Enable automatic bootloader updates

[jlebon]

Currently, Fedora CoreOS (and in fact, all other rpm-ostree-based Fedora variants) do not update the EFI bootloader together with host updates. The reason for this is explained in greater details in the bootupd README (see especially the Q&A). Recently, we've hit more and more issues related to stale bootloaders, to the point where it's becoming more urgent that we fix this gap.

The main blocker to have automatic bootloader updates is to make them safer in bootupd (related issues: coreos/bootupd#440, coreos/bootupd#454). Once it's deemed safe enough to turn on by default, we then need to integrate it into FCOS. Fedora IoT and Fedora Silverblue likely will also want this.

[bgilbert]

We should also consider whether to automatically update the BIOS bootloader. It's probably infeasible to do that safely, though.

[travier]

We've made a lot of progress on this front so we should reconsider that.

[dustymabe]

We've made a lot of progress on this front so we should reconsider that.

Added the meeting label. Might be good to summarize the progress here if you're able.

[travier]

From the 0.2.19 to the 0.2.24 release, we have fixed the following issues:

• Fixed handling of firmware vendor directories: handle efi vendordir better bootupd#630
• Removed the fixed systemd socket & service units to use ephemeral ones: drop systemd service bootupd#551
• Updates on UEFI are now completely safe: Update the ESP by creating a tmpdir and RENAME_EXCHANGE bootupd#454
• BIOS adoption has been updated: Adoption failure on Atomic Desktops using BIOS bootupd#717

We have the following issue still blocking us on Fedora CoreOS:

• Support for Fedora CoreOS' multiple EFI partition setup: Support updating multiple EFIs in mirrored setups bootupd#132
• Some SELinux rules are still missing: Missing SELinux rules (was: Empty bootupctl status since 0.2.20) bootupd#694

Once we have the SELinux issues fixed, we should be able to enable automatic updates on boot for non-RAID setups.
Once the RAID support is added, we can enable it for everyone.

This has been enabled by default on boot for the Atomic Desktops for Fedora 41 for UEFI, and planned to be enabled for BIOS as well soon.

[yasminvalim]

During our meeting today (10/30), we agreed to proceed with F42 and to assign someone with availability to implement it. You can find more details in the meeting logs.

[c4rt0]

Sorry for the noise, removing the meeting label as this was already discussed in the community meeting last week.