something odd here, I'm for sure missing something
something odd here, I'm for sure missing something
KK
Jdid that sort it?
Jwe need instructions on how stock people can move
Jah, we only need the policy.json
Jsudo curl -L https://github.com/ublue-os/config/raw/main/files/usr/etc/containers/policy.json -o /etc/containers/policy.jsonJthis looks like the cleanest command we can use?
Xwait that points the keyfile to
/usr/etc/pki/containers/ublue-os.pubJIt appears that the policy.json just loosens up the default one to let us rebase to it
JJXfrom a stock silverblue install I ran
before
before
rpm-ostree rebase ostree-image-signed:docker://ghcr.io/ublue-os/silverblue-main workedJyeah I only had to copy the policy.json in the clean vm and then the rebase worked fine
Xhow did you rebase to a signed ublue image if you don't have
ublue-os.pub on a stock silverblue install?Xif I only downloaded
policy.json and tried to rebase I gotJI don't know, clean install, I'll try it again
K@akdev Sorry to bug you, but I thought you may know what I did wrong here lol
K@j0rge gonna submit a PR for main to make it selective on the akmods it installs
Jack
Kjust to prevent issues like the steamdeck one
Klet other images pull in more if needed
Kwhich I'm sure bazzite will, like 3 more of em
J@xkrith ok, I did from a fresh ISO install, let me update it to the latest version of everything and see if that works
Jack
ACan you reproduce locally?
KI can try, need to set up a VM real quick
Kothers built the same way work so I'm thinking I just missed something stupid
GAre we planning to switch to the new iso builder when 39 drops?
AI mean like if you do
podman build locally?J@xkrith ok, yeah, so on a stock install without updates it worked, but when it's all up to date it rejects it
Jok I'm kind of at a loss as to what to do
JI mean I guess we could just have those curl instructions on the website?
Jactually wait, we could just have them rebase to an unsigned image, boot into it
Jand then rebase to a signed image
XI remember seeing a github issue before of a skopeo bug where it accepts signed image when it shouldn't
Jyeah the older version
Jwhich is what I tested in the VM
Jbut this time I installed stock fedora, upgraded it, then rebooted
Jso they must have also fixed that
Xyeah that's why
Jalright how's this?
XI see 3 options to rebase to signed image
Xfirst is to run curl commands, second is to install
ublue-os-signing.noarch.rpm package, third is your method and rebase to unsigned firstJyeah but they'd have layer that in right?
Xyea
Xrebasing to unsigned first could waste a lot of time if they're on a slow connection
JI just tested that, switching over to signed doesn't redownload anything
Jit's like a quick rebase
Xahh I see
