[rparker1@kc.rr.com: ssh+cvs is closer]

[rparker1@kc.rr.com: ssh+cvs is closer]

[Chris Faylor]

Can anyone explain the error below?  If so, is it fixable?

cgf

----- Forwarded message from Ron Parker <rparker1@kc.rr.com> -----

From: Ron Parker <rparker1@kc.rr.com>
To: cgf@cygnus.com
Subject: ssh+cvs is closer
Date: Tue, 04 Apr 2000 00:16:10 -0500

Using the cvs command that you sent me to day I got further, but
recieved a new error.

bash-2.03$ export CVS_RSH=ssh
bash-2.03$ cvs -d :ext:rdparker@sourceware.cygnus.com:/cvs/src co winsup

Enter passphrase for RSA key 'rdparker@localhost.localdomain':
Sorry, you don't have read/write access to the history file
/cvs/src/CVSROOT/history
Permission denied
bash-2.03$

----- End forwarded message -----

Re: [rparker1@kc.rr.com: ssh+cvs is closer]

[Jeffrey A Law]

  In message < 20000404012844.B16100@cygnus.com >you write:
  > Can anyone explain the error below?  If so, is it fixable?
He's probably not in the right group.

Is he in the "src" group?  

jeff

Re: [rparker1@kc.rr.com: ssh+cvs is closer]

[Chris Faylor]

On Mon, Apr 03, 2000 at 11:38:20PM -0600, Jeffrey A Law wrote:
>In message < 20000404012844.B16100@cygnus.com >you write:
>>Can anyone explain the error below?  If so, is it fixable?
>He's probably not in the right group.
>
>Is he in the "src" group?

Nope.  It doesn't look like he is.

Can somebody with root permission add him?

cgf

Re: [rparker1@kc.rr.com: ssh+cvs is closer]

[Jeffrey A Law]

  In message < 20000404014208.A21174@cygnus.com >you write:
  > On Mon, Apr 03, 2000 at 11:38:20PM -0600, Jeffrey A Law wrote:
  > >In message < 20000404012844.B16100@cygnus.com >you write:
  > >>Can anyone explain the error below?  If so, is it fixable?
  > >He's probably not in the right group.
  > >
  > >Is he in the "src" group?
  > 
  > Nope.  It doesn't look like he is.
  > 
  > Can somebody with root permission add him?
Done.  Basically someone probably goof'd and added him with a default group
of "cygwin".  I think we should only be adding folks with default groups
of "gcc" or "src" now.

jeff

Re: [rparker1@kc.rr.com: ssh+cvs is closer]

[Chris Faylor]

On Mon, Apr 03, 2000 at 11:53:06PM -0600, Jeffrey A Law wrote:
>In message < 20000404014208.A21174@cygnus.com >you write:
>> Can somebody with root permission add him?
>
>Done.  Basically someone probably goof'd and added him with a default group
>of "cygwin".  I think we should only be adding folks with default groups
>of "gcc" or "src" now.

Thanks, Jeff.

cgf

Re: [rparker1@kc.rr.com: ssh+cvs is closer]

[Tom Tromey]

Jeff> Done.  Basically someone probably goof'd and added him with a
Jeff> default group of "cygwin".  I think we should only be adding
Jeff> folks with default groups of "gcc" or "src" now.

Me.  There are plenty of other default groups that make sense,
e.g. automake.  I guess some groups, like binutils or gdb, are
deprecated.  Could we just delete them?

Tom

Re: [rparker1@kc.rr.com: ssh+cvs is closer]

[Jeffrey A Law]

  In message < 200004041350.GAA03612@ferrule.cygnus.com >you write:
  > Jeff> Done.  Basically someone probably goof'd and added him with a
  > Jeff> default group of "cygwin".  I think we should only be adding
  > Jeff> folks with default groups of "gcc" or "src" now.
  > 
  > Me.  There are plenty of other default groups that make sense,
  > e.g. automake.  I guess some groups, like binutils or gdb, are
  > deprecated.  Could we just delete them?
Yea, I believe they can go away.
jeff

Re: [rparker1@kc.rr.com: ssh+cvs is closer]

[Chris Faylor]

On Tue, Apr 04, 2000 at 11:40:18AM -0600, Jeffrey A Law wrote:
>  In message < 200004041350.GAA03612@ferrule.cygnus.com >you write:
>  > Jeff> Done.  Basically someone probably goof'd and added him with a
>  > Jeff> default group of "cygwin".  I think we should only be adding
>  > Jeff> folks with default groups of "gcc" or "src" now.
>  > 
>  > Me.  There are plenty of other default groups that make sense,
>  > e.g. automake.  I guess some groups, like binutils or gdb, are
>  > deprecated.  Could we just delete them?
>Yea, I believe they can go away.

Of course, it would be nice to be able to exercise some control over who
can checkin what and where, someday...

cgf

Re: [rparker1@kc.rr.com: ssh+cvs is closer]

[Jason Molenda]

On Mon, Apr 03, 2000 at 11:53:06PM -0600, Jeffrey A Law wrote:

> Done.  Basically someone probably goof'd and added him with a default group
> of "cygwin".  I think we should only be adding folks with default groups
> of "gcc" or "src" now.


It makes some sense to still make user's default group be the group
that they actually participate in.  e.g. Chris gives write permissions
to Joe Schmoe, and a year later Joe starts doing lame things on
the system.  The sourceware admin can look at Joe's account, see
that Joe's default group is 'cygwin', and can have Chris talk with
the guy.

If that were done, then Joe would be added to /etc/group:src so
he'd have write access to the repository.

I'm not real committed to this particular scheme, though; it may
be a little silly with the advent of the all-holding src repo. :-)

> I think we should only be adding folks with default groups
> of "gcc" or "src" now.

There are ~20-30 different projects on sourceware, only a couple
of which are in the src repo.  We'll have to keep the other groups
around for along time still.

J

Re: [rparker1@kc.rr.com: ssh+cvs is closer]

[Jason Molenda]

On Tue, Apr 04, 2000 at 01:42:19PM -0400, Chris Faylor wrote:

> >  > Me.  There are plenty of other default groups that make sense,
> >  > e.g. automake.  I guess some groups, like binutils or gdb, are
> >  > deprecated.  Could we just delete them?
> >Yea, I believe they can go away.

They're still being used for the web pages for those projects.
Each one of these projects has a repository for its web pages, and
that repository is all group owned.

This is on one of my TODO lists to clean up.


Actually, I should have mentioned this earlier when I was talking
about how users should be placed in "cygwin" if that is their true
group, not "src".  Group permissions are used in a couple of other
parts of the system in addition to the cvs repositories to grant
permissions.  The first one that comes to mind is the ftp directories.
You can only put something in ~ftp/pub/gdb if you are in group gdb,
and this makes good sense.

IMHO we should keep people in their real groups and add them in
'src' as an additional thing.


> Of course, it would be nice to be able to exercise some control over who
> can checkin what and where, someday...


Hey, you know, I was just reading about how you can use scripts
called out from the commitinfo script to implement access control
lists.  Using this kind of thing, people could have write access
to the whole /cvs/src repo, but could be specifically allowed to
write to only certain subdirs.  If someone tried to commit a change
in a dir where they shouldn't, the commit would fail (if I understand
correctly).

It'd have to be hacked in together with the callout for the cvs
log message generator, but I think the all-matching pattern "ALL"
could be used for that and directory-specific entries could be used
for the ACL-type program.

Jason

Re: [rparker1@kc.rr.com: ssh+cvs is closer]

[Tom Tromey]

Jason> If that were done, then Joe would be added to /etc/group:src so
Jason> he'd have write access to the repository.

That plan sounds good.
We could change the add-a-user script to understand this.
How does that sound?

T

Re: [rparker1@kc.rr.com: ssh+cvs is closer]

[Tom Tromey]

Jason> Hey, you know, I was just reading about how you can use scripts
Jason> called out from the commitinfo script to implement access
Jason> control lists.

This is what subversions does.
They have one big cvs repository.

Tom

Re: [rparker1@kc.rr.com: ssh+cvs is closer]

[Jason Molenda]

On Tue, Apr 04, 2000 at 01:42:19PM -0400, Chris Faylor wrote:

> >  > Me.  There are plenty of other default groups that make sense,
> >  > e.g. automake.  I guess some groups, like binutils or gdb, are
> >  > deprecated.  Could we just delete them?
> >Yea, I believe they can go away.

They're still being used for the web pages for those projects.
Each one of these projects has a repository for its web pages, and
that repository is all group owned.

This is on one of my TODO lists to clean up.


Actually, I should have mentioned this earlier when I was talking
about how users should be placed in "cygwin" if that is their true
group, not "src".  Group permissions are used in a couple of other
parts of the system in addition to the cvs repositories to grant
permissions.  The first one that comes to mind is the ftp directories.
You can only put something in ~ftp/pub/gdb if you are in group gdb,
and this makes good sense.

IMHO we should keep people in their real groups and add them in
'src' as an additional thing.


> Of course, it would be nice to be able to exercise some control over who
> can checkin what and where, someday...


Hey, you know, I was just reading about how you can use scripts
called out from the commitinfo script to implement access control
lists.  Using this kind of thing, people could have write access
to the whole /cvs/src repo, but could be specifically allowed to
write to only certain subdirs.  If someone tried to commit a change
in a dir where they shouldn't, the commit would fail (if I understand
correctly).

It'd have to be hacked in together with the callout for the cvs
log message generator, but I think the all-matching pattern "ALL"
could be used for that and directory-specific entries could be used
for the ACL-type program.

Jason

Re: [rparker1@kc.rr.com: ssh+cvs is closer]

[Jeffrey A Law]

  In message < 200004041350.GAA03612@ferrule.cygnus.com >you write:
  > Jeff> Done.  Basically someone probably goof'd and added him with a
  > Jeff> default group of "cygwin".  I think we should only be adding
  > Jeff> folks with default groups of "gcc" or "src" now.
  > 
  > Me.  There are plenty of other default groups that make sense,
  > e.g. automake.  I guess some groups, like binutils or gdb, are
  > deprecated.  Could we just delete them?
Yea, I believe they can go away.
jeff

Re: [rparker1@kc.rr.com: ssh+cvs is closer]

[Tom Tromey]

Jeff> Done.  Basically someone probably goof'd and added him with a
Jeff> default group of "cygwin".  I think we should only be adding
Jeff> folks with default groups of "gcc" or "src" now.

Me.  There are plenty of other default groups that make sense,
e.g. automake.  I guess some groups, like binutils or gdb, are
deprecated.  Could we just delete them?

Tom

[rparker1@kc.rr.com: ssh+cvs is closer]

[Chris Faylor]

Can anyone explain the error below?  If so, is it fixable?

cgf

----- Forwarded message from Ron Parker <rparker1@kc.rr.com> -----

From: Ron Parker <rparker1@kc.rr.com>
To: cgf@cygnus.com
Subject: ssh+cvs is closer
Date: Tue, 04 Apr 2000 00:16:10 -0500

Using the cvs command that you sent me to day I got further, but
recieved a new error.

bash-2.03$ export CVS_RSH=ssh
bash-2.03$ cvs -d :ext:rdparker@sourceware.cygnus.com:/cvs/src co winsup

Enter passphrase for RSA key 'rdparker@localhost.localdomain':
Sorry, you don't have read/write access to the history file
/cvs/src/CVSROOT/history
Permission denied
bash-2.03$

----- End forwarded message -----

Re: [rparker1@kc.rr.com: ssh+cvs is closer]

[Chris Faylor]

On Mon, Apr 03, 2000 at 11:53:06PM -0600, Jeffrey A Law wrote:
>In message < 20000404014208.A21174@cygnus.com >you write:
>> Can somebody with root permission add him?
>
>Done.  Basically someone probably goof'd and added him with a default group
>of "cygwin".  I think we should only be adding folks with default groups
>of "gcc" or "src" now.

Thanks, Jeff.

cgf

Re: [rparker1@kc.rr.com: ssh+cvs is closer]

[Chris Faylor]

On Mon, Apr 03, 2000 at 11:38:20PM -0600, Jeffrey A Law wrote:
>In message < 20000404012844.B16100@cygnus.com >you write:
>>Can anyone explain the error below?  If so, is it fixable?
>He's probably not in the right group.
>
>Is he in the "src" group?

Nope.  It doesn't look like he is.

Can somebody with root permission add him?

cgf

Re: [rparker1@kc.rr.com: ssh+cvs is closer]

[Jason Molenda]

On Mon, Apr 03, 2000 at 11:53:06PM -0600, Jeffrey A Law wrote:

> Done.  Basically someone probably goof'd and added him with a default group
> of "cygwin".  I think we should only be adding folks with default groups
> of "gcc" or "src" now.


It makes some sense to still make user's default group be the group
that they actually participate in.  e.g. Chris gives write permissions
to Joe Schmoe, and a year later Joe starts doing lame things on
the system.  The sourceware admin can look at Joe's account, see
that Joe's default group is 'cygwin', and can have Chris talk with
the guy.

If that were done, then Joe would be added to /etc/group:src so
he'd have write access to the repository.

I'm not real committed to this particular scheme, though; it may
be a little silly with the advent of the all-holding src repo. :-)

> I think we should only be adding folks with default groups
> of "gcc" or "src" now.

There are ~20-30 different projects on sourceware, only a couple
of which are in the src repo.  We'll have to keep the other groups
around for along time still.

J

Re: [rparker1@kc.rr.com: ssh+cvs is closer]

[Jeffrey A Law]

  In message < 20000404012844.B16100@cygnus.com >you write:
  > Can anyone explain the error below?  If so, is it fixable?
He's probably not in the right group.

Is he in the "src" group?  

jeff

Re: [rparker1@kc.rr.com: ssh+cvs is closer]

[Jeffrey A Law]

  In message < 20000404014208.A21174@cygnus.com >you write:
  > On Mon, Apr 03, 2000 at 11:38:20PM -0600, Jeffrey A Law wrote:
  > >In message < 20000404012844.B16100@cygnus.com >you write:
  > >>Can anyone explain the error below?  If so, is it fixable?
  > >He's probably not in the right group.
  > >
  > >Is he in the "src" group?
  > 
  > Nope.  It doesn't look like he is.
  > 
  > Can somebody with root permission add him?
Done.  Basically someone probably goof'd and added him with a default group
of "cygwin".  I think we should only be adding folks with default groups
of "gcc" or "src" now.

jeff

Re: [rparker1@kc.rr.com: ssh+cvs is closer]

[Chris Faylor]

On Tue, Apr 04, 2000 at 11:40:18AM -0600, Jeffrey A Law wrote:
>  In message < 200004041350.GAA03612@ferrule.cygnus.com >you write:
>  > Jeff> Done.  Basically someone probably goof'd and added him with a
>  > Jeff> default group of "cygwin".  I think we should only be adding
>  > Jeff> folks with default groups of "gcc" or "src" now.
>  > 
>  > Me.  There are plenty of other default groups that make sense,
>  > e.g. automake.  I guess some groups, like binutils or gdb, are
>  > deprecated.  Could we just delete them?
>Yea, I believe they can go away.

Of course, it would be nice to be able to exercise some control over who
can checkin what and where, someday...

cgf

Re: [rparker1@kc.rr.com: ssh+cvs is closer]

[Tom Tromey]

Jason> Hey, you know, I was just reading about how you can use scripts
Jason> called out from the commitinfo script to implement access
Jason> control lists.

This is what subversions does.
They have one big cvs repository.

Tom

Re: [rparker1@kc.rr.com: ssh+cvs is closer]

[Tom Tromey]

Jason> If that were done, then Joe would be added to /etc/group:src so
Jason> he'd have write access to the repository.

That plan sounds good.
We could change the add-a-user script to understand this.
How does that sound?

T