From: DJ Delorie <dj@redhat.com>
To: Mark Wielaard <mjw@gnu.org>
Cc: siddhesh@gotplt.org, libc-alpha@sourceware.org, carlos@redhat.com
Subject: Re: patchwork upgrade week
Date: Mon, 27 Jun 2022 13:23:37 -0400 [thread overview]
Message-ID: <xnilomja06.fsf@greed.delorie.com> (raw)
In-Reply-To: <YrOJWSiIyV5+BYuN@wildebeest.org>
Mark Wielaard <mjw@gnu.org> writes:
> If not, how else can we authenticate a patch as "OK to let the
> buildbot do a try build?"
[/me is back from vacation]
The method we're using to add this type of authentication is GPG-signed
emails. I.e. an authorized user would reply to the patch email, in the
reply give a command to their runners, and sign the command. The system
would authenticate the signature and authorize the runners to act as
instructed. Example:
In-Reply-To:...
...
Joe User wrote:
>
> The patch
>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
%cicd buildbot expensive-hosts . . .
-----BEGIN PGP SIGNATURE-----
. . .
-----END PGP SIGNATURE-----
Each runner decides whose commands they honor, and which, and how. The
curator manages the authentication, so only one keyring is needed.
Note that our existing 32-bit trybot does not use this; it assumes
patches may be malicious and plans accordingly. This allows it to
proactively test all posted patches.
next prev parent reply other threads:[~2022-06-27 17:23 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-06-20 10:26 Siddhesh Poyarekar
2022-06-22 6:53 ` Siddhesh Poyarekar
2022-06-22 21:27 ` Mark Wielaard
2022-06-23 2:16 ` Siddhesh Poyarekar
2022-06-23 7:55 ` Mark Wielaard
2022-06-23 8:39 ` Siddhesh Poyarekar
2022-06-27 17:23 ` DJ Delorie [this message]
2022-07-01 11:04 ` Mark Wielaard
2022-07-01 21:01 ` DJ Delorie
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=xnilomja06.fsf@greed.delorie.com \
--to=dj@redhat.com \
--cc=carlos@redhat.com \
--cc=libc-alpha@sourceware.org \
--cc=mjw@gnu.org \
--cc=siddhesh@gotplt.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).