My image is built here: https://github.com/pboling/galtzo/actions

➜  ujust update
note: automatic updates (stage) are enabled
Pulling manifest: ostree-image-signed:docker://ghcr.io/pboling/galtzo:latest
error: Creating importer: failed to invoke method OpenImage: failed to invoke method OpenImage: cryptographic signature verification failed: invalid signature when validating ASN.1 encoded signature

Initially I was trying to update my signing key, just to know how it was done, in case I needed to do it at some point. But ever since attempting it the images that get built are not able to be verified, and so

ujust update

refuses to upgrade my system, giving the error above. I have tried updating the key several times now, with the same result. I am following the instructions here: https://github.com/ublue-os/image-template?tab=readme-ov-file#container-signing I have the following version of cosign installed, as of the latest attempt:

➜  cosign version
  ______   ______        _______. __    _______ .__   __.
 /      | /  __  \      /       ||  |  /  _____||  \ |  |
|  ,----'|  |  |  |    |   (----`|  | |  |  __  |   \|  |
|  |     |  |  |  |     \   \    |  | |  | |_ | |  . `  |
|  `----.|  `--'  | .----)   |   |  | |  |__| | |  |\   |
 \______| \______/  |_______/    |__|  \______| |__| \__|
cosign: A tool for Container Signing, Verification and Storage in an OCI registry.

GitVersion:    2.5.3
GitCommit:     488ef8ceed5ab5d77379e9077a124a0d0df41d06
GitTreeState:  "clean"
BuildDate:     2025-07-17T19:56:47Z
GoVersion:     go1.24.5
Compiler:      gc
Platform:      linux/amd64

I have the following version of

gh

installed:

➜  gh version
gh version 2.74.2
https://github.com/cli/cli/releases/tag/v2.74.2

I don't know what else to try.

message has been deleted

When I verify the cosign.pub in the repo against the image:

➜  cosign verify --key cosign.pub ghcr.io/pboling/galtzo
setting TUF refresh period to 24h0m0s

Verification for ghcr.io/pboling/galtzo:latest --
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - Existence of the claims in the transparency log was verified offline
  - The signatures were verified against the specified public key

[{"critical":{"identity":{"docker-reference":"ghcr.io/pboling/galtzo"}...

It works! But it is unable to verify the image when updating for some reason.

Can you check if there is any diff between

/usr/etc/containers/policy.json

&

/etc/containers/policy.json

? If there is a difference, then copy the

/usr/etc/

version to

/etc/

and test if it fixes the issue.

@fiftydinar Hi, sorry for the delayed response, I was hiking in the mountains.

✗  diff /usr/etc/containers/policy.json /etc/containers/policy.json

There is no difference between the files. They are identical.