passwords.py file

[bheesham]

Changed to using a passwords.py file for storing credentials. This should take care of the whole "passwords being public" thing.

See this issue.

[rust-highfive]

r? @nikomatsakis

(rust_highfive has picked a reviewer for you, use r? to override)

[bheesham]

Uuuhhh, ignore this for now. There shouldn't be a merge conflict.

[nikomatsakis]

I know very little about this. Changing reviewer to @brson

[brson]

I'm not sure this is sufficient. It will allow us to keep the passwords hidden from the source code, but it leaves a few problems:

• It doesn't create any distinction between what credentials are required for triggering e.g. try builds vs those for dist builds, and dist builds are the only ones that need to be restricted to just a few people.
• Passwords are still transmitted over plain text to buildbot.

[brson]

A concrete change here might be to distinguish credentials for dist builds from all others. I think we should probably ask the people in #buildbot on freenode about best practices, though perhaps we just need to bite the bullet and put buildbot behind an https proxy.

[bheesham]

Putting buildbot behind nginx or something similar was what I was going to
suggest to get around the whole "transferral of passwords over plaintext".

I'll ask on #buildbot later today or tomorrow if I don't get the
information I want from the Buildbot wiki.
On Jan 15, 2015 6:46 PM, "Brian Anderson" notifications@github.com wrote:

A concrete change here might be to distinguish credentials for dist builds
from all others. I think we should probably ask the people in #buildbot on
freenode about best practices, though perhaps we just need to bite the
bullet and put buildbot behind an https proxy.

Reply to this email directly or view it on GitHub
#4 (comment).

[bheesham]

It looks like there's some fine-grain control available for this: http://docs.buildbot.net/current/manual/cfg-statustargets.html#authentication

I'll test out the HTPasswdAuth method, because that would probably be easier to manage.

EDIT: Nope. I'll stick to having a passwords.py file because I can't seem to get HTPasswdAuth to work.

[brson]

passwords.py seems good

[bheesham]

So currently the two changes are:

• Usernames and passwords are in the passwords.py file.
• The two different usernames correspond to permissions which disallows one from touching anything that has "dist" in it's name, and another one that is not disallowed.

[brson]

Looks good, thanks. Testing it now.

[brson]

Thanks @bheesham!