From ed4bd0d089d41c5d95fe74937acc2a779c6de6d4 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Tue, 25 Aug 2026 10:44:18 +0800
Subject: fix(installer): validate ISO payload metadata

Rewrite system-release atomically and reject stale or NUL-bearing
payload metadata before it reaches Anaconda bootupd.
---
 .github/workflows/build-installer-iso.yml | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

(limited to '.github/workflows/build-installer-iso.yml')

diff --git a/.github/workflows/build-installer-iso.yml b/.github/workflows/build-installer-iso.yml
index da3ef10..2402dfe 100644
--- a/.github/workflows/build-installer-iso.yml
+++ b/.github/workflows/build-installer-iso.yml
@@ -68,6 +68,26 @@ jobs:
         run: |
           sudo podman pull "${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}"
 
+      - name: Verify AeroCore install image identity
+        run: |
+          sudo podman run --rm --entrypoint /usr/bin/bash \
+            "${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}" -ceu '
+              system_release_target=$(readlink -f /etc/system-release)
+              if od -An -v -tx1 "$system_release_target" | awk '\''{ for (i = 1; i <= NF; i++) if ($i == "00") found = 1 } END { exit(found ? 0 : 1) }'\''; then
+                echo "NUL byte in ${system_release_target}" >&2
+                exit 1
+              fi
+              case "$(<"$system_release_target")" in
+                "AeroCore OS release $(rpm -E %fedora) ("*) ;;
+                *)
+                  echo "Unexpected system-release: $(<"$system_release_target")" >&2
+                  exit 1
+                  ;;
+              esac
+              jq -e '\''.["image-name"] == "aerocore-os" and .["image-vendor"] == "aerocore-io"'\'' \
+                /usr/share/ublue-os/image-info.json >/dev/null
+            '
+
       - name: Build installer ISO payload
         run: |
           mkdir -p output
-- 
cgit v1.2.3