Skip to content

acl/docs: docs on A/B update behavior - #65

Draft
Paco Huelsz (frhuelsz) wants to merge 1 commit into
user/bfjelds/ab-verity-partuuid-uki-addons-20260708from
frhuelsz/acl-customizing-docs
Draft

acl/docs: docs on A/B update behavior#65
Paco Huelsz (frhuelsz) wants to merge 1 commit into
user/bfjelds/ab-verity-partuuid-uki-addons-20260708from
frhuelsz/acl-customizing-docs

Conversation

@frhuelsz

Copy link
Copy Markdown

Adds acl/docs/customizing.md, a guide to the customization options available on ACL nodes and what an A/B update does to each.

There is currently no documentation on using or extending ACL — acl/docs/ covers the build system and internals. This fills that gap.

Contents

  • How ACL is structured: partition layout, read-only integrity-protected /usr, no package manager, /etc as an overlay.
  • What an A/B update replaces (the inactive OS slot and the signed boot artifacts) and what it carries across unchanged (ROOT, /var, the writable layer of /etc, /oem).
  • A decision flow for selecting an approach, then four options in detail: use the image as shipped, system extensions, the writable filesystem, and rebuilding the image.
  • For each option: scope of change, update behavior, and requirements.

Why this targets the ABUpdate branch

The guide describes the A/B layout introduced in #28 rather than what is on aclmain today:

Described On aclmain
256 MiB ESP 192 MiB
Per-slot verity hash partitions (HASH-A / HASH-B) Inline verity within USR
Trident installed and enabled as the on-node update agent Not in the package catalog
Slot selected by a signed UKI addon Slot PARTUUID baked into the main UKI cmdline

Basing this on aclmain would mean publishing a description of a layout that does not exist yet, so it targets user/bfjelds/ab-verity-partuuid-uki-addons-20260708 and should merge with or after #28.

Notes

  • Draft until feat: enable ABUpdate for UKI-based ACL images #28 settles, since the layout it documents is still under review there.
  • Also adds the entry to the acl/docs/README.md index, under Operational Guides.
  • Some overlap with architecture.md (partition layout, dm-verity, /etc overlay) and sysexts.md (extension mechanics) is intentional: this guide covers them from an update-behavior angle for a reader deciding how to customize. Happy to trim toward cross-references if reviewers prefer.

@bfjelds
bfjelds (bfjelds) force-pushed the user/bfjelds/ab-verity-partuuid-uki-addons-20260708 branch from 8a450f2 to 1f48808 Compare September 9, 2026 18:23
Adds acl/docs/customizing.md, describing how ACL is structured, what an
A/B update replaces, and the four customization options available today
(image as shipped, system extensions, the writable filesystem, and
rebuilding the image), together with what an update does to each.

Targets the ABUpdate branch because the guide describes the A/B layout
introduced there: the per-slot verity hash partitions, Trident as the
on-node update agent, and slot selection via a signed UKI addon rather
than a slot-specific kernel command line.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Paco <frhuelsz@microsoft.com>
@frhuelsz
Paco Huelsz (frhuelsz) force-pushed the frhuelsz/acl-customizing-docs branch from 493bd7b to b9eb282 Compare September 10, 2026 17:54
@frhuelsz Paco Huelsz (frhuelsz) changed the title acl/docs: add guide for customizing ACL and A/B update behavior acl/docs: add guidance on A/B update behavior Sep 10, 2026
@frhuelsz Paco Huelsz (frhuelsz) changed the title acl/docs: add guidance on A/B update behavior acl/docs: docs on A/B update behavior Sep 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant