From 26848f158c30f700258f4eab5df6e3a448a8d35c Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 29 Jul 2026 08:23:02 +0800
Subject: Fix installer update origin

Rewrite installed bootc origins to the configured signed registry
reference.
---
 .github/workflows/build-installer-iso.yml |  2 ++
 installer/Containerfile                   |  6 ++++++
 installer/build.sh                        | 11 +++++++++++
 just_scripts/build-installer-iso.sh       |  2 ++
 4 files changed, 21 insertions(+)

diff --git a/.github/workflows/build-installer-iso.yml b/.github/workflows/build-installer-iso.yml
index a6348aa..143eafc 100644
--- a/.github/workflows/build-installer-iso.yml
+++ b/.github/workflows/build-installer-iso.yml
@@ -91,6 +91,8 @@ jobs:
             --build-arg "BASE_IMAGE=${LIVE_BASE_IMAGE}" \
             --build-arg "INSTALL_IMAGE_PAYLOAD=${install_image_ref}:${IMAGE_TAG}" \
             --build-arg "INSTALL_IMAGE_PAYLOAD_ARCHIVE=/install-payload.oci" \
+            --build-arg "INSTALL_IMAGE_TAG=${IMAGE_TAG}" \
+            --build-arg "OSTREE_IMAGE_REF=${ostree_image_ref}" \
             --tag localhost/aerocore-os-installer:latest \
             --file installer/Containerfile \
             .
diff --git a/installer/Containerfile b/installer/Containerfile
index cf20e4f..32b327e 100644
--- a/installer/Containerfile
+++ b/installer/Containerfile
@@ -6,6 +6,8 @@ ARG IMAGE_VENDOR=AeroCore-IO
 ARG IMAGE_NAME=aerocore-os
 ARG INSTALL_IMAGE_PAYLOAD=ghcr.io/${IMAGE_VENDOR}/${IMAGE_NAME}:stable
 ARG INSTALL_IMAGE_PAYLOAD_ARCHIVE=/install-payload.oci
+ARG INSTALL_IMAGE_TAG=latest
+ARG OSTREE_IMAGE_REF=ostree-image-signed:docker://ghcr.io/${IMAGE_VENDOR}/${IMAGE_NAME}
 
 FROM ${BASE_IMAGE}
 
@@ -14,10 +16,14 @@ ARG IMAGE_VENDOR
 ARG IMAGE_NAME
 ARG INSTALL_IMAGE_PAYLOAD
 ARG INSTALL_IMAGE_PAYLOAD_ARCHIVE
+ARG INSTALL_IMAGE_TAG
+ARG OSTREE_IMAGE_REF
 
 RUN --mount=type=bind,source=.,target=/src \
     --mount=type=bind,source=output/install-payload.oci,target=/install-payload.oci,ro \
     env BASE_IMAGE="${BASE_IMAGE}" \
         INSTALL_IMAGE_PAYLOAD="${INSTALL_IMAGE_PAYLOAD}" \
         INSTALL_IMAGE_PAYLOAD_ARCHIVE="${INSTALL_IMAGE_PAYLOAD_ARCHIVE}" \
+        INSTALL_IMAGE_TAG="${INSTALL_IMAGE_TAG}" \
+        OSTREE_IMAGE_REF="${OSTREE_IMAGE_REF}" \
         /src/installer/build.sh
diff --git a/installer/build.sh b/installer/build.sh
index 0cc1b8a..3093dcc 100755
--- a/installer/build.sh
+++ b/installer/build.sh
@@ -6,6 +6,9 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 BASE_IMAGE=${BASE_IMAGE:?}
 INSTALL_IMAGE_PAYLOAD=${INSTALL_IMAGE_PAYLOAD:?}
 INSTALL_IMAGE_PAYLOAD_ARCHIVE=${INSTALL_IMAGE_PAYLOAD_ARCHIVE:-}
+INSTALL_IMAGE_TAG=${INSTALL_IMAGE_TAG:?}
+OSTREE_IMAGE_REF=${OSTREE_IMAGE_REF:?}
+ostree_origin_ref="${OSTREE_IMAGE_REF}:${INSTALL_IMAGE_TAG}"
 
 # The installer is a live KDE environment.  Keep the installed system payload
 # separate: it is the AeroCore image, while BASE_IMAGE provides the live UI.
@@ -124,6 +127,14 @@ df -h /var/tmp \${target_tmp}
 
 ostreecontainer --url=${INSTALL_IMAGE_PAYLOAD} --transport=containers-storage --no-signature-verification
 
+# The local containers-storage deployment is intentionally unverified because
+# the payload is loaded from an OCI archive. Point future bootc updates at the
+# signed registry reference configured for the image instead.
+%post --erroronfail --log=/tmp/aerocore-origin.log
+set -eux
+sed -i 's|container-image-reference=.*|container-image-reference=${ostree_origin_ref}|' /ostree/deploy/default/deploy/*.origin
+%end
+
 %post --nochroot --log=/tmp/aerocore-hostname.log
 set -eux
 target_root=
diff --git a/just_scripts/build-installer-iso.sh b/just_scripts/build-installer-iso.sh
index abd668f..2b1f7ae 100755
--- a/just_scripts/build-installer-iso.sh
+++ b/just_scripts/build-installer-iso.sh
@@ -90,6 +90,8 @@ ensure_rootful_image
   --build-arg "BASE_IMAGE=${live_base_image}" \
   --build-arg "INSTALL_IMAGE_PAYLOAD=${payload}" \
   --build-arg "INSTALL_IMAGE_PAYLOAD_ARCHIVE=/install-payload.oci" \
+  --build-arg "INSTALL_IMAGE_TAG=${image_tag}" \
+  --build-arg "OSTREE_IMAGE_REF=${ostree_image_ref}" \
   --tag "${payload}" \
   --file installer/Containerfile \
   .
-- 
cgit v1.2.3