Use lua for some scriptlets to avoid missing /bin/sh

SOURCES/90-default-user.preset

@@ -17,9 +17,14 @@ enable pipewire-pulse.socket
 
 # https://bugzilla.redhat.com/show_bug.cgi?id=1976006
 enable pipewire-media-session.service
-
-# https://bugzilla.redhat.com/show_bug.cgi?id=2022717
+# https://bugzilla.redhat.com/show_bug.cgi?id=1979419
 enable wireplumber.service
 
-# https://bugzilla.redhat.com/show_bug.cgi?id=2181984
+# Enable the session agent for snaps
+# https://bugzilla.redhat.com/show_bug.cgi?id=1734371
+enable snapd.session-agent.socket
+
+# https://src.fedoraproject.org/rpms/fedora-release/pull-request/80
 enable obex.service
+enable grub-boot-success.timer
+enable pulseaudio.socket

SOURCES/90-default.preset

@@ -1,27 +1,63 @@
-# Also see:
-# https://fedoraproject.org/wiki/Starting_services_by_default
+# See https://docs.fedoraproject.org/en-US/packaging-guidelines/DefaultServices/
+# for the Fedora policy.
 
+# On Fedora we deviate from some upstream defaults
 disable systemd-timesyncd.service
-disable systemd-resolved.service
+disable systemd-networkd.service
+disable systemd-networkd-wait-online.service
+# We want to update systemd-boot from packaging scriptlets after updates.
+disable systemd-boot-update.service
 
-# systemd
-enable remote-fs.target
-enable getty@tty1.service
+# https://fedoraproject.org/wiki/Changes/EnableSystemdOomd
+enable systemd-oomd.service
+
+# These presets were last validated en-masse on 2015-09-09
+# https://fedorahosted.org/fesco/ticket/1472
 
 # System stuff
+# https://fedoraproject.org/w/index.php?title=Starting_services_by_default&oldid=377748
+enable dbus.socket
+enable dbus-broker.service
 enable sshd.service
+
+# Locally-running services
 enable atd.*
 enable crond.*
-enable chronyd.service
 enable rpcbind.*
+
+# Approved by FESCo - https://fedorahosted.org/fesco/ticket/636
+enable chronyd.service
+
+# https://fedoraproject.org/w/index.php?title=Starting_services_by_default&oldid=377748
+# https://bugzilla.redhat.com/show_bug.cgi?id=1455704
 enable NetworkManager.service
+enable NetworkManager-wait-online.service
 enable NetworkManager-dispatcher.service
 enable ModemManager.service
+
+# Approved by FESCo - https://fedorahosted.org/fesco/ticket/1311
 enable auditd.service
+
+# https://bugzilla.redhat.com/show_bug.cgi?id=2258520
+enable audit-rules.service
+
+# Locally-running service
 enable restorecond.service
+
+# Approved by FESCo - https://fedorahosted.org/fesco/ticket/1166
 enable bluetooth.*
+
+# https://fedoraproject.org/w/index.php?title=Starting_services_by_default&oldid=377748
 enable avahi-daemon.*
-enable cups.*
+
+# Default configuration is locally-running only
+# CUPS is now socket-activatable for local use-cases, so don't enable cups.service
+# https://pagure.io/fesco/issue/1701
+enable cups.socket
+enable cups.path
+
+# RHELBLD-15232: We need the full service enabled to act as a print server
+enable cups.service
 
 # The various syslog implementations
 enable rsyslog.*
@@ -29,19 +65,31 @@ enable syslog-ng.*
 enable sysklogd.*
 
 # Network facing
+# https://fedoraproject.org/w/index.php?title=Starting_services_by_default&oldid=377748
 enable firewalld.service
-enable xinetd.service
-enable ladvd.service
 
-# Virtualization driver specific daemons. Start by defalt at boot for VM
+# Approved by FESCo - https://fedorahosted.org/fesco/ticket/2627
+# Virtualization driver specific daemons. Start by default at boot for VM
 # autostart, but shutdown after 2 mins and socket activated thereafter
 enable virtqemud.service
+enable virtxend.service
+enable virtlxcd.service
+enable virtvboxd.service
 
 # Sockets for the services listed above, to support socket activation
 # after the initial timeout
 enable virtqemud.socket
 enable virtqemud-ro.socket
 enable virtqemud-admin.socket
+enable virtxend.socket
+enable virtxend-ro.socket
+enable virtxend-admin.socket
+enable virtlxcd.socket
+enable virtlxcd-ro.socket
+enable virtlxcd-admin.socket
+enable virtvboxd.socket
+enable virtvboxd-ro.socket
+enable virtvboxd-admin.socket
 
 # Compatibility with libvirtd sockets for old clients (socket activated
 # only when required). Note that the -tcp and -tls sockets are kept disabled
@@ -78,10 +126,28 @@ enable virtlogd-admin.socket
 enable virtlockd.socket
 enable virtlockd-admin.socket
 
+# https://fedoraproject.org/w/index.php?title=Starting_services_by_default&oldid=377748
+enable xinetd.service
+
 # Storage
+# Approved by FESCo - https://fedorahosted.org/fesco/ticket/391
 enable multipathd.service
+
+# Approved by FESCo - https://fedorahosted.org/fesco/ticket/876
 enable libstoragemgmt.service
-enable lvm2-lvmpolld.socket
+
+# Approved by FESCo - https://pagure.io/fesco/issue/2386
+enable iscsid.socket
+enable iscsiuio.socket
+
+# Approved by FESCo - https://pagure.io/fesco/issue/2943
+enable iscsi-starter.service
+
+# iSCSI support for early-boot
+# https://bugzilla.redhat.com/show_bug.cgi?id=1930470
+enable iscsi-onboot.service
+
+# Locally-running services
 enable lvm2-monitor.*
 enable lvm2-lvmetad.*
 enable dm-event.*
@@ -91,6 +157,9 @@ enable dmraid-activation.service
 enable mdmonitor.service
 enable mdmonitor-takeover.service
 
+# https://bugzilla.redhat.com/show_bug.cgi?id=1817491
+enable raid-check.timer
+
 # https://bugzilla.redhat.com/show_bug.cgi?id=876237
 enable spice-vdagentd.service
 
@@ -100,161 +169,302 @@ enable qemu-guest-agent.service
 # https://bugzilla.redhat.com/show_bug.cgi?id=928726
 enable dnf-makecache.timer
 
+# https://bugzilla.redhat.com/show_bug.cgi?id=1995495
+enable rpm-ostree-countme.timer
+
 # https://bugzilla.redhat.com/show_bug.cgi?id=957135
 enable vmtoolsd.service
 
-# mcelog is a utility that collects and decodes Machine Check Exception data
-# on x86-32 and x86-64 systems.
-# https://bugzilla.redhat.com/show_bug.cgi?id=1302179
-enable mcelog.service
+# https://bugzilla.redhat.com/show_bug.cgi?id=976315
+enable dkms.service
 
-#https://bugzilla.redhat.com/show_bug.cgi?id=995987
-enable kdump.service
+# https://bugzilla.redhat.com/show_bug.cgi?id=961878
+enable ipmi.service
+enable ipmievd.service
+
+# https://bugzilla.redhat.com/show_bug.cgi?id=1039351
+enable x509watch.timer
+
+# https://bugzilla.redhat.com/show_bug.cgi?id=1060754
+enable dnssec-triggerd.service
+
+# https://bugzilla.redhat.com/show_bug.cgi?id=1095353
+enable uuidd.socket
+
+# Hardware
+# Locally-running service
+enable gpm.*
+
+# https://bugzilla.redhat.com/show_bug.cgi?id=1066421
+enable gpsd.socket
 
-#https://bugzilla.redhat.com/show_bug.cgi?id=1009970
+# https://bugzilla.redhat.com/show_bug.cgi?id=1141607
+enable x2gocleansessions.service
+
+# https://issues.redhat.com/browse/RHEL-35582
 enable tuned.service
 
-# https://bugzilla.redhat.com/show_bug.cgi?id=1215645
+# https://bugzilla.redhat.com/show_bug.cgi?id=1215641
 enable unbound-anchor.timer
 
-# Enable SSSD Kerberos Credential Cache Server
-# https://bugzilla.redhat.com/show_bug.cgi?id=1558927
-enable sssd-kcm.socket
+# https://bugzilla.redhat.com/show_bug.cgi?id=1222495
+enable lvm2-lvmpolld.*
 
-# https://bugzilla.redhat.com/show_bug.cgi?id=1578833
-enable sssd.service
+# https://fedoraproject.org/wiki/Changes/UEFISecureBootBlacklistUpdates
+enable dbxtool.service
 
-# Hardware
-enable gpm.*
-enable gpsd.*
+# Locally-running services
 enable irqbalance.service
 enable lm_sensors.service
 enable mcelog.*
-enable microcode.service
 enable smartd.service
 enable pcscd.socket
 enable rngd.service
 
 # Other stuff
+# Approved by FESCo - https://fedorahosted.org/fesco/ticket/937
+# Note: abrt-ccpp.service is excluded in favor of systemd-coredump.
 enable abrtd.service
 enable abrt-journal-core.service
 enable abrt-oops.service
 enable abrt-xorg.service
 enable abrt-vmcore.service
-enable lttng-sessiond.service
+
+# Locally-running services
+enable kdump.service
 enable ksm.service
 enable ksmtuned.service
 enable rootfs-resize.service
 enable sysstat.service
+enable sysstat-collect.timer
+enable sysstat-summary.timer
 enable uuidd.service
-
-# https://bugzilla.redhat.com/show_bug.cgi?id=1193616
-enable hypervfcopyd.service
-enable hypervkvpd.service
-enable hypervvssd.service
+enable xendomains.service
+enable xenstored.service
+enable xenconsoled.service
 
 # Desktop stuff
+# Locally-running services
 enable accounts-daemon.service
 enable rtkit-daemon.service
 enable upower.service
 enable udisks2.service
-enable packagekit-offline-update.service
-enable PackageKit.service
-# https://bugzilla.redhat.com/show_bug.cgi?id=2011240
-enable power-profiles-daemon.service
+enable polkit.service
+
+# https://bugzilla.redhat.com/show_bug.cgi?id=1187072
+enable timedatex.service
+
+# https://bugzilla.redhat.com/show_bug.cgi?id=1231745
+enable mlocate-updatedb.timer
+
+# https://src.fedoraproject.org/rpms/fedora-release/pull-request/204
+enable plocate-updatedb.timer
 
-# Initial Setup reconfiguration service
-enable initial-setup-reconfiguration.service
+# https://bugzilla.redhat.com/show_bug.cgi?id=1218999
+enable sa-update.timer
+
+# Hyper-V guest support daemons
+# https://bugzilla.redhat.com/show_bug.cgi?id=1279322
+enable vmtoolsd.service
+
+# mcelog is a utility that collects and decodes Machine Check Exception data
+# on x86-32 and x86-64 systems.
+# https://bugzilla.redhat.com/show_bug.cgi?id=1302179
+enable mcelog.service
 
-# https://bugzilla.redhat.com/show_bug.cgi?id=1312446
+# OPAL-prd is a utility specific to ppc64le systems
+# It is the "OPAL Processor Recovery Diagnostics Daemon"
+# https://bugzilla.redhat.com/show_bug.cgi?id=1312018
 enable opal-prd.service
 
-# virtlog.service is sometimes used by VMs started by libvirt.service
-# Enable virtlog.socket to have it socket activated
-# https://bugzilla.redhat.com/show_bug.cgi?id=1325503
-enable virtlogd.socket
+# lircd is the Linux Infrared Control daemon
+# Starting with version 0.9.4, it requires no manual configuration
+# https://bugzilla.redhat.com/show_bug.cgi?id=1340061
+enable lircd.socket
 
+# IPSec management
+# https://bugzilla.redhat.com/show_bug.cgi?id=1276285
+enable pluto.socket
 
-# https://bugzilla.redhat.com/show_bug.cgi?id=1271839
-enable rhsmcertd.service
+# https://bugzilla.redhat.com/show_bug.cgi?id=1367932
+# Automatically refresh installed snaps
+enable snapd.refresh.timer
+# Socket activated daemon to manage snaps
+enable snapd.socket
 
-# https://bugzilla.redhat.com/show_bug.cgi?id=1359645
-enable brandbot.*
+# Support for dual-GPU systems
+# https://bugzilla.redhat.com/show_bug.cgi?id=1389762
+enable switcheroo-control.service
 
-# https://bugzilla.redhat.com/show_bug.cgi?id=1572550
-enable timedatex.service
+# Support for the DRBD link-cleaning service
+# https://bugzilla.redhat.com/show_bug.cgi?id=1399387
+enable drbdlinksclean.service
 
-# https://bugzilla.redhat.com/show_bug.cgi?id=1578870
-enable selinux-autorelabel-mark.service
-enable rhel-configure.service
-enable rhel-dmesg.service
+# Enable the System Security Services Daemon
+# https://bugzilla.redhat.com/show_bug.cgi?id=1427649
+enable sssd.service
 
-# https://github.com/fedora-sysv/initscripts/commit/37109fdf9808
-enable nis-domainname.service
+# Enable ostree-remount on ostree-based systems
+# (Does nothing on non-ostree systems)
+# https://bugzilla.redhat.com/show_bug.cgi?id=1451458
+enable ostree-remount.service
+
+# Enable Performance Co-Pilot services
+# https://bugzilla.redhat.com/show_bug.cgi?id=1472350
+enable pmcd.service
+enable pmlogger.service
+enable pmie.service
+
+# Enable SSSD Kerberos Credential Cache Server
+# https://bugzilla.redhat.com/show_bug.cgi?id=1475999
+enable sssd-kcm.socket
+
+# sssd-secrets.socket was previously enabled, but as of
+# SSSD 2.0 it is not longer needed
+# https://bugzilla.redhat.com/show_bug.cgi?id=1615584
+
+# A mechanism to transfer state between the initramfs and the real
+# system. Obsolete since /run was introduced, but still used by some
+# services.
+# https://bugzilla.redhat.com/show_bug.cgi?id=1493479
+# https://bugzilla.redhat.com/show_bug.cgi?id=1584645
 enable import-state.service
-enable loadmodules.service
+
+# An initscripts mechanism for readonly root
+# https://bugzilla.redhat.com/show_bug.cgi?id=1493479
+# https://bugzilla.redhat.com/show_bug.cgi?id=1584645
 enable readonly-root.service
 
-# https://bugzilla.redhat.com/show_bug.cgi?id=1630200
-# s390x specific services
+# Ensure that any installed kmods are built for the currently-running
+# kernel at boot
+# https://bugzilla.redhat.com/show_bug.cgi?id=1518258
+enable akmods.service
+
+# virtualbox-guest-additions service, yet another virtual-machine guest
+# integration agent, this is a locally-running service, Note this has a
+# "ConditionVirtualization=|oracle" so it will only run under VirtualBox
+# https://bugzilla.redhat.com/show_bug.cgi?id=1534595
+enable vboxservice.service
+
+# Mark the system for SELinux autorelabel when appropriate
+# https://bugzilla.redhat.com/show_bug.cgi?id=1589720
+enable selinux-autorelabel-mark.service
+
+# https://bugzilla.redhat.com/show_bug.cgi?id=1623901
 enable cpi.service
+
+# Initialize persistent devices on s390x
 enable device_cio_free.service
 
 # Enable the stratis daemon for managing stratis storage
-# https://bugzilla.redhat.com/show_bug.cgi?id=1632510
+# https://bugzilla.redhat.com/show_bug.cgi?id=1630514
 enable stratisd.service
 
-# https://bugzilla.redhat.com/show_bug.cgi?id=1817591
-enable mlocate-updatedb.timer
+# Enable a service to finalize staged OSTree changes at shutdown
+# https://bugzilla.redhat.com/show_bug.cgi?id=1639372
+enable ostree-finalize-staged.path
 
-# nvme auto connect
-# https://bugzilla.redhat.com/show_bug.cgi?id=1805466
-enable nvmefc-boot-connections.service
+# Enable the Docker daemon socket
+# https://bugzilla.redhat.com/show_bug.cgi?id=1655602
+enable docker.socket
 
-# OSTree based systems need to remount /sysroot and
-# /var as rw via ostree-remount.service
-# ignored by non-OSTree based systems
-# https://bugzilla.redhat.com/show_bug.cgi?id=1848453
-enable ostree-remount.service
+# Enable the service for adding Fedora OCI repos to flatpak
+# https://bugzilla.redhat.com/show_bug.cgi?id=1696225
+enable flatpak-add-fedora-repos.service
 
-# DBus needed by Anaconda
-enable dbus.socket
-enable dbus-broker.service
+# Run fstrim weekly on filesystems listed in fstab
+enable fstrim.timer
 
-# Enable iscsi service files
-# https://bugzilla.redhat.com/show_bug.cgi?id=1930458
-enable iscsi.service
-enable iscsid.socket
-enable iscsiuio.socket
-enable iscsi-onboot.service
+# oneshot to generate kata VM appliance at host bootup
+# for the booted kernel
+enable kata-osbuilder-generate.service
 
-# Enable logrotate.timer
-# https://bugzilla.redhat.com/show_bug.cgi?id=1977865
-enable logrotate.timer 
-
-# Enable greenboot
-# https://bugzilla.redhat.com/show_bug.cgi?id=2005552
-enable greenboot-grub2-set-counter.service
-enable greenboot-grub2-set-success.service
-enable greenboot-healthcheck.service
-enable greenboot-rpm-ostree-grub2-check-fallback.service
-enable greenboot-status.service
-enable greenboot-task-runner.service
-enable redboot-auto-reboot.service
-enable redboot-task-runner.service
-# https://bugzilla.redhat.com/show_bug.cgi?id=2108625
-enable greenboot-service-monitor.service
-
-# https://bugzilla.redhat.com/show_bug.cgi?id=2013299
-enable low-memory-monitor.service
-
-# https://bugzilla.redhat.com/show_bug.cgi?id=2049627
-enable switcheroo-control.service
+# Enable rotation of system log files
+# https://bugzilla.redhat.com/show_bug.cgi?id=1655153#c4
+enable logrotate.timer
+
+# Enable regular update of SpamAssassin data files
+# https://bugzilla.redhat.com/show_bug.cgi?id=1651002
+enable sa-update.timer
+
+# Enable service to automatically rebuild the RPM database
+# on startup when /var/lib/rpm/.rebuilddb exists
+# https://bugzilla.redhat.com/show_bug.cgi?id=1826658
+enable rpmdb-rebuild.service
+
+# Enable service to automatically migrate the RPM database to /usr
+# on startup when /var/lib/rpm/.migratedb exists
+# https://bugzilla.redhat.com/show_bug.cgi?id=2044061
+enable rpmdb-migrate.service
+
+# Support services for Google Cloud
+# Approved by FESCo: https://pagure.io/fesco/issue/2578
+enable google-guest-agent.service
+enable google-startup-scripts.service
+enable google-shutdown-scripts.service
+
+# Support service for Azure
+# Approved by FESCo: https://pagure.io/fesco/issue/2849
+enable waagent.service
 
-# https://bugzilla.redhat.com/show_bug.cgi?id=2106811
+# Certbot (Let's Encrypt)
+# https://bugzilla.redhat.com/show_bug.cgi?id=1940211
+enable certbot-renew.timer
+
+# enable thermald by default for desktops
+# https://pagure.io/fedora-workstation/issue/71
+enable thermald.service
+
+# enable uresourced by default for desktops
+# https://pagure.io/fesco/issue/2457
+enable uresourced.service
+
+# enable power-profiles-daemon
+# https://pagure.io/fedora-workstation/issue/191
+enable power-profiles-daemon.service
+
+# Enable clevis-luks-askpass.path
+# https://bugzilla.redhat.com/show_bug.cgi?id=2101719
 enable clevis-luks-askpass.path
 
+# Enable livesys services for live media
+# https://bugzilla.redhat.com/show_bug.cgi?id=2148790
+enable livesys.service
+enable livesys-late.service
+
+# Enable Waydroid
+# https://bugzilla.redhat.com/show_bug.cgi?id=2157810
+enable waydroid-container.service
+
+# Enable nmstate to apply network configuration from /etc/nmstate/*.yml
+# https://github.com/coreos/fedora-coreos-tracker/issues/1175
+# https://github.com/coreos/fedora-coreos-config/pull/2269
+enable nmstate.service
+
+# Enable nfs-client.target
+# https://bugzilla.redhat.com/show_bug.cgi?id=2218006
+enable nfs-client.target
+
+# Enable cloud-init services
+# https://bugzilla.redhat.com/show_bug.cgi?id=2233948
+enable cloud-config.service
+enable cloud-final.service
+enable cloud-init.service
+enable cloud-init-local.service
+
 # Enable  kernel-bootcfg-boot-successful.service
-# RHEL-21816
+# https://bugzilla.redhat.com/show_bug.cgi?id=2239607
 enable kernel-bootcfg-boot-successful.service
 
+# Enable pd-mapper service for Thinkpad X13s
+# https://bugzilla.redhat.com/show_bug.cgi?id=2255318
+enable pd-mapper.service
+
+# The Cockpit web-based system management console
+enable cockpit.socket
+
+# https://fedoraproject.org/wiki/Changes/EnableFwupdRefreshByDefault
+enable fwupd-refresh.timer
+
+# RHEL-67012
+enable fips-crypto-policy-overlay.service

SOURCES/RPM-GPG-KEY-MSVSphere-10

@@ -0,0 +1,29 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGdfJ3UBEACkbmpM2jWUnjIu82OOJnWCFrmtPgI/FSRendyyIjE7k2g82n0H
+vDWXL4N8wEy4JyEFGFMupKn7tYMuDf1IwfTvxhxgOrGyK858fx+bAhxuam+svI1m
+FC5VTgmcRBLPbjQDhvpI+Mmkv6AaHQE5VqTXHYb32YgeE6wi4/td0B6kXY6tHCGL
+5guSL2aV34X1xQor1MGU9vNz0d34BwdJMu5NGFVNuhMHI4E+dxFtuCrA15dfedji
+GMCAIpXZM3KGvlcezARhZFeHy++XatW2/KcR3aMKKUS8LqKZWaVItdnhPcivF54F
+7uVorHfV4P2YdYeibN1ue9r324GPDFCQcW9Kr/jtk+PKx3ZjY3AhsV1VMMBU2a2l
+DkLXTjo6SLSLflt542xvZ1kTzNIrEG6VSvDR1MIsU0pFmd6iHDx4jP1TKOO1Vzeg
+7igr4YlPauLmEK0ETC7cI+iD21OC5tglohiFOGx18nZcmmt5GXLSDgaMbsQeHSjX
+s1FRdZptxER8aSktpr/LXnHkvFGYMplWU6vpioEBL6/HkgfrXYX6GzhISiGWVjLB
+4V4S8RAB634ty/Kdsa5RIdFhosyIxzHayMvMBQPreP0A7ea7ZhDEOYdCra7AAjiX
+OQtFjfs0pKCItEtpzL6+3z8gJ8Rn2VpmffCn8YFI6qwL/7rim+yVuM8SnwARAQAB
+tCdNU1ZTcGhlcmUgMTAgPHBhY2thZ2VyQG1zdnNwaGVyZS1vcy5ydT6JAlAEEwEI
+ADoWIQT4iYt3BiG8X85kOWQW0p82xBjmpAUCZ18ndQIbAwQLCQgHAyICAQUVCgkI
+CwQWAgEDAh4HAheAAAoJEBbSnzbEGOak/5gP/R6v0Hywy7FJCTyczxUXoviosUqG
+goDi7RQ+2+4wOrIKzq4cxvqIBttuLnj+Du4EYaB1j8cjrJKxSoo7/jDzH6fTvg6y
+5MNhls6f2SJu4WJPdmIQwtrWKqmzdspMI3xj6Suy9EZYt2EWPqAr4vmh9tHCVNg6
+FB1/XghWZVkG/hfOrEnfXh+86TG/FfMLNYWeVcKHd1klNz4LtazNsaZV7eCBHFyJ
+uPkaM25wM1ZgLETGZvsycLJAUazDsgdjU+BjhNFjPqyyy2Aw9xFcCeX25tU56emt
+fTwmXxXAh24Wkq6hR/LcbmzzxT2OhClqZjmUIniaxvgNJGgfB6BPBfJYtK3v+EdN
+/oO4Vhd/uDm+Zeh/Nul7Xp9+Fk1XuAxHwUfrM3aOkAh/YvBNjyYClbOW5l/fj2Hc
+CuuPTUqsM1ZM/f1k9Tu6U9WoSETSuiEZDzJ6aZaLP+87Cu9+kY1JJ5mTGK8JvXo/
+uKCcu7jHHedcFhSpYAfs2GjUA6a/S+CQvjdoWPxKKoUZpaUvJ1fPFEqmnyEAH6rM
+7X3WJRTH3Dx+7bdjAYqfOfa21HkY80qd3VtvBI8QUzZQT96ggpstDoUiR+Ex/xEH
+XIKw4HNka/5zwfE4uivKX0h3ZrV2fTQEiAPoxmLYllCIf1A50Mw3TIX1MQqqg/tN
+zVa6IlteuK2l/2f1
+=MBcm
+-----END PGP PUBLIC KEY BLOCK-----

SOURCES/RPM-GPG-KEY-MSVSphere-9

@@ -1,29 +0,0 @@
------BEGIN PGP PUBLIC KEY BLOCK-----
-
-mQINBGUulQgBEACk4aP3eOnKfjklE+EFb4+SsTFzDYuyirSAr60g6YNpFqTd/NVw
-8CH5qd6yqam3myiM1EAYTMDozmzfQ/4D75mdKoQN5IItPoqdpkoJOGPRGciHKtgX
-3ZOBAVFhKRcw7lLrlL/XfBl42L7hxpRj0Xk4YAQxFbk6PmcoAz2oDdHBhQd/R9Pi
-vljTYnnrPy3PakBLPlO2GLDA2KRjzHhI2vEKoSv/nBDn4O6c/RL3usOU9H/gnoc7
-MuNJQMh36xf3lDuqgIwi1D6aG6PoClNVopgbvD8IVDOpairW8TvJPMr3BpXMHwSz
-5ixDFtPnVilYgqhi0cg2AampkS2VdbLn9ofGe00DLSfTBEE4370WAPaff7mtjfbf
-mIKm/rqzW5yixSra21ab6nFE7hRiuzlqJkl9oHzt8NZoWhKp8UeoSDNXrVCLxXsg
-AHsX6dSKAppKmUl9VKXxQk6kFObLsrdD8m/If3Xfj4clikDnuqWweeeQfABuDYx4
-huoTbeOA/8U03ByCYX6A0zvC+CzHwzzO4gQqdbfaSzce6+20rH7psaAT/97lh7Ec
-A8LNdYA1CoPGDcBr+Rr3DP6NomRzBYYVQ2Tihbp4OPb1WN2FKppvjc6j0QK8ZeQP
-e1Xg4ycv4ZFJP4zJpP7TQvpRoFm2mXv8UMg8J17nKeOFMnwL7pEU1DS1fQARAQAB
-tCZNU1ZTcGhlcmUgOSA8cGFja2FnZXJAbXN2c3BoZXJlLW9zLnJ1PokCSwQTAQgA
-NRYhBLQ+/RAbCEoqakRiHJUsZhiL2nOkBQJlLpUIAhsDBAsJCAcEFQoJCAQWAgED
-Ah4FAheAAAoJEJUsZhiL2nOkkjoP/1O/ghjcXPqM6qyxwn8sqPawBqHKNB/YgPIK
-WipuxOBQXf/nxtLtne2A+dccuBc6/ghOOIjLSPOYG2LiVg1rlGa2D3465Wv4574e
-JC1Pf/eo4DxJgaotQhzJlTmC1au51ACD3kXpPuCgx88Ys1l6A1AkdraM7OC8qCri
-pnKx+Z8/NJgNVUp6eSAh6+KZ/JGA5SqBrYAlYGPgJ1ffjSmb96TUlRdukG13luU2
-Z8JoZORhhovgB2dl02MQCWpe6XRR39h9f4CIgw3w+MQA9r+lK7WLFx5uQCfO3gFq
-IEJ43IhfReiG9tCyY68hsGB0+Evr1KFPs4g1TbMXQFvM3WcanMQbMhrSCCXk+gNh
-QnjYg2/X2lz8JBOTqRulc4YQIxSHiOAT8CMw5oQnhkFwNdUrt+b+W3hUteCX4P5C
-o5Cog3EsZTAPQ0+xaZQm2jfwvjnDO1qH0fr/biOpXN4YyvqCBFN0MoWZrpAOp1H3
-ubwFmOj59RKniMkzwM8hLIvqqejvY6IEBAVjGAWmRPN9sJGVOWHmK4ZPK6oT7Ggb
-Jo64e6kS6XP6JFoL1OUeDYCk+M/ad0UCHMm0mfkQMfPwN+m3eFgJLNqWRtYbuLpX
-d2YMF8ex961XzxWXUPRuE6+ZozNszQ1nE0XQKpo7ovPx3Pp1bRhLxIMZekSfKGJ9
-7TMdj1L4
-=VVm+
------END PGP PUBLIC KEY BLOCK-----

SPECS/sphere-release.spec

@@ -1,13 +1,13 @@
 %global distro  MSVSphere
 # define MSVSphere products
 %global release_name Certified Server ARM Cinnamon KDE XFCE
-%global major   9
-%global minor   5
-%global eol_date 2032-06-01
+%global major   10
+%global minor   0
+%global eol_date 2035-06-01
 
 Name:           sphere-release
 Version:        %{major}.%{minor}
-Release:        2%{?dist}
+Release:        0.3%{?dist}
 Summary:        %{distro} release files
 License:        GPLv2
 URL:            https://msvsphere-os.ru
@@ -32,7 +32,7 @@ Provides:       system-release(releasever) = %{major}
 Provides:       base-module(platform:el%{major})
 Requires:       sphere-release-common = %{version}-%{release}
 
-Source100:      RPM-GPG-KEY-MSVSphere-9
+Source100:      RPM-GPG-KEY-MSVSphere-%{major}
 
 Source200:      LICENSE
 Source201:      EULA
@@ -534,13 +534,13 @@ sed -i "s@\$releasever@%{major}.%{minor}-beta@g" %{buildroot}%{_sysconfdir}/yum.
 install -d -m 0755 %{buildroot}%{_sysconfdir}/pki/rpm-gpg
 install -p -m 0644 %{SOURCE100} %{buildroot}%{_sysconfdir}/pki/rpm-gpg/
 
-%pre -n sphere-release-common
 # Workarround for redhat-server-eula problem
-if [ $1 = 1 ]; then
-    if [ -d /usr/share/redhat-release ]; then
-        rm -rf /usr/share/redhat-release
-    fi
-fi
+%pre -p <lua> -n sphere-release-common
+st = posix.stat("/usr/share/redhat-release")
+if st and st.type == "directory" then
+  os.remove("/usr/share/redhat-release")
+end
+return 0
 
 %post -n sphere-repos-flatpak
 /usr/bin/flatpak remote-add --system --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo ||:
@@ -550,20 +550,20 @@ fi
 /usr/bin/flatpak remote-delete --system flathub ||:
 /usr/bin/flatpak remote-delete --system fedora ||:
 
-%post identity-arm
-/usr/bin/ln -srf /usr/share/sphere-release/EULA-ARM /usr/share/sphere-release/EULA
+%posttrans -p <lua> identity-arm
+os.execute("/usr/bin/ln -srf /usr/share/sphere-release/EULA-ARM /usr/share/sphere-release/EULA")
 
 %preun identity-arm
 /usr/bin/rm -f /usr/share/sphere-release/EULA
 
-%post identity-certified
-/usr/bin/ln -srf /usr/share/sphere-release/EULA-CERTIFIED /usr/share/sphere-release/EULA
+%posttrans -p <lua> identity-certified
+os.execute("/usr/bin/ln -srf /usr/share/sphere-release/EULA-CERTIFIED /usr/share/sphere-release/EULA")
 
 %preun identity-certified
 /usr/bin/rm -f /usr/share/sphere-release/EULA
 
-%post identity-server
-/usr/bin/ln -srf /usr/share/sphere-release/EULA-SERVER /usr/share/sphere-release/EULA
+%posttrans -p <lua> identity-server
+os.execute("/usr/bin/ln -srf /usr/share/sphere-release/EULA-SERVER /usr/share/sphere-release/EULA")
 
 %preun identity-server
 /usr/bin/rm -f /usr/share/sphere-release/EULA
@@ -655,6 +655,15 @@ fi
 
 
 %changelog
+* Mon Dec 16 2024 Arkady L. Shane <tigro@msvsphere-os.ru> - 10.0-0.3
+- Use lua for some scriptlets to avoid missing /bin/sh
+
+* Mon Dec 16 2024 Arkady L. Shane <tigro@msvsphere-os.ru> - 10.0-0.2
+- enable fips-crypto-policy-overlay.service
+
+* Sun Dec 15 2024 Arkady L. Shane <tigro@msvsphere-os.ru> - 10.0-0.1
+- Rebase for MSVSphere 10
+
 * Tue Nov 26 2024 Arkady L. Shane <tigro@msvsphere-os.ru> - 9.5-2
 - Updates LICENSES