From 26848f158c30f700258f4eab5df6e3a448a8d35c Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 29 Jul 2026 08:23:02 +0800
Subject: Fix installer update origin

Rewrite installed bootc origins to the configured signed registry
reference.
---
 installer/build.sh | 11 +++++++++++
 1 file changed, 11 insertions(+)

(limited to 'installer/build.sh')

diff --git a/installer/build.sh b/installer/build.sh
index 0cc1b8a..3093dcc 100755
--- a/installer/build.sh
+++ b/installer/build.sh
@@ -6,6 +6,9 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 BASE_IMAGE=${BASE_IMAGE:?}
 INSTALL_IMAGE_PAYLOAD=${INSTALL_IMAGE_PAYLOAD:?}
 INSTALL_IMAGE_PAYLOAD_ARCHIVE=${INSTALL_IMAGE_PAYLOAD_ARCHIVE:-}
+INSTALL_IMAGE_TAG=${INSTALL_IMAGE_TAG:?}
+OSTREE_IMAGE_REF=${OSTREE_IMAGE_REF:?}
+ostree_origin_ref="${OSTREE_IMAGE_REF}:${INSTALL_IMAGE_TAG}"
 
 # The installer is a live KDE environment.  Keep the installed system payload
 # separate: it is the AeroCore image, while BASE_IMAGE provides the live UI.
@@ -124,6 +127,14 @@ df -h /var/tmp \${target_tmp}
 
 ostreecontainer --url=${INSTALL_IMAGE_PAYLOAD} --transport=containers-storage --no-signature-verification
 
+# The local containers-storage deployment is intentionally unverified because
+# the payload is loaded from an OCI archive. Point future bootc updates at the
+# signed registry reference configured for the image instead.
+%post --erroronfail --log=/tmp/aerocore-origin.log
+set -eux
+sed -i 's|container-image-reference=.*|container-image-reference=${ostree_origin_ref}|' /ostree/deploy/default/deploy/*.origin
+%end
+
 %post --nochroot --log=/tmp/aerocore-hostname.log
 set -eux
 target_root=
-- 
cgit v1.2.3


From d8983c361705874558a20328ce3355852208c178 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 29 Jul 2026 17:05:41 +0800
Subject: Fix weak password crash in Live installer

Restore the Cockpit force-password behavior embedded in Fedora 43's
Anaconda WebUI bundle. Apply strict password policy through conf.d so
weak passwords remain a form validation error instead of aborting the
installer.
---
 installer/build.sh | 5 +++++
 1 file changed, 5 insertions(+)

(limited to 'installer/build.sh')

diff --git a/installer/build.sh b/installer/build.sh
index 3093dcc..4535113 100755
--- a/installer/build.sh
+++ b/installer/build.sh
@@ -31,6 +31,11 @@ dnf --setopt=excludepkgs= reinstall -y \
   grub2-efi-x64 \
   grub2-efi-x64-cdboot
 
+# Fedora 43's anaconda-webui bundle embeds a Cockpit password helper from
+# before cockpit-project/cockpit@900c13f. Restore that upstream fix so a weak
+# pwscore result is returned as score 0 instead of rejecting the WebUI promise.
+"${SCRIPT_DIR}/patch-anaconda-webui.sh"
+
 # Apply the same AeroCore overlay to the live session where possible.
 if [[ -d /src/system_files ]]; then
   cp -a /src/system_files/. /
-- 
cgit v1.2.3