streams should be gpg signed & gpg verified

[Dimitri John Ledkov]

streams should be gpg signed & gpg verified

Over at https://cloud-images.ubuntu.com/releases/streams/v1/

https://cloud-images.ubuntu.com/releases/streams/v1/index.sjson is GPG signed stream, with key available from src:ubuntu-keyring package.

Similarly https://images.maas.io/streams/v1/ should also be probably GPG signed

And ditto https://cdimage.ubuntu.com/ubuntu-core/appliances/streams/v1/

and any other streams that I might now.

Also multipass & maas should have access to the gpg keyrings (i.e. vendor various debs produced by src:ubuntu-keyring) and fetch streams with gpg verification.

Otherwise we cannot detect if streams get mirrored and tampered with.

[Adam Collard (adam-collard)]

https://images.maas.io/ephemeral-v3/stable/streams/v1/

The MAAS image stream is signed?

[Michał Sawicz (saviq)]

We in Multipass are following LXD's suit, they've decided against GPG for cross-platform and key revocation reasons.

Streams are accessed via HTTPS, the assumption being that as long as your HTTPS connection to the host is good verified, the streams are considered trusted.

[Alberto Donato (ack)]

Marking this invalid for maas. As per Adam's comment MAAS streams (stable, candidate, daily) are GPG signed.