From f0c8bce709049b8f2972aecd672bd344f24a791e Mon Sep 17 00:00:00 2001
From: CoreOS Bot <coreosbot@fedoraproject.org>
Date: Mon, 1 Jul 2024 16:31:42 +0000
Subject: [PATCH] tree: promote changes from testing-devel at
 de0416b8820cffa2ea3b7dbd9e95a9cc0ad9a42b

---
 .github/workflows/openshift-os.yml            |  1 +
 kola-denylist.yaml                            |  8 ++-
 manifest-lock.aarch64.json                    | 62 ++++++++++---------
 manifest-lock.overrides.yaml                  | 37 +++++++----
 manifest-lock.ppc64le.json                    | 60 ++++++++++--------
 manifest-lock.s390x.json                      | 62 ++++++++++---------
 manifest-lock.x86_64.json                     | 62 ++++++++++---------
 manifests/fedora-coreos-base.yaml             |  2 +
 .../coreos-ignition-setup-user.sh             |  7 +++
 .../coreos-multipath-generator                |  3 -
 .../coreos-multipath-trigger.service          | 19 ------
 .../coreos-multipath-wait.target              |  2 -
 .../35coreos-multipath/module-setup.sh        |  2 -
 .../ignition-ostree-growfs.sh                 | 16 ++++-
 .../40ignition-ostree/module-setup.sh         |  1 +
 .../lib/systemd/system-preset/45-fcos.preset  |  6 ++
 ...coreos-bootupctl-update-secureboot.service | 20 ++++++
 .../system/coreos-fix-aleph-file.service      | 14 +++++
 .../15fcos/usr/libexec/coreos-fix-aleph-file  | 28 +++++++++
 .../usr/libexec/coreos-update-bootloader      | 27 ++++++++
 tests/kola/data/commonlib.sh                  | 18 +++---
 tests/kola/files/initrd/compression           | 10 +--
 tests/kola/files/rpmdb-sqlite                 |  8 +--
 tests/kola/kdump/crash/config.bu              |  5 ++
 .../default-network-behavior-change/test.sh   |  2 +-
 .../hostname/fallback-hostname/test.sh        | 45 ++++++--------
 tests/kola/podman/rootless-systemd            |  4 --
 .../root-reprovision/luks/512e/config.ign     |  1 +
 tests/kola/root-reprovision/luks/512e/data    |  1 +
 tests/kola/root-reprovision/luks/512e/test.sh | 36 +++++++++++
 30 files changed, 364 insertions(+), 205 deletions(-)
 delete mode 100644 overlay.d/05core/usr/lib/dracut/modules.d/35coreos-multipath/coreos-multipath-trigger.service
 create mode 100644 overlay.d/15fcos/usr/lib/systemd/system/coreos-bootupctl-update-secureboot.service
 create mode 100644 overlay.d/15fcos/usr/lib/systemd/system/coreos-fix-aleph-file.service
 create mode 100755 overlay.d/15fcos/usr/libexec/coreos-fix-aleph-file
 create mode 100755 overlay.d/15fcos/usr/libexec/coreos-update-bootloader
 create mode 120000 tests/kola/root-reprovision/luks/512e/config.ign
 create mode 120000 tests/kola/root-reprovision/luks/512e/data
 create mode 100755 tests/kola/root-reprovision/luks/512e/test.sh

diff --git a/.github/workflows/openshift-os.yml b/.github/workflows/openshift-os.yml
index 90b1676b20..1bdde9f996 100644
--- a/.github/workflows/openshift-os.yml
+++ b/.github/workflows/openshift-os.yml
@@ -14,6 +14,7 @@ on:
         type: choice
         options:
           - testing-devel
+          - rhcos-4.16
           - rhcos-4.15
           - rhcos-4.14
           - rhcos-4.13
diff --git a/kola-denylist.yaml b/kola-denylist.yaml
index 8a81a1a93e..4c31e1f557 100644
--- a/kola-denylist.yaml
+++ b/kola-denylist.yaml
@@ -7,7 +7,7 @@
   tracker: https://github.com/coreos/coreos-assembler/pull/1478
 - pattern: coreos.ignition.ssh.key
   tracker: https://github.com/coreos/fedora-coreos-tracker/issues/1553
-  # snooze: 2024-05-20 (disabled on promotion)
+  # snooze: 2024-07-01 (disabled on promotion)
   # warn: true (disabled on promotion)
   platforms:
     - azure
@@ -16,3 +16,9 @@
   # warn: true (disabled on promotion)
   arches:
     - ppc64le
+- pattern: ext.config.kdump.crash
+  tracker: https://github.com/coreos/fedora-coreos-tracker/issues/1750
+  # warn: true (disabled on promotion)
+  # snooze: 2024-07-15 (disabled on promotion)
+  arches:
+    - ppc64le
diff --git a/manifest-lock.aarch64.json b/manifest-lock.aarch64.json
index d0fef78c51..ff2b91fc7b 100644
--- a/manifest-lock.aarch64.json
+++ b/manifest-lock.aarch64.json
@@ -55,13 +55,13 @@
       }
     },
     "afterburn": {
-      "evra": "5.5.1-4.fc40.aarch64",
+      "evra": "5.6.0-1.fc40.aarch64",
       "metadata": {
         "sourcerpm": "rust-afterburn"
       }
     },
     "afterburn-dracut": {
-      "evra": "5.5.1-4.fc40.aarch64",
+      "evra": "5.6.0-1.fc40.aarch64",
       "metadata": {
         "sourcerpm": "rust-afterburn"
       }
@@ -139,7 +139,7 @@
       }
     },
     "bash-color-prompt": {
-      "evra": "0.4.1-1.fc40.noarch",
+      "evra": "0.4.2-1.fc40.noarch",
       "metadata": {
         "sourcerpm": "shell-color-prompt"
       }
@@ -319,7 +319,7 @@
       }
     },
     "container-selinux": {
-      "evra": "2:2.231.0-1.fc40.noarch",
+      "evra": "2:2.232.1-1.fc40.noarch",
       "metadata": {
         "sourcerpm": "container-selinux"
       }
@@ -409,13 +409,13 @@
       }
     },
     "cryptsetup": {
-      "evra": "2.7.2-1.fc40.aarch64",
+      "evra": "2.7.3-1.fc40.aarch64",
       "metadata": {
         "sourcerpm": "cryptsetup"
       }
     },
     "cryptsetup-libs": {
-      "evra": "2.7.2-1.fc40.aarch64",
+      "evra": "2.7.3-1.fc40.aarch64",
       "metadata": {
         "sourcerpm": "cryptsetup"
       }
@@ -733,7 +733,7 @@
       }
     },
     "fwupd": {
-      "evra": "1.9.20-1.fc40.aarch64",
+      "evra": "1.9.21-1.fc40.aarch64",
       "metadata": {
         "sourcerpm": "fwupd"
       }
@@ -787,7 +787,7 @@
       }
     },
     "glib2": {
-      "evra": "2.80.2-1.fc40.aarch64",
+      "evra": "2.80.3-1.fc40.aarch64",
       "metadata": {
         "sourcerpm": "glib2"
       }
@@ -835,7 +835,7 @@
       }
     },
     "google-compute-engine-guest-configs-udev": {
-      "evra": "20240501.00-1.fc40.noarch",
+      "evra": "20240607.00-2.fc40.noarch",
       "metadata": {
         "sourcerpm": "google-compute-engine-guest-configs"
       }
@@ -1261,7 +1261,7 @@
       }
     },
     "libgcc": {
-      "evra": "14.1.1-5.fc40.aarch64",
+      "evra": "14.1.1-6.fc40.aarch64",
       "metadata": {
         "sourcerpm": "gcc"
       }
@@ -1351,7 +1351,7 @@
       }
     },
     "libldb": {
-      "evra": "2.9.0-1.fc40.aarch64",
+      "evra": "2.9.1-1.fc40.aarch64",
       "metadata": {
         "sourcerpm": "libldb"
       }
@@ -1363,7 +1363,7 @@
       }
     },
     "libmaxminddb": {
-      "evra": "1.9.1-2.fc40.aarch64",
+      "evra": "1.10.0-1.fc40.aarch64",
       "metadata": {
         "sourcerpm": "libmaxminddb"
       }
@@ -1549,7 +1549,7 @@
       }
     },
     "libsmbclient": {
-      "evra": "2:4.20.1-1.fc40.aarch64",
+      "evra": "2:4.20.2-1.fc40.aarch64",
       "metadata": {
         "sourcerpm": "samba"
       }
@@ -1591,7 +1591,7 @@
       }
     },
     "libstdc++": {
-      "evra": "14.1.1-5.fc40.aarch64",
+      "evra": "14.1.1-6.fc40.aarch64",
       "metadata": {
         "sourcerpm": "gcc"
       }
@@ -1675,7 +1675,7 @@
       }
     },
     "libwbclient": {
-      "evra": "2:4.20.1-1.fc40.aarch64",
+      "evra": "2:4.20.2-1.fc40.aarch64",
       "metadata": {
         "sourcerpm": "samba"
       }
@@ -1687,7 +1687,7 @@
       }
     },
     "libxml2": {
-      "evra": "2.12.7-1.fc40.aarch64",
+      "evra": "2.12.8-1.fc40.aarch64",
       "metadata": {
         "sourcerpm": "libxml2"
       }
@@ -1885,7 +1885,7 @@
       }
     },
     "nmstate": {
-      "evra": "2.2.26-4.fc40.aarch64",
+      "evra": "2.2.33-1.fc40.aarch64",
       "metadata": {
         "sourcerpm": "nmstate"
       }
@@ -2017,13 +2017,13 @@
       }
     },
     "passt": {
-      "evra": "0^20240510.g7288448-1.fc40.aarch64",
+      "evra": "0^20240624.g1ee2eca-1.fc40.aarch64",
       "metadata": {
         "sourcerpm": "passt"
       }
     },
     "passt-selinux": {
-      "evra": "0^20240510.g7288448-1.fc40.noarch",
+      "evra": "0^20240624.g1ee2eca-1.fc40.noarch",
       "metadata": {
         "sourcerpm": "passt"
       }
@@ -2065,7 +2065,7 @@
       }
     },
     "podman": {
-      "evra": "5:5.1.0-1.fc40.aarch64",
+      "evra": "5:5.1.1-1.fc40.aarch64",
       "metadata": {
         "sourcerpm": "podman"
       }
@@ -2124,6 +2124,12 @@
         "sourcerpm": "publicsuffix-list"
       }
     },
+    "qed-firmware": {
+      "evra": "20240610-1.fc40.noarch",
+      "metadata": {
+        "sourcerpm": "linux-firmware"
+      }
+    },
     "qemu-user-static-x86": {
       "evra": "2:8.2.2-1.fc40.aarch64",
       "metadata": {
@@ -2197,19 +2203,19 @@
       }
     },
     "samba-client-libs": {
-      "evra": "2:4.20.1-1.fc40.aarch64",
+      "evra": "2:4.20.2-1.fc40.aarch64",
       "metadata": {
         "sourcerpm": "samba"
       }
     },
     "samba-common": {
-      "evra": "2:4.20.1-1.fc40.noarch",
+      "evra": "2:4.20.2-1.fc40.noarch",
       "metadata": {
         "sourcerpm": "samba"
       }
     },
     "samba-common-libs": {
-      "evra": "2:4.20.1-1.fc40.aarch64",
+      "evra": "2:4.20.2-1.fc40.aarch64",
       "metadata": {
         "sourcerpm": "samba"
       }
@@ -2221,13 +2227,13 @@
       }
     },
     "selinux-policy": {
-      "evra": "40.22-1.fc40.noarch",
+      "evra": "40.23-1.fc40.noarch",
       "metadata": {
         "sourcerpm": "selinux-policy"
       }
     },
     "selinux-policy-targeted": {
-      "evra": "40.22-1.fc40.noarch",
+      "evra": "40.23-1.fc40.noarch",
       "metadata": {
         "sourcerpm": "selinux-policy"
       }
@@ -2588,16 +2594,16 @@
     }
   },
   "metadata": {
-    "generated": "2024-06-16T00:00:00Z",
+    "generated": "2024-06-30T00:00:00Z",
     "rpmmd_repos": {
       "fedora": {
         "generated": "2024-04-14T18:51:04Z"
       },
       "fedora-coreos-pool": {
-        "generated": "2024-06-15T23:28:39Z"
+        "generated": "2024-06-25T23:57:53Z"
       },
       "fedora-updates": {
-        "generated": "2024-06-16T14:42:44Z"
+        "generated": "2024-06-30T04:57:59Z"
       }
     }
   }
diff --git a/manifest-lock.overrides.yaml b/manifest-lock.overrides.yaml
index dbfbecaa8e..c660c9bde4 100644
--- a/manifest-lock.overrides.yaml
+++ b/manifest-lock.overrides.yaml
@@ -9,20 +9,33 @@
 # for FCOS-specific packages (ignition, afterburn, etc.).
 
 packages:
-  containers-common:
-    evra: 5:0.59.1-2.fc40.noarch
+  afterburn:
+    evr: 5.6.0-1.fc40
     metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2024-ebe5c816a1
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1748
+      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2024-f2e6b90acd
       type: fast-track
-  containers-common-extra:
-    evra: 5:0.59.1-2.fc40.noarch
+  afterburn-dracut:
+    evr: 5.6.0-1.fc40
     metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2024-ebe5c816a1
-      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1748
+      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2024-f2e6b90acd
       type: fast-track
-  ignition:
-    evr: 2.19.0-1.fc40
+  kernel:
+    evr: 6.8.11-300.fc40
     metadata:
-      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2024-fd0b1de169
-      type: fast-track
+      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1752
+      type: pin
+  kernel-core:
+    evr: 6.8.11-300.fc40
+    metadata:
+      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1752
+      type: pin
+  kernel-modules:
+    evr: 6.8.11-300.fc40
+    metadata:
+      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1752
+      type: pin
+  kernel-modules-core:
+    evr: 6.8.11-300.fc40
+    metadata:
+      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1752
+      type: pin
diff --git a/manifest-lock.ppc64le.json b/manifest-lock.ppc64le.json
index 2f7990ec85..5430212a25 100644
--- a/manifest-lock.ppc64le.json
+++ b/manifest-lock.ppc64le.json
@@ -55,13 +55,13 @@
       }
     },
     "afterburn": {
-      "evra": "5.5.1-4.fc40.ppc64le",
+      "evra": "5.6.0-1.fc40.ppc64le",
       "metadata": {
         "sourcerpm": "rust-afterburn"
       }
     },
     "afterburn-dracut": {
-      "evra": "5.5.1-4.fc40.ppc64le",
+      "evra": "5.6.0-1.fc40.ppc64le",
       "metadata": {
         "sourcerpm": "rust-afterburn"
       }
@@ -139,7 +139,7 @@
       }
     },
     "bash-color-prompt": {
-      "evra": "0.4.1-1.fc40.noarch",
+      "evra": "0.4.2-1.fc40.noarch",
       "metadata": {
         "sourcerpm": "shell-color-prompt"
       }
@@ -325,7 +325,7 @@
       }
     },
     "container-selinux": {
-      "evra": "2:2.231.0-1.fc40.noarch",
+      "evra": "2:2.232.1-1.fc40.noarch",
       "metadata": {
         "sourcerpm": "container-selinux"
       }
@@ -409,13 +409,13 @@
       }
     },
     "cryptsetup": {
-      "evra": "2.7.2-1.fc40.ppc64le",
+      "evra": "2.7.3-1.fc40.ppc64le",
       "metadata": {
         "sourcerpm": "cryptsetup"
       }
     },
     "cryptsetup-libs": {
-      "evra": "2.7.2-1.fc40.ppc64le",
+      "evra": "2.7.3-1.fc40.ppc64le",
       "metadata": {
         "sourcerpm": "cryptsetup"
       }
@@ -709,7 +709,7 @@
       }
     },
     "fwupd": {
-      "evra": "1.9.20-1.fc40.ppc64le",
+      "evra": "1.9.21-1.fc40.ppc64le",
       "metadata": {
         "sourcerpm": "fwupd"
       }
@@ -763,7 +763,7 @@
       }
     },
     "glib2": {
-      "evra": "2.80.2-1.fc40.ppc64le",
+      "evra": "2.80.3-1.fc40.ppc64le",
       "metadata": {
         "sourcerpm": "glib2"
       }
@@ -1237,7 +1237,7 @@
       }
     },
     "libgcc": {
-      "evra": "14.1.1-5.fc40.ppc64le",
+      "evra": "14.1.1-6.fc40.ppc64le",
       "metadata": {
         "sourcerpm": "gcc"
       }
@@ -1327,7 +1327,7 @@
       }
     },
     "libldb": {
-      "evra": "2.9.0-1.fc40.ppc64le",
+      "evra": "2.9.1-1.fc40.ppc64le",
       "metadata": {
         "sourcerpm": "libldb"
       }
@@ -1339,7 +1339,7 @@
       }
     },
     "libmaxminddb": {
-      "evra": "1.9.1-2.fc40.ppc64le",
+      "evra": "1.10.0-1.fc40.ppc64le",
       "metadata": {
         "sourcerpm": "libmaxminddb"
       }
@@ -1537,7 +1537,7 @@
       }
     },
     "libsmbclient": {
-      "evra": "2:4.20.1-1.fc40.ppc64le",
+      "evra": "2:4.20.2-1.fc40.ppc64le",
       "metadata": {
         "sourcerpm": "samba"
       }
@@ -1579,7 +1579,7 @@
       }
     },
     "libstdc++": {
-      "evra": "14.1.1-5.fc40.ppc64le",
+      "evra": "14.1.1-6.fc40.ppc64le",
       "metadata": {
         "sourcerpm": "gcc"
       }
@@ -1663,7 +1663,7 @@
       }
     },
     "libwbclient": {
-      "evra": "2:4.20.1-1.fc40.ppc64le",
+      "evra": "2:4.20.2-1.fc40.ppc64le",
       "metadata": {
         "sourcerpm": "samba"
       }
@@ -1675,7 +1675,7 @@
       }
     },
     "libxml2": {
-      "evra": "2.12.7-1.fc40.ppc64le",
+      "evra": "2.12.8-1.fc40.ppc64le",
       "metadata": {
         "sourcerpm": "libxml2"
       }
@@ -1855,7 +1855,7 @@
       }
     },
     "nmstate": {
-      "evra": "2.2.26-4.fc40.ppc64le",
+      "evra": "2.2.33-1.fc40.ppc64le",
       "metadata": {
         "sourcerpm": "nmstate"
       }
@@ -1993,13 +1993,13 @@
       }
     },
     "passt": {
-      "evra": "0^20240510.g7288448-1.fc40.ppc64le",
+      "evra": "0^20240624.g1ee2eca-1.fc40.ppc64le",
       "metadata": {
         "sourcerpm": "passt"
       }
     },
     "passt-selinux": {
-      "evra": "0^20240510.g7288448-1.fc40.noarch",
+      "evra": "0^20240624.g1ee2eca-1.fc40.noarch",
       "metadata": {
         "sourcerpm": "passt"
       }
@@ -2041,7 +2041,7 @@
       }
     },
     "podman": {
-      "evra": "5:5.1.0-1.fc40.ppc64le",
+      "evra": "5:5.1.1-1.fc40.ppc64le",
       "metadata": {
         "sourcerpm": "podman"
       }
@@ -2112,6 +2112,12 @@
         "sourcerpm": "publicsuffix-list"
       }
     },
+    "qed-firmware": {
+      "evra": "20240610-1.fc40.noarch",
+      "metadata": {
+        "sourcerpm": "linux-firmware"
+      }
+    },
     "qemu-user-static-x86": {
       "evra": "2:8.2.2-1.fc40.ppc64le",
       "metadata": {
@@ -2185,19 +2191,19 @@
       }
     },
     "samba-client-libs": {
-      "evra": "2:4.20.1-1.fc40.ppc64le",
+      "evra": "2:4.20.2-1.fc40.ppc64le",
       "metadata": {
         "sourcerpm": "samba"
       }
     },
     "samba-common": {
-      "evra": "2:4.20.1-1.fc40.noarch",
+      "evra": "2:4.20.2-1.fc40.noarch",
       "metadata": {
         "sourcerpm": "samba"
       }
     },
     "samba-common-libs": {
-      "evra": "2:4.20.1-1.fc40.ppc64le",
+      "evra": "2:4.20.2-1.fc40.ppc64le",
       "metadata": {
         "sourcerpm": "samba"
       }
@@ -2209,13 +2215,13 @@
       }
     },
     "selinux-policy": {
-      "evra": "40.22-1.fc40.noarch",
+      "evra": "40.23-1.fc40.noarch",
       "metadata": {
         "sourcerpm": "selinux-policy"
       }
     },
     "selinux-policy-targeted": {
-      "evra": "40.22-1.fc40.noarch",
+      "evra": "40.23-1.fc40.noarch",
       "metadata": {
         "sourcerpm": "selinux-policy"
       }
@@ -2564,16 +2570,16 @@
     }
   },
   "metadata": {
-    "generated": "2024-06-16T00:00:00Z",
+    "generated": "2024-06-30T00:00:00Z",
     "rpmmd_repos": {
       "fedora": {
         "generated": "2024-04-14T18:51:03Z"
       },
       "fedora-coreos-pool": {
-        "generated": "2024-06-15T23:27:18Z"
+        "generated": "2024-06-25T23:56:33Z"
       },
       "fedora-updates": {
-        "generated": "2024-06-16T14:42:51Z"
+        "generated": "2024-06-30T04:58:07Z"
       }
     }
   }
diff --git a/manifest-lock.s390x.json b/manifest-lock.s390x.json
index bcc467eacf..6f3dfd5358 100644
--- a/manifest-lock.s390x.json
+++ b/manifest-lock.s390x.json
@@ -55,13 +55,13 @@
       }
     },
     "afterburn": {
-      "evra": "5.5.1-4.fc40.s390x",
+      "evra": "5.6.0-1.fc40.s390x",
       "metadata": {
         "sourcerpm": "rust-afterburn"
       }
     },
     "afterburn-dracut": {
-      "evra": "5.5.1-4.fc40.s390x",
+      "evra": "5.6.0-1.fc40.s390x",
       "metadata": {
         "sourcerpm": "rust-afterburn"
       }
@@ -139,7 +139,7 @@
       }
     },
     "bash-color-prompt": {
-      "evra": "0.4.1-1.fc40.noarch",
+      "evra": "0.4.2-1.fc40.noarch",
       "metadata": {
         "sourcerpm": "shell-color-prompt"
       }
@@ -319,7 +319,7 @@
       }
     },
     "container-selinux": {
-      "evra": "2:2.231.0-1.fc40.noarch",
+      "evra": "2:2.232.1-1.fc40.noarch",
       "metadata": {
         "sourcerpm": "container-selinux"
       }
@@ -403,13 +403,13 @@
       }
     },
     "cryptsetup": {
-      "evra": "2.7.2-1.fc40.s390x",
+      "evra": "2.7.3-1.fc40.s390x",
       "metadata": {
         "sourcerpm": "cryptsetup"
       }
     },
     "cryptsetup-libs": {
-      "evra": "2.7.2-1.fc40.s390x",
+      "evra": "2.7.3-1.fc40.s390x",
       "metadata": {
         "sourcerpm": "cryptsetup"
       }
@@ -703,7 +703,7 @@
       }
     },
     "fwupd": {
-      "evra": "1.9.20-1.fc40.s390x",
+      "evra": "1.9.21-1.fc40.s390x",
       "metadata": {
         "sourcerpm": "fwupd"
       }
@@ -739,7 +739,7 @@
       }
     },
     "glib2": {
-      "evra": "2.80.2-1.fc40.s390x",
+      "evra": "2.80.3-1.fc40.s390x",
       "metadata": {
         "sourcerpm": "glib2"
       }
@@ -1177,7 +1177,7 @@
       }
     },
     "libgcc": {
-      "evra": "14.1.1-5.fc40.s390x",
+      "evra": "14.1.1-6.fc40.s390x",
       "metadata": {
         "sourcerpm": "gcc"
       }
@@ -1267,7 +1267,7 @@
       }
     },
     "libldb": {
-      "evra": "2.9.0-1.fc40.s390x",
+      "evra": "2.9.1-1.fc40.s390x",
       "metadata": {
         "sourcerpm": "libldb"
       }
@@ -1279,7 +1279,7 @@
       }
     },
     "libmaxminddb": {
-      "evra": "1.9.1-2.fc40.s390x",
+      "evra": "1.10.0-1.fc40.s390x",
       "metadata": {
         "sourcerpm": "libmaxminddb"
       }
@@ -1465,7 +1465,7 @@
       }
     },
     "libsmbclient": {
-      "evra": "2:4.20.1-1.fc40.s390x",
+      "evra": "2:4.20.2-1.fc40.s390x",
       "metadata": {
         "sourcerpm": "samba"
       }
@@ -1507,7 +1507,7 @@
       }
     },
     "libstdc++": {
-      "evra": "14.1.1-5.fc40.s390x",
+      "evra": "14.1.1-6.fc40.s390x",
       "metadata": {
         "sourcerpm": "gcc"
       }
@@ -1591,7 +1591,7 @@
       }
     },
     "libwbclient": {
-      "evra": "2:4.20.1-1.fc40.s390x",
+      "evra": "2:4.20.2-1.fc40.s390x",
       "metadata": {
         "sourcerpm": "samba"
       }
@@ -1603,7 +1603,7 @@
       }
     },
     "libxml2": {
-      "evra": "2.12.7-1.fc40.s390x",
+      "evra": "2.12.8-1.fc40.s390x",
       "metadata": {
         "sourcerpm": "libxml2"
       }
@@ -1783,7 +1783,7 @@
       }
     },
     "nmstate": {
-      "evra": "2.2.26-4.fc40.s390x",
+      "evra": "2.2.33-1.fc40.s390x",
       "metadata": {
         "sourcerpm": "nmstate"
       }
@@ -1903,13 +1903,13 @@
       }
     },
     "passt": {
-      "evra": "0^20240510.g7288448-1.fc40.s390x",
+      "evra": "0^20240624.g1ee2eca-1.fc40.s390x",
       "metadata": {
         "sourcerpm": "passt"
       }
     },
     "passt-selinux": {
-      "evra": "0^20240510.g7288448-1.fc40.noarch",
+      "evra": "0^20240624.g1ee2eca-1.fc40.noarch",
       "metadata": {
         "sourcerpm": "passt"
       }
@@ -1951,7 +1951,7 @@
       }
     },
     "podman": {
-      "evra": "5:5.1.0-1.fc40.s390x",
+      "evra": "5:5.1.1-1.fc40.s390x",
       "metadata": {
         "sourcerpm": "podman"
       }
@@ -2010,6 +2010,12 @@
         "sourcerpm": "publicsuffix-list"
       }
     },
+    "qed-firmware": {
+      "evra": "20240610-1.fc40.noarch",
+      "metadata": {
+        "sourcerpm": "linux-firmware"
+      }
+    },
     "qemu-user-static-x86": {
       "evra": "2:8.2.2-1.fc40.s390x",
       "metadata": {
@@ -2089,19 +2095,19 @@
       }
     },
     "samba-client-libs": {
-      "evra": "2:4.20.1-1.fc40.s390x",
+      "evra": "2:4.20.2-1.fc40.s390x",
       "metadata": {
         "sourcerpm": "samba"
       }
     },
     "samba-common": {
-      "evra": "2:4.20.1-1.fc40.noarch",
+      "evra": "2:4.20.2-1.fc40.noarch",
       "metadata": {
         "sourcerpm": "samba"
       }
     },
     "samba-common-libs": {
-      "evra": "2:4.20.1-1.fc40.s390x",
+      "evra": "2:4.20.2-1.fc40.s390x",
       "metadata": {
         "sourcerpm": "samba"
       }
@@ -2113,13 +2119,13 @@
       }
     },
     "selinux-policy": {
-      "evra": "40.22-1.fc40.noarch",
+      "evra": "40.23-1.fc40.noarch",
       "metadata": {
         "sourcerpm": "selinux-policy"
       }
     },
     "selinux-policy-targeted": {
-      "evra": "40.22-1.fc40.noarch",
+      "evra": "40.23-1.fc40.noarch",
       "metadata": {
         "sourcerpm": "selinux-policy"
       }
@@ -2377,7 +2383,7 @@
       }
     },
     "veritysetup": {
-      "evra": "2.7.2-1.fc40.s390x",
+      "evra": "2.7.3-1.fc40.s390x",
       "metadata": {
         "sourcerpm": "cryptsetup"
       }
@@ -2468,16 +2474,16 @@
     }
   },
   "metadata": {
-    "generated": "2024-06-16T00:00:00Z",
+    "generated": "2024-06-30T00:00:00Z",
     "rpmmd_repos": {
       "fedora": {
         "generated": "2024-04-14T18:51:01Z"
       },
       "fedora-coreos-pool": {
-        "generated": "2024-06-15T23:27:02Z"
+        "generated": "2024-06-25T23:56:02Z"
       },
       "fedora-updates": {
-        "generated": "2024-06-16T14:42:58Z"
+        "generated": "2024-06-30T04:58:14Z"
       }
     }
   }
diff --git a/manifest-lock.x86_64.json b/manifest-lock.x86_64.json
index e2993e920c..4fdbe69b7a 100644
--- a/manifest-lock.x86_64.json
+++ b/manifest-lock.x86_64.json
@@ -55,13 +55,13 @@
       }
     },
     "afterburn": {
-      "evra": "5.5.1-4.fc40.x86_64",
+      "evra": "5.6.0-1.fc40.x86_64",
       "metadata": {
         "sourcerpm": "rust-afterburn"
       }
     },
     "afterburn-dracut": {
-      "evra": "5.5.1-4.fc40.x86_64",
+      "evra": "5.6.0-1.fc40.x86_64",
       "metadata": {
         "sourcerpm": "rust-afterburn"
       }
@@ -145,7 +145,7 @@
       }
     },
     "bash-color-prompt": {
-      "evra": "0.4.1-1.fc40.noarch",
+      "evra": "0.4.2-1.fc40.noarch",
       "metadata": {
         "sourcerpm": "shell-color-prompt"
       }
@@ -325,7 +325,7 @@
       }
     },
     "container-selinux": {
-      "evra": "2:2.231.0-1.fc40.noarch",
+      "evra": "2:2.232.1-1.fc40.noarch",
       "metadata": {
         "sourcerpm": "container-selinux"
       }
@@ -415,13 +415,13 @@
       }
     },
     "cryptsetup": {
-      "evra": "2.7.2-1.fc40.x86_64",
+      "evra": "2.7.3-1.fc40.x86_64",
       "metadata": {
         "sourcerpm": "cryptsetup"
       }
     },
     "cryptsetup-libs": {
-      "evra": "2.7.2-1.fc40.x86_64",
+      "evra": "2.7.3-1.fc40.x86_64",
       "metadata": {
         "sourcerpm": "cryptsetup"
       }
@@ -739,7 +739,7 @@
       }
     },
     "fwupd": {
-      "evra": "1.9.20-1.fc40.x86_64",
+      "evra": "1.9.21-1.fc40.x86_64",
       "metadata": {
         "sourcerpm": "fwupd"
       }
@@ -793,7 +793,7 @@
       }
     },
     "glib2": {
-      "evra": "2.80.2-1.fc40.x86_64",
+      "evra": "2.80.3-1.fc40.x86_64",
       "metadata": {
         "sourcerpm": "glib2"
       }
@@ -841,7 +841,7 @@
       }
     },
     "google-compute-engine-guest-configs-udev": {
-      "evra": "20240501.00-1.fc40.noarch",
+      "evra": "20240607.00-2.fc40.noarch",
       "metadata": {
         "sourcerpm": "google-compute-engine-guest-configs"
       }
@@ -1279,7 +1279,7 @@
       }
     },
     "libgcc": {
-      "evra": "14.1.1-5.fc40.x86_64",
+      "evra": "14.1.1-6.fc40.x86_64",
       "metadata": {
         "sourcerpm": "gcc"
       }
@@ -1369,7 +1369,7 @@
       }
     },
     "libldb": {
-      "evra": "2.9.0-1.fc40.x86_64",
+      "evra": "2.9.1-1.fc40.x86_64",
       "metadata": {
         "sourcerpm": "libldb"
       }
@@ -1381,7 +1381,7 @@
       }
     },
     "libmaxminddb": {
-      "evra": "1.9.1-2.fc40.x86_64",
+      "evra": "1.10.0-1.fc40.x86_64",
       "metadata": {
         "sourcerpm": "libmaxminddb"
       }
@@ -1567,7 +1567,7 @@
       }
     },
     "libsmbclient": {
-      "evra": "2:4.20.1-1.fc40.x86_64",
+      "evra": "2:4.20.2-1.fc40.x86_64",
       "metadata": {
         "sourcerpm": "samba"
       }
@@ -1609,7 +1609,7 @@
       }
     },
     "libstdc++": {
-      "evra": "14.1.1-5.fc40.x86_64",
+      "evra": "14.1.1-6.fc40.x86_64",
       "metadata": {
         "sourcerpm": "gcc"
       }
@@ -1693,7 +1693,7 @@
       }
     },
     "libwbclient": {
-      "evra": "2:4.20.1-1.fc40.x86_64",
+      "evra": "2:4.20.2-1.fc40.x86_64",
       "metadata": {
         "sourcerpm": "samba"
       }
@@ -1705,7 +1705,7 @@
       }
     },
     "libxml2": {
-      "evra": "2.12.7-1.fc40.x86_64",
+      "evra": "2.12.8-1.fc40.x86_64",
       "metadata": {
         "sourcerpm": "libxml2"
       }
@@ -1909,7 +1909,7 @@
       }
     },
     "nmstate": {
-      "evra": "2.2.26-4.fc40.x86_64",
+      "evra": "2.2.33-1.fc40.x86_64",
       "metadata": {
         "sourcerpm": "nmstate"
       }
@@ -2041,13 +2041,13 @@
       }
     },
     "passt": {
-      "evra": "0^20240510.g7288448-1.fc40.x86_64",
+      "evra": "0^20240624.g1ee2eca-1.fc40.x86_64",
       "metadata": {
         "sourcerpm": "passt"
       }
     },
     "passt-selinux": {
-      "evra": "0^20240510.g7288448-1.fc40.noarch",
+      "evra": "0^20240624.g1ee2eca-1.fc40.noarch",
       "metadata": {
         "sourcerpm": "passt"
       }
@@ -2089,7 +2089,7 @@
       }
     },
     "podman": {
-      "evra": "5:5.1.0-1.fc40.x86_64",
+      "evra": "5:5.1.1-1.fc40.x86_64",
       "metadata": {
         "sourcerpm": "podman"
       }
@@ -2148,6 +2148,12 @@
         "sourcerpm": "publicsuffix-list"
       }
     },
+    "qed-firmware": {
+      "evra": "20240610-1.fc40.noarch",
+      "metadata": {
+        "sourcerpm": "linux-firmware"
+      }
+    },
     "readline": {
       "evra": "8.2-8.fc40.x86_64",
       "metadata": {
@@ -2215,19 +2221,19 @@
       }
     },
     "samba-client-libs": {
-      "evra": "2:4.20.1-1.fc40.x86_64",
+      "evra": "2:4.20.2-1.fc40.x86_64",
       "metadata": {
         "sourcerpm": "samba"
       }
     },
     "samba-common": {
-      "evra": "2:4.20.1-1.fc40.noarch",
+      "evra": "2:4.20.2-1.fc40.noarch",
       "metadata": {
         "sourcerpm": "samba"
       }
     },
     "samba-common-libs": {
-      "evra": "2:4.20.1-1.fc40.x86_64",
+      "evra": "2:4.20.2-1.fc40.x86_64",
       "metadata": {
         "sourcerpm": "samba"
       }
@@ -2239,13 +2245,13 @@
       }
     },
     "selinux-policy": {
-      "evra": "40.22-1.fc40.noarch",
+      "evra": "40.23-1.fc40.noarch",
       "metadata": {
         "sourcerpm": "selinux-policy"
       }
     },
     "selinux-policy-targeted": {
-      "evra": "40.22-1.fc40.noarch",
+      "evra": "40.23-1.fc40.noarch",
       "metadata": {
         "sourcerpm": "selinux-policy"
       }
@@ -2606,16 +2612,16 @@
     }
   },
   "metadata": {
-    "generated": "2024-06-16T00:00:00Z",
+    "generated": "2024-06-30T00:00:00Z",
     "rpmmd_repos": {
       "fedora": {
         "generated": "2024-04-14T18:51:11Z"
       },
       "fedora-coreos-pool": {
-        "generated": "2024-06-15T23:28:35Z"
+        "generated": "2024-06-25T23:57:47Z"
       },
       "fedora-updates": {
-        "generated": "2024-06-16T14:43:05Z"
+        "generated": "2024-06-30T04:58:22Z"
       }
     }
   }
diff --git a/manifests/fedora-coreos-base.yaml b/manifests/fedora-coreos-base.yaml
index d2fd41a14b..a510e4c8c5 100644
--- a/manifests/fedora-coreos-base.yaml
+++ b/manifests/fedora-coreos-base.yaml
@@ -157,6 +157,8 @@ packages:
   - iptables-legacy
   # GPU Firmware files (not broken out into subpackage of linux-firmware in RHEL yet)
   - amd-gpu-firmware intel-gpu-firmware nvidia-gpu-firmware
+  # NIC firmware we've traditionally shipped but then were split out of linux-firmware in Fedora
+  - qed-firmware # https://github.com/coreos/fedora-coreos-tracker/issues/1746
 
 
 # - irqbalance
diff --git a/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-ignition-setup-user.sh b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-ignition-setup-user.sh
index efc8cc7612..a48dc1e6b3 100755
--- a/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-ignition-setup-user.sh
+++ b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-ignition-setup-user.sh
@@ -14,6 +14,13 @@ copy_file_if_exists() {
 destination=/usr/lib/ignition
 mkdir -p $destination
 
+# systemd v256 now runs the initrd with ProtectSystem=yes, which makes /usr
+# read-only. Just remount it rw until we have:
+# https://github.com/coreos/ignition/issues/1891
+if [ ! -w /usr ]; then
+    mount -o rw,remount /usr
+fi
+
 if is-live-image; then
     # Live image. If the user has supplied a config.ign via an appended
     # initrd, put it in the right place.
diff --git a/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-multipath/coreos-multipath-generator b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-multipath/coreos-multipath-generator
index 7165620fb1..f073fee942 100755
--- a/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-multipath/coreos-multipath-generator
+++ b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-multipath/coreos-multipath-generator
@@ -24,7 +24,4 @@ add_requires() {
 
 if getargbool 0 rd.multipath; then
     add_requires coreos-multipath-wait.target initrd.target
-    if ! getargbool 0 ignition.firstboot; then
-        add_requires coreos-multipath-trigger.service initrd.target
-    fi
 fi
diff --git a/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-multipath/coreos-multipath-trigger.service b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-multipath/coreos-multipath-trigger.service
deleted file mode 100644
index 524dc9140e..0000000000
--- a/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-multipath/coreos-multipath-trigger.service
+++ /dev/null
@@ -1,19 +0,0 @@
-# This unit is needed in the LUKS-on-multipath case on subsequent boots. When
-# multipathd takes ownership of the individual paths, the by-uuid/ symlink
-# which systemd-cryptsetup@.service binds to gets lost. So we retrigger udev
-# here to make sure it's re-added.
-#
-# This is tracked at:
-# https://bugzilla.redhat.com/show_bug.cgi?id=1963242
-
-[Unit]
-Description=CoreOS Trigger Multipath
-DefaultDependencies=false
-Requires=coreos-multipath-wait.target
-After=coreos-multipath-wait.target
-Before=cryptsetup-pre.target
-
-[Service]
-Type=oneshot
-ExecStart=/usr/sbin/udevadm trigger --settle --subsystem-match block
-RemainAfterExit=yes
diff --git a/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-multipath/coreos-multipath-wait.target b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-multipath/coreos-multipath-wait.target
index 87be77db19..8cdc3d8ac7 100644
--- a/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-multipath/coreos-multipath-wait.target
+++ b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-multipath/coreos-multipath-wait.target
@@ -14,6 +14,4 @@ OnFailureJobMode=isolate
 # already have our multipath target.
 Before=coreos-ignition-setup-user.service
 
-# This is already enforced by coreos-multipath-trigger.service, though ideally
-# eventually we can get rid of that one and then we *would* need this.
 Before=cryptsetup-pre.target
diff --git a/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-multipath/module-setup.sh b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-multipath/module-setup.sh
index 92a33e7e3f..b04ba58e96 100755
--- a/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-multipath/module-setup.sh
+++ b/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-multipath/module-setup.sh
@@ -23,6 +23,4 @@ install() {
     # we don't enable these; they're enabled dynamically via the generator
     inst_simple "$moddir/coreos-multipath-wait.target" \
         "$systemdsystemunitdir/coreos-multipath-wait.target"
-    inst_simple "$moddir/coreos-multipath-trigger.service" \
-        "$systemdsystemunitdir/coreos-multipath-trigger.service"
 }
diff --git a/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-growfs.sh b/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-growfs.sh
index 2bda69befe..638785449a 100755
--- a/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-growfs.sh
+++ b/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/ignition-ostree-growfs.sh
@@ -101,14 +101,28 @@ while true; do
         part)
             eval $(udevadm info --query property --export "${current_blkdev}" | grep ^DM_ || :)
             if [ -n "${DM_MPATH:-}" ]; then
+                PKNAME=/dev/mapper/${DM_MPATH}
+                partnum=${DM_PART}
                 # Since growpart does not understand device mapper, we have to use sfdisk.
-                echo ", +" | sfdisk --no-reread --no-tell-kernel --force -N "${DM_PART}" "/dev/mapper/${DM_MPATH}"
+                echo ", +" | sfdisk --no-reread --no-tell-kernel --force -N "${partnum}" "${PKNAME}"
                 udevadm settle || : # Wait for udev-triggered kpartx to update mappings
             else
                 partnum=$(cat "/sys/dev/block/${MAJMIN}/partition")
                 # XXX: ideally this'd be idempotent and we wouldn't `|| :`
                 growpart "${PKNAME}" "${partnum}" || :
             fi
+            # If this is a 512e disk, then ensure the partition end is 4K
+            # aligned to be compatible with LUKS. If it's a 4Kn disk, `size`
+            # necessarily must be 4K aligned (note the sysfs value is always
+            # reported in 512b sizes). We should be able to drop this once
+            # https://github.com/util-linux/util-linux/issues/2140 is fixed.
+            size=$(cat "/sys/dev/block/${MAJMIN}/size")
+            phy_sec=$(blockdev --getpbsz "${PKNAME}")
+            if [ "$((size % 8))" != 0 ] && [ "${phy_sec:-}" = 4096 ]; then
+                size=$(((size >> 3) << 3))  # round down to nearest 4K boundary
+                echo ", ${size}" | sfdisk --no-reread --force -N "${partnum}" "${PKNAME}"
+                partx --update --nr "${partnum}" "${PKNAME}"
+            fi
             ;;
         crypt)
             # XXX: yuck... we need to expose this sanely in clevis
diff --git a/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/module-setup.sh b/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/module-setup.sh
index d7fd9b650d..b73f977939 100755
--- a/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/module-setup.sh
+++ b/overlay.d/05core/usr/lib/dracut/modules.d/40ignition-ostree/module-setup.sh
@@ -42,6 +42,7 @@ install() {
     inst_multiple  \
         basename   \
         blkid      \
+        blockdev   \
         cat        \
         dirname    \
         findmnt    \
diff --git a/overlay.d/15fcos/usr/lib/systemd/system-preset/45-fcos.preset b/overlay.d/15fcos/usr/lib/systemd/system-preset/45-fcos.preset
index 95d8087d2b..97a80fa224 100644
--- a/overlay.d/15fcos/usr/lib/systemd/system-preset/45-fcos.preset
+++ b/overlay.d/15fcos/usr/lib/systemd/system-preset/45-fcos.preset
@@ -6,3 +6,9 @@ enable fwupd-refresh.timer
 # Check if wifi firmwares are missing when NetworkManager-wifi is installed
 # https://github.com/coreos/fedora-coreos-tracker/issues/1575
 enable coreos-check-wireless-firmwares.service
+# Strip extraneous field in aleph files to avoid bootupctl failing
+# https://github.com/coreos/fedora-coreos-tracker/issues/1724
+enable coreos-fix-aleph-file.service
+# Upgrade bootloader on Secure Boot-enabled nodes to avoid
+# https://github.com/coreos/fedora-coreos-tracker/issues/1752
+enable coreos-bootupctl-update-secureboot.service
diff --git a/overlay.d/15fcos/usr/lib/systemd/system/coreos-bootupctl-update-secureboot.service b/overlay.d/15fcos/usr/lib/systemd/system/coreos-bootupctl-update-secureboot.service
new file mode 100644
index 0000000000..7c10b7fdcc
--- /dev/null
+++ b/overlay.d/15fcos/usr/lib/systemd/system/coreos-bootupctl-update-secureboot.service
@@ -0,0 +1,20 @@
+# Remove after the next barrier release
+
+[Unit]
+Description=Update Bootloader for Secure Boot-enabled Systems
+Documentation=https://github.com/coreos/fedora-coreos-tracker/issues/1752
+ConditionSecurity=uefi-secureboot
+
+# make sure to run after the aleph file is fixed
+# see https://github.com/coreos/fedora-coreos-tracker/issues/1724
+After=coreos-fix-aleph-file.service
+Requires=coreos-fix-aleph-file.service
+
+[Service]
+Type=oneshot
+ExecStart=/usr/libexec/coreos-update-bootloader
+RemainAfterExit=yes
+MountFlags=slave
+
+[Install]
+WantedBy=multi-user.target
diff --git a/overlay.d/15fcos/usr/lib/systemd/system/coreos-fix-aleph-file.service b/overlay.d/15fcos/usr/lib/systemd/system/coreos-fix-aleph-file.service
new file mode 100644
index 0000000000..a160b82714
--- /dev/null
+++ b/overlay.d/15fcos/usr/lib/systemd/system/coreos-fix-aleph-file.service
@@ -0,0 +1,14 @@
+# Remove after the next barrier release
+
+[Unit]
+Description=Fix CoreOS Aleph File
+Documentation=https://github.com/coreos/fedora-coreos-tracker/issues/1724
+
+[Service]
+Type=oneshot
+ExecStart=/usr/libexec/coreos-fix-aleph-file
+RemainAfterExit=yes
+MountFlags=slave
+
+[Install]
+WantedBy=multi-user.target
diff --git a/overlay.d/15fcos/usr/libexec/coreos-fix-aleph-file b/overlay.d/15fcos/usr/libexec/coreos-fix-aleph-file
new file mode 100755
index 0000000000..9fd52b01fd
--- /dev/null
+++ b/overlay.d/15fcos/usr/libexec/coreos-fix-aleph-file
@@ -0,0 +1,28 @@
+#!/usr/bin/bash
+
+# This script removes the extra `version` field
+# which was shipped in a couple of builds
+# when switching to the `build` field
+# To be removed after the next barrier release.
+# see https://github.com/coreos/fedora-coreos-tracker/issues/1724 for more details
+
+set -euo pipefail
+
+ALEPH_FILE=/sysroot/.coreos-aleph-version.json
+
+if ! jq -e 'has("build") and has("version")' ${ALEPH_FILE}; then
+    echo "Aleph file does not require fixing"
+    exit
+fi
+
+echo "Aleph file is invalid; fixing"
+
+# remount /sysroot as writable
+mount -o rw,remount /sysroot
+
+# remove field "build"
+fixed_aleph=$(jq 'del(.build)' ${ALEPH_FILE})
+
+echo "$fixed_aleph" > ${ALEPH_FILE}
+
+echo "Aleph file is fixed"
diff --git a/overlay.d/15fcos/usr/libexec/coreos-update-bootloader b/overlay.d/15fcos/usr/libexec/coreos-update-bootloader
new file mode 100755
index 0000000000..1c7d65da5d
--- /dev/null
+++ b/overlay.d/15fcos/usr/libexec/coreos-update-bootloader
@@ -0,0 +1,27 @@
+#!/bin/bash
+set -euo pipefail
+
+# This script update the bootloader using bootupd
+# and also detect RAID-1 setups as those requires
+# extra steps
+
+if [ -e /dev/disk/by-label/EFI-SYSTEM ]; then
+    echo "Found ESP; calling 'bootupctl update'"
+    bootupctl update
+    exit
+fi
+
+# handle RAID case manually since bootupd doesn't support it
+# https://github.com/coreos/bootupd/issues/132
+i=1
+while true; do
+    if [ ! -e /dev/disk/by-label/esp-$i ]; then
+        break
+    fi
+    echo "Found ESP (replica $i); updating"
+    mount /dev/disk/by-label/esp-$i /boot/efi
+    cp -rp /usr/lib/bootupd/updates/EFI /boot/efi
+    umount /boot/efi
+    i=$((i+1))
+done
+sync
diff --git a/tests/kola/data/commonlib.sh b/tests/kola/data/commonlib.sh
index b3a4db28d4..70055d0858 100644
--- a/tests/kola/data/commonlib.sh
+++ b/tests/kola/data/commonlib.sh
@@ -34,6 +34,7 @@ is_fcos() {
 # Note when using this, you probably also want to check `get_rhel_maj_ver`.
 is_rhcos() {
     source /etc/os-release
+    { [ "${ID}" == "rhel" ] && [ "${VARIANT_ID}" == "coreos" ]; } || \
     [ "${ID}" == "rhcos" ]
 }
 
@@ -46,19 +47,20 @@ get_fedora_ver() {
 
 get_rhel_maj_ver() {
     source /etc/os-release
-    echo "${RHEL_VERSION%%.*}"
-}
-
-# rhcos8
-is_rhcos8() {
-    source /etc/os-release
-    [ "${ID}" == "rhcos" ] && [ "${RHEL_VERSION%%.*}" -eq 8 ]
+    if [ "${ID}" == "rhcos" ]; then
+        echo "${RHEL_VERSION%%.*}"
+    elif [ "${ID}" == "rhel" ]; then
+        echo "${VERSION_ID%%.*}"
+    else
+        fatal "Unknown ID $ID"
+    fi
 }
 
 # rhcos9
 is_rhcos9() {
     source /etc/os-release
-    [ "${ID}" == "rhcos" ] && [ "${RHEL_VERSION%%.*}" -eq 9 ]
+    { [ "${ID}" == "rhcos" ] && [ "${RHEL_VERSION%%.*}" -eq 9 ]; } || \
+    { [ "${ID}" == "rhel" ] && [ "${VERSION_ID%%.*}" -eq 9 ]; }
 }
 
 # scos
diff --git a/tests/kola/files/initrd/compression b/tests/kola/files/initrd/compression
index 4a46680305..3994260cff 100755
--- a/tests/kola/files/initrd/compression
+++ b/tests/kola/files/initrd/compression
@@ -12,11 +12,7 @@ set -xeuo pipefail
 . "$KOLA_EXT_DATA/commonlib.sh"
 
 # Check initrd for zstd magic number
-if is_rhcos8; then
-    ok "Skipping initrd zstd compression test on RHCOS 8"
-else
-    if ! LANG=C grep -aUPq "\x28\xb5\x2f\xfd" /boot/ostree/*/init*; then
-        fatal "Didn't find zstd compression in initrd"
-    fi
-    ok "Found zstd compression in initrd"
+if ! LANG=C grep -aUPq "\x28\xb5\x2f\xfd" /boot/ostree/*/init*; then
+    fatal "Didn't find zstd compression in initrd"
 fi
+ok "Found zstd compression in initrd"
diff --git a/tests/kola/files/rpmdb-sqlite b/tests/kola/files/rpmdb-sqlite
index dfacf784e6..e05b343e2b 100755
--- a/tests/kola/files/rpmdb-sqlite
+++ b/tests/kola/files/rpmdb-sqlite
@@ -2,8 +2,7 @@
 ## kola:
 ##   # Read only test thus safe to run in parallel
 ##   exclusive: false
-##   description: Verify that we're using the sqlite rpmdb backend
-##     for RHCOS 9+ and FCOS 33+.
+##   description: Verify that we're using the sqlite rpmdb backend.
 
 # See https://github.com/coreos/fedora-coreos-tracker/issues/623
 
@@ -12,11 +11,6 @@ set -xeuo pipefail
 # shellcheck disable=SC1091
 . "$KOLA_EXT_DATA/commonlib.sh"
 
-if is_rhcos8; then
-    ok "nothing to check for RHCOS 8"
-    exit 0
-fi
-
 if [ ! -f /usr/share/rpm/rpmdb.sqlite ]; then
     fatal "Didn't find file /usr/share/rpm/rpmdb.sqlite"
 fi
diff --git a/tests/kola/kdump/crash/config.bu b/tests/kola/kdump/crash/config.bu
index cdae6b0f18..1a45c87ec5 100644
--- a/tests/kola/kdump/crash/config.bu
+++ b/tests/kola/kdump/crash/config.bu
@@ -12,3 +12,8 @@ systemd:
   units:
     - name: kdump.service
       enabled: true
+      dropins:
+        - name: debug.conf
+          contents: |
+            [Service]
+            Environment="debug=1"
diff --git a/tests/kola/networking/default-network-behavior-change/test.sh b/tests/kola/networking/default-network-behavior-change/test.sh
index 0ff17a645d..540ea1ea5f 100755
--- a/tests/kola/networking/default-network-behavior-change/test.sh
+++ b/tests/kola/networking/default-network-behavior-change/test.sh
@@ -160,7 +160,7 @@ if [ "$ID" == "fedora" ]; then
     else
         fatal "fail: not operating on expected OS version"
     fi
-elif [[ "${ID_LIKE}" =~ "rhel" ]]; then
+elif [[ "${ID}" = "rhel" ]] || [[ "${ID_LIKE}" =~ "rhel" ]]; then
     # For the version comparison use string substitution to remove the
     # '.` from the version so we can use integer comparison
 
diff --git a/tests/kola/networking/hostname/fallback-hostname/test.sh b/tests/kola/networking/hostname/fallback-hostname/test.sh
index 579f32fcb7..e473fcd7f6 100755
--- a/tests/kola/networking/hostname/fallback-hostname/test.sh
+++ b/tests/kola/networking/hostname/fallback-hostname/test.sh
@@ -51,34 +51,25 @@ set -xeuo pipefail
 # shellcheck disable=SC1091
 . "$KOLA_EXT_DATA/commonlib.sh"
 
-if is_rhcos8; then
-    if [ $(hostnamectl --transient) != 'localhost' ]; then
-        fatal "transient hostname was not expected"
-    fi
-    if [ ! -z $(hostnamectl --static) ]; then
-        fatal "static hostname not expected to be set"
-    fi
-else
-    output=$(hostnamectl --json=pretty)
-    hostname=$(echo "$output" | jq -r '.Hostname')
-    fallback=$(echo "$output" | jq -r '.DefaultHostname')
-    static=$(echo "$output" | jq -r '.StaticHostname')
-    namesource=$(echo "$output" | jq -r '.HostnameSource')
+output=$(hostnamectl --json=pretty)
+hostname=$(echo "$output" | jq -r '.Hostname')
+fallback=$(echo "$output" | jq -r '.DefaultHostname')
+static=$(echo "$output" | jq -r '.StaticHostname')
+namesource=$(echo "$output" | jq -r '.HostnameSource')
 
-    if [ "$hostname" != 'localhost' ]; then
-        fatal "hostname was not expected"
-    fi
-    if [ "$fallback" != 'localhost' ]; then
-        fatal "fallback hostname was not expected"
-    fi
-    if [ "$static" != 'null' ]; then
-        fatal "static hostname not expected to be set"
-    fi
-    if [ "$namesource" != 'default' ]; then
-        # For this test since we disabled NM setting the hostname we
-        # expect the hostname to have been set via the fallback/default
-        fatal "hostname was set from non-default/fallback source"
-    fi
+if [ "$hostname" != 'localhost' ]; then
+    fatal "hostname was not expected"
+fi
+if [ "$fallback" != 'localhost' ]; then
+    fatal "fallback hostname was not expected"
+fi
+if [ "$static" != 'null' ]; then
+    fatal "static hostname not expected to be set"
+fi
+if [ "$namesource" != 'default' ]; then
+    # For this test since we disabled NM setting the hostname we
+    # expect the hostname to have been set via the fallback/default
+    fatal "hostname was set from non-default/fallback source"
 fi
 
 ok "fallback hostname wired up correctly"
diff --git a/tests/kola/podman/rootless-systemd b/tests/kola/podman/rootless-systemd
index cdfd51b0ff..d222d26567 100755
--- a/tests/kola/podman/rootless-systemd
+++ b/tests/kola/podman/rootless-systemd
@@ -66,10 +66,6 @@ main() {
     sleep 5
 
     retryflag="--retry-all-errors"
-    # --retry-all-errors flag passed to curl is not available on RHEL8
-    if is_rhcos8; then
-        retryflag="--retry-connrefused"
-    fi
     # Try to grab the web page. Retry as it might not be up fully yet.
     if ! curl --silent --show-error --retry 5 ${retryflag} http://localhost:8080 >/dev/null; then
         runascoreuser podman logs httpd
diff --git a/tests/kola/root-reprovision/luks/512e/config.ign b/tests/kola/root-reprovision/luks/512e/config.ign
new file mode 120000
index 0000000000..f72ce41f73
--- /dev/null
+++ b/tests/kola/root-reprovision/luks/512e/config.ign
@@ -0,0 +1 @@
+../config.ign
\ No newline at end of file
diff --git a/tests/kola/root-reprovision/luks/512e/data b/tests/kola/root-reprovision/luks/512e/data
new file mode 120000
index 0000000000..4909e06efb
--- /dev/null
+++ b/tests/kola/root-reprovision/luks/512e/data
@@ -0,0 +1 @@
+../data
\ No newline at end of file
diff --git a/tests/kola/root-reprovision/luks/512e/test.sh b/tests/kola/root-reprovision/luks/512e/test.sh
new file mode 100755
index 0000000000..54e9b9a077
--- /dev/null
+++ b/tests/kola/root-reprovision/luks/512e/test.sh
@@ -0,0 +1,36 @@
+#!/bin/bash
+## kola:
+##   # This test reprovisions the rootfs.
+##   tags: "reprovision"
+##   # This uses additionalDisks, which is QEMU only
+##   platforms: qemu
+##   # Root reprovisioning requires at least 4GiB of memory.
+##   minMemory: 4096
+##   # A TPM backend device is not available on s390x to suport TPM.
+##   architectures: "! s390x"
+##   # This test includes a lot of disk I/O and needs a higher
+##   # timeout value than the default.
+##   timeoutMin: 15
+##   description: Verify that LUKS on a 512e disks works.
+##   primaryDisk: ":512e"
+
+set -xeuo pipefail
+
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
+
+# sanity-check that it's a 512e disk
+phy_sec=$(blockdev --getpbsz /dev/disk/by-id/virtio-primary-disk)
+log_sec=$(blockdev --getss /dev/disk/by-id/virtio-primary-disk)
+if [ "${phy_sec}" != 4096 ] || [ "${log_sec}" != 512 ]; then
+    fatal "root device isn't 512e"
+fi
+
+# sanity-check that LUKS chose a 4096 sector size
+luks_sec=$(blockdev --getss /dev/mapper/myluksdev)
+if [ "${luks_sec}" != 4096 ]; then
+    fatal "root LUKS device isn't 4k"
+fi
+
+# run the rest of the tests
+. $KOLA_EXT_DATA/luks-test.sh