refactor: implement local builds (#356)

* refactor: implement local builds This has a long way to go. But at least want to get the branch published. Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * disable all workflows while iterating Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * cleanup fetch-kernel.sh Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * enable local builds Still need to generate tags. Removal of most of the suffix Containerfiles. Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * add tags, images.yaml Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * use anchors more! Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * start on workflows No Testing and Pushing in yet. Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * update workflows Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * more workflow modifications Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * don't cache during PRs Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * fix base64 decode Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * fix path name Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * name file Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * quotes? Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * try again. Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * try again Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * quote the env? Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * tell base64 to read from stdin Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * update workflows Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * try different way for getting json file Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * fix conditional Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * try github.workspace Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * just hardcode it Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * typo Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * main doesn't have zfs.... Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * One button build Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * remove common from centos builds Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * handle defaults Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * fix package naming? Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * don't have ./ Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * try using swap instead Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * path names Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * remove dnf remove Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * missing decleration Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * try allow-erasing instead Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * try reinstalling instead Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * Add testing via multistage build Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * add missing args Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * correct test tag name Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * fix VARS_KERNEL_VERSION now that the package is no longer messed up Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * always have json point to cache location Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * use a reusable cache workflow Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * Names Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * put generate workflow in justfile Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * add startpoint for multiarch Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * change the names Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * dynamic names for generating workflow Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * start appeasing the linter Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * fix kernel version detection Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * try again Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * filter for arch Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * move system76 to common Appease the linter Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * permissions Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * more permissions Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * move system76 back Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * add arch to tags Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * add push/sign/manifest Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * silly names Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * remove secureboot just recipe, it's internal to fetch-kernel.sh Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * add CI=1 to scripts for debug output * update warning for workflow within justfile * remove for now * Update dual-sign-check.sh * Update Containerfile.in * Update dual-sign-check.sh * Add cosign fix * Fix signing in push as well * fix: hardcode internel kcwd for fetch-kernel.sh * pass CI into fetch kernel, use cache version instead of get version for fetch kernel step * split out bazzite workflow Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * rename name of reusable build Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * additional adds to manifest Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * allow workflow dispatch for cache/akmods build Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * add comments to Justfile Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * split mega workflow by flavors Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * Build Badges and README Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * appease the linter Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> * tiny AKMODS_VERSION string update * fix manifest recipe Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> --------- Signed-off-by: m2 <69128853+m2Giles@users.noreply.github.com> Co-authored-by: Benjamin Sherman <benjamin@holyarmy.org>
2026-11-03 14:59:42 -09:00 · 2025-07-07 20:09:34 -04:00 · 2025-07-07 20:09:34 -04:00 · 00880e48db
commit 00880e48db
parent caa9847924
66 changed files with 2348 additions and 1509 deletions
--- a/.devcontainer.json
+++ b/.devcontainer.json
@ -0,0 +1,4 @@
+{
+	"image": "ghcr.io/ublue-os/devcontainer:latest",
+	"name": "akmods-devcontainer"
+}
--- a/.github/actions/get-kernel-version/action.yml
+++ b/.github/actions/get-kernel-version/action.yml
@ -1,167 +0,0 @@
---
-name: Get Kernel Version
-inputs:
-  fedora_version:
-    description: "The Fedora release version: 41, 42, etc"
-    required: true
-    type: string
-  kernel_flavor:
-    description: "The Kernel flavor: main, bazzite, coreos-stable, longterm-6.12, etc"
-    required: true
-    type: string
-  bazzite_tag:
-    description: "Optional (bazzite kernel) tag to use instead of latest"
-    required: false
-    type: string
-outputs:
-  kernel_build_tag:
-    description: "Optional (bazzite specific) tag"
-    value: ${{ steps.kernel.outputs.build_tag }}
-  kernel_major_minor_patch:
-    description: "Simple version eg, 6.12.9"
-    value: ${{ steps.kernel.outputs.major_minor_patch }}
-  kernel_release:
-    description: "Full kernel release eg, 6.12.9-200.fc41.x86_64"
-    value: ${{ steps.kernel.outputs.release }}
-runs:
-  using: "composite"
-  steps:
-    - name: Get Kernel Version
-      id: kernel
-      shell: bash
-      run: |
-        set -x
-
-        if [[ ${{ inputs.kernel_flavor }} =~ asus|surface|centos|longterm ]]; then
-          if [[ ${{ inputs.kernel_flavor }} =~ centos ]]; then
-            build_image="quay.io/centos/centos:${{ inputs.fedora_version }}"
-          else
-            build_image="quay.io/fedora/fedora:${{ inputs.fedora_version }}"
-          fi
-          podman pull "$build_image"
-
-          container_name="fq-$(uuidgen)"
-          dnf="podman exec $container_name dnf"
-
-          podman run --entrypoint /bin/bash --name "$container_name" -dt "$build_image"
-          $dnf install -y --setopt=install_weak_deps=False dnf-plugins-core
-        fi
-
-        coreos_kernel () {
-          coreos_version=${1}
-          image_linux=$(skopeo inspect docker://quay.io/fedora/fedora-coreos:${coreos_version} | jq -r '.Labels["ostree.linux"]')
-          # Pin a kernel here, gross workaround TODO: Make this cleaner
-          #if [[ "${{ inputs.kernel_flavor }}" == "coreos-stable" ]]; then
-          #   image_linux="6.13.8-200.fc41.x86_64"
-          #fi
-          major_minor_patch=$(echo $image_linux | grep -oP '^\d+\.\d+\.\d+')
-          kernel_rel_part=$(echo $image_linux | grep -oP '^\d+\.\d+\.\d+\-\K([123][0]{2})')
-          arch=$(echo $image_linux | grep -oP 'fc\d+\.\K.*$')
-
-          kernel_rel="$kernel_rel_part.fc${{ inputs.fedora_version }}"
-          kernel_version="$major_minor_patch-$kernel_rel.$arch"
-          URL="https://kojipkgs.fedoraproject.org/packages/kernel/"$major_minor_patch"/"$kernel_rel"/"$arch"/kernel-"$kernel_version".rpm"
-          echo "Querying koji for ${coreos_version} kernel: $kernel_version"
-          echo "$URL"
-          HTTP_RESP=$(curl -sI "$URL" | grep ^HTTP)
-          linux=""
-          if grep -qv "200 OK" <<< "${HTTP_RESP}"; then
-            echo "Koji failed to find $coreos_version kernel: $kernel_version"
-            case "$kernel_rel_part" in
-              "300")
-                kernel_rel_part="200"
-                ;;
-              "200")
-                kernel_rel_part="100"
-                ;;
-              "100")
-                ;;
-              *)
-                echo "unexpected kernel_rel_part ${kernel_rel_part}"
-                ;;
-            esac
-            kernel_rel="$kernel_rel_part.fc${{ inputs.fedora_version }}"
-            kernel_version="$major_minor_patch-$kernel_rel.$arch"
-            URL="https://kojipkgs.fedoraproject.org/packages/kernel/"$major_minor_patch"/"$kernel_rel"/"$arch"/kernel-"$kernel_version".rpm"
-            echo "Re-querying koji for ${coreos_version} kernel: $kernel_version"
-            echo "$URL"
-            HTTP_RESP=$(curl -sI "$URL" | grep ^HTTP)
-            if grep -qv "200 OK" <<< "${HTTP_RESP}"; then
-              echo "Koji failed to find $coreos_version kernel: $kernel_version"
-            fi
-          fi
-          if grep -q "200 OK" <<< "${HTTP_RESP}"; then
-            linux=$kernel_version
-          fi
-        }
-
-        case ${{ inputs.kernel_flavor }} in
-          "asus")
-            $dnf copr enable -y lukenukem/asus-kernel
-            linux=$($dnf repoquery --repoid copr:copr.fedorainfracloud.org:lukenukem:asus-kernel --whatprovides kernel | sort -V | tail -n1 | sed 's/.*://')
-            ;;
-          "centos")
-            linux=$($dnf repoquery --whatprovides kernel | sort -V | tail -n1 | sed 's/.*://')
-            ;;
-          "centos-hsk")
-            $dnf -y install centos-release-hyperscale-kernel
-            linux=$($dnf repoquery --enablerepo="centos-hyperscale" --whatprovides kernel | sort -V | tail -n1 | sed 's/.*://')
-            ;;
-          "bazzite")
-            if [[ -n "${{ inputs.bazzite_tag }}" ]]; then
-              latest="$(curl "https://api.github.com/repos/bazzite-org/kernel-bazzite/releases/tags/${{ inputs.bazzite_tag }}" )"
-            else
-              latest="$(curl "https://api.github.com/repos/bazzite-org/kernel-bazzite/releases/latest" )"
-            fi
-            linux=$(echo -E "$latest" | jq -r '.assets[].name' | grep -E 'kernel-.*.rpm' | grep "fc${{ inputs.fedora_version }}.x86_64" | head -1 | sed "s/kernel-//g" | sed "s/.rpm//g" )
-            build_tag=$(echo -E $latest | jq -r '.tag_name')
-            ;;
-          "longterm"*)
-            $dnf copr enable -y kwizart/kernel-${{ inputs.kernel_flavor }}
-            linux=$($dnf repoquery --enablerepo="copr:copr.fedorainfracloud.org:kwizart:kernel-${{ inputs.kernel_flavor }}" --whatprovides kernel-longterm | sort -V | tail -n1 | sed 's/.*://')
-            ;;
-          "surface")
-            if [[ "${{ inputs.fedora_version }}" < 41 ]]; then
-            $dnf config-manager --add-repo=https://pkg.surfacelinux.com/fedora/linux-surface.repo
-            else
-            $dnf config-manager addrepo --from-repofile=https://pkg.surfacelinux.com/fedora/linux-surface.repo
-            fi
-            linux=$($dnf repoquery --repoid linux-surface --whatprovides kernel-surface | sort -V | tail -n1 | sed 's/.*://')
-            ;;
-          "main")
-            base_image_name="base"
-            if [[ ${{ inputs.fedora_version }} > 40 ]]; then
-              base_image_name+="-atomic"
-            fi
-            linux=$(skopeo inspect docker://quay.io/fedora-ostree-desktops/$base_image_name:${{ inputs.fedora_version }} | jq -r '.Labels["ostree.linux"]' )
-            ;;
-          "coreos-stable")
-            coreos_kernel stable
-            ;;
-          "coreos-testing")
-            coreos_kernel testing
-            ;;
-          *)
-            echo "unexpected kernel_flavor '${{ inputs.kernel_flavor }}' for query"
-            ;;
-          esac
-          if [ -z "$linux" ] || [ "null" = "$linux" ]; then
-            echo "inspected image linux version must not be empty or null"
-            exit 1
-          fi
-          major=$(echo "$linux" | cut -d '.' -f 1)
-          minor=$(echo "$linux" | cut -d '.' -f 2)
-          patch=$(echo "$linux" | cut -d '.' -f 3)
-          kernel_major_minor_patch="${major}.${minor}.${patch}"
-
-          # Debug Output
-          echo "kernel_build_tag: ${build_tag}"
-          echo "kernel_flavor: ${{ inputs.kernel_flavor }}"
-          echo "kernel_major_minor_patch: ${kernel_major_minor_patch}"
-          echo "kernel_release: ${linux}"
-
-          # Action Output
-          echo "build_tag=${build_tag}" >> $GITHUB_OUTPUT
-          echo "major_minor_patch=${kernel_major_minor_patch}" >> $GITHUB_OUTPUT
-          echo "release=${linux}" >> $GITHUB_OUTPUT
-
--- a/.github/workflows/build-41.yml
+++ b/.github/workflows/build-41.yml
@ -1,28 +0,0 @@
-name: ublue akmods 41
-on:
-  merge_group:
-  pull_request:
-    branches:
-      - main
-    paths-ignore:
-      - '**.md'
-  schedule:
-    - cron: '25 0 * * *'  # 0025 UTC everyday (20 minutes after 42)
-  workflow_dispatch:
-
-jobs:
-  kernel-akmods:
-    uses: ./.github/workflows/reusable-build.yml
-    secrets: inherit
-    strategy:
-      fail-fast: false
-      matrix:
-        fedora_version:
-          - 41
-        kernel_flavor:
-          - main
-          - coreos-stable
-          - coreos-testing
-    with:
-      fedora_version: ${{ matrix.fedora_version }}
-      kernel_flavor: ${{ matrix.kernel_flavor }}
--- a/.github/workflows/build-42.yml
+++ b/.github/workflows/build-42.yml
@ -1,29 +0,0 @@
-name: ublue akmods 42
-on:
-  merge_group:
-  pull_request:
-    branches:
-      - main
-    paths-ignore:
-      - '**.md'
-  schedule:
-    - cron: '5 0 * * *'  # 0005 UTC everyday
-  workflow_dispatch:
-
-jobs:
-  kernel-akmods:
-    uses: ./.github/workflows/reusable-build.yml
-    secrets: inherit
-    strategy:
-      fail-fast: false
-      matrix:
-        fedora_version:
-          - 42
-        kernel_flavor:
-          - main
-          - coreos-stable
-          - coreos-testing
-          - longterm-6.12
-    with:
-      fedora_version: ${{ matrix.fedora_version }}
-      kernel_flavor: ${{ matrix.kernel_flavor }}
--- a/.github/workflows/build-akmods-bazzite.yml
+++ b/.github/workflows/build-akmods-bazzite.yml
@ -0,0 +1,91 @@
+---
+#
+# WARNING THIS IS A GENERATED WORKFLOW. DO NOT EDIT BY HAND!
+#
+# Generate the workflow by running `just generate-workflows` at git root
+# Modify the inputs in workflow-templates
+name: Build BAZZITE akmods
+on:
+  merge_group:
+  pull_request:
+    branches:
+      - main
+    paths-ignore:
+      - '**.md'
+  schedule:
+    - cron: '22 0 * * *'  # 0022 UTC everyday
+  workflow_dispatch:
+    inputs:
+      bazzite_tag:
+        description: "The release tag for the bazzite kernel"
+        required: false
+        type: string
+jobs:
+  cache_kernel_bazzite_42:
+    name: Cache bazzite (42)
+    uses: ./.github/workflows/reusable-cache-kernel.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    with:
+      kernel_flavor: bazzite
+      version: 42
+      bazzite_tag: ${{ inputs.bazzite_tag }}
+  build-bazzite_42_common:
+    name: Build common bazzite (42)
+    uses: ./.github/workflows/reusable-build.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    needs: cache_kernel_bazzite_42
+    with:
+      version: 42
+      kernel_flavor: bazzite
+      akmods_target: common
+      kernel_cache_key: ${{ needs.cache_kernel_bazzite_42.outputs.KCKEY }}
+  build-bazzite_42_extra:
+    name: Build extra bazzite (42)
+    uses: ./.github/workflows/reusable-build.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    needs: cache_kernel_bazzite_42
+    with:
+      version: 42
+      kernel_flavor: bazzite
+      akmods_target: extra
+      kernel_cache_key: ${{ needs.cache_kernel_bazzite_42.outputs.KCKEY }}
+  build-bazzite_42_nvidia:
+    name: Build nvidia bazzite (42)
+    uses: ./.github/workflows/reusable-build.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    needs: cache_kernel_bazzite_42
+    with:
+      version: 42
+      kernel_flavor: bazzite
+      akmods_target: nvidia
+      kernel_cache_key: ${{ needs.cache_kernel_bazzite_42.outputs.KCKEY }}
+  build-bazzite_42_nvidia-open:
+    name: Build nvidia-open bazzite (42)
+    uses: ./.github/workflows/reusable-build.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    needs: cache_kernel_bazzite_42
+    with:
+      version: 42
+      kernel_flavor: bazzite
+      akmods_target: nvidia-open
+      kernel_cache_key: ${{ needs.cache_kernel_bazzite_42.outputs.KCKEY }}
--- a/.github/workflows/build-akmods-centos-hsk.yml
+++ b/.github/workflows/build-akmods-centos-hsk.yml
@ -0,0 +1,71 @@
+---
+#
+# WARNING THIS IS A GENERATED WORKFLOW. DO NOT EDIT BY HAND!
+#
+# Generate the workflow by running `just generate-workflows` at git root
+# Modify the inputs in workflow-templates
+name: Build CENTOS-HSK akmods
+on:
+  merge_group:
+  pull_request:
+    branches:
+      - main
+    paths-ignore:
+      - '**.md'
+  schedule:
+    - cron: '09 0 * * *'  # 0009 UTC everyday
+  workflow_dispatch:
+jobs:
+  cache_kernel_centos-hsk_10:
+    name: Cache centos-hsk (10)
+    uses: ./.github/workflows/reusable-cache-kernel.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    with:
+      kernel_flavor: centos-hsk
+      version: 10
+  build-centos-hsk_10_nvidia:
+    name: Build nvidia centos-hsk (10)
+    uses: ./.github/workflows/reusable-build.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    needs: cache_kernel_centos-hsk_10
+    with:
+      version: 10
+      kernel_flavor: centos-hsk
+      akmods_target: nvidia
+      kernel_cache_key: ${{ needs.cache_kernel_centos-hsk_10.outputs.KCKEY }}
+  build-centos-hsk_10_nvidia-open:
+    name: Build nvidia-open centos-hsk (10)
+    uses: ./.github/workflows/reusable-build.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    needs: cache_kernel_centos-hsk_10
+    with:
+      version: 10
+      kernel_flavor: centos-hsk
+      akmods_target: nvidia-open
+      kernel_cache_key: ${{ needs.cache_kernel_centos-hsk_10.outputs.KCKEY }}
+  build-centos-hsk_10_zfs:
+    name: Build zfs centos-hsk (10)
+    uses: ./.github/workflows/reusable-build.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    needs: cache_kernel_centos-hsk_10
+    with:
+      version: 10
+      kernel_flavor: centos-hsk
+      akmods_target: zfs
+      kernel_cache_key: ${{ needs.cache_kernel_centos-hsk_10.outputs.KCKEY }}
--- a/.github/workflows/build-akmods-centos.yml
+++ b/.github/workflows/build-akmods-centos.yml
@ -0,0 +1,124 @@
+---
+#
+# WARNING THIS IS A GENERATED WORKFLOW. DO NOT EDIT BY HAND!
+#
+# Generate the workflow by running `just generate-workflows` at git root
+# Modify the inputs in workflow-templates
+name: Build CENTOS akmods
+on:
+  merge_group:
+  pull_request:
+    branches:
+      - main
+    paths-ignore:
+      - '**.md'
+  schedule:
+    - cron: '05 0 * * *'  # 0005 UTC everyday
+  workflow_dispatch:
+jobs:
+  cache_kernel_centos-hsk_10:
+    name: Cache centos-hsk (10)
+    uses: ./.github/workflows/reusable-cache-kernel.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    with:
+      kernel_flavor: centos-hsk
+      version: 10
+  build-centos-hsk_10_nvidia:
+    name: Build nvidia centos-hsk (10)
+    uses: ./.github/workflows/reusable-build.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    needs: cache_kernel_centos-hsk_10
+    with:
+      version: 10
+      kernel_flavor: centos-hsk
+      akmods_target: nvidia
+      kernel_cache_key: ${{ needs.cache_kernel_centos-hsk_10.outputs.KCKEY }}
+  build-centos-hsk_10_nvidia-open:
+    name: Build nvidia-open centos-hsk (10)
+    uses: ./.github/workflows/reusable-build.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    needs: cache_kernel_centos-hsk_10
+    with:
+      version: 10
+      kernel_flavor: centos-hsk
+      akmods_target: nvidia-open
+      kernel_cache_key: ${{ needs.cache_kernel_centos-hsk_10.outputs.KCKEY }}
+  build-centos-hsk_10_zfs:
+    name: Build zfs centos-hsk (10)
+    uses: ./.github/workflows/reusable-build.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    needs: cache_kernel_centos-hsk_10
+    with:
+      version: 10
+      kernel_flavor: centos-hsk
+      akmods_target: zfs
+      kernel_cache_key: ${{ needs.cache_kernel_centos-hsk_10.outputs.KCKEY }}
+  cache_kernel_centos_10:
+    name: Cache centos (10)
+    uses: ./.github/workflows/reusable-cache-kernel.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    with:
+      kernel_flavor: centos
+      version: 10
+  build-centos_10_nvidia:
+    name: Build nvidia centos (10)
+    uses: ./.github/workflows/reusable-build.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    needs: cache_kernel_centos_10
+    with:
+      version: 10
+      kernel_flavor: centos
+      akmods_target: nvidia
+      kernel_cache_key: ${{ needs.cache_kernel_centos_10.outputs.KCKEY }}
+  build-centos_10_nvidia-open:
+    name: Build nvidia-open centos (10)
+    uses: ./.github/workflows/reusable-build.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    needs: cache_kernel_centos_10
+    with:
+      version: 10
+      kernel_flavor: centos
+      akmods_target: nvidia-open
+      kernel_cache_key: ${{ needs.cache_kernel_centos_10.outputs.KCKEY }}
+  build-centos_10_zfs:
+    name: Build zfs centos (10)
+    uses: ./.github/workflows/reusable-build.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    needs: cache_kernel_centos_10
+    with:
+      version: 10
+      kernel_flavor: centos
+      akmods_target: zfs
+      kernel_cache_key: ${{ needs.cache_kernel_centos_10.outputs.KCKEY }}
--- a/.github/workflows/build-akmods-coreos-stable.yml
+++ b/.github/workflows/build-akmods-coreos-stable.yml
@ -0,0 +1,152 @@
+---
+#
+# WARNING THIS IS A GENERATED WORKFLOW. DO NOT EDIT BY HAND!
+#
+# Generate the workflow by running `just generate-workflows` at git root
+# Modify the inputs in workflow-templates
+name: Build COREOS-STABLE akmods
+on:
+  merge_group:
+  pull_request:
+    branches:
+      - main
+    paths-ignore:
+      - '**.md'
+  schedule:
+    - cron: '27 0 * * *'  # 0027 UTC everyday
+  workflow_dispatch:
+jobs:
+  cache_kernel_coreos-stable_42:
+    name: Cache coreos-stable (42)
+    uses: ./.github/workflows/reusable-cache-kernel.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    with:
+      kernel_flavor: coreos-stable
+      version: 42
+  build-coreos-stable_42_common:
+    name: Build common coreos-stable (42)
+    uses: ./.github/workflows/reusable-build.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    needs: cache_kernel_coreos-stable_42
+    with:
+      version: 42
+      kernel_flavor: coreos-stable
+      akmods_target: common
+      kernel_cache_key: ${{ needs.cache_kernel_coreos-stable_42.outputs.KCKEY }}
+  build-coreos-stable_42_nvidia:
+    name: Build nvidia coreos-stable (42)
+    uses: ./.github/workflows/reusable-build.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    needs: cache_kernel_coreos-stable_42
+    with:
+      version: 42
+      kernel_flavor: coreos-stable
+      akmods_target: nvidia
+      kernel_cache_key: ${{ needs.cache_kernel_coreos-stable_42.outputs.KCKEY }}
+  build-coreos-stable_42_nvidia-open:
+    name: Build nvidia-open coreos-stable (42)
+    uses: ./.github/workflows/reusable-build.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    needs: cache_kernel_coreos-stable_42
+    with:
+      version: 42
+      kernel_flavor: coreos-stable
+      akmods_target: nvidia-open
+      kernel_cache_key: ${{ needs.cache_kernel_coreos-stable_42.outputs.KCKEY }}
+  build-coreos-stable_42_zfs:
+    name: Build zfs coreos-stable (42)
+    uses: ./.github/workflows/reusable-build.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    needs: cache_kernel_coreos-stable_42
+    with:
+      version: 42
+      kernel_flavor: coreos-stable
+      akmods_target: zfs
+      kernel_cache_key: ${{ needs.cache_kernel_coreos-stable_42.outputs.KCKEY }}
+  cache_kernel_coreos-stable_41:
+    name: Cache coreos-stable (41)
+    uses: ./.github/workflows/reusable-cache-kernel.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    with:
+      kernel_flavor: coreos-stable
+      version: 41
+  build-coreos-stable_41_common:
+    name: Build common coreos-stable (41)
+    uses: ./.github/workflows/reusable-build.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    needs: cache_kernel_coreos-stable_41
+    with:
+      version: 41
+      kernel_flavor: coreos-stable
+      akmods_target: common
+      kernel_cache_key: ${{ needs.cache_kernel_coreos-stable_41.outputs.KCKEY }}
+  build-coreos-stable_41_nvidia:
+    name: Build nvidia coreos-stable (41)
+    uses: ./.github/workflows/reusable-build.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    needs: cache_kernel_coreos-stable_41
+    with:
+      version: 41
+      kernel_flavor: coreos-stable
+      akmods_target: nvidia
+      kernel_cache_key: ${{ needs.cache_kernel_coreos-stable_41.outputs.KCKEY }}
+  build-coreos-stable_41_nvidia-open:
+    name: Build nvidia-open coreos-stable (41)
+    uses: ./.github/workflows/reusable-build.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    needs: cache_kernel_coreos-stable_41
+    with:
+      version: 41
+      kernel_flavor: coreos-stable
+      akmods_target: nvidia-open
+      kernel_cache_key: ${{ needs.cache_kernel_coreos-stable_41.outputs.KCKEY }}
+  build-coreos-stable_41_zfs:
+    name: Build zfs coreos-stable (41)
+    uses: ./.github/workflows/reusable-build.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    needs: cache_kernel_coreos-stable_41
+    with:
+      version: 41
+      kernel_flavor: coreos-stable
+      akmods_target: zfs
+      kernel_cache_key: ${{ needs.cache_kernel_coreos-stable_41.outputs.KCKEY }}
--- a/.github/workflows/build-akmods-coreos-testing.yml
+++ b/.github/workflows/build-akmods-coreos-testing.yml
@ -0,0 +1,152 @@
+---
+#
+# WARNING THIS IS A GENERATED WORKFLOW. DO NOT EDIT BY HAND!
+#
+# Generate the workflow by running `just generate-workflows` at git root
+# Modify the inputs in workflow-templates
+name: Build COREOS-TESTING akmods
+on:
+  merge_group:
+  pull_request:
+    branches:
+      - main
+    paths-ignore:
+      - '**.md'
+  schedule:
+    - cron: '17 0 * * *'  # 0017 UTC everyday
+  workflow_dispatch:
+jobs:
+  cache_kernel_coreos-testing_41:
+    name: Cache coreos-testing (41)
+    uses: ./.github/workflows/reusable-cache-kernel.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    with:
+      kernel_flavor: coreos-testing
+      version: 41
+  build-coreos-testing_41_common:
+    name: Build common coreos-testing (41)
+    uses: ./.github/workflows/reusable-build.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    needs: cache_kernel_coreos-testing_41
+    with:
+      version: 41
+      kernel_flavor: coreos-testing
+      akmods_target: common
+      kernel_cache_key: ${{ needs.cache_kernel_coreos-testing_41.outputs.KCKEY }}
+  build-coreos-testing_41_nvidia:
+    name: Build nvidia coreos-testing (41)
+    uses: ./.github/workflows/reusable-build.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    needs: cache_kernel_coreos-testing_41
+    with:
+      version: 41
+      kernel_flavor: coreos-testing
+      akmods_target: nvidia
+      kernel_cache_key: ${{ needs.cache_kernel_coreos-testing_41.outputs.KCKEY }}
+  build-coreos-testing_41_nvidia-open:
+    name: Build nvidia-open coreos-testing (41)
+    uses: ./.github/workflows/reusable-build.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    needs: cache_kernel_coreos-testing_41
+    with:
+      version: 41
+      kernel_flavor: coreos-testing
+      akmods_target: nvidia-open
+      kernel_cache_key: ${{ needs.cache_kernel_coreos-testing_41.outputs.KCKEY }}
+  build-coreos-testing_41_zfs:
+    name: Build zfs coreos-testing (41)
+    uses: ./.github/workflows/reusable-build.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    needs: cache_kernel_coreos-testing_41
+    with:
+      version: 41
+      kernel_flavor: coreos-testing
+      akmods_target: zfs
+      kernel_cache_key: ${{ needs.cache_kernel_coreos-testing_41.outputs.KCKEY }}
+  cache_kernel_coreos-testing_42:
+    name: Cache coreos-testing (42)
+    uses: ./.github/workflows/reusable-cache-kernel.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    with:
+      kernel_flavor: coreos-testing
+      version: 42
+  build-coreos-testing_42_common:
+    name: Build common coreos-testing (42)
+    uses: ./.github/workflows/reusable-build.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    needs: cache_kernel_coreos-testing_42
+    with:
+      version: 42
+      kernel_flavor: coreos-testing
+      akmods_target: common
+      kernel_cache_key: ${{ needs.cache_kernel_coreos-testing_42.outputs.KCKEY }}
+  build-coreos-testing_42_nvidia:
+    name: Build nvidia coreos-testing (42)
+    uses: ./.github/workflows/reusable-build.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    needs: cache_kernel_coreos-testing_42
+    with:
+      version: 42
+      kernel_flavor: coreos-testing
+      akmods_target: nvidia
+      kernel_cache_key: ${{ needs.cache_kernel_coreos-testing_42.outputs.KCKEY }}
+  build-coreos-testing_42_nvidia-open:
+    name: Build nvidia-open coreos-testing (42)
+    uses: ./.github/workflows/reusable-build.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    needs: cache_kernel_coreos-testing_42
+    with:
+      version: 42
+      kernel_flavor: coreos-testing
+      akmods_target: nvidia-open
+      kernel_cache_key: ${{ needs.cache_kernel_coreos-testing_42.outputs.KCKEY }}
+  build-coreos-testing_42_zfs:
+    name: Build zfs coreos-testing (42)
+    uses: ./.github/workflows/reusable-build.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    needs: cache_kernel_coreos-testing_42
+    with:
+      version: 42
+      kernel_flavor: coreos-testing
+      akmods_target: zfs
+      kernel_cache_key: ${{ needs.cache_kernel_coreos-testing_42.outputs.KCKEY }}
--- a/.github/workflows/build-akmods-longterm-6.12.yml
+++ b/.github/workflows/build-akmods-longterm-6.12.yml
@ -0,0 +1,85 @@
+---
+#
+# WARNING THIS IS A GENERATED WORKFLOW. DO NOT EDIT BY HAND!
+#
+# Generate the workflow by running `just generate-workflows` at git root
+# Modify the inputs in workflow-templates
+name: Build LONGTERM-6.12 akmods
+on:
+  merge_group:
+  pull_request:
+    branches:
+      - main
+    paths-ignore:
+      - '**.md'
+  schedule:
+    - cron: '15 0 * * *'  # 0015 UTC everyday
+  workflow_dispatch:
+jobs:
+  cache_kernel_longterm-6-12_42:
+    name: Cache longterm-6.12 (42)
+    uses: ./.github/workflows/reusable-cache-kernel.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    with:
+      kernel_flavor: longterm-6.12
+      version: 42
+  build-longterm-6-12_42_common:
+    name: Build common longterm-6.12 (42)
+    uses: ./.github/workflows/reusable-build.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    needs: cache_kernel_longterm-6-12_42
+    with:
+      version: 42
+      kernel_flavor: longterm-6.12
+      akmods_target: common
+      kernel_cache_key: ${{ needs.cache_kernel_longterm-6-12_42.outputs.KCKEY }}
+  build-longterm-6-12_42_nvidia:
+    name: Build nvidia longterm-6.12 (42)
+    uses: ./.github/workflows/reusable-build.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    needs: cache_kernel_longterm-6-12_42
+    with:
+      version: 42
+      kernel_flavor: longterm-6.12
+      akmods_target: nvidia
+      kernel_cache_key: ${{ needs.cache_kernel_longterm-6-12_42.outputs.KCKEY }}
+  build-longterm-6-12_42_nvidia-open:
+    name: Build nvidia-open longterm-6.12 (42)
+    uses: ./.github/workflows/reusable-build.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    needs: cache_kernel_longterm-6-12_42
+    with:
+      version: 42
+      kernel_flavor: longterm-6.12
+      akmods_target: nvidia-open
+      kernel_cache_key: ${{ needs.cache_kernel_longterm-6-12_42.outputs.KCKEY }}
+  build-longterm-6-12_42_zfs:
+    name: Build zfs longterm-6.12 (42)
+    uses: ./.github/workflows/reusable-build.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    needs: cache_kernel_longterm-6-12_42
+    with:
+      version: 42
+      kernel_flavor: longterm-6.12
+      akmods_target: zfs
+      kernel_cache_key: ${{ needs.cache_kernel_longterm-6-12_42.outputs.KCKEY }}
--- a/.github/workflows/build-akmods-main.yml
+++ b/.github/workflows/build-akmods-main.yml
@ -0,0 +1,124 @@
+---
+#
+# WARNING THIS IS A GENERATED WORKFLOW. DO NOT EDIT BY HAND!
+#
+# Generate the workflow by running `just generate-workflows` at git root
+# Modify the inputs in workflow-templates
+name: Build MAIN akmods
+on:
+  merge_group:
+  pull_request:
+    branches:
+      - main
+    paths-ignore:
+      - '**.md'
+  schedule:
+    - cron: '07 0 * * *'  # 0007 UTC everyday
+  workflow_dispatch:
+jobs:
+  cache_kernel_main_41:
+    name: Cache main (41)
+    uses: ./.github/workflows/reusable-cache-kernel.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    with:
+      kernel_flavor: main
+      version: 41
+  build-main_41_common:
+    name: Build common main (41)
+    uses: ./.github/workflows/reusable-build.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    needs: cache_kernel_main_41
+    with:
+      version: 41
+      kernel_flavor: main
+      akmods_target: common
+      kernel_cache_key: ${{ needs.cache_kernel_main_41.outputs.KCKEY }}
+  build-main_41_nvidia:
+    name: Build nvidia main (41)
+    uses: ./.github/workflows/reusable-build.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    needs: cache_kernel_main_41
+    with:
+      version: 41
+      kernel_flavor: main
+      akmods_target: nvidia
+      kernel_cache_key: ${{ needs.cache_kernel_main_41.outputs.KCKEY }}
+  build-main_41_nvidia-open:
+    name: Build nvidia-open main (41)
+    uses: ./.github/workflows/reusable-build.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    needs: cache_kernel_main_41
+    with:
+      version: 41
+      kernel_flavor: main
+      akmods_target: nvidia-open
+      kernel_cache_key: ${{ needs.cache_kernel_main_41.outputs.KCKEY }}
+  cache_kernel_main_42:
+    name: Cache main (42)
+    uses: ./.github/workflows/reusable-cache-kernel.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    with:
+      kernel_flavor: main
+      version: 42
+  build-main_42_common:
+    name: Build common main (42)
+    uses: ./.github/workflows/reusable-build.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    needs: cache_kernel_main_42
+    with:
+      version: 42
+      kernel_flavor: main
+      akmods_target: common
+      kernel_cache_key: ${{ needs.cache_kernel_main_42.outputs.KCKEY }}
+  build-main_42_nvidia:
+    name: Build nvidia main (42)
+    uses: ./.github/workflows/reusable-build.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    needs: cache_kernel_main_42
+    with:
+      version: 42
+      kernel_flavor: main
+      akmods_target: nvidia
+      kernel_cache_key: ${{ needs.cache_kernel_main_42.outputs.KCKEY }}
+  build-main_42_nvidia-open:
+    name: Build nvidia-open main (42)
+    uses: ./.github/workflows/reusable-build.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    needs: cache_kernel_main_42
+    with:
+      version: 42
+      kernel_flavor: main
+      akmods_target: nvidia-open
+      kernel_cache_key: ${{ needs.cache_kernel_main_42.outputs.KCKEY }}
--- a/.github/workflows/build-bazzite.yml
+++ b/.github/workflows/build-bazzite.yml
@ -1,34 +0,0 @@
-name: bazzite akmods
-on:
-  merge_group:
-  pull_request:
-    branches:
-      - main
-    paths-ignore:
-      - '**.md'
-  schedule:
-    - cron: '5 0 * * *'  # 0005 UTC everyday
-  repository_dispatch:
-    types: [bazzite-kernel-build]
-  workflow_dispatch:
-    inputs:
-      release_tag:
-        description: 'Release tag (leave empty for latest)'
-        required: false
-        default: ''
-
-jobs:
-  kernel-akmods:
-    uses: ./.github/workflows/reusable-build.yml
-    secrets: inherit
-    strategy:
-      fail-fast: false
-      matrix:
-        fedora_version:
-          - 42
-        kernel_flavor:
-          - bazzite
-    with:
-      fedora_version: ${{ matrix.fedora_version }}
-      kernel_flavor: ${{ matrix.kernel_flavor }}
-      bazzite_tag: ${{ github.event_name == 'repository_dispatch' && github.event.client_payload.release_tag || github.event.inputs.release_tag }}
--- a/.github/workflows/build-centos.yml
+++ b/.github/workflows/build-centos.yml
@ -1,31 +0,0 @@
-name: ublue akmods centos
-on:
-  merge_group:
-  pull_request:
-    branches:
-      - main
-    paths-ignore:
-      - '**.md'
-  schedule:
-    - cron: '5 0 * * *'  # 0005 UTC everyday
-  workflow_dispatch:
-
-jobs:
-  kernel-akmods:
-    uses: ./.github/workflows/reusable-build.yml
-    secrets: inherit
-    strategy:
-      fail-fast: false
-      matrix:
-        kernel_flavor:
-          - centos
-          - centos-hsk
-        fedora_version:
-          - stream10
-          - stream9
-        exclude:
-          - kernel_flavor: centos-hsk
-            fedora_version: stream9
-    with:
-      kernel_flavor: ${{ matrix.kernel_flavor }}
-      fedora_version: ${{ matrix.fedora_version }}
--- a/.github/workflows/reusable-build.yml
+++ b/.github/workflows/reusable-build.yml
@ -1,447 +1,161 @@
-name: build-ublue
+name: build-akmod
+run-name: "Build ${{ inputs.akmods_target != 'common' && format('akmods-{0}', inputs.akmods_target) || 'akmods' }}:${{ inputs.kernel_flavor }}-${{ inputs.version }}"
 on:
  workflow_call:
    inputs:
-      fedora_version:
-        description: "The Fedora release version: 41, 42, etc"
-        required: true
-        type: string
-      kernel_flavor:
-        description: "The Kernel flavor: main, bazzite, coreos-stable, centos-hsk, longterm-6.12, etc"
+      akmods_target:
+        description: "The akmods to build: common, extra, zfs, nvidia, nvidia-open"
        required: true
        type: string
      bazzite_tag:
        description: "The release tag for the bazzite kernel"
        required: false
        type: string
+      kernel_flavor:
+        description: "The Kernel flavor: main, bazzite, coreos-stable, centos-hsk, longterm-6.12, etc"
+        required: true
+        type: string
+      version:
+        description: "Release Version: 10, 41, 42, etc"
+        required: true
+        type: string
+      kernel_cache_key:
+        description: "The Key for the Kernel Cache"
+        required: true
+        type: string
+  workflow_dispatch:
+    inputs:
+      akmods_target:
+        description: "The akmods to build: common, extra, zfs, nvidia, nvidia-open"
+        required: true
+        type: string
+      bazzite_tag:
+        description: "The release tag for the bazzite kernel"
+        required: false
+        type: string
+      kernel_flavor:
+        description: "The Kernel flavor: main, bazzite, coreos-stable, centos-hsk, longterm-6.12, etc"
+        required: true
+        type: string
+      version:
+        description: "Release Version: 10, 41, 42, etc"
+        required: true
+        type: string
+      kernel_cache_key:
+        description: "The Key for the Kernel Cache"
+        required: true
+        type: string
 env:
-  IMAGE_BASE_NAME: akmods
-  IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
+  AKMODS_BAZZITE_TAG: ${{ inputs.bazzite_tag }}
+  AKMODS_KERNEL: ${{ inputs.kernel_flavor }}
+  AKMODS_TARGET: ${{ inputs.akmods_target }}
+  AKMODS_VERSION: ${{ inputs.version }}
+  KCKEY: ${{ inputs.kernel_cache_key }}

 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.fedora_version }}-${{ inputs.kernel_flavor }}
+  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.version }}-${{ inputs.kernel_flavor }}-${{ inputs.akmods_target }}
  cancel-in-progress: true

 jobs:
-  cache-kernel:
-    name: Kernel ${{ inputs.fedora_version }}-${{ inputs.kernel_flavor }}
-    runs-on: ubuntu-24.04
-    env:
-      KCWD: /tmp/kernel-cache
-      KCPATH: kernel_cache
-    outputs:
-      KCKEY: ${{ inputs.kernel_flavor }}-${{ steps.kernel-version.outputs.kernel_release }}
-      KCWD: ${{ env.KCWD }}
-      KCPATH: ${{ env.KCPATH }}
-      kernel_build_tag: ${{ steps.kernel-version.outputs.kernel_build_tag }}
-      kernel_major_minor_patch: ${{ steps.kernel-version.outputs.kernel_major_minor_patch }}
-      KERNEL_VERSION: ${{ steps.kernel-version.outputs.kernel_release }}
-
-    steps:
-      - name: Checkout Repo
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-
-      - name: Get Kernel Version
-        id: kernel-version
-        uses: ./.github/actions/get-kernel-version
-        with:
-          fedora_version: ${{ inputs.fedora_version }}
-          kernel_flavor: ${{ inputs.kernel_flavor }}
-          bazzite_tag: ${{ inputs.bazzite_tag }}
-
-      - name: Cache Kernel RPMs
-        id: cache-kernel
-        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
-        with:
-          path: ${{ env.KCPATH }}
-          key: ${{ inputs.kernel_flavor }}-${{ steps.kernel-version.outputs.kernel_release }} # job outputs KCKEY
-
-      - name: Retrieve Signing Key
-        if: steps.cache-kernel.outputs.cache-hit != 'true' && github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.event_name == 'merge_group'
-        shell: bash
-        run: |
-          mkdir -p certs
-          if [[ "${{ github.event_name }}"  == 'pull_request' ]]; then
-            echo "This should not have run... exiting..."
-            exit 1
-          else
-            echo "${{ secrets.KERNEL_PRIVKEY }}" > certs/private_key.priv
-            echo "${{ secrets.AKMOD_PRIVKEY_20230518 }}" > certs/private_key_2.priv
-            # DEBUG: get character count of key
-            wc -c certs/private_key.priv
-            wc -c certs/private_key_2.priv
-          fi
-
-      - name: Fetch and Sign Kernel Packages
-        if: steps.cache-kernel.outputs.cache-hit != 'true'
-        shell: bash
-        run: |
-          if [[ ${{ inputs.kernel_flavor }} =~ centos ]]; then
-            build_image="quay.io/centos/centos:${{ inputs.fedora_version }}"
-          else
-            build_image="quay.io/fedora/fedora:${{ inputs.fedora_version }}"
-          fi
-          podman pull "$build_image"
-
-          mkdir -p ${{ env.KCWD }}
-          cp -a fetch-kernel.sh certs ${{ env.KCWD }}
-
-          echo "${{toJSON(steps.kernel-version.outputs)}}"
-
-          container_name="fq-$(uuidgen)"
-          podman run \
-            --entrypoint /bin/bash \
-            --env FEDORA_VERSION=${{ inputs.fedora_version }} \
-            --env KERNEL_BUILD_TAG=${{ steps.kernel-version.outputs.kernel_build_tag }} \
-            --env KERNEL_VERSION=${{ steps.kernel-version.outputs.kernel_release }} \
-            --env KERNEL_FLAVOR=${{ inputs.kernel_flavor }} \
-            --env DUAL_SIGN=true \
-            --name "$container_name" \
-            -v ${{ env.KCWD }}:${{ env.KCWD }}:rw \
-            -dt "$build_image"
-
-          podman exec "$container_name" bash -x ${{ env.KCWD }}/fetch-kernel.sh ${{ env.KCWD }}
-
-          find ${{ env.KCWD }}
-
-      - name: Check Secureboot Signatures
-        if: steps.cache-kernel.outputs.cache-hit != 'true'
-        shell: bash
-        run: |
-          set -x
-          if [[ ! $(command -v sbverify) || ! $(command -v curl) || ! $(command -v openssl) || ! $(command -v rpm2cpio) ]]; then
-            sudo apt update
-            sudo apt install sbsigntool curl openssl rpm2cpio
-          fi
-          KERNEL_NAME=kernel
-          if [[ "${{ inputs.kernel_flavor }}" =~ "longterm" ]]; then
-            KERNEL_NAME=kernel-longterm
-          fi
-          cd ${{ env.KCWD }}/rpms
-          rpm2cpio ${KERNEL_NAME}-core-"${{ steps.kernel-version.outputs.kernel_release }}".rpm | cpio -idmv
-          cd ./lib/modules/"${{ steps.kernel-version.outputs.kernel_release }}"/
-          sbverify --list vmlinuz
-          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
-            curl --retry 3 -#fLo kernel-sign.der https://github.com/ublue-os/akmods/raw/main/certs/public_key.der.test
-            curl --retry 3 -#fLo akmods.der https://github.com/ublue-os/akmods/raw/main/certs/public_key_2.der.test
-          else
-            curl --retry 3 -#fLo kernel-sign.der https://github.com/ublue-os/akmods/raw/main/certs/public_key.der
-            curl --retry 3 -#fLo akmods.der https://github.com/ublue-os/akmods/raw/main/certs/public_key_2.der
-          fi
-          openssl x509 -in kernel-sign.der -out kernel-sign.crt
-          openssl x509 -in akmods.der -out akmods.crt
-          sbverify --cert kernel-sign.crt vmlinuz || exit 1
-          sbverify --cert akmods.crt vmlinuz || exit 1
-
-      - name: Finalize Cache Files
-        if: steps.cache-kernel.outputs.cache-hit != 'true'
-        shell: bash
-        run: |
-          # this should be in runner user's home dir
-          mkdir -p ${{ env.KCPATH }}
-          cp -a ${{ env.KCWD }}/rpms/*.rpm ${{ env.KCPATH }}/
-          echo "$(date '+%Y%m%d.0')" > ${{ env.KCPATH }}/kernel-cache-date
-
-      - name: List Cached Kernel RPMs
-        shell: bash
-        run: |
-          find ${{ env.KCPATH }}
-
  build-akmods:
-    name: Akmods ${{ inputs.fedora_version }}-${{ inputs.kernel_flavor }}-${{ matrix.cfile_suffix }}
-    runs-on: ubuntu-24.04 # Work Around Tar Bug
-    needs: [cache-kernel]
+    name: Build ${{ matrix.platform }}
+    runs-on: ${{ matrix.platform == 'x86_64' && 'ubuntu-24.04' || 'ubuntu-24.04-arm' }}
    permissions:
+      actions: read
      contents: read
      packages: write
-      id-token: write
+    container:
+      image: "ghcr.io/ublue-os/devcontainer:latest"
+      options: "--privileged --volume /var/lib/containers:/var/lib/containers --security-opt seccomp=unconfined --security-opt label=disable --user 0:0"
    strategy:
      fail-fast: false
      matrix:
-        kernel_flavor:  # this must be in matrix for excludes, but reference inputs.kernel_flavor in workflow
-          - ${{ inputs.kernel_flavor }}
-        cfile_suffix:
-          - common
-          - extra
-          - nvidia
-          - nvidia-open
-          - zfs
-        exclude:
-          # extra
-          - kernel_flavor: main
-            cfile_suffix: extra
-          - kernel_flavor: coreos-stable
-            cfile_suffix: extra
-          - kernel_flavor: coreos-testing
-            cfile_suffix: extra
-          - kernel_flavor: longterm-6.12
-            cfile_suffix: extra
-          # zfs
-          - kernel_flavor: main
-            cfile_suffix: zfs
-          - kernel_flavor: bazzite
-            cfile_suffix: zfs
-          # centos
-          - kernel_flavor: centos
-            cfile_suffix: common
-          - kernel_flavor: centos-hsk
-            cfile_suffix: common
-          - kernel_flavor: centos
-            cfile_suffix: extra
-          - kernel_flavor: centos-hsk
-            cfile_suffix: extra
-          - kernel_flavor: centos-hsk
-            cfile_suffix: nvidia
-          - kernel_flavor: centos-hsk
-            cfile_suffix: nvidia-open
-    env:
-      KCWD: ${{ needs.cache-kernel.outputs.KCWD }}
-      KCPATH: ${{ needs.cache-kernel.outputs.KCPATH }}
-      kernel_build_tag: ${{ needs.cache-kernel.outputs.kernel_build_tag }}
-      KERNEL_VERSION: ${{ needs.cache-kernel.outputs.KERNEL_VERSION }}
-
+        platform:
+          - x86_64
+          # - aarch64
    steps:
      - name: Checkout Repo
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

-      - name: Create cache parent dir
+      - name: Mark Directory as Safe
+        run: git config --system --ad safe.directory "$GITHUB_WORKSPACE"
+
+      - name: Export GITHUB_WORKSPACE
+        id: gh-workspace
+        run: echo "GITHUB_WORKSPACE=$GITHUB_WORKSPACE" >> "$GITHUB_OUTPUT"
+        
+      - name: Cache Kernel RPMs
+        id: cache-kernel
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+        with:
+          path: ${{ steps.gh-workspace.outputs.GITHUB_WORKSPACE }}/build/${{ env.AKMODS_KERNEL }}-${{ env.AKMODS_VERSION }}/KCWD/rpms
+          key: ${{ env.KCKEY }}-${{ matrix.platform }}
+
+      - name: Fail Absent Kernel Cache
+        if: steps.cache-kernel.outputs.cache-hit != 'true'
+        run: "echo 'Kernel Cache not found for key: ${{ env.KCKEY }}'; exit 1"
+
+      - name: Retrieve Signing Key
+        if: contains(fromJson('["schedule", "workflow_dispatch", "merge_group"]'), github.event_name)
        shell: bash
        run: |
-          mkdir -p ${{ env.KCWD }}
+          mkdir -p certs
+          echo "${{ secrets.KERNEL_PRIVKEY }}" > certs/private_key.priv
+          echo "${{ secrets.AKMOD_PRIVKEY_20230518 }}" > certs/private_key_2.priv
+          # DEBUG: get character count of key
+          wc -c certs/private_key.priv
+          wc -c certs/private_key_2.priv
+        
+      - name: Build Image
+        id: build
+        run: just build
+
+      - name: Test Image
+        run: just test
+
+      - name: Push and Sign Image
+        if: contains(fromJson('["schedule", "workflow_dispatch", "merge_group"]'), github.event_name)
+        run:
+          just login-to-ghcr
+          just push
+        env:
+          COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
+          REGISTRY_ACTOR: ${{ github.actor }}
+          REGISTRY_TOKEN: ${{ github.token }}
+
+  manifest:
+    name: "Generate ${{ inputs.akmods_target != 'common' && format('akmods-{0}', inputs.akmods_target) || 'akmods' }}:${{ inputs.kernel_flavor }}-${{ inputs.version }} Manifest"
+    runs-on: ubuntu-latest
+    needs: [build-akmods]
+    container:
+      image: "ghcr.io/ublue-os/devcontainer:latest"
+      options: "--privileged --volume /var/lib/containers:/var/lib/containers --security-opt seccomp=unconfined --security-opt label=disable --user 0:0"
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    steps:
+      - name: Exit on failure
+        if: ${{ needs.build-akmods.result == 'failure' }}
+        run: exit 1
+
+      - name: Export GITHUB_WORKSPACE
+        id: gh-workspace
+        run: echo "GITHUB_WORKSPACE=$GITHUB_WORKSPACE" >> "$GITHUB_OUTPUT"

      - name: Cache Kernel RPMs
        id: cache-kernel
        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
-          path: ${{ env.KCPATH }}
-          key: ${{ needs.cache-kernel.outputs.KCKEY }}
+          path: ${{ steps.gh-workspace.outputs.GITHUB_WORKSPACE }}/build/${{ env.AKMODS_KERNEL }}-${{ env.AKMODS_VERSION }}/KCWD/rpms
+          key: ${{ env.KCKEY }}-x86_64

-      - name: Fail Absent Kernel Cache
-        if: steps.cache-kernel.outputs.cache-hit != 'true'
-        run: |
-          echo "Kernel Cache not found for key: ${{ needs.cache-kernel.outputs.KCKEY }}"
-          exit 1
-
-      - name: Get Cached Kernel Date/Version
-        shell: bash
-        run: |
-          set -exo pipefail
-
-          find ${{ env.KCPATH }}
-          KCDATE=$(cat ${{ env.KCPATH }}/kernel-cache-date)
-          if [ -z "${KCDATE}" ]; then
-            echo "kernel-cache-date must not be empty"
-          fi
-          if [ -z "${{ env.KERNEL_VERSION }}" ]; then
-            echo "KERNEL_VERSION must not be empty"
-          fi
-          KERNEL_IMAGE_VERSION=${{ env.KERNEL_VERSION }}-${KCDATE}
-          echo "KERNEL_IMAGE_VERSION=$KERNEL_IMAGE_VERSION" >> $GITHUB_ENV
-
-      - name: Matrix Variables
-        shell: bash
-        run: |
-          if [ "common" == "${{ matrix.cfile_suffix }}" ]; then
-              echo "IMAGE_NAME=${{ env.IMAGE_BASE_NAME }}" >> $GITHUB_ENV
-          else
-              echo "IMAGE_NAME=${{ env.IMAGE_BASE_NAME }}-${{ matrix.cfile_suffix }}" >> $GITHUB_ENV
-          fi
-          if [[ ${{ inputs.kernel_flavor }} =~ "centos" ]]; then
-            build_image="quay.io/centos/centos"
-          else
-            build_image="quay.io/fedora/fedora"
-          fi
-          export BUILDER_IMAGE=${build_image}
-          echo "BUILDER_IMAGE=${BUILDER_IMAGE}" >> $GITHUB_ENV
-
-      - name: Pull build image
-        shell: bash
-        run: podman pull ${{ env.BUILDER_IMAGE }}:${{ inputs.fedora_version }}
-
-      - name: AppArmor Disable
-        run: |
-          set -x
-          systemctl status apparmor
-          sudo systemctl stop apparmor
-          systemctl status apparmor || true
-
-      - name: Generate tags
-        id: generate-tags
-        shell: bash
-        run: |
-          # Generate a timestamp for creating an image version history
-          TIMESTAMP="$(date +%Y%m%d)"
-          VARIANT="${{ inputs.kernel_flavor }}-${{ inputs.fedora_version }}"
-
-          COMMIT_TAGS=()
-          BUILD_TAGS=()
-
-          # Have tags for tracking builds during pull request
-          SHA_SHORT="${GITHUB_SHA::7}"
-          COMMIT_TAGS+=("pr-${{ github.event.number }}-${VARIANT}")
-          COMMIT_TAGS+=("${SHA_SHORT}-${VARIANT}")
-
-          BUILD_TAGS=("${VARIANT}" "${VARIANT}-${TIMESTAMP}" "${VARIANT}-${KERNEL_VERSION}")
-
-          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
-              echo "Generated the following commit tags: "
-              for TAG in "${COMMIT_TAGS[@]}"; do
-                  echo "${TAG}"
-              done
-              default_tag=${COMMIT_TAGS[0]}
-              alias_tags=("${COMMIT_TAGS[@]}")
-          else
-              default_tag=${BUILD_TAGS[0]}
-              alias_tags=("${BUILD_TAGS[@]}")
-          fi
-
-          echo "Generated the following build tags: "
-          for TAG in "${BUILD_TAGS[@]}"; do
-              echo "${TAG}"
-          done
-
-          echo "alias_tags=${alias_tags[*]}" >> $GITHUB_OUTPUT
-          echo "default_tag=$default_tag" >> $GITHUB_ENV
-
-      # Build metadata
-      - name: Image Metadata
-        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
-        id: meta
-        with:
-          images: |
-            ${{ env.IMAGE_NAME }}
-          labels: |
-            org.opencontainers.image.title=${{ env.IMAGE_BASE_NAME }}
-            org.opencontainers.image.description=A caching layer for pre-built akmod RPMs
-            org.opencontainers.image.version=${{ env.KERNEL_IMAGE_VERSION }}
-            ostree.linux=${{ env.KERNEL_VERSION }}
-            io.artifacthub.package.readme-url=https://raw.githubusercontent.com/${{ github.repository }}/main/README.md
-            io.artifacthub.package.logo-url=https://avatars.githubusercontent.com/u/1728152?s=200&v=4
-
-      - name: Retrieve Signing Key
-        if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.event_name == 'merge_group'
-        shell: bash
-        run: |
-          mkdir -p certs
-          if [[ "${{ github.event_name }}"  == 'pull_request' ]]; then
-            echo "This should not have run... exiting..."
-            exit 1
-          else
-            echo "${{ secrets.KERNEL_PRIVKEY }}" > certs/private_key.priv
-            echo "${{ secrets.AKMOD_PRIVKEY_20230518 }}" > certs/private_key_2.priv
-            # DEBUG: get character count of key
-            wc -c certs/private_key.priv
-            wc -c certs/private_key_2.priv
-          fi
-
-      # Build image using Buildah action
-      - name: Build Image
-        id: build_image
-        uses: redhat-actions/buildah-build@7a95fa7ee0f02d552a32753e7414641a04307056 # v2
-        with:
-          containerfiles: |
-            ./Containerfile.${{ matrix.cfile_suffix }}
-          image: ${{ env.IMAGE_NAME }}
-          tags: |
-            ${{ steps.generate-tags.outputs.alias_tags }}
-          build-args: |
-            BUILDER_IMAGE=${{ env.BUILDER_IMAGE }}
-            KERNEL_FLAVOR=${{ inputs.kernel_flavor }}
-            FEDORA_MAJOR_VERSION=${{ inputs.fedora_version }}
-            RPMFUSION_MIRROR=${{ vars.RPMFUSION_MIRROR }}
-            DUAL_SIGN=true
-          labels: ${{ steps.meta.outputs.labels }}
-          oci: false
-
-      - name: Build Test Image
-        uses: redhat-actions/buildah-build@7a95fa7ee0f02d552a32753e7414641a04307056 # v2
-        with:
-          containerfiles: |
-            ./Containerfile.test
-          image: akmods-test
-          tags: latest
-          build-args: |
-            BUILDER_IMAGE=${{ env.BUILDER_IMAGE }}
-            KERNEL_FLAVOR=${{ inputs.kernel_flavor }}
-            FEDORA_MAJOR_VERSION=${{ inputs.fedora_version }}
-            RPMFUSION_MIRROR=${{ vars.RPMFUSION_MIRROR }}
-            INPUT_AKMODS=${{ env.IMAGE_NAME }}
-            INPUT_TAG=${{ env.default_tag }}
-            DUAL_SIGN=true
-          oci: false
-
-      - name: Test Akmods Signature
-        id: test_akmods
-        shell: bash
-        run: |
-          if ! podman run akmods-test:latest; then
-              echo "Signatures Failed"
-              exit 1
-          fi
-
-      # Workaround bug where capital letters in your GitHub username make it impossible to push to GHCR.
-      # https://github.com/macbre/push-to-ghcr/issues/12
-      - name: Lowercase Registry
-        id: registry_case
-        uses: ASzc/change-string-case-action@d0603cd0a7dd490be678164909f65c7737470a7f # v6
-        with:
-          string: ${{ env.IMAGE_REGISTRY }}
-
-      - name: Push To GHCR
-        uses: Wandalen/wretry.action@e68c23e6309f2871ca8ae4763e7629b9c258e1ea # v3.8.0
-        id: push
-        if: github.event_name != 'pull_request'
+      - name: Generate Manifest
+        if: contains(fromJson('["schedule", "workflow_dispatch", "merge_group"]'), github.event_name)
+        run:
+          just login-to-ghcr
+          just manifest
        env:
-          REGISTRY_USER: ${{ github.actor }}
-          REGISTRY_PASSWORD: ${{ github.token }}
-        with:
-          action: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2
-          attempt_limit: 3
-          attempt_delay: 15000
-          with: |
-            image: ${{ steps.build_image.outputs.image }}
-            tags: ${{ steps.build_image.outputs.tags }}
-            registry: ${{ steps.registry_case.outputs.lowercase }}
-            username: ${{ env.REGISTRY_USER }}
-            password: ${{ env.REGISTRY_PASSWORD }}
-            extra-args: |
-              --disable-content-trust
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
-        if: github.event_name != 'pull_request'
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      # Sign container
-      - uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3.9.1
-        if: github.event_name != 'pull_request'
-
-      - name: Sign container image
-        if: github.event_name != 'pull_request'
-        run: |
-          cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/${{ steps.build_image.outputs.image }}@${TAGS}
-        env:
-          TAGS: ${{ steps.push.outputs.outputs && fromJSON(steps.push.outputs.outputs).digest }}
-          COSIGN_EXPERIMENTAL: false
          COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
-
-      - name: Echo outputs
-        if: github.event_name != 'pull_request'
-        run: |
-          echo "${{ toJSON(steps.push.outputs) }}"
-
-  check:
-    name: Check all ${{ inputs.fedora_version }}-${{ inputs.kernel_flavor}} builds successful
-    runs-on: ubuntu-latest
-    needs: [build-akmods]
-    steps:
-      - name: Exit on failure
-        if: ${{ needs.build-akmods.result == 'failure' }}
-        shell: bash
-        run: exit 1
-      - name: Exit
-        shell: bash
-        run: exit 0
+          REGISTRY_ACTOR: ${{ github.actor }}
+          REGISTRY_TOKEN: ${{ github.token }}
--- a/.github/workflows/reusable-cache-kernel.yml
+++ b/.github/workflows/reusable-cache-kernel.yml
@ -0,0 +1,115 @@
+name: cache-kernel
+run-name: Cache ${{ format('{0}-{1}', inputs.kernel_flavor, inputs.version) }} Kernel
+on:
+  workflow_call:
+    inputs:
+      bazzite_tag:
+        description: "The release tag for the bazzite kernel"
+        required: false
+        type: string
+      kernel_flavor:
+        description: "The Kernel flavor: main, bazzite, coreos-stable, centos-hsk, longterm-6.12, etc"
+        required: true
+        type: string
+      version:
+        description: "Release Version: 10, 41, 42, etc"
+        required: true
+        type: string
+    outputs:
+      KCKEY:
+        description: Cache Key
+        value: ${{ jobs.cache-kernel.outputs.KCKEY }}
+  workflow_dispatch:
+    inputs:
+      bazzite_tag:
+        description: "The release tag for the bazzite kernel"
+        required: false
+        type: string
+      kernel_flavor:
+        description: "The Kernel flavor: main, bazzite, coreos-stable, centos-hsk, longterm-6.12, etc"
+        required: true
+        type: string
+      version:
+        description: "Release Version: 10, 41, 42, etc"
+        required: true
+        type: string
+env:
+  AKMODS_BAZZITE_TAG: ${{ inputs.bazzite_tag }}
+  AKMODS_KERNEL: ${{ inputs.kernel_flavor }}
+  AKMODS_VERSION: ${{ inputs.version }}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.version }}-${{ inputs.kernel_flavor }}
+  cancel-in-progress: true
+
+jobs:
+  cache-kernel:
+    name: Cache ${{ matrix.platform }}
+    runs-on: ${{ matrix.platform == 'x86_64' && 'ubuntu-24.04' || 'ubuntu-24.04-arm' }}
+    outputs:
+      KCKEY: ${{ inputs.kernel_flavor }}-${{ steps.kernel-version.outputs.kernel_major_minor_patch }}
+    container:
+      image: "ghcr.io/ublue-os/devcontainer:latest"
+      options: "--privileged --volume /var/lib/containers:/var/lib/containers --security-opt seccomp=unconfined --security-opt label=disable --user 0:0"
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+          - x86_64
+          # - aarch64
+    env:
+      AKMODS_BAZZITE_TAG: ${{ inputs.bazzite_tag }}
+      AKMODS_KERNEL: ${{ inputs.kernel_flavor }}
+      AKMODS_VERSION: ${{ inputs.version }}
+    
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      
+      - name: Mark Directory as Safe
+        run: git config --system --ad safe.directory "$GITHUB_WORKSPACE"
+      
+      - name: Get Kernel Version
+        id: kernel-version
+        run: just cache-kernel-version
+
+      - name: Cache Kernel RPMs
+        id: cache-kernel
+        uses: actions/cache@v4
+        with:
+          path: ${{ steps.kernel-version.outputs.KCPATH }}
+          key: ${{ inputs.kernel_flavor }}-${{ steps.kernel-version.outputs.kernel_major_minor_patch }}-${{ matrix.platform }} # job outputs KCKEY
+
+      - name: Retrieve Signing Key
+        if: contains(fromJSON('["schedule", "workflow_dispatch", "merge_group"]'), github.event_name) && steps.cache-kernel.outputs.cache-hit != 'true'
+        shell: bash
+        run: |
+          mkdir -p certs
+          echo "${{ secrets.KERNEL_PRIVKEY }}" > certs/private_key.priv
+          echo "${{ secrets.AKMOD_PRIVKEY_20230518 }}" > certs/private_key_2.priv
+          # DEBUG: get character count of key
+          wc -c certs/private_key.priv
+          wc -c certs/private_key_2.priv
+
+      - name: Fetch Kernel
+        if: steps.cache-kernel.outputs.cache-hit != 'true'
+        run: just fetch-kernel
+
+      - name: List Cached Kernel RPMs
+        run: find ${{ steps.kernel-version.outputs.KCPATH }}
+  check:
+    name: Check all ${{ format('{0}-{1}', inputs.kernel_flavor, inputs.version) }} cache successful
+    runs-on: ubuntu-latest
+    needs: [cache-kernel]
+    permissions:
+      actions: read
+    steps:
+      - name: Exit on failure
+        if: ${{ needs.cache-kernel.result == 'failure' }}
+        run: exit 1
+      - name: Exit
+        run: exit 0
--- a/.gitignore
+++ b/.gitignore
@ -1,2 +1,4 @@
 certs/private_key.priv.prod
 certs/public_key.der.prod
+.env
+build
--- a/Containerfile.common
+++ b/Containerfile.common
@ -1,55 +0,0 @@
-###
-### Containerfile.common - used to build ONLY NON-nvidia kmods
-###
-
-ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-42}"
-ARG BUILDER_IMAGE="${BUILDER_IMAGE:-quay.io/fedora/fedora}"
-ARG BUILDER_BASE="${BUILDER_IMAGE}:${FEDORA_MAJOR_VERSION}"
-FROM ${BUILDER_BASE} AS builder
-
-ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-42}"
-ARG KERNEL_FLAVOR="${KERNEL_FLAVOR:-main}"
-ARG RPMFUSION_MIRROR=""
-ARG DUAL_SIGN="true"
-
-COPY build_files/common build_files/shared /tmp/
-COPY certs /tmp/certs
-
-# files for akmods
-ADD https://copr.fedorainfracloud.org/coprs/ublue-os/akmods/repo/fedora-${FEDORA_MAJOR_VERSION}/ublue-os-akmods-fedora-${FEDORA_MAJOR_VERSION}.repo \
-    /tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/_copr_ublue-os-akmods.repo
-ADD https://negativo17.org/repos/fedora-multimedia.repo \
-    /tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/negativo17-fedora-multimedia.repo
-
-RUN --mount=type=bind,src=kernel_cache,dst=/tmp/kernel_cache,ro \
-    --mount=type=cache,dst=/var/cache/dnf \
-    ls -sh /tmp/kernel_cache; \
-    if [[ "${KERNEL_FLAVOR}" =~ "surface" ]]; then \
-        export KERNEL_NAME="kernel-surface" \
-    ; elif [[ "${KERNEL_FLAVOR}" =~ "longterm" ]]; then \
-        export KERNEL_NAME="kernel-longterm" \
-    ; else \
-        export KERNEL_NAME="kernel" \
-    ; fi && \
-    /tmp/build-prep.sh && \
-    if [[ "${KERNEL_FLAVOR}" =~ "coreos" ]]; then \
-      /tmp/build-ublue-os-ucore-addons.sh && \
-      cp /tmp/ublue-os-ucore-addons/rpmbuild/RPMS/noarch/ublue-os-ucore-addons*.rpm \
-        /var/cache/rpms/ucore/ \
-    ; fi && \
-    /tmp/build-ublue-os-akmods-addons.sh && \
-    cp /tmp/ublue-os-akmods-addons/rpmbuild/RPMS/noarch/ublue-os-akmods-addons*.rpm \
-      /var/cache/rpms/ublue-os/ && \
-    /tmp/build-kmod-framework-laptop.sh && \
-    /tmp/build-kmod-kvmfr.sh && \
-    /tmp/build-kmod-openrazer.sh && \
-    /tmp/build-kmod-v4l2loopback.sh && \
-    /tmp/build-kmod-wl.sh && \
-    /tmp/build-kmod-xone.sh && \
-    /tmp/dual-sign.sh && \
-    /tmp/build-post.sh
-
-FROM scratch
-
-COPY --from=builder /var/cache/kernel-rpms /kernel-rpms
-COPY --from=builder /var/cache/rpms /rpms
--- a/Containerfile.extra
+++ b/Containerfile.extra
@ -1,63 +0,0 @@
-###
-### Containerfile.extra - used to build extra kmods
-###
-
-ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-42}"
-ARG BUILDER_IMAGE="${BUILDER_IMAGE:-quay.io/fedora/fedora}"
-ARG BUILDER_BASE="${BUILDER_IMAGE}:${FEDORA_MAJOR_VERSION}"
-FROM ${BUILDER_BASE} AS builder
-
-ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-42}"
-ARG KERNEL_FLAVOR="${KERNEL_FLAVOR:-main}"
-ARG RPMFUSION_MIRROR=""
-ARG DUAL_SIGN="true"
-
-COPY build_files/extra build_files/shared /tmp/
-COPY certs /tmp/certs
-
-# files for akmods
-ADD https://copr.fedorainfracloud.org/coprs/ublue-os/akmods/repo/fedora-${FEDORA_MAJOR_VERSION}/ublue-os-akmods-fedora-${FEDORA_MAJOR_VERSION}.repo \
-    /tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/_copr_ublue-os-akmods.repo
-ADD https://negativo17.org/repos/fedora-multimedia.repo \
-    /tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/negativo17-fedora-multimedia.repo
-
-RUN --mount=type=bind,src=kernel_cache,dst=/tmp/kernel_cache,ro \
-    --mount=type=cache,dst=/var/cache/dnf \
-    ls -sh /tmp/kernel_cache; \
-    if [[ "${KERNEL_FLAVOR}" =~ "surface" ]]; then \
-        export KERNEL_NAME="kernel-surface" \
-    ; elif [[ "${KERNEL_FLAVOR}" =~ "longterm" ]]; then \
-        export KERNEL_NAME="kernel-longterm" \
-    ; else \
-        export KERNEL_NAME="kernel" \
-    ; fi && \
-    /tmp/build-prep.sh && \
-    if grep -qv "asus" <<< "${KERNEL_FLAVOR}"; then \
-        /tmp/build-kmod-zenergy.sh && \
-        /tmp/build-kmod-evdi.sh \
-    ; fi && \
-    if [[ "${FEDORA_MAJOR_VERSION}" -ge 41 ]]; then \
-        /tmp/build-kmod-gpd-fan.sh \
-    ; fi && \
-    /tmp/build-kmod-ayaneo-platform.sh && \
-    /tmp/build-kmod-ayn-platform.sh && \
-    /tmp/build-kmod-bmi260.sh && \
-    if grep -qv "bazzite" <<< "${KERNEL_FLAVOR}"; then \
-        /tmp/build-kmod-facetimehd.sh && \
-        /tmp/build-kmod-rtl8814au.sh && \
-        /tmp/build-kmod-rtl88xxau.sh && \
-        /tmp/build-kmod-VirtualBox.sh \
-    ; fi && \
-    /tmp/build-kmod-gcadapter_oc.sh && \
-    /tmp/build-kmod-nct6687d.sh && \
-    /tmp/build-kmod-system76.sh && \
-    /tmp/build-kmod-system76-io.sh && \
-    /tmp/build-kmod-ryzen-smu.sh && \
-    /tmp/build-kmod-vhba.sh && \
-    /tmp/dual-sign.sh && \
-    /tmp/build-post.sh
-
-FROM scratch
-
-COPY --from=builder /var/cache/kernel-rpms /kernel-rpms
-COPY --from=builder /var/cache/rpms /rpms
--- a/Containerfile.in
+++ b/Containerfile.in
@ -0,0 +1,211 @@
+FROM BUILDER AS build_prep
+
+ARG DUAL_SIGN="true"
+ARG KERNEL_FLAVOR_ARG
+ARG KERNEL_NAME_ARG
+ARG RPMFUSION_MIRROR_ARG
+ARG VERSION_ARG
+
+#ifdef CI_SETX
+ARG CI=1
+#endif /* CI_SETX */
+
+#ifdef NVIDIA
+ARG KMOD_MODULE_ARG
+#endif /* NVIDIA */
+
+#ifdef ZFS
+ARG ZFS_MINOR_VERSION="2.3"
+#endif /* ZFS */
+
+# /*
+# common copy/add
+# */
+
+COPY certs /tmp/certs
+
+COPY files/etc/sway/environment /tmp/ublue-os-nvidia-addons/rpmbuild/SOURCES/environment
+COPY files/usr/lib/systemd/system/ublue-nvctk-cdi.service /tmp/ublue-os-nvidia-addons/rpmbuild/SOURCES/ublue-nvctk-cdi.service
+COPY files/usr/lib/systemd/system/ublue-nvctk-cdi.service /tmp/ublue-os-ucore-nvidia/rpmbuild/SOURCES/ublue-nvctk-cdi.service
+COPY files/usr/lib/systemd/system-preset/70-ublue-nvctk-cdi.preset /tmp/ublue-os-nvidia-addons/rpmbuild/SOURCES/70-ublue-nvctk-cdi.preset
+COPY files/usr/lib/systemd/system-preset/70-ublue-nvctk-cdi.preset /tmp/ublue-os-ucore-nvidia/rpmbuild/SOURCES/70-ublue-nvctk-cdi.preset
+COPY files/etc/udev/rules.d/60-nvidia-extra-devices-pm.rules /tmp/ublue-os-nvidia-addons/rpmbuild/SOURCES/60-nvidia-extra-devices-pm.rules
+
+#ifndef CENTOS
+ADD https://copr.fedorainfracloud.org/coprs/ublue-os/akmods/repo/fedora-${VERSION}/ublue-os-akmods-fedora-${VERSION}.repo \
+    /tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/_copr_ublue-os-akmods.repo
+ADD https://negativo17.org/repos/fedora-multimedia.repo \
+    /tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/negativo17-fedora-multimedia.repo
+#endif
+
+# /*
+# Preperation
+# */
+COPY build_files/prep /tmp/
+RUN --mount=type=cache,dst=/var/cache/dnf \
+    --mount=type=cache,dst=/var/cache/libdnf5 \
+    bash <<'RUNEOF'
+set "${CI+-x}" -euo pipefail
+ls -sh /tmp/kernel_cache
+/tmp/build-prep.sh
+RUNEOF
+
+FROM build_prep AS builder
+
+ARG DUAL_SIGN="true"
+ARG KERNEL_FLAVOR_ARG
+ARG KERNEL_NAME_ARG
+ARG RPMFUSION_MIRROR_ARG
+ARG VERSION_ARG
+
+#ifdef CI_SETX
+ARG CI=1
+#endif /* CI_SETX */
+
+#ifdef NVIDIA 
+ARG KMOD_MODULE_ARG
+#endif /* NVIDIA */
+
+#if defined COMMON
+# /*
+# common akmods
+# */
+COPY build_files/common /tmp/
+RUN --mount=type=cache,dst=/var/cache/dnf \
+    --mount=type=cache,dst=/var/cache/libdnf5 \
+    bash <<'RUNEOF'
+set "${CI+-x}" -euo pipefail
+if [[ "${KERNEL_FLAVOR}" =~ "coreos" ]]; then
+    /tmp/build-ublue-os-ucore-addons.sh
+    cp /tmp/ublue-os-ucore-addons/rpmbuild/RPMS/noarch/ublue-os-ucore-addons*.rpm /var/cache/rpms/ucore/
+fi
+/tmp/build-ublue-os-akmods-addons.sh
+cp /tmp/ublue-os-akmods-addons/rpmbuild/RPMS/noarch/ublue-os-akmods-addons*.rpm /var/cache/rpms/ublue-os/
+RUNEOF
+RUN --mount=type=cache,dst=/var/cache/dnf \
+    --mount=type=cache,dst=/var/cache/libdnf5 \
+    bash <<'RUNEOF'
+/tmp/build-kmod-framework-laptop.sh
+/tmp/build-kmod-kvmfr.sh
+/tmp/build-kmod-openrazer.sh
+/tmp/build-kmod-v4l2loopback.sh
+/tmp/build-kmod-wl.sh
+/tmp/build-kmod-xone.sh
+RUNEOF
+
+#elif defined EXTRA
+# /*
+# extra akmods
+# */
+
+COPY build_files/extra /tmp/
+RUN --mount=type=cache,dst=/var/cache/dnf \
+    --mount=type=cache,dst=/var/cache/libdnf5 \
+    bash <<'RUNEOF'
+if [[ "${VERSION}" -ge 41 ]]; then
+    /tmp/build-kmod-gpd-fan.sh
+fi
+/tmp/build-kmod-ayaneo-platform.sh
+/tmp/build-kmod-ayn-platform.sh
+/tmp/build-kmod-bmi260.sh
+if grep -qv "bazzite" <<< "${KERNEL_FLAVOR}"; then
+    /tmp/build-kmod-VirtualBox.sh
+    /tmp/build-kmod-facetimehd.sh
+    /tmp/build-kmod-rtl8814au.sh
+    /tmp/build-kmod-rtl88xxau.sh
+fi
+/tmp/build-kmod-gcadapter_oc.sh
+/tmp/build-kmod-nct6687d.sh
+/tmp/build-kmod-ryzen-smu.sh
+/tmp/build-kmod-system76-io.sh
+/tmp/build-kmod-system76.sh
+/tmp/build-kmod-vhba.sh
+RUNEOF
+
+#elif defined NVIDIA
+# /*
+# nvidia kmods
+# */
+
+COPY build_files/nvidia /tmp/
+RUN --mount=type=cache,dst=/var/cache/dnf \
+    --mount=type=cache,dst=/var/cache/libdnf5 \
+    bash <<'RUNEOF'
+if [[ "${KERNEL_FLAVOR}" =~ "coreos" ]]; then
+    /tmp/build-ublue-os-ucore-nvidia.sh
+    cp /tmp/ublue-os-ucore-nvidia/rpmbuild/RPMS/noarch/ublue-os-ucore-nvidia*.rpm /var/cache/rpms/ucore/
+fi
+RUNEOF
+RUN --mount=type=cache,dst=/var/cache/dnf \
+    --mount=type=cache,dst=/var/cache/libdnf5 \
+    bash <<'RUNEOF'
+/tmp/build-ublue-os-nvidia-addons.sh
+cp /tmp/ublue-os-nvidia-addons/rpmbuild/RPMS/noarch/ublue-os-nvidia-addons*.rpm /var/cache/rpms/ublue-os/
+RUNEOF
+RUN --mount=type=cache,dst=/var/cache/dnf \
+    --mount=type=cache,dst=/var/cache/libdnf5 \
+    bash <<'RUNEOF'
+/tmp/build-kmod-nvidia.sh "$KMOD_MODULE"
+RUNEOF
+
+#elif defined ZFS
+# /*
+# zfs akmods
+# */
+COPY build_files/zfs /tmp/
+RUN --mount=type=cache,dst=/var/cache/dnf \
+    --mount=type=cache,dst=/var/cache/libdnf5 \
+    bash <<'RUNEOF'
+set "${CI+-x}" -euo pipefail
+/tmp/build-kmod-zfs.sh
+RUNEOF
+#endif
+
+# /*
+# Signing
+# */
+COPY build_files/post /tmp/
+RUN --mount=type=cache,dst=/var/cache/dnf \
+    --mount=type=cache,dst=/var/cache/libdnf5 \
+    bash <<'RUNEOF'
+set "${CI+-x}" -euo pipefail
+#ifdef ZFS
+/tmp/dual-sign-zfs.sh
+#else
+/tmp/dual-sign.sh
+#endif /* ZFS */
+/tmp/build-post.sh
+RUNEOF
+
+FROM scratch AS RPMS
+
+COPY --from=builder /var/cache/kernel-rpms /kernel-rpms
+COPY --from=builder /var/cache/rpms /rpms
+
+FROM build_prep AS test
+
+ARG DUAL_SIGN="true"
+ARG KERNEL_FLAVOR_ARG
+ARG KERNEL_NAME_ARG
+ARG RPMFUSION_MIRROR_ARG
+ARG VERSION_ARG
+
+#ifdef CI_SETX
+ENV CI=1
+#endif
+
+COPY --from=RPMS /kernel-rpms /tmp/kernel_cache
+COPY --from=RPMS /rpms /tmp/akmods-rpms
+
+COPY build_files/test/test-prep.sh /tmp/
+COPY certs /tmp/certs
+
+RUN --mount=type=cache,dst=/var/cache/dnf \
+    --mount=type=cache,dst=/var/cache/libdnf5 \
+    bash <<'RUNEOF'
+set "${CI+-x}" -euo pipefail
+/tmp/test-prep.sh
+RUNEOF
+
+COPY build_files/test/check-signatures.sh /tmp/
+CMD ["/tmp/check-signatures.sh"]
--- a/Containerfile.nvidia
+++ b/Containerfile.nvidia
@ -1,52 +0,0 @@
-###
-### Containerfile.nvidia - used to build ONLY NVIDIA kmods
-###
-
-ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-42}"
-ARG BUILDER_IMAGE="${BUILDER_IMAGE:-quay.io/fedora/fedora}"
-ARG BUILDER_BASE="${BUILDER_IMAGE}:${FEDORA_MAJOR_VERSION}"
-FROM ${BUILDER_BASE} AS builder
-
-ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-42}"
-ARG KERNEL_FLAVOR="${KERNEL_FLAVOR:-main}"
-ARG RPMFUSION_MIRROR=""
-ARG DUAL_SIGN="true"
-
-COPY build_files/nvidia build_files/shared /tmp/
-COPY certs /tmp/certs
-
-# files for nvidia
-COPY files/etc/sway/environment /tmp/ublue-os-nvidia-addons/rpmbuild/SOURCES/environment
-COPY files/usr/lib/systemd/system/ublue-nvctk-cdi.service /tmp/ublue-os-nvidia-addons/rpmbuild/SOURCES/ublue-nvctk-cdi.service
-COPY files/usr/lib/systemd/system/ublue-nvctk-cdi.service /tmp/ublue-os-ucore-nvidia/rpmbuild/SOURCES/ublue-nvctk-cdi.service
-COPY files/usr/lib/systemd/system-preset/70-ublue-nvctk-cdi.preset /tmp/ublue-os-nvidia-addons/rpmbuild/SOURCES/70-ublue-nvctk-cdi.preset
-COPY files/usr/lib/systemd/system-preset/70-ublue-nvctk-cdi.preset /tmp/ublue-os-ucore-nvidia/rpmbuild/SOURCES/70-ublue-nvctk-cdi.preset
-COPY files/etc/udev/rules.d/60-nvidia-extra-devices-pm.rules /tmp/ublue-os-nvidia-addons/rpmbuild/SOURCES/60-nvidia-extra-devices-pm.rules
-
-RUN --mount=type=bind,src=kernel_cache,dst=/tmp/kernel_cache,ro \
-    --mount=type=cache,dst=/var/cache/dnf \
-    ls -sh /tmp/kernel_cache; \
-    if [[ "${KERNEL_FLAVOR}" =~ "surface" ]]; then \
-        export KERNEL_NAME="kernel-surface" \
-    ; elif [[ "${KERNEL_FLAVOR}" =~ "longterm" ]]; then \
-        export KERNEL_NAME="kernel-longterm" \
-    ; else \
-        export KERNEL_NAME="kernel" \
-    ; fi && \
-    /tmp/build-prep.sh && \
-    if [[ "${KERNEL_FLAVOR}" =~ "coreos" ]]; then \
-      /tmp/build-ublue-os-ucore-nvidia.sh && \
-      cp /tmp/ublue-os-ucore-nvidia/rpmbuild/RPMS/noarch/ublue-os-ucore-nvidia*.rpm \
-        /var/cache/rpms/ucore/ \
-    ; fi && \
-    /tmp/build-ublue-os-nvidia-addons.sh && \
-    cp /tmp/ublue-os-nvidia-addons/rpmbuild/RPMS/noarch/ublue-os-nvidia-addons*.rpm \
-      /var/cache/rpms/ublue-os/ && \
-    /tmp/build-kmod-nvidia.sh kernel && \
-    /tmp/dual-sign.sh && \
-    /tmp/build-post.sh
-
-FROM scratch
-
-COPY --from=builder /var/cache/kernel-rpms /kernel-rpms
-COPY --from=builder /var/cache/rpms /rpms
--- a/Containerfile.nvidia-open
+++ b/Containerfile.nvidia-open
@ -1,52 +0,0 @@
-###
-### Containerfile.nvidia - used to build ONLY NVIDIA kmods
-###
-
-ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-42}"
-ARG BUILDER_IMAGE="${BUILDER_IMAGE:-quay.io/fedora/fedora}"
-ARG BUILDER_BASE="${BUILDER_IMAGE}:${FEDORA_MAJOR_VERSION}"
-FROM ${BUILDER_BASE} AS builder
-
-ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-42}"
-ARG KERNEL_FLAVOR="${KERNEL_FLAVOR:-main}"
-ARG RPMFUSION_MIRROR=""
-ARG DUAL_SIGN="true"
-
-COPY build_files/nvidia build_files/shared /tmp/
-COPY certs /tmp/certs
-
-# files for nvidia
-COPY files/etc/sway/environment /tmp/ublue-os-nvidia-addons/rpmbuild/SOURCES/environment
-COPY files/usr/lib/systemd/system/ublue-nvctk-cdi.service /tmp/ublue-os-nvidia-addons/rpmbuild/SOURCES/ublue-nvctk-cdi.service
-COPY files/usr/lib/systemd/system/ublue-nvctk-cdi.service /tmp/ublue-os-ucore-nvidia/rpmbuild/SOURCES/ublue-nvctk-cdi.service
-COPY files/usr/lib/systemd/system-preset/70-ublue-nvctk-cdi.preset /tmp/ublue-os-nvidia-addons/rpmbuild/SOURCES/70-ublue-nvctk-cdi.preset
-COPY files/usr/lib/systemd/system-preset/70-ublue-nvctk-cdi.preset /tmp/ublue-os-ucore-nvidia/rpmbuild/SOURCES/70-ublue-nvctk-cdi.preset
-COPY files/etc/udev/rules.d/60-nvidia-extra-devices-pm.rules /tmp/ublue-os-nvidia-addons/rpmbuild/SOURCES/60-nvidia-extra-devices-pm.rules
-
-RUN --mount=type=bind,src=kernel_cache,dst=/tmp/kernel_cache,ro \
-    --mount=type=cache,dst=/var/cache/dnf \
-    ls -sh /tmp/kernel_cache; \
-    if [[ "${KERNEL_FLAVOR}" =~ "surface" ]]; then \
-        export KERNEL_NAME="kernel-surface" \
-    ; elif [[ "${KERNEL_FLAVOR}" =~ "longterm" ]]; then \
-        export KERNEL_NAME="kernel-longterm" \
-    ; else \
-        export KERNEL_NAME="kernel" \
-    ; fi && \
-    /tmp/build-prep.sh && \
-    if [[ "${KERNEL_FLAVOR}" =~ "coreos" ]]; then \
-      /tmp/build-ublue-os-ucore-nvidia.sh && \
-      cp /tmp/ublue-os-ucore-nvidia/rpmbuild/RPMS/noarch/ublue-os-ucore-nvidia*.rpm \
-        /var/cache/rpms/ucore/ \
-    ; fi && \
-    /tmp/build-ublue-os-nvidia-addons.sh && \
-    cp /tmp/ublue-os-nvidia-addons/rpmbuild/RPMS/noarch/ublue-os-nvidia-addons*.rpm \
-      /var/cache/rpms/ublue-os/ && \
-    /tmp/build-kmod-nvidia.sh kernel-open && \
-    /tmp/dual-sign.sh && \
-    /tmp/build-post.sh
-
-FROM scratch
-
-COPY --from=builder /var/cache/kernel-rpms /kernel-rpms
-COPY --from=builder /var/cache/rpms /rpms
--- a/Containerfile.test
+++ b/Containerfile.test
@ -1,36 +0,0 @@
-###
-### Containerfile.test - used to test akmods
-###
-
-ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-42}"
-ARG BUILDER_IMAGE="${BUILDER_IMAGE:-quay.io/fedora/fedora}"
-ARG BUILDER_BASE="${BUILDER_IMAGE}:${FEDORA_MAJOR_VERSION}"
-ARG INPUT_AKMODS="${INPUT_AKMODS:-akmods}"
-ARG INPUT_TAG="${INPUT_TAG:-${KERNEL_FLAVOR}-${FEDORA_MAJOR_VERSION}}"
-ARG INPUT_BASE="${INPUT_AKMODS}:${INPUT_TAG}"
-FROM ${INPUT_BASE} AS akmods_cache
-FROM ${BUILDER_BASE} AS tester
-
-ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-42}"
-ARG KERNEL_FLAVOR="${KERNEL_FLAVOR:-main}"
-ARG RPMFUSION_MIRROR=""
-ARG DUAL_SIGN="true"
-
-COPY build_files/shared /tmp/
-COPY certs /tmp/certs
-
-# cached kernel rpms
-COPY --from=akmods_cache /kernel-rpms /tmp/kernel_cache
-COPY --from=akmods_cache /rpms /tmp/akmods-rpms
-
-RUN --mount=type=cache,dst=/var/cache/dnf \
-    if [[ "${KERNEL_FLAVOR}" =~ "surface" ]]; then \
-        export KERNEL_NAME="kernel-surface" \
-    ; elif [[ "${KERNEL_FLAVOR}" =~ "longterm" ]]; then \
-        export KERNEL_NAME="kernel-longterm" \
-    ; else \
-        export KERNEL_NAME="kernel" \
-    ; fi && \
-    /tmp/test-prep.sh
-
-CMD ["/tmp/check-signatures.sh"]
--- a/Containerfile.zfs
+++ b/Containerfile.zfs
@ -1,38 +0,0 @@
-###
-### Containerfile.zfs - used to build ONLY ZFS kmod
-###
-
-ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-42}"
-ARG BUILDER_IMAGE="${BUILDER_IMAGE:-quay.io/fedora/fedora}"
-ARG BUILDER_BASE="${BUILDER_IMAGE}:${FEDORA_MAJOR_VERSION}"
-FROM ${BUILDER_BASE} AS builder
-
-ARG FEDORA_MAJOR_VERSION="${FEDORA_MAJOR_VERSION:-42}"
-ARG KERNEL_FLAVOR="${KERNEL_FLAVOR:-coreos-stable}"
-ARG DUAL_SIGN="true"
-ARG RPMFUSION_MIRROR=""
-ARG ZFS_MINOR_VERSION="${ZFS_MINOR_VERSION:-2.3}"
-
-COPY build_files/zfs build_files/shared /tmp/
-COPY certs /tmp/certs
-
-# Set kernel name
-RUN --mount=type=bind,src=kernel_cache,dst=/tmp/kernel_cache,ro \
-    --mount=type=cache,dst=/var/cache/dnf \
-    ls -sh /tmp/kernel_cache; \
-    if [[ "${KERNEL_FLAVOR}" =~ "surface" ]]; then \
-        export KERNEL_NAME="kernel-surface" \
-    ; elif [[ "${KERNEL_FLAVOR}" =~ "longterm" ]]; then \
-        export KERNEL_NAME="kernel-longterm" \
-    ; else \
-        export KERNEL_NAME="kernel" \
-    ; fi && \
-    /tmp/build-prep.sh && \
-    /tmp/build-kmod-zfs.sh && \
-    /tmp/dual-sign-zfs.sh && \
-    /tmp/build-post.sh
-
-FROM scratch
-
-COPY --from=builder /var/cache/kernel-rpms /kernel-rpms
-COPY --from=builder /var/cache/rpms /rpms
--- a/468
+++ b/468
@ -0,0 +1,468 @@
+set unstable := true
+set dotenv-load := true
+
+podman := which('podman') || require('podman-remote')
+just := just_executable()
+BUILDDIR := shell('mkdir -p $1 && echo $1', env('AKMODS_BUILDDIR', absolute_path('build')))
+version_cache := shell('mkdir -p $1 && echo $1', BUILDDIR / kernel_flavor + '-' + version)
+KCWD := shell('mkdir -p $1 && echo $1', version_cache / 'KCWD')
+KCPATH := shell('mkdir -p $1 && echo $1', env('KCPATH', KCWD / 'rpms'))
+version_json := KCPATH / 'cache.json' 
+builder := if kernel_flavor =~ 'centos' { 'quay.io/centos/centos:' + version } else { 'quay.io/fedora/fedora:' + version } 
+
+
+# Inputs
+
+kernel_flavor := env('AKMODS_KERNEL', shell('yq ".defaults.kernel_flavor" images.yaml'))
+version := env('AKMODS_VERSION', if kernel_flavor =~ 'centos' { '10' } else { shell('yq ".defaults.version" images.yaml') })
+akmods_target := env('AKMODS_TARGET', if kernel_flavor =~ 'centos' { 'zfs' } else { shell('yq ".defaults.akmods_target" images.yaml') })
+bazzite_tag := env('AKMODS_BAZZITE_TAG', '')
+
+# Check if valid
+
+check_valid := if shell('yq ".images.$1[\"$2\"].$3" images.yaml', version, kernel_flavor, akmods_target) != 'null' { 'true' } else { error('Invalid Image Combination') }
+_description := shell('yq ".images.$1[\"$2\"].$3.description" images.yaml', version, kernel_flavor, akmods_target)
+_org := shell('yq ".images.$1[\"$2\"].$3.org" images.yaml', version, kernel_flavor, akmods_target)
+_repo := shell('yq ".images.$1[\"$2\"].$3.repo" images.yaml', version, kernel_flavor, akmods_target)
+registry := env('AKMODS_REGISTRY', shell('yq ".images.$1[\"$2\"].$3.registry" images.yaml', version, kernel_flavor, akmods_target))
+transport := env('AKMODS_TRANSPORT', shell('yq ".images.$1[\"$2\"].$3.transport" images.yaml', version, kernel_flavor, akmods_target))
+akmods_name := 'akmods' + if akmods_target != 'common' { '-' +akmods_target } else { '' }
+
+# Functions
+[private]
+logsum := '''
+log_sum() { echo "$1" >> ${GITHUB_STEP_SUMMARY:-/dev/stdout}; }
+log_sum "# Push to GHCR result"
+log_sum "\`\`\`"
+'''
+
+[private]
+default:
+    {{ just }} --list
+
+# Remove Build Directory
+[group('Utility')]
+clean:
+    rm -rf {{ BUILDDIR }}
+
+# Get the Kernel Version
+[private]
+get-kernel-version:
+    #!/usr/bin/bash
+    set "${CI:+-x}" -euo pipefail
+    if [[ {{ kernel_flavor }} =~ centos|longterm ]]; then
+        {{ podman }} pull --retry 3 "{{ builder }}" >&2
+        container_name="fq-$(uuidgen)"
+        builder=$({{ podman }} run --entrypoint /bin/bash -dt "{{ builder }}")
+        dnf="{{ podman }} exec -t $builder dnf"
+        $dnf install -y --setopt=install_weak_deps=False dnf-plugins-core >&2
+        trap '{{ podman }} rm -f -t 0 $builder &>/dev/null' EXIT SIGTERM
+    fi
+
+    coreos_kernel() {
+        coreos_version=${1}
+        image_linux="$(skopeo inspect docker://quay.io/fedora/fedora-coreos:$coreos_version --format '{{{{ index .Labels "ostree.linux" }}')"
+        # Kernel Pin Location
+        # if [[ "{{ kernel_flavor }}" =~ coreos-stable ]]; then
+        #     image_linux=""
+        # fi
+
+        # Get Variables
+        major_minor_patch="$(echo $image_linux | grep -oP '^\d+\.\d+\.\d+')"
+        kernel_rel_part=$(echo $image_linux | grep -oP '^\d+\.\d+\.\d+\-\K([123][0]{2})')
+        arch="$(echo $image_linux | grep -oP 'fc\d+\.\K.*$')"
+        kernel_rel="$kernel_rel_part.fc{{ version }}"
+        kernel_version="$major_minor_patch-$kernel_rel.$arch"
+        URL="https://kojipkgs.fedoraproject.org/packages/kernel/"$major_minor_patch"/"$kernel_rel"/"$arch"/kernel-"$kernel_version".rpm"
+
+        echo "Querying koji for ${coreos_version} kernel: $kernel_version" >&2
+        echo "$URL" >&2
+        HTTP_RESP=$(curl -sI "$URL" | grep ^HTTP)
+        linux=""
+        if grep -qv "200 OK" <<< "${HTTP_RESP}"; then
+            echo "Koji failed to find $coreos_version kernel: $kernel_version" >&2
+            case "$kernel_rel_part" in
+                "300") kernel_rel_part="200" ;;
+                "200") kernel_rel_part="100" ;;
+                "100") ;;
+                *) echo "unexpected kernel_rel_part ${kernel_rel_part}" >&2 ;;
+            esac
+            kernel_rel="$kernel_rel_part.fc{{ version }}"
+            kernel_version="$major_minor_patch-$kernel_rel.$arch"
+            URL="https://kojipkgs.fedoraproject.org/packages/kernel/"$major_minor_patch"/"$kernel_rel"/"$arch"/kernel-"$kernel_version".rpm"
+            echo "Re-querying koji for ${coreos_version} kernel: $kernel_version" >&2
+            echo "$URL" >&2
+            HTTP_RESP=$(curl -sI "$URL" | grep ^HTTP)
+            if grep -qv "200 OK" <<< "${HTTP_RESP}"; then
+                echo "Koji failed to find $coreos_version kernel: $kernel_version" >&2
+            fi
+        fi
+        if grep -q "200 OK" <<< "${HTTP_RESP}"; then
+            linux=$kernel_version
+        fi
+    }
+
+    kernel_name=kernel
+    case {{ kernel_flavor }} in
+        "bazzite")
+            if [[ -n "{{ bazzite_tag }}" ]]; then
+                latest="$(curl -s "https://api.github.com/repos/bazzite-org/kernel-bazzite/releases/tags/{{ bazzite_tag }}" )"
+            else
+                latest="$(curl -s "https://api.github.com/repos/bazzite-org/kernel-bazzite/releases/latest")"
+            fi
+            linux=$(echo "$latest" | jq -r '.assets[].name | match("kernel-.*fc{{ version }}.{{ arch() }}.rpm").string' | head -1 | sed "s/kernel-//g;s/.rpm//g")
+            build_tag=$(echo -E $latest | jq -r '.tag_name')
+            ;;
+        "centos")
+            $dnf makecache >&2
+            linux=$($dnf repoquery --whatprovides kernel | sort -V | tail -n1 | sed 's/.*://')
+            ;;
+        "centos-hsk")
+            $dnf -y install centos-release-hyperscale-kernel >&2
+            $dnf makecache >&2
+            linux=$($dnf repoquery --enablerepo="centos-hyperscale" --whatprovides kernel | sort -V | tail -n1 | sed 's/.*://')
+            ;;
+        "coreos-stable")
+            coreos_kernel stable
+            ;;
+        "coreos-testing")
+            coreos_kernel testing
+            ;;
+        "longterm"*)
+            $dnf copr enable -y kwizart/kernel-{{ kernel_flavor }} >&2
+            $dnf makecache >&2
+            linux=$($dnf repoquery --whatprovides kernel-longterm | sort -V | tail -n1 | sed 's/.*://')
+            kernel_name=kernel-longterm
+            ;;
+        "main")
+            base_image_name="base"
+            if [[ {{ version }} > 40 ]]; then
+                base_image_name+="-atomic"
+            fi
+            linux=$(skopeo inspect docker://quay.io/fedora-ostree-desktops/$base_image_name:{{ version }} --format '{{{{ index .Labels "ostree.linux" }}')
+            ;;
+        *)
+            echo "unexpected kernel_flavor '{{ kernel_flavor }}' for query" >&2
+            exit 1
+            ;;
+    esac
+    if [ -z "$linux" ] || [ "null" = "$linux" ]; then
+        echo "inspected image linux version must not be empty or null" >&2
+        exit 1
+    fi
+    major=$(echo "$linux" | cut -d '.' -f 1)
+    minor=$(echo "$linux" | cut -d '.' -f 2)
+    patch=$(echo "$linux" | cut -d '.' -f 3)
+    kernel_major_minor_patch="${major}.${minor}.${patch}"
+    linux="$(echo $linux | tr -d '[:cntrl:]')"
+
+    # Debug Output
+    {{ if bazzite_tag != '' { 'echo "kernel_build_tag: ${build_tag}" >&2' } else { '' } }}
+    echo "kernel_flavor: {{ kernel_flavor }}" >&2
+    echo "kernel_major_minor_patch: ${kernel_major_minor_patch}" >&2
+    echo "kernel_release: ${linux}" >&2
+    echo "kernel_name: ${kernel_name}" >&2
+
+    # Return
+    output=$(jq -nM \
+        --arg build_tag "${build_tag:-}" \
+        --arg kernel_flavor "{{ kernel_flavor}}" \
+        --arg kernel_major_minor_patch "$kernel_major_minor_patch" \
+        --arg kernel_release "$linux" \
+        --arg kernel_name "$kernel_name" \
+        --arg KCWD "{{ KCWD }}" \
+        --arg KCPATH "{{ KCPATH }}" \
+        '{
+            "kernel_build_tag": $build_tag,
+            "kernel_flavor": $kernel_flavor,
+            "kernel_major_minor_patch": $kernel_major_minor_patch,
+            "kernel_release": $kernel_release,
+            "kernel_name": $kernel_name,
+            "KCWD": $KCWD,
+            "KCPATH": $KCPATH
+        }')
+    
+    echo $output
+    
+# Cache Version Json
+[group('Build')]
+@cache-kernel-version: && populate-github-output
+    [ ! -f {{ version_json }} ] && {{ just }} get-kernel-version > {{ version_json }} || :
+
+# Populate Github Output
+[private]
+@populate-github-output:
+    {{ if env('GITHUB_OUTPUT', '') != '' { 'jq -r "to_entries[] | \"\(.key)=\(.value)\"" < ' + version_json + ' | xargs -I "{}" echo "{}" >> ' + env('GITHUB_OUTPUT') } else { '' } }}
+
+# Fetch and Sign Kernel RPMs
+[group('Build')]
+fetch-kernel: (cache-kernel-version)
+    #!/usr/bin/bash
+    {{ if path_exists(version_json) != 'true' { error('Need to run just cache-kernel-version first for dry-run') } else { '' } }}
+    {{ if path_exists( KCPATH / shell("jq -r '.kernel_name + \"-\" + .kernel_release + \".rpm\"' < $1", version_json)) == 'true' { 'exit 0' } else { '' } }}
+    set "${CI:+-x}" -euo pipefail
+
+    # Pull Build Image
+    {{ podman }} pull --retry 3 "{{ builder }}" >&2
+
+    # Prep Environment
+    cp -a fetch-kernel.sh certs {{ KCWD }} >&2
+
+    # Fetch Kernels
+    builder=$(podman run \
+        --security-opt label=disable \
+        {{ if env('CI', '') != '' { '--env CI=1' } else { '' } }} \
+        --env DUAL_SIGN=true \
+        --env KERNEL_BUILD_TAG="{{ shell('jq -r .kernel_build_tag < $1', version_json) }}" \
+        --env KERNEL_FLAVOR="{{ kernel_flavor }}" \
+        --env KERNEL_NAME="{{ shell('jq -r .kernel_name < $1', version_json) }}" \
+        --env KERNEL_VERSION="{{ shell('jq -r .kernel_release < $1' , version_json) }}" \
+        --volume "{{ KCWD }}":/tmp/kernel-cache \
+        --entrypoint /bin/bash \
+        -dt "{{ builder }}")
+    trap '{{ podman }} rm -f -t 0 $builder &>/dev/null' EXIT SIGINT
+    podman exec $builder bash /tmp/kernel-cache/fetch-kernel.sh >&2
+    echo "{{ datetime_utc('%Y%m%d') }}" > "{{ KCPATH / 'kernel-cache-date' }}"
+    find "{{ KCPATH }}"
+
+# Build Akmod Image
+[group('Build')]
+build: (cache-kernel-version) (fetch-kernel)
+    #!/usr/bin/bash
+    set "${CI:+-x}" -euo pipefail
+    {{ if path_exists(version_json) != 'true' { error('Need to run just cache-kernel-version first for dry-run') } else { '' } }}
+    {{ if path_exists( KCPATH / shell("jq -r '.kernel_name + \"-\" + .kernel_release + \".rpm\"' < $1", version_json)) != 'true' { error('No Cached RPMs') } else { '' } }}
+    CPP_FLAGS=(
+        {{ if env('CI', '') != '' { "--cpp-flag=-DCI_SETX" } else { '' } }}
+        "--cpp-flag=-DBUILDER={{ builder }}"
+        "--cpp-flag=-DKERNEL_FLAVOR_ARG=KERNEL_FLAVOR={{ kernel_flavor }}"
+        "--cpp-flag=-DKERNEL_NAME_ARG=KERNEL_NAME={{ shell("jq -r '.kernel_name' < $1", version_json) }}"
+        "--cpp-flag=-DRPMFUSION_MIRROR_ARG=RPMFUSION_MIRROR={{ env('RPMFUSION_MIRROR', '') }}"
+        "--cpp-flag=-DVERSION_ARG=VERSION={{ version }}"
+        "--cpp-flag=-D{{ replace_regex(uppercase(akmods_target), '-.*', '') }}"
+        "--cpp-flag=-D{{ replace_regex(uppercase(kernel_flavor), '-.*', '') }}"
+    )
+    if [[ "{{ akmods_target }}" =~ nvidia ]]; then
+        CPP_FLAGS+=(
+            "--cpp-flag=-DKMOD_MODULE_ARG=KMOD_MODULE={{ if akmods_target =~ 'open' { "kernel-open" } else { 'kernel' } }}"
+        )
+    fi
+    LABELS=(
+        "--label" "io.artifacthub.package.deprecated=false"
+        "--label" "io.artifacthub.package.keywords=bootc,fedora,bluefin,bazzite,centos,cayo,aurora,ublue,universal-blue"
+        "--label" "io.artifacthub.package.logo-url=https://avatars.githubusercontent.com/u/120078124?s=200&v=4"
+        "--label" "io.artifacthub.package.maintainers=[{\"name\": \"castrojo\", \"email\": \"jorge.castro@gmail.com\"}]"
+        "--label" "io.artifacthub.package.readme-url=https://raw.githubusercontent.com/ublue-os/akmods/refs/heads/main/README.md"
+        "--label" "org.opencontainers.image.created={{ datetime_utc('%Y-%m-%dT%H:%M:%SZ') }}"
+        "--label" "org.opencontainers.image.description='{{ _description }}'"
+        "--label" "org.opencontainers.image.license=Apache-2.0"
+        "--label" "org.opencontainers.image.source=https://raw.githubusercontent.com/ublue-os/akmods/refs/heads/main/Containerfile.in"
+        "--label" "org.opencontainers.image.title={{ akmods_name }}"
+        "--label" "org.opencontainers.image.url=https://github.com/{{ _org / _repo }}"
+        "--label" "org.opencontainers.image.vendor='{{ _org }}'"
+        "--label" "org.opencontainers.image.version={{ shell("jq -r '.major_minor_patch' < $1", version_json) + '-' + trim(read(KCPATH / 'kernel-cache-date')) }}"
+        "--label" "ostree.linux={{ shell("jq -r '.kernel_release' < $1", version_json) }}"
+    )
+    TAGS=(
+        "--tag" "{{ akmods_name + ':' + kernel_flavor + '-' + version + '-' + arch() }}"
+        "--tag" "{{ akmods_name + ':' + kernel_flavor + '-' + version + '-' + shell("jq -r '.kernel_release' < $1", version_json) }}"
+    )
+
+    {{ podman }} build -f Containerfile.in --volume {{ KCPATH }}:/tmp/kernel_cache:ro "${CPP_FLAGS[@]}" "${LABELS[@]}" "${TAGS[@]}" --target RPMS {{ justfile_dir () }}
+
+# Test Cached Akmod RPMs
+[group('Build')]
+test: (cache-kernel-version) (fetch-kernel)
+    #!/usr/bin/bash
+    set "${CI:+-x}" -euo pipefail
+    {{ if path_exists(version_json) != 'true' { error('Need to run just cache-kernel-version first for dry-run') } else { '' } }}
+    {{ if path_exists( KCPATH / shell("jq -r '.kernel_name + \"-\" + .kernel_release + \".rpm\"' < $1", version_json)) != 'true' { error('No Cached RPMs') } else { '' } }}
+    CPP_FLAGS=(
+        {{ if env('CI', '') != '' { "--cpp-flag=-DCI_SETX" } else { '' } }}
+        "--cpp-flag=-DBUILDER={{ builder }}"
+        "--cpp-flag=-DKERNEL_FLAVOR_ARG=KERNEL_FLAVOR={{ kernel_flavor }}"
+        "--cpp-flag=-DKERNEL_NAME_ARG=KERNEL_NAME={{ shell("jq -r '.kernel_name' < $1", version_json) }}"
+        "--cpp-flag=-DRPMFUSION_MIRROR_ARG=RPMFUSION_MIRROR={{ env('RPMFUSION_MIRROR', '') }}"
+        "--cpp-flag=-DVERSION_ARG=VERSION={{ version }}"
+        "--cpp-flag=-D{{ replace_regex(uppercase(akmods_target), '-.*', '') }}"
+        "--cpp-flag=-D{{ replace_regex(uppercase(kernel_flavor), '-.*', '') }}"
+    )
+    if [[ "{{ akmods_target }}" =~ nvidia ]]; then
+        CPP_FLAGS+=(
+            "--cpp-flag=-DKMOD_MODULE_ARG=KMOD_MODULE={{ if akmods_target =~ 'open' { "kernel-open" } else { 'kernel' } }}"
+        )
+    fi
+
+    {{ podman }} build -f Containerfile.in --volume {{ KCPATH }}:/tmp/kernel_cache:ro "${CPP_FLAGS[@]}" --target test --tag akmods-test:latest {{ justfile_dir () }}
+    if ! podman run --rm akmods-test:latest; then
+        echo "Signatures Failed" >&2
+        exit 1
+    fi
+
+# Login to Registry
+[group('Registry')]
+@login:
+    {{ podman }} login {{ registry }} -u "$REGISTRY_ACTOR"  -p "$REGISTRY_TOKEN"
+
+# Push Images to Registry
+[group('Registry')]
+push:
+    #!/usr/bin/bash
+    {{ if env('COSIGN_PRIVATE_KEY', '') != '' { 'printf "%s" "$COSIGN_PRIVATE_KEY" > /tmp/cosign.key' } else { '' } }}
+    {{ if env('CI', '') != '' { logsum } else { '' } }}
+
+    set ${CI:+-x} -eou pipefail
+
+    declare -a TAGS=($({{ podman }} image list {{ 'localhost' / akmods_name + ':' + kernel_flavor + '-' + version + '-' + arch() }} --noheading --format 'table {{{{ .Tag }}'))
+    for tag in "${TAGS[@]}"; do
+        for i in {1..5}; do
+            {{ podman }} push {{ if env('COSIGN_PRIVATE_KEY', '') != '' { '--sign-by-sigstore=/etc/ublue-os-param-file.yaml' } else { '' } }} "{{ 'localhost' / akmods_name + ':' + kernel_flavor + '-' + version + '-' + arch() }}" "{{ transport + registry / _org / akmods_name }}:$tag" && break || sleep $((5 * i));
+            if [[ $i -eq '5' ]]; then
+                exit 1
+            fi
+        done
+        {{ if env('CI', '') != '' { 'log_sum "' + registry / _org / akmods_name + ':$tag"' } else { '' } }}
+    done
+    {{ if env('CI', '') != '' { 'log_sum "\`\`\`"' } else { '' } }}
+
+# Generate Manifest and Push to Registry
+[group('Registry')]
+manifest:
+    #!/usr/bin/bash
+    {{ if env('COSIGN_PRIVATE_KEY', '') != '' { 'printf "%s" "$COSIGN_PRIVATE_KEY" > /tmp/cosign.key' } else { '' } }}
+    {{ if env('CI', '') != '' { logsum } else { '' } }}
+
+    set ${CI:+-x} -eou pipefail
+
+    LABELS=(
+        "io.artifacthub.package.deprecated=false"
+        "io.artifacthub.package.keywords=bootc,fedora,bluefin,bazzite,centos,cayo,aurora,ublue,universal-blue"
+        "io.artifacthub.package.logo-url=https://avatars.githubusercontent.com/u/120078124?s=200&v=4"
+        "io.artifacthub.package.maintainers=[{\"name\": \"castrojo\", \"email\": \"jorge.castro@gmail.com\"}]"
+        "io.artifacthub.package.readme-url=https://raw.githubusercontent.com/ublue-os/akmods/refs/heads/main/README.md"
+        "org.opencontainers.image.created={{ datetime_utc('%Y-%m-%dT%H:%M:%SZ') }}"
+        "org.opencontainers.image.description={{ _description }}"
+        "org.opencontainers.image.license=Apache-2.0"
+        "org.opencontainers.image.source=https://raw.githubusercontent.com/ublue-os/akmods/refs/heads/main/Containerfile.in"
+        "org.opencontainers.image.title={{ akmods_name }}"
+        "org.opencontainers.image.url=https://github.com/{{ _org / _repo }}"
+        "org.opencontainers.image.vendor={{ _org }}"
+        "org.opencontainers.image.version={{ kernel_flavor + '-' + version + '-' + shell("jq -r '.kernel_major_minor_patch' < $1", version_json) }}"
+    )
+    # Create Manifest
+    MANIFEST=$({{ podman }} manifest create {{ 'ghcr.io' / _org / akmods_name + ':' + kernel_flavor + '-' + version }})
+
+    for label in "${LABELS[@]}"; do
+        echo "Applying label "${label}" to manifest"
+        podman manifest annotate --index --annotation "$label" "${MANIFEST}"
+    done
+
+    MANIFEST=$({{ podman }} manifest create {{ 'ghcr.io' / _org / akmods_name + ':' + kernel_flavor + '-' + version + '-' + shell("jq -r '.kernel_major_minor_patch' < $1", version_json) }})
+
+    for label in "${LABELS[@]}"; do
+        echo "Applying label "${label}" to manifest"
+        podman manifest annotate --index --annotation "$label" "${MANIFEST}"
+    done
+
+    # Add to Manifest
+    {{ podman }} manifest add {{ 'ghcr.io' / _org / akmods_name + ':' + kernel_flavor + '-' + version }} {{ 'docker://ghcr.io' / _org / akmods_name + ':' + kernel_flavor + '-' + version + '-x86_64' }}
+    # {{ podman }} manifest add {{ 'ghcr.io' / _org / akmods_name + ':' + kernel_flavor + '-' + version }} {{ 'docker://ghcr.io' / _org / akmods_name + ':' + kernel_flavor + '-' + version + '-aarch64' }}
+    {{ podman }} manifest add {{ 'ghcr.io' / _org / akmods_name + ':' + kernel_flavor + '-' + version + '-' + shell("jq -r '.kernel_major_minor_patch' < $1", version_json) }} {{ 'docker://ghcr.io' / _org / akmods_name + ':' + kernel_flavor + '-' + version + '-' + shell("jq -r '.kernel_release' < $1", version_json) }}
+    # {{ podman }} manifest add {{ 'ghcr.io' / _org / akmods_name + ':' + kernel_flavor + '-' + version + '-' + shell("jq -r '.kernel_major_minor_patch' < $1", version_json) }} {{ 'docker://ghcr.io' / _org / akmods_name + ':' + kernel_flavor + '-' + version + '-' + replace(shell("jq -r '.kernel_release' < $1", version_json), 'x86_64', 'aarch64') }}
+
+    # Push Manifest
+    for i in {1..5}; do
+        {{ podman }} manifest push --all {{ if env('COSIGN_PRIVATE_KEY', '') != '' { '--sign-by-sigstore=/etc/ublue-os-param-file.yaml' } else { '' } }} {{ 'ghcr.io' / _org / akmods_name + ':' + kernel_flavor + '-' + version }} && break || sleep $((5 * i));
+        if [[ $i -eq '5' ]]; then
+            exit 1
+        fi
+    done
+    {{ if env('CI', '') != '' { 'log_sum "' + registry / _org / akmods_name + ':' + kernel_flavor + '-' + version + '"' } else { '' } }}
+
+    for i in {1..5}; do
+        {{ podman }} manifest push --all {{ if env('COSIGN_PRIVATE_KEY', '') != '' { '--sign-by-sigstore=/etc/ublue-os-param-file.yaml' } else { '' } }} {{ 'ghcr.io' / _org / akmods_name + ':' + kernel_flavor + '-' + version + '-' + shell("jq -r '.kernel_major_minor_patch' < $1", version_json) }} && break || sleep $((5 * i));
+        if [[ $i -eq '5' ]]; then
+            exit 1
+        fi
+    done
+    {{ if env('CI', '') != '' { 'log_sum "' + registry / _org / akmods_name + ':' + kernel_flavor + '-' + version + '-' + shell("jq -r '.kernel_major_minor_patch' < $1", version_json) + '"' } else { '' } }}
+
+    {{ if env('CI', '') != '' { 'log_sum "\`\`\`"' } else { '' } }}
+
+# Generate GHA Workflows
+[group('Utility')]
+generate-workflows:
+    #!/usr/bin/bash
+    set -euo pipefail
+
+    main() {
+        if [[ ! -d .github || ! -d .git ]]; then 
+            echo "This script must be run at the root of the repo" >&2
+            exit 1
+        fi
+
+        rm -f "./.github/workflows/build"*".yml"
+
+        declare -A images=()
+        declare -A workflows=()
+        versions=($(yq '.images | keys | .[]' images.yaml | sort | uniq))
+        flavors=($(yq '.images.* | keys | .[]' images.yaml | sort | uniq))
+        targets=($(yq 'explode(.) | .images.*.* | keys | .[]' images.yaml | sort | uniq))
+        
+        for i in "${versions[@]}"; do
+            for j in "${flavors[@]}"; do
+                for k in "${targets[@]}"; do
+                    #shellcheck disable=SC1087
+                    if [[ "$(yq ".images.$i[\"$j\"].$k" images.yaml)" != "null" ]]; then
+                        images+=(["$i-$j-$k"]="$i,$j,$k")
+                        workflows+=(["$i-$j"]="$i,$j")
+                    fi
+                done
+            done
+        done
+        for i in "${flavors[@]}"; do
+        {
+        cat <<'EOF'
+    ---
+    #
+    # WARNING THIS IS A GENERATED WORKFLOW. DO NOT EDIT BY HAND!
+    #
+    # Generate the workflow by running `just generate-workflows` at git root
+    # Modify the inputs in workflow-templates
+    EOF
+            sed "s/AKMODs/${i^^} akmods/;s/05/$(printf '%02d' $(( RANDOM % 30)))/g" ./workflow-templates/workflow.yaml.in
+            if [[ "$i" =~ bazzite ]]; then
+            cat <<'EOF'
+        inputs:
+          bazzite_tag:
+            description: "The release tag for the bazzite kernel"
+            required: false
+            type: string
+    EOF
+            fi
+            echo "jobs:"
+            for j in "${!workflows[@]}"; do
+                if [[ ! "$j" =~ $i ]]; then
+                    continue
+                fi
+                version=$(echo "${workflows[$j]}" | cut -d "," -f 1)
+                kernel_flavor=$(echo "${workflows[$j]}" | cut -d "," -f 2)
+                kernel_flavor_clean=$(echo $kernel_flavor | tr '.' '-')
+                sed -e "s/%%KERNEL_FLAVOR%%/$kernel_flavor/;s/%%KERNEL_FLAVOR_CLEAN%%/$kernel_flavor_clean/;s/%%VERSION%%/$version/" ./workflow-templates/cache_kernel.yaml.in
+                if [[ "$i" =~ bazzite ]]; then
+                    printf '      %s\n' 'bazzite_tag: ${{{{ inputs.bazzite_tag }}'
+                fi
+                for k in common extra nvidia nvidia-open zfs; do
+                    value="${images[$j-$k]:-}"
+                    if [ -z "$value" ]; then
+                        continue
+                    fi
+                    akmods_target="$(echo "$value" | cut -d "," -f 3)"
+                    sed "s/%%VERSION%%/$version/;s/%%KERNEL_FLAVOR%%/$kernel_flavor/;s/%%AKMODS_TARGET%%/$akmods_target/;s/%%KERNEL_FLAVOR_CLEAN%%/$kernel_flavor_clean/" "./workflow-templates/job.yaml.in"
+                done
+            done
+            } > "./.github/workflows/build-akmods-$i.yml"
+        done
+    }
+
+    main
--- a/README.md
+++ b/README.md
@ -1,12 +1,12 @@
 # ublue-os akmods

-[![build-bazzite](https://github.com/ublue-os/akmods/actions/workflows/build-bazzite.yml/badge.svg)](https://github.com/ublue-os/akmods/actions/workflows/build-bazzite.yml) [![build-41](https://github.com/ublue-os/akmods/actions/workflows/build-41.yml/badge.svg)](https://github.com/ublue-os/akmods/actions/workflows/build-41.yml) [![build-42](https://github.com/ublue-os/akmods/actions/workflows/build-42.yml/badge.svg)](https://github.com/ublue-os/akmods/actions/workflows/build-42.yml)
+[![Build BAZZITE akmods](https://github.com/ublue-os/akmods/actions/workflows/build-akmods-bazzite.yml/badge.svg)](https://github.com/ublue-os/akmods/actions/workflows/build-akmods-bazzite.yml)[![Build CENTOS akmods](https://github.com/ublue-os/akmods/actions/workflows/build-akmods-centos.yml/badge.svg)](https://github.com/ublue-os/akmods/actions/workflows/build-akmods-centos.yml)[![Build COREOS-STABLE akmods](https://github.com/ublue-os/akmods/actions/workflows/build-akmods-coreos-stable.yml/badge.svg)](https://github.com/ublue-os/akmods/actions/workflows/build-akmods-coreos-stable.yml)[![Build COREOS-TESTING akmods](https://github.com/ublue-os/akmods/actions/workflows/build-akmods-coreos-testing.yml/badge.svg)](https://github.com/ublue-os/akmods/actions/workflows/build-akmods-coreos-testing.yml)[![Build LONGTERM-6.12 akmods](https://github.com/ublue-os/akmods/actions/workflows/build-akmods-longterm-6.12.yml/badge.svg)](https://github.com/ublue-os/akmods/actions/workflows/build-akmods-longterm-6.12.yml)[![Build MAIN akmods](https://github.com/ublue-os/akmods/actions/workflows/build-akmods-main.yml/badge.svg)](https://github.com/ublue-os/akmods/actions/workflows/build-akmods-main.yml)

 OCI images providing a set of cached kernel RPMs and extra kernel modules to Universal Blue images. Used for better hardware support and consistent build process.

 ## How it's organized

-The [`akmods` image](https://github.com/orgs/ublue-os/packages/container/package/akmods) is built and published daily. However, there's not a single image but several, given various kernels we now support.
+The [`akmods` images](https://github.com/orgs/ublue-os/packages?repo_name=akmods) are built and published daily. However, there's not a single image but several, given various kernels we now support.

 The akmods packages are divided up for building in a few different "groups":

@ -21,37 +21,13 @@ Each of these images contains a cached copy of the respective kernel RPMs compat
 Builds also run for different kernels:

 - `bazzite` - Bazzite [builds a kernel with gaming specific patches](https://github.com/bazzite-org/kernel-bazzite) for the current release of Fedora
- `ublue 41` - Fedora 41 kernel builds:
-  - `main` - current default kernel version
-  - `coreos-stable` - current Fedora CoreOS stable kernel version
-  - `coreos-testing` - current Fedora CoreOS testing kernel version
- `ublue 42` - Fedora 42 kernel builds:
-  - `main` - current default kernel version
-  - `coreos-stable` - current Fedora CoreOS stable kernel version
-  - `coreos-testing` - current Fedora CoreOS testing kernel version
+- `main` - Mainline Fedora Kernel
+- `coreos-stable` - Current Fedora CoreOS stable kernel version
+- `coreos-testing` - Current Fedora CoreOS testing kernel version
+- `Centos` - Mainline Centos Kernel
+- `Longterm-6.12` - Fedora Kernel on Kernel 6.12 LTS

-This table shows what groups build for which kernel and Fedora release:
-
-| Build | Kernel | akmods group |
-|-------|--------|--------------|
-| bazzite | bazzite | common |
-| bazzite | bazzite | extra |
-| bazzite | bazzite | nvidia |
-| bazzite | bazzite | nvidia-open |
-| 41 | main | common |
-| 41 | main | nvidia |
-| 41 | main | nvidia-open |
-| 41 | coreos-stable | common |
-| 41 | coreos-stable | nvidia |
-| 41 | coreos-stable | nvidia-open |
-| 41 | coreos-stable | zfs |
-| 42 | main | common |
-| 42 | main | nvidia |
-| 42 | main | nvidia-open |
-| 42 | coreos-stable | common |
-| 42 | coreos-stable | nvidia |
-| 42 | coreos-stable | nvidia-open |
-| 42 | coreos-stable | zfs |
+See `images.yaml` for which akmods packages are built for each Kernel

 ## Features

@ -66,7 +42,7 @@ The `nvidia` and `nvidia-open` images contains

 - `ublue-os-nvidia-addons` - installs extra repos enabling our nvidia support
  - [nvidia container selinux policy](https://github.com/NVIDIA/dgx-selinux/tree/master/src/nvidia-container-selinux) - uses RHEL9 policy as the closest match
-  - [nvidia-container-tookkit repo](https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/latest/install-guide.html#installing-with-yum-or-dnf) - version 1.14 (and newer) provide CDI for podman use of nvidia gpus
+  - [nvidia-container-toolkit repo](https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/latest/install-guide.html#installing-with-yum-or-dnf) - version 1.14 (and newer) provide CDI for podman use of nvidia gpus
 - `ublue-os-ucore-nvidia` - a slightly lighter `ublue-os-nvidia-addons` for CoreOS/uCore systems

 ### Kmod Packages
@ -92,7 +68,7 @@ The `nvidia` and `nvidia-open` images contains
 | extra | [zenergy](https://github.com/BoukeHaarsma23/zenergy) | Based on AMD_ENERGY driver, but with some jiffies added so non-root users can read it safely | [![badge](https://copr.fedorainfracloud.org/coprs/ublue-os/akmods/package/zenergy-kmod/status_image/last_build.png)](https://copr.fedorainfracloud.org/coprs/ublue-os/akmods/package/zenergy-kmod) |
 | nvidia | [nvidia](https://negativo17.org/nvidia-driver/) | nvidia GPU drivers | [negativo17 - fedora-nvidia](https://negativo17.org/) |
 | nvidia-open | [nvidia](https://negativo17.org/nvidia-driver/) | nvidia-open GPU drivers | [negativo17 - fedora-nvidia](https://negativo17.org/) |
-| zfs | [zfs](https://github.com/openzfs/zfs) | OpenZFS advanced file system and volume manager (From  Ucore, CoreOS Only) |
+| zfs | [zfs](https://github.com/openzfs/zfs) | OpenZFS advanced file system and volume manager | [zfs](https://github.com/openzfs/zfs) |

 ## Notes

@ -115,7 +91,6 @@ We build both the open and closed drivers from NVIDIA. The open driver is the on
 - NVIDIA Pascal: Quadro: P2000, P4000, P5000, P6000, GP100; Tesla: P100, P40, P4
 - NVIDIA Maxwell: Quadro: K2200, M2000, M4000, M5000, M6000, M6000 24GB; - - Tesla: M60, M40, M6, M4

-
 ## Usage

 To install one of these kmods, you'll need to install any of their specific dependencies (checkout the `build-prep.sh` and the specific `build-FOO.sh` script for details), and ensure you are on a compatible kernel.
@ -137,14 +112,69 @@ For NVIDIA images, add something like this to your Containerfile, replacing `TAG
    ## optionally install remove old and install new kernel
    # dnf -y remove --no-autoremove kernel kernel-core kernel-modules kernel-modules-core kernel-modules-extra
    ## install ublue support package and desired kmod(s)
-    RUN rpm-ostree install /tmp/rpms/ublue-os/ublue-os-nvidia*.rpm
-    RUN rpm-ostree install /tmp/rpms/kmods/kmod-nvidia*.rpm
+    RUN dnf install /tmp/rpms/ublue-os/ublue-os-nvidia*.rpm
+    RUN dnf install /tmp/rpms/kmods/kmod-nvidia*.rpm
+  
+*Note* There is an nvidia-install script that most universal-blue images use located with the *main* repo that works for desktop Fedora installs.

 ## Verification

-These images are signed with sisgstore's [cosign](https://docs.sigstore.dev/about/overview/). You can verify the signature by downloading the `cosign.pub` key from this repo and running the following command, replacing `RELEASE` with either `40`, `41` or `42`:
+These images are signed with sisgstore's [cosign](https://docs.sigstore.dev/about/overview/). You can verify the signature by downloading the `cosign.pub` key from this repo and running the following command, replacing `KERNEL_FLAVOR` with whichever kernel you are using and `RELEASE` with either `40`, `41` or `42`:

-    cosign verify --key cosign.pub ghcr.io/ublue-os/akmods:RELEASE
+    cosign verify --key cosign.pub ghcr.io/ublue-os/akmods:KERNEL_FLAVOR-RELEASE
+
+## Local Building/Testing
+
+You can build these akmods locally with our test keys using the included `Justfile`. We strongly recommend using the provided devcontainer which contains all dependencies for building this project.
+
+### How to Use the Justfile
+
+To build an akmods package, run the following:
+
+```bash
+just build
+```
+Since nothing additional was set. The following will occur. The build scripts will determine the current fedora kernel version, download the RPMs, and sign the kernel with the test key. It will then build the common set of akmods. To modify what gets built, modify the following environment variables:
+
+- AKMODS_KERNEL - The kernel flavor you are building
+- AKMODS_VERSION - The release version
+- AKMODS_TARGET - The akmods package to build
+
+```bash
+AKMODS_KERNEL=centos AKMODS_VERSION=10 AKMODS_TARGET=zfs just build
+```
+
+Will determine the current centos kernel version, download the rpms and sign them, and will then build the zfs package.
+
+You can also populate a `.env` file to store your current settings.
+
+You can see your current settings with `just --evaluate`
+
+Additionally you can pass values as key/value pairs.
+
+```bash
+just kernel_flavor=bazzite version=42 akmods_target=extra build
+```
+
+Which will build the extra package for Bazzite.
+
+Note, the `Justfile` will compare your inputs to the `images.yaml` file to ensure you have a valid combination.
+
+### How to Use images.yaml
+
+All build targets are defined in the `images.yaml` file. This is where the top level targets are defined. You can view the targets using:
+
+```bash
+yq 'explode(.).images' images.yaml
+```
+
+### Adding Kernels and KMODs
+
+Generally speaking, Kernels are only added if they will be used internally to Universal Blue.
+
+KMODs as well will likely only be included if there is a need/desire to include them within the Universal Blue Project. Generally, KMODs for hardware enablement will be considered for inclusion or ones that fix/resolve a known feature gap.
+
+Don't hesitate to file an issue asking about inclusion.

 ## Metrics

--- a/build_files/common/build-kmod-framework-laptop.sh
+++ b/build_files/common/build-kmod-framework-laptop.sh
@ -1,6 +1,6 @@
-#!/bin/sh
+#!/usr/bin/bash

-set -oeux pipefail
+set "${CI:+-x}" -euo pipefail

 ARCH="$(rpm -E '%_arch')"
 KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')"
@ -10,9 +10,9 @@ cp /tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/_copr_ublue-os-akmods.repo /etc/

 ### BUILD framework-laptop (succeed or fail-fast with debug output)
 dnf install -y \
-    akmod-framework-laptop-*.fc${RELEASE}.${ARCH}
+    akmod-framework-laptop-*.fc"${RELEASE}"."${ARCH}"
 akmods --force --kernels "${KERNEL}" --kmod framework-laptop
-modinfo /usr/lib/modules/${KERNEL}/extra/framework-laptop/framework_laptop.ko.xz > /dev/null \
+modinfo /usr/lib/modules/"${KERNEL}"/extra/framework-laptop/framework_laptop.ko.xz > /dev/null \
 || (find /var/cache/akmods/framework-laptop/ -name \*.log -print -exec cat {} \; && exit 1)

 rm -f /etc/yum.repos.d/_copr_ublue-os-akmods.repo
--- a/build_files/common/build-kmod-kvmfr.sh
+++ b/build_files/common/build-kmod-kvmfr.sh
@ -1,6 +1,6 @@
-#!/bin/sh
+#!/usr/bin/bash

-set -oeux pipefail
+set "${CI:+-x}" -euo pipefail

 ARCH="$(rpm -E '%_arch')"
 KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')"
--- a/build_files/common/build-kmod-openrazer.sh
+++ b/build_files/common/build-kmod-openrazer.sh
@ -1,6 +1,6 @@
-#!/bin/sh
+#!/usr/bin/bash

-set -oeux pipefail
+set "${CI:+-x}" -euo pipefail

 ARCH="$(rpm -E '%_arch')"
 KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')"
@ -10,15 +10,15 @@ cp /tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/_copr_ublue-os-akmods.repo /etc/

 ### BUILD openrazer (succeed or fail-fast with debug output)
 dnf install -y \
-    akmod-openrazer-*.fc${RELEASE}.${ARCH}
+    akmod-openrazer-*.fc"${RELEASE}"."${ARCH}"
 akmods --force --kernels "${KERNEL}" --kmod openrazer
-modinfo /usr/lib/modules/${KERNEL}/extra/openrazer/razerkbd.ko.xz >/dev/null ||
+modinfo /usr/lib/modules/"${KERNEL}"/extra/openrazer/razerkbd.ko.xz >/dev/null ||
    (find /var/cache/akmods/openrazer/ -name \*.log -print -exec cat {} \; && exit 1)
-modinfo /usr/lib/modules/${KERNEL}/extra/openrazer/razermouse.ko.xz >/dev/null ||
+modinfo /usr/lib/modules/"${KERNEL}"/extra/openrazer/razermouse.ko.xz >/dev/null ||
    (find /var/cache/akmods/openrazer/ -name \*.log -print -exec cat {} \; && exit 1)
-modinfo /usr/lib/modules/${KERNEL}/extra/openrazer/razerkraken.ko.xz >/dev/null ||
+modinfo /usr/lib/modules/"${KERNEL}"/extra/openrazer/razerkraken.ko.xz >/dev/null ||
    (find /var/cache/akmods/openrazer/ -name \*.log -print -exec cat {} \; && exit 1)
-modinfo /usr/lib/modules/${KERNEL}/extra/openrazer/razeraccessory.ko.xz >/dev/null ||
+modinfo /usr/lib/modules/"${KERNEL}"/extra/openrazer/razeraccessory.ko.xz >/dev/null ||
    (find /var/cache/akmods/openrazer/ -name \*.log -print -exec cat {} \; && exit 1)

 rm -f /etc/yum.repos.d/_copr_ublue-os-akmods.repo
--- a/build_files/common/build-kmod-v4l2loopback.sh
+++ b/build_files/common/build-kmod-v4l2loopback.sh
@ -1,6 +1,6 @@
-#!/bin/sh
+#!/usr/bin/bash

-set -oeux pipefail
+set "${CI:+-x}" -euo pipefail


 ARCH="$(rpm -E '%_arch')"
@ -9,7 +9,7 @@ RELEASE="$(rpm -E '%fedora')"

 ### BUILD v4l2loopbak (succeed or fail-fast with debug output)
 dnf install -y \
-    akmod-v4l2loopback-*.fc${RELEASE}.${ARCH}
+    akmod-v4l2loopback-*.fc"${RELEASE}"."${ARCH}"
 akmods --force --kernels "${KERNEL}" --kmod v4l2loopback
-modinfo /usr/lib/modules/${KERNEL}/extra/v4l2loopback/v4l2loopback.ko.xz > /dev/null \
+modinfo /usr/lib/modules/"${KERNEL}"/extra/v4l2loopback/v4l2loopback.ko.xz > /dev/null \
 || (find /var/cache/akmods/v4l2loopback/ -name \*.log -print -exec cat {} \; && exit 1)
--- a/build_files/common/build-kmod-wl.sh
+++ b/build_files/common/build-kmod-wl.sh
@ -1,6 +1,6 @@
-#!/bin/sh
+#!/usr/bin/bash

-set -oeux pipefail
+set "${CI:+-x}" -euo pipefail


 ARCH="$(rpm -E '%_arch')"
@ -10,7 +10,7 @@ RELEASE="$(rpm -E '%fedora')"

 ### BUILD wl (succeed or fail-fast with debug output)
 dnf install -y \
-    akmod-wl-*.fc${RELEASE}.${ARCH}
+    akmod-wl-*.fc"${RELEASE}"."${ARCH}"
 akmods --force --kernels "${KERNEL}" --kmod wl
-modinfo /usr/lib/modules/${KERNEL}/extra/wl/wl.ko.xz > /dev/null \
+modinfo /usr/lib/modules/"${KERNEL}"/extra/wl/wl.ko.xz > /dev/null \
 || (find /var/cache/akmods/wl/ -name \*.log -print -exec cat {} \; && exit 1)
--- a/build_files/common/build-kmod-xone.sh
+++ b/build_files/common/build-kmod-xone.sh
@ -1,6 +1,6 @@
-#!/bin/sh
+#!/usr/bin/bash

-set -oeux pipefail
+set "${CI:+-x}" -euo pipefail

 ARCH="$(rpm -E '%_arch')"
 KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')"
@ -10,9 +10,9 @@ cp /tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/_copr_ublue-os-akmods.repo /etc/

 ### BUILD xone (succeed or fail-fast with debug output)
 dnf install -y \
-    akmod-xone-*.fc${RELEASE}.${ARCH}
+    akmod-xone-*.fc"${RELEASE}"."${ARCH}"
 akmods --force --kernels "${KERNEL}" --kmod xone
-modinfo /usr/lib/modules/${KERNEL}/extra/xone/xone-{dongle,gip,gip-gamepad,gip-headset,gip-chatpad,gip-madcatz-strat,gip-madcatz-glam,gip-pdp-jaguar}.ko.xz > /dev/null \
+modinfo /usr/lib/modules/"${KERNEL}"/extra/xone/xone-{dongle,gip,gip-gamepad,gip-headset,gip-chatpad,gip-madcatz-strat,gip-madcatz-glam,gip-pdp-jaguar}.ko.xz > /dev/null \
 || (find /var/cache/akmods/xone/ -name \*.log -print -exec cat {} \; && exit 1)

 rm -f /etc/yum.repos.d/_copr_ublue-os-akmods.repo
--- a/build_files/common/build-ublue-os-akmods-addons.sh
+++ b/build_files/common/build-ublue-os-akmods-addons.sh
@ -1,6 +1,6 @@
-#!/bin/sh
+#!/usr/bin/bash

-set -oeux pipefail
+set "${CI:+-x}" -euo pipefail


 ### BUILD UBLUE AKMODS-ADDONS RPM
--- a/build_files/common/build-ublue-os-ucore-addons.sh
+++ b/build_files/common/build-ublue-os-ucore-addons.sh
@ -1,10 +1,10 @@
-#!/bin/sh
+#!/usr/bin/bash

-set -oeux pipefail
+set "${CI:+-x}" -euo pipefail

 ### BUILD UCORE-ADDONS RPM
 install -D /etc/pki/akmods/certs/public_key.der /tmp/ublue-os-ucore-addons/rpmbuild/SOURCES/public_key.der
 rpmbuild -ba \
    --define '_topdir /tmp/ublue-os-ucore-addons/rpmbuild' \
    --define '%_tmppath %{_topdir}/tmp' \
-    /tmp/ublue-os-ucore-addons/ublue-os-ucore-addons.spec
+    /tmp/ublue-os-ucore-addons/ublue-os-ucore-addons.spec
--- a/build_files/extra/build-kmod-VirtualBox.sh
+++ b/build_files/extra/build-kmod-VirtualBox.sh
@ -1,6 +1,6 @@
-#!/bin/sh
+#!/usr/bin/bash

-set -oeux pipefail
+set "${CI:+-x}" -euo pipefail

 ARCH="$(rpm -E '%_arch')"
 KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')"
@ -9,7 +9,7 @@ RELEASE="$(rpm -E '%fedora')"

 ### BUILD VirtualBox (succeed or fail-fast with debug output)
 dnf install -y \
-    akmod-VirtualBox-*.fc${RELEASE}.${ARCH}
+    akmod-VirtualBox-*.fc"${RELEASE}"."${ARCH}"
 akmods --force --kernels "${KERNEL}" --kmod VirtualBox
-modinfo /usr/lib/modules/${KERNEL}/extra/VirtualBox/{vboxdrv,vboxnetadp,vboxnetflt}.ko.xz > /dev/null \
+modinfo /usr/lib/modules/"${KERNEL}"/extra/VirtualBox/{vboxdrv,vboxnetadp,vboxnetflt}.ko.xz > /dev/null \
 || (find /var/cache/akmods/VirtualBox/ -name \*.log -print -exec cat {} \; && exit 1)
--- a/build_files/extra/build-kmod-ayaneo-platform.sh
+++ b/build_files/extra/build-kmod-ayaneo-platform.sh
@ -1,6 +1,6 @@
-#!/bin/sh
+#!/usr/bin/bash

-set -oeux pipefail
+set "${CI:+-x}" -euo pipefail

 ARCH="$(rpm -E '%_arch')"
 KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')"
@ -9,9 +9,9 @@ RELEASE="$(rpm -E '%fedora')"
 cp /tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/_copr_ublue-os-akmods.repo /etc/yum.repos.d/

 dnf install -y \
-    akmod-ayaneo-platform-*.fc${RELEASE}.${ARCH}
+    akmod-ayaneo-platform-*.fc"${RELEASE}"."${ARCH}"
 akmods --force --kernels "${KERNEL}" --kmod ayaneo-platform
-modinfo /usr/lib/modules/${KERNEL}/extra/ayaneo-platform/ayaneo-platform.ko.xz > /dev/null \
+modinfo /usr/lib/modules/"${KERNEL}"/extra/ayaneo-platform/ayaneo-platform.ko.xz > /dev/null \
 || (find /var/cache/akmods/ayaneo-platform/ -name \*.log -print -exec cat {} \; && exit 1)

 rm -f /etc/yum.repos.d/_copr_ublue-os-akmods.repo
--- a/build_files/extra/build-kmod-ayn-platform.sh
+++ b/build_files/extra/build-kmod-ayn-platform.sh
@ -1,6 +1,6 @@
-#!/bin/sh
+#!/usr/bin/bash

-set -oeux pipefail
+set "${CI:+-x}" -euo pipefail

 ARCH="$(rpm -E '%_arch')"
 KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')"
@ -9,9 +9,9 @@ RELEASE="$(rpm -E '%fedora')"
 cp /tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/_copr_ublue-os-akmods.repo /etc/yum.repos.d/

 dnf install -y \
-    akmod-ayn-platform-*.fc${RELEASE}.${ARCH}
+    akmod-ayn-platform-*.fc"${RELEASE}"."${ARCH}"
 akmods --force --kernels "${KERNEL}" --kmod ayn-platform
-modinfo /usr/lib/modules/${KERNEL}/extra/ayn-platform/ayn-platform.ko.xz > /dev/null \
+modinfo /usr/lib/modules/"${KERNEL}"/extra/ayn-platform/ayn-platform.ko.xz > /dev/null \
 || (find /var/cache/akmods/ayn-platform/ -name \*.log -print -exec cat {} \; && exit 1)

 rm -f /etc/yum.repos.d/_copr_ublue-os-akmods.repo
--- a/build_files/extra/build-kmod-bmi260.sh
+++ b/build_files/extra/build-kmod-bmi260.sh
@ -1,6 +1,6 @@
-#!/bin/sh
+#!/usr/bin/bash

-set -oeux pipefail
+set "${CI:+-x}" -euo pipefail

 ARCH="$(rpm -E '%_arch')"
 KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')"
@ -9,9 +9,9 @@ RELEASE="$(rpm -E '%fedora')"
 cp /tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/_copr_ublue-os-akmods.repo /etc/yum.repos.d/

 dnf install -y \
-    akmod-bmi260-*.fc${RELEASE}.${ARCH}
+    akmod-bmi260-*.fc"${RELEASE}"."${ARCH}"
 akmods --force --kernels "${KERNEL}" --kmod bmi260
-modinfo /usr/lib/modules/${KERNEL}/extra/bmi260/bmi260_{core,i2c}.ko.xz > /dev/null \
+modinfo /usr/lib/modules/"${KERNEL}"/extra/bmi260/bmi260_{core,i2c}.ko.xz > /dev/null \
 || (find /var/cache/akmods/bmi260/ -name \*.log -print -exec cat {} \; && exit 1)

 rm -f /etc/yum.repos.d/_copr_ublue-os-akmods.repo
--- a/build_files/extra/build-kmod-evdi.sh
+++ b/build_files/extra/build-kmod-evdi.sh
@ -1,6 +1,6 @@
 #!/bin/bash

-set -eoux pipefail
+set "${CI:+-x}" -euo pipefail

 ARCH="$(rpm -E '%_arch')"
 KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')"
--- a/build_files/extra/build-kmod-facetimehd.sh
+++ b/build_files/extra/build-kmod-facetimehd.sh
@ -1,12 +1,12 @@
-#!/bin/sh
+#!/usr/bin/bash

-set -oeux pipefail
+set "${CI:+-x}" -euo pipefail

 ARCH="$(rpm -E '%_arch')"
 KERNEL="$(rpm -q "${KERNEL_NAME:-kernel}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')"
 RELEASE="$(rpm -E '%fedora')"

-if [[ "${RELEASE}" -ge 41 ]]; then
+if [[ "${RELEASE}" -ge 43 ]]; then
    COPR_RELEASE="rawhide"
 else
    COPR_RELEASE="${RELEASE}"
@ -17,7 +17,7 @@ curl -LsSf -o /etc/yum.repos.d/_copr_mulderje-facetimehd-kmod.repo \

 ### BUILD facetimehd (succeed or fail-fast with debug output)
 dnf install -y \
-    akmod-facetimehd-*.fc${RELEASE}.${ARCH}
+    akmod-facetimehd-*.fc"${RELEASE}"."${ARCH}"
 akmods --force --kernels "${KERNEL}" --kmod facetimehd
 modinfo "/usr/lib/modules/${KERNEL}/extra/facetimehd/facetimehd.ko.xz" > /dev/null \
 || (find /var/cache/akmods/facetimehd/ -name \*.log -print -exec cat {} \; && exit 1)
--- a/build_files/extra/build-kmod-gcadapter_oc.sh
+++ b/build_files/extra/build-kmod-gcadapter_oc.sh
@ -1,6 +1,6 @@
-#!/bin/sh
+#!/usr/bin/bash

-set -oeux pipefail
+set "${CI:+-x}" -euo pipefail

 ARCH="$(rpm -E '%_arch')"
 KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')"
@ -9,9 +9,9 @@ RELEASE="$(rpm -E '%fedora')"
 cp /tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/_copr_ublue-os-akmods.repo /etc/yum.repos.d/

 dnf install -y \
-    akmod-gcadapter_oc-*.fc${RELEASE}.${ARCH}
+    akmod-gcadapter_oc-*.fc"${RELEASE}"."${ARCH}"
 akmods --force --kernels "${KERNEL}" --kmod gcadapter_oc
-modinfo /usr/lib/modules/${KERNEL}/extra/gcadapter_oc/gcadapter_oc.ko.xz > /dev/null \
+modinfo /usr/lib/modules/"${KERNEL}"/extra/gcadapter_oc/gcadapter_oc.ko.xz > /dev/null \
 || (find /var/cache/akmods/gcadapter_oc/ -name \*.log -print -exec cat {} \; && exit 1)

 rm -f /etc/yum.repos.d/_copr_ublue-os-akmods.repo
--- a/build_files/extra/build-kmod-gpd-fan.sh
+++ b/build_files/extra/build-kmod-gpd-fan.sh
@ -1,6 +1,6 @@
-#!/bin/sh
+#!/usr/bin/bash

-set -oeux pipefail
+set "${CI:+-x}" -euo pipefail

 ARCH="$(rpm -E '%_arch')"
 KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')"
@ -10,9 +10,9 @@ cp /tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/_copr_ublue-os-akmods.repo /etc/

 ### BUILD gpd-fan (succeed or fail-fast with debug output)
 dnf install -y \
-    akmod-gpd-fan-*.fc${RELEASE}.${ARCH}
+    akmod-gpd-fan-*.fc"${RELEASE}"."${ARCH}"
 akmods --force --kernels "${KERNEL}" --kmod gpd-fan
-modinfo /usr/lib/modules/${KERNEL}/extra/gpd-fan/gpd-fan.ko.xz > /dev/null \
+modinfo /usr/lib/modules/"${KERNEL}"/extra/gpd-fan/gpd-fan.ko.xz > /dev/null \
 || (find /var/cache/akmods/gpd-fan/ -name \*.log -print -exec cat {} \; && exit 1)

 rm -f /etc/yum.repos.d/_copr_ublue-os-akmods.repo
--- a/build_files/extra/build-kmod-nct6687d.sh
+++ b/build_files/extra/build-kmod-nct6687d.sh
@ -1,6 +1,6 @@
-#!/bin/sh
+#!/usr/bin/bash

-set -oeux pipefail
+set "${CI:+-x}" -euo pipefail

 ARCH="$(rpm -E '%_arch')"
 KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')"
@ -10,9 +10,9 @@ cp /tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/_copr_ublue-os-akmods.repo /etc/

 ### BUILD nct6687d (succeed or fail-fast with debug output)
 dnf install -y \
-    akmod-nct6687d-*.fc${RELEASE}.${ARCH}
+    akmod-nct6687d-*.fc"${RELEASE}"."${ARCH}"
 akmods --force --kernels "${KERNEL}" --kmod nct6687d
-modinfo /usr/lib/modules/${KERNEL}/extra/nct6687d/nct6687.ko.xz > /dev/null \
+modinfo /usr/lib/modules/"${KERNEL}"/extra/nct6687d/nct6687.ko.xz > /dev/null \
 || (find /var/cache/akmods/nct6687d/ -name \*.log -print -exec cat {} \; && exit 1)

 rm -f /etc/yum.repos.d/_copr_ublue-os-akmods.repo
--- a/build_files/extra/build-kmod-rtl8814au.sh
+++ b/build_files/extra/build-kmod-rtl8814au.sh
@ -1,22 +1,17 @@
-#!/bin/sh
+#!/usr/bin/bash

-set -oeux pipefail
+set "${CI:+-x}" -euo pipefail

 ARCH="$(rpm -E '%_arch')"
 KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')"
 RELEASE="$(rpm -E '%fedora')"

-if [[ "${KERNEL}" =~ "6.8" ]]; then
-  echo "SKIPPED BUILD of rtl8814au: compile failure on kernel 6.8 as of 2024-03-17"
-  exit 0
-fi
-
 cp /tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/_copr_ublue-os-akmods.repo /etc/yum.repos.d/

 dnf install -y \
-    akmod-rtl8814au-*.fc${RELEASE}.${ARCH}
+    akmod-rtl8814au-*.fc"${RELEASE}"."${ARCH}"
 akmods --force --kernels "${KERNEL}" --kmod rtl8814au
-modinfo /usr/lib/modules/${KERNEL}/extra/rtl8814au/rtl8814au.ko.xz > /dev/null \
+modinfo /usr/lib/modules/"${KERNEL}"/extra/rtl8814au/rtl8814au.ko.xz > /dev/null \
 || (find /var/cache/akmods/rtl8814au/ -name \*.log -print -exec cat {} \; && exit 1)

 rm -f /etc/yum.repos.d/_copr_ublue-os-akmods.repo
--- a/build_files/extra/build-kmod-rtl88xxau.sh
+++ b/build_files/extra/build-kmod-rtl88xxau.sh
@ -1,22 +1,17 @@
-#!/bin/sh
+#!/usr/bin/bash

-set -oeux pipefail
+set "${CI:+-x}" -euo pipefail

 ARCH="$(rpm -E '%_arch')"
 KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')"
 RELEASE="$(rpm -E '%fedora')"

-if [[ "${KERNEL}" =~ "6.8" ]]; then
-  echo "SKIPPED BUILD of rtl88xxau: compile failure on kernel 6.8 as of 2024-03-17"
-  exit 0
-fi
-
 cp /tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/_copr_ublue-os-akmods.repo /etc/yum.repos.d/

 dnf install -y \
-    akmod-rtl88xxau-*.fc${RELEASE}.${ARCH}
+    akmod-rtl88xxau-*.fc"${RELEASE}"."${ARCH}"
 akmods --force --kernels "${KERNEL}" --kmod rtl88xxau
-modinfo /usr/lib/modules/${KERNEL}/extra/rtl88xxau/88XXau.ko.xz > /dev/null \
+modinfo /usr/lib/modules/"${KERNEL}"/extra/rtl88xxau/88XXau.ko.xz > /dev/null \
 || (find /var/cache/akmods/rtl88xxau/ -name \*.log -print -exec cat {} \; && exit 1)

 rm -f /etc/yum.repos.d/_copr_ublue-os-akmods.repo
--- a/build_files/extra/build-kmod-ryzen-smu.sh
+++ b/build_files/extra/build-kmod-ryzen-smu.sh
@ -1,6 +1,6 @@
-#!/bin/sh
+#!/usr/bin/bash

-set -oeux pipefail
+set "${CI:+-x}" -euo pipefail

 ARCH="$(rpm -E '%_arch')"
 KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')"
@ -10,9 +10,9 @@ cp /tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/_copr_ublue-os-akmods.repo /etc/

 ### BUILD ryzen-smu (succeed or fail-fast with debug output)
 dnf install -y \
-    akmod-ryzen-smu-*.fc${RELEASE}.${ARCH}
+    akmod-ryzen-smu-*.fc"${RELEASE}"."${ARCH}"
 akmods --force --kernels "${KERNEL}" --kmod ryzen-smu
-modinfo /usr/lib/modules/${KERNEL}/extra/ryzen-smu/ryzen_smu.ko.xz > /dev/null \
+modinfo /usr/lib/modules/"${KERNEL}"/extra/ryzen-smu/ryzen_smu.ko.xz > /dev/null \
 || (find /var/cache/akmods/ryzen-smu/ -name \*.log -print -exec cat {} \; && exit 1)

 rm -f /etc/yum.repos.d/_copr_ublue-os-akmods.repo
--- a/build_files/extra/build-kmod-system76-io.sh
+++ b/build_files/extra/build-kmod-system76-io.sh
@ -1,6 +1,6 @@
-#!/bin/sh
+#!/usr/bin/bash

-set -oeux pipefail
+set "${CI:+-x}" -euo pipefail

 ARCH="$(rpm -E '%_arch')"
 KERNEL="$(rpm -q "${KERNEL_NAME:-kernel}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')"
--- a/build_files/extra/build-kmod-system76.sh
+++ b/build_files/extra/build-kmod-system76.sh
@ -1,6 +1,6 @@
-#!/bin/sh
+#!/usr/bin/bash

-set -oeux pipefail
+set "${CI:+-x}" -euo pipefail

 ARCH="$(rpm -E '%_arch')"
 KERNEL="$(rpm -q "${KERNEL_NAME:-kernel}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')"
--- a/build_files/extra/build-kmod-vhba.sh
+++ b/build_files/extra/build-kmod-vhba.sh
@ -1,6 +1,6 @@
-#!/bin/sh
+#!/usr/bin/bash

-set -oeux pipefail
+set "${CI:+-x}" -euo pipefail


 ARCH="$(rpm -E '%_arch')"
@ -17,9 +17,9 @@ curl -LsSf -o /etc/yum.repos.d/_copr_rok-cdemu.repo "https://copr.fedorainfraclo

 ### BUILD vhba (succeed or fail-fast with debug output)
 dnf install -y \
-    akmod-vhba-*.fc${RELEASE}.${ARCH}
+    akmod-vhba-*.fc"${RELEASE}"."${ARCH}"
 akmods --force --kernels "${KERNEL}" --kmod vhba
-modinfo /usr/lib/modules/${KERNEL}/extra/vhba/vhba.ko.xz > /dev/null \
+modinfo /usr/lib/modules/"${KERNEL}"/extra/vhba/vhba.ko.xz > /dev/null \
 || (find /var/cache/akmods/vhba/ -name \*.log -print -exec cat {} \; && exit 1)

 rm -f /etc/yum.repos.d/_copr_rok-cdemu.repo
--- a/build_files/extra/build-kmod-zenergy.sh
+++ b/build_files/extra/build-kmod-zenergy.sh
@ -1,6 +1,6 @@
-#!/bin/sh
+#!/usr/bin/bash

-set -oeux pipefail
+set "${CI:+-x}" -euo pipefail

 ARCH="$(rpm -E '%_arch')"
 KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')"
@ -9,9 +9,9 @@ RELEASE="$(rpm -E '%fedora')"
 cp /tmp/ublue-os-akmods-addons/rpmbuild/SOURCES/_copr_ublue-os-akmods.repo /etc/yum.repos.d/

 dnf install -y \
-    akmod-zenergy-*.fc${RELEASE}.${ARCH}
+    akmod-zenergy-*.fc"${RELEASE}"."${ARCH}"
 akmods --force --kernels "${KERNEL}" --kmod zenergy
-modinfo /usr/lib/modules/${KERNEL}/extra/zenergy/zenergy.ko.xz > /dev/null \
+modinfo /usr/lib/modules/"${KERNEL}"/extra/zenergy/zenergy.ko.xz > /dev/null \
 || (find /var/cache/akmods/zenergy/ -name \*.log -print -exec cat {} \; && exit 1)

 rm -f /etc/yum.repos.d/_copr_ublue-os-akmods.repo
--- a/build_files/nvidia/build-kmod-nvidia.sh
+++ b/build_files/nvidia/build-kmod-nvidia.sh
@ -1,20 +1,17 @@
-#!/bin/sh
+#!/usr/bin/bash

-set -oeux pipefail
+set "${CI:+-x}" -euo pipefail

 ARCH="$(rpm -E '%_arch')"
 KERNEL_MODULE_TYPE="${1:-kernel}"

+DIST="$(rpm -E '%dist')"
+DIST="${DIST#.}"
+VARS_KERNEL_VERSION="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')"
 if [[ "${KERNEL_FLAVOR}" =~ "centos" ]]; then
-    DIST="el$(rpm -E '%centos')"
-    # on CentOS, akmods uses full kernel version and release but no arch
-    VARS_KERNEL_VERSION="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}')"
    # enable negativo17
    cp /tmp/ublue-os-nvidia-addons/rpmbuild/SOURCES/negativo17-epel-nvidia.repo /etc/yum.repos.d/
 else
-    DIST="fc$(rpm -E '%fedora')"
-    # on Fedora, akmods uses full kernel version, release and arch
-    VARS_KERNEL_VERSION="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')"
    # disable rpmfusion and enable negativo17
    sed -i 's/enabled=1/enabled=0/' /etc/yum.repos.d/rpmfusion-*.repo
    cp /tmp/ublue-os-nvidia-addons/rpmbuild/SOURCES/negativo17-fedora-nvidia.repo /etc/yum.repos.d/
@ -25,7 +22,6 @@ cd /tmp

 ### BUILD nvidia

-
 dnf install -y \
    "akmod-nvidia*.${DIST}.${ARCH}"

@ -38,11 +34,11 @@ sed -i "s/^MODULE_VARIANT=.*/MODULE_VARIANT=$KERNEL_MODULE_TYPE/" /etc/nvidia/ke

 akmods --force --kernels "${KERNEL_VERSION}" --kmod "nvidia"

-modinfo /usr/lib/modules/${KERNEL_VERSION}/extra/nvidia/nvidia{,-drm,-modeset,-peermem,-uvm}.ko.xz > /dev/null || \
-(cat /var/cache/akmods/nvidia/${NVIDIA_AKMOD_VERSION}-for-${KERNEL_VERSION}.failed.log && exit 1)
+modinfo /usr/lib/modules/"${KERNEL_VERSION}"/extra/nvidia/nvidia{,-drm,-modeset,-peermem,-uvm}.ko.xz > /dev/null || \
+(cat /var/cache/akmods/nvidia/"${NVIDIA_AKMOD_VERSION}"-for-"${KERNEL_VERSION}".failed.log && exit 1)

 # View license information
-modinfo -l /usr/lib/modules/${KERNEL_VERSION}/extra/nvidia/nvidia{,-drm,-modeset,-peermem,-uvm}.ko.xz
+modinfo -l /usr/lib/modules/"${KERNEL_VERSION}"/extra/nvidia/nvidia{,-drm,-modeset,-peermem,-uvm}.ko.xz

 # create a directory for later copying of resulting nvidia specific artifacts
 mkdir -p /var/cache/rpms/kmods/nvidia
--- a/build_files/nvidia/build-ublue-os-nvidia-addons.sh
+++ b/build_files/nvidia/build-ublue-os-nvidia-addons.sh
@ -1,6 +1,6 @@
-#!/bin/sh
+#!/usr/bin/bash

-set -oeux pipefail
+set "${CI:+-x}" -euo pipefail

 curl -L https://negativo17.org/repos/epel-nvidia.repo \
    -o /tmp/ublue-os-nvidia-addons/rpmbuild/SOURCES/negativo17-epel-nvidia.repo
--- a/build_files/nvidia/build-ublue-os-ucore-nvidia.sh
+++ b/build_files/nvidia/build-ublue-os-ucore-nvidia.sh
@ -1,6 +1,6 @@
-#!/bin/sh
+#!/usr/bin/bash

-set -oeux pipefail
+set "${CI:+-x}" -euo pipefail

 ### SETUP nvidia container stuffs

--- a/build_files/shared/build-post.sh
+++ b/build_files/shared/build-post.sh
@ -1,29 +1,25 @@
-#!/bin/sh
+#!/usr/bin/bash

-set -oeux pipefail
+set "${CI:+-x}" -euo pipefail

 # Ensure packages get copied to /var/cache/rpms
-if [ -d /var/cache/akmods ]; then
-    for RPM in $(find /var/cache/akmods/ -type f -name \*.rpm); do
-        cp "${RPM}" /var/cache/rpms/kmods/
-    done
-fi
-
-if [ -d /root/rpmbuild/RPMS/"$(uname -m)" ]; then
-    for RPM in $(find /root/rpmbuild/RPMS/"$(uname -m)"/ -type f -name \*.rpm); do
-        cp "${RPM}" /var/cache/rpms/kmods/
-    done
-fi
+pushd /root/rpmbuild/RPMS/"$(uname -m)"
+mapfile -t RPMS < <(find /root/rpmbuild/RPMS/"$(uname -m)"/ -type f -name \*.rpm)
+for RPM in "${RPMS[@]}"; do
+    cp "${RPM}" /var/cache/rpms/kmods/
+done
+popd

 # Remove kernel version from kmod package names
 # FIXME: The sed is a gross hack, maybe PR upstream?
 sed -i -e 's/args = \["rpmbuild", "-bb"\]/args = \["rpmbuild", "-bb", "--buildroot", "#{build_path}\/BUILD"\]/g' /usr/local/share/gems/gems/fpm-*/lib/fpm/package/rpm.rb
 kernel_version=$(rpm -q --qf "%{VERSION}-%{RELEASE}.%{ARCH}\n" "${KERNEL_NAME}" | head -n 1)
-for rpm in $(find /var/cache/rpms/kmods -type f -name \*.rpm); do
-    basename=$(basename ${rpm})
-    name=${basename%%-${kernel_version}*}
+mapfile -t RPMS < <(find /var/cache/rpms/kmods -type f -name \*.rpm)
+for rpm in "${RPM[@]}"; do
+    basename=$(basename "${rpm}")
+    name=${basename%%-"${kernel_version}"*}
    if [[ "$basename" == *"$kernel_version"* ]]; then
-        fpm --verbose -s rpm -t rpm -p ${rpm} -f --name ${name} ${rpm}
+        fpm --verbose -s rpm -t rpm -p "${rpm}" -f --name "${name}" "${rpm}"
    else
        echo "Skipping $basename rebuild as its name does not contain $kernel_version"
    fi
--- a/build_files/post/dual-sign.sh
+++ b/build_files/post/dual-sign.sh
@ -0,0 +1,70 @@
+#!/usr/bin/bash
+
+set "${CI:+-x}" -euo pipefail
+
+if [[ "${DUAL_SIGN}" != "true" ]]; then
+    echo "Not Dual Signing..."
+    exit 0
+fi
+
+KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')"
+SIGNING_KEY_1="/tmp/certs/signing_key_1.pem"
+SIGNING_KEY_2="/tmp/certs/signing_key_2.pem"
+PUBLIC_CHAIN="/tmp/certs/public_key_chain.pem"
+
+for module in /usr/lib/modules/"${KERNEL}"/extra/*/*.ko*; do
+    module_basename=${module:0:-3}
+    module_suffix=${module: -3}
+    if [[ "$module_suffix" == ".xz" ]]; then
+        xz --decompress "$module"
+        openssl cms -sign -signer "${SIGNING_KEY_1}" -signer "${SIGNING_KEY_2}" -binary -in "$module_basename" -outform DER -out "${module_basename}.cms" -nocerts -noattr -nosmimecap
+        /usr/src/kernels/"${KERNEL}"/scripts/sign-file -s "${module_basename}.cms" sha256 "${PUBLIC_CHAIN}" "${module_basename}"
+        /tmp/dual-sign-check.sh "${KERNEL}" "${module_basename}" "${PUBLIC_CHAIN}"
+        xz -C crc32 -f "${module_basename}"
+    elif [[ "$module_suffix" == ".gz" ]]; then
+        gzip -d "$module"
+        openssl cms -sign -signer "${SIGNING_KEY_1}" -signer "${SIGNING_KEY_2}" -binary -in "$module_basename" -outform DER -out "${module_basename}.cms" -nocerts -noattr -nosmimecap
+        /usr/src/kernels/"${KERNEL}"/scripts/sign-file -s "${module_basename}.cms" sha256 "${PUBLIC_CHAIN}" "${module_basename}"
+        /tmp/dual-sign-check.sh "${KERNEL}" "${module_basename}" "${PUBLIC_CHAIN}"
+        gzip -9f "${module_basename}"
+    else
+        openssl cms -sign -signer "${SIGNING_KEY_1}" -signer "${SIGNING_KEY_2}" -binary -in "$module" -outform DER -out "${module}.cms" -nocerts -noattr -nosmimecap
+        /usr/src/kernels/"${KERNEL}"/scripts/sign-file -s "${module}.cms" sha256 "${PUBLIC_CHAIN}" "${module}"
+        /tmp/dual-sign-check.sh "${KERNEL}" "${module}" "${PUBLIC_CHAIN}"
+    fi
+done
+find /var/cache/akmods -type f -name "\kmod-*.rpm"
+pushd /var/cache/akmods
+mapfile -t RPMPATHS < <(find . -type f -name "\kmod-*.rpm")
+for RPMPATH in "${RPMPATHS[@]}"; do
+    RPM=$(basename "${RPMPATH/\.rpm/}")
+    mkdir -p /tmp/buildroot
+    cp -r /{usr,lib} /tmp/buildroot
+    rpmrebuild --additional=--buildroot=/tmp/buildroot --batch "$RPM"
+    rm -rf /tmp/buildroot
+done
+popd
+rm -rf /usr/lib/modules/"${KERNEL}"/extra
+
+# on CentOS, akmods/rpmbuild seems to mangle kernel version in the kmod package name
+pushd /root/rpmbuild/RPMS/"$(uname -m)"/
+mapfile -t RPMPATHS < <(find . -type f -name "\kmod-*.rpm")
+for RPMPATH in "${RPMPATHS[@]}"; do
+    RPM=$(basename "${RPMPATH/\.rpm/}")
+    if [[ ! "$RPM" =~ ${KERNEL} ]]; then
+        RENAME=${RPM%"$(rpm -q --queryformat="%{VERSION}" kernel)"*}
+        RENAME+=$KERNEL
+        RENAME+=${RPM#*"$(rpm -E %dist)"}
+        RPM_RENAME="$(dirname "$RPMPATH")/$RENAME.rpm"
+        mv "$RPMPATH" "$RPM_RENAME"
+    fi
+done
+# Reinstall KMODs for initial check that they were signed
+mapfile -t kmods < <(ls -1 ./kmod-*.rpm)
+dnf reinstall -y --allowerasing "${kmods[@]}"
+popd
+for module in /usr/lib/modules/"${KERNEL}"/extra/*/*.ko*; do
+    if ! modinfo "${module}" >/dev/null; then
+        exit 1
+    fi
+done
--- a/build_files/shared/build-prep.sh
+++ b/build_files/shared/build-prep.sh
@ -1,20 +1,21 @@
 #!/usr/bin/bash

-set -oeux pipefail
+set "${CI:+-x}" -euo pipefail

 ### PREPARE REPOS
 # enable RPMs with alternatives to create them in this image build
 mkdir -p /var/lib/alternatives

-# ARCH="$(rpm -E '%_arch')"
+pushd /tmp/kernel_cache
+KERNEL_VERSION=$(find "$KERNEL_NAME"-*.rpm | grep "$(uname -m)" | grep -P "$KERNEL_NAME-\d+\.\d+\.\d+-\d+.*$(rpm -E '%{dist}')" | sed -E "s/$KERNEL_NAME-//;s/\.rpm//")
+popd
+
 if [[ "${KERNEL_FLAVOR}" =~ "centos" ]]; then
    echo "Building for CentOS"
    RELEASE="$(rpm -E '%centos')"

    mkdir -p /var/roothome
-
-    dnf remove -y subscription-manager
-    dnf -y install "https://dl.fedoraproject.org/pub/epel/epel-release-latest-${RELEASE}.noarch.rpm"
+    PREP_RPMS+=("https://dl.fedoraproject.org/pub/epel/epel-release-latest-${RELEASE}.noarch.rpm")
    dnf config-manager --set-enabled crb
 else
    echo "Building for Fedora"
@ -26,41 +27,42 @@ else
    if [ -n "${RPMFUSION_MIRROR}" ]; then
        RPMFUSION_MIRROR_RPMS=${RPMFUSION_MIRROR}
    fi
-    dnf install -y \
+    PREP_RPMS+=(
        "${RPMFUSION_MIRROR_RPMS}"/free/fedora/rpmfusion-free-release-"${RELEASE}".noarch.rpm \
        "${RPMFUSION_MIRROR_RPMS}"/nonfree/fedora/rpmfusion-nonfree-release-"${RELEASE}".noarch.rpm \
        fedora-repos-archive
+    )

-    # after F43 launches, bump to 44
-    if [[ "${FEDORA_MAJOR_VERSION}" -ge 43 ]]; then
-        # pre-release rpmfusion is in a different location
-        sed -i "s%free/fedora/releases%free/fedora/development%" /etc/yum.repos.d/rpmfusion-*.repo
-        # pre-release rpmfusion needs to enable testing
-        sed -i '0,/enabled=0/{s/enabled=0/enabled=1/}' /etc/yum.repos.d/rpmfusion-*-updates-testing.repo
-    fi
-
-    if [ -n "${RPMFUSION_MIRROR}" ]; then
-        # force use of single rpmfusion mirror
-        echo "Using single rpmfusion mirror: ${RPMFUSION_MIRROR}"
-        sed -i.bak "s%^metalink=%#metalink=%" /etc/yum.repos.d/rpmfusion-*.repo
-        sed -i "s%^#baseurl=http://download1.rpmfusion.org%baseurl=${RPMFUSION_MIRROR}%" /etc/yum.repos.d/rpmfusion-*.repo
-    fi
 fi

 # install kernel_cache provided kernel
 echo "Installing ${KERNEL_FLAVOR} kernel-cache RPMs..."

 # build image has no kernel so this needs nothing fancy, just install, but not UKIs
-dnf install -y `find /tmp/kernel_cache/*.rpm -type f | grep -v uki | xargs`
-KERNEL_VERSION=$(rpm -q "${KERNEL_NAME}" | cut -d '-' -f2-)
+#shellcheck disable=SC2046 #we want word splitting
+dnf install -y --allowerasing "${PREP_RPMS[@]}" $(find /tmp/kernel_cache/*.rpm -type f | grep "$(uname -m)" | grep -v uki | xargs)
+
+# after F43 launches, bump to 44
+if [[ "${VERSION}" -ge 43 && -f /etc/fedora-release ]]; then
+    # pre-release rpmfusion is in a different location
+    sed -i "s%free/fedora/releases%free/fedora/development%" /etc/yum.repos.d/rpmfusion-*.repo
+    # pre-release rpmfusion needs to enable testing
+    sed -i '0,/enabled=0/{s/enabled=0/enabled=1/}' /etc/yum.repos.d/rpmfusion-*-updates-testing.repo
+fi
+
+if [[ -n "${RPMFUSION_MIRROR}" && -f /etc/fedora-release ]]; then
+    # force use of single rpmfusion mirror
+    echo "Using single rpmfusion mirror: ${RPMFUSION_MIRROR}"
+    sed -i.bak "s%^metalink=%#metalink=%" /etc/yum.repos.d/rpmfusion-*.repo
+    sed -i "s%^#baseurl=http://download1.rpmfusion.org%baseurl=${RPMFUSION_MIRROR}%" /etc/yum.repos.d/rpmfusion-*.repo
+fi

 ### PREPARE BUILD ENV
-dnf install -y \
-    akmods \
-    mock \
+RPMS_TO_INSTALL+=(
+    akmods
+    mock
    ruby-devel
-
-gem install fpm
+)

 if [[ ! -s "/tmp/certs/private_key.priv" ]]; then
    echo "WARNING: Using test signing key. Run './generate-akmods-key' for production builds."
@ -72,7 +74,35 @@ install -Dm644 /tmp/certs/public_key.der   /etc/pki/akmods/certs/public_key.der
 install -Dm644 /tmp/certs/private_key.priv /etc/pki/akmods/private/private_key.priv

 if [[ "${DUAL_SIGN}" == "true" ]]; then
-    dnf install -y rpmrebuild
+    RPMS_TO_INSTALL+=(rpmrebuild)
+fi
+
+# This is for ZFS more than CentOS|CoreOS
+if [[ "${KERNEL_FLAVOR}" =~ "centos" ]] || [[ "${KERNEL_FLAVOR}" =~ "coreos" ]] || [[ "${KERNEL_FLAVOR}" =~ "longterm" ]]; then
+    mkdir -p "$(dirname /lib/modules/"${KERNEL_VERSION}"/build/certs/signing_key.x509)"
+    install -Dm644 /tmp/certs/public_key.der /lib/modules/"${KERNEL_VERSION}"/build/certs/signing_key.x509
+    install -Dm644 /tmp/certs/private_key.priv /lib/modules/"${KERNEL_VERSION}"/build/certs/signing_key.pem
+    RPMS_TO_INSTALL+=(
+        autoconf
+        automake
+        dkms
+        git
+        jq
+        libtool
+        ncompress
+        python-cffi
+    )
+fi
+if [[ "${KERNEL_FLAVOR}" =~ "coreos" ]] || [[ "${KERNEL_FLAVOR}" =~ "longterm" ]]; then
+    # this seems to be needed on longterm builds but is already present on CoreOS, too
+    RPMS_TO_INSTALL+=(libatomic)
+fi
+
+# Install RPMs
+dnf install -y --allowerasing "${RPMS_TO_INSTALL[@]}"
+
+# Configure Dual Signing
+if [[ "${DUAL_SIGN}" == 'true' ]]; then
    if [[ ! -s "/tmp/certs/private_key_2.priv" ]]; then
        echo "WARNING: Using test signing key. Run './generate-akmods-key' for production builds."
        cp /tmp/certs/private_key_2.priv{.test,}
@ -85,25 +115,8 @@ if [[ "${DUAL_SIGN}" == "true" ]]; then
    cat /tmp/certs/public_key.crt <(echo) /tmp/certs/public_key_2.crt >> /tmp/certs/public_key_chain.pem
 fi

-# This is for ZFS more than CentOS|CoreOS
-if [[ "${KERNEL_FLAVOR}" =~ "centos" ]] || [[ "${KERNEL_FLAVOR}" =~ "coreos" ]] || [[ "${KERNEL_FLAVOR}" =~ "longterm" ]]; then
-    install -Dm644 /tmp/certs/public_key.der /lib/modules/"${KERNEL_VERSION}"/build/certs/signing_key.x509
-    install -Dm644 /tmp/certs/private_key.priv /lib/modules/"${KERNEL_VERSION}"/build/certs/signing_key.pem
-    dnf install -y \
-        autoconf \
-        automake \
-        dkms \
-        git \
-        jq \
-        libtool \
-        ncompress \
-        python-cffi
-fi
-if [[ "${KERNEL_FLAVOR}" =~ "coreos" ]] || [[ "${KERNEL_FLAVOR}" =~ "longterm" ]]; then
-    # this seems to be needed on longterm builds but is already present on CoreOS, too
-    dnf install -y \
-        libatomic
-fi
+# Install FPM
+gem install fpm

 # protect against incorrect permissions in tmp dirs which can break akmods builds
 chmod 1777 /tmp /var/tmp
--- a/build_files/shared/dual-sign-check.sh
+++ b/build_files/shared/dual-sign-check.sh
@ -1,5 +1,7 @@
 #!/usr/bin/bash

+set "${CI:+-x}" -euo pipefail
+
 KERNEL="$1"
 module="$2"
 PUBLIC_CERT="$3"
--- a/build_files/shared/dual-sign.sh
+++ b/build_files/shared/dual-sign.sh
@ -1,50 +0,0 @@
-#!/usr/bin/bash
-
-set -eoux pipefail
-
-KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')"
-SIGNING_KEY_1="/tmp/certs/signing_key_1.pem"
-SIGNING_KEY_2="/tmp/certs/signing_key_2.pem"
-PUBLIC_CHAIN="/tmp/certs/public_key_chain.pem"
-
-if [[ "${DUAL_SIGN}" == "true" ]]; then
-    for module in /usr/lib/modules/"${KERNEL}"/extra/*/*.ko*; do
-        module_basename=${module:0:-3}
-        module_suffix=${module: -3}
-        if [[ "$module_suffix" == ".xz" ]]; then
-            xz --decompress "$module"
-            openssl cms -sign -signer "${SIGNING_KEY_1}" -signer "${SIGNING_KEY_2}" -binary -in "$module_basename" -outform DER -out "${module_basename}.cms" -nocerts -noattr -nosmimecap
-            /usr/src/kernels/"${KERNEL}"/scripts/sign-file -s "${module_basename}.cms" sha256 "${PUBLIC_CHAIN}" "${module_basename}"
-            /tmp/dual-sign-check.sh "${KERNEL}" "${module_basename}" "${PUBLIC_CHAIN}"
-            xz -C crc32 -f "${module_basename}"
-        elif [[ "$module_suffix" == ".gz" ]]; then
-            gzip -d "$module"
-            openssl cms -sign -signer "${SIGNING_KEY_1}" -signer "${SIGNING_KEY_2}" -binary -in "$module_basename" -outform DER -out "${module_basename}.cms" -nocerts -noattr -nosmimecap
-            /usr/src/kernels/"${KERNEL}"/scripts/sign-file -s "${module_basename}.cms" sha256 "${PUBLIC_CHAIN}" "${module_basename}"
-            /tmp/dual-sign-check.sh "${KERNEL}" "${module_basename}" "${PUBLIC_CHAIN}"
-            gzip -9f "${module_basename}"
-        else
-            openssl cms -sign -signer "${SIGNING_KEY_1}" -signer "${SIGNING_KEY_2}" -binary -in "$module" -outform DER -out "${module}.cms" -nocerts -noattr -nosmimecap
-            /usr/src/kernels/"${KERNEL}"/scripts/sign-file -s "${module}.cms" sha256 "${PUBLIC_CHAIN}" "${module}"
-            /tmp/dual-sign-check.sh "${KERNEL}" "${module}" "${PUBLIC_CHAIN}"
-        fi
-    done
-    find /var/cache/akmods -type f -name "\kmod-*.rpm"
-    for RPMPATH in $(find /var/cache/akmods/ -type f -name \kmod-*.rpm); do
-        RPM=$(basename $(echo "${RPMPATH}" | sed 's/\.rpm//'))
-        mkdir -p /tmp/buildroot
-        cp -r /{usr,lib} /tmp/buildroot
-        rpmrebuild --additional=--buildroot=/tmp/buildroot --batch "$RPM"
-        rm -rf /tmp/buildroot
-    done
-    rm -rf /usr/lib/modules/"${KERNEL}"/extra
-
-    # on CentOS, akmods seems to drop the arch from the kernel version in the kmod package name
-    KERNEL_NOARCH="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}')"
-    dnf reinstall -y /root/rpmbuild/RPMS/"$(uname -m)"/kmod-*-"${KERNEL_NOARCH}"*.rpm
-    for module in /usr/lib/modules/"${KERNEL}"/extra/*/*.ko*; do
-        if ! modinfo "${module}" >/dev/null; then
-            exit 1
-        fi
-    done
-fi
--- a/build_files/shared/check-signatures.sh
+++ b/build_files/shared/check-signatures.sh
@ -1,5 +1,8 @@
 #!/usr/bin/bash

+set "${CI:+-x}" -euo pipefail
+
+#shellcheck disable=SC1091
 source /tmp/info.sh

 KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')"
--- a/build_files/shared/test-prep.sh
+++ b/build_files/shared/test-prep.sh
@ -1,7 +1,11 @@
 #!/usr/bin/bash
-#shellcheck disable=SC2086
+#shellcheck disable=SC2206

-set -oeux pipefail
+set "${CI:+-x}" -euo pipefail
+
+pushd /tmp/kernel_cache
+KERNEL_VERSION=$(find "$KERNEL_NAME"-*.rpm | grep "$(uname -m)" | grep -P "$KERNEL_NAME-\d+\.\d+\.\d+-\d+.*$(rpm -E '%{dist}')" | sed -E "s/$KERNEL_NAME-//;s/\.rpm//")
+popd

 ### PREPARE REPOS
 if [[ "${KERNEL_FLAVOR}" =~ "centos" ]]; then
@ -11,9 +15,7 @@ if [[ "${KERNEL_FLAVOR}" =~ "centos" ]]; then
    NVIDIA_EXTRA_PKGS=""

    mkdir -p /var/roothome
-
-    dnf remove -y subscription-manager
-    dnf -y install "https://dl.fedoraproject.org/pub/epel/epel-release-latest-${RELEASE}.noarch.rpm"
+    RPM_PREP+=("https://dl.fedoraproject.org/pub/epel/epel-release-latest-${RELEASE}.noarch.rpm")
    dnf config-manager --set-enabled crb
 else
    echo "Building for Fedora"
@ -28,16 +30,14 @@ fi
 mkdir -p /var/lib/alternatives

 if [[ -f $(find /tmp/akmods-rpms/ublue-os/ublue-os-*.rpm 2> /dev/null) ]]; then
-    dnf install -y /tmp/akmods-rpms/ublue-os/ublue-os-*.rpm
+    RPM_PREP+=(/tmp/akmods-rpms/ublue-os/ublue-os-*.rpm)
 fi

-
 # install kernel_cache provided kernel
 echo "Installing ${KERNEL_FLAVOR} kernel-cache RPMs..."
 # fedora image has no kernel so this needs nothing fancy, just install
-dnf install -y /tmp/kernel_cache/*.rpm
-
-KERNEL_VERSION=$(rpm -q ${KERNEL_NAME}|cut -d '-' -f2-)
+#shellcheck disable=SC2046 # We want word splitting
+dnf install -y "${RPM_PREP[@]}" $(find /tmp/kernel_cache/*.rpm -type f | grep "$(uname -m)" | grep -v uki)

 if [[ "${KERNEL_FLAVOR}" =~ "centos" ]]; then
    echo "Building for CentOS does not require more repos"
@ -48,25 +48,11 @@ else
    if [ -n "${RPMFUSION_MIRROR}" ]; then
        RPMFUSION_MIRROR_RPMS=${RPMFUSION_MIRROR}
    fi
-    dnf install -y \
-        "${RPMFUSION_MIRROR_RPMS}"/free/fedora/rpmfusion-free-release-"${RELEASE}".noarch.rpm \
-        "${RPMFUSION_MIRROR_RPMS}"/nonfree/fedora/rpmfusion-nonfree-release-"${RELEASE}".noarch.rpm \
+    RPM_PREP+=(
+        "${RPMFUSION_MIRROR_RPMS}"/free/fedora/rpmfusion-free-release-"${RELEASE}".noarch.rpm
+        "${RPMFUSION_MIRROR_RPMS}"/nonfree/fedora/rpmfusion-nonfree-release-"${RELEASE}".noarch.rpm
        fedora-repos-archive
-
-    # after F43 launches, bump to 44
-    if [[ "${FEDORA_MAJOR_VERSION}" -ge 43 ]]; then
-        # pre-release rpmfusion is in a different location
-        sed -i "s%free/fedora/releases%free/fedora/development%" /etc/yum.repos.d/rpmfusion-*.repo
-        # pre-release rpmfusion needs to enable testing
-        sed -i '0,/enabled=0/{s/enabled=0/enabled=1/}' /etc/yum.repos.d/rpmfusion-*-updates-testing.repo
-    fi
-
-    if [ -n "${RPMFUSION_MIRROR}" ]; then
-        # force use of single rpmfusion mirror
-        echo "Using single rpmfusion mirror: ${RPMFUSION_MIRROR}"
-        sed -i.bak "s%^metalink=%#metalink=%" /etc/yum.repos.d/rpmfusion-*.repo
-        sed -i "s%^#baseurl=http://download1.rpmfusion.org%baseurl=${RPMFUSION_MIRROR}%" /etc/yum.repos.d/rpmfusion-*.repo
-    fi
+    )

    # after F43 launches, bump to 44
    if [[ "${RELEASE}" -ge 43 ]]; then
@ -88,6 +74,21 @@ else
        "https://negativo17.org/repos/fedora-multimedia.repo"
 fi

+# after F43 launches, bump to 44
+if [[ "${RELEASE}" -ge 43 && -f /etc/fedora-release ]]; then
+    # pre-release rpmfusion is in a different location
+    sed -i "s%free/fedora/releases%free/fedora/development%" /etc/yum.repos.d/rpmfusion-*.repo
+    # pre-release rpmfusion needs to enable testing
+    sed -i '0,/enabled=0/{s/enabled=0/enabled=1/}' /etc/yum.repos.d/rpmfusion-*-updates-testing.repo
+fi
+
+if [[ -n "${RPMFUSION_MIRROR}" && -f /etc/fedora-release ]]; then
+    # force use of single rpmfusion mirror
+    echo "Using single rpmfusion mirror: ${RPMFUSION_MIRROR}"
+    sed -i.bak "s%^metalink=%#metalink=%" /etc/yum.repos.d/rpmfusion-*.repo
+    sed -i "s%^#baseurl=http://download1.rpmfusion.org%baseurl=${RPMFUSION_MIRROR}%" /etc/yum.repos.d/rpmfusion-*.repo
+fi
+
 if [[ -f $(find /tmp/akmods-rpms/kmods/kmod-vhba-*.rpm) ]]; then
 curl -LsSf -o /etc/yum.repos.d/_copr_rok-cdemu.repo \
    "https://copr.fedorainfracloud.org/coprs/rok/cdemu/repo/fedora-${COPR_RELEASE}/rok-cdemu-fedora-${COPR_RELEASE}.repo"
@ -122,7 +123,8 @@ if [[ -f $(find /tmp/akmods-rpms/kmods/kmod-nvidia-*.rpm) ]]; then
 fi

 dnf install -y \
-    openssl
+    openssl \
+    "${RPM_PREP[@]}"

 if [[ ! -s "/tmp/certs/private_key.priv" ]]; then
    echo "WARNING: Using test signing key. Run './generate-akmods-key' for production builds."
@ -148,27 +150,31 @@ rm -f /tmp/certs/private_key_2.priv
 if [[ -f $(find /tmp/akmods-rpms/kmods/kmod-nvidia-*.rpm 2> /dev/null) ]]; then
    sed -i '0,/enabled=0/{s/enabled=0/enabled=1/}' /etc/yum.repos.d/negativo17-${NVIDIA_REPO_NAME}
    sed -i '0,/enabled=0/{s/enabled=0/enabled=1/}' /etc/yum.repos.d/nvidia-container-toolkit.repo
+    #shellcheck disable=SC1091
    source /tmp/akmods-rpms/kmods/nvidia-vars
-    dnf install -y \
-        libnvidia-fbc \
-        libva-nvidia-driver \
-        nvidia-driver \
-        nvidia-driver-cuda \
-        nvidia-modprobe \
-        nvidia-persistenced \
-        nvidia-settings \
-        nvidia-container-toolkit \
-        ${NVIDIA_EXTRA_PKGS} \
+    KMODS_TO_INSTALL+=(
+        libnvidia-fbc
+        libva-nvidia-driver
+        nvidia-driver
+        nvidia-driver-cuda
+        nvidia-modprobe
+        nvidia-persistenced
+        nvidia-settings
+        nvidia-container-toolkit
+        ${NVIDIA_EXTRA_PKGS}
        /tmp/akmods-rpms/kmods/kmod-nvidia-"${KERNEL_VERSION}"-"${NVIDIA_AKMOD_VERSION}"."${DIST_ARCH}".rpm
+    )
        # Codacy complains about the lack of quotes on ${NVIDIA_EXTRA_PKGS}, but we don't want quotes here
-        # we want word splitting behavior, thus 'shellcheck disable=SC2086' added to the top of this file
+        # we want word splitting behavior, thus '#shellcheck disable=SC2206' added to the top of this file
 elif [[ -f $(find /tmp/akmods-rpms/kmods/zfs/kmod-*.rpm 2> /dev/null) ]]; then
-    dnf install -y \
-        pv \
+    KMODS_TO_INSTALL+=(
+        pv
        /tmp/akmods-rpms/kmods/zfs/*.rpm
+    )
 else
-    dnf install -y \
-        /tmp/akmods-rpms/kmods/*.rpm
+    KMODS_TO_INSTALL+=(/tmp/akmods-rpms/kmods/*.rpm)
 fi

+dnf install -y "${KMODS_TO_INSTALL[@]}"
+
 printf "KERNEL_NAME=%s" "$KERNEL_NAME" >> /tmp/info.sh
--- a/build_files/zfs/build-kmod-zfs.sh
+++ b/build_files/zfs/build-kmod-zfs.sh
@ -1,15 +1,8 @@
 #!/usr/bin/bash

-set -oeux pipefail
+set "${CI:+-x}" -euo pipefail

-
-ARCH="$(rpm -E '%_arch')"
-KERNEL="$(rpm -q ${KERNEL_NAME} --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')"
-if [[ "${KERNEL_FLAVOR}" =~ "centos" ]]; then
-    RELEASE="$(rpm -E '%centos')"
-else
-    RELEASE="$(rpm -E '%fedora')"
-fi
+KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')"
 # allow pinning to a specific release series (eg, 2.0.x or 2.1.x)
 ZFS_MINOR_VERSION="${ZFS_MINOR_VERSION:-}"

@ -38,49 +31,42 @@ gpg --yes --keyserver keyserver.ubuntu.com --recv C77B9667
 gpg --yes --keyserver keyserver.ubuntu.com --recv C6AF658B

 echo "Verifying tar.gz signature"
-gpg --verify "zfs-${ZFS_VERSION}.tar.gz.asc" "zfs-${ZFS_VERSION}.tar.gz"
-if [ $? -ne 0 ]; then
+if ! gpg --verify "zfs-${ZFS_VERSION}.tar.gz.asc" "zfs-${ZFS_VERSION}.tar.gz"; then
    echo "ZFS tarball signature verification FAILED! Exiting..."
    exit 1
 fi

 echo "Verifying checksum signature"
-gpg --verify "zfs-${ZFS_VERSION}.sha256.asc"
-if [ $? -ne 0 ]; then
+if ! gpg --verify "zfs-${ZFS_VERSION}.sha256.asc"; then
    echo "Checksum signature verification FAILED! Exiting..."
    exit 1
 fi

 echo "Verifying encrypted checksum"
-gpg --decrypt "zfs-${ZFS_VERSION}.sha256.asc" | sha256sum -c
-if [ $? -ne 0 ]; then
+if ! gpg --decrypt "zfs-${ZFS_VERSION}.sha256.asc" | sha256sum -c; then
    echo "Checksum verification FAILED! Exiting..."
    exit 1
 fi

 # no-same-owner/no-same-permissions required for F40 based images building on podman 3.4.4 (ubuntu 22.04)
-tar -z -x --no-same-owner --no-same-permissions -f zfs-${ZFS_VERSION}.tar.gz
+tar -z -x --no-same-owner --no-same-permissions -f "zfs-${ZFS_VERSION}.tar.gz"

-# patch the zfs-kmod.spec.in file for older zfs versions
-ZFS_MAJ=$(echo $ZFS_VERSION | cut -f1 -d.)
-ZFS_MIN=$(echo $ZFS_VERSION | cut -f2 -d.)
-ZFS_PATCH=$(echo $ZFS_VERSION | cut -f3 -d.)
-
-cd /tmp/zfs-${ZFS_VERSION}
+cd "/tmp/zfs-${ZFS_VERSION}"
 # ensure rpm spec depends on correct kernel-devel package, else build fails on kernel-longterm kernels
 sed -i "s|kernel-devel|${KERNEL_NAME}-devel|" rpm/*/*spec.in
-./configure \
-        -with-linux=/usr/src/kernels/${KERNEL}/ \
-        -with-linux-obj=/usr/src/kernels/${KERNEL}/ \
-    && make -j $(nproc) rpm-utils rpm-kmod \
-    || (cat config.log && exit 1)
+if ! ./configure \
+        -with-linux="/usr/src/kernels/${KERNEL}/" \
+        -with-linux-obj="/usr/src/kernels/${KERNEL}/" \
+    || ! make -j "$(nproc)" rpm-utils rpm-kmod; then
+    cat config.log && exit 1
+fi


 # create a directory for later copying of resulting zfs specific artifacts
-mkdir -p /var/cache/rpms/kmods/zfs/{debug,devel,other,src} \
-    && mv *src.rpm /var/cache/rpms/kmods/zfs/src/ \
-    && mv *devel*.rpm /var/cache/rpms/kmods/zfs/devel/ \
-    && mv *debug*.rpm /var/cache/rpms/kmods/zfs/debug/ \
-    && mv zfs-dracut*.rpm /var/cache/rpms/kmods/zfs/other/ \
-    && mv zfs-test*.rpm /var/cache/rpms/kmods/zfs/other/ \
-    && mv *.rpm /var/cache/rpms/kmods/zfs/
+mkdir -p /var/cache/rpms/kmods/zfs/{debug,devel,other,src}
+mv ./*src.rpm /var/cache/rpms/kmods/zfs/src/
+mv ./*devel*.rpm /var/cache/rpms/kmods/zfs/devel/
+mv ./*debug*.rpm /var/cache/rpms/kmods/zfs/debug/
+mv zfs-dracut*.rpm /var/cache/rpms/kmods/zfs/other/
+mv zfs-test*.rpm /var/cache/rpms/kmods/zfs/other/
+mv ./*.rpm /var/cache/rpms/kmods/zfs/
--- a/build_files/zfs/dual-sign-zfs.sh
+++ b/build_files/zfs/dual-sign-zfs.sh
@ -1,47 +1,66 @@
 #!/usr/bin/bash

-set -eoux pipefail
+set "${CI:+-x}" -euo pipefail
+
+if [[ "${DUAL_SIGN}" != "true" ]]; then
+    echo "Not Dual Signing..."
+    exit 0
+fi

 KERNEL="$(rpm -q "${KERNEL_NAME}" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')"
 SIGNING_KEY_1="/tmp/certs/signing_key_1.pem"
 SIGNING_KEY_2="/tmp/certs/signing_key_2.pem"
 PUBLIC_CHAIN="/tmp/certs/public_key_chain.pem"

-if [[ "${DUAL_SIGN}" == "true" ]]; then
-    ln -s / /tmp/buildroot
-    dnf install -y /var/cache/rpms/kmods/zfs/*.rpm pv
-    modinfo /usr/lib/modules/"${KERNEL}"/extra/zfs/spl.ko
-    for module in /usr/lib/modules/"${KERNEL}"/extra/zfs/*.ko*; do
-        module_basename=${module:0:-3}
-        module_suffix=${module: -3}
-        if [[ "$module_suffix" == ".xz" ]]; then
-            xz --decompress "$module"
-            openssl cms -sign -signer "${SIGNING_KEY_1}" -signer "${SIGNING_KEY_2}" -binary -in "$module_basename" -outform DER -out "${module_basename}.cms" -nocerts -noattr -nosmimecap
-            /usr/src/kernels/"${KERNEL}"/scripts/sign-file -s "${module_basename}.cms" sha256 "${PUBLIC_CHAIN}" "${module_basename}"
-            /tmp/dual-sign-check.sh "${KERNEL}" "${module_basename}" "${PUBLIC_CHAIN}"
-            xz -C crc32 -f "${module_basename}"
-        elif [[ "$module_suffix" == ".gz" ]]; then
-            gzip -d "$module"
-            openssl cms -sign -signer "${SIGNING_KEY_1}" -signer "${SIGNING_KEY_2}" -binary -in "$module_basename" -outform DER -out "${module_basename}.cms" -nocerts -noattr -nosmimecap
-            /usr/src/kernels/"${KERNEL}"/scripts/sign-file -s "${module_basename}.cms" sha256 "${PUBLIC_CHAIN}" "${module_basename}"
-            /tmp/dual-sign-check.sh "${KERNEL}" "${module_basename}" "${PUBLIC_CHAIN}"
-            gzip -9f "${module_basename}"
-        else
-            openssl cms -sign -signer "${SIGNING_KEY_1}" -signer "${SIGNING_KEY_2}" -binary -in "$module" -outform DER -out "${module}.cms" -nocerts -noattr -nosmimecap
-            /usr/src/kernels/"${KERNEL}"/scripts/sign-file -s "${module}.cms" sha256 "${PUBLIC_CHAIN}" "${module}"
-            /tmp/dual-sign-check.sh "${KERNEL}" "${module}" "${PUBLIC_CHAIN}"
-        fi
-    done
-    find /var/cache/rpms/kmods/zfs -type f -name "\kmod-*.rpm" | grep -v debug | grep -v devel
-    RPMPATH=$(find /var/cache/rpms/kmods/zfs -type f -name "\kmod-*.rpm" | grep -v debug | grep -v devel)
-    RPM=$(basename $(echo "${RPMPATH}" | sed 's/\.rpm//'))
-    rpmrebuild --additional=--buildroot=/tmp/buildroot --batch "${RPM}"
-    rm -rf /usr/lib/modules/"${KERNEL}"/extra
-    dnf reinstall -y /root/rpmbuild/RPMS/"$(uname -m)"/kmod-*-"${KERNEL}"-*.rpm
-    for module in /usr/lib/modules/"${KERNEL}"/extra/*/*.ko*; do
-        if ! modinfo "${module}"; then
-            exit 1
-        fi
-    done
-    mv -f /root/rpmbuild/RPMS/"$(uname -m)"/kmod-*.rpm /var/cache/rpms/kmods/zfs/
-fi
+ln -s / /tmp/buildroot
+dnf install -y /var/cache/rpms/kmods/zfs/*.rpm pv
+modinfo /usr/lib/modules/"${KERNEL}"/extra/zfs/spl.ko
+for module in /usr/lib/modules/"${KERNEL}"/extra/zfs/*.ko*; do
+    module_basename=${module:0:-3}
+    module_suffix=${module: -3}
+    if [[ "$module_suffix" == ".xz" ]]; then
+        xz --decompress "$module"
+        openssl cms -sign -signer "${SIGNING_KEY_1}" -signer "${SIGNING_KEY_2}" -binary -in "$module_basename" -outform DER -out "${module_basename}.cms" -nocerts -noattr -nosmimecap
+        /usr/src/kernels/"${KERNEL}"/scripts/sign-file -s "${module_basename}.cms" sha256 "${PUBLIC_CHAIN}" "${module_basename}"
+        /tmp/dual-sign-check.sh "${KERNEL}" "${module_basename}" "${PUBLIC_CHAIN}"
+        xz -C crc32 -f "${module_basename}"
+    elif [[ "$module_suffix" == ".gz" ]]; then
+        gzip -d "$module"
+        openssl cms -sign -signer "${SIGNING_KEY_1}" -signer "${SIGNING_KEY_2}" -binary -in "$module_basename" -outform DER -out "${module_basename}.cms" -nocerts -noattr -nosmimecap
+        /usr/src/kernels/"${KERNEL}"/scripts/sign-file -s "${module_basename}.cms" sha256 "${PUBLIC_CHAIN}" "${module_basename}"
+        /tmp/dual-sign-check.sh "${KERNEL}" "${module_basename}" "${PUBLIC_CHAIN}"
+        gzip -9f "${module_basename}"
+    else
+        openssl cms -sign -signer "${SIGNING_KEY_1}" -signer "${SIGNING_KEY_2}" -binary -in "$module" -outform DER -out "${module}.cms" -nocerts -noattr -nosmimecap
+        /usr/src/kernels/"${KERNEL}"/scripts/sign-file -s "${module}.cms" sha256 "${PUBLIC_CHAIN}" "${module}"
+        /tmp/dual-sign-check.sh "${KERNEL}" "${module}" "${PUBLIC_CHAIN}"
+    fi
+done
+find /var/cache/rpms/kmods/zfs -type f -name "\kmod-*.rpm" | grep -v debug | grep -v devel
+RPMPATH=$(find /var/cache/rpms/kmods/zfs -type f -name "\kmod-*.rpm" | grep -v debug | grep -v devel)
+RPM=$(basename "${RPMPATH/\.rpm/}")
+rpmrebuild --additional=--buildroot=/tmp/buildroot --batch "${RPM}"
+rm -rf /usr/lib/modules/"${KERNEL}"/extra
+pushd /root/rpmbuild/RPMS/"$(uname -m)"/
+mapfile -t RPMPATHS < <(find . -type f -name "\kmod-*.rpm")
+for RPMPATH in "${RPMPATHS[@]}"; do
+    RPM=$(basename "${RPMPATH/\.rpm/}")
+    if [[ ! "$RPM" =~ ${KERNEL} ]]; then
+        RENAME=${RPM%"$(rpm -q --queryformat="%{VERSION}" kernel)"*}
+        RENAME+=$KERNEL
+        RENAME+=${RPM#*"$(rpm -E %dist)"}
+        RPM_RENAME="$(dirname "$RPMPATH")/$RENAME.rpm"
+        RPM_RENAME="$(dirname "$RPMPATH")/$RENAME.rpm"
+        mv "$RPMPATH" "$RPM_RENAME"
+    fi
+done
+# Reinstall KMODs for initial check that they were signed
+mapfile -t kmods < <(ls -1 ./kmod-*.rpm)
+dnf reinstall -y --allowerasing "${kmods[@]}"
+popd
+for module in /usr/lib/modules/"${KERNEL}"/extra/*/*.ko*; do
+    if ! modinfo "${module}"; then
+        exit 1
+    fi
+done
+mv -f /root/rpmbuild/RPMS/"$(uname -m)"/kmod-*.rpm /var/cache/rpms/kmods/zfs/
--- a/fetch-kernel.sh
+++ b/fetch-kernel.sh
@ -1,12 +1,16 @@
 #!/usr/bin/bash

-set -eoux pipefail
+set "${CI:+-x}" -euo pipefail

 # ensures we pass a known dir for volume mount of output rpm files
-KCWD=${1}
+KCWD=/tmp/kernel-cache
 find "${KCWD}"

+#shellcheck disable=SC2153
+kernel_name="${KERNEL_NAME}"
+#shellcheck disable=SC2153
 kernel_version="${KERNEL_VERSION}"
+#shellcheck disable=SC2153
 kernel_flavor="${KERNEL_FLAVOR}"
 build_tag="${KERNEL_BUILD_TAG:-latest}"

@ -16,64 +20,23 @@ dnf install -y --setopt=install_weak_deps=False dnf-plugins-core openssl
 if [[ "$kernel_flavor" =~ "centos" ]]; then
    CENTOS_VER=$(rpm -E %centos)
    dnf config-manager --set-enabled crb
-    dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-${CENTOS_VER}.noarch.rpm
+    dnf -y install "https://dl.fedoraproject.org/pub/epel/epel-release-latest-${CENTOS_VER}.noarch.rpm"
 fi
 dnf -y install --setopt=install_weak_deps=False rpmrebuild sbsigntools

 case "$kernel_flavor" in
-    "asus")
-        dnf copr enable -y lukenukem/asus-kernel
-        ;;
-    "surface")
-        if [[ "$(rpm -E %fedora)" -lt 41 ]]; then
-            dnf config-manager --add-repo=https://pkg.surfacelinux.com/fedora/linux-surface.repo
-        else
-            dnf config-manager addrepo --from-repofile=https://pkg.surfacelinux.com/fedora/linux-surface.repo
-        fi
-        ;;
-    "coreos-stable")
-        ;;
-    "coreos-testing")
-        ;;
-    "bazzite")
-        ;;
-    "centos")
-        ;;
-    "centos-hsk")
+    "bazzite"|"centos"*|"coreos"*|"main")
        ;;
    "longterm"*)
-        dnf -y copr enable kwizart/kernel-${kernel_flavor}
-        ;;
-    "main")
+        dnf -y copr enable kwizart/kernel-"${kernel_flavor}"
        ;;
    *)
-        echo "unexpected kernel_flavor ${kernel_flavor} for query"
+        echo "unexpected kernel_flavor ${kernel_flavor} for query" >&2
+        exit 1
        ;;
 esac

-if [[ "${kernel_flavor}" =~ asus ]]; then
-    dnf download -y \
-        kernel-"${kernel_version}" \
-        kernel-modules-"${kernel_version}" \
-        kernel-modules-core-"${kernel_version}" \
-        kernel-modules-extra-"${kernel_version}" \
-        kernel-devel-"${kernel_version}" \
-        kernel-devel-matched-"${kernel_version}" \
-        kernel-uki-virt-"${kernel_version}"
-
-elif [[ "${kernel_flavor}" == "surface" ]]; then
-    dnf download -y \
-        kernel-surface-"${kernel_version}" \
-        kernel-surface-modules-"${kernel_version}" \
-        kernel-surface-modules-core-"${kernel_version}" \
-        kernel-surface-modules-extra-"${kernel_version}" \
-        kernel-surface-devel-"${kernel_version}" \
-        kernel-surface-devel-matched-"${kernel_version}" \
-        kernel-surface-default-watchdog-"${kernel_version}" \
-        iptsd \
-        libwacom-surface \
-        libwacom-surface-data
-elif [[ "${kernel_flavor}" == "bazzite" ]]; then
+if [[ "${kernel_flavor}" == "bazzite" ]]; then
    # Using curl for bazzite release
    curl -#fLO https://github.com/bazzite-org/kernel-bazzite/releases/download/"$build_tag"/kernel-"$kernel_version".rpm
    curl -#fLO https://github.com/bazzite-org/kernel-bazzite/releases/download/"$build_tag"/kernel-core-"$kernel_version".rpm
@ -120,6 +83,7 @@ else
    
    # Using curl instead of dnf download for https links
    curl -#fLO https://kojipkgs.fedoraproject.org//packages/kernel/"$KERNEL_MAJOR_MINOR_PATCH"/"$KERNEL_RELEASE"/"$ARCH"/kernel-"$kernel_version".rpm
+    curl -#fLO https://kojipkgs.fedoraproject.org//packages/kernel/"$KERNEL_MAJOR_MINOR_PATCH"/"$KERNEL_RELEASE"/"$ARCH"/kernel-core-"$kernel_version".rpm
    curl -#fLO https://kojipkgs.fedoraproject.org//packages/kernel/"$KERNEL_MAJOR_MINOR_PATCH"/"$KERNEL_RELEASE"/"$ARCH"/kernel-modules-"$kernel_version".rpm
    curl -#fLO https://kojipkgs.fedoraproject.org//packages/kernel/"$KERNEL_MAJOR_MINOR_PATCH"/"$KERNEL_RELEASE"/"$ARCH"/kernel-modules-core-"$kernel_version".rpm
    curl -#fLO https://kojipkgs.fedoraproject.org//packages/kernel/"$KERNEL_MAJOR_MINOR_PATCH"/"$KERNEL_RELEASE"/"$ARCH"/kernel-modules-extra-"$kernel_version".rpm
@ -134,6 +98,8 @@ if [[ ! -s "${KCWD}"/certs/private_key.priv ]]; then
    cp "${KCWD}"/certs/public_key.der{.test,}
 fi

+trap 'rm -rf "${KCWD}/certs" /etc/pki/kernel/private/private_key*.priv /etc/pki/kernel/public/public_key*.crt' EXIT SIGINT
+
 PUBLIC_KEY_PATH="/etc/pki/kernel/public/public_key.crt"
 PRIVATE_KEY_PATH="/etc/pki/kernel/private/private_key.priv"

@ -143,49 +109,12 @@ install -Dm644 "${KCWD}"/certs/public_key.crt "$PUBLIC_KEY_PATH"
 install -Dm644 "${KCWD}"/certs/private_key.priv "$PRIVATE_KEY_PATH"

 ls -la /
-if [[ "${kernel_flavor}" =~ asus ]]; then
-    dnf install -y \
-        /kernel-"$kernel_version".rpm \
-        /kernel-modules-"$kernel_version".rpm \
-        /kernel-modules-core-"$kernel_version".rpm \
-        /kernel-modules-extra-"$kernel_version".rpm \
-        kernel-core-"${kernel_version}"
-elif [[ "${kernel_flavor}" =~ surface ]]; then
-    dnf install -y \
-        /kernel-surface-"$kernel_version".rpm \
-        /kernel-surface-modules-"$kernel_version".rpm \
-        /kernel-surface-modules-core-"$kernel_version".rpm \
-        /kernel-surface-modules-extra-"$kernel_version".rpm \
-        kernel-surface-core-"${kernel_version}"
-elif [[ "${kernel_flavor}" == "bazzite" ]]; then
-    dnf install -y \
-        /kernel-"$kernel_version".rpm \
-        /kernel-core-"$kernel_version".rpm \
-        /kernel-modules-"$kernel_version".rpm \
-        /kernel-modules-core-"$kernel_version".rpm \
-        /kernel-modules-extra-"$kernel_version".rpm
-elif [[ "${kernel_flavor}" =~ "centos" ]]; then
-    dnf install -y \
-        /kernel-"$kernel_version".rpm \
-        /kernel-core-"$kernel_version".rpm \
-        /kernel-modules-"$kernel_version".rpm \
-        /kernel-modules-core-"$kernel_version".rpm \
-        /kernel-modules-extra-"$kernel_version".rpm
-elif [[ "${kernel_flavor}" =~ "longterm" ]]; then
-    dnf install -y \
-        /kernel-longterm-"$kernel_version".rpm \
-        /kernel-longterm-core-"$kernel_version".rpm \
-        /kernel-longterm-modules-"$kernel_version".rpm \
-        /kernel-longterm-modules-core-"$kernel_version".rpm \
-        /kernel-longterm-modules-extra-"$kernel_version".rpm
-else
-    dnf install -y \
-        /kernel-"$kernel_version".rpm \
-        /kernel-modules-"$kernel_version".rpm \
-        /kernel-modules-core-"$kernel_version".rpm \
-        /kernel-modules-extra-"$kernel_version".rpm \
-        https://kojipkgs.fedoraproject.org//packages/kernel/"$KERNEL_MAJOR_MINOR_PATCH"/"$KERNEL_RELEASE"/"$ARCH"/kernel-core-"$kernel_version".rpm
-fi
+dnf install -y \
+    /"${kernel_name}-$kernel_version.rpm" \
+    /"${kernel_name}-core-$kernel_version.rpm" \
+    /"${kernel_name}-modules-$kernel_version.rpm" \
+    /"${kernel_name}-modules-core-$kernel_version.rpm" \
+    /"${kernel_name}-modules-extra-$kernel_version.rpm"

 # Strip Signatures from non-fedora Kernels
 if [[ ${kernel_flavor} =~ main|coreos|centos ]]; then
@ -205,8 +134,11 @@ sbsign --cert "$PUBLIC_KEY_PATH" --key "$PRIVATE_KEY_PATH" /usr/lib/modules/"${k

 # Verify Signatures
 sbverify --list /usr/lib/modules/"${kernel_version}"/vmlinuz
+if ! sbverify --cert "$PUBLIC_KEY_PATH" /usr/lib/modules/"${kernel_version}"/vmlinuz; then
+    exit 1
+fi

-rm -f "$PRIVATE_KEY_PATH" "$PUBLIC_KEY_PATH"
+rm -f "$PRIVATE_KEY_PATH"

 if [[ ${DUAL_SIGN:-} == "true" ]]; then
    SECOND_PUBLIC_KEY_PATH="/etc/pki/kernel/public/public_key_2.crt"
@ -222,46 +154,29 @@ if [[ ${DUAL_SIGN:-} == "true" ]]; then
    install -Dm644 "${KCWD}"/certs/private_key_2.priv "$SECOND_PRIVATE_KEY_PATH"
    sbsign --cert "$SECOND_PUBLIC_KEY_PATH" --key "$SECOND_PRIVATE_KEY_PATH" /usr/lib/modules/"${kernel_version}"/vmlinuz --output /usr/lib/modules/"${kernel_version}"/vmlinuz
    sbverify --list /usr/lib/modules/"${kernel_version}"/vmlinuz
-    rm -f "$SECOND_PRIVATE_KEY_PATH" "$SECOND_PUBLIC_KEY_PATH"
+    if ! sbverify --cert "$SECOND_PUBLIC_KEY_PATH" /usr/lib/modules/"${kernel_version}"/vmlinuz; then
+        exit 1
+    fi
+    rm -f "$SECOND_PRIVATE_KEY_PATH"
 fi

 ln -s / /tmp/buildroot

 # Rebuild RPMs and Verify
-if [[ "${kernel_flavor}" =~ surface ]]; then
-    rpmrebuild --additional=--buildroot=/tmp/buildroot --batch kernel-surface-core-"${kernel_version}"
-    rm -f /usr/lib/modules/"${kernel_version}"/vmlinuz
-    dnf reinstall -y \
-        /kernel-surface-"$kernel_version".rpm \
-        /kernel-surface-modules-"$kernel_version".rpm \
-        /kernel-surface-modules-core-"$kernel_version".rpm \
-        /kernel-surface-modules-extra-"$kernel_version".rpm \
-        /root/rpmbuild/RPMS/"$(uname -m)"/kernel-*.rpm
-elif [[ "${kernel_flavor}" =~ longterm ]]; then
-    rpmrebuild --additional=--buildroot=/tmp/buildroot --batch kernel-longterm-core-"${kernel_version}"
-    rm -f /usr/lib/modules/"${kernel_version}"/vmlinuz
-    find /tmp
-    find /root
-    dnf reinstall -y \
-        /kernel-longterm-"$kernel_version".rpm \
-        /kernel-longterm-modules-"$kernel_version".rpm \
-        /kernel-longterm-modules-core-"$kernel_version".rpm \
-        /kernel-longterm-modules-extra-"$kernel_version".rpm \
-        /root/rpmbuild/RPMS/"$(uname -m)"/kernel-*.rpm
-else
-    rpmrebuild --additional=--buildroot=/tmp/buildroot --batch kernel-core-"${kernel_version}"
-    rm -f /usr/lib/modules/"${kernel_version}"/vmlinuz
-    find /tmp
-    find /root
-    dnf reinstall -y \
-        /kernel-"$kernel_version".rpm \
-        /kernel-modules-"$kernel_version".rpm \
-        /kernel-modules-core-"$kernel_version".rpm \
-        /kernel-modules-extra-"$kernel_version".rpm \
-        /root/rpmbuild/RPMS/"$(uname -m)"/kernel-*.rpm
-fi
+rpmrebuild --additional=--buildroot=/tmp/buildroot --batch "${kernel_name}-core-${kernel_version}"
+rm -f /usr/lib/modules/"${kernel_version}"/vmlinuz
+find /tmp
+find /root
+dnf reinstall -y /root/rpmbuild/RPMS/"$(uname -m)"/kernel-*.rpm

+# Verify Again
 sbverify --list /usr/lib/modules/"${kernel_version}"/vmlinuz
+if ! sbverify --cert "$PUBLIC_KEY_PATH" /usr/lib/modules/"${kernel_version}"/vmlinuz; then
+    exit 1
+fi
+if [[ "${DUAL_SIGN:-}" == "true" ]] && ! sbverify --cert "${SECOND_PUBLIC_KEY_PATH:-}" /usr/lib/modules/"${kernel_version}"/vmlinuz; then
+    exit 1
+fi

 # Make Temp Dir
 mkdir -p "${KCWD}"/rpms
@ -272,9 +187,5 @@ if [ -d /root/rpmbuild/RPMS/"$(uname -m)" ]; then
  mv /root/rpmbuild/RPMS/"$(uname -m)"/kernel-*.rpm "${KCWD}"/rpms
 fi

-if [[ "${kernel_flavor}" =~ surface ]]; then
-    cp iptsd-*.rpm libwacom-*.rpm "${KCWD}"/rpms
-fi
-
 # Delete keys in /tmp if we decide to publish this later
 rm -rf "${KCWD}"/certs
--- a/images.yaml
+++ b/images.yaml
@ -0,0 +1,103 @@
+---
+defaults:
+  kernel_flavor: main
+  version: 42
+  akmods_target: common
+
+akmods-base: &akmods-base
+  org: ublue-os
+  registry: ghcr.io
+  repo: akmods
+  transport: docker://
+
+akmods-common: &akmods-common
+  name: akmods
+  description: "A caching layer for pre-built akmod RPMs"
+
+akmods-extra: &akmods-extra
+  name: akmods-extra
+  description: "A caching layer for extra pre-built akmod RPMs"
+
+akmods-nvidia: &akmods-nvidia
+  name: akmods-nvidia
+  description: "A caching layer for the pre-built nvidia akmod RPMs"
+
+akmods-nvidia-open: &akmods-nvidia-open
+  name: akmods-nvidia-open
+  description: "A caching layer for the pre-built nvidia-open akmod RPMs"
+
+akmods-zfs: &akmods-zfs
+  name: akmods-zfs
+  description: "A caching layer for the pre-built zfs akmod RPMs"
+
+desktop-build-group: &desktop-build-group
+  common:
+    !!merge <<:
+      - *akmods-base
+      - *akmods-common
+  nvidia:
+    !!merge <<:
+      - *akmods-base
+      - *akmods-nvidia
+  nvidia-open:
+    !!merge <<:
+      - *akmods-base
+      - *akmods-nvidia
+    
+server-build-group: &server-build-group
+  nvidia:
+    !!merge <<:
+      - *akmods-base
+      - *akmods-nvidia
+  nvidia-open:
+    !!merge <<:
+      - *akmods-base
+      - *akmods-nvidia
+  zfs:
+    !!merge <<:
+      - *akmods-base
+      - *akmods-zfs
+
+images:
+  10:
+    centos:
+      !!merge <<:
+        - *server-build-group
+    centos-hsk:
+      !!merge <<:
+        - *server-build-group
+  41:
+    main:
+      !!merge <<:
+        - *desktop-build-group
+    coreos-stable:
+      !!merge <<:
+        - *desktop-build-group
+        - *server-build-group
+    coreos-testing:
+      !!merge <<:
+        - *desktop-build-group
+        - *server-build-group
+  42:
+    bazzite:
+      !!merge <<:
+        - *desktop-build-group
+      extra:
+        !!merge <<:
+          - *akmods-base
+          - *akmods-extra
+    main:
+      !!merge <<:
+        - *desktop-build-group
+    coreos-stable:
+      !!merge <<:
+        - *desktop-build-group
+        - *server-build-group
+    coreos-testing:
+      !!merge <<:
+        - *desktop-build-group
+        - *server-build-group
+    "longterm-6.12":
+      !!merge <<:
+        - *desktop-build-group
+        - *server-build-group
--- a/workflow-templates/cache_kernel.yaml.in
+++ b/workflow-templates/cache_kernel.yaml.in
@ -0,0 +1,11 @@
+  cache_kernel_%%KERNEL_FLAVOR_CLEAN%%_%%VERSION%%:
+    name: Cache %%KERNEL_FLAVOR%% (%%VERSION%%)
+    uses: ./.github/workflows/reusable-cache-kernel.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    with:
+      kernel_flavor: %%KERNEL_FLAVOR%%
+      version: %%VERSION%%
--- a/workflow-templates/job.yaml.in
+++ b/workflow-templates/job.yaml.in
@ -0,0 +1,14 @@
+  build-%%KERNEL_FLAVOR_CLEAN%%_%%VERSION%%_%%AKMODS_TARGET%%:
+    name: Build %%AKMODS_TARGET%% %%KERNEL_FLAVOR%% (%%VERSION%%)
+    uses: ./.github/workflows/reusable-build.yml
+    secrets: inherit
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    needs: cache_kernel_%%KERNEL_FLAVOR_CLEAN%%_%%VERSION%%
+    with:
+      version: %%VERSION%%
+      kernel_flavor: %%KERNEL_FLAVOR%%
+      akmods_target: %%AKMODS_TARGET%%
+      kernel_cache_key: ${{ needs.cache_kernel_%%KERNEL_FLAVOR_CLEAN%%_%%VERSION%%.outputs.KCKEY }}
--- a/workflow-templates/workflow.yaml.in
+++ b/workflow-templates/workflow.yaml.in
@ -0,0 +1,11 @@
+name: Build AKMODs
+on:
+  merge_group:
+  pull_request:
+    branches:
+      - main
+    paths-ignore:
+      - '**.md'
+  schedule:
+    - cron: '05 0 * * *'  # 0005 UTC everyday
+  workflow_dispatch: