I fixed the 2 issues I have opened a couple of months ago, so now we don't have any pending issue. So, what do you think about releaseing 0.7 (or is it 0.6)?
BTW, regarding syncing with ibiblio's, looks like it is possible at all; I sent a message to the maven-dev list and the answer is that all we need is "a ssh accessible server with their repo and add the maven public key (which is available somewhere, I can send it) so we can connect and grab everything.". Is it possible to access SF's repo via SSH?
-- Felipe
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
As for the ibiblio sync, I have a couple of questions. I used to follow the maven-dev but I unsubscribed, and I can't find any posts under your name for the last couple of months. Can you send a link to it on the mailing list archives? (http://mail-archives.apache.org/mod_mbox/maven-dev/)
1. Can you please send a link to maven's public key? I have just searched for 5 minutes and I don't find it.
2. I'm not positive how we should securely open up a repository via ssh. I could add the maven key to my ~/.ssh/authorized_keys on my sourceforge account, which has a symlink to the emma project in ~/emma. How would I restrict access for the maven key to only that dir? I checked the man page for ssh and ssh_config but I didn't see anything. Anyone on the list know how to do this?
>> How would I restrict access for the maven key to
>> only that dir?
>
>Good question - I don't think that's possible...
I mean, we probably need to create an user on emma project just for that purpose (and if I understood correctly Carlos' last message on maven-dev, they do something similar on maven-plugins@SF, using an admin account).
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Thanks for the followup - hopefully Carlos can shed more light on this. So I guess that the dummy user owns the repository (has it under his home dir), rather than linking to a repo in the main project? This makes sense, but the only drawback is that this wouldn't be served over the web, and would thus require us to maintain a duplicate location for the artifacts (both in the emma-owned repo under the project tree, and in the dummy user's tree accessible via maven). I guess we could set up a separate group to control the permissions on the repo under the emma tree, but this seems like a lot of trouble.
It would be good if Carlos could tell us exactly how he handles it for the maven plugins project on SF.
-- Chad
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Chad,
I fixed the 2 issues I have opened a couple of months ago, so now we don't have any pending issue. So, what do you think about releaseing 0.7 (or is it 0.6)?
BTW, regarding syncing with ibiblio's, looks like it is possible at all; I sent a message to the maven-dev list and the answer is that all we need is "a ssh accessible server with their repo and add the maven public key (which is available somewhere, I can send it) so we can connect and grab everything.". Is it possible to access SF's repo via SSH?
-- Felipe
First of all, great job on the fixes.
As for the ibiblio sync, I have a couple of questions. I used to follow the maven-dev but I unsubscribed, and I can't find any posts under your name for the last couple of months. Can you send a link to it on the mailing list archives? (http://mail-archives.apache.org/mod_mbox/maven-dev/)
1. Can you please send a link to maven's public key? I have just searched for 5 minutes and I don't find it.
2. I'm not positive how we should securely open up a repository via ssh. I could add the maven key to my ~/.ssh/authorized_keys on my sourceforge account, which has a symlink to the emma project in ~/emma. How would I restrict access for the maven key to only that dir? I checked the man page for ssh and ssh_config but I didn't see anything. Anyone on the list know how to do this?
Thanks,
Chad
http://docs.codehaus.org/display/MAVEN/Repository+-+Security+by+nat+pryce
> unsubscribed, and I can't find any posts under
> your name for the last couple of months.
I haven't post much lately; more specifically, I've been very inactive since last JavaOne.
> Can you send a link to it on the mailing list
> archives?
Sure:
http://mail-archives.apache.org/mod_mbox/maven-dev/200601.mbox/%3c43CC739A.9010902@felipeal.net%3e
(too see the whole thread, it's on page 34)
> 1. Can you please send a link to maven's public
> key? I have just searched for 5 minutes and I
> don't find it.
I don't know where it is, but I can ask Carlos.
> How would I restrict access for the maven key to
> only that dir?
Good question - I don't think that's possible...
> Anyone on the list know how to do this?
I will ask Carlos to join this discussion - he surely know, as he does it for the maven-plugins@sf project.
-- Felipe
>> How would I restrict access for the maven key to
>> only that dir?
>
>Good question - I don't think that's possible...
I mean, we probably need to create an user on emma project just for that purpose (and if I understood correctly Carlos' last message on maven-dev, they do something similar on maven-plugins@SF, using an admin account).
Thanks for the followup - hopefully Carlos can shed more light on this. So I guess that the dummy user owns the repository (has it under his home dir), rather than linking to a repo in the main project? This makes sense, but the only drawback is that this wouldn't be served over the web, and would thus require us to maintain a duplicate location for the artifacts (both in the emma-owned repo under the project tree, and in the dummy user's tree accessible via maven). I guess we could set up a separate group to control the permissions on the repo under the emma tree, but this seems like a lot of trouble.
It would be good if Carlos could tell us exactly how he handles it for the maven plugins project on SF.
-- Chad