bootc_lib/bootc_composefs/

status.rs

use std::{io::Read, sync::OnceLock};

use anyhow::{Context, Result, ensure};
use bootc_mount::inspect_filesystem;
use composefs_ctl::composefs::erofs::format::FormatVersion;
use composefs_ctl::composefs::fsverity::{FsVerityHashValue, Sha512HashValue};
use composefs_ctl::composefs_boot::cmdline::{
    ComposefsCmdline as BootComposefsCmdline, KARG_COMPOSEFS_DIGEST, KARG_V2,
};
use composefs_ctl::composefs_oci;
use composefs_oci::OciImage;
use fn_error_context::context;
use linux_kernel_cmdline::utf8::Cmdline;
use openssl::sha::Sha256;
use serde::{Deserialize, Serialize};

use crate::{
    bootc_composefs::{
        aboot,
        boot::BootType,
        selinux::are_selinux_policies_compatible,
        state::{get_usr_overlay_status, read_boot_type, read_origin},
        utils::{compute_store_boot_digest_for_uki, get_uki_cmdline},
    },
    composefs_consts::{
        ORIGIN_KEY_BOOT_DIGEST, ORIGIN_KEY_IMAGE, ORIGIN_KEY_MANIFEST_DIGEST, TYPE1_ENT_PATH,
        TYPE1_ENT_PATH_STAGED, USER_CFG, USER_CFG_STAGED,
    },
    install::EFI_LOADER_INFO,
    parsers::{
        bls_config::{BLSConfig, BLSConfigType, EFIKey, parse_bls_config},
        grub_menuconfig::{MenuEntry, parse_grub_menuentry_file},
    },
    spec::{BootEntry, BootOrder, BootloaderKind, Host, HostSpec, ImageStatus},
    store::Storage,
    utils::{EfiError, read_uefi_var},
};

use std::str::FromStr;

use bootc_utils::try_deserialize_timestamp;
use cap_std_ext::{cap_std::fs::Dir, dirext::CapStdExtDirExt};
use ostree_container::OstreeImageReference;
use ostree_ext::container::{self as ostree_container};
use ostree_ext::containers_image_proxy::{ImageProxy, ImageReference};

use ostree_ext::oci_spec;
use ostree_ext::{container::deploy::ORIGIN_CONTAINER, oci_spec::image::ImageConfiguration};

use ostree_ext::oci_spec::image::ImageManifest;
use tokio::io::AsyncReadExt;

use crate::composefs_consts::{
    COMPOSEFS_STAGED_DEPLOYMENT_FNAME, COMPOSEFS_TRANSIENT_STATE_DIR, ORIGIN_KEY_BOOT,
    ORIGIN_KEY_BOOT_TYPE, STATE_DIR_RELATIVE,
};
use crate::spec::Bootloader;

/// Used for storing the container image info alongside of .origin file
#[derive(Debug, Serialize, Deserialize)]
pub(crate) struct ImgConfigManifest {
    pub(crate) config: ImageConfiguration,
    pub(crate) manifest: ImageManifest,
}

/// A parsed composefs command line
#[derive(Clone)]
pub(crate) struct ComposefsCmdline {
    pub allow_missing_fsverity: bool,
    pub digest: Box<str>,
    /// True when the root is a transient overlay (source prefix `transient:composefs=`).
    /// Set by [`composefs_booted`]; always `false` when constructed from a cmdline string.
    pub is_transient: bool,
}

/// Information about a deployment for soft reboot comparison
struct DeploymentBootInfo<'a> {
    boot_digest: &'a str,
    full_cmdline: &'a Cmdline<'a>,
    verity: &'a str,
}

impl ComposefsCmdline {
    pub(crate) fn new(s: &str) -> Self {
        let (allow_missing_fsverity, digest_str) = s
            .strip_prefix('?')
            .map(|v| (true, v))
            .unwrap_or_else(|| (false, s));
        ComposefsCmdline {
            allow_missing_fsverity,
            digest: digest_str.into(),
            is_transient: false,
        }
    }

    /// Search for either supported composefs kernel command line parameter.
    pub(crate) fn find_in_cmdline(cmdline: &Cmdline) -> Result<Option<Self>> {
        let Some(parsed) = BootComposefsCmdline::<Sha512HashValue>::from_cmdline(cmdline)
            .context("Parsing composefs kernel command line")?
        else {
            return Ok(None);
        };
        Ok(Some(Self {
            allow_missing_fsverity: parsed.is_insecure(),
            digest: parsed.digest().to_hex().into(),
            is_transient: false,
        }))
    }
}

fn reconcile_composefs_cmdline_with_mount_source(
    mut cmdline: ComposefsCmdline,
    mount_source: &str,
) -> Result<ComposefsCmdline> {
    let (verity, is_transient) = if let Some(v) = mount_source.strip_prefix("composefs:") {
        (v, false)
    } else if let Some(v) = mount_source.strip_prefix("transient:composefs=") {
        (v, true)
    } else {
        anyhow::bail!("Root not mounted using composefs (source: {mount_source})")
    };

    let mount_cmdline = ComposefsCmdline::new(verity);
    if *mount_cmdline.digest != *cmdline.digest {
        cmdline.digest = mount_cmdline.digest;
    }
    cmdline.is_transient = is_transient;
    Ok(cmdline)
}

/// Render a composefs karg that identifies the EROFS format of `digest`.
pub(crate) fn build_composefs_karg(
    digest: Sha512HashValue,
    format_version: FormatVersion,
    allow_missing_fsverity: bool,
) -> String {
    match format_version {
        FormatVersion::V0 | FormatVersion::V1 => {
            BootComposefsCmdline::new_v1(digest, allow_missing_fsverity)
        }
        FormatVersion::V2 => BootComposefsCmdline::new_v2(digest, allow_missing_fsverity),
    }
    .to_cmdline_arg()
}

impl std::fmt::Display for ComposefsCmdline {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        let allow_missing_fsverity = if self.allow_missing_fsverity { "?" } else { "" };
        write!(f, "{}={}{}", KARG_V2, allow_missing_fsverity, self.digest)
    }
}

/// The JSON schema for staged deployment information
/// stored in `/run/composefs/staged-deployment`
#[derive(Debug, Serialize, Deserialize)]
pub(crate) struct StagedDeployment {
    /// The id (verity hash of the EROFS image) of the staged deployment
    pub(crate) depl_id: String,
    /// Whether to finalize this staged deployment on reboot or not
    /// This also maps to `download_only` field in `BootEntry`
    pub(crate) finalization_locked: bool,
}

#[derive(Debug, PartialEq)]
pub(crate) struct BootloaderEntry {
    /// The fsverity digest associated with the bootloader entry
    /// This is the value of composefs= param
    pub(crate) fsverity: String,
    /// The name of the (UKI/Kernel+Initrd directory) related to the entry
    ///
    /// For UKI, this is the name of the UKI stripped of our custom
    /// prefix and .efi suffix
    ///
    /// For Type1 entries, this is the name to the directory containing
    /// Kernel+Initrd, stripped of our custom prefix
    ///
    /// Since this is stripped of all our custom prefixes + file extensions
    /// this is basically the verity digest part of the name
    ///
    /// We mainly need this in order to GC shared Type1 entries
    pub(crate) boot_artifact_name: String,
}

/// Detect if we have `composefs=<digest>` in `/proc/cmdline`
pub(crate) fn composefs_booted() -> Result<Option<&'static ComposefsCmdline>> {
    static CACHED_DIGEST_VALUE: OnceLock<Option<ComposefsCmdline>> = OnceLock::new();
    if let Some(v) = CACHED_DIGEST_VALUE.get() {
        return Ok(v.as_ref());
    }
    let cmdline = Cmdline::from_proc()?;
    let Some(v) = ComposefsCmdline::find_in_cmdline(&cmdline)? else {
        return Ok(None);
    };

    // Find the source of / mountpoint as the cmdline doesn't change on soft-reboot
    let root_mnt = inspect_filesystem("/".into())?;

    // The mount source is authoritative after a soft reboot, while the
    // parsed command line retains policy such as allow-missing-fsverity.
    let reconciled = reconcile_composefs_cmdline_with_mount_source(v, &root_mnt.source)?;
    let r = CACHED_DIGEST_VALUE.get_or_init(|| Some(reconciled));

    Ok(r.as_ref())
}

/// Get the staged grub UKI menuentries
pub(crate) fn get_sorted_grub_uki_boot_entries_staged<'a>(
    boot_dir: &Dir,
    str: &'a mut String,
) -> Result<Vec<MenuEntry<'a>>> {
    get_sorted_grub_uki_boot_entries_helper(boot_dir, str, true)
}

/// Get the grub UKI menuentries
pub(crate) fn get_sorted_grub_uki_boot_entries<'a>(
    boot_dir: &Dir,
    str: &'a mut String,
) -> Result<Vec<MenuEntry<'a>>> {
    get_sorted_grub_uki_boot_entries_helper(boot_dir, str, false)
}

// Need str to store lifetime
fn get_sorted_grub_uki_boot_entries_helper<'a>(
    boot_dir: &Dir,
    str: &'a mut String,
    staged: bool,
) -> Result<Vec<MenuEntry<'a>>> {
    let file = if staged {
        boot_dir
            // As the staged entry might not exist
            .open_optional(format!("grub2/{USER_CFG_STAGED}"))
            .with_context(|| format!("Opening {USER_CFG_STAGED}"))?
    } else {
        let f = boot_dir
            .open(format!("grub2/{USER_CFG}"))
            .with_context(|| format!("Opening {USER_CFG}"))?;

        Some(f)
    };

    let Some(mut file) = file else {
        return Ok(Vec::new());
    };

    file.read_to_string(str)?;
    parse_grub_menuentry_file(str)
}

/// Get sorted boot entries
/// The sort here is done in terms of what will be shown on the boot menu
/// For systemd-boot, the entries are sorted by `sort-key`
/// For grub, the entries are sorted by the filename in descending order
pub(crate) fn get_sorted_type1_boot_entries(
    boot_dir: &Dir,
    ascending: bool,
) -> Result<Vec<BLSConfig>> {
    let bootloader = get_bootloader()?;
    get_sorted_type1_boot_entries_helper(boot_dir, ascending, false, bootloader)
}

/// Same as [`get_sorted_type1_boot_entries`], but returns staged entries
/// See [`get_sorted_type1_boot_entries`] for more details
pub(crate) fn get_sorted_staged_type1_boot_entries(
    boot_dir: &Dir,
    ascending: bool,
) -> Result<Vec<BLSConfig>> {
    let bootloader = get_bootloader()?;
    get_sorted_type1_boot_entries_helper(boot_dir, ascending, true, bootloader)
}

#[context("Getting sorted Type1 boot entries")]
fn get_sorted_type1_boot_entries_helper(
    boot_dir: &Dir,
    ascending: bool,
    get_staged_entries: bool,
    bootloader: crate::spec::Bootloader,
) -> Result<Vec<BLSConfig>> {
    #[derive(Debug)]
    struct ConfigWithFilename {
        config: BLSConfig,
        filename: String,
    }

    let dir = match get_staged_entries {
        true => {
            let dir = boot_dir.open_dir_optional(TYPE1_ENT_PATH_STAGED)?;

            let Some(dir) = dir else {
                return Ok(vec![]);
            };

            dir.read_dir(".")?
        }

        false => boot_dir.read_dir(TYPE1_ENT_PATH)?,
    };

    let mut configs_with_filenames = vec![];

    for entry in dir {
        let entry = entry?;

        let file_name = entry.file_name();

        let file_name = file_name
            .to_str()
            .ok_or(anyhow::anyhow!("Found non UTF-8 characters in filename"))?;

        if !file_name.ends_with(".conf") {
            continue;
        }

        let mut file = entry
            .open()
            .with_context(|| format!("Failed to open {:?}", file_name))?;

        let mut contents = String::new();
        file.read_to_string(&mut contents)
            .with_context(|| format!("Failed to read {:?}", file_name))?;

        let config = parse_bls_config(&contents).context("Parsing bls config")?;

        configs_with_filenames.push(ConfigWithFilename {
            config,
            filename: file_name.to_string(),
        });
    }

    // Sort based on bootloader type
    configs_with_filenames.sort_by(|a, b| {
        let ord = match bootloader {
            // For systemd-boot sort by sort-key
            Bootloader::Systemd => a.config.cmp(&b.config),
            // For grub and grub-cc, sort by filename in descending order
            // See: https://github.com/bootc-dev/bootc/issues/2221
            Bootloader::Grub | Bootloader::GrubCC => b.filename.cmp(&a.filename),
            Bootloader::Ukiboot | Bootloader::None => {
                unreachable!("Bootloader checked during installation does not use BLS entries")
            }
        };

        if ascending { ord } else { ord.reverse() }
    });

    Ok(configs_with_filenames
        .into_iter()
        .map(|c| c.config)
        .collect())
}

pub(crate) fn list_type1_entries(boot_dir: &Dir) -> Result<Vec<BootloaderEntry>> {
    // Type1 Entry
    let boot_entries = get_sorted_type1_boot_entries(boot_dir, true)?;

    // We wouldn't want to delete the staged deployment if the GC runs when a
    // deployment is staged
    let staged_boot_entries = get_sorted_staged_type1_boot_entries(boot_dir, true)?;

    boot_entries
        .into_iter()
        .chain(staged_boot_entries)
        .map(|entry| {
            Ok(BootloaderEntry {
                fsverity: entry.get_verity()?,
                boot_artifact_name: entry.boot_artifact_name()?.to_string(),
            })
        })
        .collect::<Result<Vec<_>, _>>()
}

/// Get all Type1/Type2 bootloader entries
///
/// # Returns
/// The fsverity of EROFS images corresponding to boot entries
#[fn_error_context::context("Listing bootloader entries")]
pub(crate) fn list_bootloader_entries(storage: &Storage) -> Result<Vec<BootloaderEntry>> {
    let bootloader = get_bootloader()?;
    let boot_dir = storage.require_boot_dir()?;

    let entries = match bootloader.kind()? {
        BootloaderKind::GRUBClassic => {
            // Grub entries are always in boot
            let grub_dir = boot_dir.open_dir("grub2").context("Opening grub dir")?;

            // Grub UKI
            if grub_dir.exists(USER_CFG) {
                let mut s = String::new();
                let boot_entries = get_sorted_grub_uki_boot_entries(boot_dir, &mut s)?;

                let mut staged = String::new();
                let boot_entries_staged =
                    get_sorted_grub_uki_boot_entries_staged(boot_dir, &mut staged)?;

                boot_entries
                    .into_iter()
                    .chain(boot_entries_staged)
                    .map(|entry| {
                        Ok(BootloaderEntry {
                            fsverity: entry.get_verity()?,
                            boot_artifact_name: entry.boot_artifact_name()?,
                        })
                    })
                    .collect::<Result<Vec<_>, anyhow::Error>>()?
            } else {
                list_type1_entries(boot_dir)?
            }
        }

        BootloaderKind::BLSCompatible => list_type1_entries(boot_dir)?,
    };

    Ok(entries)
}

/// imgref = transport:image_name
///
/// Returns the image manifest and config, along with the digest of the
/// manifest as the registry reported it.
#[context("Getting container info")]
pub(crate) async fn get_container_manifest_and_config(
    imgref: &ImageReference,
) -> Result<(ImgConfigManifest, String)> {
    let mut config = crate::deploy::new_proxy_config();

    ostree_ext::container::merge_default_container_proxy_opts(&mut config)?;

    let proxy = ImageProxy::new_with_config(config).await?;

    let img = proxy
        .open_image_ref(&imgref)
        .await
        .with_context(|| format!("Opening image {imgref}"))?;

    let (manifest_digest, manifest) = proxy.fetch_manifest(&img).await?;
    let (mut reader, driver) = proxy.get_descriptor(&img, manifest.config()).await?;

    let mut buf = Vec::with_capacity(manifest.config().size() as usize);
    buf.resize(manifest.config().size() as usize, 0);
    reader.read_exact(&mut buf).await?;
    driver.await?;

    let config: oci_spec::image::ImageConfiguration = serde_json::from_slice(&buf)?;

    Ok((ImgConfigManifest { manifest, config }, manifest_digest))
}

/// Directory where BLS-compatible bootloaders expect Type 1 boot entries.
///
/// Its presence says nothing about the bootloader on its own: EFI systems
/// have it too, and GRUB reads the same entries via `blscfg`. It is only
/// consulted when there are no EFI variables to inspect, and then only
/// together with [`GRUB_DIRS`] to tell a BLS-native bootloader apart from
/// GRUB (see [`classify_bootloader`]).
const BLS_ENTRIES_DIR: &str = "/boot/loader/entries";

/// Directories where GRUB keeps its own configuration and modules. Their
/// presence means GRUB owns the boot flow even if BLS Type 1 entries also
/// exist, because GRUB can consume those entries itself via the `blscfg`
/// module — Fedora and RHEL enable exactly that with
/// `GRUB_ENABLE_BLSCFG=true`. `/boot/grub2` is the Fedora/RHEL path,
/// `/boot/grub` the Debian/Ubuntu one.
const GRUB_DIRS: [&str; 2] = ["/boot/grub2", "/boot/grub"];

/// Pure classifier for the bootloader kind, split from I/O for testability.
///
/// - When `EFI_LOADER_INFO` is present, its content selects between systemd-
///   boot, GRUB Confidential Compute, and generic GRUB (existing behavior).
/// - When there are no EFI variables to inspect (`SystemNotUEFI` /
///   `MissingVar`), fall back to a filesystem probe: many non-EFI systems
///   still lay down the BLS Type 1 entry layout at `/boot/loader/entries/`
///   (Raspberry Pi with direct-kernel boot from Pi firmware, U-Boot with
///   the extlinux/BLS loader, coreboot with a linux payload, various
///   ARM/embedded boards). Treat those as BLS-compatible so `storage::new`
///   picks the ESP mount as `boot_dir` rather than `/sysroot/boot/`. Only
///   fall back to GRUB when neither an EFI system nor a BLS layout is
///   present.
///
///   A BLS entries directory alone is not sufficient evidence, because GRUB
///   with `blscfg` reads the same directory. So GRUB's own directory wins
///   when both are present: a legacy-BIOS Fedora/RHEL install has
///   `/boot/grub2/` *and* `/boot/loader/entries/`, and is unambiguously
///   GRUB. Only a BLS layout with no GRUB directory implies a BLS-native
///   bootloader.
/// - Other EFI read errors propagate.
fn classify_bootloader(
    efi_loader_info: Result<String, EfiError>,
    bls_entries_dir_present: bool,
    grub_dir_present: bool,
) -> Result<Bootloader> {
    match efi_loader_info {
        Ok(loader) => {
            let loader = loader.to_lowercase();
            if loader.contains("systemd-boot") {
                Ok(Bootloader::Systemd)
            } else if loader.contains("grub cc") {
                Ok(Bootloader::GrubCC)
            } else {
                Ok(Bootloader::Grub)
            }
        }
        Err(EfiError::SystemNotUEFI) | Err(EfiError::MissingVar) => {
            if grub_dir_present {
                tracing::debug!(
                    "No EFI vars and a GRUB directory is present; treating \
                     bootloader as GRUB even if BLS entries also exist \
                     (GRUB reads them via blscfg)"
                );
                Ok(Bootloader::Grub)
            } else if bls_entries_dir_present {
                tracing::debug!(
                    "No EFI vars, no GRUB directory, and {BLS_ENTRIES_DIR} is \
                     a directory; treating bootloader as BLS-compatible \
                     (systemd-boot)"
                );
                Ok(Bootloader::Systemd)
            } else {
                Ok(Bootloader::Grub)
            }
        }
        Err(e) => anyhow::bail!("Failed to read EfiLoaderInfo: {e:?}"),
    }
}

#[context("Getting bootloader")]
pub(crate) fn get_bootloader() -> Result<Bootloader> {
    static BOOTLOADER: OnceLock<Bootloader> = OnceLock::new();

    if let Some(bootloader) = BOOTLOADER.get() {
        return Ok(*bootloader);
    }

    let efi_result = read_uefi_var(EFI_LOADER_INFO);
    let non_efi = matches!(
        &efi_result,
        Err(EfiError::SystemNotUEFI) | Err(EfiError::MissingVar),
    );

    let bootloader = classify_bootloader(
        efi_result,
        // The FS probes are only consulted in the non-EFI classification
        // branch; skip the `stat(2)`s on EFI systems.
        non_efi && std::path::Path::new(BLS_ENTRIES_DIR).is_dir(),
        non_efi && GRUB_DIRS.iter().any(|d| std::path::Path::new(d).is_dir()),
    )?;

    // The bootloader cannot change over the lifetime of a single bootc
    // invocation, so cache unconditionally.
    BOOTLOADER.get_or_init(|| bootloader);

    Ok(bootloader)
}

/// Retrieves the OCI manifest and config for a deployment from the composefs repository.
///
/// The manifest digest is read from the deployment's `.origin` file,
/// then `OciImage::open()` retrieves manifest+config from the composefs repo
/// where composefs-rs stores them as splitstreams during pull.
///
/// Falls back to reading legacy `.imginfo` files for backwards compatibility
/// with deployments created before the manifest digest was stored in `.origin`.
#[context("Reading image info for deployment {deployment_id}")]
pub(crate) fn get_imginfo(
    storage: &Storage,
    deployment_id: &str,
) -> Result<(ImgConfigManifest, String)> {
    let ini = read_origin(&storage.physical_root, deployment_id)?
        .ok_or_else(|| anyhow::anyhow!("No origin file for deployment {deployment_id}"))?;

    // Try to read the manifest digest from the origin file (new path)
    if let Some(manifest_digest_str) =
        ini.get::<String>(ORIGIN_KEY_IMAGE, ORIGIN_KEY_MANIFEST_DIGEST)
    {
        let repo = storage.get_ensure_composefs()?;
        let manifest_digest: composefs_oci::OciDigest = manifest_digest_str
            .parse()
            .with_context(|| format!("Parsing manifest digest {manifest_digest_str}"))?;
        let oci_image = OciImage::<Sha512HashValue>::open(&repo, &manifest_digest, None)
            .with_context(|| format!("Opening OCI image for manifest {manifest_digest}"))?;

        let manifest = oci_image.manifest().clone();
        let config = oci_image
            .config()
            .cloned()
            .ok_or_else(|| anyhow::anyhow!("OCI image has no config (artifact?)"))?;

        return Ok((ImgConfigManifest { config, manifest }, manifest_digest_str));
    }

    // Fallback: read legacy .imginfo file for deployments created before
    // the manifest digest was stored in .origin
    let depl_state_path = std::path::PathBuf::from(STATE_DIR_RELATIVE).join(deployment_id);
    let imginfo_fname = format!("{deployment_id}.imginfo");
    let path = depl_state_path.join(&imginfo_fname);

    let mut img_conf = storage
        .physical_root
        .open_optional(&path)
        .with_context(|| format!("Opening legacy {imginfo_fname}"))?;

    let Some(img_conf) = &mut img_conf else {
        anyhow::bail!(
            "No manifest_digest in origin and no legacy .imginfo file \
             for deployment {deployment_id}"
        );
    };

    let mut buffer = String::new();
    img_conf.read_to_string(&mut buffer)?;

    let img_conf = serde_json::from_str::<ImgConfigManifest>(&buffer)
        .context("Failed to parse .imginfo file as JSON")?;

    // Compute the manifest digest
    let mut hasher = Sha256::new();
    hasher.update(&serde_json::to_vec(&img_conf.manifest).context("Serializing image manifest")?);
    let manifest_digest_str = hex::encode(hasher.finish());
    Ok((img_conf, manifest_digest_str))
}

/// Version and created timestamp for a composefs deployment image.
///
/// The version prefers the manifest annotation. When that annotation is
/// absent, configuration labels are used (the OCI version label, then the
/// legacy `version` label), matching ostree status. The timestamp is parsed
/// from `config.created()`; an invalid value yields no timestamp.
fn image_version_and_created(
    manifest: &ImageManifest,
    config: &ImageConfiguration,
) -> (Option<String>, Option<chrono::DateTime<chrono::Utc>>) {
    let version = manifest
        .annotations()
        .as_ref()
        .and_then(|a| a.get(oci_spec::image::ANNOTATION_VERSION).cloned())
        .or_else(|| ostree_container::version_for_config(config).map(ToOwned::to_owned));

    let created_at = config.created().clone();
    let timestamp = created_at.and_then(|x| try_deserialize_timestamp(&x));
    (version, timestamp)
}

#[context("Getting composefs deployment metadata")]
fn boot_entry_from_composefs_deployment(
    storage: &Storage,
    origin: tini::Ini,
    verity: &str,
    missing_verity_allowed: bool,
    bootloader: Bootloader,
) -> Result<BootEntry> {
    let image = match origin.get::<String>("origin", ORIGIN_CONTAINER) {
        Some(img_name_from_config) => {
            let ostree_img_ref = OstreeImageReference::from_str(&img_name_from_config)?;
            let img_ref = crate::spec::ImageReference::from(ostree_img_ref);

            let (img_conf, image_digest) = get_imginfo(storage, &verity)?;

            let architecture = img_conf.config.architecture().to_string();
            let (version, timestamp) =
                image_version_and_created(&img_conf.manifest, &img_conf.config);

            Some(ImageStatus {
                image: img_ref,
                version,
                timestamp,
                image_digest,
                architecture,
            })
        }

        // Wasn't booted using a container image. Do nothing
        None => None,
    };

    let boot_type = match origin.get::<String>(ORIGIN_KEY_BOOT, ORIGIN_KEY_BOOT_TYPE) {
        Some(s) => BootType::try_from(s.as_str())?,
        None => anyhow::bail!("{ORIGIN_KEY_BOOT} not found"),
    };

    let boot_digest = origin.get::<String>(ORIGIN_KEY_BOOT, ORIGIN_KEY_BOOT_DIGEST);

    let e = BootEntry {
        image,
        cached_update: None,
        incompatible: false,
        pinned: false,
        download_only: false, // Set later on
        store: None,
        ostree: None,
        composefs: Some(crate::spec::BootEntryComposefs {
            verity: verity.into(),
            boot_type,
            bootloader,
            boot_digest,
            missing_verity_allowed,
        }),
        soft_reboot_capable: false,
    };

    Ok(e)
}

/// Get composefs status using provided storage and booted composefs data
/// instead of scraping global state.
#[context("Getting composefs deployment status")]
pub(crate) async fn get_composefs_status(
    storage: &crate::store::Storage,
    booted_cfs: &crate::store::BootedComposefs,
) -> Result<Host> {
    composefs_deployment_status_from(&storage, booted_cfs.cmdline).await
}

/// Check whether any deployment is capable of being soft rebooted or not
#[context("Checking soft reboot capability")]
fn set_soft_reboot_capability(
    storage: &Storage,
    host: &mut Host,
    bls_entries: Option<Vec<BLSConfig>>,
    booted_cmdline: &ComposefsCmdline,
) -> Result<()> {
    let booted = host.require_composefs_booted()?;

    match booted.boot_type {
        BootType::Bls => {
            let mut bls_entries =
                bls_entries.ok_or_else(|| anyhow::anyhow!("BLS entries not provided"))?;

            let staged_entries =
                get_sorted_staged_type1_boot_entries(storage.require_boot_dir()?, false)?;

            // We will have a duplicate booted entry here, but that's fine as we only use this
            // vector to check for existence of an entry
            bls_entries.extend(staged_entries);

            set_reboot_capable_type1_deployments(storage, booted_cmdline, host, bls_entries)
        }

        BootType::Uki => set_reboot_capable_uki_deployments(storage, booted_cmdline, host),
        BootType::Aboot => Ok(()),
    }
}

fn find_bls_entry<'a>(
    verity: &str,
    bls_entries: &'a Vec<BLSConfig>,
) -> Result<Option<&'a BLSConfig>> {
    for ent in bls_entries {
        if ent.get_verity()? == *verity {
            return Ok(Some(ent));
        }
    }

    Ok(None)
}

/// Compares cmdline `first` and `second` skipping either composefs karg spelling.
fn compare_cmdline_skip_cfs(first: &Cmdline<'_>, second: &Cmdline<'_>) -> bool {
    for param in first {
        if param.key() == KARG_V2.into() || param.key() == KARG_COMPOSEFS_DIGEST.into() {
            continue;
        }

        let second_param = second.iter().find(|b| *b == param);

        let Some(found_param) = second_param else {
            return false;
        };

        if found_param.value() != param.value() {
            return false;
        }
    }

    return true;
}

#[context("Setting soft reboot capability for Type1 entries")]
fn set_reboot_capable_type1_deployments(
    storage: &Storage,
    booted_cmdline: &ComposefsCmdline,
    host: &mut Host,
    bls_entries: Vec<BLSConfig>,
) -> Result<()> {
    let booted = host
        .status
        .booted
        .as_ref()
        .ok_or_else(|| anyhow::anyhow!("Failed to find booted entry"))?;

    let booted_boot_digest = booted.composefs_boot_digest()?;

    let booted_bls_entry = find_bls_entry(&*booted_cmdline.digest, &bls_entries)?
        .ok_or_else(|| anyhow::anyhow!("Booted BLS entry not found"))?;

    let booted_full_cmdline = booted_bls_entry.get_cmdline()?;

    let booted_info = DeploymentBootInfo {
        boot_digest: booted_boot_digest,
        full_cmdline: booted_full_cmdline,
        verity: &booted_cmdline.digest,
    };

    for depl in host
        .status
        .staged
        .iter_mut()
        .chain(host.status.rollback.iter_mut())
        .chain(host.status.other_deployments.iter_mut())
    {
        let depl_verity = &depl.require_composefs()?.verity;

        let entry = find_bls_entry(&depl_verity, &bls_entries)?
            .ok_or_else(|| anyhow::anyhow!("Entry not found"))?;

        let depl_cmdline = entry.get_cmdline()?;

        let target_info = DeploymentBootInfo {
            boot_digest: depl.composefs_boot_digest()?,
            full_cmdline: depl_cmdline,
            verity: &depl_verity,
        };

        depl.soft_reboot_capable =
            is_soft_rebootable(storage, booted_cmdline, &booted_info, &target_info)?;
    }

    Ok(())
}

/// Determines whether a soft reboot can be performed between the currently booted
/// deployment and a target deployment.
///
/// # Arguments
///
/// * `storage`      - The bootc storage backend
/// * `booted_cmdline` - The composefs command line parameters of the currently booted deployment
/// * `booted`       - Boot information for the currently booted deployment
/// * `target`       - Boot information for the target deployment
fn is_soft_rebootable(
    storage: &Storage,
    booted_cmdline: &ComposefsCmdline,
    booted: &DeploymentBootInfo,
    target: &DeploymentBootInfo,
) -> Result<bool> {
    if target.boot_digest != booted.boot_digest {
        tracing::debug!("Soft reboot not allowed due to kernel skew");
        return Ok(false);
    }

    if target.full_cmdline.as_bytes().len() != booted.full_cmdline.as_bytes().len() {
        tracing::debug!("Soft reboot not allowed due to differing cmdline");
        return Ok(false);
    }

    let cmdline_eq = compare_cmdline_skip_cfs(target.full_cmdline, booted.full_cmdline)
        && compare_cmdline_skip_cfs(booted.full_cmdline, target.full_cmdline);

    let selinux_compatible =
        are_selinux_policies_compatible(storage, booted_cmdline, target.verity)?;

    return Ok(cmdline_eq && selinux_compatible);
}

#[context("Setting soft reboot capability for UKI deployments")]
fn set_reboot_capable_uki_deployments(
    storage: &Storage,
    booted_cmdline: &ComposefsCmdline,
    host: &mut Host,
) -> Result<()> {
    let booted = host
        .status
        .booted
        .as_ref()
        .ok_or_else(|| anyhow::anyhow!("Failed to find booted entry"))?;

    // Since older booted systems won't have the boot digest for UKIs
    let booted_boot_digest = match booted.composefs_boot_digest() {
        Ok(d) => d,
        Err(_) => &compute_store_boot_digest_for_uki(storage, &booted_cmdline.digest)?,
    };

    let booted_full_cmdline = get_uki_cmdline(storage, &booted_cmdline.digest)?;

    let booted_info = DeploymentBootInfo {
        boot_digest: booted_boot_digest,
        full_cmdline: &booted_full_cmdline,
        verity: &booted_cmdline.digest,
    };

    for deployment in host
        .status
        .staged
        .iter_mut()
        .chain(host.status.rollback.iter_mut())
        .chain(host.status.other_deployments.iter_mut())
    {
        let depl_verity = &deployment.require_composefs()?.verity;

        // Since older booted systems won't have the boot digest for UKIs
        let depl_boot_digest = match deployment.composefs_boot_digest() {
            Ok(d) => d,
            Err(_) => &compute_store_boot_digest_for_uki(storage, depl_verity)?,
        };

        let depl_cmdline = get_uki_cmdline(storage, &deployment.require_composefs()?.verity)?;

        let target_info = DeploymentBootInfo {
            boot_digest: depl_boot_digest,
            full_cmdline: &depl_cmdline,
            verity: depl_verity,
        };

        deployment.soft_reboot_capable =
            is_soft_rebootable(storage, booted_cmdline, &booted_info, &target_info)?;
    }

    Ok(())
}

/// Whether the bootloader will boot a deployment other than the booted one,
/// i.e. whether the first (default) boot entry references some other deployment.
#[context("Determining if rollback is queued")]
fn rollback_queued_from_first_entry(
    bls_config: &BLSConfig,
    booted_composefs_digest: &str,
) -> Result<bool> {
    match &bls_config.cfg_type {
        // For UKI boot
        BLSConfigType::EFI { key } => {
            let path = match key {
                EFIKey::Efi(path) | EFIKey::Uki(path) => path,
            };
            Ok(!path.as_str().contains(booted_composefs_digest))
        }

        // For boot entry Type1
        BLSConfigType::NonEFI { options, .. } => Ok(!options
            .as_ref()
            .ok_or_else(|| anyhow::anyhow!("options key not found in bls config"))?
            .contains(booted_composefs_digest)),

        BLSConfigType::Unknown => anyhow::bail!("Unknown BLS Config Type"),
    }
}

fn read_staged_deployment() -> Result<Option<StagedDeployment>> {
    let path = format!("{COMPOSEFS_TRANSIENT_STATE_DIR}/{COMPOSEFS_STAGED_DEPLOYMENT_FNAME}");
    let contents = match std::fs::read_to_string(&path) {
        Ok(contents) => contents,
        Err(err) if err.kind() == std::io::ErrorKind::NotFound => return Ok(None),
        Err(err) => return Err(err).with_context(|| format!("Reading {path}")),
    };
    serde_json::from_str(&contents)
        .with_context(|| format!("Parsing {path}"))
        .map(Some)
}

fn aboot_entry(
    storage: &Storage,
    verity: &str,
    missing_verity_allowed: bool,
    bootloader: Bootloader,
) -> Result<BootEntry> {
    let origin = read_origin(&storage.physical_root, verity)?
        .ok_or_else(|| anyhow::anyhow!("No origin file for aboot deployment {verity}"))?;
    let entry = boot_entry_from_composefs_deployment(
        storage,
        origin,
        verity,
        missing_verity_allowed,
        bootloader,
    )?;
    ensure!(
        entry.require_composefs()?.boot_type == BootType::Aboot,
        "Slot references non-aboot deployment {verity}"
    );
    Ok(entry)
}

fn composefs_aboot_status(
    storage: &Storage,
    cmdline: &ComposefsCmdline,
    bootloader: Bootloader,
) -> Result<Host> {
    let state = aboot::AbootState::open(&storage.physical_root)?;
    let staged = match state.read_pending()? {
        Some(pending) => Some(pending.staged()),
        None => read_staged_deployment()?,
    };
    composefs_aboot_status_from(storage, &state, cmdline, staged.as_ref(), bootloader)
}

fn composefs_aboot_status_from(
    storage: &Storage,
    state: &aboot::AbootState<'_>,
    cmdline: &ComposefsCmdline,
    staged: Option<&StagedDeployment>,
    bootloader: Bootloader,
) -> Result<Host> {
    let mut host = Host::new(HostSpec {
        image: None,
        boot_order: BootOrder::Default,
    });

    host.status.booted = Some(aboot_entry(
        storage,
        &cmdline.digest,
        cmdline.allow_missing_fsverity,
        bootloader,
    )?);

    if let Some(staged) = staged.filter(|s| s.depl_id != *cmdline.digest) {
        let mut entry = aboot_entry(
            storage,
            &staged.depl_id,
            cmdline.allow_missing_fsverity,
            bootloader,
        )?;
        entry.download_only = staged.finalization_locked;
        host.status.staged = Some(entry);
    }

    let mut seen = vec![cmdline.digest.to_string()];
    if let Some(staged) = host.status.staged.as_ref() {
        seen.push(staged.require_composefs()?.verity.clone());
    }
    for deployment in state.slot_deployments()? {
        let verity = deployment.to_hex();
        if seen.contains(&verity) {
            continue;
        }
        seen.push(verity.clone());
        let entry = aboot_entry(storage, &verity, cmdline.allow_missing_fsverity, bootloader)?;
        if host.status.rollback.is_none() {
            host.status.rollback = Some(entry);
        } else {
            host.status.other_deployments.push(entry);
        }
    }

    if let Some(queued) = state.queued_rollback()? {
        let rollback =
            host.status.rollback.as_ref().ok_or_else(|| {
                anyhow::anyhow!("Queued aboot rollback deployment is unavailable")
            })?;
        ensure!(
            rollback.require_composefs()?.verity == queued,
            "Queued aboot rollback does not match the rollback deployment"
        );
        host.status.rollback_queued = true;
        host.spec.boot_order = BootOrder::Rollback;
    }

    host.spec.image = host
        .status
        .staged
        .as_ref()
        .or(host.status.booted.as_ref())
        .and_then(|entry| entry.image.as_ref())
        .map(|image| image.image.clone());
    host.status.usr_overlay = get_usr_overlay_status().ok().flatten();
    Ok(host)
}

#[context("Getting composefs deployment status")]
async fn composefs_deployment_status_from(
    storage: &Storage,
    cmdline: &ComposefsCmdline,
) -> Result<Host> {
    let booted_composefs_digest = &cmdline.digest;

    if read_boot_type(&storage.physical_root, booted_composefs_digest)? == Some(BootType::Aboot) {
        return composefs_aboot_status(storage, cmdline, aboot::get_bootloader()?);
    }

    let boot_dir = storage.require_boot_dir()?;

    // This is our source of truth
    let bootloader_entry_verity = list_bootloader_entries(storage)?;

    let host_spec = HostSpec {
        image: None,
        boot_order: BootOrder::Default,
    };

    let mut host = Host::new(host_spec);

    let staged_deployment = read_staged_deployment()?;

    let mut boot_type: Option<BootType> = None;
    let bootloader = get_bootloader()?;

    // Boot entries from deployments that are neither booted nor staged deployments
    // Rollback deployment is in here, but may also contain stale deployment entries
    let mut extra_deployment_boot_entries: Vec<BootEntry> = Vec::new();

    for BootloaderEntry {
        fsverity: verity_digest,
        ..
    } in bootloader_entry_verity
    {
        let ini = read_origin(&storage.physical_root, &verity_digest)?;

        let Some(ini) = ini else {
            const STATUS_JOURNAL_ID: &str = "d264f924dadb4c31bff0412107d391fb";

            tracing::warn!(
                message_id = STATUS_JOURNAL_ID,
                bootc.operation = "status",
                "No origin file for deployment {verity_digest}"
            );

            continue;
        };

        let mut boot_entry = boot_entry_from_composefs_deployment(
            storage,
            ini,
            &verity_digest,
            cmdline.allow_missing_fsverity,
            bootloader,
        )?;

        // SAFETY: boot_entry.composefs will always be present
        let boot_type_from_origin = boot_entry.composefs.as_ref().unwrap().boot_type;

        match boot_type {
            Some(current_type) => {
                if current_type != boot_type_from_origin {
                    anyhow::bail!("Conflicting boot types")
                }
            }

            None => {
                boot_type = Some(boot_type_from_origin);
            }
        };

        if verity_digest == booted_composefs_digest.as_ref() {
            host.status.booted = Some(boot_entry);
            continue;
        }

        if let Some(staged_deployment) = &staged_deployment {
            if verity_digest == staged_deployment.depl_id {
                boot_entry.download_only = staged_deployment.finalization_locked;
                host.status.staged = Some(boot_entry);
                continue;
            }
        }

        extra_deployment_boot_entries.push(boot_entry);
    }

    // see similar logic in the ostree-version of this
    host.spec.image = host
        .status
        .staged
        .as_ref()
        .or(host.status.booted.as_ref())
        .and_then(|entry| entry.image.as_ref())
        .map(|img| img.image.clone());

    // Shouldn't really happen, but for sanity nonetheless
    let Some(boot_type) = boot_type else {
        anyhow::bail!("Could not determine boot type");
    };

    let booted_cfs = host.require_composefs_booted()?;

    let mut grub_menu_string = String::new();
    let (is_rollback_queued, sorted_bls_config, grub_menu_entries) =
        match booted_cfs.bootloader.kind()? {
            BootloaderKind::GRUBClassic => match boot_type {
                BootType::Bls => {
                    let bls_configs = get_sorted_type1_boot_entries(boot_dir, true)?;
                    let bls_config = bls_configs
                        .first()
                        .ok_or_else(|| anyhow::anyhow!("First boot entry not found"))?;

                    match &bls_config.cfg_type {
                        BLSConfigType::NonEFI { .. } => {
                            let is_rollback_queued = rollback_queued_from_first_entry(
                                bls_config,
                                booted_composefs_digest.as_ref(),
                            )?;

                            (is_rollback_queued, Some(bls_configs), None)
                        }

                        BLSConfigType::EFI { .. } => {
                            anyhow::bail!("Found 'efi' field in Type1 boot entry")
                        }

                        BLSConfigType::Unknown => anyhow::bail!("Unknown BLS Config Type"),
                    }
                }

                BootType::Uki => {
                    let menuentries =
                        get_sorted_grub_uki_boot_entries(boot_dir, &mut grub_menu_string)?;

                    let is_rollback_queued = !menuentries
                        .first()
                        .ok_or(anyhow::anyhow!("First boot entry not found"))?
                        .body
                        .chainloader
                        .contains(booted_composefs_digest.as_ref());

                    (is_rollback_queued, None, Some(menuentries))
                }
                BootType::Aboot => {
                    anyhow::bail!("Aboot deployment unexpectedly reached GRUB status handling")
                }
            },

            // We will have BLS stuff and the UKI stuff in the same DIR
            BootloaderKind::BLSCompatible => {
                let bls_configs = get_sorted_type1_boot_entries(boot_dir, true)?;
                let bls_config = bls_configs
                    .first()
                    .ok_or(anyhow::anyhow!("First boot entry not found"))?;

                let is_rollback_queued =
                    rollback_queued_from_first_entry(bls_config, booted_composefs_digest.as_ref())?;

                (is_rollback_queued, Some(bls_configs), None)
            }
        };

    // Determine rollback deployment by matching extra deployment boot entries against entries read from /boot
    // This collects verity digest across bls and grub entries, we should just have one of them, but still works
    //
    // We want this ordered, so we have a vector here
    let bootloader_configured_verity = sorted_bls_config
        .iter()
        .flatten()
        .map(|cfg| cfg.get_verity())
        .chain(
            grub_menu_entries
                .iter()
                .flatten()
                .map(|menu| menu.get_verity()),
        )
        .collect::<Result<Vec<_>>>()?;

    let mut rollback_candidates: Vec<_> = extra_deployment_boot_entries
        .into_iter()
        .filter(|entry| {
            let verity = &entry
                .composefs
                .as_ref()
                .expect("composefs is always Some for composefs deployments")
                .verity;
            bootloader_configured_verity.contains(verity)
        })
        .collect();

    // We get sorted bootloader entries, so here we re-sort the rollback candidates
    // wrt their positions in the sorted bootloader entries as that's what determines
    // what's shown on the bootloader menu. The very next boot entry, that's not the
    // default should be the rollback
    rollback_candidates.sort_by_key(|ent| {
        bootloader_configured_verity
            .iter()
            // SAFETY: ent.composefs will definitely exist
            .position(|v| ent.composefs.as_ref().unwrap().verity == *v)
    });

    if !rollback_candidates.is_empty() {
        let mut iter = rollback_candidates.into_iter();

        host.status.rollback = iter.next();
        host.status.other_deployments = iter.collect();
    }

    host.status.rollback_queued = is_rollback_queued;

    if host.status.rollback_queued {
        host.spec.boot_order = BootOrder::Rollback
    };

    host.status.usr_overlay = get_usr_overlay_status().ok().flatten();

    set_soft_reboot_capability(storage, &mut host, sorted_bls_config, cmdline)?;

    Ok(host)
}

#[cfg(test)]
mod tests {
    use cap_std_ext::{cap_std, dirext::CapStdExtDirExt};

    use crate::bootc_composefs::aboot;
    use crate::bootc_composefs::boot::{
        FILENAME_PRIORITY_PRIMARY, FILENAME_PRIORITY_SECONDARY, primary_sort_key,
        secondary_sort_key, type1_entry_conf_file_name,
    };
    use crate::composefs_consts::{ABOOT_STATE_DIR, STATE_DIR_RELATIVE};
    use crate::parsers::grub_menuconfig::MenuentryBody;

    use super::*;

    fn write_aboot_origin(root: &Dir, digest: &str) -> Result<()> {
        let path = format!("{STATE_DIR_RELATIVE}/{digest}");
        root.create_dir_all(&path)?;
        root.atomic_write(
            format!("{path}/{digest}.origin"),
            "[boot]\nboot_type=aboot\ndigest=boot-digest\n",
        )?;
        Ok(())
    }

    #[test]
    fn aboot_status_uses_host_bootloader() -> Result<()> {
        let root = cap_std_ext::cap_tempfile::tempdir(cap_std::ambient_authority())?;
        root.create_dir("run")?;
        let run = root.open_dir("run")?;
        let storage = Storage::new_composefs_for_test(&root, &run)?;
        let a = "aa".repeat(64);
        let b = "bb".repeat(64);
        let staged_id = "cc".repeat(64);
        for digest in [&a, &b, &staged_id] {
            write_aboot_origin(&root, digest)?;
        }
        let mut state = aboot::AbootState::open(&root)?;
        state.record_booted(&Cmdline::from("androidboot.slot_suffix=_a"), &a)?;
        state.record_booted(&Cmdline::from("androidboot.slot_suffix=_b"), &b)?;
        let cmdline = ComposefsCmdline::new(&a);
        let staged = StagedDeployment {
            depl_id: staged_id,
            finalization_locked: false,
        };
        for bootloader in [Bootloader::None, Bootloader::Ukiboot] {
            let host =
                composefs_aboot_status_from(&storage, &state, &cmdline, Some(&staged), bootloader)?;
            assert_eq!(host.list_deployments().len(), 3);
            for entry in host.list_deployments() {
                assert_eq!(entry.require_composefs()?.bootloader, bootloader);
            }
        }
        Ok(())
    }

    #[test]
    fn aboot_status_from_slots() -> Result<()> {
        let root = cap_std_ext::cap_tempfile::tempdir(cap_std::ambient_authority())?;
        root.create_dir("run")?;
        let run = root.open_dir("run")?;
        let storage = Storage::new_composefs_for_test(&root, &run)?;
        let a = "aa".repeat(64);
        let b = "bb".repeat(64);
        let staged_id = "cc".repeat(64);
        for digest in [&a, &b, &staged_id] {
            write_aboot_origin(&root, digest)?;
        }
        let mut aboot_state = aboot::AbootState::open(&root)?;
        aboot_state.record_booted(&Cmdline::from("androidboot.slot_suffix=_a"), &a)?;
        aboot_state.record_booted(&Cmdline::from("androidboot.slot_suffix=_b"), &b)?;

        let cmdline = ComposefsCmdline::new(&a);
        let host =
            composefs_aboot_status_from(&storage, &aboot_state, &cmdline, None, Bootloader::None)?;
        let booted = host.require_composefs_booted()?;
        assert_eq!(booted.verity, a);
        assert_eq!(booted.boot_type, BootType::Aboot);
        assert_eq!(booted.bootloader, Bootloader::None);
        assert_eq!(
            host.status
                .rollback
                .as_ref()
                .unwrap()
                .require_composefs()?
                .verity,
            b
        );
        assert!(host.status.staged.is_none());
        assert!(host.status.other_deployments.is_empty());
        assert!(!host.status.rollback_queued);

        aboot_state.queue_rollback(&b)?;
        let host =
            composefs_aboot_status_from(&storage, &aboot_state, &cmdline, None, Bootloader::None)?;
        assert!(host.status.rollback_queued);
        assert_eq!(host.spec.boot_order, BootOrder::Rollback);
        aboot_state.clear_rollback()?;

        let staged = StagedDeployment {
            depl_id: staged_id.clone(),
            finalization_locked: true,
        };
        let host = composefs_aboot_status_from(
            &storage,
            &aboot_state,
            &cmdline,
            Some(&staged),
            Bootloader::None,
        )?;
        let staged_entry = host.status.staged.as_ref().unwrap();
        assert_eq!(staged_entry.require_composefs()?.verity, staged_id);
        assert!(staged_entry.download_only);
        assert_eq!(
            host.status
                .rollback
                .as_ref()
                .unwrap()
                .require_composefs()?
                .verity,
            b
        );

        let staged = StagedDeployment {
            depl_id: b.clone(),
            finalization_locked: false,
        };
        let host = composefs_aboot_status_from(
            &storage,
            &aboot_state,
            &cmdline,
            Some(&staged),
            Bootloader::None,
        )?;
        assert_eq!(
            host.status
                .staged
                .as_ref()
                .unwrap()
                .require_composefs()?
                .verity,
            b
        );
        assert!(host.status.rollback.is_none());

        root.atomic_write(format!("{ABOOT_STATE_DIR}/slots/b"), "invalid")?;
        let host =
            composefs_aboot_status_from(&storage, &aboot_state, &cmdline, None, Bootloader::None)?;
        assert!(host.status.rollback.is_none());
        assert_eq!(host.list_deployments().len(), 1);

        let pending = aboot_state.stage_artifacts(&staged_id, true, b"boot", None)?;
        aboot_state.write_pending(&pending)?;
        let host = composefs_aboot_status(&storage, &cmdline, Bootloader::None)?;
        assert!(host.status.staged.as_ref().unwrap().download_only);
        Ok(())
    }

    #[test]
    fn test_image_version_and_created() {
        use std::collections::HashMap;
        use std::str::FromStr;

        use ostree_ext::container::{LABEL_OCI_VERSION, LABEL_VERSION};
        use ostree_ext::oci_spec::image::{
            ANNOTATION_CREATED, ANNOTATION_VERSION, ConfigBuilder, Descriptor, Digest,
            ImageConfigurationBuilder, ImageManifestBuilder, MediaType, SCHEMA_VERSION,
        };

        const CREATED: &str = "2024-06-01T12:00:00Z";
        const ANNOTATION_CREATED_DECOY: &str = "1999-01-01T00:00:00Z";
        const LABEL_CREATED_DECOY: &str = "1980-01-01T00:00:00Z";

        struct Case {
            desc: &'static str,
            annotation_version: Option<&'static str>,
            labels: &'static [(&'static str, &'static str)],
            created: Option<&'static str>,
            expect_version: Option<&'static str>,
            expect_timestamp: Option<&'static str>,
        }
        let cases = [
            Case {
                desc: "annotation only",
                annotation_version: Some("ann-1"),
                labels: &[(ANNOTATION_CREATED, LABEL_CREATED_DECOY)],
                created: Some(CREATED),
                expect_version: Some("ann-1"),
                expect_timestamp: Some(CREATED),
            },
            Case {
                desc: "configuration label only",
                annotation_version: None,
                labels: &[(LABEL_OCI_VERSION, "label-1")],
                created: Some(CREATED),
                expect_version: Some("label-1"),
                expect_timestamp: Some(CREATED),
            },
            Case {
                desc: "legacy version label only",
                annotation_version: None,
                labels: &[(LABEL_VERSION, "legacy-1")],
                created: Some(CREATED),
                expect_version: Some("legacy-1"),
                expect_timestamp: Some(CREATED),
            },
            Case {
                desc: "annotation precedes configuration labels",
                annotation_version: Some("ann-wins"),
                labels: &[
                    (LABEL_OCI_VERSION, "label-loses"),
                    (LABEL_VERSION, "legacy-loses"),
                ],
                created: Some(CREATED),
                expect_version: Some("ann-wins"),
                expect_timestamp: Some(CREATED),
            },
            Case {
                desc: "missing version keeps a config created timestamp",
                annotation_version: None,
                labels: &[],
                created: Some(CREATED),
                expect_version: None,
                expect_timestamp: Some(CREATED),
            },
            Case {
                desc: "invalid config created timestamp",
                annotation_version: None,
                labels: &[],
                created: Some("not-a-timestamp"),
                expect_version: None,
                expect_timestamp: None,
            },
        ];

        for case in cases {
            let mut annotations = HashMap::new();
            if let Some(version) = case.annotation_version {
                annotations.insert(ANNOTATION_VERSION.to_owned(), version.to_owned());
            }
            annotations.insert(
                ANNOTATION_CREATED.to_owned(),
                ANNOTATION_CREATED_DECOY.to_owned(),
            );
            let config_desc = Descriptor::new(
                MediaType::ImageConfig,
                0,
                Digest::from_str(
                    "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
                )
                .unwrap(),
            );
            let manifest = ImageManifestBuilder::default()
                .schema_version(SCHEMA_VERSION)
                .config(config_desc)
                .layers(Vec::<Descriptor>::new())
                .annotations(annotations)
                .build()
                .unwrap();

            let mut image = ImageConfigurationBuilder::default();
            if !case.labels.is_empty() {
                let labels: HashMap<String, String> = case
                    .labels
                    .iter()
                    .map(|(k, v)| ((*k).to_owned(), (*v).to_owned()))
                    .collect();
                let config = ConfigBuilder::default().labels(labels).build().unwrap();
                image = image.config(config);
            }
            if let Some(created) = case.created {
                image = image.created(created);
            }
            let image = image.build().unwrap();

            let (version, timestamp) = image_version_and_created(&manifest, &image);
            assert_eq!(version.as_deref(), case.expect_version, "{}", case.desc);
            assert_eq!(
                timestamp,
                case.expect_timestamp.and_then(try_deserialize_timestamp),
                "{}",
                case.desc
            );
        }
    }

    #[test]
    fn test_composefs_parsing() {
        const DIGEST: &str = "8b7df143d91c716ecfa5fc1730022f6b421b05cedee8fd52b1fc65a96030ad528b7df143d91c716ecfa5fc1730022f6b421b05cedee8fd52b1fc65a96030ad52";
        let v = ComposefsCmdline::new(DIGEST);
        assert!(!v.allow_missing_fsverity);
        assert_eq!(v.digest.as_ref(), DIGEST);
        let v = ComposefsCmdline::new(&format!("?{}", DIGEST));
        assert!(v.allow_missing_fsverity);
        assert_eq!(v.digest.as_ref(), DIGEST);
    }

    #[test]
    fn test_build_composefs_karg() -> Result<()> {
        let hex = "ab".repeat(64);
        let digest = || Sha512HashValue::from_hex(&hex).unwrap();

        assert_eq!(
            build_composefs_karg(digest(), FormatVersion::V1, false),
            format!("composefs.digest=v1-sha512-12:{hex}")
        );
        assert_eq!(
            build_composefs_karg(digest(), FormatVersion::V2, true),
            format!("composefs=?{hex}")
        );

        let cmdline = Cmdline::from(format!("composefs.digest=v1-sha512-12:{hex}"));
        assert_eq!(
            ComposefsCmdline::find_in_cmdline(&cmdline)?
                .expect("composefs argument should be present")
                .digest
                .as_ref(),
            hex
        );

        Ok(())
    }

    #[test]
    fn classify_bootloader_cases() {
        struct Case {
            desc: &'static str,
            efi: Result<String, EfiError>,
            bls: bool,
            grub_dir: bool,
            expected: Bootloader,
        }
        let cases = [
            Case {
                desc: "UEFI, EFI_LOADER_INFO advertises systemd-boot",
                efi: Ok("systemd-boot 261.2".into()),
                bls: false,
                grub_dir: false,
                expected: Bootloader::Systemd,
            },
            Case {
                desc: "UEFI, EFI_LOADER_INFO advertises GRUB CC",
                efi: Ok("GRUB CC 2.12".into()),
                bls: false,
                grub_dir: false,
                expected: Bootloader::GrubCC,
            },
            Case {
                desc: "UEFI, EFI_LOADER_INFO advertises unknown; default GRUB",
                efi: Ok("something else 1.0".into()),
                bls: false,
                grub_dir: false,
                expected: Bootloader::Grub,
            },
            Case {
                desc: "Non-EFI + BLS layout present: BLS (regression fix)",
                efi: Err(EfiError::SystemNotUEFI),
                bls: true,
                grub_dir: false,
                expected: Bootloader::Systemd,
            },
            Case {
                desc: "Non-EFI + no BLS layout: fall back to GRUB",
                efi: Err(EfiError::SystemNotUEFI),
                bls: false,
                grub_dir: false,
                expected: Bootloader::Grub,
            },
            Case {
                desc: "EFI mounted but EFI_LOADER_INFO missing, BLS present",
                efi: Err(EfiError::MissingVar),
                bls: true,
                grub_dir: false,
                expected: Bootloader::Systemd,
            },
            Case {
                desc: "EFI mounted but EFI_LOADER_INFO missing, no BLS: GRUB",
                efi: Err(EfiError::MissingVar),
                bls: false,
                grub_dir: false,
                expected: Bootloader::Grub,
            },
            // A legacy-BIOS Fedora/RHEL install with GRUB_ENABLE_BLSCFG=true
            // has both directories and is unambiguously GRUB. Without the
            // GRUB probe this case returned Systemd, which is the
            // misclassification raised in review on #2376.
            Case {
                desc: "Non-EFI + BLS layout + GRUB dir: GRUB wins (blscfg)",
                efi: Err(EfiError::SystemNotUEFI),
                bls: true,
                grub_dir: true,
                expected: Bootloader::Grub,
            },
            Case {
                desc: "Non-EFI + GRUB dir, no BLS: GRUB",
                efi: Err(EfiError::SystemNotUEFI),
                bls: false,
                grub_dir: true,
                expected: Bootloader::Grub,
            },
            Case {
                desc: "EFI_LOADER_INFO missing + BLS + GRUB dir: GRUB wins",
                efi: Err(EfiError::MissingVar),
                bls: true,
                grub_dir: true,
                expected: Bootloader::Grub,
            },
            // The regression this PR fixes must survive the new probe: a
            // BLS layout with no GRUB directory is still BLS-native.
            Case {
                desc: "Non-EFI + BLS, no GRUB dir: still BLS (Pi 5, U-Boot)",
                efi: Err(EfiError::SystemNotUEFI),
                bls: true,
                grub_dir: false,
                expected: Bootloader::Systemd,
            },
            // UEFI classification must ignore both probes entirely.
            Case {
                desc: "UEFI systemd-boot with a stray GRUB dir: still systemd",
                efi: Ok("systemd-boot 261.2".into()),
                bls: true,
                grub_dir: true,
                expected: Bootloader::Systemd,
            },
        ];
        for case in cases {
            let got = classify_bootloader(case.efi, case.bls, case.grub_dir)
                .unwrap_or_else(|e| panic!("{}: {e}", case.desc));
            assert_eq!(got, case.expected, "{}", case.desc);
        }
    }

    #[test]
    fn classify_bootloader_propagates_other_efi_errors() {
        let result = classify_bootloader(
            Err(EfiError::InvalidData("test-only synthetic error")),
            false,
            false,
        );
        assert!(result.is_err(), "InvalidData should propagate as an error");
    }

    #[test]
    fn test_sorted_bls_boot_entries() -> Result<()> {
        let tempdir = cap_std_ext::cap_tempfile::tempdir(cap_std::ambient_authority())?;

        let entry1 = r#"
            title Fedora 42.20250623.3.1 (CoreOS)
            version fedora-42.0
            sort-key 1
            linux /boot/7e11ac46e3e022053e7226a20104ac656bf72d1a84e3a398b7cce70e9df188b6/vmlinuz-5.14.10
            initrd /boot/7e11ac46e3e022053e7226a20104ac656bf72d1a84e3a398b7cce70e9df188b6/initramfs-5.14.10.img
            options root=UUID=abc123 rw composefs=7e11ac46e3e022053e7226a20104ac656bf72d1a84e3a398b7cce70e9df188b6
        "#;

        let entry2 = r#"
            title Fedora 41.20250214.2.0 (CoreOS)
            version fedora-42.0
            sort-key 2
            linux /boot/febdf62805de2ae7b6b597f2a9775d9c8a753ba1e5f09298fc8fbe0b0d13bf01/vmlinuz-5.14.10
            initrd /boot/febdf62805de2ae7b6b597f2a9775d9c8a753ba1e5f09298fc8fbe0b0d13bf01/initramfs-5.14.10.img
            options root=UUID=abc123 rw composefs=febdf62805de2ae7b6b597f2a9775d9c8a753ba1e5f09298fc8fbe0b0d13bf01
        "#;

        tempdir.create_dir_all("loader/entries")?;
        tempdir.atomic_write(
            "loader/entries/random_file.txt",
            "Random file that we won't parse",
        )?;
        tempdir.atomic_write("loader/entries/entry1.conf", entry1)?;
        tempdir.atomic_write("loader/entries/entry2.conf", entry2)?;

        let result =
            get_sorted_type1_boot_entries_helper(&tempdir, true, false, Bootloader::Systemd)
                .unwrap();

        assert_eq!(result[0].sort_key.as_ref().unwrap(), "1");
        assert_eq!(result[1].sort_key.as_ref().unwrap(), "2");

        let result =
            get_sorted_type1_boot_entries_helper(&tempdir, false, false, Bootloader::Systemd)
                .unwrap();
        assert_eq!(result[0].sort_key.as_ref().unwrap(), "2");
        assert_eq!(result[1].sort_key.as_ref().unwrap(), "1");

        Ok(())
    }

    #[test]
    fn test_rollback_queued_from_first_entry_uki() -> Result<()> {
        const BOOTED: &str = "1111111111111111111111111111111111111111111111111111111111111111";
        const ROLLBACK: &str = "2222222222222222222222222222222222222222222222222222222222222222";

        let tempdir = cap_std_ext::cap_tempfile::tempdir(cap_std::ambient_authority())?;
        tempdir.create_dir_all("loader/entries")?;

        let default_entry = format!(
            "title Fedora Bootc\nversion 44\nsort-key {}\nuki /EFI/Linux/bootc/bootc_composefs-{BOOTED}.efi\n",
            primary_sort_key("fedora")
        );
        let other_entry = format!(
            "title Fedora Bootc\nversion 44\nsort-key {}\nuki /EFI/Linux/bootc/bootc_composefs-{ROLLBACK}.efi\n",
            secondary_sort_key("fedora")
        );

        // Production pairing (boot.rs): the primary entry carries sort-key
        // "...-0" AND filename release "1" — systemd-boot sorts sort-key
        // ascending, grub sorts the release field descending, both put it first.
        tempdir.atomic_write(
            format!(
                "loader/entries/{}",
                type1_entry_conf_file_name("fedora", 44, FILENAME_PRIORITY_PRIMARY)
            ),
            default_entry,
        )?;
        tempdir.atomic_write(
            format!(
                "loader/entries/{}",
                type1_entry_conf_file_name("fedora", 44, FILENAME_PRIORITY_SECONDARY)
            ),
            other_entry,
        )?;

        let sorted =
            get_sorted_type1_boot_entries_helper(&tempdir, true, false, Bootloader::Systemd)?;
        let first = sorted.first().unwrap();

        // The entry carrying the primary sort key is the bootloader default
        assert_eq!(
            first.sort_key.as_ref().unwrap(),
            &primary_sort_key("fedora")
        );

        // The default entry references the booted deployment: nothing is queued
        assert!(!rollback_queued_from_first_entry(first, BOOTED)?);
        // The default entry references another deployment: a rollback is queued
        assert!(rollback_queued_from_first_entry(first, ROLLBACK)?);

        Ok(())
    }

    #[test]
    fn test_rollback_queued_from_first_entry_type1() -> Result<()> {
        const BOOTED: &str = "7e11ac46e3e022053e7226a20104ac656bf72d1a84e3a398b7cce70e9df188b6";
        const ROLLBACK: &str = "febdf62805de2ae7b6b597f2a9775d9c8a753ba1e5f09298fc8fbe0b0d13bf01";

        let tempdir = cap_std_ext::cap_tempfile::tempdir(cap_std::ambient_authority())?;
        tempdir.create_dir_all("loader/entries")?;

        let default_entry = format!(
            "title Fedora Bootc\nversion 44\nsort-key {}\nlinux /boot/{BOOTED}/vmlinuz\ninitrd /boot/{BOOTED}/initramfs.img\noptions root=UUID=abc123 rw composefs={BOOTED}\n",
            primary_sort_key("fedora")
        );
        let other_entry = format!(
            "title Fedora Bootc\nversion 44\nsort-key {}\nlinux /boot/{ROLLBACK}/vmlinuz\ninitrd /boot/{ROLLBACK}/initramfs.img\noptions root=UUID=abc123 rw composefs={ROLLBACK}\n",
            secondary_sort_key("fedora")
        );

        // Production pairing: primary sort-key rides filename release "1"
        tempdir.atomic_write(
            format!(
                "loader/entries/{}",
                type1_entry_conf_file_name("fedora", 44, FILENAME_PRIORITY_PRIMARY)
            ),
            default_entry,
        )?;
        tempdir.atomic_write(
            format!(
                "loader/entries/{}",
                type1_entry_conf_file_name("fedora", 44, FILENAME_PRIORITY_SECONDARY)
            ),
            other_entry,
        )?;

        let sorted =
            get_sorted_type1_boot_entries_helper(&tempdir, true, false, Bootloader::Systemd)?;
        let first = sorted.first().unwrap();

        assert_eq!(
            first.sort_key.as_ref().unwrap(),
            &primary_sort_key("fedora")
        );

        assert!(!rollback_queued_from_first_entry(first, BOOTED)?);
        assert!(rollback_queued_from_first_entry(first, ROLLBACK)?);

        Ok(())
    }

    #[test]
    fn test_rollback_queued_from_first_entry_grub_type1() -> Result<()> {
        const BOOTED: &str = "7e11ac46e3e022053e7226a20104ac656bf72d1a84e3a398b7cce70e9df188b6";
        const ROLLBACK: &str = "febdf62805de2ae7b6b597f2a9775d9c8a753ba1e5f09298fc8fbe0b0d13bf01";

        let tempdir = cap_std_ext::cap_tempfile::tempdir(cap_std::ambient_authority())?;
        tempdir.create_dir_all("loader/entries")?;

        let default_entry = format!(
            "title Fedora Bootc\nversion 44\nsort-key {}\nlinux /boot/{BOOTED}/vmlinuz\ninitrd /boot/{BOOTED}/initramfs.img\noptions root=UUID=abc123 rw composefs={BOOTED}\n",
            primary_sort_key("fedora")
        );
        let other_entry = format!(
            "title Fedora Bootc\nversion 44\nsort-key {}\nlinux /boot/{ROLLBACK}/vmlinuz\ninitrd /boot/{ROLLBACK}/initramfs.img\noptions root=UUID=abc123 rw composefs={ROLLBACK}\n",
            secondary_sort_key("fedora")
        );

        tempdir.atomic_write(
            format!(
                "loader/entries/{}",
                type1_entry_conf_file_name("fedora", 44, FILENAME_PRIORITY_PRIMARY)
            ),
            default_entry,
        )?;
        tempdir.atomic_write(
            format!(
                "loader/entries/{}",
                type1_entry_conf_file_name("fedora", 44, FILENAME_PRIORITY_SECONDARY)
            ),
            other_entry,
        )?;

        // Grub and GrubCC ignore sort-key and sort the filename release field
        // descending ("1" > "0"), so the primary entry is grub's default —
        // the premise the first-entry check stands on for those bootloaders.
        let sorted = get_sorted_type1_boot_entries_helper(
            &tempdir,
            true,
            false,
            crate::spec::Bootloader::Grub,
        )?;
        let first = sorted.first().unwrap();
        assert_eq!(
            first.sort_key.as_ref().unwrap(),
            &primary_sort_key("fedora")
        );

        assert!(!rollback_queued_from_first_entry(first, BOOTED)?);
        assert!(rollback_queued_from_first_entry(first, ROLLBACK)?);

        Ok(())
    }

    #[test]
    fn test_sorted_uki_boot_entries() -> Result<()> {
        let user_cfg = r#"
            if [ -f ${config_directory}/efiuuid.cfg ]; then
                    source ${config_directory}/efiuuid.cfg
            fi

            menuentry "Fedora Bootc UKI: (f7415d75017a12a387a39d2281e033a288fc15775108250ef70a01dcadb93346)" {
                insmod fat
                insmod chain
                search --no-floppy --set=root --fs-uuid "${EFI_PART_UUID}"
                chainloader /EFI/Linux/f7415d75017a12a387a39d2281e033a288fc15775108250ef70a01dcadb93346.efi
            }

            menuentry "Fedora Bootc UKI: (7e11ac46e3e022053e7226a20104ac656bf72d1a84e3a398b7cce70e9df188b6)" {
                insmod fat
                insmod chain
                search --no-floppy --set=root --fs-uuid "${EFI_PART_UUID}"
                chainloader /EFI/Linux/7e11ac46e3e022053e7226a20104ac656bf72d1a84e3a398b7cce70e9df188b6.efi
            }
        "#;

        let bootdir = cap_std_ext::cap_tempfile::tempdir(cap_std::ambient_authority())?;
        bootdir.create_dir_all(format!("grub2"))?;
        bootdir.atomic_write(format!("grub2/{USER_CFG}"), user_cfg)?;

        let mut s = String::new();
        let result = get_sorted_grub_uki_boot_entries(&bootdir, &mut s)?;

        let expected = vec![
            MenuEntry {
                title: "Fedora Bootc UKI: (f7415d75017a12a387a39d2281e033a288fc15775108250ef70a01dcadb93346)".into(),
                body: MenuentryBody {
                    insmod: vec!["fat", "chain"],
                    chainloader: "/EFI/Linux/f7415d75017a12a387a39d2281e033a288fc15775108250ef70a01dcadb93346.efi".into(),
                    search: "--no-floppy --set=root --fs-uuid \"${EFI_PART_UUID}\"",
                    version: 0,
                    extra: vec![],
                },
            },
            MenuEntry {
                title: "Fedora Bootc UKI: (7e11ac46e3e022053e7226a20104ac656bf72d1a84e3a398b7cce70e9df188b6)".into(),
                body: MenuentryBody {
                    insmod: vec!["fat", "chain"],
                    chainloader: "/EFI/Linux/7e11ac46e3e022053e7226a20104ac656bf72d1a84e3a398b7cce70e9df188b6.efi".into(),
                    search: "--no-floppy --set=root --fs-uuid \"${EFI_PART_UUID}\"",
                    version: 0,
                    extra: vec![],
                },
            },
        ];

        assert_eq!(result, expected);

        Ok(())
    }

    #[test]
    fn test_find_in_cmdline() -> Result<()> {
        const DIGEST: &str = "8b7df143d91c716ecfa5fc1730022f6b421b05cedee8fd52b1fc65a96030ad528b7df143d91c716ecfa5fc1730022f6b421b05cedee8fd52b1fc65a96030ad52";

        let cases = [
            ("absent", "root=UUID=abc123 rw quiet", None, false),
            ("legacy", "composefs={DIGEST}", Some(DIGEST), false),
            (
                "v1",
                "composefs.digest=v1-sha512-12:{DIGEST}",
                Some(DIGEST),
                false,
            ),
            (
                "dual",
                "composefs={DIGEST} composefs.digest=v1-sha512-12:{DIGEST}",
                Some(DIGEST),
                false,
            ),
            ("legacy-insecure", "composefs=?{DIGEST}", Some(DIGEST), true),
            ("malformed", "composefs=not-a-digest", None, false),
        ];

        for (name, input, expected_digest, insecure) in cases {
            let input = input.replace("{DIGEST}", DIGEST);
            let result = ComposefsCmdline::find_in_cmdline(&Cmdline::from(input));
            if name == "malformed" {
                let error = match result {
                    Err(error) => error,
                    Ok(_) => panic!("malformed composefs argument must fail"),
                };
                assert!(
                    format!("{error:#}").contains("Parsing composefs kernel command line"),
                    "{error:#}"
                );
                assert!(format!("{error:#}").contains("composefs="), "{error:#}");
            } else if let Some(expected_digest) = expected_digest {
                let cfs = result?.expect("composefs argument should be present");
                assert_eq!(cfs.digest.as_ref(), expected_digest);
                assert_eq!(cfs.allow_missing_fsverity, insecure);
            } else {
                assert!(result?.is_none(), "{name} should not match");
            }
        }

        Ok(())
    }

    #[test]
    fn test_reconcile_composefs_cmdline_with_mount_source() -> Result<()> {
        let digest_v1 = "ab".repeat(64);
        let digest_v2 = "cd".repeat(64);
        let cases = [
            (
                "preferred V1, actual V2, strict",
                format!("composefs.digest=v1-sha512-12:{digest_v1}"),
                format!("composefs:{digest_v2}"),
                digest_v2.as_str(),
                false,
                false,
            ),
            (
                "preferred V2, actual V2, allow missing, transient",
                format!("composefs=?{digest_v1}"),
                format!("transient:composefs={digest_v2}"),
                digest_v2.as_str(),
                true,
                true,
            ),
            (
                "matching digest, strict, normal",
                format!("composefs={digest_v1}"),
                format!("composefs:{digest_v1}"),
                digest_v1.as_str(),
                false,
                false,
            ),
            (
                "matching digest, allow missing, transient",
                format!("composefs=?{digest_v1}"),
                format!("transient:composefs={digest_v1}"),
                digest_v1.as_str(),
                true,
                true,
            ),
        ];

        for (
            name,
            cmdline,
            mount_source,
            expected_digest,
            expected_allow_missing,
            expected_transient,
        ) in cases
        {
            let parsed = ComposefsCmdline::find_in_cmdline(&Cmdline::from(cmdline))?
                .unwrap_or_else(|| panic!("{name}: composefs argument should be present"));
            let reconciled = reconcile_composefs_cmdline_with_mount_source(parsed, &mount_source)?;
            assert_eq!(reconciled.digest.as_ref(), expected_digest, "{name}");
            assert_eq!(
                reconciled.allow_missing_fsverity, expected_allow_missing,
                "{name}"
            );
            assert_eq!(reconciled.is_transient, expected_transient, "{name}");
        }

        let parsed = ComposefsCmdline::new(&digest_v1);
        let error = match reconcile_composefs_cmdline_with_mount_source(parsed, "ext4") {
            Ok(_) => panic!("invalid mount source must fail"),
            Err(error) => error,
        };
        assert!(
            format!("{error:#}").contains("Root not mounted using composefs (source: ext4)"),
            "{error:#}"
        );

        Ok(())
    }

    use crate::testutils::fake_digest_version;

    /// Test that staged entries are also collected by list_type1_entries.
    /// This is important for GC to not delete staged deployments' boot binaries.
    #[test]
    fn test_list_type1_entries_includes_staged() -> Result<()> {
        let tempdir = cap_std_ext::cap_tempfile::tempdir(cap_std::ambient_authority())?;

        let digest_active = fake_digest_version(0);
        let digest_staged = fake_digest_version(1);

        let active_entry = format!(
            r#"
            title Active Deployment
            version 2
            sort-key 1
            linux /boot/bootc_composefs-{digest_active}/vmlinuz
            initrd /boot/bootc_composefs-{digest_active}/initramfs.img
            options root=UUID=abc123 rw composefs={digest_active}
        "#
        );

        let staged_entry = format!(
            r#"
            title Staged Deployment
            version 3
            sort-key 0
            linux /boot/bootc_composefs-{digest_staged}/vmlinuz
            initrd /boot/bootc_composefs-{digest_staged}/initramfs.img
            options root=UUID=abc123 rw composefs={digest_staged}
        "#
        );

        tempdir.create_dir_all("loader/entries")?;
        tempdir.create_dir_all("loader/entries.staged")?;
        tempdir.atomic_write("loader/entries/active.conf", active_entry)?;
        tempdir.atomic_write("loader/entries.staged/staged.conf", staged_entry)?;

        let result = list_type1_entries(&tempdir)?;
        assert_eq!(result.len(), 2);

        let verity_set: std::collections::HashSet<&str> =
            result.iter().map(|e| e.fsverity.as_str()).collect();
        assert!(
            verity_set.contains(digest_active.as_str()),
            "Should contain active entry"
        );
        assert!(
            verity_set.contains(digest_staged.as_str()),
            "Should contain staged entry"
        );

        Ok(())
    }

    #[test]
    fn test_get_sorted_type1_boot_entries_helper_systemd() -> Result<()> {
        let tempdir = cap_std_ext::cap_tempfile::tempdir(cap_std::ambient_authority())?;

        // Create entries with different sort-keys for systemd-boot testing
        let entry1 = format!(
            r#"
            title Fedora Linux (1.0.0)
            version 1.0.0
            sort-key {}
            linux /boot/vmlinuz
            initrd /boot/initramfs.img
        "#,
            secondary_sort_key("fedora")
        );

        let entry2 = format!(
            r#"
            title Fedora Linux (2.0.0) 
            version 2.0.0
            sort-key {}
            linux /boot/vmlinuz
            initrd /boot/initramfs.img
        "#,
            primary_sort_key("fedora")
        );

        let entry3 = format!(
            r#"
            title Fedora Linux (1.5.0)
            version 1.5.0
            sort-key {}
            linux /boot/vmlinuz
            initrd /boot/initramfs.img
        "#,
            primary_sort_key("fedora")
        );

        tempdir.create_dir_all("loader/entries")?;

        // Use realistic filenames as used in production
        let filename1 = type1_entry_conf_file_name("fedora", "1.0.0", FILENAME_PRIORITY_SECONDARY);
        let filename2 = type1_entry_conf_file_name("fedora", "2.0.0", FILENAME_PRIORITY_PRIMARY);
        let filename3 = type1_entry_conf_file_name("fedora", "1.5.0", FILENAME_PRIORITY_PRIMARY);

        tempdir.atomic_write(format!("loader/entries/{}", filename1), entry1)?;
        tempdir.atomic_write(format!("loader/entries/{}", filename2), entry2)?;
        tempdir.atomic_write(format!("loader/entries/{}", filename3), entry3)?;

        // Test systemd-boot sorting (by sort-key, then by version in descending order)
        let result = get_sorted_type1_boot_entries_helper(
            &tempdir,
            true,
            false,
            crate::spec::Bootloader::Systemd,
        )?;

        assert_eq!(result.len(), 3);
        // With ascending=true, primary sort-key (bootc-fedora-0) should come before secondary (bootc-fedora-1)
        // Within primary sort-key, version 2.0.0 should come before 1.5.0 (descending version order)
        assert_eq!(
            result[0].sort_key.as_ref().unwrap(),
            &primary_sort_key("fedora")
        );
        assert_eq!(result[0].version(), "2.0.0".into()); // Entry 2 (version 2.0.0)
        assert_eq!(
            result[1].sort_key.as_ref().unwrap(),
            &primary_sort_key("fedora")
        );
        assert_eq!(result[1].version(), "1.5.0".into()); // Entry 3 (version 1.5.0)
        assert_eq!(
            result[2].sort_key.as_ref().unwrap(),
            &secondary_sort_key("fedora")
        );
        assert_eq!(result[2].version(), "1.0.0".into()); // Entry 1 (version 1.0.0)

        // Test descending order
        let result = get_sorted_type1_boot_entries_helper(
            &tempdir,
            false,
            false,
            crate::spec::Bootloader::Systemd,
        )?;

        assert_eq!(result.len(), 3);
        // With ascending=false, secondary sort-key should come before primary
        assert_eq!(
            result[0].sort_key.as_ref().unwrap(),
            &secondary_sort_key("fedora")
        );
        assert_eq!(result[0].version(), "1.0.0".into()); // Entry 1
        assert_eq!(
            result[1].sort_key.as_ref().unwrap(),
            &primary_sort_key("fedora")
        );
        assert_eq!(result[1].version(), "1.5.0".into()); // Entry 3
        assert_eq!(
            result[2].sort_key.as_ref().unwrap(),
            &primary_sort_key("fedora")
        );
        assert_eq!(result[2].version(), "2.0.0".into()); // Entry 2

        Ok(())
    }

    #[test]
    fn test_get_sorted_type1_boot_entries_helper_grub() -> Result<()> {
        let tempdir = cap_std_ext::cap_tempfile::tempdir(cap_std::ambient_authority())?;

        // Create entries with sort-keys but GRUB ignores them and sorts by filename
        let entry1 = format!(
            r#"
            title Fedora Linux (41.20251125.0)
            version 41.20251125.0
            sort-key {}
            linux /boot/vmlinuz
            initrd /boot/initramfs.img
        "#,
            secondary_sort_key("fedora")
        );

        let entry2 = format!(
            r#"
            title Fedora Linux (42.20251125.0)
            version 42.20251125.0
            sort-key {}
            linux /boot/vmlinuz
            initrd /boot/initramfs.img
        "#,
            primary_sort_key("fedora")
        );

        tempdir.create_dir_all("loader/entries")?;

        // Use realistic filenames - GRUB will sort by these, not sort-key
        let filename1 =
            type1_entry_conf_file_name("fedora", "41.20251125.0", FILENAME_PRIORITY_SECONDARY);
        let filename2 =
            type1_entry_conf_file_name("fedora", "42.20251125.0", FILENAME_PRIORITY_PRIMARY);

        tempdir.atomic_write(format!("loader/entries/{}", filename1), entry1)?;
        tempdir.atomic_write(format!("loader/entries/{}", filename2), entry2)?;

        let result = get_sorted_type1_boot_entries_helper(
            &tempdir,
            true,
            false,
            crate::spec::Bootloader::Grub,
        )?;

        assert_eq!(result.len(), 2);
        // With ascending=true for GRUB, we reverse the default descending filename order
        // Filenames: bootc_fedora-41.20251125.0-0.conf, bootc_fedora-42.20251125.0-1.conf
        // Ascending filename order should be: 42-1, 41-0
        assert_eq!(result[0].version(), "42.20251125.0".into());
        assert_eq!(result[1].version(), "41.20251125.0".into());

        // Test descending order (GRUB's default filename sorting)
        let result = get_sorted_type1_boot_entries_helper(
            &tempdir,
            false,
            false,
            crate::spec::Bootloader::Grub,
        )?;

        assert_eq!(result.len(), 2);
        // With ascending=false for GRUB, filenames should be sorted in descending order
        // Descending filename order should be: 42-1, 41-0
        assert_eq!(result[0].version(), "41.20251125.0".into());
        assert_eq!(result[1].version(), "42.20251125.0".into());

        Ok(())
    }
}