repository·main·Indexed 42 days ago
https://github.com/blue-build/templateA foundation for creating custom, signed Fedora Atomic images. It enables users to define system configurations via recipes and deploy them as container-based images, featuring support for image signature verification with cosign and offline ISO generation.
If you are building on Fedora Atomic, you can generate an offline ISO. Follow the specific instructions provided in the BlueBuild ISO generation guide.
Note that because these ISOs are large, they cannot be hosted on GitHub for free; public projects should use alternative hosting solutions.
BlueBuild images are signed using Sigstore's cosign. To verify the integrity and authenticity of the image, download the cosign.pub file from the repository and run the cosign verify command against the image path.
cosign verify --key cosign.pub ghcr.io/blue-build/templateTo install the BlueBuild image on an existing Fedora Atomic system, you must perform a two-step rebase process. First, rebase to the unsigned image to ensure proper signing keys and policies are installed, then reboot. Finally, rebase to the signed image and reboot again.
Note: This is an experimental feature. Use at your own discretion.
Important Behavior: Using the latest tag will always point to the latest build, but it will respect the Fedora version specified in your recipe.yml. You will not be automatically upgraded to a new major Fedora version without updating your configuration.
# 1. Rebase to the unsigned image
rpm-ostree rebase ostree-unverified-registry:ghcr.io/blue-build/template:latest
# 2. Reboot
systemctl reboot
# 3. Rebase to the signed image
rpm-ostree rebase ostree-image-signed:docker://ghcr.io/blue-build/template:latest
# 4. Reboot again
systemctl reboot