Comin changes not persistent with impermanence / secureboot

[MysterOak]

When trying to integrate comin into my config I noticed that all of the changes comin made, reverted on reboot. Persisting "/var/lib/comin" didn't fix the issue. What does one need to persist in order to make comin compatible with impermanence?

The "flavour" of impermanence in use here is zfs root with rollback to empty snapshot on boot. (as described in: erase your darlings)

In use are also nh and lanzaboote, both seem to not have any issues with comin as far as I can tell.

[MysterOak]

To clarify: Comin works perfectly apart from that. Approx. 3min after boot the git state applies, but reverts to prev state on reboot.

[MysterOak]

After trying my config on a different system the problem might as well be with secureboot, as that system uses the same impermanence, but no secureboot. On said system, the issue seems to not exist.

[nlewo]

I think this could be related to the way boot entries are created in grub (i don't know well secure boot).

Maybe there is something which is not enough here:

comin/internal/executor/utils.go

Line 147 in 648d71f

if profilePath, err = profile.SetSystemProfile(operation, outPath, false); err != nil {

You could take a look at the nixos-rebuild implementation to see if it does something more regarding secure boot.

[MysterOak]

NixOS secureboot using Lanzaboote is systemd-boot only. I am familiar with neither the exact implementation of nixos-rebuild, nor the inner workings of comin, but I might take a look if the problem persists.

Interestingly enough it seems as if comin runs the rebuild in a way that triggers Lanzaboote (which is why I thought they didnt clash)... I am not exactly sure where the pipeline fails. Thank you anyway.

[diamondburned]

it seems like the boot entry is not changed at all.

$ comin status
...
  Deployer
    Deployment succeeded 20 minutes ago
    Operation switch
    ProfilePath /nix/var/nix/profiles/system-profiles/comin-76-link
    Generation 15f2b225-24a2-43ab-81ee-f9a8913f9cb8
    ...
    Outpath /nix/store/vr2qnmrfgk2g1mxsgd6d9zk0y2blfpiq-nixos-system-dma-dreamflasher-rev-751eaec-26.05.20251130.2d293cb

$ bootctl status
...
Default Boot Loader Entry:
         type: Boot Loader Specification Type #2 (UKI, .efi)
        title: NixOS Yarara 26.05.20251130.2d293cb (Linux 6.12.59) (Generation 30, 2026-01-19)
           id: nixos-generation-30-mhxl7rdikh2pvfzciys6foui5xn6wnmcvmbuflkya7ophhxpebxq.efi
       source: /boot//EFI/Linux/nixos-generation-30-mhxl7rdikh2pvfzciys6foui5xn6wnmcvmbuflkya7ophhxpebxq.efi (on the EFI System Partition)
     sort-key: lanza
      version: Generation 30, 2026-01-19
        linux: /boot//EFI/Linux/nixos-generation-30-mhxl7rdikh2pvfzciys6foui5xn6wnmcvmbuflkya7ophhxpebxq.efi
      options: init=/nix/store/4gfafpg8f37cwj6ss0v1lgglfp7vn9vi-nixos-system-dma-dreamflasher-26.05.20251130.2d293cb/init quiet splash intremap=on shell_on_fail udev.log_priority=3 rd.systemd.show_status=auto console=tty0 nohibernate root=fstab splash loglevel=4 lsm=landlock,yama,bpf

iiuc, init= should be pointing to /nix/store/vr2qn.../init, not /nix/store/4gfaf.../init.

[rv32ima]

I figured this out with the help of @diamondburned. What's happening is that lanzaboote is configured to look for new generations of the system profile and install those into systemd-boot: https://github.com/nix-community/lanzaboote/blob/7e031eb535a494582f4fc58735b5aecba7b57058/nix/modules/lanzaboote.nix#L25-L31, but comin notably doesn't use the system profile and instead uses a profile under system-profiles/comin, which results in a new profile named comin:

comin/internal/profile/profile.go

Lines 12 to 32 in 1cd5849

	const (
	systemProfiles = "/nix/var/nix/profiles/system-profiles"
	cominProfileDir = systemProfiles + "/comin"
	)
	// setSystemProfile creates a link into the directory
	// /nix/var/nix/profiles/system-profiles/comin to the built system
	// store path. This is used by the switch-to-configuration script to
	// install all entries into the bootloader.
	// Note also comin uses these links as gcroots
	// See https://github.com/nixos/nixpkgs/blob/df98ab81f908bed57c443a58ec5230f7f7de9bd3/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh#L711
	// and https://github.com/nixos/nixpkgs/blob/df98ab81f908bed57c443a58ec5230f7f7de9bd3/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py#L247
	func SetSystemProfile(operation string, outPath string, dryRun bool) (profilePath string, err error) {
	if operation == "switch" || operation == "boot" {
	err := os.MkdirAll(systemProfiles, os.ModeDir)
	if err != nil && !os.IsExist(err) {
	return profilePath, fmt.Errorf("nix: failed to create the profile directory: %s", systemProfiles)
	}
	cmdStr := fmt.Sprintf("nix-env --profile %s --set %s", cominProfileDir, outPath)
	logrus.Infof("nix: running '%s'", cmdStr)
	cmd := exec.Command("nix-env", "--profile", cominProfileDir, "--set", outPath)

... which ultimately means that the comin profile generations aren't picked up or installed by lanzaboote. I think there are two viable ways to go about this:

• comin should create new generations on the system profile and just use that
  or
• lanzaboote should be aware of the special directory for comin directories and install those generations (but it's unclear how precedence would work).

For our use-cases, I think we're just going to brute-force patch lanzaboote to use comin profile generations instead, but it's probably worth making a corresponding issue for lanzaboote.

[rv32ima]

I have a fork with our changes up: https://github.com/rv32ima/lanzaboote. With comin, we were able to fix this by using this new option like so:

  boot = {
    // ...
    lanzaboote = {
      enable = true;
      configurationLimit = 15;

      profileGlob =
        if config.services.comin.enable then
          "/nix/var/nix/profiles/system-profiles/comin-*-link"
        else
          "/nix/var/nix/profiles/system-*-link";

      # Fix bug with sbctl. See:
      # https://github.com/nix-community/lanzaboote/issues/413
      pkiBundle = "/var/lib/sbctl";
    };
  };

[nlewo]

There is an issue about that in lanzaboote: nix-community/lanzaboote#135 (comment) and someone proposed a patch to properly fix this in lanzaboote!

If some Rust dev are here, it would be nice to review the patch proposed in nix-community/lanzaboote#135 (comment).