• 0 Posts
  • 38 Comments
Joined 1 year ago
cake
Cake day: June 9th, 2023

help-circle












  • Hi! Universal Blue co-maintainer here, here’s the TLDR. You’ve got the basic descriptions right, “Universal Blue” is mostly the parent organization that holds everything in github.

    We take Fedora’s Atomic OCI images and customize them for different use cases (Aurora, Bazzite, and Bluefin) and then publish base images so people can make their own versions of whatever they want. So if you wanted to take Silverblue, Kinoite, and make your own custom image you can mostly just grab whatever you want and shove it into an OS image. Bluefin started off as a “fix me” script for Silverblue that added all the stuff I wanted and then once I was shown what Fedora wanted to do with it the natural progression was to just make it a custom image. We just released 3.0 a few minutes ago actually!

    Basically in Fedora 41 the tech will become more widely available with official OCI base images and better tooling. We just decided to start way earlier in the process so we could get all the automation out of the way, build a community, get familiar with it, etc. Happy to answer any other questions you may have!



  • ublue co-maintainer here. I go over a bunch of the reasons here: https://www.ypsidanger.com/homebrew-is-great-on-linux/

    Namely we needed a way to complement Flatpak and brew was a natural fit. It’s an ecosystem reason not a technical one. It has everything we need and a good deal of Bluefin’s target audience are already using it on mac. So for us it’s an easier lift to just add homebrew and move on to larger problems.

    Plus it’s nice that they’re working with the openssf to secure the supply chain pipeline, and it’s nice that everything is in github where we can inspect it, use the same tooling we use for the OS, etc.






  • I’m not a security expert but I do know that the Homebrew is working with openssf on security: https://openssf.org/blog/2023/11/06/alpha-omega-grant-to-help-homebrew-reach-slsa-build-level-2/

    Boxkit predates wolfi so it’s still alpine, I’ll probably replace it at some point but most of the forks of boxkit are because people want the premade github actions and they end up replacing it with whatever distro they want anyway. The wolfi connection is because I know the people who work there (including a ublue maintainer) and we have similar goals/ideas on how linux distros should be put together. My ideal dream is a wolfi userspace systemd-sysext on top of fedora base, then we can have our cake and eat it too!

    We’re not security experts but lots of us work in the field and that gives us access to peer review from experts when we set things up. We sign every artifact with sigstore so users can verify that the code used in github is what’s on their image, that sort of thing. And most of our practices utilize CNCF governance templates that lots of other projects use.