a925e0269f
* feat(ci): setup runner with containers policy Currently for ublue-os/akmods and kinoite (not pinned by digest), we verify them and pull them right after. We can't trust the authenticity of those images, as the tag in the meantime could point to a different, potentially compromised digest. To avoid this, we set up our runner so that it will refuse to pull anything from Universal Blue or quay.io/fedora-ostree-desktops without first getting verified with the corresponding public key in our repo. With this, we can completely get rid of our verify-container recipe and benefit from the retry logic that is implemented in the podman pulls we already do beforehand. This would mean that local builds would no longer verify the pulled images, as the policy is very likely not configured, but I don't think that is super important. * fix: install cosign in non-production builds |
||
|---|---|---|
| .github | ||
| build_files | ||
| system_files/shared | ||
| .devcontainer.json | ||
| .gitattributes | ||
| .gitignore | ||
| .pre-commit-config.yaml | ||
| artifacthub-repo.yml | ||
| Containerfile.in | ||
| CONTRIBUTING.md | ||
| cosign.pub | ||
| image-versions.yml | ||
| Justfile | ||
| LICENSE | ||
| quay.io-fedora-ostree-desktops.pub | ||
| README.md | ||
Aurora
Aurora is a delightful KDE desktop experience for end-users that are looking for reliability and developers for the most-hassle free setup. Zero maintenance included.
Documentation
- Discussions and Announcements - strongly recommended!
- Documentation
- Contributing Guide
- Local Building Guide
The system_files, flatpak and logos directory have been moved to here.
Secure Boot
Secure Boot is supported by default on our systems, providing an additional layer of security. After the first installation, you will be prompted to enroll the secure boot key in the BIOS.
Enter the password universalblue
when prompted to enroll our key.
If this step is not completed during the initial setup, you can manually enroll the key by running the following command in the terminal:
ujust enroll-secure-boot-key
Secure boot is supported with our custom key. The pub key can be found in the root of the akmods repository here. If you'd like to enroll this key prior to installation or rebase, download the key and run the following:
sudo mokutil --timeout -1
sudo mokutil --import public_key.der
Repobeats
