bootloader: Add GrubCC bootloader

Add GrubCC (Grub ConfidentialClusters) as a new bootloader option. This
is a minimal version of grub that's supposed to work exactly like
systemd-boot

Fixes: #2212

Signed-off-by: Johan-Liebert1 <pragyanpoudyal41999@gmail.com>

Author: Johan-Liebert1

Dockerfile

@@ -59,6 +59,7 @@ COPY --from=target-base /target-rootfs/ /
 ARG SKIP_CONFIGS
 ARG boot_type
 ARG seal_state
+ARG bootloader
 # All network-fetching operations: package installs from distro repos, Copr, Koji.
 # Separated so `just build-fetch --target=fetch` can be retried independently on
 # transient network failures without re-running the configuration phase.
@@ -89,6 +90,20 @@ RUN --mount=type=tmpfs,target=/run --mount=type=tmpfs,target=/tmp \
     if [[ ${#pkgs_to_install[@]} -gt 0 ]]; then
         dnf install -y "${pkgs_to_install[@]}"
     fi
+
+    if [[ "$bootloader" == "grub-cc" ]]; then
+        # We have this until we get grub-cc support in bootupd
+        arch=$(uname -m)
+        curl -L -o /var/grub-cc.rpm "https://kojipkgs.fedoraproject.org/packages/grub2/2.12/59.eln156/x86_64/grub2-efi-x64-cc-2.12-59.eln156.${arch}.rpm"
+        mkdir /var/grub-cc
+        rpm2archive /var/grub-cc.rpm | tar -xvz -C /var/grub-cc
+        file=$(find /var/grub-cc -name '*.efi')
+        mkdir /usr/lib/grub-cc
+        cp $file /usr/lib/grub-cc
+        rm -rvf /var/grub-cc
+        rm -rvf /var/grub-cc.rpm
+    fi
+
 EOF
 
 # Note we don't do any customization here yet

crates/lib/src/bootc_composefs/backwards_compat/bcompat_boot.rs

@@ -384,7 +384,7 @@ pub(crate) async fn prepend_custom_prefix(
                 rename_exchange_user_cfg(&grub_dir)?;
             }
 
-            Bootloader::Systemd => {
+            Bootloader::Systemd | Bootloader::GrubCC => {
                 handle_bls_conf(storage, cfs_cmdline, boot_dir, true)?;
             }
 

crates/lib/src/bootc_composefs/boot.rs

@@ -607,7 +607,7 @@ pub(crate) fn setup_composefs_bls_boot(
             )
         }
 
-        Bootloader::Systemd => {
+        Bootloader::Systemd | Bootloader::GrubCC => {
             let efi_mount = mount_esp(&esp_device).context("Mounting ESP")?;
 
             let mounted_efi = Utf8PathBuf::from(efi_mount.dir.path().as_str()?);
@@ -1169,7 +1169,9 @@ pub(crate) fn setup_composefs_uki_boot(
             write_grub_uki_menuentry(root_path, &setup_type, uki_info.boot_label, id, &esp_device)?
         }
 
-        Bootloader::Systemd => write_systemd_uki_config(&esp_mount.fd, &setup_type, uki_info, id)?,
+        Bootloader::Systemd | Bootloader::GrubCC => {
+            write_systemd_uki_config(&esp_mount.fd, &setup_type, uki_info, id)?
+        }
 
         Bootloader::None => unreachable!("Checked at install time"),
     };
@@ -1369,13 +1371,48 @@ pub(crate) async fn setup_composefs_boot(
             &root_setup.device_info.require_single_root()?,
             boot_uuid,
         )?;
-    } else if postfetch.detected_bootloader == Bootloader::Grub {
+    } else if matches!(
+        postfetch.detected_bootloader,
+        Bootloader::Grub | Bootloader::GrubCC
+    ) {
         crate::bootloader::install_via_bootupd(
             &root_setup.device_info,
             &root_setup.physical_root_path,
             &state.config_opts,
             None,
         )?;
+
+        // FIXME: Remove this hack once we have support in bootupd
+        if matches!(postfetch.detected_bootloader, Bootloader::GrubCC) {
+            root_setup
+                .physical_root
+                .remove_dir_all("boot/grub2")
+                .context("removing grub2")?;
+
+            let (os_id, ..) = parse_os_release(mounted_root.dir())?
+                .ok_or_else(|| anyhow::anyhow!("Failed to parse os-release"))?;
+
+            let dir = format!("EFI/{os_id}");
+
+            // Files are in EFI/<os-name>/
+            let efis_dir = mounted_root
+                .open_esp_dir()
+                .context("opening esp")?
+                .open_dir(&dir)
+                .with_context(|| format!("Opening {dir}"))?;
+
+            efis_dir
+                .remove_file_optional("bootuuid.cfg")
+                .context("Removing bootuuid.cfg")?;
+            efis_dir
+                .remove_file_optional("grub.cfg")
+                .context("Removing grub.cfg")?;
+
+            mounted_root
+                .dir()
+                .copy("usr/lib/grub-cc/grubx64-cc.efi", &efis_dir, "grubx64.efi")
+                .context("Copying grub-cc binary")?;
+        }
     } else {
         crate::bootloader::install_systemd_boot(
             &mounted_root,

crates/lib/src/bootc_composefs/delete.rs

@@ -153,7 +153,7 @@ fn delete_depl_boot_entries(
             }
         },
 
-        Bootloader::Systemd => {
+        Bootloader::Systemd | Bootloader::GrubCC => {
             // For Systemd UKI as well, we use .conf files
             delete_type1_conf_file(deployment, boot_dir, deleting_staged)
         }

crates/lib/src/bootc_composefs/finalize.rs

@@ -140,7 +140,7 @@ pub(crate) async fn composefs_backend_finalize(
             BootType::Uki => finalize_staged_grub_uki(boot_dir)?,
         },
 
-        Bootloader::Systemd => {
+        Bootloader::Systemd | Bootloader::GrubCC => {
             let entries_dir = boot_dir.open_dir("loader")?;
             rename_exchange_bls_entries(&entries_dir)?;
         }

crates/lib/src/bootc_composefs/rollback.rs

@@ -234,7 +234,7 @@ pub(crate) async fn composefs_rollback(
             }
         },
 
-        Bootloader::Systemd => {
+        Bootloader::Systemd | Bootloader::GrubCC => {
             // We use BLS entries for systemd UKI as well
             rollback_composefs_entries(boot_dir, rollback_entry.bootloader.clone())?;
         }

crates/lib/src/bootc_composefs/status.rs

@@ -368,7 +368,7 @@ pub(crate) fn list_bootloader_entries(storage: &Storage) -> Result<Vec<Bootloade
             }
         }
 
-        Bootloader::Systemd => list_type1_entries(boot_dir)?,
+        Bootloader::Systemd | Bootloader::GrubCC => list_type1_entries(boot_dir)?,
 
         Bootloader::None => unreachable!("Checked at install time"),
     };
@@ -414,10 +414,14 @@ pub(crate) fn get_bootloader() -> Result<Bootloader> {
     let bootloader = match read_uefi_var(EFI_LOADER_INFO) {
         Ok(loader) => {
             if loader.to_lowercase().contains("systemd-boot") {
-                Bootloader::Systemd
-            } else {
-                Bootloader::Grub
+                return Ok(Bootloader::Systemd);
+            }
+
+            if loader.to_lowercase().contains("grub cc") {
+                return Ok(Bootloader::GrubCC);
             }
+
+            return Ok(Bootloader::Grub);
         }
 
         Err(efi_error) => match efi_error {
@@ -911,7 +915,7 @@ async fn composefs_deployment_status_from(
         },
 
         // We will have BLS stuff and the UKI stuff in the same DIR
-        Bootloader::Systemd => {
+        Bootloader::Systemd | Bootloader::GrubCC => {
             let bls_configs = get_sorted_type1_boot_entries(boot_dir, true)?;
             let bls_config = bls_configs
                 .first()

crates/lib/src/bootc_composefs/update.rs

@@ -184,7 +184,7 @@ pub(crate) fn validate_update(
             }
         },
 
-        Bootloader::Systemd => rm_staged_type1_ent(boot_dir)?,
+        Bootloader::Systemd | Bootloader::GrubCC => rm_staged_type1_ent(boot_dir)?,
 
         Bootloader::None => unreachable!("Checked at install time"),
     }

crates/lib/src/install.rs

@@ -1291,6 +1291,7 @@ pub(crate) fn exec_in_host_mountns(args: &[std::ffi::OsString]) -> Result<()> {
     Err(Command::new(cmd).args(args).arg0(bootc_utils::NAME).exec()).context("exec")?
 }
 
+#[derive(Debug)]
 pub(crate) struct RootSetup {
     #[cfg(feature = "install-to-disk")]
     luks_device: Option<String>,
@@ -1874,7 +1875,7 @@ async fn install_with_sysroot(
                     Some(&deployment_path.as_str()),
                 )?;
             }
-            Bootloader::Systemd => {
+            Bootloader::Systemd | Bootloader::GrubCC => {
                 anyhow::bail!("bootupd is required for ostree-based installs");
             }
             Bootloader::None => {

crates/lib/src/install/baseline.rs

@@ -55,7 +55,7 @@ fn use_discoverable_partitions(state: &State) -> bool {
     // systemd-boot always supports BLI
     matches!(
         state.config_opts.bootloader,
-        Some(crate::spec::Bootloader::Systemd)
+        Some(crate::spec::Bootloader::Systemd) | Some(crate::spec::Bootloader::GrubCC)
     )
 }