### What needs to get done With PR #837 we have non-working support for fetch-service sessions that are externally managed. The things that keep us from "fully" supporting it are: - Today the fetch-service session handling is done *after* the LXD instance is created and setup, but we need to do some configuring on the instance *during* its setup. This includes things like doing a full apt-update and pushing&installing the fetch-service certificate. This is not something that craft-providers supports today. - Since these instances will have a random certificate installed, we need to fully isolate them from non-fetch-service builds. This means *not* using a base instance, and fully cleaning a pre-existing one (build must be "from scratch" each time). Another point here is that if we're going to support this case - using the fetch-service *during* instance setup - we should use it in the existing "managed" fetch-service "mode" too. This simplifies the code (only a single path) and makes both "modes" closer to each other. The `fetch-service-external` spread test from #837 can be used to valid implementations, as it's currently a "strict xfail" because of these limitations. ### Why it needs to get done Without this we cannot support external sessions.