fix: fail UKI build when bootloader config is missing

Fail the UKI builds when none of the packages provided a systemd-boot
configuration.

Add integration test to validate the error.

Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

Author: arnaldo2792

twoliter/embedded/imghelper

@@ -742,19 +742,18 @@ provide_certs() {
 # `*.efi` glob used to copy the loader binaries does not pick it up, so it needs
 # its own directory and copy here.
 #
-# A missing configuration file is not fatal: systemd-boot falls back to its
-# compiled-in defaults, which still boot the image. Warn instead of failing the
-# whole image build, since the rest of the ESP is intact.
+# A missing configuration file is treated as a build error: the file is
+# expected to be present whenever this function is called, so a missing file
+# indicates a packaging problem rather than an intentionally absent config.
 provide_loader_config() {
   local efi_image efi_mount loader_config
   efi_image="${1:?}"
   efi_mount="${2:?}"
   loader_config="${efi_mount}/loader/loader.conf"
 
   if [[ ! -f "${loader_config}" ]]; then
-    echo "no systemd-boot configuration found at ${loader_config}," \
-      "so systemd-boot will use its compiled-in defaults" >&2
-    return 0
+    echo "no systemd-boot configuration found at ${loader_config}" >&2
+    exit 1
   fi
 
   mmd -i "${efi_image}" ::/loader

twoliter/embedded/tests/test_provide_loader_config.sh

@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+#
+# Test `provide_loader_config` in `imghelper`:
+#
+#   When `loader/loader.conf` is missing from the ESP staging mount, the
+#   function must fail hard (non-zero exit) with an actionable error naming
+#   the searched path, instead of silently continuing with systemd-boot's
+#   compiled-in defaults.
+#
+# Run from the repo root:
+#   bash twoliter/embedded/tests/test_provide_loader_config.sh
+
+set -eu -o pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+EMBEDDED_DIR="${SCRIPT_DIR}/.."
+IMGHELPER="${EMBEDDED_DIR}/imghelper"
+
+if [[ ! -f "${IMGHELPER}" ]]; then
+  echo "test_provide_loader_config: required file not found: ${IMGHELPER}" >&2
+  exit 1
+fi
+
+pass_count=0
+fail_count=0
+
+pass() { pass_count=$((pass_count + 1)); echo "  ok: $1"; }
+fail() { fail_count=$((fail_count + 1)); echo "  FAIL: $1" >&2; }
+
+tmp=$(mktemp -d)
+trap 'rm -rf "${tmp}"' EXIT
+
+# ---------------------------------------------------------------------------
+# Test: missing loader.conf fails hard with an actionable message that
+# names the searched path.
+# ---------------------------------------------------------------------------
+efi_mount="${tmp}/efi_mount"
+mkdir -p "${efi_mount}"
+efi_image="${tmp}/efi.img"
+loader_config="${efi_mount}/loader/loader.conf"
+
+out=$(
+  VERSION_ID=x BUILD_ID=x IMAGE_NAME=x VARIANT=x ARCH=x86_64 \
+  bash -c "
+    set -eu -o pipefail
+    . '${IMGHELPER}'
+    provide_loader_config '${efi_image}' '${efi_mount}'
+  " 2>&1
+) && rc=0 || rc=$?
+
+if [[ "${rc}" -eq 0 ]]; then
+  fail "provide_loader_config should fail when loader.conf is missing, got exit 0"
+elif [[ "${out}" != *"${loader_config}"* ]]; then
+  fail "error message should name the searched path '${loader_config}'; got: ${out}"
+else
+  pass "provide_loader_config fails hard and names the searched path when loader.conf is missing"
+fi
+
+echo
+echo "test_provide_loader_config: ${pass_count} passed, ${fail_count} failed"
+[[ "${fail_count}" -eq 0 ]]

twoliter/src/tool-crates/embedded-bundle/tests/provide_loader_config.rs

@@ -0,0 +1,51 @@
+//! Integration test that runs the bash-side `provide_loader_config` test
+//! suite.
+//!
+//! The actual assertions live in
+//! `embedded/tests/test_provide_loader_config.sh`, which exercises:
+//!
+//! * `provide_loader_config` (defined in `imghelper`) fails hard with an
+//!   actionable error naming the searched `loader/loader.conf` path when
+//!   the systemd-boot loader configuration is missing from the ESP
+//!   staging mount, instead of silently continuing with systemd-boot's
+//!   compiled-in defaults.
+//!
+//! This Rust wrapper exists so the bash tests run under `cargo test`
+//! alongside the other embedded-bundle and buildsys tests.
+
+use std::path::PathBuf;
+use std::process::Command;
+
+#[test]
+fn provide_loader_config_bash_tests() {
+    // The `embedded` directory is a symlink to `twoliter/embedded` at the
+    // crate root, so `CARGO_MANIFEST_DIR` reaches the script either way.
+    let manifest_dir = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
+    let script = manifest_dir.join("embedded/tests/test_provide_loader_config.sh");
+
+    assert!(
+        script.is_file(),
+        "test_provide_loader_config.sh not found at {}",
+        script.display(),
+    );
+
+    let output = Command::new("bash")
+        .arg(&script)
+        .output()
+        .expect("failed to invoke bash");
+
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    let stderr = String::from_utf8_lossy(&output.stderr);
+
+    // Always print so failures show what the bash runner saw.
+    println!("--- test_provide_loader_config.sh stdout ---\n{stdout}");
+    if !stderr.is_empty() {
+        println!("--- test_provide_loader_config.sh stderr ---\n{stderr}");
+    }
+
+    assert!(
+        output.status.success(),
+        "test_provide_loader_config.sh failed with status {:?}",
+        output.status,
+    );
+}