Make Ostree allow to upgrade only signed commit & rejects unsigned commit

[bhaijiyunus]

Hello Experts,

Is there any way to configure ostree to allow to upgrade only signed commit & rejects the unsigned commit on embedded Linux based device?

On device, currently ostree upgrading signed & unsigned commits both but the requirement is ostree should upgrade only signed commits on the device.

Appreciate you help. Thanks.

Regards,
jbhaijy

[dbnicholson]

Currently ostree assumes that any commit in the repo has been validated and can be checked out. So, the typical way is to enable verification for pulling so that you never get untrusted content in the first place

It might be nice to have an option to verify on checkout, though.