Move branding migration into user setup

8 files changed, 86 insertions, 45 deletions

diff --git a/.github/workflows/validate-installer-iso.yml b/.github/workflows/validate-installer-iso.yml
index 25d6c44..3f02a76 100644
--- a/.github/workflows/validate-installer-iso.yml
+++ b/.github/workflows/validate-installer-iso.yml
@@ -54,6 +54,7 @@ jobs:
           done
           bash -n system_files/usr/libexec/aerocore-instruments-setup
           bash -n system_files/usr/libexec/aerocore-desktop-branding
+          bash -n system_files/usr/libexec/aerocore-desktop-branding-privileged
 
       - name: Test Bazzite Deck identity patch
         run: tests/test-patch-bazzite-deck-identity.sh
diff --git a/build_files/build.sh b/build_files/build.sh
index 916e29d..559dc7b 100755
--- a/build_files/build.sh
+++ b/build_files/build.sh
@@ -136,7 +136,5 @@ fi
 
 find /etc/environment.d /etc/skel/.config/environment.d -name 99-aerocore-mirrors.conf -type f -exec chmod 0644 {} + 2>/dev/null || true
 
-systemctl enable aerocore-desktop-branding.service
-
 /ctx/install-instruments.sh
 /ctx/patch-bazzite-deck-identity.sh
diff --git a/build_files/patch-bazzite-deck-identity.sh b/build_files/patch-bazzite-deck-identity.sh
index ea32cf3..d3ee860 100755
--- a/build_files/patch-bazzite-deck-identity.sh
+++ b/build_files/patch-bazzite-deck-identity.sh
@@ -110,6 +110,54 @@ patch_steam_state_migration() {
   fi
 }
 
+patch_desktop_branding_migration() {
+  local file="$1"
+  local marker='AeroCore desktop branding migration'
+  local condition='pkexec /usr/libexec/bazzite-privileged-user-setup "$USER"'
+  local patched_file
+
+  if [[ ! -f "$file" ]]; then
+    echo "Unable to locate expected Bazzite user setup file: $file" >&2
+    exit 1
+  fi
+
+  if grep -Fq "$marker" "$file"; then
+    return 0
+  fi
+
+  if [[ "$(grep -Foc "$condition" "$file" || true)" -ne 1 ]]; then
+    echo "Unable to locate the Bazzite privileged user setup call in $file" >&2
+    exit 1
+  fi
+
+  patched_file="$(mktemp)"
+  awk -v condition="$condition" '
+    !inserted && $0 == condition {
+      print
+      print ""
+      print "  # AeroCore desktop branding migration"
+      print "  # The image contains the correct defaults. This only repairs values"
+      print "  # persisted by an older Bazzite/AeroCore deployment."
+      print "  if [[ -f /etc/xdg/kcm-about-distrorc ]] && grep -Fxq \"Name=Bazzite\" /etc/xdg/kcm-about-distrorc; then"
+      print "    pkexec /usr/libexec/aerocore-desktop-branding-privileged"
+      print "  fi"
+      print "  /usr/libexec/aerocore-desktop-branding"
+      inserted=1
+      next
+    }
+    { print }
+    END { if (!inserted) exit 1 }
+  ' "$file" > "$patched_file"
+
+  cp "$patched_file" "$file"
+  rm -f "$patched_file"
+
+  if ! grep -Fq "$marker" "$file"; then
+    echo "Failed to add the AeroCore desktop branding migration to $file" >&2
+    exit 1
+  fi
+}
+
 # Keep AeroCore's public image-name, while restoring the Deck capability checks
 # used by Bazzite's runtime scripts. These are literal source lines; variable
 # expansion must happen later, when the scripts run on the installed system.
@@ -147,3 +195,5 @@ patch_condition \
   'if [[ $IMAGE_NAME =~ "deck" ]]; then' \
   'if [[ $IMAGE_NAME =~ "deck" || $IMAGE_NAME == aerocore-os ]]; then' \
   3
+
+patch_desktop_branding_migration "$(target_path /usr/libexec/bazzite-user-setup)"
diff --git a/system_files/usr/lib/systemd/system/aerocore-desktop-branding.service b/system_files/usr/lib/systemd/system/aerocore-desktop-branding.service
deleted file mode 100644
index fee52f1..0000000
--- a/system_files/usr/lib/systemd/system/aerocore-desktop-branding.service
+++ /dev/null
@@ -1,11 +0,0 @@
-[Unit]
-Description=Apply AeroCore desktop branding migrations
-After=local-fs.target
-Before=display-manager.service
-
-[Service]
-Type=oneshot
-ExecStart=/usr/libexec/aerocore-desktop-branding
-
-[Install]
-WantedBy=graphical.target
diff --git a/system_files/usr/libexec/aerocore-desktop-branding b/system_files/usr/libexec/aerocore-desktop-branding
index 8b8b9e0..84902eb 100755
--- a/system_files/usr/libexec/aerocore-desktop-branding
+++ b/system_files/usr/libexec/aerocore-desktop-branding
@@ -2,27 +2,15 @@
 
 set -euo pipefail
 
-# The optional prefix makes the migration testable without touching the host.
-root_prefix="${AEROCORE_DESKTOP_BRANDING_ROOT:-}"
-about_source="${root_prefix}/usr/share/aerocore/desktop-branding/kcm-about-distrorc"
-about_target="${root_prefix}/etc/xdg/kcm-about-distrorc"
+# Called from Bazzite's user-level setup. The setup's version files provide
+# the once-per-image-version guard; this helper only touches the current user.
+plasma_config="${HOME}/.config/plasma-org.kde.plasma.desktop-appletsrc"
 
-# Existing installations can retain Bazzite's old /etc copy across deployment
-# updates. Only replace that known upstream default; administrator changes win.
-if [[ -f "${about_source}" ]] &&
-  { [[ ! -f "${about_target}" ]] || grep -Fxq 'Name=Bazzite' "${about_target}"; }; then
-  install -Dm0644 "${about_source}" "${about_target}"
+if [[ -f "${plasma_config}" ]] && grep -Fxq 'icon=distributor-logo-steamdeck' "${plasma_config}"; then
+  updated_config="$(mktemp "${plasma_config}.XXXXXX")"
+  trap 'rm -f -- "${updated_config}"' EXIT
+  sed 's/^icon=distributor-logo-steamdeck$/icon=aerocore-logo/' \
+    "${plasma_config}" > "${updated_config}"
+  mv -- "${updated_config}" "${plasma_config}"
+  trap - EXIT
 fi
-
-# Deck's stock look-and-feel stores this value in each user's Plasma config.
-# Migrate only the unmodified upstream value so users can still choose an icon.
-shopt -s nullglob
-for plasma_config in "${root_prefix}"/var/home/*/.config/plasma-org.kde.plasma.desktop-appletsrc \
-  "${root_prefix}"/home/*/.config/plasma-org.kde.plasma.desktop-appletsrc; do
-  if grep -Fxq 'icon=distributor-logo-steamdeck' "${plasma_config}"; then
-    updated_config="$(mktemp "${plasma_config}.XXXXXX")"
-    sed 's/^icon=distributor-logo-steamdeck$/icon=aerocore-logo/' "${plasma_config}" > "${updated_config}"
-    cat "${updated_config}" > "${plasma_config}"
-    rm -f "${updated_config}"
-  fi
-done
diff --git a/system_files/usr/libexec/aerocore-desktop-branding-privileged b/system_files/usr/libexec/aerocore-desktop-branding-privileged
new file mode 100755
index 0000000..318a64a
--- /dev/null
+++ b/system_files/usr/libexec/aerocore-desktop-branding-privileged
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+about_source=/usr/share/aerocore/desktop-branding/kcm-about-distrorc
+about_target=/etc/xdg/kcm-about-distrorc
+
+# Only replace the known upstream default. Administrator changes win.
+if [[ -f "${about_source}" ]] &&
+  { [[ ! -f "${about_target}" ]] || grep -Fxq 'Name=Bazzite' "${about_target}"; }; then
+  install -Dm0644 "${about_source}" "${about_target}"
+fi
diff --git a/tests/fixtures/bazzite-44/usr/libexec/bazzite-user-setup b/tests/fixtures/bazzite-44/usr/libexec/bazzite-user-setup
index 90a1ea8..9466a0b 100644
--- a/tests/fixtures/bazzite-44/usr/libexec/bazzite-user-setup
+++ b/tests/fixtures/bazzite-44/usr/libexec/bazzite-user-setup
@@ -1,5 +1,7 @@
 #!/usr/bin/bash
 
+pkexec /usr/libexec/bazzite-privileged-user-setup "$USER"
+
 # Minimal structural fixture from Bazzite 44.20260820.
 if [[ $IMAGE_NAME =~ "deck" ]]; then
   touch "$HOME/Desktop/Return.desktop"
diff --git a/tests/test-desktop-branding-migration.sh b/tests/test-desktop-branding-migration.sh
index 4948b39..4715010 100755
--- a/tests/test-desktop-branding-migration.sh
+++ b/tests/test-desktop-branding-migration.sh
@@ -7,23 +7,17 @@ test_root="$(mktemp -d -t aerocore-desktop-branding.XXXXXXXXXX)"
 trap 'rm -rf "${test_root}"' EXIT
 
 mkdir -p \
-  "${test_root}/usr/share/aerocore/desktop-branding" \
-  "${test_root}/etc/xdg" \
   "${test_root}/var/home/stock/.config" \
   "${test_root}/var/home/custom/.config"
 
-cp "${repo_root}/system_files/usr/share/aerocore/desktop-branding/kcm-about-distrorc" \
-  "${test_root}/usr/share/aerocore/desktop-branding/kcm-about-distrorc"
-printf '%s\n' '[General]' 'Name=Bazzite' > "${test_root}/etc/xdg/kcm-about-distrorc"
 printf '%s\n' 'icon=distributor-logo-steamdeck' \
   > "${test_root}/var/home/stock/.config/plasma-org.kde.plasma.desktop-appletsrc"
 printf '%s\n' 'icon=user-selected-logo' \
   > "${test_root}/var/home/custom/.config/plasma-org.kde.plasma.desktop-appletsrc"
 
-AEROCORE_DESKTOP_BRANDING_ROOT="${test_root}" \
+HOME="${test_root}/var/home/stock" \
   bash "${repo_root}/system_files/usr/libexec/aerocore-desktop-branding"
 
-grep -Fxq 'Name=AeroCore OS' "${test_root}/etc/xdg/kcm-about-distrorc"
 grep -Fxq 'icon=aerocore-logo' \
   "${test_root}/var/home/stock/.config/plasma-org.kde.plasma.desktop-appletsrc"
 grep -Fxq 'icon=user-selected-logo' \
@@ -31,12 +25,10 @@ grep -Fxq 'icon=user-selected-logo' \
 
 # The migration must also be idempotent.
 first_digest="$(sha256sum \
-  "${test_root}/etc/xdg/kcm-about-distrorc" \
   "${test_root}/var/home/stock/.config/plasma-org.kde.plasma.desktop-appletsrc")"
-AEROCORE_DESKTOP_BRANDING_ROOT="${test_root}" \
+HOME="${test_root}/var/home/stock" \
   bash "${repo_root}/system_files/usr/libexec/aerocore-desktop-branding"
 second_digest="$(sha256sum \
-  "${test_root}/etc/xdg/kcm-about-distrorc" \
   "${test_root}/var/home/stock/.config/plasma-org.kde.plasma.desktop-appletsrc")"
 test "${first_digest}" = "${second_digest}"
 
@@ -55,4 +47,13 @@ grep -Fq '"/usr/share/pixmaps/system-logo-white.png"' \
 grep -Fq 'rm -f /usr/share/pixmaps/system-logo-white.png' \
   "${repo_root}/installer/build.sh"
 
+# Branding migration is user setup, not a system boot service.
+if rg -n 'aerocore-desktop-branding\.service|systemctl enable aerocore-desktop-branding' \
+  "${repo_root}/build_files" "${repo_root}/system_files"; then
+  echo "Desktop branding must not be enabled as a system service" >&2
+  exit 1
+fi
+test ! -e "${repo_root}/system_files/usr/lib/systemd/system/aerocore-desktop-branding.service"
+test -x "${repo_root}/system_files/usr/libexec/aerocore-desktop-branding-privileged"
+
 echo "Desktop branding migration fixture passed"