I don't want to sound alarming, but i was having issues moving into the signed images https://github

I don't want to sound alarming, but i was having issues moving into the signed images https://github.com/orgs/ublue-os/discussions/193#discussioncomment-6499271 and it was preventing me to update images in general, wondering if more ppl are stuck in a version due to this issue and not realizing of it because they are relying on the auto update process.

EyeCantCU•7/20/23, 2:44 PM

Ohhhh no. @j0rge the borked images probably made it out to some people

EEyeCantCU Ohhhh no. @j0rge the borked images probably made it out to some people

j0rge•7/20/23, 2:57 PM

link?

JJulio_Guti I don't want to sound alarming, but i was having issues moving into the signed i...

EyeCantCU•7/20/23, 2:57 PM

Right here

j0rge•7/20/23, 2:57 PM

oh the one just posted

EyeCantCU•7/20/23, 2:58 PM

Yeah. Same problem we encountered yesterday bringing it up. Not sure of how many people got it

j0rge•7/20/23, 2:58 PM

yeah let me reply with the one liner

EyeCantCU•7/20/23, 2:58 PM

Awesome

JJulio_Guti I don't want to sound alarming, but i was having issues moving into the signed i...

j0rge•7/20/23, 3:02 PM

hopefully you and I are he only ones, we caught the issue but a few updates might have snuck out in the 30m it took to fix

bsherman•7/20/23, 3:51 PM

I noticed that as of yesterday ( https://github.com/ublue-os/main/pull/278 )

akmods

akmods

repo can build kmod RPMs, but NOT have them auto-installed into

*-main

*-main

images...

So I'm wondering if we should document and change this use case.

We should be able to re-add the legacy broadcom wlwl driver for example, which would behave just like the gcadapter_ocgcadapter_oc and jupiterjupiter drivers, which are built, but not included in

*-main

*-main

.

Users who need them would need the extra step still, of building their own image to include the akmods/foo.rpmakmods/foo.rpm and to install it and it's dependencies.

Bbsherman I noticed that as of yesterday ( https://github.com/ublue-os/main/pull/278 ) `ak...

EyeCantCU•7/20/23, 3:55 PM

That sounds like a good idea to me. No reason to hold back now that they can be individually shipped

bsherman•7/20/23, 3:56 PM

I still wouldn't add xonexone yet though as i think it will be better to proceed with the xpad-noonexpad-noone plus xonexone plan as i've already documented in an issue

bsherman•7/20/23, 3:57 PM

btw, thanks @EyeCantCU and @KyleGospo (and others if i missed) for the work on getting the ublue-os COPR setup! looks good!

Bbsherman btw, thanks @EyeCantCU and @KyleGospo (and others if i missed) for the work on g...

EyeCantCU•7/20/23, 4:01 PM

Yw. Got you added to it

j0rge•7/20/23, 4:30 PM

j0rge•7/20/23, 4:30 PM

the creator of sigstore knows who we are now.

dreamyuki•7/20/23, 4:41 PM

so it is safe rebase to signed image rn?

j0rge•7/20/23, 4:43 PM

yeah I moved all my stuff yesterday, smooth sailing so far

Ddreamyuki so it is safe rebase to signed image rn?

Gerblesh•7/20/23, 4:43 PM

Yes

j0rge•7/20/23, 4:43 PM

● ostree-image-signed:docker://ghcr.io/ublue-os/bluefin-dx:38
                   Digest: sha256:1df2b3521aa552b45686d5bb38b85fc01823259ca08d50004fc6b06cdda84950
                  Version: 38.20230719.0 (2023-07-19T20:56:45Z)
            LocalPackages: 1password-8.10.8-1.x86_64

● ostree-image-signed:docker://ghcr.io/ublue-os/bluefin-dx:38
                   Digest: sha256:1df2b3521aa552b45686d5bb38b85fc01823259ca08d50004fc6b06cdda84950
                  Version: 38.20230719.0 (2023-07-19T20:56:45Z)
            LocalPackages: 1password-8.10.8-1.x86_64

Jj0rge ``` ● ostree-image-signed:docker://ghcr.io/ublue-os/bluefin-dx:38 ...

bsherman•7/20/23, 4:47 PM

bluefin has the benefit of building in

ublue-os

ublue-os

org and signing with the ublue-os key so no custom policy required

j0rge•7/20/23, 4:47 PM

yeah

bsherman•7/20/23, 4:47 PM

looks pretty easy for me to add though

bsherman•7/20/23, 4:47 PM

i just need a better name

bsherman•7/20/23, 4:47 PM

and, i'm building too many varieties

j0rge•7/20/23, 10:56 PM

hey @bsherman

j0rge•7/20/23, 10:56 PM

j0rge•7/20/23, 10:56 PM

my propaganda is now in newsletters.

j0rge•7/20/23, 10:56 PM

(I wrote these two)

j0rge•7/20/23, 10:56 PM

bummer about the "merger" typo, but whatever

bsherman•7/20/23, 11:16 PM

Remind me to read/watch

Gerblesh•7/21/23, 2:34 AM

@j0rge how would I get the github username from the build script or containerfile? I'm trying to figure out how to make image signing in startingpoint easy

Gerblesh•7/21/23, 2:34 AM

so that it's literally just updating the image

Gerblesh•7/21/23, 2:34 AM

and rebasing

Gerblesh•7/21/23, 2:34 AM

no messing with policy.json

Gerblesh•7/21/23, 2:36 AM

ah ok, figured it out

Gerblesh•7/21/23, 2:53 AM

see if it works

Gerblesh•7/21/23, 2:53 AM

if it does, i'll make a PR

Gerblesh•7/21/23, 5:07 AM

OK finally got it working

Gerblesh•7/21/23, 5:44 AM

https://github.com/ublue-os/startingpoint/pull/116

GitHub

feat: add support for image signing by gerblesh · Pull Request #116...

This PR adds image signing, with no additional configuration required from the user
Things done:

copy cosign public key and policy.json in the proper place (/etc/pki/containers/cosign.pub and /etc...