Bluefin Documentation

This technical comparison report evaluates the differences between the projectbluefin/bluefin and ublue-os/bluefin repositories.

Key architectural differences include:

• Supply Chain Independence: projectbluefin builds directly on Fedora-based images (e.g., quay.io/fedora-ostree-desktops/silverblue:43) without depending on ublue-os/main-images.
• Pipeline Maturity: projectbluefin implements a testing $\rightarrow$ E2E $\rightarrow$ promotion lifecycle, whereas ublue-os lacks an automated desktop E2E gate.
• Security: projectbluefin utilizes keyless signing to eliminate secret management.
• Developer Velocity: projectbluefin provides fast PR validation (1–2 minutes) via linting gates, compared to 40-minute full builds for non-image changes.

Bluefin uses a multi-stage build process defined in a Containerfile. The architecture involves building from common and brew OCI layers using a single RUN --mount step, followed by a bootc container lint check.

There are two primary implementation approaches for the base image:

1. Ublue-based: Uses FROM ghcr.io/ublue-os/silverblue-main:42. This depends on the ublue-os/main-images pipeline.
2. Fedora-direct (Project Bluefin): Uses FROM quay.io/fedora-ostree-desktops/silverblue:43@sha256:.... This builds directly on official Fedora images using a digest pin, providing full control over the supply chain and eliminating intermediate reprocessing dependencies.

Bluefin provides several channels for communication, support, and learning:

• Official Blog: Announcements for project updates.
• Project Board: todo.projectbluefin.io to see current work.
• Community Forum: Discussions (strongly recommended for users).
• Documentation: docs.projectbluefin.io for user guides and technical details.
• Contributing: Contributing Guide for developers wanting to help the project.

Bluefin supports Secure Boot by default. During the initial installation, you will be prompted to enroll the Bluefin secure boot key in the BIOS. When prompted, enter the password:

universalblue

Manual Enrollment

If you missed the prompt during setup, you can manually enroll the key using the ujust utility:

ujust enroll-secure-boot-key

Pre-installation Enrollment

If you prefer to enroll the key before installing or rebasing, download the public key from the akmods repository and run:

sudo mokutil --timeout -1
sudo mokutil --import public_key.der

To test OCI artifacts locally for bootc switch workflows, you can use podman to save the artifacts in the OCI directory format.

podman save --format oci-dir <image_name>

Bluefin uses the just command runner to manage build recipes. You can trigger local builds using the build recipe. The interface is consistent across different repository implementations.

# Local build
just build bluefin latest main

# CI build (requires sudo)
sudo just build-ghcr bluefin testing main

The bluefin-dx-groups command is a system utility used to configure specific user groups required for the Bluefin developer experience (DX). It ensures that necessary groups exist in /etc/group and automatically adds members of the wheel group to these developer-centric groups.

When executed, the script performs the following:

1. Checks if the group setup has already been run by comparing versions in /etc/ublue/dx-groups.
2. Appends the following groups to /etc/group if they are not already present:
   • docker
   • incus-admin
   • libvirt
3. Iterates through all users currently in the wheel group and adds them to docker, incus-admin, and libvirt using usermod -aG.

Note: This script is idempotent and tracks its execution state in /etc/ublue/dx-groups to prevent redundant runs.