The edition package lists installed BOTH grub-pc and grub-efi-amd64
(+ shim-signed). Those provide the same bootloader role and conflict in
apt, so every rootfs build failed with "unable to correct problems, you
have held broken packages".
A rootfs now carries exactly ONE bootloader, chosen by the BOOT variable
(mirroring the existing --boot bios|efi deploy option):
- versions.mk / common.sh: BOOT := bios (bios -> grub-pc,
efi -> grub-efi-amd64 + shim-signed + mokutil), exported via the
Makefile.
- build-rootfs.sh validates BOOT early and injects the matching boot
packages into the apt install; the static package lists no longer
contain any grub package.
- deploy-disk.sh / build-image.sh / install.sh default --boot from the
same BOOT variable, so a rootfs and the artifact deployed from it can
never disagree (BOOT=efi make image-cloud produces a UEFI image).
- mokutil is now installed explicitly in the efi flavour (it was not
pulled in because we install with --no-install-recommends).
- docs updated (building.md knob + rationale, secureboot.md note).
Define the three flagship editions as plain-text manifests:
- server (bastion): production server - observability stack, containers.
- workstation (forge): curated KDE Plasma + dev toolchains.
- cloud (nimbus): cloud kernel, cloud-init, guest agents.
Each manifest carries metadata (services to enable/mask), a package
list, a hardened kernel cmdline, and a btrfs fstab template.
