On fre, 2016-04-01 at 12:43 +0200, Alexander Larsson wrote:
On Thu, 2016-03-31 at 11:17 -0400, Colin Walters wrote:The use of a parent repo is similar to the alternatives, but it onlysupplies the objects. For a pull to work in the unprivileged repo it need to also pick up the remote url and gpg configuration from the system repo. Thus the patches above. The custom url is for the final part, where we integrate the local (untrusted) repo into the system repo. We need it to have the same branch name (verified by the signed summary) and gpg config. But ideally we should be able to do this pull without destructive updates to the system repo like adding a new remote for the untrusted user repo. I've attached a patch that lets you do this via: git pull --url=local-repo-url remote-name
I disliked this approach. So I came up with another cleaner one. With https://github.com/ostreedev/ostree/pull/237 we can now handle gpg verification during pull-local (assuming --remote= was specified), which means we can use: ostree pull-local --repo=system-repo --untrusted --gpg-verify --gpg-verify-summary --remote=origin local-shallow-repo some-branch This will verify the summary signature (and thus the "some-branch" name), as well as the remote commit. In addition you really want to verify that the new commit is newer than the old one, which you should do before commiting the pull transaction. Attaching an example script that does the whole dance. (Note: you also need the inherits-options PR) -- =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Alexander Larsson Red Hat, Inc alexl redhat com alexander larsson gmail com He's a benighted arachnophobic cowboy on the hunt for the last specimen of a great and near-mythical creature. She's a strong-willed goth mercenary with an evil twin sister. They fight crime!
Attachment:
setup-repo.sh
Description: application/shellscript