Hi,
I was looking at options we have for setting up an automated way to
mirror our
fedorahosted.org repo to
github.com. Unfortunately, the
github mirror functionality seems to be discontinued[*], so the next
best thing to do is to set up a github deploy key:
https://developer.github.com/guides/managing-deploy-keys/#deploy-keys
The private key would be on the machine we'd mirror from, the public key
would be uploaded to github. My question is -- do we want to set up the
push job on
fedorahosted.org or one of our machines?
1)
fedorahosted.org
[+] We don't have to manage the machine, dedicated admins do
[-] We'd have to give read ACL to an identity that pushes /all/
fedorahosted.org projects.
2) Our own (CI?) machines
[+] We manage the machine with the private key. We keep control of the
key.
[-] We manage the machine with the private key. We're developers, not
admins.
I would personally prefer 1) because if the git user on fedorahosted is
compromised, all bets are off anyway and the concern about a push key to
our /mirror/ repo would not be the primary one. But at the same time, I
don't feel comfortable doing the decision without asking the
list.
So -- is anyone opposed to me asking
fedorahosted.org to generate a keypair
and giving us the public key that I would upload to github?
Thanks!
[*] github has gained enough traction already, so they don't care about
this functionality anymore..
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/admin/lists/sssd-devel@lists.fedorahosted.org