From b32ea7f9c7c59b5253cab49c46621d4ac792f673 Mon Sep 17 00:00:00 2001
From: Xynnn007 <xynnn@linux.alibaba.com>
Date: Thu, 3 Sep 2026 16:31:06 +0800
Subject: [PATCH 1/6] kmod: only pass loadable modules to modinfo

Built-in modules are listed in modules.builtin and are not .ko files, so
modinfo has nothing useful to return for them. Older modinfo (e.g. on
Alibaba Cloud Linux 3) even exits non-zero when asked about builtins,
which aborts dependency resolution. Only query names that map to loadable
module files; keep modules.builtin for dependency warnings.

Signed-off-by: Xynnn007 <xynnn@linux.alibaba.com>
---
 mkosi/kmod.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/mkosi/kmod.py b/mkosi/kmod.py
index 5c2dbfd035..bc69057992 100644
--- a/mkosi/kmod.py
+++ b/mkosi/kmod.py
@@ -292,7 +292,9 @@ def resolve_module_dependencies(
     with chdir(context.root):
         nametofile = {module_path_to_name(m): m for m in all_modules(modulesd)}
 
-    todo = {*builtin, *modules}
+    # Only query loadable modules. Built-in modules are not .ko files; older modinfo (e.g. on
+    # Alibaba Cloud Linux 3) exits non-zero when asked about them.
+    todo = {m for m in modules if m in nametofile}
     mods: set[str] = set()
     firmware = set()
 

From 35ed00382b86ece9313a6805d1e1a5bf5f5c0fd9 Mon Sep 17 00:00:00 2001
From: Xynnn007 <xynnn@linux.alibaba.com>
Date: Thu, 3 Sep 2026 16:32:37 +0800
Subject: [PATCH 2/6] firstboot: only pass --force when systemd-firstboot
 supports it

--force was added in systemd 246. When the tools tree provides an older
systemd-firstboot (for example Alibaba Cloud Linux 3's systemd 239),
passing --force makes the firstboot step fail. Gate the flag on the
tools binary version.

Signed-off-by: Xynnn007 <xynnn@linux.alibaba.com>
---
 mkosi/__init__.py | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/mkosi/__init__.py b/mkosi/__init__.py
index 6f7fc904fb..614ec4eb5e 100644
--- a/mkosi/__init__.py
+++ b/mkosi/__init__.py
@@ -3269,9 +3269,15 @@ def run_firstboot(context: Context) -> None:
     if not options and not creds:
         return
 
+    cmdline = ["systemd-firstboot", "--root=/buildroot"]
+    # --force was added in systemd 246; Alibaba Cloud Linux 3 ships systemd 239.
+    if systemd_tool_version("systemd-firstboot", sandbox=context.sandbox) >= 246:
+        cmdline += ["--force"]
+    cmdline += options
+
     with complete_step("Applying first boot settings"):
         run(
-            ["systemd-firstboot", "--root=/buildroot", "--force", *options],
+            cmdline,
             sandbox=context.sandbox(options=context.rootoptions()),
         )
 

From 61605f0ebcb5bfe4b32313fbbb9b4cb4e57f0ad5 Mon Sep 17 00:00:00 2001
From: Xynnn007 <xynnn@linux.alibaba.com>
Date: Thu, 3 Sep 2026 16:35:16 +0800
Subject: [PATCH 3/6] grub: detect --disable-shim-lock before passing it to
 grub-mkimage

--disable-shim-lock was added in GRUB 2.06. Older grub-mkimage (for
example Alibaba Cloud Linux 3's GRUB 2.02) rejects the unknown option and
fails image generation. Probe --help and only pass the flag when
supported.

Signed-off-by: Xynnn007 <xynnn@linux.alibaba.com>
---
 mkosi/bootloader.py | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/mkosi/bootloader.py b/mkosi/bootloader.py
index 3260de15fe..b210d8625e 100644
--- a/mkosi/bootloader.py
+++ b/mkosi/bootloader.py
@@ -185,6 +185,18 @@ def find_grub_binary(config: Config, binary: str) -> Optional[Path]:
     return config.find_binary(f"grub-{binary}", f"grub2-{binary}", f"/usr/lib/grub/i386-pc/grub-{binary}")
 
 
+def grub_supports_disable_shim_lock(context: Context, mkimage: Path) -> bool:
+    # --disable-shim-lock was added in GRUB 2.06; Alibaba Cloud Linux 3 ships GRUB 2.02.
+    return (
+        "--disable-shim-lock"
+        in run(
+            [mkimage, "--help"],
+            stdout=subprocess.PIPE,
+            sandbox=context.sandbox(),
+        ).stdout
+    )
+
+
 def prepare_grub_config(context: Context) -> Optional[Path]:
     config = context.root / "efi" / context.config.distribution.installer.grub_prefix() / "grub.cfg"
     with umask(~0o700):
@@ -258,7 +270,12 @@ def grub_mkimage(
                 "--output", workdir(output) if output else "/grub/core.img",
                 "--format", target,
                 *(["--sbat", os.fspath(workdir(sbat))] if sbat else []),
-                *(["--disable-shim-lock"] if context.config.shim_bootloader == ShimBootloader.none else []),
+                *(
+                    ["--disable-shim-lock"]
+                    if context.config.shim_bootloader == ShimBootloader.none
+                    and grub_supports_disable_shim_lock(context, mkimage)
+                    else []
+                ),
                 "cat",
                 "cmp",
                 "div",

From 4f504e8cbacff5119458ff7d5da7c39e3f914081 Mon Sep 17 00:00:00 2001
From: Xynnn007 <xynnn@linux.alibaba.com>
Date: Thu, 3 Sep 2026 16:36:33 +0800
Subject: [PATCH 4/6] grub: create missing grubenv targets for RHEL-family ESP
 layouts

RHEL-family grub2-efi packages ship /boot/grub2/grubenv as a symlink to a
%ghost file under /boot/efi/EFI/<vendor>/grubenv. When that target is
absent, systemd-repart CopyFiles=/boot:/ fails while populating the ESP.
Create a minimal grubenv at the symlink target before installing grub.

Signed-off-by: Xynnn007 <xynnn@linux.alibaba.com>
---
 mkosi/bootloader.py | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/mkosi/bootloader.py b/mkosi/bootloader.py
index b210d8625e..aab1ca841b 100644
--- a/mkosi/bootloader.py
+++ b/mkosi/bootloader.py
@@ -197,7 +197,27 @@ def grub_supports_disable_shim_lock(context: Context, mkimage: Path) -> bool:
     )
 
 
+def ensure_grubenv(context: Context) -> None:
+    # RHEL-family grub2-efi packages ship /boot/grub2/grubenv as a symlink to a
+    # %ghost file under /boot/efi/EFI/<vendor>/grubenv. Create the target so
+    # systemd-repart CopyFiles=/boot:/ does not fail when populating the ESP.
+    link = context.root / "boot/grub2/grubenv"
+    if not link.is_symlink() or link.exists():
+        return
+
+    target = (link.parent / link.readlink()).resolve(strict=False)
+    with umask(~0o700):
+        target.parent.mkdir(parents=True, exist_ok=True)
+
+    # GRUB environment blocks are exactly 1024 bytes.
+    header = b"# GRUB Environment Block\n"
+    with umask(~0o600):
+        target.write_bytes(header + b"#" * (1024 - len(header)))
+
+
 def prepare_grub_config(context: Context) -> Optional[Path]:
+    ensure_grubenv(context)
+
     config = context.root / "efi" / context.config.distribution.installer.grub_prefix() / "grub.cfg"
     with umask(~0o700):
         config.parent.mkdir(exist_ok=True)
@@ -382,6 +402,8 @@ def install_grub(context: Context) -> None:
     if not want_grub_bios(context) and not want_grub_efi(context):
         return
 
+    ensure_grubenv(context)
+
     if want_grub_bios(context):
         grub_mkimage(context, target="i386-pc", modules=("biosdisk",))
 

From 1e0df5218a9442f256d99498864f95be6f4c1818 Mon Sep 17 00:00:00 2001
From: Xynnn007 <xynnn@linux.alibaba.com>
Date: Thu, 3 Sep 2026 16:48:46 +0800
Subject: [PATCH 5/6] Add Alibaba Cloud Linux 3 distribution support

Add alinux as a CentOS-variant installer for release 3, with Aliyun
mirrors, EPEL 8 sibling layout, SHA1 rpm-sequoia policy for the vendor
key, and a grubby stub around kernel package installation so dnf5 does
not abort on failing %posttrans scriptlets. Document the distribution
and cover repository/GPG helpers with unit tests.

Signed-off-by: Xynnn007 <xynnn@linux.alibaba.com>
Signed-off-by: qianyue.zj <qianyue.zj@alibaba-inc.com>
---
 mkosi.conf.d/alinux.conf       |  17 +++
 mkosi/distribution/__init__.py |   3 +
 mkosi/distribution/alinux.py   | 195 +++++++++++++++++++++++++++++++++
 mkosi/installer/rpm.py         |  10 +-
 mkosi/resources/man/mkosi.1.md |   7 +-
 tests/test_alinux.py           | 119 ++++++++++++++++++++
 6 files changed, 347 insertions(+), 4 deletions(-)
 create mode 100644 mkosi.conf.d/alinux.conf
 create mode 100644 mkosi/distribution/alinux.py
 create mode 100644 tests/test_alinux.py

diff --git a/mkosi.conf.d/alinux.conf b/mkosi.conf.d/alinux.conf
new file mode 100644
index 0000000000..f964e47003
--- /dev/null
+++ b/mkosi.conf.d/alinux.conf
@@ -0,0 +1,17 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Match]
+Distribution=alinux
+
+[Distribution]
+Release=3
+Repositories=epel
+
+[Content]
+# Alibaba Cloud Linux 3 (systemd 239) does not ship systemd-boot or an unsigned shim.
+Bootloader=grub
+ShimBootloader=none
+
+[Runtime]
+# Unsigned grub cannot start under the default secure-boot OVMF firmware.
+Firmware=uefi
diff --git a/mkosi/distribution/__init__.py b/mkosi/distribution/__init__.py
index e5f9848a14..c78d84cb1f 100644
--- a/mkosi/distribution/__init__.py
+++ b/mkosi/distribution/__init__.py
@@ -41,6 +41,7 @@ class Distribution(StrEnum):
     openmandriva = enum.auto()
     rocky = enum.auto()
     alma = enum.auto()
+    alinux = enum.auto()
     azure = enum.auto()
     custom = enum.auto()
 
@@ -48,6 +49,7 @@ def is_centos_variant(self) -> bool:
         return self in (
             Distribution.centos,
             Distribution.alma,
+            Distribution.alinux,
             Distribution.rocky,
             Distribution.rhel,
             Distribution.rhel_ubi,
@@ -68,6 +70,7 @@ def is_rpm_distribution(self) -> bool:
             Distribution.openmandriva,
             Distribution.rocky,
             Distribution.alma,
+            Distribution.alinux,
         )
 
     @property
diff --git a/mkosi/distribution/alinux.py b/mkosi/distribution/alinux.py
new file mode 100644
index 0000000000..48a85e5d02
--- /dev/null
+++ b/mkosi/distribution/alinux.py
@@ -0,0 +1,195 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+from collections.abc import Iterable, Sequence
+from pathlib import Path
+
+from mkosi.config import Architecture
+from mkosi.context import Context
+from mkosi.distribution import Distribution, centos, join_mirror
+from mkosi.installer.dnf import Dnf
+from mkosi.installer.rpm import RpmRepository, find_rpm_gpgkey, setup_rpm
+from mkosi.log import die
+from mkosi.versioncomp import GenericVersion
+
+
+def _is_kernel_rpm(package: str) -> bool:
+    return package == "kernel" or package.startswith("kernel-")
+
+
+class Installer(centos.Installer, distribution=Distribution.alinux):
+    @classmethod
+    def pretty_name(cls) -> str:
+        return "Alibaba Cloud Linux"
+
+    @classmethod
+    def default_release(cls) -> str:
+        return "3"
+
+    @classmethod
+    def setup(cls, context: Context) -> None:
+        if GenericVersion(cls.major_release(context.config)) != 3:
+            die(f"Only {cls.pretty_name()} 3 is currently supported")
+
+        setup_rpm(context, dbpath=cls.dbpath(context))
+        Dnf.setup(context, list(cls.repositories(context)))
+
+    @classmethod
+    def install(cls, context: Context) -> None:
+        cls.install_packages(context, ["filesystem", "alinux-release"], apivfs=False)
+
+        # alinux-release only ships /etc/os-release; mkosi expects /usr/lib/os-release.
+        etc_os_release = context.root / "etc/os-release"
+        usr_lib_os_release = context.root / "usr/lib/os-release"
+        if etc_os_release.exists() and not usr_lib_os_release.exists():
+            usr_lib_os_release.parent.mkdir(parents=True, exist_ok=True)
+            usr_lib_os_release.write_bytes(etc_os_release.read_bytes())
+
+    @classmethod
+    def install_packages(
+        cls,
+        context: Context,
+        packages: Sequence[str],
+        *,
+        apivfs: bool = True,
+        allow_downgrade: bool = False,
+    ) -> None:
+        kernels = [p for p in packages if _is_kernel_rpm(p)]
+        others = [p for p in packages if not _is_kernel_rpm(p)]
+
+        # Alinux kernel %posttrans runs `grubby --update-kernel` after kernel-install. Under an
+        # installroot there are no BLS entries for /boot/vmlinuz-*, so grubby exits 1 and newer
+        # dnf5/rpm abort the transaction. mkosi configures the bootloader itself later, so install
+        # grubby first, temporarily stub it out, install the kernel packages, then restore it.
+        if kernels:
+            if "grubby" not in others:
+                others = [*others, "grubby"]
+
+        if others:
+            super().install_packages(
+                context,
+                others,
+                apivfs=apivfs,
+                allow_downgrade=allow_downgrade,
+            )
+
+        if not kernels:
+            return
+
+        stubs = [
+            context.root / "usr/sbin/grubby",
+            context.root / "usr/libexec/grubby/grubby-bls",
+        ]
+        saved: dict[Path, bytes] = {}
+        for path in stubs:
+            if path.exists():
+                saved[path] = path.read_bytes()
+            path.parent.mkdir(parents=True, exist_ok=True)
+            path.write_text("#!/bin/sh\nexit 0\n")
+            path.chmod(0o755)
+
+        try:
+            super().install_packages(
+                context,
+                kernels,
+                apivfs=apivfs,
+                allow_downgrade=allow_downgrade,
+            )
+        finally:
+            for path, content in saved.items():
+                path.write_bytes(content)
+                path.chmod(0o755)
+
+    @classmethod
+    def architecture(cls, arch: Architecture) -> str:
+        a = {
+            Architecture.x86_64: "x86_64",
+            Architecture.arm64:  "aarch64",
+        }.get(arch)  # fmt: skip
+
+        if not a:
+            die(f"Architecture {arch} is not supported by {cls.pretty_name()}")
+
+        return a
+
+    @classmethod
+    def _default_mirror(cls) -> str:
+        return "https://mirrors.aliyun.com/alinux"
+
+    @classmethod
+    def _epel_mirror(cls, context: Context) -> str:
+        if epel := context.config.finalize_environment().get("EPEL_MIRROR"):
+            return epel
+
+        # Alinux mirrors keep EPEL as a sibling of the alinux tree (…/alinux → …/epel).
+        mirror = context.config.mirror or cls._default_mirror()
+        return join_mirror(mirror, "..").rstrip("/")
+
+    @classmethod
+    def gpgurls(cls, context: Context) -> tuple[str, ...]:
+        major = cls.major_release(context.config)
+        mirror = context.config.mirror or cls._default_mirror()
+        keyurl = join_mirror(mirror, f"{major}/RPM-GPG-KEY-ALINUX-{major}")
+
+        # Prefer a locally installed key. Do not fall back to RPM-GPG-KEY-ANOLIS from
+        # distribution-gpg-keys: that file contains multiple keys and dnf may import the
+        # Anolis OS key instead of the Alibaba Cloud Linux package-signing key.
+        key = find_rpm_gpgkey(context, f"RPM-GPG-KEY-ALINUX-{major}", required=False)
+        return (key or keyurl,)
+
+    @classmethod
+    def repository_variants(
+        cls,
+        context: Context,
+        gpgurls: tuple[str, ...],
+        repo: str,
+    ) -> list[RpmRepository]:
+        if context.config.snapshot:
+            die(f"Snapshot= is not supported for {cls.pretty_name()}")
+
+        relpath = f"$releasever/{repo.lower()}/$basearch"
+        mirror = context.config.mirror or cls._default_mirror()
+        url = f"baseurl={join_mirror(mirror, relpath)}"
+
+        return [RpmRepository(repo, url, gpgurls, repo_gpgcheck=False)]
+
+    @classmethod
+    def repositories(cls, context: Context) -> Iterable[RpmRepository]:
+        if context.config.local_mirror:
+            gpgurls = cls.gpgurls(context)
+            yield RpmRepository(
+                "local",
+                f"baseurl={context.config.local_mirror}",
+                gpgurls,
+                repo_gpgcheck=False,
+            )
+            return
+
+        gpgurls = cls.gpgurls(context)
+
+        yield from cls.repository_variants(context, gpgurls, "os")
+        yield from cls.repository_variants(context, gpgurls, "updates")
+        yield from cls.repository_variants(context, gpgurls, "plus")
+        yield from cls.repository_variants(context, gpgurls, "module")
+        yield from cls.repository_variants(context, gpgurls, "powertools")
+
+        epel_mirror = cls._epel_mirror(context)
+        epel_gpgurls = (
+            find_rpm_gpgkey(
+                context,
+                "RPM-GPG-KEY-EPEL-8",
+                join_mirror(epel_mirror, "epel/RPM-GPG-KEY-EPEL-8"),
+            ),
+        )
+        yield RpmRepository(
+            "epel",
+            f"baseurl={join_mirror(epel_mirror, 'epel/8/Everything/$basearch')}",
+            epel_gpgurls,
+            enabled=False,
+            repo_gpgcheck=False,
+        )
+
+        yield from cls.sig_repositories(context)
+
+    @classmethod
+    def sig_repositories(cls, context: Context) -> list[RpmRepository]:
+        return []
diff --git a/mkosi/installer/rpm.py b/mkosi/installer/rpm.py
index 65ab762d90..c8bba67d9b 100644
--- a/mkosi/installer/rpm.py
+++ b/mkosi/installer/rpm.py
@@ -100,12 +100,16 @@ def setup_rpm(
     if not (confdir / "macros.pkgverify_level").exists():
         (confdir / "macros.pkgverify_level").write_text("%_pkgverify_level digest")
 
-    if context.config.distribution == Distribution.opensuse or (
-        context.config.distribution.is_centos_variant() and context.config.release == "9"
+    if (
+        context.config.distribution == Distribution.opensuse
+        or context.config.distribution == Distribution.alinux
+        or (context.config.distribution.is_centos_variant() and context.config.release == "9")
     ):
         # Write an rpm sequoia policy that makes sure "sha1.second_preimage_resistance = always" is
         # configured and makes sure that a minimal config is in place to make sure builds succeed.
-        # TODO: Remove when distributions GPG keys are accepted by the default rpm-sequoia config everywhere.
+        # Needed for Alibaba Cloud Linux 3 keys that still use SHA1 binding signatures.
+        # TODO: Remove when distribution GPG keys are accepted by the default
+        # rpm-sequoia config everywhere.
 
         p = context.sandbox_tree / "etc/crypto-policies/back-ends/rpm-sequoia.config"
         p.parent.mkdir(parents=True, exist_ok=True)
diff --git a/mkosi/resources/man/mkosi.1.md b/mkosi/resources/man/mkosi.1.md
index 5371039c2a..bfe17d359f 100644
--- a/mkosi/resources/man/mkosi.1.md
+++ b/mkosi/resources/man/mkosi.1.md
@@ -502,7 +502,7 @@ boolean argument: either `1`, `yes`, or `true` to enable, or `0`, `no`,
 `Distribution=`, `--distribution=`, `-d`
 :   The distribution to install in the image. Takes one of the following
     arguments: `fedora`, `debian`, `kali`, `ubuntu`, `arch`, `opensuse`,
-    `mageia`, `centos`, `rhel`, `rhel-ubi`, `openmandriva`, `rocky`, `alma`,
+    `mageia`, `centos`, `rhel`, `rhel-ubi`, `openmandriva`, `rocky`, `alma`, `alinux`,
     `azure` or `custom`. If not specified, defaults to the distribution of
     the host or `custom` if the distribution of the host is not a supported
     distribution.
@@ -546,6 +546,7 @@ boolean argument: either `1`, `yes`, or `true` to enable, or `0`, `no`,
     | `centos`       | https://mirrors.centos.org         |                                |
     | `rocky`        | https://mirrors.rockylinux.org     |                                |
     | `alma`         | https://mirrors.almalinux.org      |                                |
+    | `alinux`       | https://mirrors.aliyun.com/alinux  |                                |
     | `fedora`       | https://mirrors.fedoraproject.org  |                                |
     | `rhel-ubi`     | https://cdn-ubi.redhat.com         |                                |
     | `mageia`       | https://www.mageia.org             |                                |
@@ -3262,6 +3263,10 @@ repository.
   the parent directory of the mirror specified in `Mirror=`. For example
   if the mirror is set to `https://mirror.net/centos-stream` **mkosi** will
   look for the epel repositories in `https://mirror.net/fedora/epel`.
+  For Alibaba Cloud Linux, **mkosi** instead looks for the epel repositories
+  directly in the parent directory of `Mirror=` (for example
+  `https://mirrors.aliyun.com/alinux` → `https://mirrors.aliyun.com/epel`),
+  matching the usual layout of Aliyun mirrors.
 
 * `SYSEXT_SCOPE` and `CONFEXT_SCOPE` can be used to override the default
   value of the respective `extension-release` file when building a sysext
diff --git a/tests/test_alinux.py b/tests/test_alinux.py
new file mode 100644
index 0000000000..339c459dee
--- /dev/null
+++ b/tests/test_alinux.py
@@ -0,0 +1,119 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+from typing import Optional
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+from mkosi.config import Architecture
+from mkosi.distribution.alinux import Installer
+
+
+def _context(
+    release: str = "3",
+    *,
+    mirror: Optional[str] = None,
+    local_mirror: Optional[str] = None,
+    epel_mirror: Optional[str] = None,
+) -> MagicMock:
+    context = MagicMock()
+    context.config.release = release
+    context.config.snapshot = None
+    context.config.mirror = mirror
+    context.config.local_mirror = local_mirror
+    env = {}
+    if epel_mirror is not None:
+        env["EPEL_MIRROR"] = epel_mirror
+    context.config.finalize_environment.return_value = env
+    return context
+
+
+def test_alinux_repository_urls() -> None:
+    context = _context()
+
+    repos = Installer.repository_variants(context, ("gpg",), "os")
+    assert repos[0].url == "baseurl=https://mirrors.aliyun.com/alinux/$releasever/os/$basearch"
+
+    repos = Installer.repository_variants(context, ("gpg",), "updates")
+    assert repos[0].url == "baseurl=https://mirrors.aliyun.com/alinux/$releasever/updates/$basearch"
+
+    context = _context(mirror="https://example.com/alinux")
+    repos = Installer.repository_variants(context, ("gpg",), "os")
+    assert repos[0].url == "baseurl=https://example.com/alinux/$releasever/os/$basearch"
+
+
+def test_alinux_repositories() -> None:
+    context = _context()
+
+    with patch("mkosi.distribution.alinux.find_rpm_gpgkey", side_effect=lambda *args, **kwargs: "gpg"):
+        repos = {repo.id: repo for repo in Installer.repositories(context)}
+
+    assert set(repos) == {"os", "updates", "plus", "module", "powertools", "epel"}
+    assert repos["os"].url == "baseurl=https://mirrors.aliyun.com/alinux/$releasever/os/$basearch"
+    assert not repos["os"].repo_gpgcheck
+    assert repos["epel"].url == "baseurl=https://mirrors.aliyun.com/epel/8/Everything/$basearch"
+    assert not repos["epel"].enabled
+    assert not repos["epel"].repo_gpgcheck
+
+
+def test_alinux_epel_follows_mirror() -> None:
+    context = _context(mirror="https://example.com/alinux")
+
+    with patch("mkosi.distribution.alinux.find_rpm_gpgkey", side_effect=lambda *args, **kwargs: "gpg"):
+        repos = {repo.id: repo for repo in Installer.repositories(context)}
+
+    assert repos["epel"].url == "baseurl=https://example.com/epel/8/Everything/$basearch"
+
+    context = _context(epel_mirror="https://epel.example.com")
+    with patch("mkosi.distribution.alinux.find_rpm_gpgkey", side_effect=lambda *args, **kwargs: "gpg"):
+        repos = {repo.id: repo for repo in Installer.repositories(context)}
+
+    assert repos["epel"].url == "baseurl=https://epel.example.com/epel/8/Everything/$basearch"
+
+
+def test_alinux_local_mirror() -> None:
+    context = _context(local_mirror="https://example.com/local")
+
+    with patch("mkosi.distribution.alinux.find_rpm_gpgkey", side_effect=lambda *args, **kwargs: "gpg"):
+        repos = list(Installer.repositories(context))
+
+    assert len(repos) == 1
+    assert repos[0].id == "local"
+    assert repos[0].url == "baseurl=https://example.com/local"
+
+
+def test_alinux_unsupported_release() -> None:
+    context = _context("4")
+
+    with pytest.raises(SystemExit):
+        Installer.setup(context)
+
+
+def test_alinux_snapshot_unsupported() -> None:
+    context = _context()
+    context.config.snapshot = "20240101"
+
+    with pytest.raises(SystemExit):
+        Installer.repository_variants(context, ("gpg",), "os")
+
+
+def test_alinux_architecture() -> None:
+    assert Installer.architecture(Architecture.x86_64) == "x86_64"
+    assert Installer.architecture(Architecture.arm64) == "aarch64"
+
+    with pytest.raises(SystemExit):
+        Installer.architecture(Architecture.s390x)
+
+
+def test_alinux_gpgurls_remote_fallback() -> None:
+    context = _context()
+
+    with patch("mkosi.distribution.alinux.find_rpm_gpgkey", return_value=None):
+        assert Installer.gpgurls(context) == ("https://mirrors.aliyun.com/alinux/3/RPM-GPG-KEY-ALINUX-3",)
+
+    context = _context(mirror="https://example.com/alinux")
+    with patch("mkosi.distribution.alinux.find_rpm_gpgkey", return_value=None):
+        assert Installer.gpgurls(context) == ("https://example.com/alinux/3/RPM-GPG-KEY-ALINUX-3",)
+
+    with patch("mkosi.distribution.alinux.find_rpm_gpgkey", return_value="file:///local.key"):
+        assert Installer.gpgurls(context) == ("file:///local.key",)

From abaef456eb3988b33a9a39438496f80f6d1e2101 Mon Sep 17 00:00:00 2001
From: Xynnn007 <xynnn@linux.alibaba.com>
Date: Thu, 3 Sep 2026 16:53:45 +0800
Subject: [PATCH 6/6] Wire alinux into tools, initrd and vm package sets

Include alinux in the shared CentOS-family Match groups, and split out
packages missing on Alibaba Cloud Linux 3 / EPEL 8 (btrfs-progs, gh,
virtiofsd, systemd-ukify, systemd-resolved, systemd-boot, wireless-regdb)
so other distributions keep the same package sets.

Signed-off-by: Xynnn007 <xynnn@linux.alibaba.com>
---
 mkosi.conf                                          |  1 -
 mkosi.conf.d/azure-centos-fedora/mkosi.conf         |  1 +
 mkosi.conf.d/wireless-regdb.conf                    |  9 +++++++++
 .../mkosi.conf.d/azure-centos-fedora.conf           |  1 +
 .../mkosi-initrd/mkosi.conf.d/centos/mkosi.conf     |  1 +
 .../mkosi.conf.d/centos/mkosi.conf.d/epel.conf      |  2 ++
 .../mkosi.conf.d/azure-centos-fedora/mkosi.conf     |  2 +-
 .../mkosi.conf.d/systemd-ukify.conf                 |  9 +++++++++
 .../mkosi-tools/mkosi.conf.d/centos/mkosi.conf      |  1 +
 .../centos/mkosi.conf.d/epel-btrfs-progs.conf       | 10 ++++++++++
 .../mkosi.conf.d/centos/mkosi.conf.d/epel.conf      |  1 -
 .../debug/mkosi.conf.d/centos-fedora.conf           |  1 +
 .../misc/mkosi.conf.d/azure-centos-fedora-gh.conf   | 13 +++++++++++++
 .../misc/mkosi.conf.d/azure-centos-fedora.conf      |  2 +-
 .../mkosi.conf.d/alinux-epel-packages.conf          | 11 +++++++++++
 .../mkosi.conf.d/azure-centos-fedora/mkosi.conf     |  2 +-
 .../azure-centos-fedora/mkosi.conf.d/virtiofsd.conf |  9 +++++++++
 .../mkosi.conf.d/azure-centos-fedora/mkosi.conf     |  2 +-
 .../mkosi.conf.d/systemd-resolved.conf              |  9 +++++++++
 .../azure-centos-fedora/mkosi.conf.d/uefi.conf      |  2 ++
 20 files changed, 83 insertions(+), 6 deletions(-)
 create mode 100644 mkosi.conf.d/wireless-regdb.conf
 create mode 100644 mkosi/resources/mkosi-tools/mkosi.conf.d/azure-centos-fedora/mkosi.conf.d/systemd-ukify.conf
 create mode 100644 mkosi/resources/mkosi-tools/mkosi.conf.d/centos/mkosi.conf.d/epel-btrfs-progs.conf
 create mode 100644 mkosi/resources/mkosi-tools/mkosi.profiles/misc/mkosi.conf.d/azure-centos-fedora-gh.conf
 create mode 100644 mkosi/resources/mkosi-tools/mkosi.profiles/package-manager/mkosi.conf.d/alinux-epel-packages.conf
 create mode 100644 mkosi/resources/mkosi-tools/mkosi.profiles/runtime/mkosi.conf.d/azure-centos-fedora/mkosi.conf.d/virtiofsd.conf
 create mode 100644 mkosi/resources/mkosi-vm/mkosi.conf.d/azure-centos-fedora/mkosi.conf.d/systemd-resolved.conf

diff --git a/mkosi.conf b/mkosi.conf
index a165cb8f3e..115795b79d 100644
--- a/mkosi.conf
+++ b/mkosi.conf
@@ -25,7 +25,6 @@ ShimBootloader=unsigned
 Packages=
         binutils
         gdb
-        wireless-regdb
 
 InitrdProfiles=lvm
 
diff --git a/mkosi.conf.d/azure-centos-fedora/mkosi.conf b/mkosi.conf.d/azure-centos-fedora/mkosi.conf
index afba426c86..4b45332dd5 100644
--- a/mkosi.conf.d/azure-centos-fedora/mkosi.conf
+++ b/mkosi.conf.d/azure-centos-fedora/mkosi.conf
@@ -3,6 +3,7 @@
 [Match]
 Distribution=|centos
 Distribution=|alma
+Distribution=|alinux
 Distribution=|rocky
 Distribution=|fedora
 Distribution=|azure
diff --git a/mkosi.conf.d/wireless-regdb.conf b/mkosi.conf.d/wireless-regdb.conf
new file mode 100644
index 0000000000..9fb9bfd96b
--- /dev/null
+++ b/mkosi.conf.d/wireless-regdb.conf
@@ -0,0 +1,9 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Match]
+# Alibaba Cloud Linux 3 / EPEL 8 do not ship wireless-regdb.
+Distribution=!alinux
+
+[Content]
+Packages=
+        wireless-regdb
diff --git a/mkosi/resources/mkosi-initrd/mkosi.conf.d/azure-centos-fedora.conf b/mkosi/resources/mkosi-initrd/mkosi.conf.d/azure-centos-fedora.conf
index d9104bf4d4..0f09309585 100644
--- a/mkosi/resources/mkosi-initrd/mkosi.conf.d/azure-centos-fedora.conf
+++ b/mkosi/resources/mkosi-initrd/mkosi.conf.d/azure-centos-fedora.conf
@@ -4,6 +4,7 @@
 Distribution=|fedora
 Distribution=|centos
 Distribution=|alma
+Distribution=|alinux
 Distribution=|rocky
 Distribution=|rhel
 Distribution=|azure
diff --git a/mkosi/resources/mkosi-initrd/mkosi.conf.d/centos/mkosi.conf b/mkosi/resources/mkosi-initrd/mkosi.conf.d/centos/mkosi.conf
index 5b25c7e41a..2c5a61c2db 100644
--- a/mkosi/resources/mkosi-initrd/mkosi.conf.d/centos/mkosi.conf
+++ b/mkosi/resources/mkosi-initrd/mkosi.conf.d/centos/mkosi.conf
@@ -3,6 +3,7 @@
 [Match]
 Distribution=|centos
 Distribution=|alma
+Distribution=|alinux
 Distribution=|rocky
 Distribution=|rhel
 
diff --git a/mkosi/resources/mkosi-initrd/mkosi.conf.d/centos/mkosi.conf.d/epel.conf b/mkosi/resources/mkosi-initrd/mkosi.conf.d/centos/mkosi.conf.d/epel.conf
index 1f73a64e99..c449b90486 100644
--- a/mkosi/resources/mkosi-initrd/mkosi.conf.d/centos/mkosi.conf.d/epel.conf
+++ b/mkosi/resources/mkosi-initrd/mkosi.conf.d/centos/mkosi.conf.d/epel.conf
@@ -2,6 +2,8 @@
 
 [Match]
 Repositories=epel
+# EPEL 8 (used by Alibaba Cloud Linux 3) does not ship btrfs-progs.
+Distribution=!alinux
 
 [Content]
 Packages=
diff --git a/mkosi/resources/mkosi-tools/mkosi.conf.d/azure-centos-fedora/mkosi.conf b/mkosi/resources/mkosi-tools/mkosi.conf.d/azure-centos-fedora/mkosi.conf
index 3f0ea2a56a..5f423b961a 100644
--- a/mkosi/resources/mkosi-tools/mkosi.conf.d/azure-centos-fedora/mkosi.conf
+++ b/mkosi/resources/mkosi-tools/mkosi.conf.d/azure-centos-fedora/mkosi.conf
@@ -3,6 +3,7 @@
 [Match]
 Distribution=|centos
 Distribution=|alma
+Distribution=|alinux
 Distribution=|rocky
 Distribution=|rhel
 Distribution=|fedora
@@ -19,5 +20,4 @@ Packages=
         qemu-img
         squashfs-tools
         systemd-udev
-        systemd-ukify
         xz
diff --git a/mkosi/resources/mkosi-tools/mkosi.conf.d/azure-centos-fedora/mkosi.conf.d/systemd-ukify.conf b/mkosi/resources/mkosi-tools/mkosi.conf.d/azure-centos-fedora/mkosi.conf.d/systemd-ukify.conf
new file mode 100644
index 0000000000..8a55be1659
--- /dev/null
+++ b/mkosi/resources/mkosi-tools/mkosi.conf.d/azure-centos-fedora/mkosi.conf.d/systemd-ukify.conf
@@ -0,0 +1,9 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Match]
+# Alibaba Cloud Linux 3 ships systemd 239 without a systemd-ukify package.
+Distribution=!alinux
+
+[Content]
+Packages=
+        systemd-ukify
diff --git a/mkosi/resources/mkosi-tools/mkosi.conf.d/centos/mkosi.conf b/mkosi/resources/mkosi-tools/mkosi.conf.d/centos/mkosi.conf
index 47a5551a38..c2b6634ca8 100644
--- a/mkosi/resources/mkosi-tools/mkosi.conf.d/centos/mkosi.conf
+++ b/mkosi/resources/mkosi-tools/mkosi.conf.d/centos/mkosi.conf
@@ -3,6 +3,7 @@
 [Match]
 Distribution=|centos
 Distribution=|alma
+Distribution=|alinux
 Distribution=|rocky
 Distribution=|rhel
 
diff --git a/mkosi/resources/mkosi-tools/mkosi.conf.d/centos/mkosi.conf.d/epel-btrfs-progs.conf b/mkosi/resources/mkosi-tools/mkosi.conf.d/centos/mkosi.conf.d/epel-btrfs-progs.conf
new file mode 100644
index 0000000000..c449b90486
--- /dev/null
+++ b/mkosi/resources/mkosi-tools/mkosi.conf.d/centos/mkosi.conf.d/epel-btrfs-progs.conf
@@ -0,0 +1,10 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Match]
+Repositories=epel
+# EPEL 8 (used by Alibaba Cloud Linux 3) does not ship btrfs-progs.
+Distribution=!alinux
+
+[Content]
+Packages=
+        btrfs-progs
diff --git a/mkosi/resources/mkosi-tools/mkosi.conf.d/centos/mkosi.conf.d/epel.conf b/mkosi/resources/mkosi-tools/mkosi.conf.d/centos/mkosi.conf.d/epel.conf
index af653f6c20..6b0d0c7c51 100644
--- a/mkosi/resources/mkosi-tools/mkosi.conf.d/centos/mkosi.conf.d/epel.conf
+++ b/mkosi/resources/mkosi-tools/mkosi.conf.d/centos/mkosi.conf.d/epel.conf
@@ -5,5 +5,4 @@ Repositories=epel
 
 [Content]
 Packages=
-        btrfs-progs
         distribution-gpg-keys
diff --git a/mkosi/resources/mkosi-tools/mkosi.profiles/debug/mkosi.conf.d/centos-fedora.conf b/mkosi/resources/mkosi-tools/mkosi.profiles/debug/mkosi.conf.d/centos-fedora.conf
index 4d9b891a0b..8ac65a37e3 100644
--- a/mkosi/resources/mkosi-tools/mkosi.profiles/debug/mkosi.conf.d/centos-fedora.conf
+++ b/mkosi/resources/mkosi-tools/mkosi.profiles/debug/mkosi.conf.d/centos-fedora.conf
@@ -3,6 +3,7 @@
 [Match]
 Distribution=|centos
 Distribution=|alma
+Distribution=|alinux
 Distribution=|rocky
 Distribution=|rhel
 Distribution=|fedora
diff --git a/mkosi/resources/mkosi-tools/mkosi.profiles/misc/mkosi.conf.d/azure-centos-fedora-gh.conf b/mkosi/resources/mkosi-tools/mkosi.profiles/misc/mkosi.conf.d/azure-centos-fedora-gh.conf
new file mode 100644
index 0000000000..ad64b05c4f
--- /dev/null
+++ b/mkosi/resources/mkosi-tools/mkosi.profiles/misc/mkosi.conf.d/azure-centos-fedora-gh.conf
@@ -0,0 +1,13 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Match]
+Distribution=|centos
+Distribution=|alma
+Distribution=|rocky
+Distribution=|rhel
+Distribution=|fedora
+Distribution=|azure
+
+[Content]
+Packages=
+        gh
diff --git a/mkosi/resources/mkosi-tools/mkosi.profiles/misc/mkosi.conf.d/azure-centos-fedora.conf b/mkosi/resources/mkosi-tools/mkosi.profiles/misc/mkosi.conf.d/azure-centos-fedora.conf
index 4a14a46881..1a196d9d46 100644
--- a/mkosi/resources/mkosi-tools/mkosi.profiles/misc/mkosi.conf.d/azure-centos-fedora.conf
+++ b/mkosi/resources/mkosi-tools/mkosi.profiles/misc/mkosi.conf.d/azure-centos-fedora.conf
@@ -3,6 +3,7 @@
 [Match]
 Distribution=|centos
 Distribution=|alma
+Distribution=|alinux
 Distribution=|rocky
 Distribution=|rhel
 Distribution=|fedora
@@ -10,7 +11,6 @@ Distribution=|azure
 
 [Content]
 Packages=
-        gh
         git-core
         man
         man-pages
diff --git a/mkosi/resources/mkosi-tools/mkosi.profiles/package-manager/mkosi.conf.d/alinux-epel-packages.conf b/mkosi/resources/mkosi-tools/mkosi.profiles/package-manager/mkosi.conf.d/alinux-epel-packages.conf
new file mode 100644
index 0000000000..f75b300779
--- /dev/null
+++ b/mkosi/resources/mkosi-tools/mkosi.profiles/package-manager/mkosi.conf.d/alinux-epel-packages.conf
@@ -0,0 +1,11 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Match]
+Distribution=alinux
+Repositories=epel
+Release=3
+
+[Content]
+# EPEL 8 does not ship apt/pacman/keyring packages available on newer EPEL releases.
+Packages=
+        distribution-gpg-keys
diff --git a/mkosi/resources/mkosi-tools/mkosi.profiles/runtime/mkosi.conf.d/azure-centos-fedora/mkosi.conf b/mkosi/resources/mkosi-tools/mkosi.profiles/runtime/mkosi.conf.d/azure-centos-fedora/mkosi.conf
index c5d915791e..007c8cc273 100644
--- a/mkosi/resources/mkosi-tools/mkosi.profiles/runtime/mkosi.conf.d/azure-centos-fedora/mkosi.conf
+++ b/mkosi/resources/mkosi-tools/mkosi.profiles/runtime/mkosi.conf.d/azure-centos-fedora/mkosi.conf
@@ -3,6 +3,7 @@
 [Match]
 Distribution=|centos
 Distribution=|alma
+Distribution=|alinux
 Distribution=|rocky
 Distribution=|rhel
 Distribution=|fedora
@@ -16,4 +17,3 @@ Packages=
         systemd-container
         systemd-journal-remote
         virt-firmware
-        virtiofsd
diff --git a/mkosi/resources/mkosi-tools/mkosi.profiles/runtime/mkosi.conf.d/azure-centos-fedora/mkosi.conf.d/virtiofsd.conf b/mkosi/resources/mkosi-tools/mkosi.profiles/runtime/mkosi.conf.d/azure-centos-fedora/mkosi.conf.d/virtiofsd.conf
new file mode 100644
index 0000000000..16a43512e5
--- /dev/null
+++ b/mkosi/resources/mkosi-tools/mkosi.profiles/runtime/mkosi.conf.d/azure-centos-fedora/mkosi.conf.d/virtiofsd.conf
@@ -0,0 +1,9 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Match]
+# Alibaba Cloud Linux 3 / EPEL 8 does not ship a standalone virtiofsd package.
+Distribution=!alinux
+
+[Content]
+Packages=
+        virtiofsd
diff --git a/mkosi/resources/mkosi-vm/mkosi.conf.d/azure-centos-fedora/mkosi.conf b/mkosi/resources/mkosi-vm/mkosi.conf.d/azure-centos-fedora/mkosi.conf
index e3e5d89f70..b768605cd3 100644
--- a/mkosi/resources/mkosi-vm/mkosi.conf.d/azure-centos-fedora/mkosi.conf
+++ b/mkosi/resources/mkosi-vm/mkosi.conf.d/azure-centos-fedora/mkosi.conf
@@ -2,6 +2,7 @@
 
 [Match]
 Distribution=|alma
+Distribution=|alinux
 Distribution=|rocky
 Distribution=|centos
 Distribution=|fedora
@@ -13,6 +14,5 @@ Packages=
         iputils
         kernel
         polkit
-        systemd-resolved
         tpm2-tss
         util-linux
diff --git a/mkosi/resources/mkosi-vm/mkosi.conf.d/azure-centos-fedora/mkosi.conf.d/systemd-resolved.conf b/mkosi/resources/mkosi-vm/mkosi.conf.d/azure-centos-fedora/mkosi.conf.d/systemd-resolved.conf
new file mode 100644
index 0000000000..ae41a61aba
--- /dev/null
+++ b/mkosi/resources/mkosi-vm/mkosi.conf.d/azure-centos-fedora/mkosi.conf.d/systemd-resolved.conf
@@ -0,0 +1,9 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Match]
+# Alibaba Cloud Linux 3 does not ship a separate systemd-resolved package.
+Distribution=!alinux
+
+[Content]
+Packages=
+        systemd-resolved
diff --git a/mkosi/resources/mkosi-vm/mkosi.conf.d/azure-centos-fedora/mkosi.conf.d/uefi.conf b/mkosi/resources/mkosi-vm/mkosi.conf.d/azure-centos-fedora/mkosi.conf.d/uefi.conf
index 9299df0ed9..713b6c11cd 100644
--- a/mkosi/resources/mkosi-vm/mkosi.conf.d/azure-centos-fedora/mkosi.conf.d/uefi.conf
+++ b/mkosi/resources/mkosi-vm/mkosi.conf.d/azure-centos-fedora/mkosi.conf.d/uefi.conf
@@ -2,6 +2,8 @@
 
 [Match]
 Architecture=uefi
+# Alibaba Cloud Linux 3 does not ship systemd-boot.
+Distribution=!alinux
 
 [Content]
 Packages=