diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..e520fca
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1 @@
+postgresql/postgresql-15.6-openeuler-llvmjit-buildrequires.patch whitespace=-blank-at-eol
diff --git a/MockBuildUtils.pm b/MockBuildUtils.pm
index aa9065b..7b09013 100644
--- a/MockBuildUtils.pm
+++ b/MockBuildUtils.pm
@@ -21,6 +21,7 @@ our @EXPORT_OK = qw(
     rpm_version rpm_release rpm_sigmd5 rpm_is_signed restamp_release_line
     cross_copy_genesis finalize_xcat_dep bump_dep_release_suffix
     build_mock_uniqueext
+    openeuler_build_target openeuler_repo_subdir
 );
 
 # install_deps_packages($os_id): the host packages mockbuild-all.pl needs to run at all, for the
@@ -30,6 +31,7 @@ our @EXPORT_OK = qw(
 sub install_deps_packages {
     my ($os_id) = @_;
     $os_id = '' unless defined $os_id;
+    return (install_deps_packages(''), '/usr/bin/systemd-nspawn') if lc($os_id) eq 'openeuler';
     # The perl modules are what actually break a run; the rest is the toolchain the script drives.
     return qw(perl perl-File-Slurper perl-IPC-Cmd perl-Parallel-ForkManager perl-Digest-SHA
               mock createrepo_c tar findutils rpm rpm-build rpm-sign rpmdevtools gnupg2 wget git)
@@ -46,9 +48,31 @@ sub install_deps_command {
     my @pkgs = install_deps_packages($os_id);
     return ('zypper', '--non-interactive', 'install', '--no-recommends', @pkgs)
         if $os_id =~ /^(?:opensuse|sles|sled)/;
+    return ('dnf', '--setopt=gpgcheck=1', '--setopt=*.gpgcheck=1', '--setopt=strict=1', '--setopt=install_weak_deps=False', '-y', 'install', @pkgs)
+        if lc($os_id) eq 'openeuler';
     return ('dnf', '-y', 'install', @pkgs);
 }
 
+sub openeuler_build_target {
+    my ($os, $arch) = @_;
+    return undef unless lc($os->{ID} // '') eq 'openeuler';
+    my $version = $os->{VERSION} || $os->{VERSION_ID} || '';
+    if ($version =~ /\A(20|22|24)\.03\s+\(LTS(?:-SP([1-9][0-9]*))?\)\z/) {
+        $version = "$1.03" . (defined($2) ? "sp$2" : '');
+    }
+    my $target = "openeuler-$version-$arch";
+    openeuler_repo_subdir($target);
+    return $target;
+}
+
+sub openeuler_repo_subdir {
+    my ($target) = @_;
+    return undef unless defined($target) && $target =~ /\Aopeneuler-/;
+    die "Unsupported openEuler build target '$target'\n"
+        unless $target =~ /\Aopeneuler-((?:20|22|24)\.03(?:sp[1-9][0-9]*)?)-(x86_64|ppc64le)\z/;
+    return "openeuler$1/$2";
+}
+
 # missing_perl_modules(@modules): those that cannot be loaded, in order. The point of --install-deps
 # is that the run AFTER it cannot die on a missing module, so the modules are proven by loading
 # them, not by trusting the package manager's exit code.
diff --git a/goconserver/mockbuild.pl b/goconserver/mockbuild.pl
index 15195c1..6acc658 100755
--- a/goconserver/mockbuild.pl
+++ b/goconserver/mockbuild.pl
@@ -7,6 +7,11 @@ use File::Basename qw(dirname basename);
 use File::Copy qw(copy);
 use File::Path qw(make_path remove_tree);
 use Getopt::Long qw(GetOptions);
+use POSIX qw(strftime);
+use FindBin;
+use lib "$FindBin::Bin/..", "$FindBin::Bin/../lib";
+use MockBuildUtils qw(openeuler_build_target openeuler_repo_subdir);
+use XCAT::BuildUtils qw(digest_file read_lines);
 
 my $script_dir = abs_path(dirname(__FILE__));
 my $repo_root  = abs_path("$script_dir/..");
@@ -46,11 +51,18 @@ die "Run as root (current uid=$>)\n" if $> != 0;
 my $arch = capture('uname -m');
 if (!$mock_cfg) {
     my $os_id = capture(q{bash -lc 'source /etc/os-release; echo $ID'});
-    $mock_cfg = resolve_mock_cfg($os_id, '10', $arch);
+    if (lc($os_id) eq 'openeuler') {
+        my $os_version = capture(q{bash -lc 'source /etc/os-release; echo "$VERSION"'});
+        $mock_cfg = openeuler_build_target({ ID => $os_id, VERSION => $os_version }, $arch);
+    } else {
+        $mock_cfg = resolve_mock_cfg($os_id, '10', $arch);
+    }
 }
 
+my $native_repo = openeuler_repo_subdir($mock_cfg);
 my ($rel) = $mock_cfg =~ /-(\d+)-/;
 $rel //= '10';
+my $dist_suffix = defined($native_repo) ? '' : ".el$rel";
 
 # --target-arch names the arch of the rpm to produce. It differs from the host arch only for a
 # forcearch target (rocky-10-riscv64-xcat on an x86_64 host; see BUILD.md "riscv64").
@@ -58,12 +70,17 @@ $target_arch = $arch if $target_arch eq '';
 my %goarch = (x86_64 => 'amd64', aarch64 => 'arm64', ppc64le => 'ppc64le', s390x => 's390x', riscv64 => 'riscv64');
 my $cross = $target_arch ne $arch;
 die "No GOARCH known for target arch $target_arch\n" if $cross && !exists $goarch{$target_arch};
+if (defined($native_repo)) {
+    my ($native_arch) = $native_repo =~ m{/([^/]+)$};
+    die "openEuler goconserver requires a native $native_arch builder\n"
+      if $cross || $arch ne $native_arch;
+}
 
 # For the host arch the Go compile happens INSIDE the mock chroot (BuildRequires: golang), so the
 # host only fetches the pinned source and drives mock. A forcearch chroot would run that compile
 # under qemu, so the cross build instead cross-compiles on the host and packages the result with
 # rpmbuild --target.
-for my $bin (qw(git rpm), ($cross ? qw(go rpmbuild) : qw(mock))) {
+for my $bin (qw(git rpm), (defined($native_repo) ? 'wget' : ()), ($cross ? qw(go rpmbuild) : qw(mock))) {
     run("command -v " . sh_quote($bin) . " >/dev/null 2>&1");
 }
 
@@ -83,13 +100,21 @@ unless ($SOURCE_DATE_EPOCH && $SOURCE_DATE_EPOCH =~ /^\d+$/) {
     chomp $SOURCE_DATE_EPOCH;
 }
 $SOURCE_DATE_EPOCH = time() unless $SOURCE_DATE_EPOCH =~ /^\d+$/;
+if (defined($native_repo)) {
+    my $native_epoch = defined($build_timestamp) ? $build_timestamp : $ENV{SOURCE_DATE_EPOCH};
+    if (defined($native_epoch)) {
+        die "Invalid native build timestamp: $native_epoch\n" unless $native_epoch =~ /\A\d+\z/;
+        $SOURCE_DATE_EPOCH = $native_epoch;
+    }
+}
 $ENV{SOURCE_DATE_EPOCH} = $SOURCE_DATE_EPOCH;
 
 # goconserver is a CGO-free static Go binary. el8/el9 chroots ship a Go too old to build 0.3.3, so
 # always COMPILE in the el10 chroot for this arch (regardless of the target EL), then ship the static
 # binary to every EL repo. The Release still carries the target's dist tag (4.el$rel) so each EL repo
 # gets a correctly-named, byte-identical rpm.
-(my $build_cfg = $mock_cfg) =~ s/-\d+-/-10-/;
+my $build_cfg = $mock_cfg;
+$build_cfg =~ s/-\d+-/-10-/ unless defined($native_repo);
 
 print_step("Configuration");
 print "repo_root:    $repo_root\n";
@@ -97,8 +122,8 @@ print "pkg_dir:      $pkg_dir\n";
 print "work_dir:     $work_dir\n";
 print "result_dir:   $result_dir\n";
 print "log_dir:      $log_dir\n";
-print "mock_cfg:     $mock_cfg (target dist tag: el$rel)\n";
-print "build_cfg:    $build_cfg (el10 -- portable static build for arch $arch)\n" if !$cross;
+print "mock_cfg:     $mock_cfg (target dist suffix: $dist_suffix)\n";
+print "build_cfg:    $build_cfg\n" if !$cross;
 print "arch:         $arch\n";
 print "target_arch:  $target_arch" . ($cross ? " (GOARCH=$goarch{$target_arch}, rpmbuild --target)" : '') . "\n";
 print "version:      $version\n";
@@ -121,6 +146,15 @@ run("git -C " . sh_quote($src_dir) . " remote add origin " . sh_quote($go_repo)
 run("git -C " . sh_quote($src_dir) . " fetch --depth 1 origin " . sh_quote($go_ref) . " >>$clone_log 2>&1");
 run("git -C " . sh_quote($src_dir) . " checkout -q FETCH_HEAD >>$clone_log 2>&1");
 
+my $go_ldflags = '-X main.Version=%{version}';
+if (defined($native_repo)) {
+    my $source_commit = capture("git -C " . sh_quote($src_dir) . " rev-parse --verify 'HEAD^{commit}'");
+    die "Cannot resolve fetched goconserver commit\n"
+      if $? != 0 || $source_commit !~ /\A[0-9a-f]{40}\z/;
+    my $build_time = strftime('%Y-%m-%dT%H:%M:%SZ', gmtime($SOURCE_DATE_EPOCH));
+    $go_ldflags .= " -X main.Commit=$source_commit -X main.BuildTime=$build_time";
+}
+
 # etcd storage backend has broken deps with modern Go modules; xCAT only uses file storage.
 unlink "$src_dir/storage/etcd.go";
 remove_tree("$src_dir/storage/etcd") if -d "$src_dir/storage/etcd";
@@ -190,6 +224,26 @@ run("tar --sort=name --owner=0 --group=0 --mtime=\@$SOURCE_DATE_EPOCH" .
 write_file("$sources_dir/goconserver.service", $service_unit);
 write_file("$sources_dir/server.conf", $server_conf);
 
+my ($go_source, $go_prep, $go_environment) = ('', '', '');
+my $native_changelog = '';
+my $go_requires = 'golang';
+if (defined($native_repo)) {
+    my $go_file = "go1.25.12.linux-$goarch{$arch}.tar.gz";
+    my %checksums = map { my ($hash, $name) = split /\s+/, $_; ($name, $hash) }
+      read_lines("$pkg_dir/toolchains/go1.25.12.sha256");
+    my $go_hash = $checksums{$go_file};
+    die "No pinned checksum for $go_file\n" unless defined($go_hash) && $go_hash =~ /\A[0-9a-f]{64}\z/;
+    my $go_url = "https://go.dev/dl/$go_file";
+    my $go_archive = "$sources_dir/$go_file";
+    run("wget --https-only --tries=3 --timeout=60 -q -O " . sh_quote($go_archive) . " " . sh_quote($go_url));
+    die "Go toolchain checksum mismatch: $go_file\n" unless digest_file($go_archive) eq $go_hash;
+    $go_source = "Source3:        $go_url\n";
+    $go_requires = 'coreutils tar gzip ca-certificates';
+    $go_prep = "echo '$go_hash  %{SOURCE3}' | sha256sum -c -\ntar -C %{_builddir} -xzf %{SOURCE3}\n";
+    $go_environment = 'export PATH=%{_builddir}/go/bin:$PATH' . "\ngo version\n";
+    $native_changelog = "* Tue Sep 08 2026 xCAT build - $version-4\n- Build in the native openEuler target with the verified Go 1.25.12 source archive.\n\n";
+}
+
 # --- Spec: the Go compile runs in %build INSIDE the chroot; modules fetched from the proxy, pinned by go.sum ---
 print_step("Write spec");
 my $spec_file = "$work_dir/goconserver.spec";
@@ -199,7 +253,7 @@ write_file($spec_file, <<"SPEC");
 %global debug_package %{nil}
 Name:           goconserver
 Version:        $version
-Release:        4.el$rel$release_suffix
+Release:        4$dist_suffix$release_suffix
 Summary:        Console server written in Go for xCAT
 License:        EPL-1.0
 URL:            https://github.com/xcat2/goconserver
@@ -208,8 +262,9 @@ BuildArch:      $arch
 Source0:        goconserver-%{version}.tar.gz
 Source1:        goconserver.service
 Source2:        server.conf
+$go_source
 
-BuildRequires:  golang
+BuildRequires:  $go_requires
 
 %description
 goconserver is a scalable console server written in Go. It provides
@@ -217,15 +272,17 @@ console logging and management for xCAT cluster nodes.
 
 %prep
 %setup -q -n goconserver-%{version}
+$go_prep
 
 %build
 # Compile in-chroot. Modules are downloaded from the Go proxy at build time (mock networking is on)
 # but PINNED + integrity-checked by the committed go.sum, so the build is reproducible without a
 # vendored tree. GOTOOLCHAIN=local pins the chroot's Go (never auto-downloads a toolchain).
+$go_environment
 export GOFLAGS=-mod=mod GOTOOLCHAIN=local CGO_ENABLED=0
 export GOCACHE=%{_builddir}/.gocache GOPATH=%{_builddir}/.gopath GOMODCACHE=%{_builddir}/.gomodcache
-go build -trimpath -buildvcs=false -ldflags "-X main.Version=%{version}" -o goconserver goconserver.go
-go build -trimpath -buildvcs=false -ldflags "-X main.Version=%{version}" -o congo cmd/congo.go
+go build -trimpath -buildvcs=false -ldflags "$go_ldflags" -o goconserver goconserver.go
+go build -trimpath -buildvcs=false -ldflags "$go_ldflags" -o congo cmd/congo.go
 
 %install
 install -Dm0755 goconserver %{buildroot}/usr/bin/goconserver
@@ -243,6 +300,7 @@ mkdir -p %{buildroot}/var/log/goconserver %{buildroot}/var/lib/goconserver
 %dir /var/lib/goconserver
 
 %changelog
+$native_changelog
 * Mon Aug 10 2026 xCAT build - $version-4.el$rel
 - Build inside a mock chroot (no host build). Modules are downloaded at build time but pinned +
   integrity-checked by a committed go.sum (no `go mod tidy`, no vendored tree). Compiled in the
diff --git a/goconserver/toolchains/go1.25.12.sha256 b/goconserver/toolchains/go1.25.12.sha256
new file mode 100644
index 0000000..e698cb0
--- /dev/null
+++ b/goconserver/toolchains/go1.25.12.sha256
@@ -0,0 +1,2 @@
+234828b7a89e0e303d2556310ee549fbcf253d28de937bac3da13d6294262ac1  go1.25.12.linux-amd64.tar.gz
+64adb4ddefef4f0a6f11af550547f39bf510350da69ab308438a21eacfde97ad  go1.25.12.linux-ppc64le.tar.gz
diff --git a/grub2-xcat/grub2-xcat.spec b/grub2-xcat/grub2-xcat.spec
index 54bd047..de43168 100644
--- a/grub2-xcat/grub2-xcat.spec
+++ b/grub2-xcat/grub2-xcat.spec
@@ -30,6 +30,9 @@ grub2-xcat provides some grub2 resources generated by grub2-mknetdir,including g
 and the EL grub2 UEFI image for riscv64 nodes, which boot through UEFI and grub2 only.
 
 %define _binaries_in_noarch_packages_terminate_build   0
+%if 0%{?openEuler}
+%global __strip /bin/true
+%endif
 
 %prep
 #cp ./grub2-res.tar.gz /root/rpmbuild/SOURCES/
diff --git a/lib/XCAT/NativeInputs.pm b/lib/XCAT/NativeInputs.pm
new file mode 100644
index 0000000..df78564
--- /dev/null
+++ b/lib/XCAT/NativeInputs.pm
@@ -0,0 +1,291 @@
+package XCAT::NativeInputs;
+
+use strict;
+use warnings;
+
+use Cwd qw(abs_path);
+use Digest::SHA ();
+use Exporter qw(import);
+use File::Basename qw(basename);
+use File::Copy qw(copy);
+use File::Path qw(make_path);
+use File::Temp qw(tempdir);
+use JSON::PP;
+
+our @EXPORT_OK = qw(load_inputs stage_inputs verify_input rpm_identity validate_outputs publisher_trust);
+
+sub read_file {
+    my ($path) = @_;
+    open my $fh, '<', $path or die "Cannot read $path: $!\n";
+    local $/;
+    my $data = <$fh>;
+    close $fh or die "Cannot close $path: $!\n";
+    return $data;
+}
+
+sub sha256 {
+    my ($path) = @_;
+    open my $fh, '<', $path or die "Cannot read $path: $!\n";
+    binmode $fh;
+    my $sha = Digest::SHA->new(256)->addfile($fh)->hexdigest;
+    close $fh or die "Cannot close $path: $!\n";
+    return $sha;
+}
+
+sub capture {
+    my (@args) = @_;
+    open my $fh, '-|', @args or die "Cannot execute $args[0]: $!\n";
+    local $/;
+    my $out = <$fh> // '';
+    close $fh or die "Command failed: @args\n";
+    $out =~ s/\s+\z//;
+    return $out;
+}
+
+sub run {
+    my (@args) = @_;
+    system(@args) == 0 or die "Command failed: @args\n";
+}
+
+sub pinned_file {
+    my ($root, $entry) = @_;
+    die "Invalid pinned path\n" unless ($entry->{path} // '') =~ m{\A[\w./-]+\z}
+        && $entry->{path} !~ m{(?:\A|/)\.\.(?:/|\z)|\A/};
+    die "Missing input $entry->{path}\n" unless -f "$root/$entry->{path}";
+    my $path = abs_path("$root/$entry->{path}") // die "Missing input $entry->{path}\n";
+    die "Input escapes repository: $entry->{path}\n" unless index($path, "$root/") == 0;
+    die "Input SHA256 mismatch: $entry->{path}\n" unless sha256($path) eq ($entry->{sha256} // '');
+    return $path;
+}
+
+sub load_inputs {
+    my ($root, $required) = @_;
+    $root = abs_path($root) // die "Missing repository\n";
+    my $catalog_path = "$root/openeuler/24.03-ppc64le.inputs.json";
+    my $catalog = JSON::PP->new->decode(read_file($catalog_path));
+    die "Unsupported native input catalog\n" unless ($catalog->{version} // 0) == 1
+        && ($catalog->{target} // '') eq 'openeuler-24.03-ppc64le';
+    my $key = $catalog->{publisher_key};
+    die "Invalid publisher fingerprint\n" unless ($key->{fingerprint} // '') =~ /\A[0-9A-F]{40}\z/;
+    my $key_path = pinned_file($root, $key);
+    my (%nodes, %outputs);
+    for my $node (@{$catalog->{inputs}}) {
+        my $name = $node->{name} // '';
+        die "Invalid native input name '$name'\n" unless $name =~ /\A[\w+.-]+\z/;
+        die "Duplicate native input '$name'\n" if $nodes{$name};
+        my $type = $node->{type} // '';
+        die "Invalid native input type '$type'\n" unless $type =~ /\A(?:srpm|publisher|owner)\z/;
+        if ($type eq 'owner') {
+            die "Unsupported native build owner '$name'\n" unless grep { $_ eq $name }
+                qw(goconserver grub2-xcat ipmitool-xcat syslinux-xcat xnba-undi xCAT-genesis-base
+                   perl-Crypt-Rijndael perl-Crypt-SSLeay perl-HTTP-Async perl-IO-Stty perl-Net-HTTPS-NB perl-Net-Telnet);
+        }
+        if ($type ne 'publisher') {
+            my $uid = $type eq 'owner' && ($name eq 'xnba-undi' || $name eq 'xCAT-genesis-base') ? 0 : 1000;
+            die "Invalid native build UID for $name\n" unless ($node->{build_uid} // -1) == $uid;
+        }
+        if ($type ne 'owner') {
+            die "Invalid pinned native URL for $name\n" unless ($node->{url} // '') =~
+                m{\Ahttps://repo\.openeuler\.org/openEuler-24\.03-LTS(?:-SP3)?/[A-Za-z0-9_./+-]+\.rpm\z};
+            die "Invalid native SHA256 for $name\n" unless ($node->{sha256} // '') =~ /\A[0-9a-f]{64}\z/;
+            die "Publisher binary must be exact GA: $name\n" if $type eq 'publisher'
+                && $node->{url} !~ m{/openEuler-24\.03-LTS/.*\.noarch\.rpm\z};
+        }
+        die "Missing output ownership for $name\n" unless ref($node->{outputs}) eq 'ARRAY' && @{$node->{outputs}};
+        for my $output (@{$node->{outputs}}) {
+            die "Invalid native output name\n" unless $output =~ /\A[\w+.-]+\z/;
+            die "Conflicting output ownership: $output\n" if $outputs{$output};
+            $outputs{$output} = $name;
+        }
+        die "Invalid publisher outputs for $name\n" if $type eq 'publisher'
+            && (@{$node->{outputs}} != 1 || $node->{outputs}[0] ne $name);
+        for my $patch (@{$node->{patches} // []}) {
+            die "Only source inputs accept patches\n" unless $type eq 'srpm';
+            $patch->{absolute_path} = pinned_file($root, $patch);
+        }
+        for my $define (@{$node->{defines} // []}) {
+            die "Invalid native spec definition for $name\n" unless $type eq 'srpm'
+                && $define =~ /\A(?:llvmjit|external_libpq|runselftest|test) [01]\z/;
+        }
+        $nodes{$name} = $node;
+    }
+    for my $name (sort keys %nodes) {
+        my $type = $nodes{$name}{type};
+        for my $dependency (@{$nodes{$name}{needs} // []}) {
+            die "Missing native dependency '$dependency'\n" unless $nodes{$dependency};
+            die "Unsupported native execution edge: $name -> $dependency\n"
+                if $type eq 'publisher' || $nodes{$dependency}{type} eq 'owner';
+        }
+    }
+    my (%mark, @order);
+    my $visit;
+    $visit = sub {
+        my ($name) = @_;
+        die "Missing native dependency '$name'\n" unless $nodes{$name};
+        die "Cyclic native dependency at '$name'\n" if ($mark{$name} // '') eq 'visiting';
+        return if $mark{$name};
+        $mark{$name} = 'visiting';
+        $visit->($_) for @{$nodes{$name}{needs} // []};
+        $mark{$name} = 'done';
+        push @order, $name;
+    };
+    $visit->($_) for sort keys %nodes;
+    my %selected;
+    my $select;
+    $select = sub {
+        my ($name) = @_;
+        die "Missing native dependency '$name'\n" unless $nodes{$name};
+        return if $selected{$name}++;
+        $select->($_) for @{$nodes{$name}{needs} // []};
+    };
+    for my $output (sort keys %$required) {
+        my $owner = $outputs{$output} // ($nodes{$output} ? $output : undef);
+        die "No native output owner for '$output'\n" unless $owner;
+        $select->($owner);
+    }
+    $select->($_) for @{$catalog->{build_inputs} // []};
+    return {catalog => $catalog, nodes => \%nodes, outputs => \%outputs,
+        order => [grep { $selected{$_} } @order], selected => \%selected,
+        publisher_key => $key_path, publisher_fingerprint => $key->{fingerprint},
+        catalog_sha256 => sha256($catalog_path)};
+}
+
+sub rpm_identity {
+    my ($path) = @_;
+    my @fields = split /\n/, capture('rpm', '-qp', '--qf',
+        '%{NAME}\n%{ARCH}\n%{SOURCEPACKAGE}\n%{RELEASE}\n', $path);
+    die "Invalid RPM header: $path\n" unless @fields == 4;
+    return {name => $fields[0], arch => $fields[1], source => $fields[2] eq '1', release => $fields[3]};
+}
+
+sub read_exact {
+    my ($fh, $size) = @_;
+    my $data = '';
+    while (length($data) < $size) {
+        my $got = read($fh, $data, $size - length($data), length($data));
+        die "Truncated RPM payload\n" unless defined($got) && $got > 0;
+    }
+    return $data;
+}
+
+sub reject_elf_payload {
+    my ($path) = @_;
+    open my $fh, '-|', 'rpm2cpio', $path or die "Cannot read RPM payload: $!\n";
+    binmode $fh;
+    my $error;
+    eval {
+        while (1) {
+            my $header = read_exact($fh, 110);
+            die "Invalid RPM cpio header\n" unless $header =~ /\A07070[12][0-9A-Fa-f]{104}\z/;
+            my @fields = map { hex($_) } $header =~ /\A.{6}(.{8})(.{8})(.{8})(.{8})(.{8})(.{8})(.{8})(.{8})(.{8})(.{8})(.{8})(.{8})(.{8})\z/s;
+            my ($size, $namesize) = @fields[6, 11];
+            die "Invalid RPM cpio filename\n" unless $namesize > 0 && $namesize <= 1048576;
+            my $name = read_exact($fh, $namesize);
+            die "Invalid RPM cpio filename terminator\n" unless $name =~ s/\0\z//;
+            read_exact($fh, (4 - (110 + $namesize) % 4) % 4);
+            last if $name eq 'TRAILER!!!' && $size == 0;
+            my $prefix = read_exact($fh, $size < 4 ? $size : 4);
+            die "ELF payload in publisher noarch RPM: $name\n" if $prefix eq "\x7fELF";
+            $size -= length($prefix);
+            while ($size) { my $count = $size < 65536 ? $size : 65536; read_exact($fh, $count); $size -= $count; }
+            read_exact($fh, (4 - $fields[6] % 4) % 4);
+        }
+        my $tail;
+        while (read($fh, $tail, 65536)) { die "Unexpected data after RPM cpio trailer\n" if $tail =~ /[^\0]/; }
+        1;
+    } or $error = $@;
+    my $closed = close($fh);
+    die $error if $error;
+    die "rpm2cpio failed: $path\n" unless $closed;
+}
+
+sub verify_input {
+    my ($plan, $node, $path, $db) = @_;
+    die "Native input SHA256 mismatch: $path\n" unless sha256($path) eq $node->{sha256};
+    my $out = capture('rpmkeys', '--dbpath', $db, '--checksig', '--verbose', $path);
+    die "Publisher signature missing or invalid: $path\n" unless $out =~ /Signature.*: OK/i
+        && $out !~ /NOKEY|NOT OK|BAD|UNSIGNED/i;
+    my $id = rpm_identity($path);
+    die "Native input NAME mismatch: $path\n" unless $id->{name} eq $node->{name};
+    if ($node->{type} eq 'publisher') {
+        die "Publisher input is not a noarch binary: $path\n" if $id->{source} || $id->{arch} ne 'noarch';
+        die "Publisher input is not exact GA: $path\n" unless $id->{release} =~ /\.oe2403\z/;
+        reject_elf_payload($path);
+    } else {
+        die "Native input is not a source RPM: $path\n" unless $id->{source};
+    }
+    die "Native input changed during verification: $path\n" unless sha256($path) eq $node->{sha256};
+    return $id;
+}
+
+sub publisher_trust {
+    my ($plan, $work) = @_;
+    make_path("$work/trust", "$work/gnupg");
+    chmod 0700, "$work/gnupg";
+    my $listing = capture('gpg', '--homedir', "$work/gnupg", '--batch', '--with-colons', '--show-keys', $plan->{publisher_key});
+    my @primary;
+    my $pub;
+    for my $line (split /\n/, $listing) {
+        my @fields = split /:/, $line;
+        $pub = 1 if $fields[0] eq 'pub';
+        if ($pub && $fields[0] eq 'fpr') { push @primary, $fields[9]; $pub = 0; }
+    }
+    die "Publisher public key fingerprint mismatch\n" unless @primary == 1 && $primary[0] eq $plan->{publisher_fingerprint};
+    run('rpmkeys', '--dbpath', "$work/trust", '--import', $plan->{publisher_key});
+    return "$work/trust";
+}
+
+sub stage_inputs {
+    my ($plan, $work) = @_;
+    die "Native input staging already exists: $work\n" if -e $work;
+    make_path($work);
+    my $db = publisher_trust($plan, $work);
+    my @ledger;
+    for my $name (@{$plan->{order}}) {
+        my $node = $plan->{nodes}{$name};
+        next if $node->{type} eq 'owner';
+        make_path("$work/$name");
+        for my $patch (@{$node->{patches} // []}) {
+            make_path("$work/$name/patches");
+            my $staged = "$work/$name/patches/" . basename($patch->{path});
+            die "Conflicting staged patch: $staged\n" if -e $staged;
+            copy($patch->{absolute_path}, $staged) or die "Cannot stage native patch: $!\n";
+            die "Staged patch SHA256 mismatch: $staged\n" unless sha256($staged) eq $patch->{sha256};
+            chmod 0444, $staged or die "Cannot protect native patch: $!\n";
+            $patch->{staged} = $staged;
+        }
+        my $dest = "$work/$name/" . basename($node->{url});
+        run('wget', '--https-only', '--tries=3', '--timeout=60', '-O', "$dest.part", $node->{url});
+        verify_input($plan, $node, "$dest.part", $db);
+        rename("$dest.part", $dest) or die "Cannot preserve native input: $!\n";
+        chmod 0444, $dest or die "Cannot protect native input: $!\n";
+        $node->{staged} = $dest;
+        push @ledger, {name => $name, type => $node->{type}, url => $node->{url},
+            sha256 => $node->{sha256}, path => $dest, publisher => $plan->{publisher_fingerprint},
+            defines => $node->{defines} // [],
+            patches => [map { {path => $_->{path}, sha256 => $_->{sha256}, staged => $_->{staged}} } @{$node->{patches} // []}]};
+    }
+    open my $fh, '>', "$work/inputs.json" or die "Cannot record native input ledger: $!\n";
+    print {$fh} JSON::PP->new->canonical->pretty->encode({catalog_sha256 => $plan->{catalog_sha256}, inputs => \@ledger});
+    close $fh or die "Cannot close native input ledger: $!\n";
+    $plan->{trust_db} = $db;
+}
+
+sub validate_outputs {
+    my ($node, $paths, $require_all) = @_;
+    my %allowed = map { $_ => 1 } @{$node->{outputs}};
+    my %seen;
+    for my $path (@$paths) {
+        my $id = rpm_identity($path);
+        next if $id->{source};
+        die "Unexpected output from $node->{name}: $id->{name}\n" unless $allowed{$id->{name}};
+        die "Duplicate output from $node->{name}: $id->{name}\n" if $seen{$id->{name}}++;
+        die "Foreign output architecture: $id->{arch}\n" unless $id->{arch} eq 'ppc64le' || $id->{arch} eq 'noarch';
+    }
+    if ($require_all) {
+        die "Missing output from $node->{name}: $_\n" for grep { !$seen{$_} } sort keys %allowed;
+    }
+    return \%seen;
+}
+
+1;
diff --git a/mock-configs/openeuler-20.03sp4-x86_64.cfg b/mock-configs/openeuler-20.03sp4-x86_64.cfg
new file mode 100644
index 0000000..f6ada6a
--- /dev/null
+++ b/mock-configs/openeuler-20.03sp4-x86_64.cfg
@@ -0,0 +1,7 @@
+include('templates/openeuler-20.03-sp4.tpl')
+config_opts['root'] = 'openeuler-20.03sp4-x86_64'
+config_opts['target_arch'] = 'x86_64'
+config_opts['legal_host_arches'] = ('x86_64',)
+config_opts['openeuler_repository_release'] = '20.03-LTS-SP4'
+config_opts['openeuler_repositories'] = ('OS', 'everything', 'update')
+include('templates/openeuler-lts-xcat.tpl')
diff --git a/mock-configs/openeuler-22.03sp4-x86_64.cfg b/mock-configs/openeuler-22.03sp4-x86_64.cfg
new file mode 100644
index 0000000..4261f65
--- /dev/null
+++ b/mock-configs/openeuler-22.03sp4-x86_64.cfg
@@ -0,0 +1,7 @@
+include('templates/openeuler-22.03-sp4.tpl')
+config_opts['root'] = 'openeuler-22.03sp4-x86_64'
+config_opts['target_arch'] = 'x86_64'
+config_opts['legal_host_arches'] = ('x86_64',)
+config_opts['openeuler_repository_release'] = '22.03-LTS-SP4'
+config_opts['openeuler_repositories'] = ('OS', 'everything', 'update')
+include('templates/openeuler-lts-xcat.tpl')
diff --git a/mock-configs/openeuler-24.03-ppc64le.cfg b/mock-configs/openeuler-24.03-ppc64le.cfg
new file mode 100644
index 0000000..5b3ce7c
--- /dev/null
+++ b/mock-configs/openeuler-24.03-ppc64le.cfg
@@ -0,0 +1,15 @@
+config_opts['root'] = 'openeuler-24.03-ppc64le'
+config_opts['target_arch'] = 'ppc64le'
+config_opts['legal_host_arches'] = ('ppc64le',)
+config_opts['releasever'] = '24.03LTS'
+config_opts['package_manager'] = 'dnf'
+config_opts['isolation'] = 'simple'
+config_opts['chrootuid'] = 1000
+config_opts['chrootgid'] = 1000
+config_opts['useradd'] = '/usr/sbin/useradd -o -m -u {{chrootuid}} -g {{chrootgid}} -d {{chroothome}} -N {{chrootuser}}'
+config_opts['use_bootstrap'] = False
+config_opts['use_bootstrap_container'] = False
+config_opts['chroot_setup_cmd'] = 'install openEuler-rpm-config openEuler-release shadow rpm-build dnf-plugins-core gcc make perl-interpreter'
+config_opts['openeuler_repository_release'] = '24.03-LTS'
+config_opts['openeuler_repositories'] = ('OS',)
+include('templates/openeuler-lts-xcat.tpl')
diff --git a/mock-configs/openeuler-24.03sp1-x86_64.cfg b/mock-configs/openeuler-24.03sp1-x86_64.cfg
new file mode 100644
index 0000000..2ca84c4
--- /dev/null
+++ b/mock-configs/openeuler-24.03sp1-x86_64.cfg
@@ -0,0 +1,8 @@
+include('templates/openeuler-24.03.tpl')
+config_opts['root'] = 'openeuler-24.03sp1-x86_64'
+config_opts['target_arch'] = 'x86_64'
+config_opts['legal_host_arches'] = ('x86_64',)
+config_opts['releasever'] = '24.03LTS_SP1'
+config_opts['openeuler_repository_release'] = '24.03-LTS-SP1'
+config_opts['openeuler_repositories'] = ('OS', 'everything', 'update')
+include('templates/openeuler-lts-xcat.tpl')
diff --git a/mock-configs/openeuler-24.03sp3-x86_64.cfg b/mock-configs/openeuler-24.03sp3-x86_64.cfg
new file mode 100644
index 0000000..82241c1
--- /dev/null
+++ b/mock-configs/openeuler-24.03sp3-x86_64.cfg
@@ -0,0 +1,8 @@
+include('templates/openeuler-24.03.tpl')
+config_opts['root'] = 'openeuler-24.03sp3-x86_64'
+config_opts['target_arch'] = 'x86_64'
+config_opts['legal_host_arches'] = ('x86_64',)
+config_opts['releasever'] = '24.03LTS_SP3'
+config_opts['openeuler_repository_release'] = '24.03-LTS-SP3'
+config_opts['openeuler_repositories'] = ('OS', 'everything', 'update')
+include('templates/openeuler-lts-xcat.tpl')
diff --git a/mock-configs/openeuler-24.03sp4-x86_64.cfg b/mock-configs/openeuler-24.03sp4-x86_64.cfg
new file mode 100644
index 0000000..4d42489
--- /dev/null
+++ b/mock-configs/openeuler-24.03sp4-x86_64.cfg
@@ -0,0 +1,8 @@
+include('templates/openeuler-24.03.tpl')
+config_opts['root'] = 'openeuler-24.03sp4-x86_64'
+config_opts['target_arch'] = 'x86_64'
+config_opts['legal_host_arches'] = ('x86_64',)
+config_opts['releasever'] = '24.03LTS_SP4'
+config_opts['openeuler_repository_release'] = '24.03-LTS-SP4'
+config_opts['openeuler_repositories'] = ('OS', 'everything', 'update')
+include('templates/openeuler-lts-xcat.tpl')
diff --git a/mock-configs/templates/openeuler-lts-xcat.tpl b/mock-configs/templates/openeuler-lts-xcat.tpl
new file mode 100644
index 0000000..5f80d47
--- /dev/null
+++ b/mock-configs/templates/openeuler-lts-xcat.tpl
@@ -0,0 +1,31 @@
+config_opts['dist'] = ''
+config_opts['use_bootstrap_image'] = False
+config_opts['description'] = 'openEuler ' + config_opts['openeuler_repository_release']
+config_opts['dnf.conf'] = """
+[main]
+keepcache=1
+reposdir=/dev/null
+logfile=/var/log/dnf.log
+retries=20
+obsoletes=1
+gpgcheck=1
+assumeyes=1
+metadata_expire=0
+best=1
+install_weak_deps=0
+skip_if_unavailable=0
+protected_packages=
+"""
+_openeuler_root = 'https://repo.openeuler.org/openEuler-' + config_opts['openeuler_repository_release']
+_openeuler_arch = config_opts['target_arch']
+for _openeuler_repo in config_opts['openeuler_repositories']:
+    config_opts['dnf.conf'] += """
+[{repo}]
+name=openEuler {release} {repo}
+baseurl={root}/{repo}/{arch}/
+enabled=1
+gpgcheck=1
+gpgkey={root}/OS/{arch}/RPM-GPG-KEY-openEuler
+skip_if_unavailable=0
+""".format(repo=_openeuler_repo, release=config_opts['openeuler_repository_release'],
+           root=_openeuler_root, arch=_openeuler_arch)
diff --git a/mockbuild-all.pl b/mockbuild-all.pl
index f108ff0..3403c16 100755
--- a/mockbuild-all.pl
+++ b/mockbuild-all.pl
@@ -13,6 +13,7 @@ use File::Temp qw(tempdir tempfile);
 use Getopt::Long qw(GetOptions);
 use Parallel::ForkManager;
 use POSIX qw(strftime);
+use JSON::PP;
 use FindBin qw($RealBin);
 use lib $RealBin, "$RealBin/lib";
 use MockBuildUtils qw(sh_quote print_step version_matches required_pkgs
@@ -20,11 +21,13 @@ use MockBuildUtils qw(sh_quote print_step version_matches required_pkgs
                       read_manifest verify_repo_packages verify_repo_signature verify_rpm_signatures
                       rpm_version rpm_release rpm_sigmd5 restamp_release_line
                       cross_copy_genesis finalize_xcat_dep bump_dep_release_suffix
-                      build_mock_uniqueext rpmkeys_checksig_problem);
+                      build_mock_uniqueext rpmkeys_checksig_problem
+                      openeuler_build_target openeuler_repo_subdir);
 # print_step and sh_quote come from MockBuildUtils above; XCAT::BuildUtils carries the same
 # print_step, so it is deliberately NOT imported here (one definition, no redefinition warning).
 use XCAT::BuildUtils qw(
   capture_command
+  digest_file
   every_step_failed
   hashes_equal
   read_lines
@@ -36,6 +39,7 @@ use XCAT::GenesisRelease qw(
   validated_release_checksums
   verify_release_file
 );
+use XCAT::NativeInputs qw(load_inputs stage_inputs verify_input rpm_identity validate_outputs publisher_trust);
 
 # --- Mount-namespace isolation: guard the host cgroup against mock teardown propagation ----------
 # mock mounts /sys/fs/cgroup into every build chroot. On these systemd build hosts every mount is
@@ -133,6 +137,7 @@ my $no_verify_repo = 0;
 my @HELD_LOCKS;
 my $LOCK_OWNER_PID;
 my ($COMMON_STAGE, $COMMON_DESTINATION, $COMMON_BACKUP);
+my %NATIVE_PLANS;
 for my $sig (qw(INT TERM HUP)) {
     $SIG{$sig} = sub { exit 1; };
 }
@@ -347,6 +352,9 @@ if ($install_deps) {
     die "FATAL: still missing after install: " . join(', ', @missing) . "\n" if @missing;
     print "  perl modules present: " . join(', ', @modules) . "\n";
     print "  host is ready\n";
+    if (lc($os_id) eq 'openeuler') {
+        install_mock_cfg(basename($_, '.cfg')) for glob("$repo_root/mock-configs/openeuler-*.cfg");
+    }
     exit 0;
 }
 
@@ -381,8 +389,10 @@ if ($genesis_release ne '') {
 # ONLY the host arch (uname -m) -- the other arch is produced on its own build host --
 # except for the forcearch targets (%forcearch_targets, --target only), which are
 # cross-built here through qemu-user-static.
+my $native_target = openeuler_build_target(\%os, $host_arch);
 my @build_targets = $target
     ? ($target)
+    : defined($native_target) ? ($native_target)
     : map { resolve_mock_cfg($os_id, $_, $host_arch) } (8, 9, 10);
 
 # What a target builds. The mock-core-configs targets (<os>+epel-<rel>-<arch>) build every
@@ -473,6 +483,14 @@ sub build_one_target {
     my %req = %{ $MANIFEST{$target} // {} };
     die "FATAL: no manifest section for target '$target' in packages-manifest.conf\n"
         if !%req;
+    my $native = $target eq 'openeuler-24.03-ppc64le' ? load_inputs($repo_root, \%req) : undef;
+    $NATIVE_PLANS{$target} = $native if $native;
+    if ($native) {
+        die "Native POWER collection requires signing and verification\n"
+            if !$gpg_sign || $no_verify_repo;
+        die "Native POWER inputs require a complete owner run\n"
+            if $skip_build || $skip_xcat_dep || $skip_perl || @extra_collect_dirs;
+    }
 
 my $run_root     = "$output_root/$run_id";
 my $build_root   = "$run_root/build-results";
@@ -505,6 +523,8 @@ my @dep_builders = (
     { name => 'goconserver', script => "$repo_root/goconserver/mockbuild.pl" },
     { name => 'conserver-xcat', script => "$repo_root/conserver/mockbuild.pl" },
     { name => 'xnba-undi',   script => "$repo_root/xnba/mockbuild.pl", noarch => 1 },
+    { name => 'python3-scp', srpm => "$repo_root/python-scp/python-scp-0.14.5-1.oe2403.src.rpm",
+      sha256 => '3461d2a3fe0122cac2893d8465ad1271ae21e5570a31d4402e3f887ef545a0e8' },
 );
 my %profile_builds = map { $_ => 1 } @{ $profile->{dep_builders} };
 
@@ -518,11 +538,16 @@ die "Missing xCAT build script: $xcat_src/buildrpms.pl\n"
 my @active_dep_builders;
 for my $b (@dep_builders) {
     next if !$profile_builds{$b->{name}};
+    if ($b->{srpm}) {
+        push @active_dep_builders, $b if $req{$b->{name}};
+        next;
+    }
     if (-f $b->{script}) {
         push @active_dep_builders, $b;
         next;
     }
     print "WARN: missing dep builder script, skipping: $b->{script}\n";
+    die "Missing native owner script: $b->{script}\n" if $native && $req{$b->{name}};
 }
 die "Missing perl builder script: $perl_builder\n"
     if !$skip_perl && !$perl_builder;
@@ -576,9 +601,35 @@ print "srpm_repo_dir:    $srpm_repo_dir\n";
 print "srpm_tarball:     $srpm_tarball\n";
 
 my @collect_roots;
+my @native_source_roots;
+
+if ($native && !$dry_run) {
+    stage_inputs($native, "$run_root/native-inputs");
+}
+
+if (!$skip_build && !$skip_xcat_dep) {
+    for my $builder (grep { $_->{srpm} } @active_dep_builders) {
+        my $source = $builder->{srpm};
+        die "Missing source RPM: $source\n" unless -f $source;
+        die "Source RPM SHA256 mismatch: $source\n" unless digest_file($source) eq $builder->{sha256};
+        next if $dry_run;
+        my $stage_dir = "$run_root/source-rpms/$builder->{name}";
+        make_path($stage_dir);
+        my $staged = "$stage_dir/" . basename($source);
+        copy($source, $staged) or die "Cannot stage source RPM $source: $!\n";
+        die "Staged source RPM SHA256 mismatch: $staged\n" unless digest_file($staged) eq $builder->{sha256};
+        $builder->{srpm} = $staged;
+    }
+}
 
 install_mock_cfg($target);
 
+if ($native) {
+    my ($runtime, $sources) = build_native_inputs($native, $target, \%req, $run_root, $log_root);
+    push @collect_roots, $runtime;
+    push @native_source_roots, @$sources;
+}
+
 if ($scrub_all_chroots) {
     run_step(
         step => "Scrub all chroots for target $target",
@@ -604,7 +655,10 @@ if (!$skip_build) {
             my $step_result = "$build_root/$name";
             my $step_log    = "$log_root/$name";
             my $step_uniqueext = build_mock_uniqueext($run_id, ++$build_step_seq, $name);
-            my $cmd = join(' ',
+            my $cmd = $builder->{srpm}
+                ? source_rpm_build_command($builder, $target, $step_uniqueext, $step_result, $step_log,
+                    "$run_root/source-rpms/$name")
+                : join(' ',
                 'perl', shell_quote($script),
                 '--mock-cfg', shell_quote($builder->{noarch} ? $profile->{noarch_cfg} : $target),
                 ($profile->{forcearch} && !$builder->{noarch} ? ('--target-arch', shell_quote($arch)) : ()),
@@ -614,13 +668,10 @@ if (!$skip_build) {
                 # host-local, run-scoped work dir so /tmp doesn't collide between runs
                 '--work-dir', shell_quote("/tmp/mockbuild-all-$run_id/$name"),
                 '--build-timestamp', $SOURCE_DATE_EPOCH,
-                # goconserver generates its spec at build time (from an upstream clone), so the
-                # in-tree spec Release bump above cannot reach it. Hand the CD suffix down so its
-                # NVR advances per run too, and pin the clone to an immutable commit (not the moving
-                # 'master') so the build is reproducible.
-                ($name eq 'goconserver'
-                    ? ('--go-ref', sh_quote($GOCONSERVER_REF),
-                       ($RELEASE_BUMP ne '' ? ('--release-suffix', sh_quote($RELEASE_BUMP)) : ()))
+                ($name eq 'goconserver' ? ('--go-ref', sh_quote($GOCONSERVER_REF)) : ()),
+                # Generated specs need the same release suffix as in-tree specs.
+                (($name eq 'goconserver' || $name eq 'xnba-undi') && $RELEASE_BUMP ne ''
+                    ? ('--release-suffix', sh_quote($RELEASE_BUMP))
                     : ()),
             );
             push @build_steps, {
@@ -630,12 +681,13 @@ if (!$skip_build) {
                 log  => "$log_root/$name/run.log",
                 scrub_cfg       => $target,
                 scrub_uniqueext => $step_uniqueext,
+                ($native ? (native_results => {$name => $step_result}) : ()),
             };
             push @collect_roots, $step_result;
         }
     }
 
-    my @perl_pkgs = sort grep { /^perl-/ } keys %req;   # manifest: perl packages required here
+    my @perl_pkgs = sort grep { /^perl-/ && (!$native || $native->{nodes}{$_}{type} eq 'owner') } keys %req;
     if (!$skip_perl && @perl_pkgs) {
         my $perl_result = "$build_root/perl/$arch";
         my $perl_log    = "$log_root/perl/$arch";
@@ -668,6 +720,7 @@ if (!$skip_build) {
             step => 'Build perl xcat-dep packages',
             cmd  => $cmd,
             log  => "$log_root/perl-build.log",
+            ($native ? (native_results => {map { $_ => "$perl_result/$_" } @perl_pkgs}) : ()),
         };
         push @collect_roots, $perl_result;
     }
@@ -711,6 +764,7 @@ if (!$skip_build) {
             '--verbose',
             '--xcat_dep_path', shell_quote($repo_root),
         );
+        $cmd = native_owner_command($native, $target, $cmd, 0) if $native;
         push @build_steps, {
             id   => 'genesis',
             step => 'Build xCAT-genesis-base (per-target, OS-dependent)',
@@ -718,10 +772,16 @@ if (!$skip_build) {
             cwd  => $xcat_src,
             log  => "$log_root/genesis-build.log",
             scrub_cfg => "xCAT-genesis-base-$target",
+            ($native ? (native_results => {'xCAT-genesis-base' => "$xcat_src/dist/$target/rpms"}) : ()),
         };
     }
 
     if (@build_steps) {
+        if ($native) {
+            for my $step (grep { $_->{id} ne 'genesis' } @build_steps) {
+                $step->{cmd} = native_owner_command($native, $target, $step->{cmd}, 1000);
+            }
+        }
         # Prefer the caller-supplied cap (global budget / active targets). Fall back to the old
         # behaviour (all steps at once) only when unset.
         my $effective_parallel_builds =
@@ -767,6 +827,20 @@ if (!$skip_build) {
         # -- ignore a genesis failure when a matching rpm already exists in dist/ -- is gone; a
         # stale artifact from a previous build must never mask a failed genesis build.)
         die "FATAL: required build step(s) failed for $target: @failed\n" if @failed;
+        if ($native && !$dry_run) {
+            for my $step (@build_steps) {
+                for my $name (sort keys %{$step->{native_results} // {}}) {
+                    my $directory = $step->{native_results}{$name};
+                    die "Missing native owner result: $directory\n" unless -d $directory;
+                    my @rpms;
+                    find({no_chdir => 1, wanted => sub {
+                        push @rpms, $File::Find::name if -f $_ && /\.rpm\z/ && !/\.src\.rpm\z/
+                            && ($name ne 'xCAT-genesis-base' || basename($_) =~ /^xCAT-genesis-base-/);
+                    }}, $directory);
+                    validate_outputs($native->{nodes}{$name}, \@rpms, 1);
+                }
+            }
+        }
     }
 }
 
@@ -787,6 +861,7 @@ if ($skip_build) {
 push @collect_roots, @extra_collect_dirs;
 @collect_roots = uniq(@collect_roots);
 my @srpm_collect_roots = uniq(@collect_roots);
+push @srpm_collect_roots, @native_source_roots;
 
 if ($genesis_release && !$dry_run) {
     remove_genesis_packages($repo_dir, 0);
@@ -835,6 +910,7 @@ if (!$dry_run && $RELEASE_BUMP ne '') {
     my @rmiss;
     for my $pkg (required_pkgs([sort keys %req], $skip_genesis, $skip_perl, $skip_xcat_dep)) {
         next if $pkg eq 'xCAT-genesis-base';
+        next if $native && $native->{nodes}{$pkg} && $native->{nodes}{$pkg}{type} eq 'publisher';
         my $rel = rpm_release($repo_dir, $pkg);
         next if !defined $rel;   # a missing rpm is caught by the completeness gate in deploy_target
         push @rmiss, "$pkg: Release '$rel' is missing the CD bump '$RELEASE_BUMP'"
@@ -940,6 +1016,21 @@ print "SRPM Tarball:          $srpm_tarball\n" if !$skip_tarball;
 # which dep builders run and which rpms the deployed repo must contain.
 sub target_profile {
     my ($target) = @_;
+    if (my $native = openeuler_repo_subdir($target)) {
+        my ($version, $arch) = $target =~ /\Aopeneuler-(.*)-([^-]+)\z/;
+        die "Native target '$target' requires a $arch build host, found $host_arch\n"
+            unless $arch eq $host_arch;
+        return {
+            rel          => $version,
+            arch         => $arch,
+            noarch_cfg   => $target,
+            forcearch    => 0,
+            epel         => 0,
+            dep_builders => [qw(grub2-xcat ipmitool-xcat syslinux-xcat goconserver conserver-xcat xnba-undi python3-scp)],
+            required     => [qw(ipmitool-xcat syslinux-xcat grub2-xcat xnba-undi
+                                perl-IO-Stty perl-HTTP-Async perl-Net-HTTPS-NB)],
+        };
+    }
     if (my $fa = $forcearch_targets{$target}) {
         return {
             %{$fa},
@@ -969,9 +1060,11 @@ sub target_profile {
 # overwrite one the host already has.
 sub install_mock_cfg {
     my ($cfg) = @_;
-    my $src = "$repo_root/mock-configs/$cfg.cfg";
+    install_mock_cfg('templates/openeuler-lts-xcat') if $cfg =~ /^openeuler-/;
+    my $extension = $cfg =~ m{^templates/} ? 'tpl' : 'cfg';
+    my $src = "$repo_root/mock-configs/$cfg.$extension";
     return if !-f $src;
-    my $dst = "/etc/mock/$cfg.cfg";
+    my $dst = "/etc/mock/$cfg.$extension";
     if (-f $dst) {
         die "$dst differs from $src: the build would not use the configuration shipped in this"
           . " tree. Remove or update the host copy (it is never overwritten here) and rerun.\n"
@@ -984,6 +1077,145 @@ sub install_mock_cfg {
     chmod 0644, $dst;
 }
 
+sub source_rpm_build_command {
+    my ($builder, $target, $uniqueext, $result, $log, $work) = @_;
+    my $cfg = "$work/mock-deterministic.cfg";
+    if (!$dry_run) {
+        make_path($work, $result);
+        open my $fh, '>', $cfg or die "Cannot write $cfg: $!\n";
+        print {$fh} "include('/etc/mock/$target.cfg')\n";
+        print {$fh} "config_opts['environment']['SOURCE_DATE_EPOCH'] = '$SOURCE_DATE_EPOCH'\n";
+        close $fh or die "Cannot close $cfg: $!\n";
+    }
+    my $mock = join(' ', 'mock', '-r', sh_quote($cfg), '--uniqueext', sh_quote($uniqueext),
+        '--define', sh_quote('use_source_date_epoch_as_buildtime 1'),
+        '--define', sh_quote('clamp_mtime_to_source_date_epoch 1'),
+        '--define', sh_quote('_buildhost xcat-build'));
+    $mock .= join('', map { ' --define ' . sh_quote($_) } @{$builder->{defines} // []});
+    my $srpm = sh_quote($builder->{srpm});
+    my $prefix = '';
+    if ($RELEASE_BUMP ne '' || @{$builder->{patches} // []} || @{$builder->{defines} // []}) {
+        my $top = "$work/restamp";
+        if (!$dry_run) {
+            make_path(map { "$top/$_" } qw(BUILD BUILDROOT RPMS SOURCES SPECS SRPMS));
+        }
+        run_step(step => "Unpack source RPM: $builder->{name}",
+            cmd => 'rpm -i --define ' . sh_quote("_topdir $top") . " $srpm",
+            log => "$log/srpm-unpack.log");
+        my @specs = $dry_run ? ("$top/SPECS/*.spec") : bsd_glob("$top/SPECS/*.spec");
+        die "Expected one spec in source RPM: $builder->{srpm}\n" unless @specs == 1;
+        bump_dep_release_suffix($top, $RELEASE_BUMP) if !$dry_run && $RELEASE_BUMP ne '';
+        for my $patch (@{$builder->{patches} // []}) {
+            my $path = $patch->{staged} // $patch->{absolute_path};
+            die "Source patch SHA256 mismatch: $path\n" unless digest_file($path) eq $patch->{sha256};
+            run_step(step => "Apply native source patch: $builder->{name}",
+                cmd => 'patch --batch --fuzz=0 -p1 -d ' . sh_quote("$top/SPECS")
+                    . ' -i ' . sh_quote($path), log => "$log/spec-patch.log");
+        }
+        my $restamped = "$work/restamp-srpm";
+        make_path($restamped) unless $dry_run;
+        $prefix = "$mock --buildsrpm --spec " . sh_quote($specs[0])
+            . ' --sources ' . sh_quote("$top/SOURCES") . ' --resultdir ' . sh_quote($restamped)
+            . ' && set -- ' . sh_quote($restamped) . '/*.src.rpm'
+            . ' && test "$#" -eq 1 && test -f "$1" && ';
+        $srpm = '"$1"';
+    }
+    return $prefix . "$mock --rebuild $srpm --resultdir " . sh_quote($result);
+}
+
+sub native_owner_command {
+    my ($plan, $target, $command, $uid) = @_;
+    my $overlay = $plan->{overlays}{$uid} // die "Missing native mock overlay\n";
+    my $script = 'mount --bind ' . sh_quote($overlay) . ' ' . sh_quote("/etc/mock/$target.cfg")
+        . ' && exec sh -c ' . sh_quote($command);
+    return 'unshare --mount --propagation private -- sh -c ' . sh_quote($script);
+}
+
+sub native_overlay {
+    my ($plan, $target, $work, $prereqs) = @_;
+    $plan->{overlays} = {1000 => "$work/native-1000.cfg", 0 => "$work/native-genesis-0.cfg",
+        procenv => "$work/native-procenv-bootstrap.cfg"};
+    return if $dry_run;
+    my $base = "$work/native-base.cfg";
+    copy("/etc/mock/$target.cfg", $base) or die "Cannot snapshot native mock configuration: $!\n";
+    my $url = $prereqs;
+    $url =~ s{([^A-Za-z0-9_./~-])}{sprintf('%%%02X', ord($1))}ge;
+    my $repo = "\n[xcat-native-inputs]\nname=xCAT native build prerequisites\nbaseurl=file://$url\n"
+        . "gpgkey=file://$url/repodata/repomd.xml.key\ngpgcheck=1\nrepo_gpgcheck=1\n"
+        . "enabled=1\nskip_if_unavailable=0\n";
+    for my $key (1000, 0, 'procenv') {
+        my $uid = $key eq 'procenv' ? 1000 : $key;
+        open my $fh, '>', $plan->{overlays}{$key} or die "Cannot write native overlay: $!\n";
+        print {$fh} 'include(' . JSON::PP->new->encode($base) . ")\n";
+        print {$fh} "config_opts['chrootuid'] = $uid\nconfig_opts['chrootgid'] = 1000\n";
+        print {$fh} "config_opts['dnf.conf'] += \"\"\"$repo\"\"\"\n";
+        print {$fh} "config_opts['plugin_conf']['bind_mount_enable'] = True\n";
+        print {$fh} "config_opts['plugin_conf']['procenv_enable'] = " . ($key eq 'procenv' ? 'False' : 'True') . "\n";
+        print {$fh} "config_opts['plugin_conf']['bind_mount_opts']['dirs'].append("
+            . '(' . JSON::PP->new->encode($prereqs) . ', ' . JSON::PP->new->encode($prereqs) . "))\n";
+        close $fh or die "Cannot close native overlay: $!\n";
+    }
+    open my $ledger, '>', "$work/native-overlays.json" or die "Cannot record native overlays: $!\n";
+    print {$ledger} JSON::PP->new->canonical->pretty->encode({base => {path => $base, sha256 => digest_file($base)},
+        overlays => [map { {purpose => $_, path => $plan->{overlays}{$_}, sha256 => digest_file($plan->{overlays}{$_})} } (1000, 0, 'procenv')]});
+    close $ledger or die "Cannot close native overlay ledger: $!\n";
+}
+
+sub build_native_inputs {
+    my ($plan, $target, $req, $work, $logs) = @_;
+    my $prereqs = "$work/native-prerequisites";
+    my $runtime = "$work/native-runtime";
+    my @source_roots;
+    make_path($prereqs, $runtime) unless $dry_run;
+    for my $name (@{$plan->{order}}) {
+        my $node = $plan->{nodes}{$name};
+        next unless $node->{type} eq 'publisher';
+        next if $dry_run;
+        verify_input($plan, $node, $node->{staged}, $plan->{trust_db});
+        copy($node->{staged}, "$prereqs/" . basename($node->{staged})) or die "Cannot stage publisher RPM: $!\n";
+        if ($req->{$name}) {
+            copy($node->{staged}, "$runtime/" . basename($node->{staged})) or die "Cannot collect publisher RPM: $!\n";
+        }
+    }
+    sign_and_index_repo($prereqs, $plan) unless $dry_run;
+    native_overlay($plan, $target, $work, $prereqs);
+    my $sequence = 0;
+    for my $name (@{$plan->{order}}) {
+        my $node = $plan->{nodes}{$name};
+        next unless $node->{type} eq 'srpm';
+        my $result = "$work/native-results/$name";
+        my $log = "$logs/native/$name";
+        my $uniqueext = build_mock_uniqueext("$target-$run_id", ++$sequence, $name);
+        my %builder = (%$node, srpm => $node->{staged} // "$work/native-inputs/$name/" . basename($node->{url}));
+        my $command = source_rpm_build_command(\%builder, $target, $uniqueext, $result, $log,
+            "$work/native-source/$name");
+        run_step(step => "Build native prerequisite: $name", log => "$log/run.log",
+            cmd => native_owner_command($plan, $target, $command, $name eq 'procenv' ? 'procenv' : 1000));
+        next if $dry_run;
+        my @rpms = grep { !/\.src\.rpm$/ } bsd_glob("$result/*.rpm");
+        validate_outputs($node, \@rpms, 1);
+        for my $rpm (@rpms) {
+            my $base = basename($rpm);
+            die "Conflicting native prerequisite artifact: $base\n" if -e "$prereqs/$base";
+            copy($rpm, "$prereqs/$base") or die "Cannot stage native prerequisite: $!\n";
+            my $id = rpm_identity($rpm);
+            copy($rpm, "$runtime/$base") or die "Cannot collect native output: $!\n" if $req->{$id->{name}};
+        }
+        sign_and_index_repo($prereqs, $plan);
+        my @problems = verify_rpms_checksig($prereqs, $gpg_key_name, $gpg_home, $plan);
+        die "Native prerequisite signature failure: @problems\n" if @problems;
+        open my $ledger, '>>', "$work/native-results.jsonl" or die "Cannot record native result: $!\n";
+        print {$ledger} JSON::PP->new->canonical->encode({name => $name, source_sha256 => $node->{sha256},
+            defines => $node->{defines} // [], patches => [map { {path => $_->{path}, sha256 => $_->{sha256}} } @{$node->{patches} // []}],
+            outputs => [map { {name => rpm_identity($_)->{name}, unsigned_path => $_,
+                unsigned_sha256 => digest_file($_), signed_sha256 => digest_file("$prereqs/" . basename($_))} } @rpms]}) . "\n";
+        close $ledger or die "Cannot close native result ledger: $!\n";
+        push @source_roots, $result;
+        scrub_buildroot($target, $uniqueext, "$log/scrub.log") unless $keep_buildroots;
+    }
+    return ($runtime, \@source_roots);
+}
+
 # Assemble the built per-target repo into the deployable, signed per-EL layout
 # <repo-dep>/rh<rel>/<arch>: copy the binary rpms, sign, createrepo, and drop the
 # xcat-dep.repo / mklocalrepo.sh / buildinfo.txt (ready to push to xcat.org).
@@ -992,7 +1224,8 @@ sub deploy_target {
     my $rel   = $info->{rel};
     my $src   = $info->{repo_dir};
     my $tarch = $info->{profile}{arch};
-    my $dest  = "$repo_dep/rh$rel/$tarch";
+    my $subdir = openeuler_repo_subdir($tgt) // "rh$rel/$tarch";
+    my $dest  = "$repo_dep/$subdir";
     print_step("Deploy $tgt -> $dest");
     return if $dry_run;
 
@@ -1020,8 +1253,8 @@ sub deploy_target {
         # rpm an earlier layout left in the collection. On the STAGE, so the published cell is
         # already correct when it is swapped in.
         remove_genesis_packages($stage, 0) if $genesis_release;
-        sign_and_index_repo($stage);
-        write_dep_repo_metadata($stage, $rel, $tarch);
+        sign_and_index_repo($stage, $NATIVE_PLANS{$tgt});
+        write_dep_repo_metadata($stage, $rel, $tarch, $subdir);
         # Automatic completeness + signature gate on the freshly signed cell -- the single
         # consolidated gate (verify_target_repo, the same one --verify-repo runs). Asserts every
         # manifest-required package is present at its pinned version, the repomd signature verifies,
@@ -1051,7 +1284,7 @@ sub deploy_target {
     remove_tree($old) if -d $old;
 
     my $n = scalar(grep { !/\.src\.rpm$/ } bsd_glob("$dest/*.rpm"));
-    print "Deployed rh$rel/$tarch: $n rpms\n";
+    print "Deployed $subdir: $n rpms\n";
 }
 
 sub publish_genesis_common_repo {
@@ -1176,8 +1409,22 @@ sub createrepo_c_cmd {
 }
 
 sub sign_and_index_repo {
-    my ($dir) = @_;
+    my ($dir, $native) = @_;
     my @rpms = grep { !/\.src\.rpm$/ } bsd_glob("$dir/*.rpm");
+    if ($native) {
+        my @built;
+        for my $rpm (@rpms) {
+            my $id = rpm_identity($rpm);
+            my $owner = $native->{outputs}{$id->{name}} // die "Undeclared native output: $id->{name}\n";
+            my $node = $native->{nodes}{$owner};
+            if ($node->{type} eq 'publisher') {
+                die "Publisher input changed before signing: $rpm\n" unless digest_file($rpm) eq $node->{sha256};
+            } else {
+                push @built, $rpm;
+            }
+        }
+        @rpms = @built;
+    }
     if ($gpg_sign && @rpms) {
         local $ENV{GNUPGHOME} = $gpg_home if $gpg_home;
         run_simple('rpmsign --define ' . shell_quote("%_gpg_name $gpg_key_name")
@@ -1191,21 +1438,26 @@ sub sign_and_index_repo {
         unlink "$repomd.asc" if -f "$repomd.asc";
         run_simple("gpg -a --detach-sign --default-key " . sh_quote($gpg_key_name) . ' ' . sh_quote($repomd));
         run_simple("gpg -a --export " . sh_quote($gpg_key_name) . " > " . sh_quote("$repomd.key"));
+        if ($native) {
+            run_simple('cat ' . sh_quote($native->{publisher_key}) . ' >> ' . sh_quote("$repomd.key"));
+        }
     }
 }
 
 sub write_dep_repo_metadata {
-    my ($dir, $rel, $tarch) = @_;
-    my $baseurl = "https://xcat.org/files/xcat/repos/yum/devel/xcat-dep/rh$rel/$tarch";
-    my $gpgcheck = $gpg_sign ? 1 : 0;
-    my $gpgkey_line = $gpg_sign ? "gpgkey=$baseurl/repodata/repomd.xml.key" : "# gpgkey=";
+    my ($dir, $rel, $tarch, $subdir) = @_;
+    $subdir //= "rh$rel/$tarch";
+    my $baseurl = "https://xcat.org/files/xcat/repos/yum/devel/xcat-dep/$subdir";
+    my $gpgcheck = $gpg_sign || $subdir =~ /^openeuler/ ? 1 : 0;
+    my $gpgkey_line = $gpgcheck ? "gpgkey=$baseurl/repodata/repomd.xml.key" : "# gpgkey=";
+    my $label = $subdir =~ /^openeuler/ ? $subdir : "rh$rel $tarch";
     # repo_gpgcheck=1 makes clients verify the DETACHED repomd.xml signature (repomd.xml.asc) against
     # gpgkey before trusting the metadata -- sign_and_index_repo produces both, so enforce it. Mirrors
     # gpgcheck: off when the repo is unsigned.
     open my $r, '>', "$dir/xcat-dep.repo" or die "Cannot write $dir/xcat-dep.repo: $!\n";
     print {$r} <<"EOF";
 [xcat-dep]
-name=xCAT 2 dependencies (rh$rel $tarch)
+name=xCAT 2 dependencies ($label)
 baseurl=$baseurl
 enabled=1
 gpgcheck=$gpgcheck
@@ -1215,7 +1467,7 @@ EOF
     close $r;
 
     write_local_repo_helper($dir);
-    write_buildinfo($dir, "rh$rel/$tarch");
+    write_buildinfo($dir, $subdir);
 }
 
 sub write_common_repo_metadata {
@@ -1273,6 +1525,10 @@ sub write_buildinfo {
     my $build_time = strftime("%a %b %e %H:%M:%S %Z %Y", gmtime($SOURCE_DATE_EPOCH));
     my $build_machine = `hostname`; chomp $build_machine;
     my $commit = `git -C "$repo_root" rev-parse HEAD 2>/dev/null`; chomp $commit;
+    if (!$commit && -f "$repo_root/Gitinfo") {
+        ($commit) = read_lines("$repo_root/Gitinfo");
+        $commit =~ s/\s+\z// if defined($commit);
+    }
     $commit ||= 'unknown';
     my $commit_short = substr($commit, 0, 7);
     my $release = strftime('snap%Y%m%d%H%M', gmtime($SOURCE_DATE_EPOCH));
@@ -1339,7 +1595,9 @@ Options:
                           the target is present at a version satisfying its pin AND that the repomd
                           is signed by --gpg-key-name; exits 0 if complete, or lists each MISSING/
                           VERSION/UNSIGNED/WRONGKEY problem and fails. The target is derived from the path
-                          (.../rh<N>/<arch> -> alma+epel-<N>-<arch>) unless --target is given; the
+                          (.../rh<N>/<arch> -> alma+epel-<N>-<arch>, or
+                          .../openeuler<releaseSP>/<arch> -> openeuler-<releaseSP>-<arch>)
+                          unless --target is given; the
                           manifest and gpg key/home come from the usual options. Use alone.
   --no-verify-repo        Suppress the AUTOMATIC post-build completeness+signature gate that runs
                           after each target's repo is finalized (default: verification ON)
@@ -1349,7 +1607,12 @@ Options:
   --target NAME           Build only this target (<ID>+epel-<REL>-<ARCH>, or a forcearch
                           config from mock-configs/ such as rocky-10-riscv64-xcat, which
                           cross-builds that arch on this host); default is the host arch
-                          across rh8, rh9 and rh10
+                          across rh8, rh9 and rh10. On openEuler the default retains the exact
+                          host release and service pack, e.g. openeuler-24.03sp3-x86_64.
+                          Native targets require the matching host architecture and deploy to
+                          <repo-dep>/openeuler<releaseSP>/<arch> with signature checks enabled.
+                          The build host must provide mock and its Perl dependencies; openEuler
+                          24.03 LTS-SP3 can build older releases in their exact native targets.
   --nproc N               Parallel jobs for buildrpms.pl (default: 1)
   --parallel-builds N     Max concurrent top-level build steps within one EL target (default: auto)
   --parallel-targets N    Concurrent EL targets (rh8/rh9/rh10). 0/auto = all at once, 1 = serial,
@@ -1669,7 +1932,7 @@ sub rpm_vercmp_segment {
 # check: it verifies each rpm's header/payload digests AND that the signature is by this key (NOKEY /
 # NOT OK => a real failure, since the key IS imported). Returns @problems.
 sub verify_rpms_checksig {
-    my ($dir, $keyname, $home) = @_;
+    my ($dir, $keyname, $home, $native) = @_;
     my @rpms = grep { !/\.src\.rpm$/ } glob("$dir/*.rpm");
     return () unless @rpms;
     require_command('rpmkeys');
@@ -1682,9 +1945,27 @@ sub verify_rpms_checksig {
     my $dbopt = '--dbpath ' . sh_quote($tmpdb);
     system("rpmkeys $dbopt --import " . sh_quote($keyfile) . ' >/dev/null 2>&1') == 0
         or return ("SIGKEY: rpmkeys --import of '$keyname' into the temp keyring failed");
+    my $publisher_db;
+    if ($native) {
+        my $trust = tempdir('native-publisher-XXXXXXXX', TMPDIR => 1, CLEANUP => 1);
+        my $ok = eval { $publisher_db = publisher_trust($native, $trust); 1; };
+        return ("SIGKEY: $@") unless $ok;
+    }
     my @problems;
     for my $rpm (@rpms) {
-        my $out = `rpmkeys $dbopt --checksig -v ${\ sh_quote($rpm)} 2>&1`;
+        my $rpm_dbopt = $dbopt;
+        if ($native) {
+            my $id = rpm_identity($rpm);
+            my $owner = $native->{outputs}{$id->{name}};
+            if (!$owner) { push @problems, "Undeclared native output: $id->{name}"; next; }
+            my $node = $native->{nodes}{$owner};
+            if ($node->{type} eq 'publisher') {
+                my $ok = eval { verify_input($native, $node, $rpm, $publisher_db); 1; };
+                push @problems, $@ unless $ok;
+                next;
+            }
+        }
+        my $out = `rpmkeys $rpm_dbopt --checksig -v ${\ sh_quote($rpm)} 2>&1`;
         push @problems, rpmkeys_checksig_problem(basename($rpm), $? >> 8, $out);
     }
     return @problems;
@@ -1725,6 +2006,7 @@ sub verify_target_repo {
     my %MAN = read_manifest($manifest);
     my %req = %{ $MAN{$tgt} // {} };
     die "FATAL: no manifest section for target '$tgt' in $manifest\n" if !%req;
+    my $native;
     # The WHOLE manifest, deliberately -- the --skip-* flags are NOT applied here. They say what
     # this INVOCATION built; they never say what the verified repository may be missing. Honouring
     # them let a repo with no xCAT-genesis-base pass whenever the verifying run happened to carry
@@ -1738,6 +2020,10 @@ sub verify_target_repo {
     my %present_evr = map { $_ => rpm_evr($dir, $_) } @names;
     my %expected = map { $_ => $req{$_} } @names;
     my @problems = verify_repo_packages(\%expected, \%present, \%present_evr, \&rpm_vercmp_segment);
+    if ($tgt eq 'openeuler-24.03-ppc64le') {
+        eval { $native = load_inputs($repo_root, \%req); 1 }
+            or push @problems, "Native input catalog: $@";
+    }
 
     # Signature gate: the IO (gpg) lives here; the decision is the pure verify_repo_signature. The
     # pipeline always signs, so a signed repo's repomd MUST be signed by --gpg-key-name. We resolve
@@ -1765,7 +2051,7 @@ sub verify_target_repo {
             require_command('rpm');
             # (a) RPM-native crypto verification: rpmkeys --checksig against an isolated keyring
             # holding only this key verifies every rpm's digests AND that the signature is by the key.
-            push @problems, verify_rpms_checksig($dir, $gpg_key_name, $gpg_home);
+            push @problems, verify_rpms_checksig($dir, $gpg_key_name, $gpg_home, $native);
             # (b) Explicit signer-id origin check kept alongside: assert each rpm's header signature
             # key id is one of this key's ids (primary/subkey).
             my $accept = gpg_key_ids($gpg_key_name, $gpg_home);
@@ -1773,7 +2059,7 @@ sub verify_target_repo {
                 push @problems, "SIGKEY: cannot list key ids for '$gpg_key_name' to verify per-rpm signatures";
             } else {
                 my @rpm_sigs = map { [ basename($_), rpm_signer_keyid($_) ] }
-                               grep { !/\.src\.rpm$/ } glob("$dir/*.rpm");
+                               grep { !/\.src\.rpm$/ && (!$native || !native_publisher_rpm($native, $_)) } glob("$dir/*.rpm");
                 push @problems, verify_rpm_signatures(\@rpm_sigs, $accept);
             }
         }
@@ -1794,6 +2080,13 @@ sub verify_target_repo {
     return 1;
 }
 
+sub native_publisher_rpm {
+    my ($plan, $rpm) = @_;
+    my $id = rpm_identity($rpm);
+    my $owner = $plan->{outputs}{$id->{name}} // return 0;
+    return $plan->{nodes}{$owner}{type} eq 'publisher';
+}
+
 # derive_target_from_repo_path: map a deployed per-target repo path .../rh<N>/<arch> to its manifest
 # target section name alma+epel-<N>-<arch>. Returns undef when the path lacks that rh<N>/<arch> tail,
 # so the standalone --verify-repo mode can require an explicit --target instead.
@@ -1802,6 +2095,9 @@ sub derive_target_from_repo_path {
     my $tgt;
     return $tgt unless defined $dir;
     $tgt = "alma+epel-$1-$2" if $dir =~ m{/rh(\d+)/([^/]+)/*$};
+    if ($dir =~ m{/openeuler((?:20|22|24)\.03(?:sp[1-9][0-9]*)?)/(x86_64|ppc64le)/*$}) {
+        $tgt = "openeuler-$1-$2";
+    }
     return $tgt;
 }
 
@@ -2150,4 +2446,3 @@ sub slurp_chomp {
     chomp $line if defined $line;
     return $line // '';
 }
-
diff --git a/openeuler/24.03-ppc64le.inputs.json b/openeuler/24.03-ppc64le.inputs.json
new file mode 100644
index 0000000..8c0af3c
--- /dev/null
+++ b/openeuler/24.03-ppc64le.inputs.json
@@ -0,0 +1,1123 @@
+{
+  "version": 1,
+  "target": "openeuler-24.03-ppc64le",
+  "publisher_key": {
+    "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/RPM-GPG-KEY-openEuler",
+    "sha256": "006e79d37c10e74c24df6d07c4efc4176515cec009daa5ed493b06f5b6ef39c1",
+    "fingerprint": "8AA16BF9F2CA5244010DCA963B477C60B675600B",
+    "path": "openeuler/RPM-GPG-KEY-openEuler-24.03-LTS"
+  },
+  "build_inputs": [
+    "perl-CPAN-Changes",
+    "perl-Class-Method-Modifiers",
+    "perl-Data-OptList",
+    "perl-Data-Section",
+    "perl-Devel-GlobalDestruction",
+    "perl-Devel-Symdump",
+    "perl-ExtUtils-CBuilder",
+    "perl-Import-Into",
+    "perl-MRO-Compat",
+    "perl-Module-Build",
+    "perl-Module-Runtime",
+    "perl-Moo",
+    "perl-Package-Generator",
+    "perl-Parallel-ForkManager",
+    "perl-Path-Class",
+    "perl-Pod-Coverage",
+    "perl-Role-Tiny",
+    "perl-Software-License",
+    "perl-Sub-Exporter",
+    "perl-Sub-Exporter-Progressive",
+    "perl-Sub-Install",
+    "perl-Sub-Quote",
+    "perl-Sub-Uplevel",
+    "perl-Test-Exception",
+    "perl-Test-Pod",
+    "perl-Test-Pod-Coverage",
+    "perl-Test-Warnings",
+    "perl-Text-Template",
+    "perl-XML-XPath",
+    "perl-inc-latest",
+    "python3-mock",
+    "python3-pbr",
+    "python3-wheel",
+    "procenv"
+  ],
+  "bootstrap_inputs": [
+    "mock",
+    "perl-Params-Util",
+    "python-psutil",
+    "python-pyroute2",
+    "perl-PerlIO-utf8_strict",
+    "perl-File-Slurper",
+    "procenv"
+  ],
+  "inputs": [
+    {
+      "name": "ksh",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/ksh-1.0.8-1.oe2403.src.rpm",
+      "sha256": "06d31f1ed0213f58d7009d5830bec3b3cb26878c4ae4deaeb8f8f4d74acb33fb",
+      "outputs": [
+        "ksh",
+        "ksh-debuginfo",
+        "ksh-debugsource"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "net-snmp",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/net-snmp-5.9.3-2.oe2403.src.rpm",
+      "sha256": "c6edbda654e5f4416e19c3f56004457daf72e4ae7058f118030c3442c486930b",
+      "outputs": [
+        "net-snmp",
+        "net-snmp-debuginfo",
+        "net-snmp-debugsource",
+        "net-snmp-devel",
+        "net-snmp-gui",
+        "net-snmp-help",
+        "net-snmp-libs",
+        "net-snmp-perl",
+        "python3-net-snmp"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "perl-DB_File",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/perl-DB_File-1.859-1.oe2403.src.rpm",
+      "sha256": "cce82dd316ed906fde94ec69e5d0298322dc4b14dba89dd3151c2823f404e8b3",
+      "outputs": [
+        "perl-DB_File",
+        "perl-DB_File-debuginfo",
+        "perl-DB_File-debugsource",
+        "perl-DB_File-help"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "perl-Digest-SHA1",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/perl-Digest-SHA1-2.13-27.oe2403.src.rpm",
+      "sha256": "2761ba4d7f43727908af232cd03b2d872f245380acfecc9cf7b65d0a2da83060",
+      "outputs": [
+        "perl-Digest-SHA1",
+        "perl-Digest-SHA1-debuginfo",
+        "perl-Digest-SHA1-debugsource",
+        "perl-Digest-SHA1-help"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "perl-IO-Tty",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/perl-IO-Tty-1.17-1.oe2403.src.rpm",
+      "sha256": "28a795eb3d834e10760dfa7e016e697c6e5c3acbdb35ee5c3971b44146c3e903",
+      "outputs": [
+        "perl-IO-Tty",
+        "perl-IO-Tty-debuginfo",
+        "perl-IO-Tty-debugsource",
+        "perl-IO-Tty-help"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "perl-Sys-Virt",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/perl-Sys-Virt-4.7.0-3.oe2403.src.rpm",
+      "sha256": "a7603e7e27afb1aa60c69852c583fc0837a895fd3975aabf7470013d4f798482",
+      "outputs": [
+        "perl-Sys-Virt",
+        "perl-Sys-Virt-debuginfo",
+        "perl-Sys-Virt-debugsource",
+        "perl-Sys-Virt-help"
+      ],
+      "needs": [
+        "perl-Params-Util",
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "nasm",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/nasm-2.16.01-1.oe2403.src.rpm",
+      "sha256": "0dac600e4da291eefb1986daabea54f9bf60aeeb5b8c8940faeb86dbcd20ea4a",
+      "outputs": [
+        "nasm",
+        "nasm-debuginfo",
+        "nasm-debugsource",
+        "nasm-help"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "docbook-style-dsssl",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/docbook-style-dsssl-1.79-28.oe2403.src.rpm",
+      "sha256": "9bc538924ce5c76e0006cd25cb1af34a3ea9b754bbd25c6fc1a65416274e5b4a",
+      "outputs": [
+        "docbook-style-dsssl",
+        "docbook-style-dsssl-help"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "docbook-utils",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/docbook-utils-0.6.14-47.oe2403.src.rpm",
+      "sha256": "2337c62d716bafcb90910f8a530d7a037ca6d93905d0b26cfb27a2d2ecf39d05",
+      "outputs": [
+        "docbook-utils",
+        "docbook-utils-help",
+        "docbook-utils-pdf"
+      ],
+      "needs": [
+        "docbook-style-dsssl",
+        "openjade",
+        "perl-SGMLSpm",
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "elinks",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/elinks-0.12-4.oe2403.src.rpm",
+      "sha256": "bd7e4695311b3eb259af15bb2a5c6154675de9cf07bf3b260591bb50ee19c40f",
+      "outputs": [
+        "elinks",
+        "elinks-debuginfo",
+        "elinks-debugsource",
+        "elinks-help"
+      ],
+      "needs": [
+        "lua",
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "help2man",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/help2man-1.49.3-1.oe2403.src.rpm",
+      "sha256": "438f7a27f86e4906d03cb1451e93b6ae189948a4287a2cbd3ce3aa75b83f7eec",
+      "outputs": [
+        "help2man",
+        "help2man-debuginfo",
+        "help2man-debugsource",
+        "help2man-help"
+      ],
+      "needs": [
+        "perl-gettext",
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "lua",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/lua-5.4.6-1.oe2403.src.rpm",
+      "sha256": "6e327bf54d114f3c6fb849a92fd8530e7d093d14e566cc9eca69e8ccd980f7ab",
+      "outputs": [
+        "lua",
+        "lua-debuginfo",
+        "lua-debugsource",
+        "lua-devel",
+        "lua-help"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "multilib-rpm-config",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/multilib-rpm-config-1-16.oe2403.src.rpm",
+      "sha256": "807e501bf7a52e868a69fdb5c412a996858c835596e90786279257a80b63c84c",
+      "outputs": [
+        "multilib-rpm-config"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "openjade",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/openjade-1.3.2-61.oe2403.src.rpm",
+      "sha256": "418003efee45c62a3c1576d960cfec704d328bf4c992362444c49ad9266955f2",
+      "outputs": [
+        "openjade",
+        "openjade-debuginfo",
+        "openjade-debugsource",
+        "openjade-help"
+      ],
+      "needs": [
+        "opensp",
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "opensp",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/opensp-1.5.2-31.oe2403.src.rpm",
+      "sha256": "12dcec9276c9234fb05424ee668f046e04c42e48300bf4c2f5c97d3182f48785",
+      "outputs": [
+        "opensp",
+        "opensp-debuginfo",
+        "opensp-debugsource",
+        "opensp-devel"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "perl-Data-UUID",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/perl-Data-UUID-1.226-1.oe2403.src.rpm",
+      "sha256": "bff5621c60eb5d5e883e222c4e4a6654f6b6babde1ecfbd350a9a82d4f986143",
+      "outputs": [
+        "perl-Data-UUID",
+        "perl-Data-UUID-debuginfo",
+        "perl-Data-UUID-debugsource",
+        "perl-Data-UUID-help"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "perl-SGMLSpm",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/perl-SGMLSpm-1.03ii-46.oe2403.src.rpm",
+      "sha256": "d64347233d55e1fed96b3f0956a6b6654875eed1bb691d19b381a824be5e48b6",
+      "outputs": [
+        "perl-SGMLSpm",
+        "perl-SGMLSpm-help"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "perl-gettext",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/perl-gettext-1.07-15.oe2403.src.rpm",
+      "sha256": "4c957422db0487ad914ce71dea89c81eb17d9ffd5fc4388cba79e4f449eb1146",
+      "outputs": [
+        "perl-Locale-gettext",
+        "perl-gettext-debuginfo",
+        "perl-gettext-debugsource",
+        "perl-gettext-help"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "uuid",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/uuid-1.6.2-47.oe2403.src.rpm",
+      "sha256": "208ec1a90ac611a11527eb813fe94bd8349085b9e10ac4d784c551933633a7f5",
+      "outputs": [
+        "uuid",
+        "uuid-c++",
+        "uuid-c++-devel",
+        "uuid-dce",
+        "uuid-dce-devel",
+        "uuid-debuginfo",
+        "uuid-debugsource",
+        "uuid-devel",
+        "uuid-help",
+        "uuid-perl"
+      ],
+      "needs": [
+        "perl-Data-UUID",
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "postgresql",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/postgresql-15.6-1.oe2403.src.rpm",
+      "sha256": "0e1dd792cccf353f7a0d7f3f9d13b1a22a7ace0a428f4b197193b99c58081960",
+      "outputs": [
+        "postgresql",
+        "postgresql-contrib",
+        "postgresql-debuginfo",
+        "postgresql-debugsource",
+        "postgresql-docs",
+        "postgresql-plperl",
+        "postgresql-plpython3",
+        "postgresql-pltcl",
+        "postgresql-private-devel",
+        "postgresql-private-libs",
+        "postgresql-server",
+        "postgresql-server-devel",
+        "postgresql-static",
+        "postgresql-test",
+        "postgresql-test-rpm-macros"
+      ],
+      "needs": [
+        "docbook-utils",
+        "elinks",
+        "help2man",
+        "multilib-rpm-config",
+        "procenv",
+        "uuid"
+      ],
+      "patches": [
+        {
+          "path": "postgresql/postgresql-15.6-openeuler-llvmjit-buildrequires.patch",
+          "sha256": "799a90eb82321722d11ffc421d4b09684f2939c44bfdc71a6c9b039a4f4d8592"
+        }
+      ],
+      "defines": [
+        "llvmjit 0",
+        "external_libpq 0",
+        "runselftest 1",
+        "test 1"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "perl-DBD-Pg",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/perl-DBD-Pg-3.18.0-1.oe2403.src.rpm",
+      "sha256": "5bb91b28459ee5754c031cf62471c86a887392587c261c8df61ab44e4c8caf09",
+      "outputs": [
+        "perl-DBD-Pg",
+        "perl-DBD-Pg-debuginfo",
+        "perl-DBD-Pg-debugsource",
+        "perl-DBD-Pg-help"
+      ],
+      "needs": [
+        "postgresql",
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "perl-CGI",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-CGI-4.57-1.oe2403.noarch.rpm",
+      "sha256": "98609a3a6c210a676a14960531cd5c82a86667da7aacea0c6e693ccbee612ee3",
+      "outputs": [
+        "perl-CGI"
+      ],
+      "needs": [],
+      "runtime": true
+    },
+    {
+      "name": "perl-CPAN-Changes",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-CPAN-Changes-0.400002-10.oe2403.noarch.rpm",
+      "sha256": "95c2a1939b26e201a07d128851b53a4fff7522b84f7a9ddb0947edf1f1ed2505",
+      "outputs": [
+        "perl-CPAN-Changes"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Class-Method-Modifiers",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Class-Method-Modifiers-2.15-1.oe2403.noarch.rpm",
+      "sha256": "e92f880e1a3eef95025938da643e07a05db0d7f2eda140a1fdaeef64d6c0a8a7",
+      "outputs": [
+        "perl-Class-Method-Modifiers"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Crypt-CBC",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Crypt-CBC-2.33-22.oe2403.noarch.rpm",
+      "sha256": "60f2dd1de7c4143301bcc1a35d52f3b69b3c40effe377a5740114d58a1205fc0",
+      "outputs": [
+        "perl-Crypt-CBC"
+      ],
+      "needs": [],
+      "runtime": true
+    },
+    {
+      "name": "perl-Data-OptList",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Data-OptList-0.114-1.oe2403.noarch.rpm",
+      "sha256": "68176d8117d5bbab5761e9b658465e96e01ecf5d6daa0e3cb400b45d77b3ecaf",
+      "outputs": [
+        "perl-Data-OptList"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Data-Section",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Data-Section-0.200007-6.oe2403.noarch.rpm",
+      "sha256": "fb307d87653b15130f0bb0480761a7e86eed8052399977f9a811977b10792f62",
+      "outputs": [
+        "perl-Data-Section"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Devel-GlobalDestruction",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Devel-GlobalDestruction-0.14-8.oe2403.noarch.rpm",
+      "sha256": "f141968f5359ed78945f08b042782889f3ff30b0d41a8ed8e9a284f1ecb80c54",
+      "outputs": [
+        "perl-Devel-GlobalDestruction"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Devel-Symdump",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Devel-Symdump-2.18-9.oe2403.noarch.rpm",
+      "sha256": "a304653f87360e565bb40f91569ccf168535f8b9e801536da9f5993cc5ca15c7",
+      "outputs": [
+        "perl-Devel-Symdump"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Expect",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Expect-1.35-7.oe2403.noarch.rpm",
+      "sha256": "a99336a76e9c9245026e7e4dc8cbddd5386dce30de91de0013905cbc9cbe9a41",
+      "outputs": [
+        "perl-Expect"
+      ],
+      "needs": [],
+      "runtime": true
+    },
+    {
+      "name": "perl-ExtUtils-CBuilder",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-ExtUtils-CBuilder-0.280236-1.oe2403.noarch.rpm",
+      "sha256": "fa99812f5cfff7d24fcbc98b40741db286e1dcfb4412ad9cdcf47fcf7722a474",
+      "outputs": [
+        "perl-ExtUtils-CBuilder"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-HTML-Form",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-HTML-Form-6.11-1.oe2403.noarch.rpm",
+      "sha256": "163a17e21393bb97e8c2e16b9ac163aea99983c294ded47c00f98998bcb1caff",
+      "outputs": [
+        "perl-HTML-Form"
+      ],
+      "needs": [],
+      "runtime": true
+    },
+    {
+      "name": "perl-Import-Into",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Import-Into-1.002005-2.oe2403.noarch.rpm",
+      "sha256": "a5bad0bbf3e5ae2789857799114f84867b7c93044b233754d238dd97b2ad563d",
+      "outputs": [
+        "perl-Import-Into"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-LWP-Protocol-https",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-LWP-Protocol-https-6.10-1.oe2403.noarch.rpm",
+      "sha256": "ee20297e3736754b5751b4160ac9a236d2d876a5bc85a7ba7bada51928bf9f74",
+      "outputs": [
+        "perl-LWP-Protocol-https"
+      ],
+      "needs": [],
+      "runtime": true
+    },
+    {
+      "name": "perl-MRO-Compat",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-MRO-Compat-0.15-1.oe2403.noarch.rpm",
+      "sha256": "3c0bb3b8a227e1682c262fb3456179da9bd2f50f47665c421104944cdb0bb0da",
+      "outputs": [
+        "perl-MRO-Compat"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Mail-Sender",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Mail-Sender-0.903-9.oe2403.noarch.rpm",
+      "sha256": "dcf401ee82064f8c06e6e22b8e28f24be97600b197ca0bc3fc3fb8883ca6f5f7",
+      "outputs": [
+        "perl-Mail-Sender"
+      ],
+      "needs": [],
+      "runtime": true
+    },
+    {
+      "name": "perl-Module-Build",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Module-Build-0.42.34-1.oe2403.noarch.rpm",
+      "sha256": "db8163ae929ca61af611d2f13e8f9b946011ecad34811a36a5bdbe4ba74dae93",
+      "outputs": [
+        "perl-Module-Build"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Module-Runtime",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Module-Runtime-0.016-5.oe2403.noarch.rpm",
+      "sha256": "87a0baf3236ccc778749c60992a79f1fdc5f4ebdb28f6f55927d0360ad37468c",
+      "outputs": [
+        "perl-Module-Runtime"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Moo",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Moo-2.005005-1.oe2403.noarch.rpm",
+      "sha256": "277a6477d7fe6320d3b487f38f245fc468abf94e9a5b75c134c8a941488ae529",
+      "outputs": [
+        "perl-Moo"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Net-DNS",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Net-DNS-1.40-1.oe2403.noarch.rpm",
+      "sha256": "c6d9932ccfaae2e515635b00204e86b5121516f5693d4fb345ae0d979bfbde23",
+      "outputs": [
+        "perl-Net-DNS"
+      ],
+      "needs": [],
+      "runtime": true
+    },
+    {
+      "name": "perl-Package-Generator",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Package-Generator-1.106-14.oe2403.noarch.rpm",
+      "sha256": "b9a424e6e083920b5000482637b62f617eb31808285ad86c09727e4f6d2c3fa8",
+      "outputs": [
+        "perl-Package-Generator"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Parallel-ForkManager",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Parallel-ForkManager-2.02-2.oe2403.noarch.rpm",
+      "sha256": "f406916c07bc1c59cb83080c91b308aa0a3e560825b948f44d02d6f93b5f9050",
+      "outputs": [
+        "perl-Parallel-ForkManager"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Path-Class",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Path-Class-0.37-14.oe2403.noarch.rpm",
+      "sha256": "aa2a7bc7789bfa34becdc8d98ad2263091cce2065776ab670802b20b72e497ce",
+      "outputs": [
+        "perl-Path-Class"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Pod-Coverage",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Pod-Coverage-0.23-16.oe2403.noarch.rpm",
+      "sha256": "d55a851604e72bd8eae598883b6d07f7795bde516b6a82e9af2654294412e3d0",
+      "outputs": [
+        "perl-Pod-Coverage"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Role-Tiny",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Role-Tiny-2.002004-1.oe2403.noarch.rpm",
+      "sha256": "058122267ea240407d97677450d50e251708d88dd9edf11a0e9cc3dfe813389d",
+      "outputs": [
+        "perl-Role-Tiny"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Software-License",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Software-License-0.104001-2.oe2403.noarch.rpm",
+      "sha256": "511ad1cd11c7acd42798f05662d8732c67bb5780bde034912102b9b9628e96f4",
+      "outputs": [
+        "perl-Software-License"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Sub-Exporter",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Sub-Exporter-0.990-1.oe2403.noarch.rpm",
+      "sha256": "1bad67d715ab6ff15e4add9f0c41b2e0f505ccc25ef0ca75ed75bcb1332d040b",
+      "outputs": [
+        "perl-Sub-Exporter"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Sub-Exporter-Progressive",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Sub-Exporter-Progressive-0.001013-8.oe2403.noarch.rpm",
+      "sha256": "dbb9b6a648ea82eaef58d6c60136e0e6101b54c40a1b6e346d85df46fd5947f4",
+      "outputs": [
+        "perl-Sub-Exporter-Progressive"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Sub-Install",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Sub-Install-0.929-1.oe2403.noarch.rpm",
+      "sha256": "5a828b848f5b730aaf30ffd9b2f7608cde97f69737bfb3abed4c7d6dd44a8e7b",
+      "outputs": [
+        "perl-Sub-Install"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Sub-Quote",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Sub-Quote-2.005001-4.oe2403.noarch.rpm",
+      "sha256": "f11b0e95c4ec3df9ed03ee923a127b2cc84794a740dbe521f3adbfc52c7ca401",
+      "outputs": [
+        "perl-Sub-Quote"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Sub-Uplevel",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Sub-Uplevel-0.2800-5.oe2403.noarch.rpm",
+      "sha256": "faa82aeb4f083ff0b4dac06a1219deacaf35ad6fc682ecbd91dfea8efbaaba74",
+      "outputs": [
+        "perl-Sub-Uplevel"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Test-Exception",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Test-Exception-0.43-10.oe2403.noarch.rpm",
+      "sha256": "ba94cb3100826ef941055017174d3b613416e785b04d20792725c17007a82361",
+      "outputs": [
+        "perl-Test-Exception"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Test-Pod",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Test-Pod-1.52-4.oe2403.noarch.rpm",
+      "sha256": "edcfbc73f8d1b848b5ff4e40699e74820f1f6c60f031f264381c29c6f01ba43a",
+      "outputs": [
+        "perl-Test-Pod"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Test-Pod-Coverage",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Test-Pod-Coverage-1.10-14.oe2403.noarch.rpm",
+      "sha256": "953f3ca4c78abc2ac4c63e2debece478409766c54e9a2ec08c2f8b1247505e4b",
+      "outputs": [
+        "perl-Test-Pod-Coverage"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Test-Warnings",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Test-Warnings-0.031-1.oe2403.noarch.rpm",
+      "sha256": "b152ba3fddab972447eb341a2cfd845d3851146d554605a02da2101d56387b8f",
+      "outputs": [
+        "perl-Test-Warnings"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Text-Template",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Text-Template-1.60-1.oe2403.noarch.rpm",
+      "sha256": "04012c8e50e8fca42b22feadc51ac84a03cb1811067cd88eadd97ed76c6138b0",
+      "outputs": [
+        "perl-Text-Template"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-XML-XPath",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-XML-XPath-1.47-1.oe2403.noarch.rpm",
+      "sha256": "4b4c440628ca82c3eaf997b2b52b38e243cb52eb3e6cc8296a858a0905008ea6",
+      "outputs": [
+        "perl-XML-XPath"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-inc-latest",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-inc-latest-0.500-12.oe2403.noarch.rpm",
+      "sha256": "46df92ce44f1dcb654642b42650dc790455dbb82d6a8594d70227c406874d82b",
+      "outputs": [
+        "perl-inc-latest"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "python3-mock",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/python3-mock-5.1.0-1.oe2403.noarch.rpm",
+      "sha256": "2cf15ae56a3c01b85be156c939cc4c26d3b0a48f67327e4089484d11c8d719a5",
+      "outputs": [
+        "python3-mock"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "python3-pbr",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/python3-pbr-6.0.0-1.oe2403.noarch.rpm",
+      "sha256": "b841a0ee0421804080a2a9dd1b58991b59098b61eaf50ea5cee08e74b245ee1d",
+      "outputs": [
+        "python3-pbr"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "python3-wheel",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/python3-wheel-0.40.0-1.oe2403.noarch.rpm",
+      "sha256": "a5f12a955d77f97f571d9d2253b845976ec52b14cb0ed2e1f22504941e2093c6",
+      "outputs": [
+        "python3-wheel"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "mock",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/mock-2.2-2.oe2403.src.rpm",
+      "sha256": "15aee65d6d6284522c3c777c2355a7b4310a706bbff4a99d227c9917e32873db",
+      "outputs": [
+        "mock",
+        "mock-plugins"
+      ],
+      "build_uid": 1000,
+      "needs": [
+        "procenv",
+        "python-psutil",
+        "python-pyroute2"
+      ]
+    },
+    {
+      "name": "perl-Params-Util",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/perl-Params-Util-1.07-26.oe2403.src.rpm",
+      "sha256": "66a4363f542e00063dbc37e0b5abe42c9537c2f54c3e1d1d8290772d4d3f1824",
+      "outputs": [
+        "perl-Params-Util",
+        "perl-Params-Util-debuginfo",
+        "perl-Params-Util-debugsource",
+        "perl-Params-Util-help"
+      ],
+      "build_uid": 1000,
+      "needs": [
+        "procenv"
+      ]
+    },
+    {
+      "name": "python-psutil",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/python-psutil-5.9.5-1.oe2403.src.rpm",
+      "sha256": "f0dc3859323b5e769cc8d3910d1d19645f6c868f152e9053fedd59a279fdc27f",
+      "outputs": [
+        "python-psutil-debuginfo",
+        "python-psutil-debugsource",
+        "python3-psutil"
+      ],
+      "build_uid": 1000,
+      "needs": [
+        "procenv"
+      ]
+    },
+    {
+      "name": "python-pyroute2",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/python-pyroute2-0.7.9-2.oe2403.src.rpm",
+      "sha256": "4f42494d851c91bb2416254fdbfa04eb33acf23bd3507b5fc03ad62089db8bed",
+      "outputs": [
+        "python-pyroute2-help",
+        "python3-pyroute2"
+      ],
+      "build_uid": 1000,
+      "needs": [
+        "procenv"
+      ]
+    },
+    {
+      "name": "perl-PerlIO-utf8_strict",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/perl-PerlIO-utf8_strict-0.010-1.oe2403.src.rpm",
+      "sha256": "5f0749a94e7e42b68a4b5a8ad13b06696cc02cceb302924cdacbecaaa43209d8",
+      "outputs": [
+        "perl-PerlIO-utf8_strict",
+        "perl-PerlIO-utf8_strict-debuginfo",
+        "perl-PerlIO-utf8_strict-debugsource",
+        "perl-PerlIO-utf8_strict-help"
+      ],
+      "build_uid": 1000,
+      "needs": [
+        "procenv"
+      ]
+    },
+    {
+      "name": "perl-File-Slurper",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS-SP3/source/Packages/perl-File-Slurper-0.014-1.oe2403sp3.src.rpm",
+      "sha256": "7f0438344d8c191e74da13c26254f71374a32128ab9efc1d79705e9b00637c1e",
+      "outputs": [
+        "perl-File-Slurper",
+        "perl-File-Slurper-help"
+      ],
+      "needs": [
+        "perl-PerlIO-utf8_strict",
+        "perl-Test-Warnings",
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "procenv",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/procenv-0.60-1.oe2403.src.rpm",
+      "sha256": "4175affb56e6a39f6aac4ada813dee8802b3086807b17a1f9cd80e91717e7819",
+      "outputs": [
+        "procenv",
+        "procenv-debuginfo",
+        "procenv-debugsource"
+      ],
+      "build_uid": 1000,
+      "needs": []
+    },
+    {
+      "name": "perl-Crypt-Rijndael",
+      "type": "owner",
+      "outputs": [
+        "perl-Crypt-Rijndael",
+        "perl-Crypt-Rijndael-debuginfo",
+        "perl-Crypt-Rijndael-debugsource"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "perl-Crypt-SSLeay",
+      "type": "owner",
+      "outputs": [
+        "perl-Crypt-SSLeay",
+        "perl-Crypt-SSLeay-debuginfo",
+        "perl-Crypt-SSLeay-debugsource"
+      ],
+      "needs": [
+        "perl-Path-Class",
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "perl-HTTP-Async",
+      "type": "owner",
+      "outputs": [
+        "perl-HTTP-Async"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "perl-Net-HTTPS-NB",
+      "type": "owner",
+      "outputs": [
+        "perl-Net-HTTPS-NB"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "perl-Net-Telnet",
+      "type": "owner",
+      "outputs": [
+        "perl-Net-Telnet"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "ipmitool-xcat",
+      "type": "owner",
+      "outputs": [
+        "ipmitool-xcat",
+        "ipmitool-xcat-debuginfo",
+        "ipmitool-xcat-debugsource"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "syslinux-xcat",
+      "type": "owner",
+      "outputs": [
+        "syslinux",
+        "syslinux-debuginfo",
+        "syslinux-debugsource",
+        "syslinux-extlinux",
+        "syslinux-xcat"
+      ],
+      "needs": [
+        "nasm",
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "grub2-xcat",
+      "type": "owner",
+      "outputs": [
+        "grub2-xcat"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "xnba-undi",
+      "type": "owner",
+      "outputs": [
+        "xnba-undi"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 0
+    },
+    {
+      "name": "goconserver",
+      "type": "owner",
+      "outputs": [
+        "goconserver"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "xCAT-genesis-base",
+      "type": "owner",
+      "outputs": [
+        "xCAT-genesis-base-ppc64"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 0
+    },
+    {
+      "name": "perl-IO-Stty",
+      "type": "owner",
+      "outputs": [
+        "perl-IO-Stty"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    }
+  ]
+}
diff --git a/openeuler/RPM-GPG-KEY-openEuler-24.03-LTS b/openeuler/RPM-GPG-KEY-openEuler-24.03-LTS
new file mode 100644
index 0000000..efabcea
--- /dev/null
+++ b/openeuler/RPM-GPG-KEY-openEuler-24.03-LTS
@@ -0,0 +1,50 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQGNBGOROkcBDAC2S6JpeU5YFzMDp5zqpWoTQmDaVnNh4dsbCEJp+Z6p2v7Y7NmM
+iGzDYvScsa0nhM15SVJsrWYFkJB1rX+ESy7RRb1qGS5FznobzgUbhmMhpE0U/5+u
+hTcvjk7wpFn04+FHugvIZ5gjP0G48gYkJoOtKKtMYA5Uvl/w0uRI6++Vme6m4W/K
+Y2igg/JmRXSHhJHLQFICtQSZWw0kvWr6EUhmnFayzB6teKwJivJzJKHBTOgiSq5h
+Q4BEcOJz0jmF4xOvpXIBB2mIb191DSXm9kadyRBZMDfw1Nqgmhhw40BRlt4hsV8k
+yKymCFqm9M48NwY99/8Cfms4IXfD9XiF7nVj8+e5CcXeEGFWatZD2nCHTAkyah2L
+Ukqe372pnQyCBvDIwkxTha/LWIVXU3eIMbSOz2dLht55yb+TNhOgK1b4xjhq6RWz
+BpGjReU8RDtghVZkelt+mBZA8HPR81DoUuAm4vQuaxKecl44FdhzeUkCVDyA6ubh
+kY5LQQBwIR7X+68AEQEAAbQkb3BlbmV1bGVyIDxvcGVuZXVsZXJAY29tcGFzcy1j
+aS5jb20+iQHNBBMBCAA3FiEEiqFr+fLKUkQBDcqWO0d8YLZ1YAsFAmOROkcCGwMF
+CwkIBwIGFQoJCAsCAxYCAQIeAQIXgAAKCRA7R3xgtnVgCzyEC/9L7TMRYC6xK2Dn
+BetWLGBYag2YQmIIPUqZLFmq7RDiyAeVgFfk3TQj7AQryp3Cg63pxGH3YEOmU2B+
+6s9advYUzEokd9DpiZoOKnNRK7EXb1aDw1Ujgd9xH4FgTNiUUxnkrb5Rlf3U5uSI
+moqTwHuagBm9JP3xDllFFyo++w/23pQpoFMza4DiGrfVRor/oqfkmuKnimxg2naU
+iAD4kO25O9Css9cgKrKNN06iuLPW0txqV9t2WfUsP28Lj+QE0yFaxlCokVbD0PSy
+L1GKZszWMN+95NuEwrD8VeEzOrji7MqTjpWmzq70O4tyzyEHlCXizhQo/6HrDVPF
+2npcCFYkxd53LmfW0MuRdEETf7hbIC0+ViD7mX55i3Z3x4MWb2X2zPl+r8yHiQsZ
+Y/wm2sPWZb7jBm8up3c+xIoJZv5yoEX7JMFtiwpEMYJhyNKhgeQ4M3hi3v4q6rIL
+QoCyujyENpr/opHL0EXFkUVvA3AUh+DR8cUiAo7X1pmJjKuRdEW5AY0EY5E6ygEM
+AMj+qR7eLSdfDkcuPkSYqvzVcaYHpBwKn6ax9QTtR6UfONbg5CGQOU90RGH8xBix
+bHf3VvIqt00x9dRW36mwLR/+CP/FJyqchC6Wh2k0SEJ5HR4frsWmOOHcT7wK150D
+uTsyuWF4DidtvWtV1sgMZQcg66iFsPbdyTGaIolXij+4tv2TJgo9468MI0gFOY+0
+2B6vluyB9k9nKNwEzH1cQCcDXa1r3P0f8iMNoojvSHZPKF9uAtUrnWULd3At+Nui
+AI3H6rc7MEp/mVGnGWbNEfpHcwHqafRuJsdQgYu0AYNPyh+NT82n+clNSh0RoYGI
+YLmPX+QBIIlsgcK3P8AZWjISKWtBRo5IJQWeB2BkMNrAKWpKUKn+nsWVaG4TZ8c+
+2oqpuO+6ol4lFhk0G7cVqW09OOQ/UNopEiXHbJvpAqzSKbuzmK+kLB67pp4/wS+w
+Os09t1o/m9qynMCCGmisNvVrWWmEiG/KaeFcQzzs9jVr9piGeGcxva70PbJew1hz
+qwARAQABiQNsBBgBCAAgFiEEiqFr+fLKUkQBDcqWO0d8YLZ1YAsFAmOROsoCGwIB
+wAkQO0d8YLZ1YAvA9CAEGQEIAB0WIQSBLhvcto+bdWqkjO8Af7dH+ze8bwUCY5E6
+ygAKCRAAf7dH+ze8b57HC/4sHZk0yhBlwMWdu0vQGE+e8W1FTkL6uF2TTsTAVmAX
+aIT3PrZJGiCfuqvdaYzArpEjWg6mk63esVs3//iGqsfQBKA6KhJgy4/daSKDnUlv
+RbzJXWFi2gd2FBvGZUvRb/otdA34UvdhHr5q5A6DqPsKu++lj6rqMdDI1RFPr70T
+N2Hd7xGevIWo620N/Hv884dkZ1QiJJ7d+BLavvLWwYy/l/c7NkwdMwFfqS1KMmLU
+Nw5opyBi57I9lhYQTqexa6Fvs5lSvtK+C6YRI6PDn+7tRyqYYQdDANeNzUkn5rBV
+ZGo5FuHlkyk0oKWX0kkYGLwaTV1BdTraeoYYywAJ59PC73pzCe4yBiQmDi6hsZ6D
+DJtrngrGwrYhq87cjBAhK94FpgPSN8CK2XiLcMjmOi8KmVnjb0F6jKH6G0sadNi5
+wm13Ec9XyrcggJUXmGBHQirHTyM3rkyI3C6xC2ZPbl6YxFyTbPruVJuFw2Cfivnk
+b0nMdbfgyoNpOr+BiPqasGzwOgwAogZCFEHPamnOov/Wk/iodTYpR3rV4IAJWBxy
+KLxZYZSf41cgTEZvOKIE2vP8jPnm/ag3T+qTEAsBSf1Y6w1ohLbifF4APq9WmJ8g
+kFuexEyHJUeivojUX2j1V+qDwLJU4EjRsAaLC5dkTf5nF04nwbdnF+qiBsG0bsVK
+V7sdKpbOEfFDQKe66bQ2n2t7jTVjOuS7sLRUx7bGLIEzj8mxhRNmxbXf/gb/Q0bw
+r9T5WxkQnTI6ZwH8t/dYDhMvwpWPCkPqwvY/JAzY3J++AE9oGVdBOu+q9xIkWX7w
+cy5VeGx2n/SLa+aNFXFi9FxyPHAozRnIM9ET8NuhEBncSgvlY1yjURmay8l0zCin
+TOmyCewwVi8TVz9wdrqrHAoItamu+y5mQgU4jinbxWBytzaQ6gmZUsoKHMNOYpOQ
+sg4mugUPR5Gv0xNn+1nZcVyL7nSGlxp7C0ujMVlBugKVR4091KizlHjfVrtuwRHG
+RvdQJiP2pHXAQpBJduIgGAQsGDCk
+=WmUf
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/packages-manifest.conf b/packages-manifest.conf
index d97d07a..6ea7058 100644
--- a/packages-manifest.conf
+++ b/packages-manifest.conf
@@ -171,6 +171,94 @@ perl-Net-DNS=0.80
 perl-Net-IP=1.26
 perl-Path-Class=0.37
 
+[openeuler-20.03sp4-x86_64]
+goconserver=>= 0.3.3-snap202011021058
+grub2-xcat=1.0
+ipmitool-xcat=>= 1.8.18-4
+syslinux-xcat=>= 6.03-1
+xnba-undi=>= 1.21.1-1
+perl-Crypt-Rijndael=1.13
+perl-Crypt-SSLeay=0.72
+perl-HTML-Form=6.07
+perl-HTTP-Async=>= 0.30-3
+perl-IO-Stty=>= 0.04-5
+perl-Net-HTTPS-NB=>= 0.14-3
+perl-Net-Telnet=3.04
+python3-scp=0.14.5
+xCAT-genesis-base=>= 2:2.18.0
+
+[openeuler-22.03sp4-x86_64]
+goconserver=>= 0.3.3-snap202011021058
+grub2-xcat=1.0
+ipmitool-xcat=>= 1.8.18-4
+syslinux-xcat=>= 6.03-1
+xnba-undi=>= 1.21.1-1
+perl-Crypt-Rijndael=1.13
+perl-Crypt-SSLeay=0.72
+perl-HTTP-Async=>= 0.30-3
+perl-IO-Stty=>= 0.04-5
+perl-Net-HTTPS-NB=>= 0.14-3
+perl-Net-Telnet=3.04
+xCAT-genesis-base=>= 2:2.18.0
+
+[openeuler-24.03sp3-x86_64]
+goconserver=>= 0.3.3-snap202011021058
+grub2-xcat=1.0
+ipmitool-xcat=>= 1.8.18-4
+syslinux-xcat=>= 6.03-1
+xnba-undi=>= 1.21.1-1
+perl-Crypt-Rijndael=1.13
+perl-Crypt-SSLeay=0.72
+perl-HTTP-Async=>= 0.30-3
+perl-IO-Stty=>= 0.04-5
+perl-Net-HTTPS-NB=>= 0.14-3
+perl-Net-Telnet=3.04
+xCAT-genesis-base=>= 2:2.18.0
+
+[openeuler-24.03sp4-x86_64]
+goconserver=>= 0.3.3-snap202011021058
+grub2-xcat=1.0
+ipmitool-xcat=>= 1.8.18-4
+syslinux-xcat=>= 6.03-1
+xnba-undi=>= 1.21.1-1
+perl-Crypt-Rijndael=1.13
+perl-Crypt-SSLeay=0.72
+perl-HTTP-Async=>= 0.30-3
+perl-IO-Stty=>= 0.04-5
+perl-Net-HTTPS-NB=>= 0.14-3
+perl-Net-Telnet=3.04
+xCAT-genesis-base=>= 2:2.18.0
+
+[openeuler-24.03-ppc64le]
+goconserver=>= 0.3.3-snap202011021058
+grub2-xcat=1.0
+ipmitool-xcat=>= 1.8.18-4
+syslinux-xcat=>= 6.03-1
+xnba-undi=>= 1.21.1-1
+perl-Crypt-Rijndael=1.13
+perl-Crypt-SSLeay=0.72
+perl-HTTP-Async=>= 0.30-3
+perl-IO-Stty=>= 0.04-5
+perl-Net-HTTPS-NB=>= 0.14-3
+perl-Net-Telnet=3.04
+xCAT-genesis-base=>= 2:2.18.0
+ksh=1.0.8
+net-snmp=5.9.3
+net-snmp-libs=5.9.3
+net-snmp-perl=5.9.3
+perl-DB_File=1.859
+perl-Digest-SHA1=2.13
+perl-IO-Tty=1.17
+perl-Sys-Virt=4.7.0
+perl-CGI=4.57
+perl-Crypt-CBC=2.33
+perl-Expect=1.35
+perl-HTML-Form=6.11
+perl-LWP-Protocol-https=6.10
+perl-Mail-Sender=0.903
+perl-Net-DNS=1.40
+perl-DBD-Pg=3.18.0
+
 # [common] is NOT a build target. It describes the SHARED repository the OpenEmbedded Genesis
 # release is published into (<repo-dep>/common), which lives beside the per-EL cells and is
 # therefore invisible to every [<target>] section above. Without it nothing asserted the published
diff --git a/postgresql/postgresql-15.6-openeuler-llvmjit-buildrequires.patch b/postgresql/postgresql-15.6-openeuler-llvmjit-buildrequires.patch
new file mode 100644
index 0000000..e47062e
--- /dev/null
+++ b/postgresql/postgresql-15.6-openeuler-llvmjit-buildrequires.patch
@@ -0,0 +1,14 @@
+--- a/postgresql.spec
++++ b/postgresql.spec
+@@ -78,7 +78,10 @@
+ Patch11: postgresql-datalayout-mismatch-on-s390.patch
+ Patch16: postgresql-pgcrypto-openssl3-tests.patch
+ 
+-BuildRequires: gcc clang
++BuildRequires: gcc
++%if %llvmjit
++BuildRequires: clang
++%endif
+ BuildRequires: perl(ExtUtils::MakeMaker) glibc-devel bison flex gawk
+ BuildRequires: perl(ExtUtils::Embed), perl-devel
+ BuildRequires: perl-generators
diff --git a/python-scp/python-scp-0.14.5-1.oe2403.src.rpm b/python-scp/python-scp-0.14.5-1.oe2403.src.rpm
new file mode 100644
index 0000000..4876bd1
Binary files /dev/null and b/python-scp/python-scp-0.14.5-1.oe2403.src.rpm differ
diff --git a/xnba/mockbuild.pl b/xnba/mockbuild.pl
index 7c1395a..da99bcd 100755
--- a/xnba/mockbuild.pl
+++ b/xnba/mockbuild.pl
@@ -7,6 +7,9 @@ use File::Basename qw(dirname);
 use File::Copy qw(copy);
 use File::Path qw(make_path remove_tree);
 use Getopt::Long qw(GetOptions);
+use FindBin qw($RealBin);
+use lib "$RealBin/..";
+use MockBuildUtils qw(restamp_release_line);
 
 my $script_dir = abs_path(dirname(__FILE__));
 my $repo_root  = abs_path("$script_dir/..");
@@ -20,6 +23,7 @@ my $mock_uniqueext = '';
 my $result_dir  = "$repo_root/build-output/list3/xnba-undi";
 my $log_dir     = "$repo_root/build-logs/list3/xnba-undi";
 my $build_timestamp;
+my $release_suffix = '';
 
 GetOptions(
     'work-dir=s'     => \$work_dir,
@@ -28,6 +32,7 @@ GetOptions(
     'result-dir=s'   => \$result_dir,
     'log-dir=s'      => \$log_dir,
     'build-timestamp=i' => \$build_timestamp,
+    'release-suffix=s' => \$release_suffix,
 ) or die usage();
 
 die "Run as root (current uid=$>)\n" if $> != 0;
@@ -133,6 +138,9 @@ install -m 644 binary/xnba.efi %{buildroot}/tftpboot/xcat/xnba.efi
 - Packaged pre-built xnba binaries for EL10
 SPEC
 
+$simple_spec = join('', map { (restamp_release_line($_, $release_suffix))[0] }
+    split(/(?<=\n)/, $simple_spec)) if $release_suffix ne '';
+
 open my $fh, '>', "$rpmbuild_top/SPECS/xnba-undi.spec"
     or die "Cannot write spec: $!\n";
 print $fh $simple_spec;
@@ -174,6 +182,7 @@ Options:
   --result-dir PATH     Output directory for RPMs
   --log-dir PATH        Output directory for logs
   --build-timestamp EPOCH  Unix timestamp for reproducible builds
+  --release-suffix STR  Append a suffix to the generated RPM Release
 USAGE
 }