yikai
(Yikai Tang)
November 17, 2025, 1:39am
1
Hello guys, I have been using Fedora Core for a few months, and it always worked well for me.
However in the latest update(43.20251024.3.0, arch=x86_64, channel=stable), I cannot get my instance of Fedora Core upgraded, whether manually or by zincati service.
The error reports is always the same, saying that “error: Importing: Unencapsulating base: Importing commit: Using remote fedora for verification; Expected commitmeta object, not DirMeta”.
I installed my instance a few updates ago, when the update was through rpm packages, I ran a few command to switch to upgrading using container layers from quay.io . Which makes me wonder if there’s some command to fix this situation for me as well.
What I tried including pruning rpm-ostree cache and update again, which didn’t work for me.
So if you have any suggestion, I’d be willing to hear from you. Much thanks in advance.
hricky
(Hristo Marinov)
November 17, 2025, 12:36pm
2
Please provide the output of the rpm-ostree status command.
What are these commands and why did you execute them?
nick123pig
(Nick Stocchero)
November 17, 2025, 9:00pm
3
I started seeing this randomly too today.
[admin@myhost ~]$ sudo rpm-ostree upgrade --bypass-driver
Pulling manifest: ostree-remote-image:fedora:docker://quay.io/fedora/fedora-coreos:stable
Importing: ostree-remote-image:fedora:docker://quay.io/fedora/fedora-coreos:stable (digest: sha256:44528ecc3fe8ab2c2a4d0990cdc0898aca334aa632d4a77f23118f8900435636)
ostree chunk layers already present: 64
ostree chunk layers needed: 1 (1.6 MB)
custom layers needed: 1 (178 bytes)
[0/2] Fetching ostree chunk 1bd5d589fdb077fde3a (1.6 MB)... done
error: Importing: Unencapsulating base: Importing commit: Using remote fedora for verification; Expected commitmeta object, not DirMeta
[admin@myhost ~]$ sudo rpm-ostree status
State: idle
Deployments:
● ostree-remote-image:fedora:docker://quay.io/fedora/fedora-coreos:stable
Digest: sha256:29177c8a90b2102839a65571d2b60837c6bd78fdf167e2228dad41bae790712a
Version: 42.20250914.3.0 (2025-09-30T03:08:59Z)
LayeredPackages: btop
ostree-remote-image:fedora:docker://quay.io/fedora/fedora-coreos:stable
Digest: sha256:29177c8a90b2102839a65571d2b60837c6bd78fdf167e2228dad41bae790712a
Version: 42.20250914.3.0 (2025-09-30T03:08:59Z)
LayeredPackages: btop
1 Like
yikai
(Yikai Tang)
November 18, 2025, 2:44am
4
The output of “rpm-ostree status” are as follows:
$ sudo rpm-ostree statusState: idleAutomaticUpdatesDriver: ZincatiDriverState: active; trying to stage 43.20251024.3.0 (failed attempts: 5)Deployments:● ostree-remote-image:fedora:registry:quay.io/fedora/fedora-coreos:stableDigest: sha256:1693b47dfccebdde19e81c3d0a0392010f0ec67e827f096d1b3f8aec662eb5cfVersion: 42.20251012.3.0 (2025-10-25T02:24:05Z)LayeredPackages: bc btop fail2ban firewalld genisoimage grubby man mosh nnn podman-compose policycoreutils-python-utils setools-console setroubleshoot-server tmux tree trivy udica vim
ostree-remote-image:fedora:registry:quay.io/fedora/fedora-coreos:stableDigest: sha256:1693b47dfccebdde19e81c3d0a0392010f0ec67e827f096d1b3f8aec662eb5cfVersion: 42.20251012.3.0 (2025-10-25T02:24:05Z)LayeredPackages: bc btop fail2ban firewalld genisoimage grubby man mosh nnn policycoreutils-python-utils setools-console setroubleshoot-server tmux tree trivy udica vim
The command for rebase was
sudo rpm-ostree rebase ostree-remote-image:fedora:registry:quay.io/fedora/fedora-coreos:stable --bypass-driver
Reason for that was the problem fixed in release 42.20250803.3.0, as stated in [https://github.com/coreos/fedora-coreos-tracker/issues/1890\ ]. I didn’t want to wait for an update, so I googled and did it myself.
kenryo
(Kenric Young)
November 18, 2025, 2:56am
5
Oh you’re getting a similar error to the one I’m getting!
I’m using the silverblue bootc image from quay.io
Can no longer upgrade F43 Silverblue bootc
yikai
(Yikai Tang)
November 18, 2025, 3:02am
6
Have you solved this problem?
kenryo
(Kenric Young)
November 18, 2025, 5:12am
7
No, but I believe this GitHub issue is related
opened 09:33PM - 17 Nov 25 UTC
kind/bug
### Describe the bug
On a freshly installed Fedora CoreOS node tracking the **t… esting** stream, Zincati logs the following warning at startup:
```
[WARN zincati::cincinnati] booted deployment quay.io/fedora/fedora-coreos@sha256:d124db75754b48750f28d9c81ec27b01ad81ff834032ac43e287b45ec98cc905 not found in the update graph
```
The system is booted from the `ostree-image-signed:docker://quay.io/fedora/fedora-coreos:testing` image, and Zincati is configured with `stream = "testing"`. The version matches the current testing stream metadata (`43.20251110.2.0`), but the booted payload digest does **not** appear to be present in the Cincinnati graph for `stream=testing`.
As a result, Zincati never finds a matching node for the booted deployment in the update graph and cannot perform managed updates from this starting point.
### Reproduction steps
1. Build an FCOS **testing** stream ISO using `coreos-installer`:
```bash
podman run --rm \
-v "$PWD:/work:Z" -w /work \
quay.io/coreos/coreos-installer:release \
download -s testing -p metal -f iso -C dist
# Then customize the ISO with dest ignition + dest-device:
podman run --rm \
-v "$PWD:/work:Z" -w /work \
quay.io/coreos/coreos-installer:release \
iso customize \
--force \
--dest-ignition terraform/onprem/.artifacts/instance.ignition \
--dest-device /dev/nvme0n1 \
-o dist/fcos-instance-autoinstall.iso \
dist/fedora-coreos-*-live-*.iso
```
**NOTE**: I manually verified that my ignition does not rebase the image/stream to an ostree native container image at any point.
2. Boot a bare-metal node (x86_64) from the customized ISO and let it auto-install.
3. After the first boot into the installed system, SSH in as core and verify with `rpm-ostree status`:
```
State: idle
AutomaticUpdatesDriver: Zincati
DriverState: active; periodically polling for updates
Deployments:
● ostree-image-signed:docker://quay.io/fedora/fedora-coreos:testing
Digest: sha256:d124db75754b48750f28d9c81ec27b01ad81ff834032ac43e287b45ec98cc905
Version: 43.20251110.2.0 (2025-11-11T04:07:55Z)
ostree-image-signed:docker://quay.io/fedora/fedora-coreos:testing
Digest: sha256:d124db75754b48750f28d9c81ec27b01ad81ff834032ac43e287b45ec98cc905
Version: 43.20251110.2.0 (2025-11-11T04:07:55Z)
```
4. Confirm the origin shows the container image:
```bash
sudo head -n 50 /ostree/deploy/*/deploy/*.origin
```
Output (abridged):
```ini
[origin]
container-image-reference=ostree-image-signed:docker://quay.io/fedora/fedora-coreos:testing
```
5. Confirm Zincati stream configuration:
```bash
grep -R --no-messages -n '^stream' /etc/zincati/config.d /usr/lib/zincati/config.d
```
Output:
```bash
/etc/zincati/config.d/90-auto-updates.toml:3:stream = "testing"
```
6. Start/restart Zincati and check the journal:
```bash
sudo systemctl restart zincati
journalctl -u zincati.service -b --no-pager | tail -n 50
```
You will see:
```
[INFO zincati::cincinnati] Cincinnati service: https://updates.coreos.fedoraproject.org
[INFO zincati::cli::agent] agent running on node '…', in update group 'default'
[INFO zincati::update_agent::actor] initialization complete, auto-updates logic enabled
[INFO zincati::update_agent::actor] reached steady state, periodically polling for updates
[WARN zincati::cincinnati] booted deployment quay.io/fedora/fedora-coreos@sha256:d124db75754b48750f28d9c81ec27b01ad81ff834032ac43e287b45ec98cc905 not found in the update graph
```
7. From the same node, query the Cincinnati graph directly:
```bash
arch=$(uname -m)
[ "$arch" = "x86_64" ] && basearch=x86_64 || basearch="$arch"
boot_digest=$(rpm-ostree status | awk '/^[[:space:]]*Digest:/ {print $2; exit}')
boot_payload="quay.io/fedora/fedora-coreos@${boot_digest}"
echo "Zincati stream: testing"
echo "Booted payload: $boot_payload"
curl -s -H 'Accept: application/json' \
"https://updates.coreos.fedoraproject.org/v1/graph?basearch=$basearch&stream=testing" \
| grep -F "\"payload\":\"$boot_payload\"" \
|| echo "payload not in graph"
```
Output:
```
Zincati stream: testing
Booted payload: quay.io/fedora/fedora-coreos@sha256:d124db75754b48750f28d9c81ec27b01ad81ff834032ac43e287b45ec98cc905
payload not in graph
```
### Expected behavior
Given that:
- The node is on the testing stream:
`ostree-image-signed:docker://quay.io/fedora/fedora-coreos:testing`
- The version matches the current testing release in stream metadata (43.20251110.2.0).
- Zincati is configured with stream = "testing".
I would expect:
- The booted payload (quay.io/fedora/fedora-coreos@sha256:d124db7…) to be present as a node in the Cincinnati graph for stream=testing, and
- Zincati to recognize the current release as a valid starting point (even if there are no newer updates yet), without logging it as “not found in the update graph”.
### Actual behavior
- The booted payload digest is not present in the Cincinnati graph for basearch=x86_64, stream=testing.
- Zincati logs show:
`[WARN zincati::cincinnati] booted deployment quay.io/fedora/fedora-coreos@sha256:d124db7… not found in the update graph`
even though the node is on the latest testing stream version and the stream JSON indicates that 43.20251110.2.0 is the current testing release.
### System details
- Hardware: bare metal x86_64 (NVMe root disk)
- Fedora CoreOS stream: testing
- Fedora CoreOS version: 43.20251110.2.0
- Deployment origin:
`container-image-reference=ostree-image-signed:docker://quay.io/fedora/fedora-coreos:testing`
- Zincati version: as shipped in FCOS 43.20251110.2.0 (`zincati 0.0.30` per journal)
- Zincati config:
```ini
# /etc/zincati/config.d/90-auto-updates.toml
[updates]
enabled = true
stream = "testing"
strategy = "periodic"
```
### Butane or Ignition config
```yaml
```
### Additional information
- The testing stream metadata at https://fedoraproject.org/coreos/download?stream=testing shows 43.20251110.2.0 as the current x86_64 release for all artifacts.
- The node was installed via coreos-installer using the metal ISO and iso customize with --dest-device + --dest-ignition, and has not been manually rebased to a different image after installation.
- From the user perspective, the system works fine, but Zincati cannot currently manage updates starting from this container-based deployment because the booted payload is not represented in the testing graph.
dustymabe
(Dusty Mabe)
November 18, 2025, 1:12pm
8
There are two separate issues here.
@kenryo (and anyone else). For the booted deployment not found in the update graph issue, follow: Zincati: booted deployment not found in update graph for FCOS testing 43.20251110.2.0 (container/ostree-image-signed) · Issue #2066 · coreos/fedora-coreos-tracker · GitHub
For the Expected commitmeta object, not DirMeta issue. @yikai somehow you missed the container signing migration . Try running this command:
sudo systemctl stop zincati
sudo rpm-ostree rebase ostree-image-signed:docker://quay.io/fedora/fedora-coreos:stable --reboot
1 Like
nick123pig
(Nick Stocchero)
November 18, 2025, 3:29pm
9
For the Expected commitmeta object, not DirMeta issue, I’m getting a secondary error now. And also, this is pretty much a vanilla coreos install just sitting; I didn’t run any commands previously for this.
[root@node admin]# sudo systemctl stop zincati
[root@node admin]# sudo rpm-ostree rebase ostree-image-signed:docker://quay.io/fedora/fedora-coreos:stable --reboot
Pulling manifest: ostree-image-signed:docker://quay.io/fedora/fedora-coreos:stable
error: Preparing import: Fetching manifest: containers-policy.json specifies a default of `insecureAcceptAnything`; refusing usage
[root@node admin]# rpm-ostree status
State: idle
Deployments:
● ostree-remote-image:fedora:docker://quay.io/fedora/fedora-coreos:stable
Digest: sha256:29177c8a90b2102839a65571d2b60837c6bd78fdf167e2228dad41bae790712a
Version: 42.20250914.3.0 (2025-09-30T03:08:59Z)
LayeredPackages: btop
ostree-remote-image:fedora:docker://quay.io/fedora/fedora-coreos:stable
Digest: sha256:29177c8a90b2102839a65571d2b60837c6bd78fdf167e2228dad41bae790712a
Version: 42.20250914.3.0 (2025-09-30T03:08:59Z)
LayeredPackages: btop
dustymabe
(Dusty Mabe)
November 18, 2025, 6:50pm
10
@nick123pig the container signing migration didn’t land until 42.20250929.3.0. You can deploy 42.20250929.3.0 and that should then migrate you properly I think.
sudo systemctl stop zincati
sudo rpm-ostree rebase ostree-remote-image:fedora:docker://quay.io/fedora/fedora-coreos:42.20250929.3.0 --reboot
nick123pig
(Nick Stocchero)
November 18, 2025, 7:29pm
11
@dustymabe that did it! Thank you!!
yikai
(Yikai Tang)
November 19, 2025, 12:01am
12
Thank you very much. This command worked for me!