Filter out BLS entries not managed by bootc by Dudecake · Pull Request #2243 · bootc-dev/bootc

Dudecake · 2026-06-10T12:59:16Z

The cases that the tests in the last commit check cannot occur anymore because of the changes in get_sorted_type1_boot_entries_helper. If they're unneeded, I can drop the commit.

Johan-Liebert1

This would work, but only for the first boot, and will probably fail on updates and switches as these entries won't be copied to the staged directory.

Dudecake · 2026-06-10T14:13:14Z

This would work, but only for the first boot, and will probably fail on updates and switches as these entries won't be copied to the staged directory.

Sad face. That makes this pretty useless as installing to a populated ESP works without issue, only bootc status and bootc update are broken.

Would the caller of list_type1_entries have to filter out these entries before calling get_verity on them?

Johan-Liebert1 · 2026-06-10T14:21:46Z

Would the caller of list_type1_entries have to filter out these entries before calling get_verity on them?

yes, and these need special treatment for updates/switches. Also, we need to make sure these appear last in the boot entries list etc etc. There are a few more cases that need to be handled

Dudecake · 2026-06-22T12:08:37Z

I've been looking at this last- and previous weekend and attempting to have the caller filter these entries out would require a lot of changes as the original filename isn't included in the return value of list_type1_entries.

Creating unique filenames for entries using the same efi argument would be possible (but quite annoying) by also putting the title and/or options in the filename, so instead in create_staged_bls_entries copies any non-managed BLS entry to the staging directory.

Johan-Liebert1

State resilience test seems to be failing with

                        content: Error:   x Assertion failed.
                        content:     ,-[/var/tmp/tmt/bootc-tmt-mldew2as-tmt-plans-integration-plan-45-composefs-corruped-state-resilience/tmt/plans/integration/plan-45-composefs-corruped-state-resilience/discover/default-0/tests/tmt/tests/booted/test-composefs-corruped-state-resilience.nu:51:12]
                        content:  50 |     
                        content:  51 | ,->     assert (
                        content:  52 | |           journalctl F_MESSAGE_ID=d264f924dadb4c31bff0412107d391fb
                        content:  53 | |           | str contains $"No origin file for deployment bad-verity"
                        content:  54 | |->     )
                        content:     : `---- It is not true.
                        content:  55 |     
                        content:     `----

This is because we log a journal message when we encounter an entry that bootc doesn't own (doesn't start with our prefix). I think it's better now to change this error message as we are handling these entries

Dudecake · 2026-06-30T06:24:08Z

Nooo...

I'm not really sure how these entries end up here as list_bootloader_entries receives them from the changed get_sorted_type1_boot_entries_helper. Or is this test for grub with a user.cfg file?

Johan-Liebert1 · 2026-07-06T12:05:16Z

        staged_entries.atomic_write(filename, new_entry.to_string().as_bytes())?;
    }

+    let original_entries = boot_dir.open_dir(TYPE1_ENT_PATH)?;


This is fine, but this is only for backwards compatibility stuff. The actual code for writing the staged entries would be somewhere in crates/lib/src/bootc_composefs/boot.rs

Johan-Liebert1 · 2026-07-06T12:06:57Z

CI errors are unrelated to this PR

Dudecake · 2026-07-20T06:41:39Z

I'm not entirely happy with what I had to do to create a BootSetupType Upgrade in test_write_systemd_uki_config, but adding it to a (new) tmt test was a bit too intimidating

cgwalters · 2026-09-08T17:58:04Z

@Johan-Liebert1 are you going to re-review this one? Only skimming at a high level it seems sane to me

Johan-Liebert1 · 2026-09-09T06:54:50Z

Ah, yes, this was buried deep in my GH notifications

Johan-Liebert1

Looks good overall. Needs a rebase to fix conflicts

Johan-Liebert1 · 2026-09-09T10:52:12Z

            .with_context(|| format!("Writing to {file_name}"))?;
    }

+    let original_entries = boot_dir.open_dir(TYPE1_ENT_PATH)?;


Repeated function https://github.com/bootc-dev/bootc/pull/2243/changes#diff-1604878878a88c4dcbd7f51444b69fc01a58e3ab48ade4e10b7a9ed05fa867f8R1232. Can be refactored

Johan-Liebert1 · 2026-09-09T10:52:57Z

 }
+
+#[cfg(test)]
+mod tests {


These tests are fine to have, but having proper integration tests in the tmt/tests directory would be much nicer

I has some difficulty setting up an environment where I can run the integration tests. The existing tests should be green in a clean fedora cloud image after installing the packages from the contributing document, but they're not...

I'll see if I can figure it out

It was SELinux...

Not that I got much further after that. I was able to add a few checks to an existing tests and the custom entry is still there at the end, but the entries.staged directory doesn't seem to exist after the bootc upgrade... So there's probably something I'm not understanding/checking correctly

It was SELinux...

that's always a tough one to find.

but the entries.staged directory doesn't seem to exist after the bootc upgrade

is the .staged directly not available after reboot, or before reboot? If it's not available before reboot, then yeah, there is something wrong here.

Before reboot, so it should be there

I don't see any obvious issues in your function. Are you sure you're checking in the right place?

Johan-Liebert1 · 2026-10-05T07:36:01Z

+        let entry = entry?;
+        let entry_name = entry.file_name()?;
+        if entry.file_type()?.is_file() && !entry_name.starts_with(BLS_ENTRY_PREFIX) {
+            original_entries.copy(entry_name.clone(), staged_entries, entry_name)?;


Ideally we'd want atomic writes here

Johan-Liebert1 · 2026-10-05T07:38:53Z

+
+#[context("Staging non-managed BLS entry")]
+pub(crate) fn stage_non_manged_bls_entries(boot_dir: &Dir, staged_entries: &Dir) -> Result<()> {
+    let original_entries = boot_dir.open_dir(TYPE1_ENT_PATH)?;


Maybe this should be the dir we pass and not the boot dir? We don't really need to boot dir per-se

Johan-Liebert1

Looks good

Dudecake · 2026-10-27T07:36:44Z

I didn't get around to fixing the integration test failures with ostree and the whitespace-only hunk in test-composefs-corrupted-state-resilience.nu past weekend + yesterday

I was planning on adding is_composefs to the ("/boot/loader/entries" | path exists) check tonight

Signed-off-by: Dudecake <ckoomen@ckoomen.eu>

bootc-bot Bot requested a review from jeckersb June 10, 2026 12:59

Dudecake force-pushed the filter-custom-bls-entries branch from dba7de3 to 9ade58e Compare June 10, 2026 13:08

Johan-Liebert1 requested changes Jun 10, 2026

View reviewed changes

Comment thread crates/lib/src/composefs_consts.rs

Dudecake marked this pull request as draft June 11, 2026 04:46

Dudecake force-pushed the filter-custom-bls-entries branch from 9ade58e to 80be97c Compare June 22, 2026 06:47

Dudecake marked this pull request as ready for review June 22, 2026 12:08

bootc-bot Bot requested a review from henrywang June 22, 2026 12:09

Johan-Liebert1 added the ci/tier-1 Run CI for tier-1 OS (centos-10) only label Jun 22, 2026

Johan-Liebert1 requested changes Jun 23, 2026

View reviewed changes

Comment thread crates/lib/src/bootc_composefs/backwards_compat/bcompat_boot.rs Outdated

Comment thread crates/lib/src/composefs_consts.rs

Comment thread crates/lib/src/bootc_composefs/backwards_compat/bcompat_boot.rs Outdated

Dudecake force-pushed the filter-custom-bls-entries branch from 80be97c to 6307167 Compare July 6, 2026 06:32

Johan-Liebert1 requested changes Jul 6, 2026

View reviewed changes

Dudecake force-pushed the filter-custom-bls-entries branch from 6307167 to 203a9f6 Compare July 20, 2026 06:38

Dudecake force-pushed the filter-custom-bls-entries branch from 203a9f6 to 4024f97 Compare August 24, 2026 06:27

Johan-Liebert1 reviewed Sep 9, 2026

View reviewed changes

Dudecake force-pushed the filter-custom-bls-entries branch from 4024f97 to e4f5df0 Compare September 21, 2026 09:16

Johan-Liebert1 mentioned this pull request Sep 21, 2026

install: Only remove bootloader dirs from the ESP #2475

Merged

cgwalters-bot added this to Composefs Stable Sep 25, 2026

cgwalters-bot moved this to In Review in Composefs Stable Sep 25, 2026

Johan-Liebert1 reviewed Oct 5, 2026

View reviewed changes

Dudecake force-pushed the filter-custom-bls-entries branch from e4f5df0 to 3ed9139 Compare October 23, 2026 20:32

Johan-Liebert1 previously approved these changes Oct 27, 2026

View reviewed changes

Dudecake added 4 commits October 27, 2026 17:34

Filter out BLS entries not managed by bootc

e7c2791

Signed-off-by: Dudecake <ckoomen@ckoomen.eu>

Copy unmanaged BLS entries to staging dir on upgrade

8a94323

Signed-off-by: Dudecake <ckoomen@ckoomen.eu>

Copy unmanaged BLS entries to staging dir on rollback

05aec35

Signed-off-by: Dudecake <ckoomen@ckoomen.eu>

Added tests for non-confirming efi BLS entries

2df98c5

Signed-off-by: Dudecake <ckoomen@ckoomen.eu>

Dudecake dismissed Johan-Liebert1’s stale review via 2df98c5 October 27, 2026 17:36

Dudecake force-pushed the filter-custom-bls-entries branch from 3ed9139 to 2df98c5 Compare October 27, 2026 17:36

Conversation

Dudecake commented Jun 10, 2026

Uh oh!

Johan-Liebert1 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Dudecake commented Jun 10, 2026

Uh oh!

Johan-Liebert1 commented Jun 10, 2026

Uh oh!

Dudecake commented Jun 22, 2026

Uh oh!

Johan-Liebert1 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Dudecake commented Jun 30, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Johan-Liebert1 commented Jul 6, 2026

Uh oh!

Dudecake commented Jul 20, 2026

Uh oh!

cgwalters commented Sep 8, 2026

Uh oh!

Johan-Liebert1 commented Sep 9, 2026

Uh oh!

Johan-Liebert1 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Johan-Liebert1 left a comment

Choose a reason for hiding this comment

Uh oh!

Dudecake commented Oct 27, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Johan-Liebert1 left a comment •

edited

Loading