composefs: Keep the legacy composefs= karg in BLS entries

[cgwalters-bot]

Since ba10fb1 made V1 the default, BLS entries carry only composefs.digest=v1-sha512-12:<digest>. The initramfs from bootc 1.16.x (e.g. the current centos-bootc:stream10, bootc 1.16.13) has ConditionKernelCommandLine=composefs on bootc-root-setup.service, so with that entry the unit never starts and switch-root fails into the emergency shell. That broke coreos/bootupd's composefs e2e job, which updates bootc in the stream10 image without regenerating the initramfs (job); the same happens on bootc switch from a current host to any image that still ships bootc 1.16, which is a consistent image, not a stale initramfs. No release is affected yet (1.16.14 predates ba10fb1).

This writes composefs=<digest> after composefs.digest= in BLS entries, with the same V1 digest. That differs from the dual-format UKI (V2 digest under bare composefs=) and from composefs-rs's docs, which call bare composefs= the V2 alias; the docs now say so. The reason is that an initramfs reading only composefs= also derives state/deploy/<digest> from it. Current parsers try composefs.digest= first, and 1.16.4 through 1.16.14 already put V1 digests under composefs=. UKIs are unchanged: their kargs come from the image's own bootc. The legacy karg can go once 1.16.x images are out of support.

Alternatives, if you'd rather not keep the legacy karg:

• Refuse or warn at install/switch when the target's initramfs lacks the composefs.digest condition (probe the unit via lsinitrd, or key off the image's bootc version). That turns the brick into an error, but the switch still doesn't work.
• Treat it as unsupported per "keeping an old initramfs with a newer bootc is not supported", and fix bootupd's CI to regenerate the initramfs after updating bootc. That covers bootupd's job but not bootc switch to a 1.16 image.
• Use the V2 digest under composefs=, matching ukify. That should work for 1.16.3+ initramfs (which prefer composefs.digest=). For 1.16.0-1.16.2, which only read composefs=, reading the source suggests they would look for state/deploy/<v2 digest> and fail; I haven't tested those versions, with either choice.

Tested on a 16-core devspace (composefs, grub, ext4, BLS):

• Repro, bootupd-style: centos-bootc:stream10 (bootc 1.16.13 initramfs) with /usr/bin/bootc replaced, installed with bcvk libvirt run --composefs-backend. With main (8f348ae) bootc the cmdline has only composefs.digest=... and boot ends in "Failed to start initrd-switch-root.service" / emergency mode; with this PR's bootc it boots with composefs root. Unmodified main image boots (control).
• New tmt test test-56-composefs-legacy-initramfs (switch to an image whose initramfs has the 1.16 unit condition, reboot): passes on this PR; against the main image it fails with a guest reboot timeout, the console showing the same switch-root failure.
• just validate and just unit-tests passed on the current head; tmt readonly, rollback, soft-reboot, soft-reboot-selinux-policy, composefs-gc and composefs-gc-uki passed on the previous revision (code unchanged since, only docs, comments and the test number).

Related: bootc-dev#2248

Generated-by: https://github.com/cgwalters/#llms

---

Review draft in cgwalters-forge, not upstream yet. This section is removed when the PR is opened upstream.

• Upstream: bootc-dev/bootc, base main
• Board item: PVTI_lAHOAQ_SPs4Bj2Gizg825vk
• Fork CI: off; the devspace testing described above is this PR's CI, and upstream CI runs once it is opened there

To review:

• Approve, or comment /promote on a line of its own, to open it upstream, ready for review. Either covers only the commits pushed so far.
• If upstream requires DCO, approving also signs off: promote adds Signed-off-by: Colin Walters <walters@verbum.org> to the commits lacking it (the bot's and yours; anyone else's only if you ask), with you as committer.
• Add a /draft line (in the same comment or before) to open it upstream as a draft (/ready undoes that).
• Close to drop it.
• Edit the title and description freely: they become the upstream PR's. Review comments are squashed into the commits they concern, with a reply here.

_{Bot run: session 929c7a64, agent ab54e08b · claude-opus-5-5 22.8M in (90% cached) / 77k out · ~$16.77 inference + ~$5.21 compute (est., list prices) · 3h 15m wall · 33.1 core-h, Actions runs 36215352573, 36206873173}

[cgwalters]

Treat it as unsupported per "keeping an old initramfs with a newer bootc is not supported", and fix bootupd's CI to regenerate the initramfs after updating bootc.

Yes, this for now.

[cgwalters-bot]

Done: bootupd CI now regenerates the initramfs after installing bootc from copr, in cgwalters-forge/bootupd#2 (composefs UEFI boot on stream10 passes there and fails on bootupd main). Closing this one as superseded.

Generated-by: https://github.com/cgwalters/#llms