<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">On Thu, Jun 26, 2014 at 5:56 AM, Thomas Oulevey <span dir="ltr"><<a href="mailto:thomas.oulevey@cern.ch" target="_blank">thomas.oulevey@cern.ch</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA1<br>
<br>
Hi All,<br>
<br>
The initial idea is to configure Koji and make it available to the<br>
community.<br>
<br>
Thanks to Karanbir/Fabian we already got the hardware and installation<br>
is on going.<br>
<br>
But first, we would like to ask for feedback:<br>
<br>
1/ PKI setup, a proposal:<br>
- - koji-web use a certificate signed by an external CA (and obviously<br>
trusted)<br>
- - the rest of the koji architecture (hub and kojid) will use a<br>
self-signed CA that we'll use to also generate other certs. The<br>
proposal is to gpg encrypt the CA within a non-public GIT repo.<br>
Talking with Fabian, he already use this method for other<br>
infrastructure project.<br>
- - the clients (at the beginning git.c.o) will use self-signed CA.<br>
<br>
This need to be discussed in the light of future integration of<br>
different user facing tools (koji, git, etc...) and if we want to<br>
provide koji client accesses, as Fedora project does.<br>
<br>
2/ Hostnames to use:<br>
- - After a round on #centos-devel, <a href="http://cbs.centos.org" target="_blank">cbs.centos.org</a> was the best we can<br>
come up with. Comments ?<br>
- - For the builders machine, we should decide on a decent naming as<br>
this info appears in RPM metadata.<br>
i.e : <a href="http://builder01.cbs.centos.org" target="_blank">builder01.cbs.centos.org</a>, <a href="http://builder02.cbs.centos.org" target="_blank">builder02.cbs.centos.org</a>, etc...<br>
Do we want to deal with different "architecture family" within the<br>
name (e.g ARM) ?<br>
i.e : <a href="http://x86-builder01.cbs.centos.org" target="_blank">x86-builder01.cbs.centos.org</a>, <a href="http://arm-builder01.cbs.centos.org" target="_blank">arm-builder01.cbs.centos.org</a><br>
<br>
Your comments are very welcome!<br>
<br>
cheers,<br><br></blockquote><div><br></div><div>+1 on the PKI setup.</div><div><br></div><div>For the hostnames, I don't see a reason the architecture is needed in the hostname. </div><div><br></div><div>-Jeff</div></div>
<br></div></div>