From 301945ffb4db538ff25cece94a66acf80223340a Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 29 Jul 2026 00:28:49 +0800
Subject: Allow live user to launch installer

Authorize only the local active liveuser session for Anaconda's specific
polkit action, avoiding the transient password prompt.

Validate installer polkit rule syntax in the pull request workflow.
---
 .github/workflows/validate-installer-iso.yml                   |  6 ++++++
 .../overrides/etc/polkit-1/rules.d/10-aerocore-liveinst.rules  | 10 ++++++++++
 2 files changed, 16 insertions(+)
 create mode 100644 installer/system_files/overrides/etc/polkit-1/rules.d/10-aerocore-liveinst.rules

diff --git a/.github/workflows/validate-installer-iso.yml b/.github/workflows/validate-installer-iso.yml
index 131ad5b..391afd8 100644
--- a/.github/workflows/validate-installer-iso.yml
+++ b/.github/workflows/validate-installer-iso.yml
@@ -38,3 +38,9 @@ jobs:
             bash -n "$script"
           done
           bash -n system_files/usr/libexec/aerocore-instruments-setup
+
+      - name: Validate installer polkit rules
+        run: |
+          for rule in installer/system_files/overrides/etc/polkit-1/rules.d/*.rules; do
+            node --check < "$rule"
+          done
diff --git a/installer/system_files/overrides/etc/polkit-1/rules.d/10-aerocore-liveinst.rules b/installer/system_files/overrides/etc/polkit-1/rules.d/10-aerocore-liveinst.rules
new file mode 100644
index 0000000..0ebcfdd
--- /dev/null
+++ b/installer/system_files/overrides/etc/polkit-1/rules.d/10-aerocore-liveinst.rules
@@ -0,0 +1,10 @@
+// The installer action is privileged by design. Allow only the local,
+// active Live ISO session to launch it without a transient password prompt.
+polkit.addRule(function(action, subject) {
+    if (action.id === "org.fedoraproject.pkexec.liveinst" &&
+        subject.user === "liveuser" &&
+        subject.local === true &&
+        subject.active === true) {
+        return polkit.Result.YES;
+    }
+});
-- 
cgit v1.2.3


From b4f22ddbba57a9283a9c377d16db6043d7b36505 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 29 Jul 2026 00:48:06 +0800
Subject: Fix weak password handling in Live installer

Keep the Live CD account locked and enforce strict user/root password
validation so weak passwords remain on the form instead of aborting the
Anaconda installation.
---
 installer/lorax_templates/remove_root_password_prompt.tmpl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/installer/lorax_templates/remove_root_password_prompt.tmpl b/installer/lorax_templates/remove_root_password_prompt.tmpl
index 3bd0342..5e5b60d 100644
--- a/installer/lorax_templates/remove_root_password_prompt.tmpl
+++ b/installer/lorax_templates/remove_root_password_prompt.tmpl
@@ -1 +1 @@
-append etc/anaconda/profile.d/fedora-kinoite.conf "\\n[User Interface]\\nhidden_spokes =\\n    PasswordSpoke"
+append etc/anaconda/profile.d/fedora-kinoite.conf "\\n[User Interface]\\nhidden_spokes =\\n    PasswordSpoke\\npassword_policies =\\n    root (quality 1, length 6, strict)\\n    user (quality 1, length 6, empty, strict)\\n    luks (quality 1, length 6)"
-- 
cgit v1.2.3


From 52379b8b287353eaa139baacc1063ef2b8a7b28f Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 29 Jul 2026 00:51:24 +0800
Subject: Brand the Live installer as AeroCore OS

Update the Live ISO product metadata and system release label while
preserving the Fedora version and Kinoite variant.
---
 installer/build.sh | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/installer/build.sh b/installer/build.sh
index a382bcf..0cc1b8a 100755
--- a/installer/build.sh
+++ b/installer/build.sh
@@ -70,7 +70,12 @@ if [[ -f /usr/share/icons/hicolor/scalable/places/distributor-logo.svg ]]; then
     /usr/share/icons/hicolor/scalable/places/start-here.svg
 fi
 
-sed -i 's/^LOGO=.*/LOGO=distributor-logo/' /usr/lib/os-release
+live_version_id="$(awk -F= '$1 == "VERSION_ID" { gsub(/\"/, "", $2); print $2; exit }' /usr/lib/os-release)"
+live_product_name="AeroCore OS"
+sed -i "s/^NAME=.*/NAME=\"${live_product_name}\"/" /usr/lib/os-release
+sed -i "s/^PRETTY_NAME=.*/PRETTY_NAME=\"${live_product_name} ${live_version_id} (Kinoite)\"/" /usr/lib/os-release
+sed -i "s/^LOGO=.*/LOGO=distributor-logo/" /usr/lib/os-release
+printf '%s release %s (Kinoite)\n' "${live_product_name}" "${live_version_id}" > /etc/system-release
 
 for desktop_file in \
   /usr/share/applications/liveinst.desktop \
-- 
cgit v1.2.3