All Ublue repos I checked have a checkout action step like this: ``` # Checkout push-to-registry act

All Ublue repos I checked have a checkout action step like this:

# Checkout push-to-registry action GitHub repository
- name: Checkout Push to Registry action
  uses: actions/checkout@v4

# Checkout push-to-registry action GitHub repository
- name: Checkout Push to Registry action
  uses: actions/checkout@v4

# Checkout push-to-registry action GitHub repository
- name: Checkout Push to Registry action
  uses: actions/checkout@v4

# Checkout push-to-registry action GitHub repository
- name: Checkout Push to Registry action
  uses: actions/checkout@v4

xynyOP•12/17/23, 3:11 PM

I wondered why this makes no sense. Then I googled "Checkout Push to Registry action" and found this: https://github.com/redhat-actions/push-to-registry/blob/9986a6552bc4571882a4a67e016b17361412b4df/.github/workflows/multiple-build.yaml#L30C1-L32C34

xynyOP•12/17/23, 3:12 PM

The build action for the push-to-registrypush-to-registry action that we use uses the exact some checkout step, with a different version.

xynyOP•12/17/23, 3:14 PM

Seems that at some point someone, probably jorge, copied some code that builds the push-to-registrypush-to-registry action and this was with it. Then no-one bothered to change this part, neither cryptic the name or the comment, which refer to checking out the push-to-registrypush-to-registry repo and not any Ublue repo.

j0rge•12/17/23, 3:14 PM

we're using actions/checkout@v4actions/checkout@v4 right?

xynyOP•12/17/23, 3:15 PM

Yeah

xynyOP•12/17/23, 3:15 PM

That's not what's funny.

Xxyny Seems that at some point someone, probably jorge, copied some code that builds t...

xynyOP•12/17/23, 3:18 PM

Yeah, this goes back to the beginning. https://github.com/ublue-os/base/commit/b5217833327427c673ef39883ef7813b7f5e9f36

j0rge•12/17/23, 3:32 PM

@KyleGospo https://universal-blue.discourse.group/t/moving-to-gnomes-prompt-for-a-default-terminal/248/7

Universal Blue

Moving to GNOME's Prompt for a default terminal

Yeah this looks like this issue: Error if distrobox container has not been entered once (#31) · Issues · Christian Hergert / prompt · GitLab We might need to interact with them on boot or something as a workaround in the meantime, anyone have thoughts on that?

Xxyny All Ublue repos I checked have a checkout action step like this: ``` # Checkout ...

Bigpod•12/17/23, 4:49 PM

its just a wrong name it doesnt really matter

BBigpod its just a wrong name it doesnt really matter

xynyOP•12/17/23, 5:10 PM

That's why I said it was funny not severe...

B_Wize•12/17/23, 5:22 PM

Random thought.... are there any plans for a hyprland build of ublue?

BB_Wize Random thought.... are there any plans for a hyprland build of ublue?

xynyOP•12/17/23, 5:23 PM

There are a lot of community images but not "official" ones. It would need a maintainer who uses the image and is willing to support others using it. Could be basically any community member, though.

B_Wize•12/17/23, 5:23 PM

With hypr now beibg available for install direct from dnf in fedora 39, I know I could just rpm- ostree install it at build, but was just curious

Xxyny There are a lot of community images but not "official" ones. It would need a mai...

B_Wize•12/17/23, 5:24 PM

Would someone with 0 experience be able to be a community maintainer?

BB_Wize Would someone with 0 experience be able to be a community maintainer?

xynyOP•12/17/23, 5:25 PM

Well, you'd have to be willing to learn of course.

Xxyny Well, you'd have to be willing to learn of course.

B_Wize•12/17/23, 5:33 PM

Learning is a favorite hobby

B_Wize•12/17/23, 5:34 PM

Just trying to figure if I could commit to it with work plus my 2 kids

xynyOP•12/17/23, 5:36 PM

I think other high-level maintainers here have similar situations, and the community is here to help.

xynyOP•12/17/23, 5:36 PM

It's just needed that some person does the effort to kickstart it and commits to at least looking after the issues and PRs.

xynyOP•12/17/23, 5:44 PM

I found https://github.com/hyprgreen but can't find vibrantleaf who makes it on this discord

EyeCantCU•12/17/23, 6:06 PM

The public signatures for our hwcompat images don't align. I think I should regenerate the key pairs for all of them:

https://github.com/ublue-os/bazzite/pull/615

j0rge•12/17/23, 6:11 PM

key looks the same in bazzite? which one doesn't match?

EyeCantCU•12/17/23, 6:13 PM

The keys for ASUS, Surface, and Framework base images (Kinoite and Silverblue). I wrote a test for Bazzites CI to verify the sigs before building the image

j0rge•12/17/23, 6:14 PM

oh I hadn't noticed that?

EyeCantCU•12/17/23, 6:14 PM

I hadn't either because they successfully sign. It's very odd

j0rge•12/17/23, 6:14 PM

I think we just put the previous cosign.pub in those repos and use the org-wide secret?

EyeCantCU•12/17/23, 6:14 PM

Yeah

j0rge•12/17/23, 6:17 PM

I hadn't even noticed that, good catch!

EyeCantCU•12/17/23, 6:18 PM

I figured we might as well add these tests to our downstream images. Establishes some form of verification. I wish the ci-test images were signed too

EyeCantCU•12/17/23, 6:19 PM

We can even do this for the Chainguard images Bluefin DX pulls from

j0rge•12/17/23, 6:19 PM

ci-test has been around a year longer than I anticipated

j0rge•12/17/23, 6:20 PM

feels like the upstream of silverblue/kinoite are getting a ton of attention now but the fedora parts are less maintained than they were before.

j0rge•12/17/23, 6:20 PM

the fedora one didn't build for 10 days!

j0rge•12/17/23, 6:22 PM

this verification is a great idea!

EyeCantCU•12/17/23, 6:25 PM

Thank you! I was brainstorming over this yesterday after looking over a lot of the images Chainguard has and going through their documentation. Then this morning I put two and two together

EyeCantCU•12/17/23, 6:25 PM

Ah, that's exactly it. Our public keys for these don't align. Will update them

j0rge•12/17/23, 6:26 PM

seems like an obvious check once you see it, that's amazing.

j0rge•12/17/23, 6:27 PM

that's a legit real improvement in our supply chain security, nice!

EyeCantCU•12/17/23, 6:40 PM

I'm pretty happy about it :). I'll get all of our downstream stuff PRd with the test today

j0rge•12/17/23, 6:41 PM

you can also file an issue with a help wanted if people want an easy fix to learn how to PR

j0rge•12/17/23, 6:41 PM

aka you don't have to do every repo, heh

EyeCantCU•12/17/23, 6:42 PM

Ha. That's a great idea

j0rge•12/17/23, 6:42 PM

then when people PR it'll be a checklist too

Robert•12/17/23, 6:43 PM

Thought: Can't we create a few GitHub Actions such as sign-image and verify-image, and use them across all repos? That way there will be no signing logic in each repo, and they are all controlled in main or similar

Since all images use the same signing keys, the custom action could have the main/cosign.pub location hard-coded

Robert•12/17/23, 6:44 PM

The action would incude "setup-cosign" and "verify-image" steps, so each repo will need a single line in the GHA workflow

EyeCantCU•12/17/23, 6:44 PM

We very well could. I really like that idea

j0rge•12/17/23, 6:44 PM

yeah there's a few places where we could start to move to centralized actions

EyeCantCU•12/17/23, 6:45 PM

Though I'd make it so that we could pass whatever public key we wanted versus hard coding it to main so that's useful downstream too

Robert•12/17/23, 6:45 PM

Yeah, maybe hard-code the default value to ublue, but make it an input so other images can change it if required

j0rge•12/17/23, 6:46 PM

then the maintenance on the repos would go from "copy and pasting improvements" to just dependabot bumping the version for us. That would be a huge win for long term maintenance and sustainability

All Ublue repos I checked have a checkout action step like this: ``` # Checkout push-to-registry act

Similar Threads

Similar Threads

Similar Threads