Install Google Chrome in base

Containerfile

@@ -1,11 +1,15 @@
 ARG silverblue_version=40
 FROM quay.io/fedora-ostree-desktops/silverblue:${silverblue_version}
 
-COPY vscode.repo /etc/yum.repos.d/vscode.repo
-COPY microsoft-release-public-key.asc /etc/pki/rpm-gpg/microsoft-release-public-key.asc
+COPY overlay-root/etc/ /etc/
+
+RUN mkdir -p /var/opt \
+    && mkdir -p /usr/lib/opt/google \
+    && ln -s /usr/lib/opt/google /var/opt/google
 
 RUN --mount=type=bind,source=packages.json,target=/packages.json,z \
-    rpm-ostree override remove \
+    rpm --import /etc/pki/rpm-gpg/google-linux-public-key.asc \
+    && rpm-ostree override remove \
         $(jq -r '"--install=\(.add[].name)"' /packages.json | paste -d" " -) \
         $(jq -r '.remove[].name' /packages.json | paste -d" " -) \
     && systemctl enable rpm-ostreed-automatic.timer \

README.md

@@ -1,2 +1,14 @@
 # custom-silverblue
+
 Following Jorge Castro's lead and making my own spin on Silverblue
+
+## Google Linux Signing Keys
+
+Google does something weird with their keys for signing RPMs.
+They add new subkeys every year or so and start signing with that.
+The subkey 
+When things start breaking eventually, get the new key with:
+
+```
+wget -O overlay-root/etc/pki/rpm-gpg/google-linux-public-key.asc https://dl.google.com/linux/linux_signing_key.pub
+```

overlay-root/etc/yum.repos.d/google-chrome.repo

@@ -0,0 +1,6 @@
+[google-chrome]
+name=google-chrome
+baseurl=https://dl.google.com/linux/chrome/rpm/stable/x86_64
+enabled=1
+gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/google-linux-public-key.asc

packages.json

@@ -16,6 +16,10 @@
         "name": "gnome-tweaks",
         "_comment": "Lets me put the titlebar buttons on the left"
       },
+      {
+        "name": "google-chrome-stable",
+        "_comment": "Real upstream Google Chrome. Being in a Flatpak breaks its sandbox."
+      },
       {
         "name": "guestfs-tools",
         "_comment": "Optiional package of Virtualization group"