Repository: systemd/mkosi

Issue:
EFI entries in the built image have a different machine ID
Hello,

When building an image and running some tests (using the latest mkosi master) I noticed that the entries under `/efi` are generated for a different machine ID than is present in the final image booted via `mkosi qemu`:

`mkosi.default`
```ini
[Distribution]
Distribution=arch

[Host]
NetworkVeth=yes
Ssh=yes

[Output]
Bootable=yes
Format=gpt_ext4
WithoutUnifiedKernelImages=yes

[Partitions]
RootSize=32G
```

```
# mkosi build
...
(10/11) Adding kernel and initramfs images to /boot...
dracut: Executing: /usr/bin/dracut -f /efi/492174d5cb10476084e2d69df3cf4568/5.11.8-arch1-1/initrd 5.11.8-arch1-1
...
dracut: *** Creating image file '/efi/492174d5cb10476084e2d69df3cf4568/5.11.8-arch1-1/initrd' ***
dracut: *** Creating initramfs image file '/efi/492174d5cb10476084e2d69df3cf4568/5.11.8-arch1-1/initrd' done ***
...
‣ Successfully linked /root/test/image.raw.
‣ Linking private ssh key file...
‣ Successfully linked /root/test/id_rsa.
‣ Resulting image size is 32.3G, consumes 1.0G.

# mkosi qemu &
# mkosi ssh "bootctl list"
Boot Loader Entries:
        title: Arch Linux (default)
           id: 492174d5cb10476084e2d69df3cf4568-5.11.8-arch1-1.conf
       source: /efi/loader/entries/492174d5cb10476084e2d69df3cf4568-5.11.8-arch1-1.conf
      version: 5.11.8-arch1-1
   machine-id: 492174d5cb10476084e2d69df3cf4568
        linux: /492174d5cb10476084e2d69df3cf4568/5.11.8-arch1-1/linux
       initrd: /492174d5cb10476084e2d69df3cf4568/5.11.8-arch1-1/initrd
      options: rhgb selinux=0 audit=0 rw

        title: Reboot Into Firmware Interface
           id: auto-reboot-to-firmware-setup
       source: /sys/firmware/efi/efivars/LoaderEntries-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f
# mkosi ssh "cat /etc/machine-id"
2a7b0c0b016f4fdea7a6a4ecc63a28ce
```

This causes issues with scripts which expect the EFI configuration under a subdirectory matching the current `machine-id` (like the systemd's integration test suite).


Discussion:
Hmm, I figure this should use the "Default" naming scheme that @DaanDeMeyer added to systemd's kernel-install, so that the machine ID doesn't matter
Yes, but that would require modifying mkosi to not use a random machine id anymore. But the problem there is that I don't think every supported distro has the required version of systemd to make that work so we'd need to gate it behind a version check. Even then, I'm not even sure Centos 8's version is up-to-date enough to have that PR included.
The latest on this is that we should probably start writing to /etc/kernel/entry-token to configure what directory the EFI entries are written to. This will still require changes to the systemd integration tests though to read /etc/kernel/entry-token to figure out what directory to look in, but at least it doesn't have to guess at what the initial machine ID was anymore.

It'll only be usable on systems that have v251 installed though, since any version before that doesn't know about /etc/kernel/entry-token. Arch should already have it and Fedora should have it in the next release, other stuff might take longer.
Hmm, maybe what we can do is write the original machine ID used to /etc/kernel/entry-token, that way the same directory will be used regardless of the systemd version and the systemd integration tests have a way to pick up what the original machine ID was.

Resolving patch:
diff --git a/mkosi/__init__.py b/mkosi/__init__.py
--- a/mkosi/__init__.py
+++ b/mkosi/__init__.py
@@ -1835,6 +1835,7 @@ def prepare_tree(args: MkosiArgs, root: Path, do_run_build_script: bool, cached:
             root.joinpath("etc/kernel").mkdir(mode=0o755)
 
             root.joinpath("etc/kernel/cmdline").write_text(" ".join(args.kernel_command_line) + "\n")
+            root.joinpath("etc/kernel/entry-token").write_text(f"{args.machine_id}\n")
 
         if do_run_build_script or args.ssh:
             root_home(args, root).mkdir(mode=0o750)


Test patch: