Quarry: Dumb Servers, Smart Clients for Secure OS Image Distribution
Dumb servers, smart clients: Distributing OS images with Quarry
Quarry is a new software delivery toolchain that uses The Update Framework (TUF) to securely distribute immutable OS images. It embraces a 'dumb server, smart client' model where static blobs are served from cheap hosting, and all intelligence lives in the client. Key features include per-machine repositories for granular access control, flexible key escrow, and autonomous updates. Quarry integrates with systemd-sysupdate and adds TUF extensions for repository listing and cross-repository links.
The protocol must not rely on a smart server to generate responses to clients; the update payloads and metadata should be static blobs served via 'dumb' static hosting and the 'smarts' should all live in the client.