Universal Blue•5mo ago

System update failed

Hi! I'm getting the following error when trying to update using the Software Update. ── 21:03:45 - System update ──────────────────────────────────────────────────── Pulling manifest: ostree-image-signed:docker://ghcr.io/ublue-os/bazzite-nvidia:stable error: Creating importer: Failed to invoke skopeo proxy method OpenImage: remote error: cryptographic signature verification failed: invalid signature when validating ASN.1 encoded signature System update failed: 0: Command failed: /usr/bin/rpm-ostree upgrade 1: /usr/bin/rpm-ostree failed: exit status: 1 Location: src/steps/os/linux.rs:273

Solution:

sudo sed -iE 's/ublue-os"/_keylost"/g' /etc/containers/policy.json

Jump to solution

47 Replies

antheas•5mo ago

nice

WilfordGrimley•5mo ago

I am getting the same on bazzite-deck stable on my OLED machine. It happens when trying to update or rebase.

antheas•5mo ago

@Robert (p5) @EyeCantCU @bsherman did it start yet?

WilfordGrimley•5mo ago

Output of rpm-ostree status

bsherman•5mo ago

what is your question?

antheas•5mo ago

look at the help thread

EyeCantCU•5mo ago

It's a global secret. All images built will have been signed with the new key

antheas•5mo ago

since when the key was rotated 1 hour ago no?

EyeCantCU•5mo ago

I don't know when exactly the secret was updated or when all images were last built

antheas•5mo ago

8 hours ago bazzite

bsherman•5mo ago

secret update July 2, 8:59 AM CDT

EyeCantCU•5mo ago

I think we should just document the rebase process

bsherman•5mo ago

lets go to the other thread for that discussion plz 🙂

WilfordGrimley•5mo ago

Can I have a link to that thread to help me understand please?

antheas•5mo ago

big oupsie no key shouldnt have affected stuff yet new* key Chillax guys I'll get you your curl script

noobeta•5mo ago

Eeer, right now I also encounter this error when trying to update.

Solution

antheas•5mo ago

sudo sed -iE 's/ublue-os"/_keylost"/g' /etc/containers/policy.json

antheas•5mo ago

there you go guys enjoy

FardinHaqueOP•5mo ago

That seems to have fixed it! Thanks @antheas

antheas•5mo ago

to anyone seeing this in the future this will disable image signing by a key so you should update to the new one after updating ill post the instructions soon mind the fact the old bazzite update catalog will become inaccessible after that

p5•5mo ago

Will that command edit the policy.json file? rpm-ostree doesn't use podman under the hood

antheas•5mo ago

yes one sec we need the one that fixes the key and i need to try it

FardinHaqueOP•5mo ago

Is there something else i have to do after using the fix you provided? I am super new to linux so will wait for your instructions. Right now after running the command it is updating again normally.

antheas•5mo ago

relax play some games and come in this thread tomorrow

FardinHaqueOP•5mo ago

thanks will do lol 🫡

antheas•5mo ago

sudo podman image trust set --type accept ghcr.io/ublue-os for now only this command works which disables verification working on a command that does both

Decay•5mo ago

@antheas what’s the steps to get the new key? Or is this handled by updating?

antheas•5mo ago

we will try to make it work after updating seamlessly however, even if i give you the key now i cant get it to work so new key is not working, the command above will in any case

Decay•5mo ago

Great I will sit tight then 🙂

WilfordGrimley•5mo ago

@antheas Are

sudo sed -iE 's/ublue-os"/_keylost"/g' /etc/containers/policy.json

sudo sed -iE 's/ublue-os"/_keylost"/g' /etc/containers/policy.json

still the recommend solutions? Will solving temporarily this way have any conflict with the script/solution being built in the other thread?

antheas•5mo ago

let me remove the second one and leave the first one for the lols remove it as well for bazzite users that want to use older versions, the current solution is sudo podman image trust set --type accept ghcr.io/ublue-os we are working on a script that will secure future bazzite versions and we will try to sign older bazzite builds so you can roll back but at this point, the only clean solution is disabling signature verification theres currently no future bazzite version, so unless you disable signature verification you cant update

WilfordGrimley•5mo ago

Is that temp solution compatible with the future script if I just want to move forward with updated in :stable? The timing of this is so sad, because I wanted to pin the last working build with nvidia 550 for my desktop rig.

antheas•5mo ago

right now no you can always edit the file by hand in the future it seems that sudo podman image trust set --type sigstoreSigned is not doing the full config replacement so it doesnt work correctly? it needs more testing that will happen tomorrow in any case, ill make sure theres a script that can migrate anyone that disables signature verification

p5•5mo ago

We are also going to be looking into re-signing select older images so they can be rebased to after the fixes have been applied. This has not yet been implemented, but is planned

antheas•5mo ago

also worth mentioning TLS encryption still protects your bazzite updates, even without signature verification so it is perfectly safe temporarily long term we would like to get that back though

WilfordGrimley•5mo ago

Really appreciate all of you devs crunching today to try to find solutions for this.

psirix•5mo ago

amen to that... was excited to hear about the release and appreciate having this thread to get on the upgrade train!

Kyle Gospo•5mo ago

https://discord.com/channels/1072614816579063828/1074438180847239279/1257854077048721520

WilfordGrimley•5mo ago

@antheas Is there anything I should do to undo sudo podman image trust set --type accept ghcr.io/ublue-os ? before or after running the bash script? this is the output of my podman image trust show --raw https://paste.centos.org/view/8bc1b1b1

wolfyreload•5mo ago

The script edits /etc/containers/policy.json This is the relevant part in your file

"ghcr.io/ublue-os": [
        {
            "type": "insecureAcceptAnything"
        }
    ],

"ghcr.io/ublue-os": [
        {
            "type": "insecureAcceptAnything"
        }
    ],

This is what it looks like in mine

 
"ghcr.io/ublue-os": [
        {
            "type": "sigstoreSigned",
            "keyPath": "/usr/etc/pki/containers/ublue-os.pub",
            "signedIdentity": {
                "type": "matchRepository"
            }
        }
    ],

 
"ghcr.io/ublue-os": [
        {
            "type": "sigstoreSigned",
            "keyPath": "/usr/etc/pki/containers/ublue-os.pub",
            "signedIdentity": {
                "type": "matchRepository"
            }
        }
    ],

You'll need to set it to this before you run the fix in announcements

antheas•5mo ago

Or just edit it to remove user from the key and download the new key But that's it that's the change not much to it If any of you want I can turn that into a command !!! Important: for anyone that ran any of the commands in this thread, you need to restore your policy before using the fix in the announcement: sudo cp /usr/etc/containers/policy.json /etc/containers/policy.json then after running the fix in the announcement, verify the policy is applied and says sigstoreSigned sudo podman image trust show | grep ghcr this will overwrite your policy file, so if you do container stuff and have a custom policy, edit the file manually

Decay•5mo ago

Will reinstalling also fix this with the newest image?

antheas•5mo ago

Why reinstall Yes clean installations from when the next ISOs come out will not have an issue Maybe they already came out

TheDarkSideOfCookies•5mo ago

@antheas Is ok in this way?

Kyle Gospo•5mo ago

If you haven't followed any of the stuff in this thread yet, do what's in #announcements instead

antheas•5mo ago

Yes Announcement won't work if they followed this thread

Dwarrelpoot•5mo ago

I used the commands from this thread on my oled deck and got the same results as @TheDarkSideOfCookies without changing anything. Took a look at my policy.json and everything was ready to go. Can’t really say how that happened but I’m happy nonetheless!

Gaming

Programming

System update failed