Check the image and its signature

The image the machine follows

On the installed machine, run:

bootc status

The image followed must be ghcr.io/tekkengreg/indiga:latest, as a signed reference:

ostree-image-signed:docker://ghcr.io/tekkengreg/indiga:latest

What the installation put on the disk is the image carried by the ISO, that is latest as of the day the ISO was built. The machine catches up with the rest through its updates.

The signature

The machine accepts an image from ghcr.io/tekkengreg/indiga only if its signature is valid for the key /etc/pki/containers/indiga.pub. Images from other registries are still accepted, as on Fedora Silverblue.

The signature is not verified during the installation. The first real verification is the first bootc upgrade, or, to verify without applying anything:

sudo bootc upgrade --check