As I have seen, the bugs and master machines have the user/pass DB, plus
Wez's blog allows us to log in with our CVS users, so I guess he also
has a copy of the password file. I cannot estimate the security conserns
of giving out the password file for our server, we will discuss this
with systems@ (also CC-ed). We would need the token for
http://master.php.net/fetch/cvspasswd.php
I don't think it's a good idea to hand it out to a server we don't
administrate ourselves, as giving out those passwords opens up commit
access to everything as a lot of passwords are *really* easy to crack.
No problem, I have expected this exact answer. We have two options to have CVS based logins on docs.php.net:
A)
- user CURL to post the username and data to
master.php.net/manage/user.php when the user
hits docs.php.net with a magic cookie, or tries to log
in there
- if we get a magic cookie back, then we set it for the user
(if it is not already set) and note the trusted status of
that cookie in a session.
B)
- set up a token protected authentication page working with
GET method at master.php.net (with a token set up for just
this purpose)
- this is easier to call, since it does not need curl magic,
and can only be called from a server knowing that token
- but the end result is very similar. either we get the stuff we
need to set in the magic cookie, or not (in the body of the HTTP
response)
Note that these two are ideas of others, I am just trying to summarize our options, and ask your opinions on it.
Goba