introducing etc-fixater

meant to enable us to lock the etc to its erofs such that rollbacks are
using the same etc

build.sh

@@ -80,6 +80,9 @@ pacman --sync --refresh --refresh --noconfirm
 # Make sure permissions are sound
 ./permission-fix.sh
 
+export PATH="$HOME/.cargo/bin:$PATH"
+cargo install just
+
 cargo build --release --manifest-path btrfs-migrator/Cargo.toml
 cp -v btrfs-migrator/target/release/btrfs-migrator mkosi.extra/usr/lib/
 
@@ -91,6 +94,10 @@ rm --recursive --force etc-factory
 git clone https://invent.kde.org/kde-linux/etc-factory
 DESTDIR=$PWD/mkosi.extra make --directory=etc-factory install
 
+rm --recursive --force etc-fixater
+git clone https://invent.kde.org/sitter/etc-fixater
+DESTDIR=$PWD/mkosi.extra just --justfile etc-fixater/Justfile --working-directory etc-fixater install
+
 # Extract the KDE packages pipeline output into mkosi.extra so kde-builder built files
 # are baked directly into the image instead of going through the package repo.
 curl --fail https://storage.kde.org/kde-linux-packages/testing/artifacts/install.tar.zst \

mkosi.extra/usr/lib/initcpio/install/systemd-extension

@@ -22,7 +22,8 @@ build() {
         systemd-loop@.service \
         systemd-volatile-root.service \
         systemd-bootchart.service \
-        etc-factory.service
+        etc-factory.service \
+        initrd-etc-fixater.service
 
     # Make double sure the dissection rule is present. Without it booting doesn't work because we can't find a root.
     # Notably not getting added by the release initcpio combined with aur systemd-git at the time of writing.

mkosi.extra/usr/lib/systemd/system-generators/kde-linux-mount-generator

@@ -68,6 +68,47 @@ EOF
     mkdir "$late_dir/sysroot.mount.wants/" || true
     ln -s ../sysroot-system.mount "$late_dir/sysroot.mount.wants/sysroot-system.mount"
 
+    # The etc in /sysetc/etc (mind that this executes at the same time as the /usr stuff below, but before sysexts and confext!)
+    cat <<- EOF > "$normal_dir/sysetc-etc.mount"
+# Generated by $(basename "$0")
+
+[Unit]
+Before=initrd-usr-fs.target initrd-parse-etc.service
+# Run the fixater first, it ensure we'll have a etc_* to work with. fixater is not required because it doesn't necessarily run if our dir already exists
+Wants=initrd-etc-fixater.service
+After=initrd-etc-fixater.service
+After=sysroot-system.mount
+After=blockdev@dev-gpt\x2dauto\x2droot.target
+# This is at least created by etc-fixater
+AssertPathExists=/sysroot/system/etc_${IMAGE_VERSION}
+
+[Mount]
+What=/dev/gpt-auto-root
+Where=/sysetc/etc
+# no noexec because there are silly scripts in /etc
+Options=rw,nodev,nosuid,exec,subvol=/etc_${IMAGE_VERSION},compress=zstd:-4
+EOF
+
+    mkdir "$normal_dir/initrd-root-fs.target.requires/" || true
+    ln -s ../sysetc-etc.mount "$normal_dir/initrd-root-fs.target.requires/sysetc-etc.mount"
+
+    # The etc bound from /sysetc/etc to /sysroot/etc (this mimics systemd's generator behavior for /usr)
+    cat <<- EOF > "$normal_dir/sysroot-etc.mount"
+# Generated by $(basename "$0")
+
+[Unit]
+Before=initrd-usr-fs.target initrd-parse-etc.service
+After=sysetc-etc.mount
+
+[Mount]
+What=/sysetc/etc
+Where=/sysroot/etc
+Options=bind
+EOF
+
+    mkdir "$normal_dir/initrd-root-fs.target.requires/" || true
+    ln -s ../sysroot-etc.mount "$normal_dir/initrd-root-fs.target.requires/sysroot-etc.mount"
+
     # The usr in /sysusr/usr
     cat <<- EOF > "$normal_dir/sysusr-usr.mount"
 # Generated by $(basename "$0")

mkosi.extra/usr/lib/systemd/system-preset/00-kde-linux.preset

@@ -37,6 +37,7 @@ enable switcheroo-control.service
 
 # KDE-Linux-specific stuff
 # also one of ours but not prefixed with kde-linux- so others can use it too
+enable etc-fixater.path
 enable kde-linux-bootloader-visibility.service
 enable kde-linux-btrfs.service
 enable kde-linux-configure-firefox.path