[debexpo-devel] implement autobuilders

Jonny Lamb jonny at debian.org
Mon Feb 2 19:20:39 CET 2009


On Sun, Feb 01, 13:31:18 -0800, Ondrej Certik wrote:
> Yes, that's already implemented in debexpo.

Yes, a SOAP interface is already there, but you'll need write a new
method to list packages which aren't built on all architectures. This
should be fairly simple.

> Yes, I'll create a new gpg key for each autobuilder and they will sign
> the binary. Debexpo will have the list of gpg keys and only accept
> uploads from them.

This also relates to my discussion with Serafeim earlier regarding using
/usr/bin/gpg directly. It would be a lot cooler if you used something
like python-gpginterface (NB: I've never actually used this module; it
might be on crack).

> So the only thing is how to actually import a new binary package and
> debexpo should be able to handle it already?
> 
> E.g. unless there is something that I don't see, all that I have to do
> is to poll the SOAP interface, build the binary package, sign it and
> upload it using dput? Why do I need a new importer script?

This is the current database design:

   http://jdl.ducs.org.uk/misc/debexpo-db-7.png

If you uploaded a source package, there would be an entry in packages,
package_versions, source_packages, and a couple in package_files. This
is all cool. Now, if you get a source package and build it, and you send
back the .deb files, you only really need to create a new
binary_packages entry and package_files entries for each .deb you
upload.

Hm, thinking about it, you may be able to simply upload a built package
(using dput, in the normal way) and the importer could check the
orig.tar.gz and diff.gz and if they're the same, and there are no binary
packages for that arch already, then just import the binary package.

This actually sounds fairly easy to do. The trickiest thing to do is
simply to decide about what to accept. For example, do you only allow
these binary upload on top of a source upload by a select few keys, or
by the uploader in the first case, or something else?

The thing is, the current importer wants a username and password before
accepting any files. This is good, and will not be changed. Therefore,
this means that an autobuilder should have a username and password,
which means the GPG checking can go out of the window, but having an
autobuilder username is horrible.

Perhaps try to actually implement it first, and see if any other bridges
are hit when you do so.

-- 
Jonny Lamb, UK
jonny at debian.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: Digital signature
URL: <http://workaround.org/pipermail/debexpo-devel/attachments/20090202/f60ab992/attachment.pgp>


More information about the debexpo-devel mailing list