Detect pending OS update after marking the booted slot good#7022
Open
agners wants to merge 1 commit into
Open
Conversation
Since #7006 Supervisor recovers an OS update that is installed but still pending a reboot by comparing rauc's primary boot slot with the booted one at load time. On GRUB-based systems (generic-x86-64, OVA, generic-aarch64) this misfires on every boot: grub.cfg increments the booted slot's boot attempt counter on each boot attempt, and rauc's GRUB backend only treats a slot as primary once it has no boot attempts pending. Until the booted slot is marked good -- which happens later in Core.start() -- GetPrimary reports the previous slot as primary, so Supervisor misdetected the previous slot's (older) version as a pending update. This raised a bogus reboot-required issue on every boot (#7016) and, since /os/info reports a pending version as the current version, made Core offer an "update" to the already running version, which Supervisor then rejected as already installed (#7017). Move the detection from load() into mark_healthy() and mark the booted slot good first: that resets the boot attempt counter, making GetPrimary trustworthy. Marking the booted slot active remains conditional on no pending update and now runs after the detection.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed change
Since #7006 Supervisor recovers an OS update that is installed but still pending a reboot by comparing rauc's primary boot slot with the booted one at load time. On GRUB-based systems (generic-x86-64, OVA, generic-aarch64) this misfires on every boot: grub.cfg increments the booted slot's boot attempt counter on each boot attempt, and rauc's GRUB backend only treats a slot as primary once it has no boot attempts pending. Until the booted slot is marked good — which happens later in
Core.start()—GetPrimaryreports the previous slot as primary, so Supervisor misdetected the previous slot's (older) version as a pending update. This raised a bogus reboot-required issue on every boot (#7016), and since/os/inforeports a pending version as the current version, it also made Core offer an "update" to the already running version, which Supervisor then rejected as already installed (#7017).Move the detection from
load()intomark_healthy()and mark the booted slot good first: that resets the boot attempt counter, makingGetPrimarytrustworthy. Marking the booted slot active remains conditional on no pending update and now runs after the detection, so a genuinely pending update (which can also be a deliberate downgrade) still isn't cancelled by a Supervisor restart.Type of change
Additional information
Checklist
ruff format supervisor tests)If API endpoints or add-on configuration are added/changed: