On Fri, Nov 01, 2013 at 04:16:11PM -0400, Matthew Miller wrote: > On Fri, Nov 01, 2013 at 08:14:17PM +0000, Richard W.M. Jones wrote: > > > (3) Virt-builder requires all images to be GPG-signed. It worries me > > > that these images are neither signed nor downloaded over https. > > The solution to this (further down the thread) was to use checksums in > > the index file. This is possible in 1.24.1 (stable version, Fedora 20) & > > 1.25.3. > > So, what else do we need here? Well .. easiest is just to make a signed index.asc file and put it next to the *-CHECKSUM file here: http://www.mirrorservice.org/sites/dl.fedoraproject.org/pub/fedora/linux/releases/19/Images/x86_64/ (Actually .. I think it needs to go in the directory *above* so it can cover both the 32- and 64-bit images.) Here's an example index file: http://libguestfs.org/download/builder/index.asc Here is the ref documentation for the index file format: http://libguestfs.org/virt-builder.1.html#creating-your-own-templates I would then add the URL of the index file [mirroring?] to virt-builder, and it all ought to Just Work ... But also .. you might decide that the index format (which I'll admit to just hacking together over one night) is not right in which case we could use another format. It would, of course, need to cover all the fields that the current index has. Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones virt-df lists disk usage of guests without needing to install any software inside the virtual machine. Supports Linux and Windows. http://people.redhat.com/~rjones/virt-df/ _______________________________________________ cloud mailing list cloud@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/cloud Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
