Images

The catalog covers three Bluefin image families: Bluefin, Bluefin Classic (published by ublue-os), and Utah.

Bluefin

Bluefin stable and testing image streams.

Bluefin is a separate image track. Rebasing between Bluefin and Bluefin Classic is not supported.

Bluefin

AMDIntel

Package Page·Download ISO·Release Assets·Digest ddab2e2d8169

Project Bluefin Dakota image stream built with BuildStream.

Last validated: Sep 29, 2026 · Last published: Sep 29, 2026

Streams

Graphics Drivers

Add Nvidia driver?

STABLE

Use this command to switch to the stable channel for this image. It is the quickest way to stay on that release stream.

GNOME 51.0Linux 7.2.6Mesa 26.2.2Podman 6.1.0

sudo bootc switch ghcr.io/projectbluefin/dakota:stable --enforce-container-sigpolicy

TESTING

Use this command to switch to the testing channel for this image. It is the quickest way to stay on that release stream.

GNOME 51.0Linux 7.2.6Mesa 26.2.2Podman 6.1.0

sudo bootc switch ghcr.io/projectbluefin/dakota:testing --enforce-container-sigpolicy

Signing and SBOM

No published cosign key URL in this catalog.

Verify Signature

Signature verification confirms this image was signed by the expected maintainers and helps detect tampering before deployment. Learn more.

cosign verify --certificate-oidc-issuer https://token.actions.githubusercontent.com --certificate-identity-regexp '^https://github.com/projectbluefin/dakota/.github/workflows/' ghcr.io/projectbluefin/dakota:stable

Verify Provenance

Provenance attestation lets you validate how the image was built in CI so you can make trust decisions from evidence. Learn more.

cosign verify-attestation --type https://slsa.dev/provenance/v1 --certificate-oidc-issuer https://token.actions.githubusercontent.com --certificate-identity-regexp '^https://github.com/projectbluefin/dakota/.github/workflows/' ghcr.io/projectbluefin/dakota:stable

Inspect SBOM

When present, SBOMs are published alongside images as OCI referrers. Use oras to inspect attached artifacts and pull the SBOM for audits, policy checks, and vulnerability triage. Learn more.

oras discover ghcr.io/projectbluefin/dakota:stable

Bluefin Classic

Current Bluefin releases from ublue-os/bluefin.

Bluefin Classic

AMDIntel

Package Page·Download ISO·Release Assets·Digest 5f67a347cf49·OSTree 006cb5cdb9ad

Primary Bluefin desktop image for most systems.

Last validated: Sep 29, 2026 · Last published: Sep 29, 2026

Streams

Graphics Drivers

Add Nvidia driver?

STABLE

Use this command to switch to the stable channel for this image. It is the quickest way to stay on that release stream.

GNOME 50.3Linux 7.1.6-201.fc44Flatpak 1.18.0Mesa 26.1.4Podman 5.8.4

sudo bootc switch ghcr.io/ublue-os/bluefin:stable --enforce-container-sigpolicy

STABLE-DAILY

Use this command to switch to the stable-daily channel for this image. It is the quickest way to stay on that release stream.

GNOME 50.3Linux 7.1.6-201.fc44Flatpak 1.18.0Mesa 26.1.4Podman 5.8.4

sudo bootc switch ghcr.io/ublue-os/bluefin:stable-daily --enforce-container-sigpolicy

LATEST

Use this command to switch to the latest channel for this image. It is the quickest way to stay on that release stream.

GNOME 50.3Linux 7.1.6-201.fc44Flatpak 1.18.0Mesa 26.1.4Podman 5.8.4

sudo bootc switch ghcr.io/ublue-os/bluefin:latest --enforce-container-sigpolicy

Signing and SBOM

Key: https://raw.githubusercontent.com/ublue-os/bluefin/main/cosign.pub

Verify Signature

Signature verification confirms this image was signed by the expected maintainers and helps detect tampering before deployment. Learn more.

cosign verify --key https://raw.githubusercontent.com/ublue-os/bluefin/main/cosign.pub ghcr.io/ublue-os/bluefin:stable

Note: key-based signature verification of legacy .sig tags requires cosign v2.x (cosign v3+ defaults to OCI 1.1 referrers). Use the Verify Provenance tab for keyless OIDC verification on cosign v3+.

Verify Provenance

Provenance attestation lets you validate how the image was built in CI so you can make trust decisions from evidence. Learn more.

cosign verify-attestation --type https://slsa.dev/provenance/v1 --certificate-oidc-issuer https://token.actions.githubusercontent.com --certificate-identity-regexp '^https://github.com/ublue-os/bluefin/.github/workflows/' ghcr.io/ublue-os/bluefin:stable

Inspect SBOM

When present, SBOMs are published alongside images as OCI referrers. Use oras to inspect attached artifacts and pull the SBOM for audits, policy checks, and vulnerability triage. Learn more.

oras discover ghcr.io/ublue-os/bluefin:stable

Utah

Project Bluefin built with Fedora Hummingbird technology.

Project Bluefin Utah

AMDIntel

Package Page·Release Assets·Digest 992c8175a6cf

Project Bluefin Utah image stream built with Fedora Hummingbird technology.

Last validated: Sep 29, 2026 · Last published: Sep 29, 2026

Streams

Graphics Drivers

Add Nvidia driver?

TESTING

Use this command to switch to the testing channel for this image. It is the quickest way to stay on that release stream.

GNOME UnavailableLinux Unavailable

sudo bootc switch ghcr.io/projectbluefin/utah:testing --enforce-container-sigpolicy

Signing and SBOM

No published cosign key URL in this catalog.

Verify Signature

Signature verification confirms this image was signed by the expected maintainers and helps detect tampering before deployment. Learn more.

cosign verify --certificate-oidc-issuer https://token.actions.githubusercontent.com --certificate-identity-regexp '^https://github.com/projectbluefin/utah/.github/workflows/' ghcr.io/projectbluefin/utah:testing

Verify Provenance

Provenance attestation lets you validate how the image was built in CI so you can make trust decisions from evidence. Learn more.

Attestation verification command unavailable.

Inspect SBOM

When present, SBOMs are published alongside images as OCI referrers. Use oras to inspect attached artifacts and pull the SBOM for audits, policy checks, and vulnerability triage. Learn more.

oras discover ghcr.io/projectbluefin/utah:testing