Re: [RFC] General Resolution to deploy tag2upload

[Joerg Jaspert <joerg@debian.org>]

On 17259 March 1977, Ian Jackson wrote:

> > Thanks.  Then possibly it is sufficient for ftpmaster just to disable
> > tag2upload's whole key until the keyring update is pushed.
> I'm not sure this is a sufficient answer.  We don't want uploads by
> revoked keys to appear on *.dgit.d.o either.

> Joerg, is there some way that this fingerprint block information could
> be made available in a more timely manner?  Ideally we would update
> push.dgit.d.o to use this information, regardless of tag2upload.
> (And the t2u conversion system should use it too.)

> I think maybe we should take this to a different venue, than this
> thread on -vote.  How about a bug against ftp.d.o and/or
> dgit-infrastructure ?

I think this is a minor issue, actually. It does not happen often. For
the time it will, we can have something like "ftpmaster pushes a list of
fingerprints via $mechanism" (ssh forced command is widely used for
similar things, for example).

That's really simple to implement.

--
bye, Joerg