[cgwalters-bot]

bootc install mount --latest now mounts the deployment that the default boot entry boots, instead of requiring the sysroot to contain exactly one deployment. This is the follow-up to the review on bootc-dev#2483 (mount.rs:90). Design notes: https://gist.github.com/cgwalters-bot/3d295a3185c75c5a24989dda21018573

A booted system knows its deployment from the kernel command line. Offline, the equivalent is the command line of the entry the bootloader would pick. The entries come from SYSROOT/boot and the ESP, and they are ordered with the same code bootc status uses: for GRUB, the user.cfg UKI entries or else the Type 1 entries sorted by file name; otherwise the Type 1 entries in BLS order. For a composefs entry, its digest (or UKI name) picks the deployment. For an ostree= entry, it is OSTree's own default (deployments()[0], which OSTree orders from the same entries, as bootc status shows it), rather than re-sorting the entries: GRUB's file name order differs from OSTree's at ten or more deployments. The bootloader probe get_bootloader uses without EFI variables now takes the boot directories, so mount shares it. A new --esp option names the ESP, and defaults to SYSROOT/boot/efi.

Caveats:

• There is no --boot. OSTree loads its deployments from SYSROOT/boot, so /boot has to be mounted there anyway, and the man page says so.
• EFI variables (such as a one-time boot entry), boot counting, loader.conf's default and grubenv's saved_entry are not considered. bootc status doesn't consider them either.
• With no boot entries at all, the old rule still applies: a sole deployment is mounted. That keeps a fresh install mountable without mounting the ESP.

Tested on a 16-core RHEL 10 devspace:

• Plan 23 (install-outside-container) is extended. On ostree it deploys the same commit ten more times (11 deployments, so file-name order would pick the wrong one) and checks that --latest follows OSTree's default, also after ostree admin set-default. On composefs it rewrites the installed boot entries to name a missing deployment and checks that the mount fails naming it, then restores them. An earlier two-deployment version of the test, run with main's bootc (683bb05), failed with target must contain exactly one deployment (found 2 OSTree, 0 composefs).
• With this change, plan 23 passes on ostree/grub, composefs grub/BLS/ext4 and composefs systemd-boot/UKI/ext4 (unsealed), and just validate and just unit-tests pass. The new unit tests cover entry ordering for each bootloader layout, the boot directory probe, and choosing the deployment.

Generated-by: https://github.com/cgwalters/#llms

---

Review draft in cgwalters-forge, not upstream yet. This section is removed when the PR is opened upstream.

• Upstream: bootc-dev/bootc, base main
• Board item: PVTI_lAHOAQ_SPs4Bj2Gizg81_2U
• Fork CI: off; the devspace testing described above is this PR's CI, and upstream CI runs once it is opened there

To review:

• Approve, or comment /promote on a line of its own, to open it upstream, ready for review. Either covers only the commits pushed so far.
• If upstream requires DCO, approving also signs off: promote adds Signed-off-by: Colin Walters <walters@verbum.org> to the commits lacking it (the bot's and yours; anyone else's only if you ask), with you as committer.
• Add a /draft line (in the same comment or before) to open it upstream as a draft (/ready undoes that).
• Close to drop it.
• Edit the title and description freely: they become the upstream PR's. Review comments are squashed into the commits they concern, with a reply here.

_{Bot run: session 929c7a64, agent ab90df78 · claude-opus-5-5 21.2M in (96% cached) / 84k out · ~$10.14 inference + ~$3.62 compute (est., list prices) · 1h 27m wall · 23.0 core-h, Actions run 36504696906}

_{Bot run: session 929c7a64, agent ab90df78 · claude-opus-5-5 27.5M in (96% cached) / 106k out · ~$13.24 inference + ~$5.97 compute (est., list prices) · 2h 27m wall · 37.9 core-h, Actions runs 36511940554, 36504696906}

[cgwalters-bot]

Review guide for head 6d62ee8a2c: where to look closely and what is safe to skim. It is advice from the bot's reviewer and doesn't replace reading the diff; the review app walks it.

bootc install mount --latest now mounts the deployment the default boot entry boots instead of requiring exactly one deployment. Composefs is handled by reusing status.rs's sorted Type 1 / GRUB user.cfg readers plus BLSConfig::get_verity, which matches bootc status. The risk is in the parts that are new code rather than reuse. For OSTree the PR parses ostree=/ostree/boot.N/... itself and picks the first entry in GRUB file-name order. bootc status instead uses ostree's own deployment list, which Sysroot::load already builds from these same entries in ostree's version order (deployments()[0] is the default). The PR's order differs from that one at 10 or more deployments (ostree-9 sorts after ostree-10). The GRUB-vs-BLS probe (is_grub, GRUB_DIRS) also repeats classify_bootloader's non-EFI branch in status.rs. The fallback for when no entries are found keeps the old exactly-one rule, so it fails closed. There is no --boot, which is consistent because OSTree only loads from SYSROOT/boot anyway. The tmt change extends plan 23, so no new test number is needed. It checks a real selection on OSTree (set-default) and only the negative case on composefs.

Hotspots

1. look-closely · logic — crates/lib/src/mount.rs:111-139 (6d62ee8): This reimplements ostree's own bootlink parsing and entry-to-deployment mapping. ostree_sysroot.deployments() is already ordered from these same entries, and bootc status uses it for OSTree. For an ostree= default entry, taking ostree's deployments[0] would drop this parser and its tests and match status exactly.
2. look-closely · logic — crates/lib/src/mount.rs:159-171 (6d62ee8): This duplicates classify_bootloader's non-EFI filesystem probe and GRUB_DIRS in bootc_composefs/status.rs, in relative-path form. Consider making the probe take a boot Dir and sharing it with get_bootloader, so the two cannot drift.
3. look-closely · logic — crates/lib/src/mount.rs:185-208 (6d62ee8): This is the core ordering. For GRUB Type 1 it uses descending file-name order, which is right for bootc's composefs entries. For OSTree entries (ostree-N-stateroot.conf) it disagrees with ostree's version order at 10 or more deployments. Also, user.cfg existence stands in for status's origin boot_type, and systemd-boot merges /boot and ESP entries.
4. note · error-handling — crates/lib/src/mount.rs:216-272 (6d62ee8): The fallback only applies with zero entries and still refuses more than one deployment, so it is safe. A foreign entry that sorts first (another OS on a shared ESP) fails hard with 'has no composefs or ostree kernel argument' rather than guessing, which is acceptable.
5. note · api — crates/lib/src/mount.rs:309-334 (6d62ee8): --esp defaults to SYSROOT/boot/efi, and there is no --boot. That is consistent because ostree Sysroot::load only reads SYSROOT/boot, and --boot can be added later without breaking anything.
6. note · test-gap — tmt/tests/booted/test-install-outside-container.nu:269-288 (6d62ee8): On composefs this only proves the entries are consulted (a missing target fails). It never selects between two composefs deployments, so that selection is covered only by the unit tests.
7. note · test-gap — tmt/tests/booted/test-install-outside-container.nu:291 (6d62ee8): This removes the etc.transient prepare-root.conf written earlier so the markers persist. A short comment would say why.

Safe to skim

• crates/lib/src/bootc_composefs/status.rs: thin wrapper exposing the existing sorted-entries helper for an explicit bootloader
• docs/src/man/bootc-install-mount.8.md: man page prose matching the new behavior
• crates/lib/src/mount.rs:499-684: table-driven unit tests

[cgwalters-bot]

Signed off 1 commit(s) with Signed-off-by: Colin Walters <walters@verbum.org> for bootc-dev/bootc's DCO check, on cgwalters's approval #32 (review) of ba441d50e809. Same trees; the head is now b298c49ceeaf.

[cgwalters-bot]

Opened upstream as bootc-dev#2515. Closing this review draft.