From af388fa9580cf445eb6a39b2ee573ef593253684 Mon Sep 17 00:00:00 2001
From: "sec-check[bot]" <sec-check[bot]@users.noreply.github.com>
Date: Thu, 10 Sep 2026 19:06:36 -0400
Subject: [PATCH] [architect] refactor: use %{release-version} in
 os-release-flatcar.bst instead of re-parsing junction ref

The element re-derived the FSDK point release from the junction file with
a bash regex, even though project.conf already declares release-version
(validated by check-release-version.py) and it is in scope for all
elements. Replace the extraction loop and the local source that read the
junction file with direct use of %{release-version}.

Fixes #88

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: sec-check[bot] <sec-check[bot]@users.noreply.github.com>
---
 .../bluefin-server/os-release-flatcar.bst     | 25 +++----------------
 1 file changed, 4 insertions(+), 21 deletions(-)

diff --git a/elements/bluefin-server/os-release-flatcar.bst b/elements/bluefin-server/os-release-flatcar.bst
index c643522..c567c0c 100644
--- a/elements/bluefin-server/os-release-flatcar.bst
+++ b/elements/bluefin-server/os-release-flatcar.bst
@@ -13,29 +13,12 @@ build-depends:
 variables:
   strip-binaries: ""
 
-sources:
-  # The FSDK point release is the source of truth for the OS image version.
-  - kind: local
-    path: elements/freedesktop-sdk.bst
-
 config:
   install-commands:
     - mkdir -p "%{install-root}/usr/lib"
     - |
-      # Extract the FSDK point release (e.g. 25.08.13) from the pinned junction ref.
-      FSDK_VERSION=""
-      while read -r line; do
-        if [[ "${line}" =~ ref:[[:space:]]+freedesktop-sdk-([0-9]+\.[0-9]+\.[0-9]+)- ]]; then
-          FSDK_VERSION="${BASH_REMATCH[1]}"
-          break
-        fi
-      done < freedesktop-sdk.bst
-      if [ -z "${FSDK_VERSION}" ]; then
-        echo "ERROR: Could not determine FSDK version from freedesktop-sdk.bst" >&2
-        exit 1
-      fi
-
-      # Flatcar-compatible version used by systemd-sysext / Flatcar Bakery matching.
+      # %{release-version} is declared in project.conf and enforced against
+      # the junction ref by check-release-version.py — no re-parsing needed.
       FLATCAR_VERSION="4593.2.3"
 
       cat <<EOF > "%{install-root}/usr/lib/os-release"
@@ -44,13 +27,13 @@ config:
       ID_LIKE=fedora
       VERSION="${FLATCAR_VERSION}-fsdk"
       VERSION_ID=${FLATCAR_VERSION}
-      PRETTY_NAME="Bluefin Server ${FSDK_VERSION}"
+      PRETTY_NAME="Bluefin Server %{release-version}"
       ANSI_COLOR="0;38;5;208"
       HOME_URL="https://github.com/projectbluefin/server"
       BUG_REPORT_URL="https://github.com/projectbluefin/server/issues"
       FLATCAR_BOARD="%{flatcar-board}"
       CPE_NAME="cpe:/o:flatcar-linux:flatcar_linux:${FLATCAR_VERSION}"
-      IMAGE_VERSION=${FSDK_VERSION}
+      IMAGE_VERSION=%{release-version}
       EOF
     - |
       mkdir -p "%{install-root}/etc"