fix: make amdcpu IOMMU %post layout-aware and idempotent

Same fix as cd4302c for intelcpu: the bare sed against /etc/default/grub
missed systemd-boot and already-generated GRUB+BLS boot entries. Update
every kernel-argument surface idempotently, guarded by file existence:
/etc/kernel/cmdline, /etc/default/grub, and the options line of every
/boot/loader/entries/*.conf. Guard the nested=1 append as well.

cook/ingredients/hypervisor/amdcpu.ks

@@ -2,8 +2,27 @@
 
 %post --nochroot --log=/mnt/sysimage/root/hypervisor-amdcpu-post.log # Beginning of %post section. Those commands are executed outside the chroot environment. Logging is enabled to help with post-installation troubleshooting
 
-sed -i 's/\(quiet\)/\1 iommu=pt rd.driver.pre=vfio-pci/i' /mnt/sysimage/etc/default/grub # Load kernel modules in GRUB. 
+# Kernel arguments cannot be attached to a single canonical location at %post time:
+# anaconda always creates /etc/kernel/cmdline (kernel-install source for both
+# systemd-boot and GRUB+BLS layouts), but GRUB+BLS boot entries have already been
+# generated from it by the kernel package scriptlets, and non-BLS flows still read
+# /etc/default/grub. Update every surface idempotently, guarded by file existence.
 
-echo "options kvm_amd nested=1" >> /mnt/sysimage/etc/modprobe.d/kvm.conf # Add support for nested virtualization
+IOMMU_ARGS="iommu=pt rd.driver.pre=vfio-pci"
+
+if [ -f /mnt/sysimage/etc/kernel/cmdline ]; then # kernel-install source (systemd-boot now, GRUB+BLS for future kernels)
+    grep -q "iommu=pt" /mnt/sysimage/etc/kernel/cmdline || echo " $IOMMU_ARGS" >> /mnt/sysimage/etc/kernel/cmdline # Append IOMMU arguments once
+fi
+
+if [ -f /mnt/sysimage/etc/default/grub ]; then # GRUB: arguments for grub.cfg-based boot flows
+    grep -q "iommu=pt" /mnt/sysimage/etc/default/grub || sed -i "s/\(quiet\)/\1 $IOMMU_ARGS/i" /mnt/sysimage/etc/default/grub # Append IOMMU arguments once
+fi
+
+for bls_entry in /mnt/sysimage/boot/loader/entries/*.conf; do # Already-generated boot entries share one "options" line shape
+    [ -e "$bls_entry" ] || continue # Nothing matched: the glob stays literal
+    grep -q "iommu=pt" "$bls_entry" || sed -i "s/^\(options .*\)/\1 $IOMMU_ARGS/" "$bls_entry" # Patch the options line of each entry once
+done
+
+grep -q "nested=1" /mnt/sysimage/etc/modprobe.d/kvm.conf 2>/dev/null || echo "options kvm_amd nested=1" >> /mnt/sysimage/etc/modprobe.d/kvm.conf # Add support for nested virtualization on AMD CPUs, exactly once
 
 %end # End of the %post section

cook/ingredients/hypervisor/intelcpu.ks

@@ -2,8 +2,27 @@
 
 %post --nochroot --log=/mnt/sysimage/root/hypervisor-intelcpu-post.log # Beginning of %post section. Those commands are executed outside the chroot environment. Logging is enabled to help with post-installation troubleshooting
 
-sed -i 's/\(quiet\)/\1 intel_iommu=on iommu=pt rd.driver.pre=vfio-pci/i' /mnt/sysimage/etc/default/grub # Load kernel modules in GRUB.
+# Kernel arguments cannot be attached to a single canonical location at %post time:
+# anaconda always creates /etc/kernel/cmdline (kernel-install source for both
+# systemd-boot and GRUB+BLS layouts), but GRUB+BLS boot entries have already been
+# generated from it by the kernel package scriptlets, and non-BLS flows still read
+# /etc/default/grub. Update every surface idempotently, guarded by file existence.
 
-echo "options kvm_intel nested=1" >> /mnt/sysimage/etc/modprobe.d/kvm.conf # Add support for nested virtualization on Intel CPUs
+IOMMU_ARGS="intel_iommu=on iommu=pt rd.driver.pre=vfio-pci"
+
+if [ -f /mnt/sysimage/etc/kernel/cmdline ]; then # kernel-install source (systemd-boot now, GRUB+BLS for future kernels)
+    grep -q "intel_iommu=on" /mnt/sysimage/etc/kernel/cmdline || echo " $IOMMU_ARGS" >> /mnt/sysimage/etc/kernel/cmdline # Append IOMMU arguments once
+fi
+
+if [ -f /mnt/sysimage/etc/default/grub ]; then # GRUB: arguments for grub.cfg-based boot flows
+    grep -q "intel_iommu=on" /mnt/sysimage/etc/default/grub || sed -i "s/\(quiet\)/\1 $IOMMU_ARGS/i" /mnt/sysimage/etc/default/grub # Append IOMMU arguments once
+fi
+
+for bls_entry in /mnt/sysimage/boot/loader/entries/*.conf; do # Already-generated boot entries share one "options" line shape
+    [ -e "$bls_entry" ] || continue # Nothing matched: the glob stays literal
+    grep -q "intel_iommu=on" "$bls_entry" || sed -i "s/^\(options .*\)/\1 $IOMMU_ARGS/" "$bls_entry" # Patch the options line of each entry once
+done
+
+grep -q "nested=1" /mnt/sysimage/etc/modprobe.d/kvm.conf 2>/dev/null || echo "options kvm_intel nested=1" >> /mnt/sysimage/etc/modprobe.d/kvm.conf # Add support for nested virtualization on Intel CPUs, exactly once
 
 %end # End of the %post section

cook/ingredients/initial-setup/gnome/config.ks

@@ -10,16 +10,16 @@ gnome-initial-setup # Add GNOME initial setup too to let user create local accou
 
 %end # End of the packages section
 
-# %post --nochroot --log=/mnt/sysimage/root/initial-setup-gnome.log # Beginning of %post section. Those commands are executed outside the chroot environment. Add logging.
+%post --nochroot --log=/mnt/sysimage/root/initial-setup-gnome.log # Beginning of %post section. Those commands are executed outside the chroot environment. Add logging.
-# 
+
-# truncate -s 0 /mnt/sysimage/usr/share/gnome-initial-setup/vendor.conf # remove content of vendor.conf so that all options are made available
+truncate -s 0 /mnt/sysimage/usr/share/gnome-initial-setup/vendor.conf # remove content of vendor.conf so that all options are made available
-# 
+
-# ## Append lines to existing vendor.conf file, so that options are skipped upon reboot
+## Append lines to existing vendor.conf file, so that options are skipped upon reboot
-# cat >> /mnt/sysimage/usr/share/gnome-initial-setup/vendor.conf<< EOF
+cat >> /mnt/sysimage/usr/share/gnome-initial-setup/vendor.conf<< EOF
-# [pages]
+[pages]
-# skip=privacy
+skip=privacy
-# [goa]
+[goa]
-# providers=local-first!
+providers=local-first!
-# EOF
+EOF
-# 
+
-# %end # End of the %post section
+%end # End of the %post section

cook/ingredients/packages/core-explicit.ks

@@ -0,0 +1,93 @@
+#            __          ____                        ____  _____
+#     ____  / /_  __  __/ / /___  ____ ___  ___     / __ \/ ___/
+#    / __ \/ __ \/ / / / / / __ \/ __ `__ \/ _ \   / / / /\__ \
+#   / /_/ / / / /_/ / / / /_/ / / / / / /  __/  / /_/ /___/ /
+#  / .___/_/ /_/\__, /_/_/\____/_/ /_/ /_/\___/   \____//____/
+# /_/          /____/
+
+# Core packages, broken down explicitly instead of using the `@core` group.
+#
+# Why: dishes that keep the Fedora remix packages (generic-release,
+# generic-logos, fedora-remix-logos) cannot coexist with fedora-release /
+# fedora-logos — both pairs hard-conflict. Listing the core packages
+# explicitly deselects the Fedora release/branding packages while the
+# remix packages provide `system-release`, `system-release(44)`,
+# `fedora-release-identity` and `system-logos` in their place.
+#
+# Package list mirrors the Fedora 44 `core` comps group (mandatory +
+# default packages), plus `basesystem`, `kernel` and `dhcp-client` from
+# the hidden core group, plus `fedora-repos` (usually pulled in via
+# fedora-release-common, which is deselected here), plus session-system
+# essentials (`dbus-daemon`, `systemd-pam`) that would otherwise be
+# dropped by --exclude-weakdeps.
+
+%packages --exclude-weakdeps # Beginning of the packages section. Package description courtesy of the Fedora project
+
+## Mandatory packages found in `core` group (dnf group info --hidden core)
+audit # User space tools for kernel auditing
+basesystem # The skeleton package which defines a simple Fedora system
+bash # The Bourne Again SHell, a command-line interpreter.
+coreutils # A set of basic GNU tools commonly used in shell scripts
+curl # A utility for getting files from remote servers (FTP, HTTP, and others)
+dhcp-client # Provides the ISC DHCP client daemon and dhclient-script
+dnf5 # Command-line package manager
+e2fsprogs # Utilities for managing ext2, ext3, and ext4 file systems
+filesystem # The basic directory layout for a Linux system
+glibc # The GNU libc libraries
+hostname # Utility to set/show the host name or domain name
+iproute # Advanced IP routing and network device configuration tools
+iputils # Network monitoring tools including ping
+kbd # Tools for configuring the console (keyboard, virtual terminals, etc.)
+kernel # The Linux kernel
+less # A text file browser similar to more, but better. Can be excluded
+man-db # Tools for searching and reading man pages. Can be excluded
+ncurses # Ncurses support utilities
+openssh-clients # An open source SSH client applications. Can be excluded
+openssh-server # An open source SSH server daemon. Can be excluded
+parted # The GNU disk partition manipulation program
+policycoreutils # SELinux policy core utilities. Can be excluded
+procps-ng # System and process monitoring utilities
+rootfiles # The basic required files for the root user's directory
+rpm # The RPM package management system
+selinux-policy-targeted # SELinux targeted policy. Can be excluded
+setup # A set of system configuration and setup files
+shadow-utils # Utilities for managing accounts and shadow password files
+sssd-common # Common files for the SSSD. Can be excluded
+sssd-kcm # An implementation of a Kerberos KCM server. Can be excluded
+sudo # Allows restricted root access for specified users
+systemd # System and Service Manager
+util-linux # Collection of basic system utilities
+vim-minimal # A minimal version of the VIM editor
+
+## Default packages found in `core` group (dnf group info --hidden core)
+NetworkManager # Network connection manager and user applications
+dnf5-plugins # Plugins for dnf5
+dracut-config-rescue # dracut configuration to turn on rescue image generation
+firewalld # A firewall daemon with D-Bus interface providing a dynamic firewall
+fwupd # Firmware update daemon
+plymouth # Graphical Boot Animation and Logger
+prefixdevname # Udev helper utility that provides network interface naming using user defined prefix
+systemd-resolved # Network Name Resolution manager
+zram-generator-defaults # Default configuration for zram-generator
+
+## Repository definitions, pulled explicitly since fedora-release is deselected
+fedora-repos # Fedora package repositories
+
+## Session-system essentials that nothing else hard-requires: with
+## --exclude-weakdeps they would be dropped (systemd merely recommends
+## systemd-pam; only anaconda requires dbus-daemon during installation).
+## Without them, login sessions never register with logind (no
+## pam_systemd.so) and display managers cannot spawn the session bus
+## (no /usr/bin/dbus-run-session), which yields a silent black screen.
+dbus-daemon # D-BUS message bus (provides /usr/bin/dbus-run-session, used by gdm-wayland-session et al.)
+systemd-pam # systemd PAM module (pam_systemd.so — registers login sessions with logind, starts user@.service)
+
+## Deselect Fedora release/branding packages — the remix packages below
+## provide system-release, system-release(44), fedora-release-identity and
+## system-logos instead
+-fedora-release
+-fedora-release-common
+-fedora-release-identity-basic
+-fedora-logos
+
+%end # End of the packages section

cook/ingredients/packages/hand-picked.ks

@@ -2,6 +2,7 @@
 
 %packages --exclude-weakdeps
 
+grub2-tools # Provides grub2-mkconfig and grub2-editenv, required by the grub2-common %posttrans scriptlet (exit 127 otherwise, which fails the whole dnf transaction)
 pciutils # PCI bus related utilities
 libusb # Library for accessing USB devices
 usbutils # Linux USB utilities

cook/ingredients/storage/biosboot.ks

@@ -0,0 +1,8 @@
+# BIOS boot storage configuration (GPT disk label with a BIOS boot partition)
+
+zerombr # Destroy all the contents of disks with invalid partition tables or other formatting unrecognizable to the installer
+clearpart --all --initlabel --disklabel=gpt # Erase all partitions, initialize a GPT disk label, and initialize the disk label to the default for the target architecture
+
+part biosboot --fstype="biosboot" --size=2 --label=biosboot # Creates a 2 MiB BIOS boot partition, required to install GRUB on a GPT-labelled disk under legacy BIOS firmware
+part /boot --fstype="ext4" --size=2048 --label=boot # Creates a 2048 MiB ext4 boot partition
+part / --fstype="ext4" --grow --label=root --mkfsoptions="-O encrypt,fast_commit" # Create a single root partition with the remaining space

cook/recipe_templates.yaml

@@ -23,7 +23,7 @@ base:
   - core/locale.ks
   - core/network.ks
   - core/services.ks
-  - packages/core.ks
+  - packages/core-explicit.ks
   - packages/fedora-remix.ks
   - packages/hand-picked.ks
 
@@ -35,6 +35,7 @@ choices:
   storage:
     standard: storage/standard.ks
     encrypted: storage/encrypted.ks
+    biosboot: storage/biosboot.ks
   bootloader:
     grub: bootloader/grub.ks
     systemd-boot: bootloader/systemd-boot.ks
@@ -60,6 +61,9 @@ features:
       - hypervisor/base/services.ks
       - hypervisor/base/post-scripts.ks
     desktop:
+      - hypervisor/base/packages.ks
+      - hypervisor/base/services.ks
+      - hypervisor/base/post-scripts.ks
       - packages/virtual-machine-manager/packages.ks
       - packages/virtual-machine-manager/post-scripts.ks
   hypervisor_type:

cook/recipes_manifest.yaml

@@ -26,34 +26,36 @@ recipes:
         hardware-support: [true, false]
         guest-agents: [true, false]
 
-#  # Server variants
+  # Server variants
-#  - name: server
+  - name: server
-#    variants:
+    variants:
-#      - repository: ["43", "rawhide"]
+      - repository: ["44"]
-#        storage: standard
+        storage: standard
-#        bootloader: grub
+        bootloader: systemd-boot
-#        hardware-support: false
+        hardware-support: false
-#        guest-agents: true
+        guest-agents: true
-#
+        initial-setup: server
-#  # Hypervisor variants
+
-#  - name: hypervisor
+  # Hypervisor variants
-#    variants:
+  - name: hypervisor
-#      - repository: 43
+    variants:
-#        storage: standard
+      - repository: ["44"]
-#        bootloader: grub
+        storage: standard
-#        hardware-support: true
+        bootloader: systemd-boot
-#        guest-agents: false
+        hardware-support: true
-#        hypervisor: base
+        guest-agents: false
-#        hypervisor_type: ["amdcpu", "intelcpu"]
+        hypervisor: base
-#
+        hypervisor_type: intelcpu
-#  # Desktop-hypervisor variants
+  # Desktop-hypervisor variants
-#  - name: desktop-hypervisor
+  - name: desktop-hypervisor
-#    variants:
+    variants:
-#      - repository: 43
+      - repository: "44"
-#        desktop: gnome
+        desktop: gnome
-#        storage: standard
+        storage: biosboot
-#        bootloader: grub
+        bootloader: grub
-#        hardware-support: false
+        security: enabled
-#        guest-agents: true
+        initial-setup: gnome
-#        hypervisor: desktop
+        hardware-support: true
-#        hypervisor_type: ["amdcpu", "intelcpu"]
+        guest-agents: false
+        hypervisor: desktop
+        hypervisor_type: intelcpu

cook/tests/test_generator.py

@@ -20,7 +20,7 @@ BASE_FRAGMENTS = [
     "core/locale.ks",
     "core/network.ks",
     "core/services.ks",
-    "packages/core.ks",
+    "packages/core-explicit.ks",
     "packages/fedora-remix.ks",
     "packages/hand-picked.ks",
 ]