Custom Query (196 matches)

At the moment, achernya has the apt repo signing key on his laptop. We should put it somewhere more useful.

See discussion 2011-09-09 on -c scripts -i apt.

1. Stick it in the locker
   1. Unencrypted (protected by AFS ACLs to scripts-root)
   2. Encrypted to maintainer's keys
2. Stick it on the hosts
3. Stick it on the Fedora guests
4. Stick it on some build VM or server
   1. scripts-owned hardware in SMR
   2. Shared (eg, zulu/magrathea)
5. Something else
6. Have each maintainer store it themselves

(3) is a bit silly. Other than that, I think they were all vaguely acceptable. One concern is whether a signed repo with a leaked key is worse than an unsigned repo (if it isn't, then being insecure is vaguely okay). (4) should ideally avoid having a single un-backed-up VM that needs to not vanish, by storing the key elsewhere.

Fedora 18 and later has httpd 2.4. Things we need to port (or check that we don’t need to port) include:

• suexec
• mod_status security
• ​the-bug
• ​mod_vhost_ldap

“You can request a non-MIT hostname, but you'll have to register the hostname yourself and configure it's DNS with a CNAME record for "scripts-vhosts.mit.edu." or an A record for scripts-vhosts.mit.edu's IP address, 18.181.0.46.”

This isn’t useful to the typical user; the choice between CNAME and A is just confusing. Also, there are too many caveats associated with CNAMEs (canonicalization will kill most of your incoming mail, and you can’t use them at the top of a zone). We should just tell all users to use A records.

If for some reason we want to document that CNAMEs are supported even though they’re strictly inferior, we can put that information in an FAQ somewhere, but it shouldn’t be on the Pony form.