Re: Debian upload monitor

2008-05-03 Thread Reinhard Tartler
Enrico Zini <[EMAIL PROTECTED]> writes: > Whether it belongs to QA or ftp-master, is what I'm trying to find > out. May I suggest that each ACCEPTED mail sent by dak could include a list of the last n accepted packages. This way no extra active service would need to be established. n is either

Re: Debian upload monitor

2008-05-02 Thread Thomas Viehmann
Enrico Zini wrote: For example, you have several IDs in your key. If I have reason to believe that you don't receive mail in one of them (for example, I can notice that a domain has expired, or I can send fake spam to all of them and see if one bounces), then I can use that address in Maintainer

Re: Debian upload monitor

2008-05-02 Thread Kurt Roeckx
On Thu, May 01, 2008 at 04:46:00PM -0400, Roberto C. Sánchez wrote: > On Thu, May 01, 2008 at 05:58:40PM +0100, Enrico Zini wrote: > > On Thu, May 01, 2008 at 05:25:16PM +0200, Thijs Kinkhorst wrote: > > > > > Doesn't dak already send you an email when it processes an upload with > > > your > >

Re: Debian upload monitor

2008-05-01 Thread Roberto C . Sánchez
On Thu, May 01, 2008 at 11:39:32PM +0100, Enrico Zini wrote: > On Thu, May 01, 2008 at 04:46:00PM -0400, Roberto C. Sánchez wrote: > > > I am curious how you could craft an upload that would use a key > > (ostensibly not your own, since you would know what you are uploading > > anyway) where you c

Re: Debian upload monitor

2008-05-01 Thread Enrico Zini
On Thu, May 01, 2008 at 04:46:00PM -0400, Roberto C. Sánchez wrote: > I am curious how you could craft an upload that would use a key > (ostensibly not your own, since you would know what you are uploading > anyway) where you could use some random DD's key to do the upload > without an email going

Re: Debian upload monitor

2008-05-01 Thread Stefano Zacchiroli
On Thu, May 01, 2008 at 04:46:00PM -0400, Roberto C. Sánchez wrote: > I am curious how you could craft an upload that would use a key > (ostensibly not your own, since you would know what you are uploading > anyway) where you could use some random DD's key to do the upload > without an email going

Re: Debian upload monitor

2008-05-01 Thread Roberto C . Sánchez
On Thu, May 01, 2008 at 05:58:40PM +0100, Enrico Zini wrote: > On Thu, May 01, 2008 at 05:25:16PM +0200, Thijs Kinkhorst wrote: > > > Doesn't dak already send you an email when it processes an upload with your > > key? What exactly does this add on top of that functionality? > > The problem is t

Re: Debian upload monitor

2008-05-01 Thread Enrico Zini
On Thu, May 01, 2008 at 05:25:16PM +0200, Thijs Kinkhorst wrote: > Doesn't dak already send you an email when it processes an upload with your > key? What exactly does this add on top of that functionality? The problem is that it seems to be possible to craft an upload that will send an email el

Re: Debian upload monitor

2008-05-01 Thread Thijs Kinkhorst
Hi Enrico, On Thursday 1 May 2008 17:19, Enrico Zini wrote: > I've put together a little script that allow to monitor all uploads > performed with a GPG key.  You can find the result at > http://merkel.debian.org/~enrico/keylog/ Doesn't dak already send you an email when it processes an upload wi

Debian upload monitor

2008-05-01 Thread Enrico Zini
Hello, I've put together a little script that allow to monitor all uploads performed with a GPG key. You can find the result at http://merkel.debian.org/~enrico/keylog/ A longer description with pointers to the code is here: http://www.enricozini.org/2008/tips/audit-uploads.html I have no plans