+		},
+		{
+			Name:  "fdo-client-linuxapp.service",
+			State: osbuild.StateEnable,
+		},
 	}
+
 	img.Environment = t.environment
 	img.Workload = workload
 	img.OSTreeParent = parentCommit
@@ -478,23 +476,23 @@ func iotContainerImage(workload workload.Workload,
 	d := t.arch.distro
 	img.Platform = t.platform
 	img.OSCustomizations = osCustomizations(t, packageSets[osPkgsKey], containers, bp.Customizations)
-	if !common.VersionLessThan(d.Releasever(), "38") {
-		// see https://github.com/ostreedev/ostree/issues/2840
-		img.OSCustomizations.Presets = []osbuild.Preset{
-			{
-				Name:  "ignition-firstboot-complete.service",
-				State: osbuild.StateEnable,
-			},
-			{
-				Name:  "coreos-ignition-write-issues.service",
-				State: osbuild.StateEnable,
-			},
-			{
-				Name:  "fdo-client-linuxapp.service",
-				State: osbuild.StateEnable,
-			},
-		}
+
+	// see https://github.com/ostreedev/ostree/issues/2840
+	img.OSCustomizations.Presets = []osbuild.Preset{
+		{
+			Name:  "ignition-firstboot-complete.service",
+			State: osbuild.StateEnable,
+		},
+		{
+			Name:  "coreos-ignition-write-issues.service",
+			State: osbuild.StateEnable,
+		},
+		{
+			Name:  "fdo-client-linuxapp.service",
+			State: osbuild.StateEnable,
+		},
 	}
+
 	img.ContainerLanguage = img.OSCustomizations.Language
 	img.Environment = t.environment
 	img.Workload = workload
@@ -575,8 +573,6 @@ func iotImage(workload workload.Workload,
 	}
 	img := image.NewOSTreeDiskImageFromCommit(commit)
 
-	distro := t.Arch().Distro()
-
 	customizations := bp.Customizations
 	img.FIPS = customizations.GetFIPS()
 	img.Users = users.UsersFromBP(customizations.GetUsers())
@@ -607,17 +603,15 @@ func iotImage(workload workload.Workload,
 	img.OSName = "fedora-iot"
 	img.LockRoot = true
 
-	if !common.VersionLessThan(distro.Releasever(), "38") {
-		img.KernelOptionsAppend = append(img.KernelOptionsAppend, "coreos.no_persist_ip")
-		switch img.Platform.GetImageFormat() {
-		case platform.FORMAT_RAW:
-			img.IgnitionPlatform = "metal"
-			if bpIgnition := customizations.GetIgnition(); bpIgnition != nil && bpIgnition.FirstBoot != nil && bpIgnition.FirstBoot.ProvisioningURL != "" {
-				img.KernelOptionsAppend = append(img.KernelOptionsAppend, "ignition.config.url="+bpIgnition.FirstBoot.ProvisioningURL)
-			}
-		case platform.FORMAT_QCOW2:
-			img.IgnitionPlatform = "qemu"
+	img.KernelOptionsAppend = append(img.KernelOptionsAppend, "coreos.no_persist_ip")
+	switch img.Platform.GetImageFormat() {
+	case platform.FORMAT_RAW:
+		img.IgnitionPlatform = "metal"
+		if bpIgnition := customizations.GetIgnition(); bpIgnition != nil && bpIgnition.FirstBoot != nil && bpIgnition.FirstBoot.ProvisioningURL != "" {
+			img.KernelOptionsAppend = append(img.KernelOptionsAppend, "ignition.config.url="+bpIgnition.FirstBoot.ProvisioningURL)
 		}
+	case platform.FORMAT_QCOW2:
+		img.IgnitionPlatform = "qemu"
 	}
 
 	if kopts := customizations.GetKernel(); kopts != nil && kopts.Append != "" {
@@ -659,10 +653,8 @@ func iotSimplifiedInstallerImage(workload workload.Workload,
 	rawImg.KernelOptionsAppend = []string{"modprobe.blacklist=vc4"}
 	rawImg.Keyboard = "us"
 	rawImg.Locale = "C.UTF-8"
-	if !common.VersionLessThan(t.arch.distro.osVersion, "38") {
-		rawImg.SysrootReadOnly = true
-		rawImg.KernelOptionsAppend = append(rawImg.KernelOptionsAppend, "rw")
-	}
+	rawImg.SysrootReadOnly = true
+	rawImg.KernelOptionsAppend = append(rawImg.KernelOptionsAppend, "rw")
 
 	rawImg.Platform = t.platform
 	rawImg.Workload = workload
@@ -672,12 +664,10 @@ func iotSimplifiedInstallerImage(workload workload.Workload,
 	rawImg.OSName = "fedora"
 	rawImg.LockRoot = true
 
-	if !common.VersionLessThan(t.arch.distro.osVersion, "38") {
-		rawImg.IgnitionPlatform = "metal"
-		rawImg.KernelOptionsAppend = append(rawImg.KernelOptionsAppend, "coreos.no_persist_ip")
-		if bpIgnition := customizations.GetIgnition(); bpIgnition != nil && bpIgnition.FirstBoot != nil && bpIgnition.FirstBoot.ProvisioningURL != "" {
-			rawImg.KernelOptionsAppend = append(rawImg.KernelOptionsAppend, "ignition.config.url="+bpIgnition.FirstBoot.ProvisioningURL)
-		}
+	rawImg.IgnitionPlatform = "metal"
+	rawImg.KernelOptionsAppend = append(rawImg.KernelOptionsAppend, "coreos.no_persist_ip")
+	if bpIgnition := customizations.GetIgnition(); bpIgnition != nil && bpIgnition.FirstBoot != nil && bpIgnition.FirstBoot.ProvisioningURL != "" {
+		rawImg.KernelOptionsAppend = append(rawImg.KernelOptionsAppend, "ignition.config.url="+bpIgnition.FirstBoot.ProvisioningURL)
 	}
 
 	// TODO: move generation into LiveImage
diff --git a/vendor/github.com/osbuild/images/pkg/distro/fedora/imagetype.go b/vendor/github.com/osbuild/images/pkg/distro/fedora/imagetype.go
index 9d5f5c833..7bdd9f540 100644
--- a/vendor/github.com/osbuild/images/pkg/distro/fedora/imagetype.go
+++ b/vendor/github.com/osbuild/images/pkg/distro/fedora/imagetype.go
@@ -224,11 +224,10 @@ func (t *imageType) Manifest(bp *blueprint.Blueprint,
 	containerSources := make([]container.SourceSpec, len(bp.Containers))
 	for idx, cont := range bp.Containers {
 		containerSources[idx] = container.SourceSpec{
-			Source:              cont.Source,
-			Name:                cont.Name,
-			TLSVerify:           cont.TLSVerify,
-			ContainersTransport: cont.ContainersTransport,
-			StoragePath:         cont.StoragePath,
+			Source:    cont.Source,
+			Name:      cont.Name,
+			TLSVerify: cont.TLSVerify,
+			Local:     cont.LocalStorage,
 		}
 	}
 
@@ -262,14 +261,6 @@ func (t *imageType) checkOptions(bp *blueprint.Blueprint, options distro.ImageOp
 		return nil, fmt.Errorf("embedding containers is not supported for %s on %s", t.name, t.arch.distro.name)
 	}
 
-	if len(bp.Containers) > 0 {
-		for _, container := range bp.Containers {
-			if err := container.Validate(); err != nil {
-				return nil, err
-			}
-		}
-	}
-
 	if options.OSTree != nil {
 		if err := options.OSTree.Validate(); err != nil {
 			return nil, err
diff --git a/vendor/github.com/osbuild/images/pkg/distro/fedora/package_sets.go b/vendor/github.com/osbuild/images/pkg/distro/fedora/package_sets.go
index 11c38aacc..0431ebd19 100644
--- a/vendor/github.com/osbuild/images/pkg/distro/fedora/package_sets.go
+++ b/vendor/github.com/osbuild/images/pkg/distro/fedora/package_sets.go
@@ -4,7 +4,6 @@ package fedora
 
 import (
 	"fmt"
-	"strconv"
 
 	"github.com/osbuild/images/internal/common"
 	"github.com/osbuild/images/pkg/arch"
@@ -74,6 +73,9 @@ func vmdkCommonPackageSet(t *imageType) rpmmd.PackageSet {
 func iotCommitPackageSet(t *imageType) rpmmd.PackageSet {
 	ps := rpmmd.PackageSet{
 		Include: []string{
+			"NetworkManager",
+			"NetworkManager-wifi",
+			"NetworkManager-wwan",
 			"aardvark-dns",
 			"atheros-firmware",
 			"attr",
@@ -87,8 +89,8 @@ func iotCommitPackageSet(t *imageType) rpmmd.PackageSet {
 			"clevis-dracut",
 			"clevis-luks",
 			"clevis-pin-tpm2",
-			"containernetworking-plugins",
 			"container-selinux",
+			"containernetworking-plugins",
 			"coreutils",
 			"cracklib-dicts",
 			"criu",
@@ -101,6 +103,8 @@ func iotCommitPackageSet(t *imageType) rpmmd.PackageSet {
 			"dracut-network",
 			"e2fsprogs",
 			"efibootmgr",
+			"fdo-client",
+			"fdo-owner-cli",
 			"fedora-iot-config",
 			"fedora-release-iot",
 			"firewalld",
@@ -116,6 +120,7 @@ func iotCommitPackageSet(t *imageType) rpmmd.PackageSet {
 			"gzip",
 			"hostname",
 			"ignition",
+			"ignition-edge",
 			"ima-evm-utils",
 			"iproute",
 			"iputils",
@@ -128,9 +133,6 @@ func iotCommitPackageSet(t *imageType) rpmmd.PackageSet {
 			"linux-firmware",
 			"lvm2",
 			"netavark",
-			"NetworkManager",
-			"NetworkManager-wifi",
-			"NetworkManager-wwan",
 			"nss-altfiles",
 			"openssh-clients",
 			"openssh-server",
@@ -154,6 +156,7 @@ func iotCommitPackageSet(t *imageType) rpmmd.PackageSet {
 			"shadow-utils",
 			"skopeo",
 			"slirp4netns",
+			"ssh-key-dir",
 			"sssd-client",
 			"sudo",
 			"systemd",
@@ -174,17 +177,6 @@ func iotCommitPackageSet(t *imageType) rpmmd.PackageSet {
 		},
 	}
 
-	if !common.VersionLessThan(t.arch.distro.osVersion, "38") {
-		ps = ps.Append(rpmmd.PackageSet{
-			Include: []string{
-				"fdo-client",
-				"fdo-owner-cli",
-				"ignition-edge",
-				"ssh-key-dir",
-			},
-		})
-	}
-
 	return ps
 }
 
@@ -498,13 +490,7 @@ func iotInstallerPackageSet(t *imageType) rpmmd.PackageSet {
 	// include anaconda packages
 	ps := anacondaPackageSet(t)
 
-	releasever := t.Arch().Distro().Releasever()
-	version, err := strconv.Atoi(releasever)
-	if err != nil {
-		panic("cannot convert releasever to int: " + err.Error())
-	}
-
-	if version >= 38 {
+	if common.VersionGreaterThanOrEqual(t.arch.distro.osVersion, "39") {
 		ps = ps.Append(rpmmd.PackageSet{
 			Include: []string{
 				"fedora-release-iot",
@@ -545,8 +531,7 @@ func liveInstallerPackageSet(t *imageType) rpmmd.PackageSet {
 		},
 	}
 
-	// We want to generate a preview image when rawhide is built
-	if !common.VersionLessThan(t.arch.distro.osVersion, "39") {
+	if common.VersionGreaterThanOrEqual(t.arch.distro.osVersion, "39") {
 		ps = ps.Append(rpmmd.PackageSet{
 			Include: []string{
 				"anaconda-webui",
@@ -560,14 +545,7 @@ func liveInstallerPackageSet(t *imageType) rpmmd.PackageSet {
 func imageInstallerPackageSet(t *imageType) rpmmd.PackageSet {
 	ps := anacondaPackageSet(t)
 
-	releasever := t.Arch().Distro().Releasever()
-	version, err := strconv.Atoi(releasever)
-	if err != nil {
-		panic("cannot convert releasever to int: " + err.Error())
-	}
-
-	// We want to generate a preview image when rawhide is built
-	if version >= 38 {
+	if common.VersionGreaterThanOrEqual(t.arch.distro.osVersion, "39") {
 		ps = ps.Append(rpmmd.PackageSet{
 			Include: []string{
 				"anaconda-webui",
diff --git a/vendor/github.com/osbuild/images/pkg/distro/image_config.go b/vendor/github.com/osbuild/images/pkg/distro/image_config.go
index da62dde5f..8be60d083 100644
--- a/vendor/github.com/osbuild/images/pkg/distro/image_config.go
+++ b/vendor/github.com/osbuild/images/pkg/distro/image_config.go
@@ -18,6 +18,7 @@ type ImageConfig struct {
 	Keyboard            *osbuild.KeymapStageOptions
 	EnabledServices     []string
 	DisabledServices    []string
+	MaskedServices      []string
 	DefaultTarget       *string
 	Sysconfig           []*osbuild.SysconfigStageOptions
 
diff --git a/vendor/github.com/osbuild/images/pkg/distro/rhel7/images.go b/vendor/github.com/osbuild/images/pkg/distro/rhel7/images.go
index dfc541531..f2c0dbcd4 100644
--- a/vendor/github.com/osbuild/images/pkg/distro/rhel7/images.go
+++ b/vendor/github.com/osbuild/images/pkg/distro/rhel7/images.go
@@ -63,6 +63,7 @@ func osCustomizations(
 
 	osc.EnabledServices = imageConfig.EnabledServices
 	osc.DisabledServices = imageConfig.DisabledServices
+	osc.MaskedServices = imageConfig.MaskedServices
 	if imageConfig.DefaultTarget != nil {
 		osc.DefaultTarget = *imageConfig.DefaultTarget
 	}
diff --git a/vendor/github.com/osbuild/images/pkg/distro/rhel7/imagetype.go b/vendor/github.com/osbuild/images/pkg/distro/rhel7/imagetype.go
index de78114e0..fb2a9bb96 100644
--- a/vendor/github.com/osbuild/images/pkg/distro/rhel7/imagetype.go
+++ b/vendor/github.com/osbuild/images/pkg/distro/rhel7/imagetype.go
@@ -200,11 +200,10 @@ func (t *imageType) Manifest(bp *blueprint.Blueprint,
 	containerSources := make([]container.SourceSpec, len(bp.Containers))
 	for idx, cont := range bp.Containers {
 		containerSources[idx] = container.SourceSpec{
-			Source:              cont.Source,
-			Name:                cont.Name,
-			TLSVerify:           cont.TLSVerify,
-			ContainersTransport: cont.ContainersTransport,
-			StoragePath:         cont.StoragePath,
+			Source:    cont.Source,
+			Name:      cont.Name,
+			TLSVerify: cont.TLSVerify,
+			Local:     cont.LocalStorage,
 		}
 	}
 
diff --git a/vendor/github.com/osbuild/images/pkg/distro/rhel8/ami.go b/vendor/github.com/osbuild/images/pkg/distro/rhel8/ami.go
index eca210843..0a060f545 100644
--- a/vendor/github.com/osbuild/images/pkg/distro/rhel8/ami.go
+++ b/vendor/github.com/osbuild/images/pkg/distro/rhel8/ami.go
@@ -368,7 +368,7 @@ func ec2CommonPackageSet(t *imageType) rpmmd.PackageSet {
 func rhelEc2CommonPackageSet(t *imageType) rpmmd.PackageSet {
 	ps := ec2CommonPackageSet(t)
 	// Include "redhat-cloud-client-configuration" on 8.7+ (COMPOSER-1804)
-	if !common.VersionLessThan(t.arch.distro.osVersion, "8.7") {
+	if common.VersionGreaterThanOrEqual(t.arch.distro.osVersion, "8.7") {
 		ps.Include = append(ps.Include, "redhat-cloud-client-configuration")
 	}
 	return ps
diff --git a/vendor/github.com/osbuild/images/pkg/distro/rhel8/distro.go b/vendor/github.com/osbuild/images/pkg/distro/rhel8/distro.go
index c20d26aae..f6b337e0a 100644
--- a/vendor/github.com/osbuild/images/pkg/distro/rhel8/distro.go
+++ b/vendor/github.com/osbuild/images/pkg/distro/rhel8/distro.go
@@ -397,7 +397,7 @@ func newDistro(name string, minor int) *distribution {
 	)
 
 	if rd.isRHEL() {
-		if !common.VersionLessThan(rd.osVersion, "8.6") {
+		if common.VersionGreaterThanOrEqual(rd.osVersion, "8.6") {
 			// image types only available on 8.6 and later on RHEL
 			// These edge image types require FDO which aren't available on older versions
 			x86_64.addImageTypes(
diff --git a/vendor/github.com/osbuild/images/pkg/distro/rhel8/images.go b/vendor/github.com/osbuild/images/pkg/distro/rhel8/images.go
index 95e3b8d9b..c4fa6d9ca 100644
--- a/vendor/github.com/osbuild/images/pkg/distro/rhel8/images.go
+++ b/vendor/github.com/osbuild/images/pkg/distro/rhel8/images.go
@@ -71,6 +71,7 @@ func osCustomizations(
 
 	osc.EnabledServices = imageConfig.EnabledServices
 	osc.DisabledServices = imageConfig.DisabledServices
+	osc.MaskedServices = imageConfig.MaskedServices
 	if imageConfig.DefaultTarget != nil {
 		osc.DefaultTarget = *imageConfig.DefaultTarget
 	}
diff --git a/vendor/github.com/osbuild/images/pkg/distro/rhel8/imagetype.go b/vendor/github.com/osbuild/images/pkg/distro/rhel8/imagetype.go
index 85f608b23..e907cf612 100644
--- a/vendor/github.com/osbuild/images/pkg/distro/rhel8/imagetype.go
+++ b/vendor/github.com/osbuild/images/pkg/distro/rhel8/imagetype.go
@@ -245,11 +245,10 @@ func (t *imageType) Manifest(bp *blueprint.Blueprint,
 	containerSources := make([]container.SourceSpec, len(bp.Containers))
 	for idx, cont := range bp.Containers {
 		containerSources[idx] = container.SourceSpec{
-			Source:              cont.Source,
-			Name:                cont.Name,
-			TLSVerify:           cont.TLSVerify,
-			ContainersTransport: cont.ContainersTransport,
-			StoragePath:         cont.StoragePath,
+			Source:    cont.Source,
+			Name:      cont.Name,
+			TLSVerify: cont.TLSVerify,
+			Local:     cont.LocalStorage,
 		}
 	}
 
@@ -296,14 +295,6 @@ func (t *imageType) checkOptions(bp *blueprint.Blueprint, options distro.ImageOp
 		return warnings, fmt.Errorf("embedding containers is not supported for %s on %s", t.name, t.arch.distro.name)
 	}
 
-	if len(bp.Containers) > 0 {
-		for _, container := range bp.Containers {
-			if err := container.Validate(); err != nil {
-				return nil, err
-			}
-		}
-	}
-
 	if options.OSTree != nil {
 		if err := options.OSTree.Validate(); err != nil {
 			return nil, err
diff --git a/vendor/github.com/osbuild/images/pkg/distro/rhel9/ami.go b/vendor/github.com/osbuild/images/pkg/distro/rhel9/ami.go
index 3df21cbfc..26d24a6ec 100644
--- a/vendor/github.com/osbuild/images/pkg/distro/rhel9/ami.go
+++ b/vendor/github.com/osbuild/images/pkg/distro/rhel9/ami.go
@@ -356,7 +356,7 @@ func ec2CommonPackageSet(t *imageType) rpmmd.PackageSet {
 func rhelEc2CommonPackageSet(t *imageType) rpmmd.PackageSet {
 	ps := ec2CommonPackageSet(t)
 	// Include "redhat-cloud-client-configuration" on 9.1+ (COMPOSER-1805)
-	if !common.VersionLessThan(t.arch.distro.osVersion, "9.1") {
+	if common.VersionGreaterThanOrEqual(t.arch.distro.osVersion, "9.1") {
 		ps.Include = append(ps.Include, "redhat-cloud-client-configuration")
 	}
 	return ps
diff --git a/vendor/github.com/osbuild/images/pkg/distro/rhel9/edge.go b/vendor/github.com/osbuild/images/pkg/distro/rhel9/edge.go
index 280cc747b..8d59a78aa 100644
--- a/vendor/github.com/osbuild/images/pkg/distro/rhel9/edge.go
+++ b/vendor/github.com/osbuild/images/pkg/distro/rhel9/edge.go
@@ -589,7 +589,7 @@ func edgeCommitPackageSet(t *imageType) rpmmd.PackageSet {
 		ps = ps.Append(aarch64EdgeCommitPackageSet(t))
 	}
 
-	if !common.VersionLessThan(t.arch.distro.osVersion, "9.2") || !t.arch.distro.isRHEL() {
+	if common.VersionGreaterThanOrEqual(t.arch.distro.osVersion, "9.2") || !t.arch.distro.isRHEL() {
 		ps.Include = append(ps.Include, "ignition", "ignition-edge", "ssh-key-dir")
 	}
 
diff --git a/vendor/github.com/osbuild/images/pkg/distro/rhel9/images.go b/vendor/github.com/osbuild/images/pkg/distro/rhel9/images.go
index 36d126b5d..78f7d0a90 100644
--- a/vendor/github.com/osbuild/images/pkg/distro/rhel9/images.go
+++ b/vendor/github.com/osbuild/images/pkg/distro/rhel9/images.go
@@ -68,6 +68,7 @@ func osCustomizations(
 
 	osc.EnabledServices = imageConfig.EnabledServices
 	osc.DisabledServices = imageConfig.DisabledServices
+	osc.MaskedServices = imageConfig.MaskedServices
 	if imageConfig.DefaultTarget != nil {
 		osc.DefaultTarget = *imageConfig.DefaultTarget
 	}
@@ -327,7 +328,7 @@ func edgeCommitImage(workload workload.Workload,
 	img.OSVersion = t.arch.distro.osVersion
 	img.Filename = t.Filename()
 
-	if !common.VersionLessThan(t.arch.distro.osVersion, "9.2") || !t.arch.distro.isRHEL() {
+	if common.VersionGreaterThanOrEqual(t.arch.distro.osVersion, "9.2") || !t.arch.distro.isRHEL() {
 		img.OSCustomizations.EnabledServices = append(img.OSCustomizations.EnabledServices, "ignition-firstboot-complete.service", "coreos-ignition-write-issues.service")
 	}
 	img.Environment = t.environment
@@ -361,7 +362,7 @@ func edgeContainerImage(workload workload.Workload,
 	img.ExtraContainerPackages = packageSets[containerPkgsKey]
 	img.Filename = t.Filename()
 
-	if !common.VersionLessThan(t.arch.distro.osVersion, "9.2") || !t.arch.distro.isRHEL() {
+	if common.VersionGreaterThanOrEqual(t.arch.distro.osVersion, "9.2") || !t.arch.distro.isRHEL() {
 		img.OSCustomizations.EnabledServices = append(img.OSCustomizations.EnabledServices, "ignition-firstboot-complete.service", "coreos-ignition-write-issues.service")
 	}
 
@@ -452,12 +453,12 @@ func edgeRawImage(workload workload.Workload,
 	}
 	img.Keyboard = "us"
 	img.Locale = "C.UTF-8"
-	if !common.VersionLessThan(t.arch.distro.osVersion, "9.2") || !t.arch.distro.isRHEL() {
+	if common.VersionGreaterThanOrEqual(t.arch.distro.osVersion, "9.2") || !t.arch.distro.isRHEL() {
 		img.SysrootReadOnly = true
 		img.KernelOptionsAppend = append(img.KernelOptionsAppend, "rw")
 	}
 
-	if !common.VersionLessThan(t.arch.distro.osVersion, "9.2") || !t.arch.distro.isRHEL() {
+	if common.VersionGreaterThanOrEqual(t.arch.distro.osVersion, "9.2") || !t.arch.distro.isRHEL() {
 		img.IgnitionPlatform = "metal"
 		img.KernelOptionsAppend = append(img.KernelOptionsAppend, "coreos.no_persist_ip")
 		if bpIgnition := customizations.GetIgnition(); bpIgnition != nil && bpIgnition.FirstBoot != nil && bpIgnition.FirstBoot.ProvisioningURL != "" {
@@ -513,7 +514,7 @@ func edgeSimplifiedInstallerImage(workload workload.Workload,
 	rawImg.KernelOptionsAppend = []string{"modprobe.blacklist=vc4"}
 	rawImg.Keyboard = "us"
 	rawImg.Locale = "C.UTF-8"
-	if !common.VersionLessThan(t.arch.distro.osVersion, "9.2") || !t.arch.distro.isRHEL() {
+	if common.VersionGreaterThanOrEqual(t.arch.distro.osVersion, "9.2") || !t.arch.distro.isRHEL() {
 		rawImg.SysrootReadOnly = true
 		rawImg.KernelOptionsAppend = append(rawImg.KernelOptionsAppend, "rw")
 	}
@@ -528,7 +529,7 @@ func edgeSimplifiedInstallerImage(workload workload.Workload,
 	rawImg.OSName = "redhat"
 	rawImg.LockRoot = true
 
-	if !common.VersionLessThan(t.arch.distro.osVersion, "9.2") || !t.arch.distro.isRHEL() {
+	if common.VersionGreaterThanOrEqual(t.arch.distro.osVersion, "9.2") || !t.arch.distro.isRHEL() {
 		rawImg.IgnitionPlatform = "metal"
 		rawImg.KernelOptionsAppend = append(rawImg.KernelOptionsAppend, "coreos.no_persist_ip")
 		if bpIgnition := customizations.GetIgnition(); bpIgnition != nil && bpIgnition.FirstBoot != nil && bpIgnition.FirstBoot.ProvisioningURL != "" {
diff --git a/vendor/github.com/osbuild/images/pkg/distro/rhel9/imagetype.go b/vendor/github.com/osbuild/images/pkg/distro/rhel9/imagetype.go
index 41f3c2b49..314f72738 100644
--- a/vendor/github.com/osbuild/images/pkg/distro/rhel9/imagetype.go
+++ b/vendor/github.com/osbuild/images/pkg/distro/rhel9/imagetype.go
@@ -250,11 +250,10 @@ func (t *imageType) Manifest(bp *blueprint.Blueprint,
 	containerSources := make([]container.SourceSpec, len(bp.Containers))
 	for idx, cont := range bp.Containers {
 		containerSources[idx] = container.SourceSpec{
-			Source:              cont.Source,
-			Name:                cont.Name,
-			TLSVerify:           cont.TLSVerify,
-			ContainersTransport: cont.ContainersTransport,
-			StoragePath:         cont.StoragePath,
+			Source:    cont.Source,
+			Name:      cont.Name,
+			TLSVerify: cont.TLSVerify,
+			Local:     cont.LocalStorage,
 		}
 	}
 
@@ -301,14 +300,6 @@ func (t *imageType) checkOptions(bp *blueprint.Blueprint, options distro.ImageOp
 		return warnings, fmt.Errorf("embedding containers is not supported for %s on %s", t.name, t.arch.distro.name)
 	}
 
-	if len(bp.Containers) > 0 {
-		for _, container := range bp.Containers {
-			if err := container.Validate(); err != nil {
-				return nil, err
-			}
-		}
-	}
-
 	if options.OSTree != nil {
 		if err := options.OSTree.Validate(); err != nil {
 			return nil, err
diff --git a/vendor/github.com/osbuild/images/pkg/manifest/anaconda_installer_iso_tree.go b/vendor/github.com/osbuild/images/pkg/manifest/anaconda_installer_iso_tree.go
index 4dcb65d3b..a61feb77d 100644
--- a/vendor/github.com/osbuild/images/pkg/manifest/anaconda_installer_iso_tree.go
+++ b/vendor/github.com/osbuild/images/pkg/manifest/anaconda_installer_iso_tree.go
@@ -389,7 +389,7 @@ func (p *AnacondaInstallerISOTree) ostreeCommitStages() []*osbuild.Stage {
 func (p *AnacondaInstallerISOTree) ostreeContainerStages() []*osbuild.Stage {
 	stages := make([]*osbuild.Stage, 0)
 
-	images := osbuild.NewContainersInputForSources([]container.Spec{*p.containerSpec})
+	image := osbuild.NewContainersInputForSingleSource(*p.containerSpec)
 
 	stages = append(stages, osbuild.NewMkdirStage(&osbuild.MkdirStageOptions{
 		Paths: []osbuild.MkdirStagePath{
@@ -402,7 +402,7 @@ func (p *AnacondaInstallerISOTree) ostreeContainerStages() []*osbuild.Stage {
 	// copy the container in
 	stages = append(stages, osbuild.NewSkopeoStageWithOCI(
 		p.PayloadPath,
-		images,
+		image,
 		nil))
 
 	// do what we can in our kickstart stage
@@ -439,13 +439,6 @@ func (p *AnacondaInstallerISOTree) ostreeContainerStages() []*osbuild.Stage {
 
 	// and what we can't do in a separate kickstart that we include
 	targetContainerTransport := "registry"
-	if p.containerSpec.ContainersTransport != nil {
-		targetContainerTransport = *p.containerSpec.ContainersTransport
-	}
-	// Canonicalize to registry, as that's what the bootc stack wants
-	if targetContainerTransport == "docker://" {
-		targetContainerTransport = "registry"
-	}
 
 	// Because osbuild core only supports a subset of options, we append to the
 	// base here with some more hardcoded defaults
diff --git a/vendor/github.com/osbuild/images/pkg/manifest/build.go b/vendor/github.com/osbuild/images/pkg/manifest/build.go
index 2c38cc9e5..acc7cc189 100644
--- a/vendor/github.com/osbuild/images/pkg/manifest/build.go
+++ b/vendor/github.com/osbuild/images/pkg/manifest/build.go
@@ -1,6 +1,8 @@
 package manifest
 
 import (
+	"fmt"
+
 	"github.com/osbuild/images/pkg/container"
 	"github.com/osbuild/images/pkg/osbuild"
 	"github.com/osbuild/images/pkg/ostree"
@@ -225,14 +227,19 @@ func (p *BuildrootFromContainer) serialize() osbuild.Pipeline {
 	if len(p.containerSpecs) == 0 {
 		panic("serialization not started")
 	}
+	if len(p.containerSpecs) != 1 {
+		panic(fmt.Sprintf("BuildrootFromContainer expectes exactly one container input, got: %v", p.containerSpecs))
+	}
+
 	pipeline := p.Base.serialize()
 	pipeline.Runner = p.runner.String()
 
-	inputs := osbuild.NewContainersInputForSources(p.containerSpecs)
+	image := osbuild.NewContainersInputForSingleSource(p.containerSpecs[0])
 	options := &osbuild.ContainerDeployOptions{
 		Exclude: []string{"/sysroot"},
 	}
-	stage, err := osbuild.NewContainerDeployStage(inputs, options)
+
+	stage, err := osbuild.NewContainerDeployStage(image, options)
 	if err != nil {
 		panic(err)
 	}
diff --git a/vendor/github.com/osbuild/images/pkg/manifest/os.go b/vendor/github.com/osbuild/images/pkg/manifest/os.go
index e6df04629..8f058460f 100644
--- a/vendor/github.com/osbuild/images/pkg/manifest/os.go
+++ b/vendor/github.com/osbuild/images/pkg/manifest/os.go
@@ -77,6 +77,7 @@ type OSCustomizations struct {
 	Timezone         string
 	EnabledServices  []string
 	DisabledServices []string
+	MaskedServices   []string
 	DefaultTarget    string
 
 	// SELinux policy, when set it enables the labeling of the tree with the
@@ -405,21 +406,14 @@ func (p *OS) serialize() osbuild.Pipeline {
 	}
 
 	if len(p.containerSpecs) > 0 {
-		images := osbuild.NewContainersInputForSources(p.containerSpecs)
-
 		var storagePath string
-
 		if containerStore := p.OSCustomizations.ContainersStorage; containerStore != nil {
 			storagePath = *containerStore
-			storageConf := "/etc/containers/storage.conf"
-
-			containerStoreOpts := osbuild.NewContainerStorageOptions(storageConf, storagePath)
-			pipeline.AddStage(osbuild.NewContainersStorageConfStage(containerStoreOpts))
 		}
 
-		manifests := osbuild.NewFilesInputForManifestLists(p.containerSpecs)
-		skopeo := osbuild.NewSkopeoStageWithContainersStorage(storagePath, images, manifests)
-		pipeline.AddStage(skopeo)
+		for _, stage := range osbuild.GenContainerStorageStages(storagePath, p.containerSpecs) {
+			pipeline.AddStage(stage)
+		}
 	}
 
 	pipeline.AddStage(osbuild.NewLocaleStage(&osbuild.LocaleStageOptions{Language: p.Language}))
@@ -706,8 +700,10 @@ func (p *OS) serialize() osbuild.Pipeline {
 
 	enabledServices := []string{}
 	disabledServices := []string{}
+	maskedServices := []string{}
 	enabledServices = append(enabledServices, p.EnabledServices...)
 	disabledServices = append(disabledServices, p.DisabledServices...)
+	maskedServices = append(maskedServices, p.MaskedServices...)
 	if p.Environment != nil {
 		enabledServices = append(enabledServices, p.Environment.GetServices()...)
 	}
@@ -716,10 +712,12 @@ func (p *OS) serialize() osbuild.Pipeline {
 		disabledServices = append(disabledServices, p.Workload.GetDisabledServices()...)
 	}
 	if len(enabledServices) != 0 ||
-		len(disabledServices) != 0 || p.DefaultTarget != "" {
+		len(disabledServices) != 0 ||
+		len(maskedServices) != 0 || p.DefaultTarget != "" {
 		pipeline.AddStage(osbuild.NewSystemdStage(&osbuild.SystemdStageOptions{
 			EnabledServices:  enabledServices,
 			DisabledServices: disabledServices,
+			MaskedServices:   maskedServices,
 			DefaultTarget:    p.DefaultTarget,
 		}))
 	}
diff --git a/vendor/github.com/osbuild/images/pkg/manifest/ostree_deployment.go b/vendor/github.com/osbuild/images/pkg/manifest/ostree_deployment.go
index 3a79326f7..3e3afb97f 100644
--- a/vendor/github.com/osbuild/images/pkg/manifest/ostree_deployment.go
+++ b/vendor/github.com/osbuild/images/pkg/manifest/ostree_deployment.go
@@ -228,7 +228,6 @@ func (p *OSTreeDeployment) doOSTreeSpec(pipeline *osbuild.Pipeline, repoPath str
 }
 
 func (p *OSTreeDeployment) doOSTreeContainerSpec(pipeline *osbuild.Pipeline, repoPath string, kernelOpts []string) string {
-	cont := *p.containerSpec
 	ref := p.ref
 
 	var targetImgref string
@@ -249,7 +248,8 @@ func (p *OSTreeDeployment) doOSTreeContainerSpec(pipeline *osbuild.Pipeline, rep
 			Label: "root",
 		},
 	}
-	images := osbuild.NewContainersInputForSources([]container.Spec{cont})
+
+	images := osbuild.NewContainersInputForSingleSource(*p.containerSpec)
 	pipeline.AddStage(osbuild.NewOSTreeDeployContainerStage(options, images))
 	return ref
 }
diff --git a/vendor/github.com/osbuild/images/pkg/osbuild/containers.go b/vendor/github.com/osbuild/images/pkg/osbuild/containers.go
new file mode 100644
index 000000000..475b8ca14
--- /dev/null
+++ b/vendor/github.com/osbuild/images/pkg/osbuild/containers.go
@@ -0,0 +1,29 @@
+package osbuild
+
+import (
+	"github.com/osbuild/images/pkg/container"
+)
+
+func GenContainerStorageStages(storagePath string, containerSpecs []container.Spec) (stages []*Stage) {
+	if storagePath != "" {
+		storageConf := "/etc/containers/storage.conf"
+
+		containerStoreOpts := NewContainerStorageOptions(storageConf, storagePath)
+		stages = append(stages, NewContainersStorageConfStage(containerStoreOpts))
+	}
+
+	images := NewContainersInputForSources(containerSpecs)
+	localImages := NewLocalContainersInputForSources(containerSpecs)
+
+	if len(images.References) > 0 {
+		manifests := NewFilesInputForManifestLists(containerSpecs)
+		stages = append(stages, NewSkopeoStageWithContainersStorage(storagePath, images, manifests))
+	}
+
+	if len(localImages.References) > 0 {
+		stages = append(stages, NewSkopeoStageWithContainersStorage(storagePath, localImages, nil))
+
+	}
+
+	return stages
+}
diff --git a/vendor/github.com/osbuild/images/pkg/osbuild/containers_input.go b/vendor/github.com/osbuild/images/pkg/osbuild/containers_input.go
index a0dc9306b..917f1ac4a 100644
--- a/vendor/github.com/osbuild/images/pkg/osbuild/containers_input.go
+++ b/vendor/github.com/osbuild/images/pkg/osbuild/containers_input.go
@@ -13,22 +13,50 @@ type ContainersInput struct {
 	References map[string]ContainersInputSourceRef `json:"references"`
 }
 
-func NewContainersInputForSources(containers []container.Spec) ContainersInput {
+func (c ContainersInput) isStageInputs() {}
+
+func newContainersInputForSources(containers []container.Spec, forLocal bool) ContainersInput {
 	refs := make(map[string]ContainersInputSourceRef, len(containers))
 	for _, c := range containers {
+		if forLocal != c.LocalStorage {
+			continue
+		}
 		ref := ContainersInputSourceRef{
 			Name: c.LocalName,
 		}
 		refs[c.ImageID] = ref
 	}
 
+	var sourceType string
+	if forLocal {
+		sourceType = "org.osbuild.containers-storage"
+	} else {
+		sourceType = "org.osbuild.containers"
+	}
+
 	return ContainersInput{
 		References: refs,
 		inputCommon: inputCommon{
-			Type:   "org.osbuild.containers",
+			Type:   sourceType,
 			Origin: InputOriginSource,
 		},
 	}
 }
 
-func (c ContainersInput) isStageInputs() {}
+func NewContainersInputForSources(containers []container.Spec) ContainersInput {
+	return newContainersInputForSources(containers, false)
+}
+
+func NewLocalContainersInputForSources(containers []container.Spec) ContainersInput {
+	return newContainersInputForSources(containers, true)
+}
+
+// NewContainersInputForSingleSource will return a containers input for a
+// single container spec. It will automatically select the right local or
+// remote input.
+func NewContainersInputForSingleSource(spec container.Spec) ContainersInput {
+	if spec.LocalStorage {
+		return NewLocalContainersInputForSources([]container.Spec{spec})
+	}
+	return NewContainersInputForSources([]container.Spec{spec})
+}
diff --git a/vendor/github.com/osbuild/images/pkg/osbuild/containers_storage_source.go b/vendor/github.com/osbuild/images/pkg/osbuild/containers_storage_source.go
new file mode 100644
index 000000000..97799268e
--- /dev/null
+++ b/vendor/github.com/osbuild/images/pkg/osbuild/containers_storage_source.go
@@ -0,0 +1,22 @@
+package osbuild
+
+import "fmt"
+
+type ContainersStorageSource struct {
+	Items map[string]struct{} `json:"items"`
+}
+
+func (ContainersStorageSource) isSource() {}
+
+func NewContainersStorageSource() *ContainersStorageSource {
+	return &ContainersStorageSource{
+		Items: make(map[string]struct{}),
+	}
+}
+
+func (source *ContainersStorageSource) AddItem(id string) {
+	if !skopeoDigestPattern.MatchString(id) {
+		panic(fmt.Errorf("item %#v has invalid image id", id))
+	}
+	source.Items[id] = struct{}{}
+}
diff --git a/vendor/github.com/osbuild/images/pkg/osbuild/skopeo_index_source.go b/vendor/github.com/osbuild/images/pkg/osbuild/skopeo_index_source.go
index 21bb87262..d273fb138 100644
--- a/vendor/github.com/osbuild/images/pkg/osbuild/skopeo_index_source.go
+++ b/vendor/github.com/osbuild/images/pkg/osbuild/skopeo_index_source.go
@@ -11,38 +11,20 @@ type SkopeoIndexSource struct {
 func (SkopeoIndexSource) isSource() {}
 
 type SkopeoIndexSourceImage struct {
-	Name                string  `json:"name"`
-	TLSVerify           *bool   `json:"tls-verify,omitempty"`
-	ContainersTransport *string `json:"containers-transport,omitempty"`
-	StorageLocation     *string `json:"storage-location,omitempty"`
+	Name      string `json:"name"`
+	TLSVerify *bool  `json:"tls-verify,omitempty"`
 }
 
 type SkopeoIndexSourceItem struct {
 	Image SkopeoIndexSourceImage `json:"image"`
 }
 
-func validateTransport(transport *string) error {
-	if transport == nil {
-		return nil
-	}
-
-	if *transport != DockerTransport && *transport != ContainersStorageTransport {
-		return fmt.Errorf("invalid container transport: %s", *transport)
-	}
-
-	return nil
-}
-
 func (item SkopeoIndexSourceItem) validate() error {
 
 	if item.Image.Name == "" {
 		return fmt.Errorf("source item has empty name")
 	}
 
-	if err := validateTransport(item.Image.ContainersTransport); err != nil {
-		return err
-	}
-
 	return nil
 }
 
@@ -55,13 +37,11 @@ func NewSkopeoIndexSource() *SkopeoIndexSource {
 
 // AddItem adds a source item to the source; will panic
 // if any of the supplied options are invalid or missing
-func (source *SkopeoIndexSource) AddItem(name, image string, tlsVerify *bool, containersTransport *string, storageLocation *string) {
+func (source *SkopeoIndexSource) AddItem(name, image string, tlsVerify *bool) {
 	item := SkopeoIndexSourceItem{
 		Image: SkopeoIndexSourceImage{
-			Name:                name,
-			TLSVerify:           tlsVerify,
-			ContainersTransport: containersTransport,
-			StorageLocation:     storageLocation,
+			Name:      name,
+			TLSVerify: tlsVerify,
 		},
 	}
 
diff --git a/vendor/github.com/osbuild/images/pkg/osbuild/skopeo_source.go b/vendor/github.com/osbuild/images/pkg/osbuild/skopeo_source.go
index 2073c918c..1145e59c5 100644
--- a/vendor/github.com/osbuild/images/pkg/osbuild/skopeo_source.go
+++ b/vendor/github.com/osbuild/images/pkg/osbuild/skopeo_source.go
@@ -17,11 +17,9 @@ type SkopeoSource struct {
 func (SkopeoSource) isSource() {}
 
 type SkopeopSourceImage struct {
-	Name                string  `json:"name,omitempty"`
-	Digest              string  `json:"digest,omitempty"`
-	TLSVerify           *bool   `json:"tls-verify,omitempty"`
-	ContainersTransport *string `json:"containers-transport,omitempty"`
-	StorageLocation     *string `json:"storage-location,omitempty"`
+	Name      string `json:"name,omitempty"`
+	Digest    string `json:"digest,omitempty"`
+	TLSVerify *bool  `json:"tls-verify,omitempty"`
 }
 
 type SkopeoSourceItem struct {
@@ -29,14 +27,12 @@ type SkopeoSourceItem struct {
 }
 
 // NewSkopeoSourceItem creates a new source item for name and digest
-func NewSkopeoSourceItem(name, digest string, tlsVerify *bool, containersTransport *string, storageLocation *string) SkopeoSourceItem {
+func NewSkopeoSourceItem(name, digest string, tlsVerify *bool) SkopeoSourceItem {
 	item := SkopeoSourceItem{
 		Image: SkopeopSourceImage{
-			Name:                name,
-			Digest:              digest,
-			TLSVerify:           tlsVerify,
-			ContainersTransport: containersTransport,
-			StorageLocation:     storageLocation,
+			Name:      name,
+			Digest:    digest,
+			TLSVerify: tlsVerify,
 		},
 	}
 	if err := item.validate(); err != nil {
@@ -54,10 +50,6 @@ func (item SkopeoSourceItem) validate() error {
 		return fmt.Errorf("source item %#v has invalid digest", item)
 	}
 
-	if err := validateTransport(item.Image.ContainersTransport); err != nil {
-		return err
-	}
-
 	return nil
 }
 
@@ -70,8 +62,8 @@ func NewSkopeoSource() *SkopeoSource {
 
 // AddItem adds a source item to the source; will panic
 // if any of the supplied options are invalid or missing
-func (source *SkopeoSource) AddItem(name, digest, image string, tlsVerify *bool, containersTransport *string, storageLocation *string) {
-	item := NewSkopeoSourceItem(name, digest, tlsVerify, containersTransport, storageLocation)
+func (source *SkopeoSource) AddItem(name, digest, image string, tlsVerify *bool) {
+	item := NewSkopeoSourceItem(name, digest, tlsVerify)
 	if !skopeoDigestPattern.MatchString(image) {
 		panic(fmt.Errorf("item %#v has invalid image id", image))
 	}
diff --git a/vendor/github.com/osbuild/images/pkg/osbuild/source.go b/vendor/github.com/osbuild/images/pkg/osbuild/source.go
index 9abe9d194..ce31dfac8 100644
--- a/vendor/github.com/osbuild/images/pkg/osbuild/source.go
+++ b/vendor/github.com/osbuild/images/pkg/osbuild/source.go
@@ -90,16 +90,20 @@ func GenSources(packages []rpmmd.PackageSpec, ostreeCommits []ostree.CommitSpec,
 		sources["org.osbuild.inline"] = ils
 	}
 
-	// collect skopeo container sources
+	// collect skopeo and local container sources
 	if len(containers) > 0 {
 		skopeo := NewSkopeoSource()
 		skopeoIndex := NewSkopeoIndexSource()
+		localContainers := NewContainersStorageSource()
 		for _, c := range containers {
-			skopeo.AddItem(c.Source, c.Digest, c.ImageID, c.TLSVerify, c.ContainersTransport, c.StoragePath)
-
-			// if we have a list digest, add a skopeo-index source as well
-			if c.ListDigest != "" {
-				skopeoIndex.AddItem(c.Source, c.ListDigest, c.TLSVerify, c.ContainersTransport, c.StoragePath)
+			if c.LocalStorage {
+				localContainers.AddItem(c.ImageID)
+			} else {
+				skopeo.AddItem(c.Source, c.Digest, c.ImageID, c.TLSVerify)
+				// if we have a list digest, add a skopeo-index source as well
+				if c.ListDigest != "" {
+					skopeoIndex.AddItem(c.Source, c.ListDigest, c.TLSVerify)
+				}
 			}
 		}
 		if len(skopeo.Items) > 0 {
@@ -108,6 +112,9 @@ func GenSources(packages []rpmmd.PackageSpec, ostreeCommits []ostree.CommitSpec,
 		if len(skopeoIndex.Items) > 0 {
 			sources["org.osbuild.skopeo-index"] = skopeoIndex
 		}
+		if len(localContainers.Items) > 0 {
+			sources["org.osbuild.containers-storage"] = localContainers
+		}
 	}
 
 	return sources, nil
diff --git a/vendor/google.golang.org/api/internal/version.go b/vendor/google.golang.org/api/internal/version.go
index 5e418fd8e..60852aed6 100644
--- a/vendor/google.golang.org/api/internal/version.go
+++ b/vendor/google.golang.org/api/internal/version.go
@@ -5,4 +5,4 @@
 package internal
 
 // Version is the current tagged release of the library.
-const Version = "0.166.0"
+const Version = "0.167.0"
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 35d04334f..0fe064599 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -193,7 +193,7 @@ github.com/acarl005/stripansi
 # github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2
 ## explicit; go 1.13
 github.com/asaskevich/govalidator
-# github.com/aws/aws-sdk-go v1.50.24
+# github.com/aws/aws-sdk-go v1.50.27
 ## explicit; go 1.19
 github.com/aws/aws-sdk-go/aws
 github.com/aws/aws-sdk-go/aws/arn
@@ -642,7 +642,7 @@ github.com/googleapis/gax-go/v2/apierror
 github.com/googleapis/gax-go/v2/apierror/internal/proto
 github.com/googleapis/gax-go/v2/callctx
 github.com/googleapis/gax-go/v2/internal
-# github.com/gophercloud/gophercloud v1.9.0
+# github.com/gophercloud/gophercloud v1.10.0
 ## explicit; go 1.14
 github.com/gophercloud/gophercloud
 github.com/gophercloud/gophercloud/internal/ctxt
@@ -851,7 +851,7 @@ github.com/oracle/oci-go-sdk/v54/identity
 github.com/oracle/oci-go-sdk/v54/objectstorage
 github.com/oracle/oci-go-sdk/v54/objectstorage/transfer
 github.com/oracle/oci-go-sdk/v54/workrequests
-# github.com/osbuild/images v0.40.0
+# github.com/osbuild/images v0.41.0
 ## explicit; go 1.19
 github.com/osbuild/images/internal/common
 github.com/osbuild/images/internal/environment
@@ -1241,7 +1241,7 @@ golang.org/x/tools/internal/pkgbits
 golang.org/x/tools/internal/tokeninternal
 golang.org/x/tools/internal/typeparams
 golang.org/x/tools/internal/typesinternal
-# google.golang.org/api v0.166.0
+# google.golang.org/api v0.167.0
 ## explicit; go 1.19
 google.golang.org/api/googleapi
 google.golang.org/api/googleapi/transport


Test patch:
diff --git a/internal/blueprint/customizations_test.go b/internal/blueprint/customizations_test.go
index 58679c0cf..8cf49f294 100644
--- a/internal/blueprint/customizations_test.go
+++ b/internal/blueprint/customizations_test.go
@@ -228,6 +228,7 @@ func TestGetServices(t *testing.T) {
 	expectedServices := ServicesCustomization{
 		Enabled:  []string{"cockpit", "osbuild-composer"},
 		Disabled: []string{"sshd", "ftp"},
+		Masked:   []string{"firewalld"},
 	}
 
 	TestCustomizations := Customizations{
@@ -238,6 +239,7 @@ func TestGetServices(t *testing.T) {
 
 	assert.ElementsMatch(t, expectedServices.Enabled, retServices.Enabled)
 	assert.ElementsMatch(t, expectedServices.Disabled, retServices.Disabled)
+	assert.ElementsMatch(t, expectedServices.Masked, retServices.Masked)
 }
 
 func TestError(t *testing.T) {
diff --git a/internal/cloudapi/v2/compose_test.go b/internal/cloudapi/v2/compose_test.go
index 09842829c..7414a871c 100644
--- a/internal/cloudapi/v2/compose_test.go
+++ b/internal/cloudapi/v2/compose_test.go
@@ -78,6 +78,7 @@ func GetTestBlueprint() blueprint.Blueprint {
 		Services: &blueprint.ServicesCustomization{
 			Enabled:  []string{"sshd"},
 			Disabled: []string{"cleanup"},
+			Masked:   []string{"firewalld"},
 		},
 		OpenSCAP: &blueprint.OpenSCAPCustomization{
 			ProfileID: "B 263-59",
@@ -198,6 +199,7 @@ func TestGetBlueprintFromCustomizations(t *testing.T) {
 		Services: &Services{
 			Disabled: &[]string{"cleanup"},
 			Enabled:  &[]string{"sshd"},
+			Masked:   &[]string{"firewalld"},
 		},
 		Openscap: &OpenSCAP{ProfileId: "B 263-59"},
 		CustomRepositories: &[]CustomRepository{
@@ -320,6 +322,7 @@ func TestGetBlueprintFromCompose(t *testing.T) {
 			Services: &Services{
 				Disabled: &[]string{"cleanup"},
 				Enabled:  &[]string{"sshd"},
+				Masked:   &[]string{"firewalld"},
 			},
 			Openscap: &BlueprintOpenSCAP{ProfileId: "B 263-59"},
 			Repositories: &[]BlueprintRepository{
diff --git a/internal/weldr/api_test.go b/internal/weldr/api_test.go
index 951cf02ad..84d6c6f49 100644
--- a/internal/weldr/api_test.go
+++ b/internal/weldr/api_test.go
@@ -499,7 +499,7 @@ func TestBlueprintsCustomizationInfoToml(t *testing.T) {
         ],
         "disabled": [
           "telnet"
-        ]
+		]
       }
     },
     "services": {
@@ -511,6 +511,9 @@ func TestBlueprintsCustomizationInfoToml(t *testing.T) {
       "disabled": [
         "postfix",
         "telnetd"
+      ],
+	  "masked": [
+	    "firewalld"
       ]
     },
     "user": [
@@ -629,6 +632,7 @@ func TestBlueprintsCustomizationInfoToml(t *testing.T) {
 			Services: &blueprint.ServicesCustomization{
 				Enabled:  []string{"sshd", "cockpit.socket", "httpd"},
 				Disabled: []string{"postfix", "telnetd"},
+				Masked:   []string{"firewalld"},
 			},
 			Filesystem: []blueprint.FilesystemCustomization{
 				blueprint.FilesystemCustomization{