Installs follow registry.quineglobal.com/quine-linux

The live ISO's installs now pull and update from
registry.quineglobal.com/quine-linux:latest (Taskfile's UPDATE_IMAGE),
our own pull-only name for the forge's image, instead of the forge's
hostname, so the update source outlives where the images are stored. CI
still pushes to the forge.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.forgejo/workflows/iso.yml

@@ -3,7 +3,9 @@ name: Image, disk image and live ISO
 # Builds the quine-linux image on our Aurora build (published by
 # quine-global-labs/aurora's workflow to this forge's registry), pushes it to
 # forge.quinefoundation.com/quine-global-labs/quine-linux (`latest`,
-# `<date>`, the commit), then builds a disk image (qcow2) and the live ISO
+# `<date>`, the commit; installed systems pull it as
+# registry.quineglobal.com/quine-linux, a pull-only name for it), then
+# builds a disk image (qcow2) and the live ISO
 # (which is also the installer, as Aurora's) from it and uploads them to MinIO
 # as <bucket>/disk/latest/disk.qcow2 and <bucket>/live/latest/live.iso,
 # replacing the last build's.

README.md

@@ -18,7 +18,9 @@ The image is built in two repos:
   [Hardware-specific patches](#hardware-specific-patches) below). Anything a
   `RUN` step on top of Aurora can do belongs here, not in the fork. Its
   workflow publishes `forge.quinefoundation.com/quine-global-labs/quine-linux`,
-  and the live ISO and disk image (to MinIO).
+  and the live ISO and disk image (to MinIO). Installed systems pull and
+  update from the same image as `registry.quineglobal.com/quine-linux`, a
+  pull-only name for it (Taskfile.yml's `UPDATE_IMAGE`).
 
 Like Aurora, there's one installer: the live ISO's. There's no separate
 install ISO.

Taskfile.yml

@@ -8,6 +8,11 @@ vars:
   # Override with a local build of the fork (BASE_IMAGE=localhost/aurora:stable,
   # see README) or stock upstream (BASE_IMAGE=ghcr.io/ublue-os/aurora:stable).
   BASE_IMAGE: forge.quinefoundation.com/quine-global-labs/aurora:stable
+  # What installed systems follow for updates: Aurora's uupd.timer stages
+  # whatever is newest there daily, for the next boot. Our own name, so it
+  # outlives where the images are stored: today a pull-only proxy to the
+  # forge's registry (petersweb-infra nixos/edge.nix), where iso.yml pushes.
+  UPDATE_IMAGE: registry.quineglobal.com/quine-linux:latest
   OUTPUT_DIR: '{{.ROOT_DIR}}/output'
   # Root is needed for the container builds and bootc; skip {{.SUDO}} when already
   # root (e.g. on a CI runner, which may not have {{.SUDO}} at all).
@@ -96,7 +101,7 @@ tasks:
       plus the live session and Anaconda WebUI, with PAYLOAD_IMAGE (what the
       installer installs) pulled into it. Podman only.
     vars:
-      PAYLOAD_IMAGE: '{{.PAYLOAD_IMAGE | default "forge.quinefoundation.com/quine-global-labs/quine-linux:latest"}}'
+      PAYLOAD_IMAGE: '{{.PAYLOAD_IMAGE | default .UPDATE_IMAGE}}'
     preconditions:
       - sh: '[ "{{.CONTAINER_RUNTIME}}" = podman ]'
         msg: The live ISO tasks need podman (they mount the image into Titanoboa's container).

live/Containerfile

@@ -6,8 +6,8 @@
 # remounts /proc/sys and pulls the image the installer installs.
 ARG BASE_IMAGE=localhost/quine-linux
 # What the installer puts on disk, from the registry, and what installed
-# systems then update from.
+# systems then update from (Taskfile.yml's UPDATE_IMAGE).
-ARG PAYLOAD_IMAGE=forge.quinefoundation.com/quine-global-labs/quine-linux:latest
+ARG PAYLOAD_IMAGE=registry.quineglobal.com/quine-linux:latest
 FROM ${BASE_IMAGE}
 ARG PAYLOAD_IMAGE
 ENV PAYLOAD_IMAGE=${PAYLOAD_IMAGE}