Change variable check to match existing style Signed-off-by: Tai Kedzierski <dch.tai@gmail.com>

lxc-download.in / Document keyserver change in help Signed-off-by: Tai Kedzierski <dch.tai@gmail.com>

lxc-download.in / allow setting keyserver from env Checks if DOWNLOAD_KEYSERVER has already been set in the environment before setting a value Signed-off-by: Tai Kedzierski <dch.tai@gmail.com>

Fix spelling of CentOS in the templates Signed-off-by: Roman Mueller <roman.mueller@gmail.com>

Use full GPG fingerprint instead of long IDs. With how easy it is to create a collision on a short ID nowadays and given that the user doesn't actually have to remember or manually enter the key ID, lets just use the full fingerprint from now on. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

download: Bump to compat level 3 Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

Added container-cache option to templates This change adds in the container-cache option within the mainline default lxc templates. The pupose here is to allow a template to pull from a location that may not be `@LOCALSTATEDIR@/cache/lxc` Signed-off-by: Kevin Carter <kevin.carter@rackspace.com>

fix lxc-console on centos / oracle unprivileged containers Signed-off-by: Stuart Cardall <developer@it-offshore.co.uk>

lxc-download: improve help text. --help and --list are special in the sense that they are independent of the other options and exit early. Document them separately. Signed-off-by: Michael Adam <obnox@samba.org> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

lxc-download: make --list more useful. Make it possible to use --list without having to specify --dist, --release, and --arch, which does not make a lot of sense. Signed-off-by: Michael Adam <obnox@samba.org> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

lxc-download: fix typo in help text. Signed-off-by: Michael Adam <obnox@samba.org> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

download: Make --keyserver actually work Reported-by: NeilGreenwood <neil.greenwood@gmail.com> Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

download: Have wget retry 3 times This forces wget to retry if it gets a network error. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

lxc-download: Bump compat to 2 after OpenSUSE OpenSUSE is now ready for the download template in the master branch, however it's not going to be compatible with older LXC as they lack the needed config files, so bump the compat level to 2 to indicate that the current lxc-download can deal with the current OpenSUSE containers. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

lxc-download: Attempt to get the GPG key 3 times This is to deal with the GPG pool occasionaly yielding broken servers. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

download: Set a 30s timeout for wget request Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

lxc-download: Fix in_userns again The use of a subshell was causing various failures, re-arrange not to use one. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

lxc-download: Ignore return code from subshell The previous change fixed parsing of multiple uid/gid ranges by using a while loop, however a failure in that loop will cause the script to exit (due to -e), so we need to ignore the return value of the commands inside that loop. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

lxc-download: Detect unpriv created by real root This adds yet another case in the in_userns function detecting the case where an unprivileged container is created by the real uid 0, in which case we want to share the system wide cache but still use the unprivileged templates and unpack method. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

templates: Fix bashisms in common code Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

download: Support nested containers in unpriv This adds detection for the case where we are root in an unprivileged container and then run LXC from there. In this case, we want to download to the system location, ignore the missing uid/gid ranges and run templates that are userns-ready. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

download: Use port-80 pool for gpg over http Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

templates: Make sure usual locations are in PATH Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

download: Fix previous change The previous change to support http proxies only worked when http_proxy was set... Instead add some detection code and only use :80 when using http_proxy. That's a bit of a workaround, but it's the only way I could find to get GPG to work with http_proxy. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

download: Force hkp on port 80 (for http proxies) Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

create: pass --mapped-gid to templates next to --mapped-uid That way templates can fix group ownership alongside uid ownership. Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

lxc-download: Tweak cache location - Also include the variant in the path - Fix invalid LXC_CACHE_BASE - Drop redundant code Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

lxc-download: Fix to work without mktemp mktemp isn't always available in busybox. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

lxc-download: Add interactive mode Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

lxc-download: Fix undefined DOWNLOAD_FORCE_CACHE Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

lxc-download: Fix wrong option parsing Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

lxc-download: POSIX doesn't specify -f for chown Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

download: Improve cache handling This adds a new --force-cache parameter which will force use of the cache even for expired images. An expired image is now only flushed from the cache once a new one is successfuly downloaded (to avoid destroying the local cache when the host doesn't have internet connectivity). The ID of the build in cache is also tracked so that we don't re-download something we already have (should only happen if we don't have a new build published by the time the previous one expires). Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

download: Support listing available images Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

download: Don't use an hardcoded exclude list Instead of hardcoding --exclude=./dev/*, use a new metadata file "excludes" which lists all the paths or patterns to exclude during extraction (one per line). Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

download: Fix download_sig logic Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

download: don't download signatures when --no-validate given - show full path to failed download location - change test to -f in case meta.tar.xz:templates has a blank line it won't attempt to sed a directory Signed-off-by: Dwight Engen <dwight.engen@oracle.com> Acked-by: Stéphane Graber <stgraber@ubuntu.com>

download: Initial template This adds a new template called "download". It's a fairly simple template with a minimal set of dependency which will grab any pre-built image available on https://images.linuxcontainers.org Note that the serverside is still work in progress (missing SSL support). Access is done over https by default with a warning being emitted if fallback to http was required (may be needed for testing, when behind proxy and with private servers). All index files and tarballs are gpg-signed with the default pubkeyid contained in the template itself. The main benefit of this template is to be entirely distribution-agnostic, any template that can be integrated with the server build infrastructure will then work on any LXC machine when using the download template. This template is also compatible with user namespaces and will hopefully help widden the number of distros that may work in unprivileged LXC. This commit also bundles a small change to the template configs to have the ubuntu template (used by the download template) to work with unprivileged LXC. Signed-off-by: Stéphane Graber <stgraber@ubuntu.com> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>