I recently discovered an issue with container signature verification in Soltros OS. The problem? My policy.json configuration wasn't keeping up with the growing family of image variants. If you've been hitting issues with rpm-ostree or Distrobox, this is why—and here's how I fixed it.

What Went Wrong

Soltros started with a single image: soltros-os. My policy.json was configured to verify signatures for that specific image path. Simple enough.

Then I added more variants: soltros-os_lts, soltros-lts_cosmic, soltros-unstable_cosmic, and GNOME editions. Each new variant got its own image path. But the policy file? Still only knew about the original image.

The result: rpm-ostree was pulling images with ostree-unverified-registry in the status output. Signature verification wasn't happening. And for some users, Distrobox was getting blocked by overly strict policies that shouldn't have applied to third-party container images.

The Fix

I've updated policy.json to properly handle all Soltros image variants while keeping Distrobox and other container tools working smoothly. The new configuration does three things:

For Users: Emergency Fix Script

If you're experiencing issues right now, I've released an emergency fix script. Download and run it: 

curl -sSL https://raw.githubusercontent.com/soltros/Soltros-OS-Components/refs/heads/master/emergency-policy-fix.sh -o fix-policy.sh
chmod +x fix-policy.sh
sudo ./fix-policy.sh

The script backs up your existing configuration, installs the corrected policy, and verifies everything is working. It's safe to run—if anything goes wrong, it automatically rolls back to your backup.

What Changed in the Build

Future Soltros images will ship with the correct policy.json from the start. I've updated my Containerfile to include signature verification policies for all current image variants:

Each image gets verified with the Soltros public key at /etc/pki/containers/soltros.pub. Everything else—Fedora base images, Ubuntu containers for Distrobox, whatever you need—works without verification requirements.

Why This Matters

Container signature verification isn't just security theater. When it works correctly, it ensures the OS image you're running actually came from me and hasn't been tampered with. But when it's misconfigured, it either fails silently (bad) or blocks legitimate use cases (also bad).

The balance I'm aiming for: verify what needs verification (Soltros system images), stay out of the way for everything else (your development containers, Distrobox environments, whatever else you're running).

Moving Forward

This is part of the learning process with an immutable OS. Policy files need to evolve alongside the distribution. I'm still figuring out the best way to handle this. Maybe there's a better approach than manually listing every image variant.

If you hit issues after running the fix script, or if you're seeing something I missed, let me know. I'm on GitHub and responsive to issues.

Soltros OS is still early. Problems like this are going to happen. But I'm committed to fixing them quickly and keeping the system reliable for the people using it.