There are a lot of community images but not "official" ones. It would need a maintainer who uses the

There are a lot of community images but not "official" ones. It would need a maintainer who uses the image and is willing to support others using it. Could be basically any community member, though.

B_Wize•12/17/23, 5:23 PM

With hypr now beibg available for install direct from dnf in fedora 39, I know I could just rpm- ostree install it at build, but was just curious

Xxyny There are a lot of community images but not "official" ones. It would need a mai...

B_Wize•12/17/23, 5:24 PM

Would someone with 0 experience be able to be a community maintainer?

BB_Wize Would someone with 0 experience be able to be a community maintainer?

xynyOP•12/17/23, 5:25 PM

Well, you'd have to be willing to learn of course.

Xxyny Well, you'd have to be willing to learn of course.

B_Wize•12/17/23, 5:33 PM

Learning is a favorite hobby

B_Wize•12/17/23, 5:34 PM

Just trying to figure if I could commit to it with work plus my 2 kids

xynyOP•12/17/23, 5:36 PM

I think other high-level maintainers here have similar situations, and the community is here to help.

xynyOP•12/17/23, 5:36 PM

It's just needed that some person does the effort to kickstart it and commits to at least looking after the issues and PRs.

xynyOP•12/17/23, 5:44 PM

I found https://github.com/hyprgreen but can't find vibrantleaf who makes it on this discord

EyeCantCU•12/17/23, 6:06 PM

The public signatures for our hwcompat images don't align. I think I should regenerate the key pairs for all of them:

https://github.com/ublue-os/bazzite/pull/615

j0rge•12/17/23, 6:11 PM

key looks the same in bazzite? which one doesn't match?

EyeCantCU•12/17/23, 6:13 PM

The keys for ASUS, Surface, and Framework base images (Kinoite and Silverblue). I wrote a test for Bazzites CI to verify the sigs before building the image

j0rge•12/17/23, 6:14 PM

oh I hadn't noticed that?

EyeCantCU•12/17/23, 6:14 PM

I hadn't either because they successfully sign. It's very odd

j0rge•12/17/23, 6:14 PM

I think we just put the previous cosign.pub in those repos and use the org-wide secret?

EyeCantCU•12/17/23, 6:14 PM

Yeah

j0rge•12/17/23, 6:17 PM

I hadn't even noticed that, good catch!

EyeCantCU•12/17/23, 6:18 PM

I figured we might as well add these tests to our downstream images. Establishes some form of verification. I wish the ci-test images were signed too

EyeCantCU•12/17/23, 6:19 PM

We can even do this for the Chainguard images Bluefin DX pulls from

j0rge•12/17/23, 6:19 PM

ci-test has been around a year longer than I anticipated

j0rge•12/17/23, 6:20 PM

feels like the upstream of silverblue/kinoite are getting a ton of attention now but the fedora parts are less maintained than they were before.

j0rge•12/17/23, 6:20 PM

the fedora one didn't build for 10 days!

j0rge•12/17/23, 6:22 PM

this verification is a great idea!

EyeCantCU•12/17/23, 6:25 PM

Thank you! I was brainstorming over this yesterday after looking over a lot of the images Chainguard has and going through their documentation. Then this morning I put two and two together

EyeCantCU•12/17/23, 6:25 PM

Ah, that's exactly it. Our public keys for these don't align. Will update them

j0rge•12/17/23, 6:26 PM

seems like an obvious check once you see it, that's amazing.

j0rge•12/17/23, 6:27 PM

that's a legit real improvement in our supply chain security, nice!

EyeCantCU•12/17/23, 6:40 PM

I'm pretty happy about it :). I'll get all of our downstream stuff PRd with the test today

j0rge•12/17/23, 6:41 PM

you can also file an issue with a help wanted if people want an easy fix to learn how to PR

j0rge•12/17/23, 6:41 PM

aka you don't have to do every repo, heh

EyeCantCU•12/17/23, 6:42 PM

Ha. That's a great idea

j0rge•12/17/23, 6:42 PM

then when people PR it'll be a checklist too

Robert•12/17/23, 6:43 PM

Thought: Can't we create a few GitHub Actions such as sign-image and verify-image, and use them across all repos? That way there will be no signing logic in each repo, and they are all controlled in main or similar

Since all images use the same signing keys, the custom action could have the main/cosign.pub location hard-coded

Robert•12/17/23, 6:44 PM

The action would incude "setup-cosign" and "verify-image" steps, so each repo will need a single line in the GHA workflow

EyeCantCU•12/17/23, 6:44 PM

We very well could. I really like that idea

j0rge•12/17/23, 6:44 PM

yeah there's a few places where we could start to move to centralized actions

EyeCantCU•12/17/23, 6:45 PM

Though I'd make it so that we could pass whatever public key we wanted versus hard coding it to main so that's useful downstream too

Robert•12/17/23, 6:45 PM

Yeah, maybe hard-code the default value to ublue, but make it an input so other images can change it if required

j0rge•12/17/23, 6:46 PM

then the maintenance on the repos would go from "copy and pasting improvements" to just dependabot bumping the version for us. That would be a huge win for long term maintenance and sustainability

Robert•12/17/23, 6:46 PM

Even downstream would need to verify the base image against the ublue org, so defaulting to ublue values makes sense.

EyeCantCU•12/17/23, 6:48 PM

Very true. I can piece this together. It'd be rather simple too

j0rge•12/17/23, 6:48 PM

sig store folks would dig that too, it's a great idea/story

Robert•12/17/23, 6:50 PM

Here's my current sign-image action if it helps. I hadn't thought about verifying the images before using them though, but i like it!
https://github.com/rsturla/eternal-main/blob/main/.github/actions/sign-image/action.yml

GitHub

eternal-main/.github/actions/sign-image/action.yml at main · rsturl...

The base configuration for the Eternal Linux project. All Eternal images inherit the configuration defined here. - rsturla/eternal-main

j0rge•12/17/23, 6:50 PM

yeah verifying first is so clutch!

Robert•12/17/23, 6:52 PM

I am still wondering how we can verify the third-party images before using them though... They are set in the Dockerfile as COPY --from=<image>COPY --from=<image>, so would we need to keep an up-to-date list of external images in the GHA workflow, or is there some integration we can do during builds?

j0rge•12/17/23, 6:52 PM

we need to ask fedora to sign their images

Robert•12/17/23, 6:52 PM

Sorry, I'm mainly thinking about the chainguard ones. Should have mentioned that

j0rge•12/17/23, 6:52 PM

I'm reasonably certain they will do this, they just seem to be behind on the infra parts of pushing oci images in general

j0rge•12/17/23, 6:53 PM

Robert•12/17/23, 6:53 PM

Chainguard images should already be signed, but I just don't know if there's a way to automatically verify them before using it, or if we will need another step to verify an array of images in GHA

j0rge•12/17/23, 6:54 PM

should be straightforward for the toolbox images right?

There are a lot of community images but not "official" ones. It would need a maintainer who uses the

Similar Threads

Similar Threads

Similar Threads