feat: share LF_KICKSTART_VERSION across all cfg files and quiet restorecon

* Extend the LF_KICKSTART_VERSION stamp (format YYYYMMDDNN) to
  lf-debian.cfg and lf-ubuntu.cfg, so all three installer configs
  share the same repo-wide build marker. Debian logs it via
  logger(1) in preseed/early_command; Ubuntu logs it via logger in
  autoinstall early-commands. Both write /root/lf-install-version
  on the installed system, mirroring the RHEL behaviour. RHEL now
  also writes the same /root/lf-install-version marker directly in
  the generated dynamic.ks %post. Bump stamp from 2026041501 to
  2026041502.
* CONTRIBUTING "Versioning the Kickstart File" section now covers
  all three cfg files and documents the per-file locations where
  the literal must be kept in lockstep.
* README: each of the RHEL / Debian / Ubuntu "Log Files" sections
  now documents /root/lf-install-version as the canonical
  cross-distro fleet identification, plus a grep hint for the
  installer-time log line that carries the same stamp.
* lf-rhel.cfg: exclude /boot/efi from `fixfiles -R -a restore` via
  the `-e` flag. The EFI system partition is vfat and cannot carry
  SELinux contexts, so every install was producing a stream of
  harmless but alarming "Operation not supported" messages on
  /boot/efi/EFI/... The functional `|| true` safety net stays in
  place.

Author: markuslf

CHANGELOG.md

@@ -10,12 +10,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
-* `lf-rhel.cfg`: Add a running `LF_KICKSTART_VERSION` build stamp (format `YYYYMMDDNN`) declared at the top of `%pre`. The stamp is echoed during install (ends up in `/tmp/kickstart.install.pre.log`, `/var/log/anaconda/anaconda.log`, and the `%post` `ks-script-*.log`) and embedded as a comment at the top of the rendered `dynamic.ks`, which is archived as `/root/dynamic.ks` on the installed system. This lets admins trace any installed host back to the exact `lf-rhel.cfg` variant that built it. CONTRIBUTING documents when and how to bump the stamp; the README documents where to read it on an installed system
+* Add a running `LF_KICKSTART_VERSION` build stamp (format `YYYYMMDDNN`) shared across `lf-rhel.cfg`, `lf-debian.cfg` and `lf-ubuntu.cfg`. The stamp is logged at install time (to `/tmp/kickstart.install.pre.log` and `/var/log/anaconda/ks-script-*.log` on RHEL, to `/var/log/installer/syslog` on Debian, and to `/var/log/installer/installer-journal.txt` on Ubuntu) and written to `/root/lf-install-version` on every installed host — a single distro-independent fleet marker that lets admins trace any installed host back to the exact installer build that produced it. On RHEL the stamp is additionally embedded as a comment at the top of the rendered `dynamic.ks` (archived as `/root/dynamic.ks`). CONTRIBUTING documents when and how to bump the stamp; the README documents where to read it on an installed system
 
 ### Fixed
 
 * `lf-rhel.cfg`: Fix `grub2-mkconfig` being silently skipped on every target version. The `%pre` script was built via an unquoted heredoc (`cat << EOT`), which let bash eat every `"$var"` and `$(cmd)` reference embedded in the generated shell code before the Python helper was even written. As a result the grub finder always ran with empty variables and printed "Could not find a grub.cfg in /boot" — hiding the fact that `/etc/default/grub` edits had not been regenerated since the first release. The heredoc is now quoted (`cat << 'EOT'`), the finder targets `/boot/grub2/grub.cfg` directly (which is the right target on RHEL/Rocky 8/9/10 for both BIOS and UEFI — on 9+ UEFI the `/boot/efi/EFI/<vendor>/grub.cfg` is only a thin wrapper that `configfile`s `/boot/grub2/grub.cfg`), and the console-ordering change in `/etc/default/grub` is actually reflected in the generated `grub.cfg`
 * `lf-rhel.cfg`: Fix post-install failure on RHEL 10 / Rocky 10 cloud installs. The previous `%post --nochroot` block copied `dynamic.ks` and `70-install-ssh-keys.ks` into `/root` of the installed system for auditing and kept breaking across Anaconda versions (first `/proc/mounts` parsing, then mount-point layout). The archival is now performed by a chrooted `%post` hook generated in `%pre` under `/usr/share/anaconda/post-scripts/`, with the content embedded via base64-decoded heredoc. The same kickstart now works on RHEL/Rocky 8, 9 and 10
+* `lf-rhel.cfg`: Exclude `/boot/efi` from `fixfiles -R -a restore` via the `-e` flag. The EFI system partition is vfat and cannot carry SELinux contexts, so previously every install produced a stream of harmless but alarming-looking `Could not set context for /boot/efi/EFI/...: Operation not supported` messages in the `%post` log. The functional `|| true` safety net is still in place
 * `lf-rhel.cfg`: Fix `sed: can't read /etc/systemd/logind.conf` on RHEL/Rocky 10 cloud installs. Recent systemd versions no longer ship `logind.conf` under `/etc/`; the `NAutoVTs=0` override is now applied via a drop-in at `/etc/systemd/logind.conf.d/10-lf-no-auto-vts.conf`, which works on all supported systemd versions
 * `lf-rhel.cfg`: The "Only touch" comment in the archived `dynamic.ks` now renders the actual target disk path (e.g. `# Only touch vda.`) instead of a literal `$lfdisk`. The Python code was using a shell-style variable reference inside a plain string where a Python format substitution was needed
 

CONTRIBUTING.md

@@ -73,15 +73,23 @@ Python packages installed via `pip` inside workflows follow a two-tier policy:
 
 ### Versioning the Kickstart File
 
-`lf-rhel.cfg` carries a running build stamp in the shell variable `LF_KICKSTART_VERSION` at the top of the `%pre` section. The value is logged at install time (to `/tmp/kickstart.install.pre.log`, the Anaconda logs, and the `%post` `ks-script-*.log`) and embedded as a comment in the `dynamic.ks` archived under `/root/dynamic.ks` on the installed system, so the origin of any installed host can be traced back to a specific build.
+All three installer config files (`lf-rhel.cfg`, `lf-debian.cfg`, `lf-ubuntu.cfg`) carry a shared running build stamp under the name `LF_KICKSTART_VERSION`. The same stamp value applies to all three files at any given time — it is a repo-wide build marker, not a per-file version.
 
 The format is `YYYYMMDDNN`, where `YYYYMMDD` is the build date and `NN` is a two-digit daily sequence number starting at `01`. Example: `2026041501` for the first build on 2026-04-15, `2026041502` for the second on the same day.
 
+On every supported target, the stamp lands in two places: the installer-time logs and the file `/root/lf-install-version` on the installed system. The installer-time logs differ by target:
+
+- `lf-rhel.cfg`: exported as a shell variable in `%pre`, echoed into `/tmp/kickstart.install.pre.log`, re-echoed by the generated `%post` (so it shows up in `/var/log/anaconda/ks-script-*.log`), and embedded as a comment in `/root/dynamic.ks`.
+- `lf-debian.cfg`: logged via `logger(1)` in `d-i preseed/early_command`, which lands in `/var/log/syslog` during install and later in `/var/log/installer/syslog`.
+- `lf-ubuntu.cfg`: logged via `logger(1)` in `early-commands`, which lands in the live installer journal and later in `/var/log/installer/installer-journal.txt`.
+
+The stamp appears as a literal in multiple places within each of the three files (header comment, early/late commands, and for `lf-rhel.cfg` the `%pre` shell variable). All occurrences must be kept in lockstep when bumping — `grep -n LF_KICKSTART_VERSION lf-*.cfg` is a quick way to find them.
+
 Rules:
 
-- Bump `LF_KICKSTART_VERSION` in every commit that changes the effective content of `lf-rhel.cfg` (kickstart logic, embedded shell/Python, comments that end up in the generated output).
-- Pure documentation commits (`README.md`, `CONTRIBUTING.md`, `CHANGELOG.md`) and commits that only touch `lf-debian.cfg` or `lf-ubuntu.cfg` do not bump the RHEL kickstart version.
-- If multiple commits on the same day change `lf-rhel.cfg`, increment `NN` accordingly.
+- Bump `LF_KICKSTART_VERSION` in every commit that changes the effective content of `lf-rhel.cfg`, `lf-debian.cfg` or `lf-ubuntu.cfg` (kickstart/preseed/autoinstall logic, embedded shell/Python, comments that end up in the generated output).
+- Pure documentation commits (`README.md`, `CONTRIBUTING.md`, `CHANGELOG.md`) do not bump the version.
+- If multiple content-changing commits happen on the same day, increment `NN` accordingly.
 - Releases (as described in the `Changelog` section) also imply a version bump, because they are also content changes.
 
 

README.md

@@ -176,6 +176,7 @@ During and after an Anaconda install, the following log files are the fastest pa
 
 * `/root/anaconda-ks.cfg`: Anaconda's generated copy of the effective kickstart. Not present on targets where `can_save_output_kickstart=False` (including Rocky 10 cloud).
 * `/root/dynamic.ks`: The kickstart fragment Linuxfabrik archived on the installed system. The first comment line reads `# Linuxfabrik Kickstart version: YYYYMMDDNN`, which attributes the host to a specific `lf-rhel.cfg` build.
+* `/root/lf-install-version`: Distro-independent fleet marker file containing just the `YYYYMMDDNN` build stamp. Same value for equivalent files on Debian and Ubuntu hosts, making `cat /root/lf-install-version` a uniform cross-distro identification across the fleet.
 * `/root/original-ks.cfg`: Anaconda's verbatim copy of the `lf-rhel.cfg` served from the `inst.ks=` URL.
 
 **For `cloud-init` problems on `lftype=cloud` and `lftype=cloud-cis` (after first boot):**
@@ -268,7 +269,11 @@ During and after a Debian Installer (d-i) preseed run, the following log files a
 * `lsb-release`, `media-info`: Base distribution and installation media metadata.
 * `partman`: Partition manager log, persisted from the install.
 * `status`: `apt`/`dpkg` status of every package installed during the install phase.
-* `syslog`: Main installer narrative for the whole install.
+* `syslog`: Main installer narrative for the whole install. `grep 'Linuxfabrik Kickstart version' /var/log/installer/syslog` surfaces the `YYYYMMDDNN` build stamp logged by the preseed `early_command`.
+
+**On the installed system, outside `/var/log/installer/`:**
+
+* `/root/lf-install-version`: Distro-independent fleet marker file containing just the `YYYYMMDDNN` build stamp of the `lf-debian.cfg` variant that was applied during installation. Same value for equivalent files on RHEL and Ubuntu hosts, making `cat /root/lf-install-version` a uniform cross-distro identification across the fleet.
 
 
 ### References
@@ -342,9 +347,13 @@ During and after a subiquity autoinstall run, the following log files are the fa
 * `autoinstall-user-data`: The autoinstall YAML subiquity consumed, persisted.
 * `cloud-init-output.log`, `cloud-init.log`: Cloud-init logs from inside the installer — subiquity uses cloud-init internally to fetch `user-data` and apply some steps.
 * `curtin-install-cfg.yaml`, `curtin-install.log`: Curtin (the actual installer under subiquity) effective config and run log. First stop for partitioning, LVM or grub issues.
-* `installer-journal.txt`: Journal snapshot from the installer environment.
+* `installer-journal.txt`: Journal snapshot from the installer environment. `grep 'Linuxfabrik Kickstart version' /var/log/installer/installer-journal.txt` surfaces the `YYYYMMDDNN` build stamp logged by the autoinstall `early-commands`.
 * `subiquity-client-debug.log`, `subiquity-server-debug.log`: Subiquity's full debug logs.
 
+**On the installed system, outside `/var/log/installer/`:**
+
+* `/root/lf-install-version`: Distro-independent fleet marker file containing just the `YYYYMMDDNN` build stamp of the `lf-ubuntu.cfg` variant that was applied during installation. Same value for equivalent files on RHEL and Debian hosts, making `cat /root/lf-install-version` a uniform cross-distro identification across the fleet.
+
 
 ### References
 

lf-debian.cfg

@@ -16,6 +16,20 @@
 #     boot: auto url=http://<server>/<path>/lf-debian.cfg
 #   Or press 'e' on the "Install" entry and append:
 #     auto url=http://<server>/<path>/lf-debian.cfg
+#
+# Version stamp (YYYYMMDDNN): LF_KICKSTART_VERSION=2026041502
+# See CONTRIBUTING "Versioning the Kickstart File" for the bump rules. The
+# same literal must appear in the early_command and late_command blocks
+# below; it is logged via logger(1) at install time (lands in /var/log/syslog
+# and later /var/log/installer/syslog) and written to /root/lf-install-version
+# on the installed system so any host can be traced back to a specific
+# lf-debian.cfg build.
+
+
+### Version stamp
+
+d-i preseed/early_command string \
+    logger -t linuxfabrik-preseed 'Linuxfabrik Kickstart version: 2026041502'
 
 
 ### Localization
@@ -146,6 +160,7 @@ d-i grub-installer/bootdev string default
 ### Post-installation
 
 d-i preseed/late_command string \
+    echo '2026041502' > /target/root/lf-install-version; \
     echo 'linuxfabrik ALL=(ALL) NOPASSWD: ALL' > /target/etc/sudoers.d/linuxfabrik; \
     chmod 0440 /target/etc/sudoers.d/linuxfabrik; \
     mkdir -p -m0700 /target/home/linuxfabrik/.ssh; \

lf-rhel.cfg

@@ -80,7 +80,7 @@ services --disabled="kdump" --enabled="NetworkManager,sshd"
 # %post scripts; the Python helper picks it up from the environment and
 # embeds it as a comment in the generated dynamic.ks so it is visible on the
 # installed system via /root/dynamic.ks.
-LF_KICKSTART_VERSION=2026041501
+LF_KICKSTART_VERSION=2026041502
 export LF_KICKSTART_VERSION
 echo "Linuxfabrik Kickstart version: $LF_KICKSTART_VERSION"
 # rhel8 only has platform-python, rhel9+ has python3, so we'll have to detect what we have
@@ -417,10 +417,12 @@ echo 'Fixing SELinux contexts'
 touch /var/log/cron
 touch /var/log/boot.log
 mkdir -p /var/cache/yum
-# ignore return code because UEFI systems with vfat filesystems
-# that don't support selinux will give us errors like
-# "Could not set context for /boot/efi/EFI/BOOT/BOOTX64.EFI:  Operation not supported"
-/usr/sbin/fixfiles -R -a restore || true
+# Exclude /boot/efi from the relabel: it is vfat, which has no xattr support,
+# so SELinux contexts cannot be stored there. Previously this produced a
+# stream of "Could not set context for /boot/efi/EFI/...: Operation not
+# supported" messages that were functionally harmless but looked alarming
+# in the post-install log.
+/usr/sbin/fixfiles -R -a -e /boot/efi restore || true
 '''
 
 post_cloud_cis = post_cloud
@@ -514,6 +516,9 @@ dynamic.append('%end')
 
 dynamic.append('%post --erroronfail')
 dynamic.append('echo "Linuxfabrik Kickstart version: {}"'.format(lf_kickstart_version))
+# Write /root/lf-install-version: a distro-independent fleet marker file
+# that carries the build stamp for quick identification across hosts.
+dynamic.append('echo "{}" > /root/lf-install-version'.format(lf_kickstart_version))
 dynamic.append(post)
 dynamic.append('%end\n')
 

lf-ubuntu.cfg

@@ -23,11 +23,25 @@
 #     device: disk0
 #     size: 1M
 #     flag: bios_grub
+#
+# Version stamp (YYYYMMDDNN): LF_KICKSTART_VERSION=2026041502
+# See CONTRIBUTING "Versioning the Kickstart File" for the bump rules. The
+# same literal must appear in the early-commands and late-commands blocks
+# below; it is logged via logger(1) during early-commands (lands in the
+# live installer journal → /var/log/installer/installer-journal.txt) and
+# written to /root/lf-install-version on the installed system so any host
+# can be traced back to a specific lf-ubuntu.cfg build.
 
 #cloud-config
 autoinstall:
   version: 1
 
+  # Log the Linuxfabrik Kickstart version stamp into the installer journal
+  # for fleet traceability. Must match the literal in the header and in
+  # late-commands below.
+  early-commands:
+    - logger -t linuxfabrik-autoinstall "Linuxfabrik Kickstart version: 2026041502"
+
   locale: en_US.UTF-8
 
   keyboard:
@@ -183,6 +197,9 @@ autoinstall:
   # These run in the installer environment; use /target to access the installed system
   # or 'curtin in-target --' to run commands inside the installed system's chroot.
   late-commands:
+    # Record the Linuxfabrik Kickstart version stamp on the installed system
+    # for fleet traceability.
+    - echo "2026041502" > /target/root/lf-install-version
     # Lock root account (no password)
     - curtin in-target -- passwd -l root
     # Allow password-less sudo for linuxfabrik