Please support sftp uploads

Bug #557714 reported by Emmet Hikory on 2010-04-08
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Launchpad itself
High
Steve Kowalik

Bug Description

Please support SFTP uploads. This eases penetration through complex firewalls, allows for secure upload (e.g. to P3As), gives synchronous feedback to uploaders, simplifies authentication proxying, etc.

GPG keys should continue to be used for verification of package uploaders: SFTP would only be an additional transport mechanism.

The current (FTP) transport mechanism should continue to be supported in parallel until April 2015, to avoid the need to change the upload path for those using lucid as a development platform without changes to dput configuration (changing to reference sftp would need some significant argument to be considered a critical security update).

Joey Stanford (joey) on 2010-04-08
tags: added: oem-services
Julian Edwards (julian-edwards) wrote :

See also bug 136593 and the linked blueprint.

Changed in soyuz:
status: New → Triaged
importance: Undecided → High
tags: added: feature poppy soyuz-upload
Jonathan Lange (jml) wrote :

I've extracted out the codehosting SFTP server's code, made it general enough be re-used and put it into our lp.services package.

In terms of what needs to be done next, here's what I told bigjools & stevenk:

I haven't done much thinking about what you'll need to do for Poppy itself. On the actual running-tcp-daemon side, you'll need to write some glue code that looks a bit like the code in daemons/sftp.tac and lib/lp/codehosting/sshserver/daemon.py. See
http://paste.ubuntu.com/415034/.

codehosting has its own avatar so the branchfs_proxy can get passed around – you probably won't need that. You won't need the ISession adapter either, since you won't be allowing any command execution or shell access.

You'll also need to implement whatever filesystem logic poppy has. You can find examples in lp/codehosting/sftp.py or in Twisted itself (twisted/conch/unix.py, iirc). If it's just "write stuff to disk like a regular SFTP server", then there's already support for that in Conch.

Steve Kowalik (stevenk) on 2010-05-31
Changed in soyuz:
assignee: nobody → Steve Kowalik (stevenk)
milestone: none → 10.05
Steve Kowalik (stevenk) wrote :

The code for this has landed in both devel and db-devel, and is due to be rolled out with 10.05. There is a small update branch that is currently waiting to be landed.

I have written configuration for it which I will test on dogfood, modulo the port on the firewall being opened. Since this needs more work by the LOSAs to get turned on, and is pending discussion with IS, it needn't hold up the release.

Changed in soyuz:
status: Triaged → Fix Committed
tags: added: qa-needstesting
Steve Kowalik (stevenk) wrote :

I have written a config branch to support sftp uploads for dogfood.launchpad.net, and verified that it works for uploading a source package to a PPA after getting IS to open the port to dogfood to me.

tags: added: qa-ok
removed: qa-needstesting
Curtis Hovey (sinzui) on 2010-06-02
Changed in soyuz:
status: Fix Committed → Fix Released
Steve Kowalik (stevenk) wrote :

Sadly, this isn't fixed released yet. I will set it back to In Progress even though the code has landed, since the service has yet to be activated.

Changed in soyuz:
status: Fix Released → In Progress
Julian Edwards (julian-edwards) wrote :

Fix Released is ok here since there code is all done. We're blocked on IS and the LOSAs setting up the production environment,

Changed in soyuz:
status: In Progress → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers

Related blueprints