API token expiration time

Miroslav Suchy msuchy at redhat.com
Tue Jun 18 11:36:10 UTC 2013


On 06/18/2013 11:21 AM, Pierre-Yves Chibon wrote:
> Well, the "No one should be affected" is not entirely true. I'm
> packaging <super cool game>, use copr to build it, advertise it. My
> account is compromised, I don't realize it. Attacker uses the token to
> build <super cool game + my own little backdoor>, all the users of the
> repo get the update and "my own little backdoor" with it:)
>
> You're gonna say it isn't much different from the current situation w/
> the koji certificate.

OK.
So lets say 6 months? It can be changed anytime in future. OK?

Mirek


More information about the copr-devel mailing list