fix: use loader.conf default instead of bootctl for UKI boot selection

bootctl set-default / set-next require either the bootctl binary in PATH
or a writable efivarfs (backing OVMF_VARS flash device).  Both may be
absent: the Ubuntu container image does not guarantee bootctl is on PATH,
and test VMs often run with a read-only combined OVMF_CODE.fd that has no
separate writable VARS.

Fix: write `default <entry-id>` directly into /boot/efi/loader/loader.conf.
Systemd-boot reads this file at every boot and honours it as the default
entry when no EFI variable preference is set.  The file is on the FAT ESP
which is always writable when cbootc runs.

upgrade.rs: replace `bootctl set-default` with set_loader_conf_default()
rollback.rs: replace `bootctl set-next` / set_next_entry_bootctl() with the
             same helper (persistent rollback — stays on old entry until the
             next explicit upgrade, which is the correct behaviour here)
tests/e2e.py: replace test_bootctl_next_entry_set (EFI var check) with
              test_loader_conf_default_set (loader.conf check); drop _diag

Author: henrywang

src/rollback.rs

@@ -152,17 +152,6 @@ fn load_uki_entries() -> Result<Vec<BLSEntry>> {
     Ok(entries)
 }
 
-fn set_next_entry_bootctl(id: &str) -> Result<()> {
-    let status = Command::new("bootctl")
-        .args(["set-next", id])
-        .status()
-        .context("spawning bootctl set-next")?;
-    if !status.success() {
-        bail!("bootctl set-next failed: {status}");
-    }
-    Ok(())
-}
-
 fn use_systemd_boot() -> bool {
     Path::new(EFI_LINUX_DIR).exists() && grubenv_path().is_none()
 }
@@ -190,7 +179,7 @@ pub fn run() -> Result<()> {
 
     let id = entry_id(&previous.path);
     if systemd_boot {
-        set_next_entry_bootctl(id)?;
+        crate::upgrade::set_loader_conf_default(std::path::Path::new("/boot/efi"), id)?;
     } else if crate::install::has_grub2() {
         // Fedora/RHEL: grub2's blscfg.mod reads BLS entries natively and
         // matches next_entry=<digest> against each entry's --id.

src/upgrade.rs

@@ -5,6 +5,36 @@ use std::{fs, os::unix::fs::symlink, path::Path, path::PathBuf, process::Command
 
 use crate::{cfsctl, config, signing};
 
+/// Write (or update) the `default <entry_id>` line in
+/// `<esp>/loader/loader.conf` so systemd-boot boots `entry_id` on the next
+/// reboot.  Writing the file directly avoids any dependency on `bootctl` or a
+/// writable efivarfs — both of which may be absent in container/VM contexts.
+pub(crate) fn set_loader_conf_default(esp: &Path, entry_id: &str) -> Result<()> {
+    let conf = esp.join("loader/loader.conf");
+    fs::create_dir_all(conf.parent().unwrap()).context("creating loader dir")?;
+    let existing = if conf.exists() {
+        fs::read_to_string(&conf).with_context(|| format!("reading {}", conf.display()))?
+    } else {
+        String::new()
+    };
+    let mut replaced = false;
+    let mut lines: Vec<String> = existing
+        .lines()
+        .map(|l| {
+            if l.starts_with("default ") || l == "default" {
+                replaced = true;
+                format!("default {entry_id}")
+            } else {
+                l.to_owned()
+            }
+        })
+        .collect();
+    if !replaced {
+        lines.push(format!("default {entry_id}"));
+    }
+    fs::write(&conf, lines.join("\n") + "\n").with_context(|| format!("writing {}", conf.display()))
+}
+
 const EFI_ESP: &str = "/boot/efi";
 // UKIs live on the ESP, not XBOOTLDR — systemd-boot always scans its own partition.
 const EFI_LINUX_DIR: &str = "/boot/efi/EFI/Linux";
@@ -65,6 +95,11 @@ pub fn run(reboot: bool) -> Result<()> {
             println!("Signing UKI ...");
             crate::install::sign_efi(&uki_path, Path::new(&sb.key), Path::new(&sb.cert))?;
         }
+        // Make the new UKI the permanent default so systemd-boot boots it on
+        // the next reboot regardless of how the EFI/Linux/*.efi entries sort.
+        // Write loader.conf directly — does not require `bootctl` or a
+        // writable efivarfs (both may be absent in container/VM contexts).
+        set_loader_conf_default(Path::new(EFI_ESP), &digest)?;
     } else {
         patch_bls_entry(Path::new(BOOT_DIR), &digest, &image_ref)?;
         if !crate::install::has_grub2() {

tests/e2e.py

@@ -438,14 +438,13 @@ def test_grubenv_next_entry_set(child):
     )
 
 
-def test_bootctl_next_entry_set(child):
-    """After rollback, the LoaderEntryOneShot EFI variable must be present."""
-    efivar_guid = "4a67b082-0a4c-41cf-b6c7-440b29bb8c4f"
-    rc, _ = run_cmd(
-        child,
-        f"test -e /sys/firmware/efi/efivars/LoaderEntryOneShot-{efivar_guid}",
+def test_loader_conf_default_set(child):
+    """After rollback, /boot/efi/loader/loader.conf must have a 'default' entry."""
+    rc, out = run_cmd(child, "cat /boot/efi/loader/loader.conf 2>/dev/null || true")
+    assert rc == 0, "could not read loader.conf"
+    assert re.search(r"^default\s+\S", out, re.MULTILINE), (
+        f"no 'default' line in /boot/efi/loader/loader.conf:\n{out!r}"
     )
-    assert rc == 0, "LoaderEntryOneShot EFI variable not set after cbootc rollback"
 
 
 def test_rolled_back_digest_active(child, expected_digest):
@@ -456,22 +455,6 @@ def test_rolled_back_digest_active(child, expected_digest):
     )
 
 
-def _diag(child, label):
-    """Run diagnostic commands for debugging; never raises."""
-    print(f"\n--- DIAG: {label} ---")
-    for cmd in [
-        "which bootctl 2>&1 || echo 'bootctl not found'",
-        "bootctl --version 2>&1 | head -1 || true",
-        "mount | grep -E 'boot|efi' || echo 'no boot/efi mounts'",
-        "ls /boot/efi/EFI/Linux/ 2>&1 || echo 'EFI/Linux not accessible'",
-        "ls /sys/firmware/efi/efivars/ 2>&1 | wc -l || echo 'no efivars'",
-        "bootctl status 2>&1 | head -20 || true",
-    ]:
-        _, out = run_cmd(child, cmd)
-        print(out.strip())
-    print(f"--- END DIAG: {label} ---\n")
-
-
 def run_upgrade_sequence(disk_image, ovmf_code, registry, uki=False,
                          secure_boot=False, ovmf_vars=None):
     """Three-boot upgrade → rollback sequence on a sparse copy of disk_image.
@@ -512,9 +495,6 @@ def step(name, fn, *args):
             step("configure_guest_network", configure_guest_network, child)
             step("wait_for_network", wait_for_network, child)
 
-            if uki:
-                _diag(child, "before switch_to_v2 (UKI)")
-
             image_ref = (
                 f"docker://{REGISTRY_HOST}:{registry.port}/test-image:latest"
             )
@@ -537,13 +517,10 @@ def step(name, fn, *args):
             if secure_boot:
                 step("secure_boot_enabled_boot2", test_secure_boot_enabled, child)
 
-            if uki:
-                _diag(child, "before rollback_succeeds (UKI Boot 2)")
-
             step("rollback_succeeds", test_rollback_succeeds, child)
 
             if uki:
-                step("bootctl_next_entry_set", test_bootctl_next_entry_set, child)
+                step("loader_conf_default_set", test_loader_conf_default_set, child)
             else:
                 step("grubenv_next_entry_set", test_grubenv_next_entry_set, child)