[Savannah-help-public] [sr #107077] bzr+ssh:// preferable to sftp://

[Sylvain Beucler]

Follow-up Comment #20, sr #107077 (project administration):

"bzr does not permit configuring server side hooks in the repository because
of security concerns"

But every VCS I know allow this (?).

For example: do you intend, at a point, to implement centralised mail
notification on commit? (which is the first thing people ask here)
Currently this relies on an expansive, per-repository scanning every 5
minutes through bzr-hookless-email, which isn't scalable.

I expect bzr+ssh to eventually work as a restricted shell that will also
execute repository hooks, and these hooks should be stored in a
root-restricted directory (like CVS/SVN/Git/Hg).
(in which case sftp access would be closed to make sure hooks are executed)

If you never intend to allow server-side hooks at the repository (!=user)
level, I guess I can enable bzr+ssh (provided we make sure that homedirs will
stay read-only), but this sounds strange.
Currently I'd expect bzr+ssh to eventually run repository hooks.


    _______________________________________________________

Reply to this item at:

  <http://savannah.gnu.org/support/?107077>

_______________________________________________
  Messaggio inviato con/da Savannah
  http://savannah.gnu.org/