grub: move disabled boot entries at the end of boot order

The GRUB entry is always set as the second boot option, assuming
PXE is first. This is not always true, as disabled entries before
PXE IPv4 can make it the first valid but not the first defined
entry in the boot order.

Move every disabled boot entry at the end of boot order.

src/utils/grub.py

@@ -334,6 +334,7 @@ def get_disk_part_type(disk_num):
 def _update_nvram(esp_disk, esp_part_number):
     loader_path = '/EFI/grub/Boot/shimx64.efi'
     bootlabel = 'grub'
+    egibootmgr_reorder_disabled_entries()
     efibootmgr_delete_bootentry(bootlabel)
     efibootmgr_create_bootentry(esp_disk, esp_part_number, loader_path, bootlabel, add_to_bootorder=False)
     efibootmgr_set_entry_order(bootlabel, 1)

src/utils/uefi.py

@@ -143,6 +143,23 @@ def efibootmgr_set_entry_order(label, position):
     except OSError as e:
         raise OgError(f'Unexpected error setting boot order to NVRAM. UEFI firmware might be buggy') from e
 
+def egibootmgr_reorder_disabled_entries():
+    logging.info(f'Setting disabled entries at the end of boot order')
+    boot_info = run_efibootmgr_json(validate=False)
+    boot_entries = boot_info.get('vars', [])
+    boot_order = boot_info.get('BootOrder', [])
+
+    for entry in boot_entries:
+        entry_number = _strip_boot_prefix(entry)
+        if not entry['active'] and entry_number in boot_order:
+            boot_order.remove(entry_number)
+            boot_order.append(entry_number)
+
+    try:
+        proc = subprocess.run([EFIBOOTMGR_BIN, "-o", ",".join(boot_order)], check=True, text=True)
+    except OSError as e:
+        raise OgError(f'Unexpected error updating boot order of inactive entries in NVRAM. UEFI firmware might be buggy') from e
+
 def _find_efi_loader(loader_paths):
     for efi_app in loader_paths:
         logging.info(f'Searching for {efi_app}')