feat(guix): carry prebuilt runtime and recover preserved state

1 files changed, 27 insertions, 2 deletions

diff --git a/src/app/images.rs b/src/app/images.rs
index fac7aa7..b1105c2 100644
--- a/src/app/images.rs
+++ b/src/app/images.rs
@@ -130,10 +130,22 @@ fn save_inner(
             },
         );
     }
+    let policy = tempfile::NamedTempFile::new()?;
+    serde_json::to_writer(
+        policy.as_file(),
+        &serde_json::json!({
+            "default": [{"type": "reject"}],
+            "transports": {
+                "containers-storage": {"": [{"type": "insecureAcceptAnything"}]}
+            }
+        }),
+    )?;
     let mut command = project.command("podman")?;
     command
+        .args(["save", "--signature-policy"])
+        .arg(policy.path());
+    command
         .args([
-            "save",
             "--multi-image-archive",
             "--format",
             "docker-archive",
@@ -178,10 +190,23 @@ pub(super) fn prepare(project: &Project, settings: &mut Settings) -> Result<()>
             archive.is_file(),
             "Release image archive is missing; deploy a complete release"
         );
+        let policy = tempfile::NamedTempFile::new()?;
+        serde_json::to_writer(
+            policy.as_file(),
+            &serde_json::json!({
+                "default": [{"type": "reject"}],
+                "transports": {
+                    "docker-archive": {"": [{"type": "insecureAcceptAnything"}]},
+                    "oci-archive": {"": [{"type": "insecureAcceptAnything"}]}
+                }
+            }),
+        )?;
         process::run(
             project
                 .command("podman")?
-                .args(["image", "load", "--input"])
+                .args(["image", "load", "--signature-policy"])
+                .arg(policy.path())
+                .arg("--input")
                 .arg(archive),
         )?;
     }