Repository: osbuild/osbuild-composer
Pull request #799 (2020-06-26 07:56:44)

distro: fix failed image build due to SELinux
Fixes: https://github.com/osbuild/osbuild-composer/issues/798
Depends on: #805

See commit messages for details.

msehnout: CI failures are coming from `curl` as usual. Otherwise I think it should be fine. Can you please take a look @teg ?
teg: I think this is ready to go in, though I think it needs a rebase to pick up some CI fix (I think the tests pass but the reporting is wrong).
To make it easier to follow, I suggest reordering the PR something like this (feel free to order them differently of course, just a suggestion if you are going to rebase anyway):
 - preparatory patches (test case generation refactoring, printing debug info on test failure)
 - the functional changes (buildroot labelling + cp labelling)
 - one patch updating all the test cases (ideally would be done as part of the patches introducing the changes making the test updates necessary, but since there are two patches in this PR, that would probably not be worth it). Squash any fixes together into one patch, and explain what was done (probably just re-ran the generation). As aarch64 image tests are not ran in our CI, leave a comment why this is still ok (you ran them manually as part of generating the test cases)
 - bump the spec file
msehnout: > I think this is ready to go in, though I think it needs a rebase to pick up some CI fix (I think the tests pass but the reporting is wrong).
> To make it easier to follow, I suggest reordering the PR something like this (feel free to order them differently of course, just a suggestion if you are going to rebase anyway):
> 
>     * preparatory patches (test case generation refactoring, printing debug info on test failure)
> 
>     * the functional changes (buildroot labelling + cp labelling)
> 
>     * one patch updating all the test cases (ideally would be done as part of the patches introducing the changes making the test updates necessary, but since there are two patches in this PR, that would probably not be worth it). Squash any fixes together into one patch, and explain what was done (probably just re-ran the generation). As aarch64 image tests are not ran in our CI, leave a comment why this is still ok (you ran them manually as part of generating the test cases)
> 
>     * bump the spec file

I think the bump should go first because without osbuild > 18, the `labels` field won't work. Is it ok like it is now?
msehnout: The test cases are not working, because they are already outdated. I'm not sure we want to commit to updating them because this patch introduced `updates` repositories:
4b0409df5b8128dbcf3c83f67893720840342e62
If we wanted to keep track od this repo, we would have to update the test-cases all the time. Maybe we could deploy our own mirror, @major ?
major: @msehnout That's possible, but it may be better to just regenerate the test cases without updates. I forgot that they would disappear in Fedora after they are updated again. 🤦🏻‍♂️
msehnout: I regenerated the test cases and ran them. It went just fine, but I don't think it is necessary to update them until we agree on the path forward. If that is ok with you @teg , I  would not block this PR on this issue.

Patch:
diff --git a/internal/distro/fedora32/distro.go b/internal/distro/fedora32/distro.go
index b5f679604..81d13e22c 100644
--- a/internal/distro/fedora32/distro.go
+++ b/internal/distro/fedora32/distro.go
@@ -298,6 +298,15 @@ func (t *imageType) pipeline(c *blueprint.Customizations, options distro.ImageOp
 func (t *imageType) buildPipeline(repos []rpmmd.RepoConfig, arch architecture, buildPackageSpecs []rpmmd.PackageSpec) *osbuild.Pipeline {
 	p := &osbuild.Pipeline{}
 	p.AddStage(osbuild.NewRPMStage(t.rpmStageOptions(arch, repos, buildPackageSpecs)))
+
+	selinuxOptions := osbuild.SELinuxStageOptions{
+		FileContexts: "etc/selinux/targeted/contexts/files/file_contexts",
+		Labels: map[string]string{
+			"/usr/bin/cp": "system_u:object_r:install_exec_t:s0",
+		},
+	}
+
+	p.AddStage(osbuild.NewSELinuxStage(&selinuxOptions))
 	return p
 }
 
@@ -742,6 +751,7 @@ func New() distro.Distro {
 			"e2fsprogs",
 			"policycoreutils",
 			"qemu-img",
+			"selinux-policy-targeted",
 			"systemd",
 			"tar",
 			"xz",
diff --git a/internal/osbuild/selinux_stage.go b/internal/osbuild/selinux_stage.go
index 80aa93b1f..1e75812d3 100644
--- a/internal/osbuild/selinux_stage.go
+++ b/internal/osbuild/selinux_stage.go
@@ -5,7 +5,8 @@ package osbuild
 // A file contexts configuration file is sepcified that describes
 // the filesystem labels to apply to the image.
 type SELinuxStageOptions struct {
-	FileContexts string `json:"file_contexts"`
+	FileContexts string            `json:"file_contexts"`
+	Labels       map[string]string `json:"labels,omitempty"`
 }
 
 func (SELinuxStageOptions) isStageOptions() {}
diff --git a/osbuild-composer.spec b/osbuild-composer.spec
index 586da059c..aa4dea072 100644
--- a/osbuild-composer.spec
+++ b/osbuild-composer.spec
@@ -49,8 +49,8 @@ BuildRequires:  golang(github.com/stretchr/testify/assert)
 
 Requires: %{name}-worker = %{version}-%{release}
 Requires: systemd
-Requires: osbuild >= 17
-Requires: osbuild-ostree >= 17
+Requires: osbuild >= 18
+Requires: osbuild-ostree >= 18
 
 Provides: weldr
 


Test patch:
diff --git a/internal/distro/distro_test_common/distro_test_common.go b/internal/distro/distro_test_common/distro_test_common.go
index 56db3c971..b8313fcfe 100644
--- a/internal/distro/distro_test_common/distro_test_common.go
+++ b/internal/distro/distro_test_common/distro_test_common.go
@@ -95,7 +95,7 @@ func TestDistro_Manifest(t *testing.T, pipelinePath string, prefix string, distr
 				return
 			}
 			if tt.Manifest != nil {
-				require.JSONEq(t, string(tt.Manifest), string(got))
+				require.JSONEqf(t, string(tt.Manifest), string(got), "Distro: %s\nArch: %s\nImage type: %s\nTest case file: %s\n", d.Name(), arch.Name(), imageType.Name(), fileName)
 			}
 		})
 	}
diff --git a/internal/distro/fedora32/distro_test.go b/internal/distro/fedora32/distro_test.go
index ad354944c..f9d22911e 100644
--- a/internal/distro/fedora32/distro_test.go
+++ b/internal/distro/fedora32/distro_test.go
@@ -87,6 +87,7 @@ func TestImageType_BuildPackages(t *testing.T) {
 		"grub2-pc",
 		"policycoreutils",
 		"qemu-img",
+		"selinux-policy-targeted",
 		"systemd",
 		"tar",
 		"xz",
@@ -97,6 +98,7 @@ func TestImageType_BuildPackages(t *testing.T) {
 		"e2fsprogs",
 		"policycoreutils",
 		"qemu-img",
+		"selinux-policy-targeted",
 		"systemd",
 		"tar",
 		"xz",
diff --git a/test/cases/fedora_32-aarch64-ami-boot.json b/test/cases/fedora_32-aarch64-ami-boot.json
index 410853ada..c78f60fcf 100644
--- a/test/cases/fedora_32-aarch64-ami-boot.json
+++ b/test/cases/fedora_32-aarch64-ami-boot.json
@@ -313,6 +313,9 @@
           "sha256:3c09e6de4c9dda4020c0f4ca732a4d564c3688399cbb0f94a64999fa4b479585": {
             "url": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/d/dnf-plugins-core-4.0.16-1.fc32.noarch.rpm"
           },
+          "sha256:3c263340038fdd392971e72305a279a0d8a0974e05e18d71c86a51433c55525f": {
+            "url": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/l/libnfsidmap-2.5.1-0.fc32.aarch64.rpm"
+          },
           "sha256:3d6ec574fe2c612bcc45395f7ee87c68f45016f005c6d7aeee6b37897f41b8d2": {
             "url": "http://mirrors.kernel.org/fedora/releases/32/Everything/aarch64/os/Packages/q/qrencode-libs-4.0.2-5.fc32.aarch64.rpm"
           },
@@ -343,6 +346,9 @@
           "sha256:45e2c1c76a0a0b6e1164c457307250a54a7de5905992b4351a84183c2e9f2633": {
             "url": "http://mirrors.kernel.org/fedora/releases/32/Everything/aarch64/os/Packages/m/mkpasswd-5.5.6-1.fc32.aarch64.rpm"
           },
+          "sha256:47719d5547c637a03553cd04f8c7197eee5b6e165e8aca5194cf87c096d471e5": {
+            "url": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/k/krb5-libs-1.18.2-10.fc32.aarch64.rpm"
+          },
           "sha256:48381163a3f2c524697efc07538f040fde0b69d4e0fdcbe3bcfbc9924dd7d5dd": {
             "url": "http://mirrors.kernel.org/fedora/releases/32/Everything/aarch64/os/Packages/x/xz-libs-5.2.5-1.fc32.aarch64.rpm"
           },
@@ -442,9 +448,6 @@
           "sha256:60774007011889671c28158f599032f0db253c153ccae70f5e2f5840f2dc490b": {
             "url": "http://mirrors.kernel.org/fedora/releases/32/Everything/aarch64/os/Packages/k/kbd-misc-2.2.0-1.fc32.noarch.rpm"
           },
-          "sha256:612ba480fae16370d8efd7d8be5cd81ef6774724ad8ad35b1eac381f9d0ee7b9": {
-            "url": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/l/libnfsidmap-2.4.3-1.rc2.fc32.aarch64.rpm"
-          },
           "sha256:61c51596cc97f35177efe8dc5e2ca52d8fd528570f33c184497f419259b73c90": {
             "url": "http://mirrors.kernel.org/fedora/releases/32/Everything/aarch64/os/Packages/p/python3-idna-2.8-6.fc32.noarch.rpm"
           },
@@ -973,9 +976,6 @@
           "sha256:e36a47ff624d27a0a7059bde2fe022302ffe335571ba8cf84e7e5e3646000557": {
             "url": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/d/dbus-1.12.20-1.fc32.aarch64.rpm"
           },
-          "sha256:e3e9485ac4a0383fbcc48a46cb4e03c59ebce219bbc734972bda6feea41da184": {
-            "url": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/k/krb5-libs-1.18.2-9.fc32.aarch64.rpm"
-          },
           "sha256:e7b49bf8e3183d7604c7f7f51dfbc1e03bc599ddd7eac459a86f4ffdc8432533": {
             "url": "http://mirrors.kernel.org/fedora/releases/32/Everything/aarch64/os/Packages/l/libaio-0.3.111-7.fc32.aarch64.rpm"
           },
@@ -1729,7 +1729,7 @@
                     "check_gpg": true
                   },
                   {
-                    "checksum": "sha256:e3e9485ac4a0383fbcc48a46cb4e03c59ebce219bbc734972bda6feea41da184",
+                    "checksum": "sha256:47719d5547c637a03553cd04f8c7197eee5b6e165e8aca5194cf87c096d471e5",
                     "check_gpg": true
                   },
                   {
@@ -1916,6 +1916,10 @@
                     "checksum": "sha256:a2a724f5a0691ee46d61566b139af518631702406f78fe4a9b0bc3d861a25b36",
                     "check_gpg": true
                   },
+                  {
+                    "checksum": "sha256:ca215bab929641bb4a875c70c741eaadbc1a321a8b65f723494339a3fc3a3085",
+                    "check_gpg": true
+                  },
                   {
                     "checksum": "sha256:d24ab66ce52e5471345071c3c445392639c287be91c19b21fd500cc3980dc65b",
                     "check_gpg": true
@@ -1924,6 +1928,14 @@
                     "checksum": "sha256:2c5e2d6dd5bd36a56744b162c633f1564bd9494f2fe71092ab39414dd846554f",
                     "check_gpg": true
                   },
+                  {
+                    "checksum": "sha256:04d6a0611b51f3b01baebcae7d64ccff0c15dfa548fbe19acfcd14a15f351df0",
+                    "check_gpg": true
+                  },
+                  {
+                    "checksum": "sha256:8a4d7e56d61fbd05beede2dc1b3dfc4ee515bf9883983f1c59c798f9fb17987e",
+                    "check_gpg": true
+                  },
                   {
                     "checksum": "sha256:09e4ac05c661fad09387f1e61050ef42447ce4e5102fcb4c4cbfe5c95618e9e9",
                     "check_gpg": true
@@ -1970,6 +1982,15 @@
                   }
                 ]
               }
+            },
+            {
+              "name": "org.osbuild.selinux",
+              "options": {
+                "file_contexts": "etc/selinux/targeted/contexts/files/file_contexts",
+                "labels": {
+                  "/usr/bin/cp": "system_u:object_r:install_exec_t:s0"
+                }
+              }
             }
           ]
         },
@@ -3017,7 +3038,7 @@
                 "check_gpg": true
               },
               {
-                "checksum": "sha256:e3e9485ac4a0383fbcc48a46cb4e03c59ebce219bbc734972bda6feea41da184",
+                "checksum": "sha256:47719d5547c637a03553cd04f8c7197eee5b6e165e8aca5194cf87c096d471e5",
                 "check_gpg": true
               },
               {
@@ -3073,7 +3094,7 @@
                 "check_gpg": true
               },
               {
-                "checksum": "sha256:612ba480fae16370d8efd7d8be5cd81ef6774724ad8ad35b1eac381f9d0ee7b9",
+                "checksum": "sha256:3c263340038fdd392971e72305a279a0d8a0974e05e18d71c86a51433c55525f",
                 "check_gpg": true
               },
               {
@@ -5039,10 +5060,10 @@
         "name": "krb5-libs",
         "epoch": 0,
         "version": "1.18.2",
-        "release": "9.fc32",
+        "release": "10.fc32",
         "arch": "aarch64",
-        "remote_location": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/k/krb5-libs-1.18.2-9.fc32.aarch64.rpm",
-        "checksum": "sha256:e3e9485ac4a0383fbcc48a46cb4e03c59ebce219bbc734972bda6feea41da184",
+        "remote_location": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/k/krb5-libs-1.18.2-10.fc32.aarch64.rpm",
+        "checksum": "sha256:47719d5547c637a03553cd04f8c7197eee5b6e165e8aca5194cf87c096d471e5",
         "check_gpg": true
       },
       {
@@ -5505,6 +5526,16 @@
         "checksum": "sha256:a2a724f5a0691ee46d61566b139af518631702406f78fe4a9b0bc3d861a25b36",
         "check_gpg": true
       },
+      {
+        "name": "rpm-plugin-selinux",
+        "epoch": 0,
+        "version": "4.15.1",
+        "release": "3.fc32.1",
+        "arch": "aarch64",
+        "remote_location": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/r/rpm-plugin-selinux-4.15.1-3.fc32.1.aarch64.rpm",
+        "checksum": "sha256:ca215bab929641bb4a875c70c741eaadbc1a321a8b65f723494339a3fc3a3085",
+        "check_gpg": true
+      },
       {
         "name": "rpm-plugin-systemd-inhibit",
         "epoch": 0,
@@ -5525,6 +5556,26 @@
         "checksum": "sha256:2c5e2d6dd5bd36a56744b162c633f1564bd9494f2fe71092ab39414dd846554f",
         "check_gpg": true
       },
+      {
+        "name": "selinux-policy",
+        "epoch": 0,
+        "version": "3.14.5",
+        "release": "42.fc32",
+        "arch": "noarch",
+        "remote_location": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/s/selinux-policy-3.14.5-42.fc32.noarch.rpm",
+        "checksum": "sha256:04d6a0611b51f3b01baebcae7d64ccff0c15dfa548fbe19acfcd14a15f351df0",
+        "check_gpg": true
+      },
+      {
+        "name": "selinux-policy-targeted",
+        "epoch": 0,
+        "version": "3.14.5",
+        "release": "42.fc32",
+        "arch": "noarch",
+        "remote_location": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/s/selinux-policy-targeted-3.14.5-42.fc32.noarch.rpm",
+        "checksum": "sha256:8a4d7e56d61fbd05beede2dc1b3dfc4ee515bf9883983f1c59c798f9fb17987e",
+        "check_gpg": true
+      },
       {
         "name": "sqlite-libs",
         "epoch": 0,
@@ -8221,10 +8272,10 @@
         "name": "krb5-libs",
         "epoch": 0,
         "version": "1.18.2",
-        "release": "9.fc32",
+        "release": "10.fc32",
         "arch": "aarch64",
-        "remote_location": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/k/krb5-libs-1.18.2-9.fc32.aarch64.rpm",
-        "checksum": "sha256:e3e9485ac4a0383fbcc48a46cb4e03c59ebce219bbc734972bda6feea41da184",
+        "remote_location": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/k/krb5-libs-1.18.2-10.fc32.aarch64.rpm",
+        "checksum": "sha256:47719d5547c637a03553cd04f8c7197eee5b6e165e8aca5194cf87c096d471e5",
         "check_gpg": true
       },
       {
@@ -8360,11 +8411,11 @@
       {
         "name": "libnfsidmap",
         "epoch": 1,
-        "version": "2.4.3",
-        "release": "1.rc2.fc32",
+        "version": "2.5.1",
+        "release": "0.fc32",
         "arch": "aarch64",
-        "remote_location": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/l/libnfsidmap-2.4.3-1.rc2.fc32.aarch64.rpm",
-        "checksum": "sha256:612ba480fae16370d8efd7d8be5cd81ef6774724ad8ad35b1eac381f9d0ee7b9",
+        "remote_location": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/l/libnfsidmap-2.5.1-0.fc32.aarch64.rpm",
+        "checksum": "sha256:3c263340038fdd392971e72305a279a0d8a0974e05e18d71c86a51433c55525f",
         "check_gpg": true
       },
       {
@@ -9150,7 +9201,7 @@
     ],
     "checksums": {
       "0": "sha256:f56d50d2c120f5fe150f53a3f72d2b8df93d0c4c51e9ae866dfa08f1d5517fb1",
-      "1": "sha256:aa5653a600eb79cf5b9867a2431b0d58a82a445c0ab942cafff3134e1a720874"
+      "1": "sha256:a1439de08af904b6248c7ee68e40d3283cb1a187ee0dca05afed02577e1715fd"
     }
   },
   "image-info": {
@@ -9372,7 +9423,7 @@
       "kmod-27-1.fc32.aarch64",
       "kmod-libs-27-1.fc32.aarch64",
       "kpartx-0.8.2-4.fc32.aarch64",
-      "krb5-libs-1.18.2-9.fc32.aarch64",
+      "krb5-libs-1.18.2-10.fc32.aarch64",
       "langpacks-core-en-3.0-3.fc32.noarch",
       "langpacks-core-font-en-3.0-3.fc32.noarch",
       "langpacks-en-3.0-3.fc32.noarch",
@@ -9420,7 +9471,7 @@
       "libndp-1.7-5.fc32.aarch64",
       "libnetfilter_conntrack-1.0.7-4.fc32.aarch64",
       "libnfnetlink-1.0.1-17.fc32.aarch64",
-      "libnfsidmap-2.4.3-1.rc2.fc32.aarch64",
+      "libnfsidmap-2.5.1-0.fc32.aarch64",
       "libnftnl-1.1.5-2.fc32.aarch64",
       "libnghttp2-1.41.0-1.fc32.aarch64",
       "libnl3-3.5.0-2.fc32.aarch64",
diff --git a/test/cases/fedora_32-aarch64-openstack-boot.json b/test/cases/fedora_32-aarch64-openstack-boot.json
index 8b8ff17c9..349df4a75 100644
--- a/test/cases/fedora_32-aarch64-openstack-boot.json
+++ b/test/cases/fedora_32-aarch64-openstack-boot.json
@@ -339,6 +339,9 @@
           "sha256:3c09e6de4c9dda4020c0f4ca732a4d564c3688399cbb0f94a64999fa4b479585": {
             "url": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/d/dnf-plugins-core-4.0.16-1.fc32.noarch.rpm"
           },
+          "sha256:3c263340038fdd392971e72305a279a0d8a0974e05e18d71c86a51433c55525f": {
+            "url": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/l/libnfsidmap-2.5.1-0.fc32.aarch64.rpm"
+          },
           "sha256:3d6ec574fe2c612bcc45395f7ee87c68f45016f005c6d7aeee6b37897f41b8d2": {
             "url": "http://mirrors.kernel.org/fedora/releases/32/Everything/aarch64/os/Packages/q/qrencode-libs-4.0.2-5.fc32.aarch64.rpm"
           },
@@ -372,6 +375,9 @@
           "sha256:45e2c1c76a0a0b6e1164c457307250a54a7de5905992b4351a84183c2e9f2633": {
             "url": "http://mirrors.kernel.org/fedora/releases/32/Everything/aarch64/os/Packages/m/mkpasswd-5.5.6-1.fc32.aarch64.rpm"
           },
+          "sha256:47719d5547c637a03553cd04f8c7197eee5b6e165e8aca5194cf87c096d471e5": {
+            "url": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/k/krb5-libs-1.18.2-10.fc32.aarch64.rpm"
+          },
           "sha256:48381163a3f2c524697efc07538f040fde0b69d4e0fdcbe3bcfbc9924dd7d5dd": {
             "url": "http://mirrors.kernel.org/fedora/releases/32/Everything/aarch64/os/Packages/x/xz-libs-5.2.5-1.fc32.aarch64.rpm"
           },
@@ -474,9 +480,6 @@
           "sha256:60774007011889671c28158f599032f0db253c153ccae70f5e2f5840f2dc490b": {
             "url": "http://mirrors.kernel.org/fedora/releases/32/Everything/aarch64/os/Packages/k/kbd-misc-2.2.0-1.fc32.noarch.rpm"
           },
-          "sha256:612ba480fae16370d8efd7d8be5cd81ef6774724ad8ad35b1eac381f9d0ee7b9": {
-            "url": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/l/libnfsidmap-2.4.3-1.rc2.fc32.aarch64.rpm"
-          },
           "sha256:61c51596cc97f35177efe8dc5e2ca52d8fd528570f33c184497f419259b73c90": {
             "url": "http://mirrors.kernel.org/fedora/releases/32/Everything/aarch64/os/Packages/p/python3-idna-2.8-6.fc32.noarch.rpm"
           },
@@ -1035,9 +1038,6 @@
           "sha256:e36a47ff624d27a0a7059bde2fe022302ffe335571ba8cf84e7e5e3646000557": {
             "url": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/d/dbus-1.12.20-1.fc32.aarch64.rpm"
           },
-          "sha256:e3e9485ac4a0383fbcc48a46cb4e03c59ebce219bbc734972bda6feea41da184": {
-            "url": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/k/krb5-libs-1.18.2-9.fc32.aarch64.rpm"
-          },
           "sha256:e7b49bf8e3183d7604c7f7f51dfbc1e03bc599ddd7eac459a86f4ffdc8432533": {
             "url": "http://mirrors.kernel.org/fedora/releases/32/Everything/aarch64/os/Packages/l/libaio-0.3.111-7.fc32.aarch64.rpm"
           },
@@ -1800,7 +1800,7 @@
                     "check_gpg": true
                   },
                   {
-                    "checksum": "sha256:e3e9485ac4a0383fbcc48a46cb4e03c59ebce219bbc734972bda6feea41da184",
+                    "checksum": "sha256:47719d5547c637a03553cd04f8c7197eee5b6e165e8aca5194cf87c096d471e5",
                     "check_gpg": true
                   },
                   {
@@ -1987,6 +1987,10 @@
                     "checksum": "sha256:a2a724f5a0691ee46d61566b139af518631702406f78fe4a9b0bc3d861a25b36",
                     "check_gpg": true
                   },
+                  {
+                    "checksum": "sha256:ca215bab929641bb4a875c70c741eaadbc1a321a8b65f723494339a3fc3a3085",
+                    "check_gpg": true
+                  },
                   {
                     "checksum": "sha256:d24ab66ce52e5471345071c3c445392639c287be91c19b21fd500cc3980dc65b",
                     "check_gpg": true
@@ -1995,6 +1999,14 @@
                     "checksum": "sha256:2c5e2d6dd5bd36a56744b162c633f1564bd9494f2fe71092ab39414dd846554f",
                     "check_gpg": true
                   },
+                  {
+                    "checksum": "sha256:04d6a0611b51f3b01baebcae7d64ccff0c15dfa548fbe19acfcd14a15f351df0",
+                    "check_gpg": true
+                  },
+                  {
+                    "checksum": "sha256:8a4d7e56d61fbd05beede2dc1b3dfc4ee515bf9883983f1c59c798f9fb17987e",
+                    "check_gpg": true
+                  },
                   {
                     "checksum": "sha256:09e4ac05c661fad09387f1e61050ef42447ce4e5102fcb4c4cbfe5c95618e9e9",
                     "check_gpg": true
@@ -2041,6 +2053,15 @@
                   }
                 ]
               }
+            },
+            {
+              "name": "org.osbuild.selinux",
+              "options": {
+                "file_contexts": "etc/selinux/targeted/contexts/files/file_contexts",
+                "labels": {
+                  "/usr/bin/cp": "system_u:object_r:install_exec_t:s0"
+                }
+              }
             }
           ]
         },
@@ -3156,7 +3177,7 @@
                 "check_gpg": true
               },
               {
-                "checksum": "sha256:e3e9485ac4a0383fbcc48a46cb4e03c59ebce219bbc734972bda6feea41da184",
+                "checksum": "sha256:47719d5547c637a03553cd04f8c7197eee5b6e165e8aca5194cf87c096d471e5",
                 "check_gpg": true
               },
               {
@@ -3212,7 +3233,7 @@
                 "check_gpg": true
               },
               {
-                "checksum": "sha256:612ba480fae16370d8efd7d8be5cd81ef6774724ad8ad35b1eac381f9d0ee7b9",
+                "checksum": "sha256:3c263340038fdd392971e72305a279a0d8a0974e05e18d71c86a51433c55525f",
                 "check_gpg": true
               },
               {
@@ -5199,10 +5220,10 @@
         "name": "krb5-libs",
         "epoch": 0,
         "version": "1.18.2",
-        "release": "9.fc32",
+        "release": "10.fc32",
         "arch": "aarch64",
-        "remote_location": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/k/krb5-libs-1.18.2-9.fc32.aarch64.rpm",
-        "checksum": "sha256:e3e9485ac4a0383fbcc48a46cb4e03c59ebce219bbc734972bda6feea41da184",
+        "remote_location": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/k/krb5-libs-1.18.2-10.fc32.aarch64.rpm",
+        "checksum": "sha256:47719d5547c637a03553cd04f8c7197eee5b6e165e8aca5194cf87c096d471e5",
         "check_gpg": true
       },
       {
@@ -5665,6 +5686,16 @@
         "checksum": "sha256:a2a724f5a0691ee46d61566b139af518631702406f78fe4a9b0bc3d861a25b36",
         "check_gpg": true
       },
+      {
+        "name": "rpm-plugin-selinux",
+        "epoch": 0,
+        "version": "4.15.1",
+        "release": "3.fc32.1",
+        "arch": "aarch64",
+        "remote_location": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/r/rpm-plugin-selinux-4.15.1-3.fc32.1.aarch64.rpm",
+        "checksum": "sha256:ca215bab929641bb4a875c70c741eaadbc1a321a8b65f723494339a3fc3a3085",
+        "check_gpg": true
+      },
       {
         "name": "rpm-plugin-systemd-inhibit",
         "epoch": 0,
@@ -5685,6 +5716,26 @@
         "checksum": "sha256:2c5e2d6dd5bd36a56744b162c633f1564bd9494f2fe71092ab39414dd846554f",
         "check_gpg": true
       },
+      {
+        "name": "selinux-policy",
+        "epoch": 0,
+        "version": "3.14.5",
+        "release": "42.fc32",
+        "arch": "noarch",
+        "remote_location": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/s/selinux-policy-3.14.5-42.fc32.noarch.rpm",
+        "checksum": "sha256:04d6a0611b51f3b01baebcae7d64ccff0c15dfa548fbe19acfcd14a15f351df0",
+        "check_gpg": true
+      },
+      {
+        "name": "selinux-policy-targeted",
+        "epoch": 0,
+        "version": "3.14.5",
+        "release": "42.fc32",
+        "arch": "noarch",
+        "remote_location": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/s/selinux-policy-targeted-3.14.5-42.fc32.noarch.rpm",
+        "checksum": "sha256:8a4d7e56d61fbd05beede2dc1b3dfc4ee515bf9883983f1c59c798f9fb17987e",
+        "check_gpg": true
+      },
       {
         "name": "sqlite-libs",
         "epoch": 0,
@@ -8551,10 +8602,10 @@
         "name": "krb5-libs",
         "epoch": 0,
         "version": "1.18.2",
-        "release": "9.fc32",
+        "release": "10.fc32",
         "arch": "aarch64",
-        "remote_location": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/k/krb5-libs-1.18.2-9.fc32.aarch64.rpm",
-        "checksum": "sha256:e3e9485ac4a0383fbcc48a46cb4e03c59ebce219bbc734972bda6feea41da184",
+        "remote_location": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/k/krb5-libs-1.18.2-10.fc32.aarch64.rpm",
+        "checksum": "sha256:47719d5547c637a03553cd04f8c7197eee5b6e165e8aca5194cf87c096d471e5",
         "check_gpg": true
       },
       {
@@ -8690,11 +8741,11 @@
       {
         "name": "libnfsidmap",
         "epoch": 1,
-        "version": "2.4.3",
-        "release": "1.rc2.fc32",
+        "version": "2.5.1",
+        "release": "0.fc32",
         "arch": "aarch64",
-        "remote_location": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/l/libnfsidmap-2.4.3-1.rc2.fc32.aarch64.rpm",
-        "checksum": "sha256:612ba480fae16370d8efd7d8be5cd81ef6774724ad8ad35b1eac381f9d0ee7b9",
+        "remote_location": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/l/libnfsidmap-2.5.1-0.fc32.aarch64.rpm",
+        "checksum": "sha256:3c263340038fdd392971e72305a279a0d8a0974e05e18d71c86a51433c55525f",
         "check_gpg": true
       },
       {
@@ -9500,7 +9551,7 @@
     ],
     "checksums": {
       "0": "sha256:f56d50d2c120f5fe150f53a3f72d2b8df93d0c4c51e9ae866dfa08f1d5517fb1",
-      "1": "sha256:aa5653a600eb79cf5b9867a2431b0d58a82a445c0ab942cafff3134e1a720874"
+      "1": "sha256:a1439de08af904b6248c7ee68e40d3283cb1a187ee0dca05afed02577e1715fd"
     }
   },
   "image-info": {
@@ -9725,7 +9776,7 @@
       "kmod-27-1.fc32.aarch64",
       "kmod-libs-27-1.fc32.aarch64",
       "kpartx-0.8.2-4.fc32.aarch64",
-      "krb5-libs-1.18.2-9.fc32.aarch64",
+      "krb5-libs-1.18.2-10.fc32.aarch64",
       "langpacks-core-en-3.0-3.fc32.noarch",
       "langpacks-core-font-en-3.0-3.fc32.noarch",
       "langpacks-en-3.0-3.fc32.noarch",
@@ -9783,7 +9834,7 @@
       "libndp-1.7-5.fc32.aarch64",
       "libnetfilter_conntrack-1.0.7-4.fc32.aarch64",
       "libnfnetlink-1.0.1-17.fc32.aarch64",
-      "libnfsidmap-2.4.3-1.rc2.fc32.aarch64",
+      "libnfsidmap-2.5.1-0.fc32.aarch64",
       "libnftnl-1.1.5-2.fc32.aarch64",
       "libnghttp2-1.41.0-1.fc32.aarch64",
       "libnl3-3.5.0-2.fc32.aarch64",
diff --git a/test/cases/fedora_32-aarch64-qcow2-boot.json b/test/cases/fedora_32-aarch64-qcow2-boot.json
index eda9574f4..ea82147c6 100644
--- a/test/cases/fedora_32-aarch64-qcow2-boot.json
+++ b/test/cases/fedora_32-aarch64-qcow2-boot.json
@@ -108,9 +108,6 @@
           "sha256:0a87bedd7687620ce85224027c0cfebc603b92962f67db432eb5a7b00d405cde": {
             "url": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/c/ca-certificates-2020.2.41-1.1.fc32.noarch.rpm"
           },
-          "sha256:0c84ca581adcd4ce0d258ad78b29bf08f3f9d7135c69d85be96167c4df5cface": {
-            "url": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/c/console-login-helper-messages-issuegen-0.18.1-1.fc32.noarch.rpm"
-          },
           "sha256:0cf223e3ea442d7929af74d8f05bcac06970ad3d74f7f8b9bccc25712ac75640": {
             "url": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/s/systemd-udev-245.6-2.fc32.aarch64.rpm"
           },
@@ -168,6 +165,9 @@
           "sha256:1a096ed78df5a9339c4b3c15372275a884a1124b048ffcfbdb768db881e47ab2": {
             "url": "http://mirrors.kernel.org/fedora/releases/32/Everything/aarch64/os/Packages/l/libpwquality-1.4.2-2.fc32.aarch64.rpm"
           },
+          "sha256:1a66c0832a5ef0b3eefa2b3ec915b97c0e725af91a807e8f699f91038291ddd6": {
+            "url": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/c/console-login-helper-messages-0.18.2-1.fc32.noarch.rpm"
+          },
           "sha256:1bbbb39da25177d52b5cd9f25f9e09b9dbac55822a4e0238da5e706d35fb5f38": {
             "url": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/s/systemd-libs-245.6-2.fc32.aarch64.rpm"
           },
@@ -204,9 +204,6 @@
           "sha256:202d761caf4c9d4937c04388a7180d6687a79e8141136be0f7ecc3a54bf80594": {
             "url": "http://mirrors.kernel.org/fedora/releases/32/Everything/aarch64/os/Packages/x/xz-5.2.5-1.fc32.aarch64.rpm"
           },
-          "sha256:223ed731b03d273f2e7f36528ea10804d2b05e4ead7613d69dc9cdb1542a33be": {
-            "url": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/c/console-login-helper-messages-0.18.1-1.fc32.noarch.rpm"
-          },
           "sha256:22954219a63638d7418204d818c01a0e3c914e2b2eb970f2e4638dcf5a7a5634": {
             "url": "http://mirrors.kernel.org/fedora/releases/32/Everything/aarch64/os/Packages/l/libutempter-1.1.6-18.fc32.aarch64.rpm"
           },
@@ -318,6 +315,9 @@
           "sha256:3c09e6de4c9dda4020c0f4ca732a4d564c3688399cbb0f94a64999fa4b479585": {
             "url": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/d/dnf-plugins-core-4.0.16-1.fc32.noarch.rpm"
           },
+          "sha256:3c263340038fdd392971e72305a279a0d8a0974e05e18d71c86a51433c55525f": {
+            "url": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/l/libnfsidmap-2.5.1-0.fc32.aarch64.rpm"
+          },
           "sha256:3d6ec574fe2c612bcc45395f7ee87c68f45016f005c6d7aeee6b37897f41b8d2": {
             "url": "http://mirrors.kernel.org/fedora/releases/32/Everything/aarch64/os/Packages/q/qrencode-libs-4.0.2-5.fc32.aarch64.rpm"
           },
@@ -348,6 +348,9 @@
           "sha256:45e2c1c76a0a0b6e1164c457307250a54a7de5905992b4351a84183c2e9f2633": {
             "url": "http://mirrors.kernel.org/fedora/releases/32/Everything/aarch64/os/Packages/m/mkpasswd-5.5.6-1.fc32.aarch64.rpm"
           },
+          "sha256:47719d5547c637a03553cd04f8c7197eee5b6e165e8aca5194cf87c096d471e5": {
+            "url": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/k/krb5-libs-1.18.2-10.fc32.aarch64.rpm"
+          },
           "sha256:48381163a3f2c524697efc07538f040fde0b69d4e0fdcbe3bcfbc9924dd7d5dd": {
             "url": "http://mirrors.kernel.org/fedora/releases/32/Everything/aarch64/os/Packages/x/xz-libs-5.2.5-1.fc32.aarch64.rpm"
           },
@@ -444,9 +447,6 @@
           "sha256:60774007011889671c28158f599032f0db253c153ccae70f5e2f5840f2dc490b": {
             "url": "http://mirrors.kernel.org/fedora/releases/32/Everything/aarch64/os/Packages/k/kbd-misc-2.2.0-1.fc32.noarch.rpm"
           },
-          "sha256:612ba480fae16370d8efd7d8be5cd81ef6774724ad8ad35b1eac381f9d0ee7b9": {
-            "url": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/l/libnfsidmap-2.4.3-1.rc2.fc32.aarch64.rpm"
-          },
           "sha256:61c51596cc97f35177efe8dc5e2ca52d8fd528570f33c184497f419259b73c90": {
             "url": "http://mirrors.kernel.org/fedora/releases/32/Everything/aarch64/os/Packages/p/python3-idna-2.8-6.fc32.noarch.rpm"
           },
@@ -609,6 +609,9 @@
           "sha256:91e35b3750f5029be019542a4143cf00de68559b9ab6ae6df2c8f7ea6e60acd9": {
             "url": "http://mirrors.kernel.org/fedora/releases/32/Everything/aarch64/os/Packages/t/tss2-1331-4.fc32.aarch64.rpm"
           },
+          "sha256:926d849718530c7e2132e9a2cfe0702506a98450c3e98a00da725118ade1c791": {
+            "url": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/c/console-login-helper-messages-profile-0.18.2-1.fc32.noarch.rpm"
+          },
           "sha256:93436ea4755be74d7be2c2749a2a10ac5cae16d62343da5ce993348678e691f4": {
             "url": "http://mirrors.kernel.org/fedora/releases/32/Everything/aarch64/os/Packages/p/python3-distro-1.4.0-5.fc32.noarch.rpm"
           },
@@ -867,6 +870,9 @@
           "sha256:cf8d722d982b7899289148986176f35ac29deb4a188964a11be65068fce36c7d": {
             "url": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/g/gnupg2-2.2.20-2.fc32.aarch64.rpm"
           },
+          "sha256:cf9b90a8f483076cd43bf4ed5643d3164d259137ae765d8a863461cbccea98eb": {
+            "url": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/c/console-login-helper-messages-motdgen-0.18.2-1.fc32.noarch.rpm"
+          },
           "sha256:cffbab9f6052ee2c7b8bcc369a411e319174de094fb94eaf71555ce485049a74": {
             "url": "http://mirrors.kernel.org/fedora/releases/32/Everything/aarch64/os/Packages/l/libgpg-error-1.36-3.fc32.aarch64.rpm"
           },
@@ -948,18 +954,9 @@
           "sha256:e051cdb98a0c7f0f4e0fc915a3a54328c9ea00299999deaddc300daa2e6f24c9": {
             "url": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/l/libdnf-0.48.0-1.fc32.aarch64.rpm"
           },
-          "sha256:e058893d6de91ec7c268bc59c3eb332957b9c2133b5b395943e14a14ed92548d": {
-            "url": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/c/console-login-helper-messages-motdgen-0.18.1-1.fc32.noarch.rpm"
-          },
           "sha256:e36a47ff624d27a0a7059bde2fe022302ffe335571ba8cf84e7e5e3646000557": {
             "url": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/d/dbus-1.12.20-1.fc32.aarch64.rpm"
           },
-          "sha256:e3e9485ac4a0383fbcc48a46cb4e03c59ebce219bbc734972bda6feea41da184": {
-            "url": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/k/krb5-libs-1.18.2-9.fc32.aarch64.rpm"
-          },
-          "sha256:e795bb396d986aadb61199f2c8f1b411f99d3b4e4ee919367305dadea585f9a2": {
-            "url": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/c/console-login-helper-messages-profile-0.18.1-1.fc32.noarch.rpm"
-          },
           "sha256:e7b49bf8e3183d7604c7f7f51dfbc1e03bc599ddd7eac459a86f4ffdc8432533": {
             "url": "http://mirrors.kernel.org/fedora/releases/32/Everything/aarch64/os/Packages/l/libaio-0.3.111-7.fc32.aarch64.rpm"
           },
@@ -996,6 +993,9 @@
           "sha256:eded265cff5d22b89a955570eba030643d6730dd5987c2efed3110ef74cd0254": {
             "url": "http://mirrors.kernel.org/fedora/releases/32/Everything/aarch64/os/Packages/p/python3-libsemanage-3.0-3.fc32.aarch64.rpm"
           },
+          "sha256:ef420fad8b429da539c83a0db62ff9085b26f04ff13fcac6f184df87ae73b84d": {
+            "url": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/c/console-login-helper-messages-issuegen-0.18.2-1.fc32.noarch.rpm"
+          },
           "sha256:efb1d9859da82a2492235650fcdec2cce08201490060566c8867a6cf6c2e3c89": {
             "url": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/l/linux-firmware-whence-20200619-109.fc32.noarch.rpm"
           },
@@ -1710,7 +1710,7 @@
                     "check_gpg": true
                   },
                   {
-                    "checksum": "sha256:e3e9485ac4a0383fbcc48a46cb4e03c59ebce219bbc734972bda6feea41da184",
+                    "checksum": "sha256:47719d5547c637a03553cd04f8c7197eee5b6e165e8aca5194cf87c096d471e5",
                     "check_gpg": true
                   },
                   {
@@ -1897,6 +1897,10 @@
                     "checksum": "sha256:a2a724f5a0691ee46d61566b139af518631702406f78fe4a9b0bc3d861a25b36",
                     "check_gpg": true
                   },
+                  {
+                    "checksum": "sha256:ca215bab929641bb4a875c70c741eaadbc1a321a8b65f723494339a3fc3a3085",
+                    "check_gpg": true
+                  },
                   {
                     "checksum": "sha256:d24ab66ce52e5471345071c3c445392639c287be91c19b21fd500cc3980dc65b",
                     "check_gpg": true
@@ -1905,6 +1909,14 @@
                     "checksum": "sha256:2c5e2d6dd5bd36a56744b162c633f1564bd9494f2fe71092ab39414dd846554f",
                     "check_gpg": true
                   },
+                  {
+                    "checksum": "sha256:04d6a0611b51f3b01baebcae7d64ccff0c15dfa548fbe19acfcd14a15f351df0",
+                    "check_gpg": true
+                  },
+                  {
+                    "checksum": "sha256:8a4d7e56d61fbd05beede2dc1b3dfc4ee515bf9883983f1c59c798f9fb17987e",
+                    "check_gpg": true
+                  },
                   {
                     "checksum": "sha256:09e4ac05c661fad09387f1e61050ef42447ce4e5102fcb4c4cbfe5c95618e9e9",
                     "check_gpg": true
@@ -1951,6 +1963,15 @@
                   }
                 ]
               }
+            },
+            {
+              "name": "org.osbuild.selinux",
+              "options": {
+                "file_contexts": "etc/selinux/targeted/contexts/files/file_contexts",
+                "labels": {
+                  "/usr/bin/cp": "system_u:object_r:install_exec_t:s0"
+                }
+              }
             }
           ]
         },
@@ -2774,19 +2795,19 @@
                 "check_gpg": true
               },
               {
-                "checksum": "sha256:223ed731b03d273f2e7f36528ea10804d2b05e4ead7613d69dc9cdb1542a33be",
+                "checksum": "sha256:1a66c0832a5ef0b3eefa2b3ec915b97c0e725af91a807e8f699f91038291ddd6",
                 "check_gpg": true
               },
               {
-                "checksum": "sha256:0c84ca581adcd4ce0d258ad78b29bf08f3f9d7135c69d85be96167c4df5cface",
+                "checksum": "sha256:ef420fad8b429da539c83a0db62ff9085b26f04ff13fcac6f184df87ae73b84d",
                 "check_gpg": true
               },
               {
-                "checksum": "sha256:e058893d6de91ec7c268bc59c3eb332957b9c2133b5b395943e14a14ed92548d",
+                "checksum": "sha256:cf9b90a8f483076cd43bf4ed5643d3164d259137ae765d8a863461cbccea98eb",
                 "check_gpg": true
               },
               {
-                "checksum": "sha256:e795bb396d986aadb61199f2c8f1b411f99d3b4e4ee919367305dadea585f9a2",
+                "checksum": "sha256:926d849718530c7e2132e9a2cfe0702506a98450c3e98a00da725118ade1c791",
                 "check_gpg": true
               },
               {
@@ -2974,7 +2995,7 @@
                 "check_gpg": true
               },
               {
-                "checksum": "sha256:e3e9485ac4a0383fbcc48a46cb4e03c59ebce219bbc734972bda6feea41da184",
+                "checksum": "sha256:47719d5547c637a03553cd04f8c7197eee5b6e165e8aca5194cf87c096d471e5",
                 "check_gpg": true
               },
               {
@@ -3030,7 +3051,7 @@
                 "check_gpg": true
               },
               {
-                "checksum": "sha256:612ba480fae16370d8efd7d8be5cd81ef6774724ad8ad35b1eac381f9d0ee7b9",
+                "checksum": "sha256:3c263340038fdd392971e72305a279a0d8a0974e05e18d71c86a51433c55525f",
                 "check_gpg": true
               },
               {
@@ -4989,10 +5010,10 @@
         "name": "krb5-libs",
         "epoch": 0,
         "version": "1.18.2",
-        "release": "9.fc32",
+        "release": "10.fc32",
         "arch": "aarch64",
-        "remote_location": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/k/krb5-libs-1.18.2-9.fc32.aarch64.rpm",
-        "checksum": "sha256:e3e9485ac4a0383fbcc48a46cb4e03c59ebce219bbc734972bda6feea41da184",
+        "remote_location": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/k/krb5-libs-1.18.2-10.fc32.aarch64.rpm",
+        "checksum": "sha256:47719d5547c637a03553cd04f8c7197eee5b6e165e8aca5194cf87c096d471e5",
         "check_gpg": true
       },
       {
@@ -5455,6 +5476,16 @@
         "checksum": "sha256:a2a724f5a0691ee46d61566b139af518631702406f78fe4a9b0bc3d861a25b36",
         "check_gpg": true
       },
+      {
+        "name": "rpm-plugin-selinux",
+        "epoch": 0,
+        "version": "4.15.1",
+        "release": "3.fc32.1",
+        "arch": "aarch64",
+        "remote_location": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/r/rpm-plugin-selinux-4.15.1-3.fc32.1.aarch64.rpm",
+        "checksum": "sha256:ca215bab929641bb4a875c70c741eaadbc1a321a8b65f723494339a3fc3a3085",
+        "check_gpg": true
+      },
       {
         "name": "rpm-plugin-systemd-inhibit",
         "epoch": 0,
@@ -5475,6 +5506,26 @@
         "checksum": "sha256:2c5e2d6dd5bd36a56744b162c633f1564bd9494f2fe71092ab39414dd846554f",
         "check_gpg": true
       },
+      {
+        "name": "selinux-policy",
+        "epoch": 0,
+        "version": "3.14.5",
+        "release": "42.fc32",
+        "arch": "noarch",
+        "remote_location": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/s/selinux-policy-3.14.5-42.fc32.noarch.rpm",
+        "checksum": "sha256:04d6a0611b51f3b01baebcae7d64ccff0c15dfa548fbe19acfcd14a15f351df0",
+        "check_gpg": true
+      },
+      {
+        "name": "selinux-policy-targeted",
+        "epoch": 0,
+        "version": "3.14.5",
+        "release": "42.fc32",
+        "arch": "noarch",
+        "remote_location": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/s/selinux-policy-targeted-3.14.5-42.fc32.noarch.rpm",
+        "checksum": "sha256:8a4d7e56d61fbd05beede2dc1b3dfc4ee515bf9883983f1c59c798f9fb17987e",
+        "check_gpg": true
+      },
       {
         "name": "sqlite-libs",
         "epoch": 0,
@@ -7610,41 +7661,41 @@
       {
         "name": "console-login-helper-messages",
         "epoch": 0,
-        "version": "0.18.1",
+        "version": "0.18.2",
         "release": "1.fc32",
         "arch": "noarch",
-        "remote_location": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/c/console-login-helper-messages-0.18.1-1.fc32.noarch.rpm",
-        "checksum": "sha256:223ed731b03d273f2e7f36528ea10804d2b05e4ead7613d69dc9cdb1542a33be",
+        "remote_location": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/c/console-login-helper-messages-0.18.2-1.fc32.noarch.rpm",
+        "checksum": "sha256:1a66c0832a5ef0b3eefa2b3ec915b97c0e725af91a807e8f699f91038291ddd6",
         "check_gpg": true
       },
       {
         "name": "console-login-helper-messages-issuegen",
         "epoch": 0,
-        "version": "0.18.1",
+        "version": "0.18.2",
         "release": "1.fc32",
         "arch": "noarch",
-        "remote_location": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/c/console-login-helper-messages-issuegen-0.18.1-1.fc32.noarch.rpm",
-        "checksum": "sha256:0c84ca581adcd4ce0d258ad78b29bf08f3f9d7135c69d85be96167c4df5cface",
+        "remote_location": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/c/console-login-helper-messages-issuegen-0.18.2-1.fc32.noarch.rpm",
+        "checksum": "sha256:ef420fad8b429da539c83a0db62ff9085b26f04ff13fcac6f184df87ae73b84d",
         "check_gpg": true
       },
       {
         "name": "console-login-helper-messages-motdgen",
         "epoch": 0,
-        "version": "0.18.1",
+        "version": "0.18.2",
         "release": "1.fc32",
         "arch": "noarch",
-        "remote_location": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/c/console-login-helper-messages-motdgen-0.18.1-1.fc32.noarch.rpm",
-        "checksum": "sha256:e058893d6de91ec7c268bc59c3eb332957b9c2133b5b395943e14a14ed92548d",
+        "remote_location": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/c/console-login-helper-messages-motdgen-0.18.2-1.fc32.noarch.rpm",
+        "checksum": "sha256:cf9b90a8f483076cd43bf4ed5643d3164d259137ae765d8a863461cbccea98eb",
         "check_gpg": true
       },
       {
         "name": "console-login-helper-messages-profile",
         "epoch": 0,
-        "version": "0.18.1",
+        "version": "0.18.2",
         "release": "1.fc32",
         "arch": "noarch",
-        "remote_location": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/c/console-login-helper-messages-profile-0.18.1-1.fc32.noarch.rpm",
-        "checksum": "sha256:e795bb396d986aadb61199f2c8f1b411f99d3b4e4ee919367305dadea585f9a2",
+        "remote_location": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/c/console-login-helper-messages-profile-0.18.2-1.fc32.noarch.rpm",
+        "checksum": "sha256:926d849718530c7e2132e9a2cfe0702506a98450c3e98a00da725118ade1c791",
         "check_gpg": true
       },
       {
@@ -8111,10 +8162,10 @@
         "name": "krb5-libs",
         "epoch": 0,
         "version": "1.18.2",
-        "release": "9.fc32",
+        "release": "10.fc32",
         "arch": "aarch64",
-        "remote_location": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/k/krb5-libs-1.18.2-9.fc32.aarch64.rpm",
-        "checksum": "sha256:e3e9485ac4a0383fbcc48a46cb4e03c59ebce219bbc734972bda6feea41da184",
+        "remote_location": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/k/krb5-libs-1.18.2-10.fc32.aarch64.rpm",
+        "checksum": "sha256:47719d5547c637a03553cd04f8c7197eee5b6e165e8aca5194cf87c096d471e5",
         "check_gpg": true
       },
       {
@@ -8250,11 +8301,11 @@
       {
         "name": "libnfsidmap",
         "epoch": 1,
-        "version": "2.4.3",
-        "release": "1.rc2.fc32",
+        "version": "2.5.1",
+        "release": "0.fc32",
         "arch": "aarch64",
-        "remote_location": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/l/libnfsidmap-2.4.3-1.rc2.fc32.aarch64.rpm",
-        "checksum": "sha256:612ba480fae16370d8efd7d8be5cd81ef6774724ad8ad35b1eac381f9d0ee7b9",
+        "remote_location": "http://mirrors.kernel.org/fedora/updates/32/Everything/aarch64/Packages/l/libnfsidmap-2.5.1-0.fc32.aarch64.rpm",
+        "checksum": "sha256:3c263340038fdd392971e72305a279a0d8a0974e05e18d71c86a51433c55525f",
         "check_gpg": true
       },
       {
@@ -8990,7 +9041,7 @@
     ],
     "checksums": {
       "0": "sha256:f56d50d2c120f5fe150f53a3f72d2b8df93d0c4c51e9ae866dfa08f1d5517fb1",
-      "1": "sha256:aa5653a600eb79cf5b9867a2431b0d58a82a445c0ab942cafff3134e1a720874"
+      "1": "sha256:a1439de08af904b6248c7ee68e40d3283cb1a187ee0dca05afed02577e1715fd"
     }
   },
   "image-info": {
@@ -9113,10 +9164,10 @@
       "cloud-init-19.4-2.fc32.noarch",
       "cloud-utils-growpart-0.31-6.fc32.noarch",
       "compat-f32-dejavu-sans-fonts-2.37-8.fc32.noarch",
-      "console-login-helper-messages-0.18.1-1.fc32.noarch",
-      "console-login-helper-messages-issuegen-0.18.1-1.fc32.noarch",
-      "console-login-helper-messages-motdgen-0.18.1-1.fc32.noarch",
-      "console-login-helper-messages-profile-0.18.1-1.fc32.noarch",
+      "console-login-helper-messages-0.18.2-1.fc32.noarch",
+      "console-login-helper-messages-issuegen-0.18.2-1.fc32.noarch",
+      "console-login-helper-messages-motdgen-0.18.2-1.fc32.noarch",
+      "console-login-helper-messages-profile-0.18.2-1.fc32.noarch",
       "coreutils-8.32-4.fc32.1.aarch64",
       "coreutils-common-8.32-4.fc32.1.aarch64",
       "cpio-2.13-4.fc32.aarch64",
@@ -9207,7 +9258,7 @@
       "kmod-27-1.fc32.aarch64",
       "kmod-libs-27-1.fc32.aarch64",
       "kpartx-0.8.2-4.fc32.aarch64",
-      "krb5-libs-1.18.2-9.fc32.aarch64",
+      "krb5-libs-1.18.2-10.fc32.aarch64",
       "langpacks-core-en-3.0-3.fc32.noarch",
       "langpacks-core-font-en-3.0-3.fc32.noarch",
       "langpacks-en-3.0-3.fc32.noarch",
@@ -9255,7 +9306,7 @@
       "libndp-1.7-5.fc32.aarch64",
       "libnetfilter_conntrack-1.0.7-4.fc32.aarch64",
       "libnfnetlink-1.0.1-17.fc32.aarch64",
-      "libnfsidmap-2.4.3-1.rc2.fc32.aarch64",
+      "libnfsidmap-2.5.1-0.fc32.aarch64",
       "libnghttp2-1.41.0-1.fc32.aarch64",
       "libnl3-3.5.0-2.fc32.aarch64",
       "libnsl2-1.2.0-6.20180605git4a062cf.fc32.aarch64",
@@ -9514,7 +9565,9 @@
       "cloud-init-local.service",
       "cloud-init.service",
       "console-getty.service",
+      "console-login-helper-messages-issuegen.path",
       "console-login-helper-messages-issuegen.service",
+      "console-login-helper-messages-motdgen.path",
       "console-login-helper-messages-motdgen.service",
       "debug-shell.service",
       "exit.target",
diff --git a/test/cases/fedora_32-x86_64-ami-boot.json b/test/cases/fedora_32-x86_64-ami-boot.json
index c9333d2ca..8032a7ab4 100644
--- a/test/cases/fedora_32-x86_64-ami-boot.json
+++ b/test/cases/fedora_32-x86_64-ami-boot.json
@@ -1853,6 +1853,10 @@
                     "checksum": "sha256:54b740cf7a75a7215168970378d9a1d6b9a5e4eb81159a874ce8ea5990436641",
                     "check_gpg": true
                   },
+                  {
+                    "checksum": "sha256:27dd9c78e41c04b5151a2b9ac150d3ebb89f2ca7a23e4896dfc718f19a000be3",
+                    "check_gpg": true
+                  },
                   {
                     "checksum": "sha256:e2a04f4de125ff60a3cdc3d2b3718a4530a9c9240c9cf14f55938444c229539f",
                     "check_gpg": true
@@ -1865,6 +1869,14 @@
                     "checksum": "sha256:ffe5076b9018efdb1612c487f637af39ab6c3c79ec37311978935cfa357ecd61",
                     "check_gpg": true
                   },
+                  {
+                    "checksum": "sha256:932a37ddd2a990a22a1ee7811d204552e8860e39a3e0c050ed618a535ae8c78c",
+                    "check_gpg": true
+                  },
+                  {
+                    "checksum": "sha256:684aae86de55bd42215c136777613211f596788d3b6405d8fa645fb967904354",
+                    "check_gpg": true
+                  },
                   {
                     "checksum": "sha256:a336d2e77255df4783f52762e44efcc8d77b044a3e39c7f577d5535212848280",
                     "check_gpg": true
@@ -1959,6 +1971,15 @@
                   }
                 ]
               }
+            },
+            {
+              "name": "org.osbuild.selinux",
+              "options": {
+                "file_contexts": "etc/selinux/targeted/contexts/files/file_contexts",
+                "labels": {
+                  "/usr/bin/cp": "system_u:object_r:install_exec_t:s0"
+                }
+              }
             }
           ]
         },
@@ -5340,6 +5361,16 @@
         "checksum": "sha256:54b740cf7a75a7215168970378d9a1d6b9a5e4eb81159a874ce8ea5990436641",
         "check_gpg": true
       },
+      {
+        "name": "rpm-plugin-selinux",
+        "epoch": 0,
+        "version": "4.15.1",
+        "release": "2.fc32.1",
+        "arch": "x86_64",
+        "remote_location": "http://mirrors.kernel.org/fedora/releases/32/Everything/x86_64/os/Packages/r/rpm-plugin-selinux-4.15.1-2.fc32.1.x86_64.rpm",
+        "checksum": "sha256:27dd9c78e41c04b5151a2b9ac150d3ebb89f2ca7a23e4896dfc718f19a000be3",
+        "check_gpg": true
+      },
       {
         "name": "rpm-plugin-systemd-inhibit",
         "epoch": 0,
@@ -5370,6 +5401,26 @@
         "checksum": "sha256:ffe5076b9018efdb1612c487f637af39ab6c3c79ec37311978935cfa357ecd61",
         "check_gpg": true
       },
+      {
+        "name": "selinux-policy",
+        "epoch": 0,
+        "version": "3.14.5",
+        "release": "32.fc32",
+        "arch": "noarch",
+        "remote_location": "http://mirrors.kernel.org/fedora/releases/32/Everything/x86_64/os/Packages/s/selinux-policy-3.14.5-32.fc32.noarch.rpm",
+        "checksum": "sha256:932a37ddd2a990a22a1ee7811d204552e8860e39a3e0c050ed618a535ae8c78c",
+        "check_gpg": true
+      },
+      {
+        "name": "selinux-policy-targeted",
+        "epoch": 0,
+        "version": "3.14.5",
+        "release": "32.fc32",
+        "arch": "noarch",
+        "remote_location": "http://mirrors.kernel.org/fedora/releases/32/Everything/x86_64/os/Packages/s/selinux-policy-targeted-3.14.5-32.fc32.noarch.rpm",
+        "checksum": "sha256:684aae86de55bd42215c136777613211f596788d3b6405d8fa645fb967904354",
+        "check_gpg": true
+      },
       {
         "name": "setup",
         "epoch": 0,
diff --git a/test/cases/fedora_32-x86_64-fedora_iot_commit-boot.json b/test/cases/fedora_32-x86_64-fedora_iot_commit-boot.json
index ce7f3af7a..cbd2e9cfc 100644
--- a/test/cases/fedora_32-x86_64-fedora_iot_commit-boot.json
+++ b/test/cases/fedora_32-x86_64-fedora_iot_commit-boot.json
@@ -2085,6 +2085,10 @@
                     "checksum": "sha256:9d220d8ee28cd0adf28e8fef547af92c3ec66e238747165939cf8e1a413ddf83",
                     "check_gpg": true
                   },
+                  {
+                    "checksum": "sha256:27dd9c78e41c04b5151a2b9ac150d3ebb89f2ca7a23e4896dfc718f19a000be3",
+                    "check_gpg": true
+                  },
                   {
                     "checksum": "sha256:e2a04f4de125ff60a3cdc3d2b3718a4530a9c9240c9cf14f55938444c229539f",
                     "check_gpg": true
@@ -2097,6 +2101,14 @@
                     "checksum": "sha256:ffe5076b9018efdb1612c487f637af39ab6c3c79ec37311978935cfa357ecd61",
                     "check_gpg": true
                   },
+                  {
+                    "checksum": "sha256:932a37ddd2a990a22a1ee7811d204552e8860e39a3e0c050ed618a535ae8c78c",
+                    "check_gpg": true
+                  },
+                  {
+                    "checksum": "sha256:684aae86de55bd42215c136777613211f596788d3b6405d8fa645fb967904354",
+                    "check_gpg": true
+                  },
                   {
                     "checksum": "sha256:a336d2e77255df4783f52762e44efcc8d77b044a3e39c7f577d5535212848280",
                     "check_gpg": true
@@ -2191,6 +2203,15 @@
                   }
                 ]
               }
+            },
+            {
+              "name": "org.osbuild.selinux",
+              "options": {
+                "file_contexts": "etc/selinux/targeted/contexts/files/file_contexts",
+                "labels": {
+                  "/usr/bin/cp": "system_u:object_r:install_exec_t:s0"
+                }
+              }
             }
           ]
         },
@@ -5846,6 +5867,16 @@
         "checksum": "sha256:9d220d8ee28cd0adf28e8fef547af92c3ec66e238747165939cf8e1a413ddf83",
         "check_gpg": true
       },
+      {
+        "name": "rpm-plugin-selinux",
+        "epoch": 0,
+        "version": "4.15.1",
+        "release": "2.fc32.1",
+        "arch": "x86_64",
+        "remote_location": "http://mirrors.kernel.org/fedora/releases/32/Everything/x86_64/os/Packages/r/rpm-plugin-selinux-4.15.1-2.fc32.1.x86_64.rpm",
+        "checksum": "sha256:27dd9c78e41c04b5151a2b9ac150d3ebb89f2ca7a23e4896dfc718f19a000be3",
+        "check_gpg": true
+      },
       {
         "name": "rpm-plugin-systemd-inhibit",
         "epoch": 0,
@@ -5876,6 +5907,26 @@
         "checksum": "sha256:ffe5076b9018efdb1612c487f637af39ab6c3c79ec37311978935cfa357ecd61",
         "check_gpg": true
       },
+      {
+        "name": "selinux-policy",
+        "epoch": 0,
+        "version": "3.14.5",
+        "release": "32.fc32",
+        "arch": "noarch",
+        "remote_location": "http://mirrors.kernel.org/fedora/releases/32/Everything/x86_64/os/Packages/s/selinux-policy-3.14.5-32.fc32.noarch.rpm",
+        "checksum": "sha256:932a37ddd2a990a22a1ee7811d204552e8860e39a3e0c050ed618a535ae8c78c",
+        "check_gpg": true
+      },
+      {
+        "name": "selinux-policy-targeted",
+        "epoch": 0,
+        "version": "3.14.5",
+        "release": "32.fc32",
+        "arch": "noarch",
+        "remote_location": "http://mirrors.kernel.org/fedora/releases/32/Everything/x86_64/os/Packages/s/selinux-policy-targeted-3.14.5-32.fc32.noarch.rpm",
+        "checksum": "sha256:684aae86de55bd42215c136777613211f596788d3b6405d8fa645fb967904354",
+        "check_gpg": true
+      },
       {
         "name": "setup",
         "epoch": 0,
@@ -10163,7 +10214,7 @@
     "ostree": {
       "refs": {
         "fedora/32/x86_64/iot": {
-          "inputhash": "f854371427eb9499107eee4e2a732884c6f4b6995dc91e58de65c2dc52a472e1"
+          "inputhash": "4879988213fbac55953e12b6268dc7fce3fc20b28d9112958665c98a546c1820"
         }
       },
       "repo": {
diff --git a/test/cases/fedora_32-x86_64-openstack-boot.json b/test/cases/fedora_32-x86_64-openstack-boot.json
index 6d30601d9..e1c384293 100644
--- a/test/cases/fedora_32-x86_64-openstack-boot.json
+++ b/test/cases/fedora_32-x86_64-openstack-boot.json
@@ -1924,6 +1924,10 @@
                     "checksum": "sha256:54b740cf7a75a7215168970378d9a1d6b9a5e4eb81159a874ce8ea5990436641",
                     "check_gpg": true
                   },
+                  {
+                    "checksum": "sha256:27dd9c78e41c04b5151a2b9ac150d3ebb89f2ca7a23e4896dfc718f19a000be3",
+                    "check_gpg": true
+                  },
                   {
                     "checksum": "sha256:e2a04f4de125ff60a3cdc3d2b3718a4530a9c9240c9cf14f55938444c229539f",
                     "check_gpg": true
@@ -1936,6 +1940,14 @@
                     "checksum": "sha256:ffe5076b9018efdb1612c487f637af39ab6c3c79ec37311978935cfa357ecd61",
                     "check_gpg": true
                   },
+                  {
+                    "checksum": "sha256:932a37ddd2a990a22a1ee7811d204552e8860e39a3e0c050ed618a535ae8c78c",
+                    "check_gpg": true
+                  },
+                  {
+                    "checksum": "sha256:684aae86de55bd42215c136777613211f596788d3b6405d8fa645fb967904354",
+                    "check_gpg": true
+                  },
                   {
                     "checksum": "sha256:a336d2e77255df4783f52762e44efcc8d77b044a3e39c7f577d5535212848280",
                     "check_gpg": true
@@ -2030,6 +2042,15 @@
                   }
                 ]
               }
+            },
+            {
+              "name": "org.osbuild.selinux",
+              "options": {
+                "file_contexts": "etc/selinux/targeted/contexts/files/file_contexts",
+                "labels": {
+                  "/usr/bin/cp": "system_u:object_r:install_exec_t:s0"
+                }
+              }
             }
           ]
         },
@@ -5500,6 +5521,16 @@
         "checksum": "sha256:54b740cf7a75a7215168970378d9a1d6b9a5e4eb81159a874ce8ea5990436641",
         "check_gpg": true
       },
+      {
+        "name": "rpm-plugin-selinux",
+        "epoch": 0,
+        "version": "4.15.1",
+        "release": "2.fc32.1",
+        "arch": "x86_64",
+        "remote_location": "http://mirrors.kernel.org/fedora/releases/32/Everything/x86_64/os/Packages/r/rpm-plugin-selinux-4.15.1-2.fc32.1.x86_64.rpm",
+        "checksum": "sha256:27dd9c78e41c04b5151a2b9ac150d3ebb89f2ca7a23e4896dfc718f19a000be3",
+        "check_gpg": true
+      },
       {
         "name": "rpm-plugin-systemd-inhibit",
         "epoch": 0,
@@ -5530,6 +5561,26 @@
         "checksum": "sha256:ffe5076b9018efdb1612c487f637af39ab6c3c79ec37311978935cfa357ecd61",
         "check_gpg": true
       },
+      {
+        "name": "selinux-policy",
+        "epoch": 0,
+        "version": "3.14.5",
+        "release": "32.fc32",
+        "arch": "noarch",
+        "remote_location": "http://mirrors.kernel.org/fedora/releases/32/Everything/x86_64/os/Packages/s/selinux-policy-3.14.5-32.fc32.noarch.rpm",
+        "checksum": "sha256:932a37ddd2a990a22a1ee7811d204552e8860e39a3e0c050ed618a535ae8c78c",
+        "check_gpg": true
+      },
+      {
+        "name": "selinux-policy-targeted",
+        "epoch": 0,
+        "version": "3.14.5",
+        "release": "32.fc32",
+        "arch": "noarch",
+        "remote_location": "http://mirrors.kernel.org/fedora/releases/32/Everything/x86_64/os/Packages/s/selinux-policy-targeted-3.14.5-32.fc32.noarch.rpm",
+        "checksum": "sha256:684aae86de55bd42215c136777613211f596788d3b6405d8fa645fb967904354",
+        "check_gpg": true
+      },
       {
         "name": "setup",
         "epoch": 0,
diff --git a/test/cases/fedora_32-x86_64-qcow2-boot.json b/test/cases/fedora_32-x86_64-qcow2-boot.json
index 86a28f03d..97d3da4e0 100644
--- a/test/cases/fedora_32-x86_64-qcow2-boot.json
+++ b/test/cases/fedora_32-x86_64-qcow2-boot.json
@@ -1855,6 +1855,10 @@
                     "checksum": "sha256:54b740cf7a75a7215168970378d9a1d6b9a5e4eb81159a874ce8ea5990436641",
                     "check_gpg": true
                   },
+                  {
+                    "checksum": "sha256:27dd9c78e41c04b5151a2b9ac150d3ebb89f2ca7a23e4896dfc718f19a000be3",
+                    "check_gpg": true
+                  },
                   {
                     "checksum": "sha256:e2a04f4de125ff60a3cdc3d2b3718a4530a9c9240c9cf14f55938444c229539f",
                     "check_gpg": true
@@ -1867,6 +1871,14 @@
                     "checksum": "sha256:ffe5076b9018efdb1612c487f637af39ab6c3c79ec37311978935cfa357ecd61",
                     "check_gpg": true
                   },
+                  {
+                    "checksum": "sha256:932a37ddd2a990a22a1ee7811d204552e8860e39a3e0c050ed618a535ae8c78c",
+                    "check_gpg": true
+                  },
+                  {
+                    "checksum": "sha256:684aae86de55bd42215c136777613211f596788d3b6405d8fa645fb967904354",
+                    "check_gpg": true
+                  },
                   {
                     "checksum": "sha256:a336d2e77255df4783f52762e44efcc8d77b044a3e39c7f577d5535212848280",
                     "check_gpg": true
@@ -1961,6 +1973,15 @@
                   }
                 ]
               }
+            },
+            {
+              "name": "org.osbuild.selinux",
+              "options": {
+                "file_contexts": "etc/selinux/targeted/contexts/files/file_contexts",
+                "labels": {
+                  "/usr/bin/cp": "system_u:object_r:install_exec_t:s0"
+                }
+              }
             }
           ]
         },
@@ -5339,6 +5360,16 @@
         "checksum": "sha256:54b740cf7a75a7215168970378d9a1d6b9a5e4eb81159a874ce8ea5990436641",
         "check_gpg": true
       },
+      {
+        "name": "rpm-plugin-selinux",
+        "epoch": 0,
+        "version": "4.15.1",
+        "release": "2.fc32.1",
+        "arch": "x86_64",
+        "remote_location": "http://mirrors.kernel.org/fedora/releases/32/Everything/x86_64/os/Packages/r/rpm-plugin-selinux-4.15.1-2.fc32.1.x86_64.rpm",
+        "checksum": "sha256:27dd9c78e41c04b5151a2b9ac150d3ebb89f2ca7a23e4896dfc718f19a000be3",
+        "check_gpg": true
+      },
       {
         "name": "rpm-plugin-systemd-inhibit",
         "epoch": 0,
@@ -5369,6 +5400,26 @@
         "checksum": "sha256:ffe5076b9018efdb1612c487f637af39ab6c3c79ec37311978935cfa357ecd61",
         "check_gpg": true
       },
+      {
+        "name": "selinux-policy",
+        "epoch": 0,
+        "version": "3.14.5",
+        "release": "32.fc32",
+        "arch": "noarch",
+        "remote_location": "http://mirrors.kernel.org/fedora/releases/32/Everything/x86_64/os/Packages/s/selinux-policy-3.14.5-32.fc32.noarch.rpm",
+        "checksum": "sha256:932a37ddd2a990a22a1ee7811d204552e8860e39a3e0c050ed618a535ae8c78c",
+        "check_gpg": true
+      },
+      {
+        "name": "selinux-policy-targeted",
+        "epoch": 0,
+        "version": "3.14.5",
+        "release": "32.fc32",
+        "arch": "noarch",
+        "remote_location": "http://mirrors.kernel.org/fedora/releases/32/Everything/x86_64/os/Packages/s/selinux-policy-targeted-3.14.5-32.fc32.noarch.rpm",
+        "checksum": "sha256:684aae86de55bd42215c136777613211f596788d3b6405d8fa645fb967904354",
+        "check_gpg": true
+      },
       {
         "name": "setup",
         "epoch": 0,
diff --git a/test/cases/fedora_32-x86_64-qcow2-customize.json b/test/cases/fedora_32-x86_64-qcow2-customize.json
index 35d597d27..dcf47b9af 100644
--- a/test/cases/fedora_32-x86_64-qcow2-customize.json
+++ b/test/cases/fedora_32-x86_64-qcow2-customize.json
@@ -1907,6 +1907,10 @@
                     "checksum": "sha256:54b740cf7a75a7215168970378d9a1d6b9a5e4eb81159a874ce8ea5990436641",
                     "check_gpg": true
                   },
+                  {
+                    "checksum": "sha256:27dd9c78e41c04b5151a2b9ac150d3ebb89f2ca7a23e4896dfc718f19a000be3",
+                    "check_gpg": true
+                  },
                   {
                     "checksum": "sha256:e2a04f4de125ff60a3cdc3d2b3718a4530a9c9240c9cf14f55938444c229539f",
                     "check_gpg": true
@@ -1919,6 +1923,14 @@
                     "checksum": "sha256:ffe5076b9018efdb1612c487f637af39ab6c3c79ec37311978935cfa357ecd61",
                     "check_gpg": true
                   },
+                  {
+                    "checksum": "sha256:932a37ddd2a990a22a1ee7811d204552e8860e39a3e0c050ed618a535ae8c78c",
+                    "check_gpg": true
+                  },
+                  {
+                    "checksum": "sha256:684aae86de55bd42215c136777613211f596788d3b6405d8fa645fb967904354",
+                    "check_gpg": true
+                  },
                   {
                     "checksum": "sha256:a336d2e77255df4783f52762e44efcc8d77b044a3e39c7f577d5535212848280",
                     "check_gpg": true
@@ -2013,6 +2025,15 @@
                   }
                 ]
               }
+            },
+            {
+              "name": "org.osbuild.selinux",
+              "options": {
+                "file_contexts": "etc/selinux/targeted/contexts/files/file_contexts",
+                "labels": {
+                  "/usr/bin/cp": "system_u:object_r:install_exec_t:s0"
+                }
+              }
             }
           ]
         },
@@ -5442,6 +5463,16 @@
         "checksum": "sha256:54b740cf7a75a7215168970378d9a1d6b9a5e4eb81159a874ce8ea5990436641",
         "check_gpg": true
       },
+      {
+        "name": "rpm-plugin-selinux",
+        "epoch": 0,
+        "version": "4.15.1",
+        "release": "2.fc32.1",
+        "arch": "x86_64",
+        "remote_location": "http://mirrors.kernel.org/fedora/releases/32/Everything/x86_64/os/Packages/r/rpm-plugin-selinux-4.15.1-2.fc32.1.x86_64.rpm",
+        "checksum": "sha256:27dd9c78e41c04b5151a2b9ac150d3ebb89f2ca7a23e4896dfc718f19a000be3",
+        "check_gpg": true
+      },
       {
         "name": "rpm-plugin-systemd-inhibit",
         "epoch": 0,
@@ -5472,6 +5503,26 @@
         "checksum": "sha256:ffe5076b9018efdb1612c487f637af39ab6c3c79ec37311978935cfa357ecd61",
         "check_gpg": true
       },
+      {
+        "name": "selinux-policy",
+        "epoch": 0,
+        "version": "3.14.5",
+        "release": "32.fc32",
+        "arch": "noarch",
+        "remote_location": "http://mirrors.kernel.org/fedora/releases/32/Everything/x86_64/os/Packages/s/selinux-policy-3.14.5-32.fc32.noarch.rpm",
+        "checksum": "sha256:932a37ddd2a990a22a1ee7811d204552e8860e39a3e0c050ed618a535ae8c78c",
+        "check_gpg": true
+      },
+      {
+        "name": "selinux-policy-targeted",
+        "epoch": 0,
+        "version": "3.14.5",
+        "release": "32.fc32",
+        "arch": "noarch",
+        "remote_location": "http://mirrors.kernel.org/fedora/releases/32/Everything/x86_64/os/Packages/s/selinux-policy-targeted-3.14.5-32.fc32.noarch.rpm",
+        "checksum": "sha256:684aae86de55bd42215c136777613211f596788d3b6405d8fa645fb967904354",
+        "check_gpg": true
+      },
       {
         "name": "setup",
         "epoch": 0,
diff --git a/test/cases/fedora_32-x86_64-vhd-boot.json b/test/cases/fedora_32-x86_64-vhd-boot.json
index 4e16dc2d3..54524d999 100644
--- a/test/cases/fedora_32-x86_64-vhd-boot.json
+++ b/test/cases/fedora_32-x86_64-vhd-boot.json
@@ -1789,6 +1789,10 @@
                     "checksum": "sha256:54b740cf7a75a7215168970378d9a1d6b9a5e4eb81159a874ce8ea5990436641",
                     "check_gpg": true
                   },
+                  {
+                    "checksum": "sha256:27dd9c78e41c04b5151a2b9ac150d3ebb89f2ca7a23e4896dfc718f19a000be3",
+                    "check_gpg": true
+                  },
                   {
                     "checksum": "sha256:e2a04f4de125ff60a3cdc3d2b3718a4530a9c9240c9cf14f55938444c229539f",
                     "check_gpg": true
@@ -1801,6 +1805,14 @@
                     "checksum": "sha256:ffe5076b9018efdb1612c487f637af39ab6c3c79ec37311978935cfa357ecd61",
                     "check_gpg": true
                   },
+                  {
+                    "checksum": "sha256:932a37ddd2a990a22a1ee7811d204552e8860e39a3e0c050ed618a535ae8c78c",
+                    "check_gpg": true
+                  },
+                  {
+                    "checksum": "sha256:684aae86de55bd42215c136777613211f596788d3b6405d8fa645fb967904354",
+                    "check_gpg": true
+                  },
                   {
                     "checksum": "sha256:a336d2e77255df4783f52762e44efcc8d77b044a3e39c7f577d5535212848280",
                     "check_gpg": true
@@ -1895,6 +1907,15 @@
                   }
                 ]
               }
+            },
+            {
+              "name": "org.osbuild.selinux",
+              "options": {
+                "file_contexts": "etc/selinux/targeted/contexts/files/file_contexts",
+                "labels": {
+                  "/usr/bin/cp": "system_u:object_r:install_exec_t:s0"
+                }
+              }
             }
           ]
         },
@@ -5191,6 +5212,16 @@
         "checksum": "sha256:54b740cf7a75a7215168970378d9a1d6b9a5e4eb81159a874ce8ea5990436641",
         "check_gpg": true
       },
+      {
+        "name": "rpm-plugin-selinux",
+        "epoch": 0,
+        "version": "4.15.1",
+        "release": "2.fc32.1",
+        "arch": "x86_64",
+        "remote_location": "http://mirrors.kernel.org/fedora/releases/32/Everything/x86_64/os/Packages/r/rpm-plugin-selinux-4.15.1-2.fc32.1.x86_64.rpm",
+        "checksum": "sha256:27dd9c78e41c04b5151a2b9ac150d3ebb89f2ca7a23e4896dfc718f19a000be3",
+        "check_gpg": true
+      },
       {
         "name": "rpm-plugin-systemd-inhibit",
         "epoch": 0,
@@ -5221,6 +5252,26 @@
         "checksum": "sha256:ffe5076b9018efdb1612c487f637af39ab6c3c79ec37311978935cfa357ecd61",
         "check_gpg": true
       },
+      {
+        "name": "selinux-policy",
+        "epoch": 0,
+        "version": "3.14.5",
+        "release": "32.fc32",
+        "arch": "noarch",
+        "remote_location": "http://mirrors.kernel.org/fedora/releases/32/Everything/x86_64/os/Packages/s/selinux-policy-3.14.5-32.fc32.noarch.rpm",
+        "checksum": "sha256:932a37ddd2a990a22a1ee7811d204552e8860e39a3e0c050ed618a535ae8c78c",
+        "check_gpg": true
+      },
+      {
+        "name": "selinux-policy-targeted",
+        "epoch": 0,
+        "version": "3.14.5",
+        "release": "32.fc32",
+        "arch": "noarch",
+        "remote_location": "http://mirrors.kernel.org/fedora/releases/32/Everything/x86_64/os/Packages/s/selinux-policy-targeted-3.14.5-32.fc32.noarch.rpm",
+        "checksum": "sha256:684aae86de55bd42215c136777613211f596788d3b6405d8fa645fb967904354",
+        "check_gpg": true
+      },
       {
         "name": "setup",
         "epoch": 0,
diff --git a/test/cases/fedora_32-x86_64-vmdk-boot.json b/test/cases/fedora_32-x86_64-vmdk-boot.json
index 56371f384..97a8356ae 100644
--- a/test/cases/fedora_32-x86_64-vmdk-boot.json
+++ b/test/cases/fedora_32-x86_64-vmdk-boot.json
@@ -1810,6 +1810,10 @@
                     "checksum": "sha256:54b740cf7a75a7215168970378d9a1d6b9a5e4eb81159a874ce8ea5990436641",
                     "check_gpg": true
                   },
+                  {
+                    "checksum": "sha256:27dd9c78e41c04b5151a2b9ac150d3ebb89f2ca7a23e4896dfc718f19a000be3",
+                    "check_gpg": true
+                  },
                   {
                     "checksum": "sha256:e2a04f4de125ff60a3cdc3d2b3718a4530a9c9240c9cf14f55938444c229539f",
                     "check_gpg": true
@@ -1822,6 +1826,14 @@
                     "checksum": "sha256:ffe5076b9018efdb1612c487f637af39ab6c3c79ec37311978935cfa357ecd61",
                     "check_gpg": true
                   },
+                  {
+                    "checksum": "sha256:932a37ddd2a990a22a1ee7811d204552e8860e39a3e0c050ed618a535ae8c78c",
+                    "check_gpg": true
+                  },
+                  {
+                    "checksum": "sha256:684aae86de55bd42215c136777613211f596788d3b6405d8fa645fb967904354",
+                    "check_gpg": true
+                  },
                   {
                     "checksum": "sha256:a336d2e77255df4783f52762e44efcc8d77b044a3e39c7f577d5535212848280",
                     "check_gpg": true
@@ -1916,6 +1928,15 @@
                   }
                 ]
               }
+            },
+            {
+              "name": "org.osbuild.selinux",
+              "options": {
+                "file_contexts": "etc/selinux/targeted/contexts/files/file_contexts",
+                "labels": {
+                  "/usr/bin/cp": "system_u:object_r:install_exec_t:s0"
+                }
+              }
             }
           ]
         },
@@ -5227,6 +5248,16 @@
         "checksum": "sha256:54b740cf7a75a7215168970378d9a1d6b9a5e4eb81159a874ce8ea5990436641",
         "check_gpg": true
       },
+      {
+        "name": "rpm-plugin-selinux",
+        "epoch": 0,
+        "version": "4.15.1",
+        "release": "2.fc32.1",
+        "arch": "x86_64",
+        "remote_location": "http://mirrors.kernel.org/fedora/releases/32/Everything/x86_64/os/Packages/r/rpm-plugin-selinux-4.15.1-2.fc32.1.x86_64.rpm",
+        "checksum": "sha256:27dd9c78e41c04b5151a2b9ac150d3ebb89f2ca7a23e4896dfc718f19a000be3",
+        "check_gpg": true
+      },
       {
         "name": "rpm-plugin-systemd-inhibit",
         "epoch": 0,
@@ -5257,6 +5288,26 @@
         "checksum": "sha256:ffe5076b9018efdb1612c487f637af39ab6c3c79ec37311978935cfa357ecd61",
         "check_gpg": true
       },
+      {
+        "name": "selinux-policy",
+        "epoch": 0,
+        "version": "3.14.5",
+        "release": "32.fc32",
+        "arch": "noarch",
+        "remote_location": "http://mirrors.kernel.org/fedora/releases/32/Everything/x86_64/os/Packages/s/selinux-policy-3.14.5-32.fc32.noarch.rpm",
+        "checksum": "sha256:932a37ddd2a990a22a1ee7811d204552e8860e39a3e0c050ed618a535ae8c78c",
+        "check_gpg": true
+      },
+      {
+        "name": "selinux-policy-targeted",
+        "epoch": 0,
+        "version": "3.14.5",
+        "release": "32.fc32",
+        "arch": "noarch",
+        "remote_location": "http://mirrors.kernel.org/fedora/releases/32/Everything/x86_64/os/Packages/s/selinux-policy-targeted-3.14.5-32.fc32.noarch.rpm",
+        "checksum": "sha256:684aae86de55bd42215c136777613211f596788d3b6405d8fa645fb967904354",
+        "check_gpg": true
+      },
       {
         "name": "setup",
         "epoch": 0,
diff --git a/tools/test-case-generators/generate-test-cases b/tools/test-case-generators/generate-test-cases
index 38c802dc1..9cdb965ac 100755
--- a/tools/test-case-generators/generate-test-cases
+++ b/tools/test-case-generators/generate-test-cases
@@ -30,6 +30,7 @@ def run_osbuild(manifest, store, output):
                             encoding="utf-8",
                             input=json.dumps(manifest))
         except:
+            log.seek(0)
             print(log.read())
             raise
 
@@ -95,19 +96,103 @@ def generate_test_case(test_type, distro, arch, output_format, test_case_request
         json.dump(test_case, case_file, indent=2)
 
 
-def main(distro, arch, image_types, keep_image_info, store, output):
+CUSTOMIZATIONS_BLUEPRINT =  {
+    "packages": [
+        {
+            "name": "bash",
+            "version": "*"
+        }
+    ],
+    "groups": [
+        {
+            "name": "core"
+        }
+    ],
+    "customizations": {
+        "hosname": "my-host",
+        "kernel": {
+            "append": "debug"
+        },
+        "sshkey": [
+            {
+                "user": "user1",
+                "key": "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC61wMCjOSHwbVb4VfVyl5sn497qW4PsdQ7Ty7aD6wDNZ/QjjULkDV/yW5WjDlDQ7UqFH0Sr7vywjqDizUAqK7zM5FsUKsUXWHWwg/ehKg8j9xKcMv11AkFoUoujtfAujnKODkk58XSA9whPr7qcw3vPrmog680pnMSzf9LC7J6kXfs6lkoKfBh9VnlxusCrw2yg0qI1fHAZBLPx7mW6+me71QZsS6sVz8v8KXyrXsKTdnF50FjzHcK9HXDBtSJS5wA3fkcRYymJe0o6WMWNdgSRVpoSiWaHHmFgdMUJaYoCfhXzyl7LtNb3Q+Sveg+tJK7JaRXBLMUllOlJ6ll5Hod root@localhost"
+            }
+        ],
+        "user": [
+            {
+                "name": "user2",
+                "description": "description 2",
+                "password": "$6$BhyxFBgrEFh0VrPJ$MllG8auiU26x2pmzL4.1maHzPHrA.4gTdCvlATFp8HJU9UPee4zCS9BVl2HOzKaUYD/zEm8r/OF05F2icWB0K/",
+                "key": "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC61wMCjOSHwbVb4VfVyl5sn497qW4PsdQ7Ty7aD6wDNZ/QjjULkDV/yW5WjDlDQ7UqFH0Sr7vywjqDizUAqK7zM5FsUKsUXWHWwg/ehKg8j9xKcMv11AkFoUoujtfAujnKODkk58XSA9whPr7qcw3vPrmog680pnMSzf9LC7J6kXfs6lkoKfBh9VnlxusCrw2yg0qI1fHAZBLPx7mW6+me71QZsS6sVz8v8KXyrXsKTdnF50FjzHcK9HXDBtSJS5wA3fkcRYymJe0o6WMWNdgSRVpoSiWaHHmFgdMUJaYoCfhXzyl7LtNb3Q+Sveg+tJK7JaRXBLMUllOlJ6ll5Hod root@localhost",
+                "home": "/home/home2",
+                "shell": "/bin/sh",
+                "groups": [
+                    "group1"
+                ],
+                "uid": 1020,
+                "gid": 1050,
+            }
+        ],
+        "group": [
+            {
+                "name": "group1",
+                "gid": 1030
+            },
+            {
+                "name": "group2",
+                "gid": 1050
+            }
+        ],
+        "timezone": {
+            "timezone": "Europe/London",
+            "ntpservers": [
+                "time.example.com"
+            ]
+        },
+        "locale": {
+            "languages": [
+                "en_US"
+            ],
+            "keyboard": "dvorak"
+        },
+#       "firewall": {
+#           "ports": [
+#               "25:tcp"
+#           ],
+#           "services": {
+#               "enabled": [
+#                   "cockpit"
+#               ],
+#               "disabled": [
+#                   "ssh"
+#               ]
+#           }
+#       },
+        "services": {
+            "enabled": [
+                "sshd.socket"
+            ],
+            "disabled": [
+                "bluetooth.service"
+            ]
+        }
+    }
+}
+
+
+def main(distro, arch, image_types, keep_image_info, store, output, with_customizations):
     with open("tools/test-case-generators/format-request-map.json") as format_request_json:
         format_request_dict = json.load(format_request_json)
     with open("tools/test-case-generators/repos.json") as repos_json:
         repos_dict = json.load(repos_json)
-    for output_format, test_case_request in format_request_dict.items():
-        if test_case_request["compose-request"]["image-type"] not in image_types:
-                continue
-        test_case_request["compose-request"]["distro"] = distro
-        test_case_request["compose-request"]["arch"] = arch
-        test_case_request["compose-request"]["repositories"] = repos_dict[distro][arch]
-        generate_test_case("boot", distro, arch, output_format, test_case_request, keep_image_info, store, output)
-    if "customize" in image_types:
+
+    # Apply all customizations from the CUSTOMIZATIONS_BLUEPRINT dictionary
+    if with_customizations:
+        if len(image_types) > 1 or image_types[0] != "qcow2":
+            print("Customizations are only available for qcow2 image type")
+            sys.exit(1)
+
         test_case_request = {
             "compose-request": {
                 "distro": distro,
@@ -115,92 +200,20 @@ def main(distro, arch, image_types, keep_image_info, store, output):
                 "repositories": repos_dict[distro][arch],
                 "image-type": "qcow2",
                 "filename": "disk.qcow2",
-                "blueprint": {
-                    "packages": [
-                        {
-                            "name": "bash",
-                            "version": "*"
-                        }
-                    ],
-                    "groups": [
-                        {
-                            "name": "core"
-                        }
-                    ],
-                    "customizations": {
-                        "hosname": "my-host",
-                        "kernel": {
-                            "append": "debug"
-                        },
-                        "sshkey": [
-                            {
-                                "user": "user1",
-                                "key": "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC61wMCjOSHwbVb4VfVyl5sn497qW4PsdQ7Ty7aD6wDNZ/QjjULkDV/yW5WjDlDQ7UqFH0Sr7vywjqDizUAqK7zM5FsUKsUXWHWwg/ehKg8j9xKcMv11AkFoUoujtfAujnKODkk58XSA9whPr7qcw3vPrmog680pnMSzf9LC7J6kXfs6lkoKfBh9VnlxusCrw2yg0qI1fHAZBLPx7mW6+me71QZsS6sVz8v8KXyrXsKTdnF50FjzHcK9HXDBtSJS5wA3fkcRYymJe0o6WMWNdgSRVpoSiWaHHmFgdMUJaYoCfhXzyl7LtNb3Q+Sveg+tJK7JaRXBLMUllOlJ6ll5Hod root@localhost"
-                            }
-                        ],
-                        "user": [
-                            {
-                                "name": "user2",
-                                "description": "description 2",
-                                "password": "$6$BhyxFBgrEFh0VrPJ$MllG8auiU26x2pmzL4.1maHzPHrA.4gTdCvlATFp8HJU9UPee4zCS9BVl2HOzKaUYD/zEm8r/OF05F2icWB0K/",
-                                "key": "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC61wMCjOSHwbVb4VfVyl5sn497qW4PsdQ7Ty7aD6wDNZ/QjjULkDV/yW5WjDlDQ7UqFH0Sr7vywjqDizUAqK7zM5FsUKsUXWHWwg/ehKg8j9xKcMv11AkFoUoujtfAujnKODkk58XSA9whPr7qcw3vPrmog680pnMSzf9LC7J6kXfs6lkoKfBh9VnlxusCrw2yg0qI1fHAZBLPx7mW6+me71QZsS6sVz8v8KXyrXsKTdnF50FjzHcK9HXDBtSJS5wA3fkcRYymJe0o6WMWNdgSRVpoSiWaHHmFgdMUJaYoCfhXzyl7LtNb3Q+Sveg+tJK7JaRXBLMUllOlJ6ll5Hod root@localhost",
-                                "home": "/home/home2",
-                                "shell": "/bin/sh",
-                                "groups": [
-                                    "group1"
-                                ],
-                                "uid": 1020,
-                                "gid": 1050,
-                            }
-                        ],
-                        "group": [
-                            {
-                                "name": "group1",
-                                "gid": 1030
-                            },
-                            {
-                                "name": "group2",
-                                "gid": 1050
-                            }
-                        ],
-                        "timezone": {
-                            "timezone": "Europe/London",
-                            "ntpservers": [
-                                "time.example.com"
-                            ]
-                        },
-                        "locale": {
-                            "languages": [
-                                "en_US"
-                            ],
-                            "keyboard": "dvorak"
-                        },
-#                        "firewall": {
-#                            "ports": [
-#                                "25:tcp"
-#                            ],
-#                            "services": {
-#                                "enabled": [
-#                                    "cockpit"
-#                                ],
-#                                "disabled": [
-#                                    "ssh"
-#                                ]
-#                            }
-#                        },
-                        "services": {
-                            "enabled": [
-                                "sshd.socket"
-                            ],
-                            "disabled": [
-                                "bluetooth.service"
-                            ]
-                        }
-                    }
-                }
+                "blueprint": CUSTOMIZATIONS_BLUEPRINT,
             }
         }
         generate_test_case("customize", distro, arch, "qcow2", test_case_request, keep_image_info, store, output)
+        return
+
+    for output_format, test_case_request in format_request_dict.items():
+        if test_case_request["compose-request"]["image-type"] not in image_types:
+                continue
+        test_case_request["compose-request"]["distro"] = distro
+        test_case_request["compose-request"]["arch"] = arch
+        test_case_request["compose-request"]["repositories"] = repos_dict[distro][arch]
+        generate_test_case("boot", distro, arch, output_format, test_case_request, keep_image_info, store, output)
+    
     return
 
 
@@ -208,11 +221,12 @@ if __name__ == '__main__':
     parser = argparse.ArgumentParser(description="Generate test cases")
     parser.add_argument("--distro", help="distribution for test cases", required=True)
     parser.add_argument("--arch", help="architecture for test cases", required=True)
-    parser.add_argument("--image-types", help="image types for test cases", required=True, nargs='*')
+    parser.add_argument("--image-types", help="image types for test cases", required=True, nargs='+')
     parser.add_argument("--keep-image-info", action='store_true', help="skip image info (re)generation, but keep the one found in the existing test case")
     parser.add_argument("--store", metavar="STORE_DIRECTORY", type=os.path.abspath, help="path to the osbuild store", required=True)
     parser.add_argument("--output", metavar="OUTPUT_DIRECTORY", type=os.path.abspath, help="path to the output directory", required=True)
+    parser.add_argument("--with-customizations", action='store_true', help="apply all currently supported customizations to the image (qcow2 only)")
     args = parser.parse_args()
 
-    main(args.distro, args.arch, args.image_types, args.keep_image_info, args.store, args.output)
+    main(args.distro, args.arch, args.image_types, args.keep_image_info, args.store, args.output, args.with_customizations)
     sys.exit()