Repository: osbuild/osbuild
Pull request #677 (2021-06-17 07:58:47)

LVM support
This PR adds support for creating disk images with LVM layout to osbuild.

Release Notes:
```markdown

- **LVM2 support** was added. For this new stages and host services were added:
- Support for parent devices were added to the `devices` host service: a device can now
  specify a device it depends on. An example is an LVM2 volume on a partition. When loading
  the devices are pre-sorted so that all dependencies are in the correct order.
- `stages/org.osbuild.lvm2.create`: new stage to create a logical volumes, the volume group and
  the physical volume in one operation.
- `devices/org.osbuild.lvm2.lv`: new device host service to activate a LVM2 logical volume. The
   logical volume is identified via the underlying device, so there is no need to know the logical
  volume's name or uuid. 
- `stages/org.osbuild.lvm2.metadata`: new stage to modify LVM2 metadata. The metadata
```

TODO:
 - [x] sort devices so that parent devices come first
 - [x] doc string fixes
 - [x] tests for the new lvm2 module
 - [x] building the image manifest in CI or converting one of the existing ones to use LVM

gicmo: With the addition of the `org.osbuild.lvm2.metadata` stage this is now feature complete \o/
Missing is:
 - [ ] doc string fixes
 - [ ] tests for the new lvm2 module
 - [ ] building the image manifest in CI or converting one of the existing ones to use LVM
teg: This is really cool!

Could we possibly apply the same logic to xfs filesystem UUIDs? We currently can't really cache images as we generate each manifest with a different random UUID...

Patch:
diff --git a/.gitignore b/.gitignore
index d9a9b2e9..2f1a40c4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -13,3 +13,5 @@ __pycache__
 cov-analysis-linux64/
 cov-analysis-osbuild.xz
 cov-int/
+
+**/.DS_Store
diff --git a/devices/org.osbuild.loopback b/devices/org.osbuild.loopback
index 955a91ff..fd0cf67e 100755
--- a/devices/org.osbuild.loopback
+++ b/devices/org.osbuild.loopback
@@ -78,7 +78,7 @@ class LoopbackService(devices.DeviceService):
 
         return lo
 
-    def open(self, devpath: str, tree: str, options: Dict):
+    def open(self, devpath: str, parent: str, tree: str, options: Dict):
         filename = options["filename"]
         self.sector_size = options.get("sector-size", 512)
         start = options.get("start", 0) * self.sector_size
diff --git a/devices/org.osbuild.lvm2.lv b/devices/org.osbuild.lvm2.lv
new file mode 100755
index 00000000..5e72d339
--- /dev/null
+++ b/devices/org.osbuild.lvm2.lv
@@ -0,0 +1,191 @@
+#!/usr/bin/python3
+"""
+Host service for providing access to LVM2 logical volumes
+
+This host service can be used to activate logical volumes
+so that they can be accessed from osbuild stages.
+The parent volume group is identified via the physical
+device which must be passed to this service as parent.
+
+Example usage, where `lvm` here is the lvm partition and
+`root` then the logical volume named `root`:
+```
+"lvm": {
+  "type": "org.osbuild.loopback",
+  "options": {
+  "filename": "disk.img",
+  "start": ...,
+},
+"root": {
+  "type": "org.osbuild.lvm2.lv",
+  "parent": "lvm",
+    "options": {
+    "volume": "root"
+  }
+}
+```
+
+Required host tools: lvchange, pvdisplay, lvdisplay
+"""
+
+import json
+import os
+import stat
+import subprocess
+import sys
+import time
+
+from typing import Dict, Tuple
+
+from osbuild import devices
+
+
+SCHEMA = """
+"additionalProperties": false,
+"required": ["volume"],
+"properties": {
+  "volume": {
+    "type": "string",
+    "description": "Logical volume to active"
+  }
+}
+"""
+
+
+class LVService(devices.DeviceService):
+
+    def __init__(self, args):
+        super().__init__(args)
+        self.target = None
+
+    @staticmethod
+    def lv_set_active(fullname: str, status: bool):
+        mode = "y" if status else "n"
+        cmd = [
+            "lvchange", "--activate", mode, fullname
+        ]
+        res = subprocess.run(cmd,
+                             check=False,
+                             stdout=subprocess.PIPE,
+                             stderr=subprocess.STDOUT,
+                             encoding="UTF-8")
+
+        if res.returncode != 0:
+            data = res.stdout.strip()
+            msg = f"Failed to set LV device ({fullname}) status: {data}"
+            raise RuntimeError(msg)
+
+    @staticmethod
+    def volume_group_for_device(device: str) -> str:
+        # Find the volume group that belongs to the device specified via `parent`
+        vg_name = None
+        count = 0
+
+        cmd = [
+            "pvdisplay", "-C", "--noheadings", "-o", "vg_name", device
+        ]
+
+        while True:
+            res = subprocess.run(cmd,
+                                 check=False,
+                                 stdout=subprocess.PIPE,
+                                 stderr=subprocess.STDOUT,
+                                 encoding="UTF-8")
+
+            if res.returncode == 5:
+                if count == 10:
+                    raise RuntimeError("Could not find parent device")
+                time.sleep(1*count)
+                count += 1
+                continue
+
+            if res.returncode != 0:
+                json.dump({"error": res.stdout.strip()}, sys.stdout)
+                return 1
+
+            vg_name = res.stdout.strip()
+            if vg_name:
+                break
+
+        return vg_name
+
+    @staticmethod
+    def device_for_logical_volume(vg_name: str, volume: str) -> Tuple[int, int]:
+        # Now that we have the volume group, find the specified logical volume and its device path
+
+        cmd = [
+            "lvdisplay", "-C", "--noheadings",
+            "-o", "lv_kernel_major,lv_kernel_minor",
+            "--separator", ";",
+            "-S", f"lv_name={volume}",
+            vg_name
+        ]
+
+        res = subprocess.run(cmd,
+                             check=False,
+                             stdout=subprocess.PIPE,
+                             stderr=subprocess.STDOUT,
+                             encoding="UTF-8")
+
+        if res.returncode != 0:
+            raise RuntimeError(res.stdout.strip())
+
+        data = res.stdout.strip()
+        devnum = list(map(int, data.split(";")))
+        assert len(devnum) == 2
+        major, minor = devnum[0], devnum[1]
+
+        return major, minor
+
+    def open(self, devpath: str, parent: str, tree: str, options: Dict):
+        lv = options["volume"]
+
+        assert not parent.startswith("/")
+        parent_path = os.path.join("/dev", parent)
+
+        # Find the volume group that belongs to the device specified
+        # via `parent`
+        vg = self.volume_group_for_device(parent_path)
+
+        # Activate the logical volume
+        self.fullname = f"{vg}/{lv}"
+        self.lv_set_active(self.fullname, True)
+
+        # Now that we have the volume group, find the major and minor
+        # device numbers for the logical volume
+        major, minor = self.device_for_logical_volume(vg, lv)
+
+        # Create the device node for the LV in the build root's /dev
+        devname = os.path.join(vg, lv)
+        fullpath = os.path.join(devpath, devname)
+
+        os.makedirs(os.path.join(devpath, vg), exist_ok=True)
+        os.mknod(fullpath, 0o666 | stat.S_IFBLK, os.makedev(major, minor))
+
+        data = {
+            "path": devname,
+            "node": {
+                "major": major,
+                "minor": minor
+            },
+            "lvm": {
+                "vg_name": vg,
+                "lv_name": lv
+            }
+        }
+        return data
+
+    def close(self):
+        if self.fullname:
+            self.lv_set_active(self.fullname, False)
+            self.fullname = None
+
+
+def main():
+    service = LVService.from_args(sys.argv[1:])
+    service.main()
+
+
+if __name__ == '__main__':
+    r = main()
+    sys.exit(r)
diff --git a/osbuild/devices.py b/osbuild/devices.py
index 7546c73e..1e40160f 100644
--- a/osbuild/devices.py
+++ b/osbuild/devices.py
@@ -26,9 +26,10 @@ class Device:
     A single device with its corresponding options
     """
 
-    def __init__(self, name, info, options: Dict):
+    def __init__(self, name, info, parent, options: Dict):
         self.name = name
         self.info = info
+        self.parent = parent
         self.options = options or {}
         self.id = self.calc_id()
 
@@ -36,16 +37,21 @@ class Device:
         # NB: Since the name of the device is arbitrary or prescribed
         # by the stage, it is not included in the id calculation.
         m = hashlib.sha256()
+
         m.update(json.dumps(self.info.name, sort_keys=True).encode())
+        if self.parent:
+            m.update(json.dumps(self.parent.id, sort_keys=True).encode())
         m.update(json.dumps(self.options, sort_keys=True).encode())
         return m.hexdigest()
 
-    def open(self, mgr: host.ServiceManager, dev: str, tree: str) -> Dict:
+    def open(self, mgr: host.ServiceManager, dev: str, parent: str, tree: str) -> Dict:
         args = {
             # global options
             "dev": dev,
             "tree": tree,
 
+            "parent": parent,
+
             # per device options
             "options": self.options,
         }
@@ -60,7 +66,7 @@ class DeviceService(host.Service):
     """Device host service"""
 
     @abc.abstractmethod
-    def open(self, devpath: str, tree: str, options: Dict):
+    def open(self, devpath: str, parent: str, tree: str, options: Dict):
         """Open a specific device
 
         This method must be implemented by the specific device service.
@@ -78,7 +84,10 @@ class DeviceService(host.Service):
 
     def dispatch(self, method: str, args, _fds):
         if method == "open":
-            r = self.open(args["dev"], args["tree"], args["options"])
+            r = self.open(args["dev"],
+                          args["parent"],
+                          args["tree"],
+                          args["options"])
             return r, None
         if method == "close":
             r = self.close()
diff --git a/osbuild/formats/v2.py b/osbuild/formats/v2.py
index 43310351..4b5190e7 100644
--- a/osbuild/formats/v2.py
+++ b/osbuild/formats/v2.py
@@ -175,14 +175,64 @@ def resolve_ref(name: str, manifest: Manifest) -> str:
     return target.id
 
 
+def sort_devices(devices: Dict) -> Dict:
+    """Sort the devices so that dependencies are in the correct order
+
+    We need to ensure that parents are sorted before the devices that
+    depend on them. For this we keep a list of devices that need to
+    be processed and iterate over that list as long as it has devices
+    in them and we make progress, i.e. the length changes.
+    """
+    result = {}
+    todo = list(devices.keys())
+
+    while todo:
+        before = len(todo)
+
+        for i, name in enumerate(todo):
+            desc = devices[name]
+
+            parent = desc.get("parent")
+            if parent and not parent in result:
+                # if the parent is not in the `result` list, it must
+                # be in `todo`; otherwise it is missing
+                if parent not in todo:
+                    msg = f"Missing parent device '{parent}' for '{name}'"
+                    raise ValueError(msg)
+
+                continue
+
+            # no parent, or parent already present, ok to add to the
+            # result and "remove" from the todo list, by setting the
+            # contents to `None`.
+            result[name] = desc
+            todo[i] = None
+
+        todo = list(filter(bool, todo))
+        if len(todo) == before:
+            # we made no progress, which means that all devices in todo
+            # depend on other devices in todo, hence we have a cycle
+            raise ValueError("Cycle detected in 'devices'")
+
+    return result
+
+
 def load_device(name: str, description: Dict, index: Index, stage: Stage):
     device_type = description["type"]
     options = description.get("options", {})
+    parent = description.get("parent")
+
+    if parent:
+        device = stage.devices.get(parent)
+        if not parent:
+            raise ValueError(f"Unknown parent device: {parent}")
+        parent = device
 
     info = index.get_module_info("Device", device_type)
+
     if not info:
         raise TypeError(f"Missing meta information for {device_type}")
-    stage.add_device(name, info, options)
+    stage.add_device(name, info, parent, options)
 
 
 def load_input(name: str, description: Dict, index: Index, stage: Stage, manifest: Manifest, source_refs: set):
@@ -244,6 +294,8 @@ def load_stage(description: Dict, index: Index, pipeline: Pipeline, manifest: Ma
     stage = pipeline.add_stage(info, opts)
 
     devs = description.get("devices", {})
+    devs = sort_devices(devs)
+
     for name, desc in devs.items():
         load_device(name, desc, index, stage)
 
@@ -392,7 +444,9 @@ def validate(manifest: Dict, index: Index) -> ValidationResult:
     result = schema.validate(manifest)
 
     def validate_module(mod, klass, path):
-        name = mod["type"]
+        name = mod.get("type")
+        if not name:
+            return
         schema = index.get_schema(klass, name, version="2")
         res = schema.validate(mod)
         result.merge(res, path=path)
diff --git a/osbuild/pipeline.py b/osbuild/pipeline.py
index c0ffd5a9..87354373 100644
--- a/osbuild/pipeline.py
+++ b/osbuild/pipeline.py
@@ -69,8 +69,8 @@ class Stage:
         self.inputs[name] = ip
         return ip
 
-    def add_device(self, name, info, options):
-        dev = Device(name, info, options)
+    def add_device(self, name, info, parent, options):
+        dev = Device(name, info, parent, options)
         self.devices[name] = dev
         return dev
 
@@ -161,7 +161,10 @@ class Stage:
                 inputs[key] = data
 
             for key, dev in self.devices.items():
-                reply = dev.open(mgr, build_root.dev, tree)
+                parent = None
+                if dev.parent:
+                    parent = devices[dev.parent.name]["path"]
+                reply = dev.open(mgr, build_root.dev, parent, tree)
                 devices[key] = reply
 
             for key, mount in self.mounts.items():
diff --git a/osbuild/util/lvm2.py b/osbuild/util/lvm2.py
new file mode 100644
index 00000000..1aba0cb6
--- /dev/null
+++ b/osbuild/util/lvm2.py
@@ -0,0 +1,628 @@
+#!/usr/bin/python3
+"""
+Utility functions to read and write LVM metadata.
+
+This module provides a `Disk` class that can be used
+to read in LVM images and explore and manipulate its
+metadata directly, i.e. it reads and writes the data
+and headers directly. This allows one to rename an
+volume group without having to involve the kernel,
+which does not like to have two active LVM volume
+groups with the same name.
+
+The struct definitions have been taken from upstream
+LVM2 sources[1], specifically:
+  - `lib/format_text/layout.h`
+  - `lib/format_text/format-text.c`
+
+[1] https://github.com/lvmteam/lvm2 (commit 8801a86)
+"""
+
+import abc
+import binascii
+import io
+import json
+import os
+import re
+import struct
+import sys
+
+from collections import OrderedDict
+from typing import BinaryIO, Dict, Union
+
+PathLike = Union[str, bytes, os.PathLike]
+
+INITIAL_CRC = 0xf597a6cf
+MDA_HEADER_SIZE = 512
+
+
+def _calc_crc(buf, crc=INITIAL_CRC):
+    crc = crc ^ 0xFFFFFFFF
+    crc = binascii.crc32(buf, crc)
+    return crc ^ 0xFFFFFFFF
+
+
+class CStruct:
+    class Field:
+        def __init__(self, name: str, ctype: str, position: int):
+            self.name = name
+            self.type = ctype
+            self.pos = position
+
+    def __init__(self, mapping: Dict, byte_order="<"):
+        fmt = byte_order
+        self.fields = []
+        for pos, name in enumerate(mapping):
+            ctype = mapping[name]
+            fmt += ctype
+            field = self.Field(name, ctype, pos)
+            self.fields.append(field)
+        self.struct = struct.Struct(fmt)
+
+    @property
+    def size(self):
+        return self.struct.size
+
+    def unpack(self, data):
+        up = self.struct.unpack_from(data)
+        res = {
+            field.name: up[idx]
+            for idx, field in enumerate(self.fields)
+        }
+        return res
+
+    def read(self, fp):
+        pos = fp.tell()
+        data = fp.read(self.size)
+
+        if len(data) < self.size:
+            return None
+
+        res = self.unpack(data)
+        res["_position"] = pos
+        return res
+
+    def pack(self, data):
+        values = [
+            data[field.name] for field in self.fields
+        ]
+        data = self.struct.pack(*values)
+        return data
+
+    def write(self, fp, data: Dict, *, offset=None):
+        packed = self.pack(data)
+
+        save = None
+        if offset:
+            save = fp.tell()
+            fp.seek(offset)
+
+        fp.write(packed)
+
+        if save:
+            fp.seek(save)
+
+    def __getitem__(self, name):
+        for f in self.fields:
+            if f.name == f:
+                return f
+        raise KeyError(f"Unknown field '{name}'")
+
+    def __contains__(self, name):
+        return any(field.name == name for field in self.fields)
+
+
+class Header:
+    """Abstract base class for all headers"""
+
+    @property
+    @classmethod
+    @abc.abstractmethod
+    def struct(cls) -> struct.Struct:
+        """Definition of the underlying struct data"""
+
+    def __init__(self, data):
+        self.data = data
+
+    def __getitem__(self, name):
+        assert name in self.struct
+        return self.data[name]
+
+    def __setitem__(self, name, value):
+        assert name in self.struct
+        self.data[name] = value
+
+    def pack(self):
+        return self.struct.pack(self.data)
+
+    @classmethod
+    def read(cls, fp):
+        data = cls.struct.read(fp)  # pylint: disable=no-member
+        return cls(data)
+
+    def write(self, fp):
+        raw = self.pack()
+        fp.write(raw)
+
+    def __str__(self) -> str:
+        msg = f"{self.__class__.__name__}:"
+        for f in self.struct.fields:
+            msg += f"\n\t{f.name}: {self[f.name]}"
+        return msg
+
+
+class LabelHeader(Header):
+
+    struct = CStruct({     # 32 bytes on disk
+        "id": "8s",        # int8_t[8] // LABELONE
+        "sector": "Q",     # uint64_t  // Sector number of this label
+        "crc": "L",        # uint32_t  // From next field to end of sector
+        "offset": "L",     # uint32_t  // Offset from start of struct to contents
+        "type": "8s"       # int8_t[8] // LVM2 00
+    })
+
+    LABELID = b"LABELONE"
+
+    # scan sector 0 to 3 inclusive
+    LABEL_SCAN_SECTORS = 4
+
+    def __init__(self, data):
+        super().__init__(data)
+        self.sector_size = 512
+
+    @classmethod
+    def search(cls, fp, *, sector_size=512):
+        fp.seek(0, io.SEEK_SET)
+        for _ in range(cls.LABEL_SCAN_SECTORS):
+            raw = fp.read(sector_size)
+            if raw[0:len(cls.LABELID)] == cls.LABELID:
+                data = cls.struct.unpack(raw)
+                return LabelHeader(data)
+        return None
+
+    def read_pv_header(self, fp):
+        sector = self.data["sector"]
+        offset = self.data["offset"]
+        offset = sector * self.sector_size + offset
+        fp.seek(offset)
+        return PVHeader.read(fp)
+
+
+class DiskLocN(Header):
+
+    struct = CStruct({
+        "offset": "Q",  # uint64_t // Offset in bytes to start sector
+        "size": "Q"     # uint64_t // Size in bytes
+    })
+
+    @property
+    def offset(self):
+        return self.data["offset"]
+
+    @property
+    def size(self):
+        return self.data["size"]
+
+    def read_data(self, fp: BinaryIO):
+        fp.seek(self.offset)
+        data = fp.read(self.size)
+        return io.BytesIO(data)
+
+    @classmethod
+    def read_array(cls, fp):
+        while True:
+            data = cls.struct.read(fp)
+
+            if not data or data["offset"] == 0:
+                break
+
+            yield DiskLocN(data)
+
+
+class PVHeader(Header):
+
+    ID_LEN = 32
+    struct = CStruct({
+        "uuid": "32s",    # int8_t[ID_LEN]
+        "disk_size": "Q"  # uint64_t // size in bytes
+    })
+    # followed by two NULL terminated list of data areas
+    # and metadata areas of type `DiskLocN`
+
+    def __init__(self, data, data_areas, meta_areas):
+        super().__init__(data)
+        self.data_areas = data_areas
+        self.meta_areas = meta_areas
+
+    @property
+    def uuid(self):
+        return self.data["uuid"]
+
+    @property
+    def disk_size(self):
+        return self.data["disk_size"]
+
+    @classmethod
+    def read(cls, fp):
+        data = cls.struct.read(fp)
+
+        data_areas = list(DiskLocN.read_array(fp))
+        meta_areas = list(DiskLocN.read_array(fp))
+
+        return cls(data, data_areas, meta_areas)
+
+    def __str__(self):
+        msg = super().__str__()
+        if self.data_areas:
+            msg += "\nData: \n\t" + "\n\t".join(map(str, self.data_areas))
+        if self.meta_areas:
+            msg += "\nMeta: \n\t" + "\n\t".join(map(str, self.meta_areas))
+        return msg
+
+
+class RawLocN(Header):
+    struct = CStruct({
+        "offset": "Q",    # uint64_t  // Offset in bytes to start sector
+        "size": "Q",      # uint64_t  // Size in bytes
+        "checksum": "L",  # uint32_t  // Checksum of data
+        "flags": "L",     # uint32_t  // Flags
+    })
+
+    IGNORED = 0x00000001
+
+    @classmethod
+    def read_array(cls, fp: BinaryIO):
+        while True:
+            loc = cls.struct.read(fp)
+
+            if not loc or loc["offset"] == 0:
+                break
+
+            yield cls(loc)
+
+
+class MDAHeader(Header):
+    struct = CStruct({
+        "checksum": "L",  # uint32_t   // Checksum of data
+        "magic": "16s",   # int8_t[16] // Allows to scan for metadata
+        "version": "L",   # uint32_t
+        "start": "Q",     # uint64_t   // Absolute start byte of itself
+        "size":  "Q"      # uint64_t   // Size of metadata area
+    })
+    # followed by a null termiated list of type `RawLocN`
+
+    LOC_COMMITTED = 0
+    LOC_PRECOMMITTED = 1
+
+    HEADER_SIZE = MDA_HEADER_SIZE
+
+    def __init__(self, data, raw_locns):
+        super().__init__(data)
+        self.raw_locns = raw_locns
+
+    @property
+    def checksum(self):
+        return self.data["checksum"]
+
+    @property
+    def magic(self):
+        return self.data["magic"]
+
+    @property
+    def version(self):
+        return self.data["version"]
+
+    @property
+    def start(self):
+        return self.data["start"]
+
+    @property
+    def size(self):
+        return self.data["size"]
+
+    @classmethod
+    def read(cls, fp):
+        data = cls.struct.read(fp)
+        raw_locns = list(RawLocN.read_array(fp))
+        return cls(data, raw_locns)
+
+    def read_metadata(self, fp) -> "Metadata":
+        loc = self.raw_locns[self.LOC_COMMITTED]
+        offset = self.start + loc["offset"]
+        fp.seek(offset)
+        data = fp.read(loc["size"])
+        md = Metadata.decode(data)
+        return md
+
+    def write_metadata(self, fp, data: "Metadata"):
+        raw = data.encode()
+
+        loc = self.raw_locns[self.LOC_COMMITTED]
+        offset = self.start + loc["offset"]
+        fp.seek(offset)
+
+        n = fp.write(raw)
+        loc["size"] = n
+        loc["checksum"] = _calc_crc(raw)
+        self.write(fp)
+
+    def write(self, fp):
+        data = self.struct.pack(self.data)
+
+        fr = io.BytesIO()
+        fr.write(data)
+
+        for loc in self.raw_locns:
+            loc.write(fr)
+
+        l = fr.tell()
+        fr.write(b"\0" * (self.HEADER_SIZE - l))
+
+        raw = fr.getvalue()
+
+        cs = struct.Struct("<L")
+        checksum = _calc_crc(raw[cs.size:])
+        self.data["checksum"] = checksum
+        data = self.struct.pack(self.data)
+        fr.seek(0)
+        fr.write(data)
+
+        fp.seek(self.start)
+        n = fp.write(fr.getvalue())
+        return n
+
+    def __str__(self):
+        msg = super().__str__()
+        if self.raw_locns:
+            msg += "\n\t" + "\n\t".join(map(str, self.raw_locns))
+        return msg
+
+
+class Metadata:
+    def __init__(self, vg_name, data: OrderedDict) -> None:
+        self._vg_name = vg_name
+        self.data = data
+
+    @property
+    def vg_name(self) -> str:
+        return self._vg_name
+
+    @vg_name.setter
+    def vg_name(self, vg_name: str) -> None:
+        self.rename_vg(vg_name)
+
+    def rename_vg(self, new_name):
+        # Replace the corresponding key in the dict and
+        # ensure it is always the first key
+        name = self.vg_name
+        d = self.data[name]
+        del self.data[name]
+        self.data[new_name] = d
+        self.data.move_to_end(new_name, last=False)
+
+    @classmethod
+    def decode(cls, data: bytes) -> "Metadata":
+        data = data.decode("utf-8")
+        name, md = Metadata.decode_data(data)
+        return cls(name, md)
+
+    def encode(self) -> bytes:
+        data = Metadata.encode_data(self.data)
+        return data.encode("utf-8")
+
+    def __str__(self) -> str:
+        return json.dumps(self.data, indent=2)
+
+    @staticmethod
+    def decode_data(raw):
+        substitutions = {
+            r"#.*\n": "",
+            r"\[": "[ ",
+            r"\]": " ]",
+            r'"': ' " ',
+            r"[=,]": "",
+            r"\s+":  " ",
+            r"\0$": "",
+        }
+
+        data = raw
+        for pattern, repl in substitutions.items():
+            data = re.sub(pattern, repl, data)
+
+        data = data.split()
+
+        DICT_START = '{'
+        DICT_END = '}'
+        ARRAY_START = '['
+        ARRAY_END = ']'
+        STRING_START = '"'
+        STRING_END = '"'
+
+        def next_token():
+            if not data:
+                return None
+            return data.pop(0)
+
+        def parse_str(val):
+            result = ""
+
+            while val != STRING_END:
+                result = f"{result} {val}"
+                val = next_token()
+
+            return result.strip()
+
+        def parse_type(val):
+            # type = integer | float | string
+            # integer = [0-9]*
+            # float = [0-9]*'.'[0-9]*
+            # string = '"'.*'"'
+
+            if val == STRING_START:
+                return parse_str(next_token())
+            if "." in val:
+                return float(val)
+            return int(val)
+
+        def parse_array(val):
+            result = []
+
+            while val != ARRAY_END:
+                val = parse_type(val)
+                result.append(val)
+                val = next_token()
+
+            return result
+
+        def parse_section(val):
+            result = OrderedDict()
+
+            while val and val != DICT_END:
+                result[val] = parse_value()
+                val = next_token()
+
+            return result
+
+        def parse_value():
+            val = next_token()
+
+            if val == DICT_START:
+                return parse_section(next_token())
+            if val == ARRAY_START:
+                return parse_array(next_token())
+
+            return parse_type(val)
+
+        name = next_token()
+        obj = parse_section(name)
+
+        return name, obj
+
+    @staticmethod
+    def encode_data(data):
+
+        def encode_dict(d):
+            s = ""
+            for k, v in d.items():
+                s += k
+                if not isinstance(v, dict):
+                    s += " = "
+                else:
+                    s += " "
+                s += encode_val(v) + "\n"
+            return s
+
+        def encode_val(v):
+            if isinstance(v, int):
+                s = str(v)
+            elif isinstance(v, str):
+                s = f'"{v}"'
+            elif isinstance(v, list):
+                s = "[" + ", ".join(encode_val(x) for x in v) + "]"
+            elif isinstance(v, dict):
+                s = '{\n'
+                s += encode_dict(v)
+                s += '}\n'
+            return s
+
+        return encode_dict(data) + "\0"
+
+
+class Disk:
+    def __init__(self, fp, path: PathLike) -> None:
+        self.fp = fp
+        self.path = path
+
+        self.lbl_hdr = None
+        self.pv_hdr = None
+        self.ma_headers = []
+        self.metadata = None
+
+        try:
+            self._init_headers()
+        except:  # pylint: disable=broad-except
+            self.fp.close()
+            raise
+
+    def _init_headers(self):
+        fp = self.fp
+        lbl = LabelHeader.search(fp)
+
+        if not lbl:
+            raise RuntimeError("Could not find label header")
+
+        self.lbl_hdr = lbl
+        self.pv_hdr = lbl.read_pv_header(fp)
+
+        pv = self.pv_hdr
+
+        for ma in pv.meta_areas:
+            data = ma.read_data(self.fp)
+            hdr = MDAHeader.read(data)
+            self.ma_headers.append(hdr)
+
+        if not self.ma_headers:
+            raise RuntimeError("Could not find metadata header")
+
+        md = self.ma_headers[0].read_metadata(fp)
+        self.metadata = md
+
+    @classmethod
+    def open(cls, path: PathLike, *, read_only=False) -> None:
+        mode = "rb"
+        if not read_only:
+            mode += "+"
+
+        fp = open(path, mode)
+
+        return cls(fp, path)
+
+    def flush_metadata(self):
+        for ma in self.ma_headers:
+            ma.write_metadata(self.fp, self.metadata)
+
+    def rename_vg(self, new_name):
+        """Rename the volume group"""
+        self.metadata.rename_vg(new_name)
+
+    def set_description(self, desc: str) -> None:
+        """Set the description of in the metadata block"""
+        self.metadata.data["description"] = desc
+
+    def set_creation_time(self, t: int) -> None:
+        """Set the creation time of the volume group"""
+        self.metadata.data["creation_time"] = t
+
+    def set_creation_host(self, host: str) -> None:
+        """Set the host that created the volume group"""
+        self.metadata.data["creation_host"] = host
+
+    def dump(self):
+        print(self.path)
+        print(self.lbl_hdr)
+        print(self.pv_hdr)
+        print(self.metadata)
+
+    def __enter__(self):
+        assert self.fp, "Disk not open"
+        return self
+
+    def __exit__(self, *exc_details):
+        if self.fp:
+            self.fp.flush()
+            self.fp.close()
+            self.fp = None
+
+
+def main():
+
+    if len(sys.argv) != 2:
+        print(f"usage: {sys.argv[0]} DISK")
+        sys.exit(1)
+
+    with Disk.open(sys.argv[1]) as disk:
+        disk.dump()
+
+
+if __name__ == "__main__":
+    main()
diff --git a/schemas/osbuild2.json b/schemas/osbuild2.json
index 5261b751..4d66c1bc 100644
--- a/schemas/osbuild2.json
+++ b/schemas/osbuild2.json
@@ -29,6 +29,7 @@
       "required": ["type"],
       "properties": {
         "type": { "type": "string" },
+        "parent": { "type": "string" },
         "options": {
           "type": "object",
           "additionalProperties": true
diff --git a/stages/org.osbuild.lvm2.create b/stages/org.osbuild.lvm2.create
new file mode 100755
index 00000000..d705acfb
--- /dev/null
+++ b/stages/org.osbuild.lvm2.create
@@ -0,0 +1,96 @@
+#!/usr/bin/python3
+"""
+Create LVM2 physical volumes, volume groups and logical volumes
+
+For the logical volumes `name` and `size` need to be provided.
+
+NB: The name of the volume group is chosen at random and should
+be changed via the `org.osbuild.lvm2.metadata` stage after the
+image has been completely assembled.
+"""
+
+
+import os
+import subprocess
+import sys
+import uuid
+
+
+import osbuild.api
+
+
+SCHEMA_2 = r"""
+"devices": {
+  "type": "object",
+  "additionalProperties": true,
+  "required": ["device"],
+  "properties": {
+    "device": {
+      "type": "object",
+      "additionalProperties": true
+    }
+  }
+},
+"options": {
+  "additionalProperties": true,
+  "required": ["volumes"],
+  "properties": {
+    "volumes": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "description": "Logical volume",
+        "type": "object",
+        "required": ["name", "size"],
+        "properties": {
+          "name": {
+            "description": "The logical volume name",
+            "type": "string",
+            "pattern": "[a-zA-Z09+_.][a-zA-Z0-9+_.-]*"
+          },
+          "size": {
+            "description": "The size of the logical volume",
+            "type": "string"
+          }
+        }
+      }
+    }
+  }
+}
+"""
+
+
+def main(devices, options):
+    device = devices["device"]
+    volumes = options["volumes"]
+    path = os.path.join("/dev", device["path"])
+
+    vg_name = str(uuid.uuid4())
+
+    print(f"LVM2: using vg name '{vg_name}'")
+
+    subprocess.run(["pvcreate", path],
+                   encoding='utf-8',
+                   check=True)
+
+    subprocess.run(["vgcreate", vg_name, path],
+                   encoding='utf-8',
+                   check=True)
+
+    for volume in volumes:
+        name = volume["name"]
+        size = volume.get("size")
+        cmd = ["lvcreate", "-an"]
+
+        if size:
+            cmd += ["-l", size]
+
+        cmd += ["-n", name, vg_name]
+
+        subprocess.run(cmd, encoding='utf-8', check=True)
+
+
+if __name__ == '__main__':
+    args = osbuild.api.arguments()
+    ret = main(args["devices"], args["options"])
+    sys.exit(ret)
diff --git a/stages/org.osbuild.lvm2.metadata b/stages/org.osbuild.lvm2.metadata
new file mode 100755
index 00000000..f347a06c
--- /dev/null
+++ b/stages/org.osbuild.lvm2.metadata
@@ -0,0 +1,84 @@
+#!/usr/bin/python3
+"""
+Set LVM2 volume group metadata
+
+This stage allows you to modify the LVM2 volume group
+metadata. This data describes various properties about
+the volume group, physical volume and logical volumes.
+Most importantly it contains the volume group name, so
+this stage can be used to rename the volume group.
+"""
+
+
+import os
+import sys
+
+import osbuild.api
+import osbuild.util.lvm2 as lvm2
+
+SCHEMA_2 = r"""
+"devices": {
+  "type": "object",
+  "additionalProperties": true,
+  "required": ["device"],
+  "properties": {
+    "device": {
+      "type": "object",
+      "additionalProperties": true
+    }
+  }
+},
+"options": {
+  "additionalProperties": true,
+  "required": ["vg_name"],
+  "properties": {
+    "creation_host": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 255
+    },
+    "creation_time": {
+      "type": "string",
+      "pattern": "[0-9]+",
+      "description": "Creation time (uint64 represented as string)"
+    },
+    "description": {
+      "type": "string",
+      "minLength": 1
+    },
+    "vg_name": {
+      "type": "string",
+      "pattern": "[a-zA-Z09+_.][a-zA-Z0-9+_.-]*"
+    }
+  }
+}
+"""
+
+
+def main(devices, options):
+    device = devices["device"]
+    path = os.path.join("/dev", device["path"])
+
+    vg_name = options["vg_name"]
+    creation_host = options.get("creation_host")
+    creation_time = options.get("creation_time")
+    description = options.get("description")
+
+    with lvm2.Disk.open(path) as disk:
+        disk.rename_vg(vg_name)
+
+        if creation_host:
+            disk.set_creation_host(creation_host)
+        if creation_time is not None:
+            ct = int(creation_time)
+            disk.set_creation_time(ct)
+        if description:
+            disk.set_description(description)
+
+        disk.flush_metadata()
+
+
+if __name__ == '__main__':
+    args = osbuild.api.arguments()
+    ret = main(args["devices"], args["options"])
+    sys.exit(ret)


Test patch:
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 9e6cc732..679b2e99 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -26,7 +26,7 @@ jobs:
     - name: "Run Tests"
       uses: osbuild/containers/src/actions/privdocker@e4de123f43b95e99dfe8eed0bd5a1cd58db50715
       with:
-        image: ghcr.io/osbuild/osbuild-ci:latest-202106231345
+        image: ghcr.io/osbuild/osbuild-ci:latest-202107281400
         run: |
           python3 -m pytest \
             --pyargs "${{ matrix.test }}" \
diff --git a/test/data/manifests/el8-ostree-bootiso.json b/test/data/manifests/el8-ostree-bootiso.json
new file mode 100644
index 00000000..e69de29b
diff --git a/test/data/manifests/f34-build-v2.json b/test/data/manifests/f34-build-v2.json
index f7f51d24..3e91372a 100644
--- a/test/data/manifests/f34-build-v2.json
+++ b/test/data/manifests/f34-build-v2.json
@@ -20,6 +20,7 @@
                 "sha256:96b69aefaddfebbac3f9b6361b01cc71196e604a56fd9a6236317e63fb68664a": {},
                 "sha256:9a698a5991a08e23e87b4bce2f3e447eafdc7fd4d84a49d91c65c6045ead1e8e": {},
                 "sha256:bc66918c24175415a0f65803bccbb3d796d733acd319577a2417371a178ce193": {},
+                "sha256:d23395e2614654c4cb717ec29cba2e61beec36bf815e74729ada20be41633caa": {},
                 "sha256:775b1498ba72e9d05a1c131fdbc2f4aabb8fd00d9c7c13ab996154e99660f92b": {},
                 "sha256:29cf7e97d6476fcfe80088a4c9cbc113d9b73e37dc9ec34967a958cef2d04e0c": {},
                 "sha256:9bff70d51ecec129854ef62d82204db3e01706c444b966cb048bc7fd8ec8b524": {},
@@ -36,7 +37,10 @@
                 "sha256:b2ffc9785842ccc76ca187d8b922fb3b91da2257341fb115ed6bdbfedb24c1eb": {},
                 "sha256:f8b418b88b30d28c911d26f6f0b9c1ede8be00fa71d28c789328dfd7c58eea67": {},
                 "sha256:5fb88eb681e996ab2199251a68c79b2797fa03d31a36dae698de393b85e1f89e": {},
+                "sha256:a657bd57bcdee99766d2076ec3b751f96670794c3dc10e20b94f917be4018281": {},
+                "sha256:7f1001c3e61932f826b3c7f87bf20efe79cd9a797f3598613c10cd1e6a49961c": {},
                 "sha256:f5f5c988604aa5c870eee7efff6d40f26acb908cf82991d762ade18c8b46aff6": {},
+                "sha256:2ad21916943c245819c1586f2841673c35f73c38bc0bbfa24e7c4f3892d73d28": {},
                 "sha256:c58752e2529cf0ea4aabb0476ef53ca7748091aa936513affc1245928ae5b1b8": {},
                 "sha256:be09e345d175a5dd6535a69db12429072ddc453874792b75446370fc4eb196a1": {},
                 "sha256:d8aa8d1e0db5f32658af8c236f06853421e4bd4618f86c9e05e121b9b805b0dc": {},
@@ -194,6 +198,8 @@
                 "sha256:5ed9093c6368733f9aecfe56b029246929047c1de33ca035fbcd0c210bae4051": {},
                 "sha256:b14d332c9d9fd66afeb9c3064db3955b7667f4cf3e85d7f76439eeba63fff488": {},
                 "sha256:1a2aaf60c22453df0c306a5618aca20a2ce19090525445037a667f468b8ceaab": {},
+                "sha256:6b215bdf0227e676436a3056969d68acbd329ee3fcccb46873fee31d6f1bafe8": {},
+                "sha256:b4c0a61643aa825845887cf39f780fa2862f629f980c095704c059b5418dba20": {},
                 "sha256:da676955f475492f17c573bc526d47c37e34919d2a6ed33ec4573a4de0cab2a7": {},
                 "sha256:ba2916d48b3a28e9bc2c9fbde19770c204b6ad4cdc94471c3c6bdbfbe8669461": {},
                 "sha256:0214ae16ef6a92843a4973aeda93db85584ad7840b1dd6e225bc57b594f58961": {},
@@ -322,6 +328,16 @@
               "docs": true
             }
           }
+        },
+        {
+          "type": "org.osbuild.selinux",
+          "options": {
+            "file_contexts": "etc/selinux/targeted/contexts/files/file_contexts",
+            "labels": {
+              "/usr/bin/cp": "system_u:object_r:install_exec_t:s0",
+              "/usr/bin/tar": "system_u:object_r:install_exec_t:s0"
+            }
+          }
         }
       ]
     }
@@ -338,6 +354,7 @@
         "sha256:96b69aefaddfebbac3f9b6361b01cc71196e604a56fd9a6236317e63fb68664a": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/b/bubblewrap-0.4.1-3.fc34.x86_64.rpm",
         "sha256:9a698a5991a08e23e87b4bce2f3e447eafdc7fd4d84a49d91c65c6045ead1e8e": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/b/bzip2-libs-1.0.8-6.fc34.x86_64.rpm",
         "sha256:bc66918c24175415a0f65803bccbb3d796d733acd319577a2417371a178ce193": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/ca-certificates-2020.2.41-7.fc34.noarch.rpm",
+        "sha256:d23395e2614654c4cb717ec29cba2e61beec36bf815e74729ada20be41633caa": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/compat-readline5-5.2-39.fc34.x86_64.rpm",
         "sha256:775b1498ba72e9d05a1c131fdbc2f4aabb8fd00d9c7c13ab996154e99660f92b": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/coreutils-8.32-21.fc34.x86_64.rpm",
         "sha256:29cf7e97d6476fcfe80088a4c9cbc113d9b73e37dc9ec34967a958cef2d04e0c": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/coreutils-common-8.32-21.fc34.x86_64.rpm",
         "sha256:9bff70d51ecec129854ef62d82204db3e01706c444b966cb048bc7fd8ec8b524": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/cpio-2.13-10.fc34.x86_64.rpm",
@@ -354,7 +371,10 @@
         "sha256:b2ffc9785842ccc76ca187d8b922fb3b91da2257341fb115ed6bdbfedb24c1eb": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dbus-libs-1.12.20-3.fc34.x86_64.rpm",
         "sha256:f8b418b88b30d28c911d26f6f0b9c1ede8be00fa71d28c789328dfd7c58eea67": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/deltarpm-3.6.2-8.fc34.x86_64.rpm",
         "sha256:5fb88eb681e996ab2199251a68c79b2797fa03d31a36dae698de393b85e1f89e": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:a657bd57bcdee99766d2076ec3b751f96670794c3dc10e20b94f917be4018281": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-event-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:7f1001c3e61932f826b3c7f87bf20efe79cd9a797f3598613c10cd1e6a49961c": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-event-libs-1.02.175-1.fc34.x86_64.rpm",
         "sha256:f5f5c988604aa5c870eee7efff6d40f26acb908cf82991d762ade18c8b46aff6": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-libs-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:2ad21916943c245819c1586f2841673c35f73c38bc0bbfa24e7c4f3892d73d28": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-persistent-data-0.9.0-3.fc34.x86_64.rpm",
         "sha256:c58752e2529cf0ea4aabb0476ef53ca7748091aa936513affc1245928ae5b1b8": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/diffutils-3.7-8.fc34.x86_64.rpm",
         "sha256:be09e345d175a5dd6535a69db12429072ddc453874792b75446370fc4eb196a1": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dnf-4.6.1-1.fc34.noarch.rpm",
         "sha256:d8aa8d1e0db5f32658af8c236f06853421e4bd4618f86c9e05e121b9b805b0dc": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dnf-data-4.6.1-1.fc34.noarch.rpm",
@@ -512,6 +532,8 @@
         "sha256:5ed9093c6368733f9aecfe56b029246929047c1de33ca035fbcd0c210bae4051": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lorax-34.9-5.fc34.x86_64.rpm",
         "sha256:b14d332c9d9fd66afeb9c3064db3955b7667f4cf3e85d7f76439eeba63fff488": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lorax-templates-generic-34.9-5.fc34.x86_64.rpm",
         "sha256:1a2aaf60c22453df0c306a5618aca20a2ce19090525445037a667f468b8ceaab": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lua-libs-5.4.2-2.fc34.x86_64.rpm",
+        "sha256:6b215bdf0227e676436a3056969d68acbd329ee3fcccb46873fee31d6f1bafe8": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lvm2-2.03.11-1.fc34.x86_64.rpm",
+        "sha256:b4c0a61643aa825845887cf39f780fa2862f629f980c095704c059b5418dba20": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lvm2-libs-2.03.11-1.fc34.x86_64.rpm",
         "sha256:da676955f475492f17c573bc526d47c37e34919d2a6ed33ec4573a4de0cab2a7": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lz4-libs-1.9.3-2.fc34.x86_64.rpm",
         "sha256:ba2916d48b3a28e9bc2c9fbde19770c204b6ad4cdc94471c3c6bdbfbe8669461": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lzo-2.10-4.fc34.x86_64.rpm",
         "sha256:0214ae16ef6a92843a4973aeda93db85584ad7840b1dd6e225bc57b594f58961": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/m/memstrack-0.2.2-1.fc34.x86_64.rpm",
diff --git a/test/data/manifests/f34-build-v2.mpp.json b/test/data/manifests/f34-build-v2.mpp.json
index 5aff9145..8d9ed8ba 100644
--- a/test/data/manifests/f34-build-v2.mpp.json
+++ b/test/data/manifests/f34-build-v2.mpp.json
@@ -33,7 +33,7 @@
                   "tar",
                   "xfsprogs",
                   "xz",
-
+                  "lvm2",
                   "selinux-policy-targeted",
                   "genisoimage",
                   "isomd5sum",
@@ -66,6 +66,16 @@
               "docs": true
             }
           }
+        },
+        {
+          "type": "org.osbuild.selinux",
+          "options": {
+            "file_contexts": "etc/selinux/targeted/contexts/files/file_contexts",
+            "labels": {
+              "/usr/bin/cp": "system_u:object_r:install_exec_t:s0",
+              "/usr/bin/tar": "system_u:object_r:install_exec_t:s0"
+            }
+          }
         }
       ]
     }
diff --git a/test/data/manifests/fedora-container.json b/test/data/manifests/fedora-container.json
index d3060224..2c5e1a53 100644
--- a/test/data/manifests/fedora-container.json
+++ b/test/data/manifests/fedora-container.json
@@ -21,6 +21,7 @@
                 "sha256:96b69aefaddfebbac3f9b6361b01cc71196e604a56fd9a6236317e63fb68664a": {},
                 "sha256:9a698a5991a08e23e87b4bce2f3e447eafdc7fd4d84a49d91c65c6045ead1e8e": {},
                 "sha256:bc66918c24175415a0f65803bccbb3d796d733acd319577a2417371a178ce193": {},
+                "sha256:d23395e2614654c4cb717ec29cba2e61beec36bf815e74729ada20be41633caa": {},
                 "sha256:775b1498ba72e9d05a1c131fdbc2f4aabb8fd00d9c7c13ab996154e99660f92b": {},
                 "sha256:29cf7e97d6476fcfe80088a4c9cbc113d9b73e37dc9ec34967a958cef2d04e0c": {},
                 "sha256:9bff70d51ecec129854ef62d82204db3e01706c444b966cb048bc7fd8ec8b524": {},
@@ -37,7 +38,10 @@
                 "sha256:b2ffc9785842ccc76ca187d8b922fb3b91da2257341fb115ed6bdbfedb24c1eb": {},
                 "sha256:f8b418b88b30d28c911d26f6f0b9c1ede8be00fa71d28c789328dfd7c58eea67": {},
                 "sha256:5fb88eb681e996ab2199251a68c79b2797fa03d31a36dae698de393b85e1f89e": {},
+                "sha256:a657bd57bcdee99766d2076ec3b751f96670794c3dc10e20b94f917be4018281": {},
+                "sha256:7f1001c3e61932f826b3c7f87bf20efe79cd9a797f3598613c10cd1e6a49961c": {},
                 "sha256:f5f5c988604aa5c870eee7efff6d40f26acb908cf82991d762ade18c8b46aff6": {},
+                "sha256:2ad21916943c245819c1586f2841673c35f73c38bc0bbfa24e7c4f3892d73d28": {},
                 "sha256:c58752e2529cf0ea4aabb0476ef53ca7748091aa936513affc1245928ae5b1b8": {},
                 "sha256:be09e345d175a5dd6535a69db12429072ddc453874792b75446370fc4eb196a1": {},
                 "sha256:d8aa8d1e0db5f32658af8c236f06853421e4bd4618f86c9e05e121b9b805b0dc": {},
@@ -195,6 +199,8 @@
                 "sha256:5ed9093c6368733f9aecfe56b029246929047c1de33ca035fbcd0c210bae4051": {},
                 "sha256:b14d332c9d9fd66afeb9c3064db3955b7667f4cf3e85d7f76439eeba63fff488": {},
                 "sha256:1a2aaf60c22453df0c306a5618aca20a2ce19090525445037a667f468b8ceaab": {},
+                "sha256:6b215bdf0227e676436a3056969d68acbd329ee3fcccb46873fee31d6f1bafe8": {},
+                "sha256:b4c0a61643aa825845887cf39f780fa2862f629f980c095704c059b5418dba20": {},
                 "sha256:da676955f475492f17c573bc526d47c37e34919d2a6ed33ec4573a4de0cab2a7": {},
                 "sha256:ba2916d48b3a28e9bc2c9fbde19770c204b6ad4cdc94471c3c6bdbfbe8669461": {},
                 "sha256:0214ae16ef6a92843a4973aeda93db85584ad7840b1dd6e225bc57b594f58961": {},
@@ -323,6 +329,16 @@
               "docs": true
             }
           }
+        },
+        {
+          "type": "org.osbuild.selinux",
+          "options": {
+            "file_contexts": "etc/selinux/targeted/contexts/files/file_contexts",
+            "labels": {
+              "/usr/bin/cp": "system_u:object_r:install_exec_t:s0",
+              "/usr/bin/tar": "system_u:object_r:install_exec_t:s0"
+            }
+          }
         }
       ]
     },
@@ -577,6 +593,7 @@
         "sha256:96b69aefaddfebbac3f9b6361b01cc71196e604a56fd9a6236317e63fb68664a": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/b/bubblewrap-0.4.1-3.fc34.x86_64.rpm",
         "sha256:9a698a5991a08e23e87b4bce2f3e447eafdc7fd4d84a49d91c65c6045ead1e8e": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/b/bzip2-libs-1.0.8-6.fc34.x86_64.rpm",
         "sha256:bc66918c24175415a0f65803bccbb3d796d733acd319577a2417371a178ce193": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/ca-certificates-2020.2.41-7.fc34.noarch.rpm",
+        "sha256:d23395e2614654c4cb717ec29cba2e61beec36bf815e74729ada20be41633caa": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/compat-readline5-5.2-39.fc34.x86_64.rpm",
         "sha256:775b1498ba72e9d05a1c131fdbc2f4aabb8fd00d9c7c13ab996154e99660f92b": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/coreutils-8.32-21.fc34.x86_64.rpm",
         "sha256:29cf7e97d6476fcfe80088a4c9cbc113d9b73e37dc9ec34967a958cef2d04e0c": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/coreutils-common-8.32-21.fc34.x86_64.rpm",
         "sha256:9bff70d51ecec129854ef62d82204db3e01706c444b966cb048bc7fd8ec8b524": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/cpio-2.13-10.fc34.x86_64.rpm",
@@ -593,7 +610,10 @@
         "sha256:b2ffc9785842ccc76ca187d8b922fb3b91da2257341fb115ed6bdbfedb24c1eb": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dbus-libs-1.12.20-3.fc34.x86_64.rpm",
         "sha256:f8b418b88b30d28c911d26f6f0b9c1ede8be00fa71d28c789328dfd7c58eea67": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/deltarpm-3.6.2-8.fc34.x86_64.rpm",
         "sha256:5fb88eb681e996ab2199251a68c79b2797fa03d31a36dae698de393b85e1f89e": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:a657bd57bcdee99766d2076ec3b751f96670794c3dc10e20b94f917be4018281": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-event-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:7f1001c3e61932f826b3c7f87bf20efe79cd9a797f3598613c10cd1e6a49961c": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-event-libs-1.02.175-1.fc34.x86_64.rpm",
         "sha256:f5f5c988604aa5c870eee7efff6d40f26acb908cf82991d762ade18c8b46aff6": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-libs-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:2ad21916943c245819c1586f2841673c35f73c38bc0bbfa24e7c4f3892d73d28": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-persistent-data-0.9.0-3.fc34.x86_64.rpm",
         "sha256:c58752e2529cf0ea4aabb0476ef53ca7748091aa936513affc1245928ae5b1b8": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/diffutils-3.7-8.fc34.x86_64.rpm",
         "sha256:be09e345d175a5dd6535a69db12429072ddc453874792b75446370fc4eb196a1": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dnf-4.6.1-1.fc34.noarch.rpm",
         "sha256:d8aa8d1e0db5f32658af8c236f06853421e4bd4618f86c9e05e121b9b805b0dc": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dnf-data-4.6.1-1.fc34.noarch.rpm",
@@ -764,6 +784,8 @@
         "sha256:5ed9093c6368733f9aecfe56b029246929047c1de33ca035fbcd0c210bae4051": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lorax-34.9-5.fc34.x86_64.rpm",
         "sha256:b14d332c9d9fd66afeb9c3064db3955b7667f4cf3e85d7f76439eeba63fff488": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lorax-templates-generic-34.9-5.fc34.x86_64.rpm",
         "sha256:1a2aaf60c22453df0c306a5618aca20a2ce19090525445037a667f468b8ceaab": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lua-libs-5.4.2-2.fc34.x86_64.rpm",
+        "sha256:6b215bdf0227e676436a3056969d68acbd329ee3fcccb46873fee31d6f1bafe8": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lvm2-2.03.11-1.fc34.x86_64.rpm",
+        "sha256:b4c0a61643aa825845887cf39f780fa2862f629f980c095704c059b5418dba20": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lvm2-libs-2.03.11-1.fc34.x86_64.rpm",
         "sha256:da676955f475492f17c573bc526d47c37e34919d2a6ed33ec4573a4de0cab2a7": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lz4-libs-1.9.3-2.fc34.x86_64.rpm",
         "sha256:ba2916d48b3a28e9bc2c9fbde19770c204b6ad4cdc94471c3c6bdbfbe8669461": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lzo-2.10-4.fc34.x86_64.rpm",
         "sha256:0214ae16ef6a92843a4973aeda93db85584ad7840b1dd6e225bc57b594f58961": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/m/memstrack-0.2.2-1.fc34.x86_64.rpm",
diff --git a/test/data/manifests/fedora-ostree-bootiso.json b/test/data/manifests/fedora-ostree-bootiso.json
index 3df7747a..92289ac0 100644
--- a/test/data/manifests/fedora-ostree-bootiso.json
+++ b/test/data/manifests/fedora-ostree-bootiso.json
@@ -21,6 +21,7 @@
                 "sha256:96b69aefaddfebbac3f9b6361b01cc71196e604a56fd9a6236317e63fb68664a": {},
                 "sha256:9a698a5991a08e23e87b4bce2f3e447eafdc7fd4d84a49d91c65c6045ead1e8e": {},
                 "sha256:bc66918c24175415a0f65803bccbb3d796d733acd319577a2417371a178ce193": {},
+                "sha256:d23395e2614654c4cb717ec29cba2e61beec36bf815e74729ada20be41633caa": {},
                 "sha256:775b1498ba72e9d05a1c131fdbc2f4aabb8fd00d9c7c13ab996154e99660f92b": {},
                 "sha256:29cf7e97d6476fcfe80088a4c9cbc113d9b73e37dc9ec34967a958cef2d04e0c": {},
                 "sha256:9bff70d51ecec129854ef62d82204db3e01706c444b966cb048bc7fd8ec8b524": {},
@@ -37,7 +38,10 @@
                 "sha256:b2ffc9785842ccc76ca187d8b922fb3b91da2257341fb115ed6bdbfedb24c1eb": {},
                 "sha256:f8b418b88b30d28c911d26f6f0b9c1ede8be00fa71d28c789328dfd7c58eea67": {},
                 "sha256:5fb88eb681e996ab2199251a68c79b2797fa03d31a36dae698de393b85e1f89e": {},
+                "sha256:a657bd57bcdee99766d2076ec3b751f96670794c3dc10e20b94f917be4018281": {},
+                "sha256:7f1001c3e61932f826b3c7f87bf20efe79cd9a797f3598613c10cd1e6a49961c": {},
                 "sha256:f5f5c988604aa5c870eee7efff6d40f26acb908cf82991d762ade18c8b46aff6": {},
+                "sha256:2ad21916943c245819c1586f2841673c35f73c38bc0bbfa24e7c4f3892d73d28": {},
                 "sha256:c58752e2529cf0ea4aabb0476ef53ca7748091aa936513affc1245928ae5b1b8": {},
                 "sha256:be09e345d175a5dd6535a69db12429072ddc453874792b75446370fc4eb196a1": {},
                 "sha256:d8aa8d1e0db5f32658af8c236f06853421e4bd4618f86c9e05e121b9b805b0dc": {},
@@ -195,6 +199,8 @@
                 "sha256:5ed9093c6368733f9aecfe56b029246929047c1de33ca035fbcd0c210bae4051": {},
                 "sha256:b14d332c9d9fd66afeb9c3064db3955b7667f4cf3e85d7f76439eeba63fff488": {},
                 "sha256:1a2aaf60c22453df0c306a5618aca20a2ce19090525445037a667f468b8ceaab": {},
+                "sha256:6b215bdf0227e676436a3056969d68acbd329ee3fcccb46873fee31d6f1bafe8": {},
+                "sha256:b4c0a61643aa825845887cf39f780fa2862f629f980c095704c059b5418dba20": {},
                 "sha256:da676955f475492f17c573bc526d47c37e34919d2a6ed33ec4573a4de0cab2a7": {},
                 "sha256:ba2916d48b3a28e9bc2c9fbde19770c204b6ad4cdc94471c3c6bdbfbe8669461": {},
                 "sha256:0214ae16ef6a92843a4973aeda93db85584ad7840b1dd6e225bc57b594f58961": {},
@@ -323,6 +329,16 @@
               "docs": true
             }
           }
+        },
+        {
+          "type": "org.osbuild.selinux",
+          "options": {
+            "file_contexts": "etc/selinux/targeted/contexts/files/file_contexts",
+            "labels": {
+              "/usr/bin/cp": "system_u:object_r:install_exec_t:s0",
+              "/usr/bin/tar": "system_u:object_r:install_exec_t:s0"
+            }
+          }
         }
       ]
     },
diff --git a/test/data/manifests/fedora-ostree-container.json b/test/data/manifests/fedora-ostree-container.json
index 39d2535b..db179437 100644
--- a/test/data/manifests/fedora-ostree-container.json
+++ b/test/data/manifests/fedora-ostree-container.json
@@ -21,6 +21,7 @@
                 "sha256:96b69aefaddfebbac3f9b6361b01cc71196e604a56fd9a6236317e63fb68664a": {},
                 "sha256:9a698a5991a08e23e87b4bce2f3e447eafdc7fd4d84a49d91c65c6045ead1e8e": {},
                 "sha256:bc66918c24175415a0f65803bccbb3d796d733acd319577a2417371a178ce193": {},
+                "sha256:d23395e2614654c4cb717ec29cba2e61beec36bf815e74729ada20be41633caa": {},
                 "sha256:775b1498ba72e9d05a1c131fdbc2f4aabb8fd00d9c7c13ab996154e99660f92b": {},
                 "sha256:29cf7e97d6476fcfe80088a4c9cbc113d9b73e37dc9ec34967a958cef2d04e0c": {},
                 "sha256:9bff70d51ecec129854ef62d82204db3e01706c444b966cb048bc7fd8ec8b524": {},
@@ -37,7 +38,10 @@
                 "sha256:b2ffc9785842ccc76ca187d8b922fb3b91da2257341fb115ed6bdbfedb24c1eb": {},
                 "sha256:f8b418b88b30d28c911d26f6f0b9c1ede8be00fa71d28c789328dfd7c58eea67": {},
                 "sha256:5fb88eb681e996ab2199251a68c79b2797fa03d31a36dae698de393b85e1f89e": {},
+                "sha256:a657bd57bcdee99766d2076ec3b751f96670794c3dc10e20b94f917be4018281": {},
+                "sha256:7f1001c3e61932f826b3c7f87bf20efe79cd9a797f3598613c10cd1e6a49961c": {},
                 "sha256:f5f5c988604aa5c870eee7efff6d40f26acb908cf82991d762ade18c8b46aff6": {},
+                "sha256:2ad21916943c245819c1586f2841673c35f73c38bc0bbfa24e7c4f3892d73d28": {},
                 "sha256:c58752e2529cf0ea4aabb0476ef53ca7748091aa936513affc1245928ae5b1b8": {},
                 "sha256:be09e345d175a5dd6535a69db12429072ddc453874792b75446370fc4eb196a1": {},
                 "sha256:d8aa8d1e0db5f32658af8c236f06853421e4bd4618f86c9e05e121b9b805b0dc": {},
@@ -195,6 +199,8 @@
                 "sha256:5ed9093c6368733f9aecfe56b029246929047c1de33ca035fbcd0c210bae4051": {},
                 "sha256:b14d332c9d9fd66afeb9c3064db3955b7667f4cf3e85d7f76439eeba63fff488": {},
                 "sha256:1a2aaf60c22453df0c306a5618aca20a2ce19090525445037a667f468b8ceaab": {},
+                "sha256:6b215bdf0227e676436a3056969d68acbd329ee3fcccb46873fee31d6f1bafe8": {},
+                "sha256:b4c0a61643aa825845887cf39f780fa2862f629f980c095704c059b5418dba20": {},
                 "sha256:da676955f475492f17c573bc526d47c37e34919d2a6ed33ec4573a4de0cab2a7": {},
                 "sha256:ba2916d48b3a28e9bc2c9fbde19770c204b6ad4cdc94471c3c6bdbfbe8669461": {},
                 "sha256:0214ae16ef6a92843a4973aeda93db85584ad7840b1dd6e225bc57b594f58961": {},
@@ -323,6 +329,16 @@
               "docs": true
             }
           }
+        },
+        {
+          "type": "org.osbuild.selinux",
+          "options": {
+            "file_contexts": "etc/selinux/targeted/contexts/files/file_contexts",
+            "labels": {
+              "/usr/bin/cp": "system_u:object_r:install_exec_t:s0",
+              "/usr/bin/tar": "system_u:object_r:install_exec_t:s0"
+            }
+          }
         }
       ]
     },
@@ -1079,6 +1095,7 @@
         "sha256:d8c5c2d285731623ddd2d6cfd9cccbd5609a7adc664e869f0c9f3b34a14eb799": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/chrony-4.0-3.fc34.x86_64.rpm",
         "sha256:e7d1d0b85ac49d8b0c9dd3fce4613e6229ac8720cfb74c80a496b9f0beaa7a22": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/cloud-init-20.4-2.fc34.noarch.rpm",
         "sha256:6d1b95e06ec98f6d65c64e18fec693d379b98128a3e94b4dec8929321354c549": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/cloud-utils-growpart-0.31-8.fc34.noarch.rpm",
+        "sha256:d23395e2614654c4cb717ec29cba2e61beec36bf815e74729ada20be41633caa": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/compat-readline5-5.2-39.fc34.x86_64.rpm",
         "sha256:1877af369228dd661ae1adfc43bbb8d53d3464d59ead0f5bcf6c2be88f8e8685": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/console-login-helper-messages-0.21.2-1.fc34.noarch.rpm",
         "sha256:3f7bde703045c2651fbd4142131ea1e303a565269388a08e2312af0eb83307a4": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/console-login-helper-messages-issuegen-0.21.2-1.fc34.noarch.rpm",
         "sha256:d2bac91a1969f555ea2641b161bb23fa0aaaffaba3284d9973ad696594b73f18": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/console-login-helper-messages-motdgen-0.21.2-1.fc34.noarch.rpm",
@@ -1100,7 +1117,10 @@
         "sha256:79834af7f95c0d1e5dcf85b794819bd854197a52d2966594abdb3c3de0fcceb6": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dejavu-sans-fonts-2.37-16.fc34.noarch.rpm",
         "sha256:f8b418b88b30d28c911d26f6f0b9c1ede8be00fa71d28c789328dfd7c58eea67": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/deltarpm-3.6.2-8.fc34.x86_64.rpm",
         "sha256:5fb88eb681e996ab2199251a68c79b2797fa03d31a36dae698de393b85e1f89e": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:a657bd57bcdee99766d2076ec3b751f96670794c3dc10e20b94f917be4018281": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-event-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:7f1001c3e61932f826b3c7f87bf20efe79cd9a797f3598613c10cd1e6a49961c": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-event-libs-1.02.175-1.fc34.x86_64.rpm",
         "sha256:f5f5c988604aa5c870eee7efff6d40f26acb908cf82991d762ade18c8b46aff6": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-libs-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:2ad21916943c245819c1586f2841673c35f73c38bc0bbfa24e7c4f3892d73d28": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-persistent-data-0.9.0-3.fc34.x86_64.rpm",
         "sha256:6152b13257229177f6cb4782ac67858a210e39a493a66290ce5bd768613cf556": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dhcp-client-4.4.2-9.b1.fc34.x86_64.rpm",
         "sha256:b73df4f459abe3cbdae9c9385d0cf612baddd0b09262ef9ec90a8cf84f80f2be": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dhcp-common-4.4.2-9.b1.fc34.noarch.rpm",
         "sha256:c58752e2529cf0ea4aabb0476ef53ca7748091aa936513affc1245928ae5b1b8": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/diffutils-3.7-8.fc34.x86_64.rpm",
@@ -1324,6 +1344,8 @@
         "sha256:5ed9093c6368733f9aecfe56b029246929047c1de33ca035fbcd0c210bae4051": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lorax-34.9-5.fc34.x86_64.rpm",
         "sha256:b14d332c9d9fd66afeb9c3064db3955b7667f4cf3e85d7f76439eeba63fff488": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lorax-templates-generic-34.9-5.fc34.x86_64.rpm",
         "sha256:1a2aaf60c22453df0c306a5618aca20a2ce19090525445037a667f468b8ceaab": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lua-libs-5.4.2-2.fc34.x86_64.rpm",
+        "sha256:6b215bdf0227e676436a3056969d68acbd329ee3fcccb46873fee31d6f1bafe8": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lvm2-2.03.11-1.fc34.x86_64.rpm",
+        "sha256:b4c0a61643aa825845887cf39f780fa2862f629f980c095704c059b5418dba20": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lvm2-libs-2.03.11-1.fc34.x86_64.rpm",
         "sha256:da676955f475492f17c573bc526d47c37e34919d2a6ed33ec4573a4de0cab2a7": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lz4-libs-1.9.3-2.fc34.x86_64.rpm",
         "sha256:ba2916d48b3a28e9bc2c9fbde19770c204b6ad4cdc94471c3c6bdbfbe8669461": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lzo-2.10-4.fc34.x86_64.rpm",
         "sha256:bfe045051bae36dd7032e361120d311e73c0caf3e014c605ecadafa9e2d0d20e": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/m/mailcap-2.1.49-3.fc34.noarch.rpm",
diff --git a/test/data/manifests/fedora-ostree-image.json b/test/data/manifests/fedora-ostree-image.json
index 18c9e20b..2da4b2db 100644
--- a/test/data/manifests/fedora-ostree-image.json
+++ b/test/data/manifests/fedora-ostree-image.json
@@ -21,6 +21,7 @@
                 "sha256:96b69aefaddfebbac3f9b6361b01cc71196e604a56fd9a6236317e63fb68664a": {},
                 "sha256:9a698a5991a08e23e87b4bce2f3e447eafdc7fd4d84a49d91c65c6045ead1e8e": {},
                 "sha256:bc66918c24175415a0f65803bccbb3d796d733acd319577a2417371a178ce193": {},
+                "sha256:d23395e2614654c4cb717ec29cba2e61beec36bf815e74729ada20be41633caa": {},
                 "sha256:775b1498ba72e9d05a1c131fdbc2f4aabb8fd00d9c7c13ab996154e99660f92b": {},
                 "sha256:29cf7e97d6476fcfe80088a4c9cbc113d9b73e37dc9ec34967a958cef2d04e0c": {},
                 "sha256:9bff70d51ecec129854ef62d82204db3e01706c444b966cb048bc7fd8ec8b524": {},
@@ -37,7 +38,10 @@
                 "sha256:b2ffc9785842ccc76ca187d8b922fb3b91da2257341fb115ed6bdbfedb24c1eb": {},
                 "sha256:f8b418b88b30d28c911d26f6f0b9c1ede8be00fa71d28c789328dfd7c58eea67": {},
                 "sha256:5fb88eb681e996ab2199251a68c79b2797fa03d31a36dae698de393b85e1f89e": {},
+                "sha256:a657bd57bcdee99766d2076ec3b751f96670794c3dc10e20b94f917be4018281": {},
+                "sha256:7f1001c3e61932f826b3c7f87bf20efe79cd9a797f3598613c10cd1e6a49961c": {},
                 "sha256:f5f5c988604aa5c870eee7efff6d40f26acb908cf82991d762ade18c8b46aff6": {},
+                "sha256:2ad21916943c245819c1586f2841673c35f73c38bc0bbfa24e7c4f3892d73d28": {},
                 "sha256:c58752e2529cf0ea4aabb0476ef53ca7748091aa936513affc1245928ae5b1b8": {},
                 "sha256:be09e345d175a5dd6535a69db12429072ddc453874792b75446370fc4eb196a1": {},
                 "sha256:d8aa8d1e0db5f32658af8c236f06853421e4bd4618f86c9e05e121b9b805b0dc": {},
@@ -195,6 +199,8 @@
                 "sha256:5ed9093c6368733f9aecfe56b029246929047c1de33ca035fbcd0c210bae4051": {},
                 "sha256:b14d332c9d9fd66afeb9c3064db3955b7667f4cf3e85d7f76439eeba63fff488": {},
                 "sha256:1a2aaf60c22453df0c306a5618aca20a2ce19090525445037a667f468b8ceaab": {},
+                "sha256:6b215bdf0227e676436a3056969d68acbd329ee3fcccb46873fee31d6f1bafe8": {},
+                "sha256:b4c0a61643aa825845887cf39f780fa2862f629f980c095704c059b5418dba20": {},
                 "sha256:da676955f475492f17c573bc526d47c37e34919d2a6ed33ec4573a4de0cab2a7": {},
                 "sha256:ba2916d48b3a28e9bc2c9fbde19770c204b6ad4cdc94471c3c6bdbfbe8669461": {},
                 "sha256:0214ae16ef6a92843a4973aeda93db85584ad7840b1dd6e225bc57b594f58961": {},
@@ -323,6 +329,16 @@
               "docs": true
             }
           }
+        },
+        {
+          "type": "org.osbuild.selinux",
+          "options": {
+            "file_contexts": "etc/selinux/targeted/contexts/files/file_contexts",
+            "labels": {
+              "/usr/bin/cp": "system_u:object_r:install_exec_t:s0",
+              "/usr/bin/tar": "system_u:object_r:install_exec_t:s0"
+            }
+          }
         }
       ]
     },
@@ -1019,7 +1035,7 @@
           }
         },
         {
-          "type": "org.osbuild.mkfs.xfs",
+          "type": "org.osbuild.lvm2.create",
           "devices": {
             "device": {
               "type": "org.osbuild.loopback",
@@ -1030,6 +1046,34 @@
               }
             }
           },
+          "options": {
+            "volumes": [
+              {
+                "name": "root",
+                "size": "100%FREE"
+              }
+            ]
+          }
+        },
+        {
+          "type": "org.osbuild.mkfs.xfs",
+          "devices": {
+            "lvm": {
+              "type": "org.osbuild.loopback",
+              "options": {
+                "filename": "disk.img",
+                "start": 413696,
+                "size": 20557791
+              }
+            },
+            "device": {
+              "type": "org.osbuild.lvm2.lv",
+              "parent": "lvm",
+              "options": {
+                "volume": "root"
+              }
+            }
+          },
           "options": {
             "uuid": "76a22bf4-f153-4541-b6c7-0332c0dfaeac",
             "label": "root"
@@ -1071,13 +1115,20 @@
                 "size": 204800
               }
             },
-            "root": {
+            "lvm": {
               "type": "org.osbuild.loopback",
               "options": {
                 "filename": "disk.img",
                 "start": 413696,
                 "size": 20557791
               }
+            },
+            "root": {
+              "type": "org.osbuild.lvm2.lv",
+              "parent": "lvm",
+              "options": {
+                "volume": "root"
+              }
             }
           },
           "mounts": [
@@ -1119,6 +1170,25 @@
               "path": "/grub2"
             }
           }
+        },
+        {
+          "type": "org.osbuild.lvm2.metadata",
+          "devices": {
+            "device": {
+              "type": "org.osbuild.loopback",
+              "options": {
+                "filename": "disk.img",
+                "start": 413696,
+                "size": 20557791,
+                "lock": true
+              }
+            }
+          },
+          "options": {
+            "vg_name": "osbuild",
+            "creation_host": "osbuild",
+            "description": "Built with osbuild"
+          }
         }
       ]
     },
diff --git a/test/data/manifests/fedora-ostree-image.mpp.json b/test/data/manifests/fedora-ostree-image.mpp.json
index 4b8309c5..468a7b69 100644
--- a/test/data/manifests/fedora-ostree-image.mpp.json
+++ b/test/data/manifests/fedora-ostree-image.mpp.json
@@ -27,7 +27,7 @@
           "uuid": "61B2905B-DF3E-4FB3-80FA-49D1E773AA32"
         },
         {
-          "id": "root",
+          "id": "lvm",
           "type": "0FC63DAF-8483-4772-8E79-3D69D8477DE4",
           "uuid": "6264D520-3FB9-423F-8AB8-7A0A8E3D3562"
         }
@@ -457,21 +457,53 @@
           }
         },
         {
-          "type": "org.osbuild.mkfs.xfs",
+          "type": "org.osbuild.lvm2.create",
           "devices": {
             "device": {
               "type": "org.osbuild.loopback",
               "options": {
                 "filename": "disk.img",
                 "start": {
-                  "mpp-format-int": "{image.layout['root'].start}"
+                  "mpp-format-int": "{image.layout['lvm'].start}"
                 },
                 "size": {
-                  "mpp-format-int": "{image.layout['root'].size}"
+                  "mpp-format-int": "{image.layout['lvm'].size}"
                 }
               }
             }
           },
+          "options": {
+            "volumes": [
+              {
+                "name": "root",
+                "size": "100%FREE"
+              }
+            ]
+          }
+        },
+        {
+          "type": "org.osbuild.mkfs.xfs",
+          "devices": {
+            "lvm": {
+              "type": "org.osbuild.loopback",
+              "options": {
+                "filename": "disk.img",
+                "start": {
+                  "mpp-format-int": "{image.layout['lvm'].start}"
+                },
+                "size": {
+                  "mpp-format-int": "{image.layout['lvm'].size}"
+                }
+              }
+            },
+            "device": {
+              "type": "org.osbuild.lvm2.lv",
+              "parent": "lvm",
+              "options": {
+                "volume": "root"
+              }
+            }
+          },
           "options": {
             "uuid": "76a22bf4-f153-4541-b6c7-0332c0dfaeac",
             "label": "root"
@@ -521,17 +553,24 @@
                 }
               }
             },
-            "root": {
+            "lvm": {
               "type": "org.osbuild.loopback",
               "options": {
                 "filename": "disk.img",
                 "start": {
-                  "mpp-format-int": "{image.layout['root'].start}"
+                  "mpp-format-int": "{image.layout['lvm'].start}"
                 },
                 "size": {
-                  "mpp-format-int": "{image.layout['root'].size}"
+                  "mpp-format-int": "{image.layout['lvm'].size}"
                 }
               }
+            },
+            "root": {
+              "type": "org.osbuild.lvm2.lv",
+              "parent": "lvm",
+              "options": {
+                "volume": "root"
+              }
             }
           },
           "mounts": [
@@ -579,6 +618,29 @@
               "path": "/grub2"
             }
           }
+        },
+        {
+          "type": "org.osbuild.lvm2.metadata",
+          "devices": {
+            "device": {
+              "type": "org.osbuild.loopback",
+              "options": {
+                "filename": "disk.img",
+                "start": {
+                  "mpp-format-int": "{image.layout['lvm'].start}"
+                },
+                "size": {
+                  "mpp-format-int": "{image.layout['lvm'].size}"
+                },
+                "lock": true
+              }
+            }
+          },
+          "options": {
+            "vg_name": "osbuild",
+            "creation_host": "osbuild",
+            "description": "Built with osbuild"
+          }
         }
       ]
     },
diff --git a/test/data/manifests/fedora-ostree-tarball.json b/test/data/manifests/fedora-ostree-tarball.json
index bec79ba9..d0f70e46 100644
--- a/test/data/manifests/fedora-ostree-tarball.json
+++ b/test/data/manifests/fedora-ostree-tarball.json
@@ -21,6 +21,7 @@
                 "sha256:96b69aefaddfebbac3f9b6361b01cc71196e604a56fd9a6236317e63fb68664a": {},
                 "sha256:9a698a5991a08e23e87b4bce2f3e447eafdc7fd4d84a49d91c65c6045ead1e8e": {},
                 "sha256:bc66918c24175415a0f65803bccbb3d796d733acd319577a2417371a178ce193": {},
+                "sha256:d23395e2614654c4cb717ec29cba2e61beec36bf815e74729ada20be41633caa": {},
                 "sha256:775b1498ba72e9d05a1c131fdbc2f4aabb8fd00d9c7c13ab996154e99660f92b": {},
                 "sha256:29cf7e97d6476fcfe80088a4c9cbc113d9b73e37dc9ec34967a958cef2d04e0c": {},
                 "sha256:9bff70d51ecec129854ef62d82204db3e01706c444b966cb048bc7fd8ec8b524": {},
@@ -37,7 +38,10 @@
                 "sha256:b2ffc9785842ccc76ca187d8b922fb3b91da2257341fb115ed6bdbfedb24c1eb": {},
                 "sha256:f8b418b88b30d28c911d26f6f0b9c1ede8be00fa71d28c789328dfd7c58eea67": {},
                 "sha256:5fb88eb681e996ab2199251a68c79b2797fa03d31a36dae698de393b85e1f89e": {},
+                "sha256:a657bd57bcdee99766d2076ec3b751f96670794c3dc10e20b94f917be4018281": {},
+                "sha256:7f1001c3e61932f826b3c7f87bf20efe79cd9a797f3598613c10cd1e6a49961c": {},
                 "sha256:f5f5c988604aa5c870eee7efff6d40f26acb908cf82991d762ade18c8b46aff6": {},
+                "sha256:2ad21916943c245819c1586f2841673c35f73c38bc0bbfa24e7c4f3892d73d28": {},
                 "sha256:c58752e2529cf0ea4aabb0476ef53ca7748091aa936513affc1245928ae5b1b8": {},
                 "sha256:be09e345d175a5dd6535a69db12429072ddc453874792b75446370fc4eb196a1": {},
                 "sha256:d8aa8d1e0db5f32658af8c236f06853421e4bd4618f86c9e05e121b9b805b0dc": {},
@@ -195,6 +199,8 @@
                 "sha256:5ed9093c6368733f9aecfe56b029246929047c1de33ca035fbcd0c210bae4051": {},
                 "sha256:b14d332c9d9fd66afeb9c3064db3955b7667f4cf3e85d7f76439eeba63fff488": {},
                 "sha256:1a2aaf60c22453df0c306a5618aca20a2ce19090525445037a667f468b8ceaab": {},
+                "sha256:6b215bdf0227e676436a3056969d68acbd329ee3fcccb46873fee31d6f1bafe8": {},
+                "sha256:b4c0a61643aa825845887cf39f780fa2862f629f980c095704c059b5418dba20": {},
                 "sha256:da676955f475492f17c573bc526d47c37e34919d2a6ed33ec4573a4de0cab2a7": {},
                 "sha256:ba2916d48b3a28e9bc2c9fbde19770c204b6ad4cdc94471c3c6bdbfbe8669461": {},
                 "sha256:0214ae16ef6a92843a4973aeda93db85584ad7840b1dd6e225bc57b594f58961": {},
@@ -323,6 +329,16 @@
               "docs": true
             }
           }
+        },
+        {
+          "type": "org.osbuild.selinux",
+          "options": {
+            "file_contexts": "etc/selinux/targeted/contexts/files/file_contexts",
+            "labels": {
+              "/usr/bin/cp": "system_u:object_r:install_exec_t:s0",
+              "/usr/bin/tar": "system_u:object_r:install_exec_t:s0"
+            }
+          }
         }
       ]
     },
@@ -846,6 +862,7 @@
         "sha256:d8c5c2d285731623ddd2d6cfd9cccbd5609a7adc664e869f0c9f3b34a14eb799": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/chrony-4.0-3.fc34.x86_64.rpm",
         "sha256:e7d1d0b85ac49d8b0c9dd3fce4613e6229ac8720cfb74c80a496b9f0beaa7a22": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/cloud-init-20.4-2.fc34.noarch.rpm",
         "sha256:6d1b95e06ec98f6d65c64e18fec693d379b98128a3e94b4dec8929321354c549": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/cloud-utils-growpart-0.31-8.fc34.noarch.rpm",
+        "sha256:d23395e2614654c4cb717ec29cba2e61beec36bf815e74729ada20be41633caa": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/compat-readline5-5.2-39.fc34.x86_64.rpm",
         "sha256:1877af369228dd661ae1adfc43bbb8d53d3464d59ead0f5bcf6c2be88f8e8685": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/console-login-helper-messages-0.21.2-1.fc34.noarch.rpm",
         "sha256:3f7bde703045c2651fbd4142131ea1e303a565269388a08e2312af0eb83307a4": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/console-login-helper-messages-issuegen-0.21.2-1.fc34.noarch.rpm",
         "sha256:d2bac91a1969f555ea2641b161bb23fa0aaaffaba3284d9973ad696594b73f18": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/console-login-helper-messages-motdgen-0.21.2-1.fc34.noarch.rpm",
@@ -867,7 +884,10 @@
         "sha256:79834af7f95c0d1e5dcf85b794819bd854197a52d2966594abdb3c3de0fcceb6": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dejavu-sans-fonts-2.37-16.fc34.noarch.rpm",
         "sha256:f8b418b88b30d28c911d26f6f0b9c1ede8be00fa71d28c789328dfd7c58eea67": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/deltarpm-3.6.2-8.fc34.x86_64.rpm",
         "sha256:5fb88eb681e996ab2199251a68c79b2797fa03d31a36dae698de393b85e1f89e": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:a657bd57bcdee99766d2076ec3b751f96670794c3dc10e20b94f917be4018281": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-event-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:7f1001c3e61932f826b3c7f87bf20efe79cd9a797f3598613c10cd1e6a49961c": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-event-libs-1.02.175-1.fc34.x86_64.rpm",
         "sha256:f5f5c988604aa5c870eee7efff6d40f26acb908cf82991d762ade18c8b46aff6": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-libs-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:2ad21916943c245819c1586f2841673c35f73c38bc0bbfa24e7c4f3892d73d28": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-persistent-data-0.9.0-3.fc34.x86_64.rpm",
         "sha256:6152b13257229177f6cb4782ac67858a210e39a493a66290ce5bd768613cf556": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dhcp-client-4.4.2-9.b1.fc34.x86_64.rpm",
         "sha256:b73df4f459abe3cbdae9c9385d0cf612baddd0b09262ef9ec90a8cf84f80f2be": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dhcp-common-4.4.2-9.b1.fc34.noarch.rpm",
         "sha256:c58752e2529cf0ea4aabb0476ef53ca7748091aa936513affc1245928ae5b1b8": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/diffutils-3.7-8.fc34.x86_64.rpm",
@@ -1082,6 +1102,8 @@
         "sha256:5ed9093c6368733f9aecfe56b029246929047c1de33ca035fbcd0c210bae4051": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lorax-34.9-5.fc34.x86_64.rpm",
         "sha256:b14d332c9d9fd66afeb9c3064db3955b7667f4cf3e85d7f76439eeba63fff488": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lorax-templates-generic-34.9-5.fc34.x86_64.rpm",
         "sha256:1a2aaf60c22453df0c306a5618aca20a2ce19090525445037a667f468b8ceaab": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lua-libs-5.4.2-2.fc34.x86_64.rpm",
+        "sha256:6b215bdf0227e676436a3056969d68acbd329ee3fcccb46873fee31d6f1bafe8": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lvm2-2.03.11-1.fc34.x86_64.rpm",
+        "sha256:b4c0a61643aa825845887cf39f780fa2862f629f980c095704c059b5418dba20": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lvm2-libs-2.03.11-1.fc34.x86_64.rpm",
         "sha256:da676955f475492f17c573bc526d47c37e34919d2a6ed33ec4573a4de0cab2a7": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lz4-libs-1.9.3-2.fc34.x86_64.rpm",
         "sha256:ba2916d48b3a28e9bc2c9fbde19770c204b6ad4cdc94471c3c6bdbfbe8669461": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lzo-2.10-4.fc34.x86_64.rpm",
         "sha256:7f2e8cf1b8b1ae6c1e9cbfa60cc6083ba88aca1f42d1639b52c3fabf7ab68185": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/m/man-db-2.9.3-3.fc34.x86_64.rpm",
diff --git a/test/data/stages/chmod/a.json b/test/data/stages/chmod/a.json
index b3929e58..b29a4a7d 100644
--- a/test/data/stages/chmod/a.json
+++ b/test/data/stages/chmod/a.json
@@ -20,6 +20,7 @@
         "sha256:96b69aefaddfebbac3f9b6361b01cc71196e604a56fd9a6236317e63fb68664a": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/b/bubblewrap-0.4.1-3.fc34.x86_64.rpm",
         "sha256:9a698a5991a08e23e87b4bce2f3e447eafdc7fd4d84a49d91c65c6045ead1e8e": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/b/bzip2-libs-1.0.8-6.fc34.x86_64.rpm",
         "sha256:bc66918c24175415a0f65803bccbb3d796d733acd319577a2417371a178ce193": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/ca-certificates-2020.2.41-7.fc34.noarch.rpm",
+        "sha256:d23395e2614654c4cb717ec29cba2e61beec36bf815e74729ada20be41633caa": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/compat-readline5-5.2-39.fc34.x86_64.rpm",
         "sha256:775b1498ba72e9d05a1c131fdbc2f4aabb8fd00d9c7c13ab996154e99660f92b": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/coreutils-8.32-21.fc34.x86_64.rpm",
         "sha256:29cf7e97d6476fcfe80088a4c9cbc113d9b73e37dc9ec34967a958cef2d04e0c": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/coreutils-common-8.32-21.fc34.x86_64.rpm",
         "sha256:9bff70d51ecec129854ef62d82204db3e01706c444b966cb048bc7fd8ec8b524": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/cpio-2.13-10.fc34.x86_64.rpm",
@@ -36,7 +37,10 @@
         "sha256:b2ffc9785842ccc76ca187d8b922fb3b91da2257341fb115ed6bdbfedb24c1eb": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dbus-libs-1.12.20-3.fc34.x86_64.rpm",
         "sha256:f8b418b88b30d28c911d26f6f0b9c1ede8be00fa71d28c789328dfd7c58eea67": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/deltarpm-3.6.2-8.fc34.x86_64.rpm",
         "sha256:5fb88eb681e996ab2199251a68c79b2797fa03d31a36dae698de393b85e1f89e": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:a657bd57bcdee99766d2076ec3b751f96670794c3dc10e20b94f917be4018281": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-event-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:7f1001c3e61932f826b3c7f87bf20efe79cd9a797f3598613c10cd1e6a49961c": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-event-libs-1.02.175-1.fc34.x86_64.rpm",
         "sha256:f5f5c988604aa5c870eee7efff6d40f26acb908cf82991d762ade18c8b46aff6": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-libs-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:2ad21916943c245819c1586f2841673c35f73c38bc0bbfa24e7c4f3892d73d28": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-persistent-data-0.9.0-3.fc34.x86_64.rpm",
         "sha256:c58752e2529cf0ea4aabb0476ef53ca7748091aa936513affc1245928ae5b1b8": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/diffutils-3.7-8.fc34.x86_64.rpm",
         "sha256:be09e345d175a5dd6535a69db12429072ddc453874792b75446370fc4eb196a1": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dnf-4.6.1-1.fc34.noarch.rpm",
         "sha256:d8aa8d1e0db5f32658af8c236f06853421e4bd4618f86c9e05e121b9b805b0dc": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dnf-data-4.6.1-1.fc34.noarch.rpm",
@@ -194,6 +198,8 @@
         "sha256:5ed9093c6368733f9aecfe56b029246929047c1de33ca035fbcd0c210bae4051": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lorax-34.9-5.fc34.x86_64.rpm",
         "sha256:b14d332c9d9fd66afeb9c3064db3955b7667f4cf3e85d7f76439eeba63fff488": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lorax-templates-generic-34.9-5.fc34.x86_64.rpm",
         "sha256:1a2aaf60c22453df0c306a5618aca20a2ce19090525445037a667f468b8ceaab": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lua-libs-5.4.2-2.fc34.x86_64.rpm",
+        "sha256:6b215bdf0227e676436a3056969d68acbd329ee3fcccb46873fee31d6f1bafe8": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lvm2-2.03.11-1.fc34.x86_64.rpm",
+        "sha256:b4c0a61643aa825845887cf39f780fa2862f629f980c095704c059b5418dba20": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lvm2-libs-2.03.11-1.fc34.x86_64.rpm",
         "sha256:da676955f475492f17c573bc526d47c37e34919d2a6ed33ec4573a4de0cab2a7": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lz4-libs-1.9.3-2.fc34.x86_64.rpm",
         "sha256:ba2916d48b3a28e9bc2c9fbde19770c204b6ad4cdc94471c3c6bdbfbe8669461": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lzo-2.10-4.fc34.x86_64.rpm",
         "sha256:0214ae16ef6a92843a4973aeda93db85584ad7840b1dd6e225bc57b594f58961": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/m/memstrack-0.2.2-1.fc34.x86_64.rpm",
@@ -335,6 +341,7 @@
                 "sha256:96b69aefaddfebbac3f9b6361b01cc71196e604a56fd9a6236317e63fb68664a": {},
                 "sha256:9a698a5991a08e23e87b4bce2f3e447eafdc7fd4d84a49d91c65c6045ead1e8e": {},
                 "sha256:bc66918c24175415a0f65803bccbb3d796d733acd319577a2417371a178ce193": {},
+                "sha256:d23395e2614654c4cb717ec29cba2e61beec36bf815e74729ada20be41633caa": {},
                 "sha256:775b1498ba72e9d05a1c131fdbc2f4aabb8fd00d9c7c13ab996154e99660f92b": {},
                 "sha256:29cf7e97d6476fcfe80088a4c9cbc113d9b73e37dc9ec34967a958cef2d04e0c": {},
                 "sha256:9bff70d51ecec129854ef62d82204db3e01706c444b966cb048bc7fd8ec8b524": {},
@@ -351,7 +358,10 @@
                 "sha256:b2ffc9785842ccc76ca187d8b922fb3b91da2257341fb115ed6bdbfedb24c1eb": {},
                 "sha256:f8b418b88b30d28c911d26f6f0b9c1ede8be00fa71d28c789328dfd7c58eea67": {},
                 "sha256:5fb88eb681e996ab2199251a68c79b2797fa03d31a36dae698de393b85e1f89e": {},
+                "sha256:a657bd57bcdee99766d2076ec3b751f96670794c3dc10e20b94f917be4018281": {},
+                "sha256:7f1001c3e61932f826b3c7f87bf20efe79cd9a797f3598613c10cd1e6a49961c": {},
                 "sha256:f5f5c988604aa5c870eee7efff6d40f26acb908cf82991d762ade18c8b46aff6": {},
+                "sha256:2ad21916943c245819c1586f2841673c35f73c38bc0bbfa24e7c4f3892d73d28": {},
                 "sha256:c58752e2529cf0ea4aabb0476ef53ca7748091aa936513affc1245928ae5b1b8": {},
                 "sha256:be09e345d175a5dd6535a69db12429072ddc453874792b75446370fc4eb196a1": {},
                 "sha256:d8aa8d1e0db5f32658af8c236f06853421e4bd4618f86c9e05e121b9b805b0dc": {},
@@ -509,6 +519,8 @@
                 "sha256:5ed9093c6368733f9aecfe56b029246929047c1de33ca035fbcd0c210bae4051": {},
                 "sha256:b14d332c9d9fd66afeb9c3064db3955b7667f4cf3e85d7f76439eeba63fff488": {},
                 "sha256:1a2aaf60c22453df0c306a5618aca20a2ce19090525445037a667f468b8ceaab": {},
+                "sha256:6b215bdf0227e676436a3056969d68acbd329ee3fcccb46873fee31d6f1bafe8": {},
+                "sha256:b4c0a61643aa825845887cf39f780fa2862f629f980c095704c059b5418dba20": {},
                 "sha256:da676955f475492f17c573bc526d47c37e34919d2a6ed33ec4573a4de0cab2a7": {},
                 "sha256:ba2916d48b3a28e9bc2c9fbde19770c204b6ad4cdc94471c3c6bdbfbe8669461": {},
                 "sha256:0214ae16ef6a92843a4973aeda93db85584ad7840b1dd6e225bc57b594f58961": {},
@@ -637,6 +649,16 @@
               "docs": true
             }
           }
+        },
+        {
+          "type": "org.osbuild.selinux",
+          "options": {
+            "file_contexts": "etc/selinux/targeted/contexts/files/file_contexts",
+            "labels": {
+              "/usr/bin/cp": "system_u:object_r:install_exec_t:s0",
+              "/usr/bin/tar": "system_u:object_r:install_exec_t:s0"
+            }
+          }
         }
       ]
     },
diff --git a/test/data/stages/chmod/b.json b/test/data/stages/chmod/b.json
index 32dfb904..b74e724b 100644
--- a/test/data/stages/chmod/b.json
+++ b/test/data/stages/chmod/b.json
@@ -20,6 +20,7 @@
         "sha256:96b69aefaddfebbac3f9b6361b01cc71196e604a56fd9a6236317e63fb68664a": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/b/bubblewrap-0.4.1-3.fc34.x86_64.rpm",
         "sha256:9a698a5991a08e23e87b4bce2f3e447eafdc7fd4d84a49d91c65c6045ead1e8e": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/b/bzip2-libs-1.0.8-6.fc34.x86_64.rpm",
         "sha256:bc66918c24175415a0f65803bccbb3d796d733acd319577a2417371a178ce193": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/ca-certificates-2020.2.41-7.fc34.noarch.rpm",
+        "sha256:d23395e2614654c4cb717ec29cba2e61beec36bf815e74729ada20be41633caa": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/compat-readline5-5.2-39.fc34.x86_64.rpm",
         "sha256:775b1498ba72e9d05a1c131fdbc2f4aabb8fd00d9c7c13ab996154e99660f92b": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/coreutils-8.32-21.fc34.x86_64.rpm",
         "sha256:29cf7e97d6476fcfe80088a4c9cbc113d9b73e37dc9ec34967a958cef2d04e0c": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/coreutils-common-8.32-21.fc34.x86_64.rpm",
         "sha256:9bff70d51ecec129854ef62d82204db3e01706c444b966cb048bc7fd8ec8b524": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/cpio-2.13-10.fc34.x86_64.rpm",
@@ -36,7 +37,10 @@
         "sha256:b2ffc9785842ccc76ca187d8b922fb3b91da2257341fb115ed6bdbfedb24c1eb": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dbus-libs-1.12.20-3.fc34.x86_64.rpm",
         "sha256:f8b418b88b30d28c911d26f6f0b9c1ede8be00fa71d28c789328dfd7c58eea67": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/deltarpm-3.6.2-8.fc34.x86_64.rpm",
         "sha256:5fb88eb681e996ab2199251a68c79b2797fa03d31a36dae698de393b85e1f89e": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:a657bd57bcdee99766d2076ec3b751f96670794c3dc10e20b94f917be4018281": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-event-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:7f1001c3e61932f826b3c7f87bf20efe79cd9a797f3598613c10cd1e6a49961c": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-event-libs-1.02.175-1.fc34.x86_64.rpm",
         "sha256:f5f5c988604aa5c870eee7efff6d40f26acb908cf82991d762ade18c8b46aff6": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-libs-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:2ad21916943c245819c1586f2841673c35f73c38bc0bbfa24e7c4f3892d73d28": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-persistent-data-0.9.0-3.fc34.x86_64.rpm",
         "sha256:c58752e2529cf0ea4aabb0476ef53ca7748091aa936513affc1245928ae5b1b8": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/diffutils-3.7-8.fc34.x86_64.rpm",
         "sha256:be09e345d175a5dd6535a69db12429072ddc453874792b75446370fc4eb196a1": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dnf-4.6.1-1.fc34.noarch.rpm",
         "sha256:d8aa8d1e0db5f32658af8c236f06853421e4bd4618f86c9e05e121b9b805b0dc": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dnf-data-4.6.1-1.fc34.noarch.rpm",
@@ -194,6 +198,8 @@
         "sha256:5ed9093c6368733f9aecfe56b029246929047c1de33ca035fbcd0c210bae4051": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lorax-34.9-5.fc34.x86_64.rpm",
         "sha256:b14d332c9d9fd66afeb9c3064db3955b7667f4cf3e85d7f76439eeba63fff488": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lorax-templates-generic-34.9-5.fc34.x86_64.rpm",
         "sha256:1a2aaf60c22453df0c306a5618aca20a2ce19090525445037a667f468b8ceaab": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lua-libs-5.4.2-2.fc34.x86_64.rpm",
+        "sha256:6b215bdf0227e676436a3056969d68acbd329ee3fcccb46873fee31d6f1bafe8": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lvm2-2.03.11-1.fc34.x86_64.rpm",
+        "sha256:b4c0a61643aa825845887cf39f780fa2862f629f980c095704c059b5418dba20": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lvm2-libs-2.03.11-1.fc34.x86_64.rpm",
         "sha256:da676955f475492f17c573bc526d47c37e34919d2a6ed33ec4573a4de0cab2a7": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lz4-libs-1.9.3-2.fc34.x86_64.rpm",
         "sha256:ba2916d48b3a28e9bc2c9fbde19770c204b6ad4cdc94471c3c6bdbfbe8669461": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lzo-2.10-4.fc34.x86_64.rpm",
         "sha256:0214ae16ef6a92843a4973aeda93db85584ad7840b1dd6e225bc57b594f58961": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/m/memstrack-0.2.2-1.fc34.x86_64.rpm",
@@ -335,6 +341,7 @@
                 "sha256:96b69aefaddfebbac3f9b6361b01cc71196e604a56fd9a6236317e63fb68664a": {},
                 "sha256:9a698a5991a08e23e87b4bce2f3e447eafdc7fd4d84a49d91c65c6045ead1e8e": {},
                 "sha256:bc66918c24175415a0f65803bccbb3d796d733acd319577a2417371a178ce193": {},
+                "sha256:d23395e2614654c4cb717ec29cba2e61beec36bf815e74729ada20be41633caa": {},
                 "sha256:775b1498ba72e9d05a1c131fdbc2f4aabb8fd00d9c7c13ab996154e99660f92b": {},
                 "sha256:29cf7e97d6476fcfe80088a4c9cbc113d9b73e37dc9ec34967a958cef2d04e0c": {},
                 "sha256:9bff70d51ecec129854ef62d82204db3e01706c444b966cb048bc7fd8ec8b524": {},
@@ -351,7 +358,10 @@
                 "sha256:b2ffc9785842ccc76ca187d8b922fb3b91da2257341fb115ed6bdbfedb24c1eb": {},
                 "sha256:f8b418b88b30d28c911d26f6f0b9c1ede8be00fa71d28c789328dfd7c58eea67": {},
                 "sha256:5fb88eb681e996ab2199251a68c79b2797fa03d31a36dae698de393b85e1f89e": {},
+                "sha256:a657bd57bcdee99766d2076ec3b751f96670794c3dc10e20b94f917be4018281": {},
+                "sha256:7f1001c3e61932f826b3c7f87bf20efe79cd9a797f3598613c10cd1e6a49961c": {},
                 "sha256:f5f5c988604aa5c870eee7efff6d40f26acb908cf82991d762ade18c8b46aff6": {},
+                "sha256:2ad21916943c245819c1586f2841673c35f73c38bc0bbfa24e7c4f3892d73d28": {},
                 "sha256:c58752e2529cf0ea4aabb0476ef53ca7748091aa936513affc1245928ae5b1b8": {},
                 "sha256:be09e345d175a5dd6535a69db12429072ddc453874792b75446370fc4eb196a1": {},
                 "sha256:d8aa8d1e0db5f32658af8c236f06853421e4bd4618f86c9e05e121b9b805b0dc": {},
@@ -509,6 +519,8 @@
                 "sha256:5ed9093c6368733f9aecfe56b029246929047c1de33ca035fbcd0c210bae4051": {},
                 "sha256:b14d332c9d9fd66afeb9c3064db3955b7667f4cf3e85d7f76439eeba63fff488": {},
                 "sha256:1a2aaf60c22453df0c306a5618aca20a2ce19090525445037a667f468b8ceaab": {},
+                "sha256:6b215bdf0227e676436a3056969d68acbd329ee3fcccb46873fee31d6f1bafe8": {},
+                "sha256:b4c0a61643aa825845887cf39f780fa2862f629f980c095704c059b5418dba20": {},
                 "sha256:da676955f475492f17c573bc526d47c37e34919d2a6ed33ec4573a4de0cab2a7": {},
                 "sha256:ba2916d48b3a28e9bc2c9fbde19770c204b6ad4cdc94471c3c6bdbfbe8669461": {},
                 "sha256:0214ae16ef6a92843a4973aeda93db85584ad7840b1dd6e225bc57b594f58961": {},
@@ -637,6 +649,16 @@
               "docs": true
             }
           }
+        },
+        {
+          "type": "org.osbuild.selinux",
+          "options": {
+            "file_contexts": "etc/selinux/targeted/contexts/files/file_contexts",
+            "labels": {
+              "/usr/bin/cp": "system_u:object_r:install_exec_t:s0",
+              "/usr/bin/tar": "system_u:object_r:install_exec_t:s0"
+            }
+          }
         }
       ]
     },
diff --git a/test/data/stages/mkdir/a.json b/test/data/stages/mkdir/a.json
index 8548eaae..dbab961f 100644
--- a/test/data/stages/mkdir/a.json
+++ b/test/data/stages/mkdir/a.json
@@ -21,6 +21,7 @@
                 "sha256:96b69aefaddfebbac3f9b6361b01cc71196e604a56fd9a6236317e63fb68664a": {},
                 "sha256:9a698a5991a08e23e87b4bce2f3e447eafdc7fd4d84a49d91c65c6045ead1e8e": {},
                 "sha256:bc66918c24175415a0f65803bccbb3d796d733acd319577a2417371a178ce193": {},
+                "sha256:d23395e2614654c4cb717ec29cba2e61beec36bf815e74729ada20be41633caa": {},
                 "sha256:775b1498ba72e9d05a1c131fdbc2f4aabb8fd00d9c7c13ab996154e99660f92b": {},
                 "sha256:29cf7e97d6476fcfe80088a4c9cbc113d9b73e37dc9ec34967a958cef2d04e0c": {},
                 "sha256:9bff70d51ecec129854ef62d82204db3e01706c444b966cb048bc7fd8ec8b524": {},
@@ -37,7 +38,10 @@
                 "sha256:b2ffc9785842ccc76ca187d8b922fb3b91da2257341fb115ed6bdbfedb24c1eb": {},
                 "sha256:f8b418b88b30d28c911d26f6f0b9c1ede8be00fa71d28c789328dfd7c58eea67": {},
                 "sha256:5fb88eb681e996ab2199251a68c79b2797fa03d31a36dae698de393b85e1f89e": {},
+                "sha256:a657bd57bcdee99766d2076ec3b751f96670794c3dc10e20b94f917be4018281": {},
+                "sha256:7f1001c3e61932f826b3c7f87bf20efe79cd9a797f3598613c10cd1e6a49961c": {},
                 "sha256:f5f5c988604aa5c870eee7efff6d40f26acb908cf82991d762ade18c8b46aff6": {},
+                "sha256:2ad21916943c245819c1586f2841673c35f73c38bc0bbfa24e7c4f3892d73d28": {},
                 "sha256:c58752e2529cf0ea4aabb0476ef53ca7748091aa936513affc1245928ae5b1b8": {},
                 "sha256:be09e345d175a5dd6535a69db12429072ddc453874792b75446370fc4eb196a1": {},
                 "sha256:d8aa8d1e0db5f32658af8c236f06853421e4bd4618f86c9e05e121b9b805b0dc": {},
@@ -195,6 +199,8 @@
                 "sha256:5ed9093c6368733f9aecfe56b029246929047c1de33ca035fbcd0c210bae4051": {},
                 "sha256:b14d332c9d9fd66afeb9c3064db3955b7667f4cf3e85d7f76439eeba63fff488": {},
                 "sha256:1a2aaf60c22453df0c306a5618aca20a2ce19090525445037a667f468b8ceaab": {},
+                "sha256:6b215bdf0227e676436a3056969d68acbd329ee3fcccb46873fee31d6f1bafe8": {},
+                "sha256:b4c0a61643aa825845887cf39f780fa2862f629f980c095704c059b5418dba20": {},
                 "sha256:da676955f475492f17c573bc526d47c37e34919d2a6ed33ec4573a4de0cab2a7": {},
                 "sha256:ba2916d48b3a28e9bc2c9fbde19770c204b6ad4cdc94471c3c6bdbfbe8669461": {},
                 "sha256:0214ae16ef6a92843a4973aeda93db85584ad7840b1dd6e225bc57b594f58961": {},
@@ -323,6 +329,16 @@
               "docs": true
             }
           }
+        },
+        {
+          "type": "org.osbuild.selinux",
+          "options": {
+            "file_contexts": "etc/selinux/targeted/contexts/files/file_contexts",
+            "labels": {
+              "/usr/bin/cp": "system_u:object_r:install_exec_t:s0",
+              "/usr/bin/tar": "system_u:object_r:install_exec_t:s0"
+            }
+          }
         }
       ]
     },
@@ -355,6 +371,7 @@
         "sha256:96b69aefaddfebbac3f9b6361b01cc71196e604a56fd9a6236317e63fb68664a": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/b/bubblewrap-0.4.1-3.fc34.x86_64.rpm",
         "sha256:9a698a5991a08e23e87b4bce2f3e447eafdc7fd4d84a49d91c65c6045ead1e8e": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/b/bzip2-libs-1.0.8-6.fc34.x86_64.rpm",
         "sha256:bc66918c24175415a0f65803bccbb3d796d733acd319577a2417371a178ce193": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/ca-certificates-2020.2.41-7.fc34.noarch.rpm",
+        "sha256:d23395e2614654c4cb717ec29cba2e61beec36bf815e74729ada20be41633caa": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/compat-readline5-5.2-39.fc34.x86_64.rpm",
         "sha256:775b1498ba72e9d05a1c131fdbc2f4aabb8fd00d9c7c13ab996154e99660f92b": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/coreutils-8.32-21.fc34.x86_64.rpm",
         "sha256:29cf7e97d6476fcfe80088a4c9cbc113d9b73e37dc9ec34967a958cef2d04e0c": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/coreutils-common-8.32-21.fc34.x86_64.rpm",
         "sha256:9bff70d51ecec129854ef62d82204db3e01706c444b966cb048bc7fd8ec8b524": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/cpio-2.13-10.fc34.x86_64.rpm",
@@ -371,7 +388,10 @@
         "sha256:b2ffc9785842ccc76ca187d8b922fb3b91da2257341fb115ed6bdbfedb24c1eb": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dbus-libs-1.12.20-3.fc34.x86_64.rpm",
         "sha256:f8b418b88b30d28c911d26f6f0b9c1ede8be00fa71d28c789328dfd7c58eea67": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/deltarpm-3.6.2-8.fc34.x86_64.rpm",
         "sha256:5fb88eb681e996ab2199251a68c79b2797fa03d31a36dae698de393b85e1f89e": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:a657bd57bcdee99766d2076ec3b751f96670794c3dc10e20b94f917be4018281": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-event-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:7f1001c3e61932f826b3c7f87bf20efe79cd9a797f3598613c10cd1e6a49961c": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-event-libs-1.02.175-1.fc34.x86_64.rpm",
         "sha256:f5f5c988604aa5c870eee7efff6d40f26acb908cf82991d762ade18c8b46aff6": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-libs-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:2ad21916943c245819c1586f2841673c35f73c38bc0bbfa24e7c4f3892d73d28": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-persistent-data-0.9.0-3.fc34.x86_64.rpm",
         "sha256:c58752e2529cf0ea4aabb0476ef53ca7748091aa936513affc1245928ae5b1b8": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/diffutils-3.7-8.fc34.x86_64.rpm",
         "sha256:be09e345d175a5dd6535a69db12429072ddc453874792b75446370fc4eb196a1": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dnf-4.6.1-1.fc34.noarch.rpm",
         "sha256:d8aa8d1e0db5f32658af8c236f06853421e4bd4618f86c9e05e121b9b805b0dc": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dnf-data-4.6.1-1.fc34.noarch.rpm",
@@ -529,6 +549,8 @@
         "sha256:5ed9093c6368733f9aecfe56b029246929047c1de33ca035fbcd0c210bae4051": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lorax-34.9-5.fc34.x86_64.rpm",
         "sha256:b14d332c9d9fd66afeb9c3064db3955b7667f4cf3e85d7f76439eeba63fff488": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lorax-templates-generic-34.9-5.fc34.x86_64.rpm",
         "sha256:1a2aaf60c22453df0c306a5618aca20a2ce19090525445037a667f468b8ceaab": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lua-libs-5.4.2-2.fc34.x86_64.rpm",
+        "sha256:6b215bdf0227e676436a3056969d68acbd329ee3fcccb46873fee31d6f1bafe8": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lvm2-2.03.11-1.fc34.x86_64.rpm",
+        "sha256:b4c0a61643aa825845887cf39f780fa2862f629f980c095704c059b5418dba20": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lvm2-libs-2.03.11-1.fc34.x86_64.rpm",
         "sha256:da676955f475492f17c573bc526d47c37e34919d2a6ed33ec4573a4de0cab2a7": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lz4-libs-1.9.3-2.fc34.x86_64.rpm",
         "sha256:ba2916d48b3a28e9bc2c9fbde19770c204b6ad4cdc94471c3c6bdbfbe8669461": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lzo-2.10-4.fc34.x86_64.rpm",
         "sha256:0214ae16ef6a92843a4973aeda93db85584ad7840b1dd6e225bc57b594f58961": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/m/memstrack-0.2.2-1.fc34.x86_64.rpm",
diff --git a/test/data/stages/mkdir/b.json b/test/data/stages/mkdir/b.json
index 64ac91fa..0830a072 100644
--- a/test/data/stages/mkdir/b.json
+++ b/test/data/stages/mkdir/b.json
@@ -21,6 +21,7 @@
                 "sha256:96b69aefaddfebbac3f9b6361b01cc71196e604a56fd9a6236317e63fb68664a": {},
                 "sha256:9a698a5991a08e23e87b4bce2f3e447eafdc7fd4d84a49d91c65c6045ead1e8e": {},
                 "sha256:bc66918c24175415a0f65803bccbb3d796d733acd319577a2417371a178ce193": {},
+                "sha256:d23395e2614654c4cb717ec29cba2e61beec36bf815e74729ada20be41633caa": {},
                 "sha256:775b1498ba72e9d05a1c131fdbc2f4aabb8fd00d9c7c13ab996154e99660f92b": {},
                 "sha256:29cf7e97d6476fcfe80088a4c9cbc113d9b73e37dc9ec34967a958cef2d04e0c": {},
                 "sha256:9bff70d51ecec129854ef62d82204db3e01706c444b966cb048bc7fd8ec8b524": {},
@@ -37,7 +38,10 @@
                 "sha256:b2ffc9785842ccc76ca187d8b922fb3b91da2257341fb115ed6bdbfedb24c1eb": {},
                 "sha256:f8b418b88b30d28c911d26f6f0b9c1ede8be00fa71d28c789328dfd7c58eea67": {},
                 "sha256:5fb88eb681e996ab2199251a68c79b2797fa03d31a36dae698de393b85e1f89e": {},
+                "sha256:a657bd57bcdee99766d2076ec3b751f96670794c3dc10e20b94f917be4018281": {},
+                "sha256:7f1001c3e61932f826b3c7f87bf20efe79cd9a797f3598613c10cd1e6a49961c": {},
                 "sha256:f5f5c988604aa5c870eee7efff6d40f26acb908cf82991d762ade18c8b46aff6": {},
+                "sha256:2ad21916943c245819c1586f2841673c35f73c38bc0bbfa24e7c4f3892d73d28": {},
                 "sha256:c58752e2529cf0ea4aabb0476ef53ca7748091aa936513affc1245928ae5b1b8": {},
                 "sha256:be09e345d175a5dd6535a69db12429072ddc453874792b75446370fc4eb196a1": {},
                 "sha256:d8aa8d1e0db5f32658af8c236f06853421e4bd4618f86c9e05e121b9b805b0dc": {},
@@ -195,6 +199,8 @@
                 "sha256:5ed9093c6368733f9aecfe56b029246929047c1de33ca035fbcd0c210bae4051": {},
                 "sha256:b14d332c9d9fd66afeb9c3064db3955b7667f4cf3e85d7f76439eeba63fff488": {},
                 "sha256:1a2aaf60c22453df0c306a5618aca20a2ce19090525445037a667f468b8ceaab": {},
+                "sha256:6b215bdf0227e676436a3056969d68acbd329ee3fcccb46873fee31d6f1bafe8": {},
+                "sha256:b4c0a61643aa825845887cf39f780fa2862f629f980c095704c059b5418dba20": {},
                 "sha256:da676955f475492f17c573bc526d47c37e34919d2a6ed33ec4573a4de0cab2a7": {},
                 "sha256:ba2916d48b3a28e9bc2c9fbde19770c204b6ad4cdc94471c3c6bdbfbe8669461": {},
                 "sha256:0214ae16ef6a92843a4973aeda93db85584ad7840b1dd6e225bc57b594f58961": {},
@@ -323,6 +329,16 @@
               "docs": true
             }
           }
+        },
+        {
+          "type": "org.osbuild.selinux",
+          "options": {
+            "file_contexts": "etc/selinux/targeted/contexts/files/file_contexts",
+            "labels": {
+              "/usr/bin/cp": "system_u:object_r:install_exec_t:s0",
+              "/usr/bin/tar": "system_u:object_r:install_exec_t:s0"
+            }
+          }
         }
       ]
     },
@@ -363,6 +379,7 @@
         "sha256:96b69aefaddfebbac3f9b6361b01cc71196e604a56fd9a6236317e63fb68664a": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/b/bubblewrap-0.4.1-3.fc34.x86_64.rpm",
         "sha256:9a698a5991a08e23e87b4bce2f3e447eafdc7fd4d84a49d91c65c6045ead1e8e": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/b/bzip2-libs-1.0.8-6.fc34.x86_64.rpm",
         "sha256:bc66918c24175415a0f65803bccbb3d796d733acd319577a2417371a178ce193": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/ca-certificates-2020.2.41-7.fc34.noarch.rpm",
+        "sha256:d23395e2614654c4cb717ec29cba2e61beec36bf815e74729ada20be41633caa": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/compat-readline5-5.2-39.fc34.x86_64.rpm",
         "sha256:775b1498ba72e9d05a1c131fdbc2f4aabb8fd00d9c7c13ab996154e99660f92b": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/coreutils-8.32-21.fc34.x86_64.rpm",
         "sha256:29cf7e97d6476fcfe80088a4c9cbc113d9b73e37dc9ec34967a958cef2d04e0c": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/coreutils-common-8.32-21.fc34.x86_64.rpm",
         "sha256:9bff70d51ecec129854ef62d82204db3e01706c444b966cb048bc7fd8ec8b524": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/cpio-2.13-10.fc34.x86_64.rpm",
@@ -379,7 +396,10 @@
         "sha256:b2ffc9785842ccc76ca187d8b922fb3b91da2257341fb115ed6bdbfedb24c1eb": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dbus-libs-1.12.20-3.fc34.x86_64.rpm",
         "sha256:f8b418b88b30d28c911d26f6f0b9c1ede8be00fa71d28c789328dfd7c58eea67": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/deltarpm-3.6.2-8.fc34.x86_64.rpm",
         "sha256:5fb88eb681e996ab2199251a68c79b2797fa03d31a36dae698de393b85e1f89e": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:a657bd57bcdee99766d2076ec3b751f96670794c3dc10e20b94f917be4018281": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-event-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:7f1001c3e61932f826b3c7f87bf20efe79cd9a797f3598613c10cd1e6a49961c": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-event-libs-1.02.175-1.fc34.x86_64.rpm",
         "sha256:f5f5c988604aa5c870eee7efff6d40f26acb908cf82991d762ade18c8b46aff6": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-libs-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:2ad21916943c245819c1586f2841673c35f73c38bc0bbfa24e7c4f3892d73d28": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-persistent-data-0.9.0-3.fc34.x86_64.rpm",
         "sha256:c58752e2529cf0ea4aabb0476ef53ca7748091aa936513affc1245928ae5b1b8": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/diffutils-3.7-8.fc34.x86_64.rpm",
         "sha256:be09e345d175a5dd6535a69db12429072ddc453874792b75446370fc4eb196a1": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dnf-4.6.1-1.fc34.noarch.rpm",
         "sha256:d8aa8d1e0db5f32658af8c236f06853421e4bd4618f86c9e05e121b9b805b0dc": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dnf-data-4.6.1-1.fc34.noarch.rpm",
@@ -537,6 +557,8 @@
         "sha256:5ed9093c6368733f9aecfe56b029246929047c1de33ca035fbcd0c210bae4051": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lorax-34.9-5.fc34.x86_64.rpm",
         "sha256:b14d332c9d9fd66afeb9c3064db3955b7667f4cf3e85d7f76439eeba63fff488": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lorax-templates-generic-34.9-5.fc34.x86_64.rpm",
         "sha256:1a2aaf60c22453df0c306a5618aca20a2ce19090525445037a667f468b8ceaab": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lua-libs-5.4.2-2.fc34.x86_64.rpm",
+        "sha256:6b215bdf0227e676436a3056969d68acbd329ee3fcccb46873fee31d6f1bafe8": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lvm2-2.03.11-1.fc34.x86_64.rpm",
+        "sha256:b4c0a61643aa825845887cf39f780fa2862f629f980c095704c059b5418dba20": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lvm2-libs-2.03.11-1.fc34.x86_64.rpm",
         "sha256:da676955f475492f17c573bc526d47c37e34919d2a6ed33ec4573a4de0cab2a7": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lz4-libs-1.9.3-2.fc34.x86_64.rpm",
         "sha256:ba2916d48b3a28e9bc2c9fbde19770c204b6ad4cdc94471c3c6bdbfbe8669461": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lzo-2.10-4.fc34.x86_64.rpm",
         "sha256:0214ae16ef6a92843a4973aeda93db85584ad7840b1dd6e225bc57b594f58961": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/m/memstrack-0.2.2-1.fc34.x86_64.rpm",
diff --git a/test/data/stages/nginx.conf/a.json b/test/data/stages/nginx.conf/a.json
index 9b156010..326b124e 100644
--- a/test/data/stages/nginx.conf/a.json
+++ b/test/data/stages/nginx.conf/a.json
@@ -21,6 +21,7 @@
                 "sha256:96b69aefaddfebbac3f9b6361b01cc71196e604a56fd9a6236317e63fb68664a": {},
                 "sha256:9a698a5991a08e23e87b4bce2f3e447eafdc7fd4d84a49d91c65c6045ead1e8e": {},
                 "sha256:bc66918c24175415a0f65803bccbb3d796d733acd319577a2417371a178ce193": {},
+                "sha256:d23395e2614654c4cb717ec29cba2e61beec36bf815e74729ada20be41633caa": {},
                 "sha256:775b1498ba72e9d05a1c131fdbc2f4aabb8fd00d9c7c13ab996154e99660f92b": {},
                 "sha256:29cf7e97d6476fcfe80088a4c9cbc113d9b73e37dc9ec34967a958cef2d04e0c": {},
                 "sha256:9bff70d51ecec129854ef62d82204db3e01706c444b966cb048bc7fd8ec8b524": {},
@@ -37,7 +38,10 @@
                 "sha256:b2ffc9785842ccc76ca187d8b922fb3b91da2257341fb115ed6bdbfedb24c1eb": {},
                 "sha256:f8b418b88b30d28c911d26f6f0b9c1ede8be00fa71d28c789328dfd7c58eea67": {},
                 "sha256:5fb88eb681e996ab2199251a68c79b2797fa03d31a36dae698de393b85e1f89e": {},
+                "sha256:a657bd57bcdee99766d2076ec3b751f96670794c3dc10e20b94f917be4018281": {},
+                "sha256:7f1001c3e61932f826b3c7f87bf20efe79cd9a797f3598613c10cd1e6a49961c": {},
                 "sha256:f5f5c988604aa5c870eee7efff6d40f26acb908cf82991d762ade18c8b46aff6": {},
+                "sha256:2ad21916943c245819c1586f2841673c35f73c38bc0bbfa24e7c4f3892d73d28": {},
                 "sha256:c58752e2529cf0ea4aabb0476ef53ca7748091aa936513affc1245928ae5b1b8": {},
                 "sha256:be09e345d175a5dd6535a69db12429072ddc453874792b75446370fc4eb196a1": {},
                 "sha256:d8aa8d1e0db5f32658af8c236f06853421e4bd4618f86c9e05e121b9b805b0dc": {},
@@ -195,6 +199,8 @@
                 "sha256:5ed9093c6368733f9aecfe56b029246929047c1de33ca035fbcd0c210bae4051": {},
                 "sha256:b14d332c9d9fd66afeb9c3064db3955b7667f4cf3e85d7f76439eeba63fff488": {},
                 "sha256:1a2aaf60c22453df0c306a5618aca20a2ce19090525445037a667f468b8ceaab": {},
+                "sha256:6b215bdf0227e676436a3056969d68acbd329ee3fcccb46873fee31d6f1bafe8": {},
+                "sha256:b4c0a61643aa825845887cf39f780fa2862f629f980c095704c059b5418dba20": {},
                 "sha256:da676955f475492f17c573bc526d47c37e34919d2a6ed33ec4573a4de0cab2a7": {},
                 "sha256:ba2916d48b3a28e9bc2c9fbde19770c204b6ad4cdc94471c3c6bdbfbe8669461": {},
                 "sha256:0214ae16ef6a92843a4973aeda93db85584ad7840b1dd6e225bc57b594f58961": {},
@@ -323,6 +329,16 @@
               "docs": true
             }
           }
+        },
+        {
+          "type": "org.osbuild.selinux",
+          "options": {
+            "file_contexts": "etc/selinux/targeted/contexts/files/file_contexts",
+            "labels": {
+              "/usr/bin/cp": "system_u:object_r:install_exec_t:s0",
+              "/usr/bin/tar": "system_u:object_r:install_exec_t:s0"
+            }
+          }
         }
       ]
     },
@@ -540,6 +556,7 @@
         "sha256:96b69aefaddfebbac3f9b6361b01cc71196e604a56fd9a6236317e63fb68664a": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/b/bubblewrap-0.4.1-3.fc34.x86_64.rpm",
         "sha256:9a698a5991a08e23e87b4bce2f3e447eafdc7fd4d84a49d91c65c6045ead1e8e": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/b/bzip2-libs-1.0.8-6.fc34.x86_64.rpm",
         "sha256:bc66918c24175415a0f65803bccbb3d796d733acd319577a2417371a178ce193": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/ca-certificates-2020.2.41-7.fc34.noarch.rpm",
+        "sha256:d23395e2614654c4cb717ec29cba2e61beec36bf815e74729ada20be41633caa": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/compat-readline5-5.2-39.fc34.x86_64.rpm",
         "sha256:775b1498ba72e9d05a1c131fdbc2f4aabb8fd00d9c7c13ab996154e99660f92b": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/coreutils-8.32-21.fc34.x86_64.rpm",
         "sha256:29cf7e97d6476fcfe80088a4c9cbc113d9b73e37dc9ec34967a958cef2d04e0c": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/coreutils-common-8.32-21.fc34.x86_64.rpm",
         "sha256:9bff70d51ecec129854ef62d82204db3e01706c444b966cb048bc7fd8ec8b524": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/cpio-2.13-10.fc34.x86_64.rpm",
@@ -556,7 +573,10 @@
         "sha256:b2ffc9785842ccc76ca187d8b922fb3b91da2257341fb115ed6bdbfedb24c1eb": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dbus-libs-1.12.20-3.fc34.x86_64.rpm",
         "sha256:f8b418b88b30d28c911d26f6f0b9c1ede8be00fa71d28c789328dfd7c58eea67": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/deltarpm-3.6.2-8.fc34.x86_64.rpm",
         "sha256:5fb88eb681e996ab2199251a68c79b2797fa03d31a36dae698de393b85e1f89e": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:a657bd57bcdee99766d2076ec3b751f96670794c3dc10e20b94f917be4018281": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-event-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:7f1001c3e61932f826b3c7f87bf20efe79cd9a797f3598613c10cd1e6a49961c": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-event-libs-1.02.175-1.fc34.x86_64.rpm",
         "sha256:f5f5c988604aa5c870eee7efff6d40f26acb908cf82991d762ade18c8b46aff6": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-libs-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:2ad21916943c245819c1586f2841673c35f73c38bc0bbfa24e7c4f3892d73d28": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-persistent-data-0.9.0-3.fc34.x86_64.rpm",
         "sha256:c58752e2529cf0ea4aabb0476ef53ca7748091aa936513affc1245928ae5b1b8": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/diffutils-3.7-8.fc34.x86_64.rpm",
         "sha256:be09e345d175a5dd6535a69db12429072ddc453874792b75446370fc4eb196a1": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dnf-4.6.1-1.fc34.noarch.rpm",
         "sha256:d8aa8d1e0db5f32658af8c236f06853421e4bd4618f86c9e05e121b9b805b0dc": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dnf-data-4.6.1-1.fc34.noarch.rpm",
@@ -721,6 +741,8 @@
         "sha256:5ed9093c6368733f9aecfe56b029246929047c1de33ca035fbcd0c210bae4051": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lorax-34.9-5.fc34.x86_64.rpm",
         "sha256:b14d332c9d9fd66afeb9c3064db3955b7667f4cf3e85d7f76439eeba63fff488": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lorax-templates-generic-34.9-5.fc34.x86_64.rpm",
         "sha256:1a2aaf60c22453df0c306a5618aca20a2ce19090525445037a667f468b8ceaab": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lua-libs-5.4.2-2.fc34.x86_64.rpm",
+        "sha256:6b215bdf0227e676436a3056969d68acbd329ee3fcccb46873fee31d6f1bafe8": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lvm2-2.03.11-1.fc34.x86_64.rpm",
+        "sha256:b4c0a61643aa825845887cf39f780fa2862f629f980c095704c059b5418dba20": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lvm2-libs-2.03.11-1.fc34.x86_64.rpm",
         "sha256:da676955f475492f17c573bc526d47c37e34919d2a6ed33ec4573a4de0cab2a7": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lz4-libs-1.9.3-2.fc34.x86_64.rpm",
         "sha256:ba2916d48b3a28e9bc2c9fbde19770c204b6ad4cdc94471c3c6bdbfbe8669461": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lzo-2.10-4.fc34.x86_64.rpm",
         "sha256:0214ae16ef6a92843a4973aeda93db85584ad7840b1dd6e225bc57b594f58961": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/m/memstrack-0.2.2-1.fc34.x86_64.rpm",
diff --git a/test/data/stages/nginx.conf/b.json b/test/data/stages/nginx.conf/b.json
index 495c23b7..ed2efb30 100644
--- a/test/data/stages/nginx.conf/b.json
+++ b/test/data/stages/nginx.conf/b.json
@@ -21,6 +21,7 @@
                 "sha256:96b69aefaddfebbac3f9b6361b01cc71196e604a56fd9a6236317e63fb68664a": {},
                 "sha256:9a698a5991a08e23e87b4bce2f3e447eafdc7fd4d84a49d91c65c6045ead1e8e": {},
                 "sha256:bc66918c24175415a0f65803bccbb3d796d733acd319577a2417371a178ce193": {},
+                "sha256:d23395e2614654c4cb717ec29cba2e61beec36bf815e74729ada20be41633caa": {},
                 "sha256:775b1498ba72e9d05a1c131fdbc2f4aabb8fd00d9c7c13ab996154e99660f92b": {},
                 "sha256:29cf7e97d6476fcfe80088a4c9cbc113d9b73e37dc9ec34967a958cef2d04e0c": {},
                 "sha256:9bff70d51ecec129854ef62d82204db3e01706c444b966cb048bc7fd8ec8b524": {},
@@ -37,7 +38,10 @@
                 "sha256:b2ffc9785842ccc76ca187d8b922fb3b91da2257341fb115ed6bdbfedb24c1eb": {},
                 "sha256:f8b418b88b30d28c911d26f6f0b9c1ede8be00fa71d28c789328dfd7c58eea67": {},
                 "sha256:5fb88eb681e996ab2199251a68c79b2797fa03d31a36dae698de393b85e1f89e": {},
+                "sha256:a657bd57bcdee99766d2076ec3b751f96670794c3dc10e20b94f917be4018281": {},
+                "sha256:7f1001c3e61932f826b3c7f87bf20efe79cd9a797f3598613c10cd1e6a49961c": {},
                 "sha256:f5f5c988604aa5c870eee7efff6d40f26acb908cf82991d762ade18c8b46aff6": {},
+                "sha256:2ad21916943c245819c1586f2841673c35f73c38bc0bbfa24e7c4f3892d73d28": {},
                 "sha256:c58752e2529cf0ea4aabb0476ef53ca7748091aa936513affc1245928ae5b1b8": {},
                 "sha256:be09e345d175a5dd6535a69db12429072ddc453874792b75446370fc4eb196a1": {},
                 "sha256:d8aa8d1e0db5f32658af8c236f06853421e4bd4618f86c9e05e121b9b805b0dc": {},
@@ -195,6 +199,8 @@
                 "sha256:5ed9093c6368733f9aecfe56b029246929047c1de33ca035fbcd0c210bae4051": {},
                 "sha256:b14d332c9d9fd66afeb9c3064db3955b7667f4cf3e85d7f76439eeba63fff488": {},
                 "sha256:1a2aaf60c22453df0c306a5618aca20a2ce19090525445037a667f468b8ceaab": {},
+                "sha256:6b215bdf0227e676436a3056969d68acbd329ee3fcccb46873fee31d6f1bafe8": {},
+                "sha256:b4c0a61643aa825845887cf39f780fa2862f629f980c095704c059b5418dba20": {},
                 "sha256:da676955f475492f17c573bc526d47c37e34919d2a6ed33ec4573a4de0cab2a7": {},
                 "sha256:ba2916d48b3a28e9bc2c9fbde19770c204b6ad4cdc94471c3c6bdbfbe8669461": {},
                 "sha256:0214ae16ef6a92843a4973aeda93db85584ad7840b1dd6e225bc57b594f58961": {},
@@ -323,6 +329,16 @@
               "docs": true
             }
           }
+        },
+        {
+          "type": "org.osbuild.selinux",
+          "options": {
+            "file_contexts": "etc/selinux/targeted/contexts/files/file_contexts",
+            "labels": {
+              "/usr/bin/cp": "system_u:object_r:install_exec_t:s0",
+              "/usr/bin/tar": "system_u:object_r:install_exec_t:s0"
+            }
+          }
         }
       ]
     },
@@ -552,6 +568,7 @@
         "sha256:96b69aefaddfebbac3f9b6361b01cc71196e604a56fd9a6236317e63fb68664a": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/b/bubblewrap-0.4.1-3.fc34.x86_64.rpm",
         "sha256:9a698a5991a08e23e87b4bce2f3e447eafdc7fd4d84a49d91c65c6045ead1e8e": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/b/bzip2-libs-1.0.8-6.fc34.x86_64.rpm",
         "sha256:bc66918c24175415a0f65803bccbb3d796d733acd319577a2417371a178ce193": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/ca-certificates-2020.2.41-7.fc34.noarch.rpm",
+        "sha256:d23395e2614654c4cb717ec29cba2e61beec36bf815e74729ada20be41633caa": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/compat-readline5-5.2-39.fc34.x86_64.rpm",
         "sha256:775b1498ba72e9d05a1c131fdbc2f4aabb8fd00d9c7c13ab996154e99660f92b": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/coreutils-8.32-21.fc34.x86_64.rpm",
         "sha256:29cf7e97d6476fcfe80088a4c9cbc113d9b73e37dc9ec34967a958cef2d04e0c": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/coreutils-common-8.32-21.fc34.x86_64.rpm",
         "sha256:9bff70d51ecec129854ef62d82204db3e01706c444b966cb048bc7fd8ec8b524": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/cpio-2.13-10.fc34.x86_64.rpm",
@@ -568,7 +585,10 @@
         "sha256:b2ffc9785842ccc76ca187d8b922fb3b91da2257341fb115ed6bdbfedb24c1eb": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dbus-libs-1.12.20-3.fc34.x86_64.rpm",
         "sha256:f8b418b88b30d28c911d26f6f0b9c1ede8be00fa71d28c789328dfd7c58eea67": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/deltarpm-3.6.2-8.fc34.x86_64.rpm",
         "sha256:5fb88eb681e996ab2199251a68c79b2797fa03d31a36dae698de393b85e1f89e": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:a657bd57bcdee99766d2076ec3b751f96670794c3dc10e20b94f917be4018281": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-event-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:7f1001c3e61932f826b3c7f87bf20efe79cd9a797f3598613c10cd1e6a49961c": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-event-libs-1.02.175-1.fc34.x86_64.rpm",
         "sha256:f5f5c988604aa5c870eee7efff6d40f26acb908cf82991d762ade18c8b46aff6": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-libs-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:2ad21916943c245819c1586f2841673c35f73c38bc0bbfa24e7c4f3892d73d28": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-persistent-data-0.9.0-3.fc34.x86_64.rpm",
         "sha256:c58752e2529cf0ea4aabb0476ef53ca7748091aa936513affc1245928ae5b1b8": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/diffutils-3.7-8.fc34.x86_64.rpm",
         "sha256:be09e345d175a5dd6535a69db12429072ddc453874792b75446370fc4eb196a1": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dnf-4.6.1-1.fc34.noarch.rpm",
         "sha256:d8aa8d1e0db5f32658af8c236f06853421e4bd4618f86c9e05e121b9b805b0dc": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dnf-data-4.6.1-1.fc34.noarch.rpm",
@@ -733,6 +753,8 @@
         "sha256:5ed9093c6368733f9aecfe56b029246929047c1de33ca035fbcd0c210bae4051": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lorax-34.9-5.fc34.x86_64.rpm",
         "sha256:b14d332c9d9fd66afeb9c3064db3955b7667f4cf3e85d7f76439eeba63fff488": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lorax-templates-generic-34.9-5.fc34.x86_64.rpm",
         "sha256:1a2aaf60c22453df0c306a5618aca20a2ce19090525445037a667f468b8ceaab": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lua-libs-5.4.2-2.fc34.x86_64.rpm",
+        "sha256:6b215bdf0227e676436a3056969d68acbd329ee3fcccb46873fee31d6f1bafe8": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lvm2-2.03.11-1.fc34.x86_64.rpm",
+        "sha256:b4c0a61643aa825845887cf39f780fa2862f629f980c095704c059b5418dba20": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lvm2-libs-2.03.11-1.fc34.x86_64.rpm",
         "sha256:da676955f475492f17c573bc526d47c37e34919d2a6ed33ec4573a4de0cab2a7": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lz4-libs-1.9.3-2.fc34.x86_64.rpm",
         "sha256:ba2916d48b3a28e9bc2c9fbde19770c204b6ad4cdc94471c3c6bdbfbe8669461": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lzo-2.10-4.fc34.x86_64.rpm",
         "sha256:0214ae16ef6a92843a4973aeda93db85584ad7840b1dd6e225bc57b594f58961": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/m/memstrack-0.2.2-1.fc34.x86_64.rpm",
diff --git a/test/data/stages/tar/tar.json b/test/data/stages/tar/tar.json
index d703f56c..4ea89b17 100644
--- a/test/data/stages/tar/tar.json
+++ b/test/data/stages/tar/tar.json
@@ -20,6 +20,7 @@
         "sha256:96b69aefaddfebbac3f9b6361b01cc71196e604a56fd9a6236317e63fb68664a": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/b/bubblewrap-0.4.1-3.fc34.x86_64.rpm",
         "sha256:9a698a5991a08e23e87b4bce2f3e447eafdc7fd4d84a49d91c65c6045ead1e8e": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/b/bzip2-libs-1.0.8-6.fc34.x86_64.rpm",
         "sha256:bc66918c24175415a0f65803bccbb3d796d733acd319577a2417371a178ce193": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/ca-certificates-2020.2.41-7.fc34.noarch.rpm",
+        "sha256:d23395e2614654c4cb717ec29cba2e61beec36bf815e74729ada20be41633caa": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/compat-readline5-5.2-39.fc34.x86_64.rpm",
         "sha256:775b1498ba72e9d05a1c131fdbc2f4aabb8fd00d9c7c13ab996154e99660f92b": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/coreutils-8.32-21.fc34.x86_64.rpm",
         "sha256:29cf7e97d6476fcfe80088a4c9cbc113d9b73e37dc9ec34967a958cef2d04e0c": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/coreutils-common-8.32-21.fc34.x86_64.rpm",
         "sha256:9bff70d51ecec129854ef62d82204db3e01706c444b966cb048bc7fd8ec8b524": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/cpio-2.13-10.fc34.x86_64.rpm",
@@ -36,7 +37,10 @@
         "sha256:b2ffc9785842ccc76ca187d8b922fb3b91da2257341fb115ed6bdbfedb24c1eb": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dbus-libs-1.12.20-3.fc34.x86_64.rpm",
         "sha256:f8b418b88b30d28c911d26f6f0b9c1ede8be00fa71d28c789328dfd7c58eea67": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/deltarpm-3.6.2-8.fc34.x86_64.rpm",
         "sha256:5fb88eb681e996ab2199251a68c79b2797fa03d31a36dae698de393b85e1f89e": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:a657bd57bcdee99766d2076ec3b751f96670794c3dc10e20b94f917be4018281": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-event-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:7f1001c3e61932f826b3c7f87bf20efe79cd9a797f3598613c10cd1e6a49961c": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-event-libs-1.02.175-1.fc34.x86_64.rpm",
         "sha256:f5f5c988604aa5c870eee7efff6d40f26acb908cf82991d762ade18c8b46aff6": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-libs-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:2ad21916943c245819c1586f2841673c35f73c38bc0bbfa24e7c4f3892d73d28": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-persistent-data-0.9.0-3.fc34.x86_64.rpm",
         "sha256:c58752e2529cf0ea4aabb0476ef53ca7748091aa936513affc1245928ae5b1b8": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/diffutils-3.7-8.fc34.x86_64.rpm",
         "sha256:be09e345d175a5dd6535a69db12429072ddc453874792b75446370fc4eb196a1": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dnf-4.6.1-1.fc34.noarch.rpm",
         "sha256:d8aa8d1e0db5f32658af8c236f06853421e4bd4618f86c9e05e121b9b805b0dc": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dnf-data-4.6.1-1.fc34.noarch.rpm",
@@ -194,6 +198,8 @@
         "sha256:5ed9093c6368733f9aecfe56b029246929047c1de33ca035fbcd0c210bae4051": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lorax-34.9-5.fc34.x86_64.rpm",
         "sha256:b14d332c9d9fd66afeb9c3064db3955b7667f4cf3e85d7f76439eeba63fff488": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lorax-templates-generic-34.9-5.fc34.x86_64.rpm",
         "sha256:1a2aaf60c22453df0c306a5618aca20a2ce19090525445037a667f468b8ceaab": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lua-libs-5.4.2-2.fc34.x86_64.rpm",
+        "sha256:6b215bdf0227e676436a3056969d68acbd329ee3fcccb46873fee31d6f1bafe8": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lvm2-2.03.11-1.fc34.x86_64.rpm",
+        "sha256:b4c0a61643aa825845887cf39f780fa2862f629f980c095704c059b5418dba20": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lvm2-libs-2.03.11-1.fc34.x86_64.rpm",
         "sha256:da676955f475492f17c573bc526d47c37e34919d2a6ed33ec4573a4de0cab2a7": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lz4-libs-1.9.3-2.fc34.x86_64.rpm",
         "sha256:ba2916d48b3a28e9bc2c9fbde19770c204b6ad4cdc94471c3c6bdbfbe8669461": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lzo-2.10-4.fc34.x86_64.rpm",
         "sha256:0214ae16ef6a92843a4973aeda93db85584ad7840b1dd6e225bc57b594f58961": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/m/memstrack-0.2.2-1.fc34.x86_64.rpm",
@@ -335,6 +341,7 @@
                 "sha256:96b69aefaddfebbac3f9b6361b01cc71196e604a56fd9a6236317e63fb68664a": {},
                 "sha256:9a698a5991a08e23e87b4bce2f3e447eafdc7fd4d84a49d91c65c6045ead1e8e": {},
                 "sha256:bc66918c24175415a0f65803bccbb3d796d733acd319577a2417371a178ce193": {},
+                "sha256:d23395e2614654c4cb717ec29cba2e61beec36bf815e74729ada20be41633caa": {},
                 "sha256:775b1498ba72e9d05a1c131fdbc2f4aabb8fd00d9c7c13ab996154e99660f92b": {},
                 "sha256:29cf7e97d6476fcfe80088a4c9cbc113d9b73e37dc9ec34967a958cef2d04e0c": {},
                 "sha256:9bff70d51ecec129854ef62d82204db3e01706c444b966cb048bc7fd8ec8b524": {},
@@ -351,7 +358,10 @@
                 "sha256:b2ffc9785842ccc76ca187d8b922fb3b91da2257341fb115ed6bdbfedb24c1eb": {},
                 "sha256:f8b418b88b30d28c911d26f6f0b9c1ede8be00fa71d28c789328dfd7c58eea67": {},
                 "sha256:5fb88eb681e996ab2199251a68c79b2797fa03d31a36dae698de393b85e1f89e": {},
+                "sha256:a657bd57bcdee99766d2076ec3b751f96670794c3dc10e20b94f917be4018281": {},
+                "sha256:7f1001c3e61932f826b3c7f87bf20efe79cd9a797f3598613c10cd1e6a49961c": {},
                 "sha256:f5f5c988604aa5c870eee7efff6d40f26acb908cf82991d762ade18c8b46aff6": {},
+                "sha256:2ad21916943c245819c1586f2841673c35f73c38bc0bbfa24e7c4f3892d73d28": {},
                 "sha256:c58752e2529cf0ea4aabb0476ef53ca7748091aa936513affc1245928ae5b1b8": {},
                 "sha256:be09e345d175a5dd6535a69db12429072ddc453874792b75446370fc4eb196a1": {},
                 "sha256:d8aa8d1e0db5f32658af8c236f06853421e4bd4618f86c9e05e121b9b805b0dc": {},
@@ -509,6 +519,8 @@
                 "sha256:5ed9093c6368733f9aecfe56b029246929047c1de33ca035fbcd0c210bae4051": {},
                 "sha256:b14d332c9d9fd66afeb9c3064db3955b7667f4cf3e85d7f76439eeba63fff488": {},
                 "sha256:1a2aaf60c22453df0c306a5618aca20a2ce19090525445037a667f468b8ceaab": {},
+                "sha256:6b215bdf0227e676436a3056969d68acbd329ee3fcccb46873fee31d6f1bafe8": {},
+                "sha256:b4c0a61643aa825845887cf39f780fa2862f629f980c095704c059b5418dba20": {},
                 "sha256:da676955f475492f17c573bc526d47c37e34919d2a6ed33ec4573a4de0cab2a7": {},
                 "sha256:ba2916d48b3a28e9bc2c9fbde19770c204b6ad4cdc94471c3c6bdbfbe8669461": {},
                 "sha256:0214ae16ef6a92843a4973aeda93db85584ad7840b1dd6e225bc57b594f58961": {},
@@ -637,6 +649,16 @@
               "docs": true
             }
           }
+        },
+        {
+          "type": "org.osbuild.selinux",
+          "options": {
+            "file_contexts": "etc/selinux/targeted/contexts/files/file_contexts",
+            "labels": {
+              "/usr/bin/cp": "system_u:object_r:install_exec_t:s0",
+              "/usr/bin/tar": "system_u:object_r:install_exec_t:s0"
+            }
+          }
         }
       ]
     },
diff --git a/test/data/stages/untar/a.json b/test/data/stages/untar/a.json
index c49d9956..b0bedbb4 100644
--- a/test/data/stages/untar/a.json
+++ b/test/data/stages/untar/a.json
@@ -21,6 +21,7 @@
                 "sha256:96b69aefaddfebbac3f9b6361b01cc71196e604a56fd9a6236317e63fb68664a": {},
                 "sha256:9a698a5991a08e23e87b4bce2f3e447eafdc7fd4d84a49d91c65c6045ead1e8e": {},
                 "sha256:bc66918c24175415a0f65803bccbb3d796d733acd319577a2417371a178ce193": {},
+                "sha256:d23395e2614654c4cb717ec29cba2e61beec36bf815e74729ada20be41633caa": {},
                 "sha256:775b1498ba72e9d05a1c131fdbc2f4aabb8fd00d9c7c13ab996154e99660f92b": {},
                 "sha256:29cf7e97d6476fcfe80088a4c9cbc113d9b73e37dc9ec34967a958cef2d04e0c": {},
                 "sha256:9bff70d51ecec129854ef62d82204db3e01706c444b966cb048bc7fd8ec8b524": {},
@@ -37,7 +38,10 @@
                 "sha256:b2ffc9785842ccc76ca187d8b922fb3b91da2257341fb115ed6bdbfedb24c1eb": {},
                 "sha256:f8b418b88b30d28c911d26f6f0b9c1ede8be00fa71d28c789328dfd7c58eea67": {},
                 "sha256:5fb88eb681e996ab2199251a68c79b2797fa03d31a36dae698de393b85e1f89e": {},
+                "sha256:a657bd57bcdee99766d2076ec3b751f96670794c3dc10e20b94f917be4018281": {},
+                "sha256:7f1001c3e61932f826b3c7f87bf20efe79cd9a797f3598613c10cd1e6a49961c": {},
                 "sha256:f5f5c988604aa5c870eee7efff6d40f26acb908cf82991d762ade18c8b46aff6": {},
+                "sha256:2ad21916943c245819c1586f2841673c35f73c38bc0bbfa24e7c4f3892d73d28": {},
                 "sha256:c58752e2529cf0ea4aabb0476ef53ca7748091aa936513affc1245928ae5b1b8": {},
                 "sha256:be09e345d175a5dd6535a69db12429072ddc453874792b75446370fc4eb196a1": {},
                 "sha256:d8aa8d1e0db5f32658af8c236f06853421e4bd4618f86c9e05e121b9b805b0dc": {},
@@ -195,6 +199,8 @@
                 "sha256:5ed9093c6368733f9aecfe56b029246929047c1de33ca035fbcd0c210bae4051": {},
                 "sha256:b14d332c9d9fd66afeb9c3064db3955b7667f4cf3e85d7f76439eeba63fff488": {},
                 "sha256:1a2aaf60c22453df0c306a5618aca20a2ce19090525445037a667f468b8ceaab": {},
+                "sha256:6b215bdf0227e676436a3056969d68acbd329ee3fcccb46873fee31d6f1bafe8": {},
+                "sha256:b4c0a61643aa825845887cf39f780fa2862f629f980c095704c059b5418dba20": {},
                 "sha256:da676955f475492f17c573bc526d47c37e34919d2a6ed33ec4573a4de0cab2a7": {},
                 "sha256:ba2916d48b3a28e9bc2c9fbde19770c204b6ad4cdc94471c3c6bdbfbe8669461": {},
                 "sha256:0214ae16ef6a92843a4973aeda93db85584ad7840b1dd6e225bc57b594f58961": {},
@@ -323,6 +329,16 @@
               "docs": true
             }
           }
+        },
+        {
+          "type": "org.osbuild.selinux",
+          "options": {
+            "file_contexts": "etc/selinux/targeted/contexts/files/file_contexts",
+            "labels": {
+              "/usr/bin/cp": "system_u:object_r:install_exec_t:s0",
+              "/usr/bin/tar": "system_u:object_r:install_exec_t:s0"
+            }
+          }
         }
       ]
     },
@@ -344,6 +360,7 @@
         "sha256:96b69aefaddfebbac3f9b6361b01cc71196e604a56fd9a6236317e63fb68664a": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/b/bubblewrap-0.4.1-3.fc34.x86_64.rpm",
         "sha256:9a698a5991a08e23e87b4bce2f3e447eafdc7fd4d84a49d91c65c6045ead1e8e": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/b/bzip2-libs-1.0.8-6.fc34.x86_64.rpm",
         "sha256:bc66918c24175415a0f65803bccbb3d796d733acd319577a2417371a178ce193": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/ca-certificates-2020.2.41-7.fc34.noarch.rpm",
+        "sha256:d23395e2614654c4cb717ec29cba2e61beec36bf815e74729ada20be41633caa": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/compat-readline5-5.2-39.fc34.x86_64.rpm",
         "sha256:775b1498ba72e9d05a1c131fdbc2f4aabb8fd00d9c7c13ab996154e99660f92b": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/coreutils-8.32-21.fc34.x86_64.rpm",
         "sha256:29cf7e97d6476fcfe80088a4c9cbc113d9b73e37dc9ec34967a958cef2d04e0c": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/coreutils-common-8.32-21.fc34.x86_64.rpm",
         "sha256:9bff70d51ecec129854ef62d82204db3e01706c444b966cb048bc7fd8ec8b524": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/cpio-2.13-10.fc34.x86_64.rpm",
@@ -360,7 +377,10 @@
         "sha256:b2ffc9785842ccc76ca187d8b922fb3b91da2257341fb115ed6bdbfedb24c1eb": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dbus-libs-1.12.20-3.fc34.x86_64.rpm",
         "sha256:f8b418b88b30d28c911d26f6f0b9c1ede8be00fa71d28c789328dfd7c58eea67": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/deltarpm-3.6.2-8.fc34.x86_64.rpm",
         "sha256:5fb88eb681e996ab2199251a68c79b2797fa03d31a36dae698de393b85e1f89e": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:a657bd57bcdee99766d2076ec3b751f96670794c3dc10e20b94f917be4018281": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-event-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:7f1001c3e61932f826b3c7f87bf20efe79cd9a797f3598613c10cd1e6a49961c": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-event-libs-1.02.175-1.fc34.x86_64.rpm",
         "sha256:f5f5c988604aa5c870eee7efff6d40f26acb908cf82991d762ade18c8b46aff6": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-libs-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:2ad21916943c245819c1586f2841673c35f73c38bc0bbfa24e7c4f3892d73d28": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-persistent-data-0.9.0-3.fc34.x86_64.rpm",
         "sha256:c58752e2529cf0ea4aabb0476ef53ca7748091aa936513affc1245928ae5b1b8": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/diffutils-3.7-8.fc34.x86_64.rpm",
         "sha256:be09e345d175a5dd6535a69db12429072ddc453874792b75446370fc4eb196a1": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dnf-4.6.1-1.fc34.noarch.rpm",
         "sha256:d8aa8d1e0db5f32658af8c236f06853421e4bd4618f86c9e05e121b9b805b0dc": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dnf-data-4.6.1-1.fc34.noarch.rpm",
@@ -518,6 +538,8 @@
         "sha256:5ed9093c6368733f9aecfe56b029246929047c1de33ca035fbcd0c210bae4051": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lorax-34.9-5.fc34.x86_64.rpm",
         "sha256:b14d332c9d9fd66afeb9c3064db3955b7667f4cf3e85d7f76439eeba63fff488": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lorax-templates-generic-34.9-5.fc34.x86_64.rpm",
         "sha256:1a2aaf60c22453df0c306a5618aca20a2ce19090525445037a667f468b8ceaab": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lua-libs-5.4.2-2.fc34.x86_64.rpm",
+        "sha256:6b215bdf0227e676436a3056969d68acbd329ee3fcccb46873fee31d6f1bafe8": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lvm2-2.03.11-1.fc34.x86_64.rpm",
+        "sha256:b4c0a61643aa825845887cf39f780fa2862f629f980c095704c059b5418dba20": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lvm2-libs-2.03.11-1.fc34.x86_64.rpm",
         "sha256:da676955f475492f17c573bc526d47c37e34919d2a6ed33ec4573a4de0cab2a7": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lz4-libs-1.9.3-2.fc34.x86_64.rpm",
         "sha256:ba2916d48b3a28e9bc2c9fbde19770c204b6ad4cdc94471c3c6bdbfbe8669461": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lzo-2.10-4.fc34.x86_64.rpm",
         "sha256:0214ae16ef6a92843a4973aeda93db85584ad7840b1dd6e225bc57b594f58961": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/m/memstrack-0.2.2-1.fc34.x86_64.rpm",
diff --git a/test/data/stages/untar/b.json b/test/data/stages/untar/b.json
index 1babbb58..08c857c4 100644
--- a/test/data/stages/untar/b.json
+++ b/test/data/stages/untar/b.json
@@ -20,6 +20,7 @@
         "sha256:96b69aefaddfebbac3f9b6361b01cc71196e604a56fd9a6236317e63fb68664a": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/b/bubblewrap-0.4.1-3.fc34.x86_64.rpm",
         "sha256:9a698a5991a08e23e87b4bce2f3e447eafdc7fd4d84a49d91c65c6045ead1e8e": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/b/bzip2-libs-1.0.8-6.fc34.x86_64.rpm",
         "sha256:bc66918c24175415a0f65803bccbb3d796d733acd319577a2417371a178ce193": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/ca-certificates-2020.2.41-7.fc34.noarch.rpm",
+        "sha256:d23395e2614654c4cb717ec29cba2e61beec36bf815e74729ada20be41633caa": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/compat-readline5-5.2-39.fc34.x86_64.rpm",
         "sha256:775b1498ba72e9d05a1c131fdbc2f4aabb8fd00d9c7c13ab996154e99660f92b": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/coreutils-8.32-21.fc34.x86_64.rpm",
         "sha256:29cf7e97d6476fcfe80088a4c9cbc113d9b73e37dc9ec34967a958cef2d04e0c": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/coreutils-common-8.32-21.fc34.x86_64.rpm",
         "sha256:9bff70d51ecec129854ef62d82204db3e01706c444b966cb048bc7fd8ec8b524": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/cpio-2.13-10.fc34.x86_64.rpm",
@@ -36,7 +37,10 @@
         "sha256:b2ffc9785842ccc76ca187d8b922fb3b91da2257341fb115ed6bdbfedb24c1eb": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dbus-libs-1.12.20-3.fc34.x86_64.rpm",
         "sha256:f8b418b88b30d28c911d26f6f0b9c1ede8be00fa71d28c789328dfd7c58eea67": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/deltarpm-3.6.2-8.fc34.x86_64.rpm",
         "sha256:5fb88eb681e996ab2199251a68c79b2797fa03d31a36dae698de393b85e1f89e": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:a657bd57bcdee99766d2076ec3b751f96670794c3dc10e20b94f917be4018281": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-event-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:7f1001c3e61932f826b3c7f87bf20efe79cd9a797f3598613c10cd1e6a49961c": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-event-libs-1.02.175-1.fc34.x86_64.rpm",
         "sha256:f5f5c988604aa5c870eee7efff6d40f26acb908cf82991d762ade18c8b46aff6": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-libs-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:2ad21916943c245819c1586f2841673c35f73c38bc0bbfa24e7c4f3892d73d28": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-persistent-data-0.9.0-3.fc34.x86_64.rpm",
         "sha256:c58752e2529cf0ea4aabb0476ef53ca7748091aa936513affc1245928ae5b1b8": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/diffutils-3.7-8.fc34.x86_64.rpm",
         "sha256:be09e345d175a5dd6535a69db12429072ddc453874792b75446370fc4eb196a1": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dnf-4.6.1-1.fc34.noarch.rpm",
         "sha256:d8aa8d1e0db5f32658af8c236f06853421e4bd4618f86c9e05e121b9b805b0dc": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dnf-data-4.6.1-1.fc34.noarch.rpm",
@@ -194,6 +198,8 @@
         "sha256:5ed9093c6368733f9aecfe56b029246929047c1de33ca035fbcd0c210bae4051": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lorax-34.9-5.fc34.x86_64.rpm",
         "sha256:b14d332c9d9fd66afeb9c3064db3955b7667f4cf3e85d7f76439eeba63fff488": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lorax-templates-generic-34.9-5.fc34.x86_64.rpm",
         "sha256:1a2aaf60c22453df0c306a5618aca20a2ce19090525445037a667f468b8ceaab": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lua-libs-5.4.2-2.fc34.x86_64.rpm",
+        "sha256:6b215bdf0227e676436a3056969d68acbd329ee3fcccb46873fee31d6f1bafe8": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lvm2-2.03.11-1.fc34.x86_64.rpm",
+        "sha256:b4c0a61643aa825845887cf39f780fa2862f629f980c095704c059b5418dba20": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lvm2-libs-2.03.11-1.fc34.x86_64.rpm",
         "sha256:da676955f475492f17c573bc526d47c37e34919d2a6ed33ec4573a4de0cab2a7": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lz4-libs-1.9.3-2.fc34.x86_64.rpm",
         "sha256:ba2916d48b3a28e9bc2c9fbde19770c204b6ad4cdc94471c3c6bdbfbe8669461": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lzo-2.10-4.fc34.x86_64.rpm",
         "sha256:0214ae16ef6a92843a4973aeda93db85584ad7840b1dd6e225bc57b594f58961": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/m/memstrack-0.2.2-1.fc34.x86_64.rpm",
@@ -335,6 +341,7 @@
                 "sha256:96b69aefaddfebbac3f9b6361b01cc71196e604a56fd9a6236317e63fb68664a": {},
                 "sha256:9a698a5991a08e23e87b4bce2f3e447eafdc7fd4d84a49d91c65c6045ead1e8e": {},
                 "sha256:bc66918c24175415a0f65803bccbb3d796d733acd319577a2417371a178ce193": {},
+                "sha256:d23395e2614654c4cb717ec29cba2e61beec36bf815e74729ada20be41633caa": {},
                 "sha256:775b1498ba72e9d05a1c131fdbc2f4aabb8fd00d9c7c13ab996154e99660f92b": {},
                 "sha256:29cf7e97d6476fcfe80088a4c9cbc113d9b73e37dc9ec34967a958cef2d04e0c": {},
                 "sha256:9bff70d51ecec129854ef62d82204db3e01706c444b966cb048bc7fd8ec8b524": {},
@@ -351,7 +358,10 @@
                 "sha256:b2ffc9785842ccc76ca187d8b922fb3b91da2257341fb115ed6bdbfedb24c1eb": {},
                 "sha256:f8b418b88b30d28c911d26f6f0b9c1ede8be00fa71d28c789328dfd7c58eea67": {},
                 "sha256:5fb88eb681e996ab2199251a68c79b2797fa03d31a36dae698de393b85e1f89e": {},
+                "sha256:a657bd57bcdee99766d2076ec3b751f96670794c3dc10e20b94f917be4018281": {},
+                "sha256:7f1001c3e61932f826b3c7f87bf20efe79cd9a797f3598613c10cd1e6a49961c": {},
                 "sha256:f5f5c988604aa5c870eee7efff6d40f26acb908cf82991d762ade18c8b46aff6": {},
+                "sha256:2ad21916943c245819c1586f2841673c35f73c38bc0bbfa24e7c4f3892d73d28": {},
                 "sha256:c58752e2529cf0ea4aabb0476ef53ca7748091aa936513affc1245928ae5b1b8": {},
                 "sha256:be09e345d175a5dd6535a69db12429072ddc453874792b75446370fc4eb196a1": {},
                 "sha256:d8aa8d1e0db5f32658af8c236f06853421e4bd4618f86c9e05e121b9b805b0dc": {},
@@ -509,6 +519,8 @@
                 "sha256:5ed9093c6368733f9aecfe56b029246929047c1de33ca035fbcd0c210bae4051": {},
                 "sha256:b14d332c9d9fd66afeb9c3064db3955b7667f4cf3e85d7f76439eeba63fff488": {},
                 "sha256:1a2aaf60c22453df0c306a5618aca20a2ce19090525445037a667f468b8ceaab": {},
+                "sha256:6b215bdf0227e676436a3056969d68acbd329ee3fcccb46873fee31d6f1bafe8": {},
+                "sha256:b4c0a61643aa825845887cf39f780fa2862f629f980c095704c059b5418dba20": {},
                 "sha256:da676955f475492f17c573bc526d47c37e34919d2a6ed33ec4573a4de0cab2a7": {},
                 "sha256:ba2916d48b3a28e9bc2c9fbde19770c204b6ad4cdc94471c3c6bdbfbe8669461": {},
                 "sha256:0214ae16ef6a92843a4973aeda93db85584ad7840b1dd6e225bc57b594f58961": {},
@@ -637,6 +649,16 @@
               "docs": true
             }
           }
+        },
+        {
+          "type": "org.osbuild.selinux",
+          "options": {
+            "file_contexts": "etc/selinux/targeted/contexts/files/file_contexts",
+            "labels": {
+              "/usr/bin/cp": "system_u:object_r:install_exec_t:s0",
+              "/usr/bin/tar": "system_u:object_r:install_exec_t:s0"
+            }
+          }
         }
       ]
     },
diff --git a/test/data/stages/xz/a.json b/test/data/stages/xz/a.json
index c49d9956..b0bedbb4 100644
--- a/test/data/stages/xz/a.json
+++ b/test/data/stages/xz/a.json
@@ -21,6 +21,7 @@
                 "sha256:96b69aefaddfebbac3f9b6361b01cc71196e604a56fd9a6236317e63fb68664a": {},
                 "sha256:9a698a5991a08e23e87b4bce2f3e447eafdc7fd4d84a49d91c65c6045ead1e8e": {},
                 "sha256:bc66918c24175415a0f65803bccbb3d796d733acd319577a2417371a178ce193": {},
+                "sha256:d23395e2614654c4cb717ec29cba2e61beec36bf815e74729ada20be41633caa": {},
                 "sha256:775b1498ba72e9d05a1c131fdbc2f4aabb8fd00d9c7c13ab996154e99660f92b": {},
                 "sha256:29cf7e97d6476fcfe80088a4c9cbc113d9b73e37dc9ec34967a958cef2d04e0c": {},
                 "sha256:9bff70d51ecec129854ef62d82204db3e01706c444b966cb048bc7fd8ec8b524": {},
@@ -37,7 +38,10 @@
                 "sha256:b2ffc9785842ccc76ca187d8b922fb3b91da2257341fb115ed6bdbfedb24c1eb": {},
                 "sha256:f8b418b88b30d28c911d26f6f0b9c1ede8be00fa71d28c789328dfd7c58eea67": {},
                 "sha256:5fb88eb681e996ab2199251a68c79b2797fa03d31a36dae698de393b85e1f89e": {},
+                "sha256:a657bd57bcdee99766d2076ec3b751f96670794c3dc10e20b94f917be4018281": {},
+                "sha256:7f1001c3e61932f826b3c7f87bf20efe79cd9a797f3598613c10cd1e6a49961c": {},
                 "sha256:f5f5c988604aa5c870eee7efff6d40f26acb908cf82991d762ade18c8b46aff6": {},
+                "sha256:2ad21916943c245819c1586f2841673c35f73c38bc0bbfa24e7c4f3892d73d28": {},
                 "sha256:c58752e2529cf0ea4aabb0476ef53ca7748091aa936513affc1245928ae5b1b8": {},
                 "sha256:be09e345d175a5dd6535a69db12429072ddc453874792b75446370fc4eb196a1": {},
                 "sha256:d8aa8d1e0db5f32658af8c236f06853421e4bd4618f86c9e05e121b9b805b0dc": {},
@@ -195,6 +199,8 @@
                 "sha256:5ed9093c6368733f9aecfe56b029246929047c1de33ca035fbcd0c210bae4051": {},
                 "sha256:b14d332c9d9fd66afeb9c3064db3955b7667f4cf3e85d7f76439eeba63fff488": {},
                 "sha256:1a2aaf60c22453df0c306a5618aca20a2ce19090525445037a667f468b8ceaab": {},
+                "sha256:6b215bdf0227e676436a3056969d68acbd329ee3fcccb46873fee31d6f1bafe8": {},
+                "sha256:b4c0a61643aa825845887cf39f780fa2862f629f980c095704c059b5418dba20": {},
                 "sha256:da676955f475492f17c573bc526d47c37e34919d2a6ed33ec4573a4de0cab2a7": {},
                 "sha256:ba2916d48b3a28e9bc2c9fbde19770c204b6ad4cdc94471c3c6bdbfbe8669461": {},
                 "sha256:0214ae16ef6a92843a4973aeda93db85584ad7840b1dd6e225bc57b594f58961": {},
@@ -323,6 +329,16 @@
               "docs": true
             }
           }
+        },
+        {
+          "type": "org.osbuild.selinux",
+          "options": {
+            "file_contexts": "etc/selinux/targeted/contexts/files/file_contexts",
+            "labels": {
+              "/usr/bin/cp": "system_u:object_r:install_exec_t:s0",
+              "/usr/bin/tar": "system_u:object_r:install_exec_t:s0"
+            }
+          }
         }
       ]
     },
@@ -344,6 +360,7 @@
         "sha256:96b69aefaddfebbac3f9b6361b01cc71196e604a56fd9a6236317e63fb68664a": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/b/bubblewrap-0.4.1-3.fc34.x86_64.rpm",
         "sha256:9a698a5991a08e23e87b4bce2f3e447eafdc7fd4d84a49d91c65c6045ead1e8e": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/b/bzip2-libs-1.0.8-6.fc34.x86_64.rpm",
         "sha256:bc66918c24175415a0f65803bccbb3d796d733acd319577a2417371a178ce193": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/ca-certificates-2020.2.41-7.fc34.noarch.rpm",
+        "sha256:d23395e2614654c4cb717ec29cba2e61beec36bf815e74729ada20be41633caa": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/compat-readline5-5.2-39.fc34.x86_64.rpm",
         "sha256:775b1498ba72e9d05a1c131fdbc2f4aabb8fd00d9c7c13ab996154e99660f92b": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/coreutils-8.32-21.fc34.x86_64.rpm",
         "sha256:29cf7e97d6476fcfe80088a4c9cbc113d9b73e37dc9ec34967a958cef2d04e0c": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/coreutils-common-8.32-21.fc34.x86_64.rpm",
         "sha256:9bff70d51ecec129854ef62d82204db3e01706c444b966cb048bc7fd8ec8b524": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/cpio-2.13-10.fc34.x86_64.rpm",
@@ -360,7 +377,10 @@
         "sha256:b2ffc9785842ccc76ca187d8b922fb3b91da2257341fb115ed6bdbfedb24c1eb": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dbus-libs-1.12.20-3.fc34.x86_64.rpm",
         "sha256:f8b418b88b30d28c911d26f6f0b9c1ede8be00fa71d28c789328dfd7c58eea67": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/deltarpm-3.6.2-8.fc34.x86_64.rpm",
         "sha256:5fb88eb681e996ab2199251a68c79b2797fa03d31a36dae698de393b85e1f89e": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:a657bd57bcdee99766d2076ec3b751f96670794c3dc10e20b94f917be4018281": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-event-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:7f1001c3e61932f826b3c7f87bf20efe79cd9a797f3598613c10cd1e6a49961c": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-event-libs-1.02.175-1.fc34.x86_64.rpm",
         "sha256:f5f5c988604aa5c870eee7efff6d40f26acb908cf82991d762ade18c8b46aff6": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-libs-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:2ad21916943c245819c1586f2841673c35f73c38bc0bbfa24e7c4f3892d73d28": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-persistent-data-0.9.0-3.fc34.x86_64.rpm",
         "sha256:c58752e2529cf0ea4aabb0476ef53ca7748091aa936513affc1245928ae5b1b8": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/diffutils-3.7-8.fc34.x86_64.rpm",
         "sha256:be09e345d175a5dd6535a69db12429072ddc453874792b75446370fc4eb196a1": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dnf-4.6.1-1.fc34.noarch.rpm",
         "sha256:d8aa8d1e0db5f32658af8c236f06853421e4bd4618f86c9e05e121b9b805b0dc": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dnf-data-4.6.1-1.fc34.noarch.rpm",
@@ -518,6 +538,8 @@
         "sha256:5ed9093c6368733f9aecfe56b029246929047c1de33ca035fbcd0c210bae4051": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lorax-34.9-5.fc34.x86_64.rpm",
         "sha256:b14d332c9d9fd66afeb9c3064db3955b7667f4cf3e85d7f76439eeba63fff488": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lorax-templates-generic-34.9-5.fc34.x86_64.rpm",
         "sha256:1a2aaf60c22453df0c306a5618aca20a2ce19090525445037a667f468b8ceaab": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lua-libs-5.4.2-2.fc34.x86_64.rpm",
+        "sha256:6b215bdf0227e676436a3056969d68acbd329ee3fcccb46873fee31d6f1bafe8": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lvm2-2.03.11-1.fc34.x86_64.rpm",
+        "sha256:b4c0a61643aa825845887cf39f780fa2862f629f980c095704c059b5418dba20": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lvm2-libs-2.03.11-1.fc34.x86_64.rpm",
         "sha256:da676955f475492f17c573bc526d47c37e34919d2a6ed33ec4573a4de0cab2a7": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lz4-libs-1.9.3-2.fc34.x86_64.rpm",
         "sha256:ba2916d48b3a28e9bc2c9fbde19770c204b6ad4cdc94471c3c6bdbfbe8669461": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lzo-2.10-4.fc34.x86_64.rpm",
         "sha256:0214ae16ef6a92843a4973aeda93db85584ad7840b1dd6e225bc57b594f58961": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/m/memstrack-0.2.2-1.fc34.x86_64.rpm",
diff --git a/test/data/stages/xz/b.json b/test/data/stages/xz/b.json
index 1a6b35fe..f2157b4a 100644
--- a/test/data/stages/xz/b.json
+++ b/test/data/stages/xz/b.json
@@ -20,6 +20,7 @@
         "sha256:96b69aefaddfebbac3f9b6361b01cc71196e604a56fd9a6236317e63fb68664a": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/b/bubblewrap-0.4.1-3.fc34.x86_64.rpm",
         "sha256:9a698a5991a08e23e87b4bce2f3e447eafdc7fd4d84a49d91c65c6045ead1e8e": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/b/bzip2-libs-1.0.8-6.fc34.x86_64.rpm",
         "sha256:bc66918c24175415a0f65803bccbb3d796d733acd319577a2417371a178ce193": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/ca-certificates-2020.2.41-7.fc34.noarch.rpm",
+        "sha256:d23395e2614654c4cb717ec29cba2e61beec36bf815e74729ada20be41633caa": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/compat-readline5-5.2-39.fc34.x86_64.rpm",
         "sha256:775b1498ba72e9d05a1c131fdbc2f4aabb8fd00d9c7c13ab996154e99660f92b": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/coreutils-8.32-21.fc34.x86_64.rpm",
         "sha256:29cf7e97d6476fcfe80088a4c9cbc113d9b73e37dc9ec34967a958cef2d04e0c": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/coreutils-common-8.32-21.fc34.x86_64.rpm",
         "sha256:9bff70d51ecec129854ef62d82204db3e01706c444b966cb048bc7fd8ec8b524": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/c/cpio-2.13-10.fc34.x86_64.rpm",
@@ -36,7 +37,10 @@
         "sha256:b2ffc9785842ccc76ca187d8b922fb3b91da2257341fb115ed6bdbfedb24c1eb": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dbus-libs-1.12.20-3.fc34.x86_64.rpm",
         "sha256:f8b418b88b30d28c911d26f6f0b9c1ede8be00fa71d28c789328dfd7c58eea67": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/deltarpm-3.6.2-8.fc34.x86_64.rpm",
         "sha256:5fb88eb681e996ab2199251a68c79b2797fa03d31a36dae698de393b85e1f89e": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:a657bd57bcdee99766d2076ec3b751f96670794c3dc10e20b94f917be4018281": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-event-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:7f1001c3e61932f826b3c7f87bf20efe79cd9a797f3598613c10cd1e6a49961c": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-event-libs-1.02.175-1.fc34.x86_64.rpm",
         "sha256:f5f5c988604aa5c870eee7efff6d40f26acb908cf82991d762ade18c8b46aff6": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-libs-1.02.175-1.fc34.x86_64.rpm",
+        "sha256:2ad21916943c245819c1586f2841673c35f73c38bc0bbfa24e7c4f3892d73d28": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/device-mapper-persistent-data-0.9.0-3.fc34.x86_64.rpm",
         "sha256:c58752e2529cf0ea4aabb0476ef53ca7748091aa936513affc1245928ae5b1b8": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/diffutils-3.7-8.fc34.x86_64.rpm",
         "sha256:be09e345d175a5dd6535a69db12429072ddc453874792b75446370fc4eb196a1": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dnf-4.6.1-1.fc34.noarch.rpm",
         "sha256:d8aa8d1e0db5f32658af8c236f06853421e4bd4618f86c9e05e121b9b805b0dc": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/d/dnf-data-4.6.1-1.fc34.noarch.rpm",
@@ -194,6 +198,8 @@
         "sha256:5ed9093c6368733f9aecfe56b029246929047c1de33ca035fbcd0c210bae4051": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lorax-34.9-5.fc34.x86_64.rpm",
         "sha256:b14d332c9d9fd66afeb9c3064db3955b7667f4cf3e85d7f76439eeba63fff488": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lorax-templates-generic-34.9-5.fc34.x86_64.rpm",
         "sha256:1a2aaf60c22453df0c306a5618aca20a2ce19090525445037a667f468b8ceaab": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lua-libs-5.4.2-2.fc34.x86_64.rpm",
+        "sha256:6b215bdf0227e676436a3056969d68acbd329ee3fcccb46873fee31d6f1bafe8": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lvm2-2.03.11-1.fc34.x86_64.rpm",
+        "sha256:b4c0a61643aa825845887cf39f780fa2862f629f980c095704c059b5418dba20": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lvm2-libs-2.03.11-1.fc34.x86_64.rpm",
         "sha256:da676955f475492f17c573bc526d47c37e34919d2a6ed33ec4573a4de0cab2a7": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lz4-libs-1.9.3-2.fc34.x86_64.rpm",
         "sha256:ba2916d48b3a28e9bc2c9fbde19770c204b6ad4cdc94471c3c6bdbfbe8669461": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/l/lzo-2.10-4.fc34.x86_64.rpm",
         "sha256:0214ae16ef6a92843a4973aeda93db85584ad7840b1dd6e225bc57b594f58961": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-fedora-20210512/Packages/m/memstrack-0.2.2-1.fc34.x86_64.rpm",
@@ -335,6 +341,7 @@
                 "sha256:96b69aefaddfebbac3f9b6361b01cc71196e604a56fd9a6236317e63fb68664a": {},
                 "sha256:9a698a5991a08e23e87b4bce2f3e447eafdc7fd4d84a49d91c65c6045ead1e8e": {},
                 "sha256:bc66918c24175415a0f65803bccbb3d796d733acd319577a2417371a178ce193": {},
+                "sha256:d23395e2614654c4cb717ec29cba2e61beec36bf815e74729ada20be41633caa": {},
                 "sha256:775b1498ba72e9d05a1c131fdbc2f4aabb8fd00d9c7c13ab996154e99660f92b": {},
                 "sha256:29cf7e97d6476fcfe80088a4c9cbc113d9b73e37dc9ec34967a958cef2d04e0c": {},
                 "sha256:9bff70d51ecec129854ef62d82204db3e01706c444b966cb048bc7fd8ec8b524": {},
@@ -351,7 +358,10 @@
                 "sha256:b2ffc9785842ccc76ca187d8b922fb3b91da2257341fb115ed6bdbfedb24c1eb": {},
                 "sha256:f8b418b88b30d28c911d26f6f0b9c1ede8be00fa71d28c789328dfd7c58eea67": {},
                 "sha256:5fb88eb681e996ab2199251a68c79b2797fa03d31a36dae698de393b85e1f89e": {},
+                "sha256:a657bd57bcdee99766d2076ec3b751f96670794c3dc10e20b94f917be4018281": {},
+                "sha256:7f1001c3e61932f826b3c7f87bf20efe79cd9a797f3598613c10cd1e6a49961c": {},
                 "sha256:f5f5c988604aa5c870eee7efff6d40f26acb908cf82991d762ade18c8b46aff6": {},
+                "sha256:2ad21916943c245819c1586f2841673c35f73c38bc0bbfa24e7c4f3892d73d28": {},
                 "sha256:c58752e2529cf0ea4aabb0476ef53ca7748091aa936513affc1245928ae5b1b8": {},
                 "sha256:be09e345d175a5dd6535a69db12429072ddc453874792b75446370fc4eb196a1": {},
                 "sha256:d8aa8d1e0db5f32658af8c236f06853421e4bd4618f86c9e05e121b9b805b0dc": {},
@@ -509,6 +519,8 @@
                 "sha256:5ed9093c6368733f9aecfe56b029246929047c1de33ca035fbcd0c210bae4051": {},
                 "sha256:b14d332c9d9fd66afeb9c3064db3955b7667f4cf3e85d7f76439eeba63fff488": {},
                 "sha256:1a2aaf60c22453df0c306a5618aca20a2ce19090525445037a667f468b8ceaab": {},
+                "sha256:6b215bdf0227e676436a3056969d68acbd329ee3fcccb46873fee31d6f1bafe8": {},
+                "sha256:b4c0a61643aa825845887cf39f780fa2862f629f980c095704c059b5418dba20": {},
                 "sha256:da676955f475492f17c573bc526d47c37e34919d2a6ed33ec4573a4de0cab2a7": {},
                 "sha256:ba2916d48b3a28e9bc2c9fbde19770c204b6ad4cdc94471c3c6bdbfbe8669461": {},
                 "sha256:0214ae16ef6a92843a4973aeda93db85584ad7840b1dd6e225bc57b594f58961": {},
@@ -637,6 +649,16 @@
               "docs": true
             }
           }
+        },
+        {
+          "type": "org.osbuild.selinux",
+          "options": {
+            "file_contexts": "etc/selinux/targeted/contexts/files/file_contexts",
+            "labels": {
+              "/usr/bin/cp": "system_u:object_r:install_exec_t:s0",
+              "/usr/bin/tar": "system_u:object_r:install_exec_t:s0"
+            }
+          }
         }
       ]
     },
diff --git a/test/mod/test_fmt_v2.py b/test/mod/test_fmt_v2.py
index 047c5aef..1f4f3b73 100644
--- a/test/mod/test_fmt_v2.py
+++ b/test/mod/test_fmt_v2.py
@@ -3,6 +3,7 @@
 #
 
 import copy
+import itertools
 import os
 import unittest
 
@@ -306,3 +307,54 @@ class TestFormatV2(unittest.TestCase):
 
         with self.assertRaises(ValueError):
             self.load_manifest(pipeline)
+
+    def test_device_sorting(self):
+        fmt = self.index.get_format_info("osbuild.formats.v2").module
+        assert(fmt)
+
+        self_cycle = {
+            "a": {"parent": "a"},
+        }
+
+        with self.assertRaises(ValueError):
+            fmt.sort_devices(self_cycle)
+
+        cycle = {
+            "a": {"parent": "b"},
+            "b": {"parent": "a"},
+        }
+
+        with self.assertRaises(ValueError):
+            fmt.sort_devices(cycle)
+
+        missing_parent = {
+            "a": {"parent": "b"},
+            "b": {"parent": "c"},
+        }
+
+        with self.assertRaises(ValueError):
+            fmt.sort_devices(missing_parent)
+
+        def ensure_sorted(devices):
+            check = {}
+
+            for name, dev in devices.items():
+
+                parent = dev.get("parent")
+                if parent:
+                    assert parent in check
+
+                check[name] = dev
+
+            assert devices == check
+
+        devices = {
+            "a": {"parent": "d"},
+            "b": {"parent": "a"},
+            "c": {"parent": None},
+            "d": {"parent": "c"},
+        }
+
+        for check in itertools.permutations(devices.keys()):
+            before = {name: devices[name] for name in check}
+            ensure_sorted(fmt.sort_devices(before))
diff --git a/test/mod/test_util_lvm2.py b/test/mod/test_util_lvm2.py
new file mode 100644
index 00000000..eb37245e
--- /dev/null
+++ b/test/mod/test_util_lvm2.py
@@ -0,0 +1,190 @@
+#
+# Test for the util.lvm2 module
+#
+
+import errno
+import os
+import json
+import subprocess
+import time
+import uuid
+
+from typing import List
+from tempfile import TemporaryDirectory
+
+import pytest
+
+from osbuild import loop
+from osbuild.util import lvm2
+from osbuild.util.types import PathLike
+
+from ..test import TestBase
+
+
+def have_lvm() -> bool:
+    try:
+        r = subprocess.run(
+            ["vgs"],
+            encoding="utf-8",
+            stdout=subprocess.PIPE,
+            check=False
+        )
+    except FileNotFoundError:
+        return False
+    return r.returncode == 0
+
+
+@pytest.fixture(name="tempdir")
+def tempdir_fixture():
+    with TemporaryDirectory(prefix="lvm2-") as tmp:
+        yield tmp
+
+
+def make_loop(ctl, fd: int, offset, sizelimit, sector_size=512):
+    lo = loop.Loop(ctl.get_unbound())
+
+    if not sizelimit:
+        stat = os.fstat(fd)
+        sizelimit = stat.st_size - offset
+        print(f"size: {sizelimit}")
+    else:
+        sizelimit *= sector_size
+
+    while True:
+        try:
+            lo.set_fd(fd)
+        except OSError as e:
+            lo.close()
+            if e.errno == errno.EBUSY:
+                continue
+            raise e
+        # `set_status` returns EBUSY when the pages from the previously
+        # bound file have not been fully cleared yet.
+        try:
+            lo.set_status(offset=offset,
+                          sizelimit=sizelimit,
+                          autoclear=True)
+        except BlockingIOError:
+            lo.clear_fd()
+            lo.close()
+            continue
+        break
+
+    return lo
+
+
+def pvcreate(path: PathLike):
+    cmd = ["pvcreate", os.fspath(path)]
+    subprocess.run(cmd, check=True)
+
+
+def vgcreate(path: PathLike, vg_name: str):
+    cmd = ["vgcreate", vg_name, os.fspath(path)]
+    subprocess.run(cmd, check=True)
+
+
+def lvcreate(vg_name, name: str, size: str):
+    cmd = [
+        "lvcreate", "-an",
+        "-l", size,
+        "-n", name,
+        vg_name
+    ]
+    subprocess.run(cmd, check=True)
+
+
+def list_vgs():
+    cmd = [
+        "vgs",
+        "--reportformat", "json",
+        "--readonly",
+        "-o", "+vg_all"
+    ]
+
+    res = subprocess.run(cmd,
+                         check=False,
+                         stdout=subprocess.PIPE,
+                         stderr=subprocess.STDOUT,
+                         encoding="UTF-8")
+
+    data = res.stdout.strip()
+
+    if res.returncode != 0:
+        msg = f"vgs: {data}"
+        raise RuntimeError(msg)
+
+    data = json.loads(data)
+
+    return data["report"][0]["vg"]
+
+
+def find_vg(lst: List, name: str):
+    for vg in lst:
+        if vg["vg_name"] == name:
+            return vg
+    return None
+
+
+@pytest.mark.skipif(not have_lvm(), reason="require lvm2 installation")
+@pytest.mark.skipif(not TestBase.can_bind_mount(), reason="root only")
+def test_rename_vg_group(tempdir):
+
+    path = os.path.join(tempdir, "lvm.img")
+    ctl = loop.LoopControl()
+
+    f = None
+    lo = None
+    try:
+        f = open(path, "wb+")
+        f.truncate(100 * 1024 * 1024)
+        f.flush()
+        lo = make_loop(ctl, f.fileno(), 0, None)
+        devname = os.path.join("/dev", lo.devname)
+
+        vg_name = str(uuid.uuid4())
+        pvcreate(devname)
+        vgcreate(devname, vg_name)
+        lvcreate(vg_name, "lv1", r"100%FREE")
+
+        vgs = list_vgs()
+        vg = find_vg(vgs, vg_name)
+        assert vg
+
+    finally:
+        if lo:
+            lo.close()
+        if f:
+            f.close()
+
+    new_name = str(uuid.uuid4())
+    with lvm2.Disk.open(path) as disk:
+        assert disk.metadata
+        assert disk.metadata.vg_name == vg_name
+
+        disk.rename_vg(new_name)
+        disk.creation_host = "osbuild"
+        disk.description = "created via lvm2 and osbuild"
+
+        disk.flush_metadata()
+
+    f = None
+    lo = None
+    try:
+        f = open(path, "rb")
+        lo = make_loop(ctl, f.fileno(), 0, None)
+        devname = os.path.join("/dev", lo.devname)
+
+        vg = None
+        for i in range(3):
+            vgs = list_vgs()
+            vg = find_vg(vgs, new_name)
+            if vg:
+                break
+            time.sleep(0.250 * (i+1))
+        if not vg:
+            raise RuntimeError(f"Could not find vg {new_name}")
+    finally:
+        if lo:
+            lo.close()
+        if f:
+            f.close()
diff --git a/test/run/test_devices.py b/test/run/test_devices.py
index 94034b3c..80b25c89 100755
--- a/test/run/test_devices.py
+++ b/test/run/test_devices.py
@@ -45,10 +45,10 @@ def test_loopback_basic(tmpdir):
         "size": size // 512  # size is in sectors / blocks
     }
 
-    dev = devices.Device("loop", info, options)
+    dev = devices.Device("loop", info, None, options)
 
     with host.ServiceManager() as mgr:
-        reply = dev.open(mgr, devpath, tree)
+        reply = dev.open(mgr, devpath, None, tree)
         assert reply
         assert reply["path"]
 
diff --git a/test/run/test_noop.py b/test/run/test_noop.py
index c82883f3..9af0cc3c 100644
--- a/test/run/test_noop.py
+++ b/test/run/test_noop.py
@@ -1,62 +1,65 @@
 #
 # Runtime Tests for No-op Pipelines
 #
-
 import json
-import unittest
 import tempfile
+import pytest
 
 from .. import test
 
-
-NOOP_V2 = {
-    "version": "2",
-    "pipelines": [
-        {
-            "name": "noop",
-            "stages": [
-                {
-                    "type": "org.osbuild.noop",
-                    "options": {"zero": 0},
-                    "inputs": {
-                        "tree": {
-                            "type": "org.osbuild.noop",
-                            "origin": "org.osbuild.pipeline",
-                            "references": {
-                                "foo": {}
+@pytest.fixture(name="jsondata", scope="module")
+def jsondata_fixture():
+    return json.dumps({
+        "version": "2",
+        "pipelines": [
+            {
+                "name": "noop",
+                "stages": [
+                    {
+                        "type": "org.osbuild.noop",
+                        "options": {"zero": 0},
+                        "inputs": {
+                            "tree": {
+                                "type": "org.osbuild.noop",
+                                "origin": "org.osbuild.pipeline",
+                                "references": {
+                                    "foo": {}
+                                }
                             }
                         }
                     }
-                }
-            ]
-        }
-    ]
-}
-
-
-class TestNoop(unittest.TestCase):
-    def setUp(self):
-        self.osbuild = test.OSBuild()
-
-    def test_noop(self):
-        #
-        # Run a noop Pipeline. Run twice to verify the cache does not affect
-        # the operation (we do not have checkpoints, nor any stages that could
-        # be checkpointed).
-        #
-        # Then run the entire thing again, to verify our own `osbuild` executor
-        # tears things down properly and allows to be executed multiple times.
-        #
-
-        with self.osbuild as osb:
-            osb.compile("{}")
-            osb.compile("{}")
-
-        with self.osbuild as osb:
-            osb.compile("{}")
-            osb.compile("{}")
-
-    def test_noop_v2(self):
-        with tempfile.TemporaryDirectory() as tmp:
-            with self.osbuild as osb:
-                osb.compile(json.dumps(NOOP_V2), output_dir=tmp)
+                ]
+            }
+        ]
+    })
+
+@pytest.fixture(name="tmpdir", scope="module")
+def tmpdir_fixture():
+    with tempfile.TemporaryDirectory() as tmp:
+        yield tmp
+
+
+@pytest.fixture(name="osb", scope="module")
+def osbuild_fixture():
+    with test.OSBuild() as osb:
+        yield osb
+
+#
+# Run a noop Pipeline. Run twice to verify the cache does not affect
+# the operation (we do not have checkpoints, nor any stages that could
+# be checkpointed).
+#
+# Then run the entire thing again, to verify our own `osbuild` executor
+# tears things down properly and allows to be executed multiple times.
+#
+def test_noop(osb):
+    osb.compile("{}")
+    osb.compile("{}")
+
+def test_noop2(osb):
+    osb.compile("{}")
+    osb.compile("{}")
+
+@pytest.mark.skipif(not test.TestBase.can_bind_mount(), reason="root-only")
+def test_noop_v2(osb, tmpdir, jsondata):
+    osb.compile(jsondata, output_dir=tmpdir)