feat: Systemd one-shot service for Kernel fallback mechanism

debian/nullboot-fallback.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=Ammend boot loader on successful kernel upgrades for TPM-backed FDE instances
+
+# Runs after basic system initialization and local filesystems are mounted.
+# This ensures a stable environment before proceeding to higher-level services.
+After=sysinit.target local-fs.target
+
+[Service]
+Type=oneshot
+
+# If BootCurrent is the latest kernel, update BootOrder
+# Also ensures a bad kernel is not reset to BootNext if a boot was unsuccessful
+ExecStart=/usr/bin/nullbootctl -no-boot-next
+
+[Install]
+WantedBy=multi-user.target

debian/nullboot.postinst

@@ -1,9 +1,11 @@
 #!/bin/sh
 set -e
-if [ "$1" = "triggered" ] || [ "$1" = "configure" ]; then
-    if [ -e "/boot/efi/EFI/ubuntu/" ]; then
-        nullbootctl
-    fi
+if [ "$1" = "configure" ] && [ -e "/boot/efi/EFI/ubuntu/" ]; then
+    systemctl enable nullboot-fallback.service
+    nullbootctl
+fi
+if [ "$1" = "triggered" ] && [ -e "/boot/efi/EFI/ubuntu/" ]; then
+    nullbootctl
 fi
 
 #DEBHELPER#

debian/rules

@@ -27,6 +27,9 @@ override_dh_gencontrol:
 	dh_gencontrol -- -Vshim-signed:Version=$(SHIM_SIGNED_VERSION)
 
 override_dh_auto_install:
+	mkdir -p debian/nullboot/etc/systemd/system
+	cp debian/nullboot-fallback.service debian/nullboot/etc/systemd/system/
+	chmod +x debian/nullboot/etc/systemd/system/nullboot-fallback.service
 	mkdir -p debian/nullboot/usr/lib/nullboot/shim
 	cp $(SHIM_DIR)/shim*.signed $(SHIM_DIR)/fb*.efi $(SHIM_DIR)/mm*.efi debian/nullboot/usr/lib/nullboot/shim
 	dh_auto_install -- --no-source