feat(installer): adopt Flatcar's EFI-SYSTEM/USR-A/USR-B/ROOT partition layout

docs/skills/ddi-installer-build.md

@@ -131,7 +131,7 @@ The release process is driven by `.github/workflows/build.yml`:
 - [ ] The live installer does not bake hardcoded SSH keys or pre-hashed root
       passwords.
 - [ ] The DDI is decompressed after the cpio step.
-- [ ] `files/installer/repart.d/20-root-a.conf` has `GrowFileSystem=yes`.
+- [ ] `files/installer/repart.d/50-root.conf` has `GrowFileSystem=yes`.
 
 ## See also
 

docs/skills/ddi-installer.md

@@ -17,7 +17,7 @@ metadata:
 - Writing or refining `systemd-repart`, `bootctl`, or `ukify` configurations.
 - Packaging or publishing DDI assets to GitHub Releases.
 - Managing partition recipes for the target disk layout (`10-esp.conf`,
-  `20-root-a.conf`, `30-var.conf`).
+  `20-usr-a.conf`, `30-usr-b.conf`, `40-oem.conf`, `50-root.conf`).
 
 ## When NOT to Use
 
@@ -72,8 +72,9 @@ container runtime pod sandboxes.
 5. `systemd-sysinstall` reads partition recipes from
    `/usr/lib/repart.sysinstall.d/` if it is populated; otherwise it falls back
    to `/usr/lib/repart.d/`. The target recipes are staged at
-   `/usr/lib/repart.d/` (`10-esp.conf`, `20-root-a.conf`, `30-var.conf`).
-6. `20-root-a.conf` copies the DDI block-for-block from
+   `/usr/lib/repart.d/` (`10-esp.conf`, `20-usr-a.conf`, `30-usr-b.conf`,
+   `40-oem.conf`, `50-root.conf`).
+6. `20-usr-a.conf` copies the DDI block-for-block from
    `/dev/disk/by-partlabel/bluefin-installer-data` (the embedded DDI data
    partition on the installer media).
 7. Target OS volume expansion is handled by `systemd-growfs`; the target OS
@@ -93,9 +94,11 @@ container runtime pod sandboxes.
 
 | Partition | Type | Size | Contents |
 |---|---|---|---|
-| ESP | vfat | 500 MiB – 1 GiB | `systemd-boot` + target OS UKI (`bluefin-server.efi`) |
-| `bluefin-server-root-a` | XFS | 4 GiB – 16 GiB | OS root filesystem (copied from installer data partition) |
-| `var` | XFS | ≥ 4 GiB | Writable persistent `/var`; grows to fill remaining disk |
+| EFI-SYSTEM | vfat | 500 MiB – 1 GiB | `systemd-boot` + target OS UKI |
+| USR-A | Flatcar `usr` (5dfbf5f4-…) | ≥ 4 GiB | read-only `/usr` (DDI copied block-for-block from installer data partition) |
+| USR-B | Flatcar `usr` (5dfbf5f4-…) | ≥ 4 GiB | empty A/B rollback slot |
+| OEM | ext4 | 1 GiB | provider/first-boot state; filesystem label `OEM` |
+| ROOT | Flatcar `root` (3884dd41-…) | writable | writable state; grows to fill remaining disk |
 
 ## Installer Boot Flow
 
@@ -187,7 +190,7 @@ offline installation.
 - [ ] The interactive installer service sets `TTYPath=/dev/tty0` so the TUI
       appears on the attached display even when serial is the primary console.
 - [ ] `bluefin-server-installer.bst` decompresses the DDI after the cpio step.
-- [ ] `files/installer/repart.d/20-root-a.conf` has `GrowFileSystem=yes`.
+- [ ] `files/installer/repart.d/50-root.conf` has `GrowFileSystem=yes`.
 
 ## See also
 

docs/skills/gap-analysis-distros.md

@@ -95,7 +95,7 @@ Bluefin Server is a BuildStream 2-based, image-based Linux server OS built from
 | Axis | Bluefin Server (as-implemented) |
 |------|---------------------------------|
 | **Philosophy** | Systemd-native, minimal, image-based server OS appliance; base DDI includes bash for login and bring-up while heavy developer/debug tools live in sysexts or system containers; intended to run container workloads and Kubernetes via optional sysexts. Sources: [AGENTS.md](../../AGENTS.md), [factory-integration.md](factory-integration.md). |
-| **State model** | Target OS DDI is an XFS filesystem image. A separate persistent `/var` partition is created by the installer. There is no second root slot provisioned today, and the UKI cmdline currently uses `rw`, so the root is not mounted read-only at runtime. Sources: [bluefin-server-ddi.bst](../../elements/oci/bluefin-server-ddi.bst), [20-root-a.conf](../../files/installer/repart.d/20-root-a.conf), [bluefin-server-installer.bst](../../elements/oci/bluefin-server-installer.bst). |
+| **State model** | Target OS DDI is an XFS filesystem image. A separate persistent `/var` partition is created by the installer. There is no second root slot provisioned today, and the UKI cmdline currently uses `rw`, so the root is not mounted read-only at runtime. Sources: [bluefin-server-ddi.bst](../../elements/oci/bluefin-server-ddi.bst), [20-usr-a.conf](../../files/installer/repart.d/20-usr-a.conf), [bluefin-server-installer.bst](../../elements/oci/bluefin-server-installer.bst). |
 | **Updates** | `systemd-sysupdate` reads root/UKI transfers from `files/os/sysupdate.d/` and the optional k0s transfer from the `k0s` component directory. Assets are published to GitHub Releases, and the combined `SHA256SUMS` manifest is signed in CI with a GPG key. `Verify=yes` is the default. Sources: [systemd-sysupdate-verification.md](systemd-sysupdate-verification.md), [50-root.transfer](../../files/os/sysupdate.d/50-root.transfer), [60-uki.transfer](../../files/os/sysupdate.d/60-uki.transfer), [70-k0s.transfer](../../files/os/sysupdate.k0s.d/70-k0s.transfer), also `systemd-sysupdate(8)`. |
 | **Provisioning** | The installer is an offline `systemd-sysinstall` image that embeds the DDI as a data partition. First-boot configuration is intended to be delivered via `systemd-creds` through the ESP or hypervisor metadata. Today only `passwd.hashed-password.root` is consumed via `systemd-sysusers.d`; the documented `tmpfiles.extra` path for SSH keys and similar files is not implemented. Sources: [bluefin-server-installer.bst](../../elements/oci/bluefin-server-installer.bst), [10-root-creds.conf](../../files/os/sysusers.d/10-root-creds.conf), [os-creds-prov.bst](../../elements/bluefin-server/os-creds-prov.bst), [systemd-creds(1)](https://www.freedesktop.org/software/systemd/man/latest/systemd-creds.html). |
 | **Customization** | Adds software through `systemd-sysext` (overlay `/usr`) and `systemd-confext` (overlay `/etc`) images. The base OS `os-release` advertises `ID=flatcar` and a matching `VERSION_ID` so pre-built Flatcar Bakery extensions load. k0s is shipped as a separately built, optionally enabled sysext. Sources: [systemd-sysext-extensions.md](systemd-sysext-extensions.md), [k0s-sysext.md](k0s-sysext.md), [os-release-flatcar.bst](../../elements/bluefin-server/os-release-flatcar.bst), [systemd-sysext(8)](https://www.freedesktop.org/software/systemd/man/latest/systemd-sysext.html). |
@@ -189,7 +189,7 @@ These gaps drive the priorities in [architecture-roadmap.md](architecture-roadma
 - [elements/bluefin-server/os-release-flatcar.bst](../../elements/bluefin-server/os-release-flatcar.bst)
 - [elements/bluefin-server/os-creds-prov.bst](../../elements/bluefin-server/os-creds-prov.bst)
 - [elements/bluefin-server/os-kured-hook.bst](../../elements/bluefin-server/os-kured-hook.bst)
-- [files/installer/repart.d/20-root-a.conf](../../files/installer/repart.d/20-root-a.conf)
+- [files/installer/repart.d/20-usr-a.conf](../../files/installer/repart.d/20-usr-a.conf)
 - [files/os/sysupdate.d/50-root.transfer](../../files/os/sysupdate.d/50-root.transfer)
 - [files/os/sysupdate.d/60-uki.transfer](../../files/os/sysupdate.d/60-uki.transfer)
 - [files/os/sysupdate.k0s.d/70-k0s.transfer](../../files/os/sysupdate.k0s.d/70-k0s.transfer)

elements/installer/installer-repart.bst

@@ -6,9 +6,11 @@ description: |
   to partition and populate the TARGET disk.
 
   Partition layout:
-    10-esp.conf          EFI System Partition (vfat, 500M–1G)
-    20-root-a.conf       Root slot A — DDI filesystem image copied here
-    30-var.conf          /var — xfs, writable, grows to fill disk
+    10-esp.conf          EFI-SYSTEM (vfat, 500M–1G)
+    20-usr-a.conf        USR-A — DDI /usr payload copied here block-for-block
+    30-usr-b.conf        USR-B — empty A/B rollback slot
+    40-oem.conf          OEM — ext4, filesystem label OEM (stage 2 boot dep)
+    50-root.conf         ROOT — writable state, grows to fill the disk
 
 sources:
   - kind: local

elements/oci/bluefin-server-ddi.bst

@@ -5,7 +5,7 @@ description: |
   Output: bluefin-server-ddi-<ver>.raw.zst + SHA256SUMS
 
   The output .raw is a filesystem image consumed by installer repart config:
-  files/installer/repart.d/20-root-a.conf via CopyBlocks=.
+  files/installer/repart.d/20-usr-a.conf via CopyBlocks=.
 
 build-depends:
   - base/base-stack.bst

elements/oci/bluefin-server-installer.bst

@@ -216,7 +216,7 @@ config:
         udevadm settle --timeout=10 || true
         local target="${TARGET_DISK:-}"
         if [ -z "${target}" ]; then
-          local root_part="$(readlink -f /dev/disk/by-partlabel/bluefin-server-root-a 2>/dev/null || true)"
+          local root_part="$(readlink -f /dev/disk/by-partlabel/ROOT 2>/dev/null || true)"
           if [ -n "${root_part}" ]; then
             target="$(lsblk -p -n -d -o PKNAME "${root_part}" 2>/dev/null || true)"
           fi
@@ -400,7 +400,7 @@ config:
     #   20-ddi-data.conf: Data (XFS) — bluefin-server-ddi.raw copied here block-for-block
     #
     # At install time, systemd-sysinstall mounts the data partition to
-    # locate the DDI at the path expected by repart.d/20-root-a.conf (CopyBlocks=).
+    # locate the DDI at the path expected by repart.d/20-usr-a.conf (CopyBlocks=).
     - |
       set -eux
       OUT="%{install-root}"

files/installer/repart.d/10-esp.conf

@@ -1,9 +1,11 @@
-# EFI System Partition
+# EFI System Partition — PARTLABEL EFI-SYSTEM
 # Created empty by systemd-repart; populated post-install by the installer
 # script via: bootctl install --esp-path=<mounted-ESP> --root=<mounted-root>
 # which copies systemd-boot and registers the OS UKI from the installed rootfs.
+# Type=esp sets the ESP type GUID (c12a7328-f81f-11d2-ba4b-00a0c93ec93b) verbatim.
 [Partition]
 Type=esp
 Format=vfat
+Label=EFI-SYSTEM
 SizeMinBytes=500M
 SizeMaxBytes=1G

files/installer/repart.d/20-usr-a.conf

@@ -0,0 +1,10 @@
+# /usr slot A — read-only, verity-capable (veritysetup lands in the /usr DDI ticket)
+# Type GUID: Flatcar's usr partition, 5dfbf5f4-2848-4bac-aa5e-0d9a20b745a6, verbatim.
+# systemd-repart copies the DDI /usr payload block-for-block from the embedded
+# installer data partition on the boot medium (same source the old 20-root-a.conf
+# consumed): the raw XFS DDI image stamped bluefin-installer-data.
+[Partition]
+Type=5dfbf5f4-2848-4bac-aa5e-0d9a20b745a6
+Label=USR-A
+CopyBlocks=/dev/disk/by-partlabel/bluefin-installer-data
+SizeMinBytes=4G

files/installer/repart.d/30-usr-b.conf

@@ -0,0 +1,7 @@
+# /usr slot B — the A/B rollback slot. Empty and unformatted in this ticket;
+# verity lands in the /usr DDI ticket. Same type GUID as USR-A so the kernel's
+# usr=PARTLABEL=USR-A logic recognises the pair; sized to match USR-A.
+[Partition]
+Type=5dfbf5f4-2848-4bac-aa5e-0d9a20b745a6
+Label=USR-B
+SizeMinBytes=4G

files/installer/repart.d/40-oem.conf

@@ -0,0 +1,10 @@
+# OEM partition — provider/first-boot state.
+# Required, not optional: stage 2 depends on dev-disk-by-label-OEM.device, so
+# without it the boot waits 90s and drops to an emergency shell. The dependency
+# matches on the filesystem LABEL, so Label=OEM formats the fs with that label.
+# Type GUID: Flatcar's OEM partition, 0fc63daf-8483-4772-8e79-3d69d8477de4, verbatim.
+[Partition]
+Type=0fc63daf-8483-4772-8e79-3d69d8477de4
+Format=ext4
+Label=OEM
+SizeMinBytes=1024M

files/installer/repart.d/50-root.conf

@@ -0,0 +1,11 @@
+# Root partition — writable state, the tail of the disk.
+# Type GUID: Flatcar's root partition, 3884dd41-8582-4404-b9a8-e9b84f2df50e, verbatim.
+# The kernel boots this as root (root=PARTLABEL=ROOT); GrowFileSystem=yes makes
+# it fill all space left after EFI-SYSTEM, USR-A, USR-B and OEM are placed.
+# Format= leaves the filesystem type to systemd-repart's auto-detection.
+[Partition]
+Type=3884dd41-8582-4404-b9a8-e9b84f2df50e
+Format=
+Label=ROOT
+GrowFileSystem=yes
+SizeMinBytes=4G