Re: Some ostree observatoins

[Colin Walters <walters verbum org>]

[ Sorry about breaking threading...I accidentally archived your message and my current mail client apparently takes that to mean "delete permanently"... ]

I still need to review what is signed by GnuPG and how the hash chaining works. Unless there is some documentation I've missed, this will take quite a but of time because I have to reverse-engineer the data structures from the source code itself.

It's basically:  .commit -> .dirtree [ -> .dirtree ] -> .filez

Where each arrow is a SHA256. And .commitmeta contains signature for .commit.  Please feel free to shoot me (or the list) a mail anytime if you have questions about the design.  (Also patches to add comments are accepted of course too =) )

I didn't look at the generation side (rpm-ostree etc.) or anything beyond "ostree admin upgrade" because I couldn't find descriptions of actual usage scenarios, which makes it very hard to evaluate how things stand security-wise.

The idea is that organizations stand up their own rpm-ostree "build servers" internally with their own custom packagesets (and their own GPG keys, or simply using TLS) and then replicate that out to clients which are configured to pull from their internal repo.