Secureblue generates SLSA build provenance for its images, and verifies provenance client-side before downloading and installing updates. This improves security by verifying that the uploaded container images were in fact generated by the GitHub Actions workflows in the repo, therefore protecting against a scenario with compromised credentials being used to push a malicious container image.
Some secureblue functionality, including automatic system updates and the optional upgrade-on-boot feature, do this provenance verification and will be broken if build provenance isn't available. Provenance verification is done in a script located at /usr/libexec/secureblue/verify-provenance.sh; if you add build provenance, you'd also need to patch this script in the kinoite-hardened variant to change a couple lines to refer to your container registry and source repo: https://github.com/secureblue/secureblue/blob/4e5ca77124601c06f737ca171acab9f2bca35081/files/system/usr/libexec/secureblue/verify-provenance.sh#L15-L16
(Alternatively, you could replace that script with a stub to disable provenance verification; this is a security degradation, but is still preferable to automatic updates not working.)
Secureblue generates SLSA build provenance for its images, and verifies provenance client-side before downloading and installing updates. This improves security by verifying that the uploaded container images were in fact generated by the GitHub Actions workflows in the repo, therefore protecting against a scenario with compromised credentials being used to push a malicious container image.
Some secureblue functionality, including automatic system updates and the optional upgrade-on-boot feature, do this provenance verification and will be broken if build provenance isn't available. Provenance verification is done in a script located at
/usr/libexec/secureblue/verify-provenance.sh; if you add build provenance, you'd also need to patch this script in the kinoite-hardened variant to change a couple lines to refer to your container registry and source repo: https://github.com/secureblue/secureblue/blob/4e5ca77124601c06f737ca171acab9f2bca35081/files/system/usr/libexec/secureblue/verify-provenance.sh#L15-L16(Alternatively, you could replace that script with a stub to disable provenance verification; this is a security degradation, but is still preferable to automatic updates not working.)