[debexpo-devel] Considerations about email addresses/features

Jonny Lamb jonnylamb at jonnylamb.com
Wed Jun 4 17:52:59 CEST 2008


On Wed, Jun 04, 2008 at 05:28:16PM +0200, Christoph Haas wrote:
> I'm afraid so. Yes, currently the signer of the changes file is taken as 
> the uploading maintainer. I wanted to change that a while ago to the 
> person mentioned in the "Maintainer:" field of the control files but that 
> was a mess. I don't think it's necessarily bad but often the addresses 
> were different and the "Maintainer:" was a mailing list or something. It 
> should be no problem to do that correctly from the start so that 
> maintainers use proper control files.

Agreed.

> With optional authentication during the upload process the problem of 
> identifying the uploader will be gone anyway, right?

I'm not sure optional authentication is possible. At the time of
writing, debexpo HEAD forces all uploads to authenticate, based on the
email and md5'd password in the users table. In other words, you can
upload a package with Maintainer different from your login email.
debexpo will never send emails to the address in Maintainer. This should
satisfy Michael's original request.

Anyway, I'm not sure how else you could disable uploading
authentication. One way could be if when uploading, 401 was thrown to
dput. Then, when the package is in the incoming directory, debexpo could
look at the value of Maintainer and look in the database for a user with
such an email address. But, this means anyone can upload a package with
an arbitrary "Maintainer" and pretend it's someone else..

However, for this reason, I now see why Christoph looked at the PGP key.
I suppose authentication could be disabled if the PGP was looked at..
Thoughts? Is it really worth it? I can't imagine anyone would be too
annoyed at having to type his or her password into dput.

> I won't kill you. But let me just contact Google so they can redirect the 
> cheque. :)

I know you're kidding, but just to clarify: my point was that perhaps
dak could provide a service most suited to your needs at the moment. I'm
sure you're aware that debexpo isn't really ready yet! :-P

> Yes, I second that. For multiple repositories it's probably worth using 
> dak. Although I wonder if it's worth to allow multiple "queues" 
> or "repositories" in debexpo, too. So that I can e.g. provide certain 
> packages for Etch and Sarge in different paths. Jonny, do you think that's 
> worth it? Perhaps the apt-get'able URLs can be used to address a certain 
> repository?
> 
> http://mydebexpo.reposito.ry/apt-source/sarge
> http://mydebexpo.reposito.ry/apt-source/etch
> 
> That might not even mean that you have to extend the database schema. 
> Perhaps just save whether a package was uploaded to "unstable" 
> or "caipirinha" and allow to query for packages of that distribution.

Each package's "distribution" is stored in the database already. I
intend to make sources.list entries possible:

    deb http://mydebexpo.reposito.ry/something/user@email.com unstable main

This way, a user can still filter out all packages not for unstable, and
all packages not for main. Distributions and components can be anything.
They are stored as strings in the database.

I hope this helps.

Thanks,

-- 
Jonny Lamb, UK                                   jonnylamb at jonnylamb.com
http://jonnylamb.com                                     GPG: 0x2E039402
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url : http://workaround.org/pipermail/debexpo-devel/attachments/20080604/0c772211/attachment.pgp 


More information about the debexpo-devel mailing list