Custom Query (196 matches)

At the moment, achernya has the apt repo signing key on his laptop. We should put it somewhere more useful.

See discussion 2011-09-09 on -c scripts -i apt.

1. Stick it in the locker
   1. Unencrypted (protected by AFS ACLs to scripts-root)
   2. Encrypted to maintainer's keys
2. Stick it on the hosts
3. Stick it on the Fedora guests
4. Stick it on some build VM or server
   1. scripts-owned hardware in SMR
   2. Shared (eg, zulu/magrathea)
5. Something else
6. Have each maintainer store it themselves

(3) is a bit silly. Other than that, I think they were all vaguely acceptable. One concern is whether a signed repo with a leaked key is worse than an unsigned repo (if it isn't, then being insecure is vaguely okay). (4) should ideally avoid having a single un-backed-up VM that needs to not vanish, by storing the key elsewhere.

See RT 1524793, in which a user was confused about a Python path with the wrong precedence: user paths should always be the most important.

See also #10

/set status=FOO

and similar commands from email don't appear to be working. The zephyr bot might also be dead.