rpm-ostree rebase fails with: specifies a default of insecureAcceptAnything; refusing usage

[marc0der]

Hi folks,

Firstly, thank you for your great work. This is a great initiative and I appreciate what you are doing here.

I'm a total n00b to immutable fedora (and rpm-ostree) and trying to test my first custom image created with the github action. All went well, and the action built my new image 🎉

Following the README in my repo, I then ran the first rebase and reboot, no problem:

$ rpm-ostree rebase ostree-unverified-registry:ghcr.io/marc0der/xfce-i3:latest
$ systemctl reboot

Once rebooted, I attempted to perform the second rebase to the signed image, but this time I ran into a problem:

$ rpm-ostree rebase ostree-image-signed:docker://ghcr.io/marc0der/xfce-i3:latest
Pulling manifest: ostree-image-signed:docker://ghcr.io/marc0der/xfce-i3:latest
error: Preparing import: Fetching manifest: containers-policy.json specifies a default of `insecureAcceptAnything`; refusing usage

This was run on a brand new install of Silverblue.

As far as I can tell, I followed the process to the book. I really don't understand what the error is saying and would really appreciate some guidance here. I'm probably missing something super obvious!

Thanks in advance and hope I can get this one off the ground!

[fiftydinar]

Hello marc0der,

I'm not sure why this issue happens, because you already rebased to unverified registry. That error usually happens when trying to directly rebase from Fedora image to your own verified registry.

/etc/containers/policy.json needs to be altered so this can work, but I don't know at the moment what is needed to modify there to get it working for you.

signing module was mostly tested from Universal Blue based images, less with Fedora based ones.
Maybe we need to look into why this happens in your case & why it works for Universal Blue based images.

Can you show me the output of current rpm-ostree status?

[xynydev]

Additionally, the output of cat /etc/containers/policy.json and cat /usr/etc/containers/policy.json would be helpful.

[marc0der]

Hi all,

So, I managed to get it working 🎉 Here's what happened:

I installed a fresh Silverblue on my machine and immediately booted into that installation. I then issued the first rebase command above. Interestingly, that took no time at all and immediately returned with a zero status code. Something seems wrong with that(?) I then rebooted and issued the rebase again, which worked fine that time. After rebooting one more time, I was in my new system.

TBH, I doubt that this was an issue with blue-build. It seems more like an rpm-ostree issue. wdyt?

[fiftydinar]

It seems more like an rpm-ostree issue. wdyt?

Maybe some rpm-ostree thing, can't be sure, as I never saw rpm-ostree returning zero status code immediatelly on rebase.

I know that it can return this, if you try to rebase to the same image you are on, but that's all I know:

error: Old and new refs are equal: ostree-image-signed:docker://ghcr.io/user/image:latest