feat(images): add 1p-vm-base-gen2-fips image

[binujp]

Summary

• add the Azure Linux 4.0 1P VM Base Gen2 FIPS UEFI image
• support x86_64 and aarch64 with FIPS enabled
• use package-provided cloud-init, chrony/PTP, and Hyper-V configuration
• remove all KIWI file injections and their loose configuration files
• use systemd-networkd without netplan or post-install config.sh customization
• include WALinuxAgent for Azure provisioning

Testing

• built with azldev image build 1p-vm-base-gen2-fips --arch x86_64
• passed azldev image test 1p-vm-base-gen2-fips (9 passed, 7 skipped)

AB#22820

[Copilot]

Pull request overview

Adds a FIPS-enabled Azure Linux 4.0 Gen2 VM image for x86_64 and aarch64.

Changes:

• Registers the new image and static test suite.
• Defines UEFI/VHD architecture settings and FIPS boot configuration.
• Includes Azure provisioning, networking, and Hyper-V packages.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
base/images/images.toml	Registers the image and capabilities.
base/images/1p-vm-base-gen2-fips/1p-vm-base-gen2-fips.kiwi	Defines the image layout, packages, and boot settings.

Suppressed comments (1)

base/images/1p-vm-base-gen2-fips/1p-vm-base-gen2-fips.kiwi:53

• The aarch64 path also leaves dracut's emergency shell enabled, unlike base/images/vm-base/vm-base.kiwi:67. Disable it so an early boot failure does not expose a root initramfs shell through the serial console.

            kernelcmdline="console=ttyAMA0 fips=1"

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (4)

base/images/images.toml:100

• This runtime-managed image has only the canonical registration, although this registry requires canonical/-dev pairs with matching Kiwi profiles (base/images/images.toml:5-27; compare vm-base at lines 32-66). Without the -dev entry, developers cannot build the same image against the dev runtime repositories, and the canonical image is the sole exception despite shipping a package manager. Add a 1p-vm-base-gen2-fips-dev registration and corresponding profiles selecting azurelinux-repos versus azurelinux-repos-dev.

[images.1p-vm-base-gen2-fips]
description = "1P VM Base Gen2 FIPS Image (UEFI)"
definition = { type = "kiwi", path = "1p-vm-base-gen2-fips/1p-vm-base-gen2-fips.kiwi" }

base/images/1p-vm-base-gen2-fips/1p-vm-base-gen2-fips.kiwi:70

• Local Kiwi builds are expected to consume the azl4-dev blob; base/images/images.toml:21-23 documents that Koji replaces this source for distro builds, and both existing VM definitions follow it. Pointing this image directly at PMC beta makes local builds use older/different RPMs than the development build pipeline and may hide integration failures.

        <source path="https://packages.microsoft.com/azurelinux/4.0/beta/base/$basearch" />

base/images/images.toml:103

• This suite currently provides no image-specific validation for the new VM. Tests under cases/static/vm-base/ are auto-marked for the vm-base family (utils/pytest_plugin.py:182-197,246-251), so this image name skips the kernel and EFI partition checks; there are also no checks that fips=1, the FIPS initramfs content, or runtime FIPS mode are effective. Add tests for this image family, including a boot/runtime FIPS assertion, rather than treating the generic 9-pass run as validation of the feature.

tests.test-suites = [
  { name = "static-image-checks" },
]

base/images/1p-vm-base-gen2-fips/1p-vm-base-gen2-fips.kiwi:40

• The PR introduces an architecture-specific aarch64 build path, but the reported testing only built and tested --arch x86_64. EFI package resolution, the ARM kernel/initramfs, and serial boot configuration differ on aarch64, so the claimed ARM support remains unvalidated. Build and run the image tests for --arch aarch64 before approval.

    <preferences arch="aarch64">
        <version>0.1</version>

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (4)

base/images/images.toml:100

• This package-managed image ships azurelinux-repos but has no matching -dev registry/profile variant. The registry contract requires canonical and -dev variants for runtime-managed images, with only distroless images exempt (base/images/images.toml:5-27); add a 1p-vm-base-gen2-fips-dev entry, matching KIWI profiles, and profile-scoped azurelinux-repos/azurelinux-repos-dev sections.

definition = { type = "kiwi", path = "1p-vm-base-gen2-fips/1p-vm-base-gen2-fips.kiwi" }

base/images/images.toml:103

• The static suite does not validate the defining FIPS behavior: there is no test family for this new image, existing vm-base kernel/UEFI tests are auto-skipped for this name, and shared tests contain no FIPS assertion. Add image-specific EFI/kernel/initramfs checks and a boot smoke test asserting /proc/sys/crypto/fips_enabled is 1.

tests.test-suites = [
  { name = "static-image-checks" },
]

base/images/1p-vm-base-gen2-fips/1p-vm-base-gen2-fips.kiwi:70

• Local KIWI builds are expected to consume the azl4-dev build repository; the canonical azurelinux-repos package separately controls the resulting OS's PMC beta runtime repository (base/images/images.toml:9-23, base/images/vm-base/vm-base.kiwi:82-92). Building directly from PMC beta can omit current distro inputs and makes local validation diverge from every other managed image.

        <source path="https://packages.microsoft.com/azurelinux/4.0/beta/base/$basearch" />

base/images/1p-vm-base-gen2-fips/1p-vm-base-gen2-fips.kiwi:43

• The PR adds a distinct aarch64 image path, but the reported validation only built and tested x86_64. Because this path selects different console, firmware, shim, and GRUB packages, build and run the image tests with --arch aarch64 before merging the claimed architecture support.

    <preferences arch="aarch64">
        <version>0.1</version>
        <packagemanager>dnf5</packagemanager>
        <locale>en_US</locale>
        <keytable>us</keytable>

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (4)

base/images/images.toml:100

• This runtime-package-managed image is missing the required -dev sibling/profile. The registry contract at base/images/images.toml:5-27 and every existing managed image pair use azurelinux-repos for canonical builds and azurelinux-repos-dev for dev builds; only distroless images are exempt. Please add matching canonical/dev KIWI profiles, profile-scoped repo packages, and an images.1p-vm-base-gen2-fips-dev registration.

[images.1p-vm-base-gen2-fips]
description = "1P VM Base Gen2 FIPS Image (UEFI)"
definition = { type = "kiwi", path = "1p-vm-base-gen2-fips/1p-vm-base-gen2-fips.kiwi" }

base/images/1p-vm-base-gen2-fips/1p-vm-base-gen2-fips.kiwi:70

• Local KIWI builds are expected to consume the shared azl4-dev source, with Koji overriding it for distro builds; see base/images/images.toml:21-23 and base/images/vm-base/vm-base.kiwi:83-92. Pointing this definition at PMC beta instead makes local builds depend on already-published beta content and can omit newer packages available in the development source.

        <source path="https://packages.microsoft.com/azurelinux/4.0/beta/base/$basearch" />

base/images/images.toml:103

• The registered suite does not exercise the VM-specific checks for this image: family matching only accepts vm-base or names beginning vm-base- (tests/utils/pytest_plugin.py:182-197), while this image is named 1p-vm-base-gen2-fips. There are also no FIPS checks in the test tree, so the reported static run cannot establish that the image boots with FIPS enabled. Add coverage for this image family and a boot-time assertion such as /proc/sys/crypto/fips_enabled == 1.

tests.test-suites = [
  { name = "static-image-checks" },
]

base/images/1p-vm-base-gen2-fips/1p-vm-base-gen2-fips.kiwi:39

• The PR reports only an x86_64 build/test, so this separate aarch64 boot configuration and its architecture-specific EFI package path remain unvalidated despite aarch64 support being part of the change. Please build and run the image tests with --arch aarch64 as well.

    <preferences arch="aarch64">

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (3)

base/images/images.toml:100

• This runtime-managed Kiwi image ships azurelinux-repos, but it has no matching -dev registration/profile. The registry contract at base/images/images.toml:5-27 and the comparable VM implementation at base/images/vm-base/vm-base.kiwi:20-22,176-198 define canonical and -dev variants so contributors can produce an image whose runtime repositories target azl4-dev. Please add the sibling registry entry and scope azurelinux-repos/azurelinux-repos-dev through matching Kiwi profiles.

definition = { type = "kiwi", path = "1p-vm-base-gen2-fips/1p-vm-base-gen2-fips.kiwi" }

base/images/1p-vm-base-gen2-fips/1p-vm-base-gen2-fips.kiwi:70

• The local build repository must be azl4-dev, not PMC beta. base/images/images.toml:21-23 states that all variants build from azl4-dev and Koji overrides this source, and base/images/vm-base/vm-base.kiwi:82-92 follows that pattern. Using beta here can silently validate stale published RPMs instead of the current distro package set.

        <source path="https://packages.microsoft.com/azurelinux/4.0/beta/base/$basearch" />

base/images/1p-vm-base-gen2-fips/1p-vm-base-gen2-fips.kiwi:24

• None of the in-repository image tests validates the defining FIPS behavior: the shared static suite only checks generic packages, footprint, and VM kernel presence, so the reported 9-pass run can succeed even if the built VM boots with /proc/sys/crypto/fips_enabled unset. Add an image-specific boot/runtime assertion that FIPS is active; because this definition also adds a separate aarch64 boot path, exercise that assertion for both architectures.

            kernelcmdline="console=ttyS0 fips=1 rd.shell=0"

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (5)

base/images/images.toml:100

• This runtime-package-managed image ships azurelinux-repos but has no matching -dev registry entry or Kiwi profile. The registry contract at base/images/images.toml:5-27 requires canonical/-dev pairs (except distroless images), with identical capabilities/tests and azurelinux-repos-dev in the dev profile. Add the sibling registration and profile so development builds do not point at PMC beta at runtime.

[images.1p-vm-base-gen2-fips]
description = "1P VM Base Gen2 FIPS Image (UEFI)"
definition = { type = "kiwi", path = "1p-vm-base-gen2-fips/1p-vm-base-gen2-fips.kiwi" }

base/images/1p-vm-base-gen2-fips/1p-vm-base-gen2-fips.kiwi:70

• All existing Kiwi definitions use the azl4-dev blob as their local build-time source and rely on Koji to override it (for example, base/images/vm-base/vm-base.kiwi:82-92 and base/images/minimal-os/minimal-os.kiwi:45-55). Pointing this image at PMC beta instead makes local builds consume the published, potentially stale package set rather than the development set being validated.

        <source path="https://packages.microsoft.com/azurelinux/4.0/beta/base/$basearch" />

base/images/images.toml:102

• The static-image-checks suite does not run the existing VM-specific checks for this image. Tests under cases/static/vm-base/ are marked image("vm-base"), and the matcher at tests/utils/pytest_plugin.py:182-197 only accepts vm-base or names beginning with vm-base-; 1p-vm-base-gen2-fips therefore skips the kernel-module and UEFI partition checks. Reuse those checks based on the machine-bootable capability or otherwise map this image into the VM family.

  { name = "static-image-checks" },

base/images/1p-vm-base-gen2-fips/1p-vm-base-gen2-fips.kiwi:39

• The new aarch64 definition and architecture-specific boot packages are unverified: the PR testing only builds and tests x86_64. Build and run the registered checks for --arch aarch64 before claiming support for this branch.

    <preferences arch="aarch64">

base/images/1p-vm-base-gen2-fips/1p-vm-base-gen2-fips.kiwi:160

• The comment has an unmatched closing parenthesis.

        <!-- Hyper-V via kernel-modules + hyperv-daemons) -->