php to the backend newimageid script so that the web interface does not
have to worry about provenance issues. Cleaner too. Also some cleanups to
log image spew.

global system images right now, exposing release and rollback to users to
going to take some thinking, since it will confuse people.

Make sure .sha1 file has same owner as image file.
If image file doesn't exist, get rid of any dangling .sha1 file.

Resurrect: get the basic signature matching code working again.

Enhance: add -U option to have imagezip update (or create) the
signature file. Previously, the signature file was created off-line
on boss with the imagehash command (that would be Mike's "imagehash"
(/usr/testbed/bin/imagehash) and not Leigh's "imagehash"
(/usr/testbed/sbin/imagehash)). Creating it as we create the image
makes a lot of sense...except for how we do it. We actually read and
create the hashes as a separate pass before we re-read, compress, and
create the image--so we read the disk twice. [This is primarily because we
are mooching off of the existing hash checking code (-H option). Doing
this right will require re-writing The Big Loop which makes a single
pass through the data, simultaneously dealing with disk IO, allocated
ranges, and compression blocks all of which have different size/alignment
criteria. But I digress...] Anyway, reading the disk data twice sucks,
but at least it is on the client and not on boss. The take away is:
don't create your images on pc600s.

Note that -U will always create a signature file for the complete disk
or partition even when you are creating a delta image (i.e., when combined
with -H).

Enhance: add "-P <pct>" option, used with -H, which tells imagezip that if
a resulting delta image would be over <pct> percent the size (where size
is number of uncompressed sectors in the image) of a full image, then just
create a full image instead. So "-P 50" says if it would be over half the
size, "-P 200" says if it was over twice the size, etc. If you always want
a delta image to be produced, use -H without -P. If you always want a full
image, don't use -H.

This is part 2 of supporting images. Part 1 is the DB and user interface
changes that Leigh is working on. Part 3 is next up and involves modifying
the image creation MFS to download and use signatures along with the
new imagezip when creating images. Stay tuned.

Experiments expire, not profiles

names in different kernels.

(Again.)

Apparently the CA we use isn't in the set that the perl LWP module uses
for its root.

an alternate CA so that they can never authenticate to the Geni
federation if they manage to get a hold of their certifiate (which
they can't). Only when TBMAINSITE=1

Remove level2 panic from menu for geni slivers (nodes). One level
will do ya.

This is not so much for efficiency but because it gives us more precise
knowledge about failures. Previously, if one node in the batch sent to
os_load failed, we didn't know which one so we had to assume all failed
and go back and reload them again. Granted, this situation was one that
"should not happen", but it does happen quite a lot, at least now when
we have flaky (IPMI) power control.

Also, brought some uniformity to the messages printed out; ie., print
a freakin timestamp already!

and replace with a hidden close button at the bottom, that
is displayed when imaging is complete.