Re: [Gnu-arch-users] SourceForge-like repositories in an arch-centric world

[Tom Lord]

    > From: Andrew Suffield <address@hidden>

    > On Mon, Feb 02, 2004 at 04:19:08PM -0800, Tom Lord wrote:
    > > You'd want to think about public key management.

    > That is an entire project in its own right. One which has been
    > frequently attempted and invariably failed (usually before getting off
    > the ground).

No, no.  Not some big public-key-clearing-house-for-the-world.

Savannah users must already provide gnu.org with their public keys to
access some features.

What I'm suggesting thinking about is what kind of database and
checking tool to build to relate those keys to who is supposed to be
able to sign what arch revisions.  (One thing this would help with if
merged-from contributor archives are also mirrored is copyright
auditting.)


    > > If one wanted to make a really cool environment for project hosting
    > > with arch, I'm not sure what parts of the existing savannah
    > > infrastructure, if any, would be really helpful.

    > Mmm. Don't overestimate the parts of savannah that you see. Most of
    > the stuff you mentioned is lightweight php goo thrown over the top of
    > the real infrastructure; most of what gforge does is about managing
    > dns, ldap (for accounts and authentication), mail, postgresql (for
    > stashing all the crap that the php goo displays), ftp, and shell
    > access (plus cvs, but that's just thrown on the top of shell access).

Why the monolith?  No feature _I_ use actually does anything special
with dns.  Mail is provided by mailman and is flaky in part because of
some of the internal interdependencies on savannah.  FTP is nowadays
handled by separate software.  Shell access isn't needed for an arch
host.  ....



    > It's not particularly *good* at any of those things, mind, but that's
    > what it *is*.


-t