From 1ade7e4498c41b9f18158afae5bfccccccb161d3 Mon Sep 17 00:00:00 2001
From: Joseph Marrero Corchado <jmarrero@redhat.com>
Date: Tue, 12 May 2026 20:31:28 -0400
Subject: [PATCH 1/4] deps: Update bcvk-qemu from v0.13.0 to v0.15.0

Assisted-by: OpenCode (Claude Opus 4.6)
Signed-off-by: Joseph Marrero Corchado <jmarrero@redhat.com>
---
 Cargo.lock                          | 2 +-
 crates/tests-integration/Cargo.toml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index e39fb5b46..3c0521bc6 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -168,7 +168,7 @@ checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 [[package]]
 name = "bcvk-qemu"
 version = "0.1.0"
-source = "git+https://github.com/bootc-dev/bcvk?rev=f4dd05a74ccb54084093c9167317a14356ca53e4#f4dd05a74ccb54084093c9167317a14356ca53e4"
+source = "git+https://github.com/bootc-dev/bcvk?rev=b32b57d7bced201a66a1ba95b8739fb8310e109b#b32b57d7bced201a66a1ba95b8739fb8310e109b"
 dependencies = [
  "camino",
  "cap-std-ext 5.1.2",
diff --git a/crates/tests-integration/Cargo.toml b/crates/tests-integration/Cargo.toml
index 0ae7e4346..e134e3573 100644
--- a/crates/tests-integration/Cargo.toml
+++ b/crates/tests-integration/Cargo.toml
@@ -30,7 +30,7 @@ bootc-kernel-cmdline = { path = "../kernel_cmdline", version = "0.0.0" }
 # This is a git dependency — not published to crates.io.
 # When updating, also check the bcvk-qemu Cargo.toml for its own
 # dependency versions (cap-std-ext, etc.) to avoid conflicts.
-bcvk-qemu = { git = "https://github.com/bootc-dev/bcvk", rev = "f4dd05a74ccb54084093c9167317a14356ca53e4" }
+bcvk-qemu = { git = "https://github.com/bootc-dev/bcvk", rev = "b32b57d7bced201a66a1ba95b8739fb8310e109b" }
 data-encoding = "2.9"
 indicatif = { workspace = true }
 libtest-mimic = "0.8.0"

From 1234f18baaae6c283214dce6172db74012afe6f5 Mon Sep 17 00:00:00 2001
From: Colin Walters <walters@verbum.org>
Date: Mon, 11 May 2026 07:19:41 -0400
Subject: [PATCH 2/4] initramfs: Fix dracut module wants symlink for dracut
 109+

dracut 109 (shipped in Fedora 45, and now backported to Fedora 44 via
FEDORA-2026-5e95ea992d) removed `systemdsystemconfdir` from
01-dist.conf, leaving the variable empty in the dracut build
environment. Our module-setup.sh used that variable for the
`initrd-root-fs.target.wants/` directory, so the symlink was written
to the root of the initramfs rather than under
/usr/lib/systemd/system/. systemd does not recognize root-level .wants
directories, so bootc-root-setup.service was silently never activated,
causing the system to drop to emergency mode on composefs+UKI boots.

Switch to `${systemdsystemunitdir}` (/usr/lib/systemd/system), which
dracut reliably sets on all versions. This matches how the ostree dracut
module has always handled this. The fix is unconditionally correct for
all dracut versions.

Assisted-by: OpenCode (Claude Sonnet 4.6)
Signed-off-by: Colin Walters <walters@verbum.org>
---
 crates/initramfs/dracut/module-setup.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/crates/initramfs/dracut/module-setup.sh b/crates/initramfs/dracut/module-setup.sh
index 2e5187dfd..5250dffd3 100755
--- a/crates/initramfs/dracut/module-setup.sh
+++ b/crates/initramfs/dracut/module-setup.sh
@@ -14,7 +14,7 @@ install() {
     local service=bootc-root-setup.service
     dracut_install /usr/lib/bootc/initramfs-setup
     inst_simple "${systemdsystemunitdir}/${service}"
-    mkdir -p "${initdir}${systemdsystemconfdir}/initrd-root-fs.target.wants"
+    mkdir -p "${initdir}${systemdsystemunitdir}/initrd-root-fs.target.wants"
     ln_r "${systemdsystemunitdir}/${service}" \
-        "${systemdsystemconfdir}/initrd-root-fs.target.wants/${service}"
+        "${systemdsystemunitdir}/initrd-root-fs.target.wants/${service}"
 }

From 8f2ce2cefeccf5aa4a99f5aa915c2db3dc2bdd9c Mon Sep 17 00:00:00 2001
From: Colin Walters <walters@verbum.org>
Date: Mon, 11 May 2026 07:20:12 -0400
Subject: [PATCH 3/4] ci: Downgrade kernel 7.0/7.1 to 6.x in CI container
 builds

Linux kernel 7.0 and 7.1 introduced a requirement that all files in a
composefs image carry fs-verity digests. bootc only applies verity to
content objects, not every file, so erofs mounts fail with 'has no
fs-verity digest' on these kernels. This is a kernel regression tracked
upstream; 7.2+ is expected to restore the prior behavior.

In provision-fetch.sh, detect kernel 7.0.x/7.1.x in the base image and
downgrade to 6.19.10-300.fc44 from Koji before the image build runs.
The downgrade uses --noscripts to prevent the kernel-core posttrans
scriptlet from invoking kernel-install (which fails and pollutes /boot
inside the container), then runs depmod manually and removes leftover
module directories from the replaced kernel.

This workaround should be removed once base images ship kernel 7.2+.

Assisted-by: OpenCode (Claude Sonnet 4.6)
Signed-off-by: Colin Walters <walters@verbum.org>
---
 hack/provision-fetch.sh | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/hack/provision-fetch.sh b/hack/provision-fetch.sh
index fb73b8695..35f6e8817 100755
--- a/hack/provision-fetch.sh
+++ b/hack/provision-fetch.sh
@@ -137,6 +137,44 @@ if ! rpm -q ostree 2>/dev/null | grep -q "2026\." ; then
     esac
 fi
 
+# Temporary: downgrade kernel to last 6.x when 7.0 or 7.1 is present.
+# Kernel 7.x broke composefs ("has no fs-verity digest"), fixed in 7.2.
+# xref https://github.com/bootc-dev/bootc/issues/2174
+# TODO: Remove once all base images ship kernel >= 7.2
+kernel_ver=$(rpm -q --qf '%{VERSION}' kernel 2>/dev/null || true)
+case "${kernel_ver}" in
+    7.0.*|7.1.*)
+        arch=$(uname -m)
+        koji_kver="6.19.10"
+        koji_krel="300.fc44"
+        koji_base="https://kojipkgs.fedoraproject.org/packages/kernel/${koji_kver}/${koji_krel}/${arch}"
+        kernel_td=$(mktemp -d)
+        trap 'rm -rf "${kernel_td}"' EXIT
+        for pkg in kernel kernel-core kernel-modules kernel-modules-core; do
+            curl --retry 5 --retry-delay 5 --retry-all-errors -fL \
+                "${koji_base}/${pkg}-${koji_kver}-${koji_krel}.${arch}.rpm" \
+                -o "${kernel_td}/${pkg}.rpm"
+        done
+        # Skip scriptlets: kernel-core's posttrans runs `kernel-install add`
+        # which calls rpm-ostree, and that fails inside a container build.
+        # We manually run depmod afterward since it's the only useful
+        # scriptlet the kernel packages would otherwise execute.
+        dnf -y install --allowerasing --setopt=tsflags=noscripts "${kernel_td}"/*.rpm
+        /sbin/depmod -a "${koji_kver}-${koji_krel}.$(uname -m)"
+        # Remove any leftover module directories for the old kernel (e.g.
+        # initramfs.img generated by the base image build is not RPM-owned
+        # so dnf does not clean it up).
+        for old_kmod_dir in /usr/lib/modules/*; do
+            kd_ver=$(basename "${old_kmod_dir}")
+            if [[ "${kd_ver}" != "${koji_kver}-"* ]]; then
+                rm -rf "${old_kmod_dir}"
+            fi
+        done
+        rm -rf "${kernel_td}"
+        trap - EXIT
+        ;;
+esac
+
 dnf clean all
 # Clean logs and caches
 rm /var/log/* /var/cache /var/lib/{dnf,rpm-state,rhsm} -rf

From 39d4523f24e63592a7e332177a1439233bdf721a Mon Sep 17 00:00:00 2001
From: John Eckersberg <jeckersb@redhat.com>
Date: Tue, 12 May 2026 17:20:04 -0400
Subject: [PATCH 4/4] ci: bump from f43 to f44 on upgrade matrix

Really we should probably test both of these while they're stable
Fedora versions, but currently CI is blocked on the f43 upgrade job
being broken, and if switching to f44 unblocks things that's progress.

Signed-off-by: John Eckersberg <jeckersb@redhat.com>
---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 42a419ffe..2ac6b6943 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -59,7 +59,7 @@ jobs:
             # Full suite: all OSes
             echo 'package_os_matrix=["fedora-43","fedora-44","fedora-45","centos-9","centos-10"]' >> "$GITHUB_OUTPUT"
             echo 'integration_os_matrix=["fedora-43","fedora-44","centos-9","centos-10"]' >> "$GITHUB_OUTPUT"
-            echo 'upgrade_os_matrix=["fedora-43","centos-10"]' >> "$GITHUB_OUTPUT"
+            echo 'upgrade_os_matrix=["fedora-44","centos-10"]' >> "$GITHUB_OUTPUT"
             echo 'run_heavy=true' >> "$GITHUB_OUTPUT"
           elif echo "$LABELS" | jq -e 'index("ci/tier-1")' > /dev/null; then
             # Tier-1 only: centos-10
