fix: coreos images to allow image signing

config/common/server-files.yml

@@ -0,0 +1,6 @@
+type: files
+files:
+  - server/usr: /usr # copy static configurations
+              # configuration you wish to end up in /etc/ on the booted system should be 
+              # added into /usr/etc/ (under /config/files) as that is the proper "distro" 
+              # config directory on ostree read more in the files module's README

config/files/usr/server/usr/etc/containers/policy.json

@@ -0,0 +1,95 @@
+{
+    "default": [
+        {
+            "type": "reject"
+        }
+    ],
+    "transports": {
+        "docker": {
+            "registry.access.redhat.com": [
+                {
+                    "type": "signedBy",
+                    "keyType": "GPGKeys",
+                    "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release"
+                }
+            ],
+            "registry.redhat.io": [
+                {
+                    "type": "signedBy",
+                    "keyType": "GPGKeys",
+                    "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release"
+                }
+            ],
+            "ghcr.io/ublue-os": [
+                {
+                    "type": "sigstoreSigned",
+                    "keyPath": "/usr/etc/pki/containers/ublue-os.pub",
+                    "signedIdentity": {
+                        "type": "matchRepository"
+                    }
+                }
+            ],
+            "": [
+                {
+                    "type": "insecureAcceptAnything"
+                }
+            ]
+        },
+        "docker-daemon": {
+            "": [
+                {
+                    "type": "insecureAcceptAnything"
+                }
+            ]
+        },
+        "atomic": {
+            "": [
+                {
+                    "type": "insecureAcceptAnything"
+                }
+            ]
+        },
+        "containers-storage": {
+            "": [
+                {
+                    "type": "insecureAcceptAnything"
+                }
+            ]
+        },
+        "dir": {
+            "": [
+                {
+                    "type": "insecureAcceptAnything"
+                }
+            ]
+        },
+        "oci": {
+            "": [
+                {
+                    "type": "insecureAcceptAnything"
+                }
+            ]
+        },
+        "oci-archive": {
+            "": [
+                {
+                    "type": "insecureAcceptAnything"
+                }
+            ]
+        },
+        "docker-archive": {
+            "": [
+                {
+                    "type": "insecureAcceptAnything"
+                }
+            ]
+        },
+        "tarball": {
+            "": [
+                {
+                    "type": "insecureAcceptAnything"
+                }
+            ]
+        }
+    }
+}

config/files/usr/server/usr/etc/containers/registries.d/ublue-os.yaml

@@ -0,0 +1,3 @@
+docker:
+  ghcr.io/ublue-os:
+    use-sigstore-attachments: true

config/files/usr/server/usr/etc/pki/containers/ublue-os.pub

@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE7lh7fJMV4dBT2jT1XafixUJa7OVA
+cT+QFVD8IfIJIS/KBAc8hx1aslzkH3tfeM0cwyCLB7kOStZ4sh6RyFQD9w==
+-----END PUBLIC KEY-----

config/recipes/server/recipe-server-main-userns.yml

@@ -1,7 +1,7 @@
 # image will be published to ghcr.io/<user>/<name>
 name: server-main-userns-hardened
 # description will be included in the image's metadata
-description: "base with some hardening applied"
+description: "coreos with some hardening applied"
 
 # the base image to build on top of (FROM) and the version tag to use
 base-image: ghcr.io/ublue-os/fedora-coreos
@@ -11,6 +11,7 @@ image-version: stable-zfs
 # you can include multiple instances of the same module
 modules:
   - from-file: common/common-files.yml
+  - from-file: common/server-files.yml
   - from-file: common/server-scripts.yml
   - from-file: common/common-packages.yml
   - from-file: common/common-bling.yml

config/recipes/server/recipe-server-main.yml

@@ -1,7 +1,7 @@
 # image will be published to ghcr.io/<user>/<name>
 name: server-main-hardened
 # description will be included in the image's metadata
-description: "base with some hardening applied"
+description: "coreos with some hardening applied"
 
 # the base image to build on top of (FROM) and the version tag to use
 base-image: ghcr.io/ublue-os/fedora-coreos
@@ -11,6 +11,7 @@ image-version: stable-zfs
 # you can include multiple instances of the same module
 modules:
   - from-file: common/common-files.yml  
+  - from-file: common/server-files.yml
   - from-file: common/server-scripts.yml
   - from-file: common/common-packages.yml
   - from-file: common/common-bling.yml

config/recipes/server/recipe-server-nvidia-userns.yml

@@ -1,7 +1,7 @@
 # image will be published to ghcr.io/<user>/<name>
 name: server-nvidia-userns-hardened
 # description will be included in the image's metadata
-description: "base nvidia with some hardening applied"
+description: "coreos nvidia with some hardening applied"
 
 # the base image to build on top of (FROM) and the version tag to use
 base-image: ghcr.io/ublue-os/fedora-coreos
@@ -11,6 +11,7 @@ image-version: stable-nvidia-zfs
 # you can include multiple instances of the same module
 modules:
   - from-file: common/common-files.yml
+  - from-file: common/server-files.yml
   - from-file: common/server-scripts.yml
   - from-file: common/common-packages.yml
   - from-file: common/common-bling.yml

config/recipes/server/recipe-server-nvidia.yml

@@ -1,7 +1,7 @@
 # image will be published to ghcr.io/<user>/<name>
 name: server-nvidia-hardened
 # description will be included in the image's metadata
-description: "base nvidia with some hardening applied"
+description: "coreos nvidia with some hardening applied"
 
 # the base image to build on top of (FROM) and the version tag to use
 base-image: ghcr.io/ublue-os/fedora-coreos
@@ -11,6 +11,7 @@ image-version: stable-nvidia-zfs
 # you can include multiple instances of the same module
 modules:
   - from-file: common/common-files.yml
+  - from-file: common/server-files.yml
   - from-file: common/server-scripts.yml
   - from-file: common/common-packages.yml
   - from-file: common/common-bling.yml

config/scripts/signing.sh

@@ -6,11 +6,8 @@ set -oue pipefail
 echo "Setting up container signing in policy.json and cosign.yaml for $IMAGE_NAME"
 echo "Registry to write: $IMAGE_REGISTRY"
 
-mkdir -p /usr/etc/pki/containers/registries.d
 cp /usr/share/ublue-os/cosign.pub /usr/etc/pki/containers/"$IMAGE_NAME".pub
 
-mkdir -p /usr/etc/containers
-touch /usr/etc/containers/policy.json
 FILE=/usr/etc/containers/policy.json
 
 yq -i -o=j '.transports.docker |=