Hi @champtar. Thanks for your PR.

I'm waiting for a coreos member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Can someone with CI / FCOS knowledge chime in ? I think 10_blscfg and other configs.d are not copied in the continuous-integration/jenkins/pr-merge test, is this expected ? ie does FCOS overwrite the full folder, or we are just testing the binary and not the full rpm ?
c9s CI works ok / I can see the new files being used.

@cgwalters any opinions on this PR ?

Anyone ?

@HuijingHei maybe ?

/ok-to-test

That all said it does look quite likely related that the upgrade test failed here https://jenkins-coreos-ci.apps.ocp.fedoraproject.org/job/bootupd/job/PR-841/6/artifact/tmp/console.txt

That all said it does look quite likely related that the upgrade test failed here https://jenkins-coreos-ci.apps.ocp.fedoraproject.org/job/bootupd/job/PR-841/6/artifact/tmp/console.txt

See my previous comment #841 (comment), I bet the failing test only copy the new binary and not the new configs.d

My ci fix is ignored, should I move it to another PR that we merge first, then rebase on top ?

My ci fix is ignored, should I move it to another PR that we merge first, then rebase on top ?

ci: also install grub config and systemd unit looks correct to me and would indeed make sense to aim to land as a distinct PR.

#879 need to be merged first then I can rebase on top

LGTM, and I tried using bootc, and check the new created grub.cfg includes:

# Other package code will be injected from here

### BEGIN 01_grub2_password.cfg ###
# Keep the comment for grub2-set-password
### BEGIN /etc/grub.d/01_users ###
if [ -f ${prefix}/user.cfg ]; then
  source ${prefix}/user.cfg
  if [ -n "${GRUB2_PASSWORD}" ]; then
    set superusers="root"
    export superusers
    password_pbkdf2 root ${GRUB2_PASSWORD}
  fi
fi
### END 01_grub2_password.cfg ###

### BEGIN 10_blscfg.cfg ###
blscfg
### END 10_blscfg.cfg ###

### BEGIN 14_menu_show_once.cfg ###
if [ "${menu_show_once_timeout}" ]; then
  set timeout_style=menu
  set timeout="${menu_show_once_timeout}"
  unset menu_show_once_timeout
  save_env menu_show_once_timeout
fi
### END 14_menu_show_once.cfg ###

### BEGIN 30_uefi-firmware.cfg ###
if [ "$grub_platform" = "efi" ]; then
        menuentry 'UEFI Firmware Settings' $menuentry_id_option 'uefi-firmware' {
                fwsetup
        }
fi
### END 30_uefi-firmware.cfg ###

### BEGIN 41_custom.cfg ###
if [ -f $prefix/custom.cfg ]; then
  source $prefix/custom.cfg
fi
### END 41_custom.cfg ###

The steps are:
Containerfile:

FROM quay.io/fedora/fedora-bootc:41
RUN rm -f /usr/libexec/bootupd && \
    rm -f /usr/bin/bootupctl
COPY bootupd/bootupd/usr /usr

Use bootc install to install grub.cfg:

# sudo podman build -t bootc-test .

# sudo truncate -s 10G disk.raw
# sudo podman run \
            --rm \
            -ti \
            --privileged \
            --pid=host \
            --security-opt label=disable \
            -v /var/lib/containers:/var/lib/containers \
            -v /dev:/dev \
            -v .:/output \
            bootc-test:latest \
            env BOOTC_BOOTLOADER_DEBUG=1 bootc install to-disk --filesystem xfs --skip-fetch-check --generic-image --via-loopback /output/disk.raw
# sudo losetup -fP disk.raw
# sudo mount -t xfs /dev/loop0p3 /mnt
# cat /mnt/boot/grub2/grub.cfg

Need to fix CI first.

Need to fix CI first.

In console.txt boot seems ok (https://jenkins-coreos-ci.apps.ocp.fedoraproject.org/job/bootupd/job/PR-841/8/artifact/tmp/console.txt), but kola qemuexec timeout (https://jenkins-coreos-ci.apps.ocp.fedoraproject.org/blue/rest/organizations/jenkins/pipelines/bootupd/branches/PR-841/runs/8/log/?start=0)
comparing with a sucessfull boot, ignition.firstboot kargs is missing, but ignition.platform.id=qemu is present

Ok I'm actually breaking ignition because 40_coreos-ignition.cfg is now after blscfg

[2025-03-17T02:47:25.147Z] Added 01_grub2_password.cfg
[2025-03-17T02:47:25.147Z] Added 10_blscfg.cfg
[2025-03-17T02:47:25.147Z] Added 14_menu_show_once.cfg
[2025-03-17T02:47:25.147Z] Added 30_uefi-firmware.cfg
[2025-03-17T02:47:25.147Z] Added 40_coreos-ignition.cfg
[2025-03-17T02:47:25.147Z] Added 41_custom.cfg
[2025-03-17T02:47:25.147Z] Added 70_coreos-user.cfg

Reordered the files a bit to see if it fixes, if yes I'll need to change ignition.cfg to 40_ignition.cfg
BTW 70_coreos-user.cfg is not needed for a long time I think

Jenkins seems to be broken right now

Waiting for fedora-iot/greenboot#214,
but this can be reviewed again / tested again

Use bootc to build image, and verify with the patch that grub password works. Let me know if other tests are needed.

1. Build container image with bootupd

# cat Containerfile
FROM quay.io/fedora/fedora-bootc:41
RUN rm -f /usr/libexec/bootupd && \
    rm -f /usr/bin/bootupctl
COPY bootupd/bootupd/usr /usr

# sudo podman build -t bootc-test .

2. Build image using bootc

# sudo truncate -s 10G disk.raw
# sudo podman run --rm --privileged -v /var/lib/containers/storage:/var/lib/containers/storage --security-opt label=type:unconfined_t --pid=host -v /var/lib/containers:/var/lib/containers -v /dev:/dev -v $PWD:/output bootc-test:latest env BOOTC_BOOTLOADER_DEBUG=1 bootc install to-disk --filesystem "xfs" --karg=console=tty0 --karg=console=ttyS0,115200n8  --skip-fetch-check --root-ssh-authorized-keys /output/id_rsa.pub --generic-image --via-loopback /output/disk.raw

3. Using libvirt to start image:

sudo virt-install \
    --name fedora-bootc \
    --cpu host-model \
    --vcpus 4 \
    --memory 4096 \
    --import --disk disk.raw,format=qcow2 \
    --os-variant fedora-eln \
    --autoconsole text \
    --boot menu=on,useserial=on

4. Manually run grub2-setpassword and reboot, check that if want to edit grub menu that requires password.

# ls /usr/lib/bootupd/grub2-static/configs.d
01_users.cfg  10_blscfg.cfg  14_menu_show_once.cfg  30_uefi-firmware.cfg  41_custom.cfg

Let me know if other tests are needed

@HuijingHei if you still have the setup, I guess you can confirm you can see the UEFI Firmware Settings entry, and try grub2-editenv - set menu_show_once_timeout=42

Still LGTM, now is a decent time to land this in git main; we do have some bootc-side integration tests that are covering the output of https://gitlab.com/fedora/bootc/base-images-dev

Let me know if other tests are needed

I guess you can confirm you can see the UEFI Firmware Settings entry, and try grub2-editenv - set menu_show_once_timeout=42

Yes, if boot with uefi, can see UEFI Firmware Settings entry on grub menu, and grub2-editenv - set menu_show_once_timeout=42 works once, then reboot the timeout is back to 1s.

If there is a RPM scratch build available somewhere I can run some tests too.

Greenboot change has been merged, waiting for a release: fedora-iot/greenboot#214

If there is a RPM scratch build available somewhere I can run some tests too.

@dustymabe can't find any rpm artifacts in the different checks

If there is a RPM scratch build available somewhere I can run some tests too.

Oh, seems the copr build failed for one month, will see if can make it work again.

If there is a RPM scratch build available somewhere I can run some tests too.

Build locally and put it to https://hhei.fedorapeople.org/bootupd-0.2.27.50.g741e9a5-1.fc41.x86_64.rpm

sudo make srpm -f .copr/Makefile
rpmbuild --rebuild target/rust-bootupd-0.2.27.50.g741e9a5-1.fc41.src.rpm

Do local build FCOS with the scratch rpm, and run kola run basic test, result is passed. Also run grub password using butane config, it works.

I think it is OK to merge this, WDYT @dustymabe ?

Oh, seems the copr build failed for one month, will see if can make it work again.

Thanks for fixing that!

Do local build FCOS with the scratch rpm, and run kola run basic test, result is passed. Also run grub password using butane config, it works.

And thanks for testing!

I think it is OK to merge this,

Agreed. I'd note again that we currently can have a quite long delay between merges to git main and shipping, and this is the type of change that I think will get some naturally more extensive testing post-merge for those CI systems that track our (COPR) git main builds (I also happen to use ostree, bootc and bootupd among other things from the COPR for my main workstation). So let's see if there's any fallout in the next week or two.

Thanks for merging !
Please do ping me if you see any fallout (I'm not subscribed to all notifications of this repo)

If there is a RPM scratch build available somewhere I can run some tests too.

Build locally and put it to https://hhei.fedorapeople.org/bootupd-0.2.27.50.g741e9a5-1.fc41.x86_64.rpm

sudo make srpm -f .copr/Makefile
rpmbuild --rebuild target/rust-bootupd-0.2.27.50.g741e9a5-1.fc41.src.rpm

Did a local build and test and this worked and passed all tests. Thanks @HuijingHei

@champtar In your opinion should we drop this hack from our package manifests when this lands in a release?

cc @cgwalters

EDIT: updated link to be correct.

When using bootupd, /etc/grub.d/ is ignored so we can remove it from the hack

We can keep (or copy paste in bootupd)

• /usr/lib/systemd/system/grub2-systemd-integration.service
• /usr/lib/systemd/system/reboot.target.wants/grub2-systemd-integration.service
• /usr/lib/systemd/system/systemd-logind.service.d/10-grub2-logind-service.conf
  (systemctl reboot --boot-loader-menu=...)

We can continue to remove

• /usr/lib/systemd/system/grub-boot-indeterminate.service
• /usr/lib/systemd/system/system-update.target.wants/grub-boot-indeterminate.service
• /usr/lib/systemd/user/grub-boot-success.service
• /usr/lib/systemd/user/grub-boot-success.timer
  as this is implemented by greenboot