Comin changes not persistent with impermanence / secureboot

[MysterOak]

When trying to integrate comin into my config I noticed that all of the changes comin made, reverted on reboot. Persisting "/var/lib/comin" didn't fix the issue. What does one need to persist in order to make comin compatible with impermanence?

The "flavour" of impermanence in use here is zfs root with rollback to empty snapshot on boot. (as described in: erase your darlings)

In use are also nh and lanzaboote, both seem to not have any issues with comin as far as I can tell.

[MysterOak]

To clarify: Comin works perfectly apart from that. Approx. 3min after boot the git state applies, but reverts to prev state on reboot.

[MysterOak]

After trying my config on a different system the problem might as well be with secureboot, as that system uses the same impermanence, but no secureboot. On said system, the issue seems to not exist.

[nlewo]

I think this could be related to the way boot entries are created in grub (i don't know well secure boot).

Maybe there is something which is not enough here:

comin/internal/executor/utils.go

Line 147 in 648d71f

if profilePath, err = profile.SetSystemProfile(operation, outPath, false); err != nil {

You could take a look at the nixos-rebuild implementation to see if it does something more regarding secure boot.

[MysterOak]

NixOS secureboot using Lanzaboote is systemd-boot only. I am familiar with neither the exact implementation of nixos-rebuild, nor the inner workings of comin, but I might take a look if the problem persists.

Interestingly enough it seems as if comin runs the rebuild in a way that triggers Lanzaboote (which is why I thought they didnt clash)... I am not exactly sure where the pipeline fails. Thank you anyway.