From 44d49d81ce051fe796e9f1e69effd8e59f9c60ab Mon Sep 17 00:00:00 2001
From: CoreOS Bot <coreosbot@fedoraproject.org>
Date: Mon, 21 Aug 2023 14:47:06 +0000
Subject: [PATCH] tree: promote changes from testing-devel at
 7c2e67e2c59f66f218ab4cba8dc465aaeb1a6a43

---
 kola-denylist.yaml                            | 63 ++++++++++---
 manifest-lock.aarch64.json                    | 90 +++++++++---------
 manifest-lock.overrides.ppc64le.yaml          | 31 -------
 manifest-lock.overrides.yaml                  | 30 ------
 manifest-lock.ppc64le.json                    | 90 +++++++++---------
 manifest-lock.s390x.json                      | 86 ++++++++---------
 manifest-lock.x86_64.json                     | 90 +++++++++---------
 manifests/system-configuration.yaml           |  2 +
 .../coreos-diskful-generator                  | 93 +++++++++++++------
 .../35coreos-ignition/coreos-gpt-setup.sh     | 15 +--
 .../coreos-rootflags.service                  | 25 +++++
 .../coreos-rootflags.sh                       |  0
 .../35coreos-ignition/module-setup.sh         |  5 +
 .../coreos-liveiso-persist-osmet.service      |  6 +-
 .../modules.d/35coreos-live/live-generator    | 73 +++++++--------
 .../ignition-ostree-check-rootfs-size.service |  1 +
 .../ignition-ostree-growfs.service            |  2 +-
 ...ion-ostree-mount-firstboot-sysroot.service | 25 -----
 ...on-ostree-mount-subsequent-sysroot.service | 24 -----
 .../ignition-ostree-mount-sysroot.sh          | 18 ----
 ...gnition-ostree-transposefs-restore.service |  1 -
 .../ignition-ostree-uuid-root.service         |  4 +-
 .../40ignition-ostree/module-setup.sh         |  6 --
 .../usr/lib/sysusers.d/10-setup-basic.conf    | 43 ---------
 24 files changed, 370 insertions(+), 453 deletions(-)
 delete mode 100644 manifest-lock.overrides.ppc64le.yaml
 create mode 100644 overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-rootflags.service
 rename overlay.d/05core/usr/lib/dracut/modules.d/{40ignition-ostree => 35coreos-ignition}/coreos-rootflags.sh (100%)
 delete mode 100644 overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-mount-firstboot-sysroot.service
 delete mode 100644 overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-mount-subsequent-sysroot.service
 delete mode 100755 overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-mount-sysroot.sh
 delete mode 100644 overlay.d/15fcos/usr/lib/sysusers.d/10-setup-basic.conf

diff --git a/kola-denylist.yaml b/kola-denylist.yaml
index dc5f0aef0c..0d8c50a38b 100644
--- a/kola-denylist.yaml
+++ b/kola-denylist.yaml
@@ -15,23 +15,62 @@
     - ppc64le
 - pattern: ext.config.kdump.crash
   tracker: https://github.com/coreos/fedora-coreos-tracker/issues/1430
-  # snooze: 2023-08-16 (disabled on promotion)
+  # snooze: 2023-08-31 (disabled on promotion)
   arches:
     - aarch64
-- pattern: ext.config.root-reprovision.*
-  tracker: https://github.com/coreos/fedora-coreos-tracker/issues/1489
-  # snooze: 2023-08-18 (disabled on promotion)
-  arches:
-    - ppc64le
+- pattern: ext.config.networking.nameserver
+  tracker: https://github.com/coreos/fedora-coreos-tracker/issues/1542
+  # snooze: 2023-08-28 (disabled on promotion)
+  streams:
+    - rawhide
+    - branched
+    - next-devel
+- pattern: ext.config.networking.no-persist-ip
+  tracker: https://github.com/coreos/fedora-coreos-tracker/issues/1542
+  # snooze: 2023-08-28 (disabled on promotion)
+  streams:
+    - rawhide
+    - branched
+    - next-devel
+- pattern: ext.config.networking.prefer-ignition-networking
+  tracker: https://github.com/coreos/fedora-coreos-tracker/issues/1542
+  # snooze: 2023-08-28 (disabled on promotion)
+  streams:
+    - rawhide
+    - branched
+    - next-devel
+- pattern: ext.config.networking.ifname-karg.everyboot-systemd-link-file
+  tracker: https://github.com/coreos/fedora-coreos-tracker/issues/1542
+  # snooze: 2023-08-28 (disabled on promotion)
+  streams:
+    - rawhide
+    - branched
+    - next-devel
+- pattern: ext.config.networking.force-persist-ip
+  tracker: https://github.com/coreos/fedora-coreos-tracker/issues/1542
+  # snooze: 2023-08-28 (disabled on promotion)
+  streams:
+    - rawhide
+    - branched
+    - next-devel
+- pattern: ext.config.networking.bridge-static-via-kargs
+  tracker: https://github.com/coreos/fedora-coreos-tracker/issues/1542
+  # snooze: 2023-08-28 (disabled on promotion)
   streams:
     - rawhide
-- pattern: ext.config.ntp.chrony.dhcp-propagation
-  tracker: https://github.com/coreos/fedora-coreos-tracker/issues/1508
-  # snooze: 2023-08-20 (disabled on promotion)
+    - branched
+    - next-devel
+- pattern: ext.config.networking.ifname-karg.udev-rule-firstboot-propagation
+  tracker: https://github.com/coreos/fedora-coreos-tracker/issues/1542
+  # snooze: 2023-08-28 (disabled on promotion)
   streams:
     - rawhide
-- pattern: ext.config.ntp.timesyncd.dhcp-propagation
-  tracker: https://github.com/coreos/fedora-coreos-tracker/issues/1508
-  # snooze: 2023-08-20 (disabled on promotion)
+    - branched
+    - next-devel
+- pattern: ext.config.networking.mtu-on-bond-kargs
+  tracker: https://github.com/coreos/fedora-coreos-tracker/issues/1542
+  # snooze: 2023-08-28 (disabled on promotion)
   streams:
     - rawhide
+    - branched
+    - next-devel
diff --git a/manifest-lock.aarch64.json b/manifest-lock.aarch64.json
index c2fd31440b..99b97d46ae 100644
--- a/manifest-lock.aarch64.json
+++ b/manifest-lock.aarch64.json
@@ -37,16 +37,16 @@
       "evra": "1.25-1.fc38.aarch64"
     },
     "amd-gpu-firmware": {
-      "evra": "20230625-151.fc38.noarch"
+      "evra": "20230804-153.fc38.noarch"
     },
     "atheros-firmware": {
-      "evra": "20230625-151.fc38.noarch"
+      "evra": "20230804-153.fc38.noarch"
     },
     "attr": {
       "evra": "2.5.1-6.fc38.aarch64"
     },
     "audit-libs": {
-      "evra": "3.1.1-1.fc38.aarch64"
+      "evra": "3.1.2-1.fc38.aarch64"
     },
     "authselect": {
       "evra": "1.4.2-2.fc38.aarch64"
@@ -79,7 +79,7 @@
       "evra": "0.2.9-1.fc38.aarch64"
     },
     "brcmfmac-firmware": {
-      "evra": "20230625-151.fc38.noarch"
+      "evra": "20230804-153.fc38.noarch"
     },
     "bsdtar": {
       "evra": "3.6.1-4.fc38.aarch64"
@@ -142,13 +142,13 @@
       "evra": "0.21.3-4.fc38.noarch"
     },
     "container-selinux": {
-      "evra": "2:2.219.0-1.fc38.noarch"
+      "evra": "2:2.221.0-1.fc38.noarch"
     },
     "containerd": {
       "evra": "1.6.19-1.fc38.aarch64"
     },
     "containernetworking-plugins": {
-      "evra": "1.1.1-16.fc38.aarch64"
+      "evra": "1.3.0-2.fc38.aarch64"
     },
     "containers-common": {
       "evra": "4:1-89.fc38.noarch"
@@ -397,10 +397,10 @@
       "evra": "3.8.0-2.fc38.aarch64"
     },
     "google-compute-engine-guest-configs-udev": {
-      "evra": "20230526.00-3.fc38.noarch"
+      "evra": "20230808.00-1.fc38.noarch"
     },
     "gpgme": {
-      "evra": "1.17.1-3.fc38.aarch64"
+      "evra": "1.17.1-5.fc38.aarch64"
     },
     "grep": {
       "evra": "3.8-3.fc38.aarch64"
@@ -430,7 +430,7 @@
       "evra": "57-1.fc38.aarch64"
     },
     "intel-gpu-firmware": {
-      "evra": "20230625-151.fc38.noarch"
+      "evra": "20230804-153.fc38.noarch"
     },
     "ipcalc": {
       "evra": "1.0.3-1.fc38.aarch64"
@@ -484,10 +484,10 @@
       "evra": "11-7.fc38.aarch64"
     },
     "jq": {
-      "evra": "1.6-15.fc38.aarch64"
+      "evra": "1.6-16.fc38.aarch64"
     },
     "json-c": {
-      "evra": "0.16-4.fc38.aarch64"
+      "evra": "0.17-1.fc38.aarch64"
     },
     "json-glib": {
       "evra": "1.6.6-4.fc38.aarch64"
@@ -502,16 +502,16 @@
       "evra": "2.5.1-5.fc38.noarch"
     },
     "kernel": {
-      "evra": "6.4.7-200.fc38.aarch64"
+      "evra": "6.4.11-200.fc38.aarch64"
     },
     "kernel-core": {
-      "evra": "6.4.7-200.fc38.aarch64"
+      "evra": "6.4.11-200.fc38.aarch64"
     },
     "kernel-modules": {
-      "evra": "6.4.7-200.fc38.aarch64"
+      "evra": "6.4.11-200.fc38.aarch64"
     },
     "kernel-modules-core": {
-      "evra": "6.4.7-200.fc38.aarch64"
+      "evra": "6.4.11-200.fc38.aarch64"
     },
     "kexec-tools": {
       "evra": "2.0.26-3.fc38.aarch64"
@@ -532,7 +532,7 @@
       "evra": "0.9.4-2.fc38.aarch64"
     },
     "krb5-libs": {
-      "evra": "1.21-2.fc38.aarch64"
+      "evra": "1.21-3.fc38.aarch64"
     },
     "less": {
       "evra": "633-1.fc38.aarch64"
@@ -697,7 +697,7 @@
       "evra": "1.0.1-23.fc38.aarch64"
     },
     "libnfsidmap": {
-      "evra": "1:2.6.3-0.fc38.aarch64"
+      "evra": "1:2.6.3-1.rc3.fc38.aarch64"
     },
     "libnftnl": {
       "evra": "1.2.4-2.fc38.aarch64"
@@ -805,7 +805,7 @@
       "evra": "0.14.1-1.fc38.aarch64"
     },
     "libtirpc": {
-      "evra": "1.3.3-1.rc1.fc38.aarch64"
+      "evra": "1.3.3-1.rc2.fc38.aarch64"
     },
     "libtool-ltdl": {
       "evra": "2.4.7-6.fc38.aarch64"
@@ -844,7 +844,7 @@
       "evra": "2.10.4-1.fc38.aarch64"
     },
     "libxmlb": {
-      "evra": "0.3.11-1.fc38.aarch64"
+      "evra": "0.3.12-1.fc38.aarch64"
     },
     "libyaml": {
       "evra": "0.2.5-9.fc38.aarch64"
@@ -856,10 +856,10 @@
       "evra": "2.5.1-34.fc38.aarch64"
     },
     "linux-firmware": {
-      "evra": "20230625-151.fc38.noarch"
+      "evra": "20230804-153.fc38.noarch"
     },
     "linux-firmware-whence": {
-      "evra": "20230625-151.fc38.noarch"
+      "evra": "20230804-153.fc38.noarch"
     },
     "lmdb-libs": {
       "evra": "0.9.31-1.fc38.aarch64"
@@ -901,7 +901,7 @@
       "evra": "4.1.1-3.fc38.aarch64"
     },
     "mt7xxx-firmware": {
-      "evra": "20230625-151.fc38.noarch"
+      "evra": "20230804-153.fc38.noarch"
     },
     "nano": {
       "evra": "7.2-2.fc38.aarch64"
@@ -931,7 +931,7 @@
       "evra": "0.52.23-2.fc38.aarch64"
     },
     "nfs-utils-coreos": {
-      "evra": "1:2.6.3-0.fc38.aarch64"
+      "evra": "1:2.6.3-1.rc3.fc38.aarch64"
     },
     "nftables": {
       "evra": "1:1.0.5-2.fc38.aarch64"
@@ -949,7 +949,7 @@
       "evra": "2.0.16-2.fc38.aarch64"
     },
     "nvidia-gpu-firmware": {
-      "evra": "20230625-151.fc38.noarch"
+      "evra": "20230804-153.fc38.noarch"
     },
     "nvme-cli": {
       "evra": "2.4-2.fc38.aarch64"
@@ -979,10 +979,10 @@
       "evra": "1.81-3.fc38.aarch64"
     },
     "ostree": {
-      "evra": "2023.4-2.fc38.aarch64"
+      "evra": "2023.5-2.fc38.aarch64"
     },
     "ostree-libs": {
-      "evra": "2023.4-2.fc38.aarch64"
+      "evra": "2023.5-2.fc38.aarch64"
     },
     "p11-kit": {
       "evra": "0.25.0-1.fc38.aarch64"
@@ -1024,10 +1024,10 @@
       "evra": "1.8.0-6.fc38.aarch64"
     },
     "podman": {
-      "evra": "5:4.6.0-1.fc38.aarch64"
+      "evra": "5:4.6.1-1.fc38.aarch64"
     },
     "podman-plugins": {
-      "evra": "5:4.6.0-1.fc38.aarch64"
+      "evra": "5:4.6.1-1.fc38.aarch64"
     },
     "policycoreutils": {
       "evra": "3.5-1.fc38.aarch64"
@@ -1054,16 +1054,16 @@
       "evra": "23.6-2.fc38.aarch64"
     },
     "publicsuffix-list-dafsa": {
-      "evra": "20230614-1.fc38.noarch"
+      "evra": "20230812-1.fc38.noarch"
     },
     "qemu-user-static-x86": {
-      "evra": "2:7.2.1-2.fc38.aarch64"
+      "evra": "2:7.2.4-2.fc38.aarch64"
     },
     "readline": {
       "evra": "8.2-3.fc38.aarch64"
     },
     "realtek-firmware": {
-      "evra": "20230625-151.fc38.noarch"
+      "evra": "20230804-153.fc38.noarch"
     },
     "rpcbind": {
       "evra": "1.2.6-4.rc2.fc38.aarch64"
@@ -1105,10 +1105,10 @@
       "evra": "4.8-12.fc38.aarch64"
     },
     "selinux-policy": {
-      "evra": "38.22-1.fc38.noarch"
+      "evra": "38.24-1.fc38.noarch"
     },
     "selinux-policy-targeted": {
-      "evra": "38.22-1.fc38.noarch"
+      "evra": "38.24-1.fc38.noarch"
     },
     "setup": {
       "evra": "2.14.3-2.fc38.noarch"
@@ -1132,7 +1132,7 @@
       "evra": "15.6-2.aarch64"
     },
     "skopeo": {
-      "evra": "1:1.13.1-1.fc38.aarch64"
+      "evra": "1:1.13.2-1.fc38.aarch64"
     },
     "slang": {
       "evra": "2.3.3-3.fc38.aarch64"
@@ -1189,22 +1189,22 @@
       "evra": "1.9.13-2.p2.fc38.aarch64"
     },
     "systemd": {
-      "evra": "253.4-1.fc38.aarch64"
+      "evra": "253.7-1.fc38.aarch64"
     },
     "systemd-container": {
-      "evra": "253.4-1.fc38.aarch64"
+      "evra": "253.7-1.fc38.aarch64"
     },
     "systemd-libs": {
-      "evra": "253.4-1.fc38.aarch64"
+      "evra": "253.7-1.fc38.aarch64"
     },
     "systemd-pam": {
-      "evra": "253.4-1.fc38.aarch64"
+      "evra": "253.7-1.fc38.aarch64"
     },
     "systemd-resolved": {
-      "evra": "253.4-1.fc38.aarch64"
+      "evra": "253.7-1.fc38.aarch64"
     },
     "systemd-udev": {
-      "evra": "253.4-1.fc38.aarch64"
+      "evra": "253.7-1.fc38.aarch64"
     },
     "tar": {
       "evra": "2:1.34-8.fc38.aarch64"
@@ -1234,10 +1234,10 @@
       "evra": "2.38.1-4.fc38.aarch64"
     },
     "vim-data": {
-      "evra": "2:9.0.1677-2.fc38.noarch"
+      "evra": "2:9.0.1712-1.fc38.noarch"
     },
     "vim-minimal": {
-      "evra": "2:9.0.1677-2.fc38.aarch64"
+      "evra": "2:9.0.1712-1.fc38.aarch64"
     },
     "which": {
       "evra": "2.21-39.fc38.aarch64"
@@ -1277,16 +1277,16 @@
     }
   },
   "metadata": {
-    "generated": "2023-08-06T00:00:00Z",
+    "generated": "2023-08-19T00:00:00Z",
     "rpmmd_repos": {
       "fedora": {
         "generated": "2023-04-13T20:36:48Z"
       },
       "fedora-coreos-pool": {
-        "generated": "2023-08-05T03:48:29Z"
+        "generated": "2023-08-18T06:29:41Z"
       },
       "fedora-updates": {
-        "generated": "2023-08-06T01:31:34Z"
+        "generated": "2023-08-19T01:06:38Z"
       }
     }
   }
diff --git a/manifest-lock.overrides.ppc64le.yaml b/manifest-lock.overrides.ppc64le.yaml
deleted file mode 100644
index 14163e6c2f..0000000000
--- a/manifest-lock.overrides.ppc64le.yaml
+++ /dev/null
@@ -1,31 +0,0 @@
-# This lockfile should be used to pin to a package version (`type: pin`) or to
-# fast-track packages ahead of Bodhi (`type: fast-track`). Fast-tracked
-# packages will automatically be removed once they are in the stable repos.
-#
-# IMPORTANT: YAML comments *will not* be preserved. All `pin` overrides *must*
-# include a URL in the `metadata.reason` key. Overrides of type `fast-track`
-# *should* include a Bodhi update URL in the `metadata.bodhi` key and a URL
-# in the `metadata.reason` key, though it's acceptable to omit a `reason`
-# for FCOS-specific packages (ignition, afterburn, etc.).
-
-packages:
-  kernel:
-    evra: 6.3.12-200.fc38.ppc64le
-    metadata:
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1489
-      type: pin
-  kernel-core:
-    evra: 6.3.12-200.fc38.ppc64le
-    metadata:
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1489
-      type: pin
-  kernel-modules:
-    evra: 6.3.12-200.fc38.ppc64le
-    metadata:
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1489
-      type: pin
-  kernel-modules-core:
-    evra: 6.3.12-200.fc38.ppc64le
-    metadata:
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1489
-      type: pin
diff --git a/manifest-lock.overrides.yaml b/manifest-lock.overrides.yaml
index fae8596b9b..1d1ec562ab 100644
--- a/manifest-lock.overrides.yaml
+++ b/manifest-lock.overrides.yaml
@@ -14,33 +14,3 @@ packages:
     metadata:
       reason: https://github.com/coreos/fedora-coreos-tracker/issues/1476
       type: pin
-  systemd:
-    evr: 253.4-1.fc38
-    metadata:
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1508
-      type: pin
-  systemd-container:
-    evr: 253.4-1.fc38
-    metadata:
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1508
-      type: pin
-  systemd-libs:
-    evr: 253.4-1.fc38
-    metadata:
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1508
-      type: pin
-  systemd-pam:
-    evr: 253.4-1.fc38
-    metadata:
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1508
-      type: pin
-  systemd-resolved:
-    evr: 253.4-1.fc38
-    metadata:
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1508
-      type: pin
-  systemd-udev:
-    evr: 253.4-1.fc38
-    metadata:
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1508
-      type: pin
diff --git a/manifest-lock.ppc64le.json b/manifest-lock.ppc64le.json
index 376087f5dd..8dbb67bcd2 100644
--- a/manifest-lock.ppc64le.json
+++ b/manifest-lock.ppc64le.json
@@ -37,16 +37,16 @@
       "evra": "1.25-1.fc38.ppc64le"
     },
     "amd-gpu-firmware": {
-      "evra": "20230625-151.fc38.noarch"
+      "evra": "20230804-153.fc38.noarch"
     },
     "atheros-firmware": {
-      "evra": "20230625-151.fc38.noarch"
+      "evra": "20230804-153.fc38.noarch"
     },
     "attr": {
       "evra": "2.5.1-6.fc38.ppc64le"
     },
     "audit-libs": {
-      "evra": "3.1.1-1.fc38.ppc64le"
+      "evra": "3.1.2-1.fc38.ppc64le"
     },
     "authselect": {
       "evra": "1.4.2-2.fc38.ppc64le"
@@ -79,7 +79,7 @@
       "evra": "32:9.18.17-1.fc38.ppc64le"
     },
     "brcmfmac-firmware": {
-      "evra": "20230625-151.fc38.noarch"
+      "evra": "20230804-153.fc38.noarch"
     },
     "bsdtar": {
       "evra": "3.6.1-4.fc38.ppc64le"
@@ -142,13 +142,13 @@
       "evra": "0.21.3-4.fc38.noarch"
     },
     "container-selinux": {
-      "evra": "2:2.219.0-1.fc38.noarch"
+      "evra": "2:2.221.0-1.fc38.noarch"
     },
     "containerd": {
       "evra": "1.6.19-1.fc38.ppc64le"
     },
     "containernetworking-plugins": {
-      "evra": "1.1.1-16.fc38.ppc64le"
+      "evra": "1.3.0-2.fc38.ppc64le"
     },
     "containers-common": {
       "evra": "4:1-89.fc38.noarch"
@@ -388,7 +388,7 @@
       "evra": "3.8.0-2.fc38.ppc64le"
     },
     "gpgme": {
-      "evra": "1.17.1-3.fc38.ppc64le"
+      "evra": "1.17.1-5.fc38.ppc64le"
     },
     "grep": {
       "evra": "3.8-3.fc38.ppc64le"
@@ -421,7 +421,7 @@
       "evra": "57-1.fc38.ppc64le"
     },
     "intel-gpu-firmware": {
-      "evra": "20230625-151.fc38.noarch"
+      "evra": "20230804-153.fc38.noarch"
     },
     "ipcalc": {
       "evra": "1.0.3-1.fc38.ppc64le"
@@ -475,10 +475,10 @@
       "evra": "11-7.fc38.ppc64le"
     },
     "jq": {
-      "evra": "1.6-15.fc38.ppc64le"
+      "evra": "1.6-16.fc38.ppc64le"
     },
     "json-c": {
-      "evra": "0.16-4.fc38.ppc64le"
+      "evra": "0.17-1.fc38.ppc64le"
     },
     "json-glib": {
       "evra": "1.6.6-4.fc38.ppc64le"
@@ -493,16 +493,16 @@
       "evra": "2.5.1-5.fc38.noarch"
     },
     "kernel": {
-      "evra": "6.3.12-200.fc38.ppc64le"
+      "evra": "6.4.11-200.fc38.ppc64le"
     },
     "kernel-core": {
-      "evra": "6.3.12-200.fc38.ppc64le"
+      "evra": "6.4.11-200.fc38.ppc64le"
     },
     "kernel-modules": {
-      "evra": "6.3.12-200.fc38.ppc64le"
+      "evra": "6.4.11-200.fc38.ppc64le"
     },
     "kernel-modules-core": {
-      "evra": "6.3.12-200.fc38.ppc64le"
+      "evra": "6.4.11-200.fc38.ppc64le"
     },
     "kexec-tools": {
       "evra": "2.0.26-3.fc38.ppc64le"
@@ -523,7 +523,7 @@
       "evra": "0.9.4-2.fc38.ppc64le"
     },
     "krb5-libs": {
-      "evra": "1.21-2.fc38.ppc64le"
+      "evra": "1.21-3.fc38.ppc64le"
     },
     "less": {
       "evra": "633-1.fc38.ppc64le"
@@ -688,7 +688,7 @@
       "evra": "1.0.1-23.fc38.ppc64le"
     },
     "libnfsidmap": {
-      "evra": "1:2.6.3-0.fc38.ppc64le"
+      "evra": "1:2.6.3-1.rc3.fc38.ppc64le"
     },
     "libnftnl": {
       "evra": "1.2.4-2.fc38.ppc64le"
@@ -802,7 +802,7 @@
       "evra": "0.14.1-1.fc38.ppc64le"
     },
     "libtirpc": {
-      "evra": "1.3.3-1.rc1.fc38.ppc64le"
+      "evra": "1.3.3-1.rc2.fc38.ppc64le"
     },
     "libtool-ltdl": {
       "evra": "2.4.7-6.fc38.ppc64le"
@@ -841,7 +841,7 @@
       "evra": "2.10.4-1.fc38.ppc64le"
     },
     "libxmlb": {
-      "evra": "0.3.11-1.fc38.ppc64le"
+      "evra": "0.3.12-1.fc38.ppc64le"
     },
     "libyaml": {
       "evra": "0.2.5-9.fc38.ppc64le"
@@ -853,10 +853,10 @@
       "evra": "2.5.1-34.fc38.ppc64le"
     },
     "linux-firmware": {
-      "evra": "20230625-151.fc38.noarch"
+      "evra": "20230804-153.fc38.noarch"
     },
     "linux-firmware-whence": {
-      "evra": "20230625-151.fc38.noarch"
+      "evra": "20230804-153.fc38.noarch"
     },
     "lmdb-libs": {
       "evra": "0.9.31-1.fc38.ppc64le"
@@ -895,7 +895,7 @@
       "evra": "4.1.1-3.fc38.ppc64le"
     },
     "mt7xxx-firmware": {
-      "evra": "20230625-151.fc38.noarch"
+      "evra": "20230804-153.fc38.noarch"
     },
     "nano": {
       "evra": "7.2-2.fc38.ppc64le"
@@ -925,7 +925,7 @@
       "evra": "0.52.23-2.fc38.ppc64le"
     },
     "nfs-utils-coreos": {
-      "evra": "1:2.6.3-0.fc38.ppc64le"
+      "evra": "1:2.6.3-1.rc3.fc38.ppc64le"
     },
     "nftables": {
       "evra": "1:1.0.5-2.fc38.ppc64le"
@@ -943,7 +943,7 @@
       "evra": "2.0.16-2.fc38.ppc64le"
     },
     "nvidia-gpu-firmware": {
-      "evra": "20230625-151.fc38.noarch"
+      "evra": "20230804-153.fc38.noarch"
     },
     "nvme-cli": {
       "evra": "2.4-2.fc38.ppc64le"
@@ -973,13 +973,13 @@
       "evra": "1.81-3.fc38.ppc64le"
     },
     "ostree": {
-      "evra": "2023.4-2.fc38.ppc64le"
+      "evra": "2023.5-2.fc38.ppc64le"
     },
     "ostree-grub2": {
-      "evra": "2023.4-2.fc38.ppc64le"
+      "evra": "2023.5-2.fc38.ppc64le"
     },
     "ostree-libs": {
-      "evra": "2023.4-2.fc38.ppc64le"
+      "evra": "2023.5-2.fc38.ppc64le"
     },
     "p11-kit": {
       "evra": "0.25.0-1.fc38.ppc64le"
@@ -1021,10 +1021,10 @@
       "evra": "1.8.0-6.fc38.ppc64le"
     },
     "podman": {
-      "evra": "5:4.6.0-1.fc38.ppc64le"
+      "evra": "5:4.6.1-1.fc38.ppc64le"
     },
     "podman-plugins": {
-      "evra": "5:4.6.0-1.fc38.ppc64le"
+      "evra": "5:4.6.1-1.fc38.ppc64le"
     },
     "policycoreutils": {
       "evra": "3.5-1.fc38.ppc64le"
@@ -1057,16 +1057,16 @@
       "evra": "23.6-2.fc38.ppc64le"
     },
     "publicsuffix-list-dafsa": {
-      "evra": "20230614-1.fc38.noarch"
+      "evra": "20230812-1.fc38.noarch"
     },
     "qemu-user-static-x86": {
-      "evra": "2:7.2.1-2.fc38.ppc64le"
+      "evra": "2:7.2.4-2.fc38.ppc64le"
     },
     "readline": {
       "evra": "8.2-3.fc38.ppc64le"
     },
     "realtek-firmware": {
-      "evra": "20230625-151.fc38.noarch"
+      "evra": "20230804-153.fc38.noarch"
     },
     "rpcbind": {
       "evra": "1.2.6-4.rc2.fc38.ppc64le"
@@ -1108,10 +1108,10 @@
       "evra": "4.8-12.fc38.ppc64le"
     },
     "selinux-policy": {
-      "evra": "38.22-1.fc38.noarch"
+      "evra": "38.24-1.fc38.noarch"
     },
     "selinux-policy-targeted": {
-      "evra": "38.22-1.fc38.noarch"
+      "evra": "38.24-1.fc38.noarch"
     },
     "servicelog": {
       "evra": "1.1.16-3.fc38.ppc64le"
@@ -1135,7 +1135,7 @@
       "evra": "2.2-3.fc38.ppc64le"
     },
     "skopeo": {
-      "evra": "1:1.13.1-1.fc38.ppc64le"
+      "evra": "1:1.13.2-1.fc38.ppc64le"
     },
     "slang": {
       "evra": "2.3.3-3.fc38.ppc64le"
@@ -1192,22 +1192,22 @@
       "evra": "1.9.13-2.p2.fc38.ppc64le"
     },
     "systemd": {
-      "evra": "253.4-1.fc38.ppc64le"
+      "evra": "253.7-1.fc38.ppc64le"
     },
     "systemd-container": {
-      "evra": "253.4-1.fc38.ppc64le"
+      "evra": "253.7-1.fc38.ppc64le"
     },
     "systemd-libs": {
-      "evra": "253.4-1.fc38.ppc64le"
+      "evra": "253.7-1.fc38.ppc64le"
     },
     "systemd-pam": {
-      "evra": "253.4-1.fc38.ppc64le"
+      "evra": "253.7-1.fc38.ppc64le"
     },
     "systemd-resolved": {
-      "evra": "253.4-1.fc38.ppc64le"
+      "evra": "253.7-1.fc38.ppc64le"
     },
     "systemd-udev": {
-      "evra": "253.4-1.fc38.ppc64le"
+      "evra": "253.7-1.fc38.ppc64le"
     },
     "tar": {
       "evra": "2:1.34-8.fc38.ppc64le"
@@ -1237,10 +1237,10 @@
       "evra": "2.38.1-4.fc38.ppc64le"
     },
     "vim-data": {
-      "evra": "2:9.0.1677-2.fc38.noarch"
+      "evra": "2:9.0.1712-1.fc38.noarch"
     },
     "vim-minimal": {
-      "evra": "2:9.0.1677-2.fc38.ppc64le"
+      "evra": "2:9.0.1712-1.fc38.ppc64le"
     },
     "which": {
       "evra": "2.21-39.fc38.ppc64le"
@@ -1280,16 +1280,16 @@
     }
   },
   "metadata": {
-    "generated": "2023-08-06T00:00:00Z",
+    "generated": "2023-08-19T00:00:00Z",
     "rpmmd_repos": {
       "fedora": {
         "generated": "2023-04-13T20:36:47Z"
       },
       "fedora-coreos-pool": {
-        "generated": "2023-08-05T03:48:27Z"
+        "generated": "2023-08-18T06:29:13Z"
       },
       "fedora-updates": {
-        "generated": "2023-08-06T01:31:41Z"
+        "generated": "2023-08-19T01:06:45Z"
       }
     }
   }
diff --git a/manifest-lock.s390x.json b/manifest-lock.s390x.json
index 9979394a72..f071917f12 100644
--- a/manifest-lock.s390x.json
+++ b/manifest-lock.s390x.json
@@ -37,16 +37,16 @@
       "evra": "1.25-1.fc38.s390x"
     },
     "amd-gpu-firmware": {
-      "evra": "20230625-151.fc38.noarch"
+      "evra": "20230804-153.fc38.noarch"
     },
     "atheros-firmware": {
-      "evra": "20230625-151.fc38.noarch"
+      "evra": "20230804-153.fc38.noarch"
     },
     "attr": {
       "evra": "2.5.1-6.fc38.s390x"
     },
     "audit-libs": {
-      "evra": "3.1.1-1.fc38.s390x"
+      "evra": "3.1.2-1.fc38.s390x"
     },
     "authselect": {
       "evra": "1.4.2-2.fc38.s390x"
@@ -76,7 +76,7 @@
       "evra": "32:9.18.17-1.fc38.s390x"
     },
     "brcmfmac-firmware": {
-      "evra": "20230625-151.fc38.noarch"
+      "evra": "20230804-153.fc38.noarch"
     },
     "bsdtar": {
       "evra": "3.6.1-4.fc38.s390x"
@@ -139,13 +139,13 @@
       "evra": "0.21.3-4.fc38.noarch"
     },
     "container-selinux": {
-      "evra": "2:2.219.0-1.fc38.noarch"
+      "evra": "2:2.221.0-1.fc38.noarch"
     },
     "containerd": {
       "evra": "1.6.19-1.fc38.s390x"
     },
     "containernetworking-plugins": {
-      "evra": "1.1.1-16.fc38.s390x"
+      "evra": "1.3.0-2.fc38.s390x"
     },
     "containers-common": {
       "evra": "4:1-89.fc38.noarch"
@@ -373,7 +373,7 @@
       "evra": "3.8.0-2.fc38.s390x"
     },
     "gpgme": {
-      "evra": "1.17.1-3.fc38.s390x"
+      "evra": "1.17.1-5.fc38.s390x"
     },
     "grep": {
       "evra": "3.8-3.fc38.s390x"
@@ -391,7 +391,7 @@
       "evra": "57-1.fc38.s390x"
     },
     "intel-gpu-firmware": {
-      "evra": "20230625-151.fc38.noarch"
+      "evra": "20230804-153.fc38.noarch"
     },
     "ipcalc": {
       "evra": "1.0.3-1.fc38.s390x"
@@ -442,10 +442,10 @@
       "evra": "11-7.fc38.s390x"
     },
     "jq": {
-      "evra": "1.6-15.fc38.s390x"
+      "evra": "1.6-16.fc38.s390x"
     },
     "json-c": {
-      "evra": "0.16-4.fc38.s390x"
+      "evra": "0.17-1.fc38.s390x"
     },
     "json-glib": {
       "evra": "1.6.6-4.fc38.s390x"
@@ -460,16 +460,16 @@
       "evra": "2.5.1-5.fc38.noarch"
     },
     "kernel": {
-      "evra": "6.4.7-200.fc38.s390x"
+      "evra": "6.4.11-200.fc38.s390x"
     },
     "kernel-core": {
-      "evra": "6.4.7-200.fc38.s390x"
+      "evra": "6.4.11-200.fc38.s390x"
     },
     "kernel-modules": {
-      "evra": "6.4.7-200.fc38.s390x"
+      "evra": "6.4.11-200.fc38.s390x"
     },
     "kernel-modules-core": {
-      "evra": "6.4.7-200.fc38.s390x"
+      "evra": "6.4.11-200.fc38.s390x"
     },
     "kexec-tools": {
       "evra": "2.0.26-3.fc38.s390x"
@@ -490,7 +490,7 @@
       "evra": "0.9.4-2.fc38.s390x"
     },
     "krb5-libs": {
-      "evra": "1.21-2.fc38.s390x"
+      "evra": "1.21-3.fc38.s390x"
     },
     "less": {
       "evra": "633-1.fc38.s390x"
@@ -640,7 +640,7 @@
       "evra": "1.0.1-23.fc38.s390x"
     },
     "libnfsidmap": {
-      "evra": "1:2.6.3-0.fc38.s390x"
+      "evra": "1:2.6.3-1.rc3.fc38.s390x"
     },
     "libnftnl": {
       "evra": "1.2.4-2.fc38.s390x"
@@ -748,7 +748,7 @@
       "evra": "0.14.1-1.fc38.s390x"
     },
     "libtirpc": {
-      "evra": "1.3.3-1.rc1.fc38.s390x"
+      "evra": "1.3.3-1.rc2.fc38.s390x"
     },
     "libtool-ltdl": {
       "evra": "2.4.7-6.fc38.s390x"
@@ -793,10 +793,10 @@
       "evra": "2.5.1-34.fc38.s390x"
     },
     "linux-firmware": {
-      "evra": "20230625-151.fc38.noarch"
+      "evra": "20230804-153.fc38.noarch"
     },
     "linux-firmware-whence": {
-      "evra": "20230625-151.fc38.noarch"
+      "evra": "20230804-153.fc38.noarch"
     },
     "lmdb-libs": {
       "evra": "0.9.31-1.fc38.s390x"
@@ -835,7 +835,7 @@
       "evra": "4.1.1-3.fc38.s390x"
     },
     "mt7xxx-firmware": {
-      "evra": "20230625-151.fc38.noarch"
+      "evra": "20230804-153.fc38.noarch"
     },
     "nano": {
       "evra": "7.2-2.fc38.s390x"
@@ -865,7 +865,7 @@
       "evra": "0.52.23-2.fc38.s390x"
     },
     "nfs-utils-coreos": {
-      "evra": "1:2.6.3-0.fc38.s390x"
+      "evra": "1:2.6.3-1.rc3.fc38.s390x"
     },
     "nftables": {
       "evra": "1:1.0.5-2.fc38.s390x"
@@ -880,7 +880,7 @@
       "evra": "2.18.1-22.fc38.s390x"
     },
     "nvidia-gpu-firmware": {
-      "evra": "20230625-151.fc38.noarch"
+      "evra": "20230804-153.fc38.noarch"
     },
     "nvme-cli": {
       "evra": "2.4-2.fc38.s390x"
@@ -907,10 +907,10 @@
       "evra": "1:3.0.9-2.fc38.s390x"
     },
     "ostree": {
-      "evra": "2023.4-2.fc38.s390x"
+      "evra": "2023.5-2.fc38.s390x"
     },
     "ostree-libs": {
-      "evra": "2023.4-2.fc38.s390x"
+      "evra": "2023.5-2.fc38.s390x"
     },
     "p11-kit": {
       "evra": "0.25.0-1.fc38.s390x"
@@ -952,10 +952,10 @@
       "evra": "1.8.0-6.fc38.s390x"
     },
     "podman": {
-      "evra": "5:4.6.0-1.fc38.s390x"
+      "evra": "5:4.6.1-1.fc38.s390x"
     },
     "podman-plugins": {
-      "evra": "5:4.6.0-1.fc38.s390x"
+      "evra": "5:4.6.1-1.fc38.s390x"
     },
     "policycoreutils": {
       "evra": "3.5-1.fc38.s390x"
@@ -982,16 +982,16 @@
       "evra": "23.6-2.fc38.s390x"
     },
     "publicsuffix-list-dafsa": {
-      "evra": "20230614-1.fc38.noarch"
+      "evra": "20230812-1.fc38.noarch"
     },
     "qemu-user-static-x86": {
-      "evra": "2:7.2.1-2.fc38.s390x"
+      "evra": "2:7.2.4-2.fc38.s390x"
     },
     "readline": {
       "evra": "8.2-3.fc38.s390x"
     },
     "realtek-firmware": {
-      "evra": "20230625-151.fc38.noarch"
+      "evra": "20230804-153.fc38.noarch"
     },
     "rpcbind": {
       "evra": "1.2.6-4.rc2.fc38.s390x"
@@ -1036,10 +1036,10 @@
       "evra": "4.8-12.fc38.s390x"
     },
     "selinux-policy": {
-      "evra": "38.22-1.fc38.noarch"
+      "evra": "38.24-1.fc38.noarch"
     },
     "selinux-policy-targeted": {
-      "evra": "38.22-1.fc38.noarch"
+      "evra": "38.24-1.fc38.noarch"
     },
     "setup": {
       "evra": "2.14.3-2.fc38.noarch"
@@ -1057,7 +1057,7 @@
       "evra": "2:4.13-6.fc38.s390x"
     },
     "skopeo": {
-      "evra": "1:1.13.1-1.fc38.s390x"
+      "evra": "1:1.13.2-1.fc38.s390x"
     },
     "slang": {
       "evra": "2.3.3-3.fc38.s390x"
@@ -1114,22 +1114,22 @@
       "evra": "1.9.13-2.p2.fc38.s390x"
     },
     "systemd": {
-      "evra": "253.4-1.fc38.s390x"
+      "evra": "253.7-1.fc38.s390x"
     },
     "systemd-container": {
-      "evra": "253.4-1.fc38.s390x"
+      "evra": "253.7-1.fc38.s390x"
     },
     "systemd-libs": {
-      "evra": "253.4-1.fc38.s390x"
+      "evra": "253.7-1.fc38.s390x"
     },
     "systemd-pam": {
-      "evra": "253.4-1.fc38.s390x"
+      "evra": "253.7-1.fc38.s390x"
     },
     "systemd-resolved": {
-      "evra": "253.4-1.fc38.s390x"
+      "evra": "253.7-1.fc38.s390x"
     },
     "systemd-udev": {
-      "evra": "253.4-1.fc38.s390x"
+      "evra": "253.7-1.fc38.s390x"
     },
     "tar": {
       "evra": "2:1.34-8.fc38.s390x"
@@ -1162,10 +1162,10 @@
       "evra": "2.6.1-1.fc38.s390x"
     },
     "vim-data": {
-      "evra": "2:9.0.1677-2.fc38.noarch"
+      "evra": "2:9.0.1712-1.fc38.noarch"
     },
     "vim-minimal": {
-      "evra": "2:9.0.1677-2.fc38.s390x"
+      "evra": "2:9.0.1712-1.fc38.s390x"
     },
     "which": {
       "evra": "2.21-39.fc38.s390x"
@@ -1205,16 +1205,16 @@
     }
   },
   "metadata": {
-    "generated": "2023-08-06T00:00:00Z",
+    "generated": "2023-08-19T00:00:00Z",
     "rpmmd_repos": {
       "fedora": {
         "generated": "2023-04-13T20:36:40Z"
       },
       "fedora-coreos-pool": {
-        "generated": "2023-08-05T03:49:01Z"
+        "generated": "2023-08-18T06:29:07Z"
       },
       "fedora-updates": {
-        "generated": "2023-08-06T01:31:49Z"
+        "generated": "2023-08-19T01:06:52Z"
       }
     }
   }
diff --git a/manifest-lock.x86_64.json b/manifest-lock.x86_64.json
index 7325e54a0b..4a616f7af5 100644
--- a/manifest-lock.x86_64.json
+++ b/manifest-lock.x86_64.json
@@ -37,16 +37,16 @@
       "evra": "1.25-1.fc38.x86_64"
     },
     "amd-gpu-firmware": {
-      "evra": "20230625-151.fc38.noarch"
+      "evra": "20230804-153.fc38.noarch"
     },
     "atheros-firmware": {
-      "evra": "20230625-151.fc38.noarch"
+      "evra": "20230804-153.fc38.noarch"
     },
     "attr": {
       "evra": "2.5.1-6.fc38.x86_64"
     },
     "audit-libs": {
-      "evra": "3.1.1-1.fc38.x86_64"
+      "evra": "3.1.2-1.fc38.x86_64"
     },
     "authselect": {
       "evra": "1.4.2-2.fc38.x86_64"
@@ -79,7 +79,7 @@
       "evra": "0.2.9-1.fc38.x86_64"
     },
     "brcmfmac-firmware": {
-      "evra": "20230625-151.fc38.noarch"
+      "evra": "20230804-153.fc38.noarch"
     },
     "bsdtar": {
       "evra": "3.6.1-4.fc38.x86_64"
@@ -142,13 +142,13 @@
       "evra": "0.21.3-4.fc38.noarch"
     },
     "container-selinux": {
-      "evra": "2:2.219.0-1.fc38.noarch"
+      "evra": "2:2.221.0-1.fc38.noarch"
     },
     "containerd": {
       "evra": "1.6.19-1.fc38.x86_64"
     },
     "containernetworking-plugins": {
-      "evra": "1.1.1-16.fc38.x86_64"
+      "evra": "1.3.0-2.fc38.x86_64"
     },
     "containers-common": {
       "evra": "4:1-89.fc38.noarch"
@@ -397,10 +397,10 @@
       "evra": "3.8.0-2.fc38.x86_64"
     },
     "google-compute-engine-guest-configs-udev": {
-      "evra": "20230526.00-3.fc38.noarch"
+      "evra": "20230808.00-1.fc38.noarch"
     },
     "gpgme": {
-      "evra": "1.17.1-3.fc38.x86_64"
+      "evra": "1.17.1-5.fc38.x86_64"
     },
     "grep": {
       "evra": "3.8-3.fc38.x86_64"
@@ -436,7 +436,7 @@
       "evra": "57-1.fc38.x86_64"
     },
     "intel-gpu-firmware": {
-      "evra": "20230625-151.fc38.noarch"
+      "evra": "20230804-153.fc38.noarch"
     },
     "ipcalc": {
       "evra": "1.0.3-1.fc38.x86_64"
@@ -490,10 +490,10 @@
       "evra": "11-7.fc38.x86_64"
     },
     "jq": {
-      "evra": "1.6-15.fc38.x86_64"
+      "evra": "1.6-16.fc38.x86_64"
     },
     "json-c": {
-      "evra": "0.16-4.fc38.x86_64"
+      "evra": "0.17-1.fc38.x86_64"
     },
     "json-glib": {
       "evra": "1.6.6-4.fc38.x86_64"
@@ -508,16 +508,16 @@
       "evra": "2.5.1-5.fc38.noarch"
     },
     "kernel": {
-      "evra": "6.4.7-200.fc38.x86_64"
+      "evra": "6.4.11-200.fc38.x86_64"
     },
     "kernel-core": {
-      "evra": "6.4.7-200.fc38.x86_64"
+      "evra": "6.4.11-200.fc38.x86_64"
     },
     "kernel-modules": {
-      "evra": "6.4.7-200.fc38.x86_64"
+      "evra": "6.4.11-200.fc38.x86_64"
     },
     "kernel-modules-core": {
-      "evra": "6.4.7-200.fc38.x86_64"
+      "evra": "6.4.11-200.fc38.x86_64"
     },
     "kexec-tools": {
       "evra": "2.0.26-3.fc38.x86_64"
@@ -538,7 +538,7 @@
       "evra": "0.9.4-2.fc38.x86_64"
     },
     "krb5-libs": {
-      "evra": "1.21-2.fc38.x86_64"
+      "evra": "1.21-3.fc38.x86_64"
     },
     "less": {
       "evra": "633-1.fc38.x86_64"
@@ -700,7 +700,7 @@
       "evra": "1.0.1-23.fc38.x86_64"
     },
     "libnfsidmap": {
-      "evra": "1:2.6.3-0.fc38.x86_64"
+      "evra": "1:2.6.3-1.rc3.fc38.x86_64"
     },
     "libnftnl": {
       "evra": "1.2.4-2.fc38.x86_64"
@@ -808,7 +808,7 @@
       "evra": "0.14.1-1.fc38.x86_64"
     },
     "libtirpc": {
-      "evra": "1.3.3-1.rc1.fc38.x86_64"
+      "evra": "1.3.3-1.rc2.fc38.x86_64"
     },
     "libtool-ltdl": {
       "evra": "2.4.7-6.fc38.x86_64"
@@ -847,7 +847,7 @@
       "evra": "2.10.4-1.fc38.x86_64"
     },
     "libxmlb": {
-      "evra": "0.3.11-1.fc38.x86_64"
+      "evra": "0.3.12-1.fc38.x86_64"
     },
     "libyaml": {
       "evra": "0.2.5-9.fc38.x86_64"
@@ -859,10 +859,10 @@
       "evra": "2.5.1-34.fc38.x86_64"
     },
     "linux-firmware": {
-      "evra": "20230625-151.fc38.noarch"
+      "evra": "20230804-153.fc38.noarch"
     },
     "linux-firmware-whence": {
-      "evra": "20230625-151.fc38.noarch"
+      "evra": "20230804-153.fc38.noarch"
     },
     "lmdb-libs": {
       "evra": "0.9.31-1.fc38.x86_64"
@@ -895,7 +895,7 @@
       "evra": "4.2-4.fc38.x86_64"
     },
     "microcode_ctl": {
-      "evra": "2:2.1-55.fc38.x86_64"
+      "evra": "2:2.1-55.1.fc38.x86_64"
     },
     "moby-engine": {
       "evra": "20.10.23-1.fc38.x86_64"
@@ -907,7 +907,7 @@
       "evra": "4.1.1-3.fc38.x86_64"
     },
     "mt7xxx-firmware": {
-      "evra": "20230625-151.fc38.noarch"
+      "evra": "20230804-153.fc38.noarch"
     },
     "nano": {
       "evra": "7.2-2.fc38.x86_64"
@@ -937,7 +937,7 @@
       "evra": "0.52.23-2.fc38.x86_64"
     },
     "nfs-utils-coreos": {
-      "evra": "1:2.6.3-0.fc38.x86_64"
+      "evra": "1:2.6.3-1.rc3.fc38.x86_64"
     },
     "nftables": {
       "evra": "1:1.0.5-2.fc38.x86_64"
@@ -955,7 +955,7 @@
       "evra": "2.0.16-2.fc38.x86_64"
     },
     "nvidia-gpu-firmware": {
-      "evra": "20230625-151.fc38.noarch"
+      "evra": "20230804-153.fc38.noarch"
     },
     "nvme-cli": {
       "evra": "2.4-2.fc38.x86_64"
@@ -985,10 +985,10 @@
       "evra": "1.81-3.fc38.x86_64"
     },
     "ostree": {
-      "evra": "2023.4-2.fc38.x86_64"
+      "evra": "2023.5-2.fc38.x86_64"
     },
     "ostree-libs": {
-      "evra": "2023.4-2.fc38.x86_64"
+      "evra": "2023.5-2.fc38.x86_64"
     },
     "p11-kit": {
       "evra": "0.25.0-1.fc38.x86_64"
@@ -1030,10 +1030,10 @@
       "evra": "1.8.0-6.fc38.x86_64"
     },
     "podman": {
-      "evra": "5:4.6.0-1.fc38.x86_64"
+      "evra": "5:4.6.1-1.fc38.x86_64"
     },
     "podman-plugins": {
-      "evra": "5:4.6.0-1.fc38.x86_64"
+      "evra": "5:4.6.1-1.fc38.x86_64"
     },
     "policycoreutils": {
       "evra": "3.5-1.fc38.x86_64"
@@ -1060,13 +1060,13 @@
       "evra": "23.6-2.fc38.x86_64"
     },
     "publicsuffix-list-dafsa": {
-      "evra": "20230614-1.fc38.noarch"
+      "evra": "20230812-1.fc38.noarch"
     },
     "readline": {
       "evra": "8.2-3.fc38.x86_64"
     },
     "realtek-firmware": {
-      "evra": "20230625-151.fc38.noarch"
+      "evra": "20230804-153.fc38.noarch"
     },
     "rpcbind": {
       "evra": "1.2.6-4.rc2.fc38.x86_64"
@@ -1108,10 +1108,10 @@
       "evra": "4.8-12.fc38.x86_64"
     },
     "selinux-policy": {
-      "evra": "38.22-1.fc38.noarch"
+      "evra": "38.24-1.fc38.noarch"
     },
     "selinux-policy-targeted": {
-      "evra": "38.22-1.fc38.noarch"
+      "evra": "38.24-1.fc38.noarch"
     },
     "setup": {
       "evra": "2.14.3-2.fc38.noarch"
@@ -1135,7 +1135,7 @@
       "evra": "15.6-2.x86_64"
     },
     "skopeo": {
-      "evra": "1:1.13.1-1.fc38.x86_64"
+      "evra": "1:1.13.2-1.fc38.x86_64"
     },
     "slang": {
       "evra": "2.3.3-3.fc38.x86_64"
@@ -1192,22 +1192,22 @@
       "evra": "1.9.13-2.p2.fc38.x86_64"
     },
     "systemd": {
-      "evra": "253.4-1.fc38.x86_64"
+      "evra": "253.7-1.fc38.x86_64"
     },
     "systemd-container": {
-      "evra": "253.4-1.fc38.x86_64"
+      "evra": "253.7-1.fc38.x86_64"
     },
     "systemd-libs": {
-      "evra": "253.4-1.fc38.x86_64"
+      "evra": "253.7-1.fc38.x86_64"
     },
     "systemd-pam": {
-      "evra": "253.4-1.fc38.x86_64"
+      "evra": "253.7-1.fc38.x86_64"
     },
     "systemd-resolved": {
-      "evra": "253.4-1.fc38.x86_64"
+      "evra": "253.7-1.fc38.x86_64"
     },
     "systemd-udev": {
-      "evra": "253.4-1.fc38.x86_64"
+      "evra": "253.7-1.fc38.x86_64"
     },
     "tar": {
       "evra": "2:1.34-8.fc38.x86_64"
@@ -1237,10 +1237,10 @@
       "evra": "2.38.1-4.fc38.x86_64"
     },
     "vim-data": {
-      "evra": "2:9.0.1677-2.fc38.noarch"
+      "evra": "2:9.0.1712-1.fc38.noarch"
     },
     "vim-minimal": {
-      "evra": "2:9.0.1677-2.fc38.x86_64"
+      "evra": "2:9.0.1712-1.fc38.x86_64"
     },
     "which": {
       "evra": "2.21-39.fc38.x86_64"
@@ -1280,16 +1280,16 @@
     }
   },
   "metadata": {
-    "generated": "2023-08-06T00:00:00Z",
+    "generated": "2023-08-19T00:00:00Z",
     "rpmmd_repos": {
       "fedora": {
         "generated": "2023-04-13T20:37:10Z"
       },
       "fedora-coreos-pool": {
-        "generated": "2023-08-05T03:49:20Z"
+        "generated": "2023-08-18T06:29:59Z"
       },
       "fedora-updates": {
-        "generated": "2023-08-06T01:31:56Z"
+        "generated": "2023-08-19T01:06:59Z"
       }
     }
   }
diff --git a/manifests/system-configuration.yaml b/manifests/system-configuration.yaml
index 77bdb5d2c4..a2fad7794a 100644
--- a/manifests/system-configuration.yaml
+++ b/manifests/system-configuration.yaml
@@ -39,6 +39,8 @@ packages:
   - stalld
   # Ignition aware SSH key management
   - ssh-key-dir
+  # Allow for configuring different timezones
+  - tzdata
 
 postprocess:
   # Mask systemd-repart. Ignition is responsible for partition setup on first
diff --git a/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-diskful-generator b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-diskful-generator
index c6cb313cea..8414013758 100755
--- a/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-diskful-generator
+++ b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-diskful-generator
@@ -41,15 +41,53 @@ add_requires() {
     ln -sf "../${name}" "${requires_dir}/${name}"
 }
 
+# If this is a live image then exit early.
+if is-live-image; then
+    exit 0
+fi
+
+# Generate a sysroot.mount unit. We can't do this later by dynamically
+# doing the mount like we used to because systemd 254+ will drop units that
+# require sysroot.mount from the transaction:
+# https://github.com/coreos/fedora-coreos-tracker/issues/1527#issuecomment-1656786452
+#
+# We'll dynamically pick up what mount options to use from the OPTIONS
+# environment variable in /run/coreos-rootflags (generated by
+# coreos-rootflags.service).
+#
+# Note that for new machines this is *only* useful on first boot because
+# coreos-boot-edit.service will add the root= and rootflags= kargs to the
+# kernel command line for subsequent boots. However we haven't migrated
+# all old machines so there are still some that could exist that don't
+# have root= and rootflags= kargs. For that reason we run this bit of
+# code on EVERY diskful boot.
+mkdir -p ${UNIT_DIR}
+# We want to generate sysroot.mount on ostree systems, but we don't want
+# to run if there's already a root= karg, where the systemd-fstab-generator
+# should win.
+if test -n "$(cmdline_arg ostree)" && test -z "$(cmdline_arg root)"; then
+    cat >${UNIT_DIR}/sysroot.mount << 'EOF'
+[Unit]
+Before=initrd-root-fs.target
+After=coreos-rootflags.service
+[Mount]
+EnvironmentFile=/run/coreos-rootflags
+What=/dev/disk/by-label/root
+Where=/sysroot
+Options=${OPTIONS}
+EOF
+    add_requires sysroot.mount initrd-root-fs.target
+    add_requires coreos-rootflags.service initrd-root-fs.target
+fi
+
 if ! $(cmdline_bool 'ignition.firstboot' 0); then
     exit 0
 fi
 
-if ! is-live-image; then
-    # coreos-ignition-setup-user.service should depend on the boot device node
-    # only on diskful boots
-    mkdir -p "${UNIT_DIR}/coreos-ignition-setup-user.service.d"
-    cat > "${UNIT_DIR}/coreos-ignition-setup-user.service.d/diskful.conf" <<EOF
+# coreos-ignition-setup-user.service should depend on the boot device node
+# only on diskful boots
+mkdir -p "${UNIT_DIR}/coreos-ignition-setup-user.service.d"
+cat > "${UNIT_DIR}/coreos-ignition-setup-user.service.d/diskful.conf" <<EOF
 [Unit]
 Requires=dev-disk-by\x2dlabel-boot.device
 After=dev-disk-by\x2dlabel-boot.device
@@ -58,33 +96,32 @@ Requires=coreos-gpt-setup.service
 After=coreos-gpt-setup.service
 EOF
 
-    # create symlink for udev rule
-    mkdir -p /run/udev/rules.d/
-    ln -sf /usr/lib/coreos/80-coreos-boot-disk.rules \
-          /run/udev/rules.d/80-coreos-boot-disk.rules
+# create symlink for udev rule
+mkdir -p /run/udev/rules.d/
+ln -sf /usr/lib/coreos/80-coreos-boot-disk.rules \
+      /run/udev/rules.d/80-coreos-boot-disk.rules
 
-    # IBM Secure Execution case
-    # During firstboot we have to reencrypt '/boot' and '/', to do that an Ignition config
-    # is injected. 'coreos-boot-disk' is required for this
-    secure_execution=0
-    if [[ $(uname -m) == s390x ]] && [[ -e /sys/firmware/uv/prot_virt_guest ]]; then
-        secure_execution=$(cat /sys/firmware/uv/prot_virt_guest)
-    fi
-    if [[ "${secure_execution}" = "1" ]]; then
-        mkdir -p /run/coreos/
-        touch /run/coreos/secure-execution
-        cp /usr/lib/coreos/01-secex.ign /usr/lib/ignition/base.d/01-secex.ign
-        # Add dropins to disable Ignition logging for all stages
-        stages=("fetch-offline" "fetch" "kargs" "disks" "mount" "files")
-        for s in "${stages[@]}"; do
-            dropin="${UNIT_DIR}/ignition-${s}.service.d"
-            mkdir -p "${dropin}"
-            cat > "${dropin}/10-secex.conf" <<EOF
+# IBM Secure Execution case
+# During firstboot we have to reencrypt '/boot' and '/', to do that an Ignition config
+# is injected. 'coreos-boot-disk' is required for this
+secure_execution=0
+if [[ $(uname -m) == s390x ]] && [[ -e /sys/firmware/uv/prot_virt_guest ]]; then
+    secure_execution=$(cat /sys/firmware/uv/prot_virt_guest)
+fi
+if [[ "${secure_execution}" = "1" ]]; then
+    mkdir -p /run/coreos/
+    touch /run/coreos/secure-execution
+    cp /usr/lib/coreos/01-secex.ign /usr/lib/ignition/base.d/01-secex.ign
+    # Add dropins to disable Ignition logging for all stages
+    stages=("fetch-offline" "fetch" "kargs" "disks" "mount" "files")
+    for s in "${stages[@]}"; do
+        dropin="${UNIT_DIR}/ignition-${s}.service.d"
+        mkdir -p "${dropin}"
+        cat > "${dropin}/10-secex.conf" <<EOF
 [Service]
 Environment=IGNITION_ARGS=-log-to-stdout
 StandardOutput=null
 StandardError=null
 EOF
-        done
-    fi
+    done
 fi
diff --git a/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-gpt-setup.sh b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-gpt-setup.sh
index e3faab91a3..11cebd34f3 100755
--- a/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-gpt-setup.sh
+++ b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-gpt-setup.sh
@@ -8,23 +8,12 @@ UNINITIALIZED_GUID='00000000-0000-4000-a000-000000000001'
 
 # If it's on multipath, get the parent device from udev properties.
 DM_MPATH=$(eval $(udevadm info --query property --export "$1") && echo "${DM_MPATH:-}")
-
 if [ -n "${DM_MPATH:-}" ]; then
     PKNAME=/dev/mapper/$DM_MPATH
     PTUUID=$(eval $(udevadm info --query property --export "$PKNAME") && echo "${ID_PART_TABLE_UUID:-}")
 else
-    # On RHEL 8 the version of lsblk doesn't have PTUUID. Let's detect
-    # if lsblk supports it. In the future we can remove the 'if' and
-    # just use the 'else'.
-    if ! lsblk --help | grep -q PTUUID; then
-        # Get the PKNAME
-        eval $(lsblk --output PKNAME --pairs --paths --nodeps "$1")
-        # Get the PTUUID
-        eval $(blkid -p -o export $PKNAME)
-    else
-        # PTUUID is the disk guid, PKNAME is the parent kernel name
-        eval $(lsblk --output PTUUID,PKNAME --pairs --paths --nodeps "$1")
-    fi
+    # PTUUID is the disk guid, PKNAME is the parent kernel name
+    eval $(lsblk --output PTUUID,PKNAME --pairs --paths --nodeps "$1")
 fi
 
 # Skip in the following two cases:
diff --git a/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-rootflags.service b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-rootflags.service
new file mode 100644
index 0000000000..3981f08510
--- /dev/null
+++ b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-rootflags.service
@@ -0,0 +1,25 @@
+[Unit]
+Description=Determine root FS mount option flags
+DefaultDependencies=false
+# Just in case. We shouldn't run twice.
+ConditionPathExists=!/run/coreos-rootflags
+# Since the sysroot.mount depends on the options generated by us
+# we must run before sysroot.mount
+Before=sysroot.mount
+# In case the disk was manipulated by Ignition and we need to pick
+# up mount options from Ignition config.
+After=ignition-disks.service
+# The script checks if the rootfs was reprovisioned so let's wait
+# until after that has completed if it was requested.
+After=ignition-ostree-transposefs-restore.service
+# Needs to run after the root device is available
+Requires=dev-disk-by\x2dlabel-root.device
+After=dev-disk-by\x2dlabel-root.device
+
+[Service]
+Type=oneshot
+StandardError=journal
+StandardOutput=append:/run/coreos-rootflags
+ExecStartPre=echo -n 'OPTIONS='
+ExecStart=/usr/sbin/coreos-rootflags
+RemainAfterExit=yes
diff --git a/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/coreos-rootflags.sh b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-rootflags.sh
similarity index 100%
rename from overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/coreos-rootflags.sh
rename to overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-rootflags.sh
diff --git a/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/module-setup.sh b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/module-setup.sh
index d39da6fa08..f78725fdc6 100755
--- a/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/module-setup.sh
+++ b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/module-setup.sh
@@ -87,4 +87,9 @@ install() {
     inst_script "$moddir/coreos-secex-ignition-decrypt.sh" \
         "/usr/sbin/coreos-secex-ignition-decrypt"
 
+    inst_multiple jq blkid
+    inst_script "$moddir/coreos-rootflags.sh" \
+        "/usr/sbin/coreos-rootflags"
+    # Install unit, but don't enable it. Will be pulled in by diskful generator.
+    inst_simple "$moddir/coreos-rootflags.service" "$systemdsystemunitdir/coreos-rootflags.service"
 }
diff --git a/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-live/coreos-liveiso-persist-osmet.service b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-live/coreos-liveiso-persist-osmet.service
index 3cef6adc30..e4cc6dba27 100644
--- a/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-live/coreos-liveiso-persist-osmet.service
+++ b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-live/coreos-liveiso-persist-osmet.service
@@ -1,12 +1,12 @@
 [Unit]
 Description=Persist Osmet Files (ISO)
-DefaultDependencies=false
 ConditionPathExists=/run/ostree-live
 ConditionKernelCommandLine=coreos.liveiso
 RequiresMountsFor=/run/media/iso
-# on el8, the ISO is mounted by our own systemd unit
-After=run-media-iso-mount.service
 Before=initrd-switch-root.target
+# DefaultDependencies=true so this unit gets stopped on switchroot to
+# allow for /run/media/iso to get unmounted.
+DefaultDependencies=true
 
 [Service]
 Type=oneshot
diff --git a/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-live/live-generator b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-live/live-generator
index 15fda8c241..add4e6dcca 100755
--- a/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-live/live-generator
+++ b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-live/live-generator
@@ -54,11 +54,6 @@ ExecStartPost=/usr/sbin/ostree-cmdline stop
 EOF
 
 isoroot=$(getarg coreos.liveiso= ||:)
-is_rhcos8() {
-    # Unfortunately we can't rely on /etc/os-release since el8 doesn't seem to
-    # have https://github.com/dracutdevs/dracut/pull/655.
-    [[ "${isoroot}" == rhcos-* ]] && [[ $(uname -r) == *.el8* ]]
-}
 
 if [ -z "${isoroot}" ]; then
     # In this case, the rootfs is already unpacked into the initrd, or we need
@@ -90,32 +85,8 @@ else
 After=${isosrc_escaped}
 Requires=${isosrc_escaped}
 EOF
-    # Temporary hack for rhel8, where our mount unit can race with udev's
-    # cdrom_id using open(O_EXCL). See:
-    # https://github.com/coreos/fedora-coreos-config/pull/1986#pullrequestreview-1120840529
-    # https://issues.redhat.com/browse/OCPBUGS-1505
-    if is_rhcos8; then
-        cat >"${UNIT_DIR}/run-media-iso-mount.service" <<EOF
-# Automatically generated by live-generator
-
-[Unit]
-DefaultDependencies=false
-# Note that bootup(7) implies that initrd-root-device is After=basic.target
-# but that appears to not be the case.  We explicitly order after sysinit.target
-After=sysinit.target
-After=initrd-root-device.target
-Before=initrd-root-fs.target
 
-[Service]
-Type=oneshot
-RemainAfterExit=yes
-# See https://issues.redhat.com/browse/OCPBUGS-1505
-# and https://github.com/coreos/fedora-coreos-config/pull/411
-ExecStart=/bin/sh -c 'for x in {0..60}; do if mount -o ro -t iso9660 /${isosrc} /run/media/iso; then break; fi; sleep 1; done'
-EOF
-        add_requires run-media-iso-mount.service initrd-root-fs.target
-    else
-        cat >"${UNIT_DIR}/run-media-iso.mount" <<EOF
+    cat >"${UNIT_DIR}/run-media-iso.mount" <<EOF
 # Automatically generated by live-generator
 
 [Unit]
@@ -127,6 +98,9 @@ Wants=systemd-udev-settle.service
 After=sysinit.target
 After=initrd-root-device.target
 Before=initrd-root-fs.target
+# This will make /run/media/iso get unmounted when no longer needed,
+# which will aid in the coreos.liveiso.fromram case.
+StopWhenUnneeded=true
 
 [Mount]
 What=/${isosrc}
@@ -134,6 +108,32 @@ Where=/run/media/iso
 Options=ro
 Type=iso9660
 EOF
+
+    # Determine what to mount in sysroot.mount based on if we were asked to run
+    # completely from RAM via coreos.liveiso.fromram karg.
+    if getargbool 0 coreos.liveiso.fromram; then
+        sysrootrequiresmountsfor=""
+        sysrootfsimg=/rootfs.img
+        # Add service to copy the rootfs.img from the ISO to memory
+        cat >"${UNIT_DIR}/coreos-liveiso-run-media-iso-cp-rootfsimg.service" <<EOF
+# Automatically generated by live-generator
+
+[Unit]
+RequiresMountsFor=/run/media/iso
+Before=sysroot.mount
+# DefaultDependencies=true so this unit gets stopped on switchroot to
+# allow for /run/media/iso to get unmounted.
+DefaultDependencies=true
+
+[Service]
+Type=oneshot
+ExecStart=cp -v /run/media/iso/images/pxeboot/rootfs.img /rootfs.img
+RemainAfterExit=yes
+EOF
+        add_requires coreos-liveiso-run-media-iso-cp-rootfsimg.service default.target
+    else
+        sysrootrequiresmountsfor="RequiresMountsFor=/run/media/iso"
+        sysrootfsimg=/run/media/iso/images/pxeboot/rootfs.img
     fi
 
     cat >"${UNIT_DIR}/sysroot.mount" <<EOF
@@ -142,12 +142,11 @@ EOF
 [Unit]
 DefaultDependencies=false
 Before=initrd-root-fs.target
-RequiresMountsFor=/run/media/iso
-# on el8, the ISO is mounted by our own systemd unit
-After=run-media-iso-mount.service
+After=coreos-liveiso-run-media-iso-cp-rootfsimg.service
+${sysrootrequiresmountsfor}
 
 [Mount]
-What=/run/media/iso/images/pxeboot/rootfs.img
+What=${sysrootfsimg}
 Where=/sysroot
 Type=squashfs
 # Offset of the squashfs within the rootfs cpio.  Assumes newc format
@@ -212,11 +211,9 @@ DefaultDependencies=false
 RequiresMountsFor=/run/ephemeral
 ConditionPathExists=/usr/lib/initrd-release
 ConditionPathExists=!/run/ephemeral/var
-# Make sure /sysroot is mounted first, since we're mounting under there
-Requires=sysroot.mount
-After=sysroot.mount
-# And after OSTree has set up the chroot() equivalent
+# We want to run after ostree is set up
 After=ostree-prepare-root.service
+Requires=ostree-prepare-root.service
 
 [Service]
 Type=oneshot
diff --git a/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-check-rootfs-size.service b/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-check-rootfs-size.service
index 610c469474..340b4d4251 100644
--- a/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-check-rootfs-size.service
+++ b/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-check-rootfs-size.service
@@ -6,6 +6,7 @@ ConditionKernelCommandLine=ostree
 ConditionPathExists=!/run/ostree-live
 After=ignition-ostree-growfs.service
 After=ostree-prepare-root.service
+Requires=ostree-prepare-root.service
 # Allow Ignition config to blank out the warning
 Before=ignition-files.service
 
diff --git a/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-growfs.service b/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-growfs.service
index da47d6660c..ce25509ac6 100644
--- a/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-growfs.service
+++ b/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-growfs.service
@@ -4,7 +4,7 @@ DefaultDependencies=false
 ConditionKernelCommandLine=ostree
 ConditionPathExists=!/run/ostree-live
 Before=initrd-root-fs.target
-Before=sysroot.mount ignition-ostree-mount-firstboot-sysroot.service
+Before=sysroot.mount
 After=ignition-ostree-uuid-root.service
 
 [Service]
diff --git a/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-mount-firstboot-sysroot.service b/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-mount-firstboot-sysroot.service
deleted file mode 100644
index 3dddf50969..0000000000
--- a/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-mount-firstboot-sysroot.service
+++ /dev/null
@@ -1,25 +0,0 @@
-[Unit]
-Description=Ignition OSTree: Mount /sysroot (First Boot)
-# These dependencies should match the "other" in
-# ignition-ostree-mount-subsequent-sysroot.service
-DefaultDependencies=false
-# If root is specified, then systemd's generator will win
-ConditionKernelCommandLine=!root
-ConditionKernelCommandLine=ostree
-# This is redundant since we're queued on -diskful.target, but eh.
-ConditionPathExists=!/run/ostree-live
-# There can be only one, Highlander style
-Conflicts=ignition-ostree-mount-subsequent-sysroot.service
-Before=initrd-root-fs.target
-After=ignition-disks.service
-# Note we don't have a Requires: /dev/disk/by-label/root here like
-# the -subsequent service does because ignition-disks may have
-# regenerated it.
-Requires=ignition-disks.service
-# These have an explicit dependency on After=sysroot.mount today
-Before=ostree-prepare-root.service ignition-remount-sysroot.service
-
-[Service]
-Type=oneshot
-RemainAfterExit=yes
-ExecStart=/usr/sbin/ignition-ostree-mount-sysroot
diff --git a/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-mount-subsequent-sysroot.service b/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-mount-subsequent-sysroot.service
deleted file mode 100644
index fe08fe6aab..0000000000
--- a/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-mount-subsequent-sysroot.service
+++ /dev/null
@@ -1,24 +0,0 @@
-# Note this unit is conditionally enabled by ignition-ostree-generator
-[Unit]
-Description=CoreOS: Mount /sysroot (Subsequent Boot)
-# These dependencies should match the "other" in
-# ignition-ostree-mount-firsboot-sysroot.service
-DefaultDependencies=false
-# If root is specified, then systemd's generator will win
-ConditionKernelCommandLine=!root
-ConditionKernelCommandLine=ostree
-ConditionPathExists=!/run/ostree-live
-# There can be only one, Highlander style
-Conflicts=ignition-ostree-mount-firstboot-sysroot.service
-# And in contrast to the firstboot, we expect
-# the root device to be ready.
-Requires=dev-disk-by\x2dlabel-root.device
-After=dev-disk-by\x2dlabel-root.device
-Before=initrd-root-fs.target
-# This has an explicit dependency on After=sysroot.mount today
-Before=ostree-prepare-root.service
-
-[Service]
-Type=oneshot
-RemainAfterExit=yes
-ExecStart=/usr/sbin/ignition-ostree-mount-sysroot
diff --git a/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-mount-sysroot.sh b/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-mount-sysroot.sh
deleted file mode 100755
index a51c4b26fe..0000000000
--- a/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-mount-sysroot.sh
+++ /dev/null
@@ -1,18 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-# Note that on *new machines* this script is now only ever used on firstboot. On
-# subsequent boots, systemd-fstab-generator mounts /sysroot from the
-# root=UUID=... and rootflags=... kargs.
-
-# We may do a migration window at some point where older machines have these
-# kargs injected so that we can simplify the model further.
-
-rootpath=/dev/disk/by-label/root
-if ! [ -b "${rootpath}" ]; then
-  echo "ignition-ostree-mount-sysroot: Failed to find ${rootpath}" 1>&2
-  exit 1
-fi
-
-echo "Mounting ${rootpath} ($(realpath "${rootpath}")) to /sysroot"
-mount -o "$(coreos-rootflags)" "${rootpath}" /sysroot
diff --git a/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-transposefs-restore.service b/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-transposefs-restore.service
index 3a294dd705..eef3c064c7 100644
--- a/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-transposefs-restore.service
+++ b/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-transposefs-restore.service
@@ -5,7 +5,6 @@ After=ignition-disks.service
 # Avoid racing with UUID regeneration
 After=ignition-ostree-uuid-root.service
 After=ignition-ostree-growfs.service
-Before=ignition-ostree-mount-firstboot-sysroot.service
 # https://issues.redhat.com/browse/OCPBUGS-16157
 # On multipath systems mounting the /sysroot before
 # the ignition-ostree services causes the transpose to fail.
diff --git a/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-uuid-root.service b/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-uuid-root.service
index 264801192e..80ecf9d42a 100644
--- a/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-uuid-root.service
+++ b/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-uuid-root.service
@@ -1,6 +1,6 @@
 [Unit]
 Description=Ignition OSTree: Regenerate Filesystem UUID (root)
-# These conditions match ignition-ostree-mount-firstboot-sysroot.service
+# These conditions match those generated in coreos-diskful-generator
 DefaultDependencies=false
 ConditionKernelCommandLine=ostree
 ConditionPathExists=!/run/ostree-live
@@ -18,7 +18,7 @@ Before=systemd-fsck@dev-disk-by\x2dlabel-dm-mpath-root.service
 # Note we don't have a Requires: /dev/disk/by-label/root here like
 # the -subsequent service does because ignition-disks may have
 # regenerated it.
-Before=ignition-ostree-mount-firstboot-sysroot.service
+Before=sysroot.mount
 
 [Service]
 Type=oneshot
diff --git a/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/module-setup.sh b/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/module-setup.sh
index f8450b38c0..81ab59896b 100755
--- a/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/module-setup.sh
+++ b/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/module-setup.sh
@@ -88,17 +88,11 @@ install() {
     done
 
     # Disk support
-    install_ignition_unit ignition-ostree-mount-firstboot-sysroot.service diskful
     for p in boot root; do
         install_ignition_unit ignition-ostree-uuid-${p}.service diskful
     done
     inst_script "$moddir/ignition-ostree-firstboot-uuid" \
         "/usr/sbin/ignition-ostree-firstboot-uuid"
-    install_ignition_unit ignition-ostree-mount-subsequent-sysroot.service diskful-subsequent
-    inst_script "$moddir/ignition-ostree-mount-sysroot.sh" \
-        "/usr/sbin/ignition-ostree-mount-sysroot"
-    inst_script "$moddir/coreos-rootflags.sh" \
-        "/usr/sbin/coreos-rootflags"
 
     install_ignition_unit ignition-ostree-growfs.service
     inst_script "$moddir/ignition-ostree-growfs.sh" \
diff --git a/overlay.d/15fcos/usr/lib/sysusers.d/10-setup-basic.conf b/overlay.d/15fcos/usr/lib/sysusers.d/10-setup-basic.conf
deleted file mode 100644
index 597b8d28e7..0000000000
--- a/overlay.d/15fcos/usr/lib/sysusers.d/10-setup-basic.conf
+++ /dev/null
@@ -1,43 +0,0 @@
-# These are basic users/groups coming from the default entries
-# in the 'setup' package. They can be dropped once that package
-# starts shipping its own sysusers.d entries.
-
-g adm 4
-g audio 63
-g bin 1
-g cdrom 11
-g daemon 2
-g dialout 18
-g disk 6
-g floppy 19
-g ftp 50
-g games 20
-g kmem 9
-g lock 54
-g lp 7
-g mail 12
-g man 15
-g mem 8
-g root 0
-g sys 3
-g tape 33
-g tty 5
-g users 100
-g video 39
-g wheel 10
-
-u adm      3:4      "adm"      /var/adm        -
-u bin      1:1      "bin"      /bin            -
-u daemon   2:2      "daemon"   /sbin           -
-u ftp      14:50    "FTP User" /var/ftp        -
-# Workaround for systemd-sysusers bug, will be fixed in v252:
-# https://github.com/systemd/systemd/issues/24217
-# u games  12:100   "games"    /usr/games      -
-u games    12:users "games"    /usr/games      -
-u halt     7:0      "halt"     /sbin           /sbin/halt
-u lp       4:7      "lp"       /var/spool/lpd  -
-u mail     8:12     "mail"     /var/spool/mail -
-u operator 11:0     "operator" /root           -
-u root     0:0      "root"     /root           /bin/bash
-u shutdown 6:0      "shutdown" /sbin           /sbin/shutdown
-u sync     5:0      "sync"     /sbin           /bin/sync