List Archive: gentoo-dev
Note: Due to technical difficulties, the Archives are currently not up to date.
provides an alternative service for most mailing lists.c.f. bug 424647
On Sunday 25 June 2006 01:39, Mike Frysinger wrote:
> On Saturday 24 June 2006 18:54, Edward Catmur wrote:
> > * Security (from malicious contributors): Glad to see layman will only
> > track the reviewed/ tree; still, anyone who checks out the sunrise/ tree
> > (and has it in PORTDIR_OVERLAY) is vulnerable.
> > - Remove from the examples any suggestion that one should check out the
> > whole tree when contributing. Point out that one should not svn up
> > sunrise/ as part of updating Portage.
> valid point i think
> ive never admined svn repos before, but would it be possible to shut off
> anon access to the non-reviewed tree ? i think that would cover this issue
> as people who get bit by bugs in the non-reviewed tree would (and should)
> be able to just go in and fix it themselves :)
after looking at some acl stuff i'm 99% sure this can be done ... so can we
get this setup ?
in fact, gentoo-wiki.com has a section on doing apache2/svn/dav/acls