Changes/FedoraSilverblueBootupd

Enable bootupd for Fedora Atomic Desktops and Fedora IoT

Summary

By design, ostree does not manage bootloader updates as they can not (yet) happen in a safe fashion. To solve this issue, bootupd was created.

bootupd is a small program that takes care of updating the bootloader. It currently supports BIOS and EFI booted systems but only rpm-ostree based systems. The updates are triggered by an administrator and are not (yet) automated for safety reasons.

This change is about enabling bootupd integration in Fedora Atomic Desktops and Fedora IoT to make bootloader updates easier and, hopefully in the future, automated.

bootupd is already used in Fedora CoreOS.

Hold on testing this on Fedora 41 systems updated from Fedora 40 until bug #2312453 is fixed and the updated package is included in a compose/build. This warning will be removed once it's safe to test. It is safe to test on fresh Fedora 41 installations.

Owner

• Name: Timothée Ravier, Tomáš Popela, Colin Walters, Paul Whalen
• Email: <siosm@fedoraproject.org>, <tpopela@fedoraproject.org>, <walters@fedoraproject.org>, <pwhalen@fedoraproject.org>

Current status

• Targeted release: Fedora Linux 41
• Last updated: 2024-09-18
• devel thread
• FESCo issue: #2900
• Tracker bug: #2150982
• Release notes tracker: #47

Detailed Description

Adding full bootupd support has two immediate benefits:

• User will be able to easily update the bootloader on their system. This will let them apply Secure Boot dbx updates that block old bootloaders with known vulnerabilities from loading. See:
  • https://github.com/fedora-silverblue/issue-tracker/issues/355
  • https://bugzilla.redhat.com/show_bug.cgi?id=2127995

• We can start planning for the removal of the ostree-grub2 package from the images to solve the "all deployments are shown twice in GRUB" issue. This bug comes from the fact that old GRUB versions that do not have BLS support and we thus can not only rely on BLS support in ostree to generate boot and have to also update the grub configuration for every updates via the scripts in the ostree-grub2 package. This has already (indirectly) caused a major upgrade issue on Silverblue/Kinoite/IoT requiring manual interventions from all users. See:
  • https://fedoramagazine.org/manual-action-required-to-update-fedora-silverblue-kinoite-and-iot-version-36/
  • https://github.com/fedora-silverblue/issue-tracker/issues/120

Note that we can not yet enable unattended bootloader updates as even though bootupd tries hard to make those updates as safe as possible, it is currently not possible that they are safe if the system crashes (or loses power) at the wrong time. The following change in shim (https://github.com/rhboot/shim/pull/502) should help with that.

Thus bootloaders updates will remain a manually user triggered operation for now.

Also note that this change currently relies on the image being composed via rpm-ostree in unified core, which is the subject of the following change also proposed for Fedora 38: https://fedoraproject.org/wiki/Changes/FedoraSilverblueUnifiedCore

Progress on this change is tracked in: https://gitlab.com/fedora/ostree/sig/-/issues/1.

Feedback

> What's the plan to apply the outstanding security updates (shim, grub2, and dbx push from June) to fedora silverblue 36 + 37 that aren't covered by this change?

We will not backport this change to a previous Fedora release.

Users that need to update their bootloader can do so manually using the instructions from the Manual action needed to resolve boot failure for Fedora Atomic Desktops and Fedora IoT Fedora Magazine article.

We'll try to backport as much as possible of this change to Fedora 37 and Fedora 36 to let users updates their bootloaders. If we require Anaconda changes (unlikely but not 100% sure at the time this is written) then those changes will not be backported as we don't respin the installer ISOs.

Benefit to Fedora

Fedora Atomic Desktops and Fedora IoT users can easily do bootloaders updates (that includes security fixes) and we can remove support for legacy GRUB versions thus simplify the upgrade process and making it more reliable.

Scope

• Proposal owners: Testing of the integration and new builds. The code changes are mostly done and the integration changes are mostly already ready as bootupd has already been integrated in a similar fashion in Fedora CoreOS.
• Other developers: N/A
• Release engineering: N/A
• Policies and guidelines: N/A (not needed for this Change)
• Trademark approval: N/A (not needed for this Change)
• Alignment with Objectives: N/A

Upgrade/compatibility impact

There should be not visible change for users when upgrading. The change only impacts the way the images are composed on the server.

How To Test

Hold on testing this on Fedora 41 systems updated from Fedora 40 until bug #2312453 is fixed and the updated package is included in a compose/build. This warning will be removed once it's safe to test. It is safe to test on fresh Fedora 41 installations.

See bug 2312453 and package update. We are now waiting for a successful compose/build.

On a system with bootupd installed (i.e. a version of Fedora with this change included), run:

$ sudo bootupctl status
$ sudo bootupctl adopt-and-update
$ sudo bootupctl status
$ sudo bootupctl validate

Your bootloader should now be updated.

New systems directly installed from a version with this change can directly do an update:

$ sudo bootupctl status
$ sudo bootupctl update
$ sudo bootupctl status
$ sudo bootupctl validate

To test the initial adoption and update again, you can remove /boot/bootupd-state.json and try again:

$ sudo rm /boot/bootupd-state.json
$ sudo bootupctl status
$ sudo bootupctl update
$ sudo bootupctl status
$ sudo bootupctl validate

Until we get #707 (PR#715), you will have to manually reset the systemd unit in case of failures:

$ sudo systemctl reset-failed bootupd.service

We will extend the test instructions once the unified core changes have landed. You can follow: https://github.com/fedora-silverblue/issue-tracker/issues/120 and https://github.com/fedora-silverblue/issue-tracker/issues/355.

User Experience

For now, users will have to update their bootloader manually via the command line. Integration to GNOME Software and Plasma Discover might be interesting to make that easier.

Once the fallback EFI feature is available in shim (and support implemented in bootupd), we can consider implementing automated updates.

Once the remaining issues listed in https://gitlab.com/fedora/ostree/sig/-/issues/1 are resolved, we will enabled automatic bootloader updates.

Dependencies

N/A

Contingency Plan

• Contingency mechanism: Revert the change in the rpm-ostree manifests. Owners will do it. Nothing to do for users.
• Contingency deadline: Before final freeze as this change needs to be included in the installation ISOs as Anaconda behaves differently if bootupd is included or not in the installed system.
• Blocks release? No

Documentation

We will write docs to let users update their bootloaders manually. They will look very similar to https://docs.fedoraproject.org/en-US/fedora-coreos/bootloader-updates/.

Release Notes

Will have to be written.