diff options
Diffstat (limited to 'installer')
| -rw-r--r-- | installer/Containerfile | 6 | ||||
| -rwxr-xr-x | installer/build.sh | 11 |
2 files changed, 17 insertions, 0 deletions
diff --git a/installer/Containerfile b/installer/Containerfile index cf20e4f..32b327e 100644 --- a/installer/Containerfile +++ b/installer/Containerfile @@ -6,6 +6,8 @@ ARG IMAGE_VENDOR=AeroCore-IO ARG IMAGE_NAME=aerocore-os ARG INSTALL_IMAGE_PAYLOAD=ghcr.io/${IMAGE_VENDOR}/${IMAGE_NAME}:stable ARG INSTALL_IMAGE_PAYLOAD_ARCHIVE=/install-payload.oci +ARG INSTALL_IMAGE_TAG=latest +ARG OSTREE_IMAGE_REF=ostree-image-signed:docker://ghcr.io/${IMAGE_VENDOR}/${IMAGE_NAME} FROM ${BASE_IMAGE} @@ -14,10 +16,14 @@ ARG IMAGE_VENDOR ARG IMAGE_NAME ARG INSTALL_IMAGE_PAYLOAD ARG INSTALL_IMAGE_PAYLOAD_ARCHIVE +ARG INSTALL_IMAGE_TAG +ARG OSTREE_IMAGE_REF RUN --mount=type=bind,source=.,target=/src \ --mount=type=bind,source=output/install-payload.oci,target=/install-payload.oci,ro \ env BASE_IMAGE="${BASE_IMAGE}" \ INSTALL_IMAGE_PAYLOAD="${INSTALL_IMAGE_PAYLOAD}" \ INSTALL_IMAGE_PAYLOAD_ARCHIVE="${INSTALL_IMAGE_PAYLOAD_ARCHIVE}" \ + INSTALL_IMAGE_TAG="${INSTALL_IMAGE_TAG}" \ + OSTREE_IMAGE_REF="${OSTREE_IMAGE_REF}" \ /src/installer/build.sh diff --git a/installer/build.sh b/installer/build.sh index 0cc1b8a..3093dcc 100755 --- a/installer/build.sh +++ b/installer/build.sh @@ -6,6 +6,9 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" BASE_IMAGE=${BASE_IMAGE:?} INSTALL_IMAGE_PAYLOAD=${INSTALL_IMAGE_PAYLOAD:?} INSTALL_IMAGE_PAYLOAD_ARCHIVE=${INSTALL_IMAGE_PAYLOAD_ARCHIVE:-} +INSTALL_IMAGE_TAG=${INSTALL_IMAGE_TAG:?} +OSTREE_IMAGE_REF=${OSTREE_IMAGE_REF:?} +ostree_origin_ref="${OSTREE_IMAGE_REF}:${INSTALL_IMAGE_TAG}" # The installer is a live KDE environment. Keep the installed system payload # separate: it is the AeroCore image, while BASE_IMAGE provides the live UI. @@ -124,6 +127,14 @@ df -h /var/tmp \${target_tmp} ostreecontainer --url=${INSTALL_IMAGE_PAYLOAD} --transport=containers-storage --no-signature-verification +# The local containers-storage deployment is intentionally unverified because +# the payload is loaded from an OCI archive. Point future bootc updates at the +# signed registry reference configured for the image instead. +%post --erroronfail --log=/tmp/aerocore-origin.log +set -eux +sed -i 's|container-image-reference=.*|container-image-reference=${ostree_origin_ref}|' /ostree/deploy/default/deploy/*.origin +%end + %post --nochroot --log=/tmp/aerocore-hostname.log set -eux target_root= |