From 8e851406d0aa571553e36356bd63a8f17adcac9c Mon Sep 17 00:00:00 2001
From: veilor <veilor@localhost>
Date: Thu, 30 Apr 2026 11:16:30 +0100
Subject: [PATCH] ks: includepkgs on updates repo
 (selinux-policy/pcre2/libselinux only) + cost=10

---
 kickstart/veilor-os.ks | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/kickstart/veilor-os.ks b/kickstart/veilor-os.ks
index 2ae0ec1..992060d 100644
--- a/kickstart/veilor-os.ks
+++ b/kickstart/veilor-os.ks
@@ -8,11 +8,11 @@
 # base Fedora 43 ships selinux-policy 42.12 with pcre2-10.47-built
 # file_contexts.bin, which fails chroot %triggerin against host's
 # libselinux (built against pcre2 10.46). 43.7 in updates is rebuilt.
-# Use updates as primary install source — base 42.12 selinux-policy
-# ships file_contexts.bin compiled with pcre2 10.47 but base ships
-# pcre2 10.46 (Fedora packaging bug). Updates 43.7 has matched pair.
-url --mirrorlist="https://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f43&arch=x86_64"
-repo --name=fedora --mirrorlist="https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64" --install
+# Base provides install tree metadata. Updates pulled only for
+# selinux-policy + pcre2 (the version-skew chokepoint) via includepkgs.
+# Cost=10 forces updates to win for the listed packages.
+url --mirrorlist="https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64"
+repo --name=updates --mirrorlist="https://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f43&arch=x86_64" --install --cost=10 --includepkgs=selinux-policy,selinux-policy-targeted,selinux-policy-devel,libselinux,libselinux-utils,python3-libselinux,pcre2,pcre2-syntax,pcre2-utf16,pcre2-utf32
 
 # ── Locale / keyboard / time (template — adjust per build) ──
 keyboard --xlayouts='us'