From a00715659960496be8753aa2adc5ec4ec7afbbf1 Mon Sep 17 00:00:00 2001 From: tranch Date: Wed, 29 Jul 2026 08:23:02 +0800 Subject: Fix installer update origin Rewrite installed bootc origins to the configured signed registry reference. --- installer/Containerfile | 6 ++++++ installer/build.sh | 11 +++++++++++ 2 files changed, 17 insertions(+) (limited to 'installer') diff --git a/installer/Containerfile b/installer/Containerfile index cf20e4f..32b327e 100644 --- a/installer/Containerfile +++ b/installer/Containerfile @@ -6,6 +6,8 @@ ARG IMAGE_VENDOR=AeroCore-IO ARG IMAGE_NAME=aerocore-os ARG INSTALL_IMAGE_PAYLOAD=ghcr.io/${IMAGE_VENDOR}/${IMAGE_NAME}:stable ARG INSTALL_IMAGE_PAYLOAD_ARCHIVE=/install-payload.oci +ARG INSTALL_IMAGE_TAG=latest +ARG OSTREE_IMAGE_REF=ostree-image-signed:docker://ghcr.io/${IMAGE_VENDOR}/${IMAGE_NAME} FROM ${BASE_IMAGE} @@ -14,10 +16,14 @@ ARG IMAGE_VENDOR ARG IMAGE_NAME ARG INSTALL_IMAGE_PAYLOAD ARG INSTALL_IMAGE_PAYLOAD_ARCHIVE +ARG INSTALL_IMAGE_TAG +ARG OSTREE_IMAGE_REF RUN --mount=type=bind,source=.,target=/src \ --mount=type=bind,source=output/install-payload.oci,target=/install-payload.oci,ro \ env BASE_IMAGE="${BASE_IMAGE}" \ INSTALL_IMAGE_PAYLOAD="${INSTALL_IMAGE_PAYLOAD}" \ INSTALL_IMAGE_PAYLOAD_ARCHIVE="${INSTALL_IMAGE_PAYLOAD_ARCHIVE}" \ + INSTALL_IMAGE_TAG="${INSTALL_IMAGE_TAG}" \ + OSTREE_IMAGE_REF="${OSTREE_IMAGE_REF}" \ /src/installer/build.sh diff --git a/installer/build.sh b/installer/build.sh index 0cc1b8a..3093dcc 100755 --- a/installer/build.sh +++ b/installer/build.sh @@ -6,6 +6,9 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" BASE_IMAGE=${BASE_IMAGE:?} INSTALL_IMAGE_PAYLOAD=${INSTALL_IMAGE_PAYLOAD:?} INSTALL_IMAGE_PAYLOAD_ARCHIVE=${INSTALL_IMAGE_PAYLOAD_ARCHIVE:-} +INSTALL_IMAGE_TAG=${INSTALL_IMAGE_TAG:?} +OSTREE_IMAGE_REF=${OSTREE_IMAGE_REF:?} +ostree_origin_ref="${OSTREE_IMAGE_REF}:${INSTALL_IMAGE_TAG}" # The installer is a live KDE environment. Keep the installed system payload # separate: it is the AeroCore image, while BASE_IMAGE provides the live UI. @@ -124,6 +127,14 @@ df -h /var/tmp \${target_tmp} ostreecontainer --url=${INSTALL_IMAGE_PAYLOAD} --transport=containers-storage --no-signature-verification +# The local containers-storage deployment is intentionally unverified because +# the payload is loaded from an OCI archive. Point future bootc updates at the +# signed registry reference configured for the image instead. +%post --erroronfail --log=/tmp/aerocore-origin.log +set -eux +sed -i 's|container-image-reference=.*|container-image-reference=${ostree_origin_ref}|' /ostree/deploy/default/deploy/*.origin +%end + %post --nochroot --log=/tmp/aerocore-hostname.log set -eux target_root= -- cgit v1.2.3 From 40a5f50c69ec323c7c5d92f6357a9774017f67a1 Mon Sep 17 00:00:00 2001 From: tranch Date: Wed, 29 Jul 2026 17:05:41 +0800 Subject: Fix weak password crash in Live installer Restore the Cockpit force-password behavior embedded in Fedora 43's Anaconda WebUI bundle. Apply strict password policy through conf.d so weak passwords remain a form validation error instead of aborting the installer. --- installer/build.sh | 5 +++ installer/patch-anaconda-webui.sh | 47 ++++++++++++++++++++++ .../etc/anaconda/conf.d/99-aerocore-password.conf | 5 +++ 3 files changed, 57 insertions(+) create mode 100755 installer/patch-anaconda-webui.sh create mode 100644 installer/system_files/overrides/etc/anaconda/conf.d/99-aerocore-password.conf (limited to 'installer') diff --git a/installer/build.sh b/installer/build.sh index 3093dcc..4535113 100755 --- a/installer/build.sh +++ b/installer/build.sh @@ -31,6 +31,11 @@ dnf --setopt=excludepkgs= reinstall -y \ grub2-efi-x64 \ grub2-efi-x64-cdboot +# Fedora 43's anaconda-webui bundle embeds a Cockpit password helper from +# before cockpit-project/cockpit@900c13f. Restore that upstream fix so a weak +# pwscore result is returned as score 0 instead of rejecting the WebUI promise. +"${SCRIPT_DIR}/patch-anaconda-webui.sh" + # Apply the same AeroCore overlay to the live session where possible. if [[ -d /src/system_files ]]; then cp -a /src/system_files/. / diff --git a/installer/patch-anaconda-webui.sh b/installer/patch-anaconda-webui.sh new file mode 100755 index 0000000..2f61516 --- /dev/null +++ b/installer/patch-anaconda-webui.sh @@ -0,0 +1,47 @@ +#!/usr/bin/env bash + +set -euo pipefail + +bundle="${1:-/usr/share/cockpit/anaconda-webui/index.js.gz}" +broken='n===0?r(new Error(X2("Password is too weak"))):o(' +fixed='n===0&&!e?r(new Error(X2("Password is too weak"))):o(' +fixed_sed='n===0\&\&!e?r(new Error(X2("Password is too weak"))):o(' + +if [[ ! -f "${bundle}" ]]; then + echo "Anaconda WebUI bundle not found: ${bundle}" >&2 + exit 1 +fi + +webui_js="$(mktemp)" +patched_js="$(mktemp)" +patched_bundle="$(mktemp)" +trap 'rm -f "${webui_js}" "${patched_js}" "${patched_bundle}"' EXIT + +gzip -dc "${bundle}" > "${webui_js}" + +fixed_count="$( (grep -oF "${fixed}" "${webui_js}" || true) | wc -l | tr -d ' ')" +if [[ "${fixed_count}" == "1" ]]; then + echo "Anaconda WebUI weak-password handling is already fixed" + exit 0 +fi + +broken_count="$( (grep -oF "${broken}" "${webui_js}" || true) | wc -l | tr -d ' ')" +if [[ "${broken_count}" != "1" ]]; then + echo "Unexpected Anaconda WebUI password helper; refusing an unsafe patch" >&2 + echo "Expected one weak-password rejection, found ${broken_count}" >&2 + exit 1 +fi + +sed "s|${broken}|${fixed_sed}|" "${webui_js}" > "${patched_js}" + +fixed_count="$( (grep -oF "${fixed}" "${patched_js}" || true) | wc -l | tr -d ' ')" +if [[ "${fixed_count}" != "1" ]] || grep -Fq "${broken}" "${patched_js}"; then + echo "Failed to patch Anaconda WebUI weak-password handling" >&2 + exit 1 +fi + +gzip -n -9 -c "${patched_js}" > "${patched_bundle}" +chmod 0644 "${patched_bundle}" +mv -f "${patched_bundle}" "${bundle}" + +echo "Patched Anaconda WebUI weak-password handling" diff --git a/installer/system_files/overrides/etc/anaconda/conf.d/99-aerocore-password.conf b/installer/system_files/overrides/etc/anaconda/conf.d/99-aerocore-password.conf new file mode 100644 index 0000000..3105934 --- /dev/null +++ b/installer/system_files/overrides/etc/anaconda/conf.d/99-aerocore-password.conf @@ -0,0 +1,5 @@ +[User Interface] +password_policies = + root (quality 1, length 6, strict) + user (quality 1, length 6, empty, strict) + luks (quality 1, length 6) -- cgit v1.2.3