Re: [gentoo-dev] Official overlay support

[Duncan Coutts <dcoutts@gentoo.org>]

(re-sending as I sent from the wrong account)
On Wed, 2006-03-22 at 19:42 +0100, Stefan Schweizer wrote:
> On 3/22/06, Donnie Berkholz <spyderous@gentoo.org> wrote:
> > This definitely sounds like a fun idea. It would be even cooler if we
> > were using a distributed SCM on both ends that allowed for easy merging.
> 
> 
> I think it should be all in a central place possibly saved with
> GPG-Keys that need to be signed by trusted persons so that someone can
> get access.
> Because security seems to be a big problem with a public overlay, but
> I think with gpg-key-based-access it could work.

Yes, we use gpg signed patches for our darcs overlay system. We add the
gpg keys of our trusted contributers to a keychain (on the server where
the darcs repo lives). Then they use "darcs send --sign" and their
patches get applied automagically.

Patches from contributers who don't sign their patches (or if the key
check fails) get forwarded to the Haskell herd's email alias so any herd
member can review and apply / reject the patches.

-- 
Duncan Coutts : Gentoo Developer (Haskell herd team lead)
email         : dcoutts at gentoo dot org

-- 
gentoo-dev@gentoo.org mailing list