Comment 24 for bug 638384

On Thu, 07 Apr 2011 13:38:54 -0000, Mattias Backman <email address hidden> wrote:
> I'm just reading this from the bottom up now... The last suggestion from
> James could be just something like this: http://paste.ubuntu.com/590764/
> with some checks along the way.
>
> Could that be a part of the "testdrive" script?

Yes, and I think that could be worth doing. I'm not particularly keen on
tying us to a second script that people need to use for things to work
well though.

> I think this covers the last point from lool:
> > * provide a tool which downloads and verifies Linaro images (for instance, shell script or pygtk UI)

Indeed.

> but not these:
> > * add the GPG key of the current Offspring instance to linaro-image-tools
> > * change linaro-media-create to verify rootfs.asc and hwpack.asc when passed --binary rootfs --hwpack hwpack args
> > * change linaro-hwpack-create to include PPA keys when the hwpack includes PPAs and linaro-hwpack-install to install them and setup the corresponding PPAs when the hwpack includes keys and PPAs

Indeed.

> Would these still be needed even with the "outside" signing with the
> sha1sums files?

Not really, but I would prefer a solution that worked with just
linaro-media-create. That's the only supported way to create a Linaro
image, so I'm fine with that.

I could be persuaded that for expediency we should just fix this
"externally."

Thanks,

James