Update build workflow and modules

.github/workflows/build.yml

@@ -34,25 +34,52 @@ jobs:
           - silverflow-nvidia-39.yml
 
     steps:
-      - name: Maximize build space
-        uses: ublue-os/remove-unwanted-software@v6
 
       # Checkout push-to-registry action GitHub repository
       - name: Checkout Push to Registry action
         uses: actions/checkout@v4
 
+      # Confirm that cosign.pub matches SIGNING_SECRET
+      - uses: sigstore/[email protected]
+        if: github.event_name != 'pull_request' && github.ref == 'refs/heads/live'
+
+      - name: Check SIGNING_SECRET matches cosign.pub
+        if: github.event_name != 'pull_request' && github.ref == 'refs/heads/live'
+        env:
+          COSIGN_EXPERIMENTAL: false
+          COSIGN_PASSWORD: ""
+          COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
+        shell: bash
+        run: |
+          echo "Checking for difference between public key from SIGNING_SECRET and cosign.pub"
+          delta=$(diff -u <(cosign public-key --key env://COSIGN_PRIVATE_KEY) cosign.pub)
+          if [ -z "$delta" ]; then
+            echo "cosign.pub matches SIGNING_SECRET"
+          else
+            echo "cosign.pub does not match SIGNING_SECRET"
+            echo "$delta"
+            exit 1
+          fi
+
       - name: Add yq (for reading recipe.yml)
-        uses: mikefarah/[email protected].4
+        uses: mikefarah/[email protected].5
 
       - name: Gather image data from recipe
         run: |
           echo "IMAGE_NAME=$(yq '.name' ./config/${{ matrix.recipe }})" >> $GITHUB_ENV
           echo "IMAGE_DESCRIPTION=$(yq '.description' ./config/${{ matrix.recipe }})" >> $GITHUB_ENV
           echo "IMAGE_MAJOR_VERSION=$(yq '.image-version' ./config/${{ matrix.recipe }})" >> $GITHUB_ENV
-          echo "BASE_IMAGE_URL=$(yq '.base-image' ./config/${{ matrix.recipe }})" >> $GITHUB_ENV
+          BASE_IMAGE=$(yq '.base-image' ./config/${{ matrix.recipe }})
+          echo "BASE_IMAGE_URL=$BASE_IMAGE" >> $GITHUB_ENV
+          echo "BASE_IMAGE_NAME=$(echo $BASE_IMAGE | sed 's/.*\/.*\///')" >> $GITHUB_ENV
           echo "IS_LATEST_VERSION=$(yq '.is_latest_version' ./config/${{ matrix.recipe }})" >> $GITHUB_ENV
           echo "IS_STABLE_VERSION=$(yq '.is_stable_version' ./config/${{ matrix.recipe }})" >> $GITHUB_ENV
 
+      - name: Verify base image
+        uses: EyeCantCU/cosign-action/[email protected]
+        with:
+          containers: ${{ env.BASE_IMAGE_NAME }}:${{ env.IMAGE_MAJOR_VERSION }}
+
       - name: Get current version
         id: labels
         run: |
@@ -128,6 +155,13 @@ jobs:
         with:
           string: ${{ env.IMAGE_NAME }}
 
+      - name: Maximize build space
+        uses: AdityaGarg8/remove-unwanted-software@v2
+        with:
+          remove-dotnet: 'true'
+          remove-android: 'true'
+          remove-haskell: 'true'
+
       # Build image using Buildah action
       - name: Build Image
         id: build_image
@@ -173,9 +207,6 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       # Sign container
-      - uses: sigstore/[email protected]
-        if: github.event_name != 'pull_request' && github.ref == 'refs/heads/live'
-
       - name: Sign container image
         if: github.event_name != 'pull_request' && github.ref == 'refs/heads/live'
         run: |

.github/workflows/release-iso.yml

@@ -18,7 +18,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Generate ISO  
-        uses: ublue-os/isogenerator@v2.2.0
+        uses: ublue-os/isogenerator@v2.3.1
         id: isogenerator
         with:
           image-name: ${{ github.event.repository.name }}

config/common_modules/scripts.yml

@@ -1,6 +1,4 @@
 type: script
 scripts:
   - signing.sh
-  - container-tools.sh
-  - udev-rules.sh
   - systemwide-themes.sh

config/files/usr/share/ublue-os/just/60-custom.just

@@ -1,4 +1,4 @@
-!include 100-bling.just
+import '100-bling.just'
 # Include some of your custom scripts here!
 
 # Run the yafti setup tool

config/silverflow-nvidia-39.yml

@@ -8,7 +8,6 @@ is_stable_version: true
 modules:
   - from-file: common_modules/files.yml
   - from-file: common_modules/rpm-ostree.yml
-  - from-file: common_modules/kmods-installer.yml
   - from-file: common_modules/bling.yml
   - from-file: common_modules/fonts.yml