Re: Bits from the CD team: plans for debian-cd v3.0
On Fri, Jul 15, 2005 at 06:36:19AM -0500, Charles Steinkuehler wrote:
> Um...maybe I'm dense, but everyone seems to be talking like there
> would only be one trusted key (apparently compiled into apt) which is
> what makes custom CDs a problem.
Not really. At the moment the set of trusted keys do have to live in a
package somewhere, though.
> What's wrong with having a configurable set of trusted keys? Then
> users could choose to trust official debian CDs/packages, stuff from
> their favorite back-ports webiste, or whatever.
At the moment the big practical problem is that actually getting a new
trusted key into a CD build is a huge pain, even if you know how. In
order to make the resulting CD install properly, you have to produce a
modified version of a -keyring package, assuming there's one in the base
system (that's for Ubuntu; in Debian at the moment you probably have to
produce a modified apt package!), and then you have to go through all
the usual rigmarole of regenerating Packages, Packages.gz, and Release,
then re-sign Release.gpg. This process is tedious, error-prone, and not
particularly amenable to simple configuration in debian-cd since it
requires modifying packages.
Remember that the people doing this will often not be using or not even
want to use debian-cd; many of them take an existing CD image and hack
it. This includes developers (e.g. installation system developers, from
time to time).
We've been here and done this in Ubuntu. It sucked.
Cheers,
--
Colin Watson [cjwatson@debian.org]
Reply to: