11 files changed, 111 insertions, 14 deletions
diff --git a/.github/workflows/build-installer-iso.yml b/.github/workflows/build-installer-iso.yml
index 1352080..cebb0a6 100644
--- a/.github/workflows/build-installer-iso.yml
+++ b/.github/workflows/build-installer-iso.yml
@@ -29,8 +29,8 @@ jobs:
       IMAGE_TAG: ${{ inputs.image_tag || 'latest' }}
       ISO_FILE_TAG: ${{ github.ref_name == 'testing' && 'testing' || (inputs.image_tag || 'latest') }}
       # Keep these aligned with the Fedora major used by the target bazzite-deck base image.
-      LIVE_BASE_IMAGE: quay.io/fedora/fedora-kinoite:43
-      FEDORA_VERSION: "43"
+      LIVE_BASE_IMAGE: quay.io/fedora/fedora-kinoite:44
+      FEDORA_VERSION: "44"
       OSTREE_IMAGE_REF: ${{ vars.OSTREE_IMAGE_REF }}
 
     steps:
diff --git a/.github/workflows/validate-installer-iso.yml b/.github/workflows/validate-installer-iso.yml
index a93e9cd..5aa6335 100644
--- a/.github/workflows/validate-installer-iso.yml
+++ b/.github/workflows/validate-installer-iso.yml
@@ -34,11 +34,14 @@ jobs:
 
       - name: Validate build scripts
         run: |
-          for script in build_files/*.sh installer/*.sh just_scripts/*.sh; do
+          for script in build_files/*.sh installer/*.sh just_scripts/*.sh tests/*.sh; do
             bash -n "$script"
           done
           bash -n system_files/usr/libexec/aerocore-instruments-setup
 
+      - name: Test Bazzite Deck identity patch
+        run: tests/test-patch-bazzite-deck-identity.sh
+
       - name: Validate Anaconda WebUI patch
         run: |
           fixture="$(mktemp)"
diff --git a/Containerfile b/Containerfile
index 16e85a2..be9737e 100644
--- a/Containerfile
+++ b/Containerfile
@@ -16,7 +16,7 @@ ARG VERSION_PRETTY="latest"
 ARG OSTREE_IMAGE_REF=""
 ## Other possible base images include:
 # ghcr.io/ublue-os/bazzite-deck:testing
-# ghcr.io/ublue-os/bazzite-deck:stable-43.20260420
+# ghcr.io/ublue-os/bazzite-deck:stable-44.20260820
 
 ### [IM]MUTABLE /opt
 ## Some bootable images, like Fedora, have /opt symlinked to /var/opt, in order to
diff --git a/Justfile b/Justfile
index b8d0be9..c412abb 100644
--- a/Justfile
+++ b/Justfile
@@ -13,7 +13,7 @@ export VERSION_TAG := env_var_or_default("VERSION_TAG", default_tag)
 export VERSION_PRETTY := env_var_or_default("VERSION_PRETTY", VERSION_TAG)
 export BASE_IMAGE := env_var_or_default("BASE_IMAGE", "ghcr.io/ublue-os/bazzite-deck:stable")
 export OSTREE_IMAGE_REF := env_var_or_default("OSTREE_IMAGE_REF", "ostree-image-signed:docker://ghcr.io/" + repo_organization + "/" + image_name)
-export LIVE_BASE_IMAGE := env_var_or_default("LIVE_BASE_IMAGE", "quay.io/fedora/fedora-kinoite:43")
+export LIVE_BASE_IMAGE := env_var_or_default("LIVE_BASE_IMAGE", "quay.io/fedora/fedora-kinoite:44")
 export TITANOBOA_REPOSITORY := env_var_or_default("TITANOBOA_REPOSITORY", "https://github.com/Zeglius/titanoboa.git")
 export TITANOBOA_REVISION := env_var_or_default("TITANOBOA_REVISION", "7737f4748458252ac827dca14b3d6dd09298472a")
 export FLATPAK_REMOTE_URL := env_var_or_default("FLATPAK_REMOTE_URL", "")
diff --git a/build_files/patch-bazzite-deck-identity.sh b/build_files/patch-bazzite-deck-identity.sh
index ea561e4..ea32cf3 100755
--- a/build_files/patch-bazzite-deck-identity.sh
+++ b/build_files/patch-bazzite-deck-identity.sh
@@ -125,8 +125,8 @@ patch_condition \
 # shellcheck disable=SC2016
 patch_condition \
   "${1:-$(target_path /usr/libexec/bazzite-hardware-setup)}" \
-  'if [[ $IMAGE_NAME =~ "deck" || $IMAGE_NAME =~ "ally" ]]; then' \
-  'if [[ $IMAGE_NAME =~ "deck" || $IMAGE_NAME =~ "ally" || $IMAGE_NAME == aerocore-os ]]; then' \
+  'if [[ $IMAGE_NAME =~ "deck" ]]; then' \
+  'if [[ $IMAGE_NAME =~ "deck" || $IMAGE_NAME == aerocore-os ]]; then' \
   1
 
 # bazzite-steam gates the Steam bootstrap archive and -steamdeck flag on the
@@ -144,6 +144,6 @@ patch_steam_state_migration "$(target_path /usr/bin/bazzite-steam)"
 # shellcheck disable=SC2016
 patch_condition \
   "$(target_path /usr/libexec/bazzite-user-setup)" \
-  'if [[ $IMAGE_NAME =~ "deck" || $IMAGE_NAME =~ "ally" ]]; then' \
-  'if [[ $IMAGE_NAME =~ "deck" || $IMAGE_NAME =~ "ally" || $IMAGE_NAME == aerocore-os ]]; then' \
+  'if [[ $IMAGE_NAME =~ "deck" ]]; then' \
+  'if [[ $IMAGE_NAME =~ "deck" || $IMAGE_NAME == aerocore-os ]]; then' \
   3
diff --git a/installer/build.sh b/installer/build.sh
index 4535113..3d6659f 100755
--- a/installer/build.sh
+++ b/installer/build.sh
@@ -9,6 +9,7 @@ INSTALL_IMAGE_PAYLOAD_ARCHIVE=${INSTALL_IMAGE_PAYLOAD_ARCHIVE:-}
 INSTALL_IMAGE_TAG=${INSTALL_IMAGE_TAG:?}
 OSTREE_IMAGE_REF=${OSTREE_IMAGE_REF:?}
 ostree_origin_ref="${OSTREE_IMAGE_REF}:${INSTALL_IMAGE_TAG}"
+live_version_id="$(awk -F= '$1 == "VERSION_ID" { gsub(/\"/, "", $2); print $2; exit }' /usr/lib/os-release)"
 
 # The installer is a live KDE environment.  Keep the installed system payload
 # separate: it is the AeroCore image, while BASE_IMAGE provides the live UI.
@@ -32,9 +33,11 @@ dnf --setopt=excludepkgs= reinstall -y \
   grub2-efi-x64-cdboot
 
 # Fedora 43's anaconda-webui bundle embeds a Cockpit password helper from
-# before cockpit-project/cockpit@900c13f. Restore that upstream fix so a weak
-# pwscore result is returned as score 0 instead of rejecting the WebUI promise.
-"${SCRIPT_DIR}/patch-anaconda-webui.sh"
+# before cockpit-project/cockpit@900c13f. Fedora 44 already carries the fix;
+# retain the workaround only for explicitly requested Fedora 43 live images.
+if [[ "${live_version_id}" == "43" ]]; then
+  "${SCRIPT_DIR}/patch-anaconda-webui.sh"
+fi
 
 # Apply the same AeroCore overlay to the live session where possible.
 if [[ -d /src/system_files ]]; then
@@ -78,7 +81,6 @@ if [[ -f /usr/share/icons/hicolor/scalable/places/distributor-logo.svg ]]; then
     /usr/share/icons/hicolor/scalable/places/start-here.svg
 fi
 
-live_version_id="$(awk -F= '$1 == "VERSION_ID" { gsub(/\"/, "", $2); print $2; exit }' /usr/lib/os-release)"
 live_product_name="AeroCore OS"
 sed -i "s/^NAME=.*/NAME=\"${live_product_name}\"/" /usr/lib/os-release
 sed -i "s/^PRETTY_NAME=.*/PRETTY_NAME=\"${live_product_name} ${live_version_id} (Kinoite)\"/" /usr/lib/os-release
diff --git a/just_scripts/build-installer-iso.sh b/just_scripts/build-installer-iso.sh
index 3353651..fb1f6c0 100755
--- a/just_scripts/build-installer-iso.sh
+++ b/just_scripts/build-installer-iso.sh
@@ -7,7 +7,7 @@ cd "${project_root}"
 
 image_name="${IMAGE_NAME:-localhost/$(just image_name)}"
 image_tag="${IMAGE_TAG:-$(just generate-default-tag)}"
-live_base_image="${LIVE_BASE_IMAGE:-quay.io/fedora/fedora-kinoite:43}"
+live_base_image="${LIVE_BASE_IMAGE:-quay.io/fedora/fedora-kinoite:44}"
 titanoboa_repository="${TITANOBOA_REPOSITORY:-https://github.com/Zeglius/titanoboa.git}"
 titanoboa_revision="${TITANOBOA_REVISION:-7737f4748458252ac827dca14b3d6dd09298472a}"
 source_image="${image_name}:${image_tag}"
diff --git a/tests/fixtures/bazzite-44/usr/bin/bazzite-steam b/tests/fixtures/bazzite-44/usr/bin/bazzite-steam
new file mode 100644
index 0000000..9249ce1
--- /dev/null
+++ b/tests/fixtures/bazzite-44/usr/bin/bazzite-steam
@@ -0,0 +1,10 @@
+#!/usr/bin/bash
+
+# Minimal structural fixture from Bazzite 44.20260820.
+if [[ $IMAGE_NAME =~ "deck" ]]; then
+  if [[ ! -d $HOME/.local/share/Steam ]]; then
+    mkdir -p "$HOME/.local/share"
+  fi
+
+  DECK_OPTION="-steamdeck"
+fi
diff --git a/tests/fixtures/bazzite-44/usr/libexec/bazzite-hardware-setup b/tests/fixtures/bazzite-44/usr/libexec/bazzite-hardware-setup
new file mode 100644
index 0000000..54aa246
--- /dev/null
+++ b/tests/fixtures/bazzite-44/usr/libexec/bazzite-hardware-setup
@@ -0,0 +1,10 @@
+#!/usr/bin/bash
+
+# Minimal structural fixture from Bazzite 44.20260820.
+if [[ "$IMAGE_NAME" != *deck* && "$IMAGE_NAME" != *dx* ]]; then
+  rm -f /etc/sddm.conf.d/steamos.conf
+fi
+
+if [[ $IMAGE_NAME =~ "deck" ]]; then
+  systemctl mask tuned.service
+fi
diff --git a/tests/fixtures/bazzite-44/usr/libexec/bazzite-user-setup b/tests/fixtures/bazzite-44/usr/libexec/bazzite-user-setup
new file mode 100644
index 0000000..90a1ea8
--- /dev/null
+++ b/tests/fixtures/bazzite-44/usr/libexec/bazzite-user-setup
@@ -0,0 +1,14 @@
+#!/usr/bin/bash
+
+# Minimal structural fixture from Bazzite 44.20260820.
+if [[ $IMAGE_NAME =~ "deck" ]]; then
+  touch "$HOME/Desktop/Return.desktop"
+fi
+
+if [[ $IMAGE_NAME =~ "deck" ]]; then
+  touch "$HOME/.config/bazzite/desktop-configured"
+fi
+
+if [[ $IMAGE_NAME =~ "deck" ]]; then
+  systemctl --user enable --now sdgyrodsu.service
+fi
diff --git a/tests/test-patch-bazzite-deck-identity.sh b/tests/test-patch-bazzite-deck-identity.sh
new file mode 100755
index 0000000..fa420ce
--- /dev/null
+++ b/tests/test-patch-bazzite-deck-identity.sh
@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+fixture_root="${repo_root}/tests/fixtures/bazzite-44"
+test_root="$(mktemp -d -t aerocore-deck-identity.XXXXXXXXXX)"
+trap 'rm -rf "${test_root}"' EXIT
+
+cp -a "${fixture_root}/." "${test_root}/"
+
+run_patch() {
+  AEROCORE_DECK_COMPAT_ROOT="${test_root}" \
+    bash "${repo_root}/build_files/patch-bazzite-deck-identity.sh"
+}
+
+assert_count() {
+  local expected="$1"
+  local pattern="$2"
+  local file="$3"
+  local actual
+
+  actual="$(grep -Foc "${pattern}" "${file}" || true)"
+  if [[ "${actual}" != "${expected}" ]]; then
+    echo "Expected ${expected} occurrence(s) of '${pattern}' in ${file}, found ${actual}" >&2
+    exit 1
+  fi
+}
+
+hardware_setup="${test_root}/usr/libexec/bazzite-hardware-setup"
+steam="${test_root}/usr/bin/bazzite-steam"
+user_setup="${test_root}/usr/libexec/bazzite-user-setup"
+# shellcheck disable=SC2016
+deck_condition='if [[ $IMAGE_NAME =~ "deck" || $IMAGE_NAME == aerocore-os ]]; then'
+# shellcheck disable=SC2016
+non_deck_condition='if [[ "$IMAGE_NAME" != aerocore-os && "$IMAGE_NAME" != *deck* && "$IMAGE_NAME" != *dx* ]]; then'
+
+run_patch
+
+assert_count 1 "${non_deck_condition}" "${hardware_setup}"
+assert_count 1 "${deck_condition}" "${hardware_setup}"
+assert_count 1 "${deck_condition}" "${steam}"
+assert_count 3 "${deck_condition}" "${user_setup}"
+assert_count 1 'AeroCore Steam state migration' "${steam}"
+
+# A second run must recognize the patched fixture and make no further changes.
+first_digest="$(sha256sum "${hardware_setup}" "${steam}" "${user_setup}")"
+run_patch
+second_digest="$(sha256sum "${hardware_setup}" "${steam}" "${user_setup}")"
+
+if [[ "${first_digest}" != "${second_digest}" ]]; then
+  echo "Deck identity patch is not idempotent" >&2
+  exit 1
+fi
+
+assert_count 1 'AeroCore Steam state migration' "${steam}"
+
+echo "Bazzite 44 Deck identity fixture passed"