Adapt to Bazzite 44

Update Deck identity matching for the new upstream scripts and add
fixture coverage for patch idempotence.

Move the live installer base to Fedora 44 while retaining the Fedora 43
Anaconda workaround for explicit legacy builds.

11 files changed, 111 insertions, 14 deletions

diff --git a/.github/workflows/build-installer-iso.yml b/.github/workflows/build-installer-iso.yml
index 1352080..cebb0a6 100644
--- a/.github/workflows/build-installer-iso.yml
+++ b/.github/workflows/build-installer-iso.yml
@@ -29,8 +29,8 @@ jobs:
       IMAGE_TAG: ${{ inputs.image_tag || 'latest' }}
       ISO_FILE_TAG: ${{ github.ref_name == 'testing' && 'testing' || (inputs.image_tag || 'latest') }}
       # Keep these aligned with the Fedora major used by the target bazzite-deck base image.
-      LIVE_BASE_IMAGE: quay.io/fedora/fedora-kinoite:43
-      FEDORA_VERSION: "43"
+      LIVE_BASE_IMAGE: quay.io/fedora/fedora-kinoite:44
+      FEDORA_VERSION: "44"
       OSTREE_IMAGE_REF: ${{ vars.OSTREE_IMAGE_REF }}
 
     steps:
diff --git a/.github/workflows/validate-installer-iso.yml b/.github/workflows/validate-installer-iso.yml
index a93e9cd..5aa6335 100644
--- a/.github/workflows/validate-installer-iso.yml
+++ b/.github/workflows/validate-installer-iso.yml
@@ -34,11 +34,14 @@ jobs:
 
       - name: Validate build scripts
         run: |
-          for script in build_files/*.sh installer/*.sh just_scripts/*.sh; do
+          for script in build_files/*.sh installer/*.sh just_scripts/*.sh tests/*.sh; do
             bash -n "$script"
           done
           bash -n system_files/usr/libexec/aerocore-instruments-setup
 
+      - name: Test Bazzite Deck identity patch
+        run: tests/test-patch-bazzite-deck-identity.sh
+
       - name: Validate Anaconda WebUI patch
         run: |
           fixture="$(mktemp)"
diff --git a/Containerfile b/Containerfile
index 16e85a2..be9737e 100644
--- a/Containerfile
+++ b/Containerfile
@@ -16,7 +16,7 @@ ARG VERSION_PRETTY="latest"
 ARG OSTREE_IMAGE_REF=""
 ## Other possible base images include:
 # ghcr.io/ublue-os/bazzite-deck:testing
-# ghcr.io/ublue-os/bazzite-deck:stable-43.20260420
+# ghcr.io/ublue-os/bazzite-deck:stable-44.20260820
 
 ### [IM]MUTABLE /opt
 ## Some bootable images, like Fedora, have /opt symlinked to /var/opt, in order to
diff --git a/Justfile b/Justfile
index b8d0be9..c412abb 100644
--- a/Justfile
+++ b/Justfile
@@ -13,7 +13,7 @@ export VERSION_TAG := env_var_or_default("VERSION_TAG", default_tag)
 export VERSION_PRETTY := env_var_or_default("VERSION_PRETTY", VERSION_TAG)
 export BASE_IMAGE := env_var_or_default("BASE_IMAGE", "ghcr.io/ublue-os/bazzite-deck:stable")
 export OSTREE_IMAGE_REF := env_var_or_default("OSTREE_IMAGE_REF", "ostree-image-signed:docker://ghcr.io/" + repo_organization + "/" + image_name)
-export LIVE_BASE_IMAGE := env_var_or_default("LIVE_BASE_IMAGE", "quay.io/fedora/fedora-kinoite:43")
+export LIVE_BASE_IMAGE := env_var_or_default("LIVE_BASE_IMAGE", "quay.io/fedora/fedora-kinoite:44")
 export TITANOBOA_REPOSITORY := env_var_or_default("TITANOBOA_REPOSITORY", "https://github.com/Zeglius/titanoboa.git")
 export TITANOBOA_REVISION := env_var_or_default("TITANOBOA_REVISION", "7737f4748458252ac827dca14b3d6dd09298472a")
 export FLATPAK_REMOTE_URL := env_var_or_default("FLATPAK_REMOTE_URL", "")
diff --git a/build_files/patch-bazzite-deck-identity.sh b/build_files/patch-bazzite-deck-identity.sh
index ea561e4..ea32cf3 100755
--- a/build_files/patch-bazzite-deck-identity.sh
+++ b/build_files/patch-bazzite-deck-identity.sh
@@ -125,8 +125,8 @@ patch_condition \
 # shellcheck disable=SC2016
 patch_condition \
   "${1:-$(target_path /usr/libexec/bazzite-hardware-setup)}" \
-  'if [[ $IMAGE_NAME =~ "deck" || $IMAGE_NAME =~ "ally" ]]; then' \
-  'if [[ $IMAGE_NAME =~ "deck" || $IMAGE_NAME =~ "ally" || $IMAGE_NAME == aerocore-os ]]; then' \
+  'if [[ $IMAGE_NAME =~ "deck" ]]; then' \
+  'if [[ $IMAGE_NAME =~ "deck" || $IMAGE_NAME == aerocore-os ]]; then' \
   1
 
 # bazzite-steam gates the Steam bootstrap archive and -steamdeck flag on the
@@ -144,6 +144,6 @@ patch_steam_state_migration "$(target_path /usr/bin/bazzite-steam)"
 # shellcheck disable=SC2016
 patch_condition \
   "$(target_path /usr/libexec/bazzite-user-setup)" \
-  'if [[ $IMAGE_NAME =~ "deck" || $IMAGE_NAME =~ "ally" ]]; then' \
-  'if [[ $IMAGE_NAME =~ "deck" || $IMAGE_NAME =~ "ally" || $IMAGE_NAME == aerocore-os ]]; then' \
+  'if [[ $IMAGE_NAME =~ "deck" ]]; then' \
+  'if [[ $IMAGE_NAME =~ "deck" || $IMAGE_NAME == aerocore-os ]]; then' \
   3
diff --git a/installer/build.sh b/installer/build.sh
index 4535113..3d6659f 100755
--- a/installer/build.sh
+++ b/installer/build.sh
@@ -9,6 +9,7 @@ INSTALL_IMAGE_PAYLOAD_ARCHIVE=${INSTALL_IMAGE_PAYLOAD_ARCHIVE:-}
 INSTALL_IMAGE_TAG=${INSTALL_IMAGE_TAG:?}
 OSTREE_IMAGE_REF=${OSTREE_IMAGE_REF:?}
 ostree_origin_ref="${OSTREE_IMAGE_REF}:${INSTALL_IMAGE_TAG}"
+live_version_id="$(awk -F= '$1 == "VERSION_ID" { gsub(/\"/, "", $2); print $2; exit }' /usr/lib/os-release)"
 
 # The installer is a live KDE environment.  Keep the installed system payload
 # separate: it is the AeroCore image, while BASE_IMAGE provides the live UI.
@@ -32,9 +33,11 @@ dnf --setopt=excludepkgs= reinstall -y \
   grub2-efi-x64-cdboot
 
 # Fedora 43's anaconda-webui bundle embeds a Cockpit password helper from
-# before cockpit-project/cockpit@900c13f. Restore that upstream fix so a weak
-# pwscore result is returned as score 0 instead of rejecting the WebUI promise.
-"${SCRIPT_DIR}/patch-anaconda-webui.sh"
+# before cockpit-project/cockpit@900c13f. Fedora 44 already carries the fix;
+# retain the workaround only for explicitly requested Fedora 43 live images.
+if [[ "${live_version_id}" == "43" ]]; then
+  "${SCRIPT_DIR}/patch-anaconda-webui.sh"
+fi
 
 # Apply the same AeroCore overlay to the live session where possible.
 if [[ -d /src/system_files ]]; then
@@ -78,7 +81,6 @@ if [[ -f /usr/share/icons/hicolor/scalable/places/distributor-logo.svg ]]; then
     /usr/share/icons/hicolor/scalable/places/start-here.svg
 fi
 
-live_version_id="$(awk -F= '$1 == "VERSION_ID" { gsub(/\"/, "", $2); print $2; exit }' /usr/lib/os-release)"
 live_product_name="AeroCore OS"
 sed -i "s/^NAME=.*/NAME=\"${live_product_name}\"/" /usr/lib/os-release
 sed -i "s/^PRETTY_NAME=.*/PRETTY_NAME=\"${live_product_name} ${live_version_id} (Kinoite)\"/" /usr/lib/os-release
diff --git a/just_scripts/build-installer-iso.sh b/just_scripts/build-installer-iso.sh
index 3353651..fb1f6c0 100755
--- a/just_scripts/build-installer-iso.sh
+++ b/just_scripts/build-installer-iso.sh
@@ -7,7 +7,7 @@ cd "${project_root}"
 
 image_name="${IMAGE_NAME:-localhost/$(just image_name)}"
 image_tag="${IMAGE_TAG:-$(just generate-default-tag)}"
-live_base_image="${LIVE_BASE_IMAGE:-quay.io/fedora/fedora-kinoite:43}"
+live_base_image="${LIVE_BASE_IMAGE:-quay.io/fedora/fedora-kinoite:44}"
 titanoboa_repository="${TITANOBOA_REPOSITORY:-https://github.com/Zeglius/titanoboa.git}"
 titanoboa_revision="${TITANOBOA_REVISION:-7737f4748458252ac827dca14b3d6dd09298472a}"
 source_image="${image_name}:${image_tag}"
diff --git a/tests/fixtures/bazzite-44/usr/bin/bazzite-steam b/tests/fixtures/bazzite-44/usr/bin/bazzite-steam
new file mode 100644
index 0000000..9249ce1
--- /dev/null
+++ b/tests/fixtures/bazzite-44/usr/bin/bazzite-steam
@@ -0,0 +1,10 @@
+#!/usr/bin/bash
+
+# Minimal structural fixture from Bazzite 44.20260820.
+if [[ $IMAGE_NAME =~ "deck" ]]; then
+  if [[ ! -d $HOME/.local/share/Steam ]]; then
+    mkdir -p "$HOME/.local/share"
+  fi
+
+  DECK_OPTION="-steamdeck"
+fi
diff --git a/tests/fixtures/bazzite-44/usr/libexec/bazzite-hardware-setup b/tests/fixtures/bazzite-44/usr/libexec/bazzite-hardware-setup
new file mode 100644
index 0000000..54aa246
--- /dev/null
+++ b/tests/fixtures/bazzite-44/usr/libexec/bazzite-hardware-setup
@@ -0,0 +1,10 @@
+#!/usr/bin/bash
+
+# Minimal structural fixture from Bazzite 44.20260820.
+if [[ "$IMAGE_NAME" != *deck* && "$IMAGE_NAME" != *dx* ]]; then
+  rm -f /etc/sddm.conf.d/steamos.conf
+fi
+
+if [[ $IMAGE_NAME =~ "deck" ]]; then
+  systemctl mask tuned.service
+fi
diff --git a/tests/fixtures/bazzite-44/usr/libexec/bazzite-user-setup b/tests/fixtures/bazzite-44/usr/libexec/bazzite-user-setup
new file mode 100644
index 0000000..90a1ea8
--- /dev/null
+++ b/tests/fixtures/bazzite-44/usr/libexec/bazzite-user-setup
@@ -0,0 +1,14 @@
+#!/usr/bin/bash
+
+# Minimal structural fixture from Bazzite 44.20260820.
+if [[ $IMAGE_NAME =~ "deck" ]]; then
+  touch "$HOME/Desktop/Return.desktop"
+fi
+
+if [[ $IMAGE_NAME =~ "deck" ]]; then
+  touch "$HOME/.config/bazzite/desktop-configured"
+fi
+
+if [[ $IMAGE_NAME =~ "deck" ]]; then
+  systemctl --user enable --now sdgyrodsu.service
+fi
diff --git a/tests/test-patch-bazzite-deck-identity.sh b/tests/test-patch-bazzite-deck-identity.sh
new file mode 100755
index 0000000..fa420ce
--- /dev/null
+++ b/tests/test-patch-bazzite-deck-identity.sh
@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+fixture_root="${repo_root}/tests/fixtures/bazzite-44"
+test_root="$(mktemp -d -t aerocore-deck-identity.XXXXXXXXXX)"
+trap 'rm -rf "${test_root}"' EXIT
+
+cp -a "${fixture_root}/." "${test_root}/"
+
+run_patch() {
+  AEROCORE_DECK_COMPAT_ROOT="${test_root}" \
+    bash "${repo_root}/build_files/patch-bazzite-deck-identity.sh"
+}
+
+assert_count() {
+  local expected="$1"
+  local pattern="$2"
+  local file="$3"
+  local actual
+
+  actual="$(grep -Foc "${pattern}" "${file}" || true)"
+  if [[ "${actual}" != "${expected}" ]]; then
+    echo "Expected ${expected} occurrence(s) of '${pattern}' in ${file}, found ${actual}" >&2
+    exit 1
+  fi
+}
+
+hardware_setup="${test_root}/usr/libexec/bazzite-hardware-setup"
+steam="${test_root}/usr/bin/bazzite-steam"
+user_setup="${test_root}/usr/libexec/bazzite-user-setup"
+# shellcheck disable=SC2016
+deck_condition='if [[ $IMAGE_NAME =~ "deck" || $IMAGE_NAME == aerocore-os ]]; then'
+# shellcheck disable=SC2016
+non_deck_condition='if [[ "$IMAGE_NAME" != aerocore-os && "$IMAGE_NAME" != *deck* && "$IMAGE_NAME" != *dx* ]]; then'
+
+run_patch
+
+assert_count 1 "${non_deck_condition}" "${hardware_setup}"
+assert_count 1 "${deck_condition}" "${hardware_setup}"
+assert_count 1 "${deck_condition}" "${steam}"
+assert_count 3 "${deck_condition}" "${user_setup}"
+assert_count 1 'AeroCore Steam state migration' "${steam}"
+
+# A second run must recognize the patched fixture and make no further changes.
+first_digest="$(sha256sum "${hardware_setup}" "${steam}" "${user_setup}")"
+run_patch
+second_digest="$(sha256sum "${hardware_setup}" "${steam}" "${user_setup}")"
+
+if [[ "${first_digest}" != "${second_digest}" ]]; then
+  echo "Deck identity patch is not idempotent" >&2
+  exit 1
+fi
+
+assert_count 1 'AeroCore Steam state migration' "${steam}"
+
+echo "Bazzite 44 Deck identity fixture passed"