diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index f25e619..19f9851 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
 
     outputs:
-      distros: ${{ steps.set-matrix.outputs.distros }}
+      matrix: ${{ steps.set-matrix.outputs.matrix }}
 
     steps:
       - uses: actions/checkout@v7
@@ -23,9 +23,11 @@ jobs:
           DISTROS=$(find . -maxdepth 1 -name '*.docker.m4' \
             | sed 's|^\./||' \
             | sed 's|\.docker\.m4$||' \
+            | grep -Ev '(-dev|-pkcs11)$' \
             | jq -R -s -c 'split("\n")[:-1]')
 
-          echo "distros=$DISTROS" >> $GITHUB_OUTPUT
+          MATRIX=$(jq -cn --argjson distros "$DISTROS" '{distro: $distros}')
+          echo "matrix=$MATRIX" >> $GITHUB_OUTPUT
 
   build-image:
     name: Build Docker Images
@@ -33,8 +35,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
-      matrix:
-        distro: ${{ fromJson(needs.generate-matrix.outputs.distros) }}
+      matrix: ${{ fromJson(needs.generate-matrix.outputs.matrix) }}
     steps:
       -
         name: Check out the repo
@@ -47,6 +48,8 @@ jobs:
           filters: |
             build:
               - ${{ matrix.distro }}.docker.m4
+              - ${{ matrix.distro }}-dev.docker.m4
+              - ${{ matrix.distro }}-pkcs11.docker.m4
               - modules/*
       -
         name: Build the Dockerfiles
@@ -68,3 +71,19 @@ jobs:
           context: .
           file: ./${{ matrix.distro }}.docker
         if: steps.changes.outputs.build == 'true'
+      -
+        name: Build Docker Images (-dev)
+        uses: docker/build-push-action@v7
+        with:
+          push: false
+          context: .
+          file: ./${{ matrix.distro }}-dev.docker
+        if: steps.changes.outputs.build == 'true' && hashFiles(format('{0}-dev.docker.m4', matrix.distro)) != ''
+      -
+        name: Build Docker Images (-pkcs11)
+        uses: docker/build-push-action@v7
+        with:
+          push: false
+          context: .
+          file: ./${{ matrix.distro }}-pkcs11.docker
+        if: steps.changes.outputs.build == 'true' && hashFiles(format('{0}-pkcs11.docker.m4', matrix.distro)) != ''
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index e0667ae..f4bb8b4 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
 
     outputs:
-      distros: ${{ steps.set-matrix.outputs.distros }}
+      matrix: ${{ steps.set-matrix.outputs.matrix }}
 
     steps:
       - uses: actions/checkout@v7
@@ -24,9 +24,11 @@ jobs:
           DISTROS=$(find . -maxdepth 1 -name '*.docker.m4' \
             | sed 's|^\./||' \
             | sed 's|\.docker\.m4$||' \
+            | grep -Ev '(-dev|-pkcs11)$' \
             | jq -R -s -c 'split("\n")[:-1]')
 
-          echo "distros=$DISTROS" >> $GITHUB_OUTPUT
+          MATRIX=$(jq -cn --argjson distros "$DISTROS" '{distro: $distros}')
+          echo "matrix=$MATRIX" >> $GITHUB_OUTPUT
 
   publish-image:
     name: Publish Docker Images
@@ -34,8 +36,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
-      matrix:
-        distro: ${{ fromJson(needs.generate-matrix.outputs.distros) }}
+      matrix: ${{ fromJson(needs.generate-matrix.outputs.matrix) }}
 
     if: "github.repository_owner == 'tpm2-software'"
     steps:
@@ -50,6 +51,8 @@ jobs:
           filters: |
             build:
               - ${{ matrix.distro }}.docker.m4
+              - ${{ matrix.distro }}-dev.docker.m4
+              - ${{ matrix.distro }}-pkcs11.docker.m4
               - modules/*
       -
         name: Build the Dockerfiles
@@ -80,3 +83,21 @@ jobs:
           file: ./${{ matrix.distro }}.docker
           tags: ghcr.io/${{ github.repository_owner }}/${{ matrix.distro }}:latest
         if: steps.changes.outputs.build == 'true'
+      -
+        name: Push -dev to GitHub Packages
+        uses: docker/build-push-action@v7
+        with:
+          push: 'true'
+          context: .
+          file: ./${{ matrix.distro }}-dev.docker
+          tags: ghcr.io/${{ github.repository_owner }}/${{ matrix.distro }}-dev:latest
+        if: steps.changes.outputs.build == 'true' && hashFiles(format('{0}-dev.docker.m4', matrix.distro)) != ''
+      -
+        name: Push -pkcs11 to GitHub Packages
+        uses: docker/build-push-action@v7
+        with:
+          push: 'true'
+          context: .
+          file: ./${{ matrix.distro }}-pkcs11.docker
+          tags: ghcr.io/${{ github.repository_owner }}/${{ matrix.distro }}-pkcs11:latest
+        if: steps.changes.outputs.build == 'true' && hashFiles(format('{0}-pkcs11.docker.m4', matrix.distro)) != ''
diff --git a/README.md b/README.md
index 610b718..26c510f 100644
--- a/README.md
+++ b/README.md
@@ -53,3 +53,19 @@ docker run -it --rm ghcr.io/tpm2-software/fedora-32 /bin/bash
 # With Podman
 podman run -it --rm ghcr.io/tpm2-software/fedora-32 /bin/bash
 ```
+
+## Structure
+
+Standard distro/version images have profile-tag variants using the same base name:
+
+- `<distro>-<version>-dev`
+- `<distro>-<version>-pkcs11`
+
+This intentionally excludes architecture-specific tags and specialized images such as
+`*-mbedtls-*`, which remain single-purpose variants.
+
+Profile intent:
+
+- base tag (`<distro>-<version>`): lean/default CI dependencies
+- dev tag (`<distro>-<version>-dev`): base plus development/tooling extras
+- pkcs11 tag (`<distro>-<version>-pkcs11`): dev plus pkcs11/python/java extras
diff --git a/alpine-3.19.docker.m4 b/alpine-3.19.docker.m4
deleted file mode 100644
index e287e66..0000000
--- a/alpine-3.19.docker.m4
+++ /dev/null
@@ -1,68 +0,0 @@
-# Alpine 3.19 Dockerfile
-FROM alpine:3.19
-
-LABEL org.opencontainers.image.source https://github.com/tpm2-software/tpm2-software-container
-
-RUN apk update && \
-    apk upgrade && \
-    apk add \
-    autoconf-archive \
-    bash \
-    cmocka-dev \
-    net-tools \
-    make \
-    git \
-    gcc \
-    g++ \
-    m4 \
-    libtool \
-    automake \
-    autoconf \
-    wget \
-    doxygen \
-    dbus-dev \
-    glib-dev \
-    clang \
-    clang-analyzer \
-    clang-extra-tools \
-    json-c-dev  \
-    iproute2 \
-    coreutils \
-    uthash-dev \
-    curl-dev \
-    python3-dev \
-    py3-yaml \
-    perl-utils \
-    openssl \
-    openssl-dev \
-    acl \
-    xxd \
-    grep \
-    dbus \
-    vim \
-    dbus-x11 \
-    procps \
-    libtasn1-dev \
-    json-glib-dev \
-    gnutls-dev \
-    expect \
-    socat \
-    libseccomp-dev \
-    gawk \
-    gzip \
-    yaml-dev \
-    nss-tools \
-    opensc \
-    openjdk17-jdk \
-    openjdk17-jre \
-    libusb-dev \
-    libftdi1-dev
-
-include(`autoconf.m4')
-include(`ibmtpm1682.m4')
-include(`swtpm.m4')
-
-WORKDIR /
-
-
-    
diff --git a/alpine-3.23-dev.docker.m4 b/alpine-3.23-dev.docker.m4
new file mode 100644
index 0000000..2279244
--- /dev/null
+++ b/alpine-3.23-dev.docker.m4
@@ -0,0 +1,4 @@
+# Alpine 3.23 Dockerfile
+include(`alpine-3.23.docker.m4')
+
+include(`alpine_dev_extras.m4')
diff --git a/alpine-3.23-pkcs11.docker.m4 b/alpine-3.23-pkcs11.docker.m4
new file mode 100644
index 0000000..dc8623b
--- /dev/null
+++ b/alpine-3.23-pkcs11.docker.m4
@@ -0,0 +1,5 @@
+# Alpine 3.23 Dockerfile
+include(`alpine-3.23-dev.docker.m4')
+
+include(`alpine_pkcs11_extras.m4')
+include(`junit.m4')
diff --git a/alpine-3.23.docker.m4 b/alpine-3.23.docker.m4
new file mode 100644
index 0000000..6f7c341
--- /dev/null
+++ b/alpine-3.23.docker.m4
@@ -0,0 +1,11 @@
+# Alpine 3.23 Dockerfile
+FROM alpine:3.23
+
+LABEL org.opencontainers.image.source="https://github.com/tpm2-software/tpm2-software-container"
+
+include(`alpine_base_deps.m4')
+
+include(`ibmtpm1682.m4')
+include(`swtpm.m4')
+
+WORKDIR /
diff --git a/alpine-3.24-dev.docker.m4 b/alpine-3.24-dev.docker.m4
new file mode 100644
index 0000000..fd93f97
--- /dev/null
+++ b/alpine-3.24-dev.docker.m4
@@ -0,0 +1,4 @@
+# Alpine 3.24 Dockerfile
+include(`alpine-3.24.docker.m4')
+
+include(`alpine_dev_extras.m4')
diff --git a/alpine-3.24-pkcs11.docker.m4 b/alpine-3.24-pkcs11.docker.m4
new file mode 100644
index 0000000..7255a92
--- /dev/null
+++ b/alpine-3.24-pkcs11.docker.m4
@@ -0,0 +1,5 @@
+# Alpine 3.24 Dockerfile
+include(`alpine-3.24-dev.docker.m4')
+
+include(`alpine_pkcs11_extras.m4')
+include(`junit.m4')
diff --git a/alpine-3.24.docker.m4 b/alpine-3.24.docker.m4
new file mode 100644
index 0000000..31da09f
--- /dev/null
+++ b/alpine-3.24.docker.m4
@@ -0,0 +1,11 @@
+# Alpine 3.24 Dockerfile
+FROM alpine:3.24
+
+LABEL org.opencontainers.image.source="https://github.com/tpm2-software/tpm2-software-container"
+
+include(`alpine_base_deps.m4')
+
+include(`ibmtpm1682.m4')
+include(`swtpm.m4')
+
+WORKDIR /
diff --git a/arch-linux-dev.docker.m4 b/arch-linux-dev.docker.m4
new file mode 100644
index 0000000..c397909
--- /dev/null
+++ b/arch-linux-dev.docker.m4
@@ -0,0 +1,4 @@
+# Arch Linux Dockerfile
+include(`arch-linux.docker.m4')
+
+include(`arch_linux_dev_extras.m4')
diff --git a/arch-linux-pkcs11.docker.m4 b/arch-linux-pkcs11.docker.m4
new file mode 100644
index 0000000..8f2deb2
--- /dev/null
+++ b/arch-linux-pkcs11.docker.m4
@@ -0,0 +1,5 @@
+# Arch Linux Dockerfile
+include(`arch-linux-dev.docker.m4')
+
+include(`arch_linux_pkcs11_extras.m4')
+include(`junit.m4')
diff --git a/arch-linux.docker.m4 b/arch-linux.docker.m4
index f4d6283..e93d4e3 100644
--- a/arch-linux.docker.m4
+++ b/arch-linux.docker.m4
@@ -1,45 +1,9 @@
-# Alpine 3.19 Dockerfile
+# Arch Linux Dockerfile
 FROM archlinux:latest
 
 LABEL org.opencontainers.image.source=https://github.com/tpm2-software/tpm2-software-container
 
-RUN pacman -Sy --noconfirm archlinux-keyring 
-RUN pacman -Syu --noconfirm
-RUN pacman -S --noconfirm base base-devel
-RUN pacman -Scc --noconfirm
-RUN pacman -Sy --noconfirm \
-    autoconf-archive \
-    cmocka \
-    procps \
-    iproute2 \
-    git \
-    pkg-config \
-    gcc \
-    libtool \
-    automake \
-    openssl \
-    uthash \
-    autoconf \
-    doxygen \
-    json-c \
-    curl \
-    util-linux \
-    libltdl \
-    libusb \
-    libftdi \
-    swtpm \
-    pkgfile \
-    glib2 \
-    glib2-devel \
-    python-yaml \
-    xxd \
-    expect \
-    perl \
-    pandoc \
-    lcov \
-    wget
-RUN ln -s /usr/bin/core_perl/shasum /usr/bin/
+include(`arch_linux_base_deps.m4')
 include(`ibmtpm1682.m4')
 
 WORKDIR /
- 
diff --git a/centos-stream10-dev.docker.m4 b/centos-stream10-dev.docker.m4
new file mode 100644
index 0000000..9745af0
--- /dev/null
+++ b/centos-stream10-dev.docker.m4
@@ -0,0 +1,3 @@
+include(`centos-stream10.docker.m4')
+
+include(`centos_dev_extras.m4')
diff --git a/centos-stream10-pkcs11.docker.m4 b/centos-stream10-pkcs11.docker.m4
new file mode 100644
index 0000000..1592925
--- /dev/null
+++ b/centos-stream10-pkcs11.docker.m4
@@ -0,0 +1,5 @@
+include(`centos-stream10-dev.docker.m4')
+
+include(`centos_pkcs11_extras.m4')
+
+ENV CLASSPATH=/usr/share/java/hamcrest/hamcrest.jar:/usr/share/java/junit.jar
diff --git a/centos-stream10.docker.m4 b/centos-stream10.docker.m4
new file mode 100644
index 0000000..373e379
--- /dev/null
+++ b/centos-stream10.docker.m4
@@ -0,0 +1,17 @@
+FROM quay.io/centos/centos:stream10
+
+LABEL org.opencontainers.image.source="https://github.com/tpm2-software/tpm2-software-container"
+
+define(`CENTOS_JAVA', `java-21-openjdk java-21-openjdk-devel')dnl
+define(`CENTOS_LIBUSB_DEVEL', `libusb1-devel')dnl
+define(`CENTOS_OPENSSL_PKCS11', `')dnl
+include(`centos_base_deps.m4')
+include(`ibmtpm1682.m4')
+include(`swtpm.m4')
+
+# make install goes into /usr/local/lib/pkgconfig which is non-standard
+# Set this so ./configure can find things and we don't have to worry about prefix changes
+# to build instructions
+ENV PKG_CONFIG_PATH=/usr/local/lib/pkgconfig
+
+WORKDIR /
diff --git a/centos-stream9-dev.docker.m4 b/centos-stream9-dev.docker.m4
new file mode 100644
index 0000000..aa39a60
--- /dev/null
+++ b/centos-stream9-dev.docker.m4
@@ -0,0 +1,3 @@
+include(`centos-stream9.docker.m4')
+
+include(`centos_dev_extras.m4')
diff --git a/centos-stream9-pkcs11.docker.m4 b/centos-stream9-pkcs11.docker.m4
new file mode 100644
index 0000000..055c9d1
--- /dev/null
+++ b/centos-stream9-pkcs11.docker.m4
@@ -0,0 +1,5 @@
+include(`centos-stream9-dev.docker.m4')
+
+include(`centos_pkcs11_extras.m4')
+
+ENV CLASSPATH=/usr/share/java/hamcrest/hamcrest.jar:/usr/share/java/junit.jar
diff --git a/centos-stream9.docker.m4 b/centos-stream9.docker.m4
new file mode 100644
index 0000000..c1ecb2a
--- /dev/null
+++ b/centos-stream9.docker.m4
@@ -0,0 +1,17 @@
+FROM quay.io/centos/centos:stream9
+
+LABEL org.opencontainers.image.source="https://github.com/tpm2-software/tpm2-software-container"
+
+define(`CENTOS_JAVA', `java-17-openjdk java-17-openjdk-devel')dnl
+define(`CENTOS_LIBUSB_DEVEL', `libusb-devel')dnl
+define(`CENTOS_OPENSSL_PKCS11', `openssl-pkcs11')dnl
+include(`centos_base_deps.m4')
+include(`ibmtpm1682.m4')
+include(`swtpm.m4')
+
+# make install goes into /usr/local/lib/pkgconfig which is non-standard
+# Set this so ./configure can find things and we don't have to worry about prefix changes
+# to build instructions
+ENV PKG_CONFIG_PATH=/usr/local/lib/pkgconfig
+
+WORKDIR /
diff --git a/fedora-32.ppc64le.docker.m4 b/fedora-32.ppc64le.docker.m4
deleted file mode 100644
index 8dc7259..0000000
--- a/fedora-32.ppc64le.docker.m4
+++ /dev/null
@@ -1,90 +0,0 @@
-FROM ppc64le/fedora:32
-
-LABEL org.opencontainers.image.source https://github.com/tpm2-software/tpm2-software-container
-
-# can return 100 if packages need update
-RUN dnf check-update; \
-    rc=$?; \
-    if [ $rc -ne 100 ] && [ $rc -ne 0 ]; then \
-        echo "dnf check-update failed: $rc"; \
-        exit $rc; \
-    fi
-
-RUN dnf -y install \
-    libcmocka \
-    libcmocka-devel \
-    net-tools \
-    git \
-    pkg-config \
-    gcc \
-    m4 \
-    libtool \
-    automake \
-    libgcrypt-devel \
-    openssl-devel \
-    gnulib \
-    glib2-devel \
-    wget \
-    doxygen \
-    dbus-libs \
-    dbus-devel \
-    clang \
-    clang-analyzer \
-    clang-tools-extra \
-    pandoc \
-    lcov \
-    libcurl-devel \
-    dbus-x11 \
-    vim \
-    python3-pip \
-    libsq3-devel \
-    iproute \
-    procps \
-    libasan \
-    libubsan \
-    perl-Digest-SHA \
-    libtasn1-devel \
-    socat \
-    libseccomp-devel \
-    expect \
-    gawk \
-    json-c-devel \
-    libyaml-devel \
-    nss-tools \
-    expect \
-    opensc \
-    java-latest-openjdk-1:13.0.2.8-1.rolling.fc32 \
-    java-latest-openjdk-devel-1:13.0.2.8-1.rolling.fc32 \
-    gnutls-utils \
-    libuuid-devel \
-    python3-devel \
-    openssl-pkcs11 \
-    autoconf-archive \
-    acl \
-    json-glib-devel \
-    libusb-devel \
-    libftdi-devel \
-    gmp-devel
-
-# The last python cryptography version that allows no rust
-# per https://github.com/pyca/cryptography/blob/75be92de8e3bce9adcec42ef3967bed0d4500902/CHANGELOG.rst#3500---2021-09-29
-ARG PYCRYPTO_VERSION="3.4.8"
-ENV CRYPTOGRAPHY_DONT_BUILD_RUST=1
-# bcrypt now needs rust to, avoid it
-# https://pypi.org/project/bcrypt/4.0.1/
-ARG PYBCRYPT_VERSION="3.2.2"
-include(`pip3.m4')
-include(`ibmtpm1637.m4')
-
-ENV LIBTPMS_AUTOGEN_EXTRA="--libdir=/usr/lib64"
-include(`swtpm.m4')
-
-include(`uthash.m4')
-include(`junit.m4')
-
-# make install goes into /usr/local/lib/pkgconfig which is non-standard
-# Set this so ./configure can find things and we don't have to worry about prefix changes
-# to build instructions
-ENV PKG_CONFIG_PATH=/usr/local/lib/pkgconfig
-
-WORKDIR /
diff --git a/fedora-41.docker.m4 b/fedora-41.docker.m4
deleted file mode 100644
index f40c726..0000000
--- a/fedora-41.docker.m4
+++ /dev/null
@@ -1,80 +0,0 @@
-FROM fedora:41
-
-LABEL org.opencontainers.image.source https://github.com/tpm2-software/tpm2-software-container
-
-# can return 100 if packages need update
-RUN dnf check-update; \
-    rc=$?; \
-    if [ $rc -ne 100 ] && [ $rc -ne 0 ]; then \
-        echo "dnf check-update failed: $rc"; \
-        exit $rc; \
-    fi
-
-RUN dnf -y install \
-    libcmocka \
-    libcmocka-devel \
-    net-tools \
-    git \
-    pkg-config \
-    gcc \
-    m4 \
-    libtool \
-    automake \
-    libgcrypt-devel \
-    openssl-devel \
-    gnulib \
-    glib2-devel \
-    wget \
-    doxygen \
-    dbus-libs \
-    dbus-devel \
-    clang \
-    clang-analyzer \
-    clang-tools-extra \
-    pandoc \
-    lcov \
-    libcurl-devel \
-    dbus-x11 \
-    vim \
-    python3-pip \
-    libsq3-devel \
-    iproute \
-    procps \
-    libasan \
-    libubsan \
-    perl-Digest-SHA \
-    libtasn1-devel \
-    socat \
-    libseccomp-devel \
-    expect \
-    gawk \
-    json-c-devel \
-    libyaml-devel \
-    nss-tools \
-    expect \
-    opensc \
-    java-latest-openjdk \
-    java-latest-openjdk-devel \
-    gnutls-utils \
-    libuuid-devel \
-    python3-devel \
-    openssl-pkcs11 \
-    acl \
-    json-glib-devel \
-    libusb1-devel \
-    libftdi-devel \
-    gmp-devel
-
-include(`pip3.m4')
-include(`autoconf.m4')
-include(`ibmtpm1682.m4')
-include(`swtpm.m4')
-include(`uthash.m4')
-include(`junit.m4')
-
-# make install goes into /usr/local/lib/pkgconfig which is non-standard
-# Set this so ./configure can find things and we don't have to worry about prefix changes
-# to build instructions
-ENV PKG_CONFIG_PATH=/usr/local/lib/pkgconfig
-
-WORKDIR /
diff --git a/fedora-43-dev.docker.m4 b/fedora-43-dev.docker.m4
new file mode 100644
index 0000000..80555ca
--- /dev/null
+++ b/fedora-43-dev.docker.m4
@@ -0,0 +1,3 @@
+include(`fedora-43.docker.m4')
+
+include(`fedora_dev_extras.m4')
diff --git a/fedora-43-pkcs11.docker.m4 b/fedora-43-pkcs11.docker.m4
new file mode 100644
index 0000000..68edc1b
--- /dev/null
+++ b/fedora-43-pkcs11.docker.m4
@@ -0,0 +1,5 @@
+include(`fedora-43-dev.docker.m4')
+
+include(`fedora_pkcs11_extras.m4')
+
+ENV CLASSPATH=/usr/share/java/hamcrest/hamcrest.jar:/usr/share/java/junit.jar
diff --git a/fedora-43.docker.m4 b/fedora-43.docker.m4
index d85268f..14993ca 100644
--- a/fedora-43.docker.m4
+++ b/fedora-43.docker.m4
@@ -1,91 +1,13 @@
 FROM fedora:43
 
-LABEL org.opencontainers.image.source https://github.com/tpm2-software/tpm2-software-container
+LABEL org.opencontainers.image.source="https://github.com/tpm2-software/tpm2-software-container"
 
-# can return 100 if packages need update
-RUN dnf check-update; \
-    rc=$?; \
-    if [ $rc -ne 100 ] && [ $rc -ne 0 ]; then \
-        echo "dnf check-update failed: $rc"; \
-        exit $rc; \
-    fi
-
-RUN dnf -y install \
-    acl \
-    autoconf-archive \
-    automake \
-    clang \
-    clang-analyzer \
-    clang-tools-extra \
-    crypto-policies-scripts \
-    dbus-devel \
-    dbus-libs \
-    dbus-x11 \
-    doxygen \
-    expect \
-    gawk \
-    gcc \
-    git \
-    glib2-devel \
-    gnulib \
-    gnutls-utils \
-    hamcrest \
-    iproute \
-    java-latest-openjdk \
-    java-latest-openjdk-devel \
-    json-c-devel \
-    json-glib-devel \
-    junit \
-    lcov \
-    libasan \
-    libcmocka \
-    libcmocka-devel \
-    libcurl-devel \
-    libftdi-devel \
-    libgcrypt-devel \
-    libseccomp-devel \
-    libsq3-devel \
-    libtasn1-devel \
-    libtool \
-    libubsan \
-    libusb1-devel \
-    libuuid-devel \
-    libyaml-devel \
-    m4 \
-    net-tools \
-    nss-tools \
-    opensc \
-    openssl \
-    openssl-devel \
-    openssl-devel-engine \
-    openssl-pkcs11 \
-    pandoc \
-    perl-Digest-SHA \
-    pkg-config \
-    procps \
-    python3-bcrypt \
-    python3-cryptography \
-    python3-devel \
-    python3-pip \
-    python3-pyasn1 \
-    python3-pyasn1-modules \
-    python3-setuptools \
-    socat \
-    swtpm \
-    uthash-devel \
-    vim \
-    wget
-
-# Tests in PKCS11 will fail becuase newer Fedora's block things like sha1 and raw RSA signatures.
-# However, we WANT those tests to run, so in this container test environment, set it LEGACY mode.
-RUN update-crypto-policies --set=LEGACY
-
-RUN python3 -m pip install python-pkcs11
+include(`fedora_base_deps.m4')
+include(`ibmtpm1682.m4')
 
 # make install goes into /usr/local/lib/pkgconfig which is non-standard
 # Set this so ./configure can find things and we don't have to worry about prefix changes
 # to build instructions
 ENV PKG_CONFIG_PATH=/usr/local/lib/pkgconfig
-ENV CLASSPATH=/usr/share/java/hamcrest/hamcrest.jar:/usr/share/java/junit.jar
 
 WORKDIR /
diff --git a/fedora-44-dev.docker.m4 b/fedora-44-dev.docker.m4
new file mode 100644
index 0000000..7a5a46d
--- /dev/null
+++ b/fedora-44-dev.docker.m4
@@ -0,0 +1,3 @@
+include(`fedora-44.docker.m4')
+
+include(`fedora_dev_extras.m4')
diff --git a/fedora-44-pkcs11.docker.m4 b/fedora-44-pkcs11.docker.m4
new file mode 100644
index 0000000..b9f49fa
--- /dev/null
+++ b/fedora-44-pkcs11.docker.m4
@@ -0,0 +1,5 @@
+include(`fedora-44-dev.docker.m4')
+
+include(`fedora_pkcs11_extras.m4')
+
+ENV CLASSPATH=/usr/share/java/hamcrest/hamcrest.jar:/usr/share/java/junit.jar
diff --git a/fedora-44.docker.m4 b/fedora-44.docker.m4
new file mode 100644
index 0000000..a64e71c
--- /dev/null
+++ b/fedora-44.docker.m4
@@ -0,0 +1,13 @@
+FROM fedora:44
+
+LABEL org.opencontainers.image.source="https://github.com/tpm2-software/tpm2-software-container"
+
+include(`fedora_base_deps.m4')
+include(`ibmtpm1682.m4')
+
+# make install goes into /usr/local/lib/pkgconfig which is non-standard
+# Set this so ./configure can find things and we don't have to worry about prefix changes
+# to build instructions
+ENV PKG_CONFIG_PATH=/usr/local/lib/pkgconfig
+
+WORKDIR /
diff --git a/fedora-44.ppc64le.docker.m4 b/fedora-44.ppc64le.docker.m4
new file mode 100644
index 0000000..9e59116
--- /dev/null
+++ b/fedora-44.ppc64le.docker.m4
@@ -0,0 +1,15 @@
+FROM --platform=linux/ppc64le fedora:44
+
+LABEL org.opencontainers.image.source="https://github.com/tpm2-software/tpm2-software-container"
+
+include(`fedora_base_deps.m4')
+include(`ibmtpm1682.m4')
+include(`junit.m4')
+
+# make install goes into /usr/local/lib/pkgconfig which is non-standard
+# Set this so ./configure can find things and we don't have to worry about prefix changes
+# to build instructions
+ENV PKG_CONFIG_PATH=/usr/local/lib/pkgconfig
+ENV CLASSPATH=/usr/share/java/hamcrest/hamcrest.jar:/usr/share/java/junit.jar
+
+WORKDIR /
diff --git a/alpine-3.15.docker.m4 b/modules/alpine_base_deps.m4
similarity index 55%
rename from alpine-3.15.docker.m4
rename to modules/alpine_base_deps.m4
index 2666216..7affe8b 100644
--- a/alpine-3.15.docker.m4
+++ b/modules/alpine_base_deps.m4
@@ -1,68 +1,48 @@
-# Alpine 3.15 Dockerfile
-FROM alpine:3.15
-
-LABEL org.opencontainers.image.source https://github.com/tpm2-software/tpm2-software-container
-
-RUN apk update && \
-    apk upgrade && \
-    apk add \
+RUN apk upgrade --no-cache && \
+    apk add --no-cache \
+    acl \
+    autoconf \
     autoconf-archive \
+    automake \
     bash \
     cmocka-dev \
-    net-tools \
-    make \
-    git \
-    gcc \
-    g++ \
-    m4 \
-    libtool \
-    automake \
-    autoconf \
-    wget \
-    doxygen \
-    dbus-dev \
-    glib-dev \
-    clang \
-    clang-analyzer \
-    clang-extra-tools \
-    json-c-dev  \
-    iproute2 \
     coreutils \
-    uthash-dev \
     curl-dev \
-    python3-dev \
-    py3-yaml \
-    perl-utils \
-    openssl \
-    openssl-dev \
-    acl \
-    xxd \
-    grep \
     dbus \
-    vim \
+    dbus-dev \
     dbus-x11 \
-    procps \
-    libtasn1-dev \
-    json-glib-dev \
-    gnutls-dev \
     expect \
-    socat \
-    libseccomp-dev \
+    g++ \
     gawk \
+    gcc \
+    git \
+    glib-dev \
+    gnutls-dev \
+    grep \
     gzip \
-    yaml-dev \
-    nss-tools \
-    opensc \
-    openjdk17-jdk \
-    openjdk17-jre \
+    iproute2 \
+    json-c-dev  \
+    json-glib-dev \
+    libftdi1-dev \
+    libqrencode-dev \
+    libseccomp-dev \
+    libtasn1-dev \
+    libtool \
     libusb-dev \
-    libftdi1-dev
-
-include(`autoconf.m4')
-include(`ibmtpm1637.m4')
-include(`swtpm.m4')
-
-WORKDIR /
-
-
-    
+    m4 \
+    make \
+    net-tools \
+    oath-toolkit-dev \
+    opensc \
+    openssl \
+    openssl-dev \
+    perl-utils \
+    procps \
+    py3-yaml \
+    python3-dev \
+    sed \
+    socat \
+    tar \
+    uthash-dev \
+    wget \
+    yaml-dev
diff --git a/modules/alpine_dev_extras.m4 b/modules/alpine_dev_extras.m4
new file mode 100644
index 0000000..72eaf28
--- /dev/null
+++ b/modules/alpine_dev_extras.m4
@@ -0,0 +1,9 @@
+RUN apk add --no-cache \
+    clang \
+    clang-analyzer \
+    clang-extra-tools \
+    doxygen \
+    lcov \
+    pandoc \
+    vim \
+    xxd
diff --git a/modules/alpine_pkcs11_extras.m4 b/modules/alpine_pkcs11_extras.m4
new file mode 100644
index 0000000..9c3aff3
--- /dev/null
+++ b/modules/alpine_pkcs11_extras.m4
@@ -0,0 +1,9 @@
+RUN apk add --no-cache \
+    file \
+    gnutls-utils \
+    nss-tools \
+    openjdk17-jdk \
+    openjdk17-jre \
+    openssh-keygen \
+    py3-bcrypt \
+    py3-pip
diff --git a/modules/arch_linux_base_deps.m4 b/modules/arch_linux_base_deps.m4
new file mode 100644
index 0000000..9c67d45
--- /dev/null
+++ b/modules/arch_linux_base_deps.m4
@@ -0,0 +1,33 @@
+RUN pacman -Sy --noconfirm archlinux-keyring
+RUN pacman -Syu --noconfirm
+RUN pacman -S --noconfirm base base-devel
+RUN pacman -Scc --noconfirm
+RUN pacman -Sy --noconfirm \
+    autoconf \
+    autoconf-archive \
+    automake \
+    cmocka \
+    curl \
+    expect \
+    gcc \
+    git \
+    glib2 \
+    glib2-devel \
+    iproute2 \
+    json-c \
+    libftdi \
+    libltdl \
+    libtool \
+    libusb \
+    openssl \
+    perl \
+    pkg-config \
+    pkgfile \
+    procps \
+    python-yaml \
+    swtpm \
+    uthash \
+    util-linux \
+    wget \
+    && pacman -Scc --noconfirm
+RUN ln -s /usr/bin/core_perl/shasum /usr/bin/
diff --git a/modules/arch_linux_dev_extras.m4 b/modules/arch_linux_dev_extras.m4
new file mode 100644
index 0000000..f573b5a
--- /dev/null
+++ b/modules/arch_linux_dev_extras.m4
@@ -0,0 +1,6 @@
+RUN pacman -Sy --noconfirm \
+    doxygen \
+    lcov \
+    pandoc \
+    xxd \
+    && pacman -Scc --noconfirm
diff --git a/modules/arch_linux_pkcs11_extras.m4 b/modules/arch_linux_pkcs11_extras.m4
new file mode 100644
index 0000000..de6b874
--- /dev/null
+++ b/modules/arch_linux_pkcs11_extras.m4
@@ -0,0 +1,4 @@
+RUN pacman -Sy --noconfirm \
+    jdk-openjdk \
+    nss \
+    && pacman -Scc --noconfirm
diff --git a/modules/autoconf.m4 b/modules/autoconf.m4
deleted file mode 100644
index c937b7e..0000000
--- a/modules/autoconf.m4
+++ /dev/null
@@ -1,10 +0,0 @@
-ARG autoconf_archive=autoconf-archive-2018.03.13
-RUN cd /tmp \
-	&& wget --quiet --show-progress --progress=dot:giga "http://mirror.kumi.systems/gnu/autoconf-archive/$autoconf_archive.tar.xz" \
-	&& tar -xf $autoconf_archive.tar.xz \
-	&& rm $autoconf_archive.tar.xz \
-	&& cd $autoconf_archive \
-	&& ./configure --prefix=/usr \
-	&& make -j $(nproc) && make install \
-	&& rm -fr /tmp/$autoconf_archive.tar.xz /tmp/$autoconf_archive
-
diff --git a/modules/centos_base_deps.m4 b/modules/centos_base_deps.m4
new file mode 100644
index 0000000..e4e0f61
--- /dev/null
+++ b/modules/centos_base_deps.m4
@@ -0,0 +1,54 @@
+
+RUN dnf -y install epel-release dnf-plugins-core \
+    && dnf config-manager --set-enabled crb \
+    && dnf -y install \
+    CENTOS_LIBUSB_DEVEL \
+    acl \
+    autoconf-archive \
+    automake \
+    dbus-devel \
+    dbus-libs \
+    dbus-x11 \
+    expect \
+    file \
+    gawk \
+    gcc \
+    git \
+    glib2-devel \
+    gmp-devel \
+    gnulib-devel \
+    gnutls-utils \
+    iproute \
+    json-c-devel \
+    json-glib-devel \
+    libasan \
+    libcmocka \
+    libcmocka-devel \
+    libcurl-devel \
+    libftdi-devel \
+    libgcrypt-devel \
+    liboath-devel \
+    libseccomp-devel \
+    libtasn1-devel \
+    libtool \
+    libubsan \
+    libuuid-devel \
+    libyaml-devel \
+    m4 \
+    net-tools \
+    opensc \
+    openssl \
+    openssl-devel \
+    perl-Digest-SHA \
+    pkg-config \
+    procps \
+    python3-devel \
+    python3-pyyaml \
+    qrencode-devel \
+    socat \
+    sqlite-devel \
+    uthash-devel \
+    vim \
+    wget \
+    && dnf clean all \
+    && rm -rf /var/cache/dnf
diff --git a/modules/centos_dev_extras.m4 b/modules/centos_dev_extras.m4
new file mode 100644
index 0000000..3f9b728
--- /dev/null
+++ b/modules/centos_dev_extras.m4
@@ -0,0 +1,9 @@
+RUN dnf -y install \
+    clang \
+    clang-analyzer \
+    clang-tools-extra \
+    doxygen \
+    lcov \
+    pandoc \
+    && dnf clean all \
+    && rm -rf /var/cache/dnf
diff --git a/modules/centos_pkcs11_extras.m4 b/modules/centos_pkcs11_extras.m4
new file mode 100644
index 0000000..457b519
--- /dev/null
+++ b/modules/centos_pkcs11_extras.m4
@@ -0,0 +1,15 @@
+RUN dnf -y install \
+    CENTOS_JAVA \
+    CENTOS_OPENSSL_PKCS11 \
+    hamcrest \
+    junit \
+    nss-tools \
+    python3-bcrypt \
+    python3-cryptography \
+    python3-pip \
+    python3-pyasn1 \
+    python3-pyasn1-modules \
+    python3-setuptools \
+    && python3 -m pip install --no-cache-dir python-pkcs11 \
+    && dnf clean all \
+    && rm -rf /var/cache/dnf /root/.cache/pip
diff --git a/modules/curl-7.80.0.m4 b/modules/curl-7.80.0.m4
deleted file mode 100644
index ba053bc..0000000
--- a/modules/curl-7.80.0.m4
+++ /dev/null
@@ -1,9 +0,0 @@
-## CURL
-ENV CURL_VERSION=7.80.0
-WORKDIR /tmp/
-RUN wget --no-verbose https://curl.se/download/curl-$CURL_VERSION.tar.gz
-RUN tar -zxf curl-$CURL_VERSION.tar.gz
-WORKDIR /tmp/curl-$CURL_VERSION
-RUN autoreconf -fi \
-	&& ./configure --prefix=/usr --with-openssl \
- 	&& make -j install
diff --git a/modules/fedora_base_deps.m4 b/modules/fedora_base_deps.m4
new file mode 100644
index 0000000..cca4de1
--- /dev/null
+++ b/modules/fedora_base_deps.m4
@@ -0,0 +1,49 @@
+RUN dnf -y install \
+    acl \
+    autoconf-archive \
+    automake \
+    crypto-policies-scripts \
+    dbus-devel \
+    dbus-libs \
+    dbus-x11 \
+    expect \
+    gawk \
+    gcc \
+    git \
+    glib2-devel \
+    gmp-devel \
+    gnulib \
+    gnutls-utils \
+    iproute \
+    json-c-devel \
+    json-glib-devel \
+    libasan \
+    libcmocka \
+    libcmocka-devel \
+    libcurl-devel \
+    libftdi-devel \
+    libgcrypt-devel \
+    libseccomp-devel \
+    libtpms-devel \
+    libsq3-devel \
+    libtasn1-devel \
+    libtool \
+    libubsan \
+    libusb1-devel \
+    libuuid-devel \
+    libyaml-devel \
+    m4 \
+    net-tools \
+    opensc \
+    openssl \
+    openssl-devel \
+    perl-Digest-SHA \
+    pkg-config \
+    procps \
+    python3-devel \
+    socat \
+    swtpm \
+    uthash-devel \
+    wget \
+    && update-crypto-policies --set=LEGACY \
+    && dnf clean all && rm -rf /var/cache/dnf
diff --git a/modules/fedora_dev_extras.m4 b/modules/fedora_dev_extras.m4
new file mode 100644
index 0000000..4099fe2
--- /dev/null
+++ b/modules/fedora_dev_extras.m4
@@ -0,0 +1,11 @@
+RUN dnf -y install \
+    clang \
+    clang-analyzer \
+    clang-tools-extra \
+    doxygen \
+    lcov \
+    pandoc \
+    python3-pyyaml \
+    vim-common \
+    && dnf clean all \
+    && rm -rf /var/cache/dnf
diff --git a/modules/fedora_pkcs11_extras.m4 b/modules/fedora_pkcs11_extras.m4
new file mode 100644
index 0000000..59b5eec
--- /dev/null
+++ b/modules/fedora_pkcs11_extras.m4
@@ -0,0 +1,17 @@
+RUN dnf -y install \
+    hamcrest \
+    java-latest-openjdk \
+    java-latest-openjdk-devel \
+    junit \
+    nss-tools \
+    openssl-pkcs11 \
+    python3-bcrypt \
+    python3-cryptography \
+    python3-pip \
+    python3-pyasn1 \
+    python3-pyasn1-modules \
+    python3-pyyaml \
+    python3-setuptools \
+    && python3 -m pip install --no-cache-dir python-pkcs11 \
+    && dnf clean all \
+    && rm -rf /var/cache/dnf /root/.cache/pip
diff --git a/modules/ibmtpm1637.m4 b/modules/ibmtpm1637.m4
deleted file mode 100644
index e237f37..0000000
--- a/modules/ibmtpm1637.m4
+++ /dev/null
@@ -1,12 +0,0 @@
-ARG ibmtpm_name=ibmtpm1637
-RUN cd /tmp \
-	&& wget $WGET_EXTRA_FLAGS "https://downloads.sourceforge.net/project/ibmswtpm2/$ibmtpm_name.tar.gz" \
-	&& sha256sum $ibmtpm_name.tar.gz | grep ^dd3a4c3f7724243bc9ebcd5c39bbf87b82c696d1c1241cb8e5883534f6e2e327 \
-	&& mkdir -p $ibmtpm_name \
-	&& tar xv --no-same-owner -f $ibmtpm_name.tar.gz -C $ibmtpm_name \
-	&& rm $ibmtpm_name.tar.gz \
-	&& cd $ibmtpm_name/src \
-	&& sed -i 's/-DTPM_NUVOTON/-DTPM_NUVOTON $(CFLAGS)/' makefile \
-	&& CFLAGS="-DNV_MEMORY_SIZE=32768 -DMIN_EVICT_OBJECTS=7" make -j$(nproc) \
-	&& cp tpm_server /usr/local/bin \
-	&& rm -fr /tmp/$ibmtpm_name
diff --git a/modules/ibmtpm1682.m4 b/modules/ibmtpm1682.m4
index 99bae2a..5893535 100644
--- a/modules/ibmtpm1682.m4
+++ b/modules/ibmtpm1682.m4
@@ -3,11 +3,13 @@ RUN cd /tmp \
 	&& wget $WGET_EXTRA_FLAGS "https://downloads.sourceforge.net/project/ibmswtpm2/$ibmtpm_name.tar.gz" \
 	&& sha1sum $ibmtpm_name.tar.gz | grep ^651800d0b87cfad55b004fbdace4e41dce800a61 \
 	&& mkdir -p $ibmtpm_name \
-	&& tar xv --no-same-owner -f $ibmtpm_name.tar.gz -C $ibmtpm_name \
+	&& (tar xv --no-same-owner -f $ibmtpm_name.tar.gz -C $ibmtpm_name \
+		|| python3 -c 'import sys, tarfile; archive="/tmp/%s.tar.gz" % sys.argv[1]; dest="/tmp/%s" % sys.argv[1]; tarfile.open(archive, "r:gz").extractall(dest)' "$ibmtpm_name") \
 	&& rm $ibmtpm_name.tar.gz \
 	&& cd $ibmtpm_name/src \
 	&& sed -i 's/0x300000ff/0x310000ff/' TpmToOsslMath.h \
 	&& sed -i 's/-DTPM_NUVOTON/-DTPM_NUVOTON $(CFLAGS)/' makefile \
 	&& CFLAGS="-DNV_MEMORY_SIZE=32768 -DMIN_EVICT_OBJECTS=7" make -j$(nproc) \
 	&& cp tpm_server /usr/local/bin \
+	&& strip /usr/local/bin/tpm_server || true \
 	&& rm -fr /tmp/$ibmtpm_name
diff --git a/modules/libressl.m4 b/modules/libressl.m4
deleted file mode 100644
index bec4ed9..0000000
--- a/modules/libressl.m4
+++ /dev/null
@@ -1,12 +0,0 @@
-## LibreSSL 2.3.4
-ENV LIBRE_VERSION=3.5.3
-
-RUN curl https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-$LIBRE_VERSION.tar.gz \
-        -o libressl-$LIBRE_VERSION.tar.gz
-
-RUN tar -xavf libressl-$LIBRE_VERSION.tar.gz --one-top-level=/tmp/
-WORKDIR /tmp/libressl-$LIBRE_VERSION
-RUN ./configure \
-      && make -j \
-      && make install \
-      && ldconfig
diff --git a/modules/mbedtls31.m4 b/modules/mbedtls31.m4
deleted file mode 100644
index 223f8d2..0000000
--- a/modules/mbedtls31.m4
+++ /dev/null
@@ -1,11 +0,0 @@
-
-## MBEDTLS 3.1
-ENV MBEDTLS_VERSION=v3.1.0
-RUN wget --no-verbose https://github.com/Mbed-TLS/mbedtls/archive/refs/tags/$MBEDTLS_VERSION.tar.gz
-RUN tar -zxf $MBEDTLS_VERSION.tar.gz --one-top-level=/tmp/
-RUN ls /tmp
-WORKDIR /tmp/mbedtls-3.1.0
-RUN make -j \
-	&& make -j \
-	&& make install \
-	&& ldconfig
diff --git a/modules/mbedtls36.m4 b/modules/mbedtls36.m4
index 92a89f3..7bd9039 100644
--- a/modules/mbedtls36.m4
+++ b/modules/mbedtls36.m4
@@ -1,13 +1,13 @@
 
 ## MBEDTLS 3.6
-ENV MBEDTLS_VERSION=v3.6.2
+ENV MBEDTLS_VERSION=v3.6.7
 
 RUN git clone --depth 1 --branch ${MBEDTLS_VERSION} --recurse-submodules --shallow-submodules \
-	https://github.com/Mbed-TLS/mbedtls.git /tmp/mbedtls
-
-WORKDIR /tmp/mbedtls
-
-RUN pip3 install --no-cache-dir --break-system-packages -r scripts/basic.requirements.txt \
+	https://github.com/Mbed-TLS/mbedtls.git /tmp/mbedtls \
+	&& cd /tmp/mbedtls \
+	&& pip3 install --no-cache-dir --break-system-packages -r scripts/basic.requirements.txt \
 	&& make -j \
 	&& make install \
-	&& ldconfig
+	&& ldconfig \
+	&& cd / \
+	&& rm -rf /tmp/mbedtls /root/.cache/pip
diff --git a/modules/opensuse_leap_base_deps.m4 b/modules/opensuse_leap_base_deps.m4
new file mode 100644
index 0000000..a2516df
--- /dev/null
+++ b/modules/opensuse_leap_base_deps.m4
@@ -0,0 +1,46 @@
+RUN zypper ref
+RUN zypper -n in \
+    acl \
+    autoconf \
+    autoconf-archive \
+    automake \
+    curl \
+    dbus-1-devel \
+    dbus-1-x11 \
+    expect \
+    gawk \
+    gcc \
+    gcc-c++ \
+    git \
+    glib2-devel \
+    gmp-devel \
+    gnutls \
+    gzip \
+    iproute \
+    json-glib-devel \
+    libcmocka-devel \
+    libcurl-devel \
+    libftdi1-devel \
+    libgcrypt-devel \
+    libjson-c-devel \
+    libseccomp-devel \
+    libtasn1-devel \
+    libtool \
+    libusb-devel \
+    libuuid-devel \
+    libyaml-devel \
+    m4 \
+    net-tools \
+    net-tools-deprecated \
+    opensc \
+    openssh-common \
+    openssl-devel \
+    pkg-config \
+    socat \
+    sqlite3 \
+    sqlite3-devel \
+    uthash-devel \
+    wget \
+    which \
+    xz \
+    && zypper clean --all
diff --git a/modules/opensuse_leap_dev_extras.m4 b/modules/opensuse_leap_dev_extras.m4
new file mode 100644
index 0000000..19ab9ed
--- /dev/null
+++ b/modules/opensuse_leap_dev_extras.m4
@@ -0,0 +1,15 @@
+RUN zypper -n in \
+    cargo \
+    doxygen \
+    clang \
+    clang-tools \
+    doxygen \
+    lcov \
+    libffi-devel \
+    pandoc \
+    patch \
+    python3-PyYAML \
+    python3-pip \
+    rust \
+    vim \
+    && zypper clean --all
diff --git a/modules/opensuse_leap_pkcs11_extras.m4 b/modules/opensuse_leap_pkcs11_extras.m4
new file mode 100644
index 0000000..38d01b5
--- /dev/null
+++ b/modules/opensuse_leap_pkcs11_extras.m4
@@ -0,0 +1,8 @@
+RUN zypper -n in \
+    java-17-openjdk \
+    java-17-openjdk-devel \
+    mozilla-nss-tools \
+    openssl-engine-libp11 \
+    python3-devel \
+    python3-pip \
+    && zypper clean --all
diff --git a/modules/ossl3.m4 b/modules/ossl3.m4
deleted file mode 100644
index 1db2952..0000000
--- a/modules/ossl3.m4
+++ /dev/null
@@ -1,14 +0,0 @@
-## OpenSSL 3
-ENV OSSL_VERSION=3.0.0
-RUN realpath $(ldconfig -p \
-    | grep libcrypto.so.1| \
-    sed 's/.* \//\//')| \
-    sed 's/^\/usr\///'| \
-    sed 's/\/libcrypto.*//' > /tmp/libdir
-RUN wget --no-verbose https://www.openssl.org/source/openssl-$OSSL_VERSION.tar.gz
-RUN tar -zxf openssl-$OSSL_VERSION.tar.gz --one-top-level=/tmp/
-WORKDIR /tmp/openssl-$OSSL_VERSION
-RUN ./config --prefix=/usr no-deprecated \
-	&& make -j \
-	&& make LIBDIR=$(cat /tmp/libdir) install \
-	&& ldconfig
diff --git a/modules/pip3-withoutupgrade.m4 b/modules/pip3-withoutupgrade.m4
index dbe354d..bde9821 100644
--- a/modules/pip3-withoutupgrade.m4
+++ b/modules/pip3-withoutupgrade.m4
@@ -7,4 +7,5 @@ ENV PIP_BREAK_SYSTEM_PACKAGES=1
 RUN pkgs="cryptography==$PYCRYPTO_VERSION pyyaml cpp-coveralls pyasn1 pyasn1_modules python-pkcs11 compiledb \
           bcrypt==$PYBCRYPT_VERSION setuptools"; \
     pkgs=$(echo "$pkgs" | sed -E 's/==\s+/ /g'); \
-    python3 -m pip install $pkgs --break-system-packages
+      python3 -m pip install --no-cache-dir $pkgs --break-system-packages; \
+      rm -rf /root/.cache/pip
diff --git a/modules/pip3.m4 b/modules/pip3.m4
index f14f413..c8d8b59 100644
--- a/modules/pip3.m4
+++ b/modules/pip3.m4
@@ -1,12 +1,13 @@
 #
 # upgrade pip first so packages are not reinstalled using a version other than what may have been specified
 #
-RUN python3 -m pip install --upgrade pip
+RUN python3 -m pip install --no-cache-dir --upgrade pip
 # install everything in one shot so we don't get a newer version of a package we specified. Ie if a module has dep on cryptogtraphy
 # and we install it in different phases pip will upgrade cryptography
 RUN pkgs="cryptography==$PYCRYPTO_VERSION pyyaml cpp-coveralls pyasn1 pyasn1_modules \
           bcrypt==$PYBCRYPT_VERSION setuptools==62.0.0"; \
     echo $pkgs; \
     pkgs=$(echo "$pkgs" | sed -E 's/==\s+/ /g'); \
-    python3 -m pip install $pkgs; \
-    python3 -m pip install python-pkcs11
+    python3 -m pip install --no-cache-dir $pkgs; \
+      python3 -m pip install --no-cache-dir python-pkcs11; \
+      rm -rf /root/.cache/pip
diff --git a/modules/python3.7.2.m4 b/modules/python3.7.2.m4
deleted file mode 100644
index 0e4014e..0000000
--- a/modules/python3.7.2.m4
+++ /dev/null
@@ -1,12 +0,0 @@
-ARG pyver="3.7.2"
-RUN cd /tmp \
-	&& wget --quiet --show-progress --progress=dot:giga "https://github.com/python/cpython/archive/v${pyver}.tar.gz" \
-	&& tar -xf v${pyver}.tar.gz \
-	&& cd cpython-${pyver}/ \
-	&& ./configure \
-	&& make -j$(nproc) \
-	&& make altinstall \
-	&& rm -fr /tmp/v${pyver}.tar.gz /tmp/cpython-${pyver}
-
-RUN update-alternatives --install "/usr/bin/python3" "python3" "$(which python3.7)" 100
-RUN update-alternatives --install "/usr/bin/pip3" "pip3" "$(which pip3.7)" 100
diff --git a/modules/rust.m4 b/modules/rust.m4
deleted file mode 100644
index a2a14b7..0000000
--- a/modules/rust.m4
+++ /dev/null
@@ -1,5 +0,0 @@
-# installs rust from source
-
-RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
-# $HOME doesn't expand, see https://github.com/moby/moby/issues/28971
-ENV PATH="/root/.cargo/bin:${PATH}"
diff --git a/modules/swtpm.m4 b/modules/swtpm.m4
index a98b30a..a803172 100644
--- a/modules/swtpm.m4
+++ b/modules/swtpm.m4
@@ -1,21 +1,26 @@
 ARG libtpms_version=0.10.2
 ARG swtpm_version=0.10.1
+COPY patches/libtpms.patch /tmp/libtpms.patch
 RUN cd /tmp/ \
     && wget $WGET_EXTRA_FLAGS https://github.com/stefanberger/libtpms/archive/refs/tags/v$libtpms_version.tar.gz \
-    && tar xv --no-same-owner -f v$libtpms_version.tar.gz \
+    && (tar xv --no-same-owner -f v$libtpms_version.tar.gz \
+	|| python3 -c 'import sys, tarfile; archive="/tmp/v%s.tar.gz" % sys.argv[1]; dest="/tmp"; tarfile.open(archive, "r:gz").extractall(dest)' "$libtpms_version") \
 	&& cd /tmp/libtpms-$libtpms_version \
 	&& ./autogen.sh --prefix=/usr $LIBTPMS_AUTOGEN_EXTRA --with-openssl --with-tpm2 \
+        && (command -d patch && patch -p1 < /tmp/libtpms.patch || true) \
 	&& make -j$(nproc) \
 	&& make install \
     && cd /tmp/ \
 	&& rm -fr /tmp/libtpms-$libtpms_version \
     && rm -f /tmp/v$libtpms_version.tar.gz \
     && wget $WGET_EXTRA_FLAGS https://github.com/stefanberger/swtpm/archive/refs/tags/v$swtpm_version.tar.gz \
-    && tar xv --no-same-owner -f v$swtpm_version.tar.gz \
+    && (tar xv --no-same-owner -f v$swtpm_version.tar.gz \
+	|| python3 -c 'import sys, tarfile; archive="/tmp/v%s.tar.gz" % sys.argv[1]; dest="/tmp"; tarfile.open(archive, "r:gz").extractall(dest)' "$swtpm_version") \
 	&& cd /tmp/swtpm-$swtpm_version \
 	&& ./autogen.sh --prefix=/usr \
 	&& make -j$(nproc) $SWTPM_MAKE_EXTRA \
 	&& make install \
     && cd /tmp/ \
 	&& rm -fr /tmp/swtpm-$swtpm_version \
-    && rm -f /tmp/v$swtpm_version.tar.gz
+    && rm -f /tmp/v$swtpm_version.tar.gz \
+    && rm /tmp/libtpms.patch
diff --git a/modules/ubuntu_20.04_base_deps.m4 b/modules/ubuntu_26.04_base_deps.m4
similarity index 64%
rename from modules/ubuntu_20.04_base_deps.m4
rename to modules/ubuntu_26.04_base_deps.m4
index 649fba2..e2a9205 100644
--- a/modules/ubuntu_20.04_base_deps.m4
+++ b/modules/ubuntu_26.04_base_deps.m4
@@ -1,57 +1,46 @@
 ENV DEBIAN_FRONTEND=noninteractive
 RUN apt-get update && \
     apt-get install -y \
+    autoconf \
     autoconf-archive \
-    curl \
-    libcmocka0 \
-    libcmocka-dev \
-    net-tools \
+    automake \
     build-essential \
-    git \
-    pkg-config \
-    gcc \
+    clang-22 \
+    clang-tools-22 \
+    curl \
+    dbus-x11 \
+    expect \
     g++ \
-    m4 \
-    libtool \
-    automake \
-    libgcrypt20-dev \
-    libssl-dev \
-    autoconf \
+    gawk \
+    gcc \
+    git \
     gnulib \
-    wget \
-    doxygen \
+    iproute2 \
+    libcmocka-dev \
+    libcmocka0 \
+    libcurl4-openssl-dev \
     libdbus-1-dev \
+    libgcrypt20-dev \
     libglib2.0-dev \
-    clang-10 \
-    clang-tools-10 \
-    pandoc \
-    lcov \
-    libcurl4-openssl-dev \
-    dbus-x11 \
-    vim-common \
+    libjson-c-dev \
+    libseccomp-dev \
     libsqlite3-dev \
-    iproute2 \
+    libssl-dev \
     libtasn1-6-dev \
-    socat \
-    libseccomp-dev \
-    expect \
-    gawk \
-    libjson-c-dev \
-    libengine-pkcs11-openssl \
-    default-jre \
-    default-jdk \
-    sqlite3 \
-    libnss3-tools \
-    python3 \
-    python3-pip \
+    libtool \
+    libtpms-dev \
     libyaml-dev \
-    libmbedtls-dev \
-    uuid-dev \
+    m4 \
+    net-tools \
     opensc \
-    gnutls-bin \
-    rustc \
-    acl \
-    libjson-glib-dev \
-    libusb-1.0-0-dev \
-    libgmp-dev \
-    libftdi-dev
+    pkg-config \
+    python3 \
+    socat \
+    sqlite3 \
+    swtpm \
+    uthash-dev \
+    wget \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN update-alternatives --install /usr/bin/clang clang /usr/bin/clang-22 100
+RUN update-alternatives --install /usr/bin/scan-build scan-build /usr/bin/scan-build-22 100
diff --git a/modules/ubuntu_26.04_dev_extras.m4 b/modules/ubuntu_26.04_dev_extras.m4
new file mode 100644
index 0000000..d3244ff
--- /dev/null
+++ b/modules/ubuntu_26.04_dev_extras.m4
@@ -0,0 +1,20 @@
+RUN apt-get update && \
+    apt-get install -y \
+    acl \
+    bear \
+    clang-format-22 \
+    clang-tidy-22 \
+    doxygen \
+    gnutls-bin \
+    lcov \
+    libftdi-dev \
+    libgmp-dev \
+    libjson-glib-dev \
+    libmbedtls-dev \
+    libusb-1.0-0-dev \
+    pandoc \
+    python3-pip \
+    rustc \
+    uuid-dev \
+    vim-common \
+    && rm -rf /var/lib/apt/lists/*
diff --git a/modules/ubuntu_26.04_pkcs11_extras.m4 b/modules/ubuntu_26.04_pkcs11_extras.m4
new file mode 100644
index 0000000..e06481d
--- /dev/null
+++ b/modules/ubuntu_26.04_pkcs11_extras.m4
@@ -0,0 +1,11 @@
+ENV PIP_REQUIRE_VIRTUALENV=0
+ENV PIP_BREAK_SYSTEM_PACKAGES=1
+RUN apt-get update && \
+    apt-get install -y \
+    default-jdk \
+    default-jre \
+    junit4 \
+    libengine-pkcs11-openssl \
+    libnss3-tools \
+    python3-pip \
+    && rm -rf /var/lib/apt/lists/*
diff --git a/modules/uthash.m4 b/modules/uthash.m4
deleted file mode 100644
index 3095413..0000000
--- a/modules/uthash.m4
+++ /dev/null
@@ -1,6 +0,0 @@
-ARG uthash="2.1.0"
-RUN cd /tmp \
-	&& wget $WGET_EXTRA_FLAGS "https://github.com/troydhanson/uthash/archive/v${uthash}.tar.gz" \
-	&& tar -xf v${uthash}.tar.gz \
-	&& cp uthash-${uthash}/src/*.h /usr/include/ \
-	&& rm -fr /tmp/v${uthash}.tar.gz /tmp/uthash-${uthash}
diff --git a/opensuse-leap-15.2.docker.m4 b/opensuse-leap-15.2.docker.m4
deleted file mode 100644
index 7af5d58..0000000
--- a/opensuse-leap-15.2.docker.m4
+++ /dev/null
@@ -1,91 +0,0 @@
-FROM opensuse/leap:15.2
-
-LABEL org.opencontainers.image.source https://github.com/tpm2-software/tpm2-software-container
-
-RUN zypper ref
-RUN zypper -n in \
-    curl \
-    libcmocka-devel \
-    net-tools \
-    git \
-    pkg-config \
-    gcc \
-    m4 \
-    libtool \
-    automake \
-    libgcrypt-devel \
-    openssl-devel \
-    glib2-devel \
-    wget \
-    doxygen \
-    clang \
-    pandoc \
-    lcov \
-    libcurl-devel \
-    vim \
-    clang7-checker \
-    sqlite3-devel \
-    dbus-1-devel \
-    dbus-1-x11 \
-    xz \
-    gzip \
-    which \
-    gcc-c++ \
-    iproute \
-    libtasn1-devel \
-    socat \
-    libseccomp-devel \
-    expect \
-    gawk \
-    net-tools-deprecated \
-    libjson-c-devel \
-    libuuid-devel \
-    libyaml-devel \
-    mozilla-nss-tools \
-    opensc \
-    java-11-openjdk-devel \
-    java-11-openjdk \
-    libffi-devel \
-    patch \
-    sqlite3 \
-    openssl-engine-libp11 \
-    gnutls \
-    acl \
-    json-glib-devel \
-    python \
-    python-pip \
-    libusb-devel \
-    libftdi1-devel \
-    gmp-devel
-
-include(`autoconf.m4')
-include(`python3.7.2.m4')
-
-include(`rust.m4')
-
-# Some other packages bring in python and python3, which at this time is too old, so we want
-# python3 to be the 3.7 version just installed.
-RUN update-alternatives --install /usr/bin/python3 python3 /usr/local/bin/python3.7 0
-
-# Python2 since OpenSuse default
-RUN python -m pip install --upgrade pip
-RUN python -m pip install pyyaml
-
-include(`pip3.m4')
-
-# Fix Automake AM_PYTHON_PATH missing python3.7 interpreter
-COPY patches/python.patch /tmp/python.patch
-RUN stat /usr/share/aclocal-1.15/python.m4
-RUN patch -d / -p1 < /tmp/python.patch
-RUN rm /tmp/python.patch
-
-include(`ibmtpm1637.m4')
-
-ENV LIBTPMS_AUTOGEN_EXTRA="--libdir=/usr/lib64"
-ENV SWTPM_MAKE_EXTRA="CFLAGS=\"-I/usr/include/libseccomp/\""
-include(`swtpm.m4')
-
-include(`uthash.m4')
-include(`junit.m4')
-
-WORKDIR /
diff --git a/opensuse-leap-dev.docker.m4 b/opensuse-leap-dev.docker.m4
new file mode 100644
index 0000000..e7e7be2
--- /dev/null
+++ b/opensuse-leap-dev.docker.m4
@@ -0,0 +1,3 @@
+include(`opensuse-leap.docker.m4')
+
+include(`opensuse_leap_dev_extras.m4')
diff --git a/opensuse-leap-pkcs11.docker.m4 b/opensuse-leap-pkcs11.docker.m4
new file mode 100644
index 0000000..18dab3f
--- /dev/null
+++ b/opensuse-leap-pkcs11.docker.m4
@@ -0,0 +1,5 @@
+include(`opensuse-leap-dev.docker.m4')
+
+include(`opensuse_leap_pkcs11_extras.m4')
+include(`pip3.m4')
+include(`junit.m4')
diff --git a/opensuse-leap.docker.m4 b/opensuse-leap.docker.m4
index 5525d7f..95278ec 100644
--- a/opensuse-leap.docker.m4
+++ b/opensuse-leap.docker.m4
@@ -1,74 +1,15 @@
 FROM opensuse/leap
 
-LABEL org.opencontainers.image.source https://github.com/tpm2-software/tpm2-software-container
+LABEL org.opencontainers.image.source="https://github.com/tpm2-software/tpm2-software-container"
 
-RUN zypper ref
-RUN zypper -n in \
-    curl \
-    libcmocka-devel \
-    net-tools \
-    git \
-    pkg-config \
-    python3-pip \
-    gcc \
-    m4 \
-    libtool \
-    automake \
-    libgcrypt-devel \
-    openssl-devel \
-    glib2-devel \
-    wget \
-    doxygen \
-    clang \
-    pandoc \
-    lcov \
-    libcurl-devel \
-    vim \
-    clang-tools \
-    sqlite3-devel \
-    dbus-1-devel \
-    dbus-1-x11 \
-    xz \
-    gzip \
-    which \
-    gcc-c++ \
-    iproute \
-    libtasn1-devel \
-    socat \
-    libseccomp-devel \
-    expect \
-    gawk \
-    net-tools-deprecated \
-    libjson-c-devel \
-    libuuid-devel \
-    libyaml-devel \
-    mozilla-nss-tools \
-    opensc \
-    java-17-openjdk-devel \
-    java-17-openjdk \
-    libffi-devel \
-    patch \
-    sqlite3 \
-    openssl-engine-libp11 \
-    gnutls \
-    acl \
-    json-glib-devel \
-    libusb-devel \
-    libftdi1-devel \
-    openssh-common \
-    gmp-devel
-
-include(`autoconf.m4')
-
-include(`rust.m4')
-
-include(`pip3.m4')
+include(`opensuse_leap_base_deps.m4')
 
 include(`ibmtpm1682.m4')
 
+# make install goes into /usr/local/lib/pkgconfig which is non-standard
+ENV PKG_CONFIG_PATH=/usr/local/lib/pkgconfig
+
 ENV LIBTPMS_AUTOGEN_EXTRA="--libdir=/usr/lib64"
 ENV SWTPM_MAKE_EXTRA="CFLAGS=\"-I/usr/include/libseccomp/\""
 include(`swtpm.m4')
 
-include(`uthash.m4')
-include(`junit.m4')
diff --git a/patches/libtpms.patch b/patches/libtpms.patch
new file mode 100644
index 0000000..dba78b5
--- /dev/null
+++ b/patches/libtpms.patch
@@ -0,0 +1,33 @@
+From fc8820cfaa8b5e17328f731df93911f6ab92443b Mon Sep 17 00:00:00 2001
+From: Stefan Berger <stefanb@linux.ibm.com>
+Date: Fri, 2 Jan 2026 11:37:31 -0500
+Subject: [PATCH] Fix a compilation error in TPMLIB_GetPlaintext
+
+Fix a compilation error that newer gcc versions may complain about:
+
+tpm_library.c: In function 'TPMLIB_GetPlaintext':
+tpm_library.c:441:11: error: assignment discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers]
+  441 |     start = strstr(stream, starttag);
+      |           ^
+At top level:
+cc1: note: unrecognized command-line option '-Wno-self-assign' may have been intended to silence earlier diagnostics
+cc1: all warnings being treated as errors
+
+Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
+---
+ src/tpm_library.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/tpm_library.c b/src/tpm_library.c
+index f48f4fd38..7b2ea687e 100644
+--- a/src/tpm_library.c
++++ b/src/tpm_library.c
+@@ -435,7 +435,7 @@ static unsigned char *TPMLIB_GetPlaintext(const char *stream,
+                                           const char *endtag,
+                                           size_t *length)
+ {
+-    char *start, *end;
++    const char *start, *end;
+     unsigned char *plaintext = NULL;
+ 
+     start = strstr(stream, starttag);
diff --git a/ubuntu-20.04-ossl3.docker.m4 b/ubuntu-20.04-ossl3.docker.m4
deleted file mode 100644
index 6ccc54a..0000000
--- a/ubuntu-20.04-ossl3.docker.m4
+++ /dev/null
@@ -1,7 +0,0 @@
-include(`ubuntu-20.04.docker.m4')
-
-# Install openssl3
-RUN apt-get remove -y libssl-dev
-include(`ossl3.m4')
-
-WORKDIR /
diff --git a/ubuntu-20.04.arm32v7.docker.m4 b/ubuntu-20.04.arm32v7.docker.m4
deleted file mode 100644
index ffe6934..0000000
--- a/ubuntu-20.04.arm32v7.docker.m4
+++ /dev/null
@@ -1,27 +0,0 @@
-FROM --platform=linux/arm/v7 ubuntu:20.04
-
-LABEL org.opencontainers.image.source https://github.com/tpm2-software/tpm2-software-container
-
-include(`ubuntu_20.04_base_deps.m4')
-
-# The last python cryptography version that allows no rust
-# per https://github.com/pyca/cryptography/blob/75be92de8e3bce9adcec42ef3967bed0d4500902/CHANGELOG.rst#3500---2021-09-29
-ARG PYCRYPTO_VERSION="3.4.8"
-ENV CRYPTOGRAPHY_DONT_BUILD_RUST=1
-# bcrypt now needs rust to, avoid it
-# https://pypi.org/project/bcrypt/4.0.1/
-ARG PYBCRYPT_VERSION="3.2.2"
-include(`pip3.m4')
-
-RUN update-alternatives --install /usr/bin/clang clang /usr/bin/clang-10 100
-RUN update-alternatives --install /usr/bin/scan-build scan-build /usr/bin/scan-build-10 100
-
-include(`autoconf.m4')
-
-ARG WGET_EXTRA_FLAGS="--no-check-certificate"
-include(`ibmtpm1637.m4')
-include(`swtpm.m4')
-include(`uthash.m4')
-include(`junit.m4')
-
-WORKDIR /
diff --git a/ubuntu-20.04.arm64v8.docker.m4 b/ubuntu-20.04.arm64v8.docker.m4
deleted file mode 100644
index f8bfd84..0000000
--- a/ubuntu-20.04.arm64v8.docker.m4
+++ /dev/null
@@ -1,17 +0,0 @@
-FROM --platform=linux/arm64 ubuntu:20.04
-
-LABEL org.opencontainers.image.source https://github.com/tpm2-software/tpm2-software-container
-
-include(`ubuntu_20.04_base_deps.m4')
-include(`pip3.m4')
-
-RUN update-alternatives --install /usr/bin/clang clang /usr/bin/clang-10 100
-RUN update-alternatives --install /usr/bin/scan-build scan-build /usr/bin/scan-build-10 100
-
-include(`autoconf.m4')
-include(`ibmtpm1637.m4')
-include(`swtpm.m4')
-include(`uthash.m4')
-include(`junit.m4')
-
-WORKDIR /
diff --git a/ubuntu-20.04.docker.m4 b/ubuntu-20.04.docker.m4
deleted file mode 100644
index 7d74a6c..0000000
--- a/ubuntu-20.04.docker.m4
+++ /dev/null
@@ -1,19 +0,0 @@
-# Ubuntu 20.04 Dockerfile
-FROM ubuntu:20.04
-
-LABEL org.opencontainers.image.source https://github.com/tpm2-software/tpm2-software-container
-
-include(`ubuntu_20.04_base_deps.m4')
-
-include(`pip3.m4')
-
-RUN update-alternatives --install /usr/bin/clang clang /usr/bin/clang-10 100
-RUN update-alternatives --install /usr/bin/scan-build scan-build /usr/bin/scan-build-10 100
-
-include(`autoconf.m4')
-include(`ibmtpm1637.m4')
-include(`swtpm.m4')
-include(`uthash.m4')
-include(`junit.m4')
-
-WORKDIR /
diff --git a/ubuntu-22.04-dev.docker.m4 b/ubuntu-22.04-dev.docker.m4
new file mode 100644
index 0000000..b125c7a
--- /dev/null
+++ b/ubuntu-22.04-dev.docker.m4
@@ -0,0 +1,2 @@
+include(`ubuntu-22.04.docker.m4')
+
diff --git a/ubuntu-22.04-mbedtls-3.1.docker.m4 b/ubuntu-22.04-mbedtls-3.1.docker.m4
deleted file mode 100644
index 447dab4..0000000
--- a/ubuntu-22.04-mbedtls-3.1.docker.m4
+++ /dev/null
@@ -1,71 +0,0 @@
-FROM ubuntu:jammy
-
-LABEL org.opencontainers.image.source https://github.com/tpm2-software/tpm2-software-container
-
-ENV DEBIAN_FRONTEND=noninteractive
-RUN apt-get update && \
-    apt-get install -y \
-    autoconf-archive \
-    curl \
-    libcmocka0 \
-    libcmocka-dev \
-    net-tools \
-    build-essential \
-    git \
-    pkg-config \
-    gcc \
-    g++ \
-    m4 \
-    libtool \
-    automake \
-    libgcrypt20-dev \
-    libssl-dev \
-    autoconf \
-    gnulib \
-    wget \
-    doxygen \
-    libdbus-1-dev \
-    libglib2.0-dev \
-    clang \
-    clang-tools \
-    pandoc \
-    lcov \
-    libcurl4-openssl-dev \
-    dbus-x11 \
-    vim-common \
-    libsqlite3-dev \
-    iproute2 \
-    libtasn1-6-dev \
-    socat \
-    libseccomp-dev \
-    expect \
-    gawk \
-    libjson-c-dev \
-    libengine-pkcs11-openssl \
-    default-jre \
-    default-jdk \
-    sqlite3 \
-    libnss3-tools \
-    python3 \
-    python3-pip \
-    libyaml-dev \
-    uuid-dev \
-    opensc \
-    gnutls-bin \
-    rustc \
-    acl \
-    libjson-glib-dev \
-    libusb-1.0-0-dev \
-    libftdi-dev \
-    libgmp-dev
-
-include(`pip3.m4')
-
-include(`autoconf.m4')
-include(`ibmtpm1682.m4')
-include(`swtpm.m4')
-include(`uthash.m4')
-include(`junit.m4')
-include(`mbedtls31.m4')
-
-WORKDIR /
diff --git a/ubuntu-22.04-mbedtls-3.6.docker.m4 b/ubuntu-22.04-mbedtls-3.6.docker.m4
index 6dec23e..9f7d47c 100644
--- a/ubuntu-22.04-mbedtls-3.6.docker.m4
+++ b/ubuntu-22.04-mbedtls-3.6.docker.m4
@@ -1,70 +1,69 @@
-FROM ubuntu:jammy
+FROM ubuntu:22.04
 
-LABEL org.opencontainers.image.source https://github.com/tpm2-software/tpm2-software-container
+LABEL org.opencontainers.image.source="https://github.com/tpm2-software/tpm2-software-container"
 
 ENV DEBIAN_FRONTEND=noninteractive
 RUN apt-get update && \
     apt-get install -y \
+    acl \
+    autoconf \
     autoconf-archive \
-    curl \
-    libcmocka0 \
-    libcmocka-dev \
-    net-tools \
-    build-essential \
-    git \
-    pkg-config \
-    gcc \
-    g++ \
-    m4 \
-    libtool \
     automake \
-    libgcrypt20-dev \
-    libssl-dev \
-    autoconf \
-    gnulib \
-    wget \
-    doxygen \
-    libdbus-1-dev \
-    libglib2.0-dev \
+    build-essential \
     clang \
     clang-tools \
-    pandoc \
-    lcov \
-    libcurl4-openssl-dev \
+    curl \
     dbus-x11 \
-    vim-common \
-    libsqlite3-dev \
-    iproute2 \
-    libtasn1-6-dev \
-    socat \
-    libseccomp-dev \
+    default-jdk \
+    default-jre \
+    doxygen \
     expect \
+    g++ \
     gawk \
-    libjson-c-dev \
+    gcc \
+    git \
+    gnulib \
+    gnutls-bin \
+    iproute2 \
+    lcov \
+    libcmocka-dev \
+    libcmocka0 \
+    libcurl4-openssl-dev \
+    libdbus-1-dev \
     libengine-pkcs11-openssl \
-    default-jre \
-    default-jdk \
-    sqlite3 \
+    libftdi-dev \
+    libgcrypt20-dev \
+    libglib2.0-dev \
+    libgmp-dev \
+    libjson-c-dev \
+    libjson-glib-dev \
     libnss3-tools \
-    python3 \
-    python3-pip \
+    libseccomp-dev \
+    libsqlite3-dev \
+    libssl-dev \
+    libtasn1-6-dev \
+    libtool \
+    libusb-1.0-0-dev \
     libyaml-dev \
-    uuid-dev \
+    m4 \
+    net-tools \
     opensc \
-    gnutls-bin \
+    pandoc \
+    pkg-config \
+    python3 \
+    python3-pip \
     rustc \
-    acl \
-    libjson-glib-dev \
-    libusb-1.0-0-dev \
-    libftdi-dev \
-    libgmp-dev
-
-include(`pip3.m4')
+    socat \
+    sqlite3 \
+    uthash-dev \
+    uuid-dev \
+    vim-common \
+    wget \
+    && rm -rf /var/lib/apt/lists/*
 
-include(`autoconf.m4')
 include(`ibmtpm1682.m4')
 include(`swtpm.m4')
-include(`uthash.m4')
+include(`pip3.m4')
 include(`junit.m4')
 include(`mbedtls36.m4')
 
diff --git a/ubuntu-22.04-pkcs11.docker.m4 b/ubuntu-22.04-pkcs11.docker.m4
new file mode 100644
index 0000000..9ca7411
--- /dev/null
+++ b/ubuntu-22.04-pkcs11.docker.m4
@@ -0,0 +1,4 @@
+include(`ubuntu-22.04-dev.docker.m4')
+
+include(`pip3.m4')
+include(`junit.m4')
diff --git a/ubuntu-22.04.docker.m4 b/ubuntu-22.04.docker.m4
index 8bd115f..e3c3405 100644
--- a/ubuntu-22.04.docker.m4
+++ b/ubuntu-22.04.docker.m4
@@ -1,71 +1,68 @@
-FROM ubuntu:jammy
+FROM ubuntu:22.04
 
-LABEL org.opencontainers.image.source https://github.com/tpm2-software/tpm2-software-container
+LABEL org.opencontainers.image.source="https://github.com/tpm2-software/tpm2-software-container"
 
 ENV DEBIAN_FRONTEND=noninteractive
 RUN apt-get update && \
     apt-get install -y \
+    acl \
+    autoconf \
     autoconf-archive \
-    curl \
-    libcmocka0 \
-    libcmocka-dev \
-    net-tools \
-    build-essential \
-    git \
-    pkg-config \
-    gcc \
-    g++ \
-    m4 \
-    libtool \
     automake \
-    libgcrypt20-dev \
-    libssl-dev \
-    autoconf \
-    gnulib \
-    wget \
-    doxygen \
-    libdbus-1-dev \
-    libglib2.0-dev \
+    build-essential \
     clang \
     clang-tools \
-    pandoc \
-    lcov \
-    libcurl4-openssl-dev \
+    curl \
     dbus-x11 \
-    vim-common \
-    libsqlite3-dev \
-    iproute2 \
-    libtasn1-6-dev \
-    socat \
-    libseccomp-dev \
+    default-jdk \
+    default-jre \
+    doxygen \
     expect \
+    g++ \
     gawk \
-    libjson-c-dev \
+    gcc \
+    git \
+    gnulib \
+    gnutls-bin \
+    iproute2 \
+    lcov \
+    libcmocka-dev \
+    libcmocka0 \
+    libcurl4-openssl-dev \
+    libdbus-1-dev \
     libengine-pkcs11-openssl \
-    default-jre \
-    default-jdk \
-    sqlite3 \
+    libftdi-dev \
+    libgcrypt20-dev \
+    libglib2.0-dev \
+    libgmp-dev \
+    libjson-c-dev \
+    libjson-glib-dev \
+    libmbedtls-dev \
     libnss3-tools \
-    python3 \
-    python3-pip \
+    libseccomp-dev \
+    libsqlite3-dev \
+    libssl-dev \
+    libtasn1-6-dev \
+    libtool \
+    libusb-1.0-0-dev \
     libyaml-dev \
-    libmbedtls-dev \
-    uuid-dev \
+    m4 \
+    net-tools \
     opensc \
-    gnutls-bin \
+    pandoc \
+    pkg-config \
+    python3 \
+    python3-pip \
     rustc \
-    acl \
-    libjson-glib-dev \
-    libusb-1.0-0-dev \
-    libftdi-dev \
-    libgmp-dev \
-    uthash-dev
-
-include(`pip3.m4')
+    socat \
+    sqlite3 \
+    uthash-dev \
+    uuid-dev \
+    vim-common \
+    wget \
+    && rm -rf /var/lib/apt/lists/*
 
-include(`autoconf.m4')
 include(`ibmtpm1682.m4')
 include(`swtpm.m4')
-include(`junit.m4')
 
 WORKDIR /
diff --git a/ubuntu-24.04-dev.docker.m4 b/ubuntu-24.04-dev.docker.m4
new file mode 100644
index 0000000..20d54b2
--- /dev/null
+++ b/ubuntu-24.04-dev.docker.m4
@@ -0,0 +1,2 @@
+include(`ubuntu-24.04.docker.m4')
+
diff --git a/ubuntu-24.04-pkcs11.docker.m4 b/ubuntu-24.04-pkcs11.docker.m4
new file mode 100644
index 0000000..2e91318
--- /dev/null
+++ b/ubuntu-24.04-pkcs11.docker.m4
@@ -0,0 +1,4 @@
+include(`ubuntu-24.04-dev.docker.m4')
+
+include(`pip3-withoutupgrade.m4')
+include(`junit.m4')
diff --git a/ubuntu-24.04.docker.m4 b/ubuntu-24.04.docker.m4
index 15684b4..d9c79b6 100644
--- a/ubuntu-24.04.docker.m4
+++ b/ubuntu-24.04.docker.m4
@@ -1,76 +1,73 @@
-FROM ubuntu:noble
+FROM ubuntu:24.04
 
-LABEL org.opencontainers.image.source https://github.com/tpm2-software/tpm2-software-container
+LABEL org.opencontainers.image.source="https://github.com/tpm2-software/tpm2-software-container"
 
 ENV DEBIAN_FRONTEND=noninteractive
 ENV PIP_REQUIRE_VIRTUALENV=0
 ENV PIP_BREAK_SYSTEM_PACKAGES=1
 RUN apt-get update && \
     apt-get install -y \
+    acl \
+    autoconf \
     autoconf-archive \
-    curl \
-    libcmocka0 \
-    libcmocka-dev \
-    net-tools \
-    build-essential \
-    git \
-    pkg-config \
-    gcc \
-    g++ \
-    m4 \
-    libtool \
     automake \
-    libgcrypt20-dev \
-    libssl-dev \
-    autoconf \
-    gnulib \
-    wget \
-    doxygen \
-    libdbus-1-dev \
-    libglib2.0-dev \
+    bear \
+    build-essential \
     clang \
-    clang-tools \
     clang-format \
-    pandoc \
-    lcov \
-    libcurl4-openssl-dev \
+    clang-tidy \
+    clang-tools \
+    curl \
     dbus-x11 \
-    vim-common \
-    libsqlite3-dev \
-    iproute2 \
-    libtasn1-6-dev \
-    socat \
-    libseccomp-dev \
+    default-jdk \
+    default-jre \
+    doxygen \
     expect \
+    g++ \
     gawk \
-    libjson-c-dev \
+    gcc \
+    git \
+    gnulib \
+    gnutls-bin \
+    iproute2 \
+    lcov \
+    libcmocka-dev \
+    libcmocka0 \
+    libcurl4-openssl-dev \
+    libdbus-1-dev \
     libengine-pkcs11-openssl \
-    default-jre \
-    default-jdk \
-    sqlite3 \
+    libftdi-dev \
+    libgcrypt20-dev \
+    libglib2.0-dev \
+    libgmp-dev \
+    libjson-c-dev \
+    libjson-glib-dev \
+    libmbedtls-dev \
     libnss3-tools \
-    python3 \
-    python3-pip \
+    libseccomp-dev \
+    libsqlite3-dev \
+    libssl-dev \
+    libtasn1-6-dev \
+    libtool \
+    libusb-1.0-0-dev \
     libyaml-dev \
-    libmbedtls-dev \
-    uuid-dev \
+    m4 \
+    net-tools \
     opensc \
-    gnutls-bin \
+    pandoc \
+    pkg-config \
+    python3 \
+    python3-pip \
     rustc \
-    acl \
-    libjson-glib-dev \
-    libusb-1.0-0-dev \
-    libftdi-dev \
-    libgmp-dev \
+    socat \
+    sqlite3 \
     uthash-dev \
-    clang-tidy \
-    bear
-
-include(`pip3-withoutupgrade.m4')
+    uuid-dev \
+    vim-common \
+    wget \
+    && rm -rf /var/lib/apt/lists/*
 
-include(`autoconf.m4')
 include(`ibmtpm1682.m4')
 include(`swtpm.m4')
-include(`junit.m4')
 
 WORKDIR /
diff --git a/ubuntu-26.04-dev.docker.m4 b/ubuntu-26.04-dev.docker.m4
new file mode 100644
index 0000000..ef70f2e
--- /dev/null
+++ b/ubuntu-26.04-dev.docker.m4
@@ -0,0 +1,3 @@
+include(`ubuntu-26.04.docker.m4')
+
+include(`ubuntu_26.04_dev_extras.m4')
diff --git a/ubuntu-26.04-pkcs11.docker.m4 b/ubuntu-26.04-pkcs11.docker.m4
new file mode 100644
index 0000000..ff1917a
--- /dev/null
+++ b/ubuntu-26.04-pkcs11.docker.m4
@@ -0,0 +1,5 @@
+include(`ubuntu-26.04-dev.docker.m4')
+
+include(`ubuntu_26.04_pkcs11_extras.m4')
+include(`pip3-withoutupgrade.m4')
+include(`junit.m4')
diff --git a/ubuntu-26.04.arm32v7.docker.m4 b/ubuntu-26.04.arm32v7.docker.m4
new file mode 100644
index 0000000..8b44999
--- /dev/null
+++ b/ubuntu-26.04.arm32v7.docker.m4
@@ -0,0 +1,8 @@
+FROM --platform=linux/arm/v7 ubuntu:26.04
+
+LABEL org.opencontainers.image.source="https://github.com/tpm2-software/tpm2-software-container"
+
+include(`ubuntu_26.04_base_deps.m4')
+include(`ibmtpm1682.m4')
+
+WORKDIR /
diff --git a/ubuntu-26.04.arm64v8.docker.m4 b/ubuntu-26.04.arm64v8.docker.m4
new file mode 100644
index 0000000..8575a85
--- /dev/null
+++ b/ubuntu-26.04.arm64v8.docker.m4
@@ -0,0 +1,8 @@
+FROM --platform=linux/arm64 ubuntu:26.04
+
+LABEL org.opencontainers.image.source="https://github.com/tpm2-software/tpm2-software-container"
+
+include(`ubuntu_26.04_base_deps.m4')
+include(`ibmtpm1682.m4')
+
+WORKDIR /
diff --git a/ubuntu-26.04.docker.m4 b/ubuntu-26.04.docker.m4
new file mode 100644
index 0000000..ed4ff09
--- /dev/null
+++ b/ubuntu-26.04.docker.m4
@@ -0,0 +1,8 @@
+FROM ubuntu:26.04
+
+LABEL org.opencontainers.image.source="https://github.com/tpm2-software/tpm2-software-container"
+
+include(`ubuntu_26.04_base_deps.m4')
+include(`ibmtpm1682.m4')
+
+WORKDIR /