[debexpo-devel] Considerations about email addresses/features
Christoph Haas
email at christoph-haas.de
Wed Jun 4 18:12:41 CEST 2008
On Mittwoch, 4. Juni 2008, Jonny Lamb wrote:
> On Wed, Jun 04, 2008 at 05:28:16PM +0200, Christoph Haas wrote:
> I'm not sure optional authentication is possible. At the time of
> writing, debexpo HEAD forces all uploads to authenticate, based on the
> email and md5'd password in the users table. In other words, you can
> upload a package with Maintainer different from your login email.
> debexpo will never send emails to the address in Maintainer. This should
> satisfy Michael's original request.
>
> Anyway, I'm not sure how else you could disable uploading
> authentication. One way could be if when uploading, 401 was thrown to
> dput. Then, when the package is in the incoming directory, debexpo could
> look at the value of Maintainer and look in the database for a user with
> such an email address. But, this means anyone can upload a package with
> an arbitrary "Maintainer" and pretend it's someone else..
>
> However, for this reason, I now see why Christoph looked at the PGP key.
Now I see it, too. :) Yes, indeed. People accidentally uploaded other
people's packages which lead to confusion. At first I started with a
blacklist but that didn't quite cut it. So I relied on the PGP signature
and have a keyring running (which is also very troublesome due to
permissions given to the web server).
> Each package's "distribution" is stored in the database already. I
> intend to make sources.list entries possible:
>
> deb http://mydebexpo.reposito.ry/something/user@email.com unstable
> main
>
> This way, a user can still filter out all packages not for unstable, and
> all packages not for main. Distributions and components can be anything.
> They are stored as strings in the database.
Purrfect.
Christoph
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part.
Url : http://workaround.org/pipermail/debexpo-devel/attachments/20080604/e501164b/attachment-0001.pgp
More information about the debexpo-devel
mailing list