From e8b02475857dd4486f3a45868b47919510cfab01 Mon Sep 17 00:00:00 2001 From: Craig Jennings Date: Tue, 21 Jul 2026 06:50:25 -0500 Subject: docs: close GRUB_CMDLINE merge task --- todo.org | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'todo.org') diff --git a/todo.org b/todo.org index 128bc07..dc6589d 100644 --- a/todo.org +++ b/todo.org @@ -45,7 +45,9 @@ below): input-side-spec.org (DRAFT, four decisions open). * Archsetup Open Work -** TODO [#B] Installer GRUB_CMDLINE overwrite drops boot params :bug:solo: +** DONE [#B] Installer GRUB_CMDLINE overwrite drops boot params :bug:solo: +CLOSED: [2026-07-21 Tue] +Fixed in f9da097: update_grub_cmdline merges the current value with archsetup's tokens (existing tokens survive, same-key conflicts resolve to archsetup's value) behind a refuse-to-write safety check, via awk + mv with a backup_system_file first. TDD via tests/installer-steps/test_grub_cmdline.py (8 cases incl. cryptdevice/resume/zfs survival and idempotence). Grading: Critical severity (unbootable) x some-users-sometimes (machines whose base install set a cryptdevice=/resume=/zfs= cmdline param) = P2 = [#B]. archsetup:3054 rewrites the whole GRUB_CMDLINE_LINUX_DEFAULT line with a fixed string; nothing re-adds a pre-existing cryptdevice/resume/zfs token, so grub-mkconfig (3059) can bake an unbootable config. Fix: read the current value and append only the missing tokens; assert any pre-existing boot-critical token survives before grub-mkconfig. See [[file:docs/design/2026-07-19-sentry-code-findings.org][sentry code findings]] (S3). ** TODO [#B] Audit cgit-published repos for secrets and privacy :bug:security: -- cgit v1.2.3