Adding custom BLS entry blocks most `bootc` operations

[Dudecake]

bootc status gives an "efi does not start with custom prefix" error if a custom BLS entry is present.

‎BLSConfig::get_verity expects entries for .efi files to be UKI's with a name starting with bootc_composefs-

[archlinux ~]# bootc status                         
error: Status: Getting composefs deployment status: Getting composefs deployment status: Listing bootloader entries: efi does not start with custom prefix
[archlinux ~]# mv /boot/loader/entries/fwupd.conf{,.bak}
[archlinux ~]# bootc status                             
● Booted image: 192.168.122.1/bootc-iot
        Digest: sha256:b71bd3f9e704a0c41e5722227c0181700062e4a46d0e9839de5df43c9dd52d86 (amd64)
        Verity: 1b58308f766da92eb21c7fb8c3a016d4bb5315a4b70771e014d906c2a8036f2040d625cc145986b3a8c2328cefee16c342d0d0de24b835fff1768f4476a2fe0a
       Version: latest (2026-06-03T07:44:07Z)

  Rollback image: 192.168.122.1/bootc-iot
          Digest: sha256:d6b21a4d2b0eb2cd0694ee71f2dcfc5720f2698b2c0324bcd364829688bfc668 (amd64)
          Verity: 29d1f17c5d2b8c6e86d28eb4d5df4a1ec9f7d2a7e34cd6f238bae668e9cd86310c14b17f1d4e73e353d54b57ee5702b2a291ebd1e4a62dccaa7d61bd8ece00ec
         Version: latest (2026-05-27T21:35:58Z)

Contents of /boot/loader/entries:

==> /boot/loader/entries/bootc_arch-1b58308f766da92eb21c7fb8c3a016d4bb5315a4b70771e014d906c2a8036f2040d625cc145986b3a8c2328cefee16c342d0d0de24b835fff1768f4476a2fe0a-1.conf <==
title Arch Linux
version 1b58308f766da92eb21c7fb8c3a016d4bb5315a4b70771e014d906c2a8036f2040d625cc145986b3a8c2328cefee16c342d0d0de24b835fff1768f4476a2fe0a
linux /EFI/Linux/bootc_composefs-1b58308f766da92eb21c7fb8c3a016d4bb5315a4b70771e014d906c2a8036f2040d625cc145986b3a8c2328cefee16c342d0d0de24b835fff1768f4476a2fe0a/vmlinuz
initrd /EFI/Linux/bootc_composefs-1b58308f766da92eb21c7fb8c3a016d4bb5315a4b70771e014d906c2a8036f2040d625cc145986b3a8c2328cefee16c342d0d0de24b835fff1768f4476a2fe0a/initrd
options rw composefs=1b58308f766da92eb21c7fb8c3a016d4bb5315a4b70771e014d906c2a8036f2040d625cc145986b3a8c2328cefee16c342d0d0de24b835fff1768f4476a2fe0a
sort-key bootc-arch-0

==> /boot/loader/entries/bootc_arch-29d1f17c5d2b8c6e86d28eb4d5df4a1ec9f7d2a7e34cd6f238bae668e9cd86310c14b17f1d4e73e353d54b57ee5702b2a291ebd1e4a62dccaa7d61bd8ece00ec-0.conf <==
title Arch Linux
version 29d1f17c5d2b8c6e86d28eb4d5df4a1ec9f7d2a7e34cd6f238bae668e9cd86310c14b17f1d4e73e353d54b57ee5702b2a291ebd1e4a62dccaa7d61bd8ece00ec
linux /EFI/Linux/bootc_composefs-d9df04000c701c246c77f8937b960bbcff55e3122748915d6c794548e5611bd0dd4492d1da3451a420cd7ea3d47c4236885606a58f6fa99c9e0bb422ff3a523f/vmlinuz
initrd /EFI/Linux/bootc_composefs-d9df04000c701c246c77f8937b960bbcff55e3122748915d6c794548e5611bd0dd4492d1da3451a420cd7ea3d47c4236885606a58f6fa99c9e0bb422ff3a523f/initrd
options rw composefs=29d1f17c5d2b8c6e86d28eb4d5df4a1ec9f7d2a7e34cd6f238bae668e9cd86310c14b17f1d4e73e353d54b57ee5702b2a291ebd1e4a62dccaa7d61bd8ece00ec
sort-key bootc-arch-1

==> /boot/loader/entries/fwupd.conf <==
title      Firmware updater
version    2.1.1
efi        /EFI/boot/fwupdx64.efi

Entries not starting with bootc_ should probably be skipped as installing things like fwupd or memtest86+ shouldn't block updates

[Johan-Liebert1]

We have this prefix to keep track of the boot entries that bootc owns. Adding entries in here that are not managed by bootc complicates things a bit. For now, you should be able to put fwupdx64.efi in EFI/Linux and the bootloader should pick it up

[Dudecake]

Thank you for the response.

systemd-boot only seems to pick up shellx64.efi (it also really doesn't like it that fwupdx64.efi isn't an UKI as it spams the Parsed PE file '${file}' is not a UKI. message 256 times), grub might pick it up.

[archlinux ~]# ls /boot /boot/EFI/*                               
/boot:
EFI  fwupdx64.efi  ipxe-x86_64.efi  loader  shellx64.efi

/boot/EFI/BOOT:
BOOTX64.EFI  fwupdx64.efi  ipxe-x86_64.efi

/boot/EFI/Linux:
bootc_composefs-1b58308f766da92eb21c7fb8c3a016d4bb5315a4b70771e014d906c2a8036f2040d625cc145986b3a8c2328cefee16c342d0d0de24b835fff1768f4476a2fe0a  fwupdx64.efi
bootc_composefs-d9df04000c701c246c77f8937b960bbcff55e3122748915d6c794548e5611bd0dd4492d1da3451a420cd7ea3d47c4236885606a58f6fa99c9e0bb422ff3a523f  ipxe-x86_64.efi

/boot/EFI/systemd:
systemd-bootx64.efi
[archlinux ~]# bootctl list                                       
Parsed PE file '/boot/EFI/Linux/fwupdx64.efi' is not a UKI. (...)
Parsed PE file '/boot/EFI/Linux/ipxe-x86_64.efi' is not a UKI. (...)
         type: Boot Loader Specification Type #1 (.conf)
        title: Arch Linux (1b58308f766da92eb21c7fb8c3a016d4bb5315a4b70771e014d906c2a8036f2040d625cc145986b3a8c2328cefee16c342d0d0de24b835fff1768f4476a2fe0a) (default) (selected)
           id: bootc_arch-1b58308f766da92eb21c7fb8c3a016d4bb5315a4b70771e014d906c2a8036f2040d625cc145986b3a8c2328cefee16c342d0d0de24b835fff1768f4476a2fe0a-1.conf
       source: /boot//loader/entries/bootc_arch-1b58308f766da92eb21c7fb8c3a016d4bb5315a4b70771e014d906c2a8036f2040d625cc145986b3a8c2328cefee16c342d0d0de24b835fff1768f4476a2fe0a-1.conf (on the EFI System Partition)
     sort-key: bootc-arch-0
      version: 1b58308f766da92eb21c7fb8c3a016d4bb5315a4b70771e014d906c2a8036f2040d625cc145986b3a8c2328cefee16c342d0d0de24b835fff1768f4476a2fe0a
        linux: /boot//EFI/Linux/bootc_composefs-1b58308f766da92eb21c7fb8c3a016d4bb5315a4b70771e014d906c2a8036f2040d625cc145986b3a8c2328cefee16c342d0d0de24b835fff1768f4476a2fe0a/vmlinuz
       initrd: /boot//EFI/Linux/bootc_composefs-1b58308f766da92eb21c7fb8c3a016d4bb5315a4b70771e014d906c2a8036f2040d625cc145986b3a8c2328cefee16c342d0d0de24b835fff1768f4476a2fe0a/initrd
      options: rw composefs=1b58308f766da92eb21c7fb8c3a016d4bb5315a4b70771e014d906c2a8036f2040d625cc145986b3a8c2328cefee16c342d0d0de24b835fff1768f4476a2fe0a

         type: Boot Loader Specification Type #1 (.conf)
        title: Arch Linux (29d1f17c5d2b8c6e86d28eb4d5df4a1ec9f7d2a7e34cd6f238bae668e9cd86310c14b17f1d4e73e353d54b57ee5702b2a291ebd1e4a62dccaa7d61bd8ece00ec)
           id: bootc_arch-29d1f17c5d2b8c6e86d28eb4d5df4a1ec9f7d2a7e34cd6f238bae668e9cd86310c14b17f1d4e73e353d54b57ee5702b2a291ebd1e4a62dccaa7d61bd8ece00ec-0.conf
       source: /boot//loader/entries/bootc_arch-29d1f17c5d2b8c6e86d28eb4d5df4a1ec9f7d2a7e34cd6f238bae668e9cd86310c14b17f1d4e73e353d54b57ee5702b2a291ebd1e4a62dccaa7d61bd8ece00ec-0.conf (on the EFI System Partition)
     sort-key: bootc-arch-1
      version: 29d1f17c5d2b8c6e86d28eb4d5df4a1ec9f7d2a7e34cd6f238bae668e9cd86310c14b17f1d4e73e353d54b57ee5702b2a291ebd1e4a62dccaa7d61bd8ece00ec
        linux: /boot//EFI/Linux/bootc_composefs-d9df04000c701c246c77f8937b960bbcff55e3122748915d6c794548e5611bd0dd4492d1da3451a420cd7ea3d47c4236885606a58f6fa99c9e0bb422ff3a523f/vmlinuz
       initrd: /boot//EFI/Linux/bootc_composefs-d9df04000c701c246c77f8937b960bbcff55e3122748915d6c794548e5611bd0dd4492d1da3451a420cd7ea3d47c4236885606a58f6fa99c9e0bb422ff3a523f/initrd
      options: rw composefs=29d1f17c5d2b8c6e86d28eb4d5df4a1ec9f7d2a7e34cd6f238bae668e9cd86310c14b17f1d4e73e353d54b57ee5702b2a291ebd1e4a62dccaa7d61bd8ece00ec

         type: Automatic
        title: EFI Shell
           id: auto-efi-shell
       source: /sys/firmware/efi/efivars/LoaderEntries-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f (on the EFI System Partition)

         type: Automatic
        title: Reboot Into Firmware Interface
           id: auto-reboot-to-firmware-setup
       source: /sys/firmware/efi/efivars/LoaderEntries-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f (on the EFI System Partition)

There's also the problem that on my laptop (the above is from a test vm) the ESP is shared with an openSUSE MicroOS as I wanted to do some testing on actual hardware before committing to the switch.

==> /boot/efi/loader/entries/bootc_arch-9b5c21ac28d6d11c1311d6646f05d7b25d6c46293b541e8ff03065be6a310d9181de6392b0245954711267c4a0bed1f19f83f2b4924dfd428670086283925cd9-1.conf <==
title Arch Linux
version 9b5c21ac28d6d11c1311d6646f05d7b25d6c46293b541e8ff03065be6a310d9181de6392b0245954711267c4a0bed1f19f83f2b4924dfd428670086283925cd9
linux /EFI/Linux/bootc_composefs-9b5c21ac28d6d11c1311d6646f05d7b25d6c46293b541e8ff03065be6a310d9181de6392b0245954711267c4a0bed1f19f83f2b4924dfd428670086283925cd9/vmlinuz
initrd /EFI/Linux/bootc_composefs-9b5c21ac28d6d11c1311d6646f05d7b25d6c46293b541e8ff03065be6a310d9181de6392b0245954711267c4a0bed1f19f83f2b4924dfd428670086283925cd9/initrd
options root=/dev/mapper/cr_root rootflags=subvol=/@/arch rw boot=UUID=3C18-0718 composefs=9b5c21ac28d6d11c1311d6646f05d7b25d6c46293b541e8ff03065be6a310d9181de6392b0245954711267c4a0bed1f19f83f2b4924dfd428670086283925cd9 systemd.mount-extra=UUID=3C18-0718:/boot:auto:ro
sort-key bootc-arch-0

==> /boot/efi/loader/entries/dbd5f562fd384960948860f9c9a7c5db-6.19.10-1-default-102.conf <==
# Boot Loader Specification type#1 entry
title      openSUSE MicroOS 20260331
version    102@6.19.10-1-default
machine-id dbd5f562fd384960948860f9c9a7c5db
sort-key   opensuse-microos
options    root=/dev/mapper/cr_root swapaccount=1 mitigations=auto security=selinux selinux=1 enforcing=1 systemd.machine_id=dbd5f562fd384960948860f9c9a7c5db rootflags=subvol=@/.snapshots/102/snapshot
linux      /dbd5f562fd384960948860f9c9a7c5db/6.19.10-1-default/linux-f0b4fdbff4c0e19479da1676b7c980a61827a036
initrd     /dbd5f562fd384960948860f9c9a7c5db/6.19.10-1-default/initrd-7f37480b9d321eeefcc8ccececca0288469ca303

During the migration period it's not thàt much of a problem to append .bak to all other opensuse entries, but on my pc at home I use things like iPXE enough that it would be annoying to manually select it in the UEFI/shell every time I want to use it.