Function install_systemd_boot

crates/lib/src/bootloader.rs:240–327

(
    prepared_root: &MountedImageRoot,
    configopts: &crate::install::InstallConfigOpts,
    autoenroll: Option<SecurebootKeys>,
)

/// Install systemd-boot using a pre-prepared boot root.
#[context("Installing bootloader")]
pub(crate) fn install_systemd_boot(
    prepared_root: &MountedImageRoot,
    configopts: &crate::install::InstallConfigOpts,
    autoenroll: Option<SecurebootKeys>,
) -> Result<()> {
    println!("Installing bootloader via systemd-boot");

    // We use the --root of the mounted target root, so we have the right /etc/os-release.
    let root_path = prepared_root
        .root_path()
        .to_str()
        .ok_or_else(|| anyhow::anyhow!("composefs tmpdir path is not UTF-8"))?;
    let esp_path_in_root = format!("/{}", prepared_root.esp_subdir);

    let mut bootctl_args = vec![
        "install",
        "--root",
        root_path,
        "--esp-path",
        esp_path_in_root.as_str(),
        // If we supported XBOOTLDR in the future, that'd go here with --boot-path.
    ];

    if configopts.generic_image {
        bootctl_args.push("--no-variables");
        // `--random-seed` was only added to `bootctl install` in systemd 257.
        let systemd_version = bootctl_systemd_version()?;
        if systemd_version >= BOOTCTL_RANDOM_SEED_MIN_VERSION {
            bootctl_args.extend(["--random-seed", "no"]);
        } else {
            tracing::debug!(
                "Skipping --random-seed: requires systemd >= {BOOTCTL_RANDOM_SEED_MIN_VERSION}, found {systemd_version}"
            );
        }
    }

    Command::new("bootctl")
        .args(bootctl_args)
        // Skip partition-type GUID validation because e.g. osbuild
        // may not provide the udev database.
        .env("SYSTEMD_RELAX_ESP_CHECKS", "1")
        // bootc doesn't use the entry-token file, but bootctl still tries to
        // write it.  Redirect into /tmp (a tmpfs mounted by MountedImageRoot)
        // so the write succeeds and is automatically discarded.
        .env("KERNEL_INSTALL_CONF_ROOT", KERNEL_INSTALL_CONF_ROOT)
        .log_debug()
        // Capture stderr so bootctl error messages appear in our error chain.
        .run_capture_stderr()?;

    if let Some(SecurebootKeys { dir, keys }) = autoenroll {
        let esp_dir = prepared_root.open_esp_dir()?;
        let keys_path = prepared_root
            .root_path()
            .join(prepared_root.esp_subdir)
            .join(SYSTEMD_KEY_DIR);
        create_dir_all(&keys_path).with_context(|| {
            format!("Creating secureboot key directory {}", keys_path.display())
        })?;