Search
Making containers bootable for fun and profit | bootc porject
For those unaware, bootc is a tool for in-place operating system updates using container images. bootc is used in Fedora CoreOS and will be used in Fedora Atomic eventually, slowly replacing rpm-ostree.
Why are these updates still shown to me?
original post: https://lemmy.world/post/16475168
I've activated automatic updates in Gnome Software Center. Now more and more updates are shown to me here. Even after a reboot, the update notifications are still there. If I manually click on "update all" and reboot, the update notifications disappear, but I actually thought, after reading the documentation, that updates would require no action from me at all, and that's what I want.
The weird thing is, the installed programs themselves claim to already be on the new, updated version. So why are the updates still shown in the Software Center?
Various issues with Fedora 40 KDE spin
Hi all,
Edit: I use the KDE spin of Fedora 40 (updated after I posted this) and have a Windows 10 partition. However, I am not able to boot into Windows as it doesn't show up in GRUB.
I've been encountering some frustrating issues with my Fedora Linux installation and I'm hoping someone here might be able to offer some guidance or solutions. I'm gonna post them all in this thread - please tell me if I should break each issue into individual
-
Time Setting: I've noticed that my system time doesn't seem to be setting correctly, even when I have automatic time synchronization enabled. The time in my BIOS is correct. Even when I try to set the time manually, it reverts back to the wrong settings.
-
Persistent Wi-Fi Password Prompts: Despite having saved my Wi-Fi password in the connection settings within KDE, I'm constantly being asked to re-enter it every time I connect. It's a bit of a hassle, My credentials are saved.
-
Browser Rendering Issues: When using both Chrome and Firefox on Fedora, I've noticed that certain websites, like Arduino.cc, don't load images or schematics properly. For example, when I try to access https://docs.arduino.cc/built-in-examples/basics/Blink/ the images fail to load. Strangely, I don't encounter this problem when using the same browsers on my Windows desktop. I have also tried to start Firefox in "fail safe" mode without addons enable but it does not make solve the issue.
-
Dual Boot Trouble: During the installation process, I managed to break my dual boot to Windows, which didn't happen when I initially tried out Linux Mint. The Linux Mint installer automatically managed to make my system dual boot through GRUB. However, I probably messed up in the Fedora installation process, and now I don't know how to fix it.
-
Driver Discovery: Despite enabling RPM Fusion for the Nvidia Driver, I cannot find the driver in the Discover app. Is there a step I might be missing, or a different approach I should take to locate and install the Nvidia driver?
My hwinfo, using hwinfo --short:, removed keyboard, mouse etc.
``` cpu:
11th Gen Intel(R) Core(TM) i7-1185G7
graphics card:
nVidia TU117M [GeForce MX450]
Intel TigerLake-LP GT2 [Iris Xe Graphics]
sound:
Intel Tiger Lake-LP Smart Sound Technology Audio Controller
storage:
Samsung Electronics NVMe SSD Controller PM9A1/PM9A3/980PRO
network:
wlp0s20f3 Intel Wi-Fi 6 AX201
enp0s31f6 Intel Ethernet Connection (13) I219-LM
network interface:
enp0s31f6 Ethernet network interface
lo Loopback network interface
wlp0s20f3 Ethernet network interface
disk:
/dev/nvme0n1 Samsung Electronics NVMe SSD Controller PM9A1/PM9A3/980PRO
/dev/zram0 Disk
partition:
/dev/nvme0n1p1 Partition
/dev/nvme0n1p2 Partition
/dev/nvme0n1p3 Partition
/dev/nvme0n1p4 Partition
/dev/nvme0n1p5 Partition
/dev/nvme0n1p6 Partition
/dev/nvme0n1p7 Partition ```
Weekly Updates from Fedora's Marketer ‒ Week 1
re-publicado de: https://lemmy.ml/post/10758642
> Hey guys, I've finally started exploring talking about the work I'm doing with the Fedora Project as part of the marketing team and now as part of the design and magazine teams too! I really enjoy the "This Week in" style of weekly reports on all the work that is being done, so I'm looking forwards to sharing it like that! > > I'm also pushing to get this officially in the project (for more teams to do this weekly/monthly report) so we can actually create a project-wide newsletter, something at least akin to a This Week in Fedora, and I'd really appreciate your feedback.
.local resolution not working on fedora minimal install
I can't resolve (ping, ssh) any computer on my network from a newly installed minimal Gnome Desktop F39 on a laptop; since it's minimal, it's possible something's missing from the installation.
trying from the laptop gives:
$ ping server.local ping: server.local: Temporary failure in name resolution
pinging .box static DNS entries as well as IP addresses works. all other computers can resolve each other and the new laptop (1 debian, 1 fedora, 1 macOS), some have static, some dynamic IPs. they all get the DNS IP of my pi-hole, which resolves everything fine. resolve.conf and all other relevant files are stock. avahi and systemd-resolve are running and report no issues. same behaviour with WiFi and LAN.
I could switch to static IPs and assign e.g. .box suffixes all around via local DNS but I don't want to do that, this setup is/was working on every other PC.
any ideas what I'm missing?
edit: just booted off of a live USB with F39, resolves server.local just fine. so I'm missing something in my installation, right?
edit II: installed it (minimal) on another laptop, same deal - no .local resolution.
Bazzite
Is Bazzite what one would call an "immutable" OS? I found this part of the FAQ but am still unclear as my understanding isn't very deep.
Happy 20th birthday (https://fosstodon.org/@fedora) (https://lemmy.ml/c/fedora)
Happy 20th birthday @[email protected] @[email protected]
https://listman.redhat.com/archives/fedora-announce-list/2003-November/msg00000.html
and 39 is out tommorow
Why journald isn't auto completing my user .service?
Hello!, so i have 2 services in my .config/systemd/user
one of them is named flatpak-update.service
, and the other find-and-delete.service
.
When i write journalctl --user-unit flatpak
it autocomplete like any other command in bash, but if i try the same with journalctl --user-unit find
it don't autocomplete, as the service didn't exist, but if i type journalctl --user-unit find-and-delete.service
i list the service logs as normal, why it isn't autocompleting the name?, thank for any answer or suggestion
Werte Kollegen. Habe bei einem Freund (https://social.tchncs.de/tags/Fedora) 38 Workstation installiert, lief auch alles soweit einwandfrei. Nur Firefox zickt herum. Nach gefühlten 5 Sek. kom
Werte Kollegen. Habe bei einem Freund #Fedora 38 Workstation installiert, lief auch alles soweit einwandfrei. Nur Firefox zickt herum. Nach gefühlten 5 Sek. kommt die Meldungen: Anwendungen reagiert nicht, warten oder beenden. Brave läuft, Librewolf läuft, Firefox nicht !? hat jemand von euch eine Idee an was das liegen könnte ? \#fedora #fedora38 #linux @[email protected] @[email protected] @[email protected] @LinuxGuides @linuxlads
Flatpak install/update fails with “Need more input” or “Input buffer too small”
Problem When updating your flatpak apps… as of yesterday’s update of libostree, it won’t work. You’ll see some errors like Writing content object: Need more input. Cause ostree was updated, including libostree. There’s some change that broke flatpak’s ability to update packages. Related Issues ...
Resolved: ostree 2023.4-2 (as linked in the comments below) has been pushed to stable, updating your system will resolve the issue.
Tl;dr: There seems to be a bug in ostree-libs 2023.4
that causes errors when trying to update flatpaks, gnome software loads forever when trying to update a flatpak and manually running flatpak update
shows errors (I was getting an "input buffer too small" error, others seemed to be getting errors like "Need more input".)
Running sudo dnf downgrade ostree
worked perfectly for me, I'll be ignoring the ostree/ostree-libs update for now and hopefully the issue will be resolved soon.
Hello people posting nostalgic screenshots of CDE and whatnot. You have checked the accessability settings in Gnome haven't you?
Hello people posting nostalgic screenshots of CDE and whatnot. You have checked the accessability settings in Gnome haven't you?
Accessability isn't only for people with disabilities. It also helps people with good taste.
Using Fedora CoreOS, how can I add secrets to podman systemd services?
Like the title says, does anyone know how to give systemd services a secret?
For example: postgresql.bu
``` variant: fcos version: 1.4.0 storage: directories: - path: /opt/services/postgres/data overwrite: true mode: 0755 systemd: units: - name: postgres.service enabled: true contents: | [Unit] Description=The PostgreSQL object-relational database system Wants=network-online.target After=network-online.target
[Service] Type=notify NotifyAccess=all Restart=on-failure RestartSec=60 ExecStartPre=-/bin/podman kill postgres ExecStartPre=-/bin/podman rm postgres ExecStartPre=/bin/podman pull docker.io/library/postgres:15 ExecStart=/bin/podman run --name postgres \ --volume /opt/services/postgres/data:/var/lib/postgresql/data:z \ --env POSTGRES_USER=admin \ --env POSTGRES_PASSWORD=admin \ --env POSTGRES_DB=admin \ --replace --sdnotify=conmon \ --publish 0.0.0.0:5432:5432/tcp \ --restart=unless-stopped \ --log-level info \ docker.io/library/postgres:15
[Install] WantedBy=multi-user.target
```
If that is my SystemD unit file, can I replace:
env POSTGRES_PASSWORD=admin
with a value that is discovered at runtime?
(https://www.youtube.com/watch?v=w7f9eIZ10w8)
https://www.youtube.com/watch?v=w7f9eIZ10w8
Watching the first @[email protected] @[email protected] Video podcast #youtube #fedora #podcast #video #nowwithvideo
FFmpeg will be part of Fedora's official repos with Fedora 36
Due to licensing issues, ffmpeg and its encoders/decoders were always a pain point to new users on Fedora (and it will still require some manual intervention to get everything working correctly due to those licensing issues), BUT it's halfway there now, because ffmpeg is finally coming to the main repos of the distro, with the codecs that they are able to provide without potential legal trouble.
See here a list of supported decoding and encoding codecs.
You'll notice a lack of H264 decoders there. That's the main pain point I was talking about. You'll still need RPMFusion to get it, but for most other cases you'll be able to get it directly from the repos.
PSA: If you have a LUKS encrypted system and a TPM2 chip, you can put it to good use
One of the main things that put people off having a LUKS encrypted system is having to input the LUKS password on every boot, even if it brings a lot more safety to your system to do so. So, what if I told you that there's a way to have your encryption cake and eat it too? TPM2 is the answer.
Using it you can have your system be automatically decrypted at boot with no need for inputting your password without losing on the security, as it detects if there are any significant changes to your system in order to block it (although I'm not technical enough to explain it properly).
There's a relatively easy way to do so in other distros that use mkinitcpio for building the system's initramfs (I even have an Arch Linux install guide using it), but fedora uses dracut for the same task, and I couldn't find a way to do so with it. Until now.
Thanks to u/ditto for pointing me out to the mailing list page with the steps provided here and to Ulf Volmer in said mailing list for the step-by-step guide on how to do it.
So, are you ready?
---
First of all, you need to check if you actually have a TPM2 chip, just to make sure. To do that, run cat /sys/class/tpm/tpm0/device/description
or cat /sys/class/tpm/tpm0/tpm_version_major
. You'll get a result showing your TPM2 chip if you have one working. So, if you do, time to use it.
After that, run lsblk
to make sure which partition houses your LUKS container.
-
Run
systemd-cryptenroll --tpm2-device=auto /dev/$DEVICE
, where $DEVICE is your partition where your LUKS encryption rests (in my case /dev/sda3). -
After that, edit
/etc/crypttab
, making it look something like this:
luks-$UUID UUID=$UUID - tpm2-device=auto,discard
I'll reference it as (part1) (part2) (part3) (part4) for an easier understanding of the file's contents
The changes you'll do in this case is changing part3 to -
and adding tpm2-device=auto
to part4.
After that, make dracut aware of the tpm2 by creating the /etc/dracut.conf.d/tss2.conf
file, with its contents being the following:
install_optional_items+=" /usr/lib64/libtss2* /usr/lib64/libfido2.so.* "
After that, recreate the initramfs by running sudo dracut -f
and reboot your system. If everything went correctly, your system should automatically boot without the need to input your LUKS password.
PSA: NVIDIA drivers and Secure Boot are not mutually exclusive anymore, and here's how to finally do it
Here's how to automatically sign NVIDIA Kernel module in Fedora to make it more convenient to use with Secure Boot enabled.
I've been using Fedora for the best part of 4 months now, and one of the only gripes I had with the distro is that there wasn't a way to automatically sign the NVIDIA kernel modules after each update, so users like me needed to either disable secure boot (which I could do, but didn't want to because I'm stubborn and managed to make it work in every other distro I used) or manually sign the kernel modules after each driver and kernel update (which I made easier with a small script, but it still required basically two reboots and a bit of time).
Not. Anymore.
The process is made dead simple with the signed versions of kmodtool and akmods provided by Elia's COPR repos. Just follow the guide and boom, you're done. It'll take less than 5 minutes.
The only catch is that, if you already have a kmod built for your kernel version you'll have to rebuild it or uninstall the NVIDIA drivers and then reinstall them, which will do the same thing.
And now for the news.
The process gets even simpler in Fedora 36!
The patches applied to these packages in the COPR repos are merged upstream and will (if all goes well) be there with 36's release (the related Bugzilla was closed for Rawhide last December, so all you'll need to do is generate, sign and enroll your keys and then move them to the right location before installing the NVIDIA drivers / rebuilding your kmod modules.
I decided to make this PSA because I literally found their blog post by accident after 4 months of looking for a way to do this, so at least now more people will be aware of it.
Chromium maintainer for Fedora has disabled Sync and Google Sign-In support right now
> Google has announced that it is cutting off access to the Sync and "other Google Exclusive" APIs from all builds except Google Chrome. > > [...] They're not closing a security hole, they're just requiring that everyone use Chrome. > >Or to put it bluntly, they do not want you to access their Google API functionality without using proprietary software (Google Chrome). There is no good reason for Google to do this, other than to force people to use Chrome.
More info (Google's shitty explanation/justification): https://groups.google.com/a/chromium.org/g/chromium-packagers/c/SG6jnsP4pWM (Mirror)
Oh it was hard. FYI Fedora supports a major version for a year. To upgrade from non-supported old version, additional steps may be required:
- https://en.wikipedia.org/wiki/Fedora_Linux#Releases
- Can I upgrade from an End Of Life (EOL) release?
I hope you could solve the new issue too.
You won't HAVE to, but it might make it easier at first. The kernel module for the drivers simply needs to be signed and then secure boot will be happy. I've done it for debian before but can't find the exact piece of documentation explaining how to sign the kernel module.
Edit: Debian Guide
@senectus Why should it be more complicated than dnf group install […]
and maybe dnf group uninstall […]
?
If I were you I would ask in [email protected]
Silverblue has Firefox installed as an RPM.
There are multiple ways to add the missing codecs, the easiest one is to add the rpmfusion RPMs, reboot and install libavcodec-freeworld
.
So I suppose you have the Flatpak AND the RPM installed. I would recommend the Fedora RPM, it works great and is really fast.
Also, you get more answers on discussion.fedoraproject.org
The Signal one will just be a metadata issue.
flatpak update -y
kill -9 gnome-software
pkcon refresh
Checking inside /usr/lib/kernel/install.d/
, you can see the mechanisms in place for installing new kernel entries. Not knowing what you did to your config (did you back it up before making changes?), you should check if the entries are being populated properly in /boot/loader/entries/
. If they are, you have likely toyed with the BLS config in some way that broke being able to load dynamic entries without mkconfig.
If that is indeed the case, I wouldn't know exactly what you touched to break it, but this discussion forum might give some insight.
If this isn't the problem, it might be helpful to post your grub config minus any sensitive details to help determine what is going wrong.
The main ublue variants (bluefin/aurora, bazzite) use ublue-update for updating.
This fixes many issues like not updating on metered connections or on low battery.
Have a look in there, maybe you can hook a notify-send -t 0 -a "Update" "Update finished" "reboot any time to apply them"
The -t 0
makes the message stay there forever until clicked. Otherwise you can enter a number in seconds.
You could also open a PR in their ublue upate. They dont want update messages as normies never update manually. So a config could enable this message opt-in.
You may find more help on https://discussion.fedoraproject.org
First: please mention "I am dual booting the Fedora KDE spin with Windows" at the top, to make things clearer :)
But lets see.
1.
It's e the time in my BIOS is correct.
Dont understand that sentence. But this may be a typical windows thing, as Windows is changing the BIOS time to the one used, while Linux normally keeps the BIOS time normal and uses the offset (like UTC+3).
Have a look at this page, ItsFoss is awesome
timedatectl set-local-rtc 1
2.
This sounds like a KDE Wallet issue.
Under systemsettings, see your KDE Wallet settings. Do you have a wallet set as default, that was created by default?
The default wallet uses your login password and gets opened with the login from SDDM. If you changed your login password, or something else, this doesnt work.
In the network settings, did you select "save password for this user (encrypted)" or "save password for all users (unencrypted)"? For wifi passwords you could use that as a fallback, its actually more secure in some scenarios afaik, as only plasma can read it.
3.
You are using an nVidia card, did you install any drivers? Nvidia didnt care for linux way too long. You may want to install them manually.
As your system is fresh, and as you need Nvidia drivers, I highly recommend switching to universal blue. Their kinoite-nvidia
image has all the drivers and settings, and if something breaks, it is at their end and you will not get the update.
I really cant recommend some hacky way to install the drivers, blacklist nouveau, enable the drivers etc.
I use kinoite-main daily, it is awesome. Atomic/image based Fedora is way better.
Note though that dualbooting is not as easy it seems.
(The rpm-ostree variants are now called "Atomic Desktops" but not long, in the past the GNOME "Fedora Silverblue" was the most dominant)
4.
Linux Mint uses legacy boot and is not secureboot compatible. Fedora should actually cause less problems.
Search on Fedora Discuss, this is also a common problem with a fix.
5.
Discover only shows graphical apps, you install it from the Terminal (Konsole).
But as I said, I do not recommend installing NVidia drivers on your own on Fedora, as it has too many updates and sometimes drivers break. This happens way too often.
Also to use them you will need to make some more small changes to some files, it is not complex but a few steps.
I recommend kinoite-nvidia by ublue, or as ublue has this as their main variant, Aurora:
-
If you dual-boot into Windows, that's probably what sets the time. Linux expects the time in the BIOS to be set to UTC by default, Windows does not. You can change some registry entry in Windows so it uses UTC as well.
-
Might be related to 5.
-
Discover is (mostly) for GUI applications. Follow this guide to install the NVIDIA driver.
@Enragedzeus @possiblylinux127 It semms like you are confusing Fedora 38 with 39.
The best. Checkout the rpm-ostree variants.
A few things Fedora centers itself around:
- Wayland-oriented Workstations
- SELinux support OOTB
- BTRFS as default filesystem
- General attitude toward using close to bleeding edge packages as defaults
- Package order of Fedora rpm repos, Fedora Flatpak -> RPMFusion, Flathub -> copr -> external installation
- Immutable variants of Fedora exist for the major desktops
Fedora generally prides itself on being a Wayland-focused and oriented workstation distro. There is still active support for desktop environments/window managers that run on Xorg, but you should consider moving toward a Wayland-supporting environment (Gnome, KDE, Sway, Hyprland).
SELinux (a Mandatory Access Control system) is enabled by default and has pretuned policies installed that should support most use cases out of the box. SEApplet is a useful utility to find active SELinux denials in case an application is getting permission denied issues for seemingly no reason.
If you intend to use BTRFS as your filesystem of choice and want to utilize it to its fullest (encrypted partitions, subvolume encryption, automatic snapshots), it is best to read up how BTRFS and subvolumes work before partitioning so that your subvolumes will be correct the first time. It can be tedious to edit subvolumes, move their contents, and remount portions of the filesystem after they have already been populated.
I'm sure you're used to how things on Arch with bleeding edge works, and understand that on Arch you should always read patch notes before updating. Generally, updates on Fedora are fine to just push through. It is worth generally reading what is new when performing system upgrades to a new version of Fedora, I have noticed occasionally in over five years of usage the first target release of a new version of Fedora can sometimes have breakages that tend to get fixed within the next couple of weeks. There is extensive testing for system upgrades that can be openly viewed, but the testing doesn't always catch everything before a new release.
By default, the best way to grab packages on Fedora is from the official repos or from the Fedora Flatpaks. Barring that or if you aren't satisfied by a default package for whatever reason (some stuff in default repos doesn't have ffmpeg support or others due to codec licensing issues), you can add the second-party RPMFusion repos or add Flathub to grab additional or alternative packages as well. If those avenues fail, you might be able to find someone maintaining the package you need or want to test on Copr, which is essentially like Ubuntu's Launchpad PPA platform. Barring all else, you could manually install a given application externally, though obviously this typically isn't the best solution in most cases. Some cases where you might want RPMFusion packages are for things like audacity-freeworld
, which includes proper ffmpeg support for Audacity. This package comes from rpmfusion-free. Or you might want something like akmod-nvidia
to install the proprietary NVidia drivers or steam
to install Steam. These packages come from rpmfusion-nonfree. Also, if you are not familiar with Flatpak, it might be worth becoming familiar with how it works (Flatseal is an excellent application that lets you modify how certain Flatpaks are sandboxed).
Immutable variants of Fedora (Silverblue, Kinoite, Sway Atomic, Budgie Atomic) also exist and provide an immutable base image that won't typically get modified across boots. Most of the custom user installation of programs is intended to be installed via Flatpaks (Fedora or Flathub) or through using toolboxes to create sandboxed environments for certain workflows. If you absolutely need to rebase the system image with extra utilities, rpm-ostree is available to modify the system package selection, though this method is not recommended to just be used to install everything (needless rebasing of the immutable image defeats the point of using an immutable distro). Obviously these spins aren't for everyone, but are there for those who want to use them.
My first two concerns are: -I can't find any software that can manage my NZXT 240 correctly I found Cooler Control which depends on liquidctl But there's an open ticket that won't be solved right away. -I have a problem with Falthub, I have the Fedora dependences but it's not up to date compared to what you can find on Github. -Gwenview or Gthumb don't want to play my videos.
And I have other worries but for the moment that's all I have in mind
This is the best summary I could come up with:
After not being ready in time for this week's early release target date, it's now been determined today that Fedora 40 is ready for release next week.
At today's Go/No-Go meeting, it was determined that Fedora Linux 40 Final RC1.14 meets all the release criteria with no blocker bugs remaining and thus declared a "GO" for release next week.
Fedora 40 thus will see its official release happen next Tuesday, 23 April.
Fedora Linux 40 features the GNOME 46 desktop components, the shiny new KDE Plasma 6.0 desktop will be available, the Linux 6.8 kernel is powering this beast, and a plethora of software package updates like LLVM 18 along with various exciting features.
Meanwhile set for release next Thursday, 25 April, is the Ubuntu 24.04 LTS release.
A busy week ahead for Linux distributions and more Phoronix benchmarks to come.
The original article contains 141 words, the summary contains 141 words. Saved 0%. I'm a bot and I'm open source!
This is the best summary I could come up with:
The Fedora Engineering and Steering Committee (FESCo) on Monday approved some last-minute features ahead of the Fedora Linux 40 release quickly coming up in February.
-
A new tool for Fedora IoT called "Simplified Provisioning" that makes it easier to deploy and configure the Fedora Internet of Things (IoT) edition.
-
Fedora IoT will now be built using the RPM-OSTree unified core.
-
As for the recent debate around Fedora 40 dropping KDE X11 by default, FESCo has offered their latest guidance.
At the meeting they decided that KDE packages may reintroduce support for X11 are allowed in the main Fedora repositories but that they must not be included by default for any release-blocking deliverables like the ISO/image, etc.
More details on this week's FESco rulings can be found via the Fedora mailing list.
The original article contains 269 words, the summary contains 134 words. Saved 50%. I'm a bot and I'm open source!
check the GRUB_CMDLINE_LINUX
key in /etc/default/grub
it should contain the info about any subvolume. if it does not then there might be another grub config hook that is used by Fedora to add that info.
If you want to be able to change subvol names without having to touch the grub config you might also want to switch to using subvolid
instead of subvol
keys on the kernel command line, because the id will stay the same after a rename (this could backfire though if you assign functions to certain names like "fallback" etc.).
Edit: found the hook that adds the kernel command line option for btrfs subvolumes. in /etc/grub.d/10_linux
there is this bit of code:
case x"$GRUB_FS" in
xbtrfs)
rootsubvol="`make_system_path_relative_to_its_root /`"
rootsubvol="${rootsubvol#/}"
if [ "x${rootsubvol}" != x ]; then
GRUB_CMDLINE_LINUX="rootflags=subvol=${rootsubvol} ${GRUB_CMDLINE_LINUX}"
fi;;
xzfs)
[skipped for brevity]
;;
esac
so it seems it is always looking at the subvol name of the currently mounted root fs.
- Does Silverblue being immutable has an effect on security, or is it more about stability and reliability?
It should also be more secure. The fact that your install is the same as thousands of others, including the devs', and that updates get patched as a whole, makes it more secure due to the reproducibility you mentioned.
If the devs notice a flaw, it will also be on every other install and fixed immediately.
In theory, malicious actors also can't modify the (live) system, but I can't make a statement about that.
You can also take a look at SecureBlue if security is very important to you.
Updates get installed automatically and staged, so you can just boot into a fresh and updated image every day when shutting off the PC before bed without even noticing :)
- Is it possible to have Nvidia drivers with Secure Boot on Silverblue, and how?
Go to universal-blue.org and select your wanted image there. They have a Nvidia-image for every variant, where the drivers are already baked into the base image.
They support Secure Boot, and if the driver breaks, which it shouldn't, because then thousands others would do that too, you can just select yesterday's image and don't have to worry about fixing something. Your OS will always boot and be usable!
Take a look at my post for further information: https://feddit.de/post/8234416
I use deja dup because I have a lot of useless (unencrypted) storage from organisations. Deja dup backs up my data in an encrypted and easy to use fashion. It is a gnome app but I use it in KDE.