Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow collaborators to upload to OPM #61

Open
hamishforbes opened this issue Apr 9, 2018 · 2 comments
Open

Allow collaborators to upload to OPM #61

hamishforbes opened this issue Apr 9, 2018 · 2 comments

Comments

@hamishforbes
Copy link

At the moment I don't seem to be able to upload a package on a repo which I have push/write access.

Specifically I have push access to https://github.com/pintsized/ledge so I can push a new version to github, tag the release etc.
However when I try and upload to opm i get

ERROR: /Users/hamish/.opmrc: github_account "hamishforbes" does not match the github account "pintsized" in repo_link https://github.com/pintsized/ledge in dist.ini.

Looks like this check is clientside only?
I commented it out and successfully uploaded the package but it came through on OPM under my namespace, it should be under pintsized still.
This may have just been because I had set is_original=no locally though?

@agentzh
Copy link
Member

agentzh commented Apr 9, 2018

@hamishforbes We use github authentication here, so if you do not have that github account's token, you cannot upload under that account's name. This security check is important. The right way is to introduce a github organization account so that all the members of that organization can upload new releases under that organization account.

@hamishforbes
Copy link
Author

It seems excessive to be forced to create an organisation just so that 2 people can push releases of a library though, especially when github provides a mechanism for another user to have full write access without an organisation.

Is the check clientside only? It's difficult to tell exactly what happened on the server side, the entry on http://opm.openresty.org/ is under my namespace but the link is to the pintsized repo.
Does this mean the package was built from the pintsized repo and just listed on opm as my user?

Given that repos a user has collaborator access to are listed under the github /user/repos API call along with the current user's permissions for that repo, it doesn't seem like a security problem to add a new feature / enhancement to allow collaborators to push to OPM.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants