Re: Run TryBot-apply_patch on the full queue?

[DJ Delorie <dj@redhat.com>]

"Carlos O'Donell" <carlos@redhat.com> writes:
> My only concern had been "how do you authenticate this?"
>
> However, after having slept a full night I realized that we need signed
> emails, so the curator already needs to validate signatures.
>
> The "injection" API could take signed messages too?

Any authentication needs to happen before the request is sent to the
trybot.  In our current scheme, it's the curator's job.  If you write
your own patchwork bot, it will be up to you to figure out what/if
you're going to authenticate.

I'll note that authentication isn't really required just to see if a
patch *applies* though.  It's a build that's a security issue.

> Yes. We should just accept a "signed message" API?

The trybot API is not public.  It trusts the runner to manage
authorizations.  Curator authenticates, runner authorizes, trybot does[*].

> That would reuse all the same infrastructure we have for signed emails?

Once we have that, sure, we can share bits of code between the curator
and other patchbots.  However, once we have that, we might not *need* to
share that between patchbots, because the curator would handle those
cases for us.

But signed emails won't solve Siddhesh's request of retrying every
pending patch every day, because they won't be signed.


[*] because, as we all know; do or do not, there is no try.