Of course, everyone's favourite tool to build secure Linux images with dm-verity, TPM, SecureBoot is mkosi by @daandemeyer and others. It now is learning a new trick: support for AzureLinux (ex CBL Mariner) – in addition to the other 12 supported distributions.
And that's really great, because this means I can finally quickly test the stuff I am working on within the systemd project on my own company's Linux distribution, the same way I test other distributions.
Yay!