Re: Adding Avahi and USB drive support to libostree

[Colin Walters <walters verbum org>]

On Mon, Mar 27, 2017, at 11:06 AM, Philip Withnall wrote:
> I think I’m going to put a branch together which adds a new URI scheme
> to libostree, of the form ‘ostree-gpg:ABC123’, where ABC123 is the GPG
> key ID for the repository to pull from. Resolving this URI would look
> for remotes which use that key...

Eeek.  I'm not saying it's fundamentally wrong, maybe we end up there, but I'd like
to explore other solutions a bit more.   The GPG approach 🗝 feels...complex.  It's linking
together in a non-obvious way two concepts in ostree which were previously
completely orthogonal.

> The other problem related to this solution is that of key rotation.

Yeah, among others.

Let me strawman this:  To fetch a given ref from a remote, we proceed
as today and resolve ref -> commit hash.  Then, we automatically
try to fetch that commit from any locally mounted media (cheap).
If that fails, we use network heuristics - try to fetch from local Avahi
sources.  This could maybe be implemented today by simply
prepending them to a locally-generated mirrorlist, with the canonical
upstream last.