@j0rge on an up to date stock silverblue install this worked: ``` podman pull ghcr.io/ublue-os/conf

@j0rge on an up to date stock silverblue install this worked:

podman pull ghcr.io/ublue-os/config
rpm-ostree install --assumeyes --apply-live --force-replacefiles $(find ~/.local/share/containers -name ublue-os-signing.noarch.rpm 2>/dev/null)
rpm-ostree rebase --uninstall ublue-os-signing-0.1-1.fc38.noarch ostree-image-signed:docker://ghcr.io/ublue-os/silverblue-main

podman pull ghcr.io/ublue-os/config
rpm-ostree install --assumeyes --apply-live --force-replacefiles $(find ~/.local/share/containers -name ublue-os-signing.noarch.rpm 2>/dev/null)
rpm-ostree rebase --uninstall ublue-os-signing-0.1-1.fc38.noarch ostree-image-signed:docker://ghcr.io/ublue-os/silverblue-main

podman pull ghcr.io/ublue-os/config
rpm-ostree install --assumeyes --apply-live --force-replacefiles $(find ~/.local/share/containers -name ublue-os-signing.noarch.rpm 2>/dev/null)
rpm-ostree rebase --uninstall ublue-os-signing-0.1-1.fc38.noarch ostree-image-signed:docker://ghcr.io/ublue-os/silverblue-main

podman pull ghcr.io/ublue-os/config
rpm-ostree install --assumeyes --apply-live --force-replacefiles $(find ~/.local/share/containers -name ublue-os-signing.noarch.rpm 2>/dev/null)
rpm-ostree rebase --uninstall ublue-os-signing-0.1-1.fc38.noarch ostree-image-signed:docker://ghcr.io/ublue-os/silverblue-main

State: idle
AutomaticUpdates: stage; rpm-ostreed-automatic.timer: no runs since boot
Deployments:
● ostree-image-signed:docker://ghcr.io/ublue-os/silverblue-main
                   Digest: sha256:3dc528ffd5d19228cb8f79d696ec797f90c2c40c917dcfd871d89ff9fb825de0
                  Version: 38.20230719.0 (2023-07-19T19:54:09Z)

  fedora:fedora/38/x86_64/silverblue
                  Version: 38.20230719.0 (2023-07-19T02:37:06Z)
                   Commit: 01d2b50f3ff36c03aa9c8408ef55a5d85c8e62fb367458f2bd5d81b2a3827f3b
             GPGSignature: Valid signature by 6A51BBABBA3D5467B6171221809A8D7CEB10B464

State: idle
AutomaticUpdates: stage; rpm-ostreed-automatic.timer: no runs since boot
Deployments:
● ostree-image-signed:docker://ghcr.io/ublue-os/silverblue-main
                   Digest: sha256:3dc528ffd5d19228cb8f79d696ec797f90c2c40c917dcfd871d89ff9fb825de0
                  Version: 38.20230719.0 (2023-07-19T19:54:09Z)

  fedora:fedora/38/x86_64/silverblue
                  Version: 38.20230719.0 (2023-07-19T02:37:06Z)
                   Commit: 01d2b50f3ff36c03aa9c8408ef55a5d85c8e62fb367458f2bd5d81b2a3827f3b
             GPGSignature: Valid signature by 6A51BBABBA3D5467B6171221809A8D7CEB10B464

State: idle
AutomaticUpdates: stage; rpm-ostreed-automatic.timer: no runs since boot
Deployments:
● ostree-image-signed:docker://ghcr.io/ublue-os/silverblue-main
                   Digest: sha256:3dc528ffd5d19228cb8f79d696ec797f90c2c40c917dcfd871d89ff9fb825de0
                  Version: 38.20230719.0 (2023-07-19T19:54:09Z)

  fedora:fedora/38/x86_64/silverblue
                  Version: 38.20230719.0 (2023-07-19T02:37:06Z)
                   Commit: 01d2b50f3ff36c03aa9c8408ef55a5d85c8e62fb367458f2bd5d81b2a3827f3b
             GPGSignature: Valid signature by 6A51BBABBA3D5467B6171221809A8D7CEB10B464

State: idle
AutomaticUpdates: stage; rpm-ostreed-automatic.timer: no runs since boot
Deployments:
● ostree-image-signed:docker://ghcr.io/ublue-os/silverblue-main
                   Digest: sha256:3dc528ffd5d19228cb8f79d696ec797f90c2c40c917dcfd871d89ff9fb825de0
                  Version: 38.20230719.0 (2023-07-19T19:54:09Z)

  fedora:fedora/38/x86_64/silverblue
                  Version: 38.20230719.0 (2023-07-19T02:37:06Z)
                   Commit: 01d2b50f3ff36c03aa9c8408ef55a5d85c8e62fb367458f2bd5d81b2a3827f3b
             GPGSignature: Valid signature by 6A51BBABBA3D5467B6171221809A8D7CEB10B464

Xxkrith @j0rge on an up to date stock silverblue install this worked: ``` podman pull g...

j0rge•7/19/23, 10:49 PM

want to leave the first comment?

j0rge•7/19/23, 10:49 PM

https://universal-blue.org/blog/2023/07/19/sigstore-signed-images-are-now-here/

Sigstore signed images are now here - Universal Blue

Custom Operating System images based on Fedora

Xxkrith @j0rge on an up to date stock silverblue install this worked: ``` podman pull g...

Kyle Gospo•7/19/23, 10:49 PM

beauty, love it

j0rge•7/19/23, 10:50 PM

yeah and it also appears that blog posts don't show up in the forum until there's at least one comment in the blog

j0rge•7/19/23, 10:51 PM

so we need that snippet in there to kick it off anyway

Kyle Gospo•7/19/23, 10:51 PM

only suggestion, should grab the name of the package dynamically

Kyle Gospo•7/19/23, 10:51 PM

otherwise when it updates that command will break

j0rge•7/19/23, 10:51 PM

also, if we published the rpm in like, the releases section we wouldn't need the podman command at all right?

xkrithOP•7/19/23, 10:52 PM

right now the signing package is only available in that container

j0rge•7/19/23, 10:52 PM

https://github.com/orgs/ublue-os/discussions/193

GitHub

Sigstore signed images are now here - Universal Blue · ublue-os · D...

Sigstore signed images are now here - Universal Blue Custom Operating System images based on Fedora https://universal-blue.org/blog/2023/07/19/sigstore-signed-images-are-now-here/

j0rge•7/19/23, 10:53 PM

ah ok, adding an emoji was enough to kick off giscus at least

Kyle Gospo•7/19/23, 10:53 PM

podman pull ghcr.io/ublue-os/config
rpm-ostree install --assumeyes --apply-live --force-replacefiles $(find ~/.local/share/containers -name ublue-os-signing.noarch.rpm 2>/dev/null)
rpm-ostree rebase --uninstall $(rpm -qa | grep ublue-os-signing) ostree-image-signed:docker://ghcr.io/ublue-os/silverblue-main

podman pull ghcr.io/ublue-os/config
rpm-ostree install --assumeyes --apply-live --force-replacefiles $(find ~/.local/share/containers -name ublue-os-signing.noarch.rpm 2>/dev/null)
rpm-ostree rebase --uninstall $(rpm -qa | grep ublue-os-signing) ostree-image-signed:docker://ghcr.io/ublue-os/silverblue-main

Jj0rge also, if we published the rpm in like, the releases section we wouldn't need the...

akdev•7/19/23, 10:54 PM

Yeah

KKyle Gospo ```podman pull ghcr.io/ublue-os/config rpm-ostree install --assumeyes --apply-li...

xkrithOP•7/19/23, 11:11 PM

method using rpm query instead of grep:

podman pull ghcr.io/ublue-os/config
rpm-ostree install --assumeyes --apply-live --force-replacefiles $(find ~/.local/share/containers -name ublue-os-signing.noarch.rpm 2>/dev/null)
rpm-ostree rebase --uninstall $(rpm -q ublue-os-signing-* --queryformat '%{NAME}-%{VERSION}-%{RELEASE}.%{Arch}') ostree-image-signed:docker://ghcr.io/ublue-os/silverblue-main

podman pull ghcr.io/ublue-os/config
rpm-ostree install --assumeyes --apply-live --force-replacefiles $(find ~/.local/share/containers -name ublue-os-signing.noarch.rpm 2>/dev/null)
rpm-ostree rebase --uninstall $(rpm -q ublue-os-signing-* --queryformat '%{NAME}-%{VERSION}-%{RELEASE}.%{Arch}') ostree-image-signed:docker://ghcr.io/ublue-os/silverblue-main

j0rge•7/19/23, 11:15 PM

oh no

j0rge•7/19/23, 11:15 PM

now we have another (good) problem

j0rge•7/19/23, 11:15 PM

remember how I said we're going to hit 1 million pulls on friday?

j0rge•7/19/23, 11:16 PM

We are, as of now, at 991249991249

tulip•7/19/23, 11:49 PM

oh dear god

tulip•7/19/23, 11:50 PM

that's amazing!

j0rge•7/19/23, 11:55 PM

https://github.com/ublue-os/website/pull/301

GitHub

feat: one million pull blog! by castrojo · Pull Request #301 · ublu...

j0rge•7/19/23, 11:55 PM

need one review and we're good to go!

j0rge•7/19/23, 11:55 PM

@KyleGospo you've been here a long time, do the honors?

Kyle Gospo•7/19/23, 11:59 PM

I'd love the honor

Kyle Gospo•7/19/23, 11:59 PM

Uno moment

j0rge•7/20/23, 12:18 AM

\o/

j0rge•7/20/23, 12:18 AM

smoke if you got em!

EyeCantCU•7/20/23, 12:19 AM

Just had a thought. Do we need to change anything in isogenerator now that we have signed images?

j0rge•7/20/23, 12:24 AM

not sure

j0rge•7/20/23, 12:24 AM

looking but nothing jumps out at me

EyeCantCU•7/20/23, 12:48 AM

I'll give it a sweep

bketelsen•7/20/23, 1:17 AM

worth mentioning somewhere that you have to have the last unverified pull before you can switch to the signed image

bketelsen•7/20/23, 1:17 AM

Rebooting into signed now

bketelsen•7/20/23, 1:19 AM

hacker voicehacker voice: I'm in

bketelsen•7/20/23, 1:19 AM

kudos to everyone on the amazing job getting this shipped. what a team

Julio_Guti•7/20/23, 1:24 PM

I don't want to sound alarming, but i was having issues moving into the signed images https://github.com/orgs/ublue-os/discussions/193#discussioncomment-6499271 and it was preventing me to update images in general, wondering if more ppl are stuck in a version due to this issue and not realizing of it because they are relying on the auto update process.

EyeCantCU•7/20/23, 2:44 PM

Ohhhh no. @j0rge the borked images probably made it out to some people