[JanZachmann]

Summary

Keeps behaviours of the scripted initramfs that the init did not keep, and removes a stale update validation config:

• /run is mounted with nosuid, nodev, strictatime and mode 0755.
• The links in /etc/omnect/create-fs-links.txt (one <target> <link> pair per line) are created once, then the file is deleted.
• With persistent-var-log, /var/log is /mnt/data/log, the directory of the scripted initramfs. The fsck logs are written to /mnt/data/log/fsck.
• After switch_root the initramfs files are deleted, so their RAM is freed. The delete does not cross into mounted filesystems, and the number of deleted entries is logged. When / is not a ramfs or tmpfs, the files are kept and the reason is logged.
• A factory reset restore creates missing parent directories with the owner and mode from the backup.
• The fsck logs and the flash mode logs are readable only by root: files 0600, the fsck log directory 0700. The scripted initramfs kept fsck output only in the status file, which has mode 0600.
• parted runs in script mode, and a failed parted print is an error.
• An empty bootpart_fsuuid= fails at once with a clear error instead of waiting for the timeout.
• An fsck record in the env that does not unpack or has no exit code line (the format of the scripted initramfs) is deleted instead of staying there on every later boot. The text of a record without exit code is logged first.
• On a boot without omnect_validate_update, /mnt/data/var/lib/omnect-device-service/update_validation_conf.json is deleted. A missing file is not an error, a failed delete is logged as a warning. On a validation boot the file is kept.
• tests/contract holds the status file for every factory reset result, and a test checks that the init writes exactly these files.
• docs/usage.md describes the symlinks, the removal of the update validation config, and that a failed EFI boot entry ends a flash mode with a fatal error.
• docs/usage.md and the README warn that flash mode 3 does not check TLS certificates on a machine without rtc.
• Two wrong comments are fixed: the init does not create /mnt/cert/ca and /mnt/cert/priv, and GRUB probes the boot partition of its own disk.

Reason

These are behaviours of the scripted initramfs that the init did not keep, or kept only partly. A device updated from the scripted initramfs would lose its log history and its one-time links, and run with a /run that allows suid binaries and device files. omnect/meta-omnect#697 builds the init into omnect-os and needs these fixes.

omnect-device-service writes the update validation config before the reboot into the validation boot of an update it runs itself (set_boot_partition), and removes it after a successful validation. A failed validation reboots without removing it. An ADU update does not go through omnect-device-service: the swupdate handler only sets omnect_validate_update_part and does not write the file, but the validation reads it. So after a failed local validation, the next ADU update is validated as a local one: no IoT Hub connection check, and deviceupdate-agent is not started by omnect-device-service. A config written by hand is also deleted on every boot without validation; omnect/omnect-device-service#207 adds this to the update validation docs.

The contract files close a gap that no device test can see: the status file is the interface to omnect-device-service. omnect/omnect-device-service#207 adds a copy of these files and a test that parses each one. The error-after-wipe and warning cases are built by the factory reset status code, so they hold values the init really writes.

Signed-off-by: Jan Zachmann 50990105+JanZachmann@users.noreply.github.com

[JoergZeidler]

Review of 6c8374b against the PR text, the legacy scripts (meta-omnect origin/kirkstone), the meta-omnect#697 head and omnect-device-service main. 31 inline comments, each labelled: Medium 2, Low 29 (two of them Decisions). Nothing Critical, nothing High.

Before merge

• An answer on the update_validation_conf.json removal (thread on remove_update_validation_conf): the premise is wrong, my recommendation is to drop cb91062.
• The real decode path tested (thread on BootEnv::get_fsck_status).
• The wrong statements: types.rs:16, fs_link.rs:81, usage.md:41.

The rest is Low.

Machine checks on 6c8374b

Check	Result
cargo fmt -- --check	ok
clippy -D warnings -W items_after_statements -W items_after_test_module, 12 feature sets (the README sets, persistent-var-log in two of them, core,grub,gpt,factory-reset)	0 warnings
cargo test, the same 12 sets	lib 341 / 340 / 329 / 327 / 364 / 352 / 341 / 352 / 658 / 478 / 619 / 392 passed, 0 failed
armv7 clippy -D warnings, uboot/gpt all modes + persistent-var-log	ok
cargo audit	clean

Legacy parity, verified

Claim	Legacy
/run flags	fs-mount:57 mode=0755,nodev,nosuid,strictatime
create-fs-links.txt format, third field ignored, rm after	fs-link:13-18; a failed ln/rm returned 1 → on_exit_release_image loop
/mnt/data/log	common-sh:230-231
initramfs freed	legacy image uses initramfs-framework-base, busybox switch_root deletes the old root
restore parents with owner and mode	factory-reset:146 cp --parents -av; the Rust restore runs cp -a without --parents
fsck record without exit code line	uboot-sh:34, grub-sh:53
empty bootpart_fsuuid=	PR 697 omnect.inc.in:45-46, probe --set=… then bootpart_fsuuid=${bootpart_fsuuid}
OMNECT_PART_TABLE ??= "gpt", OMNECT_EARLY_MODULES on i.MX8MM	PR 697 omnect-os-init.inc:19-20,28, phytec-imx8mm.inc:105

Body-only items

• Specs: none contradicts the PR; three statements go stale and need a dated note: 2026-07-29-legacy-env-alignment-design.md §8.1 (second reader, one case now distinguished) and §3.4 (the same reasoning as for omnect_validate_update applies to the ODS config file); 2026-05-27-first-boot-detection-design.md §2.1 "No migration logic" (the log move is a migration of its own). The flash spec §8 says nothing about the log mode, the resize spec lists parted without -s; both fine.
• Commits 3f6d564 and 814f9de: Signed-off-by without angle brackets. Three merge commits, moot with the squash.
• The contract files are an interface for ODS; the PR names no ODS PR.

Verified, no change needed

decode_fsck_output keeps a production caller under grub (get_fsck_from_file), the file is read and removed in one go. InvalidValue is built only by invalid_fsck_record. create_parent_dirs stops at rootfs or the first existing entry, the backup has every parent with its attributes. delete_contents: symlink_metadata does not follow links, the dev check skips every mount point, /proc is in the new root before /proc/self/fd/N is used, the old rootfs mount-point dir is empty after MS_MOVE; f_type as u32 is right for i32, u32 and i64; RAMFS_MAGIC matches linux/magic.h. parted -s on DOS: nothing in the extended container is mounted before the resize. The conf path matches the ODS default and the var/lib bind mount. create_root_only_file/_dir also fix an existing mode; no non-root reader of the fsck or flash logs in this repo or ODS. EFI entry failure is fatal in every flash mode, as usage.md says. Status codes 0–4 match FactoryResetStatusCode. create_link replaces a file or link and refuses a directory, as usage.md says.

Not verified

A device run of any parity item; the RAM gain and time of the initramfs free; the log move on a device coming from the legacy image; whether omnect-ui or the portal read the fsck or flash logs; the systemd /run limits against the shipped version; i686.

Signed-off-by: Joerg Zeidler 62105035+JoergZeidler@users.noreply.github.com

[JoergZeidler]

Round 2 on 58b440c. All 31 threads answered, 8 new commits, all with the full trailer.

Machine checks (all exit 0): cargo fmt -- --check; clippy (-D warnings -W clippy::items_after_statements -W clippy::items_after_test_module) and cargo test on 14 feature sets; cargo clippy --target armv7-unknown-linux-gnueabihf on uboot,dos,persistent-var-log,factory-reset,resize-data,test-utils; cargo audit clean.

Feature set (+ test-utils)	lib tests
grub,gpt / grub,dos / uboot,gpt / uboot,dos	347 / 346 / 335 / 333
grub,gpt,factory-reset / uboot,dos,factory-reset	472 / 458
grub,gpt,resize-data / uboot,dos,resize-data	370 / 359
grub,gpt,persistent-var-log / uboot,dos,persistent-var-log,factory-reset,resize-data	351 / 488
grub,gpt,release-image / uboot,dos,release-image / grub,gpt,resize-data,release-image	347 / 333 / 370
grub,gpt,early-modules	391

Update validation config: you are right, I withdraw the Medium. My claim held only for updates ODS runs itself. Checked: the ADU handlers (swupdate_handler_v2_grub.sh:824, _u-boot.sh:823) only set omnect_validate_update_part, the validation reads the file (update_validation.rs:184), and a failed validation reboots without removing it (:344). The six contract files in omnect/omnect-device-service#207 (e9488c7) are byte-identical to tests/contract, and b39fbb5 has the doc sentence.

Fixes verified (my own mutation checks on the new tests):

Thread	Commit	Check
real decode path untested	f72a389	get_fsck_env is the one path for the trait default and the GRUB arm. Reverting "does not unpack" to Ok(None): get_fsck_status_rejects_a_value_that_does_not_unpack fails
Ok(None) never cleared, silent applet failure, dropped text	f72a389	invalid + cleared, Err keeps the record with a warning, text logged before the drop, §8.1 note
tautological /run test	58b440c	const table, the loop uses it. /run without flags: test fails
log move conflict	b7f8894	<name>.old. Without the rename: migrate_var_log_moves_a_conflicting_entry_to_old fails
restore dir before lookup	be85407	order fixed. No test guards it (old order: all 8 tests pass); fine for a Low
parted print, -s untested	1f9b8dd	run_cmd returns stdout, print_args tested
statfs / read_dir / is_ram_fs / PROC_SELF_FD	2ac0b5e	done. metadata() instead of symlink_metadata() in delete_contents: two tests fail
fsck log dir 0700	58b440c	write_fsck_log creates it; without that line the test fails
contract strings	6b2e6cb	built from restore_all and restored_status; the warning shape fix is right
comments, wording, specs, usage.md	58b440c, b7f8894, 833fcb6	all done

Kept as parity: the /run size. The fs_link thread stays open for the team decision; it does not block this PR.

New, all Low, no need to hold the PR:

1. src/bootloader/mod.rs:328: the warn line writes the whole fsck text in one kmsg write. KmsgLogger::log ignores the write result, and the kernel rejects a /dev/kmsg write above the record limit (about 1 KiB, devkmsg_write; from memory of printk.c, not tested on a device). A long legacy record then logs nothing. output_tail(.., FSCK_REASON_LINES) is what fsck.rs:300 uses for the same output.
2. src/early_init.rs:13: struct EssentialMount is declared before RUN_FLAGS and ESSENTIAL_MOUNTS; the convention puts const first. The compiler does not care about the order.
3. src/filesystem/overlayfs.rs:172: the function-local MIGRATED_LOG_SUFFIX is the only local const outside tests. Your reason (dies with the function) is fair; a const in paths:: next to DATA_LOG_OLD would die with it too, as a dead-code warning. Optional.
4. 2026-07-29-legacy-env-alignment-design.md:5: one line of the new Correction is not wrapped. types.rs:21 has a short wrap.

Not verified: a device run of the parity items, the initramfs free on a board, the log move on a device coming from the scripted initramfs.

Signed-off-by: Joerg Zeidler 62105035+JoergZeidler@users.noreply.github.com