Tails

See Bug #17686 (parent task) for context, and Bug #17687 for the “fix?” approach.

Assigning to @anonym for input on the release management side given (1) I have my own opinion on the topic already; (2) others need to take some time off.

We rely on ISO history to build IUKs in Jenkins; I’ve prepared some modifications to the release process documentation I’ll be pushing in another branch (see Bug #17659, which for now focuses on proposed improvements following the 4.5~rc1 and 4.5 releases) to reorder things a little, so that the IMG+ISO push starts a little earlier as it can take some time©®™ (see Bug #17414).

But basically, what we need from that push is (of course) the last IMG+ISO (all other ones are already in place, ready to be downloaded): at this stage, it’s highly likely we’ll have the images built reproducibly in Jenkins (I have seen no exceptions until now). So maybe we can have wrap_tails_create_iuks consider different things:

• feed it either MATCHING_JENKINS_IMAGES_BUILD_ID or some https://nightly.tails.boum.org/[…] URL so that it fetches the latest images from there on its own (e.g. https://nightly.tails.boum.org/build_Tails_ISO_stable/builds/3271/archive/build-artifacts/).
• or make it possible to specify whatever base URL, so that the release manager du jour is able to push images to their favorite location, and use that to have the wrapper download them from (e.g. https://tails.debamax.com/latest/ is something I could use).

Of course, one would need to authenticate images properly, checking the signatures…

What do you think?