Title: testing updates blocked
bug
Title: testing updates blocked: "A signature was required, but no signature exists" (signed + unverified rebase both fail)
Hi! Updates on the testing branch are failing with a signature error.
Current deployment:
- Origin: ostree-image-signed:docker://ghcr.io/ublue-os/bazzite:testing
- Version: testing-43.20260303.3 (2026-03-03T16:46:25Z)
- Digest: sha256:5a782b85e21bd5d77f56b66d45102110ee53f39fa8b741e140f12fe51c956930
- Secure Boot: enabled (mokutil --sb-state)
- bootc: not used (bootc not installed)
- LayeredPackages: clamav clamav-update glmark2 libreoffice vkmark
Repro:
1) ujust update (or rpm-ostree upgrade)
=> error: Preparing import: Fetching manifest: failed to invoke method OpenImage:
A signature was required, but no signature exists
2) Tried bypass via unverified rebase:
sudo rpm-ostree rebase --reboot ostree-unverified-registry:ghcr.io/ublue-os/bazzite:testing
=> same error: A signature was required, but no signature exists
It looks like the testing tag is currently unsigned, but whatβs confusing is that the unverified rebase still enforces signatures.
Is this expected? Any recommended workaround besides rebasing to stable?
rpm-ostree status -v
mokutil --sb-state
cat /etc/containers/policy.json
ls -la /etc/containers/policy.d/ 2>/dev/null || true
journalctl -u rpm-ostreed -b --no-pager | tail -n 200
Workaround-wise I'm fine rebasing to stable, but I'm reporting because testing appears unsigned and unverified rebase still enforces signatures. Is that expected behavior?
Logs below. If you need more, tell me what to collect. I can rebase to stable as a workaround, but reporting because testing appears unsigned and unverified rebase still enforces signatures.
Hi! Updates on the testing branch are failing with a signature error.
Current deployment:
- Origin: ostree-image-signed:docker://ghcr.io/ublue-os/bazzite:testing
- Version: testing-43.20260303.3 (2026-03-03T16:46:25Z)
- Digest: sha256:5a782b85e21bd5d77f56b66d45102110ee53f39fa8b741e140f12fe51c956930
- Secure Boot: enabled (mokutil --sb-state)
- bootc: not used (bootc not installed)
- LayeredPackages: clamav clamav-update glmark2 libreoffice vkmark
Repro:
1) ujust update (or rpm-ostree upgrade)
=> error: Preparing import: Fetching manifest: failed to invoke method OpenImage:
A signature was required, but no signature exists
2) Tried bypass via unverified rebase:
sudo rpm-ostree rebase --reboot ostree-unverified-registry:ghcr.io/ublue-os/bazzite:testing
=> same error: A signature was required, but no signature exists
It looks like the testing tag is currently unsigned, but whatβs confusing is that the unverified rebase still enforces signatures.
Is this expected? Any recommended workaround besides rebasing to stable?
rpm-ostree status -v
mokutil --sb-state
cat /etc/containers/policy.json
ls -la /etc/containers/policy.d/ 2>/dev/null || true
journalctl -u rpm-ostreed -b --no-pager | tail -n 200
Workaround-wise I'm fine rebasing to stable, but I'm reporting because testing appears unsigned and unverified rebase still enforces signatures. Is that expected behavior?
Logs below. If you need more, tell me what to collect. I can rebase to stable as a workaround, but reporting because testing appears unsigned and unverified rebase still enforces signatures.
