Hey guys, my Bazzite fork keeps failing at the "Signing container image" step, with the error: ``` R

Hey guys, my Bazzite fork keeps failing at the "Signing container image" step, with the error:

Run cosign sign -y --key env://COSIGN_PRIVATE_KEY ghcr.io/d3-x-t3r/bazzite-deck@${TAGS}
Error: signing [ghcr.io/d3-x-t3r/bazzite-deck@sha256:348eae68293c04e7958da6ed0007609a78a61c9c43e3de86b38d067bccc83b3f]: getting signer: reading key: decrypt: encrypted: decryption failed
main.go:74: error during command execution: signing [ghcr.io/d3-x-t3r/bazzite-deck@sha256:348eae68293c04e7958da6ed0007609a78a61c9c43e3de86b38d067bccc83b3f]: getting signer: reading key: decrypt: encrypted: decryption failed
Error: Process completed with exit code 1.

Run cosign sign -y --key env://COSIGN_PRIVATE_KEY ghcr.io/d3-x-t3r/bazzite-deck@${TAGS}
Error: signing [ghcr.io/d3-x-t3r/bazzite-deck@sha256:348eae68293c04e7958da6ed0007609a78a61c9c43e3de86b38d067bccc83b3f]: getting signer: reading key: decrypt: encrypted: decryption failed
main.go:74: error during command execution: signing [ghcr.io/d3-x-t3r/bazzite-deck@sha256:348eae68293c04e7958da6ed0007609a78a61c9c43e3de86b38d067bccc83b3f]: getting signer: reading key: decrypt: encrypted: decryption failed
Error: Process completed with exit code 1.

Run cosign sign -y --key env://COSIGN_PRIVATE_KEY ghcr.io/d3-x-t3r/bazzite-deck@${TAGS}
Error: signing [ghcr.io/d3-x-t3r/bazzite-deck@sha256:348eae68293c04e7958da6ed0007609a78a61c9c43e3de86b38d067bccc83b3f]: getting signer: reading key: decrypt: encrypted: decryption failed
main.go:74: error during command execution: signing [ghcr.io/d3-x-t3r/bazzite-deck@sha256:348eae68293c04e7958da6ed0007609a78a61c9c43e3de86b38d067bccc83b3f]: getting signer: reading key: decrypt: encrypted: decryption failed
Error: Process completed with exit code 1.

Run cosign sign -y --key env://COSIGN_PRIVATE_KEY ghcr.io/d3-x-t3r/bazzite-deck@${TAGS}
Error: signing [ghcr.io/d3-x-t3r/bazzite-deck@sha256:348eae68293c04e7958da6ed0007609a78a61c9c43e3de86b38d067bccc83b3f]: getting signer: reading key: decrypt: encrypted: decryption failed
main.go:74: error during command execution: signing [ghcr.io/d3-x-t3r/bazzite-deck@sha256:348eae68293c04e7958da6ed0007609a78a61c9c43e3de86b38d067bccc83b3f]: getting signer: reading key: decrypt: encrypted: decryption failed
Error: Process completed with exit code 1.

I've replaced my cosign.pub and pasted the private key under Secrets > Repository secretes, under the variables

SIGNING_SECRET

SIGNING_SECRET

and

COSIGN_PRIVATE_KEY

COSIGN_PRIVATE_KEY

. Should I be using Variables instead? As I understand, Variables are plain-text and should't be used for secrets, so not sure where I'm going wrong.

Dd3Xt3r Hey guys, my Bazzite fork keeps failing at the "Signing container image" step, w...

HikariKnight•12/3/23, 9:39 PM

The signing secret is supposed to be the contents of cosign.key
there is no

COSIGN_PRIVATE_KEY

COSIGN_PRIVATE_KEY

unless you maybe forked the actual bazzite repo instead of using the startingpoint template

HHikariKnight The signing secret is supposed to be the contents of cosign.key there is no `COS...

d3Xt3rOP•12/3/23, 9:39 PM

Yes it is cosign.key and yes I did fork the repo as per the official instructions (I believe Kyle's?).

HikariKnight•12/3/23, 9:40 PM

because in 99% of cases youre supposed to use startingpoint otherwise you have to mess around with a lot more stuff
https://universal-blue.org/tinker/make-your-own/

Introduction - Universal Blue

Custom Operating System images based on Fedora

HHikariKnight because in 99% of cases youre supposed to use startingpoint otherwise you have t...

d3Xt3rOP•12/3/23, 9:40 PM

Well then why did Kyle(?) recommend forking the repo instead?

HikariKnight•12/3/23, 9:41 PM

maybe what you were going to do would require more fine tuning?

HikariKnight•12/3/23, 9:41 PM

i dont know what youre planning to do

HHikariKnight maybe what you were going to do would require more fine tuning?

d3Xt3rOP•12/3/23, 9:42 PM

Well my plan is to firstly get rid of all the nvidia-stuff in the build and restrict it to just bazzite-deck builds and ditch everything else. Next is to debloat the build by getting rid of packages that I don't use, and finally, add my own packages to the Containerfile.

Dd3Xt3r Well then why did Kyle(?) recommend forking the repo instead?

Kyle Gospo•12/3/23, 9:42 PM

really depends on what you're trying to do

KKyle Gospo really depends on what you're trying to do

d3Xt3rOP•12/3/23, 9:43 PM

Dd3Xt3r Well my plan is to firstly get rid of all the nvidia-stuff in the build and rest...

Kyle Gospo•12/3/23, 9:43 PM

in this case, since you want to debloat, the realistic option is a fork. You can use startingpoint or even just your own containerfile that does FROM ghcr.io/ublue-os/bazzite

Kyle Gospo•12/3/23, 9:43 PM

but removing a package will free up zero disk space in that scenario

Kyle Gospo•12/3/23, 9:43 PM

if you don't care about that and simply want them turned off, you can do that

Kyle Gospo•12/3/23, 9:43 PM

and it'll be much easier on you

HikariKnight•12/3/23, 9:44 PM

hence why i said in 99% of cases startingpoint is the way to go

KKyle Gospo but removing a package will free up zero disk space in that scenario

d3Xt3rOP•12/3/23, 9:44 PM

you mean the final image that gets published to ghcr wont be smaller?

Dd3Xt3r you mean the final image that gets published to ghcr *wont* be smaller?

Kyle Gospo•12/3/23, 9:44 PM

correct

d3Xt3rOP•12/3/23, 9:44 PM

O_o

Kyle Gospo•12/3/23, 9:44 PM

larger, if anything

d3Xt3rOP•12/3/23, 9:44 PM

I thought the Container file is building everything from scratch.. or is that not how it works?

Dd3Xt3r I thought the Container file is building everything from scratch.. or is that no...

Kyle Gospo•12/3/23, 9:44 PM

we have the same limitation, if I remove something that's included in Silverblue or Kinoite we save no disk space

Kyle Gospo•12/3/23, 9:45 PM

if you're removing something we add, a fork saves you disk space

Kyle Gospo•12/3/23, 9:45 PM

since it's never added in the first place

KKyle Gospo if you're removing something *we* add, a fork saves you disk space

d3Xt3rOP•12/3/23, 9:45 PM

Ah right. Well, that suits me fine then

d3Xt3rOP•12/3/23, 9:45 PM

Now how do I fix this signing error lol

Kyle Gospo•12/3/23, 9:45 PM

you need a key pair defined in your github private vars to sign an image

Kyle Gospo•12/3/23, 9:46 PM

you can either not sign it, or add a key

d3Xt3rOP•12/3/23, 9:46 PM

I've replaced my cosign.pub and pasted the private key under Secrets > Repository secretes, under the variables SIGNING_SECRET and COSIGN_PRIVATE_KEY. Should I be using Variables instead? As I understand, Variables are plain-text and should't be used for secrets, so not sure where I'm going wrong.

Kyle Gospo•12/3/23, 9:46 PM

ublue webite has guides for the latter

Kyle Gospo•12/3/23, 9:46 PM

should be secret, sec

Kyle Gospo•12/3/23, 9:46 PM

SIGNING_SECRET

SIGNING_SECRET

Kyle Gospo•12/3/23, 9:46 PM

is what it's named

d3Xt3rOP•12/3/23, 9:47 PM

yep I've got that

d3Xt3rOP•12/3/23, 9:47 PM

it's under "repository secrets"

Kyle Gospo•12/3/23, 9:47 PM

does your key have a password?

d3Xt3rOP•12/3/23, 9:47 PM

nope

d3Xt3rOP•12/3/23, 9:47 PM

also, the error in the log mentions only

COSIGN_PRIVATE_KEY

COSIGN_PRIVATE_KEY

Kyle Gospo•12/3/23, 9:47 PM

this is why

d3Xt3rOP•12/3/23, 9:49 PM

hmm. Should I just re-upload my cosign.pub and replace the

SIGNING_SECRET

SIGNING_SECRET

with cosign.key and try again?

Kyle Gospo•12/3/23, 9:49 PM

worth a shot

VoidedKN0X•12/3/23, 10:05 PM

quick question, i would like to install bazzite too on my asus zenbook pro duo. hybrid graphics and dual screen laptop.

VoidedKN0X•12/3/23, 10:06 PM

can i easily add a kernel module? asus-wmi to be exact

VoidedKN0X•12/3/23, 10:07 PM

asus-wmi-screenpad*

VVoidedKN0X can i easily add a kernel module? asus-wmi to be exact

Kyle Gospo•12/3/23, 10:07 PM

you cannot, has to be part of the image

Kyle Gospo•12/3/23, 10:07 PM

is this not included with asus-linux?

VoidedKN0X•12/3/23, 10:07 PM

i don't know, i can't find anything documented related to it tbh

Kyle Gospo•12/3/23, 10:08 PM

https://gitlab.com/asus-linux/fedora-kernel

GitLab

asus-linux / fedora-kernel · GitLab

fedpkg --name kernel --namespace rpms --release f38 local --arch x86_64 --without debug --without debuginfo --with release --with headers --without configchecks

Kyle Gospo•12/3/23, 10:08 PM

Kyle Gospo•12/3/23, 10:08 PM

seems like it

VoidedKN0X•12/3/23, 10:08 PM

ohh haven't found that link, that's why

Hey guys, my Bazzite fork keeps failing at the "Signing container image" step, with the error: ``` R

Similar Threads

Similar Threads

Similar Threads