From 4dd41315acaa07112864a3833dfb7775d9b44274 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Fri, 24 Jul 2026 17:29:04 +0800
Subject: Rename live installer to installer ISO

Use installer ISO terminology across Just, workflows, scripts, docs, and
image payloads while preserving compatibility aliases for existing
commands.
---
 .github/workflows/build-installer-iso.yml | 180 ++++++++++++++++++++++++++++++
 1 file changed, 180 insertions(+)
 create mode 100644 .github/workflows/build-installer-iso.yml

(limited to '.github/workflows/build-installer-iso.yml')

diff --git a/.github/workflows/build-installer-iso.yml b/.github/workflows/build-installer-iso.yml
new file mode 100644
index 0000000..cfa7b80
--- /dev/null
+++ b/.github/workflows/build-installer-iso.yml
@@ -0,0 +1,180 @@
+name: Build installer ISO
+
+on:
+  workflow_dispatch:
+    inputs:
+      image_tag:
+        description: "AeroCore image tag to install"
+        required: false
+        default: latest
+        type: string
+  workflow_call:
+  workflow_run:
+    workflows:
+      - Build container image
+    types:
+      - completed
+    branches:
+      - main
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  build-installer-iso:
+    name: Build KDE installer ISO
+    if: github.event_name != 'workflow_run' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push')
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      packages: read
+
+    env:
+      IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
+      IMAGE_TAG: ${{ inputs.image_tag || 'latest' }}
+      ISO_FILE_TAG: ${{ github.ref_name == 'testing' && 'testing' || (inputs.image_tag || 'latest') }}
+      # Keep these aligned with the Fedora major used by the target bazzite-deck base image.
+      LIVE_BASE_IMAGE: quay.io/fedora/fedora-kinoite:43
+      FEDORA_VERSION: "43"
+
+    steps:
+      - name: Maximize build space
+        uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9
+        with:
+          remove-codeql: true
+
+      - name: Mount container storage BTRFS loopback
+        run: |
+          sudo truncate -s 70G /mnt/podman-storage.img
+          sudo mkfs.btrfs -f /mnt/podman-storage.img
+          sudo podman system reset --force
+          sudo systemctl stop podman.service
+          sudo mount -o compress-force=zstd:2 /mnt/podman-storage.img /var/lib/containers/storage
+          sudo systemctl start podman.service
+
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+
+      - name: Install just
+        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4
+
+      - name: Prepare image references
+        run: |
+          image_name="$(just image_name)"
+          image_registry="${IMAGE_REGISTRY,,}"
+          echo "IMAGE_NAME=${image_name,,}" >> "$GITHUB_ENV"
+          echo "IMAGE_REGISTRY=${image_registry}" >> "$GITHUB_ENV"
+
+      - name: Login to GHCR
+        run: |
+          echo '${{ secrets.GITHUB_TOKEN }}' | sudo podman login ghcr.io \
+            --username '${{ github.actor }}' --password-stdin
+
+      - name: Pull AeroCore install image
+        run: |
+          sudo podman pull "${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}"
+
+      - name: Build installer ISO payload
+        run: |
+          mkdir -p output
+          sudo podman tag \
+            "${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}" \
+            localhost/aerocore-installer-payload:latest
+          sudo podman save \
+            --format oci-archive \
+            --output output/install-payload.oci \
+            localhost/aerocore-installer-payload:latest
+
+          sudo podman build \
+            --cap-add sys_admin \
+            --security-opt label=disable \
+            --build-arg "BASE_IMAGE=${LIVE_BASE_IMAGE}" \
+            --build-arg "INSTALL_IMAGE_PAYLOAD=localhost/aerocore-installer-payload:latest" \
+            --build-arg "INSTALL_IMAGE_PAYLOAD_ARCHIVE=/install-payload.oci" \
+            --tag localhost/aerocore-installer-payload:latest \
+            --file installer/Containerfile \
+            .
+
+      - name: Build ISO
+        id: build
+        uses: Zeglius/titanoboa@7737f4748458252ac827dca14b3d6dd09298472a # revamp-pr
+        with:
+          image-ref: localhost/aerocore-installer-payload:latest
+          iso-dest: ${{ github.workspace }}/output/aerocore-os-${{ env.ISO_FILE_TAG }}-amd64.iso
+
+      - name: Normalize ISO output path
+        shell: bash
+        env:
+          GENERATED_ISO: ${{ steps.build.outputs.iso-dest }}
+          EXPECTED_ISO: ${{ github.workspace }}/output/aerocore-os-${{ env.ISO_FILE_TAG }}-amd64.iso
+        run: |
+          if [[ ! -f "${GENERATED_ISO}" ]]; then
+            echo "::error::Generated ISO does not exist at ${GENERATED_ISO}"
+            exit 1
+          fi
+          if [[ "${GENERATED_ISO}" != "${EXPECTED_ISO}" ]]; then
+            mkdir -p "$(dirname "${EXPECTED_ISO}")"
+            mv "${GENERATED_ISO}" "${EXPECTED_ISO}"
+          fi
+
+      - name: Display checksum
+        shell: bash
+        run: |
+          set -o pipefail
+          iso_path="output/aerocore-os-${ISO_FILE_TAG}-amd64.iso"
+          checksum_path="${iso_path}-CHECKSUM"
+          sha256sum "${iso_path}" | tee "${checksum_path}"
+          {
+            echo "# ISO Checksum (SHA256)"
+            echo
+            echo "ISO: $(basename "${iso_path}")"
+            echo
+            echo '```'
+            cat "${checksum_path}"
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Move ISO to upload directory
+        id: upload-directory
+        shell: bash
+        run: |
+          iso_upload_dir="${{ github.workspace }}/output/upload"
+          iso_path="${{ github.workspace }}/output/aerocore-os-${ISO_FILE_TAG}-amd64.iso"
+          iso_name="$(basename "${iso_path}")"
+
+          mkdir -p "${iso_upload_dir}"
+          mv "${iso_path}" "${iso_upload_dir}/"
+          (
+            cd "${iso_upload_dir}"
+            sha256sum "${iso_name}" | tee "${iso_name}-CHECKSUM"
+          )
+          echo "iso-upload-dir=${iso_upload_dir}" >> "$GITHUB_OUTPUT"
+
+      - name: Upload ISO checksum to Job Artifacts
+        if: github.ref_name == 'testing'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: aerocore-os-installer-iso-${{ env.ISO_FILE_TAG }}-checksum
+          path: ${{ steps.upload-directory.outputs.iso-upload-dir }}/*-CHECKSUM
+          if-no-files-found: error
+          retention-days: 1
+          compression-level: 0
+
+      - name: Upload ISO and checksum to R2
+        if: github.event_name == 'workflow_dispatch' && github.ref_name == 'main'
+        shell: bash
+        env:
+          RCLONE_CONFIG_R2_TYPE: s3
+          RCLONE_CONFIG_R2_PROVIDER: Cloudflare
+          RCLONE_CONFIG_R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
+          RCLONE_CONFIG_R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
+          RCLONE_CONFIG_R2_REGION: auto
+          RCLONE_CONFIG_R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
+          SOURCE_DIR: ${{ steps.upload-directory.outputs.iso-upload-dir }}
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y rclone
+          rclone copy "$SOURCE_DIR" R2:bazzite
-- 
cgit v1.2.3


From 9cdb3a038c2d29eefd95c4f5a274881a67e061c9 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Sat, 25 Jul 2026 07:39:18 +0800
Subject: Disable automatic installer ISO builds

Remove the workflow_run trigger from the installer ISO workflow while ISO construction is being tested manually. Keep workflow_dispatch and workflow_call available.
---
 .github/workflows/build-installer-iso.yml | 8 --------
 1 file changed, 8 deletions(-)

(limited to '.github/workflows/build-installer-iso.yml')

diff --git a/.github/workflows/build-installer-iso.yml b/.github/workflows/build-installer-iso.yml
index cfa7b80..bae0458 100644
--- a/.github/workflows/build-installer-iso.yml
+++ b/.github/workflows/build-installer-iso.yml
@@ -9,13 +9,6 @@ on:
         default: latest
         type: string
   workflow_call:
-  workflow_run:
-    workflows:
-      - Build container image
-    types:
-      - completed
-    branches:
-      - main
 
 permissions: {}
 
@@ -26,7 +19,6 @@ concurrency:
 jobs:
   build-installer-iso:
     name: Build KDE installer ISO
-    if: github.event_name != 'workflow_run' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push')
     runs-on: ubuntu-24.04
     permissions:
       contents: read
-- 
cgit v1.2.3


From db108b8b23c86ba39a2ba289fc6129a6325f045f Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Sat, 25 Jul 2026 09:57:45 +0800
Subject: Normalize installer payload and host naming

Use a formal local installer image tag and set aerocore-os as the
default hostname in both the live image and installed target system.
---
 .github/workflows/build-installer-iso.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to '.github/workflows/build-installer-iso.yml')

diff --git a/.github/workflows/build-installer-iso.yml b/.github/workflows/build-installer-iso.yml
index bae0458..7650ebb 100644
--- a/.github/workflows/build-installer-iso.yml
+++ b/.github/workflows/build-installer-iso.yml
@@ -74,7 +74,7 @@ jobs:
           mkdir -p output
           sudo podman tag \
             "${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}" \
-            localhost/aerocore-installer-payload:latest
+            localhost/aerocore-os-installer:latest
           sudo podman save \
             --format oci-archive \
             --output output/install-payload.oci \
@@ -86,7 +86,7 @@ jobs:
             --build-arg "BASE_IMAGE=${LIVE_BASE_IMAGE}" \
             --build-arg "INSTALL_IMAGE_PAYLOAD=localhost/aerocore-installer-payload:latest" \
             --build-arg "INSTALL_IMAGE_PAYLOAD_ARCHIVE=/install-payload.oci" \
-            --tag localhost/aerocore-installer-payload:latest \
+            --tag localhost/aerocore-os-installer:latest \
             --file installer/Containerfile \
             .
 
@@ -94,7 +94,7 @@ jobs:
         id: build
         uses: Zeglius/titanoboa@7737f4748458252ac827dca14b3d6dd09298472a # revamp-pr
         with:
-          image-ref: localhost/aerocore-installer-payload:latest
+          image-ref: localhost/aerocore-os-installer:latest
           iso-dest: ${{ github.workspace }}/output/aerocore-os-${{ env.ISO_FILE_TAG }}-amd64.iso
 
       - name: Normalize ISO output path
-- 
cgit v1.2.3


From ce39b6bacb3fa9e7ec2770798649f4f3a1bd6678 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Sat, 25 Jul 2026 10:13:57 +0800
Subject: Fix stale installer payload references

---
 .github/workflows/build-installer-iso.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to '.github/workflows/build-installer-iso.yml')

diff --git a/.github/workflows/build-installer-iso.yml b/.github/workflows/build-installer-iso.yml
index 7650ebb..f7897b9 100644
--- a/.github/workflows/build-installer-iso.yml
+++ b/.github/workflows/build-installer-iso.yml
@@ -78,13 +78,13 @@ jobs:
           sudo podman save \
             --format oci-archive \
             --output output/install-payload.oci \
-            localhost/aerocore-installer-payload:latest
+            localhost/aerocore-os-installer:latest
 
           sudo podman build \
             --cap-add sys_admin \
             --security-opt label=disable \
             --build-arg "BASE_IMAGE=${LIVE_BASE_IMAGE}" \
-            --build-arg "INSTALL_IMAGE_PAYLOAD=localhost/aerocore-installer-payload:latest" \
+            --build-arg "INSTALL_IMAGE_PAYLOAD=localhost/aerocore-os-installer:latest" \
             --build-arg "INSTALL_IMAGE_PAYLOAD_ARCHIVE=/install-payload.oci" \
             --tag localhost/aerocore-os-installer:latest \
             --file installer/Containerfile \
-- 
cgit v1.2.3


From 0ebf76e160c1e45d537e24d145fed47a38d8d99d Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Sat, 25 Jul 2026 22:49:06 +0800
Subject: Route installer updates through OSTREE_IMAGE_REF

Use the configured ref for ISO boot origins and derive GHCR fallbacks
from the current repository instead of hardcoding the image path.
---
 .github/workflows/build-installer-iso.yml | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

(limited to '.github/workflows/build-installer-iso.yml')

diff --git a/.github/workflows/build-installer-iso.yml b/.github/workflows/build-installer-iso.yml
index f7897b9..a6348aa 100644
--- a/.github/workflows/build-installer-iso.yml
+++ b/.github/workflows/build-installer-iso.yml
@@ -31,6 +31,7 @@ jobs:
       # Keep these aligned with the Fedora major used by the target bazzite-deck base image.
       LIVE_BASE_IMAGE: quay.io/fedora/fedora-kinoite:43
       FEDORA_VERSION: "43"
+      OSTREE_IMAGE_REF: ${{ vars.OSTREE_IMAGE_REF }}
 
     steps:
       - name: Maximize build space
@@ -72,19 +73,23 @@ jobs:
       - name: Build installer ISO payload
         run: |
           mkdir -p output
+          ostree_image_ref="${OSTREE_IMAGE_REF:-ostree-image-signed:docker://${IMAGE_REGISTRY}/${IMAGE_NAME}}"
+          install_image_ref="${ostree_image_ref#ostree-image-signed:docker://}"
+          install_image_ref="${install_image_ref#ostree-unverified-registry:docker://}"
+          install_image_ref="${install_image_ref#docker://}"
           sudo podman tag \
             "${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}" \
-            localhost/aerocore-os-installer:latest
+            "${install_image_ref}:${IMAGE_TAG}"
           sudo podman save \
             --format oci-archive \
             --output output/install-payload.oci \
-            localhost/aerocore-os-installer:latest
+            "${install_image_ref}:${IMAGE_TAG}"
 
           sudo podman build \
             --cap-add sys_admin \
             --security-opt label=disable \
             --build-arg "BASE_IMAGE=${LIVE_BASE_IMAGE}" \
-            --build-arg "INSTALL_IMAGE_PAYLOAD=localhost/aerocore-os-installer:latest" \
+            --build-arg "INSTALL_IMAGE_PAYLOAD=${install_image_ref}:${IMAGE_TAG}" \
             --build-arg "INSTALL_IMAGE_PAYLOAD_ARCHIVE=/install-payload.oci" \
             --tag localhost/aerocore-os-installer:latest \
             --file installer/Containerfile \
-- 
cgit v1.2.3


From 26848f158c30f700258f4eab5df6e3a448a8d35c Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 29 Jul 2026 08:23:02 +0800
Subject: Fix installer update origin

Rewrite installed bootc origins to the configured signed registry
reference.
---
 .github/workflows/build-installer-iso.yml | 2 ++
 1 file changed, 2 insertions(+)

(limited to '.github/workflows/build-installer-iso.yml')

diff --git a/.github/workflows/build-installer-iso.yml b/.github/workflows/build-installer-iso.yml
index a6348aa..143eafc 100644
--- a/.github/workflows/build-installer-iso.yml
+++ b/.github/workflows/build-installer-iso.yml
@@ -91,6 +91,8 @@ jobs:
             --build-arg "BASE_IMAGE=${LIVE_BASE_IMAGE}" \
             --build-arg "INSTALL_IMAGE_PAYLOAD=${install_image_ref}:${IMAGE_TAG}" \
             --build-arg "INSTALL_IMAGE_PAYLOAD_ARCHIVE=/install-payload.oci" \
+            --build-arg "INSTALL_IMAGE_TAG=${IMAGE_TAG}" \
+            --build-arg "OSTREE_IMAGE_REF=${ostree_image_ref}" \
             --tag localhost/aerocore-os-installer:latest \
             --file installer/Containerfile \
             .
-- 
cgit v1.2.3


From 636dcb9dc7af0c23bddeb855da8479eb06df090a Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 5 Aug 2026 06:50:26 +0800
Subject: Align ISO workflow live naming

Match Bazzite's live ISO workflow label and output filename while keeping local build and run helpers pointed at the same artifact.
---
 .github/workflows/build-installer-iso.yml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

(limited to '.github/workflows/build-installer-iso.yml')

diff --git a/.github/workflows/build-installer-iso.yml b/.github/workflows/build-installer-iso.yml
index 143eafc..1352080 100644
--- a/.github/workflows/build-installer-iso.yml
+++ b/.github/workflows/build-installer-iso.yml
@@ -1,4 +1,4 @@
-name: Build installer ISO
+name: Build Live ISOs
 
 on:
   workflow_dispatch:
@@ -18,7 +18,7 @@ concurrency:
 
 jobs:
   build-installer-iso:
-    name: Build KDE installer ISO
+    name: Build KDE live ISO
     runs-on: ubuntu-24.04
     permissions:
       contents: read
@@ -102,13 +102,13 @@ jobs:
         uses: Zeglius/titanoboa@7737f4748458252ac827dca14b3d6dd09298472a # revamp-pr
         with:
           image-ref: localhost/aerocore-os-installer:latest
-          iso-dest: ${{ github.workspace }}/output/aerocore-os-${{ env.ISO_FILE_TAG }}-amd64.iso
+          iso-dest: ${{ github.workspace }}/output/aerocore-os-${{ env.ISO_FILE_TAG }}-live-amd64.iso
 
       - name: Normalize ISO output path
         shell: bash
         env:
           GENERATED_ISO: ${{ steps.build.outputs.iso-dest }}
-          EXPECTED_ISO: ${{ github.workspace }}/output/aerocore-os-${{ env.ISO_FILE_TAG }}-amd64.iso
+          EXPECTED_ISO: ${{ github.workspace }}/output/aerocore-os-${{ env.ISO_FILE_TAG }}-live-amd64.iso
         run: |
           if [[ ! -f "${GENERATED_ISO}" ]]; then
             echo "::error::Generated ISO does not exist at ${GENERATED_ISO}"
@@ -123,7 +123,7 @@ jobs:
         shell: bash
         run: |
           set -o pipefail
-          iso_path="output/aerocore-os-${ISO_FILE_TAG}-amd64.iso"
+          iso_path="output/aerocore-os-${ISO_FILE_TAG}-live-amd64.iso"
           checksum_path="${iso_path}-CHECKSUM"
           sha256sum "${iso_path}" | tee "${checksum_path}"
           {
@@ -141,7 +141,7 @@ jobs:
         shell: bash
         run: |
           iso_upload_dir="${{ github.workspace }}/output/upload"
-          iso_path="${{ github.workspace }}/output/aerocore-os-${ISO_FILE_TAG}-amd64.iso"
+          iso_path="${{ github.workspace }}/output/aerocore-os-${ISO_FILE_TAG}-live-amd64.iso"
           iso_name="$(basename "${iso_path}")"
 
           mkdir -p "${iso_upload_dir}"
-- 
cgit v1.2.3


From 80cde14b9c368f58e8f16ad121396ce2f1a50f44 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Fri, 21 Aug 2026 08:42:38 +0800
Subject: Adapt to Bazzite 44

Update Deck identity matching for the new upstream scripts and add
fixture coverage for patch idempotence.

Move the live installer base to Fedora 44 while retaining the Fedora 43
Anaconda workaround for explicit legacy builds.
---
 .github/workflows/build-installer-iso.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to '.github/workflows/build-installer-iso.yml')

diff --git a/.github/workflows/build-installer-iso.yml b/.github/workflows/build-installer-iso.yml
index 1352080..cebb0a6 100644
--- a/.github/workflows/build-installer-iso.yml
+++ b/.github/workflows/build-installer-iso.yml
@@ -29,8 +29,8 @@ jobs:
       IMAGE_TAG: ${{ inputs.image_tag || 'latest' }}
       ISO_FILE_TAG: ${{ github.ref_name == 'testing' && 'testing' || (inputs.image_tag || 'latest') }}
       # Keep these aligned with the Fedora major used by the target bazzite-deck base image.
-      LIVE_BASE_IMAGE: quay.io/fedora/fedora-kinoite:43
-      FEDORA_VERSION: "43"
+      LIVE_BASE_IMAGE: quay.io/fedora/fedora-kinoite:44
+      FEDORA_VERSION: "44"
       OSTREE_IMAGE_REF: ${{ vars.OSTREE_IMAGE_REF }}
 
     steps:
-- 
cgit v1.2.3


From 0a25c4e957f98df15c5e914fd647c3cd6de54456 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Sat, 22 Aug 2026 00:08:30 +0800
Subject: Publish testing ISO to R2

---
 .github/workflows/build-installer-iso.yml | 12 +-----------
 1 file changed, 1 insertion(+), 11 deletions(-)

(limited to '.github/workflows/build-installer-iso.yml')

diff --git a/.github/workflows/build-installer-iso.yml b/.github/workflows/build-installer-iso.yml
index cebb0a6..9073077 100644
--- a/.github/workflows/build-installer-iso.yml
+++ b/.github/workflows/build-installer-iso.yml
@@ -152,18 +152,8 @@ jobs:
           )
           echo "iso-upload-dir=${iso_upload_dir}" >> "$GITHUB_OUTPUT"
 
-      - name: Upload ISO checksum to Job Artifacts
-        if: github.ref_name == 'testing'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: aerocore-os-installer-iso-${{ env.ISO_FILE_TAG }}-checksum
-          path: ${{ steps.upload-directory.outputs.iso-upload-dir }}/*-CHECKSUM
-          if-no-files-found: error
-          retention-days: 1
-          compression-level: 0
-
       - name: Upload ISO and checksum to R2
-        if: github.event_name == 'workflow_dispatch' && github.ref_name == 'main'
+        if: github.event_name == 'workflow_dispatch' && (github.ref_name == 'main' || github.ref_name == 'testing')
         shell: bash
         env:
           RCLONE_CONFIG_R2_TYPE: s3
-- 
cgit v1.2.3


From 10411b5e32b78f57b6ad995c434cfc4fc390d689 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 26 Aug 2026 10:59:21 +0800
Subject: fix(config): make local dotenv optional

Load a private .env when present, but keep CI configuration in GitHub
runtime variables and retain the tracked template as a guide.
---
 .github/workflows/build-installer-iso.yml | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

(limited to '.github/workflows/build-installer-iso.yml')

diff --git a/.github/workflows/build-installer-iso.yml b/.github/workflows/build-installer-iso.yml
index 9073077..da3ef10 100644
--- a/.github/workflows/build-installer-iso.yml
+++ b/.github/workflows/build-installer-iso.yml
@@ -26,6 +26,7 @@ jobs:
 
     env:
       IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
+      IMAGE_NAME: ${{ vars.IMAGE_NAME || github.event.repository.name }}
       IMAGE_TAG: ${{ inputs.image_tag || 'latest' }}
       ISO_FILE_TAG: ${{ github.ref_name == 'testing' && 'testing' || (inputs.image_tag || 'latest') }}
       # Keep these aligned with the Fedora major used by the target bazzite-deck base image.
@@ -51,12 +52,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
-      - name: Install just
-        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4
-
       - name: Prepare image references
         run: |
-          image_name="$(just image_name)"
+          image_name="${IMAGE_NAME,,}"
           image_registry="${IMAGE_REGISTRY,,}"
           echo "IMAGE_NAME=${image_name,,}" >> "$GITHUB_ENV"
           echo "IMAGE_REGISTRY=${image_registry}" >> "$GITHUB_ENV"
-- 
cgit v1.2.3


From ed4bd0d089d41c5d95fe74937acc2a779c6de6d4 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Tue, 25 Aug 2026 10:44:18 +0800
Subject: fix(installer): validate ISO payload metadata

Rewrite system-release atomically and reject stale or NUL-bearing
payload metadata before it reaches Anaconda bootupd.
---
 .github/workflows/build-installer-iso.yml | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

(limited to '.github/workflows/build-installer-iso.yml')

diff --git a/.github/workflows/build-installer-iso.yml b/.github/workflows/build-installer-iso.yml
index da3ef10..2402dfe 100644
--- a/.github/workflows/build-installer-iso.yml
+++ b/.github/workflows/build-installer-iso.yml
@@ -68,6 +68,26 @@ jobs:
         run: |
           sudo podman pull "${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}"
 
+      - name: Verify AeroCore install image identity
+        run: |
+          sudo podman run --rm --entrypoint /usr/bin/bash \
+            "${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}" -ceu '
+              system_release_target=$(readlink -f /etc/system-release)
+              if od -An -v -tx1 "$system_release_target" | awk '\''{ for (i = 1; i <= NF; i++) if ($i == "00") found = 1 } END { exit(found ? 0 : 1) }'\''; then
+                echo "NUL byte in ${system_release_target}" >&2
+                exit 1
+              fi
+              case "$(<"$system_release_target")" in
+                "AeroCore OS release $(rpm -E %fedora) ("*) ;;
+                *)
+                  echo "Unexpected system-release: $(<"$system_release_target")" >&2
+                  exit 1
+                  ;;
+              esac
+              jq -e '\''.["image-name"] == "aerocore-os" and .["image-vendor"] == "aerocore-io"'\'' \
+                /usr/share/ublue-os/image-info.json >/dev/null
+            '
+
       - name: Build installer ISO payload
         run: |
           mkdir -p output
-- 
cgit v1.2.3


From 589ad97b642f779d036500a253d587f403c0678e Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Fri, 28 Aug 2026 17:44:13 +0800
Subject: fix: validate image Fedora version

---
 .github/workflows/build-installer-iso.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to '.github/workflows/build-installer-iso.yml')

diff --git a/.github/workflows/build-installer-iso.yml b/.github/workflows/build-installer-iso.yml
index 2402dfe..d8faa69 100644
--- a/.github/workflows/build-installer-iso.yml
+++ b/.github/workflows/build-installer-iso.yml
@@ -73,12 +73,13 @@ jobs:
           sudo podman run --rm --entrypoint /usr/bin/bash \
             "${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}" -ceu '
               system_release_target=$(readlink -f /etc/system-release)
+              fedora_version=$(jq -er '."fedora-version" | strings' /usr/share/ublue-os/image-info.json)
               if od -An -v -tx1 "$system_release_target" | awk '\''{ for (i = 1; i <= NF; i++) if ($i == "00") found = 1 } END { exit(found ? 0 : 1) }'\''; then
                 echo "NUL byte in ${system_release_target}" >&2
                 exit 1
               fi
               case "$(<"$system_release_target")" in
-                "AeroCore OS release $(rpm -E %fedora) ("*) ;;
+                "AeroCore OS release ${fedora_version} ("*) ;;
                 *)
                   echo "Unexpected system-release: $(<"$system_release_target")" >&2
                   exit 1
-- 
cgit v1.2.3


From c8ae5599162c956c133ea6bebdbaf30f511aa5a1 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Sat, 29 Aug 2026 17:41:50 +0800
Subject: ci: skip ISO image identity check

---
 .github/workflows/build-installer-iso.yml | 21 ---------------------
 1 file changed, 21 deletions(-)

(limited to '.github/workflows/build-installer-iso.yml')

diff --git a/.github/workflows/build-installer-iso.yml b/.github/workflows/build-installer-iso.yml
index d8faa69..da3ef10 100644
--- a/.github/workflows/build-installer-iso.yml
+++ b/.github/workflows/build-installer-iso.yml
@@ -68,27 +68,6 @@ jobs:
         run: |
           sudo podman pull "${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}"
 
-      - name: Verify AeroCore install image identity
-        run: |
-          sudo podman run --rm --entrypoint /usr/bin/bash \
-            "${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}" -ceu '
-              system_release_target=$(readlink -f /etc/system-release)
-              fedora_version=$(jq -er '."fedora-version" | strings' /usr/share/ublue-os/image-info.json)
-              if od -An -v -tx1 "$system_release_target" | awk '\''{ for (i = 1; i <= NF; i++) if ($i == "00") found = 1 } END { exit(found ? 0 : 1) }'\''; then
-                echo "NUL byte in ${system_release_target}" >&2
-                exit 1
-              fi
-              case "$(<"$system_release_target")" in
-                "AeroCore OS release ${fedora_version} ("*) ;;
-                *)
-                  echo "Unexpected system-release: $(<"$system_release_target")" >&2
-                  exit 1
-                  ;;
-              esac
-              jq -e '\''.["image-name"] == "aerocore-os" and .["image-vendor"] == "aerocore-io"'\'' \
-                /usr/share/ublue-os/image-info.json >/dev/null
-            '
-
       - name: Build installer ISO payload
         run: |
           mkdir -p output
-- 
cgit v1.2.3