(In reply to Andrei Borzenkov from comment #0) > Apart from the obvious bug in pcr-oracle, this invalidates any claim of > "immutability" of MicroOS - failed update makes it impossible to boot > MicroOS without human intervention. Also comment here that the ESP, /etc and /var are outside of the transaction. This bug is a very interesting case where a side effect (the update of the boot loader) affect all the transactions at the same time: the new boot loader is visible for all the snapshots. We are thinking how to fix this. One option can be that when doing a rollback, recover the old boot loader from the snapshot. This is the correct approach in general, but if the user select an old snapshot from the boot loader, it is still using the most updated one.