feat: replace rollback_trigger with next-deployment-id for GRUB fallback detection

Replace the boolean `greenboot_rollback_trigger` GRUB variable with
`greenboot_next_deployment_id`, which stores the staged deployment's
ID (imageDigest for bootc, checksum for rpm-ostree). This serves a
dual purpose: it acts as the rollback trigger and enables GRUB-level
kernel fallback detection by comparing the stored ID against the
actually booted deployment.

Key changes:
- grub.rs: replace set/get/unset_rollback_trigger with
  set/get/unset_next_deployment_id using new string-valued GRUB
  variable helpers (set_grub_str_var, get_grub_str_var)
- handler.rs: add get_booted_deployment_id and get_staged_deployment_id
  to query deployment IDs from bootc or rpm-ostree; add force flag to
  handle_rollback to bypass boot_counter checks when making a GRUB
  fallback permanent
- main.rs: add detect_grub_fallback() which compares stored vs booted
  deployment ID; on mismatch, make fallback permanent via forced
  rollback and clear next_deployment_id to prevent rollback loops;
  SetRollbackTrigger now queries the staged deployment ID and sets
  both next_deployment_id and fallback independently

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: say-paul

src/lib/grub.rs

@@ -82,25 +82,6 @@ fn unset_boot_counter_at(grub_path: &str) -> Result<()> {
     unset_grub_var("boot_counter", grub_path)
 }
 
-/// sets greenboot_rollback_trigger=1 and fallback=1
-pub fn set_rollback_trigger() -> Result<()> {
-    set_rollback_trigger_at(GRUB_PATH)
-}
-
-fn set_rollback_trigger_at(grub_path: &str) -> Result<()> {
-    set_grub_var("greenboot_rollback_trigger", 1, grub_path)?;
-    set_grub_var("fallback", 1, grub_path)
-}
-
-/// unsets greenboot_rollback_trigger
-pub fn unset_rollback_trigger() -> Result<()> {
-    unset_rollback_trigger_at(GRUB_PATH)
-}
-
-fn unset_rollback_trigger_at(grub_path: &str) -> Result<()> {
-    unset_grub_var("greenboot_rollback_trigger", grub_path)
-}
-
 /// sets fallback=1 for GRUB-level kernel fallback protection
 pub fn set_fallback() -> Result<()> {
     set_fallback_at(GRUB_PATH)
@@ -128,13 +109,31 @@ fn get_fallback_at(grub_path: &str) -> Result<bool> {
     get_grub_bool_var("fallback", grub_path)
 }
 
-/// gets greenboot_rollback_trigger value, returns true if set to 1
-pub fn get_rollback_trigger() -> Result<bool> {
-    get_rollback_trigger_at(GRUB_PATH)
+/// sets greenboot_next_deployment_id to the given deployment ID string
+pub fn set_next_deployment_id(id: &str) -> Result<()> {
+    set_next_deployment_id_at(id, GRUB_PATH)
 }
 
-fn get_rollback_trigger_at(grub_path: &str) -> Result<bool> {
-    get_grub_bool_var("greenboot_rollback_trigger", grub_path)
+fn set_next_deployment_id_at(id: &str, grub_path: &str) -> Result<()> {
+    set_grub_str_var("greenboot_next_deployment_id", id, grub_path)
+}
+
+/// unsets greenboot_next_deployment_id
+pub fn unset_next_deployment_id() -> Result<()> {
+    unset_next_deployment_id_at(GRUB_PATH)
+}
+
+fn unset_next_deployment_id_at(grub_path: &str) -> Result<()> {
+    unset_grub_var("greenboot_next_deployment_id", grub_path)
+}
+
+/// returns the stored deployment ID, or None if not set
+pub fn get_next_deployment_id() -> Result<Option<String>> {
+    get_next_deployment_id_at(GRUB_PATH)
+}
+
+fn get_next_deployment_id_at(grub_path: &str) -> Result<Option<String>> {
+    get_grub_str_var("greenboot_next_deployment_id", grub_path)
 }
 
 fn get_grub_bool_var(key: &str, grub_path: &str) -> Result<bool> {
@@ -187,12 +186,45 @@ fn set_grub_var(key: &str, val: u16, grub_path: &str) -> Result<()> {
     Ok(())
 }
 
+fn set_grub_str_var(key: &str, val: &str, grub_path: &str) -> Result<()> {
+    let grub_result = Command::new("grub2-editenv")
+        .arg(grub_path)
+        .arg("set")
+        .arg(format!("{key}={val}"))
+        .status()
+        .context("Unable to set grubenv")?;
+
+    if !grub_result.success() {
+        bail!("Failed to set grubenv key: {key}");
+    }
+
+    log::info!("Set grubenv: {key}={val}");
+    Ok(())
+}
+
+fn get_grub_str_var(key: &str, grub_path: &str) -> Result<Option<String>> {
+    let grub_vars = Command::new("grub2-editenv")
+        .arg(grub_path)
+        .arg("list")
+        .output()
+        .context(format!("Unable to list grubenv variables for key: {key}"))?;
+
+    let prefix = format!("{key}=");
+    let output = String::from_utf8_lossy(&grub_vars.stdout);
+    for line in output.lines() {
+        if let Some(value) = line.strip_prefix(&prefix) {
+            return Ok(Some(value.to_string()));
+        }
+    }
+    Ok(None)
+}
+
 #[cfg(test)]
 mod tests {
     use super::{
-        get_boot_counter_at, get_fallback_at, get_rollback_trigger_at, set_boot_counter_at,
-        set_fallback_at, set_rollback_trigger_at, unset_boot_counter_at, unset_fallback_at,
-        unset_rollback_trigger_at,
+        get_boot_counter_at, get_fallback_at, get_next_deployment_id_at, set_boot_counter_at,
+        set_fallback_at, set_next_deployment_id_at, unset_boot_counter_at, unset_fallback_at,
+        unset_next_deployment_id_at,
     };
     use anyhow::Context;
     use std::fs;
@@ -266,41 +298,66 @@ mod tests {
     }
 
     #[test]
-    fn test_rollback_trigger_functions() {
+    fn test_next_deployment_id_set_and_get() {
         let (_temp_dir, grubenv) = setup_test_paths();
 
-        assert!(!get_rollback_trigger_at(&grubenv).unwrap());
-        assert!(!get_fallback_at(&grubenv).unwrap());
+        assert_eq!(get_next_deployment_id_at(&grubenv).unwrap(), None);
 
-        set_rollback_trigger_at(&grubenv).unwrap();
-        assert!(get_rollback_trigger_at(&grubenv).unwrap());
-        assert!(get_fallback_at(&grubenv).unwrap());
+        let id = "sha256:abc123def456";
+        set_next_deployment_id_at(id, &grubenv).unwrap();
+        assert_eq!(
+            get_next_deployment_id_at(&grubenv).unwrap(),
+            Some(id.to_string())
+        );
+    }
 
-        // unset_rollback_trigger only clears the trigger, not fallback
-        unset_rollback_trigger_at(&grubenv).unwrap();
-        assert!(!get_rollback_trigger_at(&grubenv).unwrap());
-        assert!(get_fallback_at(&grubenv).unwrap());
+    #[test]
+    fn test_next_deployment_id_unset() {
+        let (_temp_dir, grubenv) = setup_test_paths();
 
-        // fallback has its own lifecycle, unset independently
-        unset_fallback_at(&grubenv).unwrap();
-        assert!(!get_fallback_at(&grubenv).unwrap());
+        let id = "sha256:abc123def456";
+        set_next_deployment_id_at(id, &grubenv).unwrap();
+        assert!(get_next_deployment_id_at(&grubenv).unwrap().is_some());
+
+        unset_next_deployment_id_at(&grubenv).unwrap();
+        assert_eq!(get_next_deployment_id_at(&grubenv).unwrap(), None);
     }
 
     #[test]
-    fn test_rollback_trigger_with_other_vars() {
+    fn test_next_deployment_id_coexists_with_boot_counter() {
         let (_temp_dir, grubenv) = setup_test_paths();
 
+        let id = "sha256:abc123def456";
         set_boot_counter_at(3, &grubenv).unwrap();
-        set_rollback_trigger_at(&grubenv).unwrap();
+        set_next_deployment_id_at(id, &grubenv).unwrap();
 
         assert_eq!(get_boot_counter_at(&grubenv).unwrap(), Some(3));
-        assert!(get_rollback_trigger_at(&grubenv).unwrap());
-        assert!(get_fallback_at(&grubenv).unwrap());
+        assert_eq!(
+            get_next_deployment_id_at(&grubenv).unwrap(),
+            Some(id.to_string())
+        );
 
-        // unset_rollback_trigger leaves boot_counter and fallback intact
-        unset_rollback_trigger_at(&grubenv).unwrap();
+        unset_next_deployment_id_at(&grubenv).unwrap();
         assert_eq!(get_boot_counter_at(&grubenv).unwrap(), Some(3));
-        assert!(!get_rollback_trigger_at(&grubenv).unwrap());
+        assert_eq!(get_next_deployment_id_at(&grubenv).unwrap(), None);
+    }
+
+    #[test]
+    fn test_next_deployment_id_coexists_with_fallback() {
+        let (_temp_dir, grubenv) = setup_test_paths();
+
+        let id = "sha256:abc123def456";
+        set_next_deployment_id_at(id, &grubenv).unwrap();
+        set_fallback_at(&grubenv).unwrap();
+
+        assert_eq!(
+            get_next_deployment_id_at(&grubenv).unwrap(),
+            Some(id.to_string())
+        );
+        assert!(get_fallback_at(&grubenv).unwrap());
+
+        unset_next_deployment_id_at(&grubenv).unwrap();
+        assert_eq!(get_next_deployment_id_at(&grubenv).unwrap(), None);
         assert!(get_fallback_at(&grubenv).unwrap());
     }
 
@@ -333,36 +390,30 @@ mod tests {
         assert!(!get_fallback_at(&grubenv).unwrap());
     }
 
-    #[test]
-    fn test_fallback_set_via_rollback_trigger() {
-        let (_temp_dir, grubenv) = setup_test_paths();
-
-        set_rollback_trigger_at(&grubenv).unwrap();
-        assert!(get_fallback_at(&grubenv).unwrap());
-        assert!(get_rollback_trigger_at(&grubenv).unwrap());
-    }
-
     #[test]
     fn test_fallback_coexists_with_boot_counter() {
         let (_temp_dir, grubenv) = setup_test_paths();
 
         set_boot_counter_at(3, &grubenv).unwrap();
-        set_rollback_trigger_at(&grubenv).unwrap();
+        set_fallback_at(&grubenv).unwrap();
 
         assert_eq!(get_boot_counter_at(&grubenv).unwrap(), Some(3));
         assert!(get_fallback_at(&grubenv).unwrap());
-        assert!(get_rollback_trigger_at(&grubenv).unwrap());
     }
 
     #[test]
-    fn test_fallback_independent_unset() {
+    fn test_fallback_independent_of_deployment_id() {
         let (_temp_dir, grubenv) = setup_test_paths();
 
-        set_rollback_trigger_at(&grubenv).unwrap();
+        let id = "sha256:abc123def456";
+        set_next_deployment_id_at(id, &grubenv).unwrap();
+        set_fallback_at(&grubenv).unwrap();
+
+        unset_next_deployment_id_at(&grubenv).unwrap();
+        assert_eq!(get_next_deployment_id_at(&grubenv).unwrap(), None);
         assert!(get_fallback_at(&grubenv).unwrap());
 
         unset_fallback_at(&grubenv).unwrap();
         assert!(!get_fallback_at(&grubenv).unwrap());
-        assert!(get_rollback_trigger_at(&grubenv).unwrap());
     }
 }

src/lib/handler.rs

@@ -52,6 +52,78 @@ pub fn detect_os_deployment() -> Option<&'static str> {
     }
 }
 
+/// Returns the deployment ID of the currently booted deployment, or None
+/// if not on an ostree-based system or if the query fails.
+pub fn get_booted_deployment_id() -> Option<String> {
+    match detect_os_deployment() {
+        Some("bootc") => get_bootc_deployment_id("booted"),
+        Some("rpm-ostree") => get_rpm_ostree_deployment_id("booted"),
+        _ => None,
+    }
+}
+
+/// Returns the deployment ID of the staged (pending) deployment, or None
+/// if not on an ostree-based system or if no deployment is staged.
+pub fn get_staged_deployment_id() -> Option<String> {
+    match detect_os_deployment() {
+        Some("bootc") => get_bootc_deployment_id("staged"),
+        Some("rpm-ostree") => get_rpm_ostree_deployment_id("staged"),
+        _ => None,
+    }
+}
+
+fn get_bootc_deployment_id(key: &str) -> Option<String> {
+    let mut args = vec!["status", "--json"];
+    if key == "booted" {
+        args.insert(1, "--booted");
+    }
+
+    let output = Command::new("bootc").args(&args).output().ok()?;
+
+    if !output.status.success() {
+        log::warn!("Error parsing bootc status");
+        return None;
+    }
+
+    let json: Value = serde_json::from_slice(&output.stdout).ok()?;
+
+    json.get("status")
+        .and_then(|s| s.get(key))
+        .and_then(|d| d.get("image"))
+        .and_then(|i| i.get("imageDigest"))
+        .and_then(|d| d.as_str())
+        .map(|s| s.to_string())
+}
+
+fn get_rpm_ostree_deployment_id(key: &str) -> Option<String> {
+    let output = Command::new("rpm-ostree")
+        .args(["status", "--json"])
+        .output()
+        .ok()?;
+
+    if !output.status.success() {
+        log::warn!("Error parsing rpmostree status");
+        return None;
+    }
+
+    let json: Value = serde_json::from_slice(&output.stdout).ok()?;
+    let deployments = json.get("deployments")?.as_array()?;
+
+    for deployment in deployments {
+        if deployment
+            .get(key)
+            .and_then(|v| v.as_bool())
+            .unwrap_or(false)
+        {
+            return deployment
+                .get("checksum")
+                .and_then(|c| c.as_str())
+                .map(|s| s.to_string());
+        }
+    }
+    None
+}
+
 /// reboots the system if boot_counter is greater than 0 or can be forced too
 pub fn handle_reboot(force: bool) -> Result<()> {
     if !force {
@@ -66,39 +138,44 @@ pub fn handle_reboot(force: bool) -> Result<()> {
 }
 
 /// Rollback to the previous deployment if the boot counter allows.
-pub fn handle_rollback() -> Result<()> {
-    let boot_counter = get_boot_counter()?;
+/// When `force` is true, bypass the boot_counter check entirely
+/// (used when GRUB kernel fallback is detected and rollback must be made permanent).
+pub fn handle_rollback(force: bool) -> Result<()> {
+    if !force {
+        let boot_counter = get_boot_counter()?;
 
-    match boot_counter {
-        // Exit early if boot_counter is not set
-        None => {
-            bail!("System is unhealthy but boot_counter is not set, manual intervention required")
-        }
-        // Proceed with rollback if boot_counter is <= 0
-        Some(counter) if counter <= 0 => {
-            log::info!("Greenboot will now attempt to rollback to a previous deployment.");
-            if let Some(deployment_cmd) = detect_os_deployment() {
-                log::info!("Deployment manager '{deployment_cmd}' detected, attempting rollback.");
-                let status = Command::new(deployment_cmd)
-                    .arg("rollback")
-                    .status()
-                    .context(format!("Failed to execute '{deployment_cmd} rollback'"))?;
-
-                if !status.success() {
-                    bail!(
-                        "Rollback with '{}' failed with status: {}",
-                        deployment_cmd,
-                        status
-                    );
-                }
-            } else {
-                bail!("Rollback only supported in bootc or rpm-ostree environment.");
+        match boot_counter {
+            None => {
+                bail!(
+                    "System is unhealthy but boot_counter is not set, manual intervention required"
+                )
+            }
+            Some(counter) if counter > 0 => {
+                bail!("Rollback not initiated as boot_counter is {}", counter)
             }
-            Ok(())
+            _ => {}
         }
-        // Reject if boot_counter is > 0
-        Some(counter) => bail!("Rollback not initiated as boot_counter is {}", counter),
     }
+
+    log::info!("Greenboot will now attempt to rollback to a previous deployment.");
+    if let Some(deployment_cmd) = detect_os_deployment() {
+        log::info!("Deployment manager '{deployment_cmd}' detected, attempting rollback.");
+        let status = Command::new(deployment_cmd)
+            .arg("rollback")
+            .status()
+            .context(format!("Failed to execute '{deployment_cmd} rollback'"))?;
+
+        if !status.success() {
+            bail!(
+                "Rollback with '{}' failed with status: {}",
+                deployment_cmd,
+                status
+            );
+        }
+    } else {
+        bail!("Rollback only supported in bootc or rpm-ostree environment.");
+    }
+    Ok(())
 }
 
 /// writes greenboot status to motd.d/boot-status