[Sugar-devel] [Systems] aslo -> CDN

[Bernie Innocenti]

[cc += sugar-devel@]

On Thu, 2009-11-26 at 08:44 -0600, dfarning at sugarlabs.org wrote:
> Many people have access to the upload directory.

We could mitigate this by using separate groups. We already use a soas
group for soas.

Besides, do the activity authors still need to upload source tarballs
here? Couldn't this be done with Remora?

If not, couldn't we set release tags on Gitorious and download the
tarballs from cgit? I know release tarballs sometimes contain more files
than just a git snapshot, but it would work for most activities.


>  My thought is to
> start moving towards a staging directory layer.  Individuals will have
> assess to specific staging directories.  From there, a cron job can
> sync from staging/ to downloads/ .

If the script just moves the files over without any additional checking,
security would remain unchanged.

One possibility is requiring all files to be gpg signed by the author,
but this makes things quite complicated: most developers do not seem to
be familiar with gpg, and we'd still have to come up with some fancy ACL
system based on the gpg key.

It would be much easier if Remora could be configured or extended to
distribute all our source tarballs too.

-- 
   // Bernie Innocenti - http://codewiz.org/
 \X/  Sugar Labs       - http://sugarlabs.org/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
Url : http://lists.sugarlabs.org/archive/sugar-devel/attachments/20091130/87672e5c/attachment.pgp