Install patched anaconda-webui from the forge's RPM registry, not COPR

The fork (quine/quine-anaconda-webui on forge.quinefoundation.com) now
builds its RPM with Forgejo Actions and publishes it to the quine org's
package registry. The installer image adds that repo with priority=10 so
it wins over Fedora's anaconda-webui, verifies Forgejo's signed repo
metadata (the RPMs themselves are unsigned), and the Taskfile passes the
repo metadata checksum as a build arg so a newly published RPM busts the
cached dnf layer.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Taskfile.yml

@@ -3,7 +3,16 @@ version: '3'
 vars:
   IMAGE: quine-linux
   INSTALLER_IMAGE: quine-installer
-  COPR_REPO: philip-peterson/quine-anaconda-webui
+  # dnf .repo for the patched anaconda-webui, built by the fork's CI.
+  RPM_REPO_URL: https://forge.quinefoundation.com/api/packages/quine/rpm.repo
+  # Checksum of that repo's current metadata; passed as a build arg so the
+  # installer's dnf layer is rebuilt exactly when a new RPM gets published.
+  RPM_REPO_REV:
+    sh: |
+      [ -n "{{.RPM_REPO_URL}}" ] || exit 0
+      base=$(curl -fsSL "{{.RPM_REPO_URL}}" | sed -n 's/^baseurl=//p' | head -1)
+      sum() { if command -v sha256sum >/dev/null; then sha256sum; else shasum -a 256; fi; }
+      curl -fsSL "$base/repodata/repomd.xml" 2>/dev/null | sum | cut -c1-16
   OUTPUT_DIR: ./output
   # Any docker-CLI-compatible runtime works for plain builds. Prefers podman,
   # falls back to docker; override with CONTAINER_RUNTIME=... (env or task var).
@@ -68,24 +77,22 @@ tasks:
       Build the patched-Anaconda installer-environment container (see
       installer/Containerfile and docs/patched-anaconda-installer.md). This
       is separate from the quine-linux OS image itself. Defaults to the
-      {{.COPR_REPO}} COPR project; override with
-      `task build-installer-image COPR_REPO=you/other-project`.
+      anaconda-webui build at {{.RPM_REPO_URL}}; override with
+      `task build-installer-image RPM_REPO_URL=...` (empty = stock Fedora).
     cmds:
-      - sudo {{.CONTAINER_RUNTIME}} build --platform {{.PLATFORM}} -t {{.INSTALLER_IMAGE}} --build-arg COPR_REPO={{.COPR_REPO}} -f installer/Containerfile installer/
-    sources:
-      - installer/Containerfile
+      - sudo {{.CONTAINER_RUNTIME}} build --platform {{.PLATFORM}} -t {{.INSTALLER_IMAGE}} --build-arg RPM_REPO_URL={{.RPM_REPO_URL}} --build-arg RPM_REPO_REV={{.RPM_REPO_REV}} -f installer/Containerfile installer/
 
   build-installer-iso:
     desc: >-
       Build a bootable install ISO using the patched-Anaconda installer
       image to install the quine-linux bootc image, via
       bootc-image-builder's `bootc-installer` type. Output lands in
-      {{.OUTPUT_DIR}}/bootc-installer/install.iso. Uses the same COPR_REPO
+      {{.OUTPUT_DIR}}/bootc-installer/install.iso. Uses the same RPM_REPO_URL
       default/override as build-installer-image.
     deps: [build-image]
     cmds:
       - task: build-installer-image
-        vars: { COPR_REPO: "{{.COPR_REPO}}" }
+        vars: { RPM_REPO_URL: "{{.RPM_REPO_URL}}" }
       - task: export-to-storage
         vars: { IMAGES: "{{.IMAGE}} {{.INSTALLER_IMAGE}}" }
       - mkdir -p {{.OUTPUT_DIR}}

docs/patched-anaconda-installer.md

@@ -30,7 +30,7 @@ everywhere else. All current upstream feature work happens on the WebUI, so
 that's the one to fork:
 
 - https://github.com/rhinstaller/anaconda-webui, forked to
-  https://github.com/philip-peterson/anaconda-webui
+  https://github.com/philip-peterson/quine-anaconda-webui
 
 `installer/Containerfile` depends on `anaconda-webui` explicitly (not just
 the bare `anaconda` metapackage) so the UI doesn't depend on incidentally
@@ -39,34 +39,46 @@ matching a release-identity package.
 ## Workflow
 
 1. **Fork** `rhinstaller/anaconda-webui` to
-   `philip-peterson/anaconda-webui` on GitHub, make your panel/control
+   `philip-peterson/quine-anaconda-webui` on GitHub, make your panel/control
    changes there.
 2. **Get it built as an RPM your installer container can `dnf install`.**
-   Recommended: a Fedora COPR project.
-   - Create the COPR project `philip-peterson/quine-anaconda-webui`
-     (https://copr.fedorainfracloud.org/), point it at
-     `philip-peterson/anaconda-webui` (branch or a webhook), let COPR build
-     it against the Fedora release Aurora currently tracks.
-   - That name is already wired in as the `COPR_REPO` default in
-     `Taskfile.yml` and `installer/Containerfile`. Using a different COPR
-     project name means overriding `COPR_REPO=` on the `task` invocations
-     below instead.
-   - This publishes your fork's source and build logs on COPR's
-     infrastructure (marking a project "unlisted" hides it from browsing,
-     not from direct access) -- worth knowing before you push anything you
-     wouldn't want visible outside this machine.
+   The fork's own Forgejo Actions workflow does this, as a self-hosted
+   stand-in for COPR: `.forgejo/workflows/rpm.yml` runs
+   `.forgejo/build-rpm.sh` in a fresh `fedora:rawhide` container (upstream's
+   `make srpm`, then `rpmbuild`) and uploads the RPM to the forge's package
+   registry. Setup, once:
+   - Host the fork on `forge.quinefoundation.com` (Forgejo Actions only runs
+     for repos on the forge), under the account the package should be
+     published as -- the `quine` org by default
+     (`quine/quine-anaconda-webui`).
+   - Add a repo secret `RPM_UPLOAD_TOKEN`: an access token for that account
+     with `write:package` scope, from a user
+     allowed to publish packages for that org.
+   - The result is served at
+     `https://forge.quinefoundation.com/api/packages/quine/rpm.repo`,
+     already wired in as the `RPM_REPO_URL` default in `Taskfile.yml`.
+     Publishing under a different owner means overriding `RPM_REPO_URL=` on
+     the `task` invocations below.
+
+   Versioning: the build fetches upstream's tags so `git describe` yields
+   e.g. `86.3.gabcdef0` (3 commits past upstream 86), and the Release is
+   `<run number>.quine`, so each build is a new version that sorts above
+   Fedora's own. The installer also gives this repo dnf `priority=10`, so
+   it wins even when Fedora ships a newer upstream release.
 3. **Build the installer image and ISO:**
    ```sh
    task build-installer-iso
    ```
    This builds the quine-linux OS image (if needed), builds
-   `installer/Containerfile` with the `philip-peterson/quine-anaconda-webui`
-   COPR repo enabled, and produces `output/bootc-installer/install.iso`.
-4. **Iterate:** push a change to your fork, wait for COPR to rebuild, rerun
-   `task build-installer-iso` -- podman/task will rebuild the installer
-   layer to pick up the new RPM.
+   `installer/Containerfile` with that repo enabled, and produces
+   `output/bootc-installer/install.iso`. `RPM_REPO_URL=` (empty) builds
+   with stock Fedora `anaconda-webui` instead.
+4. **Iterate:** push a change to your fork, wait for its RPM workflow,
+   rerun `task build-installer-iso`. The Taskfile passes a checksum of the
+   repo's metadata into the build, so a newly published RPM invalidates
+   the cached `dnf install` layer and gets picked up.
 
-## Local alternative (no COPR)
+## Local alternative (no forge)
 
 If you'd rather not publish the fork anywhere: build the RPM locally with
 `mock` targeting the same Fedora release/arch as the installer base,

installer/Containerfile

@@ -6,15 +6,25 @@
 
 FROM quay.io/fedora/fedora-bootc:rawhide
 
-# Set to your COPR project (e.g. "yourname/quine-anaconda") holding a build
-# of your patched anaconda-webui fork. Override at build time with
-# --build-arg COPR_REPO=... instead of editing this file.
-ARG COPR_REPO
+# URL of a dnf .repo file for the repository holding a build of the patched
+# anaconda-webui fork -- by default the Forgejo RPM registry its CI publishes
+# to (see docs/patched-anaconda-installer.md). Override at build time with
+# --build-arg RPM_REPO_URL=...; empty means stock Fedora anaconda-webui.
+ARG RPM_REPO_URL
+# Set by the Taskfile to the repo metadata's checksum; only here so a newly
+# published RPM invalidates the build cache for the layer below.
+ARG RPM_REPO_REV
 
+# priority=10 (default 99) makes dnf take anaconda-webui from that repo even
+# when Fedora's own build is newer. Forgejo signs the repo metadata but not
+# the RPMs themselves, so verify the signed metadata (which carries each
+# package's checksum) instead of per-package signatures.
 RUN set -eux; \
-    dnf install -y dnf-plugins-core; \
-    if [ -n "${COPR_REPO}" ]; then \
-      dnf copr enable -y "${COPR_REPO}"; \
+    echo "anaconda-webui repo rev: ${RPM_REPO_REV:-none}"; \
+    if [ -n "${RPM_REPO_URL}" ]; then \
+      curl -fsSL "${RPM_REPO_URL}" -o /etc/yum.repos.d/quine-anaconda.repo; \
+      sed -i 's/^gpgcheck=.*/gpgcheck=0/' /etc/yum.repos.d/quine-anaconda.repo; \
+      printf '\nrepo_gpgcheck=1\npriority=10\n' >> /etc/yum.repos.d/quine-anaconda.repo; \
     fi; \
     dnf install -y \
       anaconda-webui \