MIME-Version: 1.0
In-Reply-To: <20130219153632.GE3033@piware.de>
References: <20130216013854.GD12029@momjian.us>
	<20130216084421.GA1223@msgid.df7cb.de>
	<20130216153309.GF12029@momjian.us>
	<20130216234034.GG12029@momjian.us>
	<20130217054028.GA6000@alvh.no-ip.org>
	<20130217121745.GH12029@momjian.us>
	<20130218020824.GA4691@alvh.no-ip.org>
	<20130219120304.GB20153@momjian.us>
	<5123952C.1030408@2ndQuadrant.com>
	<CABUevExD808PKJEMuhLnH_pk8hD9yJ3eSA2Dv0q_EP1-o7B5Mg@mail.gmail.com>
	<20130219153632.GE3033@piware.de>
Date: Tue, 19 Feb 2013 16:40:40 +0100
Message-ID: 
 <CABUevEzGrQ=0J8dw1fj=k-cVkzbgfnNOkwYTk_BK-zLu8P+wBA@mail.gmail.com>
Subject: Re: [pgsql-pkg-debian] Re: We should not transition to
	apt.postgresql.org until we have a PPA
From: Magnus Hagander <magnus@hagander.net>
To: Martin Pitt <mpitt@debian.org>
Cc: Greg Smith <greg@2ndquadrant.com>, Bruce Momjian <bruce@momjian.us>,
	Alvaro Herrera <alvherre@2ndquadrant.com>,
	Christoph Berg <myon@debian.org>,
	Stefan Kaltenbrunner <stefan@kaltenbrunner.cc>,
	Josh Berkus <josh@agliodbs.com>,
	PostgreSQL WWW <pgsql-www@postgresql.org>,
	PostgreSQL in Debian <pgsql-pkg-debian@postgresql.org>,
	Tom Lane <tgl@sss.pgh.pa.us>
Content-Type: text/plain; charset=ISO-8859-1
Precedence: bulk
Sender: pgsql-www-owner@postgresql.org

On Tue, Feb 19, 2013 at 4:36 PM, Martin Pitt <mpitt@debian.org> wrote:
> Magnus Hagander [2013-02-19 16:22 +0100]:
>> > The instructions at http://www.postgresql.org/download/linux/debian/ are a
>> > bit much right now, so some automation toward reducing them would be useful.
>
>> Yes. This is why we have multiple debian packaging experts in the
>> project. And also people who know some things about debian packages
>> and some things about usual customers, to bridge the gap ;)
>
> I think I can claim to have a sufficient understanding of how Debian
> and Ubuntu archives and packaging work to offer to write such a
> script. :-)

Most definitely.

(BTW, this proves which debian packager wasn' tin the IRC channel at
the time :P)


>> Just to keep people informed, the current plan which is the latest
>> conclusion in the IRC discussion amongst the packagers is:
>>
>> * Change the package pinning to be less conservative, and more with
>> what most people want. That will remove one step from the installation
>> instructions. Obviously this needs some lead time, but shouldn't be
>> too much.
>
> I'm very much in favor of this.
>
>> * Create an automated script that will set the repository up for
>> people. This can either be downloaded and run, or it can be downloaded
>> as a signed https download and piped directly to the shell for those
>> daring people who trust postgresql.org.
>
> My current idea is to ship both the GPG key and the script in the
> Debian/Ubuntu postgresql-common package. This closes the
> authentication loophole in the sense that you can trust to get the
> real postgresql archive if you trust that you have the real Debian
> archive, and it doesn't need scary "wget | sudo bash" hacks.

Unfortunately, it will take quite a while to propagate, no?

What we were considering was using a curl | sudo bash basically. It
will then be signed by our main SSL certificate, so that should be
almost as trustworthy as a package signature (ours would be
exploitable by somebody tricking a public CA into giving them a cert
for www.postgresql.org)


> So in theory this script could also set up the apt pinning, but I'd
> rather not, because (1) doing that automatically would be besides the
> point of having the pinning requirement in the first place, and (2)
> automatically doing this can potentially break an already existing
> (unrelated) apt pin configuration in "interesting" ways.

Yeah, +1.


-- 
 Magnus Hagander
 Me: http://www.hagander.net/
 Work: http://www.redpill-linpro.com/


-- 
Sent via pgsql-www mailing list (pgsql-www@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-www