tools for building cloud images in the buildsystem

[Seth Vidal]

On Mon, 12 Nov 2012, Matthew Miller wrote:

> On Mon, Nov 12, 2012 at 10:48:18AM -0500, Seth Vidal wrote:
>> Why don't  we spin up a persistent euca instance, give you some disk
>> space and a cron job. You can just run ami-creator w/a sensible
>> kickstart...
>> Trivial and disposable.
>
> That would be fine, as long as we can be very sure about the access control
> and chain of identity assurance.

I don't know how/if we do that _now_.

I mean - we know who setup the koji builders and where koji lives but 
'chain of identity assurance'..... That sounds awfully specific and 
legalistic.

Maybe you can describe what that phrase means to you so I can understand 
that a bit better.


> I don't know the existing internal systems for this, but it'd be great to
> have auditable assurance that images which appear on the mirrors were built
> in a known-clean environment against the official repositories from a
> certain kickstart file in git.

'known clean'? What kind of clean do you want? If we use a new instance to 
build a new image is that clean enough? I'm certain I could do all of it 
in a single ansible playbook: spin up a new instance in euca, attach a set 
of disks, run ami-creator, retrieve the results. It's not very difficult 
at all, actually.



> For the purposes of Rawhide nightlies (pushed to alt.fedoraproject.org?),
> I'm perfectly fine with trusting me to do the right thing. :) For the alpha,
> beta, and final builds, as well as possible mid-release image updates, I'd
> like access to go through some control system, whatever that might be.

Let me know what you think the control system requires to be considered 
"safe".

-sv