microsoft · mayankfz · Aug 17, 2026 · Aug 17, 2026
@@ -0,0 +1,24 @@
+From b5153c74f62233438a72710673c0e53e3e1af7de Mon Sep 17 00:00:00 2001
+From: Mayank Singh <mayansingh@microsoft.com>
+Date: Mon, 17 Aug 2026 00:00:00 +0000
+Subject: [PATCH] decrypt-root: fix first-boot ordering race
+
+Decrypt ROOT before initramfs waits for or mounts it. Remove the
+ignition-disks ordering that creates a first-boot cycle and can drop the
+decryption job.
+---
+ dracut/31decrypt-root/decrypt-root.service | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/dracut/31decrypt-root/decrypt-root.service b/dracut/31decrypt-root/decrypt-root.service
+index 54f941a..7702f00 100644
+--- a/dracut/31decrypt-root/decrypt-root.service
++++ b/dracut/31decrypt-root/decrypt-root.service
+@@ -7 +7 @@
+-After=systemd-networkd.service dev-disk-by\x2dpartlabel-ROOT.device ignition-disks.service
++After=systemd-networkd.service dev-disk-by\x2dpartlabel-ROOT.device
+@@ -8,0 +9,3 @@
++# Decrypt ROOT before initramfs waits for or mounts it.
++Before=cryptsetup.target initrd-root-device.target sysroot.mount
++# Avoid ignition-disks.service here; it creates a first-boot ordering cycle.
+
@@ -2,7 +2,7 @@
 
 Name:           bootengine
 Version:        0.0.38
-Release:        2%{?dist}
+Release:        3%{?dist}
 Summary:        Flatcar bootengine dracut modules and helper utilities
 
 License:        BSD-2-Clause
@@ -12,6 +12,7 @@ URL:            https://github.com/flatcar/bootengine
 Source0:        https://github.com/flatcar/bootengine/archive/%{commit_hash}.tar.gz#/%{name}-%{version}.tar.gz
 Patch0:         0001-modify-tests.patch
 Patch1:         0002-delete-UKI-firstboot-addon-after-Ignition.patch
+Patch2:         0003-decrypt-root-fix-firstboot-ordering.patch
 BuildArch:      noarch
 BuildRequires:  dracut
 Requires:       util-linux
@@ -72,6 +73,11 @@ chmod +x \
 %{_sbindir}/update-bootengine
 
 %changelog
+* Mon Aug 17 2026 Mayank Singh <mayansingh@microsoft.com> - 0.0.38-3
+- decrypt-root: fix first-boot ordering race that dropped the decryption job
+  and fell through to the dracut emergency shell (Before= root-device/sysroot,
+  drop After=ignition-disks.service).
+
 * Tue May 06 2026 Lanze Liu <lanzeliu@microsoft.com> - 0.0.38-2
 - Update firstboot addon removal to use glob pattern for UAPI UKI naming
 

@@ -34,6 +34,11 @@ install_items+=" /usr/sbin/dmsetup "
 # Cryptsetup libraries (required for veritysetup and crypt module)
 install_items+=" /usr/lib/libcryptsetup.so.12 /usr/lib64/libcryptsetup.so.12 "
 install_items+=" /usr/sbin/cryptsetup "
+# TPM2 libs for LUKS root auto-unlock. systemd-cryptsetup dlopen()s these at
+# runtime, so dracut's ldd scan misses them and so we are adding them.
+install_items+=" /usr/lib64/libtss2-esys.so.0 /usr/lib64/libtss2-sys.so.1 "
+install_items+=" /usr/lib64/libtss2-mu.so.0 /usr/lib64/libtss2-rc.so.0 "
+install_items+=" /usr/lib64/libtss2-tctildr.so.0 /usr/lib64/libtss2-tcti-device.so.0 "
 # dm-verity tool
 install_items+=" /usr/sbin/veritysetup "
 # systemd-veritysetup binary (dracut should include it via module, but be explicit)

@@ -0,0 +1,16 @@
+#!/bin/bash
+
+set -euo pipefail
+
+config_dir="/run/chrony/conf.d"
+config_file="${config_dir}/azure-ptp.conf"
+
+install -d -m 0755 "${config_dir}"
+
+if [[ -e /dev/ptp_hyperv ]]; then
+    printf '%s\n' \
+        'refclock PHC /dev/ptp_hyperv poll 3 dpoll -2 offset 0 stratum 2 prefer' \
+        > "${config_file}"
+else
+    rm -f "${config_file}"
+fi
@@ -1,4 +1,6 @@
-# This should only be used when chronyd is configured to use the /dev/ptp_hyperv device
 [Unit]
 Wants=dev-ptp_hyperv.device
 After=dev-ptp_hyperv.device
+
+[Service]
+ExecStartPre=/usr/libexec/chrony-azure-ptp
@@ -5,6 +5,9 @@
 # Include configuration files found in /etc/chrony/conf.d.
 confdir /etc/chrony/conf.d
 
+# Include runtime configuration generated for Azure platform devices.
+confdir /run/chrony/conf.d
+
 # This will use (up to):
 # - 2 sources from 2.ubuntu.pool.ntp.org which is ipv6 enabled as well
 # - 1 source from [013].ubuntu.pool.ntp.org each (ipv4 only atm)
@@ -25,6 +28,9 @@ sourcedir /run/chrony-dhcp
 # Use NTP sources found in /etc/chrony/sources.d.
 sourcedir /etc/chrony/sources.d
 
+# Match the Azure Linux 3.0 RPM fallback when Hyper-V PTP is unavailable.
+server time.windows.com iburst
+
 # This directive specify the location of the file containing ID/key pairs for
 # NTP authentication.
 #keyfile /etc/chrony/chrony.keys
@@ -58,8 +64,5 @@ makestep 1.0 -1
 # leap-smeared time.
 leapsectz right/UTC
 
-# Azure hosts are synchronized to internal Microsoft time servers
-# that take their time from Microsoft-owned Stratum 1 devices.
-# The Hyper-V drivers surface this time source as a PTP-based
-# time source in the guest. This configures chrony to use it.
-refclock PHC /dev/ptp_hyperv poll 3 dpoll -2 offset 0 stratum 2
+# /run/chrony/conf.d/azure-ptp.conf is generated before chronyd starts when
+# the Hyper-V PTP device is available.
@@ -55,18 +55,30 @@ if [[ -f "${rootfs}/usr/lib/systemd/system/chronyd.service" ]]; then
     sed -i \
         's|^ExecStart=/usr/sbin/chronyd $OPTIONS$|ExecStart=/usr/sbin/chronyd -f /usr/lib/chrony/chrony.conf $OPTIONS|' \
         "${rootfs}/usr/lib/systemd/system/chronyd.service"
+
+    # Azure Linux 3.0 adds remove-daemon-state, but its chrony-helper does not
+    # implement that command. Preserve update-daemon for DHCP-provided sources.
+    sed -i \
+        '\|^ExecStopPost=.*/chrony-helper remove-daemon-state$|d' \
+        "${rootfs}/usr/lib/systemd/system/chronyd.service"
 fi
 
 # Copy Azure-optimized chrony.conf from this directory.
 # Overwrites the RPM default that manglefs already moved from /etc.
-# Key differences: makestep 1.0 -1 (always-step), PTP refclock for Hyper-V clock.
+# Key differences: always-step, network fallback, and optional Hyper-V PTP.
 
 # Copy Azure-optimized chrony.conf to /usr/lib/chrony/chrony.conf
 if [[ -f "${script_dir}/chrony.conf" ]]; then
     cp "${script_dir}/chrony.conf" "${rootfs}/usr/lib/chrony/chrony.conf"
 fi
 
-# chronyd.service drop-in (Wants/After dev-ptp_hyperv.device)
+# Generate the optional Hyper-V PTP source before chronyd starts.
+if [[ -f "${script_dir}/chrony-azure-ptp" ]]; then
+    install -D -m 0755 "${script_dir}/chrony-azure-ptp" \
+        "${rootfs}/usr/libexec/chrony-azure-ptp"
+fi
+
+# chronyd.service drop-in for optional Hyper-V PTP configuration.
 if [[ -f "${script_dir}/chrony-hyperv.conf" ]]; then
     mkdir -p "${rootfs}/usr/lib/systemd/system/chronyd.service.d"
     cp "${script_dir}/chrony-hyperv.conf" \