acl: use slot-*.addon.efi verbatim instead of verity*.addon.efi - #759
Merged
Conversation
…n.efi ACL verity addon templates are renamed to slot-a.addon.efi/slot-b.addon.efi on the image ESP. Copy the selected slot template into the staged UKI addon directory verbatim (no rename to verity.addon.efi), matching its source filename. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
Azure Pipelines: Successfully started running 1 pipeline(s). There may be pipelines that require an authorized user to comment /azp run to run. |
bfjelds (bfjelds)
marked this pull request as draft
August 28, 2026 20:21
Contributor
There was a problem hiding this comment.
Pull request overview
Updates ACL UKI verity-addon activation to use slot-specific addon template filenames (slot-a.addon.efi / slot-b.addon.efi) and to stage the selected template without renaming, aligning staged addon filenames with the source templates on the image ESP.
Changes:
- Switch template selection for A/B volumes from
verity-{a,b}.addon.efitoslot-{a,b}.addon.efi. - Stage the chosen template into the staged
.extra.d/directory using its original filename (noverity.addon.efirename). - Remove the unused
VERITY_ADDON_FILENAMEconstant and update related tests/comments.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Introduce SLOT_A_ADDON_FILENAME and SLOT_B_ADDON_FILENAME constants for slot-a.addon.efi/slot-b.addon.efi, replacing string literals in activate_verity_addon_for_target_volume and its tests. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
bfjelds (bfjelds)
changed the title
- Fix ACL_ADDON_TEMPLATES_DIR doc comment: still referenced the old verity-a/verity-b template names instead of slot-a/slot-b. - Fix activate_verity_addon_for_target_volume to remove a stale addon for the other slot from the staged addon dir before activating the target slot. stage_uki_on_esp copies the images live .extra.d/ verbatim, and ACL images ship slot A active by default, so an update targeting slot B could otherwise leave both slot-a.addon.efi and slot-b.addon.efi staged, letting systemd-boot apply both (conflicting) verity cmdlines. - Add regression test covering stale other-slot addon removal. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Paco Huelsz (frhuelsz)
approved these changes
Aug 28, 2026
bfjelds (bfjelds)
marked this pull request as ready for review
August 28, 2026 22:13
|
Azure Pipelines: Successfully started running 1 pipeline(s). There may be pipelines that require an authorized user to comment /azp run to run. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rename ACL slot-based uki addons from
verity-{a|b}.addon.efitoslot-{a|b}.addon.efiand, on update, copy addon as named (no longer removing-<slot>).Validated with pr-e2e + acldevel