From f730598f9718bf9e43533b2e2645d567c1238e75 Mon Sep 17 00:00:00 2001 From: Brian Fjeldstad Date: Thu, 23 Jul 2026 20:23:33 +0000 Subject: [PATCH 1/2] acl-grub: use dedicated /usr verity hash partitions, consistent with UKI GRUB's disk_layout.json previously used the legacy single-partition inline-hash verity scheme. The UKI-side changes in this branch switched grub.cfg's verity cmdline construction to UUID=-based hash identification (dropping hash-offset=), which only works when the hash tree lives on its own independently-discoverable partition. Mirror disk_layout_uki.json's structure: add dedicated HASH-A/HASH-B partitions (dps-usr-verity type) cross-referenced via verity_hash, so blkid/udev can resolve systemd.verity_usr_hash=UUID= the same way UKI does. ACL-GRUB still cannot do Trident A/B updates (no addon-swap equivalent), but the partitioning/verity mechanics are now consistent between the two boot paths instead of silently broken on GRUB. ESP stays at 128MiB (no AB-staging need on GRUB). BIOS-BOOT partition is kept (shared with Portage/flatcar builds; RPM/GRUB mode already skips installing to it). --- build_library/disk_layout.json | 42 +++++++++++++++++++++++++--------- 1 file changed, 31 insertions(+), 11 deletions(-) diff --git a/build_library/disk_layout.json b/build_library/disk_layout.json index e9747044f72..6aa4b69b552 100644 --- a/build_library/disk_layout.json +++ b/build_library/disk_layout.json @@ -32,22 +32,36 @@ "fs_type":"btrfs", "fs_compression":"zstd", "mount":"/usr", + "verity_hash":"4", "features": ["prioritize", "verity"] }, "4":{ + "label":"HASH-A", + "uuid":"1fae528b-6baf-4efc-a226-2a23f9291ce6", + "type":"dps-usr-verity", + "blocks":"20480" + }, + "5":{ "label":"USR-B", "uuid":"e03dd35c-7c2d-4a47-b3fe-27f15780a57c", "type":"flatcar-rootfs", "blocks":"2097152", - "fs_blocks":"262144" + "fs_blocks":"262144", + "verity_hash":"6" }, - "5":{ + "6":{ + "label":"HASH-B", + "uuid":"accb60b1-1d72-4e05-9363-6fd51e2ce788", + "type":"dps-usr-verity", + "blocks":"20480" + }, + "7":{ "label":"ROOT-C", "uuid":"d82521b4-07ac-4f1c-8840-ddefedc332f3", "type":"blank", "blocks":"0" }, - "6":{ + "8":{ "label":"OEM", "fs_label":"OEM", "type":"data", @@ -56,17 +70,17 @@ "fs_compression":"zlib", "mount":"/oem" }, - "7":{ + "9":{ "label":"OEM-CONFIG", "type":"flatcar-reserved", "blocks":"131072" }, - "8":{ + "10":{ "type":"blank", "label":"flatcar-reserved", "blocks":"0" }, - "9":{ + "11":{ "label":"ROOT", "fs_label":"ROOT", "type":"dps-root", @@ -76,28 +90,28 @@ } }, "vm":{ - "9":{ + "11":{ "label":"ROOT", "fs_label":"ROOT", "blocks":"12943360" } }, "azure":{ - "9":{ + "11":{ "label":"ROOT", "fs_label":"ROOT", "blocks":"58875904" } }, "vagrant":{ - "9":{ + "11":{ "label":"ROOT", "fs_label":"ROOT", "blocks":"33845248" } }, "onmetal":{ - "7":{ + "9":{ "label":"config-2", "fs_label":"config-2", "type":"data", @@ -130,6 +144,12 @@ "type":"blank" }, "9":{ + "type":"blank" + }, + "10":{ + "type":"blank" + }, + "11":{ "label":"ROOT", "fs_label":"ROOT", "type":"0fc63daf-8483-4772-8e79-3d69d8477de4", @@ -137,4 +157,4 @@ } } } -} +} From bb733233dd111970a7c6e00901ce125f0a661315 Mon Sep 17 00:00:00 2001 From: Brian Fjeldstad Date: Fri, 24 Jul 2026 14:51:10 +0000 Subject: [PATCH 2/2] vm_image_util: extend device-init timeout to GRUB arm64 test images too install_uki_timeout_addon already works around a CI-only QEMU-TCG flake on arm64 kola test images: heavy parallel-VM CPU contention can prevent udev from initialising ESP/OEM/usr-verity devices within the default initrd device timeout, dropping the VM to an emergency shell. That fix was UKI-only (built as a signed .efi addon dropped into .efi.extra.d/). GRUB has no addon mechanism, so add install_grub_timeout_override: since grub.cfg is plain text (not signed/embedded like a UKI), patch the already-written grub.cfg copies on the test image's ESP directly via sed, appending systemd.default_device_timeout_sec=120 to the shared linux_cmdline. Same scoping as the UKI addon: arm64 test image only (INJECT_DOCKER_SYSEXT=true), never applied to production images or amd64. --- build_library/vm_image_util.sh | 53 ++++++++++++++++++++++++++++++++++ 1 file changed, 53 insertions(+) diff --git a/build_library/vm_image_util.sh b/build_library/vm_image_util.sh index 10ceccdc6ea..97e09e6af84 100644 --- a/build_library/vm_image_util.sh +++ b/build_library/vm_image_util.sh @@ -556,6 +556,8 @@ install_oem_package() { if [[ "${BOOTLOADER_MODE}" == "uki" ]]; then install_uki_oem_addon install_uki_timeout_addon + elif [[ "${BOOTLOADER_MODE}" == "grub" ]]; then + install_grub_timeout_override fi return 0 fi @@ -602,6 +604,8 @@ install_oem_package() { if [[ "${BOOTLOADER_MODE}" == "uki" ]]; then install_uki_oem_addon install_uki_timeout_addon + elif [[ "${BOOTLOADER_MODE}" == "grub" ]]; then + install_grub_timeout_override fi } @@ -851,6 +855,55 @@ install_uki_timeout_addon() { sudo rm -rf "${timeout_temp_dir}" } +# Append systemd.default_device_timeout_sec=120 to grub.cfg's shared cmdline, +# scoped to the arm64 kola *test* image only (INJECT_DOCKER_SYSEXT=true). +# +# GRUB has no addon mechanism like UKI's .extra.d, so unlike +# install_uki_timeout_addon this patches the already-written grub.cfg copies +# on the ESP directly (both are plain text, no rebuild/re-signing needed) - +# same CI-only QEMU-TCG device-init timeout this exists to work around. +# +# Deliberately NOT applied to the production VM image (INJECT_DOCKER_SYSEXT=false) +# or to amd64: the failure is a CI-only TCG-emulation artefact that never occurs +# on real hardware. +install_grub_timeout_override() { + if [[ "${BOOTLOADER_MODE}" != "grub" ]]; then + return 0 + fi + + # Scope: arm64 test image only. + if [[ "${ARCH}" != "arm64" ]] || [[ "${INJECT_DOCKER_SYSEXT:-false}" != "true" ]]; then + return 0 + fi + + local esp_dir="${VM_TMP_ROOT}/boot" + local -a grub_cfgs=( + "${esp_dir}/EFI/boot/grub.cfg" + "${esp_dir}/boot/grub2/grub.cfg" + ) + + local found=0 + for cfg in "${grub_cfgs[@]}"; do + if [[ ! -f "${cfg}" ]]; then + continue + fi + found=1 + if sudo grep -q 'systemd.default_device_timeout_sec=' "${cfg}"; then + info "GRUB timeout override: ${cfg} already patched; skipping" + continue + fi + sudo sed -i 's/^set linux_cmdline="\(.*\)"$/set linux_cmdline="\1 systemd.default_device_timeout_sec=120"/' "${cfg}" + info "GRUB timeout override: patched ${cfg}" + done + + if [[ "${found}" -eq 0 ]]; then + warn "GRUB timeout override: no grub.cfg found under ${esp_dir}; skipping" + return 0 + fi + + info "GRUB timeout override: cmdline += systemd.default_device_timeout_sec=120" +} + # Any other tweaks required? run_fs_hook() { local fs_hook=$(_get_vm_opt FS_HOOK)