On Wed, Mar 27, 2019 at 04:58:23PM +0100, Paolo Bonzini wrote:
On 27/03/19 16:30, Daniel P. Berrangé wrote:
Perhaps the VM test scripts should do a "HEAD" request for the image
every time to discover if it has been changed on the server, before
honouring the local cache.
Another possibility is to first download the shasum from
download.patchew.org, and compare _that_ against the one that is stored
locally, instead of hardcoding it in QEMU's repository.
Personally I prefer the idea of having the shasum stored in the repo.
That means that if we update git master to point to a newer image,
previous stable branches will stick with their original image, rather
than using a new image that may be incompatible with the stable branch
Storing hash in git also means that if someone compromised the patchew
server, they can't cause developer to run compromised images, without
first also compromising git to change the hash.