Pop_OS! User switching to UBlue - Security concerns -

[j0rge]

I can’t speak for secureblue but we sign our images with cosign so that you can verify that the image you’re using is built from the source code on GitHub (check the verification instructions here):

Bluefin Administration Guide

Day to Day Operation Bluefin and Aurora are designed to be installed for the life of the hardware without reinstallation. Unlike traditional operating systems the image is always pristine and “clean”, making upgrades less problematic. Updates are automatic and silent by default. Secure Boot Secure Boot is supported by default on our systems, providing an additional layer of security. After the first installation, you will be prompted to enroll the secure boot key in the BIOS. Enter the passwor…

And we verify the signature during our build process:

Universal Blue base images are now verified during the build process!

I am excited to announce that over the weekend there was a significant security enhancement to Universal Blue’s image supply chain! As of December 24th, Ublue images built downstream of main now verify the signature of their base image. Last week, I started working on cosign-action, a set of actions looking to simplify the process of using sigstore’s ‘cosign’ in GitHub workflows. So far this includes two actions - verify and sign. Verify The verify action can verify any image against either a …

Currently however, Fedora is not signing their container images, so that part of the chain isn’t locked down but it’s in progress, as soon as that’s available we’ll use it an post an announcement.