feat(images): add 1p-vm-base-gen1-fips image

[binujp]

Summary

• add the Azure Linux 4.0 1P VM Base Gen1 FIPS BIOS image
• enable FIPS through the kernel command line and dracut-fips
• use package-provided cloud-init, chrony/PTP, and Hyper-V configuration
• remove all KIWI file injections and their loose configuration files
• use systemd-networkd without netplan or post-install config.sh customization

Testing

• built with azldev image build 1p-vm-base-gen1-fips --arch x86_64
• passed azldev image test 1p-vm-base-gen1-fips (9 passed, 7 skipped)

AB#22819

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Dan Streetman (ddstreetmicrosoft)]

issue(blocking): I have the same concerns here as in the other PR: #18468 (review)

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Suppressed comments (4)

base/images/1p-vm-base-gen1-fips/1p-vm-base-gen1-fips.kiwi:41

• Local image builds should use the azl4-dev blob, while the installed azurelinux-repos package controls the runtime PMC-beta source. Every existing KIWI definition follows this split (for example, base/images/vm-base/vm-base.kiwi:83-92), and base/images/images.toml:21-23 documents that Koji overrides the build repository. Pointing the build directly at PMC beta makes local validation consume stale published packages rather than current distro inputs.

        <source path="https://packages.microsoft.com/azurelinux/4.0/beta/base/$basearch" />

base/images/images.toml:100

• This package-managed image is missing the required canonical/-dev pair documented at base/images/images.toml:5-27; all existing non-distroless images use profiles to select azurelinux-repos versus azurelinux-repos-dev. Add a 1p-vm-base-gen1-fips-dev registry entry and matching KIWI profiles/package sections so development builds do not boot with production repository configuration.

[images.1p-vm-base-gen1-fips]
description = "1P VM Base Gen1 FIPS Image (BIOS)"
definition = { type = "kiwi", path = "1p-vm-base-gen1-fips/1p-vm-base-gen1-fips.kiwi" }

base/images/1p-vm-base-gen1-fips/1p-vm-base-gen1-fips.kiwi:130

• Remove the unmatched closing parenthesis in this comment.

        <!-- Hyper-V via kernel-modules + hyperv-daemons) -->

base/images/images.toml:103

• Only offline filesystem checks are registered, so the reported image test cannot verify the two defining runtime behaviors: booting as an Azure Gen1 VM and entering FIPS mode. The comparable vm-base entry registers LISA boot suites (base/images/images.toml:35-42). Add an appropriate boot/runtime suite and a FIPS assertion (for example, checking /proc/sys/crypto/fips_enabled) before relying on this image.

tests.test-suites = [
  { name = "static-image-checks" },
]