From 42a6ff3286804854c1c21a7e62158f09e19a9b09 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Sun, 12 Jul 2026 23:33:44 +0800
Subject: Add live installer build workflow

Add a Bazzite-style installer payload, CI workflow, and local\nPodman commands for building and testing the live ISO.\n\nFix stale disk image configuration references and installer targets.
---
 just_scripts/build-live-installer.sh | 58 ++++++++++++++++++++++++++++++++++++
 just_scripts/run-live-installer.sh   | 23 ++++++++++++++
 2 files changed, 81 insertions(+)
 create mode 100755 just_scripts/build-live-installer.sh
 create mode 100755 just_scripts/run-live-installer.sh

(limited to 'just_scripts')

diff --git a/just_scripts/build-live-installer.sh b/just_scripts/build-live-installer.sh
new file mode 100755
index 0000000..16b371e
--- /dev/null
+++ b/just_scripts/build-live-installer.sh
@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+project_root="$(git rev-parse --show-toplevel)"
+cd "${project_root}"
+
+image_name="${IMAGE_NAME:-$(just image_name)}"
+image_tag="${IMAGE_TAG:-$(just generate-default-tag)}"
+base_image="${BASE_IMAGE:-ghcr.io/ublue-os/bazzite:stable}"
+payload="localhost/${image_name}:live-payload"
+output_dir="${project_root}/output"
+api_socket="${PODMAN_SOCKET:-/run/podman/podman.sock}"
+if [[ "${EUID}" -eq 0 ]]; then
+  podman_cmd=(podman)
+else
+  podman_cmd=(sudo podman)
+fi
+
+if [[ ! -S "${api_socket}" ]]; then
+  echo "Podman API socket not found: ${api_socket}" >&2
+  echo "Set PODMAN_SOCKET to the rootful Podman socket and retry." >&2
+  exit 1
+fi
+
+mkdir -p "${output_dir}"
+"${podman_cmd[@]}" tag "${image_name}:${image_tag}" "${payload}"
+
+"${podman_cmd[@]}" build \
+  --cap-add sys_admin \
+  --security-opt label=disable \
+  --build-arg "BASE_IMAGE=${base_image}" \
+  --build-arg "INSTALL_IMAGE_PAYLOAD=${payload}" \
+  --tag localhost/aerocore-live-payload:latest \
+  --file installer/Containerfile \
+  .
+
+"${podman_cmd[@]}" run --rm --privileged \
+  --volume "${api_socket}:/var/run/docker.sock" \
+  --volume "${project_root}/output:/build-container-installer/build" \
+  --volume "${project_root}/installer/lorax_templates:/additional_lorax_templates:ro" \
+  docker.io/jasonn3/build-container-installer:latest \
+  ADDITIONAL_TEMPLATES="/additional_lorax_templates/remove_root_password_prompt.tmpl /additional_lorax_templates/set_default_user.tmpl" \
+  ARCH="x86_64" \
+  ENABLE_CACHE_DNF="false" \
+  ENABLE_CACHE_SKOPEO="false" \
+  ENABLE_FLATPAK_DEPENDENCIES="false" \
+  IMAGE_NAME="aerocore-live-payload" \
+  IMAGE_REPO="localhost" \
+  IMAGE_TAG="latest" \
+  ISO_NAME="build/aerocore-os-${image_tag}-amd64.iso" \
+  VARIANT="Kinoite" \
+  VERSION="${FEDORA_VERSION:-44}"
+
+iso="${output_dir}/aerocore-os-${image_tag}-amd64.iso"
+if [[ -f "${iso}" ]]; then
+  sha256sum "${iso}" | tee "${iso}-CHECKSUM"
+fi
diff --git a/just_scripts/run-live-installer.sh b/just_scripts/run-live-installer.sh
new file mode 100755
index 0000000..2723aae
--- /dev/null
+++ b/just_scripts/run-live-installer.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+project_root="$(git rev-parse --show-toplevel)"
+cd "${project_root}"
+
+image_tag="${IMAGE_TAG:-$(just generate-default-tag)}"
+iso="${project_root}/output/aerocore-os-${image_tag}-amd64.iso"
+
+if [[ ! -f "${iso}" ]]; then
+  just build-live-installer
+fi
+
+podman run --rm --cap-add NET_ADMIN \
+  --publish 127.0.0.1:8006:8006 \
+  --env CPU_CORES=2 \
+  --env RAM_SIZE=4G \
+  --env DISK_SIZE=64G \
+  --env BOOT_MODE=uefi \
+  --device /dev/kvm \
+  --volume "${iso}:/boot.iso:ro" \
+  docker.io/qemux/qemu-docker
-- 
cgit v1.2.3


From 04b8dcbbc3d5707f488c9b67ba96ce88ccd15181 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Fri, 17 Jul 2026 06:56:56 +0800
Subject: Fix live installer ISO build

Build the live installer from the requested local AeroCore image, use a
separate Fedora live base, pass the payload through rootful container
storage, and write reproducible checksum entries without host paths.
---
 just_scripts/build-live-installer.sh | 84 +++++++++++++++++++++++++++++++-----
 1 file changed, 74 insertions(+), 10 deletions(-)

(limited to 'just_scripts')

diff --git a/just_scripts/build-live-installer.sh b/just_scripts/build-live-installer.sh
index 16b371e..45335cb 100755
--- a/just_scripts/build-live-installer.sh
+++ b/just_scripts/build-live-installer.sh
@@ -5,41 +5,98 @@ set -euo pipefail
 project_root="$(git rev-parse --show-toplevel)"
 cd "${project_root}"
 
-image_name="${IMAGE_NAME:-$(just image_name)}"
+image_name="${IMAGE_NAME:-localhost/$(just image_name)}"
 image_tag="${IMAGE_TAG:-$(just generate-default-tag)}"
-base_image="${BASE_IMAGE:-ghcr.io/ublue-os/bazzite:stable}"
-payload="localhost/${image_name}:live-payload"
+live_base_image="${LIVE_BASE_IMAGE:-quay.io/fedora/fedora-kinoite:43}"
+installer_builder_image="${INSTALLER_BUILDER_IMAGE:-ghcr.io/jasonn3/build-container-installer:v1.5.0}"
+source_image="${image_name}:${image_tag}"
+payload="localhost/aerocore-live-payload:latest"
 output_dir="${project_root}/output"
+payload_archive="${output_dir}/install-payload.oci"
+iso="${output_dir}/aerocore-os-${image_tag}-amd64.iso"
+checksum="${iso}-CHECKSUM"
 api_socket="${PODMAN_SOCKET:-/run/podman/podman.sock}"
 if [[ "${EUID}" -eq 0 ]]; then
   podman_cmd=(podman)
+  socket_test=(test -S "${api_socket}")
 else
   podman_cmd=(sudo podman)
+  socket_test=(sudo test -S "${api_socket}")
 fi
 
-if [[ ! -S "${api_socket}" ]]; then
+if ! "${socket_test[@]}"; then
   echo "Podman API socket not found: ${api_socket}" >&2
   echo "Set PODMAN_SOCKET to the rootful Podman socket and retry." >&2
   exit 1
 fi
 
+ensure_rootful_image() {
+  local root_image_id user_image_id user_name user_uid copy_tmp
+
+  root_image_id="$("${podman_cmd[@]}" images \
+    --filter "reference=${source_image}" \
+    --format "{{.ID}}" | head -n1)"
+
+  if [[ -n "${root_image_id}" ]]; then
+    return 0
+  fi
+
+  if [[ "${EUID}" -ne 0 ]]; then
+    just _rootful_load_image "${image_name}" "${image_tag}"
+    return
+  fi
+
+  if [[ -z "${SUDO_USER:-}" ]]; then
+    return
+  fi
+
+  user_name="${SUDO_USER}"
+  user_uid="$(id -u "${user_name}")"
+  user_image_id="$(sudo -u "${user_name}" \
+    env XDG_RUNTIME_DIR="/run/user/${user_uid}" \
+    podman images \
+      --filter "reference=${source_image}" \
+      --format "{{.ID}}" | head -n1)"
+
+  if [[ -z "${user_image_id}" ]]; then
+    return
+  fi
+
+  copy_tmp="$(mktemp -p "${project_root}" -d -t _build_podman_scp.XXXXXXXXXX)"
+  TMPDIR="${copy_tmp}" podman image scp \
+    "${user_uid}@localhost::${source_image}" \
+    "root@localhost::${source_image}"
+  rm -rf "${copy_tmp}"
+}
+
 mkdir -p "${output_dir}"
-"${podman_cmd[@]}" tag "${image_name}:${image_tag}" "${payload}"
+ensure_rootful_image
+
+"${podman_cmd[@]}" tag "${source_image}" "${payload}"
+"${podman_cmd[@]}" save --format oci-archive --output "${payload_archive}" "${payload}"
 
 "${podman_cmd[@]}" build \
   --cap-add sys_admin \
   --security-opt label=disable \
-  --build-arg "BASE_IMAGE=${base_image}" \
+  --build-arg "BASE_IMAGE=${live_base_image}" \
   --build-arg "INSTALL_IMAGE_PAYLOAD=${payload}" \
-  --tag localhost/aerocore-live-payload:latest \
+  --build-arg "INSTALL_IMAGE_PAYLOAD_ARCHIVE=/install-payload.oci" \
+  --tag "${payload}" \
   --file installer/Containerfile \
   .
 
+if [[ "${EUID}" -eq 0 ]]; then
+  rm -f "${iso}" "${checksum}"
+else
+  sudo rm -f "${iso}" "${checksum}"
+fi
+
 "${podman_cmd[@]}" run --rm --privileged \
   --volume "${api_socket}:/var/run/docker.sock" \
+  --volume /var/lib/containers/storage:/var/lib/containers/storage \
   --volume "${project_root}/output:/build-container-installer/build" \
   --volume "${project_root}/installer/lorax_templates:/additional_lorax_templates:ro" \
-  docker.io/jasonn3/build-container-installer:latest \
+  "${installer_builder_image}" \
   ADDITIONAL_TEMPLATES="/additional_lorax_templates/remove_root_password_prompt.tmpl /additional_lorax_templates/set_default_user.tmpl" \
   ARCH="x86_64" \
   ENABLE_CACHE_DNF="false" \
@@ -47,12 +104,19 @@ mkdir -p "${output_dir}"
   ENABLE_FLATPAK_DEPENDENCIES="false" \
   IMAGE_NAME="aerocore-live-payload" \
   IMAGE_REPO="localhost" \
+  IMAGE_SRC="containers-storage:${payload}" \
   IMAGE_TAG="latest" \
   ISO_NAME="build/aerocore-os-${image_tag}-amd64.iso" \
   VARIANT="Kinoite" \
   VERSION="${FEDORA_VERSION:-44}"
 
-iso="${output_dir}/aerocore-os-${image_tag}-amd64.iso"
 if [[ -f "${iso}" ]]; then
-  sha256sum "${iso}" | tee "${iso}-CHECKSUM"
+  if [[ "${EUID}" -ne 0 ]]; then
+    sudo chown "$(id -u):$(id -g)" "${iso}"
+    sudo rm -f "${checksum}"
+    (cd "${output_dir}" && sha256sum "$(basename "${iso}")") | sudo tee "${checksum}"
+    sudo chown "$(id -u):$(id -g)" "${checksum}"
+  else
+    (cd "${output_dir}" && sha256sum "$(basename "${iso}")") | tee "${checksum}"
+  fi
 fi
-- 
cgit v1.2.3


From 4dd41315acaa07112864a3833dfb7775d9b44274 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Fri, 24 Jul 2026 17:29:04 +0800
Subject: Rename live installer to installer ISO

Use installer ISO terminology across Just, workflows, scripts, docs, and
image payloads while preserving compatibility aliases for existing
commands.
---
 just_scripts/build-installer-iso.sh  | 122 +++++++++++++++++++++++++++++++++++
 just_scripts/build-live-installer.sh | 122 -----------------------------------
 just_scripts/run-installer-iso.sh    |  23 +++++++
 just_scripts/run-live-installer.sh   |  23 -------
 4 files changed, 145 insertions(+), 145 deletions(-)
 create mode 100755 just_scripts/build-installer-iso.sh
 delete mode 100755 just_scripts/build-live-installer.sh
 create mode 100755 just_scripts/run-installer-iso.sh
 delete mode 100755 just_scripts/run-live-installer.sh

(limited to 'just_scripts')

diff --git a/just_scripts/build-installer-iso.sh b/just_scripts/build-installer-iso.sh
new file mode 100755
index 0000000..22d14a0
--- /dev/null
+++ b/just_scripts/build-installer-iso.sh
@@ -0,0 +1,122 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+project_root="$(git rev-parse --show-toplevel)"
+cd "${project_root}"
+
+image_name="${IMAGE_NAME:-localhost/$(just image_name)}"
+image_tag="${IMAGE_TAG:-$(just generate-default-tag)}"
+live_base_image="${LIVE_BASE_IMAGE:-quay.io/fedora/fedora-kinoite:43}"
+installer_builder_image="${INSTALLER_BUILDER_IMAGE:-ghcr.io/jasonn3/build-container-installer:v1.5.0}"
+source_image="${image_name}:${image_tag}"
+payload="localhost/aerocore-installer-payload:latest"
+output_dir="${project_root}/output"
+payload_archive="${output_dir}/install-payload.oci"
+iso="${output_dir}/aerocore-os-${image_tag}-amd64.iso"
+checksum="${iso}-CHECKSUM"
+api_socket="${PODMAN_SOCKET:-/run/podman/podman.sock}"
+if [[ "${EUID}" -eq 0 ]]; then
+  podman_cmd=(podman)
+  socket_test=(test -S "${api_socket}")
+else
+  podman_cmd=(sudo podman)
+  socket_test=(sudo test -S "${api_socket}")
+fi
+
+if ! "${socket_test[@]}"; then
+  echo "Podman API socket not found: ${api_socket}" >&2
+  echo "Set PODMAN_SOCKET to the rootful Podman socket and retry." >&2
+  exit 1
+fi
+
+ensure_rootful_image() {
+  local root_image_id user_image_id user_name user_uid copy_tmp
+
+  root_image_id="$("${podman_cmd[@]}" images \
+    --filter "reference=${source_image}" \
+    --format "{{.ID}}" | head -n1)"
+
+  if [[ -n "${root_image_id}" ]]; then
+    return 0
+  fi
+
+  if [[ "${EUID}" -ne 0 ]]; then
+    just _rootful_load_image "${image_name}" "${image_tag}"
+    return
+  fi
+
+  if [[ -z "${SUDO_USER:-}" ]]; then
+    return
+  fi
+
+  user_name="${SUDO_USER}"
+  user_uid="$(id -u "${user_name}")"
+  user_image_id="$(sudo -u "${user_name}" \
+    env XDG_RUNTIME_DIR="/run/user/${user_uid}" \
+    podman images \
+      --filter "reference=${source_image}" \
+      --format "{{.ID}}" | head -n1)"
+
+  if [[ -z "${user_image_id}" ]]; then
+    return
+  fi
+
+  copy_tmp="$(mktemp -p "${project_root}" -d -t _build_podman_scp.XXXXXXXXXX)"
+  TMPDIR="${copy_tmp}" podman image scp \
+    "${user_uid}@localhost::${source_image}" \
+    "root@localhost::${source_image}"
+  rm -rf "${copy_tmp}"
+}
+
+mkdir -p "${output_dir}"
+ensure_rootful_image
+
+"${podman_cmd[@]}" tag "${source_image}" "${payload}"
+"${podman_cmd[@]}" save --format oci-archive --output "${payload_archive}" "${payload}"
+
+"${podman_cmd[@]}" build \
+  --cap-add sys_admin \
+  --security-opt label=disable \
+  --build-arg "BASE_IMAGE=${live_base_image}" \
+  --build-arg "INSTALL_IMAGE_PAYLOAD=${payload}" \
+  --build-arg "INSTALL_IMAGE_PAYLOAD_ARCHIVE=/install-payload.oci" \
+  --tag "${payload}" \
+  --file installer/Containerfile \
+  .
+
+if [[ "${EUID}" -eq 0 ]]; then
+  rm -f "${iso}" "${checksum}"
+else
+  sudo rm -f "${iso}" "${checksum}"
+fi
+
+"${podman_cmd[@]}" run --rm --privileged \
+  --volume "${api_socket}:/var/run/docker.sock" \
+  --volume /var/lib/containers/storage:/var/lib/containers/storage \
+  --volume "${project_root}/output:/build-container-installer/build" \
+  --volume "${project_root}/installer/lorax_templates:/additional_lorax_templates:ro" \
+  "${installer_builder_image}" \
+  ADDITIONAL_TEMPLATES="/additional_lorax_templates/remove_root_password_prompt.tmpl /additional_lorax_templates/set_default_user.tmpl" \
+  ARCH="x86_64" \
+  ENABLE_CACHE_DNF="false" \
+  ENABLE_CACHE_SKOPEO="false" \
+  ENABLE_FLATPAK_DEPENDENCIES="false" \
+  IMAGE_NAME="aerocore-installer-payload" \
+  IMAGE_REPO="localhost" \
+  IMAGE_SRC="containers-storage:${payload}" \
+  IMAGE_TAG="latest" \
+  ISO_NAME="build/aerocore-os-${image_tag}-amd64.iso" \
+  VARIANT="Kinoite" \
+  VERSION="${FEDORA_VERSION:-44}"
+
+if [[ -f "${iso}" ]]; then
+  if [[ "${EUID}" -ne 0 ]]; then
+    sudo chown "$(id -u):$(id -g)" "${iso}"
+    sudo rm -f "${checksum}"
+    (cd "${output_dir}" && sha256sum "$(basename "${iso}")") | sudo tee "${checksum}"
+    sudo chown "$(id -u):$(id -g)" "${checksum}"
+  else
+    (cd "${output_dir}" && sha256sum "$(basename "${iso}")") | tee "${checksum}"
+  fi
+fi
diff --git a/just_scripts/build-live-installer.sh b/just_scripts/build-live-installer.sh
deleted file mode 100755
index 45335cb..0000000
--- a/just_scripts/build-live-installer.sh
+++ /dev/null
@@ -1,122 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-project_root="$(git rev-parse --show-toplevel)"
-cd "${project_root}"
-
-image_name="${IMAGE_NAME:-localhost/$(just image_name)}"
-image_tag="${IMAGE_TAG:-$(just generate-default-tag)}"
-live_base_image="${LIVE_BASE_IMAGE:-quay.io/fedora/fedora-kinoite:43}"
-installer_builder_image="${INSTALLER_BUILDER_IMAGE:-ghcr.io/jasonn3/build-container-installer:v1.5.0}"
-source_image="${image_name}:${image_tag}"
-payload="localhost/aerocore-live-payload:latest"
-output_dir="${project_root}/output"
-payload_archive="${output_dir}/install-payload.oci"
-iso="${output_dir}/aerocore-os-${image_tag}-amd64.iso"
-checksum="${iso}-CHECKSUM"
-api_socket="${PODMAN_SOCKET:-/run/podman/podman.sock}"
-if [[ "${EUID}" -eq 0 ]]; then
-  podman_cmd=(podman)
-  socket_test=(test -S "${api_socket}")
-else
-  podman_cmd=(sudo podman)
-  socket_test=(sudo test -S "${api_socket}")
-fi
-
-if ! "${socket_test[@]}"; then
-  echo "Podman API socket not found: ${api_socket}" >&2
-  echo "Set PODMAN_SOCKET to the rootful Podman socket and retry." >&2
-  exit 1
-fi
-
-ensure_rootful_image() {
-  local root_image_id user_image_id user_name user_uid copy_tmp
-
-  root_image_id="$("${podman_cmd[@]}" images \
-    --filter "reference=${source_image}" \
-    --format "{{.ID}}" | head -n1)"
-
-  if [[ -n "${root_image_id}" ]]; then
-    return 0
-  fi
-
-  if [[ "${EUID}" -ne 0 ]]; then
-    just _rootful_load_image "${image_name}" "${image_tag}"
-    return
-  fi
-
-  if [[ -z "${SUDO_USER:-}" ]]; then
-    return
-  fi
-
-  user_name="${SUDO_USER}"
-  user_uid="$(id -u "${user_name}")"
-  user_image_id="$(sudo -u "${user_name}" \
-    env XDG_RUNTIME_DIR="/run/user/${user_uid}" \
-    podman images \
-      --filter "reference=${source_image}" \
-      --format "{{.ID}}" | head -n1)"
-
-  if [[ -z "${user_image_id}" ]]; then
-    return
-  fi
-
-  copy_tmp="$(mktemp -p "${project_root}" -d -t _build_podman_scp.XXXXXXXXXX)"
-  TMPDIR="${copy_tmp}" podman image scp \
-    "${user_uid}@localhost::${source_image}" \
-    "root@localhost::${source_image}"
-  rm -rf "${copy_tmp}"
-}
-
-mkdir -p "${output_dir}"
-ensure_rootful_image
-
-"${podman_cmd[@]}" tag "${source_image}" "${payload}"
-"${podman_cmd[@]}" save --format oci-archive --output "${payload_archive}" "${payload}"
-
-"${podman_cmd[@]}" build \
-  --cap-add sys_admin \
-  --security-opt label=disable \
-  --build-arg "BASE_IMAGE=${live_base_image}" \
-  --build-arg "INSTALL_IMAGE_PAYLOAD=${payload}" \
-  --build-arg "INSTALL_IMAGE_PAYLOAD_ARCHIVE=/install-payload.oci" \
-  --tag "${payload}" \
-  --file installer/Containerfile \
-  .
-
-if [[ "${EUID}" -eq 0 ]]; then
-  rm -f "${iso}" "${checksum}"
-else
-  sudo rm -f "${iso}" "${checksum}"
-fi
-
-"${podman_cmd[@]}" run --rm --privileged \
-  --volume "${api_socket}:/var/run/docker.sock" \
-  --volume /var/lib/containers/storage:/var/lib/containers/storage \
-  --volume "${project_root}/output:/build-container-installer/build" \
-  --volume "${project_root}/installer/lorax_templates:/additional_lorax_templates:ro" \
-  "${installer_builder_image}" \
-  ADDITIONAL_TEMPLATES="/additional_lorax_templates/remove_root_password_prompt.tmpl /additional_lorax_templates/set_default_user.tmpl" \
-  ARCH="x86_64" \
-  ENABLE_CACHE_DNF="false" \
-  ENABLE_CACHE_SKOPEO="false" \
-  ENABLE_FLATPAK_DEPENDENCIES="false" \
-  IMAGE_NAME="aerocore-live-payload" \
-  IMAGE_REPO="localhost" \
-  IMAGE_SRC="containers-storage:${payload}" \
-  IMAGE_TAG="latest" \
-  ISO_NAME="build/aerocore-os-${image_tag}-amd64.iso" \
-  VARIANT="Kinoite" \
-  VERSION="${FEDORA_VERSION:-44}"
-
-if [[ -f "${iso}" ]]; then
-  if [[ "${EUID}" -ne 0 ]]; then
-    sudo chown "$(id -u):$(id -g)" "${iso}"
-    sudo rm -f "${checksum}"
-    (cd "${output_dir}" && sha256sum "$(basename "${iso}")") | sudo tee "${checksum}"
-    sudo chown "$(id -u):$(id -g)" "${checksum}"
-  else
-    (cd "${output_dir}" && sha256sum "$(basename "${iso}")") | tee "${checksum}"
-  fi
-fi
diff --git a/just_scripts/run-installer-iso.sh b/just_scripts/run-installer-iso.sh
new file mode 100755
index 0000000..2c49164
--- /dev/null
+++ b/just_scripts/run-installer-iso.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+project_root="$(git rev-parse --show-toplevel)"
+cd "${project_root}"
+
+image_tag="${IMAGE_TAG:-$(just generate-default-tag)}"
+iso="${project_root}/output/aerocore-os-${image_tag}-amd64.iso"
+
+if [[ ! -f "${iso}" ]]; then
+  just build-installer-iso
+fi
+
+podman run --rm --cap-add NET_ADMIN \
+  --publish 127.0.0.1:8006:8006 \
+  --env CPU_CORES=2 \
+  --env RAM_SIZE=4G \
+  --env DISK_SIZE=64G \
+  --env BOOT_MODE=uefi \
+  --device /dev/kvm \
+  --volume "${iso}:/boot.iso:ro" \
+  docker.io/qemux/qemu-docker
diff --git a/just_scripts/run-live-installer.sh b/just_scripts/run-live-installer.sh
deleted file mode 100755
index 2723aae..0000000
--- a/just_scripts/run-live-installer.sh
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-project_root="$(git rev-parse --show-toplevel)"
-cd "${project_root}"
-
-image_tag="${IMAGE_TAG:-$(just generate-default-tag)}"
-iso="${project_root}/output/aerocore-os-${image_tag}-amd64.iso"
-
-if [[ ! -f "${iso}" ]]; then
-  just build-live-installer
-fi
-
-podman run --rm --cap-add NET_ADMIN \
-  --publish 127.0.0.1:8006:8006 \
-  --env CPU_CORES=2 \
-  --env RAM_SIZE=4G \
-  --env DISK_SIZE=64G \
-  --env BOOT_MODE=uefi \
-  --device /dev/kvm \
-  --volume "${iso}:/boot.iso:ro" \
-  docker.io/qemux/qemu-docker
-- 
cgit v1.2.3


From c008e52494fd3e350d4231bb7c229d576a17d800 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Sat, 25 Jul 2026 04:41:50 +0800
Subject: Use target var tmp during installer deploy

Bind the live installer's /var/tmp to the mounted target system in the pre-install phase so ostreecontainer can stage image layers on target disk space instead of the tiny LiveOS rootfs.
---
 just_scripts/build-installer-iso.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'just_scripts')

diff --git a/just_scripts/build-installer-iso.sh b/just_scripts/build-installer-iso.sh
index 22d14a0..5c9e9eb 100755
--- a/just_scripts/build-installer-iso.sh
+++ b/just_scripts/build-installer-iso.sh
@@ -97,7 +97,7 @@ fi
   --volume "${project_root}/output:/build-container-installer/build" \
   --volume "${project_root}/installer/lorax_templates:/additional_lorax_templates:ro" \
   "${installer_builder_image}" \
-  ADDITIONAL_TEMPLATES="/additional_lorax_templates/remove_root_password_prompt.tmpl /additional_lorax_templates/set_default_user.tmpl" \
+  ADDITIONAL_TEMPLATES="/additional_lorax_templates/remove_root_password_prompt.tmpl /additional_lorax_templates/set_default_user.tmpl /additional_lorax_templates/use_target_var_tmp.tmpl" \
   ARCH="x86_64" \
   ENABLE_CACHE_DNF="false" \
   ENABLE_CACHE_SKOPEO="false" \
-- 
cgit v1.2.3


From 981dde9ceed99c6b0a9dde1bce74e6100f0593d2 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Sat, 25 Jul 2026 07:14:05 +0800
Subject: Apply var tmp fix in installer payload

Write the pre-install /var/tmp bind mount hook from installer/build.sh so both Titanoboa CI builds and local ISO builds carry the fix. The previous lorax template path was only wired through the local helper and did not affect GitHub Actions.
---
 just_scripts/build-installer-iso.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'just_scripts')

diff --git a/just_scripts/build-installer-iso.sh b/just_scripts/build-installer-iso.sh
index 5c9e9eb..22d14a0 100755
--- a/just_scripts/build-installer-iso.sh
+++ b/just_scripts/build-installer-iso.sh
@@ -97,7 +97,7 @@ fi
   --volume "${project_root}/output:/build-container-installer/build" \
   --volume "${project_root}/installer/lorax_templates:/additional_lorax_templates:ro" \
   "${installer_builder_image}" \
-  ADDITIONAL_TEMPLATES="/additional_lorax_templates/remove_root_password_prompt.tmpl /additional_lorax_templates/set_default_user.tmpl /additional_lorax_templates/use_target_var_tmp.tmpl" \
+  ADDITIONAL_TEMPLATES="/additional_lorax_templates/remove_root_password_prompt.tmpl /additional_lorax_templates/set_default_user.tmpl" \
   ARCH="x86_64" \
   ENABLE_CACHE_DNF="false" \
   ENABLE_CACHE_SKOPEO="false" \
-- 
cgit v1.2.3


From db108b8b23c86ba39a2ba289fc6129a6325f045f Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Sat, 25 Jul 2026 09:57:45 +0800
Subject: Normalize installer payload and host naming

Use a formal local installer image tag and set aerocore-os as the
default hostname in both the live image and installed target system.
---
 just_scripts/build-installer-iso.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'just_scripts')

diff --git a/just_scripts/build-installer-iso.sh b/just_scripts/build-installer-iso.sh
index 22d14a0..38e1718 100755
--- a/just_scripts/build-installer-iso.sh
+++ b/just_scripts/build-installer-iso.sh
@@ -10,7 +10,7 @@ image_tag="${IMAGE_TAG:-$(just generate-default-tag)}"
 live_base_image="${LIVE_BASE_IMAGE:-quay.io/fedora/fedora-kinoite:43}"
 installer_builder_image="${INSTALLER_BUILDER_IMAGE:-ghcr.io/jasonn3/build-container-installer:v1.5.0}"
 source_image="${image_name}:${image_tag}"
-payload="localhost/aerocore-installer-payload:latest"
+payload="localhost/aerocore-os-installer:latest"
 output_dir="${project_root}/output"
 payload_archive="${output_dir}/install-payload.oci"
 iso="${output_dir}/aerocore-os-${image_tag}-amd64.iso"
@@ -102,7 +102,7 @@ fi
   ENABLE_CACHE_DNF="false" \
   ENABLE_CACHE_SKOPEO="false" \
   ENABLE_FLATPAK_DEPENDENCIES="false" \
-  IMAGE_NAME="aerocore-installer-payload" \
+  IMAGE_NAME="aerocore-os-installer" \
   IMAGE_REPO="localhost" \
   IMAGE_SRC="containers-storage:${payload}" \
   IMAGE_TAG="latest" \
-- 
cgit v1.2.3


From 0ebf76e160c1e45d537e24d145fed47a38d8d99d Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Sat, 25 Jul 2026 22:49:06 +0800
Subject: Route installer updates through OSTREE_IMAGE_REF

Use the configured ref for ISO boot origins and derive GHCR fallbacks
from the current repository instead of hardcoding the image path.
---
 just_scripts/build-installer-iso.sh | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

(limited to 'just_scripts')

diff --git a/just_scripts/build-installer-iso.sh b/just_scripts/build-installer-iso.sh
index 38e1718..abd668f 100755
--- a/just_scripts/build-installer-iso.sh
+++ b/just_scripts/build-installer-iso.sh
@@ -10,7 +10,16 @@ image_tag="${IMAGE_TAG:-$(just generate-default-tag)}"
 live_base_image="${LIVE_BASE_IMAGE:-quay.io/fedora/fedora-kinoite:43}"
 installer_builder_image="${INSTALLER_BUILDER_IMAGE:-ghcr.io/jasonn3/build-container-installer:v1.5.0}"
 source_image="${image_name}:${image_tag}"
-payload="localhost/aerocore-os-installer:latest"
+# Keep the payload in local container storage, but use the public update
+# reference as its local tag so Anaconda writes that reference as the boot
+# origin instead of persisting the temporary localhost name. OSTREE_IMAGE_REF
+# is intentionally tagless, matching the image-info contract.
+image_basename="${image_name##*/}"
+ostree_image_ref="${OSTREE_IMAGE_REF:-ostree-image-signed:docker://ghcr.io/${REPO_ORGANIZATION:-AeroCore-IO}/${image_basename}}"
+install_image_ref="${ostree_image_ref#ostree-image-signed:docker://}"
+install_image_ref="${install_image_ref#ostree-unverified-registry:docker://}"
+install_image_ref="${install_image_ref#docker://}"
+payload="${install_image_ref}:${image_tag}"
 output_dir="${project_root}/output"
 payload_archive="${output_dir}/install-payload.oci"
 iso="${output_dir}/aerocore-os-${image_tag}-amd64.iso"
-- 
cgit v1.2.3


From 26848f158c30f700258f4eab5df6e3a448a8d35c Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 29 Jul 2026 08:23:02 +0800
Subject: Fix installer update origin

Rewrite installed bootc origins to the configured signed registry
reference.
---
 just_scripts/build-installer-iso.sh | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'just_scripts')

diff --git a/just_scripts/build-installer-iso.sh b/just_scripts/build-installer-iso.sh
index abd668f..2b1f7ae 100755
--- a/just_scripts/build-installer-iso.sh
+++ b/just_scripts/build-installer-iso.sh
@@ -90,6 +90,8 @@ ensure_rootful_image
   --build-arg "BASE_IMAGE=${live_base_image}" \
   --build-arg "INSTALL_IMAGE_PAYLOAD=${payload}" \
   --build-arg "INSTALL_IMAGE_PAYLOAD_ARCHIVE=/install-payload.oci" \
+  --build-arg "INSTALL_IMAGE_TAG=${image_tag}" \
+  --build-arg "OSTREE_IMAGE_REF=${ostree_image_ref}" \
   --tag "${payload}" \
   --file installer/Containerfile \
   .
-- 
cgit v1.2.3


From 2d1118b6860c0e80ccc78883d6b814d73df4da67 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 29 Jul 2026 14:50:10 +0800
Subject: Align local installer ISO build with CI

Use the pinned Titanoboa builder and matching build arguments so just
build-installer-iso produces the same media as the GitHub Actions
workflow.
---
 just_scripts/build-installer-iso.sh | 49 +++++++++++++++++++++++--------------
 1 file changed, 30 insertions(+), 19 deletions(-)

(limited to 'just_scripts')

diff --git a/just_scripts/build-installer-iso.sh b/just_scripts/build-installer-iso.sh
index 2b1f7ae..3226527 100755
--- a/just_scripts/build-installer-iso.sh
+++ b/just_scripts/build-installer-iso.sh
@@ -8,7 +8,8 @@ cd "${project_root}"
 image_name="${IMAGE_NAME:-localhost/$(just image_name)}"
 image_tag="${IMAGE_TAG:-$(just generate-default-tag)}"
 live_base_image="${LIVE_BASE_IMAGE:-quay.io/fedora/fedora-kinoite:43}"
-installer_builder_image="${INSTALLER_BUILDER_IMAGE:-ghcr.io/jasonn3/build-container-installer:v1.5.0}"
+titanoboa_repository="${TITANOBOA_REPOSITORY:-https://github.com/Zeglius/titanoboa.git}"
+titanoboa_revision="${TITANOBOA_REVISION:-7737f4748458252ac827dca14b3d6dd09298472a}"
 source_image="${image_name}:${image_tag}"
 # Keep the payload in local container storage, but use the public update
 # reference as its local tag so Anaconda writes that reference as the boot
@@ -102,24 +103,34 @@ else
   sudo rm -f "${iso}" "${checksum}"
 fi
 
-"${podman_cmd[@]}" run --rm --privileged \
-  --volume "${api_socket}:/var/run/docker.sock" \
-  --volume /var/lib/containers/storage:/var/lib/containers/storage \
-  --volume "${project_root}/output:/build-container-installer/build" \
-  --volume "${project_root}/installer/lorax_templates:/additional_lorax_templates:ro" \
-  "${installer_builder_image}" \
-  ADDITIONAL_TEMPLATES="/additional_lorax_templates/remove_root_password_prompt.tmpl /additional_lorax_templates/set_default_user.tmpl" \
-  ARCH="x86_64" \
-  ENABLE_CACHE_DNF="false" \
-  ENABLE_CACHE_SKOPEO="false" \
-  ENABLE_FLATPAK_DEPENDENCIES="false" \
-  IMAGE_NAME="aerocore-os-installer" \
-  IMAGE_REPO="localhost" \
-  IMAGE_SRC="containers-storage:${payload}" \
-  IMAGE_TAG="latest" \
-  ISO_NAME="build/aerocore-os-${image_tag}-amd64.iso" \
-  VARIANT="Kinoite" \
-  VERSION="${FEDORA_VERSION:-44}"
+tmp_titanoboa="$(mktemp -d -t aerocore-titanoboa.XXXXXXXXXX)"
+trap 'rm -rf "${tmp_titanoboa}"' EXIT
+
+git clone --quiet --filter=blob:none --no-checkout \
+  "${titanoboa_repository}" "${tmp_titanoboa}"
+git -C "${tmp_titanoboa}" fetch --quiet origin "${titanoboa_revision}"
+git -C "${tmp_titanoboa}" checkout --quiet "${titanoboa_revision}"
+
+# Keep this invocation aligned with Zeglius/titanoboa's GitHub Action:
+# `just build IMAGE 1 0 none squashfs "" 1`.
+(
+  cd "${tmp_titanoboa}"
+  CI=1 TITANOBOA_WORKDIR="${tmp_titanoboa}/work" \
+    sudo PATH="${PATH}" just build "${payload}" 1 0 none squashfs "" 1
+)
+
+titanoboa_iso="${tmp_titanoboa}/output.iso"
+if [[ ! -f "${titanoboa_iso}" ]]; then
+  echo "Titanoboa did not produce ${titanoboa_iso}" >&2
+  exit 1
+fi
+if [[ "${EUID}" -eq 0 ]]; then
+  rm -f "${iso}" "${checksum}"
+  mv "${titanoboa_iso}" "${iso}"
+else
+  sudo rm -f "${iso}" "${checksum}"
+  sudo mv "${titanoboa_iso}" "${iso}"
+fi
 
 if [[ -f "${iso}" ]]; then
   if [[ "${EUID}" -ne 0 ]]; then
-- 
cgit v1.2.3


From a2f42fc771aba319e9d9b75e90a6dabeedde9fa1 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 29 Jul 2026 15:26:08 +0800
Subject: Fix Titanoboa Justfile lookup

Run the pinned builder with explicit Justfile and working directory
paths under sudo.
---
 just_scripts/build-installer-iso.sh | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

(limited to 'just_scripts')

diff --git a/just_scripts/build-installer-iso.sh b/just_scripts/build-installer-iso.sh
index 3226527..4e634a6 100755
--- a/just_scripts/build-installer-iso.sh
+++ b/just_scripts/build-installer-iso.sh
@@ -115,8 +115,13 @@ git -C "${tmp_titanoboa}" checkout --quiet "${titanoboa_revision}"
 # `just build IMAGE 1 0 none squashfs "" 1`.
 (
   cd "${tmp_titanoboa}"
-  CI=1 TITANOBOA_WORKDIR="${tmp_titanoboa}/work" \
-    sudo PATH="${PATH}" just build "${payload}" 1 0 none squashfs "" 1
+  sudo env \
+    CI=1 \
+    TITANOBOA_WORKDIR="${tmp_titanoboa}/work" \
+    just \
+    --justfile "${tmp_titanoboa}/Justfile" \
+    --working-directory "${tmp_titanoboa}" \
+    build "${payload}" 1 0 none squashfs "" 1
 )
 
 titanoboa_iso="${tmp_titanoboa}/output.iso"
-- 
cgit v1.2.3


From afe0884c451f5f3698779c7cfe8085ac0c4923a2 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 29 Jul 2026 16:20:38 +0800
Subject: Use Titanoboa main script for ISO builds

The pinned Titanoboa revision has no Justfile; invoke its GitHub Action
entrypoint and collect the generated ISO.
---
 just_scripts/build-installer-iso.sh | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

(limited to 'just_scripts')

diff --git a/just_scripts/build-installer-iso.sh b/just_scripts/build-installer-iso.sh
index 4e634a6..0aacf43 100755
--- a/just_scripts/build-installer-iso.sh
+++ b/just_scripts/build-installer-iso.sh
@@ -111,22 +111,20 @@ git clone --quiet --filter=blob:none --no-checkout \
 git -C "${tmp_titanoboa}" fetch --quiet origin "${titanoboa_revision}"
 git -C "${tmp_titanoboa}" checkout --quiet "${titanoboa_revision}"
 
-# Keep this invocation aligned with Zeglius/titanoboa's GitHub Action:
-# `just build IMAGE 1 0 none squashfs "" 1`.
+# Keep this invocation aligned with the pinned revision's GitHub Action.
+# This revision exposes main.sh rather than a Justfile.
 (
   cd "${tmp_titanoboa}"
-  sudo env \
+  env \
     CI=1 \
-    TITANOBOA_WORKDIR="${tmp_titanoboa}/work" \
-    just \
-    --justfile "${tmp_titanoboa}/Justfile" \
-    --working-directory "${tmp_titanoboa}" \
-    build "${payload}" 1 0 none squashfs "" 1
+    TITANOBOA_CTR_IMAGE="${payload}" \
+    TITANOBOA_OUTPUT_DIR="${tmp_titanoboa}/output" \
+    "${tmp_titanoboa}/main.sh"
 )
 
-titanoboa_iso="${tmp_titanoboa}/output.iso"
+titanoboa_iso="$(find "${tmp_titanoboa}/output" -maxdepth 1 -type f -name '*.iso' -print -quit)"
 if [[ ! -f "${titanoboa_iso}" ]]; then
-  echo "Titanoboa did not produce ${titanoboa_iso}" >&2
+  echo "Titanoboa did not produce an ISO in ${tmp_titanoboa}/output" >&2
   exit 1
 fi
 if [[ "${EUID}" -eq 0 ]]; then
-- 
cgit v1.2.3


From 636dcb9dc7af0c23bddeb855da8479eb06df090a Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 5 Aug 2026 06:50:26 +0800
Subject: Align ISO workflow live naming

Match Bazzite's live ISO workflow label and output filename while keeping local build and run helpers pointed at the same artifact.
---
 just_scripts/build-installer-iso.sh | 2 +-
 just_scripts/run-installer-iso.sh   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

(limited to 'just_scripts')

diff --git a/just_scripts/build-installer-iso.sh b/just_scripts/build-installer-iso.sh
index 0aacf43..3353651 100755
--- a/just_scripts/build-installer-iso.sh
+++ b/just_scripts/build-installer-iso.sh
@@ -23,7 +23,7 @@ install_image_ref="${install_image_ref#docker://}"
 payload="${install_image_ref}:${image_tag}"
 output_dir="${project_root}/output"
 payload_archive="${output_dir}/install-payload.oci"
-iso="${output_dir}/aerocore-os-${image_tag}-amd64.iso"
+iso="${output_dir}/aerocore-os-${image_tag}-live-amd64.iso"
 checksum="${iso}-CHECKSUM"
 api_socket="${PODMAN_SOCKET:-/run/podman/podman.sock}"
 if [[ "${EUID}" -eq 0 ]]; then
diff --git a/just_scripts/run-installer-iso.sh b/just_scripts/run-installer-iso.sh
index 2c49164..c495215 100755
--- a/just_scripts/run-installer-iso.sh
+++ b/just_scripts/run-installer-iso.sh
@@ -6,7 +6,7 @@ project_root="$(git rev-parse --show-toplevel)"
 cd "${project_root}"
 
 image_tag="${IMAGE_TAG:-$(just generate-default-tag)}"
-iso="${project_root}/output/aerocore-os-${image_tag}-amd64.iso"
+iso="${project_root}/output/aerocore-os-${image_tag}-live-amd64.iso"
 
 if [[ ! -f "${iso}" ]]; then
   just build-installer-iso
-- 
cgit v1.2.3


From 80cde14b9c368f58e8f16ad121396ce2f1a50f44 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Fri, 21 Aug 2026 08:42:38 +0800
Subject: Adapt to Bazzite 44

Update Deck identity matching for the new upstream scripts and add
fixture coverage for patch idempotence.

Move the live installer base to Fedora 44 while retaining the Fedora 43
Anaconda workaround for explicit legacy builds.
---
 just_scripts/build-installer-iso.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'just_scripts')

diff --git a/just_scripts/build-installer-iso.sh b/just_scripts/build-installer-iso.sh
index 3353651..fb1f6c0 100755
--- a/just_scripts/build-installer-iso.sh
+++ b/just_scripts/build-installer-iso.sh
@@ -7,7 +7,7 @@ cd "${project_root}"
 
 image_name="${IMAGE_NAME:-localhost/$(just image_name)}"
 image_tag="${IMAGE_TAG:-$(just generate-default-tag)}"
-live_base_image="${LIVE_BASE_IMAGE:-quay.io/fedora/fedora-kinoite:43}"
+live_base_image="${LIVE_BASE_IMAGE:-quay.io/fedora/fedora-kinoite:44}"
 titanoboa_repository="${TITANOBOA_REPOSITORY:-https://github.com/Zeglius/titanoboa.git}"
 titanoboa_revision="${TITANOBOA_REVISION:-7737f4748458252ac827dca14b3d6dd09298472a}"
 source_image="${image_name}:${image_tag}"
-- 
cgit v1.2.3


From c42b55f8accfea46263890323f2aedd2142fd515 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Tue, 25 Aug 2026 11:41:20 +0800
Subject: fix(installer): validate payload on build host

Move payload inspection out of the nested Podman build so local ISO
builds do not require /dev/fuse. Normalize local registry references.
---
 just_scripts/build-installer-iso.sh | 29 ++++++++++++++++++++++++++++-
 1 file changed, 28 insertions(+), 1 deletion(-)

(limited to 'just_scripts')

diff --git a/just_scripts/build-installer-iso.sh b/just_scripts/build-installer-iso.sh
index fb1f6c0..5d40a05 100755
--- a/just_scripts/build-installer-iso.sh
+++ b/just_scripts/build-installer-iso.sh
@@ -16,7 +16,10 @@ source_image="${image_name}:${image_tag}"
 # origin instead of persisting the temporary localhost name. OSTREE_IMAGE_REF
 # is intentionally tagless, matching the image-info contract.
 image_basename="${image_name##*/}"
-ostree_image_ref="${OSTREE_IMAGE_REF:-ostree-image-signed:docker://ghcr.io/${REPO_ORGANIZATION:-AeroCore-IO}/${image_basename}}"
+registry_organization="${REPO_ORGANIZATION:-aerocore-io}"
+registry_organization="${registry_organization,,}"
+ostree_image_ref="${OSTREE_IMAGE_REF:-ostree-image-signed:docker://ghcr.io/${registry_organization}/${image_basename}}"
+ostree_image_ref="${ostree_image_ref,,}"
 install_image_ref="${ostree_image_ref#ostree-image-signed:docker://}"
 install_image_ref="${install_image_ref#ostree-unverified-registry:docker://}"
 install_image_ref="${install_image_ref#docker://}"
@@ -79,8 +82,32 @@ ensure_rootful_image() {
   rm -rf "${copy_tmp}"
 }
 
+validate_install_payload() {
+  # Run on the build host rather than from installer/Containerfile. Nested
+  # Podman has no /dev/fuse in the build sandbox, while this check needs to
+  # mount the payload rootfs to inspect the bootupd label source.
+  "${podman_cmd[@]}" run --rm --network none --entrypoint /usr/bin/bash \
+    "${source_image}" -ceu '
+      system_release_target=$(readlink -f /etc/system-release)
+      if od -An -v -tx1 "$system_release_target" | awk '\''{ for (i = 1; i <= NF; i++) if ($i == "00") found = 1 } END { exit(found ? 0 : 1) }'\''; then
+        echo "Install payload has a NUL byte in ${system_release_target}" >&2
+        exit 1
+      fi
+      case "$(<"$system_release_target")" in
+        "AeroCore OS release $(rpm -E %fedora) ("*) ;;
+        *)
+          echo "Unexpected system-release: $(<"$system_release_target")" >&2
+          exit 1
+          ;;
+      esac
+      jq -e '\''.["image-name"] == "aerocore-os" and .["image-vendor"] == "aerocore-io"'\'' \
+        /usr/share/ublue-os/image-info.json >/dev/null
+    '
+}
+
 mkdir -p "${output_dir}"
 ensure_rootful_image
+validate_install_payload
 
 "${podman_cmd[@]}" tag "${source_image}" "${payload}"
 "${podman_cmd[@]}" save --format oci-archive --output "${payload_archive}" "${payload}"
-- 
cgit v1.2.3