Build install kernel & Client with verifiable repos

[Toomas Tamm]

On Tue, 2015-10-20 at 12:48 -0400, George {Skip} F VerDuin wrote:
> On 10/20/2015 11:10 AM, Thomas Lange wrote:
> > <<SNIP>>> the wiki page to get the idea published if you want. I'm not 
> > sure if I want to add the FAI project repository by default, I need to 
> > think on this topic for some more time.
> If you decide "not", then I'd be happy to offer the idea of loading 
> sources.list.d/... and trusted.gpg.d/... as an alternative design on the 
> wiki.

I would argue against adding any external sources as default. I am a big
supporter of the "Debian way" of not replacing packages with newer
versions over the lifetime of a release (I know, there are a small
number of exceptions). 

Some users of FAI make local modifications (subtle or major), and any
change in the code may break things for them. Also there might appear a
need to modify the config space, which, due to Murphy's law, will always
happen at the most inappropriate time.

As an example, I have an old computer cluster which has Debian etch
installed on it. Although I have not tried it recently, I believe I
could still re-install a node on it (using FAI 3.1.8) if needed. I am
not confident whether the config space would work with the most recent
FAI 4.3.3.

Regards,
Toomas Tamm