consider an installation method that does not use a config repo

[rptaylor]

Based on http://www.eessi.io/docs/getting_access/native_installation/ and looking at the cvmfs-config-eessi RPM, it looks like you have designed it to coexist with the cvmfs-config-default package. We did the same with our cvmfs-config-computecanada package and this makes sense in some ways and is convenient (providing access to all the CERN, OSG, EGI etc repos). However, our config package also installs a config file which overrides the default config repo to ours:

/etc/cvmfs/default.d/80-computecanada.conf:CVMFS_CONFIG_REPOSITORY=cvmfs-config.computecanada.ca

Without that, in the EESSI installation you get the default that comes with cvmfs-config-default.rpm:

/etc/cvmfs/default.d/50-cern.conf:CVMFS_CONFIG_REPOSITORY=cvmfs-config.cern.ch

Although that is the standard default behaviour of CVMFS, if you want to fully avoid the security implications of using a config repo and want to provide an easy way for sites to use EESSI repos only, without any config repo, you could make a new package based on cvmfs-config-eessi (maybe call it cvmfs-config-eessi-standalone) and add the "cvmfs-config" RPM capability, like cvmfs-config-default has:

$ rpm -q --whatprovides cvmfs-config
cvmfs-config-default-2.0-1.noarch

This would cause cvmfs-config-eessi-standalone to replace and conflict with cvmfs-config-default so the latter would not need to be installed and no config repo would be active. (CVMFS requires the 'cvmfs-config' capability but I think the idea was that organizations could provide this via their own config package if they want to avoid using the default config repo.)

This is assuming that cvmfs-config-eessi directly provides all the config required to access EESSI repos, but I see there are also EESSI config/keys in /cvmfs/cvmfs-config.cern.ch so not sure if that is the case.

Related: cvmfs/cvmfs#3542