From ed4bd0d089d41c5d95fe74937acc2a779c6de6d4 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Tue, 25 Aug 2026 10:44:18 +0800
Subject: fix(installer): validate ISO payload metadata

Rewrite system-release atomically and reject stale or NUL-bearing
payload metadata before it reaches Anaconda bootupd.
---
 build_files/image-info | 29 ++++++++++++++++++++++++++++-
 1 file changed, 28 insertions(+), 1 deletion(-)

(limited to 'build_files/image-info')

diff --git a/build_files/image-info b/build_files/image-info
index bd66383..ae4406a 100755
--- a/build_files/image-info
+++ b/build_files/image-info
@@ -40,6 +40,20 @@ cat > "$IMAGE_INFO" <<EOF
 }
 EOF
 
+# Fail the image build if the metadata file was not rewritten with the
+# downstream identity.  A base Bazzite image can otherwise leave a plausible
+# looking build with image-info.json still claiming bazzite-deck.
+if [[ "$IMAGE_NAME" != "aerocore-os" || "$IMAGE_VENDOR" != "aerocore-io" ]]; then
+  echo "Unexpected AeroCore image identity: ${IMAGE_VENDOR}/${IMAGE_NAME}" >&2
+  exit 1
+fi
+
+jq -e \
+  --arg image_name "$IMAGE_NAME" \
+  --arg image_vendor "$IMAGE_VENDOR" \
+  '.["image-name"] == $image_name and .["image-vendor"] == $image_vendor and .["image-ref"] != null' \
+  "$IMAGE_INFO" >/dev/null
+
 # Keep the display name consistent across desktop settings and os-release.
 sed -i "s/^VARIANT_ID=.*/VARIANT_ID=$IMAGE_ID/" /usr/lib/os-release
 sed -i "s/^PRETTY_NAME=.*/PRETTY_NAME=\"$IMAGE_PRETTY_NAME\"/" /usr/lib/os-release
@@ -56,7 +70,20 @@ sed -i "s/^ANSI_COLOR=.*/ANSI_COLOR=\"$LOGO_COLOR\"/" /usr/lib/os-release
 sed -i "/^REDHAT_BUGZILLA_PRODUCT=/d; /^REDHAT_BUGZILLA_PRODUCT_VERSION=/d; /^REDHAT_SUPPORT_PRODUCT=/d; /^REDHAT_SUPPORT_PRODUCT_VERSION=/d" /usr/lib/os-release
 sed -i "s|^VERSION_CODENAME=.*|VERSION_CODENAME=\"Deck\"|" /usr/lib/os-release
 
-echo "$IMAGE_PRETTY_NAME release $FEDORA_VERSION (Deck)" > /etc/system-release
+# /etc/system-release is normally a symlink to the RPM-owned fedora-release.
+# Write through that link and verify the final bytes: bootupd uses this value as
+# the efibootmgr label, where even a trailing NUL makes Anaconda fail before
+# any %post installer hook can run.
+SYSTEM_RELEASE="/etc/system-release"
+SYSTEM_RELEASE_TARGET="$(readlink -f "$SYSTEM_RELEASE")"
+EXPECTED_SYSTEM_RELEASE="$IMAGE_PRETTY_NAME release $FEDORA_VERSION (Deck)"
+printf '%s\n' "$EXPECTED_SYSTEM_RELEASE" > "$SYSTEM_RELEASE"
+
+if ! cmp -s <(printf '%s\n' "$EXPECTED_SYSTEM_RELEASE") "$SYSTEM_RELEASE_TARGET"; then
+  echo "Failed to write a clean AeroCore system-release to ${SYSTEM_RELEASE_TARGET}" >&2
+  od -An -v -tx1 "$SYSTEM_RELEASE_TARGET" >&2
+  exit 1
+fi
 
 if grep -q '^BUILD_ID=' /usr/lib/os-release; then
   sed -i "s/^BUILD_ID=.*/BUILD_ID=\"$VERSION_PRETTY\"/" /usr/lib/os-release
-- 
cgit v1.2.3