Change:
During systemd-boot update step attempts to touch EFI variables, even when is set to . Steps to reproduce the behavior: NixOS 21.05 with systemd-boot and to NixOS 21.11 () switch fails with: An error is just an indication of update trying to touch EFI variables. (I have EFI vars touching disabled on that system because of some unrelated firmware breakage) Manually running properly finishes, further switches work fine. systemd-boot update should not touch EFI variables during upgrade. <!-- Please @ people who are in the list of the offending package or module. If in doubt, check for whoever last touched something. --Please run and paste the result. Maintainer information:
I had a similar issue which I fixed by running "sudo nixos-rebuild --install-bootloader switch"
The fix for this got reverted in

Discussion:
warnings.warn("NIXOS_INSTALL_GRUB env var deprecated, use NIXOS_INSTALL_BOOTLOADER", DeprecationWarning) os.environ["NIXOS_INSTALL_BOOTLOADER"] = "1" <ins> # flags to pass to bootctl install/update bootctl_flags = [] if "@canTouchEfiVariables@" != "1": bootctl_flags.append("--no-variables") if "@graceful@" == "1": bootctl_flags.append("--graceful") </ins> if os.getenv("NIXOS_INSTALL_BOOTLOADER") == "1": # bootctl uses fopen() with modes "wxe" and fails if the file exists. if os.path.exists("@efiSysMountPoint@/loader/loader.conf"): os.unlink("@efiSysMountPoint@/loader/loader.conf") <del> flags = [] if "@canTouchEfiVariables@" != "1": flags.append("--no-variables") if "@graceful@" == "1": flags.append("--graceful") subprocess.check_call(["@systemd@/bin/bootctl", "--esp-path=@efiSysMountPoint@"] + flags + ["install"]) </del> <ins> subprocess.check_call(["@systemd@/bin/bootctl", "--esp-path=@efiSysMountPoint@"] + bootctl_flags + ["install"]) </ins> else: # Update bootloader to latest if needed available_out = subprocess.check_output(["@systemd@/bin/bootctl", "--version"], universal_newlines=True).split()[2]

print("skipping systemd-boot update to %s because of known regression" % available_version) else: print("updating systemd-boot from %s to %s" % (installed_version, available_version)) <del> subprocess.check_call(["@systemd@/bin/bootctl", "--esp-path=@efiSysMountPoint@", "update"]) </del> <ins> subprocess.check_call(["@systemd@/bin/bootctl", "--esp-path=@efiSysMountPoint@"] + bootctl_flags + ["update"]) </ins> mkdir_p("@efiSysMountPoint@/efi/nixos") mkdir_p("@efiSysMountPoint@/loader/entries")

'' mkdir $out diskImage=$out/disk.img <del> ${qemu}/bin/qemu-img create -f qcow2 $diskImage "60M" </del> <ins> ${qemu}/bin/qemu-img create -f qcow2 $diskImage "120M" </ins> ${if cfg.useEFIBoot then '' efiVars=$out/efi-vars.fd cp ${cfg.efi.variables} $efiVars

+ " -drive if=pflash,format=raw,unit=1,file=$efiVars"); } '' <del> # Create a /boot EFI partition with 60M and arbitrary but fixed GUIDs for reproducibility </del> <ins> # Create a /boot EFI partition with 120M and arbitrary but fixed GUIDs for reproducibility </ins> ${pkgs.gptfdisk}/bin/sgdisk  --set-alignment=1 --new=1:34:2047 --change-name=1:BIOSBootPartition --typecode=1:ef02  --set-alignment=512 --largest-new=2 --change-name=2:EFISystem --typecode=2:ef00 

# Replace version inside sd-boot with something older. See magic[] string in systemd src/boot/efi/boot.c machine.succeed( """ <del> find /boot -iname '*.efi' -print0 |  </del> <ins> find /boot -iname '*boot*.efi' -print0 |  </ins> xargs -0 -I '{}' sed -i 's/#### LoaderInfo: systemd-boot .* ####/#### LoaderInfo: systemd-boot 000.0-1-notnixos ####/' '{}' """ ) output = machine.succeed("/run/current-system/bin/switch-to-configuration boot") <del> assert "updating systemd-boot from (000.0-1-notnixos) to " in output </del> <ins> assert "updating systemd-boot from 000.0-1-notnixos to " in output </ins> ''; };