Re: Security issues when running gerrit patches on jenkins

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 07/18/2012 10:00 AM, Robert Middleswarth wrote: Perhaps this is just an example of my limited dimensional thinking around SCMs. I tend to think by default, "There should be a well described pathway to committer status. Once achieved, you can commit, that's it." Old school thinking. :) However, I get that more complex infrastructure may have other considerations. In Fedora, for example, things went from a wide open SCM where anyone could commit to any package, to a more segregated system with the idea of an over-packager status that one can attain, which provides the now rare ability to commit to any package. Similarly here, oVirt may say, "Fine, you can commit code to the main git repo, but you have to earn Level Q to be able to kick-off automated testing." I just want us to be careful how we contextualize, too. While trust is one reason we don't give root to everyone, another reason is we want to be sure they know how to be safe and sane in that position. People may need e.g. training or testing that they are not going to accidentally do something that makes Jenkins fall down and cry. - - Karsten - -- Karsten 'quaid' Wade, Sr. Analyst - Community Growth http://TheOpenSourceWay.org .^\ http://community.redhat.com @quaid (identi.ca/twitter/IRC) \v' gpg: AD0E0C41