Add kernel-update reconcile hook and lifecycle commands

Author: GlitchSlayed

README.md

@@ -212,6 +212,22 @@ sudo rustyuki install
 sudo rustyuki install --kernel-version "6.12.0-200.fc41.x86_64"
 ```
 
+#### `reconcile` — Rebuild all installed kernel UKIs and prune stale artifacts
+
+Rebuilds UKIs for every kernel reported by `rpm -q kernel`, prunes stale `linux-*.efi` entries in the output directory, and runs `bootctl update`.
+
+```bash
+sudo rustyuki reconcile
+```
+
+#### `install-hook` — Run reconcile automatically on kernel updates
+
+Installs a `kernel-install` plugin so `rustyuki reconcile` runs on kernel add/remove events.
+
+```bash
+sudo rustyuki install-hook
+```
+
 ---
 
 ## Example Workflow

src/app.rs

@@ -151,6 +151,31 @@ pub fn install(
     Ok(path)
 }
 
+/// Rebuilds UKIs for all installed kernels and prunes stale artifacts.
+pub fn reconcile(
+    runner: &dyn CommandRunner,
+    cfg: &AppConfig,
+    base: &GenerateSettings,
+) -> Result<()> {
+    let kernels = list_installed_kernels(runner)?;
+    for kernel in &kernels {
+        let mut settings = base.clone();
+        settings.kernel_version = kernel.clone();
+        let _ = generate(runner, cfg, &settings)?;
+    }
+
+    let removed = prune_stale_uki_artifacts(&base.output_dir, &kernels)?;
+    if !removed.is_empty() {
+        info!("Pruned {} stale UKI artifact(s)", removed.len());
+    }
+
+    runner
+        .run("bootctl", &["update"])
+        .context("bootctl update failed")?;
+
+    Ok(())
+}
+
 /// Reports current status and resolved paths.
 pub fn status(runner: &dyn CommandRunner, cfg: &AppConfig) -> Result<String> {
     let uname = runner

src/cli.rs

@@ -28,6 +28,10 @@ pub enum Commands {
     Generate(GenerateArgs),
     /// Generate UKI and run bootloader update/install step.
     Install(GenerateArgs),
+    /// Reconcile UKIs for all installed kernels and prune stale artifacts.
+    Reconcile,
+    /// Install kernel-install hook so reconcile runs on kernel updates.
+    InstallHook(InstallHookArgs),
     /// Show current operational status and resolved settings.
     Status,
 }
@@ -54,3 +58,15 @@ pub struct GenerateArgs {
     #[arg(long)]
     pub os_release: Option<PathBuf>,
 }
+
+/// Options for installing the kernel-install hook.
+#[derive(Debug, Clone, Parser)]
+pub struct InstallHookArgs {
+    /// Destination path for the kernel-install plugin script.
+    #[arg(long, default_value = "/usr/lib/kernel/install.d/90-rustyuki.install")]
+    pub plugin_path: PathBuf,
+
+    /// Optional explicit path to the rustyuki binary to invoke from the hook.
+    #[arg(long)]
+    pub binary_path: Option<PathBuf>,
+}

src/config.rs

@@ -136,7 +136,10 @@ extra_args = []
 extra_args = []
 "#;
         let cfg: AppConfig = toml::from_str(content).unwrap_or_else(|e| panic!("{e}"));
-        assert_eq!(cfg.uki.cmdline_state_dir, std::path::PathBuf::from("/var/lib/uki-build"));
+        assert_eq!(
+            cfg.uki.cmdline_state_dir,
+            std::path::PathBuf::from("/var/lib/uki-build")
+        );
         assert_eq!(cfg.uki.cmdline_min_tokens, 3);
     }
 }

src/hook.rs

@@ -0,0 +1,90 @@
+use anyhow::{Context, Result};
+use std::fs;
+use std::os::unix::fs::PermissionsExt;
+use std::path::Path;
+
+pub fn install_kernel_update_hook(binary: &Path, config: &Path, plugin_path: &Path) -> Result<()> {
+    let parent = plugin_path.parent().with_context(|| {
+        format!(
+            "kernel-install plugin path has no parent: {}",
+            plugin_path.display()
+        )
+    })?;
+    fs::create_dir_all(parent)
+        .with_context(|| format!("failed creating plugin directory {}", parent.display()))?;
+
+    let script = render_kernel_install_plugin(binary, config)?;
+    fs::write(plugin_path, script)
+        .with_context(|| format!("failed writing plugin {}", plugin_path.display()))?;
+
+    let mut perms = fs::metadata(plugin_path)
+        .with_context(|| format!("failed stat {}", plugin_path.display()))?
+        .permissions();
+    perms.set_mode(0o755);
+    fs::set_permissions(plugin_path, perms)
+        .with_context(|| format!("failed chmod +x {}", plugin_path.display()))?;
+
+    Ok(())
+}
+
+pub fn render_kernel_install_plugin(binary: &Path, config: &Path) -> Result<String> {
+    let bin = binary
+        .to_str()
+        .with_context(|| format!("binary path is non-UTF8: {}", binary.display()))?;
+    let cfg = config
+        .to_str()
+        .with_context(|| format!("config path is non-UTF8: {}", config.display()))?;
+
+    Ok(format!(
+        r#"#!/usr/bin/env bash
+set -euo pipefail
+
+COMMAND="${{1:-}}"
+KERNEL_VER="${{2:-unknown}}"
+RUSTYUKI_BIN="{bin}"
+RUSTYUKI_CONFIG="{cfg}"
+
+log() {{
+  echo "[rustyuki-hook] $*" >&2
+}}
+
+if [[ ! -x "$RUSTYUKI_BIN" ]]; then
+  log "RustyUKI binary not executable: $RUSTYUKI_BIN"
+  exit 1
+fi
+
+case "$COMMAND" in
+  add)
+    log "kernel add: $KERNEL_VER; reconciling all installed kernels"
+    ;;
+  remove)
+    log "kernel remove: $KERNEL_VER; reconciling all installed kernels"
+    ;;
+  *)
+    log "kernel command '$COMMAND'; running reconcile"
+    ;;
+esac
+
+exec "$RUSTYUKI_BIN" --config "$RUSTYUKI_CONFIG" reconcile
+"#
+    ))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::render_kernel_install_plugin;
+    use std::path::Path;
+
+    #[test]
+    fn plugin_contains_reconcile_and_config() {
+        let script = render_kernel_install_plugin(
+            Path::new("/usr/local/bin/rustyuki"),
+            Path::new("/etc/uki/uki.conf"),
+        )
+        .unwrap_or_else(|e| panic!("{e}"));
+
+        assert!(script.contains("reconcile"));
+        assert!(script.contains("--config \"$RUSTYUKI_CONFIG\""));
+        assert!(script.contains("KERNEL_VER"));
+    }
+}

src/main.rs

@@ -7,17 +7,19 @@ mod config;
 mod dracut;
 mod efi;
 mod error;
+mod hook;
 mod kernel;
 mod privilege;
 mod ukify;
 
 use anyhow::{Context, Result};
-use app::{generate, install, resolve_generate_settings, status};
+use app::{generate, install, reconcile, resolve_generate_settings, status};
 use clap::Parser;
 use cli::{Cli, Commands};
 use cmd::{CommandRunner, RealCommandRunner};
 use config::AppConfig;
 use env_logger::Env;
+use hook::install_kernel_update_hook;
 use log::LevelFilter;
 use privilege::require_root;
 
@@ -60,6 +62,33 @@ fn run() -> Result<()> {
             let settings = resolve_generate_settings(&cfg, args, &uname);
             let _ = install(&runner, &cfg, &settings)?;
         }
+        Commands::Reconcile => {
+            let uname = current_kernel(&runner)?;
+            let settings = resolve_generate_settings(
+                &cfg,
+                &cli::GenerateArgs {
+                    kernel_version: Some(uname),
+                    esp_path: None,
+                    output_dir: None,
+                    cmdline_file: None,
+                    splash: None,
+                    os_release: None,
+                },
+                "",
+            );
+            reconcile(&runner, &cfg, &settings)?;
+        }
+        Commands::InstallHook(args) => {
+            let binary = args.binary_path.clone().unwrap_or_else(|| {
+                std::env::current_exe()
+                    .unwrap_or_else(|_| std::path::PathBuf::from("/usr/local/bin/rustyuki"))
+            });
+            install_kernel_update_hook(&binary, &cli.config, &args.plugin_path)?;
+            println!(
+                "installed kernel-install hook at {}",
+                args.plugin_path.display()
+            );
+        }
         Commands::Status => {
             let text = status(&runner, &cfg)?;
             println!("{text}");