[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

t2u in the archive (was: General Resolution to deploy tag2upload)



On 17273 March 1977, Sean Whitton wrote:

The ftpmaster team have refused to trust uploads coming from the
tag2upload service.  This GR is to override that decision.

took us a few days to discuss and get to a point, but hey, where is the
hurry anyways? It's not like we are time bound in implementing this.

Now, we have the following proposal on how to get t2u integrated. Note,
we are not entirely happy with it and do not think this is the best way
forward, but given the current situation, it is a way that gets things
untangled, and then we see what the future will bring.

So, in short: A t2u uploaded source package should consist of whatever
t2u produces (normal Debian source package) *plus* two additional files.

The first file contains client side generated data, but to *not*
overburden the client, this *only* consists of the output of `git
ls-files --format="%(objectmode) %(objectname) %(path)"` for the tag
that should be uploaded, signed by the DD/DM key - or something
similarly easily generated on client side. Exact format can be hashed
out between t2u people and ftpmaster during implementation.

The second file consists of a shallow git clone of the repository for
the tag that t2u wants to upload, put into an appropriately named
tarball.

We believe that this, while not being ideal, serves both sides: t2u has
their "just git and similar anyways-available-tools on client", while
the archive gets enough uploaded to independently do whatever it wants
to do.

Obvious (ha) note: The above mentions a command and stuff, but the exact
way is up to implementation. It can even contain more data if deemed
useful or add a file from t2u with a list what it added/generated, for
example. Or - in the future - might be completely replaced with another
implementation we all agree on, provided it has similar minimal basic
requirements as the thing proposed here. (Summarized as detached
signature from the DD/DM over the tree of the tag, and that tree/tags
data available in a file beside the upload).

--
for the FTPTeam,
Joerg,
Thorsten,
Ansgar,
Scott,
Luke


Reply to: