From c1f3f42c14e5bbf1c8181d1469ac58f1d9f7ebf3 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 29 Jul 2026 00:28:49 +0800
Subject: Allow live user to launch installer

Authorize only the local active liveuser session for Anaconda's specific
polkit action, avoiding the transient password prompt.

Validate installer polkit rule syntax in the pull request workflow.
---
 .github/workflows/validate-installer-iso.yml                   |  6 ++++++
 .../overrides/etc/polkit-1/rules.d/10-aerocore-liveinst.rules  | 10 ++++++++++
 2 files changed, 16 insertions(+)
 create mode 100644 installer/system_files/overrides/etc/polkit-1/rules.d/10-aerocore-liveinst.rules

diff --git a/.github/workflows/validate-installer-iso.yml b/.github/workflows/validate-installer-iso.yml
index 131ad5b..391afd8 100644
--- a/.github/workflows/validate-installer-iso.yml
+++ b/.github/workflows/validate-installer-iso.yml
@@ -38,3 +38,9 @@ jobs:
             bash -n "$script"
           done
           bash -n system_files/usr/libexec/aerocore-instruments-setup
+
+      - name: Validate installer polkit rules
+        run: |
+          for rule in installer/system_files/overrides/etc/polkit-1/rules.d/*.rules; do
+            node --check < "$rule"
+          done
diff --git a/installer/system_files/overrides/etc/polkit-1/rules.d/10-aerocore-liveinst.rules b/installer/system_files/overrides/etc/polkit-1/rules.d/10-aerocore-liveinst.rules
new file mode 100644
index 0000000..0ebcfdd
--- /dev/null
+++ b/installer/system_files/overrides/etc/polkit-1/rules.d/10-aerocore-liveinst.rules
@@ -0,0 +1,10 @@
+// The installer action is privileged by design. Allow only the local,
+// active Live ISO session to launch it without a transient password prompt.
+polkit.addRule(function(action, subject) {
+    if (action.id === "org.fedoraproject.pkexec.liveinst" &&
+        subject.user === "liveuser" &&
+        subject.local === true &&
+        subject.active === true) {
+        return polkit.Result.YES;
+    }
+});
-- 
cgit v1.2.3


From 20b653d974a43d277e87a971eeaed22cf22d9811 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 29 Jul 2026 00:48:06 +0800
Subject: Fix weak password handling in Live installer

Keep the Live CD account locked and enforce strict user/root password
validation so weak passwords remain on the form instead of aborting the
Anaconda installation.
---
 installer/lorax_templates/remove_root_password_prompt.tmpl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/installer/lorax_templates/remove_root_password_prompt.tmpl b/installer/lorax_templates/remove_root_password_prompt.tmpl
index 3bd0342..5e5b60d 100644
--- a/installer/lorax_templates/remove_root_password_prompt.tmpl
+++ b/installer/lorax_templates/remove_root_password_prompt.tmpl
@@ -1 +1 @@
-append etc/anaconda/profile.d/fedora-kinoite.conf "\\n[User Interface]\\nhidden_spokes =\\n    PasswordSpoke"
+append etc/anaconda/profile.d/fedora-kinoite.conf "\\n[User Interface]\\nhidden_spokes =\\n    PasswordSpoke\\npassword_policies =\\n    root (quality 1, length 6, strict)\\n    user (quality 1, length 6, empty, strict)\\n    luks (quality 1, length 6)"
-- 
cgit v1.2.3


From 13e8465b802802657d10f935bbfc7dae3aa5286b Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 29 Jul 2026 00:51:24 +0800
Subject: Brand the Live installer as AeroCore OS

Update the Live ISO product metadata and system release label while
preserving the Fedora version and Kinoite variant.
---
 installer/build.sh | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/installer/build.sh b/installer/build.sh
index a382bcf..0cc1b8a 100755
--- a/installer/build.sh
+++ b/installer/build.sh
@@ -70,7 +70,12 @@ if [[ -f /usr/share/icons/hicolor/scalable/places/distributor-logo.svg ]]; then
     /usr/share/icons/hicolor/scalable/places/start-here.svg
 fi
 
-sed -i 's/^LOGO=.*/LOGO=distributor-logo/' /usr/lib/os-release
+live_version_id="$(awk -F= '$1 == "VERSION_ID" { gsub(/\"/, "", $2); print $2; exit }' /usr/lib/os-release)"
+live_product_name="AeroCore OS"
+sed -i "s/^NAME=.*/NAME=\"${live_product_name}\"/" /usr/lib/os-release
+sed -i "s/^PRETTY_NAME=.*/PRETTY_NAME=\"${live_product_name} ${live_version_id} (Kinoite)\"/" /usr/lib/os-release
+sed -i "s/^LOGO=.*/LOGO=distributor-logo/" /usr/lib/os-release
+printf '%s release %s (Kinoite)\n' "${live_product_name}" "${live_version_id}" > /etc/system-release
 
 for desktop_file in \
   /usr/share/applications/liveinst.desktop \
-- 
cgit v1.2.3