https://bugzilla.redhat.com/show_bug.cgi?id=2483948



--- Comment #6 from Vitaly Kuznetsov <[email protected]> ---
python3-cvmutils is actually a library which is used by both 'cvm-reseal' and
'cvm-encrypt-image' because of

%{python3_sitelib}/cvmutils

I've separated the packages because their usage is significantly different.
'cvm-encrypt-image' is executed in the
environment where the image is prepared and 'cvm-reseal' must run on the target
VM. Going forward, I expect cvm-reseal
to go to the initramfs because re-sealing requires un-sealing and with the
newly introduced PCR7 barrier it becomes
impossible in the main system (it is a good change from security perspective). 

I think what we can do is create a separate 'cvm-encrypt-image' into its own
package so we will have 3 packages in output:
cvm-encrypt-image
cvm-reseal
python3-cvmutils

This looks ideal from the perspective of dependencies: 'cvm-encrypt-image' may
require tools we do not want to have in the
target CVM. In the sources, I also have an experimental dracut module which we
don't enable just yet so at the end of the day
I expect the number of sub-packages to grow. While we may go with a single
'cvmutils', it will make it harder to do the split
later. What do you think?


-- 
You are receiving this mail because:
You are on the CC list for the bug.
You are always notified about changes to this product and component
https://bugzilla.redhat.com/show_bug.cgi?id=2483948

Report this comment as SPAM: 
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-spam&short_desc=Report%20of%20Bug%202483948%23c6

-- 
_______________________________________________
package-review mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it: 
https://forge.fedoraproject.org/infra/tickets/issues/new

Reply via email to