UKI Addons Support

contrib/packaging/finalize-uki

@@ -35,6 +35,17 @@ if [[ -f "${uki_src}/${kver}.dump" ]]; then
     cp "${uki_src}/${kver}.dump" /boot
 fi
 
+# If we have a UKI Addon dir, add it
+if [[ -d "${uki_src}/${kver}.efi.extra.d" ]]; then
+    cp -r "${uki_src}/${kver}.efi.extra.d" /boot/EFI/Linux
+fi
+
+# If we have a global UKI Addon dir, add it
+if [[ -d "${uki_src}/loader/addons" ]]; then
+    mkdir -p /boot/loader
+    cp -r "${uki_src}/loader/addons" /boot/loader
+fi
+
 # NOTE: We used to create a symlink from /usr/lib/modules/${kver}/${kver}.efi to the UKI
 # for tooling compatibility. However, composefs-boot's find_uki_components() doesn't
 # handle symlinks correctly and fails with "is not a regular file". The UKI is already

crates/lib/src/bootc_composefs/delete.rs

@@ -6,7 +6,7 @@ use cap_std_ext::{cap_std::fs::Dir, dirext::CapStdExtDirExt};
 use crate::{
     bootc_composefs::{
         aboot,
-        boot::{BootType, get_efi_uuid_source},
+        boot::{BootType, STAGED_GLOBAL_UKI_ADDONS_DIR, get_efi_uuid_source},
         gc::{GCOpts, composefs_gc},
         rollback::{composefs_rollback, rename_exchange_user_cfg},
         state::remove_staged_deployment,
@@ -270,6 +270,14 @@ pub(crate) async fn delete_composefs_deployment(
         }
     } else {
         delete_depl_boot_entries(&depl_to_del, &storage, deleting_staged)?;
+
+        if deleting_staged {
+            let esp = storage.require_esp()?;
+
+            esp.fd
+                .remove_all_optional(STAGED_GLOBAL_UKI_ADDONS_DIR)
+                .context("Removing staged Global UKI Addons")?;
+        }
     }
 
     composefs_gc(

crates/lib/src/bootc_composefs/finalize.rs

@@ -1,5 +1,6 @@
 use std::{path::Path, process::Command};
 
+use crate::bootc_composefs::boot::{GLOBAL_UKI_ADDONS_DIR, STAGED_GLOBAL_UKI_ADDONS_DIR};
 use crate::bootc_composefs::gc::{GCOpts, composefs_gc};
 use crate::bootc_composefs::rollback::{rename_exchange_bls_entries, rename_exchange_user_cfg};
 use crate::bootc_composefs::status::get_composefs_status;
@@ -16,7 +17,7 @@ use cap_std_ext::dirext::CapStdExtDirExt;
 use composefs::generic_tree::{FileSystem, Stat};
 use composefs_ctl::composefs;
 use etc_merge::{Diff, compute_diff, merge, traverse_etc};
-use rustix::fs::{Mode, OFlags, fsync};
+use rustix::fs::{Mode, OFlags, RenameFlags, fsync, renameat, renameat_with};
 
 use fn_error_context::context;
 
@@ -154,6 +155,42 @@ pub(crate) async fn composefs_backend_finalize(
         );
     }
 
+    let esp = storage.require_esp()?;
+
+    // Un-stage Global UKI Addons (if present) as the penultimate step
+    if esp.fd.exists(STAGED_GLOBAL_UKI_ADDONS_DIR) {
+        if esp.fd.exists(GLOBAL_UKI_ADDONS_DIR) {
+            tracing::debug!(
+                "Atomically exchanging {STAGED_GLOBAL_UKI_ADDONS_DIR} and {GLOBAL_UKI_ADDONS_DIR}"
+            );
+
+            renameat_with(
+                &esp.fd,
+                STAGED_GLOBAL_UKI_ADDONS_DIR,
+                &esp.fd,
+                GLOBAL_UKI_ADDONS_DIR,
+                RenameFlags::EXCHANGE,
+            )
+            .context("Atomically exchanging staged Global UKI Addons")?;
+
+            esp.fd
+                .remove_dir_all(STAGED_GLOBAL_UKI_ADDONS_DIR)
+                .context("Removing staged Global UKI Addons dir")?;
+        } else {
+            tracing::debug!(
+                "No global addons in the current deployment. Finalizing global UKI Addons"
+            );
+
+            renameat(
+                &esp.fd,
+                STAGED_GLOBAL_UKI_ADDONS_DIR,
+                &esp.fd,
+                GLOBAL_UKI_ADDONS_DIR,
+            )
+            .context("Finalizing global UKI Addons")?;
+        }
+    }
+
     let boot_dir = storage.require_boot_dir()?;
 
     match booted_composefs.bootloader.kind()? {