7 ms·

Not at all: adding new packages or developers is automatically signed (by the snapshot bot). Administrators may later sign the keys and delegations, individuall

by AltGr 11y ago

Not at all: adding new packages or developers is automatically signed (by the snapshot bot). Administrators may later sign the keys and delegations, individually or in batch, after verifying the developer identity out of band (the specification doesn't yet include the mechanisms for this verification, but with a git repo based on GitHub, the GitHub login gives a good start).

justinsb 11y ago
Thank you for the clarification. Can I install these "not yet trusted" packages? Presumably I can, I just get a big warning. And how do you deal with squatters - can I (as the "real developer") submit a second claim on an unverified package name (that an impostor has claimed)? Edit: And does this mean that the snapshot bot automatically merges (well-formed) pull requests for new packages?
- AltGr 11y ago
  The pull-requests for new packages are manually merged (as it the case now), automatically signed. Names uniquely identify one package. A repository maintainer can replace the owner of a package, and clear the existing package contents. This shouldn't be done for a different package with the same name if any users still have the package installed, though, as they will consider that an up/down-grade. Hope that clarifies a little!
  - justinsb 11y ago
    That does help me a lot - thanks! The manual "pre-approval process" via accepting the PR is what I was missing, and that does seem to fix most of the shortcomings of the underlying system (assuming a reliable human!) So you have a human that looks at incoming requests to prevent abuse, and to arbitrate problems. And then the snapshot server signs that result to allow distribution over HTTP, and then periodically it gets signed by the quorum of "gods" to indicate that these packages have the full seal of approval. I think it is pretty specific to OCaml's current workflow and volume, but signing is better than not signing!
    - AltGr 11y ago
      It's indeed specific to our workflow -- allowing additions without moderation would cause all sort of problems we don't address; but not to OCaml, e.g. Homebrew uses a very similar, GitHub based workflow (which we actually drew lots of inspiration from) ! What is nice is that the moderation, if given the proper reports, e.g. Travis with lint and security checks, is very fast in the simple cases, and readily opens discussion in the others -- that's where GitHub really shines. I mentionned GitHub, but note that we intend to also provide the tooling to host your own signed repository, indenpendently of it.

by AltGr 11y ago

justinsb 11y ago

Thank you for the clarification. Can I install these "not yet trusted" packages? Presumably I can, I just get a big warning. And how do you deal with squatters - can I (as the "real developer") submit a second claim on an unverified package name (that an impostor has claimed)? Edit: And does this mean that the snapshot bot automatically merges (well-formed) pull requests for new packages?

AltGr 11y ago
The pull-requests for new packages are manually merged (as it the case now), automatically signed. Names uniquely identify one package. A repository maintainer can replace the owner of a package, and clear the existing package contents. This shouldn't be done for a different package with the same name if any users still have the package installed, though, as they will consider that an up/down-grade. Hope that clarifies a little!
- justinsb 11y ago
  That does help me a lot - thanks! The manual "pre-approval process" via accepting the PR is what I was missing, and that does seem to fix most of the shortcomings of the underlying system (assuming a reliable human!) So you have a human that looks at incoming requests to prevent abuse, and to arbitrate problems. And then the snapshot server signs that result to allow distribution over HTTP, and then periodically it gets signed by the quorum of "gods" to indicate that these packages have the full seal of approval. I think it is pretty specific to OCaml's current workflow and volume, but signing is better than not signing!
  - AltGr 11y ago
    It's indeed specific to our workflow -- allowing additions without moderation would cause all sort of problems we don't address; but not to OCaml, e.g. Homebrew uses a very similar, GitHub based workflow (which we actually drew lots of inspiration from) ! What is nice is that the moderation, if given the proper reports, e.g. Travis with lint and security checks, is very fast in the simple cases, and readily opens discussion in the others -- that's where GitHub really shines. I mentionned GitHub, but note that we intend to also provide the tooling to host your own signed repository, indenpendently of it.