[Fedora-legal-list] Hosting Fedora cloud images

[Richard W.M. Jones]

On Fri, Nov 01, 2013 at 04:16:11PM -0400, Matthew Miller wrote:
> On Fri, Nov 01, 2013 at 08:14:17PM +0000, Richard W.M. Jones wrote:
> > > (3) Virt-builder requires all images to be GPG-signed.  It worries me
> > > that these images are neither signed nor downloaded over https.
> > The solution to this (further down the thread) was to use checksums in
> > the index file.  This is possible in 1.24.1 (stable version, Fedora 20) &
> > 1.25.3.
> 
> So, what else do we need here?

Well ..  easiest is just to make a signed index.asc file and put it
next to the *-CHECKSUM file here:

http://www.mirrorservice.org/sites/dl.fedoraproject.org/pub/fedora/linux/releases/19/Images/x86_64/

(Actually ..  I think it needs to go in the directory *above* so it
can cover both the 32- and 64-bit images.)

Here's an example index file:
http://libguestfs.org/download/builder/index.asc

Here is the ref documentation for the index file format:
http://libguestfs.org/virt-builder.1.html#creating-your-own-templates

I would then add the URL of the index file [mirroring?] to
virt-builder, and it all ought to Just Work ...

But also ..  you might decide that the index format (which I'll admit
to just hacking together over one night) is not right in which case we
could use another format.  It would, of course, need to cover all the
fields that the current index has.

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
virt-df lists disk usage of guests without needing to install any
software inside the virtual machine.  Supports Linux and Windows.
http://people.redhat.com/~rjones/virt-df/