[SSSD] New Try to build SSSD on Karmic both as of 2009.08.04

Stephen Gallagher sgallagh at redhat.com
Mon Aug 17 14:30:45 UTC 2009


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 08/13/2009 07:34 PM, Karsten Wade wrote:
> On Tue, Aug 11, 2009 at 06:09:24AM -0400, Simo Sorce wrote:
> 
>> Given we use git it doesn't seem a great match.
>> If the Fedora facility do upgrade to the newer Transifex, then maybe
>> that's going to be easier for us as we will not need to make any bzr to
>> git transformation and use 2 separate account systems, etc...
> 
> I just checked on this, it's in progress.  I'll send along the Trac
> ticket when it's generated so anyone can watch it.  Diego is working
> on the 0.7 upgrade, and he needs a db dump that cannot happen until
> after Fedora 12 Alpha freeze (Fedora Infrastructure freezes changes
> and certain activities around release times.)  That would make it
> "after a few weeks", since Alpha was pushed back a week.
> 
> He asked that we file a ticket on Transifex.org that explains what we
> would be looking for in a l10n workflow so that it fits with the SSSD
> development model.  I can file the ticket, but need a solid idea of
> what SSSD would want (I'll run the same concept by the rest of
> FreeIPA, figuring there it's identical?)  These would be features that
> could appear in 0.8 if they do not exist currently in a way you can
> use.
> 
> Another idea, btw, is to use the instance at Transifex.net instead of
> translate.fedoraproject.org.  It depends, I suppose, on which group
> you want to get a new account (presuming they don't have a
> Transifex.net account yet) -- Fedora l10n community who don't have a
> Transifex.net account, or non-Fedora l10n community who don't have a
> Fedora Account. :)  In the end, I think the effect on SSSD is the
> same, but it may be different in the longer term depending on where
> you see the bulk and growth of your l10n community to be.
> 
> - Karsten
> 
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel

Sorry for the long delay in my reply. We've been busy getting SSSD 0.5.0
ready for release.

I've been thinking about how we can sort out the translations without
requiring major architecture changes to Transifex, and I've come up with
the following set of our requirements, and then some suggestions on how
to implement them.

We really have only one unbreakable rule: All submissions to the
upstream git repository must be approved by a "gatekeeper" (At present,
this means Simo Sorce, Sumit Bose or myself).  This is absolutely
necessary in a low-level security feature such as the SSSD. There must
be no possibility that, through a security vulnerability in Transifex, a
user could submit code to the SSSD without security review.

In our typical (non-translation) development process, we submit our
patches to the public mailing list and receive a review from one or more
of our peers on the project. Once that code is "acked", one of the
gatekeepers will then do a final review and apply the path to our
upstream git repository. (This final review is generally waived if a
gatekeeper was the primary reviewer)

As I understand it, the way Transifex works is that we are required to
add the "transifex" user to our gatekeepers list and trust that the
Transifex system will allow only translation changes to be made.

What we originally discussed as our needs in Transifex was that, once a
translation was made, that the Transifex server should automatically
email that patch to the sssd-devel list, where it would then be treated
as any other development patch.

As I thought more about it, I began thinking that a more reasonable
approach (within the existing Transifex process) would be to have
Transifex add an approval process into the system. Instead of needing to
mail out patches, Transifex should be configurable with a set of users
authorized to approve submissions to git. When a translation is made, it
should auto-notify either the sssd-devel mailing list or possibly just
the list of gatekeepers for the project.

The project gatekeeper would then be able to log into Transifex, inspect
the change to ensure it doesn't look suspicious and then sign off on the
change. Then and only then, should Transifex have permission to submit
the patch directly to git. (Ideally, it should also add the --signoff
argument to note which gatekeeper approved the change)

I'm not sure how much of this is available in the current release of
Transifex, and how much would be needed in 0.8.

Karsten, please CC me on the ticket when you create it.


- -- 
Stephen Gallagher
RHCE 804006346421761

Looking to carve out IT costs?
www.redhat.com/carveoutcosts/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkqJaY8ACgkQeiVVYja6o6Pc7gCeMR3cDYFs2MNRMyzBbAk/AB3u
D1gAn0jmSsuebWBnkzD2L1IoTMYsiRe2
=XWLJ
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list