From 2e3eff6ce3c09050461ffdc4b032fa4b0900e7c6 Mon Sep 17 00:00:00 2001 From: Juha Uotila <10782843+inffy@users.noreply.github.com> Date: Tue, 8 Sep 2026 09:45:56 +0300 Subject: [PATCH 1/6] chore: add ublue-os. pub key --- ublue-os-key.pub | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 ublue-os-key.pub diff --git a/ublue-os-key.pub b/ublue-os-key.pub new file mode 100644 index 0000000..bd5b192 --- /dev/null +++ b/ublue-os-key.pub @@ -0,0 +1,4 @@ +-----BEGIN PUBLIC KEY----- +MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEHLRpBfPRYiMl9wb7s6fx47PzzNWu +3zyJgXhWEvxoOgwv9CpwjbvUwR9qHxNMWkJhuGE6cjDA2hpy1I6NbA+24Q== +-----END PUBLIC KEY----- From 9a33c9fb2e5da4e07246a1dec9dfd11afda790d5 Mon Sep 17 00:00:00 2001 From: Juha Uotila <10782843+inffy@users.noreply.github.com> Date: Tue, 8 Sep 2026 09:55:52 +0300 Subject: [PATCH 2/6] add runner-keys script --- .github/setup-runner-keys.sh | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100755 .github/setup-runner-keys.sh diff --git a/.github/setup-runner-keys.sh b/.github/setup-runner-keys.sh new file mode 100755 index 0000000..912eb1c --- /dev/null +++ b/.github/setup-runner-keys.sh @@ -0,0 +1,23 @@ +#!/usr/bin/env bash + +# Setup Public Keys for containers that are pulled during the build + +set -eoux pipefail + +PKI_DIR="/etc/pki/containers" +REGISTRIES="/etc/containers/registries.d" + +mkdir -p "${PKI_DIR}" "${REGISTRIES}" +cp ublue-os-key.pub "${PKI_DIR}/ghcr.io-ublue-os.pub" + +yq -n '.docker."ghcr.io/ublue-os".use-sigstore-attachments = true' | tee "${REGISTRIES}"/ublue-os.yaml + +jq '.transports.docker["ghcr.io/ublue-os"] = [ + { + "type": "sigstoreSigned", + "keyPath": "/etc/pki/containers/ghcr.io-ublue-os.pub", + "signedIdentity": { + "type": "matchRepository" + } + } +]' /etc/containers/policy.json | tee /etc/containers/policy.json.tmp > /dev/null && mv /etc/containers/policy.json.tmp /etc/containers/policy.json From 45f8080d4c168a213bacf81ee5eb9ad630e22fe3 Mon Sep 17 00:00:00 2001 From: Juha Uotila <10782843+inffy@users.noreply.github.com> Date: Tue, 8 Sep 2026 09:57:31 +0300 Subject: [PATCH 3/6] modify the workflows --- .github/workflows/build-iso-stable.yml | 2 ++ .github/workflows/build-iso-testing.yml | 2 ++ .github/workflows/reusable-build-iso-anaconda.yml | 4 ++++ 3 files changed, 8 insertions(+) diff --git a/.github/workflows/build-iso-stable.yml b/.github/workflows/build-iso-stable.yml index 66bf2b5..5d9307c 100644 --- a/.github/workflows/build-iso-stable.yml +++ b/.github/workflows/build-iso-stable.yml @@ -8,6 +8,8 @@ on: paths: - ".github/workflows/build-iso-stable.yml" - ".github/workflows/reusable-build-iso-anaconda.yml" + - ".github/setup-runner-keys.sh" + - "ublue-os-key.pub" - "iso_files/**" workflow_dispatch: inputs: diff --git a/.github/workflows/build-iso-testing.yml b/.github/workflows/build-iso-testing.yml index 6696881..6846862 100644 --- a/.github/workflows/build-iso-testing.yml +++ b/.github/workflows/build-iso-testing.yml @@ -8,6 +8,8 @@ on: paths: - ".github/workflows/build-iso-testing.yml" - ".github/workflows/reusable-build-iso-anaconda.yml" + - ".github/setup-runner-keys.sh" + - "ublue-os-key.pub" - "iso_files/**" workflow_call: workflow_dispatch: diff --git a/.github/workflows/reusable-build-iso-anaconda.yml b/.github/workflows/reusable-build-iso-anaconda.yml index 870e40e..0d761a5 100644 --- a/.github/workflows/reusable-build-iso-anaconda.yml +++ b/.github/workflows/reusable-build-iso-anaconda.yml @@ -54,6 +54,10 @@ jobs: - name: Maximize build space uses: ublue-os/remove-unwanted-software@695eb75bc387dbcd9685a8e72d23439d8686cba6 # v10 + - name: Configure containers policy for build + run: | + sudo ./.github/setup-runner-keys.sh + - name: Checkout common repo uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: From 43df3af2aa83e91a056746ace4f4aa7f8cc0fb52 Mon Sep 17 00:00:00 2001 From: Juha Uotila <10782843+inffy@users.noreply.github.com> Date: Sat, 12 Sep 2026 19:40:18 +0300 Subject: [PATCH 4/6] rename the ublue-os key --- ublue-os-key.pub => ghcr.io-ublue-os.pub | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename ublue-os-key.pub => ghcr.io-ublue-os.pub (100%) diff --git a/ublue-os-key.pub b/ghcr.io-ublue-os.pub similarity index 100% rename from ublue-os-key.pub rename to ghcr.io-ublue-os.pub From 93f8a7a8e29214f5188a4d86dcb140c7b7d1247a Mon Sep 17 00:00:00 2001 From: Juha Uotila <10782843+inffy@users.noreply.github.com> Date: Sat, 12 Sep 2026 19:44:53 +0300 Subject: [PATCH 5/6] fix --- .github/setup-runner-keys.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/setup-runner-keys.sh b/.github/setup-runner-keys.sh index 912eb1c..76ed0d8 100755 --- a/.github/setup-runner-keys.sh +++ b/.github/setup-runner-keys.sh @@ -8,7 +8,7 @@ PKI_DIR="/etc/pki/containers" REGISTRIES="/etc/containers/registries.d" mkdir -p "${PKI_DIR}" "${REGISTRIES}" -cp ublue-os-key.pub "${PKI_DIR}/ghcr.io-ublue-os.pub" +cp ghcr.io-ublue-os.pub "${PKI_DIR}/ghcr.io-ublue-os.pub" yq -n '.docker."ghcr.io/ublue-os".use-sigstore-attachments = true' | tee "${REGISTRIES}"/ublue-os.yaml From e3748113ae2ba03c7922d242a1e75313d35f9ba8 Mon Sep 17 00:00:00 2001 From: renner <80410025+renner0e@users.noreply.github.com> Date: Sat, 12 Sep 2026 20:42:25 +0200 Subject: [PATCH 6/6] Apply batched suggestions from code review Co-authored-by: renner <80410025+renner0e@users.noreply.github.com> --- .github/workflows/build-iso-stable.yml | 2 +- .github/workflows/build-iso-testing.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build-iso-stable.yml b/.github/workflows/build-iso-stable.yml index 5d9307c..d423269 100644 --- a/.github/workflows/build-iso-stable.yml +++ b/.github/workflows/build-iso-stable.yml @@ -9,7 +9,7 @@ on: - ".github/workflows/build-iso-stable.yml" - ".github/workflows/reusable-build-iso-anaconda.yml" - ".github/setup-runner-keys.sh" - - "ublue-os-key.pub" + - "ghcr.io-ublue-os.pub" - "iso_files/**" workflow_dispatch: inputs: diff --git a/.github/workflows/build-iso-testing.yml b/.github/workflows/build-iso-testing.yml index 6846862..964b2f1 100644 --- a/.github/workflows/build-iso-testing.yml +++ b/.github/workflows/build-iso-testing.yml @@ -9,7 +9,7 @@ on: - ".github/workflows/build-iso-testing.yml" - ".github/workflows/reusable-build-iso-anaconda.yml" - ".github/setup-runner-keys.sh" - - "ublue-os-key.pub" + - "ghcr.io-ublue-os.pub" - "iso_files/**" workflow_call: workflow_dispatch: