[Content]
Ssh=yes
SshKey=/home/pbonzini/.ssh/id_rsa
Autologin=yes
‣ Could not provision user namespace via systemd-nsresourced ([Errno 2] No such file or directory), falling back to unprivileged user namespace via unshare(CLONE_NEWUSER) and writing /proc/self/uid_map directly
‣ Removing output files of main image…
‣ Acquiring lock on /home/pbonzini/mkosi/image
‣ Acquired lock on /home/pbonzini/mkosi/image
‣ + rm -rf -- /work/home/pbonzini/mkosi/image /work/home/pbonzini/mkosi/image.raw
‣ 0.1s for step "Removing output files of main image…"
‣ Validating certificates and keys
‣ 0.0s for step "Validating certificates and keys"
‣ + /usr/bin/systemd-repart --version
‣ Version reported by /usr/bin/systemd-repart is 257-23.el10-gf9c70df
‣ + cp --recursive --no-dereference --preserve=mode,links,timestamps,ownership,xattr --reflink=auto --copy-contents /work/usr/share/crypto-policies/back-ends/DEFAULT /work/var/tmp/mkosi-workspace-9zplxmhg/sandbox/etc/crypto-policies/back-ends --no-target-directory
‣ Syncing package manager metadata
‣ + dnf --assumeyes --best --releasever=10 --installroot=/buildroot --setopt=keepcache=1 --setopt=logdir=/var/log --setopt=cachedir=/var/cache/dnf --setopt=install_weak_deps=0 --setopt=check_config_file_age=0 --setopt=persistdir=/buildroot/var/lib/dnf --setopt=debuglevel=10 --config=/etc/dnf/dnf.conf --setopt=reposdir=/etc/yum.repos.d --setopt=varsdir=/etc/dnf/vars --setopt=proxy_sslcacert=/proxy.cacert makecache
timer: config: 0 ms
Loaded plugins: builddep, changelog, config-manager, copr, debuginfo-install, download, generate_completion_cache, groups-manager, kpatch, needs-restarting, notify-packagekit, playground, product-id, repoclosure, repodiff, repograph, repomanage, reposync, subscription-manager, system-upgrade, uploadprofile
Updating Subscription Management repositories.
Unable to read consumer identity
This system is not registered with an entitlement server. You can use subscription-manager to register.
DNF version: 4.20.0
Command: dnf --assumeyes --best --releasever=10 --installroot=/buildroot --setopt=keepcache=1 --setopt=logdir=/var/log --setopt=cachedir=/var/cache/dnf --setopt=install_weak_deps=0 --setopt=check_config_file_age=0 --setopt=persistdir=/buildroot/var/lib/dnf --setopt=debuglevel=10 --config=/etc/dnf/dnf.conf --setopt=reposdir=/etc/yum.repos.d --setopt=varsdir=/etc/dnf/vars --setopt=proxy_sslcacert=/proxy.cacert makecache
Installroot: /buildroot
Releasever: 10
cachedir: /buildroot/var/cache/dnf
Base command: makecache
Extra commands: ['--assumeyes', '--best', '--releasever=10', '--installroot=/buildroot', '--setopt=keepcache=1', '--setopt=logdir=/var/log', '--setopt=cachedir=/var/cache/dnf', '--setopt=install_weak_deps=0', '--setopt=check_config_file_age=0', '--setopt=persistdir=/buildroot/var/lib/dnf', '--setopt=debuglevel=10', '--config=/etc/dnf/dnf.conf', '--setopt=reposdir=/etc/yum.repos.d', '--setopt=varsdir=/etc/dnf/vars', '--setopt=proxy_sslcacert=/proxy.cacert', 'makecache']
Configuration file /etc/dnf/plugins/subscription-manager.conf does not exist.
Making cache files for all metadata files.
baseos: has expired and will be refreshed.
appstream: has expired and will be refreshed.
crb: has expired and will be refreshed.
extras: has expired and will be refreshed.
baseos 405 kB/s | 9.1 kB 00:00
reviving: 'baseos' can be revived - metalink checksums match.
baseos: using metadata from Mon Mar 16 18:24:42 2026.
appstream 26 kB/s | 9.3 kB 00:00
reviving: 'appstream' can be revived - metalink checksums match.
appstream: using metadata from Mon Mar 16 18:27:07 2026.
crb 71 kB/s | 9.0 kB 00:00
reviving: 'crb' can be revived - metalink checksums match.
crb: using metadata from Mon Mar 16 18:30:09 2026.
extras 407 kB/s | 10 kB 00:00
reviving: 'extras' can be revived - metalink checksums match.
extras: using metadata from Mon Mar 9 13:47:51 2026.
timer: sack setup: 607 ms
User-Agent: constructed: 'libdnf (CentOS Stream 10; generic; Linux.x86_64)'
Metadata cache created.
Cleaning up.
Plugins were unloaded.
‣ 1.0s for step "Syncing package manager metadata"
‣ + rm -rf -- /work/var/tmp/mkosi-workspace-9zplxmhg /work/var/tmp/mkosi-workspace-9zplxmhg/root
‣ Building main image
‣ [main] + cp --recursive --no-dereference --preserve=mode,links,timestamps,ownership,xattr --reflink=auto --copy-contents /work/usr/share/crypto-policies/back-ends/DEFAULT /work/var/tmp/mkosi-workspace-cjt7f4d8/sandbox/etc/crypto-policies/back-ends --no-target-directory
‣ [main] Installing CentOS
‣ [main] + dnf --assumeyes --best --releasever=10 --installroot=/buildroot --setopt=keepcache=1 --setopt=logdir=/var/log --setopt=cachedir=/var/cache/dnf --setopt=install_weak_deps=0 --setopt=check_config_file_age=0 --setopt=persistdir=/buildroot/var/lib/dnf --setopt=debuglevel=10 --setopt=metadata_expire=never --config=/etc/dnf/dnf.conf --setopt=reposdir=/etc/yum.repos.d --setopt=varsdir=/etc/dnf/vars --setopt=proxy_sslcacert=/proxy.cacert install basesystem
timer: config: 0 ms
Loaded plugins: builddep, changelog, config-manager, copr, debuginfo-install, download, generate_completion_cache, groups-manager, kpatch, needs-restarting, notify-packagekit, playground, product-id, repoclosure, repodiff, repograph, repomanage, reposync, subscription-manager, system-upgrade, uploadprofile
Updating Subscription Management repositories.
Unable to read consumer identity
This system is not registered with an entitlement server. You can use subscription-manager to register.
DNF version: 4.20.0
Command: dnf --assumeyes --best --releasever=10 --installroot=/buildroot --setopt=keepcache=1 --setopt=logdir=/var/log --setopt=cachedir=/var/cache/dnf --setopt=install_weak_deps=0 --setopt=check_config_file_age=0 --setopt=persistdir=/buildroot/var/lib/dnf --setopt=debuglevel=10 --setopt=metadata_expire=never --config=/etc/dnf/dnf.conf --setopt=reposdir=/etc/yum.repos.d --setopt=varsdir=/etc/dnf/vars --setopt=proxy_sslcacert=/proxy.cacert install basesystem
Installroot: /buildroot
Releasever: 10
cachedir: /buildroot/var/cache/dnf
Base command: install
Extra commands: ['--assumeyes', '--best', '--releasever=10', '--installroot=/buildroot', '--setopt=keepcache=1', '--setopt=logdir=/var/log', '--setopt=cachedir=/var/cache/dnf', '--setopt=install_weak_deps=0', '--setopt=check_config_file_age=0', '--setopt=persistdir=/buildroot/var/lib/dnf', '--setopt=debuglevel=10', '--setopt=metadata_expire=never', '--config=/etc/dnf/dnf.conf', '--setopt=reposdir=/etc/yum.repos.d', '--setopt=varsdir=/etc/dnf/vars', '--setopt=proxy_sslcacert=/proxy.cacert', 'install', 'basesystem']
Configuration file /etc/dnf/plugins/subscription-manager.conf does not exist.
User-Agent: constructed: 'libdnf (CentOS Stream 10; generic; Linux.x86_64)'
repo: using cache for: baseos
baseos: using metadata from Mon Mar 16 18:24:42 2026.
repo: using cache for: appstream
appstream: using metadata from Mon Mar 16 18:27:07 2026.
repo: using cache for: crb
crb: using metadata from Mon Mar 16 18:30:09 2026.
repo: using cache for: extras
extras: using metadata from Mon Mar 9 13:47:51 2026.
timer: sack setup: 79 ms
--> Starting dependency resolution
---> Package basesystem.noarch 11-22.el10 will be installed
---> Package centos-gpg-keys.noarch 10.0-20.el10 will be installed
---> Package centos-stream-release.noarch 10.0-20.el10 will be installed
---> Package centos-stream-repos.noarch 10.0-20.el10 will be installed
---> Package filesystem.x86_64 3.18-17.el10 will be installed
---> Package setup.noarch 2.14.5-7.el10 will be installed
--> Finished dependency resolution
timer: depsolve: 6 ms
Dependencies resolved.
=======================================================================================================================
Package Architecture Version Repository Size
=======================================================================================================================
Installing:
basesystem noarch 11-22.el10 baseos 4.3 k
Installing dependencies:
centos-gpg-keys noarch 10.0-20.el10 baseos 27 k
centos-stream-release noarch 10.0-20.el10 baseos 30 k
centos-stream-repos noarch 10.0-20.el10 baseos 12 k
filesystem x86_64 3.18-17.el10 baseos 4.8 M
setup noarch 2.14.5-7.el10 baseos 153 k
Transaction Summary
=======================================================================================================================
Install 6 Packages
Total size: 5.0 M
Installed size: 786 k
Downloading Packages:
[SKIPPED] basesystem-11-22.el10.noarch.rpm: Already downloaded
[SKIPPED] centos-gpg-keys-10.0-20.el10.noarch.rpm: Already downloaded
[SKIPPED] centos-stream-release-10.0-20.el10.noarch.rpm: Already downloaded
[SKIPPED] centos-stream-repos-10.0-20.el10.noarch.rpm: Already downloaded
[SKIPPED] filesystem-3.18-17.el10.x86_64.rpm: Already downloaded
[SKIPPED] setup-2.14.5-7.el10.noarch.rpm: Already downloaded
Using rpmkeys executable at /usr/bin/rpmkeys to verify signatures
baseos 1.6 MB/s | 1.6 kB 00:00
Importing GPG key 0x8483C65D:
Userid : "CentOS (CentOS Official Signing Key) <security@centos.org>"
Fingerprint: 99DB 70FA E1D7 CE22 7FB6 4882 05B5 55B3 8483 C65D
From : /usr/share/distribution-gpg-keys/centos/RPM-GPG-KEY-CentOS-Official-SHA256
Key imported successfully
baseos 2.1 MB/s | 2.1 kB 00:00
Importing GPG key 0x1D997668:
Userid : "CentOS Extras SIG (https://wiki.centos.org/SpecialInterestGroup) <security@centos.org>"
Fingerprint: 363F C097 2F64 B699 AED3 968E 1FF6 A217 1D99 7668
From : /usr/share/distribution-gpg-keys/centos/RPM-GPG-KEY-CentOS-SIG-Extras
warning: Certificate 1FF6A2171D997668:
Policy rejects subkey 8B5C8111FCA5D0FF: Policy rejected non-revocation signature (PrimaryKeyBinding) requiring second pre-image resistance
Key imported successfully
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
timer: transaction test: 45 ms
Running transaction
RPMDB altered outside of DNF.
RPM transaction start.
Running scriptlet: filesystem-3.18-17.el10.x86_64 1/1
Preparing : 1/1
Installed: centos-gpg-keys-10.0-20.el10.noarch
Installing : centos-gpg-keys-10.0-20.el10.noarch 1/6
Installed: centos-stream-repos-10.0-20.el10.noarch
Installing : centos-stream-repos-10.0-20.el10.noarch 2/6
Installed: centos-stream-release-10.0-20.el10.noarch
Installing : centos-stream-release-10.0-20.el10.noarch 3/6
Installed: setup-2.14.5-7.el10.noarch
Installing : setup-2.14.5-7.el10.noarch 4/6
Running scriptlet: setup-2.14.5-7.el10.noarch 4/6
Installed: filesystem-3.18-17.el10.x86_64
Installing : filesystem-3.18-17.el10.x86_64 5/6
Installed: basesystem-11-22.el10.noarch
Installing : basesystem-11-22.el10.noarch 6/6
Running scriptlet: filesystem-3.18-17.el10.x86_64 6/6
RPM transaction over.
timer: verify transaction: 4 ms
timer: transaction: 298 ms
Completion plugin: Generating completion cache...
Installed products updated.
Installed: basesystem-11-22.el10.noarch
Installed: centos-gpg-keys-10.0-20.el10.noarch
Installed: centos-stream-release-10.0-20.el10.noarch
Installed: centos-stream-repos-10.0-20.el10.noarch
Installed: filesystem-3.18-17.el10.x86_64
Installed: setup-2.14.5-7.el10.noarch
Installed:
basesystem-11-22.el10.noarch centos-gpg-keys-10.0-20.el10.noarch
centos-stream-release-10.0-20.el10.noarch centos-stream-repos-10.0-20.el10.noarch
filesystem-3.18-17.el10.x86_64 setup-2.14.5-7.el10.noarch
Complete!
Cleaning up.
Plugins were unloaded.
‣ [main] 1.0s for step "Installing CentOS"
‣ [main] Generating hardware database
‣ [main] + systemd-hwdb --root=/buildroot --usr --strict update
No hwdb files found, skipping.
‣ [main] 0.1s for step "Generating hardware database"
‣ [main] Running postinstall script /home/pbonzini/mkosi/mkosi.postinst…
‣ [main] + /work/postinst final
total 64
drwxr-xr-x. 2 root root 4096 Oct 29 2024 alternatives
drwxr-xr-x. 2 root root 6 Mar 17 16:45 ca-certificates
drwxr-xr-x. 3 root root 23 Mar 17 16:45 crypto-policies
drwxr-xr-x. 4 root root 49 Mar 17 16:45 dnf
-rw-r--r--. 1 root root 973 Mar 17 16:45 group
-rw-r--r--. 1 root root 0 Mar 17 16:45 gshadow
-rw-r--r--. 1 root root 384 Mar 17 16:45 hosts
-rw-r--r--. 1 root root 43387 Mar 13 16:57 ld.so.cache
lrwxrwxrwx. 1 root root 19 Mar 17 16:45 mtab -> ../proc/self/mounts
-rw-r--r--. 1 root root 298 Mar 17 16:45 nsswitch.conf
drwxr-xr-x. 3 root root 19 Mar 17 16:45 pacman.d
-rw-r--r--. 1 root root 2197 Mar 17 16:45 passwd
drwxr-xr-x. 4 root root 33 Mar 17 16:45 pki
-rw-r--r--. 1 root root 0 Mar 17 16:45 resolv.conf
drwxr-xr-x. 2 root root 57 Mar 17 16:45 rpm
-rw-r--r--. 1 root root 0 Mar 17 16:45 shadow
drwxr-xr-x. 2 root root 116 Mar 13 16:33 ssl
drwxr-xr-x. 2 root root 24 Mar 17 16:45 yum.repos.d
‣ [main] 0.1s for step "Running postinstall script /home/pbonzini/mkosi/mkosi.postinst…"
‣ [main] Generating system users
‣ [main] + systemd-sysusers --root=/buildroot
‣ [main] 0.1s for step "Generating system users"
‣ [main] Generating volatile files
‣ [main] + systemd-tmpfiles --root=/buildroot --boot --create --remove --exclude-prefix=/tmp --exclude-prefix=/var/tmp --exclude-prefix=/run --exclude-prefix=/proc --exclude-prefix=/sys --exclude-prefix=/dev
‣ [main] 0.1s for step "Generating volatile files"
‣ [main] Applying presets…
‣ [main] + systemctl --root=/buildroot preset-all
‣ [main] + systemctl --root=/buildroot --global preset-all
‣ [main] 0.1s for step "Applying presets…"
‣ [main] + rm -rf -- /work/var/tmp/mkosi-workspace-cjt7f4d8/root/usr/lib/sysimage/rpm /work/var/tmp/mkosi-workspace-cjt7f4d8/root/var/cache/dnf /work/var/tmp/mkosi-workspace-cjt7f4d8/root/var/lib/dnf
‣ [main] + systemd-repart --version
‣ [main] Version reported by systemd-repart is 257-23.el10-gf9c70df
‣ [main] + systemd-repart --version
‣ [main] Version reported by systemd-repart is 257-23.el10-gf9c70df
‣ [main] # /home/pbonzini/mkosi/mkosi.repart/00-esp.conf (truncated to 100 lines)
‣ [main] [Partition]
‣ [main] Type=esp
‣ [main] Format=vfat
‣ [main] CopyFiles=/boot:/
‣ [main] CopyFiles=/efi:/
‣ [main] SizeMinBytes=512M
‣ [main] SizeMaxBytes=512M
‣ [main]
‣ [main] # /home/pbonzini/mkosi/mkosi.repart/10-root.conf (truncated to 100 lines)
‣ [main] [Partition]
‣ [main] Type=root
‣ [main] Format=xfs
‣ [main] CopyFiles=/
‣ [main] SizeMinBytes=20G
‣ [main] SizeMaxBytes=20G
‣ [main]
‣ [main] Generating disk image
/home/pbonzini/mkosi/mkosi.crt
None
‣ [main] + rm -rf -- /work/var/tmp/mkosi-workspace-cjt7f4d8 /work/var/tmp/mkosi-workspace-cjt7f4d8/root
‣ [main] + tput cnorm
‣ [main] + tput smam
Traceback (most recent call last):
File "/home/pbonzini/mkosi/mkosi-venv/lib64/python3.12/site-packages/mkosi/run.py", line 104, in uncaught_exception_handler
yield
File "/usr/lib64/python3.12/contextlib.py", line 81, in inner
return func(*args, **kwds)
^^^^^^^^^^^^^^^^^^^
File "/home/pbonzini/mkosi/mkosi-venv/lib64/python3.12/site-packages/mkosi/__main__.py", line 44, in main
run_verb(args, tools, images, resources=resources)
File "/home/pbonzini/mkosi/mkosi-venv/lib64/python3.12/site-packages/mkosi/__init__.py", line 5242, in run_verb
build_image(
File "/home/pbonzini/mkosi/mkosi-venv/lib64/python3.12/site-packages/mkosi/__init__.py", line 4086, in build_image
partitions = make_disk(context, skip=("esp", "xbootldr"), tabs=True, msg="Generating disk image")
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/pbonzini/mkosi/mkosi-venv/lib64/python3.12/site-packages/mkosi/__init__.py", line 3615, in make_disk
return make_image(
^^^^^^^^^^^
File "/home/pbonzini/mkosi/mkosi-venv/lib64/python3.12/site-packages/mkosi/__init__.py", line 3496, in make_image
run_systemd_sign_tool(
File "/home/pbonzini/mkosi/mkosi-venv/lib64/python3.12/site-packages/mkosi/bootloader.py", line 498, in run_systemd_sign_tool
assert key
^^^
AssertionError
mkosi commit the issue has been seen with
mkosi 27~devel (installed via pip)
Used host distribution
CentOS Stream 10
Used target distribution
Fedora 43
Linux kernel version used
kernel-6.12.0-212.el10.x86_64 (but it should not matter)
CPU architectures issue was seen on
x86_64
Unexpected behaviour you saw
My
mkosi.defaulthasand I also have a
mkosi.crtfile (but nomkosi.key) in the execution directory.mkosifails with a traceback.Used mkosi config
mkosi output