diff --git a/src/cmd-build b/src/cmd-build
index a48f982764614a499adaa16c31587138d0fcf67b..2597d880baacbd5c799cbff96e48ab7bcf62293f 100755
--- a/src/cmd-build
+++ b/src/cmd-build
@@ -100,7 +100,6 @@ while true; do
             ;;
         -*)
             fatal "$0: unrecognized option: $1"
-            exit 1
             ;;
         *)
             break
@@ -228,6 +227,9 @@ cat > "${commitmeta_input_json}" <<EOF
 }
 EOF
 
+if [ -d "${workdir}/src/yumrepos" ]; then
+    prepare_git_artifacts "${workdir}/src/yumrepos" "${PWD}/coreos-assembler-yumrepos-git.json"
+fi
 prepare_git_artifacts "${configdir_gitrepo}" "${PWD}/coreos-assembler-config.tar.gz" "${PWD}/coreos-assembler-config-git.json"
 
 extra_compose_args=()
@@ -407,7 +409,16 @@ cat > tmp/buildmeta.json <<EOF
  "coreos-assembler.image-config-checksum": "${image_config_checksum}",
  "coreos-assembler.image-input-checksum": "${image_input_checksum}",
  "coreos-assembler.code-source": "${src_location}",
- "coreos-assembler.container-config-git": $(jq -M '.git' ${PWD}/coreos-assembler-config-git.json),
+EOF
+
+if [[ -f 'src/config.json' ]]; then
+    cat >> tmp/buildmeta.json <<EOF
+ "coreos-assembler.config-variant": "$(jq --raw-output '."coreos-assembler.config-variant"' 'src/config.json')"
+EOF
+fi
+
+cat >> tmp/buildmeta.json <<EOF
+ "coreos-assembler.container-config-git": $(jq -M '.git' "${PWD}/coreos-assembler-config-git.json"),
  "coreos-assembler.meta-stamp": $(python3 -c 'import time; print(time.time_ns())'),
  "coreos-assembler.delayed-meta-merge": ${DELAY_META_MERGE},
  "coreos-assembler.meta-stamp": $(date +%s%9N)
@@ -427,6 +438,14 @@ cat > tmp/images.json <<EOF
 }
 EOF
 
+if [ -f "${PWD}/coreos-assembler-yumrepos-git.json" ]; then
+    cat > tmp/yumrepos-git.json <<EOF
+{ "coreos-assembler.yumrepos-git": $(jq -M '.git' "${PWD}/coreos-assembler-yumrepos-git.json") }
+EOF
+else
+    echo '{}' > tmp/yumrepos-git.json
+fi
+
 overridesjson=tmp/overrides.json
 if [ -f "${overrides_active_stamp}" ]; then
     echo '{ "coreos-assembler.overrides-active": true }' > "${overridesjson}"
@@ -446,7 +465,7 @@ fi
 
 # Merge all the JSON; note that we want ${composejson} first
 # since we may be overriding data from a previous build.
-cat "${composejson}" "${overridesjson}" tmp/meta.json tmp/buildmeta.json tmp/diff.json tmp/parent-diff.json tmp/images.json tmp/cosa-image.json "${commitmeta_input_json}" | jq -s add > meta.json
+cat "${composejson}" "${overridesjson}" tmp/meta.json tmp/buildmeta.json tmp/diff.json tmp/parent-diff.json tmp/images.json tmp/cosa-image.json tmp/yumrepos-git.json "${commitmeta_input_json}" | jq -s add > meta.json
 
 # Move lockfile into build dir
 mv "${lockfile_out}" .
diff --git a/src/cmd-build-fast b/src/cmd-build-fast
index 49da7912354387c2cd60497cddfeb51d5e077f84..c07d3072344a1a6afc2052228a24300eefdee903 100755
--- a/src/cmd-build-fast
+++ b/src/cmd-build-fast
@@ -47,7 +47,6 @@ while true; do
             ;;
         -*)
             fatal "$0: unrecognized option: $1"
-            exit 1
             ;;
         *)
             break
diff --git a/src/cmd-buildextend-extensions b/src/cmd-buildextend-extensions
index bbd6bb9c2e38489378d6addeda8a7d6b66e5b6d9..4201acd05fc9974e86f4d175f80f4d63b27ba7b5 100755
--- a/src/cmd-buildextend-extensions
+++ b/src/cmd-buildextend-extensions
@@ -1,6 +1,7 @@
 #!/usr/bin/python3 -u
 
 import argparse
+import json
 import os
 import shutil
 import sys
@@ -28,8 +29,17 @@ def main():
         print("Use --force to force a rebuild")
         return
 
-    treefile_src = 'src/config/manifest.yaml'
-    extensions_src = 'src/config/extensions.yaml'
+    init_config = 'src/config.json'
+    if os.path.exists(init_config):
+        with open(init_config, encoding='utf-8') as f:
+            init_cfg = json.loads(f.read())
+            variant = init_cfg["coreos-assembler.config-variant"]
+            treefile_src = f"src/config/manifest-{variant}.yaml"
+            extensions_src = f"src/config/extensions-{variant}.yaml"
+    else:
+        treefile_src = 'src/config/manifest.yaml'
+        extensions_src = 'src/config/extensions.yaml'
+
     if not os.path.exists(extensions_src):
         raise Exception(f"Missing {extensions_src}")
 
diff --git a/src/cmd-fetch b/src/cmd-fetch
index 03ffa962c7519ecf49eada8b3b69e348d04fb90c..6813b657f15da226f8d4aabe13c2c06c8948ac6b 100755
--- a/src/cmd-fetch
+++ b/src/cmd-fetch
@@ -67,7 +67,6 @@ while true; do
             ;;
         *)
             fatal "$0: unrecognized option: $1"
-            exit 1
             ;;
     esac
     shift
@@ -76,7 +75,6 @@ done
 if [ $# -ne 0 ]; then
     print_help
     fatal "ERROR: Too many arguments"
-    exit 1
 fi
 
 prepare_build
diff --git a/src/cmd-init b/src/cmd-init
index 117977b923b9ae6bb09c106b135c342151a35031..d3d58667643ae04529e96e3cdf4cca39d3af00a4 100755
--- a/src/cmd-init
+++ b/src/cmd-init
@@ -9,12 +9,18 @@ dn=$(dirname "$0")
 FORCE=0
 BRANCH=""
 COMMIT=""
+TRANSIENT=0
+YUMREPOS=""
+YUMREPOS_BRANCH=""
+VARIANT=""
 
 print_help() {
     cat 1>&2 <<'EOF'
 Usage: coreos-assembler init --help
-       coreos-assembler init [--force] [--branch BRANCH] 
-                             [--commit COMMIT] GITCONFIG [SUBDIR]
+       coreos-assembler init [--force] [--transient] [--branch BRANCH] 
+                             [--commit COMMIT] [-V/--variant VARIANT]
+                             [--yumrepos GITREPO] [--yumrepos-branch BRANCH]
+			     GITCONFIG [SUBDIR]
 
   For example, you can use https://github.com/coreos/fedora-coreos-config
   as GITCONFIG, or fork it.  Another option useful for local development
@@ -22,6 +28,29 @@ Usage: coreos-assembler init --help
   starting with `/` - a symlink to it will be created and then used directly.
   You can specify a branch of a git repo with the `--branch` flag.
 
+  Use `--yumrepos` for builds that need .repo files and a content_sets.yaml which
+  are not in GITCONFIG. For example: files need to be hidden behind a firewall
+  in GITREPO. Using this option will clone GITREPO alongside GITCONFIG, thus you
+  may need to configure certificates. Use `--yumrepos-branch` to choose a non-default
+  branch when cloning. Local paths are also supported. 
+
+  Use `--transient` for builds that will throw away all cached data on success/failure,
+  and should hence not invoke `fsync()` for example.
+
+  Each config repo must include a default set of manifests for NOSA to be able
+  to build an ostree commit and disk images (respectively with 'manifest.yaml'
+  and 'image.yaml'). You can also optionally provide another manifest to build
+  extensions (via extensions.yaml).
+
+  Config repos may also include additional variants and you can select which one
+  to use with the '--variant' flag. The manifests for those variants should
+  follow the following naming convention: 'manifest-$VARIANT.yaml'
+  'image-$VARIANT.yaml' 'extensions-$VARIANT.yaml'.
+
+  The selected variant will be stored in 'src/variant.json'. Make sure to clean
+  all caches with 'cosa clean --all' if you manually switch the variant after
+  'cosa init'.
+  
   If specified, SUBDIR is a subdirectory of the git repository that should
   contain manifest.yaml and image.yaml (or image.ks).
 EOF
@@ -29,7 +58,7 @@ EOF
 
 # Call getopt to validate the provided input.
 rc=0
-options=$(getopt --options hfb:c: --longoptions help,force,branch:,commit: -- "$@") || rc=$?
+options=$(getopt --options hfb:c:V: --longoptions help,force,transient,branch:,commit:,yumrepos:,yumrepos-branch:,variant: -- "$@") || rc=$?
 [ $rc -eq 0 ] || {
     print_help
     exit 1
@@ -44,6 +73,9 @@ while true; do
     -f | --force)
         FORCE=1
         ;;
+    --transient)
+        TRANSIENT=1
+        ;;
     -b | --branch)
         case "$2" in
             "")
@@ -62,6 +94,33 @@ while true; do
                 shift ;;
         esac
         ;;
+    --yumrepos)
+        case "$2" in
+            "")
+                shift ;;
+            *)
+                YUMREPOS="$2"
+                shift ;;
+        esac
+        ;;
+    --yumrepos-branch)
+        case "$2" in
+            "")
+                shift ;;
+            *)
+                YUMREPOS_BRANCH="$2"
+                shift ;;
+        esac
+        ;;
+    -V | --variant)
+        case "$2" in
+            "")
+                shift ;;
+            *)
+                VARIANT="$2"
+                shift ;;
+        esac
+        ;;
     --)
         shift
         break
@@ -69,17 +128,15 @@ while true; do
     *)
         print_help
         fatal "init: unrecognized option: $1"
-        exit 1
         ;;
     esac
     shift
 done
 
 # If user did not provide a repo then error out
-if [ $# = 0 ]; then
+if [ $# -ne 1 ]; then
     print_help
     fatal "ERROR: Missing GITCONFIG"
-    exit 1
 fi
 
 # If the current working dir is not empty then error out
@@ -116,6 +173,7 @@ mkdir -p src
             if [ -n "${COMMIT}" ]; then
                 git -C ./config fetch origin "$COMMIT"
                 git -C ./config reset --hard "$COMMIT"
+                git -C ./config submodule update --init --recursive
             fi
             if [ -n "${subdir}" ]; then
                 mv config config-git
@@ -124,15 +182,46 @@ mkdir -p src
             (set +x; cd config && echo -n "Config commit: " && git describe --tags --always --abbrev=42)
             ;;
      esac
-     manifest=config/manifest.yaml
-     if ! [ -f "${manifest}" ]; then
-         echo 1>&2 "Failed to find src/${manifest}"
-         fatal "If using a custom configuration, be sure it has a manifest.yaml."
-     fi
  fi)
 
+# Default paths for manifest.yaml & image.yaml
+manifest="src/config/manifest.yaml"
+image="src/config/image.yaml"
+if [[ ! -f "${manifest}" ]] || [[ ! -f "${image}" ]]; then
+    echo 1>&2 "Could not find default manifests (${manifest} & ${image})"
+    fatal "If you are using a custom configuration, be sure it has a manifest.yaml & image.yaml."
+fi
+
+# Select the variant if requested
+if [[ -n "${VARIANT}" ]] && [[ "${VARIANT}" != "default" ]]; then
+    manifest="src/config/manifest-${VARIANT}.yaml"
+    image="src/config/image-${VARIANT}.yaml"
+    if [[ ! -f "${manifest}" ]] || [[ ! -f "${image}" ]]; then
+        fatal "Could not find the manifests (${manifest} & ${image}) for the '${VARIANT}' variant"
+    fi
+    echo "Using variant: '${VARIANT}'"
+    cat > "src/config.json" <<EOF
+{
+  "coreos-assembler.config-variant": "${VARIANT}"
+}
+EOF
+fi
+
 mkdir -p cache
 mkdir -p builds
 mkdir -p tmp
 mkdir -p overrides/rpm
 mkdir -p overrides/rootfs
+
+if test "${TRANSIENT}" = 1; then
+    touch tmp/nosa-transient
+fi
+
+case "${YUMREPOS}" in
+    "");;
+    /*) ln -s "${YUMREPOS}" src/yumrepos;;
+    *) git clone ${YUMREPOS_BRANCH:+--branch=${YUMREPOS_BRANCH}} --depth=1 "${YUMREPOS}" src/yumrepos;;
+esac
+
+set +x
+echo "Initialized $PWD as nestos-assembler working directory."
diff --git a/src/cmd-offline-update b/src/cmd-offline-update
index 28efe1773f60ffbc241cac97e5de411e7671b799..146b3616f481a0fcb94d0ada6d93ea59cb60f773 100755
--- a/src/cmd-offline-update
+++ b/src/cmd-offline-update
@@ -57,7 +57,6 @@ while true; do
             ;;
         -*)
             fatal "$0: unrecognized option: $1"
-            exit 1
             ;;
         *)
             break
diff --git a/src/cmdlib.sh b/src/cmdlib.sh
index 5ee1d1cbd33031ba76fd8de31b4ae178f1407ec6..8a0904470a9fdf2be0ebe3e02d8e6eb15497ce36 100755
--- a/src/cmdlib.sh
+++ b/src/cmdlib.sh
@@ -161,7 +161,19 @@ prepare_build() {
     mkdir "${tmp_builddir}"
 
     configdir=${workdir}/src/config
-    manifest=${configdir}/manifest.yaml
+    initconfig="${workdir}/src/config.json"
+    if [[ -f "${initconfig}" ]]; then
+        variant="$(jq --raw-output '."coreos-assembler.config-variant"' "${initconfig}")"
+        manifest="${configdir}/manifest-${variant}.yaml"
+        image="${configdir}/image-${variant}.yaml"
+        # Currently unused as cmd-buildextend-extensions is in Python
+        # extensions="${configdir}/extensions-${variant}.yaml"
+    else
+        manifest="${configdir}/manifest.yaml"
+        image="${configdir}/image.yaml"
+        # Currently unused as cmd-buildextend-extensions is in Python
+        # extensions="${configdir}/extensions.yaml"
+    fi
     # for the base lockfile, we default to JSON since that's what rpm-ostree
     # actually outputs
     manifest_lock=$(pick_yaml_or_else_json "${configdir}/manifest-lock.${basearch}" json)
@@ -203,6 +215,11 @@ prepare_build() {
         else
             ostree init --repo="${tmprepo}" --mode=archive
         fi
+
+        # No need to fsync for transient flows
+        if test -f "${workdir}/tmp/nosa-transient"; then
+            ostree --repo="${tmprepo}" config set 'core.fsync' 'false'
+        fi
     fi
 
     configdir_gitrepo=${configdir}
@@ -311,7 +328,7 @@ prepare_compose_overlays() {
         exit 1
     fi
 
-    if [ -d "${overridesdir}" ] || [ -d "${ovld}" ]; then
+    if [ -d "${overridesdir}" ] || [ -d "${ovld}" ] || [ -d "${workdir}/src/yumrepos" ]; then
         mkdir -p "${tmp_overridesdir}"
         cat > "${override_manifest}" <<EOF
 include: ${manifest}
@@ -319,7 +336,14 @@ EOF
         # Because right now rpm-ostree doesn't look for .repo files in
         # each included dir.
         # https://github.com/projectatomic/rpm-ostree/issues/1628
-        cp "${workdir}"/src/config/*.repo "${tmp_overridesdir}"/
+        find "${configdir}/" -maxdepth 1 -type f -name '*.repo' -exec cp -t "${tmp_overridesdir}" {} +
+        if [ -d "${workdir}/src/yumrepos" ]; then
+            find "${workdir}/src/yumrepos/" -maxdepth 1 -type f -name '*.repo' -exec cp -t "${tmp_overridesdir}" {} +
+        fi
+        if ! ls "${tmp_overridesdir}"/*.repo; then
+            echo "ERROR: no yum repo files were found"
+            exit 1
+        fi
         manifest=${override_manifest}
     fi
 
@@ -385,6 +409,35 @@ EOF
     else
         rm -vf "${local_overrides_lockfile}"
     fi
+
+    contentset_path=""
+    if [ -e "${configdir}/content_sets.yaml" ]; then
+        contentset_path="${configdir}/content_sets.yaml"
+    elif [ -e "${workdir}/src/yumrepos/content_sets.yaml" ]; then
+        contentset_path="${workdir}/src/yumrepos/content_sets.yaml"
+    fi
+
+    if [ -n "${contentset_path}" ]; then
+        mkdir -p "${tmp_overridesdir}"/contentsetrootfs/usr/share/buildinfo/
+        # create_content_manifest takes in the base repos and maps them to their pulp repository IDs
+        # available in content_sets.yaml. The mapped repos are then available in content_manifest.json
+        # Feature: https://issues.redhat.com/browse/GRPA-3731
+        create_content_manifest "${contentset_path}" "${tmp_overridesdir}/contentsetrootfs/usr/share/buildinfo/content_manifest.json"
+        # adjust permissions to appease the ext.config.shared.files.file-directory-permissions test
+        chmod 0644 "${tmp_overridesdir}/contentsetrootfs/usr/share/buildinfo/content_manifest.json"
+
+        echo -n "Committing ${tmp_overridesdir}/contentsetrootfs... "
+        commit_overlay contentset "${tmp_overridesdir}/contentsetrootfs"
+        layers="${layers} overlay/contentset"
+    fi
+
+    if [ -n "${layers}" ]; then
+        echo "ostree-layers:" >> "${override_manifest}"
+        for layer in ${layers}; do
+            echo "  - ${layer}" >> "${override_manifest}"
+        done
+    fi
+
     rootfs_overrides="${overridesdir}/rootfs"
     if [[ -d "${rootfs_overrides}" && -n $(ls -A "${rootfs_overrides}") ]]; then
         echo -n "Committing ${rootfs_overrides}... "