Sigstore signed images are now here - Universal Blue

[giscus[bot]]

Sigstore signed images are now here - Universal Blue

Custom Operating System images based on Fedora

https://universal-blue.org/blog/2023/07/19/sigstore-signed-images-are-now-here/

[bketelsen]

What a glorious day!

[bubuntux]

am i missing something?
i tried and got this

$ rpm-ostree rebase ostree-image-signed:docker://ghcr.io/ublue-os/sericea-nvidia:38
Pulling manifest: ostree-image-signed:docker://ghcr.io/ublue-os/sericea-nvidia:38
error: Creating importer: Failed to invoke skopeo proxy method OpenImage: remote error: open /usr/etc/pki/containers/ublue-os.pub: no such file or directory

currently running

$ rpm-ostree status
State: idle
AutomaticUpdates: stage; rpm-ostreed-automatic.timer: no runs since boot
Deployments:
● ostree-unverified-registry:ghcr.io/ublue-os/sericea-nvidia:38
                   Digest: sha256:a6f24b1231209a6731938acd321ec890f1fa130485515b4cda7c2abad442320f
                  Version: 38.20230719.0 (2023-07-19T17:06:54Z)
          LayeredPackages: power-profiles-daemon

i do see the ublue-os.pub in /usr/etc/pki/ rather than /usr/etc/pki/containers/

...

had to adjust /etc/containers/policy.json to the correct path to make it work AND then move it back after the update

[castrojo]

It looks like you may have received a busted image during the transition, here's a three liner to copy all the right stuff to your machine if anyone else runs into this (thanks to xkrith for figuring this out):

podman pull ghcr.io/ublue-os/config
rpm-ostree install --assumeyes --apply-live --force-replacefiles $(find ~/.local/share/containers -name ublue-os-signing.noarch.rpm 2>/dev/null)
rpm-ostree rebase --uninstall $(rpm -q ublue-os-signing-* --queryformat '%{NAME}-%{VERSION}-%{RELEASE}.%{Arch}') ostree-image-signed:docker://ghcr.io/ublue-os/silverblue-main