Update the virt feature

mkosi.images/base/mkosi.extra/usr/lib/systemd/system/systemd-sysext.service.d/10_run_sysusers.conf

@@ -0,0 +1,5 @@
+# systemd-sysusers.service runs before local file systems are mounted, so it never
+# gets sysusers.d files shipped in extensions. Run it again once they are merged.
+[Service]
+ExecStartPost=systemd-sysusers
+ExecReload=systemd-sysusers

mkosi.images/ext-virt/mkosi.conf

@@ -11,11 +11,25 @@ CompressOutput=zstd
 [Content]
 Bootable=no
 BaseTrees=%O/base_%v
+WithRecommends=yes
+RemovePackages=
+    virt-manager
 Packages=
+    qemu-system-gui
     qemu-system-x86
     qemu-system-arm
+    qemu-system-riscv
+    qemu-system-modules-opengl
+    qemu-system-modules-spice
+    qemu-system-misc
+    qemu-utils
     libvirt-daemon-system
     libvirt-clients
-    virt-manager
+    libspice-server1
+    libvirglrenderer1
+    virgl-server
+    spice-html5
     bridge-utils
+    ovmf
+    qemu-efi-aarch64
     virtinst

mkosi.images/ext-virt/mkosi.extra/usr/lib/systemd/system/libvirt-guests.service.d/10_libvirtd.conf

@@ -0,0 +1,6 @@
+# Start libvirtd once at boot so autostart networks and guests come up. Upholding
+# libvirtd.service directly would restart it whenever it exits idle. After= also
+# shuts guests down before libvirtd stops.
+[Unit]
+Wants=libvirtd.service
+After=libvirtd.service

mkosi.images/ext-virt/mkosi.extra/usr/lib/systemd/system/multi-user.target.d/10_libvirtd.conf

@@ -0,0 +1,4 @@
+# Extensions are merged after the boot transaction is built, so a .wants symlink
+# never starts these. Upholds= is re-checked after the service manager reloads.
+[Unit]
+Upholds=libvirtd.socket libvirtd-ro.socket libvirtd-admin.socket libvirt-guests.service

mkosi.images/ext-virt/mkosi.extra/usr/lib/sysusers.d/libvirt-dnsmasq.conf

@@ -0,0 +1,4 @@
+# Ubuntu creates this user in libvirt-daemon-config-network's postinst rather than
+# sysusers.d, and maintainer scripts don't run for extensions.
+# Type  Name             ID  GECOS              Home directory
+u       libvirt-dnsmasq  -   "Libvirt Dnsmasq"  /var/lib/libvirt/dnsmasq

mkosi.images/ext-virt/mkosi.extra/usr/lib/tmpfiles.d/libvirt.conf

@@ -0,0 +1,9 @@
+# Type  Path                         Mode  User          Group         Age  Argument
+d       /var/lib/libvirt/images      0711  root          root          -    -
+d       /var/lib/libvirt/qemu        0750  libvirt-qemu  kvm           -    -
+d       /var/cache/libvirt/qemu      0750  libvirt-qemu  kvm           -    -
+d       /var/log/libvirt/qemu        0750  root          libvirt-qemu  -    -
+d       /etc/mdevctl.d/              0750  root          root          -    -
+# Enable default NAT network
+C       /etc/libvirt/qemu/networks/default.xml - - - - /usr/share/libvirt/networks/default.xml
+L       /etc/libvirt/qemu/networks/autostart/default.xml - - - - /etc/libvirt/qemu/networks/default.xml

mkosi.images/ext-virt/mkosi.finalize

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Reload the service manager once this extension is merged so the units it ships
+# get loaded. mkosi names the file after the image version, hence the glob.
+release=("$BUILDROOT"/usr/lib/extension-release.d/extension-release.*)
+if [[ ${#release[@]} -ne 1 || ! -f ${release[0]} ]]; then
+    echo "Expected one extension-release file, found: ${release[*]}" >&2
+    exit 1
+fi
+echo "EXTENSION_RELOAD_MANAGER=1" >> "${release[0]}"
+
+# mkosi removes empty directories from extensions, but mdevctl won't run without
+# its callout and notifier directories.
+mkdir -p "$BUILDROOT"/usr/lib/mdevctl/scripts.d/{callouts,notifiers}