From c22aae05910a941db7ef50720f97943838371377 Mon Sep 17 00:00:00 2001
From: Philip Peterson <1326208+philip-peterson@users.noreply.github.com>
Date: Mon, 2 Nov 2026 04:19:24 -0900
Subject: [PATCH] Installs follow registry.quineglobal.com/quine-linux

The live ISO's installs now pull and update from
registry.quineglobal.com/quine-linux:latest (Taskfile's UPDATE_IMAGE),
our own pull-only name for the forge's image, instead of the forge's
hostname, so the update source outlives where the images are stored. CI
still pushes to the forge.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .forgejo/workflows/iso.yml | 4 +++-
 README.md                  | 4 +++-
 Taskfile.yml               | 7 ++++++-
 live/Containerfile         | 4 ++--
 4 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/.forgejo/workflows/iso.yml b/.forgejo/workflows/iso.yml
index f62515e..82ec3e2 100644
--- a/.forgejo/workflows/iso.yml
+++ b/.forgejo/workflows/iso.yml
@@ -3,7 +3,9 @@ name: Image, disk image and live ISO
 # Builds the quine-linux image on our Aurora build (published by
 # quine-global-labs/aurora's workflow to this forge's registry), pushes it to
 # forge.quinefoundation.com/quine-global-labs/quine-linux (`latest`,
-# `<date>`, the commit), then builds a disk image (qcow2) and the live ISO
+# `<date>`, the commit; installed systems pull it as
+# registry.quineglobal.com/quine-linux, a pull-only name for it), then
+# builds a disk image (qcow2) and the live ISO
 # (which is also the installer, as Aurora's) from it and uploads them to MinIO
 # as <bucket>/disk/latest/disk.qcow2 and <bucket>/live/latest/live.iso,
 # replacing the last build's.
diff --git a/README.md b/README.md
index 27f4ef9..a120191 100644
--- a/README.md
+++ b/README.md
@@ -18,7 +18,9 @@ The image is built in two repos:
   [Hardware-specific patches](#hardware-specific-patches) below). Anything a
   `RUN` step on top of Aurora can do belongs here, not in the fork. Its
   workflow publishes `forge.quinefoundation.com/quine-global-labs/quine-linux`,
-  and the live ISO and disk image (to MinIO).
+  and the live ISO and disk image (to MinIO). Installed systems pull and
+  update from the same image as `registry.quineglobal.com/quine-linux`, a
+  pull-only name for it (Taskfile.yml's `UPDATE_IMAGE`).
 
 Like Aurora, there's one installer: the live ISO's. There's no separate
 install ISO.
diff --git a/Taskfile.yml b/Taskfile.yml
index 5233b80..a3da387 100644
--- a/Taskfile.yml
+++ b/Taskfile.yml
@@ -8,6 +8,11 @@ vars:
   # Override with a local build of the fork (BASE_IMAGE=localhost/aurora:stable,
   # see README) or stock upstream (BASE_IMAGE=ghcr.io/ublue-os/aurora:stable).
   BASE_IMAGE: forge.quinefoundation.com/quine-global-labs/aurora:stable
+  # What installed systems follow for updates: Aurora's uupd.timer stages
+  # whatever is newest there daily, for the next boot. Our own name, so it
+  # outlives where the images are stored: today a pull-only proxy to the
+  # forge's registry (petersweb-infra nixos/edge.nix), where iso.yml pushes.
+  UPDATE_IMAGE: registry.quineglobal.com/quine-linux:latest
   OUTPUT_DIR: '{{.ROOT_DIR}}/output'
   # Root is needed for the container builds and bootc; skip {{.SUDO}} when already
   # root (e.g. on a CI runner, which may not have {{.SUDO}} at all).
@@ -96,7 +101,7 @@ tasks:
       plus the live session and Anaconda WebUI, with PAYLOAD_IMAGE (what the
       installer installs) pulled into it. Podman only.
     vars:
-      PAYLOAD_IMAGE: '{{.PAYLOAD_IMAGE | default "forge.quinefoundation.com/quine-global-labs/quine-linux:latest"}}'
+      PAYLOAD_IMAGE: '{{.PAYLOAD_IMAGE | default .UPDATE_IMAGE}}'
     preconditions:
       - sh: '[ "{{.CONTAINER_RUNTIME}}" = podman ]'
         msg: The live ISO tasks need podman (they mount the image into Titanoboa's container).
diff --git a/live/Containerfile b/live/Containerfile
index 6df7a15..960c781 100644
--- a/live/Containerfile
+++ b/live/Containerfile
@@ -6,8 +6,8 @@
 # remounts /proc/sys and pulls the image the installer installs.
 ARG BASE_IMAGE=localhost/quine-linux
 # What the installer puts on disk, from the registry, and what installed
-# systems then update from.
-ARG PAYLOAD_IMAGE=forge.quinefoundation.com/quine-global-labs/quine-linux:latest
+# systems then update from (Taskfile.yml's UPDATE_IMAGE).
+ARG PAYLOAD_IMAGE=registry.quineglobal.com/quine-linux:latest
 FROM ${BASE_IMAGE}
 ARG PAYLOAD_IMAGE
 ENV PAYLOAD_IMAGE=${PAYLOAD_IMAGE}