fix(installer): validate ISO payload metadata

Rewrite system-release atomically and reject stale or NUL-bearing
payload metadata before it reaches Anaconda bootupd.

2 files changed, 61 insertions, 1 deletions

diff --git a/build_files/build.sh b/build_files/build.sh
index 5618d20..dd58852 100755
--- a/build_files/build.sh
+++ b/build_files/build.sh
@@ -14,6 +14,39 @@ esac
 # Copy the contents of system_files/ of the git repo to /
 cp -avf "/ctx/system_files"/. /
 
+# KDE's Deck presets use distributor-logo-steamdeck.svg for the Kickoff
+# launcher.  In the Bazzite base image that name (and the related aliases)
+# may already exist as links to the upstream distributor-logo.svg.  Install
+# the AeroCore asset explicitly after the general overlay so the final image
+# cannot silently retain the upstream Bazzite logo.
+AEROCORE_DISTRIBUTOR_LOGO="/ctx/system_files/usr/share/icons/hicolor/scalable/places/distributor-logo.svg"
+AEROCORE_ICON_DIR="/usr/share/icons/hicolor/scalable/places"
+mkdir -p "${AEROCORE_ICON_DIR}"
+for icon_name in \
+  distributor-logo.svg \
+  distributor-logo-steamdeck.svg \
+  bazzite-logo.svg \
+  start-here.svg; do
+  cp -f "${AEROCORE_DISTRIBUTOR_LOGO}" "${AEROCORE_ICON_DIR}/${icon_name}"
+done
+
+# The Plasma launcher resolves the standard start-here name from both scalable
+# and per-size places directories.  Populate every existing Bazzite icon size
+# in the installed payload, not only in the live installer image.
+for icon_dir in /usr/share/icons/hicolor/*/places; do
+  [[ -d "${icon_dir}" ]] || continue
+  source_icon="${icon_dir}/bazzite-logo-icon.png"
+  if [[ -f "${source_icon}" ]]; then
+    cp -f "${source_icon}" "${icon_dir}/start-here.png"
+    cp -f "${source_icon}" "${icon_dir}/fedora-logo-icon.png"
+  fi
+done
+
+if ! cmp -s "${AEROCORE_DISTRIBUTOR_LOGO}" "${AEROCORE_ICON_DIR}/distributor-logo.svg"; then
+  echo "AeroCore distributor logo was not installed into the image" >&2
+  exit 1
+fi
+
 # Default HDMI-CEC to putting the TV into standby when the system sleeps.
 # `ujust toggle-cec-sleep enable` changes this same setting at runtime.  Keep
 # the default in the base image's config so users do not need to run the
diff --git a/build_files/image-info b/build_files/image-info
index bd66383..ae4406a 100755
--- a/build_files/image-info
+++ b/build_files/image-info
@@ -40,6 +40,20 @@ cat > "$IMAGE_INFO" <<EOF
 }
 EOF
 
+# Fail the image build if the metadata file was not rewritten with the
+# downstream identity.  A base Bazzite image can otherwise leave a plausible
+# looking build with image-info.json still claiming bazzite-deck.
+if [[ "$IMAGE_NAME" != "aerocore-os" || "$IMAGE_VENDOR" != "aerocore-io" ]]; then
+  echo "Unexpected AeroCore image identity: ${IMAGE_VENDOR}/${IMAGE_NAME}" >&2
+  exit 1
+fi
+
+jq -e \
+  --arg image_name "$IMAGE_NAME" \
+  --arg image_vendor "$IMAGE_VENDOR" \
+  '.["image-name"] == $image_name and .["image-vendor"] == $image_vendor and .["image-ref"] != null' \
+  "$IMAGE_INFO" >/dev/null
+
 # Keep the display name consistent across desktop settings and os-release.
 sed -i "s/^VARIANT_ID=.*/VARIANT_ID=$IMAGE_ID/" /usr/lib/os-release
 sed -i "s/^PRETTY_NAME=.*/PRETTY_NAME=\"$IMAGE_PRETTY_NAME\"/" /usr/lib/os-release
@@ -56,7 +70,20 @@ sed -i "s/^ANSI_COLOR=.*/ANSI_COLOR=\"$LOGO_COLOR\"/" /usr/lib/os-release
 sed -i "/^REDHAT_BUGZILLA_PRODUCT=/d; /^REDHAT_BUGZILLA_PRODUCT_VERSION=/d; /^REDHAT_SUPPORT_PRODUCT=/d; /^REDHAT_SUPPORT_PRODUCT_VERSION=/d" /usr/lib/os-release
 sed -i "s|^VERSION_CODENAME=.*|VERSION_CODENAME=\"Deck\"|" /usr/lib/os-release
 
-echo "$IMAGE_PRETTY_NAME release $FEDORA_VERSION (Deck)" > /etc/system-release
+# /etc/system-release is normally a symlink to the RPM-owned fedora-release.
+# Write through that link and verify the final bytes: bootupd uses this value as
+# the efibootmgr label, where even a trailing NUL makes Anaconda fail before
+# any %post installer hook can run.
+SYSTEM_RELEASE="/etc/system-release"
+SYSTEM_RELEASE_TARGET="$(readlink -f "$SYSTEM_RELEASE")"
+EXPECTED_SYSTEM_RELEASE="$IMAGE_PRETTY_NAME release $FEDORA_VERSION (Deck)"
+printf '%s\n' "$EXPECTED_SYSTEM_RELEASE" > "$SYSTEM_RELEASE"
+
+if ! cmp -s <(printf '%s\n' "$EXPECTED_SYSTEM_RELEASE") "$SYSTEM_RELEASE_TARGET"; then
+  echo "Failed to write a clean AeroCore system-release to ${SYSTEM_RELEASE_TARGET}" >&2
+  od -An -v -tx1 "$SYSTEM_RELEASE_TARGET" >&2
+  exit 1
+fi
 
 if grep -q '^BUILD_ID=' /usr/lib/os-release; then
   sed -i "s/^BUILD_ID=.*/BUILD_ID=\"$VERSION_PRETTY\"/" /usr/lib/os-release