A personal, signed Bluefin image for my workstation.
This is not a general-purpose distribution or an official Bluefin/Universal Blue image. It is a small set of reproducible customizations layered on top of the current stable Bluefin Nvidia image.
ghcr.io/iegorch86/precision-bluefin:stable
The image targets an NVIDIA-specific Bluefin-DX image.
- Brave Browser installed as a native RPM
- Seahorse password and key manager
- Simple Scan
- system-config-printer
The image installs:
gazegaze-guigaze-gnome-extension
The gazed.service system service is enabled.
The build deliberately does not run:
authselect select gaze
This avoids replacing the system-wide authentication profile. Gaze is intended for the graphical login and lock-screen workflow rather than changing every PAM authentication path.
The repository includes the vendor driver payload needed for the Pantum M6550NW and related Pantum models:
- CUPS filters and PPD files
- SANE scanner backends and configuration
- Pantum support files under
/opt/pantum libjpeg8compatibility support required by the existing vendor binaries
CUPS is enabled in the image. Scanner support is provided through SANE and Simple Scan.
The vendor-backup/ directory is retained only as a reference copy. It is not copied into the finished image.
From an existing Bluefin or compatible bootc system:
sudo bootc switch ghcr.io/iegorch86/precision-bluefin:stable
sudo systemctl rebootAfter rebooting, confirm the active deployment:
bootc statusTest the image on non-critical hardware before switching the primary family desktop.
Each successful build publishes several tags:
| Tag | Purpose |
|---|---|
stable |
Current recommended image |
upstream-<release> |
Marker for the matching Bluefin stable release |
stable-YYYYMMDD |
Build date |
stable-<git-sha> |
Source revision |
stable-YYYYMMDD-<git-sha> |
Date and source revision |
Example:
upstream-44.20260802
stable-20260804-d4c5249
The GitHub Actions workflow:
- Inspects the current
ghcr.io/ublue-os/precision-bluefin:stableimage. - Resolves its exact digest and version.
- Confirms that the stable Bluefin GitHub release and image version agree.
- Pins the build to that exact upstream digest.
- Builds and runs
bootc container lint. - Rechunks the image for more resumable updates.
- Publishes all image tags to GHCR.
- Signs the published digest with Cosign.
A scheduled check runs daily at 12:15 UTC. It skips rebuilding when the corresponding upstream-<release> marker already exists.
Pushes to main, pull requests, and manually dispatched runs use the current stable Bluefin digest. Markdown-only changes are excluded from automatic image builds.
The public signing key is stored in cosign.pub.
With Cosign installed, verify the published image with:
cosign verify \
--key cosign.pub \
ghcr.io/iegorch86/precision-bluefin:stableThe private cosign.key must never be committed. GitHub Actions receives it through the repository secret named SIGNING_SECRET.
Run the Justfile syntax checks:
just checkBuild the image locally with rootful Podman:
sudo podman build \
--pull=newer \
--tag precision-bluefin:test \
--file Containerfile \
.| Path | Purpose |
|---|---|
Containerfile |
Selects the Bluefin base and runs the image build |
build_files/build.sh |
Installs packages, services, and dependencies |
system_files/ |
Files copied into the immutable image |
vendor-backup/ |
Reference backup of the original Pantum configuration |
image-template.env |
Image name, description, registry owner, and default tag |
.github/workflows/build.yml |
Stable-release detection, build, publish, and signing workflow |
cosign.pub |
Public image-signing key |
Bluefin and Fedora bootable images may normally make /opt a symlink into mutable /var. Brave and the Pantum vendor payload store application files under /opt, so the Containerfile creates a real immutable /opt directory before applying the customizations.
The temporary COPR used for libjpeg8 is disabled again after package installation.
This image is built from and depends on:
Pantum driver files remain subject to the vendor's applicable terms. This repository is maintained for personal use and comes without warranty or official support from Bluefin, Universal Blue, Fedora, Pantum, or the other upstream projects.