fix(grub,keyring): auto-apply GRUB font via a boot service; fix two helper bugs (#172)

Two bugs surfaced running the new recipes on a real (candidate.20260616) host:

1) `ujust margine-grub-hidpi` failed: `bootupctl backend install
   --with-static-configs` refuses once installed ("invalid re-install
   attempted: /boot/bootupd-state.json already exists"). bootupd has NO
   supported re-render command. Replace it with bootupd's own composition —
   `cat grub-static-pre.cfg configs.d/*.cfg > /boot/grub2/grub.cfg` — guarded
   by grub2-script-check + blscfg/font sanity + a backup + atomic write, and
   made idempotent (no-op when grub.cfg/font already match). Validated off-boot:
   the render passes grub2-script-check and carries blscfg + margine.pf2.

2) `ujust margine-keyring` (default `status`) printed correctly but exited 1:
   `[[ -n "$bak" ]] && echo` trips `set -e` when no backup exists. Use an `if`.

Also — answer "shouldn't this just be in the image?": the GRUB config/font ARE
baked, but the bootloader on /boot is per-install and NOT updated by image
upgrades. So make it AUTOMATIC instead of a manual ujust: add
margine-grub-hidpi.service (oneshot, enabled via multi-user.target.wants) that
runs the idempotent script at boot — the baked GRUB config now lands on /boot
after an update with no manual step. The ujust recipe stays as a force/inspect
helper. (Keyring stays opt-in by design: per-user $HOME state, encrypted with
the login password, and a security-reducing choice that needs consent.)

Layer A: assert the service ships AND is enabled (the .wants symlink).

Author: daniel-g-carrasco

.github/scripts/validate-image-rootfs.sh

@@ -85,6 +85,11 @@ GRUB_GFX="usr/lib/bootupd/grub2-static/configs.d/05_margine-gfxmode.cfg"
 check_file "$GRUB_GFX" "A.4.gfx"
 check_nonempty "usr/lib/bootupd/grub2-static/fonts/margine.pf2" "A.4.gfx"
 check_exec "usr/libexec/margine/grub-hidpi-apply" "A.4.gfx"
+# The re-render runs automatically at boot (the bootloader on /boot isn't
+# updated by image upgrades) — assert the service ships AND is enabled.
+check_file "usr/lib/systemd/system/margine-grub-hidpi.service" "A.4.gfx"
+test -L "$ROOTFS/usr/lib/systemd/system/multi-user.target.wants/margine-grub-hidpi.service" \
+  || { echo "::error::A.4.gfx margine-grub-hidpi.service is not enabled (multi-user.target.wants symlink missing) — GRUB font won't auto-apply"; fail=1; }
 grep -q 'loadfont .*margine\.pf2' "$ROOTFS/$GRUB_GFX" 2>/dev/null \
   || { echo "::error::A.4.gfx GRUB drop-in does not loadfont the baked margine.pf2 — menu stays tiny on HiDPI"; fail=1; }
 grep -q '^[[:space:]]*set gfxterm_font=' "$ROOTFS/$GRUB_GFX" 2>/dev/null \

build_files/60-custom.just

@@ -664,7 +664,7 @@ margine-autologin ACTION="status" USER="":
 margine-tpm-unlock ACTION="status" PCRS="7":
     sudo /usr/bin/margine-tpm-unlock {{ ACTION }} {{ PCRS }}
 
-# Make the GRUB boot menu legible on HiDPI panels: copy the baked large font onto /boot and re-render /boot/grub2/grub.cfg from the image. Run ONCE after `ujust margine-update`, then reboot. (An upgrade alone does NOT re-render the bootloader config — bootupd only does that at install time, so new font/gfx settings never reach /boot otherwise.)
+# Force/inspect the HiDPI GRUB font + grub.cfg render NOW. Normally you don't need this: margine-grub-hidpi.service applies it automatically at boot whenever the image's baked GRUB config changes (the bootloader on /boot isn't updated by image upgrades, so a boot-time service closes the gap). Run this only to apply it immediately after an update instead of waiting for the next reboot. Safe + idempotent (grub2-script-check + backup; no-op when already current).
 [group('Margine')]
 margine-grub-hidpi:
     @sudo /usr/libexec/margine/grub-hidpi-apply

build_files/system_files/usr/bin/margine-keyring

@@ -46,7 +46,10 @@ status() {
   echo "  file: $LOGIN ($(stat -c '%s bytes, mode %a' "$LOGIN" 2>/dev/null))"
   local bak
   bak="$(ls -1t "$LOGIN".margine.bak.* 2>/dev/null | head -1 || true)"
-  [[ -n "$bak" ]] && echo "  backup: $bak (restore with: ujust margine-keyring restore)"
+  # NB: plain `[[ -n "$bak" ]] && echo` would make status() exit non-zero under
+  # `set -e` when there is no backup — use an if so `ujust margine-keyring`
+  # (default action) always exits 0.
+  if [[ -n "$bak" ]]; then echo "  backup: $bak (restore with: ujust margine-keyring restore)"; fi
 }
 
 blank() {

build_files/system_files/usr/lib/systemd/system/margine-grub-hidpi.service

@@ -0,0 +1,20 @@
+[Unit]
+Description=Margine: apply the HiDPI GRUB font + re-render grub.cfg when the baked config changes
+Documentation=https://github.com/daniel-g-carrasco/margine-image
+# The bootloader lives on /boot (+ESP); bootc/bootupd only write it at install,
+# not on image upgrades. This oneshot closes that gap: it renders the image's
+# baked GRUB static config onto /boot whenever it differs (idempotent — a no-op
+# on every boot where nothing changed). Needs /boot mounted; skips itself if the
+# image ships no baked font.
+RequiresMountsFor=/boot
+ConditionPathExists=/usr/lib/bootupd/grub2-static/fonts/margine.pf2
+After=local-fs.target
+
+[Service]
+Type=oneshot
+# Idempotent + self-guarding (grub2-script-check + backup + atomic write); the
+# script no-ops unless the rendered grub.cfg/font would differ from /boot.
+ExecStart=/usr/libexec/margine/grub-hidpi-apply --quiet
+
+[Install]
+WantedBy=multi-user.target

build_files/system_files/usr/lib/systemd/system/multi-user.target.wants/margine-grub-hidpi.service

@@ -0,0 +1 @@
+../margine-grub-hidpi.service

build_files/system_files/usr/libexec/margine/grub-hidpi-apply

@@ -1,41 +1,65 @@
 #!/usr/bin/env bash
-# Make the baked HiDPI GRUB font live on an EXISTING install.
+# Apply the baked HiDPI GRUB font + render /boot/grub2/grub.cfg from the image's
+# bootupd static config. Idempotent — re-renders ONLY when the result would
+# differ from what's already on /boot.
 #
-# WHY THIS EXISTS: bootupd renders /boot/grub2/grub.cfg from the image's
-# /usr/lib/bootupd/grub2-static/{grub-static-pre.cfg,configs.d/*,grub-static-
-# efi.cfg} ONLY at OS install time (or `migrate-static-grub-config`). A normal
-# `bootc upgrade` / `rpm-ostree upgrade` does NOT re-render it, and `bootupctl
-# update` only refreshes the EFI binaries — neither rewrites grub.cfg nor
-# copies the font to /boot. So a new font / drop-in shipped in the image never
-# reaches the boot partition until this runs. Fresh installs pick it up at
-# install; existing installs run this once (via `ujust margine-grub-hidpi`).
+# Runs AUTOMATICALLY at boot via margine-grub-hidpi.service (so a new baked
+# GRUB config lands after an image update with no manual step) and on demand
+# via `ujust margine-grub-hidpi`.
 #
-# Idempotent. Reversible: the font/config live in the image (rpm-ostree
-# rollback reverts the rootfs side); re-running this re-renders from whatever
-# image is currently deployed.
+# WHY a per-install step exists at all: the OS image is immutable, but the
+# BOOTLOADER lives on /boot (+ the ESP), which bootc/bootupd write at INSTALL
+# time and do NOT update on `rpm-ostree upgrade` / `bootc upgrade` (bootupd
+# update refreshes only the EFI binaries, never re-renders grub.cfg). So the
+# baked grub.cfg/font never reach /boot on an upgrade by themselves. There is
+# no supported bootupd re-render command — `bootupctl backend install` refuses
+# once /boot/bootupd-state.json exists. So we replicate bootupd's own
+# composition (grub-static-pre.cfg + configs.d/*.cfg, glob-sorted), guarded by
+# grub2-script-check + a backup + atomic write so it can never leave an
+# unbootable grub.cfg.
 set -euo pipefail
 
+QUIET=0; [[ "${1:-}" == "--quiet" ]] && QUIET=1
+say() { [[ "$QUIET" -eq 1 ]] || printf '%s\n' "$*"; }
+
 [[ "$(id -u)" -eq 0 ]] || { echo "ERROR: must run as root (use: ujust margine-grub-hidpi)"; exit 1; }
 
-FONT_SRC=/usr/lib/bootupd/grub2-static/fonts/margine.pf2
-if [[ ! -f "$FONT_SRC" ]]; then
-  echo "ERROR: baked GRUB font missing ($FONT_SRC)."
-  echo "       This deployment predates the HiDPI GRUB font — run 'ujust margine-update' first."
-  exit 1
+SRC=/usr/lib/bootupd/grub2-static
+FONT_SRC="$SRC/fonts/margine.pf2"
+FONT_DST=/boot/grub2/fonts/margine.pf2
+CFG=/boot/grub2/grub.cfg
+
+# Image without the baked font (e.g. rolled back below #168) → nothing to do.
+[[ -f "$FONT_SRC" ]] || { say "no baked GRUB font in this image — nothing to do"; exit 0; }
+# Need the static parts + a /boot/grub2 (skip quietly on odd layouts).
+[[ -f "$SRC/grub-static-pre.cfg" && -d "$SRC/configs.d" && -d /boot/grub2 ]] \
+  || { say "bootupd static config or /boot/grub2 not present — skipping"; exit 0; }
+
+# Render exactly as bootupd does for /boot/grub2/grub.cfg: pre + configs.d/*
+# (the shell glob sorts the same way bootupd does). The ESP's
+# grub-static-efi.cfg has no font logic, so we never touch it.
+tmp="$(mktemp)"; trap 'rm -f "$tmp"' EXIT
+cat "$SRC/grub-static-pre.cfg" "$SRC"/configs.d/*.cfg > "$tmp"
+
+# Idempotent fast path (the common case every boot): font already on /boot and
+# grub.cfg already equals the render → nothing to do.
+if [[ -f "$FONT_DST" ]] && cmp -s "$FONT_SRC" "$FONT_DST" && cmp -s "$tmp" "$CFG"; then
+  say "GRUB HiDPI font + grub.cfg already current — nothing to do"
+  exit 0
 fi
 
-# 1) Put the font on /boot, where GRUB ($prefix=/boot/grub2) can loadfont it.
-#    bootupd renders grub.cfg but does NOT ship this font, so copy it ourselves.
-echo "Installing $FONT_SRC -> /boot/grub2/fonts/margine.pf2"
-mkdir -p /boot/grub2/fonts
-install -m0644 "$FONT_SRC" /boot/grub2/fonts/margine.pf2
-
-# 2) Re-render /boot/grub2/grub.cfg (+ the ESP's grub-static-efi.cfg) from the
-#    current image's static drop-ins. `backend install --with-static-configs`
-#    is the only bootupd path that re-applies configs.d/* after install;
-#    --filesystem /boot lets bootupd discover the backing ESP(s). DEST_ROOT=/
-#    is the running system; src-root defaults to /.
-echo "Re-rendering /boot/grub2/grub.cfg from the image static config..."
-/usr/bin/bootupctl backend install --with-static-configs --filesystem /boot /
-
-echo "Done. Reboot to see the larger boot menu:  systemctl reboot"
+# Safety gate: never install a grub.cfg that fails syntax or is missing the
+# load-bearing pieces (BLS menu import + our font).
+grub2-script-check "$tmp" || { echo "ERROR: rendered grub.cfg failed grub2-script-check — refusing to install"; exit 1; }
+grep -q 'blscfg'      "$tmp" || { echo "ERROR: rendered grub.cfg lacks blscfg (no menu entries) — refusing"; exit 1; }
+grep -q 'margine.pf2' "$tmp" || { echo "ERROR: rendered grub.cfg lacks the margine font — refusing"; exit 1; }
+
+# 1) Font onto /boot (GRUB $prefix=/boot/grub2 at boot).
+install -D -m0644 "$FONT_SRC" "$FONT_DST"
+say "installed $FONT_DST"
+
+# 2) grub.cfg: back up the current one, then atomically replace.
+[[ -f "$CFG" ]] && cp -a "$CFG" "$CFG.margine.bak"
+install -m0644 "$tmp" "$CFG"
+say "re-rendered $CFG (backup: $CFG.margine.bak)"
+say "Done. The larger boot menu shows on the NEXT reboot."