Re: Moving existing ostree users to a new branch - take 2

[Colin Walters <walters verbum org>]

On Wed, May 3, 2017, at 11:49 AM, Daniel Drake wrote:
> Instead of having the EOL branch itself present the redirect to the
> new branch, do it the other way round: have the new branch note that
> it is the replacement for EOL branches x, y and z.

How would this work from a security perspective?  Would we be requiring
that the new branch commit is signed by the same GPG key?  This would
make GPG mandatory basically.  Before this, one could e.g. rely on fetching
over TLS.

> (in
> the same place where it is stored on the server - currently the repo
> config).

Hm, but the repo config isn't signed.

I understand the goal of wanting to remove the old branches...but
it doesn't seem like it'd be too onerous to prune them down to just
the latest commit object with just a redirect left over?

(Presuming of course that the ostree version in the old branch has
 this redirect logic)