launchpad-dev team mailing list archive

[Robert Collins <robertc@xxxxxxxxxxxxxxxxx>]

(private branches, security)

One way would be:
Give the slaves (outside the chroots/vms) an OAuth key for accessing LP,
and permit OAuth access to private branches.

Given that recipe execution (with arbitrary commands *disabled*) is safe
to run outside the chroot, the combination would seem safe to me.

If we need arbitrary command execution we have move the recipe *build*
step inside the vm/chroot environment, and there we'd want to use URL
aliases + a mirror of the branch made from outside the vm/chroot.

But that (temporary mirroring) is much more CPU work and more complex to
boot.

-Rob

Attachment: signature.asc
Description: This is a digitally signed message part