The current donwload template model to download those images does do
both https and gpg validation.

** Changed in: lxc (Ubuntu)
       Status: Triaged => Fix Released

You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to lxc in Ubuntu.

  ubuntu-cloud template: use simplestreams to add integrity verification

Status in lxc package in Ubuntu:
  Fix Released

Bug description:
  Currently we wget the ubuntu-cloud template without any integrity
  verification.  We then proceed to execute binaries like /bin/passwd
  while still in the ubuntu-cloud template (in a chroot, but without any
  effective containment).  We should be verifying that the image we
  download has not been tampered with.

To manage notifications about this bug go to:

Mailing list:
Post to     :
Unsubscribe :
More help   :

Reply via email to