On Wednesday, 21 January 2015 23:57:07 CEST, Ben Cooksley wrote:
> Using either=20
> http://www.guywarner.com/2014/06/part-2-integrating-phabricator-and.html
> or http://www.dctrwatson.com/2013/01/jenkins-and-phabricator/ or a
> variation thereof.

That is quite some custom code that one has to maintain, though.

> Commit emails could either be sent by our existing hooks, or we could
> migrate to Herald and customise it's template to fit what we need if
> necessary.
> People would filter them / subscribe to them through Herald.

How would they subcribe via Herald if it was done via the existing hooks?

> Doesn't seem too high, although I don't see how that would be made web
> accessible - which might be the hard and costly part maintenance wise.
> (You have to deal with security issues too as you are in a separate
> web application, so you need to authenticate the developer first).

Well, Apache's mod_authnz_ldap and a "Require group developers" stanza=20
makes this really easy. Just look up $user from an appropriate env var=20
provided by the web server. Where is the problem?

> Our existing solution is triggered on change events in LDAP and causes
> all SSH keys to be re-read and a new ~/.ssh/authorized_keys file to be
> written out. You can't rely on OpenLDAP stating the addition/removals
> properly when using the syncrepl interface, at least in my experience.
> In this way we avoid dependence on the Identity web application.

A quick & dirty approach:

  `ssh bot@gerrit set-account $user --remove-ssh-keys ALL`
  `ssh bot@gerrit set-account $user --add-ssh-key - < authorized_keys`

A better and race-free code would have to invoke `comm` in addition to=20
that, and only add/remove keys which has to be removed or added. That's=20
left as an excercise for the reader, it's easy enough. Or, to avoid relying=20=

on a local state altogether, just issue a REST call for SSH key retrieval=20
and base a decision on that. It's gonna be like 10 lines of custom code.

Cheers,
Jan

--=20
Trojit=C3=A1, a fast Qt IMAP e-mail client -- http://trojita.flaska.net/