On Sat, Nov 19, 2005 at 06:57:41PM +0100 or thereabouts, Danny van Dyk wrote:
> | There are no provisions for key management and I cannot see an easy way to
> | handle it.  It's easy to add new keys, but how do we clean out old keys for
> | retired arch testers?  (including arch testers that "retire" without ever
> | informing us)  SSH doesn't log key ID as near as I can tell, so we have no
> | way of tracking what keys are used and how often.  Also, how do we
> | definitively correlate an SSH key with an arch tester?
>
> Do we have to? Nobody has to track how often an Arch Tester uses RO
> access to CVS, as you don't need that information. RO CVS access is a
> service to the ATs. Their work is pretty much outside CVS...

Yes, we have to.  If someone retires, their access needs to be revoked.

> | Now, the same question for email -- how do we manage aliases, especially
> | for inactive, retired and semi-retired arch testers?  We could track usage
> | in logs, but between mailing list subscriptions, bugzilla
> notifications and
> | all sorts of other automated emails, that's not an accurate representation
> | of whether an email alias is actively used or not.
> Afaik the gentoo.org address is only a forward to their normal adress,
> so one can hardly speak 'active usage'. You simply can't actively use
> it! On the other hand, tracking down how active/inactive a AT/HT is
> falls under the project the AT/HT is associated with, or the AT/HT
> Project (hparker) as last resort. So if he says 'AT foo is inactive',
> he's to be removed from email forwarding and CVS RO Access. I really
> don't see the problem here.

Because, in practice, this doesn't happen.  Accounts (or, in this case,
email addresses) stay around until someone gets enough of a bee under their
bonnet to do somethig about it.  Since there's no pain or cost for the
AT/HT project lead, there's no reason for them to be vigilant about
tracking activity.  Plus, assuming we have a large number of these testers,
how are people going to know whether or not one specific arch tester is
active?  That's not an acceptable solution.

--kurt