uki-addons: GC Global UKI Addons

Similar to how we GC UKIs and scoped UKI Addons, GC Global UKI addons if
we have no EROFS images remaining that hold a reference to them, which
means that the deployments that depended on the Global addons have been
removed

Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

Author: Johan-Liebert1

crates/lib/src/bootc_composefs/gc.rs

@@ -17,6 +17,11 @@ use ostree_ext::composefs_oci::linked_erofs_images;
 use rustix::fs::AtFlags;
 use rustix::fs::{statat, unlinkat};
 
+use crate::bootc_composefs::boot::GLOBAL_UKI_ADDONS_DIR;
+use crate::bootc_composefs::boot::get_global_uki_addon_name;
+use crate::bootc_composefs::uki_addon::UkiAddonType;
+use crate::bootc_composefs::uki_addon::list_installed_uki_addons;
+use crate::bootc_composefs::uki_addon::list_referenced_uki_addons;
 use crate::{
     bootc_composefs::{
         boot::{BOOTC_UKI_DIR, BootType, get_type1_dir_name, get_uki_addon_dir_name, get_uki_name},
@@ -142,9 +147,6 @@ fn delete_kernel_initrd(storage: &Storage, dir_to_delete: &str, dry_run: bool) -
 fn delete_uki(storage: &Storage, uki_id: &str, dry_run: bool) -> Result<()> {
     let esp_mnt = storage.require_esp()?;
 
-    // NOTE: We don't delete global addons here (see `GLOBAL_UKI_ADDONS_DIR`)
-    // Which is fine as global addons don't belong to any single deployment, but it also
-    // means they're never cleaned up at all: see the TODO on `GLOBAL_UKI_ADDONS_DIR`.
     let uki_dir = esp_mnt.fd.open_dir(BOOTC_UKI_DIR)?;
 
     for entry in uki_dir.entries_utf8()? {
@@ -291,7 +293,7 @@ pub(crate) async fn composefs_gc(
         )
     }
 
-    for (ty, verity) in unreferenced_boot_binaries {
+    for (ty, verity) in &unreferenced_boot_binaries {
         match ty {
             BootType::Bls => {
                 delete_kernel_initrd(storage, &get_type1_dir_name(verity), gc_opts.dry_run)?
@@ -300,6 +302,55 @@ pub(crate) async fn composefs_gc(
         }
     }
 
+    // Remove unreferenced global UKI Addons
+    let currently_referenced_addons = list_referenced_uki_addons(booted_cfs, &bootloader_entries)?;
+    let currently_installed_addons = list_installed_uki_addons(storage)?;
+    let mut unreferenced_global_addons = vec![];
+
+    tracing::debug!("currently_referenced_addons: {currently_referenced_addons:#?}");
+    tracing::debug!("currently_installed_addons: {currently_installed_addons:#?}");
+
+    for installed_addon in &currently_installed_addons {
+        // We handle scoped UKI Addons along with the UKI itself
+        if installed_addon.addon_type != UkiAddonType::Global {
+            continue;
+        }
+
+        let is_referenced = currently_referenced_addons.iter().any(|(_, refs)| {
+            refs.iter().any(|r| {
+                r.addon_type == installed_addon.addon_type && r.name == installed_addon.name
+            })
+        });
+
+        if !is_referenced {
+            unreferenced_global_addons.push(installed_addon.name.clone());
+        }
+    }
+
+    tracing::debug!("Unreferenced Global Addons: {unreferenced_global_addons:?}");
+
+    if !unreferenced_global_addons.is_empty() {
+        let global_uki_dir = storage
+            .require_esp()?
+            .fd
+            .open_dir(GLOBAL_UKI_ADDONS_DIR)
+            .context("Opening global UKI Addons dir")?;
+
+        for addon in &unreferenced_global_addons {
+            let global_addon_name = get_global_uki_addon_name(&addon);
+
+            tracing::debug!("Deleting Global UKI Addon: {}", addon);
+
+            if gc_opts.dry_run {
+                continue;
+            }
+
+            global_uki_dir
+                .remove_file(&global_addon_name)
+                .with_context(|| format!("Removing global addon {global_addon_name}"))?;
+        }
+    }
+
     if !gc_opts.prune_repo {
         return Ok(GcResult::default());
     }

crates/lib/src/bootc_composefs/uki_addon.rs

@@ -163,10 +163,15 @@ pub fn list_installed_uki_addons(storage: &Storage) -> Result<Vec<UkiAddonsList>
             .context("Gathering global addons")?;
     };
 
-    for ent in esp
+    let Some(bootc_uki_dir) = esp
         .fd
-        .open_dir(BOOTC_UKI_DIR)
+        .open_dir_optional(BOOTC_UKI_DIR)
         .context("Opening UKI dir")?
+    else {
+        return Ok(addons);
+    };
+
+    for ent in bootc_uki_dir
         .entries_utf8()
         .context("Reading UKI dir entries")?
     {

tmt/tests/booted/test-composefs-gc-uki.nu

@@ -33,13 +33,15 @@ def first_boot [] {
     let addon_cmds = "
       mkdir -p /out/${kver}.efi.extra.d
       ukify build --cmdline 'gc_test=1' --output /out/${kver}.efi.extra.d/gc-test.addon.efi
+      mkdir -p /out/loader/addons
+      ukify build --cmdline 'gc_test=global' --output /out/loader/addons/gc-test-global.addon.efi
     "
 
     $containerfile = (tap make_uki_containerfile $containerfile --addon-cmds $addon_cmds)
 
     echo $containerfile | podman build -t localhost/bootc-first . -f -
 
-    bootc switch --transport containers-storage --uki-addon gc-test localhost/bootc-first
+    bootc switch --transport containers-storage --uki-addon gc-test --global-uki-addon gc-test-global localhost/bootc-first
 
     # Make sure we have the .boot EROFS
     let st = bootc status --json | from json
@@ -141,6 +143,10 @@ def fourth_boot [] {
     let boot1_addon_dir = $"/var/tmp/efi/EFI/Linux/bootc/($uki_prefix)(cat /var/boot1-verity).efi.extra.d"
     assert (not ($boot1_addon_dir | path exists))
 
+    # The global addon should also be gone
+    let global_addon = $"/var/tmp/efi/EFI/loader/addons/bootc_composefs-gc-test-global.addon.efi"
+    assert (not ($global_addon | path exists))
+
     mut containerfile = "
         FROM localhost/bootc as base
         RUN echo 'another file' > /usr/share/another-one