on stock silverblue you'll need to install the `ublue-os-signing.noarch.rpm` package first right? si

X

xkrithOP•7/19/23, 8:55 PM

or I guess edit the configs and key yourself

X

xkrithOP•7/19/23, 9:00 PM

sudo mkdir /etc/pki/containers
sudo curl -L https://github.com/ublue-os/config/raw/main/files/usr/etc/pki/containers/ublue-os.pub -o /etc/pki/containers/ublue-os.pub
sudo curl -L https://github.com/ublue-os/config/raw/main/files/usr/etc/containers/policy.json -o /etc/containers/policy.json
sudo curl -L https://github.com/ublue-os/config/raw/main/files/usr/etc/containers/registries.d/ublue-os.yaml -o /etc/containers/registries.d/ublue-os.yaml

sudo mkdir /etc/pki/containers
sudo curl -L https://github.com/ublue-os/config/raw/main/files/usr/etc/pki/containers/ublue-os.pub -o /etc/pki/containers/ublue-os.pub
sudo curl -L https://github.com/ublue-os/config/raw/main/files/usr/etc/containers/policy.json -o /etc/containers/policy.json
sudo curl -L https://github.com/ublue-os/config/raw/main/files/usr/etc/containers/registries.d/ublue-os.yaml -o /etc/containers/registries.d/ublue-os.yaml

sudo mkdir /etc/pki/containers
sudo curl -L https://github.com/ublue-os/config/raw/main/files/usr/etc/pki/containers/ublue-os.pub -o /etc/pki/containers/ublue-os.pub
sudo curl -L https://github.com/ublue-os/config/raw/main/files/usr/etc/containers/policy.json -o /etc/containers/policy.json
sudo curl -L https://github.com/ublue-os/config/raw/main/files/usr/etc/containers/registries.d/ublue-os.yaml -o /etc/containers/registries.d/ublue-os.yaml

sudo mkdir /etc/pki/containers
sudo curl -L https://github.com/ublue-os/config/raw/main/files/usr/etc/pki/containers/ublue-os.pub -o /etc/pki/containers/ublue-os.pub
sudo curl -L https://github.com/ublue-os/config/raw/main/files/usr/etc/containers/policy.json -o /etc/containers/policy.json
sudo curl -L https://github.com/ublue-os/config/raw/main/files/usr/etc/containers/registries.d/ublue-os.yaml -o /etc/containers/registries.d/ublue-os.yaml

K

Kyle Gospo•7/19/23, 9:00 PM

https://github.com/ublue-os/akmods/pull/37

K

Kyle Gospo•7/19/23, 9:00 PM

something odd here, I'm for sure missing something

K

Kyle Gospo•7/19/23, 9:01 PM

2023/07/19 20:59:37 akmodsbuild: make[1]: *** No rule to make target '/tmp/akmodsbuild.PQ3yLo8G/BUILD/openrgb-kmod-0.0.git.15.e85abc0e/_kmod_build_6.3.12-100.fc37.x86_64/i2c-piix4.o', needed by '/tmp/akmodsbuild.PQ3yLo8G/BUILD/openrgb-kmod-0.0.git.15.e85abc0e/_kmod_build_6.3.12-100.fc37.x86_64/'.  Stop.
2023/07/19 20:59:37 akmodsbuild: make: *** [Makefile:2037: /tmp/akmodsbuild.PQ3yLo8G/BUILD/openrgb-kmod-0.0.git.15.e85abc0e/_kmod_build_6.3.12-100.fc37.x86_64] Error 2

2023/07/19 20:59:37 akmodsbuild: make[1]: *** No rule to make target '/tmp/akmodsbuild.PQ3yLo8G/BUILD/openrgb-kmod-0.0.git.15.e85abc0e/_kmod_build_6.3.12-100.fc37.x86_64/i2c-piix4.o', needed by '/tmp/akmodsbuild.PQ3yLo8G/BUILD/openrgb-kmod-0.0.git.15.e85abc0e/_kmod_build_6.3.12-100.fc37.x86_64/'.  Stop.
2023/07/19 20:59:37 akmodsbuild: make: *** [Makefile:2037: /tmp/akmodsbuild.PQ3yLo8G/BUILD/openrgb-kmod-0.0.git.15.e85abc0e/_kmod_build_6.3.12-100.fc37.x86_64] Error 2

2023/07/19 20:59:37 akmodsbuild: make[1]: *** No rule to make target '/tmp/akmodsbuild.PQ3yLo8G/BUILD/openrgb-kmod-0.0.git.15.e85abc0e/_kmod_build_6.3.12-100.fc37.x86_64/i2c-piix4.o', needed by '/tmp/akmodsbuild.PQ3yLo8G/BUILD/openrgb-kmod-0.0.git.15.e85abc0e/_kmod_build_6.3.12-100.fc37.x86_64/'.  Stop.
2023/07/19 20:59:37 akmodsbuild: make: *** [Makefile:2037: /tmp/akmodsbuild.PQ3yLo8G/BUILD/openrgb-kmod-0.0.git.15.e85abc0e/_kmod_build_6.3.12-100.fc37.x86_64] Error 2

2023/07/19 20:59:37 akmodsbuild: make[1]: *** No rule to make target '/tmp/akmodsbuild.PQ3yLo8G/BUILD/openrgb-kmod-0.0.git.15.e85abc0e/_kmod_build_6.3.12-100.fc37.x86_64/i2c-piix4.o', needed by '/tmp/akmodsbuild.PQ3yLo8G/BUILD/openrgb-kmod-0.0.git.15.e85abc0e/_kmod_build_6.3.12-100.fc37.x86_64/'.  Stop.
2023/07/19 20:59:37 akmodsbuild: make: *** [Makefile:2037: /tmp/akmodsbuild.PQ3yLo8G/BUILD/openrgb-kmod-0.0.git.15.e85abc0e/_kmod_build_6.3.12-100.fc37.x86_64] Error 2

K

Kyle Gospo•7/19/23, 9:01 PM

https://github.com/KyleGospo/openrgb-dkms/blob/main/Makefile

Xxkrith on stock silverblue you'll need to install the `ublue-os-signing.noarch.rpm` pac...

J

j0rge•7/19/23, 9:17 PM

did that sort it?

J

j0rge•7/19/23, 9:17 PM

we need instructions on how stock people can move

J

j0rge•7/19/23, 9:18 PM

ah, we only need the policy.json

J

j0rge•7/19/23, 9:19 PM

sudo curl -L https://github.com/ublue-os/config/raw/main/files/usr/etc/containers/policy.json -o /etc/containers/policy.json

sudo curl -L https://github.com/ublue-os/config/raw/main/files/usr/etc/containers/policy.json -o /etc/containers/policy.json

sudo curl -L https://github.com/ublue-os/config/raw/main/files/usr/etc/containers/policy.json -o /etc/containers/policy.json

sudo curl -L https://github.com/ublue-os/config/raw/main/files/usr/etc/containers/policy.json -o /etc/containers/policy.json

J

j0rge•7/19/23, 9:19 PM

this looks like the cleanest command we can use?

X

xkrithOP•7/19/23, 9:21 PM

wait that points the keyfile to

/usr/etc/pki/containers/ublue-os.pub

/usr/etc/pki/containers/ublue-os.pub

/usr/etc/pki/containers/ublue-os.pub

/usr/etc/pki/containers/ublue-os.pub

J

j0rge•7/19/23, 9:22 PM

It appears that the policy.json just loosens up the default one to let us rebase to it

J

j0rge•7/19/23, 9:22 PM

[jorge@fedora ~]$ rpm-ostree status
State: idle
AutomaticUpdates: stage; rpm-ostreed-automatic.timer: no runs since boot
Deployments:
● ostree-image-signed:docker://ghcr.io/ublue-os/bluefin-dx
                   Digest: sha256:1df2b3521aa552b45686d5bb38b85fc01823259ca08d50004fc6b06cdda84950
                  Version: 38.20230719.0 (2023-07-19T21:20:23Z)
          LayeredPackages: langpacks-en

  fedora:fedora/38/x86_64/silverblue
                  Version: 38.1.6 (2023-04-13T19:07:12Z)
                   Commit: ae8facf4c86ef40b54f2cae494a95d8349131d24aa6d4af6697d37a39fab50f0
             GPGSignature: Valid signature by 6A51BBABBA3D5467B6171221809A8D7CEB10B464

[jorge@fedora ~]$ rpm-ostree status
State: idle
AutomaticUpdates: stage; rpm-ostreed-automatic.timer: no runs since boot
Deployments:
● ostree-image-signed:docker://ghcr.io/ublue-os/bluefin-dx
                   Digest: sha256:1df2b3521aa552b45686d5bb38b85fc01823259ca08d50004fc6b06cdda84950
                  Version: 38.20230719.0 (2023-07-19T21:20:23Z)
          LayeredPackages: langpacks-en

  fedora:fedora/38/x86_64/silverblue
                  Version: 38.1.6 (2023-04-13T19:07:12Z)
                   Commit: ae8facf4c86ef40b54f2cae494a95d8349131d24aa6d4af6697d37a39fab50f0
             GPGSignature: Valid signature by 6A51BBABBA3D5467B6171221809A8D7CEB10B464

[jorge@fedora ~]$ rpm-ostree status
State: idle
AutomaticUpdates: stage; rpm-ostreed-automatic.timer: no runs since boot
Deployments:
● ostree-image-signed:docker://ghcr.io/ublue-os/bluefin-dx
                   Digest: sha256:1df2b3521aa552b45686d5bb38b85fc01823259ca08d50004fc6b06cdda84950
                  Version: 38.20230719.0 (2023-07-19T21:20:23Z)
          LayeredPackages: langpacks-en

  fedora:fedora/38/x86_64/silverblue
                  Version: 38.1.6 (2023-04-13T19:07:12Z)
                   Commit: ae8facf4c86ef40b54f2cae494a95d8349131d24aa6d4af6697d37a39fab50f0
             GPGSignature: Valid signature by 6A51BBABBA3D5467B6171221809A8D7CEB10B464

[jorge@fedora ~]$ rpm-ostree status
State: idle
AutomaticUpdates: stage; rpm-ostreed-automatic.timer: no runs since boot
Deployments:
● ostree-image-signed:docker://ghcr.io/ublue-os/bluefin-dx
                   Digest: sha256:1df2b3521aa552b45686d5bb38b85fc01823259ca08d50004fc6b06cdda84950
                  Version: 38.20230719.0 (2023-07-19T21:20:23Z)
          LayeredPackages: langpacks-en

  fedora:fedora/38/x86_64/silverblue
                  Version: 38.1.6 (2023-04-13T19:07:12Z)
                   Commit: ae8facf4c86ef40b54f2cae494a95d8349131d24aa6d4af6697d37a39fab50f0
             GPGSignature: Valid signature by 6A51BBABBA3D5467B6171221809A8D7CEB10B464

J

j0rge•7/19/23, 9:28 PM

https://github.com/ublue-os/website/pull/300 <-- needs a review

X

xkrithOP•7/19/23, 9:30 PM

from a stock silverblue install I ran

sudo mkdir /etc/pki/containers
sudo curl -L https://github.com/ublue-os/config/raw/main/files/usr/etc/pki/containers/ublue-os.pub -o /etc/pki/containers/ublue-os.pub
sudo curl -L https://github.com/ublue-os/config/raw/main/files/usr/etc/containers/registries.d/ublue-os.yaml -o /etc/containers/registries.d/ublue-os.yaml
curl -L https://github.com/ublue-os/config/raw/main/files/usr/etc/containers/policy.json | sed 's|/usr||' | sudo tee /etc/containers/policy.json

sudo mkdir /etc/pki/containers
sudo curl -L https://github.com/ublue-os/config/raw/main/files/usr/etc/pki/containers/ublue-os.pub -o /etc/pki/containers/ublue-os.pub
sudo curl -L https://github.com/ublue-os/config/raw/main/files/usr/etc/containers/registries.d/ublue-os.yaml -o /etc/containers/registries.d/ublue-os.yaml
curl -L https://github.com/ublue-os/config/raw/main/files/usr/etc/containers/policy.json | sed 's|/usr||' | sudo tee /etc/containers/policy.json

sudo mkdir /etc/pki/containers
sudo curl -L https://github.com/ublue-os/config/raw/main/files/usr/etc/pki/containers/ublue-os.pub -o /etc/pki/containers/ublue-os.pub
sudo curl -L https://github.com/ublue-os/config/raw/main/files/usr/etc/containers/registries.d/ublue-os.yaml -o /etc/containers/registries.d/ublue-os.yaml
curl -L https://github.com/ublue-os/config/raw/main/files/usr/etc/containers/policy.json | sed 's|/usr||' | sudo tee /etc/containers/policy.json

sudo mkdir /etc/pki/containers
sudo curl -L https://github.com/ublue-os/config/raw/main/files/usr/etc/pki/containers/ublue-os.pub -o /etc/pki/containers/ublue-os.pub
sudo curl -L https://github.com/ublue-os/config/raw/main/files/usr/etc/containers/registries.d/ublue-os.yaml -o /etc/containers/registries.d/ublue-os.yaml
curl -L https://github.com/ublue-os/config/raw/main/files/usr/etc/containers/policy.json | sed 's|/usr||' | sudo tee /etc/containers/policy.json

before

rpm-ostree rebase ostree-image-signed:docker://ghcr.io/ublue-os/silverblue-main

rpm-ostree rebase ostree-image-signed:docker://ghcr.io/ublue-os/silverblue-main

rpm-ostree rebase ostree-image-signed:docker://ghcr.io/ublue-os/silverblue-main

rpm-ostree rebase ostree-image-signed:docker://ghcr.io/ublue-os/silverblue-main worked

J

j0rge•7/19/23, 9:31 PM

yeah I only had to copy the policy.json in the clean vm and then the rebase worked fine

X

xkrithOP•7/19/23, 9:31 PM

how did you rebase to a signed ublue image if you don't have

ublue-os.pub

ublue-os.pub

ublue-os.pub

ublue-os.pub on a stock silverblue install?

X

xkrithOP•7/19/23, 9:34 PM

if I only downloaded

policy.json

policy.json

policy.json

policy.json and tried to rebase I got

error: Creating importer: Failed to invoke skopeo proxy method OpenImage: remote error: open /usr/etc/pki/containers/ublue-os.pub: no such file or directory

error: Creating importer: Failed to invoke skopeo proxy method OpenImage: remote error: open /usr/etc/pki/containers/ublue-os.pub: no such file or directory

error: Creating importer: Failed to invoke skopeo proxy method OpenImage: remote error: open /usr/etc/pki/containers/ublue-os.pub: no such file or directory

error: Creating importer: Failed to invoke skopeo proxy method OpenImage: remote error: open /usr/etc/pki/containers/ublue-os.pub: no such file or directory

J

j0rge•7/19/23, 9:34 PM

I don't know, clean install, I'll try it again

KKyle Gospo something odd here, I'm for sure missing something

K

Kyle Gospo•7/19/23, 9:38 PM

@akdev Sorry to bug you, but I thought you may know what I did wrong here lol

K

Kyle Gospo•7/19/23, 9:38 PM

@j0rge gonna submit a PR for main to make it selective on the akmods it installs

J

j0rge•7/19/23, 9:38 PM

ack

K

Kyle Gospo•7/19/23, 9:39 PM

just to prevent issues like the steamdeck one

K

Kyle Gospo•7/19/23, 9:39 PM

let other images pull in more if needed

K

Kyle Gospo•7/19/23, 9:39 PM

which I'm sure bazzite will, like 3 more of em

J

j0rge•7/19/23, 9:39 PM

@xkrith ok, I did from a fresh ISO install, let me update it to the latest version of everything and see if that works

J

j0rge•7/19/23, 9:39 PM

ack

KKyle Gospo @akdev Sorry to bug you, but I thought you may know what I did wrong here lol

A

akdev•7/19/23, 9:41 PM

Can you reproduce locally?

Aakdev Can you reproduce locally?

K

Kyle Gospo•7/19/23, 9:42 PM

I can try, need to set up a VM real quick

K

Kyle Gospo•7/19/23, 9:42 PM

others built the same way work so I'm thinking I just missed something stupid

G

Gerblesh•7/19/23, 9:43 PM

Are we planning to switch to the new iso builder when 39 drops?

KKyle Gospo I can try, need to set up a VM real quick

A

akdev•7/19/23, 9:47 PM

I mean like if you do

podman build

podman build

podman build

podman build locally?

J

j0rge•7/19/23, 9:50 PM

@xkrith ok, yeah, so on a stock install without updates it worked, but when it's all up to date it rejects it

J

j0rge•7/19/23, 9:51 PM

ok I'm kind of at a loss as to what to do

J

j0rge•7/19/23, 9:51 PM

I mean I guess we could just have those curl instructions on the website?

J

j0rge•7/19/23, 9:52 PM

actually wait, we could just have them rebase to an unsigned image, boot into it

J

j0rge•7/19/23, 9:52 PM

and then rebase to a signed image

X

xkrithOP•7/19/23, 9:53 PM

I remember seeing a github issue before of a skopeo bug where it accepts signed image when it shouldn't

J

j0rge•7/19/23, 9:54 PM

yeah the older version

J

j0rge•7/19/23, 9:54 PM

which is what I tested in the VM

J

j0rge•7/19/23, 9:54 PM

but this time I installed stock fedora, upgraded it, then rebooted

J

j0rge•7/19/23, 9:54 PM

so they must have also fixed that

X

xkrithOP•7/19/23, 9:54 PM

yeah that's why

J

j0rge•7/19/23, 9:56 PM

https://github.com/ublue-os/website/pull/300/files

GitHub

feat: add instructions for adding our policy.json by castrojo · Pul...

J

j0rge•7/19/23, 9:56 PM

alright how's this?

X

xkrithOP•7/19/23, 9:56 PM

I see 3 options to rebase to signed image

X

xkrithOP•7/19/23, 9:57 PM

first is to run curl commands, second is to install

ublue-os-signing.noarch.rpm

ublue-os-signing.noarch.rpm

package, third is your method and rebase to unsigned first

J

j0rge•7/19/23, 9:58 PM

yeah but they'd have layer that in right?

X

xkrithOP•7/19/23, 9:58 PM

yea

on stock silverblue you'll need to install the `ublue-os-signing.noarch.rpm` package first right? si

Similar Threads

Similar Threads

Similar Threads