rpm-ostree rebase fails with new signed images

[feumpi]

When trying to rebase my Fedora Silverblue with

rpm-ostree rebase ostree-image-signed:docker://ghcr.io/ublue-os/silverblue-nvidia:latest

as told by the README since 4 days ago (pull #130 / commit 0c1ae8a)

I get the following error:

Pulling manifest: ostree-image-signed:docker://ghcr.io/ublue-os/silverblue-nvidia:latest

error: Preparing import: Fetching manifest: containers-policy.json specifies a default of `insecureAcceptAnything`; refusing usage

And it only works by using the old unsigned way:

rpm-ostree rebase ostree-unverified-registry:ghcr.io/ublue-os/silverblue-nvidia:latest

Do I need to do anything else before rebasing to the signed images?

[EyeCantCU]

After rebasing to the unverified ublue image, are you able to rebase to the signed image?

[feumpi]

I am, yes. Just got everything still working, including secure boot, after rebasing from unsigned to the signed image.

[EyeCantCU]

We probably need to add a note somewhere for Fedora Silverblue users so that they rebase to the unsigned images here first. Thank you so much for the information

[castrojo]

We added this here but maybe we need stronger warnings somewhere else?

https://universal-blue.org/images/#preparing-to-rebase

[feumpi]

Would be nice to have a warning here on the README and also on the website guide, which were my entry points when looking to try ublue instead of manually layering Nvidia on Silverblue.

Thanks for all your efforts, by the way! Quite an unusually seamless nvidia experience on Linux.

[castrojo]

The website is just indexing the README, so this PR should fix it in both places, I'll do another one for the main images.

[castrojo]

Oh in main we just point people to the /installation page, which makes sense.

It sucks to have to keep a set of the same instructions for nvidia but I think it also makes sense because people need to do multiple steps, so this seems like the least worst solution for now. What do ya'll think?

[EyeCantCU]

Resolved. Thank you!