This is a tracking bug for Change: Enable bootupd for Fedora Silverblue & Kinoite For more details, see: https://fedoraproject.org/wiki/Changes/FedoraSilverblueBootupd By design, ostree does not manage bootloader updates as they can not (yet) happen in a safe fashion. To solve this issue, bootupd (https://github.com/coreos/bootupd) was created. bootupd is a small socket activated program that takes care of updating the bootloader. It currently only supports EFI booted systems and rpm-ostree based systems. The updates are triggered by an administrator and are not (yet) automated for safety reasons. This change is about enabling bootupd integration in Fedora Silverblue and Fedora Kinoite to make bootloader updates easier. bootupd is already used in Fedora CoreOS. If you encounter a bug related to this Change, please do not comment here. Instead create a new bug and set it to block this bug.
Today we reached the Code Complete (Testable) milestone on the F38 schedule: https://fedorapeople.org/groups/schedule/f-38/f-38-key-tasks.html At this time, all F38 Changes should be complete enough to be testable. You can indicate this by setting this tracker to the MODIFIED status. If the Change is 100% code complete, you can set the tracker to ON_QA. If you need to defer this Change to F39, please NEEDINFO me. Changes that have not reached at least the MODIFIED status will be given to FESCo for evaluation of contingency plans.
This is not yet testable but we're trying to make that happen. Added the dependency.
Today we reached the Code Complete (100% complete) milestone on the F38 schedule: https://fedorapeople.org/groups/schedule/f-38/f-38-key-tasks.html At this time, all F38 Changes should be 100% complete. You can indicate this by setting this tracker to the ON_QA status. If you need to defer this Change to F39 please NEEDINFO me. Note that we are entering the Beta freeze. Additional package changes to complete this Change will need an approved blocker or freeze exception. See https://fedoraproject.org/wiki/QA:SOP_blocker_bug_process and https://fedoraproject.org/wiki/QA:SOP_freeze_exception_bug_process for more information. Changes that have not reached the ON_QA status will be given to FESCo for evaluation of contingency plans.
We did not manage to make it happen for F38. This will be for F39 and we'll try to backport the changes as much as possible later.
Ack. Deferring to F39
This is not yet ready for F39 Beta. We'll try to land it as soon as possible via a freeze exception.
We haven't been able to land this in Fedora 39 as we're missing changes in Anaconda. Pushing to Fedora 40. We might try to land part of it in F39 as a backport as we now have the unified core change in.
OK, so making the appropriate changes.
It would appear that Anaconda has some enhancements related to bootupd: https://github.com/rhinstaller/anaconda/releases/tag/anaconda-40.12-1 https://src.fedoraproject.org/rpms/anaconda/c/5e11b73af16b9e042106f40255e3a499e9894d40 What would be next for enabling bootupd in Silverblue and Kinoite?
Hey Timothée , we are at the 'testable' deadline for F40 now, what is the status of this at present? Thanks!
This change was deferred to F41 following a FESCo meeting vote https://meetbot.fedoraproject.org/meeting_matrix_fedoraproject-org/2024-02-26/fesco.2024-02-26-19.35.html (line 3.ad)
Sorry I forgot to update this bug. This is now ready for Fedora 40. See: https://pagure.io/fesco/issue/3173#comment-898382
The last missing bit is https://github.com/fedora-silverblue/issue-tracker/issues/530
Thanks Adam. I've updated https://fedoraproject.org/wiki/Changes/FedoraSilverblueBootupd back to F40. Could you sync the change pages? Thanks
Aoife is back now, so I'll leave it to her.
Moving back to F41 as we did not really complete this work for F40. We'll try to backport some of it in F40 once ready.
F40 was released on 2024-04-23, so I am closing this tracker. If this Change was not completed, please notify me ASAP.
Not sure if the comments crossed, but reopening since this moved back to F41
*** Bug 2127995 has been marked as a duplicate of this bug. ***
After updating Fedora 40 Silverblue from 40.20240614.0 to 40.20240617.0 today I get the following message trying to boot the new deployment: error: ../../grub-core/kern/efi/sb.c:182:bad shim signature. error: ../../grub-core/loader/i386/efi/linux.c:258:you need to load the kernel first. Press any key to continue... I have secure boot enabled. Is this a consequence of the bootloader files not being updated by rpm-ostree update? How can I fix this? I originally reported https://bugzilla.redhat.com/show_bug.cgi?id=2150982
I suspect the kernel update from 6.8.11-300.fc40 to 6.9.4-200.fc40 to be responsible for the boot error: awarda@fedora:~$ rpm-ostree db diff d19d7f c7bdc9 ostree diff commit from: d19d7f (d19d7f53db1b53f2a5741eacb0d6a6a1c8550501887eeecc3627b1a8c6699b8a) ostree diff commit to: c7bdc9 (c7bdc9ecab9df0609da0e04b685ca7608174e6cb81d49e1cf4b70b798557018e) Upgraded: aardvark-dns 1.10.0-1.fc40 -> 1.11.0-1.fc40 alsa-lib 1.2.11-2.fc40 -> 1.2.12-1.fc40 alsa-ucm 1.2.11-2.fc40 -> 1.2.12-1.fc40 alsa-utils 1.2.11-1.fc40 -> 1.2.12-1.fc40 containers-common 5:0.59.1-1.fc40 -> 5:0.59.1-2.fc40 containers-common-extra 5:0.59.1-1.fc40 -> 5:0.59.1-2.fc40 glibc 2.39-13.fc40 -> 2.39-15.fc40 glibc-all-langpacks 2.39-13.fc40 -> 2.39-15.fc40 glibc-common 2.39-13.fc40 -> 2.39-15.fc40 glibc-gconv-extra 2.39-13.fc40 -> 2.39-15.fc40 kernel 6.8.11-300.fc40 -> 6.9.4-200.fc40 kernel-core 6.8.11-300.fc40 -> 6.9.4-200.fc40 kernel-modules 6.8.11-300.fc40 -> 6.9.4-200.fc40 kernel-modules-core 6.8.11-300.fc40 -> 6.9.4-200.fc40 kernel-modules-extra 6.8.11-300.fc40 -> 6.9.4-200.fc40 libdav1d 1.4.0-1.fc40 -> 1.4.3-1.fc40 libevdev 1.13.1-4.fc40 -> 1.13.2-2.fc40 libxml2 2.12.7-1.fc40 -> 2.12.8-1.fc40 mesa-dri-drivers 24.1.1-3.fc40 -> 24.1.1-5.fc40 mesa-filesystem 24.1.1-3.fc40 -> 24.1.1-5.fc40 mesa-libEGL 24.1.1-3.fc40 -> 24.1.1-5.fc40 mesa-libGL 24.1.1-3.fc40 -> 24.1.1-5.fc40 mesa-libgbm 24.1.1-3.fc40 -> 24.1.1-5.fc40 mesa-libglapi 24.1.1-3.fc40 -> 24.1.1-5.fc40 mesa-libxatracker 24.1.1-3.fc40 -> 24.1.1-5.fc40 mesa-va-drivers 24.1.1-3.fc40 -> 24.1.1-5.fc40 mesa-vulkan-drivers 24.1.1-3.fc40 -> 24.1.1-5.fc40 netavark 1.10.3-3.fc40 -> 1.11.0-1.fc40 nspr 4.35.0-23.fc40 -> 4.35.0-24.fc40 nss 3.100.0-1.fc40 -> 3.101.0-1.fc40 nss-softokn 3.100.0-1.fc40 -> 3.101.0-1.fc40 nss-softokn-freebl 3.100.0-1.fc40 -> 3.101.0-1.fc40 nss-sysinit 3.100.0-1.fc40 -> 3.101.0-1.fc40 nss-util 3.100.0-1.fc40 -> 3.101.0-1.fc40 paps 0.8.0-8.fc40 -> 0.8.0-9.fc40 python3-boto3 1.34.99-1.fc40 -> 1.34.121-1.fc40 python3-botocore 1.34.99-1.fc40 -> 1.34.121-1.fc40 Added: fuse-overlayfs-1.13-1.fc40.x86_64 Here is some other report that looks related: https://forums.fedoraforum.org/showthread.php?332808-Kernel-6-9-4-now I suspect that rpm-ostree has installed the updated files into /usr/lib/ostree-boot/efi/EFI/fedora/ but grub is using /boot/efi/EFI/fedora/ to boot - is this correct? Could I fix this by manually copying files from /usr/lib/ostree-boot/efi/EFI/fedora/ to /boot/efi/EFI/fedora/ or something else? I fear bricking my system thus I am not up for experimentation without some expert guidance.
The workaround described in https://github.com/fedora-silverblue/issue-tracker/issues/543 fixed this for me.
correction to my comment #20: the closed duplicate https://bugzilla.redhat.com/show_bug.cgi?id=2127995 was originally reported by me for f36sb
Hi Timothee, could you provide a status update on this change please? Changes need to be code complete before we enter beta freeze next Tuesday 27th August. Are you still on track to land this in F41, or do you need to defer to F42? Thanks, Aoife
Hi @tpopela @walters @tim has this change been implemented for F41 fully yet? An understanding of where the work is at for F41 release for the changes report to FESCo would be very much appreciated. This report is being submitted today. If you have an update this week, please comment under the FESCo issue as I will be on PTO from 27th Aug - 1st September. If you need to defer, please let me know and I will make the relevant changes to the tracker bug and wiki page. Thanks!
This change is ready for F41 even though we are still investigating some related issues: - https://gitlab.com/fedora/ostree/sig/-/issues/1 - https://bugzilla.redhat.com/show_bug.cgi?id=2304328 We can undo it before the release freeze if we can not fix those in time for the release.
This successfully landed in Fedora 41.