From 0c0dfb787e70befd75a45f96aefaea5752fe0dac Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vin=C3=ADcius=20Ferr=C3=A3o?=
 <2031761+viniciusferrao@users.noreply.github.com>
Date: Mon, 21 Sep 2026 18:23:51 -0300
Subject: [PATCH] feat(openeuler): build native dependency packages

---
 .gitattributes                                |    1 +
 MockBuildUtils.pm                             |   24 +
 goconserver/mockbuild.pl                      |   76 +-
 goconserver/toolchains/go1.25.12.sha256       |    2 +
 grub2-xcat/grub2-xcat.spec                    |    3 +
 lib/XCAT/NativeInputs.pm                      |  291 +++++
 mock-configs/openeuler-20.03sp4-x86_64.cfg    |    7 +
 mock-configs/openeuler-22.03sp4-x86_64.cfg    |    7 +
 mock-configs/openeuler-24.03-ppc64le.cfg      |   15 +
 mock-configs/openeuler-24.03sp1-x86_64.cfg    |    8 +
 mock-configs/openeuler-24.03sp3-x86_64.cfg    |    8 +
 mock-configs/openeuler-24.03sp4-x86_64.cfg    |    8 +
 mock-configs/templates/openeuler-lts-xcat.tpl |   31 +
 mockbuild-all.pl                              |  355 +++++-
 openeuler/24.03-ppc64le.inputs.json           | 1123 +++++++++++++++++
 openeuler/RPM-GPG-KEY-openEuler-24.03-LTS     |   50 +
 packages-manifest.conf                        |   88 ++
 ...15.6-openeuler-llvmjit-buildrequires.patch |   14 +
 python-scp/python-scp-0.14.5-1.oe2403.src.rpm |  Bin 0 -> 25107 bytes
 xnba/mockbuild.pl                             |    9 +
 20 files changed, 2081 insertions(+), 39 deletions(-)
 create mode 100644 .gitattributes
 create mode 100644 goconserver/toolchains/go1.25.12.sha256
 create mode 100644 lib/XCAT/NativeInputs.pm
 create mode 100644 mock-configs/openeuler-20.03sp4-x86_64.cfg
 create mode 100644 mock-configs/openeuler-22.03sp4-x86_64.cfg
 create mode 100644 mock-configs/openeuler-24.03-ppc64le.cfg
 create mode 100644 mock-configs/openeuler-24.03sp1-x86_64.cfg
 create mode 100644 mock-configs/openeuler-24.03sp3-x86_64.cfg
 create mode 100644 mock-configs/openeuler-24.03sp4-x86_64.cfg
 create mode 100644 mock-configs/templates/openeuler-lts-xcat.tpl
 create mode 100644 openeuler/24.03-ppc64le.inputs.json
 create mode 100644 openeuler/RPM-GPG-KEY-openEuler-24.03-LTS
 create mode 100644 postgresql/postgresql-15.6-openeuler-llvmjit-buildrequires.patch
 create mode 100644 python-scp/python-scp-0.14.5-1.oe2403.src.rpm

diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..e520fca
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1 @@
+postgresql/postgresql-15.6-openeuler-llvmjit-buildrequires.patch whitespace=-blank-at-eol
diff --git a/MockBuildUtils.pm b/MockBuildUtils.pm
index aa9065b..7b09013 100644
--- a/MockBuildUtils.pm
+++ b/MockBuildUtils.pm
@@ -21,6 +21,7 @@ our @EXPORT_OK = qw(
     rpm_version rpm_release rpm_sigmd5 rpm_is_signed restamp_release_line
     cross_copy_genesis finalize_xcat_dep bump_dep_release_suffix
     build_mock_uniqueext
+    openeuler_build_target openeuler_repo_subdir
 );
 
 # install_deps_packages($os_id): the host packages mockbuild-all.pl needs to run at all, for the
@@ -30,6 +31,7 @@ our @EXPORT_OK = qw(
 sub install_deps_packages {
     my ($os_id) = @_;
     $os_id = '' unless defined $os_id;
+    return (install_deps_packages(''), '/usr/bin/systemd-nspawn') if lc($os_id) eq 'openeuler';
     # The perl modules are what actually break a run; the rest is the toolchain the script drives.
     return qw(perl perl-File-Slurper perl-IPC-Cmd perl-Parallel-ForkManager perl-Digest-SHA
               mock createrepo_c tar findutils rpm rpm-build rpm-sign rpmdevtools gnupg2 wget git)
@@ -46,9 +48,31 @@ sub install_deps_command {
     my @pkgs = install_deps_packages($os_id);
     return ('zypper', '--non-interactive', 'install', '--no-recommends', @pkgs)
         if $os_id =~ /^(?:opensuse|sles|sled)/;
+    return ('dnf', '--setopt=gpgcheck=1', '--setopt=*.gpgcheck=1', '--setopt=strict=1', '--setopt=install_weak_deps=False', '-y', 'install', @pkgs)
+        if lc($os_id) eq 'openeuler';
     return ('dnf', '-y', 'install', @pkgs);
 }
 
+sub openeuler_build_target {
+    my ($os, $arch) = @_;
+    return undef unless lc($os->{ID} // '') eq 'openeuler';
+    my $version = $os->{VERSION} || $os->{VERSION_ID} || '';
+    if ($version =~ /\A(20|22|24)\.03\s+\(LTS(?:-SP([1-9][0-9]*))?\)\z/) {
+        $version = "$1.03" . (defined($2) ? "sp$2" : '');
+    }
+    my $target = "openeuler-$version-$arch";
+    openeuler_repo_subdir($target);
+    return $target;
+}
+
+sub openeuler_repo_subdir {
+    my ($target) = @_;
+    return undef unless defined($target) && $target =~ /\Aopeneuler-/;
+    die "Unsupported openEuler build target '$target'\n"
+        unless $target =~ /\Aopeneuler-((?:20|22|24)\.03(?:sp[1-9][0-9]*)?)-(x86_64|ppc64le)\z/;
+    return "openeuler$1/$2";
+}
+
 # missing_perl_modules(@modules): those that cannot be loaded, in order. The point of --install-deps
 # is that the run AFTER it cannot die on a missing module, so the modules are proven by loading
 # them, not by trusting the package manager's exit code.
diff --git a/goconserver/mockbuild.pl b/goconserver/mockbuild.pl
index 15195c1..6acc658 100755
--- a/goconserver/mockbuild.pl
+++ b/goconserver/mockbuild.pl
@@ -7,6 +7,11 @@ use File::Basename qw(dirname basename);
 use File::Copy qw(copy);
 use File::Path qw(make_path remove_tree);
 use Getopt::Long qw(GetOptions);
+use POSIX qw(strftime);
+use FindBin;
+use lib "$FindBin::Bin/..", "$FindBin::Bin/../lib";
+use MockBuildUtils qw(openeuler_build_target openeuler_repo_subdir);
+use XCAT::BuildUtils qw(digest_file read_lines);
 
 my $script_dir = abs_path(dirname(__FILE__));
 my $repo_root  = abs_path("$script_dir/..");
@@ -46,11 +51,18 @@ die "Run as root (current uid=$>)\n" if $> != 0;
 my $arch = capture('uname -m');
 if (!$mock_cfg) {
     my $os_id = capture(q{bash -lc 'source /etc/os-release; echo $ID'});
-    $mock_cfg = resolve_mock_cfg($os_id, '10', $arch);
+    if (lc($os_id) eq 'openeuler') {
+        my $os_version = capture(q{bash -lc 'source /etc/os-release; echo "$VERSION"'});
+        $mock_cfg = openeuler_build_target({ ID => $os_id, VERSION => $os_version }, $arch);
+    } else {
+        $mock_cfg = resolve_mock_cfg($os_id, '10', $arch);
+    }
 }
 
+my $native_repo = openeuler_repo_subdir($mock_cfg);
 my ($rel) = $mock_cfg =~ /-(\d+)-/;
 $rel //= '10';
+my $dist_suffix = defined($native_repo) ? '' : ".el$rel";
 
 # --target-arch names the arch of the rpm to produce. It differs from the host arch only for a
 # forcearch target (rocky-10-riscv64-xcat on an x86_64 host; see BUILD.md "riscv64").
@@ -58,12 +70,17 @@ $target_arch = $arch if $target_arch eq '';
 my %goarch = (x86_64 => 'amd64', aarch64 => 'arm64', ppc64le => 'ppc64le', s390x => 's390x', riscv64 => 'riscv64');
 my $cross = $target_arch ne $arch;
 die "No GOARCH known for target arch $target_arch\n" if $cross && !exists $goarch{$target_arch};
+if (defined($native_repo)) {
+    my ($native_arch) = $native_repo =~ m{/([^/]+)$};
+    die "openEuler goconserver requires a native $native_arch builder\n"
+      if $cross || $arch ne $native_arch;
+}
 
 # For the host arch the Go compile happens INSIDE the mock chroot (BuildRequires: golang), so the
 # host only fetches the pinned source and drives mock. A forcearch chroot would run that compile
 # under qemu, so the cross build instead cross-compiles on the host and packages the result with
 # rpmbuild --target.
-for my $bin (qw(git rpm), ($cross ? qw(go rpmbuild) : qw(mock))) {
+for my $bin (qw(git rpm), (defined($native_repo) ? 'wget' : ()), ($cross ? qw(go rpmbuild) : qw(mock))) {
     run("command -v " . sh_quote($bin) . " >/dev/null 2>&1");
 }
 
@@ -83,13 +100,21 @@ unless ($SOURCE_DATE_EPOCH && $SOURCE_DATE_EPOCH =~ /^\d+$/) {
     chomp $SOURCE_DATE_EPOCH;
 }
 $SOURCE_DATE_EPOCH = time() unless $SOURCE_DATE_EPOCH =~ /^\d+$/;
+if (defined($native_repo)) {
+    my $native_epoch = defined($build_timestamp) ? $build_timestamp : $ENV{SOURCE_DATE_EPOCH};
+    if (defined($native_epoch)) {
+        die "Invalid native build timestamp: $native_epoch\n" unless $native_epoch =~ /\A\d+\z/;
+        $SOURCE_DATE_EPOCH = $native_epoch;
+    }
+}
 $ENV{SOURCE_DATE_EPOCH} = $SOURCE_DATE_EPOCH;
 
 # goconserver is a CGO-free static Go binary. el8/el9 chroots ship a Go too old to build 0.3.3, so
 # always COMPILE in the el10 chroot for this arch (regardless of the target EL), then ship the static
 # binary to every EL repo. The Release still carries the target's dist tag (4.el$rel) so each EL repo
 # gets a correctly-named, byte-identical rpm.
-(my $build_cfg = $mock_cfg) =~ s/-\d+-/-10-/;
+my $build_cfg = $mock_cfg;
+$build_cfg =~ s/-\d+-/-10-/ unless defined($native_repo);
 
 print_step("Configuration");
 print "repo_root:    $repo_root\n";
@@ -97,8 +122,8 @@ print "pkg_dir:      $pkg_dir\n";
 print "work_dir:     $work_dir\n";
 print "result_dir:   $result_dir\n";
 print "log_dir:      $log_dir\n";
-print "mock_cfg:     $mock_cfg (target dist tag: el$rel)\n";
-print "build_cfg:    $build_cfg (el10 -- portable static build for arch $arch)\n" if !$cross;
+print "mock_cfg:     $mock_cfg (target dist suffix: $dist_suffix)\n";
+print "build_cfg:    $build_cfg\n" if !$cross;
 print "arch:         $arch\n";
 print "target_arch:  $target_arch" . ($cross ? " (GOARCH=$goarch{$target_arch}, rpmbuild --target)" : '') . "\n";
 print "version:      $version\n";
@@ -121,6 +146,15 @@ run("git -C " . sh_quote($src_dir) . " remote add origin " . sh_quote($go_repo)
 run("git -C " . sh_quote($src_dir) . " fetch --depth 1 origin " . sh_quote($go_ref) . " >>$clone_log 2>&1");
 run("git -C " . sh_quote($src_dir) . " checkout -q FETCH_HEAD >>$clone_log 2>&1");
 
+my $go_ldflags = '-X main.Version=%{version}';
+if (defined($native_repo)) {
+    my $source_commit = capture("git -C " . sh_quote($src_dir) . " rev-parse --verify 'HEAD^{commit}'");
+    die "Cannot resolve fetched goconserver commit\n"
+      if $? != 0 || $source_commit !~ /\A[0-9a-f]{40}\z/;
+    my $build_time = strftime('%Y-%m-%dT%H:%M:%SZ', gmtime($SOURCE_DATE_EPOCH));
+    $go_ldflags .= " -X main.Commit=$source_commit -X main.BuildTime=$build_time";
+}
+
 # etcd storage backend has broken deps with modern Go modules; xCAT only uses file storage.
 unlink "$src_dir/storage/etcd.go";
 remove_tree("$src_dir/storage/etcd") if -d "$src_dir/storage/etcd";
@@ -190,6 +224,26 @@ run("tar --sort=name --owner=0 --group=0 --mtime=\@$SOURCE_DATE_EPOCH" .
 write_file("$sources_dir/goconserver.service", $service_unit);
 write_file("$sources_dir/server.conf", $server_conf);
 
+my ($go_source, $go_prep, $go_environment) = ('', '', '');
+my $native_changelog = '';
+my $go_requires = 'golang';
+if (defined($native_repo)) {
+    my $go_file = "go1.25.12.linux-$goarch{$arch}.tar.gz";
+    my %checksums = map { my ($hash, $name) = split /\s+/, $_; ($name, $hash) }
+      read_lines("$pkg_dir/toolchains/go1.25.12.sha256");
+    my $go_hash = $checksums{$go_file};
+    die "No pinned checksum for $go_file\n" unless defined($go_hash) && $go_hash =~ /\A[0-9a-f]{64}\z/;
+    my $go_url = "https://go.dev/dl/$go_file";
+    my $go_archive = "$sources_dir/$go_file";
+    run("wget --https-only --tries=3 --timeout=60 -q -O " . sh_quote($go_archive) . " " . sh_quote($go_url));
+    die "Go toolchain checksum mismatch: $go_file\n" unless digest_file($go_archive) eq $go_hash;
+    $go_source = "Source3:        $go_url\n";
+    $go_requires = 'coreutils tar gzip ca-certificates';
+    $go_prep = "echo '$go_hash  %{SOURCE3}' | sha256sum -c -\ntar -C %{_builddir} -xzf %{SOURCE3}\n";
+    $go_environment = 'export PATH=%{_builddir}/go/bin:$PATH' . "\ngo version\n";
+    $native_changelog = "* Tue Sep 08 2026 xCAT build - $version-4\n- Build in the native openEuler target with the verified Go 1.25.12 source archive.\n\n";
+}
+
 # --- Spec: the Go compile runs in %build INSIDE the chroot; modules fetched from the proxy, pinned by go.sum ---
 print_step("Write spec");
 my $spec_file = "$work_dir/goconserver.spec";
@@ -199,7 +253,7 @@ write_file($spec_file, <<"SPEC");
 %global debug_package %{nil}
 Name:           goconserver
 Version:        $version
-Release:        4.el$rel$release_suffix
+Release:        4$dist_suffix$release_suffix
 Summary:        Console server written in Go for xCAT
 License:        EPL-1.0
 URL:            https://github.com/xcat2/goconserver
@@ -208,8 +262,9 @@ BuildArch:      $arch
 Source0:        goconserver-%{version}.tar.gz
 Source1:        goconserver.service
 Source2:        server.conf
+$go_source
 
-BuildRequires:  golang
+BuildRequires:  $go_requires
 
 %description
 goconserver is a scalable console server written in Go. It provides
@@ -217,15 +272,17 @@ console logging and management for xCAT cluster nodes.
 
 %prep
 %setup -q -n goconserver-%{version}
+$go_prep
 
 %build
 # Compile in-chroot. Modules are downloaded from the Go proxy at build time (mock networking is on)
 # but PINNED + integrity-checked by the committed go.sum, so the build is reproducible without a
 # vendored tree. GOTOOLCHAIN=local pins the chroot's Go (never auto-downloads a toolchain).
+$go_environment
 export GOFLAGS=-mod=mod GOTOOLCHAIN=local CGO_ENABLED=0
 export GOCACHE=%{_builddir}/.gocache GOPATH=%{_builddir}/.gopath GOMODCACHE=%{_builddir}/.gomodcache
-go build -trimpath -buildvcs=false -ldflags "-X main.Version=%{version}" -o goconserver goconserver.go
-go build -trimpath -buildvcs=false -ldflags "-X main.Version=%{version}" -o congo cmd/congo.go
+go build -trimpath -buildvcs=false -ldflags "$go_ldflags" -o goconserver goconserver.go
+go build -trimpath -buildvcs=false -ldflags "$go_ldflags" -o congo cmd/congo.go
 
 %install
 install -Dm0755 goconserver %{buildroot}/usr/bin/goconserver
@@ -243,6 +300,7 @@ mkdir -p %{buildroot}/var/log/goconserver %{buildroot}/var/lib/goconserver
 %dir /var/lib/goconserver
 
 %changelog
+$native_changelog
 * Mon Aug 10 2026 xCAT build - $version-4.el$rel
 - Build inside a mock chroot (no host build). Modules are downloaded at build time but pinned +
   integrity-checked by a committed go.sum (no `go mod tidy`, no vendored tree). Compiled in the
diff --git a/goconserver/toolchains/go1.25.12.sha256 b/goconserver/toolchains/go1.25.12.sha256
new file mode 100644
index 0000000..e698cb0
--- /dev/null
+++ b/goconserver/toolchains/go1.25.12.sha256
@@ -0,0 +1,2 @@
+234828b7a89e0e303d2556310ee549fbcf253d28de937bac3da13d6294262ac1  go1.25.12.linux-amd64.tar.gz
+64adb4ddefef4f0a6f11af550547f39bf510350da69ab308438a21eacfde97ad  go1.25.12.linux-ppc64le.tar.gz
diff --git a/grub2-xcat/grub2-xcat.spec b/grub2-xcat/grub2-xcat.spec
index 54bd047..de43168 100644
--- a/grub2-xcat/grub2-xcat.spec
+++ b/grub2-xcat/grub2-xcat.spec
@@ -30,6 +30,9 @@ grub2-xcat provides some grub2 resources generated by grub2-mknetdir,including g
 and the EL grub2 UEFI image for riscv64 nodes, which boot through UEFI and grub2 only.
 
 %define _binaries_in_noarch_packages_terminate_build   0
+%if 0%{?openEuler}
+%global __strip /bin/true
+%endif
 
 %prep
 #cp ./grub2-res.tar.gz /root/rpmbuild/SOURCES/
diff --git a/lib/XCAT/NativeInputs.pm b/lib/XCAT/NativeInputs.pm
new file mode 100644
index 0000000..df78564
--- /dev/null
+++ b/lib/XCAT/NativeInputs.pm
@@ -0,0 +1,291 @@
+package XCAT::NativeInputs;
+
+use strict;
+use warnings;
+
+use Cwd qw(abs_path);
+use Digest::SHA ();
+use Exporter qw(import);
+use File::Basename qw(basename);
+use File::Copy qw(copy);
+use File::Path qw(make_path);
+use File::Temp qw(tempdir);
+use JSON::PP;
+
+our @EXPORT_OK = qw(load_inputs stage_inputs verify_input rpm_identity validate_outputs publisher_trust);
+
+sub read_file {
+    my ($path) = @_;
+    open my $fh, '<', $path or die "Cannot read $path: $!\n";
+    local $/;
+    my $data = <$fh>;
+    close $fh or die "Cannot close $path: $!\n";
+    return $data;
+}
+
+sub sha256 {
+    my ($path) = @_;
+    open my $fh, '<', $path or die "Cannot read $path: $!\n";
+    binmode $fh;
+    my $sha = Digest::SHA->new(256)->addfile($fh)->hexdigest;
+    close $fh or die "Cannot close $path: $!\n";
+    return $sha;
+}
+
+sub capture {
+    my (@args) = @_;
+    open my $fh, '-|', @args or die "Cannot execute $args[0]: $!\n";
+    local $/;
+    my $out = <$fh> // '';
+    close $fh or die "Command failed: @args\n";
+    $out =~ s/\s+\z//;
+    return $out;
+}
+
+sub run {
+    my (@args) = @_;
+    system(@args) == 0 or die "Command failed: @args\n";
+}
+
+sub pinned_file {
+    my ($root, $entry) = @_;
+    die "Invalid pinned path\n" unless ($entry->{path} // '') =~ m{\A[\w./-]+\z}
+        && $entry->{path} !~ m{(?:\A|/)\.\.(?:/|\z)|\A/};
+    die "Missing input $entry->{path}\n" unless -f "$root/$entry->{path}";
+    my $path = abs_path("$root/$entry->{path}") // die "Missing input $entry->{path}\n";
+    die "Input escapes repository: $entry->{path}\n" unless index($path, "$root/") == 0;
+    die "Input SHA256 mismatch: $entry->{path}\n" unless sha256($path) eq ($entry->{sha256} // '');
+    return $path;
+}
+
+sub load_inputs {
+    my ($root, $required) = @_;
+    $root = abs_path($root) // die "Missing repository\n";
+    my $catalog_path = "$root/openeuler/24.03-ppc64le.inputs.json";
+    my $catalog = JSON::PP->new->decode(read_file($catalog_path));
+    die "Unsupported native input catalog\n" unless ($catalog->{version} // 0) == 1
+        && ($catalog->{target} // '') eq 'openeuler-24.03-ppc64le';
+    my $key = $catalog->{publisher_key};
+    die "Invalid publisher fingerprint\n" unless ($key->{fingerprint} // '') =~ /\A[0-9A-F]{40}\z/;
+    my $key_path = pinned_file($root, $key);
+    my (%nodes, %outputs);
+    for my $node (@{$catalog->{inputs}}) {
+        my $name = $node->{name} // '';
+        die "Invalid native input name '$name'\n" unless $name =~ /\A[\w+.-]+\z/;
+        die "Duplicate native input '$name'\n" if $nodes{$name};
+        my $type = $node->{type} // '';
+        die "Invalid native input type '$type'\n" unless $type =~ /\A(?:srpm|publisher|owner)\z/;
+        if ($type eq 'owner') {
+            die "Unsupported native build owner '$name'\n" unless grep { $_ eq $name }
+                qw(goconserver grub2-xcat ipmitool-xcat syslinux-xcat xnba-undi xCAT-genesis-base
+                   perl-Crypt-Rijndael perl-Crypt-SSLeay perl-HTTP-Async perl-IO-Stty perl-Net-HTTPS-NB perl-Net-Telnet);
+        }
+        if ($type ne 'publisher') {
+            my $uid = $type eq 'owner' && ($name eq 'xnba-undi' || $name eq 'xCAT-genesis-base') ? 0 : 1000;
+            die "Invalid native build UID for $name\n" unless ($node->{build_uid} // -1) == $uid;
+        }
+        if ($type ne 'owner') {
+            die "Invalid pinned native URL for $name\n" unless ($node->{url} // '') =~
+                m{\Ahttps://repo\.openeuler\.org/openEuler-24\.03-LTS(?:-SP3)?/[A-Za-z0-9_./+-]+\.rpm\z};
+            die "Invalid native SHA256 for $name\n" unless ($node->{sha256} // '') =~ /\A[0-9a-f]{64}\z/;
+            die "Publisher binary must be exact GA: $name\n" if $type eq 'publisher'
+                && $node->{url} !~ m{/openEuler-24\.03-LTS/.*\.noarch\.rpm\z};
+        }
+        die "Missing output ownership for $name\n" unless ref($node->{outputs}) eq 'ARRAY' && @{$node->{outputs}};
+        for my $output (@{$node->{outputs}}) {
+            die "Invalid native output name\n" unless $output =~ /\A[\w+.-]+\z/;
+            die "Conflicting output ownership: $output\n" if $outputs{$output};
+            $outputs{$output} = $name;
+        }
+        die "Invalid publisher outputs for $name\n" if $type eq 'publisher'
+            && (@{$node->{outputs}} != 1 || $node->{outputs}[0] ne $name);
+        for my $patch (@{$node->{patches} // []}) {
+            die "Only source inputs accept patches\n" unless $type eq 'srpm';
+            $patch->{absolute_path} = pinned_file($root, $patch);
+        }
+        for my $define (@{$node->{defines} // []}) {
+            die "Invalid native spec definition for $name\n" unless $type eq 'srpm'
+                && $define =~ /\A(?:llvmjit|external_libpq|runselftest|test) [01]\z/;
+        }
+        $nodes{$name} = $node;
+    }
+    for my $name (sort keys %nodes) {
+        my $type = $nodes{$name}{type};
+        for my $dependency (@{$nodes{$name}{needs} // []}) {
+            die "Missing native dependency '$dependency'\n" unless $nodes{$dependency};
+            die "Unsupported native execution edge: $name -> $dependency\n"
+                if $type eq 'publisher' || $nodes{$dependency}{type} eq 'owner';
+        }
+    }
+    my (%mark, @order);
+    my $visit;
+    $visit = sub {
+        my ($name) = @_;
+        die "Missing native dependency '$name'\n" unless $nodes{$name};
+        die "Cyclic native dependency at '$name'\n" if ($mark{$name} // '') eq 'visiting';
+        return if $mark{$name};
+        $mark{$name} = 'visiting';
+        $visit->($_) for @{$nodes{$name}{needs} // []};
+        $mark{$name} = 'done';
+        push @order, $name;
+    };
+    $visit->($_) for sort keys %nodes;
+    my %selected;
+    my $select;
+    $select = sub {
+        my ($name) = @_;
+        die "Missing native dependency '$name'\n" unless $nodes{$name};
+        return if $selected{$name}++;
+        $select->($_) for @{$nodes{$name}{needs} // []};
+    };
+    for my $output (sort keys %$required) {
+        my $owner = $outputs{$output} // ($nodes{$output} ? $output : undef);
+        die "No native output owner for '$output'\n" unless $owner;
+        $select->($owner);
+    }
+    $select->($_) for @{$catalog->{build_inputs} // []};
+    return {catalog => $catalog, nodes => \%nodes, outputs => \%outputs,
+        order => [grep { $selected{$_} } @order], selected => \%selected,
+        publisher_key => $key_path, publisher_fingerprint => $key->{fingerprint},
+        catalog_sha256 => sha256($catalog_path)};
+}
+
+sub rpm_identity {
+    my ($path) = @_;
+    my @fields = split /\n/, capture('rpm', '-qp', '--qf',
+        '%{NAME}\n%{ARCH}\n%{SOURCEPACKAGE}\n%{RELEASE}\n', $path);
+    die "Invalid RPM header: $path\n" unless @fields == 4;
+    return {name => $fields[0], arch => $fields[1], source => $fields[2] eq '1', release => $fields[3]};
+}
+
+sub read_exact {
+    my ($fh, $size) = @_;
+    my $data = '';
+    while (length($data) < $size) {
+        my $got = read($fh, $data, $size - length($data), length($data));
+        die "Truncated RPM payload\n" unless defined($got) && $got > 0;
+    }
+    return $data;
+}
+
+sub reject_elf_payload {
+    my ($path) = @_;
+    open my $fh, '-|', 'rpm2cpio', $path or die "Cannot read RPM payload: $!\n";
+    binmode $fh;
+    my $error;
+    eval {
+        while (1) {
+            my $header = read_exact($fh, 110);
+            die "Invalid RPM cpio header\n" unless $header =~ /\A07070[12][0-9A-Fa-f]{104}\z/;
+            my @fields = map { hex($_) } $header =~ /\A.{6}(.{8})(.{8})(.{8})(.{8})(.{8})(.{8})(.{8})(.{8})(.{8})(.{8})(.{8})(.{8})(.{8})\z/s;
+            my ($size, $namesize) = @fields[6, 11];
+            die "Invalid RPM cpio filename\n" unless $namesize > 0 && $namesize <= 1048576;
+            my $name = read_exact($fh, $namesize);
+            die "Invalid RPM cpio filename terminator\n" unless $name =~ s/\0\z//;
+            read_exact($fh, (4 - (110 + $namesize) % 4) % 4);
+            last if $name eq 'TRAILER!!!' && $size == 0;
+            my $prefix = read_exact($fh, $size < 4 ? $size : 4);
+            die "ELF payload in publisher noarch RPM: $name\n" if $prefix eq "\x7fELF";
+            $size -= length($prefix);
+            while ($size) { my $count = $size < 65536 ? $size : 65536; read_exact($fh, $count); $size -= $count; }
+            read_exact($fh, (4 - $fields[6] % 4) % 4);
+        }
+        my $tail;
+        while (read($fh, $tail, 65536)) { die "Unexpected data after RPM cpio trailer\n" if $tail =~ /[^\0]/; }
+        1;
+    } or $error = $@;
+    my $closed = close($fh);
+    die $error if $error;
+    die "rpm2cpio failed: $path\n" unless $closed;
+}
+
+sub verify_input {
+    my ($plan, $node, $path, $db) = @_;
+    die "Native input SHA256 mismatch: $path\n" unless sha256($path) eq $node->{sha256};
+    my $out = capture('rpmkeys', '--dbpath', $db, '--checksig', '--verbose', $path);
+    die "Publisher signature missing or invalid: $path\n" unless $out =~ /Signature.*: OK/i
+        && $out !~ /NOKEY|NOT OK|BAD|UNSIGNED/i;
+    my $id = rpm_identity($path);
+    die "Native input NAME mismatch: $path\n" unless $id->{name} eq $node->{name};
+    if ($node->{type} eq 'publisher') {
+        die "Publisher input is not a noarch binary: $path\n" if $id->{source} || $id->{arch} ne 'noarch';
+        die "Publisher input is not exact GA: $path\n" unless $id->{release} =~ /\.oe2403\z/;
+        reject_elf_payload($path);
+    } else {
+        die "Native input is not a source RPM: $path\n" unless $id->{source};
+    }
+    die "Native input changed during verification: $path\n" unless sha256($path) eq $node->{sha256};
+    return $id;
+}
+
+sub publisher_trust {
+    my ($plan, $work) = @_;
+    make_path("$work/trust", "$work/gnupg");
+    chmod 0700, "$work/gnupg";
+    my $listing = capture('gpg', '--homedir', "$work/gnupg", '--batch', '--with-colons', '--show-keys', $plan->{publisher_key});
+    my @primary;
+    my $pub;
+    for my $line (split /\n/, $listing) {
+        my @fields = split /:/, $line;
+        $pub = 1 if $fields[0] eq 'pub';
+        if ($pub && $fields[0] eq 'fpr') { push @primary, $fields[9]; $pub = 0; }
+    }
+    die "Publisher public key fingerprint mismatch\n" unless @primary == 1 && $primary[0] eq $plan->{publisher_fingerprint};
+    run('rpmkeys', '--dbpath', "$work/trust", '--import', $plan->{publisher_key});
+    return "$work/trust";
+}
+
+sub stage_inputs {
+    my ($plan, $work) = @_;
+    die "Native input staging already exists: $work\n" if -e $work;
+    make_path($work);
+    my $db = publisher_trust($plan, $work);
+    my @ledger;
+    for my $name (@{$plan->{order}}) {
+        my $node = $plan->{nodes}{$name};
+        next if $node->{type} eq 'owner';
+        make_path("$work/$name");
+        for my $patch (@{$node->{patches} // []}) {
+            make_path("$work/$name/patches");
+            my $staged = "$work/$name/patches/" . basename($patch->{path});
+            die "Conflicting staged patch: $staged\n" if -e $staged;
+            copy($patch->{absolute_path}, $staged) or die "Cannot stage native patch: $!\n";
+            die "Staged patch SHA256 mismatch: $staged\n" unless sha256($staged) eq $patch->{sha256};
+            chmod 0444, $staged or die "Cannot protect native patch: $!\n";
+            $patch->{staged} = $staged;
+        }
+        my $dest = "$work/$name/" . basename($node->{url});
+        run('wget', '--https-only', '--tries=3', '--timeout=60', '-O', "$dest.part", $node->{url});
+        verify_input($plan, $node, "$dest.part", $db);
+        rename("$dest.part", $dest) or die "Cannot preserve native input: $!\n";
+        chmod 0444, $dest or die "Cannot protect native input: $!\n";
+        $node->{staged} = $dest;
+        push @ledger, {name => $name, type => $node->{type}, url => $node->{url},
+            sha256 => $node->{sha256}, path => $dest, publisher => $plan->{publisher_fingerprint},
+            defines => $node->{defines} // [],
+            patches => [map { {path => $_->{path}, sha256 => $_->{sha256}, staged => $_->{staged}} } @{$node->{patches} // []}]};
+    }
+    open my $fh, '>', "$work/inputs.json" or die "Cannot record native input ledger: $!\n";
+    print {$fh} JSON::PP->new->canonical->pretty->encode({catalog_sha256 => $plan->{catalog_sha256}, inputs => \@ledger});
+    close $fh or die "Cannot close native input ledger: $!\n";
+    $plan->{trust_db} = $db;
+}
+
+sub validate_outputs {
+    my ($node, $paths, $require_all) = @_;
+    my %allowed = map { $_ => 1 } @{$node->{outputs}};
+    my %seen;
+    for my $path (@$paths) {
+        my $id = rpm_identity($path);
+        next if $id->{source};
+        die "Unexpected output from $node->{name}: $id->{name}\n" unless $allowed{$id->{name}};
+        die "Duplicate output from $node->{name}: $id->{name}\n" if $seen{$id->{name}}++;
+        die "Foreign output architecture: $id->{arch}\n" unless $id->{arch} eq 'ppc64le' || $id->{arch} eq 'noarch';
+    }
+    if ($require_all) {
+        die "Missing output from $node->{name}: $_\n" for grep { !$seen{$_} } sort keys %allowed;
+    }
+    return \%seen;
+}
+
+1;
diff --git a/mock-configs/openeuler-20.03sp4-x86_64.cfg b/mock-configs/openeuler-20.03sp4-x86_64.cfg
new file mode 100644
index 0000000..f6ada6a
--- /dev/null
+++ b/mock-configs/openeuler-20.03sp4-x86_64.cfg
@@ -0,0 +1,7 @@
+include('templates/openeuler-20.03-sp4.tpl')
+config_opts['root'] = 'openeuler-20.03sp4-x86_64'
+config_opts['target_arch'] = 'x86_64'
+config_opts['legal_host_arches'] = ('x86_64',)
+config_opts['openeuler_repository_release'] = '20.03-LTS-SP4'
+config_opts['openeuler_repositories'] = ('OS', 'everything', 'update')
+include('templates/openeuler-lts-xcat.tpl')
diff --git a/mock-configs/openeuler-22.03sp4-x86_64.cfg b/mock-configs/openeuler-22.03sp4-x86_64.cfg
new file mode 100644
index 0000000..4261f65
--- /dev/null
+++ b/mock-configs/openeuler-22.03sp4-x86_64.cfg
@@ -0,0 +1,7 @@
+include('templates/openeuler-22.03-sp4.tpl')
+config_opts['root'] = 'openeuler-22.03sp4-x86_64'
+config_opts['target_arch'] = 'x86_64'
+config_opts['legal_host_arches'] = ('x86_64',)
+config_opts['openeuler_repository_release'] = '22.03-LTS-SP4'
+config_opts['openeuler_repositories'] = ('OS', 'everything', 'update')
+include('templates/openeuler-lts-xcat.tpl')
diff --git a/mock-configs/openeuler-24.03-ppc64le.cfg b/mock-configs/openeuler-24.03-ppc64le.cfg
new file mode 100644
index 0000000..5b3ce7c
--- /dev/null
+++ b/mock-configs/openeuler-24.03-ppc64le.cfg
@@ -0,0 +1,15 @@
+config_opts['root'] = 'openeuler-24.03-ppc64le'
+config_opts['target_arch'] = 'ppc64le'
+config_opts['legal_host_arches'] = ('ppc64le',)
+config_opts['releasever'] = '24.03LTS'
+config_opts['package_manager'] = 'dnf'
+config_opts['isolation'] = 'simple'
+config_opts['chrootuid'] = 1000
+config_opts['chrootgid'] = 1000
+config_opts['useradd'] = '/usr/sbin/useradd -o -m -u {{chrootuid}} -g {{chrootgid}} -d {{chroothome}} -N {{chrootuser}}'
+config_opts['use_bootstrap'] = False
+config_opts['use_bootstrap_container'] = False
+config_opts['chroot_setup_cmd'] = 'install openEuler-rpm-config openEuler-release shadow rpm-build dnf-plugins-core gcc make perl-interpreter'
+config_opts['openeuler_repository_release'] = '24.03-LTS'
+config_opts['openeuler_repositories'] = ('OS',)
+include('templates/openeuler-lts-xcat.tpl')
diff --git a/mock-configs/openeuler-24.03sp1-x86_64.cfg b/mock-configs/openeuler-24.03sp1-x86_64.cfg
new file mode 100644
index 0000000..2ca84c4
--- /dev/null
+++ b/mock-configs/openeuler-24.03sp1-x86_64.cfg
@@ -0,0 +1,8 @@
+include('templates/openeuler-24.03.tpl')
+config_opts['root'] = 'openeuler-24.03sp1-x86_64'
+config_opts['target_arch'] = 'x86_64'
+config_opts['legal_host_arches'] = ('x86_64',)
+config_opts['releasever'] = '24.03LTS_SP1'
+config_opts['openeuler_repository_release'] = '24.03-LTS-SP1'
+config_opts['openeuler_repositories'] = ('OS', 'everything', 'update')
+include('templates/openeuler-lts-xcat.tpl')
diff --git a/mock-configs/openeuler-24.03sp3-x86_64.cfg b/mock-configs/openeuler-24.03sp3-x86_64.cfg
new file mode 100644
index 0000000..82241c1
--- /dev/null
+++ b/mock-configs/openeuler-24.03sp3-x86_64.cfg
@@ -0,0 +1,8 @@
+include('templates/openeuler-24.03.tpl')
+config_opts['root'] = 'openeuler-24.03sp3-x86_64'
+config_opts['target_arch'] = 'x86_64'
+config_opts['legal_host_arches'] = ('x86_64',)
+config_opts['releasever'] = '24.03LTS_SP3'
+config_opts['openeuler_repository_release'] = '24.03-LTS-SP3'
+config_opts['openeuler_repositories'] = ('OS', 'everything', 'update')
+include('templates/openeuler-lts-xcat.tpl')
diff --git a/mock-configs/openeuler-24.03sp4-x86_64.cfg b/mock-configs/openeuler-24.03sp4-x86_64.cfg
new file mode 100644
index 0000000..4d42489
--- /dev/null
+++ b/mock-configs/openeuler-24.03sp4-x86_64.cfg
@@ -0,0 +1,8 @@
+include('templates/openeuler-24.03.tpl')
+config_opts['root'] = 'openeuler-24.03sp4-x86_64'
+config_opts['target_arch'] = 'x86_64'
+config_opts['legal_host_arches'] = ('x86_64',)
+config_opts['releasever'] = '24.03LTS_SP4'
+config_opts['openeuler_repository_release'] = '24.03-LTS-SP4'
+config_opts['openeuler_repositories'] = ('OS', 'everything', 'update')
+include('templates/openeuler-lts-xcat.tpl')
diff --git a/mock-configs/templates/openeuler-lts-xcat.tpl b/mock-configs/templates/openeuler-lts-xcat.tpl
new file mode 100644
index 0000000..5f80d47
--- /dev/null
+++ b/mock-configs/templates/openeuler-lts-xcat.tpl
@@ -0,0 +1,31 @@
+config_opts['dist'] = ''
+config_opts['use_bootstrap_image'] = False
+config_opts['description'] = 'openEuler ' + config_opts['openeuler_repository_release']
+config_opts['dnf.conf'] = """
+[main]
+keepcache=1
+reposdir=/dev/null
+logfile=/var/log/dnf.log
+retries=20
+obsoletes=1
+gpgcheck=1
+assumeyes=1
+metadata_expire=0
+best=1
+install_weak_deps=0
+skip_if_unavailable=0
+protected_packages=
+"""
+_openeuler_root = 'https://repo.openeuler.org/openEuler-' + config_opts['openeuler_repository_release']
+_openeuler_arch = config_opts['target_arch']
+for _openeuler_repo in config_opts['openeuler_repositories']:
+    config_opts['dnf.conf'] += """
+[{repo}]
+name=openEuler {release} {repo}
+baseurl={root}/{repo}/{arch}/
+enabled=1
+gpgcheck=1
+gpgkey={root}/OS/{arch}/RPM-GPG-KEY-openEuler
+skip_if_unavailable=0
+""".format(repo=_openeuler_repo, release=config_opts['openeuler_repository_release'],
+           root=_openeuler_root, arch=_openeuler_arch)
diff --git a/mockbuild-all.pl b/mockbuild-all.pl
index f108ff0..3403c16 100755
--- a/mockbuild-all.pl
+++ b/mockbuild-all.pl
@@ -13,6 +13,7 @@ use File::Temp qw(tempdir tempfile);
 use Getopt::Long qw(GetOptions);
 use Parallel::ForkManager;
 use POSIX qw(strftime);
+use JSON::PP;
 use FindBin qw($RealBin);
 use lib $RealBin, "$RealBin/lib";
 use MockBuildUtils qw(sh_quote print_step version_matches required_pkgs
@@ -20,11 +21,13 @@ use MockBuildUtils qw(sh_quote print_step version_matches required_pkgs
                       read_manifest verify_repo_packages verify_repo_signature verify_rpm_signatures
                       rpm_version rpm_release rpm_sigmd5 restamp_release_line
                       cross_copy_genesis finalize_xcat_dep bump_dep_release_suffix
-                      build_mock_uniqueext rpmkeys_checksig_problem);
+                      build_mock_uniqueext rpmkeys_checksig_problem
+                      openeuler_build_target openeuler_repo_subdir);
 # print_step and sh_quote come from MockBuildUtils above; XCAT::BuildUtils carries the same
 # print_step, so it is deliberately NOT imported here (one definition, no redefinition warning).
 use XCAT::BuildUtils qw(
   capture_command
+  digest_file
   every_step_failed
   hashes_equal
   read_lines
@@ -36,6 +39,7 @@ use XCAT::GenesisRelease qw(
   validated_release_checksums
   verify_release_file
 );
+use XCAT::NativeInputs qw(load_inputs stage_inputs verify_input rpm_identity validate_outputs publisher_trust);
 
 # --- Mount-namespace isolation: guard the host cgroup against mock teardown propagation ----------
 # mock mounts /sys/fs/cgroup into every build chroot. On these systemd build hosts every mount is
@@ -133,6 +137,7 @@ my $no_verify_repo = 0;
 my @HELD_LOCKS;
 my $LOCK_OWNER_PID;
 my ($COMMON_STAGE, $COMMON_DESTINATION, $COMMON_BACKUP);
+my %NATIVE_PLANS;
 for my $sig (qw(INT TERM HUP)) {
     $SIG{$sig} = sub { exit 1; };
 }
@@ -347,6 +352,9 @@ if ($install_deps) {
     die "FATAL: still missing after install: " . join(', ', @missing) . "\n" if @missing;
     print "  perl modules present: " . join(', ', @modules) . "\n";
     print "  host is ready\n";
+    if (lc($os_id) eq 'openeuler') {
+        install_mock_cfg(basename($_, '.cfg')) for glob("$repo_root/mock-configs/openeuler-*.cfg");
+    }
     exit 0;
 }
 
@@ -381,8 +389,10 @@ if ($genesis_release ne '') {
 # ONLY the host arch (uname -m) -- the other arch is produced on its own build host --
 # except for the forcearch targets (%forcearch_targets, --target only), which are
 # cross-built here through qemu-user-static.
+my $native_target = openeuler_build_target(\%os, $host_arch);
 my @build_targets = $target
     ? ($target)
+    : defined($native_target) ? ($native_target)
     : map { resolve_mock_cfg($os_id, $_, $host_arch) } (8, 9, 10);
 
 # What a target builds. The mock-core-configs targets (<os>+epel-<rel>-<arch>) build every
@@ -473,6 +483,14 @@ sub build_one_target {
     my %req = %{ $MANIFEST{$target} // {} };
     die "FATAL: no manifest section for target '$target' in packages-manifest.conf\n"
         if !%req;
+    my $native = $target eq 'openeuler-24.03-ppc64le' ? load_inputs($repo_root, \%req) : undef;
+    $NATIVE_PLANS{$target} = $native if $native;
+    if ($native) {
+        die "Native POWER collection requires signing and verification\n"
+            if !$gpg_sign || $no_verify_repo;
+        die "Native POWER inputs require a complete owner run\n"
+            if $skip_build || $skip_xcat_dep || $skip_perl || @extra_collect_dirs;
+    }
 
 my $run_root     = "$output_root/$run_id";
 my $build_root   = "$run_root/build-results";
@@ -505,6 +523,8 @@ my @dep_builders = (
     { name => 'goconserver', script => "$repo_root/goconserver/mockbuild.pl" },
     { name => 'conserver-xcat', script => "$repo_root/conserver/mockbuild.pl" },
     { name => 'xnba-undi',   script => "$repo_root/xnba/mockbuild.pl", noarch => 1 },
+    { name => 'python3-scp', srpm => "$repo_root/python-scp/python-scp-0.14.5-1.oe2403.src.rpm",
+      sha256 => '3461d2a3fe0122cac2893d8465ad1271ae21e5570a31d4402e3f887ef545a0e8' },
 );
 my %profile_builds = map { $_ => 1 } @{ $profile->{dep_builders} };
 
@@ -518,11 +538,16 @@ die "Missing xCAT build script: $xcat_src/buildrpms.pl\n"
 my @active_dep_builders;
 for my $b (@dep_builders) {
     next if !$profile_builds{$b->{name}};
+    if ($b->{srpm}) {
+        push @active_dep_builders, $b if $req{$b->{name}};
+        next;
+    }
     if (-f $b->{script}) {
         push @active_dep_builders, $b;
         next;
     }
     print "WARN: missing dep builder script, skipping: $b->{script}\n";
+    die "Missing native owner script: $b->{script}\n" if $native && $req{$b->{name}};
 }
 die "Missing perl builder script: $perl_builder\n"
     if !$skip_perl && !$perl_builder;
@@ -576,9 +601,35 @@ print "srpm_repo_dir:    $srpm_repo_dir\n";
 print "srpm_tarball:     $srpm_tarball\n";
 
 my @collect_roots;
+my @native_source_roots;
+
+if ($native && !$dry_run) {
+    stage_inputs($native, "$run_root/native-inputs");
+}
+
+if (!$skip_build && !$skip_xcat_dep) {
+    for my $builder (grep { $_->{srpm} } @active_dep_builders) {
+        my $source = $builder->{srpm};
+        die "Missing source RPM: $source\n" unless -f $source;
+        die "Source RPM SHA256 mismatch: $source\n" unless digest_file($source) eq $builder->{sha256};
+        next if $dry_run;
+        my $stage_dir = "$run_root/source-rpms/$builder->{name}";
+        make_path($stage_dir);
+        my $staged = "$stage_dir/" . basename($source);
+        copy($source, $staged) or die "Cannot stage source RPM $source: $!\n";
+        die "Staged source RPM SHA256 mismatch: $staged\n" unless digest_file($staged) eq $builder->{sha256};
+        $builder->{srpm} = $staged;
+    }
+}
 
 install_mock_cfg($target);
 
+if ($native) {
+    my ($runtime, $sources) = build_native_inputs($native, $target, \%req, $run_root, $log_root);
+    push @collect_roots, $runtime;
+    push @native_source_roots, @$sources;
+}
+
 if ($scrub_all_chroots) {
     run_step(
         step => "Scrub all chroots for target $target",
@@ -604,7 +655,10 @@ if (!$skip_build) {
             my $step_result = "$build_root/$name";
             my $step_log    = "$log_root/$name";
             my $step_uniqueext = build_mock_uniqueext($run_id, ++$build_step_seq, $name);
-            my $cmd = join(' ',
+            my $cmd = $builder->{srpm}
+                ? source_rpm_build_command($builder, $target, $step_uniqueext, $step_result, $step_log,
+                    "$run_root/source-rpms/$name")
+                : join(' ',
                 'perl', shell_quote($script),
                 '--mock-cfg', shell_quote($builder->{noarch} ? $profile->{noarch_cfg} : $target),
                 ($profile->{forcearch} && !$builder->{noarch} ? ('--target-arch', shell_quote($arch)) : ()),
@@ -614,13 +668,10 @@ if (!$skip_build) {
                 # host-local, run-scoped work dir so /tmp doesn't collide between runs
                 '--work-dir', shell_quote("/tmp/mockbuild-all-$run_id/$name"),
                 '--build-timestamp', $SOURCE_DATE_EPOCH,
-                # goconserver generates its spec at build time (from an upstream clone), so the
-                # in-tree spec Release bump above cannot reach it. Hand the CD suffix down so its
-                # NVR advances per run too, and pin the clone to an immutable commit (not the moving
-                # 'master') so the build is reproducible.
-                ($name eq 'goconserver'
-                    ? ('--go-ref', sh_quote($GOCONSERVER_REF),
-                       ($RELEASE_BUMP ne '' ? ('--release-suffix', sh_quote($RELEASE_BUMP)) : ()))
+                ($name eq 'goconserver' ? ('--go-ref', sh_quote($GOCONSERVER_REF)) : ()),
+                # Generated specs need the same release suffix as in-tree specs.
+                (($name eq 'goconserver' || $name eq 'xnba-undi') && $RELEASE_BUMP ne ''
+                    ? ('--release-suffix', sh_quote($RELEASE_BUMP))
                     : ()),
             );
             push @build_steps, {
@@ -630,12 +681,13 @@ if (!$skip_build) {
                 log  => "$log_root/$name/run.log",
                 scrub_cfg       => $target,
                 scrub_uniqueext => $step_uniqueext,
+                ($native ? (native_results => {$name => $step_result}) : ()),
             };
             push @collect_roots, $step_result;
         }
     }
 
-    my @perl_pkgs = sort grep { /^perl-/ } keys %req;   # manifest: perl packages required here
+    my @perl_pkgs = sort grep { /^perl-/ && (!$native || $native->{nodes}{$_}{type} eq 'owner') } keys %req;
     if (!$skip_perl && @perl_pkgs) {
         my $perl_result = "$build_root/perl/$arch";
         my $perl_log    = "$log_root/perl/$arch";
@@ -668,6 +720,7 @@ if (!$skip_build) {
             step => 'Build perl xcat-dep packages',
             cmd  => $cmd,
             log  => "$log_root/perl-build.log",
+            ($native ? (native_results => {map { $_ => "$perl_result/$_" } @perl_pkgs}) : ()),
         };
         push @collect_roots, $perl_result;
     }
@@ -711,6 +764,7 @@ if (!$skip_build) {
             '--verbose',
             '--xcat_dep_path', shell_quote($repo_root),
         );
+        $cmd = native_owner_command($native, $target, $cmd, 0) if $native;
         push @build_steps, {
             id   => 'genesis',
             step => 'Build xCAT-genesis-base (per-target, OS-dependent)',
@@ -718,10 +772,16 @@ if (!$skip_build) {
             cwd  => $xcat_src,
             log  => "$log_root/genesis-build.log",
             scrub_cfg => "xCAT-genesis-base-$target",
+            ($native ? (native_results => {'xCAT-genesis-base' => "$xcat_src/dist/$target/rpms"}) : ()),
         };
     }
 
     if (@build_steps) {
+        if ($native) {
+            for my $step (grep { $_->{id} ne 'genesis' } @build_steps) {
+                $step->{cmd} = native_owner_command($native, $target, $step->{cmd}, 1000);
+            }
+        }
         # Prefer the caller-supplied cap (global budget / active targets). Fall back to the old
         # behaviour (all steps at once) only when unset.
         my $effective_parallel_builds =
@@ -767,6 +827,20 @@ if (!$skip_build) {
         # -- ignore a genesis failure when a matching rpm already exists in dist/ -- is gone; a
         # stale artifact from a previous build must never mask a failed genesis build.)
         die "FATAL: required build step(s) failed for $target: @failed\n" if @failed;
+        if ($native && !$dry_run) {
+            for my $step (@build_steps) {
+                for my $name (sort keys %{$step->{native_results} // {}}) {
+                    my $directory = $step->{native_results}{$name};
+                    die "Missing native owner result: $directory\n" unless -d $directory;
+                    my @rpms;
+                    find({no_chdir => 1, wanted => sub {
+                        push @rpms, $File::Find::name if -f $_ && /\.rpm\z/ && !/\.src\.rpm\z/
+                            && ($name ne 'xCAT-genesis-base' || basename($_) =~ /^xCAT-genesis-base-/);
+                    }}, $directory);
+                    validate_outputs($native->{nodes}{$name}, \@rpms, 1);
+                }
+            }
+        }
     }
 }
 
@@ -787,6 +861,7 @@ if ($skip_build) {
 push @collect_roots, @extra_collect_dirs;
 @collect_roots = uniq(@collect_roots);
 my @srpm_collect_roots = uniq(@collect_roots);
+push @srpm_collect_roots, @native_source_roots;
 
 if ($genesis_release && !$dry_run) {
     remove_genesis_packages($repo_dir, 0);
@@ -835,6 +910,7 @@ if (!$dry_run && $RELEASE_BUMP ne '') {
     my @rmiss;
     for my $pkg (required_pkgs([sort keys %req], $skip_genesis, $skip_perl, $skip_xcat_dep)) {
         next if $pkg eq 'xCAT-genesis-base';
+        next if $native && $native->{nodes}{$pkg} && $native->{nodes}{$pkg}{type} eq 'publisher';
         my $rel = rpm_release($repo_dir, $pkg);
         next if !defined $rel;   # a missing rpm is caught by the completeness gate in deploy_target
         push @rmiss, "$pkg: Release '$rel' is missing the CD bump '$RELEASE_BUMP'"
@@ -940,6 +1016,21 @@ print "SRPM Tarball:          $srpm_tarball\n" if !$skip_tarball;
 # which dep builders run and which rpms the deployed repo must contain.
 sub target_profile {
     my ($target) = @_;
+    if (my $native = openeuler_repo_subdir($target)) {
+        my ($version, $arch) = $target =~ /\Aopeneuler-(.*)-([^-]+)\z/;
+        die "Native target '$target' requires a $arch build host, found $host_arch\n"
+            unless $arch eq $host_arch;
+        return {
+            rel          => $version,
+            arch         => $arch,
+            noarch_cfg   => $target,
+            forcearch    => 0,
+            epel         => 0,
+            dep_builders => [qw(grub2-xcat ipmitool-xcat syslinux-xcat goconserver conserver-xcat xnba-undi python3-scp)],
+            required     => [qw(ipmitool-xcat syslinux-xcat grub2-xcat xnba-undi
+                                perl-IO-Stty perl-HTTP-Async perl-Net-HTTPS-NB)],
+        };
+    }
     if (my $fa = $forcearch_targets{$target}) {
         return {
             %{$fa},
@@ -969,9 +1060,11 @@ sub target_profile {
 # overwrite one the host already has.
 sub install_mock_cfg {
     my ($cfg) = @_;
-    my $src = "$repo_root/mock-configs/$cfg.cfg";
+    install_mock_cfg('templates/openeuler-lts-xcat') if $cfg =~ /^openeuler-/;
+    my $extension = $cfg =~ m{^templates/} ? 'tpl' : 'cfg';
+    my $src = "$repo_root/mock-configs/$cfg.$extension";
     return if !-f $src;
-    my $dst = "/etc/mock/$cfg.cfg";
+    my $dst = "/etc/mock/$cfg.$extension";
     if (-f $dst) {
         die "$dst differs from $src: the build would not use the configuration shipped in this"
           . " tree. Remove or update the host copy (it is never overwritten here) and rerun.\n"
@@ -984,6 +1077,145 @@ sub install_mock_cfg {
     chmod 0644, $dst;
 }
 
+sub source_rpm_build_command {
+    my ($builder, $target, $uniqueext, $result, $log, $work) = @_;
+    my $cfg = "$work/mock-deterministic.cfg";
+    if (!$dry_run) {
+        make_path($work, $result);
+        open my $fh, '>', $cfg or die "Cannot write $cfg: $!\n";
+        print {$fh} "include('/etc/mock/$target.cfg')\n";
+        print {$fh} "config_opts['environment']['SOURCE_DATE_EPOCH'] = '$SOURCE_DATE_EPOCH'\n";
+        close $fh or die "Cannot close $cfg: $!\n";
+    }
+    my $mock = join(' ', 'mock', '-r', sh_quote($cfg), '--uniqueext', sh_quote($uniqueext),
+        '--define', sh_quote('use_source_date_epoch_as_buildtime 1'),
+        '--define', sh_quote('clamp_mtime_to_source_date_epoch 1'),
+        '--define', sh_quote('_buildhost xcat-build'));
+    $mock .= join('', map { ' --define ' . sh_quote($_) } @{$builder->{defines} // []});
+    my $srpm = sh_quote($builder->{srpm});
+    my $prefix = '';
+    if ($RELEASE_BUMP ne '' || @{$builder->{patches} // []} || @{$builder->{defines} // []}) {
+        my $top = "$work/restamp";
+        if (!$dry_run) {
+            make_path(map { "$top/$_" } qw(BUILD BUILDROOT RPMS SOURCES SPECS SRPMS));
+        }
+        run_step(step => "Unpack source RPM: $builder->{name}",
+            cmd => 'rpm -i --define ' . sh_quote("_topdir $top") . " $srpm",
+            log => "$log/srpm-unpack.log");
+        my @specs = $dry_run ? ("$top/SPECS/*.spec") : bsd_glob("$top/SPECS/*.spec");
+        die "Expected one spec in source RPM: $builder->{srpm}\n" unless @specs == 1;
+        bump_dep_release_suffix($top, $RELEASE_BUMP) if !$dry_run && $RELEASE_BUMP ne '';
+        for my $patch (@{$builder->{patches} // []}) {
+            my $path = $patch->{staged} // $patch->{absolute_path};
+            die "Source patch SHA256 mismatch: $path\n" unless digest_file($path) eq $patch->{sha256};
+            run_step(step => "Apply native source patch: $builder->{name}",
+                cmd => 'patch --batch --fuzz=0 -p1 -d ' . sh_quote("$top/SPECS")
+                    . ' -i ' . sh_quote($path), log => "$log/spec-patch.log");
+        }
+        my $restamped = "$work/restamp-srpm";
+        make_path($restamped) unless $dry_run;
+        $prefix = "$mock --buildsrpm --spec " . sh_quote($specs[0])
+            . ' --sources ' . sh_quote("$top/SOURCES") . ' --resultdir ' . sh_quote($restamped)
+            . ' && set -- ' . sh_quote($restamped) . '/*.src.rpm'
+            . ' && test "$#" -eq 1 && test -f "$1" && ';
+        $srpm = '"$1"';
+    }
+    return $prefix . "$mock --rebuild $srpm --resultdir " . sh_quote($result);
+}
+
+sub native_owner_command {
+    my ($plan, $target, $command, $uid) = @_;
+    my $overlay = $plan->{overlays}{$uid} // die "Missing native mock overlay\n";
+    my $script = 'mount --bind ' . sh_quote($overlay) . ' ' . sh_quote("/etc/mock/$target.cfg")
+        . ' && exec sh -c ' . sh_quote($command);
+    return 'unshare --mount --propagation private -- sh -c ' . sh_quote($script);
+}
+
+sub native_overlay {
+    my ($plan, $target, $work, $prereqs) = @_;
+    $plan->{overlays} = {1000 => "$work/native-1000.cfg", 0 => "$work/native-genesis-0.cfg",
+        procenv => "$work/native-procenv-bootstrap.cfg"};
+    return if $dry_run;
+    my $base = "$work/native-base.cfg";
+    copy("/etc/mock/$target.cfg", $base) or die "Cannot snapshot native mock configuration: $!\n";
+    my $url = $prereqs;
+    $url =~ s{([^A-Za-z0-9_./~-])}{sprintf('%%%02X', ord($1))}ge;
+    my $repo = "\n[xcat-native-inputs]\nname=xCAT native build prerequisites\nbaseurl=file://$url\n"
+        . "gpgkey=file://$url/repodata/repomd.xml.key\ngpgcheck=1\nrepo_gpgcheck=1\n"
+        . "enabled=1\nskip_if_unavailable=0\n";
+    for my $key (1000, 0, 'procenv') {
+        my $uid = $key eq 'procenv' ? 1000 : $key;
+        open my $fh, '>', $plan->{overlays}{$key} or die "Cannot write native overlay: $!\n";
+        print {$fh} 'include(' . JSON::PP->new->encode($base) . ")\n";
+        print {$fh} "config_opts['chrootuid'] = $uid\nconfig_opts['chrootgid'] = 1000\n";
+        print {$fh} "config_opts['dnf.conf'] += \"\"\"$repo\"\"\"\n";
+        print {$fh} "config_opts['plugin_conf']['bind_mount_enable'] = True\n";
+        print {$fh} "config_opts['plugin_conf']['procenv_enable'] = " . ($key eq 'procenv' ? 'False' : 'True') . "\n";
+        print {$fh} "config_opts['plugin_conf']['bind_mount_opts']['dirs'].append("
+            . '(' . JSON::PP->new->encode($prereqs) . ', ' . JSON::PP->new->encode($prereqs) . "))\n";
+        close $fh or die "Cannot close native overlay: $!\n";
+    }
+    open my $ledger, '>', "$work/native-overlays.json" or die "Cannot record native overlays: $!\n";
+    print {$ledger} JSON::PP->new->canonical->pretty->encode({base => {path => $base, sha256 => digest_file($base)},
+        overlays => [map { {purpose => $_, path => $plan->{overlays}{$_}, sha256 => digest_file($plan->{overlays}{$_})} } (1000, 0, 'procenv')]});
+    close $ledger or die "Cannot close native overlay ledger: $!\n";
+}
+
+sub build_native_inputs {
+    my ($plan, $target, $req, $work, $logs) = @_;
+    my $prereqs = "$work/native-prerequisites";
+    my $runtime = "$work/native-runtime";
+    my @source_roots;
+    make_path($prereqs, $runtime) unless $dry_run;
+    for my $name (@{$plan->{order}}) {
+        my $node = $plan->{nodes}{$name};
+        next unless $node->{type} eq 'publisher';
+        next if $dry_run;
+        verify_input($plan, $node, $node->{staged}, $plan->{trust_db});
+        copy($node->{staged}, "$prereqs/" . basename($node->{staged})) or die "Cannot stage publisher RPM: $!\n";
+        if ($req->{$name}) {
+            copy($node->{staged}, "$runtime/" . basename($node->{staged})) or die "Cannot collect publisher RPM: $!\n";
+        }
+    }
+    sign_and_index_repo($prereqs, $plan) unless $dry_run;
+    native_overlay($plan, $target, $work, $prereqs);
+    my $sequence = 0;
+    for my $name (@{$plan->{order}}) {
+        my $node = $plan->{nodes}{$name};
+        next unless $node->{type} eq 'srpm';
+        my $result = "$work/native-results/$name";
+        my $log = "$logs/native/$name";
+        my $uniqueext = build_mock_uniqueext("$target-$run_id", ++$sequence, $name);
+        my %builder = (%$node, srpm => $node->{staged} // "$work/native-inputs/$name/" . basename($node->{url}));
+        my $command = source_rpm_build_command(\%builder, $target, $uniqueext, $result, $log,
+            "$work/native-source/$name");
+        run_step(step => "Build native prerequisite: $name", log => "$log/run.log",
+            cmd => native_owner_command($plan, $target, $command, $name eq 'procenv' ? 'procenv' : 1000));
+        next if $dry_run;
+        my @rpms = grep { !/\.src\.rpm$/ } bsd_glob("$result/*.rpm");
+        validate_outputs($node, \@rpms, 1);
+        for my $rpm (@rpms) {
+            my $base = basename($rpm);
+            die "Conflicting native prerequisite artifact: $base\n" if -e "$prereqs/$base";
+            copy($rpm, "$prereqs/$base") or die "Cannot stage native prerequisite: $!\n";
+            my $id = rpm_identity($rpm);
+            copy($rpm, "$runtime/$base") or die "Cannot collect native output: $!\n" if $req->{$id->{name}};
+        }
+        sign_and_index_repo($prereqs, $plan);
+        my @problems = verify_rpms_checksig($prereqs, $gpg_key_name, $gpg_home, $plan);
+        die "Native prerequisite signature failure: @problems\n" if @problems;
+        open my $ledger, '>>', "$work/native-results.jsonl" or die "Cannot record native result: $!\n";
+        print {$ledger} JSON::PP->new->canonical->encode({name => $name, source_sha256 => $node->{sha256},
+            defines => $node->{defines} // [], patches => [map { {path => $_->{path}, sha256 => $_->{sha256}} } @{$node->{patches} // []}],
+            outputs => [map { {name => rpm_identity($_)->{name}, unsigned_path => $_,
+                unsigned_sha256 => digest_file($_), signed_sha256 => digest_file("$prereqs/" . basename($_))} } @rpms]}) . "\n";
+        close $ledger or die "Cannot close native result ledger: $!\n";
+        push @source_roots, $result;
+        scrub_buildroot($target, $uniqueext, "$log/scrub.log") unless $keep_buildroots;
+    }
+    return ($runtime, \@source_roots);
+}
+
 # Assemble the built per-target repo into the deployable, signed per-EL layout
 # <repo-dep>/rh<rel>/<arch>: copy the binary rpms, sign, createrepo, and drop the
 # xcat-dep.repo / mklocalrepo.sh / buildinfo.txt (ready to push to xcat.org).
@@ -992,7 +1224,8 @@ sub deploy_target {
     my $rel   = $info->{rel};
     my $src   = $info->{repo_dir};
     my $tarch = $info->{profile}{arch};
-    my $dest  = "$repo_dep/rh$rel/$tarch";
+    my $subdir = openeuler_repo_subdir($tgt) // "rh$rel/$tarch";
+    my $dest  = "$repo_dep/$subdir";
     print_step("Deploy $tgt -> $dest");
     return if $dry_run;
 
@@ -1020,8 +1253,8 @@ sub deploy_target {
         # rpm an earlier layout left in the collection. On the STAGE, so the published cell is
         # already correct when it is swapped in.
         remove_genesis_packages($stage, 0) if $genesis_release;
-        sign_and_index_repo($stage);
-        write_dep_repo_metadata($stage, $rel, $tarch);
+        sign_and_index_repo($stage, $NATIVE_PLANS{$tgt});
+        write_dep_repo_metadata($stage, $rel, $tarch, $subdir);
         # Automatic completeness + signature gate on the freshly signed cell -- the single
         # consolidated gate (verify_target_repo, the same one --verify-repo runs). Asserts every
         # manifest-required package is present at its pinned version, the repomd signature verifies,
@@ -1051,7 +1284,7 @@ sub deploy_target {
     remove_tree($old) if -d $old;
 
     my $n = scalar(grep { !/\.src\.rpm$/ } bsd_glob("$dest/*.rpm"));
-    print "Deployed rh$rel/$tarch: $n rpms\n";
+    print "Deployed $subdir: $n rpms\n";
 }
 
 sub publish_genesis_common_repo {
@@ -1176,8 +1409,22 @@ sub createrepo_c_cmd {
 }
 
 sub sign_and_index_repo {
-    my ($dir) = @_;
+    my ($dir, $native) = @_;
     my @rpms = grep { !/\.src\.rpm$/ } bsd_glob("$dir/*.rpm");
+    if ($native) {
+        my @built;
+        for my $rpm (@rpms) {
+            my $id = rpm_identity($rpm);
+            my $owner = $native->{outputs}{$id->{name}} // die "Undeclared native output: $id->{name}\n";
+            my $node = $native->{nodes}{$owner};
+            if ($node->{type} eq 'publisher') {
+                die "Publisher input changed before signing: $rpm\n" unless digest_file($rpm) eq $node->{sha256};
+            } else {
+                push @built, $rpm;
+            }
+        }
+        @rpms = @built;
+    }
     if ($gpg_sign && @rpms) {
         local $ENV{GNUPGHOME} = $gpg_home if $gpg_home;
         run_simple('rpmsign --define ' . shell_quote("%_gpg_name $gpg_key_name")
@@ -1191,21 +1438,26 @@ sub sign_and_index_repo {
         unlink "$repomd.asc" if -f "$repomd.asc";
         run_simple("gpg -a --detach-sign --default-key " . sh_quote($gpg_key_name) . ' ' . sh_quote($repomd));
         run_simple("gpg -a --export " . sh_quote($gpg_key_name) . " > " . sh_quote("$repomd.key"));
+        if ($native) {
+            run_simple('cat ' . sh_quote($native->{publisher_key}) . ' >> ' . sh_quote("$repomd.key"));
+        }
     }
 }
 
 sub write_dep_repo_metadata {
-    my ($dir, $rel, $tarch) = @_;
-    my $baseurl = "https://xcat.org/files/xcat/repos/yum/devel/xcat-dep/rh$rel/$tarch";
-    my $gpgcheck = $gpg_sign ? 1 : 0;
-    my $gpgkey_line = $gpg_sign ? "gpgkey=$baseurl/repodata/repomd.xml.key" : "# gpgkey=";
+    my ($dir, $rel, $tarch, $subdir) = @_;
+    $subdir //= "rh$rel/$tarch";
+    my $baseurl = "https://xcat.org/files/xcat/repos/yum/devel/xcat-dep/$subdir";
+    my $gpgcheck = $gpg_sign || $subdir =~ /^openeuler/ ? 1 : 0;
+    my $gpgkey_line = $gpgcheck ? "gpgkey=$baseurl/repodata/repomd.xml.key" : "# gpgkey=";
+    my $label = $subdir =~ /^openeuler/ ? $subdir : "rh$rel $tarch";
     # repo_gpgcheck=1 makes clients verify the DETACHED repomd.xml signature (repomd.xml.asc) against
     # gpgkey before trusting the metadata -- sign_and_index_repo produces both, so enforce it. Mirrors
     # gpgcheck: off when the repo is unsigned.
     open my $r, '>', "$dir/xcat-dep.repo" or die "Cannot write $dir/xcat-dep.repo: $!\n";
     print {$r} <<"EOF";
 [xcat-dep]
-name=xCAT 2 dependencies (rh$rel $tarch)
+name=xCAT 2 dependencies ($label)
 baseurl=$baseurl
 enabled=1
 gpgcheck=$gpgcheck
@@ -1215,7 +1467,7 @@ EOF
     close $r;
 
     write_local_repo_helper($dir);
-    write_buildinfo($dir, "rh$rel/$tarch");
+    write_buildinfo($dir, $subdir);
 }
 
 sub write_common_repo_metadata {
@@ -1273,6 +1525,10 @@ sub write_buildinfo {
     my $build_time = strftime("%a %b %e %H:%M:%S %Z %Y", gmtime($SOURCE_DATE_EPOCH));
     my $build_machine = `hostname`; chomp $build_machine;
     my $commit = `git -C "$repo_root" rev-parse HEAD 2>/dev/null`; chomp $commit;
+    if (!$commit && -f "$repo_root/Gitinfo") {
+        ($commit) = read_lines("$repo_root/Gitinfo");
+        $commit =~ s/\s+\z// if defined($commit);
+    }
     $commit ||= 'unknown';
     my $commit_short = substr($commit, 0, 7);
     my $release = strftime('snap%Y%m%d%H%M', gmtime($SOURCE_DATE_EPOCH));
@@ -1339,7 +1595,9 @@ Options:
                           the target is present at a version satisfying its pin AND that the repomd
                           is signed by --gpg-key-name; exits 0 if complete, or lists each MISSING/
                           VERSION/UNSIGNED/WRONGKEY problem and fails. The target is derived from the path
-                          (.../rh<N>/<arch> -> alma+epel-<N>-<arch>) unless --target is given; the
+                          (.../rh<N>/<arch> -> alma+epel-<N>-<arch>, or
+                          .../openeuler<releaseSP>/<arch> -> openeuler-<releaseSP>-<arch>)
+                          unless --target is given; the
                           manifest and gpg key/home come from the usual options. Use alone.
   --no-verify-repo        Suppress the AUTOMATIC post-build completeness+signature gate that runs
                           after each target's repo is finalized (default: verification ON)
@@ -1349,7 +1607,12 @@ Options:
   --target NAME           Build only this target (<ID>+epel-<REL>-<ARCH>, or a forcearch
                           config from mock-configs/ such as rocky-10-riscv64-xcat, which
                           cross-builds that arch on this host); default is the host arch
-                          across rh8, rh9 and rh10
+                          across rh8, rh9 and rh10. On openEuler the default retains the exact
+                          host release and service pack, e.g. openeuler-24.03sp3-x86_64.
+                          Native targets require the matching host architecture and deploy to
+                          <repo-dep>/openeuler<releaseSP>/<arch> with signature checks enabled.
+                          The build host must provide mock and its Perl dependencies; openEuler
+                          24.03 LTS-SP3 can build older releases in their exact native targets.
   --nproc N               Parallel jobs for buildrpms.pl (default: 1)
   --parallel-builds N     Max concurrent top-level build steps within one EL target (default: auto)
   --parallel-targets N    Concurrent EL targets (rh8/rh9/rh10). 0/auto = all at once, 1 = serial,
@@ -1669,7 +1932,7 @@ sub rpm_vercmp_segment {
 # check: it verifies each rpm's header/payload digests AND that the signature is by this key (NOKEY /
 # NOT OK => a real failure, since the key IS imported). Returns @problems.
 sub verify_rpms_checksig {
-    my ($dir, $keyname, $home) = @_;
+    my ($dir, $keyname, $home, $native) = @_;
     my @rpms = grep { !/\.src\.rpm$/ } glob("$dir/*.rpm");
     return () unless @rpms;
     require_command('rpmkeys');
@@ -1682,9 +1945,27 @@ sub verify_rpms_checksig {
     my $dbopt = '--dbpath ' . sh_quote($tmpdb);
     system("rpmkeys $dbopt --import " . sh_quote($keyfile) . ' >/dev/null 2>&1') == 0
         or return ("SIGKEY: rpmkeys --import of '$keyname' into the temp keyring failed");
+    my $publisher_db;
+    if ($native) {
+        my $trust = tempdir('native-publisher-XXXXXXXX', TMPDIR => 1, CLEANUP => 1);
+        my $ok = eval { $publisher_db = publisher_trust($native, $trust); 1; };
+        return ("SIGKEY: $@") unless $ok;
+    }
     my @problems;
     for my $rpm (@rpms) {
-        my $out = `rpmkeys $dbopt --checksig -v ${\ sh_quote($rpm)} 2>&1`;
+        my $rpm_dbopt = $dbopt;
+        if ($native) {
+            my $id = rpm_identity($rpm);
+            my $owner = $native->{outputs}{$id->{name}};
+            if (!$owner) { push @problems, "Undeclared native output: $id->{name}"; next; }
+            my $node = $native->{nodes}{$owner};
+            if ($node->{type} eq 'publisher') {
+                my $ok = eval { verify_input($native, $node, $rpm, $publisher_db); 1; };
+                push @problems, $@ unless $ok;
+                next;
+            }
+        }
+        my $out = `rpmkeys $rpm_dbopt --checksig -v ${\ sh_quote($rpm)} 2>&1`;
         push @problems, rpmkeys_checksig_problem(basename($rpm), $? >> 8, $out);
     }
     return @problems;
@@ -1725,6 +2006,7 @@ sub verify_target_repo {
     my %MAN = read_manifest($manifest);
     my %req = %{ $MAN{$tgt} // {} };
     die "FATAL: no manifest section for target '$tgt' in $manifest\n" if !%req;
+    my $native;
     # The WHOLE manifest, deliberately -- the --skip-* flags are NOT applied here. They say what
     # this INVOCATION built; they never say what the verified repository may be missing. Honouring
     # them let a repo with no xCAT-genesis-base pass whenever the verifying run happened to carry
@@ -1738,6 +2020,10 @@ sub verify_target_repo {
     my %present_evr = map { $_ => rpm_evr($dir, $_) } @names;
     my %expected = map { $_ => $req{$_} } @names;
     my @problems = verify_repo_packages(\%expected, \%present, \%present_evr, \&rpm_vercmp_segment);
+    if ($tgt eq 'openeuler-24.03-ppc64le') {
+        eval { $native = load_inputs($repo_root, \%req); 1 }
+            or push @problems, "Native input catalog: $@";
+    }
 
     # Signature gate: the IO (gpg) lives here; the decision is the pure verify_repo_signature. The
     # pipeline always signs, so a signed repo's repomd MUST be signed by --gpg-key-name. We resolve
@@ -1765,7 +2051,7 @@ sub verify_target_repo {
             require_command('rpm');
             # (a) RPM-native crypto verification: rpmkeys --checksig against an isolated keyring
             # holding only this key verifies every rpm's digests AND that the signature is by the key.
-            push @problems, verify_rpms_checksig($dir, $gpg_key_name, $gpg_home);
+            push @problems, verify_rpms_checksig($dir, $gpg_key_name, $gpg_home, $native);
             # (b) Explicit signer-id origin check kept alongside: assert each rpm's header signature
             # key id is one of this key's ids (primary/subkey).
             my $accept = gpg_key_ids($gpg_key_name, $gpg_home);
@@ -1773,7 +2059,7 @@ sub verify_target_repo {
                 push @problems, "SIGKEY: cannot list key ids for '$gpg_key_name' to verify per-rpm signatures";
             } else {
                 my @rpm_sigs = map { [ basename($_), rpm_signer_keyid($_) ] }
-                               grep { !/\.src\.rpm$/ } glob("$dir/*.rpm");
+                               grep { !/\.src\.rpm$/ && (!$native || !native_publisher_rpm($native, $_)) } glob("$dir/*.rpm");
                 push @problems, verify_rpm_signatures(\@rpm_sigs, $accept);
             }
         }
@@ -1794,6 +2080,13 @@ sub verify_target_repo {
     return 1;
 }
 
+sub native_publisher_rpm {
+    my ($plan, $rpm) = @_;
+    my $id = rpm_identity($rpm);
+    my $owner = $plan->{outputs}{$id->{name}} // return 0;
+    return $plan->{nodes}{$owner}{type} eq 'publisher';
+}
+
 # derive_target_from_repo_path: map a deployed per-target repo path .../rh<N>/<arch> to its manifest
 # target section name alma+epel-<N>-<arch>. Returns undef when the path lacks that rh<N>/<arch> tail,
 # so the standalone --verify-repo mode can require an explicit --target instead.
@@ -1802,6 +2095,9 @@ sub derive_target_from_repo_path {
     my $tgt;
     return $tgt unless defined $dir;
     $tgt = "alma+epel-$1-$2" if $dir =~ m{/rh(\d+)/([^/]+)/*$};
+    if ($dir =~ m{/openeuler((?:20|22|24)\.03(?:sp[1-9][0-9]*)?)/(x86_64|ppc64le)/*$}) {
+        $tgt = "openeuler-$1-$2";
+    }
     return $tgt;
 }
 
@@ -2150,4 +2446,3 @@ sub slurp_chomp {
     chomp $line if defined $line;
     return $line // '';
 }
-
diff --git a/openeuler/24.03-ppc64le.inputs.json b/openeuler/24.03-ppc64le.inputs.json
new file mode 100644
index 0000000..8c0af3c
--- /dev/null
+++ b/openeuler/24.03-ppc64le.inputs.json
@@ -0,0 +1,1123 @@
+{
+  "version": 1,
+  "target": "openeuler-24.03-ppc64le",
+  "publisher_key": {
+    "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/RPM-GPG-KEY-openEuler",
+    "sha256": "006e79d37c10e74c24df6d07c4efc4176515cec009daa5ed493b06f5b6ef39c1",
+    "fingerprint": "8AA16BF9F2CA5244010DCA963B477C60B675600B",
+    "path": "openeuler/RPM-GPG-KEY-openEuler-24.03-LTS"
+  },
+  "build_inputs": [
+    "perl-CPAN-Changes",
+    "perl-Class-Method-Modifiers",
+    "perl-Data-OptList",
+    "perl-Data-Section",
+    "perl-Devel-GlobalDestruction",
+    "perl-Devel-Symdump",
+    "perl-ExtUtils-CBuilder",
+    "perl-Import-Into",
+    "perl-MRO-Compat",
+    "perl-Module-Build",
+    "perl-Module-Runtime",
+    "perl-Moo",
+    "perl-Package-Generator",
+    "perl-Parallel-ForkManager",
+    "perl-Path-Class",
+    "perl-Pod-Coverage",
+    "perl-Role-Tiny",
+    "perl-Software-License",
+    "perl-Sub-Exporter",
+    "perl-Sub-Exporter-Progressive",
+    "perl-Sub-Install",
+    "perl-Sub-Quote",
+    "perl-Sub-Uplevel",
+    "perl-Test-Exception",
+    "perl-Test-Pod",
+    "perl-Test-Pod-Coverage",
+    "perl-Test-Warnings",
+    "perl-Text-Template",
+    "perl-XML-XPath",
+    "perl-inc-latest",
+    "python3-mock",
+    "python3-pbr",
+    "python3-wheel",
+    "procenv"
+  ],
+  "bootstrap_inputs": [
+    "mock",
+    "perl-Params-Util",
+    "python-psutil",
+    "python-pyroute2",
+    "perl-PerlIO-utf8_strict",
+    "perl-File-Slurper",
+    "procenv"
+  ],
+  "inputs": [
+    {
+      "name": "ksh",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/ksh-1.0.8-1.oe2403.src.rpm",
+      "sha256": "06d31f1ed0213f58d7009d5830bec3b3cb26878c4ae4deaeb8f8f4d74acb33fb",
+      "outputs": [
+        "ksh",
+        "ksh-debuginfo",
+        "ksh-debugsource"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "net-snmp",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/net-snmp-5.9.3-2.oe2403.src.rpm",
+      "sha256": "c6edbda654e5f4416e19c3f56004457daf72e4ae7058f118030c3442c486930b",
+      "outputs": [
+        "net-snmp",
+        "net-snmp-debuginfo",
+        "net-snmp-debugsource",
+        "net-snmp-devel",
+        "net-snmp-gui",
+        "net-snmp-help",
+        "net-snmp-libs",
+        "net-snmp-perl",
+        "python3-net-snmp"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "perl-DB_File",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/perl-DB_File-1.859-1.oe2403.src.rpm",
+      "sha256": "cce82dd316ed906fde94ec69e5d0298322dc4b14dba89dd3151c2823f404e8b3",
+      "outputs": [
+        "perl-DB_File",
+        "perl-DB_File-debuginfo",
+        "perl-DB_File-debugsource",
+        "perl-DB_File-help"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "perl-Digest-SHA1",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/perl-Digest-SHA1-2.13-27.oe2403.src.rpm",
+      "sha256": "2761ba4d7f43727908af232cd03b2d872f245380acfecc9cf7b65d0a2da83060",
+      "outputs": [
+        "perl-Digest-SHA1",
+        "perl-Digest-SHA1-debuginfo",
+        "perl-Digest-SHA1-debugsource",
+        "perl-Digest-SHA1-help"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "perl-IO-Tty",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/perl-IO-Tty-1.17-1.oe2403.src.rpm",
+      "sha256": "28a795eb3d834e10760dfa7e016e697c6e5c3acbdb35ee5c3971b44146c3e903",
+      "outputs": [
+        "perl-IO-Tty",
+        "perl-IO-Tty-debuginfo",
+        "perl-IO-Tty-debugsource",
+        "perl-IO-Tty-help"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "perl-Sys-Virt",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/perl-Sys-Virt-4.7.0-3.oe2403.src.rpm",
+      "sha256": "a7603e7e27afb1aa60c69852c583fc0837a895fd3975aabf7470013d4f798482",
+      "outputs": [
+        "perl-Sys-Virt",
+        "perl-Sys-Virt-debuginfo",
+        "perl-Sys-Virt-debugsource",
+        "perl-Sys-Virt-help"
+      ],
+      "needs": [
+        "perl-Params-Util",
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "nasm",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/nasm-2.16.01-1.oe2403.src.rpm",
+      "sha256": "0dac600e4da291eefb1986daabea54f9bf60aeeb5b8c8940faeb86dbcd20ea4a",
+      "outputs": [
+        "nasm",
+        "nasm-debuginfo",
+        "nasm-debugsource",
+        "nasm-help"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "docbook-style-dsssl",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/docbook-style-dsssl-1.79-28.oe2403.src.rpm",
+      "sha256": "9bc538924ce5c76e0006cd25cb1af34a3ea9b754bbd25c6fc1a65416274e5b4a",
+      "outputs": [
+        "docbook-style-dsssl",
+        "docbook-style-dsssl-help"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "docbook-utils",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/docbook-utils-0.6.14-47.oe2403.src.rpm",
+      "sha256": "2337c62d716bafcb90910f8a530d7a037ca6d93905d0b26cfb27a2d2ecf39d05",
+      "outputs": [
+        "docbook-utils",
+        "docbook-utils-help",
+        "docbook-utils-pdf"
+      ],
+      "needs": [
+        "docbook-style-dsssl",
+        "openjade",
+        "perl-SGMLSpm",
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "elinks",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/elinks-0.12-4.oe2403.src.rpm",
+      "sha256": "bd7e4695311b3eb259af15bb2a5c6154675de9cf07bf3b260591bb50ee19c40f",
+      "outputs": [
+        "elinks",
+        "elinks-debuginfo",
+        "elinks-debugsource",
+        "elinks-help"
+      ],
+      "needs": [
+        "lua",
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "help2man",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/help2man-1.49.3-1.oe2403.src.rpm",
+      "sha256": "438f7a27f86e4906d03cb1451e93b6ae189948a4287a2cbd3ce3aa75b83f7eec",
+      "outputs": [
+        "help2man",
+        "help2man-debuginfo",
+        "help2man-debugsource",
+        "help2man-help"
+      ],
+      "needs": [
+        "perl-gettext",
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "lua",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/lua-5.4.6-1.oe2403.src.rpm",
+      "sha256": "6e327bf54d114f3c6fb849a92fd8530e7d093d14e566cc9eca69e8ccd980f7ab",
+      "outputs": [
+        "lua",
+        "lua-debuginfo",
+        "lua-debugsource",
+        "lua-devel",
+        "lua-help"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "multilib-rpm-config",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/multilib-rpm-config-1-16.oe2403.src.rpm",
+      "sha256": "807e501bf7a52e868a69fdb5c412a996858c835596e90786279257a80b63c84c",
+      "outputs": [
+        "multilib-rpm-config"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "openjade",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/openjade-1.3.2-61.oe2403.src.rpm",
+      "sha256": "418003efee45c62a3c1576d960cfec704d328bf4c992362444c49ad9266955f2",
+      "outputs": [
+        "openjade",
+        "openjade-debuginfo",
+        "openjade-debugsource",
+        "openjade-help"
+      ],
+      "needs": [
+        "opensp",
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "opensp",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/opensp-1.5.2-31.oe2403.src.rpm",
+      "sha256": "12dcec9276c9234fb05424ee668f046e04c42e48300bf4c2f5c97d3182f48785",
+      "outputs": [
+        "opensp",
+        "opensp-debuginfo",
+        "opensp-debugsource",
+        "opensp-devel"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "perl-Data-UUID",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/perl-Data-UUID-1.226-1.oe2403.src.rpm",
+      "sha256": "bff5621c60eb5d5e883e222c4e4a6654f6b6babde1ecfbd350a9a82d4f986143",
+      "outputs": [
+        "perl-Data-UUID",
+        "perl-Data-UUID-debuginfo",
+        "perl-Data-UUID-debugsource",
+        "perl-Data-UUID-help"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "perl-SGMLSpm",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/perl-SGMLSpm-1.03ii-46.oe2403.src.rpm",
+      "sha256": "d64347233d55e1fed96b3f0956a6b6654875eed1bb691d19b381a824be5e48b6",
+      "outputs": [
+        "perl-SGMLSpm",
+        "perl-SGMLSpm-help"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "perl-gettext",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/perl-gettext-1.07-15.oe2403.src.rpm",
+      "sha256": "4c957422db0487ad914ce71dea89c81eb17d9ffd5fc4388cba79e4f449eb1146",
+      "outputs": [
+        "perl-Locale-gettext",
+        "perl-gettext-debuginfo",
+        "perl-gettext-debugsource",
+        "perl-gettext-help"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "uuid",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/uuid-1.6.2-47.oe2403.src.rpm",
+      "sha256": "208ec1a90ac611a11527eb813fe94bd8349085b9e10ac4d784c551933633a7f5",
+      "outputs": [
+        "uuid",
+        "uuid-c++",
+        "uuid-c++-devel",
+        "uuid-dce",
+        "uuid-dce-devel",
+        "uuid-debuginfo",
+        "uuid-debugsource",
+        "uuid-devel",
+        "uuid-help",
+        "uuid-perl"
+      ],
+      "needs": [
+        "perl-Data-UUID",
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "postgresql",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/postgresql-15.6-1.oe2403.src.rpm",
+      "sha256": "0e1dd792cccf353f7a0d7f3f9d13b1a22a7ace0a428f4b197193b99c58081960",
+      "outputs": [
+        "postgresql",
+        "postgresql-contrib",
+        "postgresql-debuginfo",
+        "postgresql-debugsource",
+        "postgresql-docs",
+        "postgresql-plperl",
+        "postgresql-plpython3",
+        "postgresql-pltcl",
+        "postgresql-private-devel",
+        "postgresql-private-libs",
+        "postgresql-server",
+        "postgresql-server-devel",
+        "postgresql-static",
+        "postgresql-test",
+        "postgresql-test-rpm-macros"
+      ],
+      "needs": [
+        "docbook-utils",
+        "elinks",
+        "help2man",
+        "multilib-rpm-config",
+        "procenv",
+        "uuid"
+      ],
+      "patches": [
+        {
+          "path": "postgresql/postgresql-15.6-openeuler-llvmjit-buildrequires.patch",
+          "sha256": "799a90eb82321722d11ffc421d4b09684f2939c44bfdc71a6c9b039a4f4d8592"
+        }
+      ],
+      "defines": [
+        "llvmjit 0",
+        "external_libpq 0",
+        "runselftest 1",
+        "test 1"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "perl-DBD-Pg",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/perl-DBD-Pg-3.18.0-1.oe2403.src.rpm",
+      "sha256": "5bb91b28459ee5754c031cf62471c86a887392587c261c8df61ab44e4c8caf09",
+      "outputs": [
+        "perl-DBD-Pg",
+        "perl-DBD-Pg-debuginfo",
+        "perl-DBD-Pg-debugsource",
+        "perl-DBD-Pg-help"
+      ],
+      "needs": [
+        "postgresql",
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "perl-CGI",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-CGI-4.57-1.oe2403.noarch.rpm",
+      "sha256": "98609a3a6c210a676a14960531cd5c82a86667da7aacea0c6e693ccbee612ee3",
+      "outputs": [
+        "perl-CGI"
+      ],
+      "needs": [],
+      "runtime": true
+    },
+    {
+      "name": "perl-CPAN-Changes",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-CPAN-Changes-0.400002-10.oe2403.noarch.rpm",
+      "sha256": "95c2a1939b26e201a07d128851b53a4fff7522b84f7a9ddb0947edf1f1ed2505",
+      "outputs": [
+        "perl-CPAN-Changes"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Class-Method-Modifiers",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Class-Method-Modifiers-2.15-1.oe2403.noarch.rpm",
+      "sha256": "e92f880e1a3eef95025938da643e07a05db0d7f2eda140a1fdaeef64d6c0a8a7",
+      "outputs": [
+        "perl-Class-Method-Modifiers"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Crypt-CBC",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Crypt-CBC-2.33-22.oe2403.noarch.rpm",
+      "sha256": "60f2dd1de7c4143301bcc1a35d52f3b69b3c40effe377a5740114d58a1205fc0",
+      "outputs": [
+        "perl-Crypt-CBC"
+      ],
+      "needs": [],
+      "runtime": true
+    },
+    {
+      "name": "perl-Data-OptList",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Data-OptList-0.114-1.oe2403.noarch.rpm",
+      "sha256": "68176d8117d5bbab5761e9b658465e96e01ecf5d6daa0e3cb400b45d77b3ecaf",
+      "outputs": [
+        "perl-Data-OptList"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Data-Section",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Data-Section-0.200007-6.oe2403.noarch.rpm",
+      "sha256": "fb307d87653b15130f0bb0480761a7e86eed8052399977f9a811977b10792f62",
+      "outputs": [
+        "perl-Data-Section"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Devel-GlobalDestruction",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Devel-GlobalDestruction-0.14-8.oe2403.noarch.rpm",
+      "sha256": "f141968f5359ed78945f08b042782889f3ff30b0d41a8ed8e9a284f1ecb80c54",
+      "outputs": [
+        "perl-Devel-GlobalDestruction"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Devel-Symdump",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Devel-Symdump-2.18-9.oe2403.noarch.rpm",
+      "sha256": "a304653f87360e565bb40f91569ccf168535f8b9e801536da9f5993cc5ca15c7",
+      "outputs": [
+        "perl-Devel-Symdump"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Expect",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Expect-1.35-7.oe2403.noarch.rpm",
+      "sha256": "a99336a76e9c9245026e7e4dc8cbddd5386dce30de91de0013905cbc9cbe9a41",
+      "outputs": [
+        "perl-Expect"
+      ],
+      "needs": [],
+      "runtime": true
+    },
+    {
+      "name": "perl-ExtUtils-CBuilder",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-ExtUtils-CBuilder-0.280236-1.oe2403.noarch.rpm",
+      "sha256": "fa99812f5cfff7d24fcbc98b40741db286e1dcfb4412ad9cdcf47fcf7722a474",
+      "outputs": [
+        "perl-ExtUtils-CBuilder"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-HTML-Form",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-HTML-Form-6.11-1.oe2403.noarch.rpm",
+      "sha256": "163a17e21393bb97e8c2e16b9ac163aea99983c294ded47c00f98998bcb1caff",
+      "outputs": [
+        "perl-HTML-Form"
+      ],
+      "needs": [],
+      "runtime": true
+    },
+    {
+      "name": "perl-Import-Into",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Import-Into-1.002005-2.oe2403.noarch.rpm",
+      "sha256": "a5bad0bbf3e5ae2789857799114f84867b7c93044b233754d238dd97b2ad563d",
+      "outputs": [
+        "perl-Import-Into"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-LWP-Protocol-https",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-LWP-Protocol-https-6.10-1.oe2403.noarch.rpm",
+      "sha256": "ee20297e3736754b5751b4160ac9a236d2d876a5bc85a7ba7bada51928bf9f74",
+      "outputs": [
+        "perl-LWP-Protocol-https"
+      ],
+      "needs": [],
+      "runtime": true
+    },
+    {
+      "name": "perl-MRO-Compat",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-MRO-Compat-0.15-1.oe2403.noarch.rpm",
+      "sha256": "3c0bb3b8a227e1682c262fb3456179da9bd2f50f47665c421104944cdb0bb0da",
+      "outputs": [
+        "perl-MRO-Compat"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Mail-Sender",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Mail-Sender-0.903-9.oe2403.noarch.rpm",
+      "sha256": "dcf401ee82064f8c06e6e22b8e28f24be97600b197ca0bc3fc3fb8883ca6f5f7",
+      "outputs": [
+        "perl-Mail-Sender"
+      ],
+      "needs": [],
+      "runtime": true
+    },
+    {
+      "name": "perl-Module-Build",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Module-Build-0.42.34-1.oe2403.noarch.rpm",
+      "sha256": "db8163ae929ca61af611d2f13e8f9b946011ecad34811a36a5bdbe4ba74dae93",
+      "outputs": [
+        "perl-Module-Build"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Module-Runtime",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Module-Runtime-0.016-5.oe2403.noarch.rpm",
+      "sha256": "87a0baf3236ccc778749c60992a79f1fdc5f4ebdb28f6f55927d0360ad37468c",
+      "outputs": [
+        "perl-Module-Runtime"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Moo",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Moo-2.005005-1.oe2403.noarch.rpm",
+      "sha256": "277a6477d7fe6320d3b487f38f245fc468abf94e9a5b75c134c8a941488ae529",
+      "outputs": [
+        "perl-Moo"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Net-DNS",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Net-DNS-1.40-1.oe2403.noarch.rpm",
+      "sha256": "c6d9932ccfaae2e515635b00204e86b5121516f5693d4fb345ae0d979bfbde23",
+      "outputs": [
+        "perl-Net-DNS"
+      ],
+      "needs": [],
+      "runtime": true
+    },
+    {
+      "name": "perl-Package-Generator",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Package-Generator-1.106-14.oe2403.noarch.rpm",
+      "sha256": "b9a424e6e083920b5000482637b62f617eb31808285ad86c09727e4f6d2c3fa8",
+      "outputs": [
+        "perl-Package-Generator"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Parallel-ForkManager",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Parallel-ForkManager-2.02-2.oe2403.noarch.rpm",
+      "sha256": "f406916c07bc1c59cb83080c91b308aa0a3e560825b948f44d02d6f93b5f9050",
+      "outputs": [
+        "perl-Parallel-ForkManager"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Path-Class",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Path-Class-0.37-14.oe2403.noarch.rpm",
+      "sha256": "aa2a7bc7789bfa34becdc8d98ad2263091cce2065776ab670802b20b72e497ce",
+      "outputs": [
+        "perl-Path-Class"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Pod-Coverage",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Pod-Coverage-0.23-16.oe2403.noarch.rpm",
+      "sha256": "d55a851604e72bd8eae598883b6d07f7795bde516b6a82e9af2654294412e3d0",
+      "outputs": [
+        "perl-Pod-Coverage"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Role-Tiny",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Role-Tiny-2.002004-1.oe2403.noarch.rpm",
+      "sha256": "058122267ea240407d97677450d50e251708d88dd9edf11a0e9cc3dfe813389d",
+      "outputs": [
+        "perl-Role-Tiny"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Software-License",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Software-License-0.104001-2.oe2403.noarch.rpm",
+      "sha256": "511ad1cd11c7acd42798f05662d8732c67bb5780bde034912102b9b9628e96f4",
+      "outputs": [
+        "perl-Software-License"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Sub-Exporter",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Sub-Exporter-0.990-1.oe2403.noarch.rpm",
+      "sha256": "1bad67d715ab6ff15e4add9f0c41b2e0f505ccc25ef0ca75ed75bcb1332d040b",
+      "outputs": [
+        "perl-Sub-Exporter"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Sub-Exporter-Progressive",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Sub-Exporter-Progressive-0.001013-8.oe2403.noarch.rpm",
+      "sha256": "dbb9b6a648ea82eaef58d6c60136e0e6101b54c40a1b6e346d85df46fd5947f4",
+      "outputs": [
+        "perl-Sub-Exporter-Progressive"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Sub-Install",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Sub-Install-0.929-1.oe2403.noarch.rpm",
+      "sha256": "5a828b848f5b730aaf30ffd9b2f7608cde97f69737bfb3abed4c7d6dd44a8e7b",
+      "outputs": [
+        "perl-Sub-Install"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Sub-Quote",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Sub-Quote-2.005001-4.oe2403.noarch.rpm",
+      "sha256": "f11b0e95c4ec3df9ed03ee923a127b2cc84794a740dbe521f3adbfc52c7ca401",
+      "outputs": [
+        "perl-Sub-Quote"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Sub-Uplevel",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Sub-Uplevel-0.2800-5.oe2403.noarch.rpm",
+      "sha256": "faa82aeb4f083ff0b4dac06a1219deacaf35ad6fc682ecbd91dfea8efbaaba74",
+      "outputs": [
+        "perl-Sub-Uplevel"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Test-Exception",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Test-Exception-0.43-10.oe2403.noarch.rpm",
+      "sha256": "ba94cb3100826ef941055017174d3b613416e785b04d20792725c17007a82361",
+      "outputs": [
+        "perl-Test-Exception"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Test-Pod",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Test-Pod-1.52-4.oe2403.noarch.rpm",
+      "sha256": "edcfbc73f8d1b848b5ff4e40699e74820f1f6c60f031f264381c29c6f01ba43a",
+      "outputs": [
+        "perl-Test-Pod"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Test-Pod-Coverage",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Test-Pod-Coverage-1.10-14.oe2403.noarch.rpm",
+      "sha256": "953f3ca4c78abc2ac4c63e2debece478409766c54e9a2ec08c2f8b1247505e4b",
+      "outputs": [
+        "perl-Test-Pod-Coverage"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Test-Warnings",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Test-Warnings-0.031-1.oe2403.noarch.rpm",
+      "sha256": "b152ba3fddab972447eb341a2cfd845d3851146d554605a02da2101d56387b8f",
+      "outputs": [
+        "perl-Test-Warnings"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-Text-Template",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-Text-Template-1.60-1.oe2403.noarch.rpm",
+      "sha256": "04012c8e50e8fca42b22feadc51ac84a03cb1811067cd88eadd97ed76c6138b0",
+      "outputs": [
+        "perl-Text-Template"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-XML-XPath",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-XML-XPath-1.47-1.oe2403.noarch.rpm",
+      "sha256": "4b4c440628ca82c3eaf997b2b52b38e243cb52eb3e6cc8296a858a0905008ea6",
+      "outputs": [
+        "perl-XML-XPath"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "perl-inc-latest",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/perl-inc-latest-0.500-12.oe2403.noarch.rpm",
+      "sha256": "46df92ce44f1dcb654642b42650dc790455dbb82d6a8594d70227c406874d82b",
+      "outputs": [
+        "perl-inc-latest"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "python3-mock",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/python3-mock-5.1.0-1.oe2403.noarch.rpm",
+      "sha256": "2cf15ae56a3c01b85be156c939cc4c26d3b0a48f67327e4089484d11c8d719a5",
+      "outputs": [
+        "python3-mock"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "python3-pbr",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/python3-pbr-6.0.0-1.oe2403.noarch.rpm",
+      "sha256": "b841a0ee0421804080a2a9dd1b58991b59098b61eaf50ea5cee08e74b245ee1d",
+      "outputs": [
+        "python3-pbr"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "python3-wheel",
+      "type": "publisher",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/everything/x86_64/Packages/python3-wheel-0.40.0-1.oe2403.noarch.rpm",
+      "sha256": "a5f12a955d77f97f571d9d2253b845976ec52b14cb0ed2e1f22504941e2093c6",
+      "outputs": [
+        "python3-wheel"
+      ],
+      "needs": [],
+      "runtime": false
+    },
+    {
+      "name": "mock",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/mock-2.2-2.oe2403.src.rpm",
+      "sha256": "15aee65d6d6284522c3c777c2355a7b4310a706bbff4a99d227c9917e32873db",
+      "outputs": [
+        "mock",
+        "mock-plugins"
+      ],
+      "build_uid": 1000,
+      "needs": [
+        "procenv",
+        "python-psutil",
+        "python-pyroute2"
+      ]
+    },
+    {
+      "name": "perl-Params-Util",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/perl-Params-Util-1.07-26.oe2403.src.rpm",
+      "sha256": "66a4363f542e00063dbc37e0b5abe42c9537c2f54c3e1d1d8290772d4d3f1824",
+      "outputs": [
+        "perl-Params-Util",
+        "perl-Params-Util-debuginfo",
+        "perl-Params-Util-debugsource",
+        "perl-Params-Util-help"
+      ],
+      "build_uid": 1000,
+      "needs": [
+        "procenv"
+      ]
+    },
+    {
+      "name": "python-psutil",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/python-psutil-5.9.5-1.oe2403.src.rpm",
+      "sha256": "f0dc3859323b5e769cc8d3910d1d19645f6c868f152e9053fedd59a279fdc27f",
+      "outputs": [
+        "python-psutil-debuginfo",
+        "python-psutil-debugsource",
+        "python3-psutil"
+      ],
+      "build_uid": 1000,
+      "needs": [
+        "procenv"
+      ]
+    },
+    {
+      "name": "python-pyroute2",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/python-pyroute2-0.7.9-2.oe2403.src.rpm",
+      "sha256": "4f42494d851c91bb2416254fdbfa04eb33acf23bd3507b5fc03ad62089db8bed",
+      "outputs": [
+        "python-pyroute2-help",
+        "python3-pyroute2"
+      ],
+      "build_uid": 1000,
+      "needs": [
+        "procenv"
+      ]
+    },
+    {
+      "name": "perl-PerlIO-utf8_strict",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/perl-PerlIO-utf8_strict-0.010-1.oe2403.src.rpm",
+      "sha256": "5f0749a94e7e42b68a4b5a8ad13b06696cc02cceb302924cdacbecaaa43209d8",
+      "outputs": [
+        "perl-PerlIO-utf8_strict",
+        "perl-PerlIO-utf8_strict-debuginfo",
+        "perl-PerlIO-utf8_strict-debugsource",
+        "perl-PerlIO-utf8_strict-help"
+      ],
+      "build_uid": 1000,
+      "needs": [
+        "procenv"
+      ]
+    },
+    {
+      "name": "perl-File-Slurper",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS-SP3/source/Packages/perl-File-Slurper-0.014-1.oe2403sp3.src.rpm",
+      "sha256": "7f0438344d8c191e74da13c26254f71374a32128ab9efc1d79705e9b00637c1e",
+      "outputs": [
+        "perl-File-Slurper",
+        "perl-File-Slurper-help"
+      ],
+      "needs": [
+        "perl-PerlIO-utf8_strict",
+        "perl-Test-Warnings",
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "procenv",
+      "type": "srpm",
+      "url": "https://repo.openeuler.org/openEuler-24.03-LTS/source/Packages/procenv-0.60-1.oe2403.src.rpm",
+      "sha256": "4175affb56e6a39f6aac4ada813dee8802b3086807b17a1f9cd80e91717e7819",
+      "outputs": [
+        "procenv",
+        "procenv-debuginfo",
+        "procenv-debugsource"
+      ],
+      "build_uid": 1000,
+      "needs": []
+    },
+    {
+      "name": "perl-Crypt-Rijndael",
+      "type": "owner",
+      "outputs": [
+        "perl-Crypt-Rijndael",
+        "perl-Crypt-Rijndael-debuginfo",
+        "perl-Crypt-Rijndael-debugsource"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "perl-Crypt-SSLeay",
+      "type": "owner",
+      "outputs": [
+        "perl-Crypt-SSLeay",
+        "perl-Crypt-SSLeay-debuginfo",
+        "perl-Crypt-SSLeay-debugsource"
+      ],
+      "needs": [
+        "perl-Path-Class",
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "perl-HTTP-Async",
+      "type": "owner",
+      "outputs": [
+        "perl-HTTP-Async"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "perl-Net-HTTPS-NB",
+      "type": "owner",
+      "outputs": [
+        "perl-Net-HTTPS-NB"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "perl-Net-Telnet",
+      "type": "owner",
+      "outputs": [
+        "perl-Net-Telnet"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "ipmitool-xcat",
+      "type": "owner",
+      "outputs": [
+        "ipmitool-xcat",
+        "ipmitool-xcat-debuginfo",
+        "ipmitool-xcat-debugsource"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "syslinux-xcat",
+      "type": "owner",
+      "outputs": [
+        "syslinux",
+        "syslinux-debuginfo",
+        "syslinux-debugsource",
+        "syslinux-extlinux",
+        "syslinux-xcat"
+      ],
+      "needs": [
+        "nasm",
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "grub2-xcat",
+      "type": "owner",
+      "outputs": [
+        "grub2-xcat"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "xnba-undi",
+      "type": "owner",
+      "outputs": [
+        "xnba-undi"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 0
+    },
+    {
+      "name": "goconserver",
+      "type": "owner",
+      "outputs": [
+        "goconserver"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    },
+    {
+      "name": "xCAT-genesis-base",
+      "type": "owner",
+      "outputs": [
+        "xCAT-genesis-base-ppc64"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 0
+    },
+    {
+      "name": "perl-IO-Stty",
+      "type": "owner",
+      "outputs": [
+        "perl-IO-Stty"
+      ],
+      "needs": [
+        "procenv"
+      ],
+      "build_uid": 1000
+    }
+  ]
+}
diff --git a/openeuler/RPM-GPG-KEY-openEuler-24.03-LTS b/openeuler/RPM-GPG-KEY-openEuler-24.03-LTS
new file mode 100644
index 0000000..efabcea
--- /dev/null
+++ b/openeuler/RPM-GPG-KEY-openEuler-24.03-LTS
@@ -0,0 +1,50 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQGNBGOROkcBDAC2S6JpeU5YFzMDp5zqpWoTQmDaVnNh4dsbCEJp+Z6p2v7Y7NmM
+iGzDYvScsa0nhM15SVJsrWYFkJB1rX+ESy7RRb1qGS5FznobzgUbhmMhpE0U/5+u
+hTcvjk7wpFn04+FHugvIZ5gjP0G48gYkJoOtKKtMYA5Uvl/w0uRI6++Vme6m4W/K
+Y2igg/JmRXSHhJHLQFICtQSZWw0kvWr6EUhmnFayzB6teKwJivJzJKHBTOgiSq5h
+Q4BEcOJz0jmF4xOvpXIBB2mIb191DSXm9kadyRBZMDfw1Nqgmhhw40BRlt4hsV8k
+yKymCFqm9M48NwY99/8Cfms4IXfD9XiF7nVj8+e5CcXeEGFWatZD2nCHTAkyah2L
+Ukqe372pnQyCBvDIwkxTha/LWIVXU3eIMbSOz2dLht55yb+TNhOgK1b4xjhq6RWz
+BpGjReU8RDtghVZkelt+mBZA8HPR81DoUuAm4vQuaxKecl44FdhzeUkCVDyA6ubh
+kY5LQQBwIR7X+68AEQEAAbQkb3BlbmV1bGVyIDxvcGVuZXVsZXJAY29tcGFzcy1j
+aS5jb20+iQHNBBMBCAA3FiEEiqFr+fLKUkQBDcqWO0d8YLZ1YAsFAmOROkcCGwMF
+CwkIBwIGFQoJCAsCAxYCAQIeAQIXgAAKCRA7R3xgtnVgCzyEC/9L7TMRYC6xK2Dn
+BetWLGBYag2YQmIIPUqZLFmq7RDiyAeVgFfk3TQj7AQryp3Cg63pxGH3YEOmU2B+
+6s9advYUzEokd9DpiZoOKnNRK7EXb1aDw1Ujgd9xH4FgTNiUUxnkrb5Rlf3U5uSI
+moqTwHuagBm9JP3xDllFFyo++w/23pQpoFMza4DiGrfVRor/oqfkmuKnimxg2naU
+iAD4kO25O9Css9cgKrKNN06iuLPW0txqV9t2WfUsP28Lj+QE0yFaxlCokVbD0PSy
+L1GKZszWMN+95NuEwrD8VeEzOrji7MqTjpWmzq70O4tyzyEHlCXizhQo/6HrDVPF
+2npcCFYkxd53LmfW0MuRdEETf7hbIC0+ViD7mX55i3Z3x4MWb2X2zPl+r8yHiQsZ
+Y/wm2sPWZb7jBm8up3c+xIoJZv5yoEX7JMFtiwpEMYJhyNKhgeQ4M3hi3v4q6rIL
+QoCyujyENpr/opHL0EXFkUVvA3AUh+DR8cUiAo7X1pmJjKuRdEW5AY0EY5E6ygEM
+AMj+qR7eLSdfDkcuPkSYqvzVcaYHpBwKn6ax9QTtR6UfONbg5CGQOU90RGH8xBix
+bHf3VvIqt00x9dRW36mwLR/+CP/FJyqchC6Wh2k0SEJ5HR4frsWmOOHcT7wK150D
+uTsyuWF4DidtvWtV1sgMZQcg66iFsPbdyTGaIolXij+4tv2TJgo9468MI0gFOY+0
+2B6vluyB9k9nKNwEzH1cQCcDXa1r3P0f8iMNoojvSHZPKF9uAtUrnWULd3At+Nui
+AI3H6rc7MEp/mVGnGWbNEfpHcwHqafRuJsdQgYu0AYNPyh+NT82n+clNSh0RoYGI
+YLmPX+QBIIlsgcK3P8AZWjISKWtBRo5IJQWeB2BkMNrAKWpKUKn+nsWVaG4TZ8c+
+2oqpuO+6ol4lFhk0G7cVqW09OOQ/UNopEiXHbJvpAqzSKbuzmK+kLB67pp4/wS+w
+Os09t1o/m9qynMCCGmisNvVrWWmEiG/KaeFcQzzs9jVr9piGeGcxva70PbJew1hz
+qwARAQABiQNsBBgBCAAgFiEEiqFr+fLKUkQBDcqWO0d8YLZ1YAsFAmOROsoCGwIB
+wAkQO0d8YLZ1YAvA9CAEGQEIAB0WIQSBLhvcto+bdWqkjO8Af7dH+ze8bwUCY5E6
+ygAKCRAAf7dH+ze8b57HC/4sHZk0yhBlwMWdu0vQGE+e8W1FTkL6uF2TTsTAVmAX
+aIT3PrZJGiCfuqvdaYzArpEjWg6mk63esVs3//iGqsfQBKA6KhJgy4/daSKDnUlv
+RbzJXWFi2gd2FBvGZUvRb/otdA34UvdhHr5q5A6DqPsKu++lj6rqMdDI1RFPr70T
+N2Hd7xGevIWo620N/Hv884dkZ1QiJJ7d+BLavvLWwYy/l/c7NkwdMwFfqS1KMmLU
+Nw5opyBi57I9lhYQTqexa6Fvs5lSvtK+C6YRI6PDn+7tRyqYYQdDANeNzUkn5rBV
+ZGo5FuHlkyk0oKWX0kkYGLwaTV1BdTraeoYYywAJ59PC73pzCe4yBiQmDi6hsZ6D
+DJtrngrGwrYhq87cjBAhK94FpgPSN8CK2XiLcMjmOi8KmVnjb0F6jKH6G0sadNi5
+wm13Ec9XyrcggJUXmGBHQirHTyM3rkyI3C6xC2ZPbl6YxFyTbPruVJuFw2Cfivnk
+b0nMdbfgyoNpOr+BiPqasGzwOgwAogZCFEHPamnOov/Wk/iodTYpR3rV4IAJWBxy
+KLxZYZSf41cgTEZvOKIE2vP8jPnm/ag3T+qTEAsBSf1Y6w1ohLbifF4APq9WmJ8g
+kFuexEyHJUeivojUX2j1V+qDwLJU4EjRsAaLC5dkTf5nF04nwbdnF+qiBsG0bsVK
+V7sdKpbOEfFDQKe66bQ2n2t7jTVjOuS7sLRUx7bGLIEzj8mxhRNmxbXf/gb/Q0bw
+r9T5WxkQnTI6ZwH8t/dYDhMvwpWPCkPqwvY/JAzY3J++AE9oGVdBOu+q9xIkWX7w
+cy5VeGx2n/SLa+aNFXFi9FxyPHAozRnIM9ET8NuhEBncSgvlY1yjURmay8l0zCin
+TOmyCewwVi8TVz9wdrqrHAoItamu+y5mQgU4jinbxWBytzaQ6gmZUsoKHMNOYpOQ
+sg4mugUPR5Gv0xNn+1nZcVyL7nSGlxp7C0ujMVlBugKVR4091KizlHjfVrtuwRHG
+RvdQJiP2pHXAQpBJduIgGAQsGDCk
+=WmUf
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/packages-manifest.conf b/packages-manifest.conf
index d97d07a..6ea7058 100644
--- a/packages-manifest.conf
+++ b/packages-manifest.conf
@@ -171,6 +171,94 @@ perl-Net-DNS=0.80
 perl-Net-IP=1.26
 perl-Path-Class=0.37
 
+[openeuler-20.03sp4-x86_64]
+goconserver=>= 0.3.3-snap202011021058
+grub2-xcat=1.0
+ipmitool-xcat=>= 1.8.18-4
+syslinux-xcat=>= 6.03-1
+xnba-undi=>= 1.21.1-1
+perl-Crypt-Rijndael=1.13
+perl-Crypt-SSLeay=0.72
+perl-HTML-Form=6.07
+perl-HTTP-Async=>= 0.30-3
+perl-IO-Stty=>= 0.04-5
+perl-Net-HTTPS-NB=>= 0.14-3
+perl-Net-Telnet=3.04
+python3-scp=0.14.5
+xCAT-genesis-base=>= 2:2.18.0
+
+[openeuler-22.03sp4-x86_64]
+goconserver=>= 0.3.3-snap202011021058
+grub2-xcat=1.0
+ipmitool-xcat=>= 1.8.18-4
+syslinux-xcat=>= 6.03-1
+xnba-undi=>= 1.21.1-1
+perl-Crypt-Rijndael=1.13
+perl-Crypt-SSLeay=0.72
+perl-HTTP-Async=>= 0.30-3
+perl-IO-Stty=>= 0.04-5
+perl-Net-HTTPS-NB=>= 0.14-3
+perl-Net-Telnet=3.04
+xCAT-genesis-base=>= 2:2.18.0
+
+[openeuler-24.03sp3-x86_64]
+goconserver=>= 0.3.3-snap202011021058
+grub2-xcat=1.0
+ipmitool-xcat=>= 1.8.18-4
+syslinux-xcat=>= 6.03-1
+xnba-undi=>= 1.21.1-1
+perl-Crypt-Rijndael=1.13
+perl-Crypt-SSLeay=0.72
+perl-HTTP-Async=>= 0.30-3
+perl-IO-Stty=>= 0.04-5
+perl-Net-HTTPS-NB=>= 0.14-3
+perl-Net-Telnet=3.04
+xCAT-genesis-base=>= 2:2.18.0
+
+[openeuler-24.03sp4-x86_64]
+goconserver=>= 0.3.3-snap202011021058
+grub2-xcat=1.0
+ipmitool-xcat=>= 1.8.18-4
+syslinux-xcat=>= 6.03-1
+xnba-undi=>= 1.21.1-1
+perl-Crypt-Rijndael=1.13
+perl-Crypt-SSLeay=0.72
+perl-HTTP-Async=>= 0.30-3
+perl-IO-Stty=>= 0.04-5
+perl-Net-HTTPS-NB=>= 0.14-3
+perl-Net-Telnet=3.04
+xCAT-genesis-base=>= 2:2.18.0
+
+[openeuler-24.03-ppc64le]
+goconserver=>= 0.3.3-snap202011021058
+grub2-xcat=1.0
+ipmitool-xcat=>= 1.8.18-4
+syslinux-xcat=>= 6.03-1
+xnba-undi=>= 1.21.1-1
+perl-Crypt-Rijndael=1.13
+perl-Crypt-SSLeay=0.72
+perl-HTTP-Async=>= 0.30-3
+perl-IO-Stty=>= 0.04-5
+perl-Net-HTTPS-NB=>= 0.14-3
+perl-Net-Telnet=3.04
+xCAT-genesis-base=>= 2:2.18.0
+ksh=1.0.8
+net-snmp=5.9.3
+net-snmp-libs=5.9.3
+net-snmp-perl=5.9.3
+perl-DB_File=1.859
+perl-Digest-SHA1=2.13
+perl-IO-Tty=1.17
+perl-Sys-Virt=4.7.0
+perl-CGI=4.57
+perl-Crypt-CBC=2.33
+perl-Expect=1.35
+perl-HTML-Form=6.11
+perl-LWP-Protocol-https=6.10
+perl-Mail-Sender=0.903
+perl-Net-DNS=1.40
+perl-DBD-Pg=3.18.0
+
 # [common] is NOT a build target. It describes the SHARED repository the OpenEmbedded Genesis
 # release is published into (<repo-dep>/common), which lives beside the per-EL cells and is
 # therefore invisible to every [<target>] section above. Without it nothing asserted the published
diff --git a/postgresql/postgresql-15.6-openeuler-llvmjit-buildrequires.patch b/postgresql/postgresql-15.6-openeuler-llvmjit-buildrequires.patch
new file mode 100644
index 0000000..e47062e
--- /dev/null
+++ b/postgresql/postgresql-15.6-openeuler-llvmjit-buildrequires.patch
@@ -0,0 +1,14 @@
+--- a/postgresql.spec
++++ b/postgresql.spec
+@@ -78,7 +78,10 @@
+ Patch11: postgresql-datalayout-mismatch-on-s390.patch
+ Patch16: postgresql-pgcrypto-openssl3-tests.patch
+ 
+-BuildRequires: gcc clang
++BuildRequires: gcc
++%if %llvmjit
++BuildRequires: clang
++%endif
+ BuildRequires: perl(ExtUtils::MakeMaker) glibc-devel bison flex gawk
+ BuildRequires: perl(ExtUtils::Embed), perl-devel
+ BuildRequires: perl-generators
diff --git a/python-scp/python-scp-0.14.5-1.oe2403.src.rpm b/python-scp/python-scp-0.14.5-1.oe2403.src.rpm
new file mode 100644
index 0000000000000000000000000000000000000000..4876bd190bb7106de39b8deaff39ad86d0e4da68
GIT binary patch
literal 25107
zcmeFXbzD?k*Ec>i3?Pb#AfO}N-5nCrjWh!@LpMl+NViCrl$1(?NDC4o9U>i4(j_4M
zo>9E+>#pDPKJWAS-G4lv>*$$vzGtny*4}Hcz4o3pY`)%_L<50PKqw9#E*AE7EY4;Q
zEbOct+^jq-9IW<mPHuKC(Esg)0>b!5(dgoDC|B>WL7?j|foD<R#sZ$>0eT%UjrR)!
zpCFV0;Km0YFn>J*{Q{xfxWdOs0T2l78$i)PAXMQiya7-^AF4P&0exuO07ddu0g9C0
z0VtBM2?AXc4@2oi2cckt_=xYL`?Hcwy^Tq8wR#!34f3mzJ>_e#$3R7hM6Q#P+dIJR
z;I1}sCvh`-TL-AKGmDueEAR*c<6QqO%b<*VPMDsX!shql%{=u-4%3v;&m)*8A;up~
z<juUT2Pmxt(MWJz^mmsvsa}=bIg-*WsA0XC+YwU;%BXyJd~Q*2*B@)#CC2O^EbWAN
z#%T_J72`gwcHv8jq%=}&==elPTI9nJiWz&3tnYngRRJ5bmNw#3Qau!^%aa>Bc`8wg
zcFVVSXL3R*${f&9O3?0vy#H#*4hLBsMDY_BBOLM=u{h{bBu$~@CDH>iZhMt9_5s(O
zU-ZfbSV~2+2OZMTuIC7HY_cw-K&%&+H<%s{8YuU07;|=jND@(0&B4%dy)?8WYpFJF
z>8?8VPsMg2?|vlg%nEOi71Su*Zrqmo=mY-(D!rd8B-%CXSv<~$PT7GM7YqZ>RPS-m
zm@@EWwJ?1RQWgJxJ^$Ny&34=}dKC_jZ}>#oP4IB>TV_Ocw#W2<Ubtb=x4pKLX(0(b
z=?Aw)Uo&>@pG=`l8|hYNG?phngKo&yc_*iUXo?M@l0L2&XR6~iwN$9;YOb!bm}8a+
z@bL1%xcIo?+-6){P&gMHY6dq$aPtXp@R`B+xj4AY5FGphrd%LCem)*JFF!9Af*mdZ
zgK}^I&)nQRoCs5HGZ;6wDW?FGlY@hg%Tz#sABNzCBltP__@Ufz0WNlaC{%z02qF+j
z)vJC(W6l!YCkfwsRh)*3ClCl{WPJT~{pEqbJn)wX{_?<I9{9@xe|g|95B%kUzdZ1l
z2mbQFUmp0s@xafT$mQkb6F?ZKVSqq?s+;hEK*T`p0wf09Kplhl0YH&5FyIDiDnGB^
zbrGO$0zw6DBwht55+my=NW6B1iLNlRZh`~c6jylj3iDjyEr0@b6rfo0t39%=f~?CR
z>orJyyH|Y36+Q$gl23hwkFGH975)KGz#fXi6+Qtdpc_T!3ZDTK+1~OBpI_mKD|~T<
zV}D_Epl?6>mkdx~%;?CmB1>6WR~R`qBz}2?!2ku?pcGzVT!13&mtA4xxB!gGd4-XF
z1LRS;uQ0(CA6a)o+C$C(QeNf?-vTI7UiAv!zT!W+!X#IG7k~ouh)#ONe|ClM{K9Ae
z?<b!gpum{W$N>uY8=W7ZfPOS;fCA$}7XT<=AC3JA3tr*YD=hH~qa#Zf$o9y70{VXH
zL1I||1NzW^_fPH$n*bC!zJ~w>^rKr`VRe8a<!u0pY>#Y*#12<{U4SCx-LJ606+ih3
z8(#6VuCUP+M)nt}4+c<V|2|w{_!a(mg%MY{_ZPky2T-K_fh*i`#UHuCivUITXW|Mk
z0ThtOxbo-C)n9xJ$Q6Gbpn!c0C=yG7{#FkK{i=t8{-}onHByMJJq#!hLJ;;&5C^Ce
z)Yj749;9gjhX6cQ2an%uS7*301p0>r#Kj3}=j>qb<N|TAhd9ISU=S#9JHgE?;g11j
zmNtO+V@oK+#R3inG;u&2oa|lf&FpPhA(|GJ&Jf@~!207Y1nLYlM!=omc4lxG1mR?F
z`;(8XUOGElAUlJUH3#~~3`SbA02<ia*?2%q;cz>M3*6ZSXy#_=VgWQms<(Bpf!o6E
zT%azN_I9j*BM>4HAeb2oFSj|e`gv6d1>S=|B94l(s){U}tQ;)%PAoQ17q}D1!o|fw
zkd5t+;wh`WlQ~EW7%?zFge4pX0y=b6U1oKGI<cC2{%qn5v@r)d;cALB!e(U(b%I&i
zvHfx-$i~vn)g5GK4|Os_h9aIR2*g3)U*%tg>;*z3ybgK8;7|k)HzzNYpNAc4%FWFU
z<416F^Kx;(&0uEy2p$f&DVKm5A14nt7ax=x3g_j8BFqF#*#+PTE_PEW48+TgU}xvx
z;THgkg)mMIPBT+}c7A?1AB>wFZVE-P1LZ<~egOnfJ>=x(g7KJfaB_13p655^VMnm@
za3O;gxFE<6CwqIBfBXP)`_JoFRB<88?0<?d77MryavA;e1uP6O^8Vcp2E>WYRZA`w
z2UDlNJzM_P2xy19xH`Dl+uJz*!FIEN0}Y)VY;7z}>7{_Fbb>oO!(lQ&$SFf@;m!=d
zdB`^pEX{$?0N(w)xLDa)xmh?s+^oE;>^~_7KP!+WVRts)n`Y0whvHL<yFu;Dtz7LK
zEg`~xJc?U;0CQ*W%xY#Q3Soi#{#5~_0z{{V3)IZoSmU8AMEGa0BBA)-#myg0kf#4z
zO}JROfF>*uEe9A7mB8XNvxb_(kt^;o+{qaT?5nQ)6am%->~Au^-Hco~|0vJ>C;8us
z02yFdfWhDK`A=&F!okPE!^JMZ#ev*ckQXqWf80Qx{dpnZ0l5l<{o6^ue|q^x{7W44
zr`TaduC9Nvus~)Gmi8cXParIiI|ZQI)dj)A4?^(s!cEP1xp+7@`Ar3&yrwX?fEkPv
z2Iu1B5D?%qHRChm<mKZQfW!Fs&Dc3O0YP>Il#_>(6UGOH!me})z@bnser_1I053Ne
zH_Qym&jIHJ)(tNQ2QQ$N3(CX6!_CcZ#)~i&;4u~87U1GTaPXP(!Qq@dPysjx2#kz6
zK^&aFrCG4{uh|jA`88;;I@|^hbq0huz#6W$wooSzK^)}7{EO5JR<tw&QXU}tPe}=^
zrLG9rL8hkv&pZRxuy=JbgR=|%A^I~N1IZluyO@PNGF2k;8QWDnIkTDavhlF9aq{sY
z_<+>F3yclvAs};@^6~<iLVyDXe6YhfIk`AZ5iqC#4-X$7;1(z!KbNVgnHhqQ3z_2n
zJ|BW5T`g^35<sdG#QBx-z+f5}+}X^@(gB&1!T;O#7+`q67buGz<WKAGzn*hdC;P{i
zfNuo<6hsh_Kl04g5(58nsXE-z)e^{gzlFJ2ex}lY$NXCc{dW>T?)|qcONW2Q`k99R
zZbl*hFzo-u6O7#D{x+=-kXxC(1M;{5f!Uk6A|HUm5^zd^yF-x&5$B($D`1I$|8b^&
z?w>3`qrdm$PyPQJ{pSRC0E5k75IQysds{f0jkN<Cu#=l2Qw5u()<eYybYLf22#XT}
zLie|fLI-AZb#`I{_Iso-@^-aDp5c%iKZM2oUn<j3(NdR^*7)bVL<iQ;l+e`D5TO<W
zTOuI(5b9qTh+a5^9bzbiJa^iGA;8>Oy8LE>5tcuD{ZD-|1x|Nn7C;_{u&5&-P$s8G
z%&tss%;qd^%=Rp95LPhqG61wm$tX(5YKTx$d;NM6WTEy_S5-1rQPnj5$@1}`geX4v
zL+a}Bx0vFCKctY_e)<Dx`zp-<Cvf1LggmZ8e)<x^!UA`Po4L9`O>N*Jl>a2o;!Ftv
z)HvI~;SLavpPi(!v~zZW+SvSuyL)97!lJ?fblTb4(t+jo2#}{w$iIsdbrluOtI_|f
zzw}^r=jS!%<%WR4e;5F!$d-?X=YOb??WZrDEuc<tHelKQsSCfNi3NsC0l&it0&Mau
zP#~I-@BU{)`S*r}fUjGBHtzhdtULc_%wHwEf9k>S_x}+e{E>C97V{so@CV~R&<zAc
zU0ULSk~FK6v&-MR<L@~C$)4E4{!K>!#(%OOF7E%%BS_BwuRU>ab+-7Q4)%|=cC{(}
zb}ASLVF~Q{zu&UBcsKx+5D1Hdlck*t0z%0~W5Gs)FtDS9h>HHKkl0u{yRh0gyC8R$
zpIZ@-Jg!;;sq6Pn^mkf;_y6yDfeqtdXhpvLf7j{!ua*9M{om8-V()5ZflQQtxaH42
z`IT{Pq5o<Gf8+fdi$Hni%I$wv4|v_d-T?--ef&R-Ipp`N-@OL*{QtSaKXns%hM+OC
zfSXx^sUSZo1Oc_Q`E{a1R>t5?z<2nc^)Neo2-FpMdU3Hd`&svb*usIYd@$fF`WR?}
zJPUxS{^>06$I$^<L<4O7{Id8DXL$$<;_oAt24?B>>lA`Km0g`eSUEV@oGo48EPs5l
zWc))P@<fZ&@~4sgI@SGcD@6*MSpel1;4p0tW`yVf6+I=W6NHl!!pY9b1^J^K^IunH
z!2fm41PoZvv~Y#Uy8=}d0i*>^$bYLi!;LH@{WSF7sJtMp$~aj<BwWoQ?7T>;9REG5
zKTAS?vieW;o8K0Yp5yrGISz>G&u{+5lE8UN_;1huP^AKts$LbCG=M@3#2om$Q7546
z1VjGZ@as35%geK8!1MKc5y%n`P+Uiw_JV5~bid_!cHJPr8Vh%8YfBlG`g((ZaBy%(
zKz%)io14mx_yDMd=g|&2-MjBt0#5z4+cUdcK4Q%xsWa8q#i^B6Th(7)iFm&6>jeI_
zTukn+_w++sdoM}}t{EAza`~FwTrk$jZ%E&`9BkP&@9ygzBsA^*YGT#7W`e~X6cCVG
z4U$rfYynASMP=lsWk;2>d?f!iXYma?aN>zg6or2<tumyH^a+L5=P^wB(5HI@*qXMG
z5ft?DTMwY-OLK@NiO=Xy{X4E5DU%oKDf9AnsPaj~dx<^4Z|lLqLr<2<0tuNFmg9fC
z^Yj%SC&q;65612yrb>qjr!w&@<~c7>`ZWcmC9k^*va&*061=>)&vNtPa9%UC1^0ex
zBeBA)fO{o3WstohZo{zx!)~7qe<nxA6fC>ol~4!`pc;t0g<5S=$;DgE`xYcvma<c^
zTUP0~x0|xRyN|oGhvJX$?&wI*r=@LZKwVx&B}W_?Zy?gs4bo|s5gn+)!rtD(<iZ`^
zX9l#i`T5J<1_UF_&BckI2T49z?GkJ4N!-OLEXsp~v$XxVhzysv#&ls1db&Zr-7et+
z#X&#gofmU)Z~_T}A}`}n=dgL+x|RiqQ=mj&e}XnJif7_|iG`8+^hw{*D-mY!93Ceo
zzaFaEb}T>Wv1%w)8xbl3qoEA=@n%cxC|}GA1@K@%ufJ+mF~b0!$+e)dvkIw=Eey9Z
z@8q6<(smIct~Io{rE^dy%NV{1D*6N}xj#WGioq7V`Q9PO-V6(K0%S`Ob#L^8XLG|W
z21eN!s_)ITbshe*(jx;3up{QQHPw$K2x=(EVmiYQms*8b&+VH%$6}Z~{<8)#G~WnO
z`hgi7bPU0>{I|>7I(~Bw<;l}b7#D6bSXsGo8C2+~7d0O?6|*i!(JM~fXm2abiL4si
zABr*UUG6s4pg+BI>dd?MJ!DM89kmCNuS|d+Vyu8tcSp>G|13NZOX)%Y+n1r;N$lIU
z{6*{KrJ5N1z_o<Yv923?Ow9Kvm!apE?wDIXzU^m?ugSjHcO5n1!q(?3@Gvh&k2~A9
z%|Q{QPuhcHLRKywo-7driIa<rTTJ6`zG2x4;z5%TQIl8(HDYz1TE8dD4v`*5-Man3
z6p!cf^U-z)c)I(?m-%a#Rt+Egz&l>TX9SUACznDbA$}qI_xd`?vlyuE7gK%!yE>c+
zjm$D%QY1!=H~ZJ|ow><Hmt5Lu6C_?@boX_&>}?17y;@lW!O;Q~FW$>Yb6|~M<R-Nb
z_HJE_qm+$FNW6_+1~KyLDe&q!`{*-1Dg0Jy4#snGfME#n=UgmBpNXa>of_xP99_;j
zDv7_nL_Nqpx{O}kDV3nO@Y0kGjVoIEAhlz@GV9J9l`a1E)aP?E<>~ODJ;^p7NpsxA
zt&90($&DUW+w{x3Xnq+aPY(Q&FHuq4<)rfy#WmJX1y9%U*!eL1{S<}>Jg#9k_RBU`
zq_LnoWEO9&Y+`esC$xij-=8+vKF$oz*bX5{d*WX>ax`fE!%Of8{Y>75K;ZN~#mxR$
zV$h}0oqJEu>;;ErIycW<{M<NPKms$9io)Y0m+0<=*aROgUbTsAZ{NS{9vm4O8~xgJ
zT{nvp)n)5uc{m5r`!1Y0*vca6yQ#D{={B1Zpn0*hucLM*&sf_0KaXe=y+{3FYu4H7
z{|VLI()@ArZHzOu&8>*;?c-xNx)HD7+lk5`>4H<>Z{abOpG^3~4mdU3gBIpNu&!Td
zaouHYzo+;9bPdC2Ec)VM+qux74+qC7*03?piMjR`mbNZEHe?=#VzT06vh-v7QSGDJ
zi;felGm&BYQ8ALc@e6ZjQ4;50;_+ziM}y}5sxEOZ?`obO(O673>w=iKq6WNhdR6D=
z#x75yKOE0CEI2rprCo+>^ZPa7p2x5VlEe8q_lUdRFraR1^S%@5x8BB>;n&%=lrp9>
zl5Yp6-h1tom$Ie2*dJq~SW+C6XxpAM0?s>C(lkwBAS0WaZY&KMoOcjejEg47I37K6
z=T{r>5xtXA*-TZkqAz!|Tdw_S0~ST`%W?`K-&d1H+AM2w4eKJtn#FqWt`Y9?d%TgM
zwZ6u;;q#SxLI#^QdBG}EH(h_q?J@C?^|*cyyMv`}$<7F&e@4-6<|>@OKEArz@UX}2
zQ&n}<gVuDz)W8x!OmzYq6~lCl_6)X(+r+os8tTa^vufn-qHnKx^3s=VkCm)JKk`v1
z>8+PdvL};(H%t~<>n)*|(t<sn6v5~M5xg&LZaeDtcqc4*c!AzRk1>ab>v>25aXi*q
z?T%)?wQ`1khX&)ZZyWWrN*>wm1xVT+Rbt0~ktx8G=DJ?63@)XNstDFSf-A4xKwzi5
z*`84c?eA_dcT%}2N2F&QKl)nR)BlN!_VAp+yJICPKlVdLp@5Dg-9y)n<n0JP8c7x`
zjZsRir&{mjBDblYdE=mo+eEbo+D=Gw&8n#2zoe*GlRt!I=GC@l+8ld2Nk@lFkEXqQ
z$+5LgW64$Cv((OFwa;M?E%YF`ke-bs69YR(SmfD9YdY<R_g5nOzkSsaF-^k})2x?^
zozlYV;vdl0l#cbS`s6oCP~aCi&Cy*QDU-*Nc)#E?gYJ@-!rgQK=K&KQr5&v^vn=+<
zPYb^YT5xJ-uvGf0L7{$pJ$IvKkB6y34nC0Z9U8oYnCz=6xqYP7NL~?ohcSnj>A+yT
z)F*?sG=XAd|DlA*GSe%_M6^pHt~;VSQBCbdy#yQ8yZ6%71oGPhlRv`l&iAx5^B>%l
zQ@}r#BsjXIoQH_dC5x9~rD6+A@p)1E?IIS#mJNf-&zb(PICI)p^N#z`Q1;Yp30vHV
z=w;Z%v#odU24>V3j%YqtIKQF*+h@+`Oj_pN8v6=*8q3!0khwhYTK3##(^)|BA+tH<
z%lBN#(+^~Y4BMCMP`AH$2jnoWP0F;Qz0f>nH65C86%>ApIp0-%jsA#Yb7AA=YBIQj
z>)MarL+bljDyB&(#D+g`U6O<uzYvs+&+Y8$#W!OrDnRakQDmY2o)`xUkerP)igjI*
zy56u3p`1MzjT`1~X8kM^m7z_!!KQy<L^3PSpbK|<c#N-=h&OMCuj=<+W%|y<BT~F=
zPQ|JFlb4Y@!~0FL=SqpZq^p}T`m&#OcDwP)A5~0}mY8MuF7xv|5J*(jNh#UEt9BZ@
zZdWjb(u?5(4ogE&J$0VCo3WEsm5+WfkHW}#IOzQX@Ay63*XCOAHu)M}*XDzLboP=-
zH_olku-tHp3CbVtru-#)8ba>u_)Vgeo>BDpH41}WAFIwKysK1oW{1ykX4M{itcUOy
z&^K(HRIUcQRV9msZobKhaA;prioqx=6FVH{ZPm>peh&KVbab5u?W2V(o-xIMgjPq$
zvcrZn+uZDa!+3{uf%~>npvhLmE;ukzEruj4R=H_*ex5VJ5*CfmAefSMA->cS+!Ue_
zBWB|lwj&|9@#%%1n^3lx_?O7xs6+$(y{@J2bPU?#d)0Y#t>dCi7~g__ybM(dox9id
zA{)LP@PSTM=pE;bT7R3{_JHg5lX~dFdl$P`S+Bq!*f0t{_GlP1!7O+cJJyq!Te|O&
zrbMQ-yki;Ce!jW0#bTZCVFzmn-CEQV<VdV`O@kUkg`mnI{(;Ucd79yFzASgL@GX@7
zjM3(!wxNJ$<adJ<CL9&EjeMtedGhj=LuwSgLPiDPi-iwgj;C#pFkM6nuDOpd4ja&i
zkdU7~m?MJ9DY<1H@X-cOU8|1qjZ+8@X??}^Vk=P(%Q}qf$aq$(&>4$gbZhl_J)vy8
zg@T8^S@_fSfbDCIY1#E#jtGJ4y(&RtJ07lYH41{>Q4TxokbHTt|GFm7Gtq0P&Ro9*
z@5n^NZH7h3)>Z>I!b|W=86y_ShK<+K&e!}@g9n1$r-vp<$4os-b+$L0=pTFWRrv9?
z))P4EdW?hiqw9kX<^;gKeUw9+hXKZI;4$UFsOlT{)cbt#bqZxp^q3A>R4K2Y4nMv>
z4?`%0OJBQ|-jZB9tFoxZ6M?caJxp~}`H}}b`&Mbx&~i_=%YxJGd)t!7@Ojo*>TBFl
zm*$#{B0XEd%JOT@{N@2M*Lr(cy*D4GS&ek{A4Dwd^`w0NT0R`^TtFjwI(r{KV<cIa
zkf=NqoKeb@`I?B~!<W!7c{v9kW|y@VL5A1nuZbUhyp<|Jx1~{^mVUeM=<JE@;Z~s)
z-|^d$t;Z}=17uG)R*e%HBPfj<BNqdo@5JNk3U~~Gwj3_6`w&RFv&f9o4te`;Ups9&
z-~75m+o+`a{=4Uw8*fi-y_O!&Cw3pN*&VHzp~?&wyU+?-_4RYCjz3_-Qpc`rzHuzc
z@WIKX@TMYu)q<#ueq%@Xa=Ce$F+x4>q>kgRu1^&HojmesL!Z|-nnM?vMeOZ2@Ji{&
zvN<iAvxeT0(CdD?Fw0XN+a{Z;d2r*$2gV9Ei=ujBn;V~Rv%FAIy|)=q!ue>raT34#
z?mF>%BO}roKcD-xdUmyj-NQIDlvTPrBMrr=W0lkVn`8S<bwb%;GZCMXr7cX{J<QL~
zqqG8^w?s?7e?sW?_`F!3fM9{9=i=Q0$>T;I5LuvBdkgh;#TIY6uZ^)H{`ID(LH6!9
zX<MpfO|-h5h1g=Ccqy!{=^ePdQEn6)_rK*nOqFaPzANg3hQE&g<edlKd{s<PN=~g%
ze+JqULQ*0wg%SgW&JQo!O=C4pVJ4G#;~aM3!A&$f4>g#}?aXlH1A<p=T#Rt;pS-CF
zJgr=hKlFzYtFe+rD6_3Q$dtDyz!%RdV^5?P>zRw7tb=v6ME-H)aZCY85@6Sv!pTuw
zi?`YfZ2XasVBJmLdrJp0<zZ-V8gx{q#$VM_^WW?V(;SxR?Ae_e-#c|8E?Ov}fo#s)
zC6y`iz|nkOD$GP&R0K5@BD`>N`p&>1)kn@o(qmVpI+I(62C2HQB*bkbrfHXZVL4!_
z=PZ==nnq7~B`tT^I!ok8@O1b+O<(KrAcmdgmkM1wX14wM<fs`NiB}ts+*JZU5_Lw@
z<UAV5QL$|!NIp`68n0H{?c_uSuMDK<c@PhWg1bIF6C!kPZPFrrr@s+f^+?5DAMZ|G
zI3f-86~ip9^=M2Z2Dl4NUHTv|hk<W!k(AiHkEqgU`~Fl;kc)D5u)MVGQeZHZ)g1iE
zB0a0Ltis;<WQY33=~0Uc#}i@EI1#<s(}&Yq2MAKzDebXDXSQ0MHs?j@s@Yej7Y0)A
z2S4q7@8#_rh})nNA@25l$y+OoDK|KMFX3)z)Say4qVx*zR_dqB4z1V8Z<oN&Ul)cN
zMg+c>r3&SK_5%yIBg-0h&m87DXXAr9zd>u9@T!ASbVh{7-LUNCHC=~dB58sIyiwB#
zY^%MjGQF+tGe?`tr);wr6yYz9nDx2)y)CE4x@^LD4lEn61h!DZ@6~<Gc|P#EiCSOB
z4&K2qq!&4Yn{%AQ$Imfnh7i+VY^YtJHax0iMPa#}av~R(-5RzrrHfZoC0Q88wL7(z
ziRHz&%X;mb%)u)O5rgiv(@}a++J5IVDIu9eSeXjAyEZTG^~Ci>+lrVj!K(dOZr<i6
zy|zzdC`o!=^$MP=dQEaNM$7c|(BAGkGFsUrb+5<nkImfJ4vE=_NoT53V#qG$PA^p<
zLAf)Skz%0lloYJ&Nu>TQe!s_J45YjB;>15sP@w)m0E0W6cd+KbD-3VK=H%G8z3C#I
z)bIG~PPG51*c0lG-s|`b-JWIw7uatGmZR?k5Jgd_1T;FFpMMZcs?;Qrr?qv)aO5e9
z#m~7P@N%2#iPGmy9Nqcjw=VI!H768XglYx|1fP0g(hN!sDG#@s&c!3<4jyr5W-s)E
zTK^TkchaHENqk?JU?cSPIuG|^OkJbAXPn6OVJD5wgjlr9jD+?dNu(t(6M0Hs={U-D
z@$g7@jBe0IAI%!@JZPYe6d-CZ7L8W3B76VA_=Rh`8RWH!MHiv6>fTuyp&Yg4zR!(b
z)93een<N5_^FzR7&H_3jeBr@@I^BhVY-5NjZKD_WJ;CPnyWUATHlvC8o1-xw!Xxd^
z@pzuSa>AHIFFj!%w|V@6v1|ohj=zAK(Q#*!!$Q_C$bX%5`g+!RIZ=xdnGunbYrk{+
z{g%fm-_!)F8l$zg$=QnB=i{uL#;GL*=wqVTwW+<r3I~&d-ulO}9GDfY#iSUJD8yu%
zWXBdy;IYQYm#~ZxE0O3rf4vYk;e9&mJMruythhXigXF;%4_?v?Hs0jDK{d`3vb$SJ
z$E^!F!M@C2rEys@f}SC&B6qd%&*sbn9r~xLD=@_~I)s7>Q1rJtjH1H(BQ$=*=yJ)I
zDsNm1YWeIG^yyxj+X1fknBKKh%muL>U+Y$ir)7$PEvY9g&FGx>xo4$^-+e47Rdzhg
zEPUWlh^y1Ypg25gcj-H<hI`YwX}!=|f6UpEh%mJ-u=k0H)!-HdO3ln6pFY)*YodL*
z>BH)xTqtzK=6gx51QQx9Z&pHUH#hWJI-8EN0{Umi35(m;2u7PvtXIOI=I5^!k`Hw|
zA#YZTExxlPg7iAE2Bt0wg3?OG8Yb;3zE3dX5kg&`mOaNE8&)LgRq8BVCO(PNQFO~6
zU3r;gbp-!fen(U>xAV09#!@$#0NwGIMaPMjV~u|C%epWEA;EV(j+kT(T<HNEhF)yb
z9$pl)n<eBkBZI<wh+sAQ_c915Yi|u{fE&9oPhGn3WM*7-)9}F%$HL?I&hIJ?fue1X
z-%wwpZ15!8l~mF5yJqd6&VMt)I~$)Wop`>F!f;!PTz`XjG}`oQ(wn|R{zqSxKGz);
zh4eVewrSW0D=^#d<8QwTL)$b<mdw`*>vQbfX02jxZLB-YbfdWGmA1luzY(upsQkr`
zh{hy&0Y6W6!&Y@h`5XchIyd(0MB>IavhAsEM%yE-i1{aOsEQV(Luw7z(x6YLjR>2X
zN}sZ?L|5RAc~lMvJ&Ky4+<1D5d)u)K_sB>QY9FrK6!wgP`T1T-#^{9#84vqOmVHef
zoY!P$@wq{65joq7$nFSi+}^@{bGp-#uQ>;Y?X5}G{ERWq?p>G<#n2Ua4zm^7y0izX
z$K#~lKRu}-^PhDUEUq6y$R))ru^kn?tP4sFHshpyIvDL#-OWiq%u%kHG(p_fpn6C-
zP&2re-8&<@Tp}y>SQ|sHJAg-~x6p4-g0`4@jG?Aclu*Plt(R(-*6BJ|?5Rgb^b}+C
z?PfeN^-5R8uasSkR+bBcnna`T)tVz#+WBs1Mpy_^S-;b=2x4h(=OIt#Dt_YJ?i|gf
zHOX>hKx4s;jq^0j70b23@-DxA15v2pnhUj5655yLAc#+zgh!kOQ(>RO<B<i?+>@wh
zTM6D_^$GV<%ELc9Po}rroZ&ZHCvV~@J05zo+FuwMPwS}o3h_C)Cn{I%F5}7;$4lv=
zH`ej*`8Zl`Jx{>unA|0a@EL1>Euk5^4h9fwcxzEVw^)a<5w5a$8bNCgNC*X0gWnZO
zPdO3?CR@+wWoNy4sS>U5o?bDw+A$7Wt7{vi9y9cIGlfZ`uf{Gz$bHzH$%B$uc6gJy
z9i(*_|1kB1`-85s$<OsU#Y-ZQBaP7HUb3%pD;H3z@A~8U_8n)7sd@!#_8j${7+<(Q
z&YZ%=@t@y5aQU(!S1UzEf<3KIK>y0H3qN%O0~0HKQWDk8;@NfDRox0hY&lP>!hCE6
zv^%u3FGX{|qbwmPL$579yZ*?2?~U-<w&+E^W6uv}vF5Hcoy41N<o7<l@f%6I73Mg2
z<Mr<G%G8@dCncWRX-?V9n2PnW0@6>m_Ue%lWoX@bc@8h;RHQ?WVK=7Z$745C3L6??
z<W*=;6uxCQL>~lyg$tDGE4^E2D0@9rKb(NaCwv22&Cu59&YgbIq9dFq%iet)YA>g^
zZg^c<n1Qu&rp`KP3-NV{rPK+PEGrQ|@Ka7q<zBQBw28CDcb=D{-}(AA6x&@<ah&PJ
z?QHAoBIjtE?xq$9>H)Ep54yKYyKX*x_f6$^`CHJ5MDmK|=VVbmPIr3I^2qeU;tJa~
zS`k~6nA%OsQ)a1szOh&5dZpzFm^A`C+*m;xWaR?hTCJ|{$OFA(9N#i2aB-sQOdc{y
zzd&HT6Yc(*wZ=?nd^8w`DAZmatD3nVF=sL=W!7?Gfi3tAT1Ai^)1q4b`K3g2>~g~U
zga^)4&j=SQy3B+26K8!I<?V<S=VGk+0!`X(<gwwEScA*R`Eu+Dh>ewQ5y@c&d-L`Z
z&>Cpx)9^`)KSKHHKUVmR-y5}dK%{a-3KW@rN8<ZzkFe9Dx~aQ9<^8^?bXh|ryVc_9
z+Mrn#wl&iVp1VGg%z7}V_q^v)=rV~SYN(vI)`)MrFvuR1@ASLe*C)!Uxr;t!^*Ja=
zy){~s7L#K#0(C?YL@H9*r_<_N%8hpRMN}T|Zcz=G1FKHOI}5`vm`iB|6xV$AvX8_m
zC{p<RzB*{qPCJ%le5C9PGf`aH2aX);IR7*cl@&vniKUyR3W}x`(RhCBbsVZm)6)>_
z`CIC>#TPoP8~DLD_?cz6o@egY&!UtDuFYb{nq0UqOY)^(4>=!>+#kl+eY0G9Ke^z&
zHoJslXO^XDW?Dq<JY7^EVdIY?!LHbdyq9R4e0{qO39{FzXy6C>_{j;-COHaOvyXgk
zN-xlQDKZyf(t`xGlWYsUtOfZbXt;M)cP+ZR3uKIVJADk<&VT6PB^+wK9O24g_PeLi
zX&Rg|=~kjH8QbTU-B_e)B+8j|v6z~%_HNnS9E%>?t$dg>T8K@IDTuJm@OhD}#fsDW
z?zt>)X9=A<lF8+%3vaZKRI>4d=(IFa#zRxLS(>CPBRZQ*7*(iGSLag%S0(V(N85ck
z;?nYxJHmtD`4k+NoN}B-z7IMu4LEK}?y%rccN+Q=X@NHj)bG0!M`#>AN~k)tiiCP?
z)?z@ZpUz^&^EXGh`R7T7SQ(NE+%sU+tQ#6nWp5Q07%D8exk6N-(7G+l{4zF?W02%W
zM_GWz*L5<fh&!<7;63})b3OT|Yzq469W&K#x_4!wkA5%=Hw$z{e`+pKkH$Bt5~JU*
zz~<8sCquuJn$5w(=3Bzu=t)RBv(5JMlUYBtROuWc3S|x{w0x;0F^|eo^J#lgLr33e
zwR>s&?V^R+{11n1y7AXvQXX%0E%ZK>Q$WyJrA!SH$;-tv*HoBT?{TB4f4G_2^j&V*
zUB$X*_bB4od_N(3JK8>Oj@#_rTm^S#Q@OzQWtStb(TJOm%g1gNh0v~g@c6A!O?)+=
zmHc8hPqmO?I)P$6bmN}eX(;x-ybiTto@(&3;anr*2noyZ*#pus%#KCQa38;R{V5Hq
z!*{56h#)Z<JQh2ql;Uqn4J7y1LS**Sd$?MzcRXKx<`|>ZNH=@Nq%}XY(+l4qaU{$V
zo80gV3RZh6ETz$PPa3U2S8Y9?jj4X%GJ~93Dfv_0<p$%mdwU*)(<Ca;(EP>cGhAaT
zc$Cx}4s*n=j-ct?K96iI$!W!nKvq>w()RLMqsUStl;$j|2zr)_@1H|ZD%3Wvza4x$
zk{?CL$mv-ilWE>CFF@@s!grRQ;2HgSyejC#zK`0Nt0=mS=kVomxk`$D#H{@Na4aIl
zA0PRLZ@)<u_OOe)Rr$f3Iagdk^7V$+>T}KvmM@hf#sNGR9IFv;mfgYg4Gn|xf>1Q|
zj-fdJCHp<-KDkif?19@yN!#8RFE0m1EcoasT$s^6=C*SfrfDjc8woxy@^!DBd4x-2
zsG?XX*zTjvx_ex9J$nhfFPUsjv;JyU9r2NFu;K1~xkzpgabvOFDV>e7j_vl_j>P)5
zn$?huln2)=*Y1o9<JUzFYFodoTYhQeX?>K8y&SCCr1$XQfopi8w>(9jN_J%S{F>;8
zhN1=S>~T)UnQg+60{To}j~k+L;yJUk$HK!fEuN2Q_B|Hg$Q!kwB=sqim<#*uU1Q=X
zr)r#EtkU~Hw4=4fuGO_4)7Y#}oZC2FR3yl(`-mUT^t@rQnijOnR(s{+uj)j7SjHVT
zmO~e;h33HD9TS`?u>SJhtc#~>rh?JRT(@AMUw9@g2URAnv9Rq)zt@HpTb{VF#*<lo
za%mlknWCMhX<obq4|V;xa^Jho8B-e5p%C>`R`XlIB+pY+R9+Vz9TP0+k(2U}e>GmW
zv_Kzq(aqbLe6LYW-T09u%WISOX%NN&5%FPaw@d;5%d+>ex2?0m@0GT`H`Bb*k!?3-
ztT=tzo`2j#;%Mdh`a_*vNoOuCG~m;0T=-Eyf9JzI0)K?c&0t;!nKKOHdu#-uV%A0E
zo-VuDM#>mYXf)ZB_UJy++M!-KJkRfF%YSU)5p<O3!!&34{2=d>P*jP<;`fR8*LoEa
z2djZ?C39X04P*?C6rw(cxs2Y#TzC(z+fOhwzs-6vq#|I<+wmorE7~C}ye?=EG2!$4
z){vrqZ??I9I!Tr1yx1<MJ1tHdzL4=VIeE%YVyut?I!V&ZI5H_&I?pez<!u&8_Y0mb
z1}^F~E{=?ieCbh%T9%Q@;TA}eWL>4W-M{(dsCc1jMw(sJB-;Np@+3synuZHYlM9R8
z&gxbW+L!ucH?f8N63^SCpL0W-<&I?ssrEmx-SHU=lXzEw#berNs!B<p#d$+(jedt*
z(|2O?^GtNr<4|2w7;iY~z?@sdZN*wq_oBXuRz26G=h`hA+X4No1*fk-&(IXVcYjD$
zE{;yWv$0m(q*PfZr_Ef%!<%UnAo!3ZOmB)(Ggv#SH+eJBQTpxMq{1a7@D1DtPfu|9
zx)(kgPs~`>YH;WDnr&|wq*y!gB;sv>L~n&0n*{{A($_oYL6(P5t9qq;Q#2nKd`u>s
z+^f()+(Y%2$;53izPqG6g+Ua8qe8e<pBmolP9}0R%s=-nIugV;m{UYkpF#8SgjwN+
zp+m+3-K&`$tXt@m%Xm<>{j#-HkqW5VUMVc{CN_*MG~Ia_<!q#imGPeGXdDm2C)kGi
zVBwvtqRzCmBp;0=I1dvO1wy_w&hryP>5*2`>#B?A0>c^i-Jbcsg`SQ2rO_0P<*@mx
zS!%flft%%w6Me2@YaO^h7w$GKI>KYk^bB1ozy2tLR`}H1BQCP4+J>kVf5t_uE)CYh
zL_MT|ky}Sj#yXlQbvs|BD>g6ADAPwVoh-(9-C{)a$$?y=jic>HG+}}HWWf`1fw};w
zn+;*1!V5h(Ui4f-=XSEoR7FI{jF8Hm0rd6U+Hv=i;&%t;YtrOGy0v;k%$8~Ud=rZl
zH*T%&Fje_Py*H&u?zrRntj>Mgva{g)b37w!A+AsSe3_X~4fQ0W3-|*=<S9L6I}O*~
zCR}DQ?^Ij5Q?1~I`yA*SMcCtp;b=E`Lz#7xr^=R2Uo@&Z1UJ0d0yJ+pCY0TBuuL$$
z-FqO5`R!yuZmiO2P{*2tjp*Ba+<>*zY&6rdWf_?nZ9fWw`q1vCle(+a*Z2Uc@-ogG
ztJWu76YO7xGPzv5XzpBh_(JHWmRV@2Mw>W;Xx@K=eedb3_K<@)724qXMsitrCPUHF
zWv<B&Bii@PZ^^+6JYS1_6HI$IKr?GUa3lX#=R$A)s5#rfYcWqxFTrqPj!TyZDOgmf
z-^0gW7zhfJN_zxRO696V+*-R~B)SfzOjHU#Pwe?&qopI)8K-PO&h%YjqeUU1ZW;=u
z@DPy^L|c5OkthD}d{yEsl>nM-v&!Ge_L_XPHPldmc}?&`O;=}ZHlc0cdT)dOtuGHq
z8##)4NDXRLzc(lu-6P6b4kusnJ!NEeQ{=lty-m(5O4NLJcro&;12bWm(QGM2<XxFs
z!whpV%#(+rb4l?tPe$Aq4!)|1`pBm_jI$sNm(6Ys;l#YNojq~H|DF){4f9?5BfEyq
z(Ft8J+t%YB23xGnZ_e{M-zLaNM+Ij^!qxXbG{6#<A0_kIKUebXH}rn=HI{2LqV_(U
zc!l#P1-6F7YKmcX-RWzq${BJG!vafW)FVFT(Gxv?<8~|((O()+1Je{02=3|rqyoy1
zarQZ-d4V<Ga@^LN6Fp9);Kw#H0E5KvJWcc@;3_!E(R<ZTSheHb9QPt<$Wiw7+R4&_
zXW=Q|#@F_fn+6$&3K-kGW&MqjX&U~kLs5ZPu%)7hRVTY0x1F}NiFR*6Rjf@_9!dA%
z=Dg6y7xYuDvhYcNG#({dXNx10y+piIn1*?rPjEMVmABk_$BQwqc?j>IDYV!^(_2YD
z=A`l7oRi#Q4{b?JrpS-aZVZSzgOJ{j6rplnd(8ZwPz~=t#+FF0_vw}&4luD4X(X=>
zdKeHKfod?=^bSk%PS&S9KfTgMj~AMivIe*o^OgRdG;gPt3NXq$<POyqGuGm8m$grF
zF%-<GI6E0VP@A5SR~1```TE{5X&ljOmyr&hy}Q^;yVx9ad7dbU<u{D*|6ve299(_I
zM1WD7tEIhi_O&x<L_bb2V`_tcUT%jR$Ig~#q5k}-Gq@CYku|BJ-N!tq*=B^Asi2xz
z<i#+j>EpS)BezG!@?jMZy<xVdp=%_?nzX)zL7FF`Fs+Gm!|HAmjtGqsT{|-DMht1D
z7j@LO4!R{@lFYbMP^)z{I=U1ygSEj#mon$q<-~KJh0_NtK^BCZ6$}G&Q<_cWzu2qI
z!dJC96TjZMU3Dj&%XlaSrY>c}H+qfoaQ3n9Yn`1`_p{X;lPAwklCwcLSRs?n`dxHu
z>}i#5-?Xy1WxAN_DpVs8x<N~8*&9V~CHOuiqg01$5!6zYaG`#=zUm=O{j`5rsRFaB
zZaosuga56)5*I=9JSKcW*qC=O@QF5`BY_cpGIh3YE$vQ$O_N*_9k-DJgGtv;fW|!z
z4V@W3QTe0<EHQ(kGN=J@x2a;*kILtZJ}|qYC+GzwR)xc$WI~JKQw#?+8}j+S1Rd53
zwV(#VcF~D7shVlZyRDNi^R?^JY#IjoZzygTClK5!nSA;b@y++i$sA0)ryZSV@9|{c
zYG7>oVA#Q@740T`PS{;^p;9i{-f~PF=FR~-#>|`%Wj*a1+uh&Zt$T;AUJ}!^cvgDx
zNhT(%kEoh;oSp@!9F^$5b%@%MonO3{)Fnjo?X7*{iIxBEgW_3#xc}xu($k(&IK|RJ
z%D(3gQNT<Rb(0WyW52poUdR*2Eog}9Mb!DkMlUXn)9^;ahCG?aof@Z-A&+t#%H<DI
zeBWcRhlw|^^<&pji^ZHK$2+Ne$E?cZC(Z_mjRsNbA7DNzax8Up4%P?fEsLmgp9RP`
z>WaTMC5yTtHNFe=uPsqN>y&}nK=Pkw)Rfy_?<Pz&vgM^<y-(?@)P-i<eJee}{vm7M
z;QlhL^xGlRXPm{RZWx-uG&iEw9d3s|wDOsmX7$LB)6x=AY!-LMJqfjpy04MSuAPbH
zu!ZI#MD!ty(P~YWlkOsGGi~yHY#W7>G>_#c8{a0<qV_PaXJK^f$_Z&K>I$R99tT04
z9`7ga{!sg2*}>E{-GN&4jQrEHHW#|Oh<>G&8`+S!T^o?@oA|UKsm)PHoaR2eGb!dX
zp~{Ax2lo}Lvq~G@*iSoGi(S59^wWRD9#}k~Gt<tz6II3bqw?c8zWZIi3h2kjHuWMe
z{hO>&;{x7a9>}%K?aMe^CfWT!#NT_<mzXEjtNPTA@-0fx4@Xy(RLVqLI_I16sd0O6
zz87?lF5BN;?R;?~8r!Zjo4f5*-zqVeu8-DzWu-|&lgDbF_u{4}m)8As;w-Rn7Ryv8
zLlRreC`MTgl0D2FkLOe*%6H?Qg&=@x_*YcKx&~Vq854s8$&;pArCc`&PdcR%tZ=oJ
zLjtkLX)*{);zHuVg|ItAySV|aOkW-gDY}1XQk73SG;;FpA@iOIt69j&e7rzfb1gFq
ztcfrw)b@S7OwLDYC#3aI=m}X8anXC~K1@}_ffTpQVv5xd`ch6$rDqkynKAK9N$s%?
zRug$b0XE(WZ}l+YQTy>~V;6U2iE@bZ@)Z&v)9>IXaqWYm8ly5KB?AhwB%7jx4};#6
z8C{&S4n1ANXI$^9@tACt{a}L#%e9zpnsWOb{wX(5hCe<K??CfqUDfl+N140U64y~9
zi23Hj=5y%2Vh~yhGk?>zWs*M0xM^)sGZMpz{S4hsjIew1$p{^GFX&tjy~hpX<T!lk
zgls05lHF~)!mW%q1K)o8T^ickvi<1k^UPk{nz#7(DXRIfX0-^ygQ3YY(K<pkHn%r%
zyA^Jo&b)BcSFMauds|{kW-Jzes96DH#{Wjq#^NU}M%csZW&1XewNvfvkbS2l)i6|W
zc$0>o?;5XbH|9bk7S?*Yn>*gU4+BlD4=KF#SEk6*<$H=Yy|%{|r<wb=8-;@zHoT0L
zljB4l<{CXRn57egj_n0*1#SAfFfNrVf*jB3HXJMN3V7qpZqEdXiFO|kt*oiFkCU?P
zF04fAP;))bof=CRo+zQP$(08Cq;hFNmD?<-4S2aVne$`35}NDis*-YU8B?)74_s0D
zEEC@sZM8>j{czJ)ZP?^u@4A|*d#2*EFM;yP<~@3lOuJep(|F!k|KKp3_7bHNwNE=A
zRlzTVh~!S+8850`&QVD5js$O>KYFaJT|YGVdL}4^GSn!|c^H$j+i?^2h@jzS@`H{D
zze8&#VWWEoTN||0H5+4d9@38nLPK5DtsjYJOM<s7<C(0>Pp$VvlD-7!J_>yh(CBpS
zahMSXAF7%G8-l1>eNUHB`%y*Ww9oF5gs$ZV#%mn6dm2w9st1LB2pwl~nUCL|iqoKd
z_r(I9I}^?t>k_T%9Q1IPP-{{#ji^N^pI!Fyq(wt4+_G5gxuNIKVqGwAj+Ei+Zn4#O
z<{ql=jrWcd$=#3722t|0j-0f<I~fj>iqtoYFRQNyuYbRd7Gm?@fVTPt>JN1`r-;!p
z6E^gOkpoGB&#<ZM`{QF(oz-chtF?lTsFoe1N<mvH!#`*-Hpo0@h{;zqt1}#^1^YFX
zd<TymzTJ=B+>J$%ZsxqxES9Dre)_2%v`pdlW$^8jLR41kU<wYUmO=&?{+Amkd?gJ+
zdhvaNcYV2ZrvyT4i}jiagks*!1-{l2G7vcJo7*}#)aGv}B5!#Kj&EP8>?(dkwOGID
zt@Ej2xAvX2X+nzG{<hX*YNx1OK4HPF!s6F^#qw(X>kZ<J(RJFjg1&h-RtnZO?Uj#H
z)xz5q5jm#n?X3Nt#%6OxpHCJ=Y2;vH4fkE|uLkYg@T9U!ebSU<bpPsp?2O=HxuEvm
z9Hn{pu5G*#PO#tM&_Os}RIraD!)281k8+HX^kDG0|46rLk=Fd-+Kc^SlL$Rh>G<|N
zeLthhxhdPFBbZe&^<2rI#qID8hBWRinNQBsZ{a&Hlb&QHP42D`Jl4Hw8$F6;{^%9e
z`y^#{)Bcm}TVV60L6;i~w<9l}QDitwMm%qd+&O<!s4sddxvbr2SEiLglueYvjbd2W
zdM0V%t~MnsK?)Da%3FGJ;q*EyXqbM<DSR~odrbH-O@$<NR6L%@YYSo7@eXkte3bhZ
zsd|AZH3RxXr?Hu%^Xm+~@0ahc<4ozkvn19riiop{x|tR>u}%FB7p-nKGfQK@$0tBY
zt~enoNA!~O5)J&;QZj$++Xf2O(vQO<!p8LRuN!Y1PLdB)YAx^O$u`MyKWv*HTw0Kh
zv(w8d6$kf2l&GW%__{l~<GUkFrOIURX=&2NGb))HF|vu@9>Va!rkRTr9~LW>_m@(A
zyc6USC_b0_KY5qjdY3R#3;WoMGQ|9L>X#dC<*tg@hq(rCNH<!X@;KWoiL59q1%%e<
zV*4ax<FvNkUh^?La4_`t#2$@{hPm3p0#rUXWx<W<*s6p256-ZeEchql<b0Yh(qoJE
zq6kq22l9pRlx-?h4h+8~THL6}$i-;g-Op2;+_0NbO2nWEZ46E3a}CDp$_wk=im&q}
z%5)+06A!L0p+%(e1lU)4d84l0YA@N>?mEUxI}U$YI;vJF1NvNjcSEt1F8Di(S#~$A
zLPfW^GXZysw%g$M+dH=R*k)`XRuZENOTFhr{A}%OMC606{S8VVna|0-%es5)s|$vT
zuwL7g34qqmn7VpbmRV7k9MOl`jFz@Z#>Z10%m<6c1f&!d#ZKL`epo`s)4?0<YaW8x
z;xuPxEE-qTp1ytr3q3iM%V$N&v^0;mdwI$dv+*8f{*ggZVaQyR1#4trrdFvcJDHLv
zE6T%1A?;#~Vh#3^B#e`%mUXzDk&47e6fEn+pPnp4P*%=Fj=a2!ItSl=J-r-g#=Y-0
ziDmb_H6f)1hs(xiy<z<W>C5j^IL3UeQlYC6J)yh1iZe<5TX+W1q<eXoedK0V2{O?d
z7g?{J=-N&0KMJ+xA&9-xu7#Jutyrw^xMa^O6H3=2?^(m?e^23iMPIwE{J4WA`oXhu
zq0iUMqsS!>3B!c$ie0QS8n5SY=JE}u*mn{zN}8IoHr9Wq+mMP;xc2>dWZ7d%{UY=s
zdO1^BQOD5-&@$T1rVjb<&$`72wLH>HJ<Kn1q7KRir9>xy)7NdT!+dSh_c${>UTLEo
zD;2S%x;AR~JRRktJnAAgnh&9Nk!nOTDKW*%oberRzR8O+_UYveJTB2gd1h)M&5g$w
z5rPx*k-m+2p6`B9q_wd27wtK*RG&Vo2ClJ$QqP0u!G`yx-^}m(=V{oRxI1qeTuW-v
zbj*XlLz{%>5HiTdckLb>6$j)oY!h^bx3O2Kr^HfqR%_So$P<0|P_;8%_%$;xSdSR2
zQMRGWc1F(RyAOAI#cdh96qg1jB8pk&E$_QX)~0!*baU`!eRH3cliQAfm6~hQ0;<R-
zLAx)@*|@O*a#*+R%JUqisIT2?G`XeVb0VYg(!kDT$};w?;nD*idi0`b-}cfE&$*st
z7FRqYOQ5n&4(lS<kqPIb#rTjB_$WOijuBy$%*6oiD4M34$x~U;d?;B9YC1-BQqK11
z+6%lZD%7Wbv#7*%w{ljv*ww%)SC)6oo#PO5*Xz~ol0HX)kndxaZZSR$-%zaU$iz&|
zBo1zLiuq+xE0Me;I4H4-Vp$$4z9kX;q4VH-rAFON7N#|PBDIEHxgmpG&$EK%?~zAs
zwba>K3lZNMhA0ZW<8zi!Do;o?I120V#HO%_^M7C!ChW%$&8*im6Z^hRXkpqk)icBB
znq4!a|Gc%FGFV@wuTzr>E&8S_Ux>(qRP=PWZRtD-WC^9G&#%?48Q|~#6cn)NQpG>$
zW^Y`<xR_EidyFsUnNvO`;l4@1h<o$Ne#owx%UJ`=os4aqlV7FLJL4nTK^1TP>m{7I
zq08j976UZyh&G8XF=9(&b+O0hmN@UTI`~HyN|RfQ<4TH|tnx+XUa@v;y}IEm3%blW
z5i)A(x;er$B+qQD^J-(sSI#`p>qYRHhoPvlKeNi3f#r|Ly#gpd8OaWpA#TG^{-VZ)
zeZ@k$B<42%sDg0j4g0~OnXo23%{L5Ifu#cOTS*%XE3Kj)C-joUE>o{N#)+a{;LZvc
zoSJ>z92dSQTb>x>{$8Z*9o8hl?WmV--gq`z*}M6}318%B@a+pF&jH&zVt4FJujRo{
z)+<V|^(fXt4OIPiV&qm=6tH=uFG_D;)8KS%y7~OM_o}uf%k*t}rkh`*UoR?zSDn69
zqiJtV9FMI$Cu*lDW36G5edzxcRVTI0qrN4}^{~Vz+?<_%tCA_d^JdB9oN}zBvLC@f
z=p@S+p1&G-Ws0h@{4V9=v3#HUiNQye!|1LoyCg3lcV{JcTw+aMQF275e%<n7da8#F
zU7Y!W)i6vqJFwzlkS=+x@XSn6Kd}24`%P8!L!#KRik(+X1?#?vHqY^7vB`z29Y4uO
z#>K(;iVMluZ`fwMNYlV=r!h)xChInLZBexpCe-Sv0AtHM!{R4ZI@&%Zt1frk@r}{A
z&6KlpN^e?`AMvIq)QqNpubwzWpDId)UpTHxC1Ag(|Di9NVC{OhCP%kqKK+VLb;Vnv
zPZT9G_QM|Hi4CHytHKBb1?ytnkG)&qr5O6xR2O9j2nPjtRa;+GPb=j^amIAiBh$J#
z@L{5KpX^PMu^LZ`oX_~fw&xzRB_Om|bG$cN2coOFf_bMwubvGziAr&r7(EWF9<b4y
zpQn6;6A@9&C8<>80Ot~XwFUo3tJedfA!(*8Bjt0D4&<%SWO!su!PAoJ>Ntk;@TOfc
zit9|s1zn@-*N!uxg*|Mt7eX%-Y{OQSZBI-_5R{ut9|<PGG8*RQ`pOTwZhVZ1e46$~
zlU?;r0*Sq82i}NExZee4@l)a5-oZWfC29W(6t@#*coH*v;M^nkXzq_k0X$y>P{8<B
zXm-IpV@xToH%d<0eb(qk=G;!B&z<-5JRYfh!lHp&Cz?8(zv9*)ilhEN0jB_1|B!oK
zrme86*K6xPm!*{VkCzys#?#4ICtsi|6xQ0?yL#C>-UvFJvp?fAFh5sZ=wAV#A&^&7
zAaUR|wxH8N&9lDEN|zv-GJ$uVb25{&$Dz;Ydc#y>@uWBlF@y0;Imk@DUf9vc7d%(S
zU7jxMocUgo`G5XYeZLed5D(6UvxNVr|Ht^x|9SksJ52s)ywH?TP?phr_Uswl{qg?*
Lj(c=)@IC+l#2GK2

literal 0
HcmV?d00001

diff --git a/xnba/mockbuild.pl b/xnba/mockbuild.pl
index 7c1395a..da99bcd 100755
--- a/xnba/mockbuild.pl
+++ b/xnba/mockbuild.pl
@@ -7,6 +7,9 @@ use File::Basename qw(dirname);
 use File::Copy qw(copy);
 use File::Path qw(make_path remove_tree);
 use Getopt::Long qw(GetOptions);
+use FindBin qw($RealBin);
+use lib "$RealBin/..";
+use MockBuildUtils qw(restamp_release_line);
 
 my $script_dir = abs_path(dirname(__FILE__));
 my $repo_root  = abs_path("$script_dir/..");
@@ -20,6 +23,7 @@ my $mock_uniqueext = '';
 my $result_dir  = "$repo_root/build-output/list3/xnba-undi";
 my $log_dir     = "$repo_root/build-logs/list3/xnba-undi";
 my $build_timestamp;
+my $release_suffix = '';
 
 GetOptions(
     'work-dir=s'     => \$work_dir,
@@ -28,6 +32,7 @@ GetOptions(
     'result-dir=s'   => \$result_dir,
     'log-dir=s'      => \$log_dir,
     'build-timestamp=i' => \$build_timestamp,
+    'release-suffix=s' => \$release_suffix,
 ) or die usage();
 
 die "Run as root (current uid=$>)\n" if $> != 0;
@@ -133,6 +138,9 @@ install -m 644 binary/xnba.efi %{buildroot}/tftpboot/xcat/xnba.efi
 - Packaged pre-built xnba binaries for EL10
 SPEC
 
+$simple_spec = join('', map { (restamp_release_line($_, $release_suffix))[0] }
+    split(/(?<=\n)/, $simple_spec)) if $release_suffix ne '';
+
 open my $fh, '>', "$rpmbuild_top/SPECS/xnba-undi.spec"
     or die "Cannot write spec: $!\n";
 print $fh $simple_spec;
@@ -174,6 +182,7 @@ Options:
   --result-dir PATH     Output directory for RPMs
   --log-dir PATH        Output directory for logs
   --build-timestamp EPOCH  Unix timestamp for reproducible builds
+  --release-suffix STR  Append a suffix to the generated RPM Release
 USAGE
 }