Dan Nicholson

I haven't reviewed the code yet, but this is awesome and how it should have been done initially. If you can inspect the key algorithm from a standard format, then...

> * Add this new functionality in a new type called either `pkcs8` or `auto`. I can't really think of what other form of signing would be desired besides a...

Sorry, I keep meaning to give some time to reviewing this. The one thing I'll say now is that I don't think `x509` is an appropriate name for the backend....

I cobbled together something to indicate the issue even though it doesn't cause errors since I couldn't get it to boot with `/var` initially read-only. ``` $ cat /usr/local/bin/var-overlay-setup #!/bin/sh...

> > Several systemd units such as `systemd-rfkill.service` that persist data to `/var` fail if the overlayfs hasn't been mounted since the underlying mount is read only. These units are...

> So no, we are certainly not going to move all early boot stuff behind local-fs.target, if we know precisely what it needs. And we do know for those services...

Another option is to finish off https://github.com/ostreedev/ostree/pull/1166 so that flatpak can do sane remote modification instead of doing the "add remote with just URL if it doesn't exist then set...

I spent a while looking at this trying to figure out how to only download the command line tools once, but this is the bootstrapping procedure I came up with....

While I think it's nice to use the timestamp of the destination file as the source for the `If-Modified-Since` header, it loses the URL. It would be better to keep...

An extension of this problem is that if you set `useETag`, then it won't be used because the URL isn't in the cached JSON and then it's operating entirely on...