Glarion/glarion
Watch
1
0
Fork
You've already forked glarion
 0
Code Issues 10 Pull requests Projects Releases Packages Wiki Activity

ISO-installed systems track an unverified origin: updates skip signature verification #11

New issue
Open
opened 2026-07-16 08:34:11 +00:00 by james.oates · 0 comments
james.oates commented 2026-07-16 08:34:11 +00:00
Owner
Copy link

Found on the VM testbed (2026-07-15): a system installed from the bootc-image-builder ISO has origin ostree-unverified-registry:ghcr.io/glarion-os/glarion:latest — updates are pulled and applied without cosign verification. The signed path (ostree-image-signed:docker://…) currently only exists via the README's manual two-step rebase; our own installer produces unverified systems.

The image itself already ships the verification policy (/etc/containers/policy.json + registries.d + public key), so the machinery is present — only the origin string is wrong.

Fix candidates (investigate in order):

  1. bootc-image-builder option/config to set a signed transport for the installed origin (check current bib docs)
  2. Kickstart %post in the ISO build: rpm-ostree rebase ostree-image-signed:docker://ghcr.io/glarion-os/glarion:latest (no download needed — same digest already deployed; just rewrites the origin)
  3. In-image migration unit that transmutes unverified→signed origin on first boot (also fixes existing installs, including the rebase-path first step)

Also add a testbed/CI assertion: freshly installed system's rpm-ostree status must show the signed origin. Part of the Easy Install / Simple Safe Updates cast-iron work.

Found on the VM testbed (2026-07-15): a system installed from the bootc-image-builder ISO has origin `ostree-unverified-registry:ghcr.io/glarion-os/glarion:latest` — updates are pulled and applied without cosign verification. The signed path (`ostree-image-signed:docker://…`) currently only exists via the README's manual two-step rebase; our own installer produces unverified systems. The image itself already ships the verification policy (`/etc/containers/policy.json` + registries.d + public key), so the machinery is present — only the origin string is wrong. Fix candidates (investigate in order): 1. bootc-image-builder option/config to set a signed transport for the installed origin (check current bib docs) 2. Kickstart `%post` in the ISO build: `rpm-ostree rebase ostree-image-signed:docker://ghcr.io/glarion-os/glarion:latest` (no download needed — same digest already deployed; just rewrites the origin) 3. In-image migration unit that transmutes unverified→signed origin on first boot (also fixes *existing* installs, including the rebase-path first step) Also add a testbed/CI assertion: freshly installed system's `rpm-ostree status` must show the signed origin. Part of the Easy Install / Simple Safe Updates cast-iron work.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
No results found.
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
Glarion/glarion#11
No description provided.