Hector Oron writes ("Bug#906317: dgit: consider demoting git-buildpackage to
recommends"):
> As I understood, DSA team had some concerns for security reasons since
> porterboxes are meant to be used to debug package build failures and
> not used for anything else, so it is much preferred a 'push' scenario
> where developers push the code to porterboxes, rather than 'pull',
> being `apt-get source` the unique exception to that unwritten policy.
That concern seems to be related to #790093 and the presence of dgit
at all, rather than the Depends on git-buildpackage ?
> So developers would like to use `dgit push` from porterboxes, however
> getting that functionality also opens a can of worms, allowing for
> pulls as well.
This is probably out of context for this bug, but:
I think developers ought not to run `dgit push' on a porterbox because
that would involve exposing their private key (via gpg agent at least)
to the porterbox. It would be better to run `dgit rpush' on their own
machine. In practice do man people try to upload directly from a
porterbox anyway ?
I confess I haven't looked at what howtos etc. we provide to porters.
Maybe we should have a `how to be a porter' guide which covers finding
a machine, proper gitish source code management, BTS interaction, etc.
(That would I think inevitably result in advising the user to run
`dgit clone' on the porterbox for the same reasons that in a legacy
source-package-based workflow they would say `apt source'. Hence the
desire to fix #790093.)
Ian.
--
Ian Jackson <[email protected]> These opinions are my own.
If I emailed you from an address @fyvzl.net or @evade.org.uk, that is
a private address which bypasses my fierce spamfilter.
