diff options
| author | tranch <tranch.xiao@gmail.com> | 2026-08-25 10:44:18 +0800 |
|---|---|---|
| committer | tranch <tranch.xiao@gmail.com> | 2026-08-26 11:38:45 +0800 |
| commit | ed4bd0d089d41c5d95fe74937acc2a779c6de6d4 (patch) | |
| tree | 9e67759798c4c9864a67ed9cd5f8519a4339ea94 /.github/workflows | |
| parent | 99c47421bdb444e2eb799c1db1fe11a8ea91dee3 (diff) | |
| download | AeroCore-OS-ed4bd0d089d41c5d95fe74937acc2a779c6de6d4.tar.gz AeroCore-OS-ed4bd0d089d41c5d95fe74937acc2a779c6de6d4.zip | |
fix(installer): validate ISO payload metadata
Rewrite system-release atomically and reject stale or NUL-bearing
payload metadata before it reaches Anaconda bootupd.
Diffstat (limited to '.github/workflows')
| -rw-r--r-- | .github/workflows/build-installer-iso.yml | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/.github/workflows/build-installer-iso.yml b/.github/workflows/build-installer-iso.yml index da3ef10..2402dfe 100644 --- a/.github/workflows/build-installer-iso.yml +++ b/.github/workflows/build-installer-iso.yml @@ -68,6 +68,26 @@ jobs: run: | sudo podman pull "${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}" + - name: Verify AeroCore install image identity + run: | + sudo podman run --rm --entrypoint /usr/bin/bash \ + "${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}" -ceu ' + system_release_target=$(readlink -f /etc/system-release) + if od -An -v -tx1 "$system_release_target" | awk '\''{ for (i = 1; i <= NF; i++) if ($i == "00") found = 1 } END { exit(found ? 0 : 1) }'\''; then + echo "NUL byte in ${system_release_target}" >&2 + exit 1 + fi + case "$(<"$system_release_target")" in + "AeroCore OS release $(rpm -E %fedora) ("*) ;; + *) + echo "Unexpected system-release: $(<"$system_release_target")" >&2 + exit 1 + ;; + esac + jq -e '\''.["image-name"] == "aerocore-os" and .["image-vendor"] == "aerocore-io"'\'' \ + /usr/share/ublue-os/image-info.json >/dev/null + ' + - name: Build installer ISO payload run: | mkdir -p output |