feat(images): add 1p-vm-base-gen1-fips image

[binujp]

Summary

• add the Azure Linux 4.0 1P VM Base Gen1 FIPS BIOS image
• enable FIPS through the kernel command line and dracut-fips
• use package-provided cloud-init, chrony/PTP, and Hyper-V configuration
• remove all KIWI file injections and their loose configuration files
• use systemd-networkd without netplan or post-install config.sh customization

Testing

• built with azldev image build 1p-vm-base-gen1-fips --arch x86_64
• passed azldev image test 1p-vm-base-gen1-fips (9 passed, 7 skipped)

AB#22819

[Copilot]

Pull request overview

Adds the Azure Linux 4.0 1P Gen1 FIPS VM image.

Changes:

• Registers the image and static test suite.
• Defines its VHD, FIPS, boot, networking, and Azure package configuration.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
base/images/images.toml	Registers image capabilities and tests.
base/images/1p-vm-base-gen1-fips/1p-vm-base-gen1-fips.kiwi	Defines the bootable FIPS image.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (3)

base/images/images.toml:103

• static-image-checks does not validate the defining behaviors of this new image. The existing VM checks under cases/static/vm-base/ are auto-marked for the vm-base family, so this 1p-... name skips them, and the suite never boots the VHD to verify legacy BIOS startup or crypto.fips_enabled=1. Add image-specific static checks plus a boot/runtime test suite that asserts FIPS is active before treating the image as tested.

tests.test-suites = [
  { name = "static-image-checks" },
]

base/images/1p-vm-base-gen1-fips/1p-vm-base-gen1-fips.kiwi:130

• Remove the unmatched closing parenthesis in this comment.

        <!-- Hyper-V via kernel-modules + hyperv-daemons) -->

base/images/images.toml:100

• This runtime-managed image is missing the required -dev sibling/profile. The established pattern registers both variants and scopes azurelinux-repos versus azurelinux-repos-dev by profile (see base/images/images.toml:33-66 and base/images/vm-base/vm-base.kiwi:9-23,170-199); without that, contributors cannot build the equivalent image pointed at azl4-dev runtime repositories. Please add both registry entries and profile-scoped repo packages.

[images.1p-vm-base-gen1-fips]
description = "1P VM Base Gen1 FIPS Image (BIOS)"
definition = { type = "kiwi", path = "1p-vm-base-gen1-fips/1p-vm-base-gen1-fips.kiwi" }

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (3)

base/images/images.toml:103

• The static suite does not exercise this image's VM-specific checks: tests under cases/static/vm-base/ are selected only when the image name is vm-base or starts with vm-base-, so this 1p-vm-base... image skips the partition and kernel checks. It also has no runtime suite to verify that the BIOS image boots with FIPS active. Add image-specific static checks and a boot-time FIPS smoke test (or register an appropriate runtime suite) so the image's defining BIOS/FIPS behavior is covered.

tests.test-suites = [
  { name = "static-image-checks" },
]

base/images/1p-vm-base-gen1-fips/1p-vm-base-gen1-fips.kiwi:129

• The comment ends with an unmatched ). Replace it with a period or add the corresponding opening parenthesis.

        <!-- Hyper-V via kernel-modules + hyperv-daemons) -->

base/images/images.toml:100

• This runtime-managed image ships azurelinux-repos but has no -dev registry entry/profile that ships azurelinux-repos-dev. Runtime-managed Kiwi images are paired this way throughout the file (for example, vm-base/vm-base-dev at lines 32–66), with only package-manager-free distroless images exempt. Add a matching 1p-vm-base-gen1-fips-dev entry and Kiwi profile so local/dev builds do not bake production runtime repositories.

[images.1p-vm-base-gen1-fips]
description = "1P VM Base Gen1 FIPS Image (BIOS)"
definition = { type = "kiwi", path = "1p-vm-base-gen1-fips/1p-vm-base-gen1-fips.kiwi" }

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (4)

base/images/images.toml:103

• The configured test run never exercises this VM's boot path or FIPS state. Tests under cases/static/vm-base/ are auto-marked for the vm-base family (pytest_plugin.py:182-197,246-251), so this image name skips the kernel and partition checks; the reported 9 passed/7 skipped are only generic checks. Add image-specific BIOS/FIPS checks plus a LISA/runtime boot suite that verifies FIPS is active, rather than relying solely on offline package inspection.

tests.test-suites = [
  { name = "static-image-checks" },
]

base/images/1p-vm-base-gen1-fips/1p-vm-base-gen1-fips.kiwi:130

• Remove the unmatched closing parenthesis from this comment.

        <!-- Hyper-V via kernel-modules + hyperv-daemons) -->

base/images/1p-vm-base-gen1-fips/1p-vm-base-gen1-fips.kiwi:40

• This is the only KIWI image that builds directly from PMC beta. The registry contract says local image builds use the azl4-dev source and Koji overrides it for distro builds (base/images/images.toml:21-23), as every other KIWI definition does. Using beta here means local validation can miss current development packages; point this source at the shared azl4-dev repository.

        <source path="https://packages.microsoft.com/azurelinux/4.0/beta/base/$basearch" />

base/images/images.toml:100

• This runtime-managed image has no -dev sibling or KIWI profile, although the registry contract requires canonical/-dev pairs to ship azurelinux-repos and azurelinux-repos-dev respectively; only distroless images are exempt (base/images/images.toml:5-27). Add matching canonical/dev profiles and register 1p-vm-base-gen1-fips-dev, otherwise the development-repository variant cannot be built or tested.

[images.1p-vm-base-gen1-fips]
description = "1P VM Base Gen1 FIPS Image (BIOS)"
definition = { type = "kiwi", path = "1p-vm-base-gen1-fips/1p-vm-base-gen1-fips.kiwi" }

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (4)

base/images/images.toml:103

• Although static-image-checks is registered, this image name does not match the existing vm-base test family: pytest_plugin.py:182-197 only accepts vm-base or vm-base-*, so the kernel and partition tests under cases/static/vm-base/ are skipped for 1p-vm-base-gen1-fips. Add image-specific BIOS/FIPS checks (or an explicit family mapping) so the suite verifies boot layout, kernel contents, fips=1, and the FIPS initramfs rather than only shared RPM metadata.

tests.test-suites = [
  { name = "static-image-checks" },
  { name = "lisa-main" },

base/images/1p-vm-base-gen1-fips/1p-vm-base-gen1-fips.kiwi:130

• Remove the unmatched closing parenthesis from this comment.

        <!-- Hyper-V via kernel-modules + hyperv-daemons) -->

base/images/images.toml:100

• This runtime-package-managed image is registered only as the canonical variant. The registry contract at base/images/images.toml:5-27 and every existing runtime-managed family pair the canonical entry with a -dev entry/profile so local validation can ship azurelinux-repos-dev instead of PMC repos. Please add the matching 1p-vm-base-gen1-fips-dev registration and Kiwi profile/package selection; the only documented single-variant exception is distroless images without package management.

[images.1p-vm-base-gen1-fips]
description = "1P VM Base Gen1 FIPS Image (BIOS)"
definition = { type = "kiwi", path = "1p-vm-base-gen1-fips/1p-vm-base-gen1-fips.kiwi" }

base/images/1p-vm-base-gen1-fips/1p-vm-base-gen1-fips.kiwi:40

• The repository-wide image contract uses the azl4-dev blob as the local build-time source and lets Koji override it (base/images/images.toml:21-23; base/images/vm-base/vm-base.kiwi:82-92). Pointing this definition directly at PMC beta means local builds cannot consume current azl4-dev RPMs and makes canonical and future -dev builds use a different input source from every other image. Use the standard azl4-dev source here; keep azurelinux-repos responsible only for the image's runtime repository.

    <!-- Build-time package source; koji overrides this for distro builds. -->
    <repository type="rpm-md" alias="azurelinux-base">
        <source path="https://packages.microsoft.com/azurelinux/4.0/beta/base/$basearch" />

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (4)

base/images/1p-vm-base-gen1-fips/1p-vm-base-gen1-fips.kiwi:130

• Remove the unmatched closing parenthesis from this comment.

        <!-- Hyper-V via kernel-modules + hyperv-daemons) -->

base/images/images.toml:102

• static-image-checks only gives this image the generic checks. The plugin marks cases/static/vm-base/ tests as image("vm-base") and matches only that exact name or a vm-base-* prefix (tests/utils/pytest_plugin.py:182-197,246-251), so this 1p-* image skips the existing kernel-module and root-partition checks, and there is no BIOS-specific partition check. Add static tests for this family or refactor the shared bootable-VM checks to use the machine-bootable capability.

tests.test-suites = [
  { name = "static-image-checks" },

base/images/1p-vm-base-gen1-fips/1p-vm-base-gen1-fips.kiwi:40

• This is the only KIWI definition that builds directly from PMC beta. The repository-wide image convention (base/images/images.toml:21-23, followed by every other .kiwi) uses azl4-dev for local build inputs and lets Koji override that source; using beta here makes local builds consume older published RPMs instead of current development packages. Point the build-time repository at the same azl4-dev source as the other images.

    <!-- Build-time package source; koji overrides this for distro builds. -->
    <repository type="rpm-md" alias="azurelinux-base">
        <source path="https://packages.microsoft.com/azurelinux/4.0/beta/base/$basearch" />

base/images/images.toml:100

• This runtime-managed image installs azurelinux-repos but has no matching -dev registration/profile. The registry convention at base/images/images.toml:5-27 requires canonical and -dev variants to differ only by azurelinux-repos versus azurelinux-repos-dev; only distroless images are exempt. Add the paired registry entry and KIWI profiles so local development can build and test the dev-repository variant.

[images.1p-vm-base-gen1-fips]
description = "1P VM Base Gen1 FIPS Image (BIOS)"
definition = { type = "kiwi", path = "1p-vm-base-gen1-fips/1p-vm-base-gen1-fips.kiwi" }