wait, this *is* the same as the secureboot key <https://github.com/ublue-os/config/blob/main/build/u
wait, this is the same as the secureboot key https://github.com/ublue-os/config/blob/main/build/ublue-os-just/00-default.just
Kyes, the kernel is signed with fedora's key (valid anywhere you'd find secure boot)
Kand the akmods are signed with the akmod key (required for akmods to load under secure boot)
Kchange is to also sign the kernel with the akmod key
Rright, so this could still be added to main to help downstream projects, despite not having a reason to be in main until this point
Kpotentially, yes
Ri get that you don't have to
Kwould require pulling the akmod key into main and porting this over
Kright now that key is not present
Rif I had access to your privkey, then i could put that into my repos 
Rbut i cant
Rand you shouldnt give it to me
Rdownstream image users that use nvidia/asus/hwe already have this imported thankfully, so adding it to main would make it uniform
Kyeah, and hwe
Bactually, the secure boot signing key (AND our cosign key) is an org global secrets, so we could use it in main if the choice was made to sign the whole kernel there, but i'm not yet convinced we should do so, even if it is the right choice for bluefin
Kthe signing action has a self-check
Kthat uses the key located in /etc/pki bla bla bla
Kthat won't be there (unless it's added)
Bright, the global secret would need to be injected at the correct location as part of a build step
KYep
K@j0rge that error might be transitory now that I think about it
Kwe aren't
:latest in a PR
Jshould I rerun the checks?
Krerunning them would do nothing
Kwould have to merge
Kor make some not-to-be-merged version that is purely for testing
Jwell, it's already broken so what do we have to lose?
Kyour call
Bspeaking of calls... have a second?
Ksure, I was about to get lunch and get back to real work, I'll call you in a moment
J@Kyle Gospo but if there was an error it'll be localized right?
Kwouldn't build
Btty is fine
Kworst case is the same issue you have now
Jack, merging
Bthis is failing due to no local registry, no?
Jshould we just pin the last known kernel for now?
JI can back this out.
KNot a bad way to go
KBut let's see if this works
KShould be there anyway
Blet's watch it
Jit failed already, same issue
Jdoes anybody remember how to pin a kernel?
EI think we need to fetch it from Koji and do an override replace?
Bthat's how pin/rollback of package works, yes
JI have no idea how to do this, does someone have cycles to help out?
Jlooks like if we had a newer bootupd it might have helped
Rit's probably less jank at that point to pin the entire upstream image
EI'm taking a look but more eyes would be appreciated
