Re: General keyring process questions.

On Thu, Feb 29, 2024 at 09:55:45AM -0500, Carlos O'Donell wrote:
> - Does adding a key to allowed-signers give access to also update
>   allowed-signers itself?

No, it just adds the key to the keyring. The actual permissions to that
repository are granted by LF IT upon request and the trusted introducer
verification process.

>   - I assume the answer is that only trusted indtroducers can update
>     the keyring, and that the keyring is only an intermediary keyring
>     because it doesn't look like a normal gitolite admin repo.

Correct.

> - What is the syntax of allowed-signers?

https://man.openbsd.org/ssh-keygen.1#ALLOWED_SIGNERS

>   - What does 'namespace="git"' mean?

It means that this key is allowed to sign git commits.

> - Are new account requests sent to [email protected]?

For the moment -- I expect we will set up [email protected] in the
near future.

> - What are the implications of selecting a username?

Minimal.

>   - I assume the answer is that the username is not visible anywhere, but
>     is the username used during the ssh connection to the gitolite server
>     and as such is the name used in the gitolite admin repo with the keys?

The username only shows up in the backend logs and helps us figure out who
connected and what operations they performed.

> - How do we authorize group membership?

Helpdesk request.

>   - How do we know what groups to request in the email to LF IT?

To be established.

>   - Group membership is a gitolite repo policy detail and some groups may
>     have distinct project policy e.g. web repo vs. code repo.
> 
>     How do we enforce that policy?
> 
>     For example, a gitolite project will usually have an admin repo with
>     configuration and keys, and the code repos. In the current setup it
>     LF IT is the maintainer of the admin repo, and the community maintains
>     the keyring and content repos. If we have several content repos, how
>     do we authorize only access to one of them? Is that encoded in the
>     allowed-signers in some way?

No, this is discussed in a helpdesk request and acked by designated group
managers on the project side. We can establish the exact procedure at a later
time.

HTH.

-K