From 42a6ff3286804854c1c21a7e62158f09e19a9b09 Mon Sep 17 00:00:00 2001 From: tranch Date: Sun, 12 Jul 2026 23:33:44 +0800 Subject: Add live installer build workflow Add a Bazzite-style installer payload, CI workflow, and local\nPodman commands for building and testing the live ISO.\n\nFix stale disk image configuration references and installer targets. --- installer/build.sh | 60 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 60 insertions(+) create mode 100755 installer/build.sh (limited to 'installer/build.sh') diff --git a/installer/build.sh b/installer/build.sh new file mode 100755 index 0000000..7532df8 --- /dev/null +++ b/installer/build.sh @@ -0,0 +1,60 @@ +#!/usr/bin/env bash + +set -euxo pipefail + +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +BASE_IMAGE=${BASE_IMAGE:?} +INSTALL_IMAGE_PAYLOAD=${INSTALL_IMAGE_PAYLOAD:?} + +# The installer is a live KDE environment. Keep the installed system payload +# separate: it is the AeroCore image, while BASE_IMAGE provides the live UI. +dnf install -y \ + anaconda-live \ + libblockdev-btrfs \ + libblockdev-dm \ + libblockdev-lvm \ + dracut-live \ + livesys-scripts \ + grub2-efi-x64-cdboot + +# Apply the same AeroCore overlay to the live session where possible. +if [[ -d /src/system_files ]]; then + cp -a /src/system_files/. / +fi + +# Make the install payload available to Anaconda. When the build is running +# with the host container store mounted, this avoids a second registry pull. +if mountpoint -q /usr/lib/containers/storage; then + podman save --format oci-archive "${INSTALL_IMAGE_PAYLOAD}" | \ + podman load --storage-opt additionalimagestore='' +else + podman pull "${INSTALL_IMAGE_PAYLOAD}" +fi + +# Tell Anaconda to install the bootc container that was loaded above. +mkdir -p /var/lib/rpm-state +cat >> /usr/share/anaconda/interactive-defaults.ks </dev/null; then + cp -a /usr/lib/efi/*/*/EFI /boot/efi/ +fi + +systemd-firstboot --timezone UTC +dnf clean all -- cgit v1.2.3 From 04b8dcbbc3d5707f488c9b67ba96ce88ccd15181 Mon Sep 17 00:00:00 2001 From: tranch Date: Fri, 17 Jul 2026 06:56:56 +0800 Subject: Fix live installer ISO build Build the live installer from the requested local AeroCore image, use a separate Fedora live base, pass the payload through rootful container storage, and write reproducible checksum entries without host paths. --- installer/build.sh | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) (limited to 'installer/build.sh') diff --git a/installer/build.sh b/installer/build.sh index 7532df8..033fe9b 100755 --- a/installer/build.sh +++ b/installer/build.sh @@ -5,10 +5,14 @@ set -euxo pipefail SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" BASE_IMAGE=${BASE_IMAGE:?} INSTALL_IMAGE_PAYLOAD=${INSTALL_IMAGE_PAYLOAD:?} +INSTALL_IMAGE_PAYLOAD_ARCHIVE=${INSTALL_IMAGE_PAYLOAD_ARCHIVE:-} # The installer is a live KDE environment. Keep the installed system payload # separate: it is the AeroCore image, while BASE_IMAGE provides the live UI. -dnf install -y \ +# Bazzite excludes some base packages from normal transactions. The live +# installer needs Anaconda's exact NetworkManager dependencies, so clear the +# excludes only for this dependency install. +dnf --setopt=excludepkgs= install -y \ anaconda-live \ libblockdev-btrfs \ libblockdev-dm \ @@ -22,9 +26,10 @@ if [[ -d /src/system_files ]]; then cp -a /src/system_files/. / fi -# Make the install payload available to Anaconda. When the build is running -# with the host container store mounted, this avoids a second registry pull. -if mountpoint -q /usr/lib/containers/storage; then +# Make the install payload available to Anaconda. +if [[ -n "${INSTALL_IMAGE_PAYLOAD_ARCHIVE}" && -f "${INSTALL_IMAGE_PAYLOAD_ARCHIVE}" ]]; then + podman load --storage-opt additionalimagestore='' < "${INSTALL_IMAGE_PAYLOAD_ARCHIVE}" +elif mountpoint -q /usr/lib/containers/storage; then podman save --format oci-archive "${INSTALL_IMAGE_PAYLOAD}" | \ podman load --storage-opt additionalimagestore='' else -- cgit v1.2.3 From 33ccd0f64b93bb615a771b6f246bcdb4cb3969f1 Mon Sep 17 00:00:00 2001 From: tranch Date: Fri, 24 Jul 2026 08:18:08 +0800 Subject: Fix live installer EFI fallback Copy Fedora grubx64.efi to the fallback EFI path expected by bootc-image-builder. --- installer/build.sh | 3 +++ 1 file changed, 3 insertions(+) (limited to 'installer/build.sh') diff --git a/installer/build.sh b/installer/build.sh index 033fe9b..921e628 100755 --- a/installer/build.sh +++ b/installer/build.sh @@ -61,5 +61,8 @@ if compgen -G '/usr/lib/efi/*/*/EFI' >/dev/null; then cp -a /usr/lib/efi/*/*/EFI /boot/efi/ fi +# bootc-image-builder needs the Fedora live ISO fallback EFI loader. +cp -v /boot/efi/EFI/fedora/grubx64.efi /boot/efi/EFI/BOOT/fbx64.efi + systemd-firstboot --timezone UTC dnf clean all -- cgit v1.2.3 From 986e450e1ab476e35012370d97b7e4526e113d88 Mon Sep 17 00:00:00 2001 From: tranch Date: Fri, 24 Jul 2026 09:17:07 +0800 Subject: Fix live installer GRUB EFI fallback Install the full EFI GRUB package and create the fallback directory. --- installer/build.sh | 2 ++ 1 file changed, 2 insertions(+) (limited to 'installer/build.sh') diff --git a/installer/build.sh b/installer/build.sh index 921e628..6f1561f 100755 --- a/installer/build.sh +++ b/installer/build.sh @@ -19,6 +19,7 @@ dnf --setopt=excludepkgs= install -y \ libblockdev-lvm \ dracut-live \ livesys-scripts \ + grub2-efi-x64 \ grub2-efi-x64-cdboot # Apply the same AeroCore overlay to the live session where possible. @@ -62,6 +63,7 @@ if compgen -G '/usr/lib/efi/*/*/EFI' >/dev/null; then fi # bootc-image-builder needs the Fedora live ISO fallback EFI loader. +mkdir -p /boot/efi/EFI/BOOT cp -v /boot/efi/EFI/fedora/grubx64.efi /boot/efi/EFI/BOOT/fbx64.efi systemd-firstboot --timezone UTC -- cgit v1.2.3 From 2de184fb8db64a900ed2e64e292fd7b77f3deae4 Mon Sep 17 00:00:00 2001 From: tranch Date: Fri, 24 Jul 2026 09:39:33 +0800 Subject: Find live installer EFI files robustly Avoid assuming the Fedora EFI directory layout when creating fbx64.efi. --- installer/build.sh | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) (limited to 'installer/build.sh') diff --git a/installer/build.sh b/installer/build.sh index 6f1561f..2f8a26b 100755 --- a/installer/build.sh +++ b/installer/build.sh @@ -58,13 +58,21 @@ sed -i 's/^livesys_session=.*/livesys_session=kde/' /etc/sysconfig/livesys systemctl enable livesys.service livesys-late.service mkdir -p /boot/efi -if compgen -G '/usr/lib/efi/*/*/EFI' >/dev/null; then - cp -a /usr/lib/efi/*/*/EFI /boot/efi/ +efi_dir="$(find /usr/lib/efi -type d -name EFI -print -quit 2>/dev/null || true)" +if [[ -n "${efi_dir}" ]]; then + cp -a "${efi_dir}" /boot/efi/ fi # bootc-image-builder needs the Fedora live ISO fallback EFI loader. +grubx64="$(find /usr/lib/efi /boot/efi -type f \ + -path '*/EFI/fedora/grubx64.efi' -print -quit 2>/dev/null || true)" +if [[ -z "${grubx64}" ]]; then + echo "grubx64.efi was not found in the installed EFI tree" >&2 + find /usr/lib/efi /boot/efi -type f -path '*/EFI/*' -print >&2 || true + exit 1 +fi mkdir -p /boot/efi/EFI/BOOT -cp -v /boot/efi/EFI/fedora/grubx64.efi /boot/efi/EFI/BOOT/fbx64.efi +cp -v "${grubx64}" /boot/efi/EFI/BOOT/fbx64.efi systemd-firstboot --timezone UTC dnf clean all -- cgit v1.2.3 From e41af95f56d4cbfee68081f82dd329ee68486267 Mon Sep 17 00:00:00 2001 From: tranch Date: Fri, 24 Jul 2026 09:44:48 +0800 Subject: Restore EFI GRUB files in Kinoite build Reinstall EFI packages so missing payload files are materialized. --- installer/build.sh | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'installer/build.sh') diff --git a/installer/build.sh b/installer/build.sh index 2f8a26b..efce782 100755 --- a/installer/build.sh +++ b/installer/build.sh @@ -22,6 +22,12 @@ dnf --setopt=excludepkgs= install -y \ grub2-efi-x64 \ grub2-efi-x64-cdboot +# Kinoite can carry the EFI packages in the RPM database without their files +# materialized in the container filesystem. Restore the files for the ISO. +dnf --setopt=excludepkgs= reinstall -y \ + grub2-efi-x64 \ + grub2-efi-x64-cdboot + # Apply the same AeroCore overlay to the live session where possible. if [[ -d /src/system_files ]]; then cp -a /src/system_files/. / -- cgit v1.2.3 From 1d0659a9f5ac7e18639a88b772f0766afa3910db Mon Sep 17 00:00:00 2001 From: tranch Date: Fri, 24 Jul 2026 13:34:08 +0800 Subject: Add standard UEFI fallback loader Include BOOTX64.EFI alongside the bootc-image-builder fbx64.efi so removable-media UEFI firmware can boot the live installer ISO. --- installer/build.sh | 2 ++ 1 file changed, 2 insertions(+) (limited to 'installer/build.sh') diff --git a/installer/build.sh b/installer/build.sh index efce782..3ee1744 100755 --- a/installer/build.sh +++ b/installer/build.sh @@ -78,6 +78,8 @@ if [[ -z "${grubx64}" ]]; then exit 1 fi mkdir -p /boot/efi/EFI/BOOT +# UEFI removable-media fallback; keep fbx64.efi for bootc-image-builder. +cp -v "${grubx64}" /boot/efi/EFI/BOOT/BOOTX64.EFI cp -v "${grubx64}" /boot/efi/EFI/BOOT/fbx64.efi systemd-firstboot --timezone UTC -- cgit v1.2.3 From d3698fbc897c39cdc723cb85b5e03daf3e1bbc31 Mon Sep 17 00:00:00 2001 From: tranch Date: Fri, 24 Jul 2026 16:58:29 +0800 Subject: Brand live installer sidebar Copy installer branding assets into Anaconda's pixmaps directory after the shared live-session overlay so AeroCore resources take precedence. Ignore local .DS_Store files to keep macOS metadata out of commits. --- installer/build.sh | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'installer/build.sh') diff --git a/installer/build.sh b/installer/build.sh index 3ee1744..f9eb210 100755 --- a/installer/build.sh +++ b/installer/build.sh @@ -33,6 +33,12 @@ if [[ -d /src/system_files ]]; then cp -a /src/system_files/. / fi +BRANDING_DIR="${SCRIPT_DIR}/branding" +if [[ -d "${BRANDING_DIR}" ]]; then + mkdir -p /usr/share/anaconda/pixmaps + cp -a "${BRANDING_DIR}/." /usr/share/anaconda/pixmaps/ +fi + # Make the install payload available to Anaconda. if [[ -n "${INSTALL_IMAGE_PAYLOAD_ARCHIVE}" && -f "${INSTALL_IMAGE_PAYLOAD_ARCHIVE}" ]]; then podman load --storage-opt additionalimagestore='' < "${INSTALL_IMAGE_PAYLOAD_ARCHIVE}" -- cgit v1.2.3 From 4bf6f276a7c616ebb7797952c5f33e5f282fb2c8 Mon Sep 17 00:00:00 2001 From: tranch Date: Sat, 25 Jul 2026 04:55:42 +0800 Subject: Brand installer live session icons Install AeroCore icon aliases for the live KDE launcher and replace Anaconda's installer icon in the hicolor theme. --- installer/build.sh | 39 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) (limited to 'installer/build.sh') diff --git a/installer/build.sh b/installer/build.sh index f9eb210..c8ac830 100755 --- a/installer/build.sh +++ b/installer/build.sh @@ -39,6 +39,45 @@ if [[ -d "${BRANDING_DIR}" ]]; then cp -a "${BRANDING_DIR}/." /usr/share/anaconda/pixmaps/ fi +# Installer-only overrides, kept separate from the installed AeroCore payload. +if [[ -d "${SCRIPT_DIR}/system_files/overrides" ]]; then + cp -a "${SCRIPT_DIR}/system_files/overrides/." / +fi + +# Plasma's live-session launcher defaults to start-here, and Fedora keeps +# LOGO=fedora-logo-icon in the base live environment. +for size in 16x16 22x22 24x24 32x32 36x36 48x48 64x64 96x96 128x128 256x256; do + icon_dir="/usr/share/icons/hicolor/${size}" + if [[ -f "${icon_dir}/bazzite-logo-icon.png" ]]; then + mkdir -p "${icon_dir}/apps" "${icon_dir}/places" + cp -f "${icon_dir}/bazzite-logo-icon.png" "${icon_dir}/apps/fedora-logo-icon.png" + cp -f "${icon_dir}/bazzite-logo-icon.png" "${icon_dir}/places/start-here.png" + fi +done + +if [[ -f /usr/share/icons/hicolor/scalable/places/distributor-logo.svg ]]; then + mkdir -p /usr/share/icons/hicolor/scalable/apps /usr/share/icons/hicolor/scalable/places + cp -f /usr/share/icons/hicolor/scalable/places/distributor-logo.svg \ + /usr/share/icons/hicolor/scalable/apps/start-here.svg + cp -f /usr/share/icons/hicolor/scalable/places/distributor-logo.svg \ + /usr/share/icons/hicolor/scalable/places/start-here.svg +fi + +sed -i 's/^LOGO=.*/LOGO=distributor-logo/' /usr/lib/os-release + +for desktop_file in \ + /usr/share/applications/liveinst.desktop \ + /usr/share/applications/org.fedoraproject.AnacondaInstaller.desktop \ + /usr/share/applications/anaconda.desktop; do + if [[ -f "${desktop_file}" ]]; then + sed -i 's/^Icon=.*/Icon=org.fedoraproject.AnacondaInstaller/' "${desktop_file}" + fi +done + +if command -v gtk-update-icon-cache >/dev/null 2>&1; then + gtk-update-icon-cache -f /usr/share/icons/hicolor || true +fi + # Make the install payload available to Anaconda. if [[ -n "${INSTALL_IMAGE_PAYLOAD_ARCHIVE}" && -f "${INSTALL_IMAGE_PAYLOAD_ARCHIVE}" ]]; then podman load --storage-opt additionalimagestore='' < "${INSTALL_IMAGE_PAYLOAD_ARCHIVE}" -- cgit v1.2.3 From 981dde9ceed99c6b0a9dde1bce74e6100f0593d2 Mon Sep 17 00:00:00 2001 From: tranch Date: Sat, 25 Jul 2026 07:14:05 +0800 Subject: Apply var tmp fix in installer payload Write the pre-install /var/tmp bind mount hook from installer/build.sh so both Titanoboa CI builds and local ISO builds carry the fix. The previous lorax template path was only wired through the local helper and did not affect GitHub Actions. --- installer/build.sh | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) (limited to 'installer/build.sh') diff --git a/installer/build.sh b/installer/build.sh index c8ac830..aa30f42 100755 --- a/installer/build.sh +++ b/installer/build.sh @@ -91,6 +91,25 @@ fi # Tell Anaconda to install the bootc container that was loaded above. mkdir -p /var/lib/rpm-state cat >> /usr/share/anaconda/interactive-defaults.ks <&2 + exit 1 +fi +mkdir -p \${target_tmp} +chmod 1777 \${target_tmp} +mount --bind \${target_tmp} /var/tmp +df -h /var/tmp \${target_tmp} +%end + ostreecontainer --url=${INSTALL_IMAGE_PAYLOAD} --transport=containers-storage --no-signature-verification EOF -- cgit v1.2.3 From db108b8b23c86ba39a2ba289fc6129a6325f045f Mon Sep 17 00:00:00 2001 From: tranch Date: Sat, 25 Jul 2026 09:57:45 +0800 Subject: Normalize installer payload and host naming Use a formal local installer image tag and set aerocore-os as the default hostname in both the live image and installed target system. --- installer/build.sh | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) (limited to 'installer/build.sh') diff --git a/installer/build.sh b/installer/build.sh index aa30f42..c119dcc 100755 --- a/installer/build.sh +++ b/installer/build.sh @@ -111,6 +111,22 @@ df -h /var/tmp \${target_tmp} %end ostreecontainer --url=${INSTALL_IMAGE_PAYLOAD} --transport=containers-storage --no-signature-verification + +%post --nochroot --log=/tmp/aerocore-hostname.log +set -eux +target_root= +for root in /mnt/sysroot /mnt/sysimage /var/mnt/sysimage; do + if mountpoint -q \${root}; then + target_root=\${root} + break + fi +done +if [ x\${target_root} = x ]; then + echo No mounted target system found for hostname setup >&2 + exit 1 +fi +systemd-firstboot --root=\${target_root} --hostname=aerocore-os +%end EOF mkdir -p /usr/lib/bootc-image-builder @@ -146,5 +162,5 @@ mkdir -p /boot/efi/EFI/BOOT cp -v "${grubx64}" /boot/efi/EFI/BOOT/BOOTX64.EFI cp -v "${grubx64}" /boot/efi/EFI/BOOT/fbx64.efi -systemd-firstboot --timezone UTC +systemd-firstboot --hostname aerocore-os --timezone UTC dnf clean all -- cgit v1.2.3 From db976362b9e8f96ed3f0974ba5d36af859b00dc3 Mon Sep 17 00:00:00 2001 From: tranch Date: Sun, 26 Jul 2026 11:00:21 +0800 Subject: Hide GRUB menu after installer deployment Configure target GRUB during Anaconda post-install. Preserve Bazzite menu controls and dual-boot recovery. --- installer/build.sh | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) (limited to 'installer/build.sh') diff --git a/installer/build.sh b/installer/build.sh index c119dcc..a382bcf 100755 --- a/installer/build.sh +++ b/installer/build.sh @@ -44,6 +44,13 @@ if [[ -d "${SCRIPT_DIR}/system_files/overrides" ]]; then cp -a "${SCRIPT_DIR}/system_files/overrides/." / fi +# The target system is an upstream-built bootc image. Keep this installer-only +# helper out of the installed image and invoke it after Anaconda mounts the +# target rootfs. +install -Dm0755 \ + "${SCRIPT_DIR}/configure-target-grub.sh" \ + /usr/libexec/aerocore-configure-target-grub + # Plasma's live-session launcher defaults to start-here, and Fedora keeps # LOGO=fedora-logo-icon in the base live environment. for size in 16x16 22x22 24x24 32x32 36x36 48x48 64x64 96x96 128x128 256x256; do @@ -127,6 +134,22 @@ if [ x\${target_root} = x ]; then fi systemd-firstboot --root=\${target_root} --hostname=aerocore-os %end + +%post --nochroot --log=/tmp/aerocore-grub.log +set -eux +target_root= +for root in /mnt/sysroot /mnt/sysimage /var/mnt/sysimage; do + if mountpoint -q \${root}; then + target_root=\${root} + break + fi +done +if [ x\${target_root} = x ]; then + echo No mounted target system found for GRUB configuration >&2 + exit 1 +fi +/usr/libexec/aerocore-configure-target-grub \${target_root} +%end EOF mkdir -p /usr/lib/bootc-image-builder -- cgit v1.2.3 From 52379b8b287353eaa139baacc1063ef2b8a7b28f Mon Sep 17 00:00:00 2001 From: tranch Date: Wed, 29 Jul 2026 00:51:24 +0800 Subject: Brand the Live installer as AeroCore OS Update the Live ISO product metadata and system release label while preserving the Fedora version and Kinoite variant. --- installer/build.sh | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'installer/build.sh') diff --git a/installer/build.sh b/installer/build.sh index a382bcf..0cc1b8a 100755 --- a/installer/build.sh +++ b/installer/build.sh @@ -70,7 +70,12 @@ if [[ -f /usr/share/icons/hicolor/scalable/places/distributor-logo.svg ]]; then /usr/share/icons/hicolor/scalable/places/start-here.svg fi -sed -i 's/^LOGO=.*/LOGO=distributor-logo/' /usr/lib/os-release +live_version_id="$(awk -F= '$1 == "VERSION_ID" { gsub(/\"/, "", $2); print $2; exit }' /usr/lib/os-release)" +live_product_name="AeroCore OS" +sed -i "s/^NAME=.*/NAME=\"${live_product_name}\"/" /usr/lib/os-release +sed -i "s/^PRETTY_NAME=.*/PRETTY_NAME=\"${live_product_name} ${live_version_id} (Kinoite)\"/" /usr/lib/os-release +sed -i "s/^LOGO=.*/LOGO=distributor-logo/" /usr/lib/os-release +printf '%s release %s (Kinoite)\n' "${live_product_name}" "${live_version_id}" > /etc/system-release for desktop_file in \ /usr/share/applications/liveinst.desktop \ -- cgit v1.2.3 From 26848f158c30f700258f4eab5df6e3a448a8d35c Mon Sep 17 00:00:00 2001 From: tranch Date: Wed, 29 Jul 2026 08:23:02 +0800 Subject: Fix installer update origin Rewrite installed bootc origins to the configured signed registry reference. --- installer/build.sh | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'installer/build.sh') diff --git a/installer/build.sh b/installer/build.sh index 0cc1b8a..3093dcc 100755 --- a/installer/build.sh +++ b/installer/build.sh @@ -6,6 +6,9 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" BASE_IMAGE=${BASE_IMAGE:?} INSTALL_IMAGE_PAYLOAD=${INSTALL_IMAGE_PAYLOAD:?} INSTALL_IMAGE_PAYLOAD_ARCHIVE=${INSTALL_IMAGE_PAYLOAD_ARCHIVE:-} +INSTALL_IMAGE_TAG=${INSTALL_IMAGE_TAG:?} +OSTREE_IMAGE_REF=${OSTREE_IMAGE_REF:?} +ostree_origin_ref="${OSTREE_IMAGE_REF}:${INSTALL_IMAGE_TAG}" # The installer is a live KDE environment. Keep the installed system payload # separate: it is the AeroCore image, while BASE_IMAGE provides the live UI. @@ -124,6 +127,14 @@ df -h /var/tmp \${target_tmp} ostreecontainer --url=${INSTALL_IMAGE_PAYLOAD} --transport=containers-storage --no-signature-verification +# The local containers-storage deployment is intentionally unverified because +# the payload is loaded from an OCI archive. Point future bootc updates at the +# signed registry reference configured for the image instead. +%post --erroronfail --log=/tmp/aerocore-origin.log +set -eux +sed -i 's|container-image-reference=.*|container-image-reference=${ostree_origin_ref}|' /ostree/deploy/default/deploy/*.origin +%end + %post --nochroot --log=/tmp/aerocore-hostname.log set -eux target_root= -- cgit v1.2.3 From d8983c361705874558a20328ce3355852208c178 Mon Sep 17 00:00:00 2001 From: tranch Date: Wed, 29 Jul 2026 17:05:41 +0800 Subject: Fix weak password crash in Live installer Restore the Cockpit force-password behavior embedded in Fedora 43's Anaconda WebUI bundle. Apply strict password policy through conf.d so weak passwords remain a form validation error instead of aborting the installer. --- installer/build.sh | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'installer/build.sh') diff --git a/installer/build.sh b/installer/build.sh index 3093dcc..4535113 100755 --- a/installer/build.sh +++ b/installer/build.sh @@ -31,6 +31,11 @@ dnf --setopt=excludepkgs= reinstall -y \ grub2-efi-x64 \ grub2-efi-x64-cdboot +# Fedora 43's anaconda-webui bundle embeds a Cockpit password helper from +# before cockpit-project/cockpit@900c13f. Restore that upstream fix so a weak +# pwscore result is returned as score 0 instead of rejecting the WebUI promise. +"${SCRIPT_DIR}/patch-anaconda-webui.sh" + # Apply the same AeroCore overlay to the live session where possible. if [[ -d /src/system_files ]]; then cp -a /src/system_files/. / -- cgit v1.2.3 From 80cde14b9c368f58e8f16ad121396ce2f1a50f44 Mon Sep 17 00:00:00 2001 From: tranch Date: Fri, 21 Aug 2026 08:42:38 +0800 Subject: Adapt to Bazzite 44 Update Deck identity matching for the new upstream scripts and add fixture coverage for patch idempotence. Move the live installer base to Fedora 44 while retaining the Fedora 43 Anaconda workaround for explicit legacy builds. --- installer/build.sh | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) (limited to 'installer/build.sh') diff --git a/installer/build.sh b/installer/build.sh index 4535113..3d6659f 100755 --- a/installer/build.sh +++ b/installer/build.sh @@ -9,6 +9,7 @@ INSTALL_IMAGE_PAYLOAD_ARCHIVE=${INSTALL_IMAGE_PAYLOAD_ARCHIVE:-} INSTALL_IMAGE_TAG=${INSTALL_IMAGE_TAG:?} OSTREE_IMAGE_REF=${OSTREE_IMAGE_REF:?} ostree_origin_ref="${OSTREE_IMAGE_REF}:${INSTALL_IMAGE_TAG}" +live_version_id="$(awk -F= '$1 == "VERSION_ID" { gsub(/\"/, "", $2); print $2; exit }' /usr/lib/os-release)" # The installer is a live KDE environment. Keep the installed system payload # separate: it is the AeroCore image, while BASE_IMAGE provides the live UI. @@ -32,9 +33,11 @@ dnf --setopt=excludepkgs= reinstall -y \ grub2-efi-x64-cdboot # Fedora 43's anaconda-webui bundle embeds a Cockpit password helper from -# before cockpit-project/cockpit@900c13f. Restore that upstream fix so a weak -# pwscore result is returned as score 0 instead of rejecting the WebUI promise. -"${SCRIPT_DIR}/patch-anaconda-webui.sh" +# before cockpit-project/cockpit@900c13f. Fedora 44 already carries the fix; +# retain the workaround only for explicitly requested Fedora 43 live images. +if [[ "${live_version_id}" == "43" ]]; then + "${SCRIPT_DIR}/patch-anaconda-webui.sh" +fi # Apply the same AeroCore overlay to the live session where possible. if [[ -d /src/system_files ]]; then @@ -78,7 +81,6 @@ if [[ -f /usr/share/icons/hicolor/scalable/places/distributor-logo.svg ]]; then /usr/share/icons/hicolor/scalable/places/start-here.svg fi -live_version_id="$(awk -F= '$1 == "VERSION_ID" { gsub(/\"/, "", $2); print $2; exit }' /usr/lib/os-release)" live_product_name="AeroCore OS" sed -i "s/^NAME=.*/NAME=\"${live_product_name}\"/" /usr/lib/os-release sed -i "s/^PRETTY_NAME=.*/PRETTY_NAME=\"${live_product_name} ${live_version_id} (Kinoite)\"/" /usr/lib/os-release -- cgit v1.2.3 From 6cb356d3837ef5a9637c2f6df1de7ef85196c280 Mon Sep 17 00:00:00 2001 From: tranch Date: Wed, 26 Aug 2026 10:41:01 +0800 Subject: fix(installer): configure the GPT auto-root type Resolve Anaconda target mounts to their backing partition before marking it as the bootc GPT auto-root partition. --- installer/build.sh | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) (limited to 'installer/build.sh') diff --git a/installer/build.sh b/installer/build.sh index 3d6659f..205f18c 100755 --- a/installer/build.sh +++ b/installer/build.sh @@ -23,6 +23,7 @@ dnf --setopt=excludepkgs= install -y \ libblockdev-lvm \ dracut-live \ livesys-scripts \ + gdisk \ grub2-efi-x64 \ grub2-efi-x64-cdboot @@ -62,6 +63,10 @@ install -Dm0755 \ "${SCRIPT_DIR}/configure-target-grub.sh" \ /usr/libexec/aerocore-configure-target-grub +install -Dm0755 \ + "${SCRIPT_DIR}/configure-target-gpt-root.sh" \ + /usr/libexec/aerocore-configure-target-gpt-root + # Plasma's live-session launcher defaults to start-here, and Fedora keeps # LOGO=fedora-logo-icon in the base live environment. for size in 16x16 22x22 24x24 32x32 36x36 48x48 64x64 96x96 128x128 256x256; do @@ -132,6 +137,26 @@ mount --bind \${target_tmp} /var/tmp df -h /var/tmp \${target_tmp} %end +# bootc relies on systemd's GPT auto-root discovery on the first boot. Anaconda +# can leave the installed root partition with the generic Linux filesystem +# type, which makes /dev/gpt-auto-root unavailable even though the filesystem +# itself is healthy. Normalize the type before ostreecontainer deployment. +%pre-install --erroronfail --log=/tmp/aerocore-gpt-root.log +set -eux +target_root= +for root in /mnt/sysroot /mnt/sysimage /var/mnt/sysroot /var/mnt/sysimage; do + if mountpoint -q \${root}; then + target_root=\${root} + break + fi +done +if [ x\${target_root} = x ]; then + echo No mounted target system found for GPT root configuration >&2 + exit 1 +fi +/usr/libexec/aerocore-configure-target-gpt-root \${target_root} +%end + ostreecontainer --url=${INSTALL_IMAGE_PAYLOAD} --transport=containers-storage --no-signature-verification # The local containers-storage deployment is intentionally unverified because -- cgit v1.2.3 From cc2a2c630120627d8d89e6fec90fdeeb04ca1a51 Mon Sep 17 00:00:00 2001 From: tranch Date: Wed, 26 Aug 2026 10:41:53 +0800 Subject: fix(installer): restore interactive account setup Use an AeroCore Anaconda profile so the live installer keeps the accounts page that Fedora KDE hides. --- installer/build.sh | 1 + 1 file changed, 1 insertion(+) (limited to 'installer/build.sh') diff --git a/installer/build.sh b/installer/build.sh index 205f18c..937d324 100755 --- a/installer/build.sh +++ b/installer/build.sh @@ -89,6 +89,7 @@ fi live_product_name="AeroCore OS" sed -i "s/^NAME=.*/NAME=\"${live_product_name}\"/" /usr/lib/os-release sed -i "s/^PRETTY_NAME=.*/PRETTY_NAME=\"${live_product_name} ${live_version_id} (Kinoite)\"/" /usr/lib/os-release +sed -i 's/^ID=.*/ID=aerocore/' /usr/lib/os-release sed -i "s/^LOGO=.*/LOGO=distributor-logo/" /usr/lib/os-release printf '%s release %s (Kinoite)\n' "${live_product_name}" "${live_version_id}" > /etc/system-release -- cgit v1.2.3 From 99c47421bdb444e2eb799c1db1fe11a8ea91dee3 Mon Sep 17 00:00:00 2001 From: tranch Date: Tue, 25 Aug 2026 09:51:14 +0800 Subject: Document local live ISO reproduction path --- installer/build.sh | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) (limited to 'installer/build.sh') diff --git a/installer/build.sh b/installer/build.sh index 205f18c..dda0706 100755 --- a/installer/build.sh +++ b/installer/build.sh @@ -157,6 +157,24 @@ fi /usr/libexec/aerocore-configure-target-gpt-root \${target_root} %end +# Do not let stale Fedora boot files from an earlier installation collide with +# the bootc payload being installed. This matches the upstream Bazzite +# installer behavior; other vendor EFI directories are left untouched. +%pre-install --erroronfail --log=/tmp/aerocore-efi-cleanup.log +set -eux +efi_root= +for root in /mnt/sysroot /mnt/sysimage /var/mnt/sysroot /var/mnt/sysimage; do + if mountpoint -q \${root}/boot/efi; then + efi_root=\${root}/boot/efi + break + fi +done +if [ x\${efi_root} = x ]; then + echo No mounted EFI system partition found for cleanup >&2 + exit 1 +fi +rm -rf \${efi_root}/EFI/fedora +%end ostreecontainer --url=${INSTALL_IMAGE_PAYLOAD} --transport=containers-storage --no-signature-verification # The local containers-storage deployment is intentionally unverified because -- cgit v1.2.3 From ed4bd0d089d41c5d95fe74937acc2a779c6de6d4 Mon Sep 17 00:00:00 2001 From: tranch Date: Tue, 25 Aug 2026 10:44:18 +0800 Subject: fix(installer): validate ISO payload metadata Rewrite system-release atomically and reject stale or NUL-bearing payload metadata before it reaches Anaconda bootupd. --- installer/build.sh | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) (limited to 'installer/build.sh') diff --git a/installer/build.sh b/installer/build.sh index dda0706..dd7b7f5 100755 --- a/installer/build.sh +++ b/installer/build.sh @@ -115,6 +115,33 @@ else podman pull "${INSTALL_IMAGE_PAYLOAD}" fi +# Refuse to build an ISO with a payload that still carries Bazzite release +# bytes. bootupd derives its EFI label from system-release during installation; +# a trailing NUL there makes efibootmgr fail before Anaconda can run %post. +podman run --rm --entrypoint /usr/bin/bash "${INSTALL_IMAGE_PAYLOAD}" -ceu ' + system_release=/etc/system-release + system_release_target=$(readlink -f "$system_release") + + if od -An -v -tx1 "$system_release_target" | awk '\''{ for (i = 1; i <= NF; i++) if ($i == "00") found = 1 } END { exit(found ? 0 : 1) }'\''; then + echo "Install payload has a NUL byte in ${system_release_target}" >&2 + od -An -v -tx1 "$system_release_target" >&2 + exit 1 + fi + + expected_prefix="AeroCore OS release $(rpm -E %fedora) (" + system_release_value=$(<"$system_release_target") + case "$system_release_value" in + "$expected_prefix"*) ;; + *) + echo "Install payload has an unexpected system-release: ${system_release_value@Q}" >&2 + exit 1 + ;; + esac + + jq -e '\''.["image-name"] == "aerocore-os" and .["image-vendor"] == "aerocore-io"'\'' \ + /usr/share/ublue-os/image-info.json >/dev/null +' + # Tell Anaconda to install the bootc container that was loaded above. mkdir -p /var/lib/rpm-state cat >> /usr/share/anaconda/interactive-defaults.ks < Date: Tue, 25 Aug 2026 11:41:20 +0800 Subject: fix(installer): validate payload on build host Move payload inspection out of the nested Podman build so local ISO builds do not require /dev/fuse. Normalize local registry references. --- installer/build.sh | 27 --------------------------- 1 file changed, 27 deletions(-) (limited to 'installer/build.sh') diff --git a/installer/build.sh b/installer/build.sh index dd7b7f5..dda0706 100755 --- a/installer/build.sh +++ b/installer/build.sh @@ -115,33 +115,6 @@ else podman pull "${INSTALL_IMAGE_PAYLOAD}" fi -# Refuse to build an ISO with a payload that still carries Bazzite release -# bytes. bootupd derives its EFI label from system-release during installation; -# a trailing NUL there makes efibootmgr fail before Anaconda can run %post. -podman run --rm --entrypoint /usr/bin/bash "${INSTALL_IMAGE_PAYLOAD}" -ceu ' - system_release=/etc/system-release - system_release_target=$(readlink -f "$system_release") - - if od -An -v -tx1 "$system_release_target" | awk '\''{ for (i = 1; i <= NF; i++) if ($i == "00") found = 1 } END { exit(found ? 0 : 1) }'\''; then - echo "Install payload has a NUL byte in ${system_release_target}" >&2 - od -An -v -tx1 "$system_release_target" >&2 - exit 1 - fi - - expected_prefix="AeroCore OS release $(rpm -E %fedora) (" - system_release_value=$(<"$system_release_target") - case "$system_release_value" in - "$expected_prefix"*) ;; - *) - echo "Install payload has an unexpected system-release: ${system_release_value@Q}" >&2 - exit 1 - ;; - esac - - jq -e '\''.["image-name"] == "aerocore-os" and .["image-vendor"] == "aerocore-io"'\'' \ - /usr/share/ublue-os/image-info.json >/dev/null -' - # Tell Anaconda to install the bootc container that was loaded above. mkdir -p /var/lib/rpm-state cat >> /usr/share/anaconda/interactive-defaults.ks < Date: Thu, 27 Aug 2026 23:00:51 +0800 Subject: fix: replace About System logo symlink Ensure KDE About System uses the AeroCore asset in both payload and live installer builds. --- installer/build.sh | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'installer/build.sh') diff --git a/installer/build.sh b/installer/build.sh index e027bd6..1920085 100755 --- a/installer/build.sh +++ b/installer/build.sh @@ -45,6 +45,15 @@ if [[ -d /src/system_files ]]; then cp -a /src/system_files/. / fi +# The live base can already contain this About System asset as a symlink. +# Replace the link itself so the installer UI also renders AeroCore branding. +if [[ -f /src/system_files/usr/share/pixmaps/system-logo-white.png ]]; then + rm -f /usr/share/pixmaps/system-logo-white.png + install -Dm0644 \ + /src/system_files/usr/share/pixmaps/system-logo-white.png \ + /usr/share/pixmaps/system-logo-white.png +fi + BRANDING_DIR="${SCRIPT_DIR}/branding" if [[ -d "${BRANDING_DIR}" ]]; then mkdir -p /usr/share/anaconda/pixmaps -- cgit v1.2.3 From 115f7475e2716410fa5603114d3ec8c3211b9ca3 Mon Sep 17 00:00:00 2001 From: tranch Date: Sat, 12 Sep 2026 15:51:39 +0800 Subject: Fix LiveISO root path initialization Create the /root symlink target before early-boot services run. This avoids systemd-tmpfiles failures that delay Anaconda startup. --- installer/build.sh | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'installer/build.sh') diff --git a/installer/build.sh b/installer/build.sh index 1920085..34c55b7 100755 --- a/installer/build.sh +++ b/installer/build.sh @@ -11,6 +11,10 @@ OSTREE_IMAGE_REF=${OSTREE_IMAGE_REF:?} ostree_origin_ref="${OSTREE_IMAGE_REF}:${INSTALL_IMAGE_TAG}" live_version_id="$(awk -F= '$1 == "VERSION_ID" { gsub(/\"/, "", $2); print $2; exit }' /usr/lib/os-release)" +# The live image may ship /root as a symlink. Ensure its target exists before +# systemd-tmpfiles and other early-boot services process root-owned paths. +mkdir -p "$(realpath /root)" + # The installer is a live KDE environment. Keep the installed system payload # separate: it is the AeroCore image, while BASE_IMAGE provides the live UI. # Bazzite excludes some base packages from normal transactions. The live -- cgit v1.2.3