Align local installer ISO build with CI

Use the pinned Titanoboa builder and matching build arguments so just
build-installer-iso produces the same media as the GitHub Actions
workflow.

3 files changed, 37 insertions, 24 deletions

diff --git a/Justfile b/Justfile
index 8161c52..47567b5 100644
--- a/Justfile
+++ b/Justfile
@@ -14,7 +14,8 @@ export VERSION_PRETTY := env_var_or_default("VERSION_PRETTY", VERSION_TAG)
 export BASE_IMAGE := env_var_or_default("BASE_IMAGE", "ghcr.io/ublue-os/bazzite-deck:stable")
 export OSTREE_IMAGE_REF := env_var_or_default("OSTREE_IMAGE_REF", "ostree-image-signed:docker://ghcr.io/" + repo_organization + "/" + image_name)
 export LIVE_BASE_IMAGE := env_var_or_default("LIVE_BASE_IMAGE", "quay.io/fedora/fedora-kinoite:43")
-export INSTALLER_BUILDER_IMAGE := env_var_or_default("INSTALLER_BUILDER_IMAGE", "ghcr.io/jasonn3/build-container-installer:v1.5.0")
+export TITANOBOA_REPOSITORY := env_var_or_default("TITANOBOA_REPOSITORY", "https://github.com/Zeglius/titanoboa.git")
+export TITANOBOA_REVISION := env_var_or_default("TITANOBOA_REVISION", "7737f4748458252ac827dca14b3d6dd09298472a")
 export FLATPAK_REMOTE_URL := env_var_or_default("FLATPAK_REMOTE_URL", "")
 export HOMEBREW_BOTTLE_DOMAIN := env_var_or_default("HOMEBREW_BOTTLE_DOMAIN", "")
 export HOMEBREW_API_DOMAIN := env_var_or_default("HOMEBREW_API_DOMAIN", "")
@@ -38,7 +39,7 @@ alias run-live-installer := run-installer-iso
 default:
     @just --list
 
-# Build a Bazzite-style installer ISO
+# Build the same Titanoboa-based installer ISO as CI
 build-installer-iso $target_image=("localhost/" + image_name) $tag=default_tag:
     @IMAGE_NAME="{{ target_image }}" IMAGE_TAG="{{ tag }}" ./just_scripts/build-installer-iso.sh
 
diff --git a/README.md b/README.md
index de33959..6faf2ae 100644
--- a/README.md
+++ b/README.md
@@ -64,6 +64,7 @@ just build-installer-iso
 just run-installer-iso
 ```
 
-This requires privileged Podman, a rootful Podman API socket, and roughly
-70 GiB of free space. The installer ISO workflow consumes the published
-`latest` AeroCore image and uploads the ISO as a GitHub Actions artifact.
+This requires privileged Podman, a rootful Podman API socket, `git`, and
+roughly 70 GiB of free space. Local ISO generation uses the same pinned
+Titanoboa builder as the installer workflow, and writes the ISO plus its
+SHA-256 checksum under `output/`.
diff --git a/just_scripts/build-installer-iso.sh b/just_scripts/build-installer-iso.sh
index 2b1f7ae..3226527 100755
--- a/just_scripts/build-installer-iso.sh
+++ b/just_scripts/build-installer-iso.sh
@@ -8,7 +8,8 @@ cd "${project_root}"
 image_name="${IMAGE_NAME:-localhost/$(just image_name)}"
 image_tag="${IMAGE_TAG:-$(just generate-default-tag)}"
 live_base_image="${LIVE_BASE_IMAGE:-quay.io/fedora/fedora-kinoite:43}"
-installer_builder_image="${INSTALLER_BUILDER_IMAGE:-ghcr.io/jasonn3/build-container-installer:v1.5.0}"
+titanoboa_repository="${TITANOBOA_REPOSITORY:-https://github.com/Zeglius/titanoboa.git}"
+titanoboa_revision="${TITANOBOA_REVISION:-7737f4748458252ac827dca14b3d6dd09298472a}"
 source_image="${image_name}:${image_tag}"
 # Keep the payload in local container storage, but use the public update
 # reference as its local tag so Anaconda writes that reference as the boot
@@ -102,24 +103,34 @@ else
   sudo rm -f "${iso}" "${checksum}"
 fi
 
-"${podman_cmd[@]}" run --rm --privileged \
-  --volume "${api_socket}:/var/run/docker.sock" \
-  --volume /var/lib/containers/storage:/var/lib/containers/storage \
-  --volume "${project_root}/output:/build-container-installer/build" \
-  --volume "${project_root}/installer/lorax_templates:/additional_lorax_templates:ro" \
-  "${installer_builder_image}" \
-  ADDITIONAL_TEMPLATES="/additional_lorax_templates/remove_root_password_prompt.tmpl /additional_lorax_templates/set_default_user.tmpl" \
-  ARCH="x86_64" \
-  ENABLE_CACHE_DNF="false" \
-  ENABLE_CACHE_SKOPEO="false" \
-  ENABLE_FLATPAK_DEPENDENCIES="false" \
-  IMAGE_NAME="aerocore-os-installer" \
-  IMAGE_REPO="localhost" \
-  IMAGE_SRC="containers-storage:${payload}" \
-  IMAGE_TAG="latest" \
-  ISO_NAME="build/aerocore-os-${image_tag}-amd64.iso" \
-  VARIANT="Kinoite" \
-  VERSION="${FEDORA_VERSION:-44}"
+tmp_titanoboa="$(mktemp -d -t aerocore-titanoboa.XXXXXXXXXX)"
+trap 'rm -rf "${tmp_titanoboa}"' EXIT
+
+git clone --quiet --filter=blob:none --no-checkout \
+  "${titanoboa_repository}" "${tmp_titanoboa}"
+git -C "${tmp_titanoboa}" fetch --quiet origin "${titanoboa_revision}"
+git -C "${tmp_titanoboa}" checkout --quiet "${titanoboa_revision}"
+
+# Keep this invocation aligned with Zeglius/titanoboa's GitHub Action:
+# `just build IMAGE 1 0 none squashfs "" 1`.
+(
+  cd "${tmp_titanoboa}"
+  CI=1 TITANOBOA_WORKDIR="${tmp_titanoboa}/work" \
+    sudo PATH="${PATH}" just build "${payload}" 1 0 none squashfs "" 1
+)
+
+titanoboa_iso="${tmp_titanoboa}/output.iso"
+if [[ ! -f "${titanoboa_iso}" ]]; then
+  echo "Titanoboa did not produce ${titanoboa_iso}" >&2
+  exit 1
+fi
+if [[ "${EUID}" -eq 0 ]]; then
+  rm -f "${iso}" "${checksum}"
+  mv "${titanoboa_iso}" "${iso}"
+else
+  sudo rm -f "${iso}" "${checksum}"
+  sudo mv "${titanoboa_iso}" "${iso}"
+fi
 
 if [[ -f "${iso}" ]]; then
   if [[ "${EUID}" -ne 0 ]]; then