Repository: osbuild/osbuild-composer
Pull request #3743 (2023-10-16 19:34:00)

Enables 'fdo.di_mfg_string_type_mac_iface' variable passing
Adds implementation of the 'fdo.di_mfg_string_type_mac_iface' dracut variable to allow simplified installer images to pass this value to the manufacturing-client.service.


This pull request includes:

- [ ] adequate testing for the new functionality or fixed issue
- [ ] adequate documentation informing people about the change such as
  - [ ] submit a PR for the [guides](https://github.com/osbuild/guides) repository if this PR changed any behavior described there: https://www.osbuild.org/guides/

<!--
Thanks for proposing a change to osbuild-composer!

Please don't remove the above check list. These are things that each pull
request must have before it is merged. It helps maintainers to not forget
anything.

If the reason for ticking any of the boxes is ambiguous, please add a short
note explaining why.

In addition, if this pull request fixes a downstream issue, please refer to
test/README.md and add these additional items:

- [ ] 1st commit of any `rhbz#` related PR contains bug reproducer; CI reports FAIL or
- [ ] PR contains automated tests for new functionality and
- [ ] QE has approved reproducer/new tests and
- [ ] Subsequent commits provide bug fixes without modifying the reproducer; CI reports PASS and
- [ ] QE approves this PR; RHBZ status is set to `MODIFIED + Verified=Tested`

Information regarding our GitLab pipeline (Schutzbot):

CI will not be ran automatically if WIP label is applied or the PR is in DRAFT state, instead only
a link will be provided to the pipeline which can then be triggered manually if desired. To run the
CI automatically either switch the PR to ready or apply WIP+test label.

Outside contributors need manual approval from one of the osbuild-composer maintainers.

Schutzbot will only be triggered if all Tests jobs in GitHub workflow succeed.
-->


djach7: This PR is linked to https://github.com/osbuild/images/pull/208, which enables 'fdo.di_mfg_string_type_mac_iface' passing in the images repo.
miabbott: See https://github.com/osbuild/osbuild-composer/pull/3723 for an example of how to vendor in a copy of `osbuild/images`  which may allow the CI to run successfully
croissanne: Rebased to prevent OCI private key leaking. Apologies :(

Patch:
diff --git a/cmd/osbuild-playground/my-container.go b/cmd/osbuild-playground/my-container.go
index f59527d8c..d8c22c7af 100644
--- a/cmd/osbuild-playground/my-container.go
+++ b/cmd/osbuild-playground/my-container.go
@@ -46,7 +46,7 @@ func (img *MyContainer) InstantiateManifest(m *manifest.Manifest,
 	// Let's create a simple OCI container!
 
 	// configure a build pipeline
-	build := manifest.NewBuild(m, runner, repos)
+	build := manifest.NewBuild(m, runner, repos, nil)
 	build.Checkpoint()
 
 	// create a minimal non-bootable OS tree
diff --git a/cmd/osbuild-playground/my-image.go b/cmd/osbuild-playground/my-image.go
index de8a0b4e0..f2e2d7c52 100644
--- a/cmd/osbuild-playground/my-image.go
+++ b/cmd/osbuild-playground/my-image.go
@@ -30,7 +30,7 @@ func (img *MyImage) InstantiateManifest(m *manifest.Manifest,
 	// Let's create a simple raw image!
 
 	// configure a build pipeline
-	build := manifest.NewBuild(m, runner, repos)
+	build := manifest.NewBuild(m, runner, repos, nil)
 	build.Checkpoint()
 
 	// create an x86_64 platform with bios boot
diff --git a/go.mod b/go.mod
index 4f80dc210..6f386283d 100644
--- a/go.mod
+++ b/go.mod
@@ -12,9 +12,9 @@ require (
 	github.com/Azure/go-autorest/autorest v0.11.29
 	github.com/Azure/go-autorest/autorest/azure/auth v0.5.12
 	github.com/BurntSushi/toml v1.3.2
-	github.com/aws/aws-sdk-go v1.48.13
+	github.com/aws/aws-sdk-go v1.49.0
 	github.com/coreos/go-semver v0.3.1
-	github.com/coreos/go-systemd v0.0.0-20190719114852-fd7a80b32e1f
+	github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf
 	github.com/deepmap/oapi-codegen v1.8.2
 	github.com/getkin/kin-openapi v0.93.0
 	github.com/gobwas/glob v0.2.3
@@ -31,7 +31,7 @@ require (
 	github.com/labstack/gommon v0.4.1
 	github.com/openshift-online/ocm-sdk-go v0.1.388
 	github.com/oracle/oci-go-sdk/v54 v54.0.0
-	github.com/osbuild/images v0.21.0
+	github.com/osbuild/images v0.24.0
 	github.com/osbuild/osbuild-composer/pkg/splunk_logger v0.0.0-20231117174845-e969a9dc3cd1
 	github.com/osbuild/pulp-client v0.1.0
 	github.com/prometheus/client_golang v1.17.0
@@ -69,7 +69,7 @@ require (
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cenkalti/backoff/v4 v4.2.1 // indirect
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
-	github.com/containers/common v0.57.0 // indirect
+	github.com/containers/common v0.57.1 // indirect
 	github.com/containers/image/v5 v5.29.0 // indirect
 	github.com/containers/libtrust v0.0.0-20230121012942-c1716e8a8d01 // indirect
 	github.com/containers/ocicrypt v1.1.9 // indirect
diff --git a/go.sum b/go.sum
index 94b813f6d..37a7d6338 100644
--- a/go.sum
+++ b/go.sum
@@ -61,8 +61,8 @@ github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d/go.mod h1:asat6
 github.com/asaskevich/govalidator v0.0.0-20200907205600-7a23bdc65eef/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
-github.com/aws/aws-sdk-go v1.48.13 h1:6N4GTme6MpxfCisWf5pql8k3TBORiKTmbeutZCDXlG8=
-github.com/aws/aws-sdk-go v1.48.13/go.mod h1:LF8svs817+Nz+DmiMQKTO3ubZ/6IaTpq3TjupRn3Eqk=
+github.com/aws/aws-sdk-go v1.49.0 h1:g9BkW1fo9GqKfwg2+zCD+TW/D36Ux+vtfJ8guF4AYmY=
+github.com/aws/aws-sdk-go v1.49.0/go.mod h1:LF8svs817+Nz+DmiMQKTO3ubZ/6IaTpq3TjupRn3Eqk=
 github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuPk=
 github.com/aymerick/douceur v0.2.0/go.mod h1:wlT5vV2O3h55X9m7iVYN0TBM0NH/MmbLnd30/FjWUq4=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
@@ -76,8 +76,8 @@ github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDk
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cockroachdb/apd v1.1.0 h1:3LFP3629v+1aKXU5Q37mxmRxX/pIu1nijXydLShEq5I=
 github.com/cockroachdb/apd v1.1.0/go.mod h1:8Sl8LxpKi29FqWXR16WEFZRNSz3SoPzUzeMeY4+DwBQ=
-github.com/containers/common v0.57.0 h1:5O/+6QUBafKK0/zeok9y1rLPukfWgdE0sT4nuzmyAqk=
-github.com/containers/common v0.57.0/go.mod h1:t/Z+/sFrapvFMEJe3YnecN49/Tae2wYEQShbEN6SRaU=
+github.com/containers/common v0.57.1 h1:KWAs4PMPgBFmBV4QNbXhUB8TqvlgR95BJN2sbbXkWHY=
+github.com/containers/common v0.57.1/go.mod h1:t/Z+/sFrapvFMEJe3YnecN49/Tae2wYEQShbEN6SRaU=
 github.com/containers/image/v5 v5.29.0 h1:9+nhS/ZM7c4Kuzu5tJ0NMpxrgoryOJ2HAYTgG8Ny7j4=
 github.com/containers/image/v5 v5.29.0/go.mod h1:kQ7qcDsps424ZAz24thD+x7+dJw1vgur3A9tTDsj97E=
 github.com/containers/libtrust v0.0.0-20230121012942-c1716e8a8d01 h1:Qzk5C6cYglewc+UyGf6lc8Mj2UaPTHy/iF2De0/77CA=
@@ -89,8 +89,9 @@ github.com/containers/storage v1.51.0/go.mod h1:ybl8a3j1PPtpyaEi/5A6TOFs+5TrEyOb
 github.com/coreos/go-semver v0.3.1 h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4=
 github.com/coreos/go-semver v0.3.1/go.mod h1:irMmmIw/7yzSRPWryHsK7EYSg09caPQL03VsM8rvUec=
 github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
-github.com/coreos/go-systemd v0.0.0-20190719114852-fd7a80b32e1f h1:JOrtw2xFKzlg+cbHpyrpLDmnN1HqhBfnX7WDiW7eG2c=
 github.com/coreos/go-systemd v0.0.0-20190719114852-fd7a80b32e1f/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
+github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf h1:iW4rZ826su+pqaw19uhpSCzhj44qo35pNgKFGqzDKkU=
+github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
 github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
@@ -453,8 +454,8 @@ github.com/openshift-online/ocm-sdk-go v0.1.388 h1:c8yPCUQwJm3QhcVmnyMPFpeDtxPBa
 github.com/openshift-online/ocm-sdk-go v0.1.388/go.mod h1:/+VFIw1iW2H0jEkFH4GnbL/liWareyzsL0w7mDIudB4=
 github.com/oracle/oci-go-sdk/v54 v54.0.0 h1:CDLjeSejv2aDpElAJrhKpi6zvT/zhZCZuXchUUZ+LS4=
 github.com/oracle/oci-go-sdk/v54 v54.0.0/go.mod h1:+t+yvcFGVp+3ZnztnyxqXfQDsMlq8U25faBLa+mqCMc=
-github.com/osbuild/images v0.21.0 h1:xqW7Y6F+ihoL8x2J+S3nGDRXIqZPq//c0Q8ny3afdpo=
-github.com/osbuild/images v0.21.0/go.mod h1:HtKiCjR4gQcqcd8E7i37orlFqhsjZmFCvyM89E3aeos=
+github.com/osbuild/images v0.24.0 h1:EP1+9Y5IKuTIZ3Q/RmP5/MdUyjlX7zSZCS0NOXK2+Bg=
+github.com/osbuild/images v0.24.0/go.mod h1:jC7HIvrDKqMJjvNOiaz+QbBJG9oz2YBZHrHsF4nQX1k=
 github.com/osbuild/osbuild-composer/pkg/splunk_logger v0.0.0-20231117174845-e969a9dc3cd1 h1:UFEJIcPa46W8gtWgOYzriRKYyy1t6SWL0BI7fPTuVvc=
 github.com/osbuild/osbuild-composer/pkg/splunk_logger v0.0.0-20231117174845-e969a9dc3cd1/go.mod h1:z+WA+dX6qMwc7fqY5jCzESDIlg4WR2sBQezxsoXv9Ik=
 github.com/osbuild/pulp-client v0.1.0 h1:L0C4ezBJGTamN3BKdv+rKLuq/WxXJbsFwz/Hj7aEmJ8=
diff --git a/internal/blueprint/blueprint.go b/internal/blueprint/blueprint.go
index 517f2b39d..3df6a5782 100644
--- a/internal/blueprint/blueprint.go
+++ b/internal/blueprint/blueprint.go
@@ -22,6 +22,7 @@ type Blueprint struct {
 	Containers     []Container     `json:"containers,omitempty" toml:"containers,omitempty"`
 	Customizations *Customizations `json:"customizations,omitempty" toml:"customizations"`
 	Distro         string          `json:"distro" toml:"distro"`
+	Arch           string          `json:"architecture,omitempty" toml:"architecture,omitempty"`
 }
 
 type Change struct {
diff --git a/internal/blueprint/customizations.go b/internal/blueprint/customizations.go
index 146c3b72e..770413450 100644
--- a/internal/blueprint/customizations.go
+++ b/internal/blueprint/customizations.go
@@ -48,8 +48,9 @@ type FDOCustomization struct {
 	DiunPubKeyInsecure     string `json:"diun_pub_key_insecure,omitempty" toml:"diun_pub_key_insecure,omitempty"`
 	// This is the output of:
 	// echo "sha256:$(openssl x509 -fingerprint -sha256 -noout -in diun_cert.pem | cut -d"=" -f2 | sed 's/://g')"
-	DiunPubKeyHash      string `json:"diun_pub_key_hash,omitempty" toml:"diun_pub_key_hash,omitempty"`
-	DiunPubKeyRootCerts string `json:"diun_pub_key_root_certs,omitempty" toml:"diun_pub_key_root_certs,omitempty"`
+	DiunPubKeyHash          string `json:"diun_pub_key_hash,omitempty" toml:"diun_pub_key_hash,omitempty"`
+	DiunPubKeyRootCerts     string `json:"diun_pub_key_root_certs,omitempty" toml:"diun_pub_key_root_certs,omitempty"`
+	DiMfgStringTypeMacIface string `json:"di_mfg_string_type_mac_iface,omitempty" toml:"di_mfg_string_type_mac_iface,omitempty"`
 }
 
 type KernelCustomization struct {
diff --git a/internal/blueprint/repository_customizations.go b/internal/blueprint/repository_customizations.go
index 9288b69fc..fb72bfd53 100644
--- a/internal/blueprint/repository_customizations.go
+++ b/internal/blueprint/repository_customizations.go
@@ -8,18 +8,19 @@ import (
 )
 
 type RepositoryCustomization struct {
-	Id           string   `json:"id" toml:"id"`
-	BaseURLs     []string `json:"baseurls,omitempty" toml:"baseurls,omitempty"`
-	GPGKeys      []string `json:"gpgkeys,omitempty" toml:"gpgkeys,omitempty"`
-	Metalink     string   `json:"metalink,omitempty" toml:"metalink,omitempty"`
-	Mirrorlist   string   `json:"mirrorlist,omitempty" toml:"mirrorlist,omitempty"`
-	Name         string   `json:"name,omitempty" toml:"name,omitempty"`
-	Priority     *int     `json:"priority,omitempty" toml:"priority,omitempty"`
-	Enabled      *bool    `json:"enabled,omitempty" toml:"enabled,omitempty"`
-	GPGCheck     *bool    `json:"gpgcheck,omitempty" toml:"gpgcheck,omitempty"`
-	RepoGPGCheck *bool    `json:"repo_gpgcheck,omitempty" toml:"repo_gpgcheck,omitempty"`
-	SSLVerify    *bool    `json:"sslverify,omitempty" toml:"sslverify,omitempty"`
-	Filename     string   `json:"filename,omitempty" toml:"filename,omitempty"`
+	Id             string   `json:"id" toml:"id"`
+	BaseURLs       []string `json:"baseurls,omitempty" toml:"baseurls,omitempty"`
+	GPGKeys        []string `json:"gpgkeys,omitempty" toml:"gpgkeys,omitempty"`
+	Metalink       string   `json:"metalink,omitempty" toml:"metalink,omitempty"`
+	Mirrorlist     string   `json:"mirrorlist,omitempty" toml:"mirrorlist,omitempty"`
+	Name           string   `json:"name,omitempty" toml:"name,omitempty"`
+	Priority       *int     `json:"priority,omitempty" toml:"priority,omitempty"`
+	Enabled        *bool    `json:"enabled,omitempty" toml:"enabled,omitempty"`
+	GPGCheck       *bool    `json:"gpgcheck,omitempty" toml:"gpgcheck,omitempty"`
+	RepoGPGCheck   *bool    `json:"repo_gpgcheck,omitempty" toml:"repo_gpgcheck,omitempty"`
+	SSLVerify      *bool    `json:"sslverify,omitempty" toml:"sslverify,omitempty"`
+	ModuleHotfixes *bool    `json:"module_hotfixes,omitempty" toml:"module_hotfixes,omitempty"`
+	Filename       string   `json:"filename,omitempty" toml:"filename,omitempty"`
 }
 
 const repoFilenameRegex = "^[\\w.-]{1,250}\\.repo$"
diff --git a/internal/cloudapi/v2/compose.go b/internal/cloudapi/v2/compose.go
index 72c48f8fb..707832113 100644
--- a/internal/cloudapi/v2/compose.go
+++ b/internal/cloudapi/v2/compose.go
@@ -356,6 +356,9 @@ func (request *ComposeRequest) GetBlueprintWithCustomizations() (blueprint.Bluep
 		if request.Customizations.Fdo.ManufacturingServerUrl != nil {
 			fdo.ManufacturingServerURL = *request.Customizations.Fdo.ManufacturingServerUrl
 		}
+		if request.Customizations.Fdo.DiMfgStringTypeMacIface != nil {
+			fdo.DiMfgStringTypeMacIface = *request.Customizations.Fdo.DiMfgStringTypeMacIface
+		}
 
 		bp.Customizations.FDO = fdo
 	}
diff --git a/internal/cloudapi/v2/openapi.v2.gen.go b/internal/cloudapi/v2/openapi.v2.gen.go
index 37708b54c..d231f7d62 100644
--- a/internal/cloudapi/v2/openapi.v2.gen.go
+++ b/internal/cloudapi/v2/openapi.v2.gen.go
@@ -437,10 +437,11 @@ type ErrorList struct {
 
 // FIDO device onboard configuration
 type FDO struct {
-	DiunPubKeyHash         *string `json:"diun_pub_key_hash,omitempty"`
-	DiunPubKeyInsecure     *string `json:"diun_pub_key_insecure,omitempty"`
-	DiunPubKeyRootCerts    *string `json:"diun_pub_key_root_certs,omitempty"`
-	ManufacturingServerUrl *string `json:"manufacturing_server_url,omitempty"`
+	DiMfgStringTypeMacIface *string `json:"di_mfg_string_type_mac_iface,omitempty"`
+	DiunPubKeyHash          *string `json:"diun_pub_key_hash,omitempty"`
+	DiunPubKeyInsecure      *string `json:"diun_pub_key_insecure,omitempty"`
+	DiunPubKeyRootCerts     *string `json:"diun_pub_key_root_certs,omitempty"`
+	ManufacturingServerUrl  *string `json:"manufacturing_server_url,omitempty"`
 }
 
 // System FIPS mode setup
@@ -1145,108 +1146,109 @@ var swaggerSpec = []string{
 	"v/GCa4WqDKZ5vG7xXC/r69+k0RGx2YSXGzEXcy4PK9AAorMzRwsTQA0BlaSTxkQcm+JBrZbuWBd2mlNd",
 	"2KEuGsFPykWpoLozE7NUo55rV1gS6tWU6EzBFGrKHjFi+r+CmAvmjZpqmoET+SR/lcPYCNZwiS4JN6fs",
 	"AWPpBilpEtv5O9VwUfMFwOk+WTXlTmDZbjdt1TrFOR6yla34iyb1psCVBpWOubQWNpmgC86k9vFVoBoC",
-	"SoYUMuWkUtpt6Jxc9ID55MXzhy9jNHuxIbfTFzPeChOODJ+hzS3lVn4xEBPpOpgLiS9Zoi8fvEgJg9jL",
-	"ykSwpb2sTJHd6NNTtg+QPYHkPoAjoXJkFvlx5BXaxIhlwyDzbgF2JtXxuzwL7KA1ckUaeT8iUsIo57LX",
-	"Wm7SkDMp6JADz4ESMnpPjUj+heJpg6d8O2kVzkIJpkBCRRLr3yKoFEZrZdR+tfpjMkqCThNPwfMfkU9z",
-	"+vkh/SIZ9feJppOEO2MheQCTl/ScfPk0Po/gFGIChjOBeBz9cql6UK1X9qv1ZJ6Bj4nYryqGFNkvSS9o",
-	"YQLZRvd6rHN2jnD6TNN8Ijty+gDGJv7uUSbWeFnUa/BZGk+UCcAgsRD/oiwej1FBDeooH4y0z+O0/Gem",
-	"XP4qDMk668XgD+xCT/25W358zLD4ofmHAFTUT/FjuYVNzOWfKfKOx3h7Gkni8OZQYjMXyCFI7DbLhETZ",
-	"NKpunBx0JCSJifB2LLpY2HxpEui0ef0z4cWhb4yRWO26gkRze8kfe/3G5XHj9hj0BGXQQsBwIOfgSIHI",
-	"L+YyBz9ywQgrszzSvXrSZiYpsefIAS03uaqmMEGTup4vEGgRC5PA25wfkH6UWKoALaR6T7GwA3l82rwG",
-	"QWQmG7hnMFeOhKSbQMEKkvHnzvA8aI+SSclRDviAfDJ0SJ/loIdzA79YrBi+j031F/oUSp5gOMnGRQLr",
-	"XXLE5wUAy6SUU9TvY1m30ZxCZ1fcux+j74hRN6CnKqqISAnlb2wq6GGKdh70EAJRMNGhvpm3KLWCkD3X",
-	"W0dl6haiTO8guT6Z2a2Ct74jcC7APMoCNxzKERehUNUh+AH5HCRgh9tTb8yo2xdJZsOmHBEAfUFdKLAB",
-	"HWe2SGTk71BmlM4QArqoeYOwucRXQUnu5LTtq7ZnfkBa0LDDTaKoHoSpAIwoFSkCwTDKOZwH9woDrbxw",
-	"ABn6OiAA5MAnqRx8/RO5EDvY/P7pK2gQoH4BaJoMca5VP4Y8hrhSN6OxDAkCLEwrD04oAwH1suATdLCB",
-	"/jeWpvEpH4wccMmG7rcjDnroAMSqsd1ZTrnjctDz/hd6HveoyFtBp7BPHCWlae5KjWD+YT2BxGuBBKaL",
-	"CU+lgUldiMnXP/W/ckB1PEHPxwIB/RR89hh2IZt9WR7ccfSAKuGAIxYYA1AEfRcpMj96n6Rg/bSAU/qp",
-	"W781wxoMzRzkRgWQzAYkpO9gQddQG25pV2Qi5SHcD9suXiawK74ukzmTzQQEjj/8SwodI7n763LulWyW",
-	"8F8Wc6ohNxAxIRG5IYPYzFWKlVqpslGpjYHLbkrhPw1NtR2UByutzEMbd9IU0WxJG3NzI/gz9TT4L3P8",
-	"Y4kAm8u4FgBupMLKKbdjcb8dlNew2wbdXeWwmVpr3Caq2Arb6/gsF0Npr23Z+STqkKokLo2xc27ECFvb",
-	"+PdUu3W0PonPbAcUUrOvrhmdYK7DfuDutrNVElUqdvHc390Qg8ywsUCGCHxq80Mbpe+sUHz14y3ya/sz",
-	"T4dkdLL6xihrry9bqakn43C/IpIU2fGBD6m45KULbHo1yWxky+fBg41IWCNbjJd9yQ5YClYXE+z67oCY",
-	"aIQJMsFwFmun9JqkcKmWD6uH+wflw/1VTgGtrr9Qb6vs9aQlNe8elN6m69ZyTKUuB4MoW0Uprp6DFot3",
-	"gdLo5EIAPUk+IBBw5EEmmWPQ2kTS4tLKrhKwWHBApyQcIg+6AfwBMfFIOfhFOIa0IqbIceS/ERrhu4CH",
-	"qkLjMSam1AwHhPuelvg7RBw1rfoK7kZBmjgliQOwsEu/hadxlVhFYQxk68TwyJW/c2J8kFIebYPtACTr",
-	"rhY673AQF+GsJXCY2J4k30455NmMClzrPzXS+u+wJDhINF9iZzEmFRsKTuUwcMpzNswx28fBr9ifHHrR",
-	"zw+NjK4ORtA7SLxJ/oj1UzkyUTlO8CtMywseRHkzUnNUzi7LiABYkudHGpn6N9EBUzGHr3/Mwcvfi40Z",
-	"nEbgHDxJQqOGHHPCPWmEz//K0QnMZDNT7qQS+CLK39lFMHlyYVOCE+q5NAkt30WBWarSFigVKoOZAZ0w",
-	"pMqcJGNzMEm6kgnlrvhjRJmB1uWArtbhggG0cycBWr/JmWjoW9ulkl8EhTk/kFQ/H/ZE5982HeqbuSPI",
-	"V3hYVMZssme5WC4WD4sH+WKq10DFxdJzg8f0FackBsvHtj/cJqUa8vGirVAtp2nVE8T4Uv1VZfO1EAH6",
-	"86GCxZ1DnFPl24q1CWszF80jKXGCOhqiau+WoqtEHzrdchX4VYJCMbNtqJO2p8KIcxKkFJjpuc3B9UUp",
-	"ec2BvrT8RlABnbRXC1RQg2aje4/0dUO6c3ZlADqr7oVwfsYzrJIAXzicoM0xw76NeeTExNIycocJ/UW7",
-	"G4/u2p3jl85Vs9HpNe5bAJEJZpToAvwBmUCGdQRA+2X15otFBjicSE1flwspCa+ce44zywOJgrrURWpf",
-	"Jpogh3oSsPIeU+LMstpnq50X88wuzYLYimtVFtYiRpOVNEc7mpO60wZjcoxmKh9gmav2pFanWapuAhw4",
-	"o34yYOmnFoM5kFh+erFq6MfUmaBKRAyjHNbQTaSsVH3PCTKoizgI/FZZdfuENKeIeq/8j4AjgxITBvU1",
-	"MQcRIi93vfxd/yRX/7n4SDZz1WzvtudXQ/hL7roJbLOvf6ZUHyAiUq3chrpBSMUlsgCra4ay0WGTu32E",
-	"hGHLgxFAyYO26zkYBb7Lf/nM+ZfsIG2vwDbIDogOdCQKBpThEtQWqzOTTy+F0ikBKQkKkEhYCKuUSBiU",
-	"SYPPwVp/BcXyfrE6LJtwHx3WqkOzUh3Wh/UyrFdqqAYPDszycL84GsEvWR3IHjJIDDvn4DECLKoYnMNj",
-	"NnLm5UhS2fuy4MtfbpEu2EfLpclbdLO5u5k5HiOBmCtNPTC1UUAaHSBIXNLiQgItxMBnAxLTQR4mXwA2",
-	"ERFYzPQFUnp/AUGVs1U7p9WL0GLPgyYl3HcRA4bcXKqqcbEsBHJgOFgezWQbG5EBifZStA8k1ww31oqr",
-	"p7bP+llMSVs6CHawFMs+k3TJu0IkpxXaBoJUjZB6NsPs9CWkPEZH2EGr0t8ExA5VP7bMf+9HHVI8tuFI",
-	"61Dsx0dM4spVSrt28W0f4fbJj/RLW+HFKwqWr61jRnqaGvLoijcra8piCvmy5o0t16ytekWgWJUEF/rl",
-	"ll7ElOgNV/pox8ZKTTmriRDhKK32a9/xtHT4qXA+5Cg9C+koeKP1o+hKgkCdmrOQdPYYLypdLOQO30kl",
-	"Qevq+u465awMZYCgq62jlyDUJoGvN3kW6BzNNu2sLBJ0lTxXJaZbCfWoZdpwt9vRKKHm5QekIYDcE1qN",
-	"CozjT0Gh7qcs+DSv3VS/gprRT2A+BxUXHpAhmkfxVEqCqunQEF2tfyWDfJSZOnbsMWQgU0lWrItYonsI",
-	"5bhSYgzpBKXlKcYqiv++QuKdC4e3ywK1PCu4CyB5od5880cycYUYnBcVL0TErk+ldh6Vpkj2My93UUko",
-	"SSme0GBy8r+j1mn7ElyfXoPru6NOuwkuWk/gqHPVvFCvB2RA3Jv25dFpw+gZ9KjVOO6M6k9nY/Rxvg9N",
-	"p/s0PYCnp23nHDqifv5afi8clS/27Pao7b+fCu/+9QANSOfWOr472H+F/Zp3f1xzT7rnFW+MCLotGH33",
-	"7e1mfDm74fZjmd48Tlsfd71hqXnZbY6ap9b4sX5THpCP5zFrG012UrwpT9nF0IG+ad/t4XtIGsfcLdWf",
-	"Wm98WGvcVQ5Mcce6lZsn88E6vN17xNej+/rtgFwcvfaLlcn90ZXZ7fGnymEHNsl+2ytdTbx6u0ULbdS6",
-	"fyq9uc2r6wa8KA7Pzyr+yKo2fTTme/3egExvHvqo2Xn3nzv7V91HenV9MZ10b0bvQ6v0eFyf+M/FC/Fa",
-	"MC7Pyu/QL767vOEfnp17aDy5ur59dwZk9iZeZ88jRu8xOpl502drcjMVhHTrBavX8gvn9332VKyV3dZd",
-	"/6BpDA+qY+PspH8y6o4dMj4tDEhxdFdt3MJasXpWeX8tjsUQVSYXxvUjvb7yL47u+VlvUizenT41ZtfI",
-	"n+3VD4y7wlPL7h6MK737i9cB2UftZ2uGu1fFqVN6Oj2+vTB8Zzrmh4093xlbJdofVnnlw32eXBcPTmn/",
-	"/aFafoUXtYfe3qX9jNCA1PeLj/TeHhqlC6+39zp6pq+ctcRz/Xp497z3NDmp33rMfGiw17Ph+bh87t1e",
-	"NN779ju/afAj+7Q0IMWO/15+gN2jolVu166NrnleMN5eabFuGOz16NHH7w8M17B/2H306m/9wqj3cely",
-	"s22ReuHt+WJAcP3Gd0b+wYH/Zj8UpqI8FAQL65a/vdrvXf/16a76PKzaY3FSty/uCo+PB9Xym92pXUwb",
-	"t42bxtGAiOOT0+eH24nhtqyL427poteoP7v342Hl3O70u6XO49EMPpRsgziN8Llxdj6B7v2r2axNBsRw",
-	"jT18c351dNQ9ajYa1RPcaqGzfZfZJ2cH/j2/6XS75eJTzXi2yftT/aThqjPUPJ3WT5rTcXtAjqbt05Mb",
-	"et5s8ObR0VOzMW01z6xW86TaaDSt8c28997lU6NwcPTkWc6s13h+OrNfZxf2gBT2Rvsf16P7yfCsXGy9",
-	"Vcbtg6uTo8si6TzuHd2VXH/S23vr+73KQ4cdVdzKqe8I7+K2dX7REW6tdTwgJXb68dig/dLMO3xq1zuN",
-	"Y7PbbF7NXhuvnD7c1Q+e7vzmXmFIXlkf3ZY7t1fN0ey6ebD/cFiv4av7AXFrvb0hvzmeHjTLHeaYjW61",
-	"e+zT2XOph8UpfK5e3HTuxV6/BUtVzJ96p83XD3pw/VS/r5xfjWvFAbHeHqx6+bIwdMutj95Bv155aB0P",
-	"S87ktdp2Ju9W++0CWaXSx+PTu8uees/n583R5GO051z29v1362xAXt8L58WZ81zu4OEp2z9tNGZXh3cP",
-	"rPHcm/a6xZbx2q9PW03yPu4d+7M392F6P7k8evRb7fv6Fao8DUgX35VG55d1bh4ce/zkvdbdezRJl9z0",
-	"9s7Ya//64rjiPjCnYZJW3zaf7uuvz2PvwT6e8Urh8BBdDYg9LrIOmRVfL6dj6I8K+K5+Zew/Trrj185t",
-	"99yq3R3eX8zO/YcH8TF9JK/dy9rD7cnR20WVP1O32x2QkRj2z0p7tdnw9qHQqEyOhvD99qEsDu4+Ll+N",
-	"DzTuPbcw7FwedgpnxnmzfVu6Oanv18vHZsNpnRyaAzIuWzf4qXfTgPC8eH7e+Dib3I5vzzsd66L8dPOE",
-	"zy7vZ2VROZ+djDiDbm3aaz5cjexr1J51jvrP5wMyYd6lcz1EI94/rB30R+Wjy7ZvfTyzZu3+/bh3MX62",
-	"bu3S/emk174hzdnH+Ga237orv117+KF2KHmUfd1+fGYX1LioXHR6hwX8cX7Tv3XEa7fxx4D8cT3qHwyI",
-	"ki6ty+N1omdFSTVl6IVzJ11I/740I+3WOFUdmho4kXp60AjoElLlH4npJpBLtYIDpWvHUvZUZeqAfPaw",
-	"hxxM0JfUKtWlpK3wriC6YyX2r3WJJL0eYIXTY8tand62ueq/IOccDGfhReTxePp8l4U3MJjpW5O0dZfS",
-	"L0lG34gNGQmlBO+ITCqVF8qGF4x/Q+CJLvkLVOXkhfrIYEjk5KvYofEg51PKUkklLYeXVBNk2QLZ4iBi",
-	"wrFlL3xAYFV1E2UWJLECkHhMsFqslKvpPsMtLra/ClLkwMiBVpgCz2xD/hlG42Nla2HWOnQ4DW4PCFae",
-	"g3Ywo4UTvmpOyTq++J1y82XNy0MeI+xGui7Y0Qm6ZRf3RAKH2ALHFifN/u7HSs53iL6E3TbEX4jwNFZr",
-	"YiVEeCBslOClxTyhTNg56CKGDZj3KHXyRHhSomSymdK61zsx33jZ/erYe9gqG/IExSnu+s2E2XnXK7Sg",
-	"3Gdkuyj8steKzLa+/3kx72pjn8XvS2zqslQls3GM5Y8SbOqy4rq/Td1SArWbuixFuTZ1WOVc/P4tnfOE",
-	"+oX+EMJyUpqqBsE8vLGdIejo2zdUcSEY+gIsL5LO8VORQXleBiRl7XUcF7gIkiB6BR0HpDQEeufxAYEM",
-	"acan9YelcWHUNuCSE0zVnXvaCyYRHhDmO0jfLsLQiDKUBVMEbDiJ6o/UbgaqdEbObogAnMKwTFZ9g4B8",
-	"EgPiUc5xEFZ28bsKnrhQGLZ2xwXrAQS1lNYjmXJ0dlY5KGO5i7vcqb6QPrb1kdqyx2L++w4Hasse6VdE",
-	"bn02tmy/wk2sKod3z/eLMga3Se4NMih1du+qe2uDWEK4Cb4tbJcdM/yYT8iqNL5EQufSLtx5Qj+Ze5se",
-	"UlkA+W2lIFqdjpjnlSgPMMw6jOf0UQPnA4ah68gkAX3HywfZ16mkC8q0d6mdiG5QS9HH1cvSNrdoLmnR",
-	"nNs5ZJZrtdIhaDQajWbl8gM2S87zcbt02W/V5LP2JTu9aLHuE97rdu+m/hm8bZy7tx3a/rgdld+Oy+Zx",
-	"7aN41H8v7L+vy++LJ5ggVvrRSgyldho+w2LWk5tBE+gIQaapOlR/nYQq5vlDP/zgmlJedbsIqtT99WfX",
-	"MBnRtIQZXUImaGACq7QgndmiM815XqVuGij45kTwpbeGBw0bgbJK9FMKcuSwmE6neaheKy9B0JcXOu1m",
-	"67LXypXzxbwtXEcraUKR7Kp3pIYPcpUZULWSAHo4FjP8mimHF6zJF18zlXwxX8roqwYUmQqGQwnihT+x",
-	"+V3tq7Rq3lOkY3Kaq6i6XhCwAkCZSqZykAivrtXXOsMwxyoU9vrO+pjJTpnKpZpn6KuCHGm3KyaETGTm",
-	"47e8tE2NSvzrF9nEdwP/mf7NmKBOQCMvKLBUPbH6Gp8K/0Uf4wsu1A53nDZy5p/m++UfqfimPtCiPk6i",
-	"FqNcLMayeYIsXCcIKBVeg0ty5gitFX8xKqntnKRMnCZyi1R/4dBBxvzyoG2ilaww+w6beujSXz90w1e3",
-	"aIyR8gphjYgevfLXj35HoC9syvCH9kR5iMm9AaK9rTGp/h2YjAmdkoUlqP0dq39H0LunkkSAqsIA1FAX",
-	"WJoJFq5Occi8//lNnhHuuy5ks6BeJs6EFPOK9pOCUzDm38X0aNr93k1dSAgBQdOwaxZ4VE4dK0vEoIQH",
-	"lxYoh9gEMRgyd8XvA5NGfQBUp79jFjdw+DLjuqZchJ8o0kwGcRF+7OjXnPjkZzq+J8WnZGbfl/hN6VeP",
-	"3jbTlj54CWzI5foxgcx/G9Nh8290/OY8vznPlpwnYBppnOZXKU876EshDTcoSokPxWylKkWA/x9TlhKU",
-	"StlBSbr8Vph+s63/UIVpJf/ShmBca0rRX+LfWdyKn8SY1f8hLvIX6F6LX7D8u7WvtO9dpmwpdS8Wms6v",
-	"YhkiVfmhP9CTztcEehcFdUlkEp+UL9Vvx72qv2qAtLP5PSG1JVkSl5CtOQBOUGj4I1J8hAnmdkyIg7Uy",
-	"HIu56NaFZSoE4SIBASZ6D2NKABxSX4SfB/YdsU7MqzrJ30J+o5APvo+ZejTkFojuitPRq8hAxAQQqm/E",
-	"N3wHsuByLPBZ2NS37CB+dN67uvyS/687SKfqIjQrDOyFuzztGCW+9bn2LEUttzhOt+rz91zluUef5JLI",
-	"KBs8YGck/i314K6MqLFB1cGK6tWD5QvvCoECxN2xwee1dNYYJOHntnIhuHxtzVGcf0P193nceB7nxFpx",
-	"KBPLvXQw/zvPWvJ4bHHoYvVS689cVJ8pj9zSOdPXNKJ3aIiEIGLq+CETmEhf/0ATZy1y/atLdtadjBDP",
-	"3wdj88GIPtO74lyES7nLufhtpP42Uv+vGalLvCmN3yngcZ1iicXMv/WwxFzSZjZvUlCXY6zK9Ii1U7dn",
-	"/KVHfz6HtN2uP/5NRyAgxu9j9u85Znqj/+cdMhhtIOg4IEo2C3fT/Jht9mhDopMeiBElhmrM5tdYD2dA",
-	"ic70g7q9/wgFzX9K6lf+Zhm+cinVCxB/9vsU/z7Fu5xitLyD5MmNknxWS8iroMlP7vvF/KuliQaoKF4g",
-	"rXIJIvwQyn+gXrJ2Ot+jqoc0LtYN7uOmpm/oS+SjK9GSKWDQw3n1HUwbj3S5CfSw/kJ9TnkeEMuFHwMo",
-	"TMpKW1lITBPQwsRaNwAX0EI/OUzwzdHgvvBomE1wvn3//wMAAP//WK0jTPGVAAA=",
+	"SoYUMuWkUtpt6Jxc9IC9uCPrRZP7RSLx4kLjRbKqFeuKffLi+cOXMZq92JDbm1thwpHhsy3gyb3/YiAm",
+	"0pU2FxJf8lBfIStFEmIvKzPHlja/sl12I2hPGUtA9gSSXQGOhEqqWWTgkRtpE+eWDYNUvQXYmVRP8fIs",
+	"sIPWCCJpFf6IDArDostubrmrQ1amoEMOPAdKyOg9NYT5F8qzDa717cRbOAslyQKRFom4f4tkUxitFWr7",
+	"1eqPCTUJOk2eBc9/RKDN6eeH9IuE2t8ny04S/o+FbANMXtKT+OXT+DyCU4gJGM4E4nH0y6XqQbVe2a/W",
+	"k4kJPiZiv6oYUmTwJN2mhQlkG/3xsc7ZOcLpM01zouwoGgIYmwSCR5lY45ZRr8FnaW1RJgCDxEL8izKR",
+	"PEYFNaijnDbSoI/T8p+ZcvmrMCTrrBeDP7ALPfXnbgn1MUvkh+YfAlBhQsWP5RY2MZd/pghIHuPtaSSJ",
+	"w5tDic1cIIcgsdssExJl06i6cXLQkZAkJsLbsUpjYfOlSaDT5vXPxCOHvjFGYrWvCxLN7SV/7PUbl8eN",
+	"22PQE5RBCwHDgZyDIwUiv5j8HPzIBSOsTAtJdwNKI5ukBKsjj7Xc5Kr8wgRN6nq+QKBFLEwC93R+QPpR",
+	"JqoCtJAbPsXCDuTxafMaBKGcbODPwVx5HpJ+BQUryN6fe8/zoD1KZjFHSeMD8snQOQAsBz2cG/jFYsXw",
+	"fWyqv9CnUPIEw0k2LhJY75JUPq8YWCalnKJ+H0vTjeYUesfi4YAYfUeMugE9VRVGREoof2NTQQ9zuvOg",
+	"hxCIoo8O9c28RakVxPi53joqtbcQpYYH2fjJVHAV7fUdgXMB5lHauOFQjrgIhaqO2Q/I5yBjO9yeemNG",
+	"3b5IMhs25YgA6AvqQoEN6DizRSIjf4e6pHSGENBFzRuEzSW+CkpyJ6dtX7U98wPSgoYdbhJF9SCuBWBE",
+	"qUgRCIZR3uQ8uFcYaOWFA8jQ1wEBIAc+SeXg65/IhdjB5vdPX0GDAPULQNNkiHOt+jHkMcSVuhmNZUgQ",
+	"YGFaeXBCGQiolwWfoIMN9L+xvI5P+WDkgEs2dL8dcdBDByBWje3Ocsp/l4Oe97/Q87hHRd4KOoV94igp",
+	"TXNXagTzDwsQJF4LJDBdTHgqDUzqQky+/qn/lQOq4wl6PhYI6Kfgs8ewC9nsy/LgjqMHVBkKHLHAGIAi",
+	"6LtIkfnR+yQF66cFnNJP3fqtGRZtaOYgNyqAZDYgIX0HC7qG2nBLuyITKQ/hfth28TKBXfF1mcyZbCYg",
+	"cPzhX1IZGcndX5ekr2SzhP+ymIQNuYGICYnIDRnEZq5SrNRKlY1KbQxcdlPO/2loqu2gPFhpdSHauJOm",
+	"iGZL2pibG8GfqafBf5njH8sc2Fz3tQBwIxVWTrkdCxTuoLyG3Tbo7irpzdRa4zZhyFbYXgd0uRhKe23L",
+	"zidRh1QlcWmMnZMpRtjaxiGo2q2j9Ul8ZjugkJqudc3oBHMdJwR3t52tsq5SsYsnC++GGGSGjQUyROBT",
+	"mx/aKN9nheKrH2+RkNufeTqGo7PbN4Zle33ZSk09Gbj7FaGnyI4PfEjFJS9dYNOrSWYjWz4PHmxEwqLa",
+	"YrxOTHbAUrC6mGDXdwfERCNMkAmGs1g7pdckhUu1fFg93D8oH+6vcgpodf2FeluluyctqXn3oFY3XbeW",
+	"Yyp1ORhE2SpKcfUctFjtC5RGJxcC6EnyAYGAIw8yyRyD1iaSFpdWdpWAxYIDOiXhEHnQDeAPiIlHKiIg",
+	"wjGkFTFFjiP/jdAI3wU8VFUmjzExpWY4INz3tMTfIUSpadVXcDcK0sQpSRyAhV36LTyNq8QqCoMmW2eS",
+	"R77/nTPpgxz0aBtsByBZqLXQeYeDuAhnLYHDTPgk+XZKOs9mVKRb/6mR1n+HNcRBZvoSO4sxqdhQcCqH",
+	"gVOes2GO2T4OfsX+5NCLfn5oZHQ5MYLeQeJN8kesn0qqiep3gl9hHl/wIEq0kZqjcnZZRgTAkjw/0sjU",
+	"v4kOmIo5fP1jDl7+XmzM4DQC5+BJEho15JgT7kkjfP5Xjk5gJpuZcieVwBdRws8ugsmTC5sSnFDPpUlo",
+	"+S4KzFKV50CpUCnPDOgMI1UXJRmbg0nSlUwod8UfI8oMtC5pdLUOFwygnTsJ0PpNzkRD39ou9/wiqOT5",
+	"gSz8+bAnOmG36VDfzB1BvsLDolJskz3LxXKxeFg8yBdTvQYqLpaeTDymrzglk1g+tv3hNjnYkI8XbYVq",
+	"OU2rniDGlwq2KpvvkQjQnw8VLO4c4pwq31asTVjMuWgeSYkTFN4QVay3FI4l+tDplqvArxIUipltQ520",
+	"PRWGqJMgpcBMT4YO7jtKSYQO9KXlN4IK6KS9WqCCGjQbXZSk7yfSnbMrI9ZZdZGE8zOeYZU1+MLhBG2O",
+	"GfZtzCMnJpaWkTtM6C/a3Xh01+4cv3Sumo1Or3HfAohMMKNEV+wPyAQyrCMA2i+rN18sMsDhRGr6ur5I",
+	"SXjl3HOcWR5IFNQtMFL7MtEEOdSTgJX3mBJnltU+W+28mKeCaRbEVtzDsrAWMZqspDna0ZzUnTYYk2M0",
+	"UwkEy1y1J7U6zVJ1E+DAGfWTAUs/tXrMgcTy06tbQz+mTh1VImIYJb2GbiJlpeqLUZBBXcRB4LfKqusq",
+	"pDlF1HvlfwQcGZSYMCjIiTmIEHm56+Xv+ie5+s/FR7KZq2Z7tz2/GsJfcjlOYJt9/TOlXAERkWrlNtSV",
+	"QyoukQVY3UuUjQ6b3O0jJAxbHowASh60Xc/BKPBd/stnzr9kB2l7BbZBdkB0oCNRYaAMl6AYWZ2ZfHrt",
+	"lE4JSElQgETCQljlUMKgrhp8Dtb6KyiW94vVYdmE++iwVh2aleqwPqyXYb1SQzV4cGCWh/vF0Qh+yepA",
+	"9pBBYtg5B48RYFGJ4Rwes5Ezr1+Syt6XBV/+cot0wT5armXeopvN3c3M8RgJxFxp6oGpjQLS6ABB4lYX",
+	"FxJoIQY+G5CYDvIw+QKwiYjAYqZvnNL7CwiqnK3aOa1ehBZ7HjQp4b6LGDDk5lJlkIt1JJADw8HyaCbb",
+	"2IgMSLSXon0guWa4sVbcVbV91s9iDtvSQbCDpVj2maRL3hUiOa0yNxCkaoTUsxmmsy8h5TE6wg5alS8n",
+	"IHao+rFlwnw/6pDisQ1HWodiPz5iEleucuC1i2/7CLdPfqRf2gov3mmwfM8dM9LT1JBHV7xZWYQWU8iX",
+	"NW9suWZt1SsCxaokuNAvt/QipkRvuANIOzZWaspZTYQIR2m1X/uOp6XDT4XzIUfpWUhHwRutH0V3GATq",
+	"1JyFpLPHeBXqYuV3+E4qCVpX15fdKWdlKAMEXW0dvQShNgl8vcmzQOdotmlnZZGgq+S5qkndSqhHLdOG",
+	"u92ORgk1Lz8gDQHkntBqVGAcfwoqez9lwad5saf6FRSZfgLzOai48IAM0TyKp1ISVBGIhuhq/SsZ5KPM",
+	"1LFjjyEDmUqyYl31El1cKMeVEmNIJygtTzFWgvz3VR7vXGm8XRao5VnB5QHJG/jmmz+SiSvE4LwKeSEi",
+	"dn0qtfOolkWyn3l9jEpCSUrxhAaTk/8dtU7bl+D69Bpc3x112k1w0XoCR52r5oV6PSAD4t60L49OG0bP",
+	"oEetxnFnVH86G6OP831oOt2n6QE8PW0759AR9fPX8nvhqHyxZ7dHbf/9VHj3rwdoQDq31vHdwf4r7Ne8",
+	"++Oae9I9r3hjRNBtwei7b28348vZDbcfy/Tmcdr6uOsNS83LbnPUPLXGj/Wb8oB8PI9Z22iyk+JNecou",
+	"hg70TftuD99D0jjmbqn+1Hrjw1rjrnJgijvWrdw8mQ/W4e3eI74e3ddvB+Ti6LVfrEzuj67Mbo8/VQ47",
+	"sEn2217pauLV2y1aaKPW/VPpzW1eXTfgRXF4flbxR1a16aMx3+v3BmR689BHzc67/9zZv+o+0qvri+mk",
+	"ezN6H1qlx+P6xH8uXojXgnF5Vn6HfvHd5Q3/8OzcQ+PJ1fXtuzMgszfxOnseMXqP0cnMmz5bk5upIKRb",
+	"L1i9ll84v++zp2Kt7Lbu+gdNY3hQHRtnJ/2TUXfskPFpYUCKo7tq4xbWitWzyvtrcSyGqDK5MK4f6fWV",
+	"f3F0z896k2Lx7vSpMbtG/myvfmDcFZ5advdgXOndX7wOyD5qP1sz3L0qTp3S0+nx7YXhO9MxP2zs+c7Y",
+	"KtH+sMorH+7z5Lp4cEr77w/V8iu8qD309i7tZ4QGpL5ffKT39tAoXXi9vdfRM33lrCWe69fDu+e9p8lJ",
+	"/dZj5kODvZ4Nz8flc+/2ovHet9/5TYMf2aelASl2/PfyA+weFa1yu3ZtdM3zgvH2Sot1w2CvR48+fn9g",
+	"uIb9w+6jV3/rF0a9j0uXm22L1AtvzxcDgus3vjPyDw78N/uhMBXloSBYWLf87dV+7/qvT3fV52HVHouT",
+	"un1xV3h8PKiW3+xO7WLauG3cNI4GRByfnD4/3E4Mt2VdHHdLF71G/dm9Hw8r53an3y11Ho9m8KFkG8Rp",
+	"hM+Ns/MJdO9fzWZtMiCGa+zhm/Oro6PuUbPRqJ7gVgud7bvMPjk78O/5TafbLRefasazTd6f6icNV52h",
+	"5um0ftKcjtsDcjRtn57c0PNmgzePjp6ajWmreWa1mifVRqNpjW/mvfcunxqFg6Mnz3Jmvcbz05n9Oruw",
+	"B6SwN9r/uB7dT4Zn5WLrrTJuH1ydHF0WSedx7+iu5PqT3t5b3+9VHjrsqOJWTn1HeBe3rfOLjnBrreMB",
+	"KbHTj8cG7Zdm3uFTu95pHJvdZvNq9tp45fThrn7wdOc39wpD8sr66Lbcub1qjmbXzYP9h8N6DV/dD4hb",
+	"6+0N+c3x9KBZ7jDHbHSr3WOfzp5LPSxO4XP14qZzL/b6LViqYv7UO22+ftCD66f6feX8alwrDoj19mDV",
+	"y5eFoVtuffQO+vXKQ+t4WHImr9W2M3m32m8XyCqVPh6f3l321Hs+P2+OJh+jPeeyt++/W2cD8vpeOC/O",
+	"nOdyBw9P2f5pozG7Orx7YI3n3rTXLbaM13592mqS93Hv2J+9uQ/T+8nl0aPfat/Xr1DlaUC6+K40Or+s",
+	"c/Pg2OMn77Xu3qNJuuSmt3fGXvvXF8cV94E5DZO0+rb5dF9/fR57D/bxjFcKh4foakDscZF1yKz4ejkd",
+	"Q39UwHf1K2P/cdIdv3Zuu+dW7e7w/mJ27j88iI/pI3ntXtYebk+O3i6q/Jm63e6AjMSwf1baq82Gtw+F",
+	"RmVyNITvtw9lcXD3cflqfKBx77mFYefysFM4M86b7dvSzUl9v14+NhtO6+TQHJBx2brBT72bBoTnxfPz",
+	"xsfZ5HZ8e97pWBflp5snfHZ5PyuLyvnsZMQZdGvTXvPhamRfo/asc9R/Ph+QCfMuneshGvH+Ye2gPyof",
+	"XbZ96+OZNWv378e9i/GzdWuX7k8nvfYNac4+xjez/dZd+e3aww+1Q8mj7Ov24zO7oMZF5aLTOyzgj/Ob",
+	"/q0jXruNPwbkj+tR/2BAlHRpXR6vEz0rarApQy+cO+lC+vctG2nXzKly0tTAidTTg0ZA15wq/0hMN4Fc",
+	"qhUcKF07lrKnSlkH5LOHPeRggr6klrUuJW2FlwvRHUu3f61LJOn1ACucHlvW6vS2zVX/BTnnYDgLby6P",
+	"x9Pnuyy8ssFM35qkrbuUfkky+kZsyEgoJXhHZFKpvFBnvGD8GwJPdI1goConb+BHBkMiJ1/FDo0HOZ9S",
+	"lkoqaTm8pJogyxbIFgcRE44te+GLA6uqmyizIIkVgMRjgtVipVxN9xlucRP+VZAiB0YOtMIUeGYb8s8w",
+	"Gh8rWwuz1qHDaXDdQLDyHLSDGS2c8FVzStbxxS+hmy9rXh7yGGE30nXBjk7QLbu4JxI4xBY4tjhp9nc/",
+	"VqO+Q/Ql7LYh/kKEp7FaEyshwgNhowQvLeYJZcLOQRcxbMC8R6mTJ8KTEiWTzZTWvd6J+cbr9FfH3sNW",
+	"2ZAnKE5x128mzM67XqEF5T4j20Xhl71WZLb1hdGLeVcb+yx+kGJTl6UqmY1jLH/FYFOXFfcDbuqWEqjd",
+	"1GUpyrWpwyrn4vdv6Zwn1C/0lxOWk9JUNQjm4RXvDEFHX9ehigvB0BdgeZF0jp+KDMrzMiApa6/juMBF",
+	"kATRK+g4IKUh0DuPDwhkSDM+rT8sjQujtgGXnGCqLunTXjCJ8IAw30H6OhKGRpShLJgiYMNJVH+kdjNQ",
+	"pTNydkME4BSGZbLqowXkkxgQj3KOg7Cyi99V8MSFwrC1Oy5YDyCopbQeyZSjs7PKQRnLXdzlEvaF9LGt",
+	"j9SWPRbz33c4UFv2SL9TcuuzsWX7FW5iVTm8e75flDG4TXJvkEGps3tXXXQbxBLCTfBtYbvsmOHHfEJW",
+	"pfElEjqXduHOE/rJ3Nv0kMoCyG8rBdHqdMQ8r0R5gGHWYTynjxo4HzAMXUcmCeg7Xj7Ivk4lXVCmvUvt",
+	"RHTlWoo+rl6Wtrl2c0mL5tzOIbNcq5UOQaPRaDQrlx+wWXKej9uly36rJp+1L9npRYt1n/Bet3s39c/g",
+	"bePcve3Q9sftqPx2XDaPax/Fo/57Yf99XX5fPMEEsdKPVmIotdPwGRazntwMmkBHCDJN1aH66yRUMc8f",
+	"+uEX2pTyqttFUKXur7/ThsmIpiXM6BIyQQMTWKUF6cwWnWnO8yp100DBRyqCT8M1PGjYCJRVop9SkCOH",
+	"xXQ6zUP1WnkJgr680Gk3W5e9Vq6cL+Zt4TpaSROKZFe9IzV8kKvMgKqVBNDDsZjh10w5vJFNvviaqeSL",
+	"+VJGXzWgyFQwHEoQL/yJze9qX6VV854iHZPTXEXV9YKAFQDKVDKVg0R4162+BxqGOVahsNeX3MdMdspU",
+	"LtU8Q18V5Ei7XTEhZCIzH78Wpm1qVOKfy8gmPjT4z/SPzAR1Ahp5QYGl6onV5/tU+C/6el9wA3e447SR",
+	"M/+W3y//qsU39UUX9TUTtRjlYjGWzRNk4TpBQKnwGtyqM0dorfiLUUlt5yRl4jSRW6T6C4cOMuaXB20T",
+	"rWSF2XfY1EOX/vqhG766RWOMlFcIa0T06JW/fvQ7An1hU4Y/tCfKQ0zuDRDtbY1J9e/AZEzolCwsQe3v",
+	"WP07gt49lSQCVBUGoIa68dJMsHB1ikPm/c9v8oxw33UhmwX1MnEmpJhXtJ8UnIIx/5CmR9MuBG/qQkII",
+	"CJqGXbPAo3LqWFkiBiU8uLRAOcQmiMGQuSt+H5g06ouhOv0ds7iBw5cZ1zXlIvymkWYyiIvw60i/5sQn",
+	"v+vxPSk+JTP7vsRvSr969LaZtvTBS2BDLtePCWT+25gOm3/U4zfn+c15tuQ8AdNI4zS/SnnaQV8KabhB",
+	"UUp8WWYrVSkC/P+YspSgVMoOStLlt8L0m239hypMK/mXNgTjWlOK/hL/MONW/CTGrP4PcZG/QPda/OTl",
+	"3619pX0gM2VLqXux0HR+FcsQqcoP/UWfdL4m0LsoqEsik/ikfNp+O+5V/VUDpJ3N7wmpLcmSuIRszQFw",
+	"gkLDH5HiI0wwt2NCHKyV4VjMRbcuLFMhCBcJCDDRexhTAuCQ+iL8nrDviHViXtVJ/hbyG4V88EHN1KMh",
+	"t0B0V5yOXkUGIiaAUH2FvuE7kAWXY4HPwqa+ZQfxo/Pe1eWX/H/dQTpVF6FZYWAv3OVpxyjxcdC1Zylq",
+	"ucVxulXfy+cqzz36hpdERtngATsj8Y+vB3dlRI0Nqg5WVK8eLF94VwgUIO6ODb7HpbPGIAm/z5ULweVr",
+	"a47i/KOrv8/jxvM4J9aKQ5lY7qWD+d951pLHY4tDF6uXWn/movpMeeSWzpm+phG9Q0MkBBFTxw+ZwET6",
+	"+geaOGuR619dsrPuZIR4/j4Ymw9G9F3fFeciXMpdzsVvI/W3kfp/zUhd4k1p/E4Bj+sUSyxm/nGIJeaS",
+	"NrN5k4K6HGNVpkesnbo94y89+vM5pO12/bVwOgIBMX4fs3/PMdMb/T/vkMFoA0HHAVGyWbib5sdss0cb",
+	"Ep30QIwoMVRjNr/GejgDSnSmH9Tt/UcoaP5TUr/yN8vwlUupXoD4s9+n+Pcp3uUUo+UdJE9ulOSzWkJe",
+	"BU1+ct8v5l8tTTRARfECaZVLEOGHUP4D9ZK10/keVT2kcbFucB83NX1DXyIfXYmWTAGDHs6rD2faeKTL",
+	"TaCH9Sftc8rzgFgu/BhAYVJW2spCYpqAFibWugG4gBb6yWGCj5QG94VHw2yC8+37/x8AAP//GqcAuSKW",
+	"AAA=",
 }
 
 // GetSwagger returns the content of the embedded swagger specification file
diff --git a/internal/cloudapi/v2/openapi.v2.yml b/internal/cloudapi/v2/openapi.v2.yml
index 600d24278..e353b0334 100644
--- a/internal/cloudapi/v2/openapi.v2.yml
+++ b/internal/cloudapi/v2/openapi.v2.yml
@@ -1509,6 +1509,8 @@ components:
           type: string
         diun_pub_key_root_certs:
           type: string
+        di_mfg_string_type_mac_iface:
+          type: string
     FIPS:
       type: object
       additionalProperties: false
diff --git a/internal/jobqueue/fsjobqueue/fsjobqueue.go b/internal/jobqueue/fsjobqueue/fsjobqueue.go
index 69b7ca8ea..348c2e723 100644
--- a/internal/jobqueue/fsjobqueue/fsjobqueue.go
+++ b/internal/jobqueue/fsjobqueue/fsjobqueue.go
@@ -493,18 +493,21 @@ func (q *fsJobQueue) UpdateWorkerStatus(wID uuid.UUID) error {
 	return nil
 }
 
-func (q *fsJobQueue) Workers(olderThan time.Duration) ([]uuid.UUID, error) {
+func (q *fsJobQueue) Workers(olderThan time.Duration) ([]jobqueue.Worker, error) {
 	q.mu.Lock()
 	defer q.mu.Unlock()
 
 	now := time.Now()
-	wIDs := []uuid.UUID{}
-	for wID, worker := range q.workers {
-		if now.Sub(worker.Heartbeat) > olderThan {
-			wIDs = append(wIDs, wID)
+	workers := []jobqueue.Worker{}
+	for wID, w := range q.workers {
+		if now.Sub(w.Heartbeat) > olderThan {
+			workers = append(workers, jobqueue.Worker{
+				ID:   wID,
+				Arch: w.Arch,
+			})
 		}
 	}
-	return wIDs, nil
+	return workers, nil
 }
 
 func (q *fsJobQueue) DeleteWorker(wID uuid.UUID) error {
diff --git a/internal/store/fixtures.go b/internal/store/fixtures.go
index 59f76687c..e71783ff1 100644
--- a/internal/store/fixtures.go
+++ b/internal/store/fixtures.go
@@ -79,6 +79,7 @@ func FixtureBase() *Store {
 		}}
 
 	s.blueprints[bName] = b
+
 	s.composes = map[uuid.UUID]Compose{
 		uuid.MustParse("30000000-0000-0000-0000-000000000000"): {
 			Blueprint: &b,
@@ -309,6 +310,18 @@ func FixtureEmpty() *Store {
 	b3.Distro = "fedora-1"
 	s.blueprints[b3.Name] = b3
 
+	// Bad arch blueprint
+	b4 := b
+	b4.Name = "test-badarch"
+	b4.Arch = "badarch"
+	s.blueprints[b4.Name] = b4
+
+	// Cross arch blueprint
+	b5 := b
+	b5.Name = "test-crossarch"
+	b5.Arch = test_distro.TestArch2Name
+	s.blueprints[b5.Name] = b5
+
 	return s
 }
 
diff --git a/internal/weldr/api.go b/internal/weldr/api.go
index 379a7dbfd..0057dc12f 100644
--- a/internal/weldr/api.go
+++ b/internal/weldr/api.go
@@ -52,7 +52,7 @@ type API struct {
 	workers *worker.Server
 
 	solver       *dnfjson.BaseSolver
-	archName     string
+	hostArch     string
 	repoRegistry *reporegistry.RepoRegistry
 
 	logger *log.Logger
@@ -63,7 +63,6 @@ type API struct {
 
 	hostDistroName string                   // Name of the host distro
 	distroRegistry *distroregistry.Registry // Available distros
-	distros        []string                 // Supported distro names
 
 	//  List of ImageType names, which should not be exposed by the API
 	distrosImageTypeDenylist map[string][]string
@@ -97,7 +96,7 @@ func (cs ComposeState) ToString() string {
 // systemRepoNames returns a list of the system repos
 // NOTE: The system repos have no concept of id vs. name so the id is returned
 func (api *API) systemRepoNames() (names []string) {
-	repos, err := api.repoRegistry.ReposByArchName(api.hostDistroName, api.archName, false)
+	repos, err := api.repoRegistry.ReposByArchName(api.hostDistroName, api.hostArch, false)
 	if err == nil {
 		for _, repo := range repos {
 			names = append(names, repo.Name)
@@ -107,14 +106,16 @@ func (api *API) systemRepoNames() (names []string) {
 }
 
 // validDistros returns a list of distributions that also have repositories
-func validDistros(rr *reporegistry.RepoRegistry, dr *distroregistry.Registry, arch string, logger *log.Logger) []string {
+func (api *API) validDistros(arch string) []string {
 	distros := []string{}
-	for _, d := range dr.List() {
-		_, found := rr.DistroHasRepos(d, arch)
+	for _, d := range api.distroRegistry.List() {
+		_, found := api.repoRegistry.DistroHasRepos(d, arch)
 		if found {
 			distros = append(distros, d)
 		} else {
-			logger.Printf("Distro %s has no repositories, skipping.", d)
+			if api.logger != nil {
+				api.logger.Printf("Distro %s has no repositories, skipping.", d)
+			}
 		}
 	}
 
@@ -136,13 +137,12 @@ func NewTestAPI(solver *dnfjson.BaseSolver, arch distro.Arch, dr *distroregistry
 		store:                    store,
 		workers:                  workers,
 		solver:                   solver,
-		archName:                 arch.Name(),
+		hostArch:                 arch.Name(),
 		repoRegistry:             rr,
 		logger:                   logger,
 		compatOutputDir:          compatOutputDir,
 		hostDistroName:           hostDistro.Name(),
 		distroRegistry:           dr,
-		distros:                  validDistros(rr, dr, arch.Name(), logger),
 		distrosImageTypeDenylist: distrosImageTypeDenylist,
 	}
 	return setupRouter(api)
@@ -158,7 +158,7 @@ func New(repoPaths []string, stateDir string, solver *dnfjson.BaseSolver, dr *di
 	if err != nil {
 		return nil, fmt.Errorf("failed to read host distro information")
 	}
-	archName := common.CurrentArch()
+	hostArch := common.CurrentArch()
 
 	rr, err := reporegistry.New(repoPaths)
 	if err != nil {
@@ -170,13 +170,13 @@ func New(repoPaths []string, stateDir string, solver *dnfjson.BaseSolver, dr *di
 		// get canonical distro name if the host distro is supported
 		hostDistroName = hostDistro.Name()
 
-		_, err = hostDistro.GetArch(archName)
+		_, err = hostDistro.GetArch(hostArch)
 		if err != nil {
 			return nil, fmt.Errorf("Host distro does not support host architecture: %v", err)
 		}
 
 		// Check if repositories for the host distro and arch were loaded
-		_, err = rr.ReposByArchName(hostDistroName, archName, false)
+		_, err = rr.ReposByArchName(hostDistroName, hostArch, false)
 		if err != nil {
 			log.Printf("loaded repository definitions don't contain any for the host distro/arch: %v", err)
 		}
@@ -192,13 +192,12 @@ func New(repoPaths []string, stateDir string, solver *dnfjson.BaseSolver, dr *di
 		store:                    store,
 		workers:                  workers,
 		solver:                   solver,
-		archName:                 archName,
+		hostArch:                 hostArch,
 		repoRegistry:             rr,
 		logger:                   logger,
 		compatOutputDir:          compatOutputDir,
 		hostDistroName:           hostDistroName,
 		distroRegistry:           dr,
-		distros:                  validDistros(rr, dr, archName, logger),
 		distrosImageTypeDenylist: distrosImageTypeDenylist,
 	}
 	return setupRouter(api), nil
@@ -308,22 +307,22 @@ func (api *API) ServeHTTP(writer http.ResponseWriter, request *http.Request) {
 // metadata.
 func (api *API) PreloadMetadata() {
 	log.Printf("Starting metadata preload goroutines")
-	for _, distro := range api.distros {
+	for _, distro := range api.validDistros(api.hostArch) {
 		go func(distro string) {
 			startTime := time.Now()
-			d := api.getDistro(distro)
+			d := api.getDistro(distro, api.hostArch)
 			if d == nil {
 				log.Printf("GetDistro - unknown distribution: %s", distro)
 				return
 			}
 
-			repos, err := api.allRepositories(distro)
+			repos, err := api.allRepositories(distro, api.hostArch)
 			if err != nil {
 				log.Printf("Error getting repositories for distro %s: %s", distro, err)
 				return
 			}
 
-			solver := api.solver.NewWithConfig(d.ModulePlatformID(), d.Releasever(), api.archName, d.Name())
+			solver := api.solver.NewWithConfig(d.ModulePlatformID(), d.Releasever(), api.hostArch, d.Name())
 			_, err = solver.Depsolve([]rpmmd.PackageSet{{Include: []string{"filesystem"}, Repositories: repos}})
 			if err != nil {
 				log.Printf("Problem preloading distro metadata for %s: %s", distro, err)
@@ -469,7 +468,7 @@ func (api *API) isImageTypeAllowed(distroName, imageType string) (bool, error) {
 // getImageType returns the ImageType for the selected distro
 // This is necessary because different distros support different image types, and the image
 // type may have a different package set than other distros.
-func (api *API) getImageType(distroName, imageType string) (distro.ImageType, error) {
+func (api *API) getImageType(distroName, imageType, archName string) (distro.ImageType, error) {
 	imgAllowed, err := api.isImageTypeAllowed(distroName, imageType)
 	if err != nil {
 		return nil, fmt.Errorf("error while checking if image type is allowed: %v", err)
@@ -478,20 +477,21 @@ func (api *API) getImageType(distroName, imageType string) (distro.ImageType, er
 		return nil, fmt.Errorf("image type %q for distro %q is denied by configuration", imageType, distroName)
 	}
 
-	distro := api.getDistro(distroName)
+	distro := api.getDistro(distroName, archName)
 	if distro == nil {
 		return nil, fmt.Errorf("GetDistro - unknown distribution: %s", distroName)
 	}
-	arch, err := distro.GetArch(api.archName)
+
+	arch, err := distro.GetArch(archName)
 	if err != nil {
 		return nil, err
 	}
 	return arch.GetImageType(imageType)
 }
 
-func (api *API) parseDistro(query url.Values) (string, error) {
+func (api *API) parseDistro(query url.Values, arch string) (string, error) {
 	if distro := query.Get("distro"); distro != "" {
-		if common.IsStringInSortedSlice(api.distros, distro) {
+		if common.IsStringInSortedSlice(api.validDistros(arch), distro) {
 			return distro, nil
 		}
 		return "", errors_package.New("Invalid distro: " + distro)
@@ -501,8 +501,8 @@ func (api *API) parseDistro(query url.Values) (string, error) {
 
 // getDistro returns the named distro or nil
 // It excludes unsupported distros by first checking the api.distros list
-func (api *API) getDistro(name string) distro.Distro {
-	if !common.IsStringInSortedSlice(api.distros, name) {
+func (api *API) getDistro(name, arch string) distro.Distro {
+	if !common.IsStringInSortedSlice(api.validDistros(arch), name) {
 		return nil
 	}
 	return api.distroRegistry.GetDistro(name)
@@ -664,7 +664,7 @@ func (api *API) getSourceConfigs(params httprouter.Params) (map[string]store.Sou
 	sources := map[string]store.SourceConfig{}
 	errors := []responseError{}
 
-	repos, err := api.repoRegistry.ReposByArchName(api.hostDistroName, api.archName, false)
+	repos, err := api.repoRegistry.ReposByArchName(api.hostDistroName, api.hostArch, false)
 	if err != nil {
 		error := responseError{
 			ID:  "InternalError",
@@ -939,7 +939,7 @@ func (api *API) sourceNewHandler(writer http.ResponseWriter, request *http.Reque
 	// If there is a list of distros, check to make sure they are valid
 	invalid := []string{}
 	for _, d := range source.SourceConfig().Distros {
-		if !common.IsStringInSortedSlice(api.distros, d) {
+		if !common.IsStringInSortedSlice(api.validDistros(api.hostArch), d) {
 			invalid = append(invalid, d)
 		}
 	}
@@ -1050,9 +1050,14 @@ func (api *API) modulesListHandler(writer http.ResponseWriter, request *http.Req
 
 	modulesParam := params.ByName("modules")
 
+	archName := api.hostArch
+	if queryArch := request.URL.Query().Get("arch"); queryArch != "" {
+		archName = queryArch
+	}
+
 	// Optional distro parameter
 	// If it is empty it will return api.hostDistroName
-	distroName, err := api.parseDistro(request.URL.Query())
+	distroName, err := api.parseDistro(request.URL.Query(), archName)
 	if err != nil {
 		errors := responseError{
 			ID:  "DistroError",
@@ -1071,7 +1076,7 @@ func (api *API) modulesListHandler(writer http.ResponseWriter, request *http.Req
 
 		names = strings.Split(modulesParam, ",")
 	}
-	packages, err := api.fetchPackageList(distroName, names)
+	packages, err := api.fetchPackageList(distroName, archName, names)
 
 	if err != nil {
 		errors := responseError{
@@ -1133,9 +1138,14 @@ func (api *API) projectsListHandler(writer http.ResponseWriter, request *http.Re
 		return
 	}
 
+	archName := api.hostArch
+	if queryArch := request.URL.Query().Get("arch"); queryArch != "" {
+		archName = queryArch
+	}
+
 	// Optional distro parameter
 	// If it is empty it will return api.hostDistroName
-	distroName, err := api.parseDistro(request.URL.Query())
+	distroName, err := api.parseDistro(request.URL.Query(), archName)
 	if err != nil {
 		errors := responseError{
 			ID:  "DistroError",
@@ -1144,7 +1154,7 @@ func (api *API) projectsListHandler(writer http.ResponseWriter, request *http.Re
 		statusResponseError(writer, http.StatusBadRequest, errors)
 		return
 	}
-	availablePackages, err := api.fetchPackageList(distroName, []string{})
+	availablePackages, err := api.fetchPackageList(distroName, archName, []string{})
 
 	if err != nil {
 		errors := responseError{
@@ -1216,9 +1226,14 @@ func (api *API) modulesInfoHandler(writer http.ResponseWriter, request *http.Req
 
 	names := strings.Split(modules, ",")
 
+	archName := api.hostArch
+	if queryArch := request.URL.Query().Get("arch"); queryArch != "" {
+		archName = queryArch
+	}
+
 	// Optional distro parameter
 	// If it is empty it will return api.hostDistroName
-	distroName, err := api.parseDistro(request.URL.Query())
+	distroName, err := api.parseDistro(request.URL.Query(), archName)
 	if err != nil {
 		errors := responseError{
 			ID:  "DistroError",
@@ -1227,7 +1242,7 @@ func (api *API) modulesInfoHandler(writer http.ResponseWriter, request *http.Req
 		statusResponseError(writer, http.StatusBadRequest, errors)
 		return
 	}
-	foundPackages, err := api.fetchPackageList(distroName, names)
+	foundPackages, err := api.fetchPackageList(distroName, archName, names)
 
 	if err != nil {
 		errors := responseError{
@@ -1250,7 +1265,7 @@ func (api *API) modulesInfoHandler(writer http.ResponseWriter, request *http.Req
 	packageInfos := foundPackages.ToPackageInfos()
 
 	if modulesRequested {
-		repos, err := api.allRepositories(distroName)
+		repos, err := api.allRepositories(distroName, archName)
 		if err != nil {
 			errors := responseError{
 				ID:  "InternalError",
@@ -1259,7 +1274,7 @@ func (api *API) modulesInfoHandler(writer http.ResponseWriter, request *http.Req
 			statusResponseError(writer, http.StatusBadRequest, errors)
 			return
 		}
-		d := api.getDistro(distroName)
+		d := api.getDistro(distroName, archName)
 		if d == nil {
 			errors := responseError{
 				ID:  "DistroError",
@@ -1269,7 +1284,7 @@ func (api *API) modulesInfoHandler(writer http.ResponseWriter, request *http.Req
 			return
 		}
 
-		solver := api.solver.NewWithConfig(d.ModulePlatformID(), d.Releasever(), api.archName, d.Name())
+		solver := api.solver.NewWithConfig(d.ModulePlatformID(), d.Releasever(), archName, d.Name())
 		for i := range packageInfos {
 			pkgName := packageInfos[i].Name
 			solved, err := solver.Depsolve([]rpmmd.PackageSet{{Include: []string{pkgName}, Repositories: repos}})
@@ -1321,9 +1336,14 @@ func (api *API) projectsDepsolveHandler(writer http.ResponseWriter, request *htt
 	projects = projects[1:]
 	names := strings.Split(projects, ",")
 
+	archName := api.hostArch
+	if queryArch := request.URL.Query().Get("arch"); queryArch != "" {
+		archName = queryArch
+	}
+
 	// Optional distro parameter
 	// If it is empty it will return api.hostDistroName
-	distroName, err := api.parseDistro(request.URL.Query())
+	distroName, err := api.parseDistro(request.URL.Query(), archName)
 	if err != nil {
 		errors := responseError{
 			ID:  "DistroError",
@@ -1333,7 +1353,7 @@ func (api *API) projectsDepsolveHandler(writer http.ResponseWriter, request *htt
 		return
 	}
 
-	d := api.getDistro(distroName)
+	d := api.getDistro(distroName, archName)
 	if d == nil {
 		errors := responseError{
 			ID:  "DistroError",
@@ -1343,7 +1363,7 @@ func (api *API) projectsDepsolveHandler(writer http.ResponseWriter, request *htt
 		return
 	}
 
-	repos, err := api.allRepositories(distroName)
+	repos, err := api.allRepositories(distroName, archName)
 	if err != nil {
 		errors := responseError{
 			ID:  "ProjectsError",
@@ -1353,7 +1373,7 @@ func (api *API) projectsDepsolveHandler(writer http.ResponseWriter, request *htt
 		return
 	}
 
-	solver := api.solver.NewWithConfig(d.ModulePlatformID(), d.Releasever(), api.archName, d.Name())
+	solver := api.solver.NewWithConfig(d.ModulePlatformID(), d.Releasever(), archName, d.Name())
 	deps, err := solver.Depsolve([]rpmmd.PackageSet{{Include: names, Repositories: repos}})
 	if err != nil {
 		errors := responseError{
@@ -2034,10 +2054,14 @@ func (api *API) blueprintsNewHandler(writer http.ResponseWriter, request *http.R
 
 	// Check the blueprint's distro to make sure it is valid
 	if len(blueprint.Distro) > 0 {
-		if !common.IsStringInSortedSlice(api.distros, blueprint.Distro) {
+		arch := blueprint.Arch
+		if arch == "" {
+			arch = api.hostArch
+		}
+		if !common.IsStringInSortedSlice(api.validDistros(arch), blueprint.Distro) {
 			errors := responseError{
 				ID:  "BlueprintsError",
-				Msg: fmt.Sprintf("'%s' is not a valid distribution", blueprint.Distro),
+				Msg: fmt.Sprintf("'%s' is not a valid distribution (architecture '%s')", blueprint.Distro, arch),
 			}
 			statusResponseError(writer, http.StatusBadRequest, errors)
 			return
@@ -2243,12 +2267,13 @@ func (api *API) blueprintsTagHandler(writer http.ResponseWriter, request *http.R
 }
 
 // depsolve handles depsolving package sets required for serializing a manifest for a given distribution.
-func (api *API) depsolve(packageSets map[string][]rpmmd.PackageSet, distro distro.Distro) (map[string][]rpmmd.PackageSpec, error) {
+func (api *API) depsolve(packageSets map[string][]rpmmd.PackageSet, arch distro.Arch) (map[string][]rpmmd.PackageSpec, error) {
 
+	distro := arch.Distro()
 	platformID := distro.ModulePlatformID()
 	releasever := distro.Releasever()
 	distroName := distro.Name()
-	solver := api.solver.NewWithConfig(platformID, releasever, api.archName, distroName)
+	solver := api.solver.NewWithConfig(platformID, releasever, arch.Name(), distroName)
 
 	depsolvedSets := make(map[string][]rpmmd.PackageSpec, len(packageSets))
 
@@ -2266,7 +2291,7 @@ func (api *API) depsolve(packageSets map[string][]rpmmd.PackageSet, distro distr
 	return depsolvedSets, nil
 }
 
-func (api *API) resolveContainers(sourceSpecs map[string][]container.SourceSpec) (map[string][]container.Spec, error) {
+func (api *API) resolveContainers(sourceSpecs map[string][]container.SourceSpec, archName string) (map[string][]container.Spec, error) {
 
 	specs := make(map[string][]container.Spec, len(sourceSpecs))
 
@@ -2280,7 +2305,7 @@ func (api *API) resolveContainers(sourceSpecs map[string][]container.SourceSpec)
 	// to multiple pipelines at any point, this should work.
 	for name, sources := range sourceSpecs {
 		job := worker.ContainerResolveJob{
-			Arch:  api.archName,
+			Arch:  archName,
 			Specs: make([]worker.ContainerSpec, len(sources)),
 		}
 
@@ -2423,17 +2448,23 @@ func (api *API) composeHandler(writer http.ResponseWriter, request *http.Request
 	if distroName == "" {
 		distroName = api.hostDistroName
 	}
-	if api.getDistro(distroName) == nil {
+
+	archName := bp.Arch
+	if archName == "" {
+		archName = api.hostArch
+	}
+
+	if api.getDistro(distroName, archName) == nil {
 		errors := responseError{
 			ID:  "DistroError",
-			Msg: fmt.Sprintf("Unknown distribution: %s", distroName),
+			Msg: fmt.Sprintf("Unknown distribution: %s for arch %s", distroName, archName),
 		}
 		statusResponseError(writer, http.StatusBadRequest, errors)
 		return
 	}
 
 	// Get the imageType that corresponds to the distribution selected by the blueprint
-	imageType, err := api.getImageType(distroName, cr.ComposeType)
+	imageType, err := api.getImageType(distroName, cr.ComposeType, archName)
 	if err != nil {
 		errors := responseError{
 			ID:  "ComposeError",
@@ -2526,7 +2557,7 @@ func (api *API) composeHandler(writer http.ResponseWriter, request *http.Request
 		return
 	}
 
-	packageSets, err := api.depsolve(manifest.GetPackageSetChains(), imageType.Arch().Distro())
+	packageSets, err := api.depsolve(manifest.GetPackageSetChains(), imageType.Arch())
 	if err != nil {
 		errors := responseError{
 			ID:  "DepsolveError",
@@ -2536,7 +2567,7 @@ func (api *API) composeHandler(writer http.ResponseWriter, request *http.Request
 		return
 	}
 
-	containerSpecs, err := api.resolveContainers(manifest.GetContainerSourceSpecs())
+	containerSpecs, err := api.resolveContainers(manifest.GetContainerSourceSpecs(), archName)
 	if err != nil {
 		errors := responseError{
 			ID:  "ContainerResolveError",
@@ -2577,6 +2608,25 @@ func (api *API) composeHandler(writer http.ResponseWriter, request *http.Request
 		}
 	}
 
+	workerAvailable, err := api.workers.WorkerAvailableForArch(archName)
+	if err != nil {
+		log.Println("error when pushing new compose: ", err.Error())
+		errors := responseError{
+			ID:  "ComposePushErrored",
+			Msg: err.Error(),
+		}
+		statusResponseError(writer, http.StatusInternalServerError, errors)
+		return
+	}
+	if !workerAvailable {
+		errors := responseError{
+			ID:  "ComposePushErrored",
+			Msg: fmt.Sprintf("No worker for arch '%s'  available", archName),
+		}
+		statusResponseError(writer, http.StatusBadRequest, errors)
+		return
+	}
+
 	if testMode == "1" {
 		// Create a failed compose
 		err = api.store.PushTestCompose(composeID, mf, imageType, bp, size, targets, false, packages)
@@ -2585,8 +2635,7 @@ func (api *API) composeHandler(writer http.ResponseWriter, request *http.Request
 		err = api.store.PushTestCompose(composeID, mf, imageType, bp, size, targets, true, packages)
 	} else {
 		var jobId uuid.UUID
-
-		jobId, err = api.workers.EnqueueOSBuild(api.archName, &worker.OSBuildJob{
+		jobId, err = api.workers.EnqueueOSBuild(archName, &worker.OSBuildJob{
 			Manifest: mf,
 			Targets:  targets,
 			PipelineNames: &worker.PipelineNames{
@@ -2767,9 +2816,15 @@ func (api *API) composeTypesHandler(writer http.ResponseWriter, request *http.Re
 	if !verifyRequestVersion(writer, params, 0) {
 		return
 	}
+
+	archName := api.hostArch
+	if queryArch := request.URL.Query().Get("arch"); queryArch != "" {
+		archName = queryArch
+	}
+
 	// Optional distro parameter
 	// If it is empty it will return api.hostDistroName
-	distroName, err := api.parseDistro(request.URL.Query())
+	distroName, err := api.parseDistro(request.URL.Query(), archName)
 	if err != nil {
 		errors := responseError{
 			ID:  "DistroError",
@@ -2779,7 +2834,7 @@ func (api *API) composeTypesHandler(writer http.ResponseWriter, request *http.Re
 		return
 	}
 
-	d := api.getDistro(distroName)
+	d := api.getDistro(distroName, archName)
 	if d == nil {
 		errors := responseError{
 			ID:  "DistroError",
@@ -2790,11 +2845,11 @@ func (api *API) composeTypesHandler(writer http.ResponseWriter, request *http.Re
 	}
 
 	// Get the distro specific arch so that we can return the correct list of image types
-	arch, err := d.GetArch(api.archName)
+	arch, err := d.GetArch(archName)
 	if err != nil {
 		errors := responseError{
 			ID:  "DistroError",
-			Msg: fmt.Sprintf("Unknown arch: %s", api.archName),
+			Msg: fmt.Sprintf("Unknown arch: %s", arch),
 		}
 		statusResponseError(writer, http.StatusBadRequest, errors)
 		return
@@ -3442,17 +3497,17 @@ func (api *API) composeFailedHandler(writer http.ResponseWriter, request *http.R
 }
 
 // fetchPackageList returns the package list or the selected distribution
-func (api *API) fetchPackageList(distroName string, names []string) (packages rpmmd.PackageList, err error) {
-	d := api.getDistro(distroName)
+func (api *API) fetchPackageList(distroName, arch string, names []string) (packages rpmmd.PackageList, err error) {
+	d := api.getDistro(distroName, arch)
 	if d == nil {
 		return nil, fmt.Errorf("GetDistro - unknown distribution: %s", distroName)
 	}
-	repos, err := api.allRepositories(distroName)
+	repos, err := api.allRepositories(distroName, arch)
 	if err != nil {
 		return nil, err
 	}
 
-	solver := api.solver.NewWithConfig(d.ModulePlatformID(), d.Releasever(), api.archName, d.Name())
+	solver := api.solver.NewWithConfig(d.ModulePlatformID(), d.Releasever(), arch, d.Name())
 	if len(names) == 0 {
 		packages, err = solver.FetchMetadata(repos)
 	} else {
@@ -3503,8 +3558,8 @@ func (api *API) allRepositoriesByImageType(imageType distro.ImageType) ([]rpmmd.
 }
 
 // Returns all configured repositories (base + sources) as rpmmd.RepoConfig
-func (api *API) allRepositories(distroName string) ([]rpmmd.RepoConfig, error) {
-	repos, err := api.repoRegistry.ReposByArchName(distroName, api.archName, false)
+func (api *API) allRepositories(distroName, arch string) ([]rpmmd.RepoConfig, error) {
+	repos, err := api.repoRegistry.ReposByArchName(distroName, arch, false)
 	if err != nil {
 		return nil, err
 	}
@@ -3521,16 +3576,21 @@ func (api *API) depsolveBlueprint(bp blueprint.Blueprint) ([]rpmmd.PackageSpec,
 		bp.Distro = api.hostDistroName
 	}
 
-	d := api.getDistro(bp.Distro)
+	arch := bp.Arch
+	if arch == "" {
+		arch = api.hostArch
+	}
+
+	d := api.getDistro(bp.Distro, arch)
 	if d == nil {
 		return nil, fmt.Errorf("GetDistro - unknown distribution: %s", bp.Distro)
 	}
-	repos, err := api.allRepositories(bp.Distro)
+	repos, err := api.allRepositories(bp.Distro, arch)
 	if err != nil {
 		return nil, err
 	}
 
-	solver := api.solver.NewWithConfig(d.ModulePlatformID(), d.Releasever(), api.archName, d.Name())
+	solver := api.solver.NewWithConfig(d.ModulePlatformID(), d.Releasever(), arch, d.Name())
 	solved, err := solver.Depsolve([]rpmmd.PackageSet{{Include: bp.GetPackages(), Repositories: repos}})
 	if err != nil {
 		return nil, err
@@ -3629,10 +3689,15 @@ func (api *API) distrosListHandler(writer http.ResponseWriter, request *http.Req
 		return
 	}
 
+	archName := api.hostArch
+	if arch := request.URL.Query().Get("arch"); arch != "" {
+		archName = arch
+	}
+
 	var reply struct {
 		Distros []string `json:"distros"`
 	}
-	reply.Distros = api.distros
+	reply.Distros = api.validDistros(archName)
 
 	err := json.NewEncoder(writer).Encode(reply)
 	common.PanicOnError(err)
diff --git a/internal/worker/server.go b/internal/worker/server.go
index 254c1421c..530d18a4d 100644
--- a/internal/worker/server.go
+++ b/internal/worker/server.go
@@ -163,9 +163,9 @@ func (s *Server) WatchWorkers() {
 			logrus.Warningf("Unable to query workers: %v", err)
 			continue
 		}
-		for _, wID := range workers {
-			logrus.Infof("Removing inactive worker: %s", wID)
-			err = s.jobs.DeleteWorker(wID)
+		for _, w := range workers {
+			logrus.Infof("Removing inactive worker: %s", w.ID)
+			err = s.jobs.DeleteWorker(w.ID)
 			if err != nil {
 				logrus.Warningf("Unable to remove worker: %v", err)
 			}
@@ -823,6 +823,28 @@ func (s *Server) RequeueOrFinishJob(token uuid.UUID, maxRetries uint64, result j
 	return nil
 }
 
+func (s *Server) RegisterWorker(a string) (uuid.UUID, error) {
+	workerID, err := s.jobs.InsertWorker(a)
+	if err != nil {
+		return uuid.Nil, err
+	}
+	logrus.Infof("Worker (%v) registered", a)
+	return workerID, nil
+}
+
+func (s *Server) WorkerAvailableForArch(a string) (bool, error) {
+	workers, err := s.jobs.Workers(0)
+	if err != nil {
+		return false, err
+	}
+	for _, w := range workers {
+		if a == w.Arch {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
 // apiHandlers implements api.ServerInterface - the http api route handlers
 // generated from api/openapi.yml. This is a separate object, because these
 // handlers should not be exposed on the `Server` object.
@@ -1037,11 +1059,10 @@ func (h *apiHandlers) PostWorkers(ctx echo.Context) error {
 		return err
 	}
 
-	workerID, err := h.server.jobs.InsertWorker(body.Arch)
+	workerID, err := h.server.RegisterWorker(body.Arch)
 	if err != nil {
 		return api.HTTPErrorWithInternal(api.ErrorInsertingWorker, err)
 	}
-	logrus.Infof("Worker (%v) registered", body.Arch)
 
 	return ctx.JSON(http.StatusCreated, api.PostWorkersResponse{
 		ObjectReference: api.ObjectReference{
diff --git a/pkg/jobqueue/dbjobqueue/dbjobqueue.go b/pkg/jobqueue/dbjobqueue/dbjobqueue.go
index fc56dbb46..be1bda07b 100644
--- a/pkg/jobqueue/dbjobqueue/dbjobqueue.go
+++ b/pkg/jobqueue/dbjobqueue/dbjobqueue.go
@@ -124,7 +124,7 @@ const (
 		SET heartbeat = now()
 		WHERE worker_id = $1`
 	sqlQueryWorkers = `
-		SELECT worker_id
+		SELECT worker_id, arch
 		FROM workers
 		WHERE age(now(), heartbeat) > $1`
 	sqlDeleteWorker = `
@@ -746,7 +746,7 @@ func (q *DBJobQueue) UpdateWorkerStatus(workerID uuid.UUID) error {
 	}
 	return nil
 }
-func (q *DBJobQueue) Workers(olderThan time.Duration) ([]uuid.UUID, error) {
+func (q *DBJobQueue) Workers(olderThan time.Duration) ([]jobqueue.Worker, error) {
 	conn, err := q.pool.Acquire(context.Background())
 	if err != nil {
 		return nil, err
@@ -759,23 +759,27 @@ func (q *DBJobQueue) Workers(olderThan time.Duration) ([]uuid.UUID, error) {
 	}
 	defer rows.Close()
 
-	workerIDs := make([]uuid.UUID, 0)
+	workers := make([]jobqueue.Worker, 0)
 	for rows.Next() {
 		var w uuid.UUID
-		err = rows.Scan(&w)
+		var a string
+		err = rows.Scan(&w, &a)
 		if err != nil {
 			// Log the error and try to continue with the next row
 			q.logger.Error(err, "Unable to read token from heartbeats")
 			continue
 		}
-		workerIDs = append(workerIDs, w)
+		workers = append(workers, jobqueue.Worker{
+			ID:   w,
+			Arch: a,
+		})
 	}
 	if rows.Err() != nil {
 		q.logger.Error(rows.Err(), "Error reading tokens from heartbeats")
 		return nil, rows.Err()
 	}
 
-	return workerIDs, nil
+	return workers, nil
 }
 
 func (q *DBJobQueue) DeleteWorker(workerID uuid.UUID) error {
diff --git a/pkg/jobqueue/jobqueue.go b/pkg/jobqueue/jobqueue.go
index 55c357cab..5c50e874b 100644
--- a/pkg/jobqueue/jobqueue.go
+++ b/pkg/jobqueue/jobqueue.go
@@ -88,7 +88,7 @@ type JobQueue interface {
 	UpdateWorkerStatus(workerID uuid.UUID) error
 
 	// Get a list of workers which haven't been updated in the specified time frame
-	Workers(olderThan time.Duration) ([]uuid.UUID, error)
+	Workers(olderThan time.Duration) ([]Worker, error)
 
 	// Deletes the worker
 	DeleteWorker(workerID uuid.UUID) error
@@ -115,3 +115,8 @@ var (
 	ErrActiveJobs     = errors.New("worker has active jobs associated with it")
 	ErrWorkerNotExist = errors.New("worker does not exist")
 )
+
+type Worker struct {
+	ID   uuid.UUID
+	Arch string
+}
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/endpoints/defaults.go b/vendor/github.com/aws/aws-sdk-go/aws/endpoints/defaults.go
index ee1ea9b6a..cdf456abe 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/endpoints/defaults.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/endpoints/defaults.go
@@ -25843,55 +25843,123 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "af-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "af-south-1",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-east-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ap-east-1",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-northeast-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ap-northeast-1",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-northeast-2",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ap-northeast-2",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-northeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ap-northeast-3",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ap-south-1",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ap-southeast-1",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-2",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ap-southeast-2",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ap-southeast-3",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ca-central-1",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region:  "ca-central-1",
 					Variant: fipsVariant,
 				}: endpoint{},
+				endpointKey{
+					Region:  "ca-central-1",
+					Variant: fipsVariant | dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "eu-central-1",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "eu-north-1",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "eu-south-1",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "eu-west-1",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-2",
 				}: endpoint{},
+				endpointKey{
+					Region:  "eu-west-2",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region:  "eu-west-3",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "fips-ca-central-1",
 				}: endpoint{
@@ -25925,40 +25993,84 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "il-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "il-central-1",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "me-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "me-south-1",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "sa-east-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "sa-east-1",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "us-east-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-east-1",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region:  "us-east-1",
 					Variant: fipsVariant,
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-east-1",
+					Variant: fipsVariant | dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "us-east-2",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-east-2",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region:  "us-east-2",
 					Variant: fipsVariant,
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-east-2",
+					Variant: fipsVariant | dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "us-west-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-west-1",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region:  "us-west-1",
 					Variant: fipsVariant,
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-west-1",
+					Variant: fipsVariant | dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "us-west-2",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-west-2",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region:  "us-west-2",
 					Variant: fipsVariant,
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-west-2",
+					Variant: fipsVariant | dualStackVariant,
+				}: endpoint{},
 			},
 		},
 		"sagemaker-geospatial": service{
@@ -26187,160 +26299,267 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "af-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "af-south-1",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-east-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ap-east-1",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-northeast-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ap-northeast-1",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-northeast-2",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ap-northeast-2",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-northeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ap-northeast-3",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ap-south-1",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-south-2",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ap-south-2",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ap-southeast-1",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-2",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ap-southeast-2",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ap-southeast-3",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-4",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ap-southeast-4",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ca-central-1",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region:  "ca-central-1",
 					Variant: fipsVariant,
-				}: endpoint{
-					Hostname: "secretsmanager-fips.ca-central-1.amazonaws.com",
-				},
+				}: endpoint{},
+				endpointKey{
+					Region:  "ca-central-1",
+					Variant: fipsVariant | dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1-fips",
 				}: endpoint{
-					Hostname: "secretsmanager-fips.ca-central-1.amazonaws.com",
-					CredentialScope: credentialScope{
-						Region: "ca-central-1",
-					},
+
 					Deprecated: boxedTrue,
 				},
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "eu-central-1",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-central-2",
 				}: endpoint{},
+				endpointKey{
+					Region:  "eu-central-2",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "eu-north-1",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "eu-south-1",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-south-2",
 				}: endpoint{},
+				endpointKey{
+					Region:  "eu-south-2",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "eu-west-1",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-2",
 				}: endpoint{},
+				endpointKey{
+					Region:  "eu-west-2",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region:  "eu-west-3",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "il-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "il-central-1",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "me-central-1",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "me-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "me-south-1",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "sa-east-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "sa-east-1",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "us-east-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-east-1",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region:  "us-east-1",
 					Variant: fipsVariant,
-				}: endpoint{
-					Hostname: "secretsmanager-fips.us-east-1.amazonaws.com",
-				},
+				}: endpoint{},
+				endpointKey{
+					Region:  "us-east-1",
+					Variant: fipsVariant | dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "us-east-1-fips",
 				}: endpoint{
-					Hostname: "secretsmanager-fips.us-east-1.amazonaws.com",
-					CredentialScope: credentialScope{
-						Region: "us-east-1",
-					},
+
 					Deprecated: boxedTrue,
 				},
 				endpointKey{
 					Region: "us-east-2",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-east-2",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region:  "us-east-2",
 					Variant: fipsVariant,
-				}: endpoint{
-					Hostname: "secretsmanager-fips.us-east-2.amazonaws.com",
-				},
+				}: endpoint{},
+				endpointKey{
+					Region:  "us-east-2",
+					Variant: fipsVariant | dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "us-east-2-fips",
 				}: endpoint{
-					Hostname: "secretsmanager-fips.us-east-2.amazonaws.com",
-					CredentialScope: credentialScope{
-						Region: "us-east-2",
-					},
+
 					Deprecated: boxedTrue,
 				},
 				endpointKey{
 					Region: "us-west-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-west-1",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region:  "us-west-1",
 					Variant: fipsVariant,
-				}: endpoint{
-					Hostname: "secretsmanager-fips.us-west-1.amazonaws.com",
-				},
+				}: endpoint{},
+				endpointKey{
+					Region:  "us-west-1",
+					Variant: fipsVariant | dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "us-west-1-fips",
 				}: endpoint{
-					Hostname: "secretsmanager-fips.us-west-1.amazonaws.com",
-					CredentialScope: credentialScope{
-						Region: "us-west-1",
-					},
+
 					Deprecated: boxedTrue,
 				},
 				endpointKey{
 					Region: "us-west-2",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-west-2",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region:  "us-west-2",
 					Variant: fipsVariant,
-				}: endpoint{
-					Hostname: "secretsmanager-fips.us-west-2.amazonaws.com",
-				},
+				}: endpoint{},
+				endpointKey{
+					Region:  "us-west-2",
+					Variant: fipsVariant | dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "us-west-2-fips",
 				}: endpoint{
-					Hostname: "secretsmanager-fips.us-west-2.amazonaws.com",
-					CredentialScope: credentialScope{
-						Region: "us-west-2",
-					},
+
 					Deprecated: boxedTrue,
 				},
 			},
@@ -34864,9 +35083,17 @@ var awscnPartition = partition{
 				endpointKey{
 					Region: "cn-north-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "cn-north-1",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "cn-northwest-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "cn-northwest-1",
+					Variant: dualStackVariant,
+				}: endpoint{},
 			},
 		},
 		"securityhub": service{
@@ -38246,7 +38473,21 @@ var awsusgovPartition = partition{
 			},
 		},
 		"health": service{
+			Defaults: endpointDefaults{
+				defaultKey{}: endpoint{
+					SSLCommonName: "health.us-gov-west-1.amazonaws.com",
+					Protocols:     []string{"https"},
+				},
+			},
 			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "aws-us-gov-global",
+				}: endpoint{
+					Hostname: "global.health.us-gov.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+				},
 				endpointKey{
 					Region: "fips-us-gov-west-1",
 				}: endpoint{
@@ -40488,17 +40729,33 @@ var awsusgovPartition = partition{
 				endpointKey{
 					Region: "us-gov-east-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-gov-east-1",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region:  "us-gov-east-1",
 					Variant: fipsVariant,
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-gov-east-1",
+					Variant: fipsVariant | dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "us-gov-west-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-gov-west-1",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region:  "us-gov-west-1",
 					Variant: fipsVariant,
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-gov-west-1",
+					Variant: fipsVariant | dualStackVariant,
+				}: endpoint{},
 			},
 		},
 		"secretsmanager": service{
@@ -40506,37 +40763,43 @@ var awsusgovPartition = partition{
 				endpointKey{
 					Region: "us-gov-east-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-gov-east-1",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region:  "us-gov-east-1",
 					Variant: fipsVariant,
-				}: endpoint{
-					Hostname: "secretsmanager-fips.us-gov-east-1.amazonaws.com",
-				},
+				}: endpoint{},
+				endpointKey{
+					Region:  "us-gov-east-1",
+					Variant: fipsVariant | dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "us-gov-east-1-fips",
 				}: endpoint{
-					Hostname: "secretsmanager-fips.us-gov-east-1.amazonaws.com",
-					CredentialScope: credentialScope{
-						Region: "us-gov-east-1",
-					},
+
 					Deprecated: boxedTrue,
 				},
 				endpointKey{
 					Region: "us-gov-west-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-gov-west-1",
+					Variant: dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region:  "us-gov-west-1",
 					Variant: fipsVariant,
-				}: endpoint{
-					Hostname: "secretsmanager-fips.us-gov-west-1.amazonaws.com",
-				},
+				}: endpoint{},
+				endpointKey{
+					Region:  "us-gov-west-1",
+					Variant: fipsVariant | dualStackVariant,
+				}: endpoint{},
 				endpointKey{
 					Region: "us-gov-west-1-fips",
 				}: endpoint{
-					Hostname: "secretsmanager-fips.us-gov-west-1.amazonaws.com",
-					CredentialScope: credentialScope{
-						Region: "us-gov-west-1",
-					},
+
 					Deprecated: boxedTrue,
 				},
 			},
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/version.go b/vendor/github.com/aws/aws-sdk-go/aws/version.go
index 192a3361d..06b0728a2 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/version.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/version.go
@@ -5,4 +5,4 @@ package aws
 const SDKName = "aws-sdk-go"
 
 // SDKVersion is the version of this SDK
-const SDKVersion = "1.48.13"
+const SDKVersion = "1.49.0"
diff --git a/vendor/github.com/aws/aws-sdk-go/service/ec2/api.go b/vendor/github.com/aws/aws-sdk-go/service/ec2/api.go
index 56f6e6201..6d7aa0c0a 100644
--- a/vendor/github.com/aws/aws-sdk-go/service/ec2/api.go
+++ b/vendor/github.com/aws/aws-sdk-go/service/ec2/api.go
@@ -161017,6 +161017,9 @@ func (s *PrivateIpAddressSpecification) SetPrivateIpAddress(v string) *PrivateIp
 type ProcessorInfo struct {
 	_ struct{} `type:"structure"`
 
+	// The manufacturer of the processor.
+	Manufacturer *string `locationName:"manufacturer" type:"string"`
+
 	// The architectures supported by the instance type.
 	SupportedArchitectures []*string `locationName:"supportedArchitectures" locationNameList:"item" type:"list" enum:"ArchitectureType"`
 
@@ -161047,6 +161050,12 @@ func (s ProcessorInfo) GoString() string {
 	return s.String()
 }
 
+// SetManufacturer sets the Manufacturer field's value.
+func (s *ProcessorInfo) SetManufacturer(v string) *ProcessorInfo {
+	s.Manufacturer = &v
+	return s
+}
+
 // SetSupportedArchitectures sets the SupportedArchitectures field's value.
 func (s *ProcessorInfo) SetSupportedArchitectures(v []*string) *ProcessorInfo {
 	s.SupportedArchitectures = v
@@ -194338,6 +194347,33 @@ const (
 
 	// InstanceTypeDl2q24xlarge is a InstanceType enum value
 	InstanceTypeDl2q24xlarge = "dl2q.24xlarge"
+
+	// InstanceTypeMac2M2Metal is a InstanceType enum value
+	InstanceTypeMac2M2Metal = "mac2-m2.metal"
+
+	// InstanceTypeI4i12xlarge is a InstanceType enum value
+	InstanceTypeI4i12xlarge = "i4i.12xlarge"
+
+	// InstanceTypeI4i24xlarge is a InstanceType enum value
+	InstanceTypeI4i24xlarge = "i4i.24xlarge"
+
+	// InstanceTypeC7iMetal24xl is a InstanceType enum value
+	InstanceTypeC7iMetal24xl = "c7i.metal-24xl"
+
+	// InstanceTypeC7iMetal48xl is a InstanceType enum value
+	InstanceTypeC7iMetal48xl = "c7i.metal-48xl"
+
+	// InstanceTypeM7iMetal24xl is a InstanceType enum value
+	InstanceTypeM7iMetal24xl = "m7i.metal-24xl"
+
+	// InstanceTypeM7iMetal48xl is a InstanceType enum value
+	InstanceTypeM7iMetal48xl = "m7i.metal-48xl"
+
+	// InstanceTypeR7iMetal24xl is a InstanceType enum value
+	InstanceTypeR7iMetal24xl = "r7i.metal-24xl"
+
+	// InstanceTypeR7iMetal48xl is a InstanceType enum value
+	InstanceTypeR7iMetal48xl = "r7i.metal-48xl"
 )
 
 // InstanceType_Values returns all elements of the InstanceType enum
@@ -195115,6 +195151,15 @@ func InstanceType_Values() []string {
 		InstanceTypeR7i24xlarge,
 		InstanceTypeR7i48xlarge,
 		InstanceTypeDl2q24xlarge,
+		InstanceTypeMac2M2Metal,
+		InstanceTypeI4i12xlarge,
+		InstanceTypeI4i24xlarge,
+		InstanceTypeC7iMetal24xl,
+		InstanceTypeC7iMetal48xl,
+		InstanceTypeM7iMetal24xl,
+		InstanceTypeM7iMetal48xl,
+		InstanceTypeR7iMetal24xl,
+		InstanceTypeR7iMetal48xl,
 	}
 }
 
diff --git a/vendor/github.com/osbuild/images/internal/common/constants.go b/vendor/github.com/osbuild/images/internal/common/constants.go
index 7c570a708..3257f94f1 100644
--- a/vendor/github.com/osbuild/images/internal/common/constants.go
+++ b/vendor/github.com/osbuild/images/internal/common/constants.go
@@ -11,6 +11,14 @@ const (
 	GibiByte = 1024 * 1024 * 1024        // GiB
 	TeraByte = 1000 * 1000 * 1000 * 1000 // TB
 	TebiByte = 1024 * 1024 * 1024 * 1024 // TiB
+
+	// shorthands
+	KiB = KibiByte
+	MB  = MegaByte
+	MiB = MebiByte
+	GB  = GigaByte
+	GiB = GibiByte
+	TiB = TebiByte
 )
 
 // These constants are set during buildtime using additional
diff --git a/vendor/github.com/osbuild/images/pkg/blueprint/customizations.go b/vendor/github.com/osbuild/images/pkg/blueprint/customizations.go
index c136ac01d..d83ed2ebb 100644
--- a/vendor/github.com/osbuild/images/pkg/blueprint/customizations.go
+++ b/vendor/github.com/osbuild/images/pkg/blueprint/customizations.go
@@ -45,8 +45,9 @@ type FDOCustomization struct {
 	DiunPubKeyInsecure     string `json:"diun_pub_key_insecure,omitempty" toml:"diun_pub_key_insecure,omitempty"`
 	// This is the output of:
 	// echo "sha256:$(openssl x509 -fingerprint -sha256 -noout -in diun_cert.pem | cut -d"=" -f2 | sed 's/://g')"
-	DiunPubKeyHash      string `json:"diun_pub_key_hash,omitempty" toml:"diun_pub_key_hash,omitempty"`
-	DiunPubKeyRootCerts string `json:"diun_pub_key_root_certs,omitempty" toml:"diun_pub_key_root_certs,omitempty"`
+	DiunPubKeyHash          string `json:"diun_pub_key_hash,omitempty" toml:"diun_pub_key_hash,omitempty"`
+	DiunPubKeyRootCerts     string `json:"diun_pub_key_root_certs,omitempty" toml:"diun_pub_key_root_certs,omitempty"`
+	DiMfgStringTypeMacIface string `json:"di_mfg_string_type_mac_iface,omitempty" toml:"di_mfg_string_type_mac_iface,omitempty"`
 }
 
 type KernelCustomization struct {
diff --git a/vendor/github.com/osbuild/images/pkg/blueprint/fsnode_customizations.go b/vendor/github.com/osbuild/images/pkg/blueprint/fsnode_customizations.go
index 3e0b458c3..a99308ae1 100644
--- a/vendor/github.com/osbuild/images/pkg/blueprint/fsnode_customizations.go
+++ b/vendor/github.com/osbuild/images/pkg/blueprint/fsnode_customizations.go
@@ -11,8 +11,8 @@ import (
 	"strings"
 
 	"github.com/osbuild/images/internal/common"
-	"github.com/osbuild/images/internal/fsnode"
 	"github.com/osbuild/images/internal/pathpolicy"
+	"github.com/osbuild/images/pkg/customizations/fsnode"
 )
 
 // validateModeString checks that the given string is a valid mode octal number
diff --git a/vendor/github.com/osbuild/images/pkg/blueprint/repository_customizations.go b/vendor/github.com/osbuild/images/pkg/blueprint/repository_customizations.go
index f534804cd..1159f8d76 100644
--- a/vendor/github.com/osbuild/images/pkg/blueprint/repository_customizations.go
+++ b/vendor/github.com/osbuild/images/pkg/blueprint/repository_customizations.go
@@ -7,23 +7,24 @@ import (
 	"strings"
 
 	"github.com/osbuild/images/internal/common"
-	"github.com/osbuild/images/internal/fsnode"
+	"github.com/osbuild/images/pkg/customizations/fsnode"
 	"github.com/osbuild/images/pkg/rpmmd"
 )
 
 type RepositoryCustomization struct {
-	Id           string   `json:"id" toml:"id"`
-	BaseURLs     []string `json:"baseurls,omitempty" toml:"baseurls,omitempty"`
-	GPGKeys      []string `json:"gpgkeys,omitempty" toml:"gpgkeys,omitempty"`
-	Metalink     string   `json:"metalink,omitempty" toml:"metalink,omitempty"`
-	Mirrorlist   string   `json:"mirrorlist,omitempty" toml:"mirrorlist,omitempty"`
-	Name         string   `json:"name,omitempty" toml:"name,omitempty"`
-	Priority     *int     `json:"priority,omitempty" toml:"priority,omitempty"`
-	Enabled      *bool    `json:"enabled,omitempty" toml:"enabled,omitempty"`
-	GPGCheck     *bool    `json:"gpgcheck,omitempty" toml:"gpgcheck,omitempty"`
-	RepoGPGCheck *bool    `json:"repo_gpgcheck,omitempty" toml:"repo_gpgcheck,omitempty"`
-	SSLVerify    *bool    `json:"sslverify,omitempty" toml:"sslverify,omitempty"`
-	Filename     string   `json:"filename,omitempty" toml:"filename,omitempty"`
+	Id             string   `json:"id" toml:"id"`
+	BaseURLs       []string `json:"baseurls,omitempty" toml:"baseurls,omitempty"`
+	GPGKeys        []string `json:"gpgkeys,omitempty" toml:"gpgkeys,omitempty"`
+	Metalink       string   `json:"metalink,omitempty" toml:"metalink,omitempty"`
+	Mirrorlist     string   `json:"mirrorlist,omitempty" toml:"mirrorlist,omitempty"`
+	Name           string   `json:"name,omitempty" toml:"name,omitempty"`
+	Priority       *int     `json:"priority,omitempty" toml:"priority,omitempty"`
+	Enabled        *bool    `json:"enabled,omitempty" toml:"enabled,omitempty"`
+	GPGCheck       *bool    `json:"gpgcheck,omitempty" toml:"gpgcheck,omitempty"`
+	RepoGPGCheck   *bool    `json:"repo_gpgcheck,omitempty" toml:"repo_gpgcheck,omitempty"`
+	SSLVerify      *bool    `json:"sslverify,omitempty" toml:"sslverify,omitempty"`
+	ModuleHotfixes *bool    `json:"module_hotfixes,omitempty" toml:"module_hotfixes,omitempty"`
+	Filename       string   `json:"filename,omitempty" toml:"filename,omitempty"`
 }
 
 const repoFilenameRegex = "^[\\w.-]{1,250}\\.repo$"
@@ -117,16 +118,17 @@ func (repo RepositoryCustomization) customRepoToRepoConfig() rpmmd.RepoConfig {
 	copy(keys, repo.GPGKeys)
 
 	repoConfig := rpmmd.RepoConfig{
-		Id:           repo.Id,
-		BaseURLs:     urls,
-		GPGKeys:      keys,
-		Name:         repo.Name,
-		Metalink:     repo.Metalink,
-		MirrorList:   repo.Mirrorlist,
-		CheckGPG:     repo.GPGCheck,
-		CheckRepoGPG: repo.RepoGPGCheck,
-		Priority:     repo.Priority,
-		Enabled:      repo.Enabled,
+		Id:             repo.Id,
+		BaseURLs:       urls,
+		GPGKeys:        keys,
+		Name:           repo.Name,
+		Metalink:       repo.Metalink,
+		MirrorList:     repo.Mirrorlist,
+		CheckGPG:       repo.GPGCheck,
+		CheckRepoGPG:   repo.RepoGPGCheck,
+		Priority:       repo.Priority,
+		ModuleHotfixes: repo.ModuleHotfixes,
+		Enabled:        repo.Enabled,
 	}
 
 	if repo.SSLVerify != nil {
diff --git a/vendor/github.com/osbuild/images/internal/fdo/fdo.go b/vendor/github.com/osbuild/images/pkg/customizations/fdo/fdo.go
similarity index 53%
rename from vendor/github.com/osbuild/images/internal/fdo/fdo.go
rename to vendor/github.com/osbuild/images/pkg/customizations/fdo/fdo.go
index c047a6215..d86573bae 100644
--- a/vendor/github.com/osbuild/images/internal/fdo/fdo.go
+++ b/vendor/github.com/osbuild/images/pkg/customizations/fdo/fdo.go
@@ -3,10 +3,11 @@ package fdo
 import "github.com/osbuild/images/pkg/blueprint"
 
 type Options struct {
-	ManufacturingServerURL string
-	DiunPubKeyInsecure     string
-	DiunPubKeyHash         string
-	DiunPubKeyRootCerts    string
+	ManufacturingServerURL  string
+	DiunPubKeyInsecure      string
+	DiunPubKeyHash          string
+	DiunPubKeyRootCerts     string
+	DiMfgStringTypeMacIface string
 }
 
 func FromBP(bpFDO blueprint.FDOCustomization) *Options {
diff --git a/vendor/github.com/osbuild/images/internal/fsnode/dir.go b/vendor/github.com/osbuild/images/pkg/customizations/fsnode/dir.go
similarity index 100%
rename from vendor/github.com/osbuild/images/internal/fsnode/dir.go
rename to vendor/github.com/osbuild/images/pkg/customizations/fsnode/dir.go
diff --git a/vendor/github.com/osbuild/images/internal/fsnode/file.go b/vendor/github.com/osbuild/images/pkg/customizations/fsnode/file.go
similarity index 100%
rename from vendor/github.com/osbuild/images/internal/fsnode/file.go
rename to vendor/github.com/osbuild/images/pkg/customizations/fsnode/file.go
diff --git a/vendor/github.com/osbuild/images/internal/fsnode/fsnode.go b/vendor/github.com/osbuild/images/pkg/customizations/fsnode/fsnode.go
similarity index 100%
rename from vendor/github.com/osbuild/images/internal/fsnode/fsnode.go
rename to vendor/github.com/osbuild/images/pkg/customizations/fsnode/fsnode.go
diff --git a/vendor/github.com/osbuild/images/internal/ignition/ignition.go b/vendor/github.com/osbuild/images/pkg/customizations/ignition/ignition.go
similarity index 100%
rename from vendor/github.com/osbuild/images/internal/ignition/ignition.go
rename to vendor/github.com/osbuild/images/pkg/customizations/ignition/ignition.go
diff --git a/vendor/github.com/osbuild/images/internal/oscap/oscap.go b/vendor/github.com/osbuild/images/pkg/customizations/oscap/oscap.go
similarity index 98%
rename from vendor/github.com/osbuild/images/internal/oscap/oscap.go
rename to vendor/github.com/osbuild/images/pkg/customizations/oscap/oscap.go
index 5b36fd7c3..ffc06db9c 100644
--- a/vendor/github.com/osbuild/images/internal/oscap/oscap.go
+++ b/vendor/github.com/osbuild/images/pkg/customizations/oscap/oscap.go
@@ -5,7 +5,7 @@ import (
 	"path/filepath"
 	"strings"
 
-	"github.com/osbuild/images/internal/fsnode"
+	"github.com/osbuild/images/pkg/customizations/fsnode"
 )
 
 type Profile string
diff --git a/vendor/github.com/osbuild/images/internal/shell/shell.go b/vendor/github.com/osbuild/images/pkg/customizations/shell/shell.go
similarity index 100%
rename from vendor/github.com/osbuild/images/internal/shell/shell.go
rename to vendor/github.com/osbuild/images/pkg/customizations/shell/shell.go
diff --git a/vendor/github.com/osbuild/images/internal/users/users.go b/vendor/github.com/osbuild/images/pkg/customizations/users/users.go
similarity index 100%
rename from vendor/github.com/osbuild/images/internal/users/users.go
rename to vendor/github.com/osbuild/images/pkg/customizations/users/users.go
diff --git a/vendor/github.com/osbuild/images/pkg/disk/luks.go b/vendor/github.com/osbuild/images/pkg/disk/luks.go
index 21f7b786b..93b10b3a0 100644
--- a/vendor/github.com/osbuild/images/pkg/disk/luks.go
+++ b/vendor/github.com/osbuild/images/pkg/disk/luks.go
@@ -5,6 +5,8 @@ import (
 	"math/rand"
 
 	"github.com/google/uuid"
+
+	"github.com/osbuild/images/internal/common"
 )
 
 type Argon2id struct {
@@ -96,5 +98,5 @@ func (lc *LUKSContainer) MetadataSize() uint64 {
 	}
 
 	// 16 MiB is the default size for the LUKS2 header
-	return 16 * 1024 * 1024
+	return 16 * common.MiB
 }
diff --git a/vendor/github.com/osbuild/images/pkg/disk/lvm.go b/vendor/github.com/osbuild/images/pkg/disk/lvm.go
index 13cb561ff..30118c025 100644
--- a/vendor/github.com/osbuild/images/pkg/disk/lvm.go
+++ b/vendor/github.com/osbuild/images/pkg/disk/lvm.go
@@ -138,7 +138,7 @@ func (vg *LVMVolumeGroup) MetadataSize() uint64 {
 	// of the metadata and its location and thus the start of the physical
 	// extent. For now we assume the default which results in a start of
 	// the physical extent 1 MiB
-	return 1024 * 1024
+	return 1 * common.MiB
 }
 
 type LVMLogicalVolume struct {
diff --git a/vendor/github.com/osbuild/images/pkg/disk/partition_table.go b/vendor/github.com/osbuild/images/pkg/disk/partition_table.go
index bc807e4e6..ceefabebe 100644
--- a/vendor/github.com/osbuild/images/pkg/disk/partition_table.go
+++ b/vendor/github.com/osbuild/images/pkg/disk/partition_table.go
@@ -7,6 +7,7 @@ import (
 
 	"github.com/google/uuid"
 
+	"github.com/osbuild/images/internal/common"
 	"github.com/osbuild/images/pkg/blueprint"
 )
 
@@ -630,7 +631,7 @@ func (pt *PartitionTable) ensureLVM() error {
 	// we need a /boot partition to boot LVM, ensure one exists
 	bootPath := entityPath(pt, "/boot")
 	if bootPath == nil {
-		_, err := pt.CreateMountpoint("/boot", 512*1024*1024)
+		_, err := pt.CreateMountpoint("/boot", 512*common.MiB)
 
 		if err != nil {
 			return err
diff --git a/vendor/github.com/osbuild/images/pkg/distro/fedora/distro.go b/vendor/github.com/osbuild/images/pkg/distro/fedora/distro.go
index 17b1d9d5f..ec397266a 100644
--- a/vendor/github.com/osbuild/images/pkg/distro/fedora/distro.go
+++ b/vendor/github.com/osbuild/images/pkg/distro/fedora/distro.go
@@ -8,9 +8,9 @@ import (
 
 	"github.com/osbuild/images/internal/common"
 	"github.com/osbuild/images/internal/environment"
-	"github.com/osbuild/images/internal/fsnode"
-	"github.com/osbuild/images/internal/oscap"
 	"github.com/osbuild/images/pkg/arch"
+	"github.com/osbuild/images/pkg/customizations/fsnode"
+	"github.com/osbuild/images/pkg/customizations/oscap"
 	"github.com/osbuild/images/pkg/distro"
 	"github.com/osbuild/images/pkg/osbuild"
 	"github.com/osbuild/images/pkg/platform"
@@ -38,6 +38,9 @@ const (
 
 	// Added kernel command line options for ami, qcow2, openstack, vhd and vmdk types
 	cloudKernelOptions = "ro no_timer_check console=ttyS0,115200n8 biosdevname=0 net.ifnames=0"
+
+	// location for saving openscap remediation data
+	oscapDataDir = "/oscap_data"
 )
 
 var (
diff --git a/vendor/github.com/osbuild/images/pkg/distro/fedora/images.go b/vendor/github.com/osbuild/images/pkg/distro/fedora/images.go
index 2bc618177..6943789c2 100644
--- a/vendor/github.com/osbuild/images/pkg/distro/fedora/images.go
+++ b/vendor/github.com/osbuild/images/pkg/distro/fedora/images.go
@@ -5,14 +5,14 @@ import (
 	"math/rand"
 
 	"github.com/osbuild/images/internal/common"
-	"github.com/osbuild/images/internal/fdo"
-	"github.com/osbuild/images/internal/fsnode"
-	"github.com/osbuild/images/internal/ignition"
-	"github.com/osbuild/images/internal/oscap"
-	"github.com/osbuild/images/internal/users"
 	"github.com/osbuild/images/internal/workload"
 	"github.com/osbuild/images/pkg/blueprint"
 	"github.com/osbuild/images/pkg/container"
+	"github.com/osbuild/images/pkg/customizations/fdo"
+	"github.com/osbuild/images/pkg/customizations/fsnode"
+	"github.com/osbuild/images/pkg/customizations/ignition"
+	"github.com/osbuild/images/pkg/customizations/oscap"
+	"github.com/osbuild/images/pkg/customizations/users"
 	"github.com/osbuild/images/pkg/distro"
 	"github.com/osbuild/images/pkg/image"
 	"github.com/osbuild/images/pkg/manifest"
@@ -165,14 +165,25 @@ func osCustomizations(
 		if t.rpmOstree {
 			panic("unexpected oscap options for ostree image type")
 		}
+
+		// although the osbuild stage will create this directory,
+		// it's probably better to ensure that it is created here
+		dataDirNode, err := fsnode.NewDirectory(oscapDataDir, nil, nil, nil, true)
+		if err != nil {
+			panic("unexpected error creating OpenSCAP data directory")
+		}
+
+		osc.Directories = append(osc.Directories, dataDirNode)
+
 		var datastream = oscapConfig.DataStream
 		if datastream == "" {
 			datastream = oscap.DefaultFedoraDatastream()
 		}
 
 		oscapStageOptions := osbuild.OscapConfig{
-			Datastream: datastream,
-			ProfileID:  oscapConfig.ProfileID,
+			Datastream:  datastream,
+			ProfileID:   oscapConfig.ProfileID,
+			Compression: true,
 		}
 
 		if oscapConfig.Tailoring != nil {
@@ -182,14 +193,15 @@ func osCustomizations(
 			}
 
 			tailoringOptions := osbuild.OscapAutotailorConfig{
+				NewProfile: newProfile,
+				Datastream: datastream,
+				ProfileID:  oscapConfig.ProfileID,
 				Selected:   oscapConfig.Tailoring.Selected,
 				Unselected: oscapConfig.Tailoring.Unselected,
-				NewProfile: newProfile,
 			}
 
 			osc.OpenSCAPTailorConfig = osbuild.NewOscapAutotailorStageOptions(
 				tailoringFilepath,
-				oscapStageOptions,
 				tailoringOptions,
 			)
 
@@ -201,7 +213,7 @@ func osCustomizations(
 			osc.Directories = append(osc.Directories, tailoringDir)
 		}
 
-		osc.OpenSCAPConfig = osbuild.NewOscapRemediationStageOptions(oscapStageOptions)
+		osc.OpenSCAPConfig = osbuild.NewOscapRemediationStageOptions(oscapDataDir, oscapStageOptions)
 	}
 
 	osc.ShellInit = imageConfig.ShellInit
diff --git a/vendor/github.com/osbuild/images/pkg/distro/fedora/imagetype.go b/vendor/github.com/osbuild/images/pkg/distro/fedora/imagetype.go
index 61031c5bc..b8a80a82e 100644
--- a/vendor/github.com/osbuild/images/pkg/distro/fedora/imagetype.go
+++ b/vendor/github.com/osbuild/images/pkg/distro/fedora/imagetype.go
@@ -7,11 +7,11 @@ import (
 
 	"github.com/osbuild/images/internal/common"
 	"github.com/osbuild/images/internal/environment"
-	"github.com/osbuild/images/internal/oscap"
 	"github.com/osbuild/images/internal/pathpolicy"
 	"github.com/osbuild/images/internal/workload"
 	"github.com/osbuild/images/pkg/blueprint"
 	"github.com/osbuild/images/pkg/container"
+	"github.com/osbuild/images/pkg/customizations/oscap"
 	"github.com/osbuild/images/pkg/disk"
 	"github.com/osbuild/images/pkg/distro"
 	"github.com/osbuild/images/pkg/image"
diff --git a/vendor/github.com/osbuild/images/pkg/distro/image_config.go b/vendor/github.com/osbuild/images/pkg/distro/image_config.go
index dad0942fc..da62dde5f 100644
--- a/vendor/github.com/osbuild/images/pkg/distro/image_config.go
+++ b/vendor/github.com/osbuild/images/pkg/distro/image_config.go
@@ -4,8 +4,8 @@ import (
 	"fmt"
 	"reflect"
 
-	"github.com/osbuild/images/internal/fsnode"
-	"github.com/osbuild/images/internal/shell"
+	"github.com/osbuild/images/pkg/customizations/fsnode"
+	"github.com/osbuild/images/pkg/customizations/shell"
 	"github.com/osbuild/images/pkg/osbuild"
 	"github.com/osbuild/images/pkg/subscription"
 )
diff --git a/vendor/github.com/osbuild/images/pkg/distro/rhel7/distro.go b/vendor/github.com/osbuild/images/pkg/distro/rhel7/distro.go
index 03c616155..797058d19 100644
--- a/vendor/github.com/osbuild/images/pkg/distro/rhel7/distro.go
+++ b/vendor/github.com/osbuild/images/pkg/distro/rhel7/distro.go
@@ -22,6 +22,9 @@ const (
 
 	// blueprint package set name
 	blueprintPkgsKey = "blueprint"
+
+	// location for saving openscap remediation data
+	oscapDataDir = "/oscap_data"
 )
 
 // RHEL-based OS image configuration defaults
diff --git a/vendor/github.com/osbuild/images/pkg/distro/rhel7/images.go b/vendor/github.com/osbuild/images/pkg/distro/rhel7/images.go
index 3aae1bc55..dfc541531 100644
--- a/vendor/github.com/osbuild/images/pkg/distro/rhel7/images.go
+++ b/vendor/github.com/osbuild/images/pkg/distro/rhel7/images.go
@@ -5,11 +5,11 @@ import (
 	"math/rand"
 
 	"github.com/osbuild/images/internal/common"
-	"github.com/osbuild/images/internal/users"
 	"github.com/osbuild/images/internal/workload"
 	"github.com/osbuild/images/pkg/arch"
 	"github.com/osbuild/images/pkg/blueprint"
 	"github.com/osbuild/images/pkg/container"
+	"github.com/osbuild/images/pkg/customizations/users"
 	"github.com/osbuild/images/pkg/distro"
 	"github.com/osbuild/images/pkg/image"
 	"github.com/osbuild/images/pkg/manifest"
@@ -131,9 +131,11 @@ func osCustomizations(
 
 	if oscapConfig := c.GetOpenSCAP(); oscapConfig != nil {
 		osc.OpenSCAPConfig = osbuild.NewOscapRemediationStageOptions(
+			oscapDataDir,
 			osbuild.OscapConfig{
-				Datastream: oscapConfig.DataStream,
-				ProfileID:  oscapConfig.ProfileID,
+				Datastream:  oscapConfig.DataStream,
+				ProfileID:   oscapConfig.ProfileID,
+				Compression: true,
 			},
 		)
 	}
diff --git a/vendor/github.com/osbuild/images/pkg/distro/rhel8/azure.go b/vendor/github.com/osbuild/images/pkg/distro/rhel8/azure.go
index df194c46c..34d464a87 100644
--- a/vendor/github.com/osbuild/images/pkg/distro/rhel8/azure.go
+++ b/vendor/github.com/osbuild/images/pkg/distro/rhel8/azure.go
@@ -2,8 +2,8 @@ package rhel8
 
 import (
 	"github.com/osbuild/images/internal/common"
-	"github.com/osbuild/images/internal/shell"
 	"github.com/osbuild/images/pkg/arch"
+	"github.com/osbuild/images/pkg/customizations/shell"
 	"github.com/osbuild/images/pkg/disk"
 	"github.com/osbuild/images/pkg/distro"
 	"github.com/osbuild/images/pkg/osbuild"
diff --git a/vendor/github.com/osbuild/images/pkg/distro/rhel8/distro.go b/vendor/github.com/osbuild/images/pkg/distro/rhel8/distro.go
index 047d4f6fc..fb14324c4 100644
--- a/vendor/github.com/osbuild/images/pkg/distro/rhel8/distro.go
+++ b/vendor/github.com/osbuild/images/pkg/distro/rhel8/distro.go
@@ -7,8 +7,8 @@ import (
 	"strings"
 
 	"github.com/osbuild/images/internal/common"
-	"github.com/osbuild/images/internal/oscap"
 	"github.com/osbuild/images/pkg/arch"
+	"github.com/osbuild/images/pkg/customizations/oscap"
 	"github.com/osbuild/images/pkg/distro"
 	"github.com/osbuild/images/pkg/osbuild"
 	"github.com/osbuild/images/pkg/platform"
diff --git a/vendor/github.com/osbuild/images/pkg/distro/rhel8/edge.go b/vendor/github.com/osbuild/images/pkg/distro/rhel8/edge.go
index fcda04bd4..87fa6be62 100644
--- a/vendor/github.com/osbuild/images/pkg/distro/rhel8/edge.go
+++ b/vendor/github.com/osbuild/images/pkg/distro/rhel8/edge.go
@@ -4,8 +4,8 @@ import (
 	"fmt"
 
 	"github.com/osbuild/images/internal/common"
-	"github.com/osbuild/images/internal/fsnode"
 	"github.com/osbuild/images/pkg/arch"
+	"github.com/osbuild/images/pkg/customizations/fsnode"
 	"github.com/osbuild/images/pkg/distro"
 	"github.com/osbuild/images/pkg/rpmmd"
 )
diff --git a/vendor/github.com/osbuild/images/pkg/distro/rhel8/images.go b/vendor/github.com/osbuild/images/pkg/distro/rhel8/images.go
index 5d0508beb..1eeae9a35 100644
--- a/vendor/github.com/osbuild/images/pkg/distro/rhel8/images.go
+++ b/vendor/github.com/osbuild/images/pkg/distro/rhel8/images.go
@@ -4,15 +4,15 @@ import (
 	"fmt"
 	"math/rand"
 
-	"github.com/osbuild/images/internal/fdo"
-	"github.com/osbuild/images/internal/fsnode"
-	"github.com/osbuild/images/internal/ignition"
-	"github.com/osbuild/images/internal/oscap"
-	"github.com/osbuild/images/internal/users"
 	"github.com/osbuild/images/internal/workload"
 	"github.com/osbuild/images/pkg/arch"
 	"github.com/osbuild/images/pkg/blueprint"
 	"github.com/osbuild/images/pkg/container"
+	"github.com/osbuild/images/pkg/customizations/fdo"
+	"github.com/osbuild/images/pkg/customizations/fsnode"
+	"github.com/osbuild/images/pkg/customizations/ignition"
+	"github.com/osbuild/images/pkg/customizations/oscap"
+	"github.com/osbuild/images/pkg/customizations/users"
 	"github.com/osbuild/images/pkg/distro"
 	"github.com/osbuild/images/pkg/image"
 	"github.com/osbuild/images/pkg/manifest"
@@ -186,14 +186,25 @@ func osCustomizations(
 		if t.rpmOstree {
 			panic("unexpected oscap options for ostree image type")
 		}
+
+		// although the osbuild stage will create this directory,
+		// it's probably better to ensure that it is created here
+		dataDirNode, err := fsnode.NewDirectory(oscapDataDir, nil, nil, nil, true)
+		if err != nil {
+			panic("unexpected error creating OpenSCAP data directory")
+		}
+
+		osc.Directories = append(osc.Directories, dataDirNode)
+
 		var datastream = oscapConfig.DataStream
 		if datastream == "" {
 			datastream = oscap.DefaultRHEL8Datastream(t.arch.distro.isRHEL())
 		}
 
 		oscapStageOptions := osbuild.OscapConfig{
-			Datastream: datastream,
-			ProfileID:  oscapConfig.ProfileID,
+			Datastream:  datastream,
+			ProfileID:   oscapConfig.ProfileID,
+			Compression: true,
 		}
 
 		if oscapConfig.Tailoring != nil {
@@ -203,14 +214,15 @@ func osCustomizations(
 			}
 
 			tailoringOptions := osbuild.OscapAutotailorConfig{
+				NewProfile: newProfile,
+				Datastream: datastream,
+				ProfileID:  oscapConfig.ProfileID,
 				Selected:   oscapConfig.Tailoring.Selected,
 				Unselected: oscapConfig.Tailoring.Unselected,
-				NewProfile: newProfile,
 			}
 
 			osc.OpenSCAPTailorConfig = osbuild.NewOscapAutotailorStageOptions(
 				tailoringFilepath,
-				oscapStageOptions,
 				tailoringOptions,
 			)
 
@@ -222,7 +234,7 @@ func osCustomizations(
 			osc.Directories = append(osc.Directories, tailoringDir)
 		}
 
-		osc.OpenSCAPConfig = osbuild.NewOscapRemediationStageOptions(oscapStageOptions)
+		osc.OpenSCAPConfig = osbuild.NewOscapRemediationStageOptions(oscapDataDir, oscapStageOptions)
 	}
 
 	osc.ShellInit = imageConfig.ShellInit
diff --git a/vendor/github.com/osbuild/images/pkg/distro/rhel8/imagetype.go b/vendor/github.com/osbuild/images/pkg/distro/rhel8/imagetype.go
index edf11da9b..88bd78709 100644
--- a/vendor/github.com/osbuild/images/pkg/distro/rhel8/imagetype.go
+++ b/vendor/github.com/osbuild/images/pkg/distro/rhel8/imagetype.go
@@ -10,11 +10,11 @@ import (
 
 	"github.com/osbuild/images/internal/common"
 	"github.com/osbuild/images/internal/environment"
-	"github.com/osbuild/images/internal/oscap"
 	"github.com/osbuild/images/internal/pathpolicy"
 	"github.com/osbuild/images/internal/workload"
 	"github.com/osbuild/images/pkg/blueprint"
 	"github.com/osbuild/images/pkg/container"
+	"github.com/osbuild/images/pkg/customizations/oscap"
 	"github.com/osbuild/images/pkg/disk"
 	"github.com/osbuild/images/pkg/distro"
 	"github.com/osbuild/images/pkg/image"
@@ -37,6 +37,9 @@ const (
 
 	// blueprint package set name
 	blueprintPkgsKey = "blueprint"
+
+	// location for saving openscap remediation data
+	oscapDataDir = "/oscap_data"
 )
 
 type imageFunc func(workload workload.Workload, t *imageType, customizations *blueprint.Customizations, options distro.ImageOptions, packageSets map[string]rpmmd.PackageSet, containers []container.SourceSpec, rng *rand.Rand) (image.ImageKind, error)
diff --git a/vendor/github.com/osbuild/images/pkg/distro/rhel9/distro.go b/vendor/github.com/osbuild/images/pkg/distro/rhel9/distro.go
index e84315139..92415038b 100644
--- a/vendor/github.com/osbuild/images/pkg/distro/rhel9/distro.go
+++ b/vendor/github.com/osbuild/images/pkg/distro/rhel9/distro.go
@@ -7,8 +7,8 @@ import (
 	"strings"
 
 	"github.com/osbuild/images/internal/common"
-	"github.com/osbuild/images/internal/oscap"
 	"github.com/osbuild/images/pkg/arch"
+	"github.com/osbuild/images/pkg/customizations/oscap"
 	"github.com/osbuild/images/pkg/distro"
 	"github.com/osbuild/images/pkg/osbuild"
 	"github.com/osbuild/images/pkg/platform"
diff --git a/vendor/github.com/osbuild/images/pkg/distro/rhel9/edge.go b/vendor/github.com/osbuild/images/pkg/distro/rhel9/edge.go
index be41c605e..280cc747b 100644
--- a/vendor/github.com/osbuild/images/pkg/distro/rhel9/edge.go
+++ b/vendor/github.com/osbuild/images/pkg/distro/rhel9/edge.go
@@ -5,8 +5,8 @@ import (
 
 	"github.com/osbuild/images/internal/common"
 	"github.com/osbuild/images/internal/environment"
-	"github.com/osbuild/images/internal/fsnode"
 	"github.com/osbuild/images/pkg/arch"
+	"github.com/osbuild/images/pkg/customizations/fsnode"
 	"github.com/osbuild/images/pkg/disk"
 	"github.com/osbuild/images/pkg/distro"
 	"github.com/osbuild/images/pkg/osbuild"
@@ -400,7 +400,7 @@ func edgeBasePartitionTables(t *imageType) (disk.PartitionTable, bool) {
 							Description: "built with lvm2 and osbuild",
 							LogicalVolumes: []disk.LVMLogicalVolume{
 								{
-									Size: 9 * 1024 * 1024 * 1024, // 9 GB
+									Size: 9 * common.GiB, // 9 GiB
 									Name: "rootlv",
 									Payload: &disk.Filesystem{
 										Type:         "xfs",
@@ -471,7 +471,7 @@ func edgeBasePartitionTables(t *imageType) (disk.PartitionTable, bool) {
 							Description: "built with lvm2 and osbuild",
 							LogicalVolumes: []disk.LVMLogicalVolume{
 								{
-									Size: 9 * 1024 * 1024 * 1024, // 9 GB
+									Size: 9 * common.GiB, // 9 GiB
 									Name: "rootlv",
 									Payload: &disk.Filesystem{
 										Type:         "xfs",
diff --git a/vendor/github.com/osbuild/images/pkg/distro/rhel9/images.go b/vendor/github.com/osbuild/images/pkg/distro/rhel9/images.go
index 9d9ff97f0..225e7a06b 100644
--- a/vendor/github.com/osbuild/images/pkg/distro/rhel9/images.go
+++ b/vendor/github.com/osbuild/images/pkg/distro/rhel9/images.go
@@ -5,14 +5,14 @@ import (
 	"math/rand"
 
 	"github.com/osbuild/images/internal/common"
-	"github.com/osbuild/images/internal/fdo"
-	"github.com/osbuild/images/internal/fsnode"
-	"github.com/osbuild/images/internal/ignition"
-	"github.com/osbuild/images/internal/oscap"
-	"github.com/osbuild/images/internal/users"
 	"github.com/osbuild/images/internal/workload"
 	"github.com/osbuild/images/pkg/blueprint"
 	"github.com/osbuild/images/pkg/container"
+	"github.com/osbuild/images/pkg/customizations/fdo"
+	"github.com/osbuild/images/pkg/customizations/fsnode"
+	"github.com/osbuild/images/pkg/customizations/ignition"
+	"github.com/osbuild/images/pkg/customizations/oscap"
+	"github.com/osbuild/images/pkg/customizations/users"
 	"github.com/osbuild/images/pkg/distro"
 	"github.com/osbuild/images/pkg/image"
 	"github.com/osbuild/images/pkg/manifest"
@@ -183,14 +183,25 @@ func osCustomizations(
 		if t.rpmOstree {
 			panic("unexpected oscap options for ostree image type")
 		}
+
+		// although the osbuild stage will create this directory,
+		// it's probably better to ensure that it is created here
+		dataDirNode, err := fsnode.NewDirectory(oscapDataDir, nil, nil, nil, true)
+		if err != nil {
+			panic("unexpected error creating OpenSCAP data directory")
+		}
+
+		osc.Directories = append(osc.Directories, dataDirNode)
+
 		var datastream = oscapConfig.DataStream
 		if datastream == "" {
 			datastream = oscap.DefaultRHEL9Datastream(t.arch.distro.isRHEL())
 		}
 
 		oscapStageOptions := osbuild.OscapConfig{
-			Datastream: datastream,
-			ProfileID:  oscapConfig.ProfileID,
+			Datastream:  datastream,
+			ProfileID:   oscapConfig.ProfileID,
+			Compression: true,
 		}
 
 		if oscapConfig.Tailoring != nil {
@@ -200,14 +211,15 @@ func osCustomizations(
 			}
 
 			tailoringOptions := osbuild.OscapAutotailorConfig{
+				NewProfile: newProfile,
+				Datastream: datastream,
+				ProfileID:  oscapConfig.ProfileID,
 				Selected:   oscapConfig.Tailoring.Selected,
 				Unselected: oscapConfig.Tailoring.Unselected,
-				NewProfile: newProfile,
 			}
 
 			osc.OpenSCAPTailorConfig = osbuild.NewOscapAutotailorStageOptions(
 				tailoringFilepath,
-				oscapStageOptions,
 				tailoringOptions,
 			)
 
@@ -219,7 +231,7 @@ func osCustomizations(
 			osc.Directories = append(osc.Directories, tailoringDir)
 		}
 
-		osc.OpenSCAPConfig = osbuild.NewOscapRemediationStageOptions(oscapStageOptions)
+		osc.OpenSCAPConfig = osbuild.NewOscapRemediationStageOptions(oscapDataDir, oscapStageOptions)
 	}
 
 	osc.ShellInit = imageConfig.ShellInit
diff --git a/vendor/github.com/osbuild/images/pkg/distro/rhel9/imagetype.go b/vendor/github.com/osbuild/images/pkg/distro/rhel9/imagetype.go
index a307caec3..6d8b6e9dc 100644
--- a/vendor/github.com/osbuild/images/pkg/distro/rhel9/imagetype.go
+++ b/vendor/github.com/osbuild/images/pkg/distro/rhel9/imagetype.go
@@ -10,11 +10,11 @@ import (
 
 	"github.com/osbuild/images/internal/common"
 	"github.com/osbuild/images/internal/environment"
-	"github.com/osbuild/images/internal/oscap"
 	"github.com/osbuild/images/internal/pathpolicy"
 	"github.com/osbuild/images/internal/workload"
 	"github.com/osbuild/images/pkg/blueprint"
 	"github.com/osbuild/images/pkg/container"
+	"github.com/osbuild/images/pkg/customizations/oscap"
 	"github.com/osbuild/images/pkg/disk"
 	"github.com/osbuild/images/pkg/distro"
 	"github.com/osbuild/images/pkg/image"
@@ -40,6 +40,9 @@ const (
 
 	// blueprint package set name
 	blueprintPkgsKey = "blueprint"
+
+	// location for saving openscap remediation data
+	oscapDataDir = "/oscap_data"
 )
 
 type imageFunc func(workload workload.Workload, t *imageType, customizations *blueprint.Customizations, options distro.ImageOptions, packageSets map[string]rpmmd.PackageSet, containers []container.SourceSpec, rng *rand.Rand) (image.ImageKind, error)
diff --git a/vendor/github.com/osbuild/images/pkg/image/anaconda_live_installer.go b/vendor/github.com/osbuild/images/pkg/image/anaconda_live_installer.go
index 2487e16b6..97bcea742 100644
--- a/vendor/github.com/osbuild/images/pkg/image/anaconda_live_installer.go
+++ b/vendor/github.com/osbuild/images/pkg/image/anaconda_live_installer.go
@@ -46,7 +46,7 @@ func (img *AnacondaLiveInstaller) InstantiateManifest(m *manifest.Manifest,
 	repos []rpmmd.RepoConfig,
 	runner runner.Runner,
 	rng *rand.Rand) (*artifact.Artifact, error) {
-	buildPipeline := manifest.NewBuild(m, runner, repos)
+	buildPipeline := manifest.NewBuild(m, runner, repos, nil)
 	buildPipeline.Checkpoint()
 
 	livePipeline := manifest.NewAnacondaInstaller(m,
diff --git a/vendor/github.com/osbuild/images/pkg/image/anaconda_ostree_installer.go b/vendor/github.com/osbuild/images/pkg/image/anaconda_ostree_installer.go
index 5636b4616..bea9c13a7 100644
--- a/vendor/github.com/osbuild/images/pkg/image/anaconda_ostree_installer.go
+++ b/vendor/github.com/osbuild/images/pkg/image/anaconda_ostree_installer.go
@@ -5,9 +5,9 @@ import (
 	"math/rand"
 
 	"github.com/osbuild/images/internal/common"
-	"github.com/osbuild/images/internal/users"
 	"github.com/osbuild/images/pkg/arch"
 	"github.com/osbuild/images/pkg/artifact"
+	"github.com/osbuild/images/pkg/customizations/users"
 	"github.com/osbuild/images/pkg/disk"
 	"github.com/osbuild/images/pkg/manifest"
 	"github.com/osbuild/images/pkg/ostree"
@@ -53,7 +53,7 @@ func (img *AnacondaOSTreeInstaller) InstantiateManifest(m *manifest.Manifest,
 	repos []rpmmd.RepoConfig,
 	runner runner.Runner,
 	rng *rand.Rand) (*artifact.Artifact, error) {
-	buildPipeline := manifest.NewBuild(m, runner, repos)
+	buildPipeline := manifest.NewBuild(m, runner, repos, nil)
 	buildPipeline.Checkpoint()
 
 	anacondaPipeline := manifest.NewAnacondaInstaller(m,
diff --git a/vendor/github.com/osbuild/images/pkg/image/anaconda_tar_installer.go b/vendor/github.com/osbuild/images/pkg/image/anaconda_tar_installer.go
index 46d34d4e2..83c073e92 100644
--- a/vendor/github.com/osbuild/images/pkg/image/anaconda_tar_installer.go
+++ b/vendor/github.com/osbuild/images/pkg/image/anaconda_tar_installer.go
@@ -7,10 +7,10 @@ import (
 
 	"github.com/osbuild/images/internal/common"
 	"github.com/osbuild/images/internal/environment"
-	"github.com/osbuild/images/internal/users"
 	"github.com/osbuild/images/internal/workload"
 	"github.com/osbuild/images/pkg/arch"
 	"github.com/osbuild/images/pkg/artifact"
+	"github.com/osbuild/images/pkg/customizations/users"
 	"github.com/osbuild/images/pkg/disk"
 	"github.com/osbuild/images/pkg/manifest"
 	"github.com/osbuild/images/pkg/platform"
@@ -63,7 +63,7 @@ func (img *AnacondaTarInstaller) InstantiateManifest(m *manifest.Manifest,
 	repos []rpmmd.RepoConfig,
 	runner runner.Runner,
 	rng *rand.Rand) (*artifact.Artifact, error) {
-	buildPipeline := manifest.NewBuild(m, runner, repos)
+	buildPipeline := manifest.NewBuild(m, runner, repos, nil)
 	buildPipeline.Checkpoint()
 
 	anacondaPipeline := manifest.NewAnacondaInstaller(m,
diff --git a/vendor/github.com/osbuild/images/pkg/image/archive.go b/vendor/github.com/osbuild/images/pkg/image/archive.go
index edf30a0a9..85767c05d 100644
--- a/vendor/github.com/osbuild/images/pkg/image/archive.go
+++ b/vendor/github.com/osbuild/images/pkg/image/archive.go
@@ -31,7 +31,7 @@ func (img *Archive) InstantiateManifest(m *manifest.Manifest,
 	repos []rpmmd.RepoConfig,
 	runner runner.Runner,
 	rng *rand.Rand) (*artifact.Artifact, error) {
-	buildPipeline := manifest.NewBuild(m, runner, repos)
+	buildPipeline := manifest.NewBuild(m, runner, repos, nil)
 	buildPipeline.Checkpoint()
 
 	osPipeline := manifest.NewOS(m, buildPipeline, img.Platform, repos)
diff --git a/vendor/github.com/osbuild/images/pkg/image/container.go b/vendor/github.com/osbuild/images/pkg/image/container.go
index c967ea596..977feab52 100644
--- a/vendor/github.com/osbuild/images/pkg/image/container.go
+++ b/vendor/github.com/osbuild/images/pkg/image/container.go
@@ -31,7 +31,7 @@ func (img *BaseContainer) InstantiateManifest(m *manifest.Manifest,
 	repos []rpmmd.RepoConfig,
 	runner runner.Runner,
 	rng *rand.Rand) (*artifact.Artifact, error) {
-	buildPipeline := manifest.NewBuild(m, runner, repos)
+	buildPipeline := manifest.NewBuild(m, runner, repos, nil)
 	buildPipeline.Checkpoint()
 
 	osPipeline := manifest.NewOS(m, buildPipeline, img.Platform, repos)
diff --git a/vendor/github.com/osbuild/images/pkg/image/disk.go b/vendor/github.com/osbuild/images/pkg/image/disk.go
index 2669ed128..45f5b3079 100644
--- a/vendor/github.com/osbuild/images/pkg/image/disk.go
+++ b/vendor/github.com/osbuild/images/pkg/image/disk.go
@@ -49,7 +49,7 @@ func (img *DiskImage) InstantiateManifest(m *manifest.Manifest,
 	repos []rpmmd.RepoConfig,
 	runner runner.Runner,
 	rng *rand.Rand) (*artifact.Artifact, error) {
-	buildPipeline := manifest.NewBuild(m, runner, repos)
+	buildPipeline := manifest.NewBuild(m, runner, repos, nil)
 	buildPipeline.Checkpoint()
 
 	osPipeline := manifest.NewOS(m, buildPipeline, img.Platform, repos)
diff --git a/vendor/github.com/osbuild/images/pkg/image/ostree_archive.go b/vendor/github.com/osbuild/images/pkg/image/ostree_archive.go
index d0deff6ee..5cd02dddc 100644
--- a/vendor/github.com/osbuild/images/pkg/image/ostree_archive.go
+++ b/vendor/github.com/osbuild/images/pkg/image/ostree_archive.go
@@ -47,7 +47,7 @@ func (img *OSTreeArchive) InstantiateManifest(m *manifest.Manifest,
 	repos []rpmmd.RepoConfig,
 	runner runner.Runner,
 	rng *rand.Rand) (*artifact.Artifact, error) {
-	buildPipeline := manifest.NewBuild(m, runner, repos)
+	buildPipeline := manifest.NewBuild(m, runner, repos, nil)
 	buildPipeline.Checkpoint()
 
 	osPipeline := manifest.NewOS(m, buildPipeline, img.Platform, repos)
diff --git a/vendor/github.com/osbuild/images/pkg/image/ostree_container.go b/vendor/github.com/osbuild/images/pkg/image/ostree_container.go
index 75373e31f..16e2f7ef2 100644
--- a/vendor/github.com/osbuild/images/pkg/image/ostree_container.go
+++ b/vendor/github.com/osbuild/images/pkg/image/ostree_container.go
@@ -44,7 +44,7 @@ func (img *OSTreeContainer) InstantiateManifest(m *manifest.Manifest,
 	repos []rpmmd.RepoConfig,
 	runner runner.Runner,
 	rng *rand.Rand) (*artifact.Artifact, error) {
-	buildPipeline := manifest.NewBuild(m, runner, repos)
+	buildPipeline := manifest.NewBuild(m, runner, repos, nil)
 	buildPipeline.Checkpoint()
 
 	osPipeline := manifest.NewOS(m, buildPipeline, img.Platform, repos)
diff --git a/vendor/github.com/osbuild/images/pkg/image/ostree_disk.go b/vendor/github.com/osbuild/images/pkg/image/ostree_disk.go
index 19e8c105f..ca418a313 100644
--- a/vendor/github.com/osbuild/images/pkg/image/ostree_disk.go
+++ b/vendor/github.com/osbuild/images/pkg/image/ostree_disk.go
@@ -4,11 +4,11 @@ import (
 	"fmt"
 	"math/rand"
 
-	"github.com/osbuild/images/internal/fsnode"
-	"github.com/osbuild/images/internal/users"
 	"github.com/osbuild/images/internal/workload"
 	"github.com/osbuild/images/pkg/artifact"
 	"github.com/osbuild/images/pkg/container"
+	"github.com/osbuild/images/pkg/customizations/fsnode"
+	"github.com/osbuild/images/pkg/customizations/users"
 	"github.com/osbuild/images/pkg/disk"
 	"github.com/osbuild/images/pkg/manifest"
 	"github.com/osbuild/images/pkg/ostree"
@@ -53,6 +53,10 @@ type OSTreeDiskImage struct {
 	// Lock the root account in the deployment unless the user defined root
 	// user options in the build configuration.
 	LockRoot bool
+
+	// Container buildable tweaks the buildroot to be container friendly,
+	// i.e. to not rely on an installed osbuild-selinux
+	ContainerBuildable bool
 }
 
 func NewOSTreeDiskImageFromCommit(commit ostree.SourceSpec) *OSTreeDiskImage {
@@ -102,11 +106,14 @@ func baseRawOstreeImage(img *OSTreeDiskImage, m *manifest.Manifest, buildPipelin
 	return manifest.NewRawOStreeImage(buildPipeline, osPipeline, img.Platform)
 }
 
+// replaced in testing
+var manifestNewBuild = manifest.NewBuild
+
 func (img *OSTreeDiskImage) InstantiateManifest(m *manifest.Manifest,
 	repos []rpmmd.RepoConfig,
 	runner runner.Runner,
 	rng *rand.Rand) (*artifact.Artifact, error) {
-	buildPipeline := manifest.NewBuild(m, runner, repos)
+	buildPipeline := manifestNewBuild(m, runner, repos, &manifest.BuildOptions{ContainerBuildable: img.ContainerBuildable})
 	buildPipeline.Checkpoint()
 
 	// don't support compressing non-raw images
diff --git a/vendor/github.com/osbuild/images/pkg/image/ostree_simplified_installer.go b/vendor/github.com/osbuild/images/pkg/image/ostree_simplified_installer.go
index abb59e79e..151b8abe6 100644
--- a/vendor/github.com/osbuild/images/pkg/image/ostree_simplified_installer.go
+++ b/vendor/github.com/osbuild/images/pkg/image/ostree_simplified_installer.go
@@ -6,11 +6,11 @@ import (
 
 	"github.com/osbuild/images/internal/common"
 	"github.com/osbuild/images/internal/environment"
-	"github.com/osbuild/images/internal/fdo"
-	"github.com/osbuild/images/internal/ignition"
 	"github.com/osbuild/images/internal/workload"
 	"github.com/osbuild/images/pkg/arch"
 	"github.com/osbuild/images/pkg/artifact"
+	"github.com/osbuild/images/pkg/customizations/fdo"
+	"github.com/osbuild/images/pkg/customizations/ignition"
 	"github.com/osbuild/images/pkg/disk"
 	"github.com/osbuild/images/pkg/manifest"
 	"github.com/osbuild/images/pkg/platform"
@@ -73,7 +73,7 @@ func (img *OSTreeSimplifiedInstaller) InstantiateManifest(m *manifest.Manifest,
 	repos []rpmmd.RepoConfig,
 	runner runner.Runner,
 	rng *rand.Rand) (*artifact.Artifact, error) {
-	buildPipeline := manifest.NewBuild(m, runner, repos)
+	buildPipeline := manifest.NewBuild(m, runner, repos, nil)
 	buildPipeline.Checkpoint()
 
 	imageFilename := "image.raw.xz"
@@ -127,6 +127,9 @@ func (img *OSTreeSimplifiedInstaller) InstantiateManifest(m *manifest.Manifest,
 		if img.FDO.DiunPubKeyRootCerts != "" {
 			kernelOpts = append(kernelOpts, "fdo.diun_pub_key_root_certs=/fdo_diun_pub_key_root_certs.pem")
 		}
+		if img.FDO.DiMfgStringTypeMacIface != "" {
+			kernelOpts = append(kernelOpts, "fdo.di_mfg_string_type_mac_iface="+img.FDO.DiMfgStringTypeMacIface)
+		}
 	}
 
 	bootTreePipeline.KernelOpts = kernelOpts
diff --git a/vendor/github.com/osbuild/images/pkg/manifest/anaconda_installer.go b/vendor/github.com/osbuild/images/pkg/manifest/anaconda_installer.go
index 3046e623f..958f77b24 100644
--- a/vendor/github.com/osbuild/images/pkg/manifest/anaconda_installer.go
+++ b/vendor/github.com/osbuild/images/pkg/manifest/anaconda_installer.go
@@ -4,10 +4,10 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/osbuild/images/internal/fsnode"
-	"github.com/osbuild/images/internal/users"
 	"github.com/osbuild/images/pkg/arch"
 	"github.com/osbuild/images/pkg/container"
+	"github.com/osbuild/images/pkg/customizations/fsnode"
+	"github.com/osbuild/images/pkg/customizations/users"
 	"github.com/osbuild/images/pkg/osbuild"
 	"github.com/osbuild/images/pkg/ostree"
 	"github.com/osbuild/images/pkg/platform"
@@ -309,14 +309,11 @@ func (p *AnacondaInstaller) serialize() osbuild.Pipeline {
 
 	if p.Type == AnacondaInstallerTypePayload {
 		if p.InteractiveDefaults != nil {
-			kickstartOptions, err := osbuild.NewKickstartStageOptions(
+			kickstartOptions, err := osbuild.NewKickstartStageOptionsWithLiveIMG(
 				"/usr/share/anaconda/interactive-defaults.ks",
-				p.InteractiveDefaults.TarPath,
 				p.Users,
 				p.Groups,
-				"",
-				"",
-				"",
+				p.InteractiveDefaults.TarPath,
 			)
 
 			if err != nil {
diff --git a/vendor/github.com/osbuild/images/pkg/manifest/anaconda_installer_iso_tree.go b/vendor/github.com/osbuild/images/pkg/manifest/anaconda_installer_iso_tree.go
index 8fc5461de..cb209de4d 100644
--- a/vendor/github.com/osbuild/images/pkg/manifest/anaconda_installer_iso_tree.go
+++ b/vendor/github.com/osbuild/images/pkg/manifest/anaconda_installer_iso_tree.go
@@ -4,8 +4,8 @@ import (
 	"fmt"
 	"path"
 
-	"github.com/osbuild/images/internal/users"
 	"github.com/osbuild/images/pkg/container"
+	"github.com/osbuild/images/pkg/customizations/users"
 	"github.com/osbuild/images/pkg/disk"
 	"github.com/osbuild/images/pkg/osbuild"
 	"github.com/osbuild/images/pkg/ostree"
@@ -272,7 +272,13 @@ func (p *AnacondaInstallerISOTree) serialize() osbuild.Pipeline {
 		))
 
 		// Configure the kickstart file with the payload and any user options
-		kickstartOptions, err := osbuild.NewKickstartStageOptions(p.KSPath, "", p.Users, p.Groups, makeISORootPath(p.PayloadPath), p.ostreeCommitSpec.Ref, p.OSName)
+		kickstartOptions, err := osbuild.NewKickstartStageOptionsWithOSTreeCommit(
+			p.KSPath,
+			p.Users,
+			p.Groups,
+			makeISORootPath(p.PayloadPath),
+			p.ostreeCommitSpec.Ref,
+			p.OSName)
 
 		if err != nil {
 			panic("failed to create kickstartstage options")
@@ -288,7 +294,12 @@ func (p *AnacondaInstallerISOTree) serialize() osbuild.Pipeline {
 		// If the KSPath is set, we need to add the kickstart stage to this (bootiso-tree) pipeline.
 		// If it's not specified here, it should have been added to the InteractiveDefaults in the anaconda-tree.
 		if p.KSPath != "" {
-			kickstartOptions, err := osbuild.NewKickstartStageOptions(p.KSPath, makeISORootPath(p.PayloadPath), p.Users, p.Groups, "", "", p.OSName)
+			kickstartOptions, err := osbuild.NewKickstartStageOptionsWithLiveIMG(
+				p.KSPath,
+				p.Users,
+				p.Groups,
+				makeISORootPath(p.PayloadPath))
+
 			if err != nil {
 				panic("failed to create kickstartstage options")
 			}
diff --git a/vendor/github.com/osbuild/images/pkg/manifest/build.go b/vendor/github.com/osbuild/images/pkg/manifest/build.go
index 65e5b6aa1..05b532f5f 100644
--- a/vendor/github.com/osbuild/images/pkg/manifest/build.go
+++ b/vendor/github.com/osbuild/images/pkg/manifest/build.go
@@ -22,17 +22,31 @@ type Build struct {
 	dependents   []Pipeline
 	repos        []rpmmd.RepoConfig
 	packageSpecs []rpmmd.PackageSpec
+
+	containerBuildable bool
+}
+
+type BuildOptions struct {
+	// ContainerBuildable tweaks the buildroot to be container friendly,
+	// i.e. to not rely on an installed osbuild-selinux
+	ContainerBuildable bool
 }
 
 // NewBuild creates a new build pipeline from the repositories in repos
 // and the specified packages.
-func NewBuild(m *Manifest, runner runner.Runner, repos []rpmmd.RepoConfig) *Build {
+func NewBuild(m *Manifest, runner runner.Runner, repos []rpmmd.RepoConfig, opts *BuildOptions) *Build {
+	if opts == nil {
+		opts = &BuildOptions{}
+	}
+
 	name := "build"
 	pipeline := &Build{
 		Base:       NewBase(m, name, nil),
 		runner:     runner,
 		dependents: make([]Pipeline, 0),
 		repos:      filterRepos(repos, name),
+
+		containerBuildable: opts.ContainerBuildable,
 	}
 	m.addPipeline(pipeline)
 	return pipeline
@@ -109,6 +123,10 @@ func (p *Build) getSELinuxLabels() map[string]string {
 		switch pkg.Name {
 		case "coreutils":
 			labels["/usr/bin/cp"] = "system_u:object_r:install_exec_t:s0"
+			if p.containerBuildable {
+				labels["/usr/bin/mount"] = "system_u:object_r:install_exec_t:s0"
+				labels["/usr/bin/umount"] = "system_u:object_r:install_exec_t:s0"
+			}
 		case "tar":
 			labels["/usr/bin/tar"] = "system_u:object_r:install_exec_t:s0"
 		}
diff --git a/vendor/github.com/osbuild/images/pkg/manifest/coi_iso_tree.go b/vendor/github.com/osbuild/images/pkg/manifest/coi_iso_tree.go
index 269f97737..9c3fca9a0 100644
--- a/vendor/github.com/osbuild/images/pkg/manifest/coi_iso_tree.go
+++ b/vendor/github.com/osbuild/images/pkg/manifest/coi_iso_tree.go
@@ -4,7 +4,7 @@ import (
 	"crypto/sha256"
 	"fmt"
 
-	"github.com/osbuild/images/internal/users"
+	"github.com/osbuild/images/pkg/customizations/users"
 	"github.com/osbuild/images/pkg/disk"
 	"github.com/osbuild/images/pkg/osbuild"
 )
diff --git a/vendor/github.com/osbuild/images/pkg/manifest/coreos_installer.go b/vendor/github.com/osbuild/images/pkg/manifest/coreos_installer.go
index 24206561e..a469911e6 100644
--- a/vendor/github.com/osbuild/images/pkg/manifest/coreos_installer.go
+++ b/vendor/github.com/osbuild/images/pkg/manifest/coreos_installer.go
@@ -3,10 +3,10 @@ package manifest
 import (
 	"fmt"
 
-	"github.com/osbuild/images/internal/fdo"
-	"github.com/osbuild/images/internal/ignition"
 	"github.com/osbuild/images/pkg/arch"
 	"github.com/osbuild/images/pkg/container"
+	"github.com/osbuild/images/pkg/customizations/fdo"
+	"github.com/osbuild/images/pkg/customizations/ignition"
 	"github.com/osbuild/images/pkg/osbuild"
 	"github.com/osbuild/images/pkg/ostree"
 	"github.com/osbuild/images/pkg/platform"
diff --git a/vendor/github.com/osbuild/images/pkg/manifest/os.go b/vendor/github.com/osbuild/images/pkg/manifest/os.go
index 95f95051e..2e0317466 100644
--- a/vendor/github.com/osbuild/images/pkg/manifest/os.go
+++ b/vendor/github.com/osbuild/images/pkg/manifest/os.go
@@ -7,12 +7,12 @@ import (
 
 	"github.com/osbuild/images/internal/common"
 	"github.com/osbuild/images/internal/environment"
-	"github.com/osbuild/images/internal/fsnode"
-	"github.com/osbuild/images/internal/shell"
-	"github.com/osbuild/images/internal/users"
 	"github.com/osbuild/images/internal/workload"
 	"github.com/osbuild/images/pkg/arch"
 	"github.com/osbuild/images/pkg/container"
+	"github.com/osbuild/images/pkg/customizations/fsnode"
+	"github.com/osbuild/images/pkg/customizations/shell"
+	"github.com/osbuild/images/pkg/customizations/users"
 	"github.com/osbuild/images/pkg/disk"
 	"github.com/osbuild/images/pkg/osbuild"
 	"github.com/osbuild/images/pkg/ostree"
@@ -220,7 +220,7 @@ func (p *OS) getPackageSetChain(Distro) []rpmmd.PackageSet {
 	}
 
 	if p.OpenSCAPConfig != nil {
-		packages = append(packages, "openscap-scanner", "scap-security-guide")
+		packages = append(packages, "openscap-scanner", "scap-security-guide", "xz")
 	}
 
 	// Make sure the right packages are included for subscriptions
diff --git a/vendor/github.com/osbuild/images/pkg/manifest/ostree_deployment.go b/vendor/github.com/osbuild/images/pkg/manifest/ostree_deployment.go
index f34cdedab..52e97c174 100644
--- a/vendor/github.com/osbuild/images/pkg/manifest/ostree_deployment.go
+++ b/vendor/github.com/osbuild/images/pkg/manifest/ostree_deployment.go
@@ -6,9 +6,9 @@ import (
 	"strings"
 
 	"github.com/osbuild/images/internal/common"
-	"github.com/osbuild/images/internal/fsnode"
-	"github.com/osbuild/images/internal/users"
 	"github.com/osbuild/images/pkg/container"
+	"github.com/osbuild/images/pkg/customizations/fsnode"
+	"github.com/osbuild/images/pkg/customizations/users"
 	"github.com/osbuild/images/pkg/disk"
 	"github.com/osbuild/images/pkg/osbuild"
 	"github.com/osbuild/images/pkg/ostree"
diff --git a/vendor/github.com/osbuild/images/pkg/osbuild/fips.go b/vendor/github.com/osbuild/images/pkg/osbuild/fips.go
index 91ffed800..8cf447e56 100644
--- a/vendor/github.com/osbuild/images/pkg/osbuild/fips.go
+++ b/vendor/github.com/osbuild/images/pkg/osbuild/fips.go
@@ -4,7 +4,7 @@ import (
 	"os"
 
 	"github.com/osbuild/images/internal/common"
-	"github.com/osbuild/images/internal/fsnode"
+	"github.com/osbuild/images/pkg/customizations/fsnode"
 	"github.com/osbuild/images/pkg/disk"
 )
 
diff --git a/vendor/github.com/osbuild/images/pkg/osbuild/fsnode.go b/vendor/github.com/osbuild/images/pkg/osbuild/fsnode.go
index 9345f82c6..f5399d6b8 100644
--- a/vendor/github.com/osbuild/images/pkg/osbuild/fsnode.go
+++ b/vendor/github.com/osbuild/images/pkg/osbuild/fsnode.go
@@ -4,7 +4,7 @@ import (
 	"crypto/sha256"
 	"fmt"
 
-	"github.com/osbuild/images/internal/fsnode"
+	"github.com/osbuild/images/pkg/customizations/fsnode"
 )
 
 // GenFileNodesStages generates the stages for a list of file nodes.
diff --git a/vendor/github.com/osbuild/images/pkg/osbuild/groups_stage.go b/vendor/github.com/osbuild/images/pkg/osbuild/groups_stage.go
index 97350807b..7f8982348 100644
--- a/vendor/github.com/osbuild/images/pkg/osbuild/groups_stage.go
+++ b/vendor/github.com/osbuild/images/pkg/osbuild/groups_stage.go
@@ -1,7 +1,7 @@
 package osbuild
 
 import (
-	"github.com/osbuild/images/internal/users"
+	"github.com/osbuild/images/pkg/customizations/users"
 )
 
 type GroupsStageOptions struct {
diff --git a/vendor/github.com/osbuild/images/pkg/osbuild/kickstart_stage.go b/vendor/github.com/osbuild/images/pkg/osbuild/kickstart_stage.go
index 0f41baca5..3ad57115d 100644
--- a/vendor/github.com/osbuild/images/pkg/osbuild/kickstart_stage.go
+++ b/vendor/github.com/osbuild/images/pkg/osbuild/kickstart_stage.go
@@ -1,31 +1,40 @@
 package osbuild
 
-import "github.com/osbuild/images/internal/users"
+import "github.com/osbuild/images/pkg/customizations/users"
 
 type KickstartStageOptions struct {
 	// Where to place the kickstart file
 	Path string `json:"path"`
 
-	OSTree *OSTreeOptions `json:"ostree,omitempty"`
+	OSTreeCommit    *OSTreeCommitOptions    `json:"ostree,omitempty"`
+	OSTreeContainer *OSTreeContainerOptions `json:"ostreecontainer,omitempty"`
 
-	LiveIMG *LiveIMG `json:"liveimg,omitempty"`
+	LiveIMG *LiveIMGOptions `json:"liveimg,omitempty"`
 
 	Users map[string]UsersStageOptionsUser `json:"users,omitempty"`
 
 	Groups map[string]GroupsStageOptionsGroup `json:"groups,omitempty"`
 }
 
-type LiveIMG struct {
+type LiveIMGOptions struct {
 	URL string `json:"url"`
 }
 
-type OSTreeOptions struct {
+type OSTreeCommitOptions struct {
 	OSName string `json:"osname"`
 	URL    string `json:"url"`
 	Ref    string `json:"ref"`
 	GPG    bool   `json:"gpg"`
 }
 
+type OSTreeContainerOptions struct {
+	StateRoot             string `json:"stateroot"`
+	URL                   string `json:"url"`
+	Transport             string `json:"transport"`
+	Remote                string `json:"remote"`
+	SignatureVerification bool   `json:"signatureverification"`
+}
+
 func (KickstartStageOptions) isStageOptions() {}
 
 // Creates an Anaconda kickstart file
@@ -38,12 +47,8 @@ func NewKickstartStage(options *KickstartStageOptions) *Stage {
 
 func NewKickstartStageOptions(
 	path string,
-	imageURL string,
 	userCustomizations []users.User,
-	groupCustomizations []users.Group,
-	ostreeURL string,
-	ostreeRef string,
-	osName string) (*KickstartStageOptions, error) {
+	groupCustomizations []users.Group) (*KickstartStageOptions, error) {
 
 	var users map[string]UsersStageOptionsUser
 	if usersOptions, err := NewUsersStageOptions(userCustomizations, false); err != nil {
@@ -57,27 +62,91 @@ func NewKickstartStageOptions(
 		groups = groupsOptions.Groups
 	}
 
-	var ostreeOptions *OSTreeOptions
+	return &KickstartStageOptions{
+		Path:         path,
+		OSTreeCommit: nil,
+		LiveIMG:      nil,
+		Users:        users,
+		Groups:       groups,
+	}, nil
+}
+
+func NewKickstartStageOptionsWithOSTreeCommit(
+	path string,
+	userCustomizations []users.User,
+	groupCustomizations []users.Group,
+	ostreeURL string,
+	ostreeRef string,
+	osName string) (*KickstartStageOptions, error) {
+
+	options, err := NewKickstartStageOptions(path, userCustomizations, groupCustomizations)
+
+	if err != nil {
+		return nil, err
+	}
+
 	if ostreeURL != "" {
-		ostreeOptions = &OSTreeOptions{
+		ostreeCommitOptions := &OSTreeCommitOptions{
 			OSName: osName,
 			URL:    ostreeURL,
 			Ref:    ostreeRef,
 			GPG:    false,
 		}
+
+		options.OSTreeCommit = ostreeCommitOptions
+	}
+
+	return options, nil
+}
+
+func NewKickstartStageOptionsWithOSTreeContainer(
+	path string,
+	userCustomizations []users.User,
+	groupCustomizations []users.Group,
+	containerURL string,
+	containerTransport string,
+	containerRemote string,
+	containerStateRoot string) (*KickstartStageOptions, error) {
+
+	options, err := NewKickstartStageOptions(path, userCustomizations, groupCustomizations)
+
+	if err != nil {
+		return nil, err
+	}
+
+	if containerURL != "" {
+		ostreeContainerOptions := &OSTreeContainerOptions{
+			StateRoot:             containerStateRoot,
+			URL:                   containerURL,
+			Remote:                containerRemote,
+			Transport:             containerTransport,
+			SignatureVerification: false,
+		}
+
+		options.OSTreeContainer = ostreeContainerOptions
+	}
+
+	return options, nil
+}
+
+func NewKickstartStageOptionsWithLiveIMG(
+	path string,
+	userCustomizations []users.User,
+	groupCustomizations []users.Group,
+	imageURL string) (*KickstartStageOptions, error) {
+
+	options, err := NewKickstartStageOptions(path, userCustomizations, groupCustomizations)
+
+	if err != nil {
+		return nil, err
 	}
 
-	var liveImg *LiveIMG
 	if imageURL != "" {
-		liveImg = &LiveIMG{
+		liveImg := &LiveIMGOptions{
 			URL: imageURL,
 		}
+		options.LiveIMG = liveImg
 	}
-	return &KickstartStageOptions{
-		Path:    path,
-		OSTree:  ostreeOptions,
-		LiveIMG: liveImg,
-		Users:   users,
-		Groups:  groups,
-	}, nil
+
+	return options, nil
 }
diff --git a/vendor/github.com/osbuild/images/pkg/osbuild/oscap_autotailor_stage.go b/vendor/github.com/osbuild/images/pkg/osbuild/oscap_autotailor_stage.go
index fae8aef87..36b3d6544 100644
--- a/vendor/github.com/osbuild/images/pkg/osbuild/oscap_autotailor_stage.go
+++ b/vendor/github.com/osbuild/images/pkg/osbuild/oscap_autotailor_stage.go
@@ -6,9 +6,11 @@ type OscapAutotailorStageOptions struct {
 	Filepath string                `json:"filepath"`
 	Config   OscapAutotailorConfig `json:"config"`
 }
+
 type OscapAutotailorConfig struct {
-	OscapConfig
 	NewProfile string   `json:"new_profile"`
+	Datastream string   `json:"datastream" toml:"datastream"`
+	ProfileID  string   `json:"profile_id" toml:"profile_id"`
 	Selected   []string `json:"selected,omitempty"`
 	Unselected []string `json:"unselected,omitempty"`
 }
@@ -16,11 +18,16 @@ type OscapAutotailorConfig struct {
 func (OscapAutotailorStageOptions) isStageOptions() {}
 
 func (c OscapAutotailorConfig) validate() error {
+	if c.Datastream == "" {
+		return fmt.Errorf("'datastream' must be specified")
+	}
+	if c.ProfileID == "" {
+		return fmt.Errorf("'profile_id' must be specified")
+	}
 	if c.NewProfile == "" {
 		return fmt.Errorf("'new_profile' must be specified")
 	}
-	// reuse the oscap validation
-	return c.OscapConfig.validate()
+	return nil
 }
 
 func NewOscapAutotailorStage(options *OscapAutotailorStageOptions) *Stage {
@@ -34,14 +41,15 @@ func NewOscapAutotailorStage(options *OscapAutotailorStageOptions) *Stage {
 	}
 }
 
-func NewOscapAutotailorStageOptions(filepath string, oscapOptions OscapConfig, autotailorOptions OscapAutotailorConfig) *OscapAutotailorStageOptions {
+func NewOscapAutotailorStageOptions(filepath string, autotailorOptions OscapAutotailorConfig) *OscapAutotailorStageOptions {
 	return &OscapAutotailorStageOptions{
 		Filepath: filepath,
 		Config: OscapAutotailorConfig{
-			OscapConfig: oscapOptions,
-			NewProfile:  autotailorOptions.NewProfile,
-			Selected:    autotailorOptions.Selected,
-			Unselected:  autotailorOptions.Unselected,
+			NewProfile: autotailorOptions.NewProfile,
+			Datastream: autotailorOptions.Datastream,
+			ProfileID:  autotailorOptions.ProfileID,
+			Selected:   autotailorOptions.Selected,
+			Unselected: autotailorOptions.Unselected,
 		},
 	}
 }
diff --git a/vendor/github.com/osbuild/images/pkg/osbuild/oscap_remediation_stage.go b/vendor/github.com/osbuild/images/pkg/osbuild/oscap_remediation_stage.go
index 7c1916b32..b1408218b 100644
--- a/vendor/github.com/osbuild/images/pkg/osbuild/oscap_remediation_stage.go
+++ b/vendor/github.com/osbuild/images/pkg/osbuild/oscap_remediation_stage.go
@@ -15,6 +15,7 @@ type OscapRemediationStageOptions struct {
 	DataDir string      `json:"data_dir,omitempty"`
 	Config  OscapConfig `json:"config"`
 }
+
 type OscapConfig struct {
 	Datastream   string              `json:"datastream" toml:"datastream"`
 	ProfileID    string              `json:"profile_id" toml:"profile_id"`
@@ -23,10 +24,11 @@ type OscapConfig struct {
 	BenchmarkID  string              `json:"benchmark_id,omitempty" toml:"benchmark_id,omitempty"`
 	Tailoring    string              `json:"tailoring,omitempty" toml:"tailoring,omitempty"`
 	TailoringID  string              `json:"tailoring_id,omitempty" toml:"tailoring_id,omitempty"`
-	ArfResult    string              `json:"arf_result,omitempty" toml:"arf_result,omitempty"`
+	ArfResult    string              `json:"arf_results,omitempty" toml:"arf_results,omitempty"`
 	HtmlReport   string              `json:"html_report,omitempty" toml:"html_report,omitempty"`
 	VerboseLog   string              `json:"verbose_log,omitempty" toml:"verbose_log,omitempty"`
 	VerboseLevel OscapVerbosityLevel `json:"verbose_level,omitempty" toml:"verbose_level,omitempty"`
+	Compression  bool                `json:"compress_results,omitempty" toml:"compress_results,omitempty"`
 }
 
 func (OscapRemediationStageOptions) isStageOptions() {}
@@ -70,8 +72,9 @@ func NewOscapRemediationStage(options *OscapRemediationStageOptions) *Stage {
 	}
 }
 
-func NewOscapRemediationStageOptions(options OscapConfig) *OscapRemediationStageOptions {
+func NewOscapRemediationStageOptions(dataDir string, options OscapConfig) *OscapRemediationStageOptions {
 	return &OscapRemediationStageOptions{
+		DataDir: dataDir,
 		Config: OscapConfig{
 			ProfileID:    options.ProfileID,
 			Datastream:   options.Datastream,
@@ -83,6 +86,7 @@ func NewOscapRemediationStageOptions(options OscapConfig) *OscapRemediationStage
 			HtmlReport:   options.HtmlReport,
 			VerboseLog:   options.VerboseLog,
 			VerboseLevel: options.VerboseLevel,
+			Compression:  options.Compression,
 		},
 	}
 }
diff --git a/vendor/github.com/osbuild/images/pkg/osbuild/shell_init_stage.go b/vendor/github.com/osbuild/images/pkg/osbuild/shell_init_stage.go
index f3cfdf6a8..969e8b727 100644
--- a/vendor/github.com/osbuild/images/pkg/osbuild/shell_init_stage.go
+++ b/vendor/github.com/osbuild/images/pkg/osbuild/shell_init_stage.go
@@ -4,7 +4,7 @@ import (
 	"fmt"
 	"regexp"
 
-	"github.com/osbuild/images/internal/shell"
+	"github.com/osbuild/images/pkg/customizations/shell"
 )
 
 const filenameRegex = "^[a-zA-Z0-9\\.\\-_]{1,250}$"
diff --git a/vendor/github.com/osbuild/images/pkg/osbuild/skopeo_source.go b/vendor/github.com/osbuild/images/pkg/osbuild/skopeo_source.go
index 857d447fb..6852ec647 100644
--- a/vendor/github.com/osbuild/images/pkg/osbuild/skopeo_source.go
+++ b/vendor/github.com/osbuild/images/pkg/osbuild/skopeo_source.go
@@ -39,13 +39,12 @@ func NewSkopeoSourceItem(name, digest string, tlsVerify *bool) SkopeoSourceItem
 }
 
 func (item SkopeoSourceItem) validate() error {
-
 	if item.Image.Name == "" {
-		return fmt.Errorf("source item has empty name")
+		return fmt.Errorf("source item %#v has empty name", item)
 	}
 
 	if !skopeoDigestPattern.MatchString(item.Image.Digest) {
-		return fmt.Errorf("source item has invalid digest")
+		return fmt.Errorf("source item %#v has invalid digest", item)
 	}
 
 	return nil
@@ -63,7 +62,7 @@ func NewSkopeoSource() *SkopeoSource {
 func (source *SkopeoSource) AddItem(name, digest, image string, tlsVerify *bool) {
 	item := NewSkopeoSourceItem(name, digest, tlsVerify)
 	if !skopeoDigestPattern.MatchString(image) {
-		panic("item has invalid image id")
+		panic(fmt.Errorf("item %#v has invalid image id", image))
 	}
 	source.Items[image] = item
 }
diff --git a/vendor/github.com/osbuild/images/pkg/osbuild/users_stage.go b/vendor/github.com/osbuild/images/pkg/osbuild/users_stage.go
index cd9f77d02..6d2a6ef98 100644
--- a/vendor/github.com/osbuild/images/pkg/osbuild/users_stage.go
+++ b/vendor/github.com/osbuild/images/pkg/osbuild/users_stage.go
@@ -1,8 +1,8 @@
 package osbuild
 
 import (
-	"github.com/osbuild/images/internal/users"
 	"github.com/osbuild/images/pkg/crypt"
+	"github.com/osbuild/images/pkg/customizations/users"
 )
 
 type UsersStageOptions struct {
diff --git a/vendor/github.com/osbuild/images/pkg/osbuild/yum_repos_stage.go b/vendor/github.com/osbuild/images/pkg/osbuild/yum_repos_stage.go
index 297811865..cf2995e25 100644
--- a/vendor/github.com/osbuild/images/pkg/osbuild/yum_repos_stage.go
+++ b/vendor/github.com/osbuild/images/pkg/osbuild/yum_repos_stage.go
@@ -99,17 +99,18 @@ func repoConfigToYumRepository(repo rpmmd.RepoConfig) YumRepository {
 	}
 
 	yumRepo := YumRepository{
-		Id:           repo.Id,
-		Name:         repo.Name,
-		Mirrorlist:   repo.MirrorList,
-		Metalink:     repo.Metalink,
-		BaseURLs:     urls,
-		GPGKey:       keys,
-		GPGCheck:     repo.CheckGPG,
-		RepoGPGCheck: repo.CheckRepoGPG,
-		Enabled:      repo.Enabled,
-		Priority:     repo.Priority,
-		SSLVerify:    sslVerify,
+		Id:             repo.Id,
+		Name:           repo.Name,
+		Mirrorlist:     repo.MirrorList,
+		Metalink:       repo.Metalink,
+		BaseURLs:       urls,
+		GPGKey:         keys,
+		GPGCheck:       repo.CheckGPG,
+		RepoGPGCheck:   repo.CheckRepoGPG,
+		Enabled:        repo.Enabled,
+		Priority:       repo.Priority,
+		SSLVerify:      sslVerify,
+		ModuleHotfixes: repo.ModuleHotfixes,
 	}
 
 	return yumRepo
diff --git a/vendor/github.com/osbuild/images/pkg/rpmmd/repository.go b/vendor/github.com/osbuild/images/pkg/rpmmd/repository.go
index b185864e0..be264d7c0 100644
--- a/vendor/github.com/osbuild/images/pkg/rpmmd/repository.go
+++ b/vendor/github.com/osbuild/images/pkg/rpmmd/repository.go
@@ -23,6 +23,7 @@ type repository struct {
 	CheckGPG       bool     `json:"check_gpg,omitempty"`
 	IgnoreSSL      bool     `json:"ignore_ssl,omitempty"`
 	RHSM           bool     `json:"rhsm,omitempty"`
+	ModuleHotfixes *bool    `json:"module_hotfixes,omitempty"`
 	MetadataExpire string   `json:"metadata_expire,omitempty"`
 	ImageTypeTags  []string `json:"image_type_tags,omitempty"`
 }
@@ -42,6 +43,7 @@ type RepoConfig struct {
 	Priority       *int     `json:"priority,omitempty"`
 	IgnoreSSL      *bool    `json:"ignore_ssl,omitempty"`
 	MetadataExpire string   `json:"metadata_expire,omitempty"`
+	ModuleHotfixes *bool    `json:"module_hotfixes,omitempty"`
 	RHSM           bool     `json:"rhsm,omitempty"`
 	Enabled        *bool    `json:"enabled,omitempty"`
 	ImageTypeTags  []string `json:"image_type_tags,omitempty"`
@@ -58,6 +60,12 @@ func (r *RepoConfig) Hash() string {
 	bpts := func(b *bool) string {
 		return fmt.Sprintf("%T", b)
 	}
+	bptsIgnoreNil := func(b *bool) string {
+		if b == nil {
+			return ""
+		}
+		return bts(*b)
+	}
 	ats := func(s []string) string {
 		return strings.Join(s, "")
 	}
@@ -69,7 +77,8 @@ func (r *RepoConfig) Hash() string {
 		bpts(r.CheckRepoGPG)+
 		bpts(r.IgnoreSSL)+
 		r.MetadataExpire+
-		bts(r.RHSM))))
+		bts(r.RHSM)+
+		bptsIgnoreNil(r.ModuleHotfixes))))
 }
 
 type DistrosRepoConfigs map[string]map[string][]RepoConfig
@@ -245,6 +254,7 @@ func loadRepositoriesFromFile(filename string) (map[string][]RepoConfig, error)
 				CheckGPG:       &repo.CheckGPG,
 				RHSM:           repo.RHSM,
 				MetadataExpire: repo.MetadataExpire,
+				ModuleHotfixes: repo.ModuleHotfixes,
 				ImageTypeTags:  repo.ImageTypeTags,
 			}
 
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 76c699a83..db0d250b4 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -119,7 +119,7 @@ github.com/acarl005/stripansi
 # github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2
 ## explicit; go 1.13
 github.com/asaskevich/govalidator
-# github.com/aws/aws-sdk-go v1.48.13
+# github.com/aws/aws-sdk-go v1.49.0
 ## explicit; go 1.19
 github.com/aws/aws-sdk-go/aws
 github.com/aws/aws-sdk-go/aws/arn
@@ -190,7 +190,7 @@ github.com/cenkalti/backoff/v4
 # github.com/cespare/xxhash/v2 v2.2.0
 ## explicit; go 1.11
 github.com/cespare/xxhash/v2
-# github.com/containers/common v0.57.0
+# github.com/containers/common v0.57.1
 ## explicit; go 1.18
 github.com/containers/common/pkg/retry
 # github.com/containers/image/v5 v5.29.0
@@ -289,7 +289,7 @@ github.com/containers/storage/pkg/unshare
 # github.com/coreos/go-semver v0.3.1
 ## explicit; go 1.8
 github.com/coreos/go-semver/semver
-# github.com/coreos/go-systemd v0.0.0-20190719114852-fd7a80b32e1f
+# github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf
 ## explicit
 github.com/coreos/go-systemd/activation
 # github.com/cyberphone/json-canonicalization v0.0.0-20231011164504-785e29786b46
@@ -656,23 +656,23 @@ github.com/oracle/oci-go-sdk/v54/identity
 github.com/oracle/oci-go-sdk/v54/objectstorage
 github.com/oracle/oci-go-sdk/v54/objectstorage/transfer
 github.com/oracle/oci-go-sdk/v54/workrequests
-# github.com/osbuild/images v0.21.0
+# github.com/osbuild/images v0.24.0
 ## explicit; go 1.19
 github.com/osbuild/images/internal/common
 github.com/osbuild/images/internal/environment
-github.com/osbuild/images/internal/fdo
-github.com/osbuild/images/internal/fsnode
-github.com/osbuild/images/internal/ignition
-github.com/osbuild/images/internal/oscap
 github.com/osbuild/images/internal/pathpolicy
-github.com/osbuild/images/internal/shell
-github.com/osbuild/images/internal/users
 github.com/osbuild/images/internal/workload
 github.com/osbuild/images/pkg/arch
 github.com/osbuild/images/pkg/artifact
 github.com/osbuild/images/pkg/blueprint
 github.com/osbuild/images/pkg/container
 github.com/osbuild/images/pkg/crypt
+github.com/osbuild/images/pkg/customizations/fdo
+github.com/osbuild/images/pkg/customizations/fsnode
+github.com/osbuild/images/pkg/customizations/ignition
+github.com/osbuild/images/pkg/customizations/oscap
+github.com/osbuild/images/pkg/customizations/shell
+github.com/osbuild/images/pkg/customizations/users
 github.com/osbuild/images/pkg/disk
 github.com/osbuild/images/pkg/distro
 github.com/osbuild/images/pkg/distro/fedora


Test patch:
diff --git a/internal/blueprint/blueprint_convert_test.go b/internal/blueprint/blueprint_convert_test.go
index e767d83c7..4422a21f1 100644
--- a/internal/blueprint/blueprint_convert_test.go
+++ b/internal/blueprint/blueprint_convert_test.go
@@ -114,10 +114,11 @@ func TestConvert(t *testing.T) {
 					},
 					InstallationDevice: "/dev/sda",
 					FDO: &FDOCustomization{
-						ManufacturingServerURL: "http://manufacturing.fdo",
-						DiunPubKeyInsecure:     "insecure-pubkey",
-						DiunPubKeyHash:         "hash-pubkey",
-						DiunPubKeyRootCerts:    "root-certs",
+						ManufacturingServerURL:  "http://manufacturing.fdo",
+						DiunPubKeyInsecure:      "insecure-pubkey",
+						DiunPubKeyHash:          "hash-pubkey",
+						DiunPubKeyRootCerts:     "root-certs",
+						DiMfgStringTypeMacIface: "iface",
 					},
 					OpenSCAP: &OpenSCAPCustomization{
 						DataStream: "stream",
@@ -264,10 +265,11 @@ func TestConvert(t *testing.T) {
 					},
 					InstallationDevice: "/dev/sda",
 					FDO: &iblueprint.FDOCustomization{
-						ManufacturingServerURL: "http://manufacturing.fdo",
-						DiunPubKeyInsecure:     "insecure-pubkey",
-						DiunPubKeyHash:         "hash-pubkey",
-						DiunPubKeyRootCerts:    "root-certs",
+						ManufacturingServerURL:  "http://manufacturing.fdo",
+						DiunPubKeyInsecure:      "insecure-pubkey",
+						DiunPubKeyHash:          "hash-pubkey",
+						DiunPubKeyRootCerts:     "root-certs",
+						DiMfgStringTypeMacIface: "iface",
 					},
 					OpenSCAP: &iblueprint.OpenSCAPCustomization{
 						DataStream: "stream",
diff --git a/internal/client/unit_test.go b/internal/client/unit_test.go
index cb0b27751..c4b0f76fa 100644
--- a/internal/client/unit_test.go
+++ b/internal/client/unit_test.go
@@ -71,6 +71,10 @@ func executeTests(m *testing.M) int {
 		panic(err)
 	}
 	distro2 := test_distro.NewTestDistro("test-distro-2", "platform:test-2", "2")
+	_, err = fixture.Workers.RegisterWorker(arch.Name())
+	if err != nil {
+		panic(err)
+	}
 
 	rr := reporegistry.NewFromDistrosRepoConfigs(rpmmd.DistrosRepoConfigs{
 		test_distro.TestDistroName: {
diff --git a/internal/cloudapi/v2/compose_test.go b/internal/cloudapi/v2/compose_test.go
index 885bec88a..2ef67d876 100644
--- a/internal/cloudapi/v2/compose_test.go
+++ b/internal/cloudapi/v2/compose_test.go
@@ -110,10 +110,11 @@ func TestGetBlueprintWithCustomizations(t *testing.T) {
 			}),
 		},
 		Fdo: &FDO{
-			DiunPubKeyHash:         common.ToPtr("pubkeyhash"),
-			DiunPubKeyInsecure:     common.ToPtr("pubkeyinsecure"),
-			DiunPubKeyRootCerts:    common.ToPtr("pubkeyrootcerts"),
-			ManufacturingServerUrl: common.ToPtr("serverurl"),
+			DiunPubKeyHash:          common.ToPtr("pubkeyhash"),
+			DiunPubKeyInsecure:      common.ToPtr("pubkeyinsecure"),
+			DiunPubKeyRootCerts:     common.ToPtr("pubkeyrootcerts"),
+			ManufacturingServerUrl:  common.ToPtr("serverurl"),
+			DiMfgStringTypeMacIface: common.ToPtr("iface"),
 		},
 		Ignition: &Ignition{
 			Firstboot: &IgnitionFirstboot{
@@ -211,10 +212,11 @@ func TestGetBlueprintWithCustomizations(t *testing.T) {
 			},
 		},
 		FDO: &blueprint.FDOCustomization{
-			DiunPubKeyHash:         "pubkeyhash",
-			DiunPubKeyInsecure:     "pubkeyinsecure",
-			DiunPubKeyRootCerts:    "pubkeyrootcerts",
-			ManufacturingServerURL: "serverurl",
+			DiunPubKeyHash:          "pubkeyhash",
+			DiunPubKeyInsecure:      "pubkeyinsecure",
+			DiunPubKeyRootCerts:     "pubkeyrootcerts",
+			ManufacturingServerURL:  "serverurl",
+			DiMfgStringTypeMacIface: "iface",
 		},
 		Ignition: &blueprint.IgnitionCustomization{
 			FirstBoot: &blueprint.FirstBootIgnitionCustomization{
diff --git a/internal/weldr/api_test.go b/internal/weldr/api_test.go
index aab08bbc2..99018e1d8 100644
--- a/internal/weldr/api_test.go
+++ b/internal/weldr/api_test.go
@@ -70,6 +70,9 @@ func createWeldrAPI(tempdir string, fixtureGenerator rpmmd_mock.FixtureGenerator
 			test_distro.TestArchName: {
 				{Name: "test-id", BaseURLs: []string{"http://example.com/test/os/x86_64"}, CheckGPG: common.ToPtr(true)},
 			},
+			test_distro.TestArch2Name: {
+				{Name: "test-id", BaseURLs: []string{"http://example.com/test/os/aarch64"}, CheckGPG: common.ToPtr(true)},
+			},
 		},
 		test_distro.TestDistro2Name: {
 			test_distro.TestArchName: {
@@ -236,7 +239,7 @@ func TestBlueprintsNew(t *testing.T) {
 		{"POST", "/api/v0/blueprints/new", ``, http.StatusBadRequest, `{"status":false,"errors":[{"id":"BlueprintsError","msg":"Missing blueprint"}]}`},
 		{"POST", "/api/v0/blueprints/new", `{"name":"test","description":"Test","distro":"test-distro","packages":[],"version":""}`, http.StatusOK, `{"status":true}`},
 		{"POST", "/api/v0/blueprints/new", `{"name":"test2","description":"Test 2","distro":"test-distro-2","packages":[],"version":""}`, http.StatusOK, `{"status":true}`},
-		{"POST", "/api/v0/blueprints/new", `{"name":"test","description":"Test","distro":"fedora-1","packages":[],"version":""}`, http.StatusBadRequest, `{"status":false,"errors":[{"id":"BlueprintsError","msg":"'fedora-1' is not a valid distribution"}]}`},
+		{"POST", "/api/v0/blueprints/new", `{"name":"test","description":"Test","distro":"fedora-1","packages":[],"version":""}`, http.StatusBadRequest, `{"status":false,"errors":[{"id":"BlueprintsError","msg":"'fedora-1' is not a valid distribution (architecture 'test_arch')"}]}`},
 	}
 
 	tempdir := t.TempDir()
@@ -1191,7 +1194,27 @@ func TestCompose(t *testing.T) {
 			"/api/v1/compose",
 			fmt.Sprintf(`{"blueprint_name": "test-fedora-1","compose_type": "%s","branch": "master"}`, test_distro.TestImageTypeName),
 			http.StatusBadRequest,
-			`{"status": false,"errors":[{"id":"DistroError", "msg":"Unknown distribution: fedora-1"}]}`,
+			`{"status": false,"errors":[{"id":"DistroError", "msg":"Unknown distribution: fedora-1 for arch test_arch"}]}`,
+			nil,
+			[]string{"build_id", "warnings"},
+		},
+		"bad-arch": {
+			false,
+			"POST",
+			"/api/v1/compose",
+			fmt.Sprintf(`{"blueprint_name": "test-badarch","compose_type": "%s","branch": "master"}`, test_distro.TestImageTypeName),
+			http.StatusBadRequest,
+			`{"status": false,"errors":[{"id":"DistroError", "msg":"Unknown distribution: test-distro for arch badarch"}]}`,
+			nil,
+			[]string{"build_id", "warnings"},
+		},
+		"cross-arch": {
+			false,
+			"POST",
+			"/api/v1/compose",
+			fmt.Sprintf(`{"blueprint_name": "test-crossarch","compose_type": "%s","branch": "master"}`, test_distro.TestImageTypeName),
+			http.StatusBadRequest,
+			`{"status": false,"errors":[{"id":"ComposePushErrored", "msg":"No worker for arch 'test_arch2'  available"}]}`,
 			nil,
 			[]string{"build_id", "warnings"},
 		},
@@ -1300,6 +1323,8 @@ func TestCompose(t *testing.T) {
 	tempdir := t.TempDir()
 	for name, c := range cases {
 		api, s := createWeldrAPI(tempdir, rpmmd_mock.NoComposesFixture)
+		_, err = api.workers.RegisterWorker(arch.Name())
+		require.NoError(t, err)
 		test.TestRoute(t, api, c.External, c.Method, c.Path, c.Body, c.ExpectedStatus, c.ExpectedJSON, c.IgnoreFields...)
 
 		if c.ExpectedStatus != http.StatusOK {
@@ -2271,6 +2296,8 @@ func TestComposePOST_ImageTypeDenylist(t *testing.T) {
 
 	for _, c := range cases {
 		api, s := createWeldrAPI2(tempdir, rpmmd_mock.NoComposesFixture, c.imageTypeDenylist)
+		_, err = api.workers.RegisterWorker(arch.Name())
+		require.NoError(t, err)
 		test.TestRoute(t, api, true, "POST", c.Path, c.Body, c.ExpectedStatus, c.ExpectedJSON, c.IgnoreFields...)
 
 		if c.ExpectedStatus != http.StatusOK {
diff --git a/internal/weldr/compose_test.go b/internal/weldr/compose_test.go
index 38907c270..b91905567 100644
--- a/internal/weldr/compose_test.go
+++ b/internal/weldr/compose_test.go
@@ -42,6 +42,8 @@ func TestComposeStatusFromLegacyError(t *testing.T) {
 		t.Fatalf("error serializing osbuild manifest: %v", err)
 	}
 
+	_, err = api.workers.RegisterWorker(arch.Name())
+	require.NoError(t, err)
 	jobId, err := api.workers.EnqueueOSBuild(arch.Name(), &worker.OSBuildJob{Manifest: mf}, "")
 	require.NoError(t, err)
 
@@ -95,6 +97,8 @@ func TestComposeStatusFromJobError(t *testing.T) {
 		t.Fatalf("error serializing osbuild manifest: %v", err)
 	}
 
+	_, err = api.workers.RegisterWorker(arch.Name())
+	require.NoError(t, err)
 	jobId, err := api.workers.EnqueueOSBuild(arch.Name(), &worker.OSBuildJob{Manifest: mf}, "")
 	require.NoError(t, err)
 
diff --git a/test/cases/cross-distro.sh b/test/cases/cross-distro.sh
index 918177476..22f421c22 100755
--- a/test/cases/cross-distro.sh
+++ b/test/cases/cross-distro.sh
@@ -146,7 +146,7 @@ EOF
 
     # there is a different reponse if legacy composer-cli is used
     if rpm -q --quiet weldr-client; then
-        EXPECTED_RESPONSE="ERROR: BlueprintsError: '$REMAINING_DISTRO' is not a valid distribution"
+        EXPECTED_RESPONSE="ERROR: BlueprintsError: '$REMAINING_DISTRO' is not a valid distribution (architecture '$(uname -m)')"
     else
         EXPECTED_RESPONSE="'$REMAINING_DISTRO' is not a valid distribution"
         RESPONSE=${RESPONSE#*: }
diff --git a/test/cases/ostree-simplified-installer.sh b/test/cases/ostree-simplified-installer.sh
index 815bcffef..025596cc9 100755
--- a/test/cases/ostree-simplified-installer.sh
+++ b/test/cases/ostree-simplified-installer.sh
@@ -26,6 +26,11 @@ do
 done
 # Prepare service api server config filef
 sudo /usr/local/bin/yq -iy '.service_info.diskencryption_clevis |= [{disk_label: "/dev/vda4", reencrypt: true, binding: {pin: "tpm2", config: "{}"}}]' /etc/fdo/aio/configs/serviceinfo_api_server.yml
+if [[ "$VERSION_ID" == "9.3" || "$VERSION_ID" == "9" ]]; then
+    # Modify manufacturing server config to process fdo
+    # guest interface during onboarding
+    sudo sed -i 's/SerialNumber/MACAddress/g' /etc/fdo/aio/configs/manufacturing_server.yml
+fi
 sudo systemctl restart fdo-aio
 
 # workaround for bug https://bugzilla.redhat.com/show_bug.cgi?id=2213660
@@ -538,6 +543,9 @@ done
 # Check image installation result
 check_result
 
+# Get VM interface name in advance
+MFG_GUEST_INT_NAME=$(sudo ssh "${SSH_OPTIONS[@]}" -i "${SSH_KEY}" "simple@${EDGE_GUEST_ADDRESS}" "nmcli device status | grep ethernet & exit" | awk '{print $1}')
+
 greenprint "🕹 Get ostree install commit value"
 INSTALL_HASH=$(curl "${PROD_REPO_URL}/refs/heads/${OSTREE_REF}")
 
@@ -610,6 +618,12 @@ manufacturing_server_url="http://${FDO_SERVER_ADDRESS}:8080"
 diun_pub_key_insecure="true"
 EOF
 
+if [[ "$VERSION_ID" == "9.3" || "$VERSION_ID" == "9" ]]; then
+    tee -a "$BLUEPRINT_FILE" > /dev/null << EOF
+di_mfg_string_type_mac_iface="${MFG_GUEST_INT_NAME}"
+EOF
+fi
+
 # workaround selinux bug https://bugzilla.redhat.com/show_bug.cgi?id=2026795
 if [[ "$VERSION_ID" == "9.3" || "$VERSION_ID" == "9" ]]; then
     tee -a "$BLUEPRINT_FILE" > /dev/null << EOF
@@ -618,6 +632,7 @@ append = "enforcing=0"
 EOF
 fi
 
+
 greenprint "📄 installer blueprint"
 cat "$BLUEPRINT_FILE"
 
@@ -743,6 +758,7 @@ sudo ansible-playbook -v -i "${TEMPDIR}"/inventory \
     -e edge_type=edge-simplified-installer \
     -e fdo_credential="true" \
     -e sysroot_ro="$SYSROOT_RO" \
+    -e mfg_guest_int_name="${MFG_GUEST_INT_NAME}" \
     -e fips="${FIPS}" \
     /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0
 check_result
@@ -787,6 +803,12 @@ manufacturing_server_url="http://${FDO_SERVER_ADDRESS}:8080"
 diun_pub_key_hash="${DIUN_PUB_KEY_HASH}"
 EOF
 
+if [[ "$VERSION_ID" == "9.3" || "$VERSION_ID" == "9" ]]; then
+    tee -a "$BLUEPRINT_FILE" > /dev/null << EOF
+di_mfg_string_type_mac_iface="${MFG_GUEST_INT_NAME}"
+EOF
+fi
+
 # workaround selinux bug https://bugzilla.redhat.com/show_bug.cgi?id=2026795
 if [[ "$VERSION_ID" == "9.3" || "$VERSION_ID" == "9" ]]; then
     tee -a "$BLUEPRINT_FILE" > /dev/null << EOF
@@ -922,6 +944,7 @@ sudo ansible-playbook -v -i "${TEMPDIR}"/inventory \
     -e edge_type=edge-simplified-installer \
     -e fdo_credential="true" \
     -e sysroot_ro="$SYSROOT_RO" \
+    -e mfg_guest_int_name="${MFG_GUEST_INT_NAME}" \
     -e fips="${FIPS}" \
     /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0
 check_result
@@ -1060,6 +1083,7 @@ sudo ansible-playbook -v -i "${TEMPDIR}"/inventory \
     -e edge_type=edge-simplified-installer \
     -e fdo_credential="true" \
     -e sysroot_ro="$SYSROOT_RO" \
+    -e mfg_guest_int_name="${MFG_GUEST_INT_NAME}" \
     -e fips="${FIPS}" \
     /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0
 
@@ -1112,6 +1136,12 @@ diun_pub_key_root_certs="""
 ${DIUN_PUB_KEY_ROOT_CERTS}"""
 EOF
 
+if [[ "$VERSION_ID" == "9.3" || "$VERSION_ID" == "9" ]]; then
+    tee -a "$BLUEPRINT_FILE" > /dev/null << EOF
+di_mfg_string_type_mac_iface="${MFG_GUEST_INT_NAME}"
+EOF
+fi
+
 # workaround selinux bug https://bugzilla.redhat.com/show_bug.cgi?id=2026795
 if [[ "$VERSION_ID" == "9.3" || "$VERSION_ID" == "9" ]]; then
     tee -a "$BLUEPRINT_FILE" > /dev/null << EOF
@@ -1228,6 +1258,7 @@ sudo ansible-playbook -v -i "${TEMPDIR}"/inventory \
     -e edge_type=edge-simplified-installer \
     -e fdo_credential="true" \
     -e sysroot_ro="$SYSROOT_RO" \
+    -e mfg_guest_int_name="${MFG_GUEST_INT_NAME}" \
     -e fips="${FIPS}" \
     /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0
 check_result
@@ -1370,6 +1401,7 @@ sudo ansible-playbook -v -i "${TEMPDIR}"/inventory \
     -e edge_type=edge-simplified-installer \
     -e fdo_credential="true" \
     -e sysroot_ro="$SYSROOT_RO" \
+    -e mfg_guest_int_name="${MFG_GUEST_INT_NAME}" \
     -e fips="${FIPS}" \
     /usr/share/tests/osbuild-composer/ansible/check_ostree.yaml || RESULTS=0
 
diff --git a/test/data/ansible/check_ostree.yaml b/test/data/ansible/check_ostree.yaml
index 2d2106e1f..f7cd00b11 100644
--- a/test/data/ansible/check_ostree.yaml
+++ b/test/data/ansible/check_ostree.yaml
@@ -1007,6 +1007,29 @@
     - debug:
         var: result_fdo_client_linuxapp_journalctl
 
+    # case: check fdo device mac in device info field within device credentials
+    - name: Check mac address within device credentials
+      block:
+        - name: Check MAC address of interface taken from fdo customization
+          shell: "cat /sys/class/net/{{ mfg_guest_int_name }}/address"
+          register: fdo_cust_mac_add
+        - name: Check mac within fdo device credentials
+          shell: fdo-owner-tool dump-device-credential /etc/device-credentials | grep -E 'Device Info' | awk '{print $3}'
+          register: dev_credentials_mac_add
+        - assert:
+            that:
+              - dev_credentials_mac_add.stdout == fdo_cust_mac_add.stdout
+            fail_msg: "Wrong device info within device credentials"
+            success_msg: "Device onboarded successfully via network interface"
+      always:
+        - set_fact:
+            total_counter: "{{ total_counter | int + 1 }}"
+      rescue:
+        - name: failed count + 1
+          set_fact:
+            failed_counter: "{{ failed_counter | int + 1 }}"
+      when: fdo_credential == "true"
+
     # case: checking firewall customizations
     - name: Check applied firewall customizations
       block: