Skip to content

Filter out BLS entries not managed by bootc #2243

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Dudecake wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Filter out BLS entries not managed by bootc #2243

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
e7c2791
Filter out BLS entries not managed by bootc
Dudecake Jun 10, 2026
8a94323
Copy unmanaged BLS entries to staging dir on upgrade
Dudecake Jun 10, 2026
05aec35
Copy unmanaged BLS entries to staging dir on rollback
Dudecake Jul 14, 2026
2df98c5
Added tests for non-confirming efi BLS entries
Dudecake Jun 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
69 changes: 68 additions & 1 deletion crates/lib/src/bootc_composefs/backwards_compat/bcompat_boot.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,10 +11,11 @@ use crate::{
ComposefsCmdline, get_bootloader, get_sorted_grub_uki_boot_entries,
get_sorted_type1_boot_entries,
},
utils::stage_non_manged_bls_entries,
},
composefs_consts::{
ORIGIN_KEY_BOOT, ORIGIN_KEY_BOOT_TYPE, STATE_DIR_RELATIVE, TYPE1_BOOT_DIR_PREFIX,
TYPE1_ENT_PATH_STAGED, UKI_NAME_PREFIX, USER_CFG_STAGED,
TYPE1_ENT_PATH, TYPE1_ENT_PATH_STAGED, UKI_NAME_PREFIX, USER_CFG_STAGED,
},
parsers::bls_config::{BLSConfig, BLSConfigType, EFIKey},
spec::BootloaderKind,
Expand Down Expand Up @@ -244,6 +245,8 @@ fn create_staged_bls_entries(boot_dir: &Dir, entries: &Vec<(String, BLSConfig)>)
staged_entries.atomic_write(filename, new_entry.to_string().as_bytes())?;
}

stage_non_manged_bls_entries(&boot_dir.open_dir(TYPE1_ENT_PATH)?, &staged_entries)?;

fsync(staged_entries.reopen_as_ownedfd()?).context("fsync")
}

Expand Down Expand Up @@ -399,3 +402,67 @@ pub(crate) async fn prepend_custom_prefix(

Ok(())
}

#[cfg(test)]
mod tests {
use crate::bootc_composefs::backwards_compat::bcompat_boot::*;
use crate::parsers::bls_config::parse_bls_config;
use anyhow::Result;
use cap_std_ext::{cap_std, dirext::CapStdExtDirExt};

#[test]
fn test_create_staged_bls_entries() -> Result<()> {
let tempdir = cap_std_ext::cap_tempfile::tempdir(cap_std::ambient_authority())?;

let entry1 = r#"
title Fedora 42.20250623.3.1 (CoreOS)
version fedora-42.0
sort-key 1
linux /boot/7e11ac46e3e022053e7226a20104ac656bf72d1a84e3a398b7cce70e9df188b6/vmlinuz-5.14.10
initrd /boot/7e11ac46e3e022053e7226a20104ac656bf72d1a84e3a398b7cce70e9df188b6/initramfs-5.14.10.img
options root=UUID=abc123 rw composefs=7e11ac46e3e022053e7226a20104ac656bf72d1a84e3a398b7cce70e9df188b6
"#;
let entry2 = r#"
title Fedora 41.20250214.2.0 (CoreOS)
version fedora-42.0
sort-key 2
efi /EFI/Linux/f7415d75017a12a387a39d2281e033a288fc15775108250ef70a01dcadb93346.efi
options root=UUID=abc123 rw composefs=febdf62805de2ae7b6b597f2a9775d9c8a753ba1e5f09298fc8fbe0b0d13bf01
"#;
let entry3 = r#"
title Test
version 1
sort-key 9
efi /EFI/boot/test.efi
"#;

tempdir.create_dir_all("loader/entries")?;
tempdir.atomic_write("loader/entries/bootc_entry1.conf", entry1)?;
tempdir.atomic_write("loader/entries/bootc_entry2.conf", entry2)?;
tempdir.atomic_write("loader/entries/entry3.conf", entry3)?;

let entries = vec![
(
"bootc_entry1.conf".to_string(),
parse_bls_config(entry1).unwrap(),
),
(
"bootc_entry2.conf".to_string(),
parse_bls_config(entry2).unwrap(),
),
];

create_staged_bls_entries(&tempdir, &entries).unwrap();

assert!(tempdir.exists("loader/entries.staged/bootc_entry1.conf"));
assert!(tempdir.exists("loader/entries.staged/bootc_entry2.conf"));
assert!(tempdir.exists("loader/entries.staged/entry3.conf"));

assert_eq!(
str::from_utf8(&tempdir.read("loader/entries.staged/entry3.conf")?[..])?,
entry3
);

Ok(())
}
}
118 changes: 118 additions & 0 deletions crates/lib/src/bootc_composefs/boot.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,6 +103,7 @@ use serde::{Deserialize, Serialize};

use crate::bootc_composefs::state::{get_booted_bls, write_composefs_state};
use crate::bootc_composefs::status::build_composefs_karg;
use crate::bootc_composefs::utils::stage_non_manged_bls_entries;
use crate::bootc_kargs::compute_new_kargs;
use crate::composefs_consts::{
BLS_ENTRY_FILE_PREFIX, TYPE1_BOOT_DIR_PREFIX, TYPE1_ENT_PATH, TYPE1_ENT_PATH_STAGED,
Expand Down Expand Up @@ -1078,6 +1079,12 @@ pub(crate) fn setup_composefs_bls_boot(
)?;
}

if is_upgrade {
let original_entries =
Dir::open_ambient_dir(&loader_path.join(BOOT_LOADER_ENTRIES), ambient_authority())?;
stage_non_manged_bls_entries(&original_entries, &loader_entries_dir)?;
}

let owned_loader_entries_fd = loader_entries_dir
.reopen_as_ownedfd()
.context("Reopening as owned fd")?;
Expand Down Expand Up @@ -1795,6 +1802,10 @@ fn write_systemd_uki_config(
)?;
}

if let BootSetupType::Upgrade(_) = setup_type {
stage_non_manged_bls_entries(&esp_dir.open_dir(TYPE1_ENT_PATH)?, &entries_dir)?;
}

// Write the timeout for bootloader menu if not exists
if !esp_dir.exists(SYSTEMD_LOADER_CONF_PATH) {
esp_dir
Expand Down Expand Up @@ -2709,6 +2720,16 @@ pub(crate) fn expected_boot_image_ids(

#[cfg(test)]
mod tests {
use cap_std::fs::Dir;
use cap_std_ext::cap_std;
use ostree_ext::{ostree::SysrootBuilder, sysroot::SysrootLock};
use std::fs::File;

use crate::{
bootc_composefs::{digest::new_temp_composefs_repo, status::ComposefsCmdline},
k8sapitypes::Resource,
};

use super::*;
use composefs::erofs::format::FormatVersion;
use composefs_boot::bootloader::{AbootArtifact, AbootEncoding, AbootEntry, Type2Entry};
Expand Down Expand Up @@ -3544,4 +3565,101 @@ mod tests {
}
}
}

#[tokio::test]
async fn test_write_systemd_uki_config() -> Result<()> {
let tempdir = cap_std_ext::cap_tempfile::tempdir(cap_std::ambient_authority())?;

let entry1 = r#"
title Fedora 42.20250623.3.1 (CoreOS)
version fedora-42.0
sort-key 1
linux /boot/7e11ac46e3e022053e7226a20104ac656bf72d1a84e3a398b7cce70e9df188b6/vmlinuz-5.14.10
initrd /boot/7e11ac46e3e022053e7226a20104ac656bf72d1a84e3a398b7cce70e9df188b6/initramfs-5.14.10.img
options root=UUID=abc123 rw composefs=7e11ac46e3e022053e7226a20104ac656bf72d1a84e3a398b7cce70e9df188b6
"#;
let entry2 = r#"
title Fedora 41.20250214.2.0 (CoreOS)
version fedora-42.0
sort-key 2
efi /EFI/Linux/f7415d75017a12a387a39d2281e033a288fc15775108250ef70a01dcadb93346.efi
options root=UUID=abc123 rw composefs=febdf62805de2ae7b6b597f2a9775d9c8a753ba1e5f09298fc8fbe0b0d13bf01
"#;
let entry3 = r#"
title Test
version 1
sort-key 9
efi /EFI/boot/test.efi
"#;

tempdir.create_dir_all("loader/entries")?;
tempdir.atomic_write("loader/entries/bootc_entry1.conf", entry1)?;
tempdir.atomic_write("loader/entries/bootc_entry2.conf", entry2)?;
tempdir.atomic_write("loader/entries/entry3.conf", entry3)?;

let sysroot_path = format!(
"{}/test_write_systemd_uki_config",
std::env::temp_dir().display()
);
std::fs::create_dir_all(&sysroot_path)?;
let dir = Dir::from_std_file(File::open(&sysroot_path)?);
let sysroot_dir = cap_std_ext::cap_tempfile::tempdir_in(&dir)?;
sysroot_dir.create_dir_all("ostree/repo")?;
sysroot_dir.atomic_write(
"ostree/repo/config",
r#"[core]
repo_version=1
mode=bare-split-xattrs
"#,
)?;

let sysroot = SysrootBuilder::new()
.path(Some(sysroot_path.into()))
.create(None)?;
let sysroot_lock = SysrootLock::new_from_sysroot(&sysroot).await?;
let storage = Storage::new_ostree(sysroot_lock, &sysroot_dir)?;
let cmdline = Box::new(ComposefsCmdline::new(Default::default()));
let (_repo_dir, repo) = new_temp_composefs_repo(FormatVersion::V1)?;
let booted_composefs = BootedComposefs {
repo: repo,
cmdline: Box::leak(cmdline),
};
let host = Host {
resource: Resource {
api_version: Default::default(),
kind: Default::default(),
metadata: Default::default(),
},
spec: Default::default(),
status: Default::default(),
};
let boot_setup_type = BootSetupType::Upgrade((&storage, &booted_composefs, &host));
let boot_label = "label".to_string();
let id = Sha512HashValue::EMPTY;
let bootloader = Bootloader::Systemd;

write_systemd_uki_config(
&tempdir,
&boot_setup_type,
boot_label,
None,
None,
&id,
&bootloader,
)?;

assert!(tempdir.exists(SYSTEMD_LOADER_CONF_PATH));
assert!(tempdir.exists("loader/entries.staged"));
assert!(tempdir.exists("loader/entries.staged/bootc_bootc-00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000-1.conf"));
assert!(tempdir.exists("loader/entries.staged/bootc_bootc-fedora-42.0-0.conf"));
assert!(!tempdir.exists("loader/entries.staged/bootc_bootc-fedora-42.0-1.conf"));
assert!(tempdir.exists("loader/entries.staged/entry3.conf"));

assert_eq!(
str::from_utf8(&tempdir.read("loader/entries.staged/entry3.conf")?[..])?,
entry3
);

Ok(())
}
}
73 changes: 72 additions & 1 deletion crates/lib/src/bootc_composefs/rollback.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,10 @@ use crate::bootc_composefs::boot::{
secondary_sort_key, type1_entry_conf_file_name,
};
use crate::bootc_composefs::status::{get_composefs_status, get_sorted_type1_boot_entries};
use crate::bootc_composefs::utils::stage_non_manged_bls_entries;
use crate::composefs_consts::{
COMPOSEFS_STAGED_DEPLOYMENT_FNAME, COMPOSEFS_TRANSIENT_STATE_DIR, TYPE1_ENT_PATH_STAGED,
COMPOSEFS_STAGED_DEPLOYMENT_FNAME, COMPOSEFS_TRANSIENT_STATE_DIR, TYPE1_ENT_PATH,
TYPE1_ENT_PATH_STAGED,
};
use crate::deploy::ROLLBACK_JOURNAL_ID;
use crate::spec::{Bootloader, BootloaderKind, Host};
Expand Down Expand Up @@ -199,6 +201,8 @@ fn rollback_composefs_entries(host: &Host, boot_dir: &Dir, bootloader: Bootloade
.with_context(|| format!("Writing to {file_name}"))?;
}

stage_non_manged_bls_entries(&boot_dir.open_dir(TYPE1_ENT_PATH)?, &rollback_entries_dir)?;

let rollback_entries_dir = rollback_entries_dir
.reopen_as_ownedfd()
.context("Reopening as owned fd")?;
Expand Down Expand Up @@ -299,3 +303,70 @@ pub(crate) async fn composefs_rollback(

Ok(())
}

#[cfg(test)]
mod tests {

@Johan-Liebert1 Johan-Liebert1 Sep 9, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These tests are fine to have, but having proper integration tests in the tmt/tests directory would be much nicer

@Dudecake Dudecake Sep 21, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I has some difficulty setting up an environment where I can run the integration tests. The existing tests should be green in a clean fedora cloud image after installing the packages from the contributing document, but they're not...

I'll see if I can figure it out

@Dudecake Dudecake Oct 5, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It was SELinux...

Not that I got much further after that. I was able to add a few checks to an existing tests and the custom entry is still there at the end, but the entries.staged directory doesn't seem to exist after the bootc upgrade... So there's probably something I'm not understanding/checking correctly

@Johan-Liebert1 Johan-Liebert1 Oct 5, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It was SELinux...

that's always a tough one to find.

but the entries.staged directory doesn't seem to exist after the bootc upgrade

is the .staged directly not available after reboot, or before reboot? If it's not available before reboot, then yeah, there is something wrong here.

@Dudecake Dudecake Oct 5, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Before reboot, so it should be there

@Johan-Liebert1 Johan-Liebert1 Oct 5, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't see any obvious issues in your function. Are you sure you're checking in the right place?

use anyhow::{Ok, Result};
use cap_std_ext::{cap_std, dirext::CapStdExtDirExt};

use crate::k8sapitypes::Resource;
use crate::spec::Bootloader;
use crate::{bootc_composefs::rollback::rollback_composefs_entries, spec::Host};

#[test]
fn test_rollback_composefs_entries() -> Result<()> {
let tempdir = cap_std_ext::cap_tempfile::tempdir(cap_std::ambient_authority())?;

let entry1 = r#"
title Fedora 42.20250623.3.1 (CoreOS)
version fedora-42.0
sort-key 1
linux /boot/7e11ac46e3e022053e7226a20104ac656bf72d1a84e3a398b7cce70e9df188b6/vmlinuz-5.14.10
initrd /boot/7e11ac46e3e022053e7226a20104ac656bf72d1a84e3a398b7cce70e9df188b6/initramfs-5.14.10.img
options root=UUID=abc123 rw composefs=7e11ac46e3e022053e7226a20104ac656bf72d1a84e3a398b7cce70e9df188b6
"#;
let entry2 = r#"
title Fedora 41.20250214.2.0 (CoreOS)
version fedora-42.0
sort-key 2
efi /EFI/Linux/f7415d75017a12a387a39d2281e033a288fc15775108250ef70a01dcadb93346.efi
options root=UUID=abc123 rw composefs=febdf62805de2ae7b6b597f2a9775d9c8a753ba1e5f09298fc8fbe0b0d13bf01
"#;
let entry3 = r#"
title Test
version 1
sort-key 9
efi /EFI/boot/test.efi
"#;

tempdir.create_dir_all("loader/entries")?;
tempdir.atomic_write("loader/entries/bootc_entry1.conf", entry1)?;
tempdir.atomic_write("loader/entries/bootc_entry2.conf", entry2)?;
tempdir.atomic_write("loader/entries/entry3.conf", entry3)?;

let host = Host {
resource: Resource {
api_version: Default::default(),
kind: Default::default(),
metadata: Default::default(),
},
spec: Default::default(),
status: Default::default(),
};
let bootloader = Bootloader::None;

rollback_composefs_entries(&host, &tempdir, bootloader)?;

assert!(tempdir.exists("loader/entries"));
assert!(tempdir.exists("loader/entries/bootc_bootc-fedora-42.0-0.conf"));
assert!(tempdir.exists("loader/entries/bootc_bootc-fedora-42.0-1.conf"));
assert!(tempdir.exists("loader/entries/entry3.conf"));

assert_eq!(
str::from_utf8(&tempdir.read("loader/entries/entry3.conf")?[..])?,
entry3
);

Ok(())
}
}
24 changes: 16 additions & 8 deletions crates/lib/src/bootc_composefs/status.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,8 +23,8 @@ use crate::{
utils::{compute_store_boot_digest_for_uki, get_uki_cmdline},
},
composefs_consts::{
ORIGIN_KEY_BOOT_DIGEST, ORIGIN_KEY_IMAGE, ORIGIN_KEY_MANIFEST_DIGEST, TYPE1_ENT_PATH,
TYPE1_ENT_PATH_STAGED, USER_CFG, USER_CFG_STAGED,
BLS_ENTRY_PREFIX, ORIGIN_KEY_BOOT_DIGEST, ORIGIN_KEY_IMAGE, ORIGIN_KEY_MANIFEST_DIGEST,
TYPE1_ENT_PATH, TYPE1_ENT_PATH_STAGED, USER_CFG, USER_CFG_STAGED,
},
install::EFI_LOADER_INFO,
parsers::{
Expand Down Expand Up @@ -306,7 +306,7 @@ fn get_sorted_type1_boot_entries_helper(
.to_str()
.ok_or(anyhow::anyhow!("Found non UTF-8 characters in filename"))?;

if !file_name.ends_with(".conf") {
if !(file_name.starts_with(BLS_ENTRY_PREFIX) && file_name.ends_with(".conf")) {
continue;
}

Expand Down Expand Up @@ -1548,8 +1548,16 @@ mod tests {
"loader/entries/random_file.txt",
"Random file that we won't parse",
)?;
tempdir.atomic_write("loader/entries/entry1.conf", entry1)?;
tempdir.atomic_write("loader/entries/entry2.conf", entry2)?;
tempdir.atomic_write(
"loader/entries/random_file.conf",
"Random file that we won't parse",
)?;
tempdir.atomic_write(
"loader/entries/bootc_random_file.txt",
"Random file that we won't parse",
)?;
tempdir.atomic_write("loader/entries/bootc_entry1.conf", entry1)?;
tempdir.atomic_write("loader/entries/bootc_entry2.conf", entry2)?;

let result =
get_sorted_type1_boot_entries_helper(&tempdir, true, false, Bootloader::Systemd)
Expand Down Expand Up @@ -1933,8 +1941,8 @@ mod tests {

tempdir.create_dir_all("loader/entries")?;
tempdir.create_dir_all("loader/entries.staged")?;
tempdir.atomic_write("loader/entries/active.conf", active_entry)?;
tempdir.atomic_write("loader/entries.staged/staged.conf", staged_entry)?;
tempdir.atomic_write("loader/entries/bootc_active.conf", active_entry)?;
tempdir.atomic_write("loader/entries.staged/bootc_staged.conf", staged_entry)?;

let result = list_type1_entries(&tempdir)?;
assert_eq!(result.len(), 2);
Expand Down Expand Up @@ -1971,7 +1979,7 @@ mod tests {

let entry2 = format!(
r#"
title Fedora Linux (2.0.0)
title Fedora Linux (2.0.0)
version 2.0.0
sort-key {}
linux /boot/vmlinuz
Expand Down
Loading
Loading