Repository: osbuild/osbuild-composer
Pull request #2803 (2022-07-05 17:52:09)

distro: move isMountpointAllowed
This is a micro pr to move the `isMountpointAllowed` function to the common distro package since this function is shared used in multiple distro packages.


This pull request includes:

- [ ] adequate testing for the new functionality or fixed issue
- [ ] adequate documentation informing people about the change such as
  - [ ] submit a PR for the [guides](https://github.com/osbuild/guides) repository if this PR changed any behavior described there: https://www.osbuild.org/guides/

<!--
Thanks for proposing a change to osbuild-composer!

Please don't remove the above check list. These are things that each pull
request must have before it is merged. It helps maintainers to not forget
anything.

If the reason for ticking any of the boxes is ambiguous, please add a short
note explaining why.

In addition, if this pull request fixes a downstream issue, please refer to
test/README.md and add these additional items:

- [ ] 1st commit of any `rhbz#` related PR contains bug reproducer; CI reports FAIL or
- [ ] PR contains automated tests for new functionality and
- [ ] QE has approved reproducer/new tests and
- [ ] Subsequent commits provide bug fixes without modifying the reproducer; CI reports PASS and
- [ ] QE approves this PR; RHBZ status is set to `MODIFIED + Verified=Tested`

Information regarding our GitLab pipeline (Schutzbot):

CI will not be ran automatically if WIP label is applied or the PR is in DRAFT state, instead only
a link will be provided to the pipeline which can then be triggered manually if desired. To run the
CI automatically either switch the PR to ready or apply WIP+test label.

Outside contributors need manual approval from one of the osbuild-composer maintainers.

Schutzbot will only be triggered if all Tests jobs in GitHub workflow succeed.
-->



Patch:
diff --git a/internal/distro/distro.go b/internal/distro/distro.go
index 7a62b6fe8..1a43a2660 100644
--- a/internal/distro/distro.go
+++ b/internal/distro/distro.go
@@ -3,6 +3,8 @@ package distro
 import (
 	"encoding/json"
 	"fmt"
+	"path"
+	"strings"
 
 	"github.com/osbuild/osbuild-composer/internal/blueprint"
 	"github.com/osbuild/osbuild-composer/internal/disk"
@@ -257,3 +259,22 @@ func MakePackageSetChains(t ImageType, packageSets map[string]rpmmd.PackageSet,
 
 	return chainedSets
 }
+
+func IsMountpointAllowed(mountpoint string, allowlist []string) bool {
+	for _, allowed := range allowlist {
+		match, _ := path.Match(allowed, mountpoint)
+		if match {
+			return true
+		}
+		// ensure that only clean mountpoints
+		// are valid
+		if strings.Contains(mountpoint, "//") {
+			return false
+		}
+		match = strings.HasPrefix(mountpoint, allowed+"/")
+		if allowed != "/" && match {
+			return true
+		}
+	}
+	return false
+}
diff --git a/internal/distro/fedora/distro.go b/internal/distro/fedora/distro.go
index 6ea24f86c..fca290281 100644
--- a/internal/distro/fedora/distro.go
+++ b/internal/distro/fedora/distro.go
@@ -4,7 +4,6 @@ import (
 	"errors"
 	"fmt"
 	"math/rand"
-	"path"
 	"sort"
 	"strings"
 
@@ -649,7 +648,9 @@ func (t *imageType) Exports() []string {
 func (t *imageType) getBootType() distro.BootType {
 	bootType := t.arch.bootType
 	if t.bootType != distro.UnsetBootType {
-		bootType = t.bootType
+		if bootType == distro.HybridBootType {
+			bootType = t.bootType
+		}
 	}
 	return bootType
 }
@@ -733,25 +734,6 @@ func (t *imageType) Manifest(customizations *blueprint.Customizations,
 	return manifest.Serialize(packageSets)
 }
 
-func isMountpointAllowed(mountpoint string) bool {
-	for _, allowed := range mountpointAllowList {
-		match, _ := path.Match(allowed, mountpoint)
-		if match {
-			return true
-		}
-		// ensure that only clean mountpoints
-		// are valid
-		if strings.Contains(mountpoint, "//") {
-			return false
-		}
-		match = strings.HasPrefix(mountpoint, allowed+"/")
-		if allowed != "/" && match {
-			return true
-		}
-	}
-	return false
-}
-
 // checkOptions checks the validity and compatibility of options and customizations for the image type.
 func (t *imageType) checkOptions(customizations *blueprint.Customizations, options distro.ImageOptions) error {
 	if t.bootISO && t.rpmOstree {
@@ -779,7 +761,7 @@ func (t *imageType) checkOptions(customizations *blueprint.Customizations, optio
 
 	invalidMountpoints := []string{}
 	for _, m := range mountpoints {
-		if !isMountpointAllowed(m.Mountpoint) {
+		if !distro.IsMountpointAllowed(m.Mountpoint, mountpointAllowList) {
 			invalidMountpoints = append(invalidMountpoints, m.Mountpoint)
 		}
 	}
diff --git a/internal/distro/fedora/manifests.go b/internal/distro/fedora/manifests.go
index 06c10e492..53490dd22 100644
--- a/internal/distro/fedora/manifests.go
+++ b/internal/distro/fedora/manifests.go
@@ -229,7 +229,9 @@ func osPipeline(m *manifest.Manifest,
 			return nil, err
 		}
 		pl.PartitionTable = pt
+	}
 
+	if t.bootable || t.rpmOstree {
 		if t.supportsUEFI() {
 			pl.UEFIVendor = t.arch.distro.vendor
 		}
diff --git a/internal/distro/fedora/package_sets.go b/internal/distro/fedora/package_sets.go
index 0f31c294b..07377c38e 100644
--- a/internal/distro/fedora/package_sets.go
+++ b/internal/distro/fedora/package_sets.go
@@ -30,84 +30,6 @@ func ec2CommonPackageSet(t *imageType) rpmmd.PackageSet {
 			"geolite2-country",
 			"zram-generator-defaults",
 		},
-	}.Append(bootPackageSet(t))
-}
-
-// BOOT PACKAGE SETS
-
-func bootPackageSet(t *imageType) rpmmd.PackageSet {
-	if !t.bootable {
-		return rpmmd.PackageSet{}
-	}
-
-	var addLegacyBootPkg bool
-	var addUEFIBootPkg bool
-
-	switch bt := t.getBootType(); bt {
-	case distro.LegacyBootType:
-		addLegacyBootPkg = true
-	case distro.UEFIBootType:
-		addUEFIBootPkg = true
-	case distro.HybridBootType:
-		addLegacyBootPkg = true
-		addUEFIBootPkg = true
-	default:
-		panic(fmt.Sprintf("unsupported boot type: %q", bt))
-	}
-
-	ps := rpmmd.PackageSet{}
-
-	switch t.Arch().Name() {
-	case distro.X86_64ArchName:
-		if addLegacyBootPkg {
-			ps = ps.Append(x8664LegacyBootPackageSet(t))
-		}
-		if addUEFIBootPkg {
-			ps = ps.Append(x8664UEFIBootPackageSet(t))
-		}
-
-	case distro.Aarch64ArchName:
-		ps = ps.Append(aarch64UEFIBootPackageSet(t))
-
-	default:
-		panic(fmt.Sprintf("unsupported boot arch: %s", t.Arch().Name()))
-	}
-
-	return ps
-}
-
-// x86_64 Legacy arch-specific boot package set
-func x8664LegacyBootPackageSet(t *imageType) rpmmd.PackageSet {
-	return rpmmd.PackageSet{
-		Include: []string{
-			"dracut-config-generic",
-			"grub2-pc",
-		},
-	}
-}
-
-// x86_64 UEFI arch-specific boot package set
-func x8664UEFIBootPackageSet(t *imageType) rpmmd.PackageSet {
-	return rpmmd.PackageSet{
-		Include: []string{
-			"dracut-config-generic",
-			"efibootmgr",
-			"grub2-efi-x64",
-			"shim-x64",
-		},
-	}
-}
-
-// aarch64 UEFI arch-specific boot package set
-func aarch64UEFIBootPackageSet(t *imageType) rpmmd.PackageSet {
-	return rpmmd.PackageSet{
-		Include: []string{
-			"dracut-config-generic",
-			"efibootmgr",
-			"grub2-efi-aa64",
-			"grub2-tools",
-			"shim-aa64",
-		},
 	}
 }
 
@@ -132,7 +54,7 @@ func qcow2CommonPackageSet(t *imageType) rpmmd.PackageSet {
 			"grubby-deprecated",
 			"extlinux-bootloader",
 		},
-	}.Append(bootPackageSet(t))
+	}
 
 	return ps
 }
@@ -157,7 +79,7 @@ func vhdCommonPackageSet(t *imageType) rpmmd.PackageSet {
 			"geolite2-country",
 			"zram-generator-defaults",
 		},
-	}.Append(bootPackageSet(t))
+	}
 
 	return ps
 }
@@ -183,7 +105,7 @@ func vmdkCommonPackageSet(t *imageType) rpmmd.PackageSet {
 			"grubby-deprecated",
 			"extlinux-bootloader",
 		},
-	}.Append(bootPackageSet(t))
+	}
 
 	return ps
 }
@@ -207,7 +129,7 @@ func openstackCommonPackageSet(t *imageType) rpmmd.PackageSet {
 			"geolite2-country",
 			"zram-generator-defaults",
 		},
-	}.Append(bootPackageSet(t))
+	}
 
 	return ps
 }
@@ -223,7 +145,6 @@ func iotCommitPackageSet(t *imageType) rpmmd.PackageSet {
 			"sssd-client",
 			"libsss_sudo",
 			"shadow-utils",
-			"dracut-config-generic",
 			"dracut-network",
 			"polkit",
 			"lvm2",
@@ -329,10 +250,6 @@ func iotCommitPackageSet(t *imageType) rpmmd.PackageSet {
 func x8664IOTCommitPackageSet() rpmmd.PackageSet {
 	return rpmmd.PackageSet{
 		Include: []string{
-			"grub2",
-			"grub2-efi-x64",
-			"efibootmgr",
-			"shim-x64",
 			"microcode_ctl",
 			"iwl1000-firmware",
 			"iwl100-firmware",
@@ -352,10 +269,6 @@ func x8664IOTCommitPackageSet() rpmmd.PackageSet {
 func aarch64IOTCommitPackageSet() rpmmd.PackageSet {
 	return rpmmd.PackageSet{
 		Include: []string{
-			"grub2",
-			"grub2-efi-aa64",
-			"efibootmgr",
-			"shim-aa64",
 			"uboot-images-armv8",
 			"bcm283x-firmware",
 			"arm-image-installer"},
diff --git a/internal/distro/rhel7/distro.go b/internal/distro/rhel7/distro.go
index cf0600cab..d210b5099 100644
--- a/internal/distro/rhel7/distro.go
+++ b/internal/distro/rhel7/distro.go
@@ -5,7 +5,6 @@ import (
 	"errors"
 	"fmt"
 	"math/rand"
-	"path"
 	"sort"
 	"strings"
 
@@ -427,25 +426,6 @@ func (t *imageType) Manifest(customizations *blueprint.Customizations,
 	)
 }
 
-func isMountpointAllowed(mountpoint string) bool {
-	for _, allowed := range mountpointAllowList {
-		match, _ := path.Match(allowed, mountpoint)
-		if match {
-			return true
-		}
-		// ensure that only clean mountpoints
-		// are valid
-		if strings.Contains(mountpoint, "//") {
-			return false
-		}
-		match = strings.HasPrefix(mountpoint, allowed+"/")
-		if allowed != "/" && match {
-			return true
-		}
-	}
-	return false
-}
-
 // checkOptions checks the validity and compatibility of options and customizations for the image type.
 func (t *imageType) checkOptions(customizations *blueprint.Customizations, options distro.ImageOptions) error {
 
@@ -453,7 +433,7 @@ func (t *imageType) checkOptions(customizations *blueprint.Customizations, optio
 
 	invalidMountpoints := []string{}
 	for _, m := range mountpoints {
-		if !isMountpointAllowed(m.Mountpoint) {
+		if !distro.IsMountpointAllowed(m.Mountpoint, mountpointAllowList) {
 			invalidMountpoints = append(invalidMountpoints, m.Mountpoint)
 		}
 	}
diff --git a/internal/distro/rhel8/distro.go b/internal/distro/rhel8/distro.go
index 7d9f78c15..7a6b5de2e 100644
--- a/internal/distro/rhel8/distro.go
+++ b/internal/distro/rhel8/distro.go
@@ -5,7 +5,6 @@ import (
 	"errors"
 	"fmt"
 	"math/rand"
-	"path"
 	"sort"
 	"strings"
 
@@ -546,25 +545,6 @@ func (t *imageType) Manifest(customizations *blueprint.Customizations,
 	)
 }
 
-func isMountpointAllowed(mountpoint string) bool {
-	for _, allowed := range mountpointAllowList {
-		match, _ := path.Match(allowed, mountpoint)
-		if match {
-			return true
-		}
-		// ensure that only clean mountpoints
-		// are valid
-		if strings.Contains(mountpoint, "//") {
-			return false
-		}
-		match = strings.HasPrefix(mountpoint, allowed+"/")
-		if allowed != "/" && match {
-			return true
-		}
-	}
-	return false
-}
-
 // checkOptions checks the validity and compatibility of options and customizations for the image type.
 func (t *imageType) checkOptions(customizations *blueprint.Customizations, options distro.ImageOptions) error {
 	if t.bootISO && t.rpmOstree {
@@ -623,7 +603,7 @@ func (t *imageType) checkOptions(customizations *blueprint.Customizations, optio
 
 	invalidMountpoints := []string{}
 	for _, m := range mountpoints {
-		if !isMountpointAllowed(m.Mountpoint) {
+		if !distro.IsMountpointAllowed(m.Mountpoint, mountpointAllowList) {
 			invalidMountpoints = append(invalidMountpoints, m.Mountpoint)
 		}
 	}
diff --git a/internal/distro/rhel90/distro.go b/internal/distro/rhel90/distro.go
index 2516330b6..fff1da7b4 100644
--- a/internal/distro/rhel90/distro.go
+++ b/internal/distro/rhel90/distro.go
@@ -5,7 +5,6 @@ import (
 	"errors"
 	"fmt"
 	"math/rand"
-	"path"
 	"sort"
 	"strings"
 
@@ -492,25 +491,6 @@ func (t *imageType) Manifest(customizations *blueprint.Customizations,
 	)
 }
 
-func isMountpointAllowed(mountpoint string) bool {
-	for _, allowed := range mountpointAllowList {
-		match, _ := path.Match(allowed, mountpoint)
-		if match {
-			return true
-		}
-		// ensure that only clean mountpoints
-		// are valid
-		if strings.Contains(mountpoint, "//") {
-			return false
-		}
-		match = strings.HasPrefix(mountpoint, allowed+"/")
-		if allowed != "/" && match {
-			return true
-		}
-	}
-	return false
-}
-
 // checkOptions checks the validity and compatibility of options and customizations for the image type.
 func (t *imageType) checkOptions(customizations *blueprint.Customizations, options distro.ImageOptions) error {
 	if t.bootISO && t.rpmOstree {
@@ -569,7 +549,7 @@ func (t *imageType) checkOptions(customizations *blueprint.Customizations, optio
 
 	invalidMountpoints := []string{}
 	for _, m := range mountpoints {
-		if !isMountpointAllowed(m.Mountpoint) {
+		if !distro.IsMountpointAllowed(m.Mountpoint, mountpointAllowList) {
 			invalidMountpoints = append(invalidMountpoints, m.Mountpoint)
 		}
 	}
diff --git a/internal/manifest/os.go b/internal/manifest/os.go
index 06064bee3..3289a7cfd 100644
--- a/internal/manifest/os.go
+++ b/internal/manifest/os.go
@@ -115,6 +115,7 @@ func NewOSPipeline(m *Manifest,
 	p := &OSPipeline{
 		BasePipeline: NewBasePipeline(m, "os", buildPipeline, nil),
 		repos:        repos,
+		arch:         arch,
 		Language:     "C.UTF-8",
 		Hostname:     "localhost.localdomain",
 		Timezone:     "UTC",
@@ -127,6 +128,34 @@ func NewOSPipeline(m *Manifest,
 
 func (p *OSPipeline) getPackageSetChain() []rpmmd.PackageSet {
 	packages := []string{}
+
+	switch p.arch {
+	case ARCH_X86_64:
+		if p.BIOSPlatform != "" {
+			packages = append(packages,
+				"dracut-config-generic",
+				"grub2-pc")
+		}
+		if p.UEFIVendor != "" {
+			packages = append(packages,
+				"dracut-config-generic",
+				"efibootmgr",
+				"grub2-efi-x64",
+				"shim-x64")
+		}
+	case ARCH_AARCH64:
+		if p.UEFIVendor != "" {
+			packages = append(packages,
+				"dracut-config-generic",
+				"efibootmgr",
+				"grub2-efi-aa64",
+				"grub2-tools",
+				"shim-aa64")
+		}
+	default:
+		panic("unsupported architecture")
+	}
+
 	chain := []rpmmd.PackageSet{
 		{
 			Include:      append(packages, p.ExtraBasePackages...),


Test patch:
diff --git a/test/data/manifests/fedora_34-aarch64-ami-boot.json b/test/data/manifests/fedora_34-aarch64-ami-boot.json
index b353da0bf..7b0bf24df 100644
--- a/test/data/manifests/fedora_34-aarch64-ami-boot.json
+++ b/test/data/manifests/fedora_34-aarch64-ami-boot.json
@@ -4749,6 +4749,10 @@
             "options": {
               "root_fs_uuid": "6e4ff95f-f662-45ee-a82a-bdf44a2d0b75",
               "boot_fs_uuid": "0194fdc2-fa2f-4cc0-81d3-ff12045b73c8",
+              "uefi": {
+                "vendor": "fedora",
+                "unified": true
+              },
               "saved_entry": "ffffffffffffffffffffffffffffffff-5.15.13-100.fc34.aarch64",
               "write_cmdline": false,
               "config": {
diff --git a/test/data/manifests/fedora_34-x86_64-fedora_iot_commit-boot.json b/test/data/manifests/fedora_34-x86_64-fedora_iot_commit-boot.json
index 470a427f4..9778850c0 100644
--- a/test/data/manifests/fedora_34-x86_64-fedora_iot_commit-boot.json
+++ b/test/data/manifests/fedora_34-x86_64-fedora_iot_commit-boot.json
@@ -1248,6 +1248,22 @@
                       }
                     }
                   },
+                  {
+                    "id": "sha256:d999a3002712972253f264814ccc4cf2b0959a121c3cdd7e10a7c8423f4b6d32",
+                    "options": {
+                      "metadata": {
+                        "rpm.check_gpg": true
+                      }
+                    }
+                  },
+                  {
+                    "id": "sha256:7c274d3c094f73d2ee7bebc3b9b854b3303330eac9fa2d1f4461fd7460b34605",
+                    "options": {
+                      "metadata": {
+                        "rpm.check_gpg": true
+                      }
+                    }
+                  },
                   {
                     "id": "sha256:5a4b0cc50d9929ef558617fecd879f80a459379047ec77bcc238e5b305258bf5",
                     "options": {
@@ -8439,6 +8455,26 @@
         "checksum": "sha256:9d3e2e24cce87a77671ec717b3c7d9a8aa584768af441c86b0aa7565d6691fdc",
         "check_gpg": true
       },
+      {
+        "name": "grub2-pc",
+        "epoch": 1,
+        "version": "2.06",
+        "release": "9.fc34",
+        "arch": "x86_64",
+        "remote_location": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-updates-released-20220113/Packages/g/grub2-pc-2.06-9.fc34.x86_64.rpm",
+        "checksum": "sha256:d999a3002712972253f264814ccc4cf2b0959a121c3cdd7e10a7c8423f4b6d32",
+        "check_gpg": true
+      },
+      {
+        "name": "grub2-pc-modules",
+        "epoch": 1,
+        "version": "2.06",
+        "release": "9.fc34",
+        "arch": "noarch",
+        "remote_location": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-updates-released-20220113/Packages/g/grub2-pc-modules-2.06-9.fc34.noarch.rpm",
+        "checksum": "sha256:7c274d3c094f73d2ee7bebc3b9b854b3303330eac9fa2d1f4461fd7460b34605",
+        "check_gpg": true
+      },
       {
         "name": "grub2-tools",
         "epoch": 1,
diff --git a/test/data/manifests/fedora_34-x86_64-fedora_iot_commit_debug-boot.json b/test/data/manifests/fedora_34-x86_64-fedora_iot_commit_debug-boot.json
index 85f04b3df..164dfe70a 100644
--- a/test/data/manifests/fedora_34-x86_64-fedora_iot_commit_debug-boot.json
+++ b/test/data/manifests/fedora_34-x86_64-fedora_iot_commit_debug-boot.json
@@ -1254,6 +1254,22 @@
                       }
                     }
                   },
+                  {
+                    "id": "sha256:d999a3002712972253f264814ccc4cf2b0959a121c3cdd7e10a7c8423f4b6d32",
+                    "options": {
+                      "metadata": {
+                        "rpm.check_gpg": true
+                      }
+                    }
+                  },
+                  {
+                    "id": "sha256:7c274d3c094f73d2ee7bebc3b9b854b3303330eac9fa2d1f4461fd7460b34605",
+                    "options": {
+                      "metadata": {
+                        "rpm.check_gpg": true
+                      }
+                    }
+                  },
                   {
                     "id": "sha256:5a4b0cc50d9929ef558617fecd879f80a459379047ec77bcc238e5b305258bf5",
                     "options": {
@@ -8445,6 +8461,26 @@
         "checksum": "sha256:9d3e2e24cce87a77671ec717b3c7d9a8aa584768af441c86b0aa7565d6691fdc",
         "check_gpg": true
       },
+      {
+        "name": "grub2-pc",
+        "epoch": 1,
+        "version": "2.06",
+        "release": "9.fc34",
+        "arch": "x86_64",
+        "remote_location": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-updates-released-20220113/Packages/g/grub2-pc-2.06-9.fc34.x86_64.rpm",
+        "checksum": "sha256:d999a3002712972253f264814ccc4cf2b0959a121c3cdd7e10a7c8423f4b6d32",
+        "check_gpg": true
+      },
+      {
+        "name": "grub2-pc-modules",
+        "epoch": 1,
+        "version": "2.06",
+        "release": "9.fc34",
+        "arch": "noarch",
+        "remote_location": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-updates-released-20220113/Packages/g/grub2-pc-modules-2.06-9.fc34.noarch.rpm",
+        "checksum": "sha256:7c274d3c094f73d2ee7bebc3b9b854b3303330eac9fa2d1f4461fd7460b34605",
+        "check_gpg": true
+      },
       {
         "name": "grub2-tools",
         "epoch": 1,
diff --git a/test/data/manifests/fedora_34-x86_64-fedora_iot_container-boot.json b/test/data/manifests/fedora_34-x86_64-fedora_iot_container-boot.json
index 6a32d3d5f..3f9c2233b 100644
--- a/test/data/manifests/fedora_34-x86_64-fedora_iot_container-boot.json
+++ b/test/data/manifests/fedora_34-x86_64-fedora_iot_container-boot.json
@@ -1248,6 +1248,22 @@
                       }
                     }
                   },
+                  {
+                    "id": "sha256:d999a3002712972253f264814ccc4cf2b0959a121c3cdd7e10a7c8423f4b6d32",
+                    "options": {
+                      "metadata": {
+                        "rpm.check_gpg": true
+                      }
+                    }
+                  },
+                  {
+                    "id": "sha256:7c274d3c094f73d2ee7bebc3b9b854b3303330eac9fa2d1f4461fd7460b34605",
+                    "options": {
+                      "metadata": {
+                        "rpm.check_gpg": true
+                      }
+                    }
+                  },
                   {
                     "id": "sha256:5a4b0cc50d9929ef558617fecd879f80a459379047ec77bcc238e5b305258bf5",
                     "options": {
@@ -10003,6 +10019,26 @@
         "checksum": "sha256:9d3e2e24cce87a77671ec717b3c7d9a8aa584768af441c86b0aa7565d6691fdc",
         "check_gpg": true
       },
+      {
+        "name": "grub2-pc",
+        "epoch": 1,
+        "version": "2.06",
+        "release": "9.fc34",
+        "arch": "x86_64",
+        "remote_location": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-updates-released-20220113/Packages/g/grub2-pc-2.06-9.fc34.x86_64.rpm",
+        "checksum": "sha256:d999a3002712972253f264814ccc4cf2b0959a121c3cdd7e10a7c8423f4b6d32",
+        "check_gpg": true
+      },
+      {
+        "name": "grub2-pc-modules",
+        "epoch": 1,
+        "version": "2.06",
+        "release": "9.fc34",
+        "arch": "noarch",
+        "remote_location": "https://rpmrepo.osbuild.org/v2/mirror/public/f34/f34-x86_64-updates-released-20220113/Packages/g/grub2-pc-modules-2.06-9.fc34.noarch.rpm",
+        "checksum": "sha256:7c274d3c094f73d2ee7bebc3b9b854b3303330eac9fa2d1f4461fd7460b34605",
+        "check_gpg": true
+      },
       {
         "name": "grub2-tools",
         "epoch": 1,
diff --git a/test/data/manifests/fedora_35-aarch64-ami-boot.json b/test/data/manifests/fedora_35-aarch64-ami-boot.json
index 0c23d5678..6dffe77ae 100644
--- a/test/data/manifests/fedora_35-aarch64-ami-boot.json
+++ b/test/data/manifests/fedora_35-aarch64-ami-boot.json
@@ -4893,6 +4893,10 @@
             "options": {
               "root_fs_uuid": "6e4ff95f-f662-45ee-a82a-bdf44a2d0b75",
               "boot_fs_uuid": "0194fdc2-fa2f-4cc0-81d3-ff12045b73c8",
+              "uefi": {
+                "vendor": "fedora",
+                "unified": true
+              },
               "saved_entry": "ffffffffffffffffffffffffffffffff-5.15.13-200.fc35.aarch64",
               "write_cmdline": false,
               "config": {
diff --git a/test/data/manifests/fedora_35-x86_64-fedora_iot_commit-boot.json b/test/data/manifests/fedora_35-x86_64-fedora_iot_commit-boot.json
index 601d05ca2..af034f5d5 100644
--- a/test/data/manifests/fedora_35-x86_64-fedora_iot_commit-boot.json
+++ b/test/data/manifests/fedora_35-x86_64-fedora_iot_commit-boot.json
@@ -1544,6 +1544,22 @@
                       }
                     }
                   },
+                  {
+                    "id": "sha256:bd422838b08aee333b919798924814148118cd1d2ec7051a3d01f0161eec4184",
+                    "options": {
+                      "metadata": {
+                        "rpm.check_gpg": true
+                      }
+                    }
+                  },
+                  {
+                    "id": "sha256:59525eff25d7e8c661f3d2a5308d431234cbd5e4a70c4150c3a71639d0e0e136",
+                    "options": {
+                      "metadata": {
+                        "rpm.check_gpg": true
+                      }
+                    }
+                  },
                   {
                     "id": "sha256:94104f196a74be27358ac696a3f6063d45f7c33df2785a42454b988141760564",
                     "options": {
@@ -8830,6 +8846,26 @@
         "checksum": "sha256:2a3580b96d36668085e21a9d6e11cc2a7d254bfba9855c66fbfc663ea1f211c8",
         "check_gpg": true
       },
+      {
+        "name": "grub2-pc",
+        "epoch": 1,
+        "version": "2.06",
+        "release": "10.fc35",
+        "arch": "x86_64",
+        "remote_location": "https://rpmrepo.osbuild.org/v2/mirror/public/f35/f35-x86_64-updates-released-20220113/Packages/g/grub2-pc-2.06-10.fc35.x86_64.rpm",
+        "checksum": "sha256:bd422838b08aee333b919798924814148118cd1d2ec7051a3d01f0161eec4184",
+        "check_gpg": true
+      },
+      {
+        "name": "grub2-pc-modules",
+        "epoch": 1,
+        "version": "2.06",
+        "release": "10.fc35",
+        "arch": "noarch",
+        "remote_location": "https://rpmrepo.osbuild.org/v2/mirror/public/f35/f35-x86_64-updates-released-20220113/Packages/g/grub2-pc-modules-2.06-10.fc35.noarch.rpm",
+        "checksum": "sha256:59525eff25d7e8c661f3d2a5308d431234cbd5e4a70c4150c3a71639d0e0e136",
+        "check_gpg": true
+      },
       {
         "name": "grub2-tools",
         "epoch": 1,
diff --git a/test/data/manifests/fedora_35-x86_64-fedora_iot_commit_debug-boot.json b/test/data/manifests/fedora_35-x86_64-fedora_iot_commit_debug-boot.json
index 67aeecb33..ee8c08d49 100644
--- a/test/data/manifests/fedora_35-x86_64-fedora_iot_commit_debug-boot.json
+++ b/test/data/manifests/fedora_35-x86_64-fedora_iot_commit_debug-boot.json
@@ -1550,6 +1550,22 @@
                       }
                     }
                   },
+                  {
+                    "id": "sha256:bd422838b08aee333b919798924814148118cd1d2ec7051a3d01f0161eec4184",
+                    "options": {
+                      "metadata": {
+                        "rpm.check_gpg": true
+                      }
+                    }
+                  },
+                  {
+                    "id": "sha256:59525eff25d7e8c661f3d2a5308d431234cbd5e4a70c4150c3a71639d0e0e136",
+                    "options": {
+                      "metadata": {
+                        "rpm.check_gpg": true
+                      }
+                    }
+                  },
                   {
                     "id": "sha256:94104f196a74be27358ac696a3f6063d45f7c33df2785a42454b988141760564",
                     "options": {
@@ -8836,6 +8852,26 @@
         "checksum": "sha256:2a3580b96d36668085e21a9d6e11cc2a7d254bfba9855c66fbfc663ea1f211c8",
         "check_gpg": true
       },
+      {
+        "name": "grub2-pc",
+        "epoch": 1,
+        "version": "2.06",
+        "release": "10.fc35",
+        "arch": "x86_64",
+        "remote_location": "https://rpmrepo.osbuild.org/v2/mirror/public/f35/f35-x86_64-updates-released-20220113/Packages/g/grub2-pc-2.06-10.fc35.x86_64.rpm",
+        "checksum": "sha256:bd422838b08aee333b919798924814148118cd1d2ec7051a3d01f0161eec4184",
+        "check_gpg": true
+      },
+      {
+        "name": "grub2-pc-modules",
+        "epoch": 1,
+        "version": "2.06",
+        "release": "10.fc35",
+        "arch": "noarch",
+        "remote_location": "https://rpmrepo.osbuild.org/v2/mirror/public/f35/f35-x86_64-updates-released-20220113/Packages/g/grub2-pc-modules-2.06-10.fc35.noarch.rpm",
+        "checksum": "sha256:59525eff25d7e8c661f3d2a5308d431234cbd5e4a70c4150c3a71639d0e0e136",
+        "check_gpg": true
+      },
       {
         "name": "grub2-tools",
         "epoch": 1,
diff --git a/test/data/manifests/fedora_35-x86_64-fedora_iot_container-boot.json b/test/data/manifests/fedora_35-x86_64-fedora_iot_container-boot.json
index 39f5a82b3..2806d40ff 100644
--- a/test/data/manifests/fedora_35-x86_64-fedora_iot_container-boot.json
+++ b/test/data/manifests/fedora_35-x86_64-fedora_iot_container-boot.json
@@ -1544,6 +1544,22 @@
                       }
                     }
                   },
+                  {
+                    "id": "sha256:bd422838b08aee333b919798924814148118cd1d2ec7051a3d01f0161eec4184",
+                    "options": {
+                      "metadata": {
+                        "rpm.check_gpg": true
+                      }
+                    }
+                  },
+                  {
+                    "id": "sha256:59525eff25d7e8c661f3d2a5308d431234cbd5e4a70c4150c3a71639d0e0e136",
+                    "options": {
+                      "metadata": {
+                        "rpm.check_gpg": true
+                      }
+                    }
+                  },
                   {
                     "id": "sha256:94104f196a74be27358ac696a3f6063d45f7c33df2785a42454b988141760564",
                     "options": {
@@ -10367,6 +10383,26 @@
         "checksum": "sha256:2a3580b96d36668085e21a9d6e11cc2a7d254bfba9855c66fbfc663ea1f211c8",
         "check_gpg": true
       },
+      {
+        "name": "grub2-pc",
+        "epoch": 1,
+        "version": "2.06",
+        "release": "10.fc35",
+        "arch": "x86_64",
+        "remote_location": "https://rpmrepo.osbuild.org/v2/mirror/public/f35/f35-x86_64-updates-released-20220113/Packages/g/grub2-pc-2.06-10.fc35.x86_64.rpm",
+        "checksum": "sha256:bd422838b08aee333b919798924814148118cd1d2ec7051a3d01f0161eec4184",
+        "check_gpg": true
+      },
+      {
+        "name": "grub2-pc-modules",
+        "epoch": 1,
+        "version": "2.06",
+        "release": "10.fc35",
+        "arch": "noarch",
+        "remote_location": "https://rpmrepo.osbuild.org/v2/mirror/public/f35/f35-x86_64-updates-released-20220113/Packages/g/grub2-pc-modules-2.06-10.fc35.noarch.rpm",
+        "checksum": "sha256:59525eff25d7e8c661f3d2a5308d431234cbd5e4a70c4150c3a71639d0e0e136",
+        "check_gpg": true
+      },
       {
         "name": "grub2-tools",
         "epoch": 1,
diff --git a/test/data/manifests/fedora_36-aarch64-ami-boot.json b/test/data/manifests/fedora_36-aarch64-ami-boot.json
index 44dc9a9ea..ade40b5fc 100644
--- a/test/data/manifests/fedora_36-aarch64-ami-boot.json
+++ b/test/data/manifests/fedora_36-aarch64-ami-boot.json
@@ -5211,6 +5211,10 @@
             "options": {
               "root_fs_uuid": "6e4ff95f-f662-45ee-a82a-bdf44a2d0b75",
               "boot_fs_uuid": "0194fdc2-fa2f-4cc0-81d3-ff12045b73c8",
+              "uefi": {
+                "vendor": "fedora",
+                "unified": true
+              },
               "saved_entry": "ffffffffffffffffffffffffffffffff-5.18.0-0.rc5.40.fc37.aarch64",
               "write_cmdline": false,
               "config": {
diff --git a/test/data/manifests/fedora_36-x86_64-fedora_iot_commit-boot.json b/test/data/manifests/fedora_36-x86_64-fedora_iot_commit-boot.json
index 02b71195f..9557a1224 100644
--- a/test/data/manifests/fedora_36-x86_64-fedora_iot_commit-boot.json
+++ b/test/data/manifests/fedora_36-x86_64-fedora_iot_commit-boot.json
@@ -642,6 +642,22 @@
                       }
                     }
                   },
+                  {
+                    "id": "sha256:45d7bed87c83512634879d2519527be7c5184c2d516d146654abeb7d4907c09c",
+                    "options": {
+                      "metadata": {
+                        "rpm.check_gpg": true
+                      }
+                    }
+                  },
+                  {
+                    "id": "sha256:f30f4de190e9762199192165577e250d6a1b8936fdd99a7a14646c4154ece10f",
+                    "options": {
+                      "metadata": {
+                        "rpm.check_gpg": true
+                      }
+                    }
+                  },
                   {
                     "id": "sha256:ca6570e80b38f61221d622cab52390fa65a1fe9abfb402cc4ce4990a83f8d0f3",
                     "options": {
@@ -7915,6 +7931,26 @@
         "checksum": "sha256:5bb35ae3935a110f929aacbe0e1b8c2176072fb9260a1bc1881a4ce8c578cb2e",
         "check_gpg": true
       },
+      {
+        "name": "grub2-pc",
+        "epoch": 1,
+        "version": "2.06",
+        "release": "28.fc37",
+        "arch": "x86_64",
+        "remote_location": "https://rpmrepo.osbuild.org/v2/mirror/public/f36/f36-x86_64-rawhide-20220324/Packages/g/grub2-pc-2.06-28.fc37.x86_64.rpm",
+        "checksum": "sha256:45d7bed87c83512634879d2519527be7c5184c2d516d146654abeb7d4907c09c",
+        "check_gpg": true
+      },
+      {
+        "name": "grub2-pc-modules",
+        "epoch": 1,
+        "version": "2.06",
+        "release": "28.fc37",
+        "arch": "noarch",
+        "remote_location": "https://rpmrepo.osbuild.org/v2/mirror/public/f36/f36-x86_64-rawhide-20220324/Packages/g/grub2-pc-modules-2.06-28.fc37.noarch.rpm",
+        "checksum": "sha256:f30f4de190e9762199192165577e250d6a1b8936fdd99a7a14646c4154ece10f",
+        "check_gpg": true
+      },
       {
         "name": "grub2-tools",
         "epoch": 1,
diff --git a/test/data/manifests/fedora_36-x86_64-fedora_iot_commit_debug-boot.json b/test/data/manifests/fedora_36-x86_64-fedora_iot_commit_debug-boot.json
index 32a04542f..39dec806b 100644
--- a/test/data/manifests/fedora_36-x86_64-fedora_iot_commit_debug-boot.json
+++ b/test/data/manifests/fedora_36-x86_64-fedora_iot_commit_debug-boot.json
@@ -648,6 +648,22 @@
                       }
                     }
                   },
+                  {
+                    "id": "sha256:45d7bed87c83512634879d2519527be7c5184c2d516d146654abeb7d4907c09c",
+                    "options": {
+                      "metadata": {
+                        "rpm.check_gpg": true
+                      }
+                    }
+                  },
+                  {
+                    "id": "sha256:f30f4de190e9762199192165577e250d6a1b8936fdd99a7a14646c4154ece10f",
+                    "options": {
+                      "metadata": {
+                        "rpm.check_gpg": true
+                      }
+                    }
+                  },
                   {
                     "id": "sha256:ca6570e80b38f61221d622cab52390fa65a1fe9abfb402cc4ce4990a83f8d0f3",
                     "options": {
@@ -7921,6 +7937,26 @@
         "checksum": "sha256:5bb35ae3935a110f929aacbe0e1b8c2176072fb9260a1bc1881a4ce8c578cb2e",
         "check_gpg": true
       },
+      {
+        "name": "grub2-pc",
+        "epoch": 1,
+        "version": "2.06",
+        "release": "28.fc37",
+        "arch": "x86_64",
+        "remote_location": "https://rpmrepo.osbuild.org/v2/mirror/public/f36/f36-x86_64-rawhide-20220324/Packages/g/grub2-pc-2.06-28.fc37.x86_64.rpm",
+        "checksum": "sha256:45d7bed87c83512634879d2519527be7c5184c2d516d146654abeb7d4907c09c",
+        "check_gpg": true
+      },
+      {
+        "name": "grub2-pc-modules",
+        "epoch": 1,
+        "version": "2.06",
+        "release": "28.fc37",
+        "arch": "noarch",
+        "remote_location": "https://rpmrepo.osbuild.org/v2/mirror/public/f36/f36-x86_64-rawhide-20220324/Packages/g/grub2-pc-modules-2.06-28.fc37.noarch.rpm",
+        "checksum": "sha256:f30f4de190e9762199192165577e250d6a1b8936fdd99a7a14646c4154ece10f",
+        "check_gpg": true
+      },
       {
         "name": "grub2-tools",
         "epoch": 1,
diff --git a/test/data/manifests/fedora_36-x86_64-fedora_iot_container-boot.json b/test/data/manifests/fedora_36-x86_64-fedora_iot_container-boot.json
index 316349cb2..9202c25c1 100644
--- a/test/data/manifests/fedora_36-x86_64-fedora_iot_container-boot.json
+++ b/test/data/manifests/fedora_36-x86_64-fedora_iot_container-boot.json
@@ -642,6 +642,22 @@
                       }
                     }
                   },
+                  {
+                    "id": "sha256:45d7bed87c83512634879d2519527be7c5184c2d516d146654abeb7d4907c09c",
+                    "options": {
+                      "metadata": {
+                        "rpm.check_gpg": true
+                      }
+                    }
+                  },
+                  {
+                    "id": "sha256:f30f4de190e9762199192165577e250d6a1b8936fdd99a7a14646c4154ece10f",
+                    "options": {
+                      "metadata": {
+                        "rpm.check_gpg": true
+                      }
+                    }
+                  },
                   {
                     "id": "sha256:ca6570e80b38f61221d622cab52390fa65a1fe9abfb402cc4ce4990a83f8d0f3",
                     "options": {
@@ -9450,6 +9466,26 @@
         "checksum": "sha256:5bb35ae3935a110f929aacbe0e1b8c2176072fb9260a1bc1881a4ce8c578cb2e",
         "check_gpg": true
       },
+      {
+        "name": "grub2-pc",
+        "epoch": 1,
+        "version": "2.06",
+        "release": "28.fc37",
+        "arch": "x86_64",
+        "remote_location": "https://rpmrepo.osbuild.org/v2/mirror/public/f36/f36-x86_64-rawhide-20220324/Packages/g/grub2-pc-2.06-28.fc37.x86_64.rpm",
+        "checksum": "sha256:45d7bed87c83512634879d2519527be7c5184c2d516d146654abeb7d4907c09c",
+        "check_gpg": true
+      },
+      {
+        "name": "grub2-pc-modules",
+        "epoch": 1,
+        "version": "2.06",
+        "release": "28.fc37",
+        "arch": "noarch",
+        "remote_location": "https://rpmrepo.osbuild.org/v2/mirror/public/f36/f36-x86_64-rawhide-20220324/Packages/g/grub2-pc-modules-2.06-28.fc37.noarch.rpm",
+        "checksum": "sha256:f30f4de190e9762199192165577e250d6a1b8936fdd99a7a14646c4154ece10f",
+        "check_gpg": true
+      },
       {
         "name": "grub2-tools",
         "epoch": 1,