Please support sftp uploads

[Emmet Hikory]

Please support SFTP uploads. This eases penetration through complex firewalls, allows for secure upload (e.g. to P3As), gives synchronous feedback to uploaders, simplifies authentication proxying, etc.

GPG keys should continue to be used for verification of package uploaders: SFTP would only be an additional transport mechanism.

The current (FTP) transport mechanism should continue to be supported in parallel until April 2015, to avoid the need to change the upload path for those using lucid as a development platform without changes to dput configuration (changing to reference sftp would need some significant argument to be considered a critical security update).

[Julian Edwards (julian-edwards)]

See also bug 136593 and the linked blueprint.

[Jonathan Lange (jml)]

I've extracted out the codehosting SFTP server's code, made it general enough be re-used and put it into our lp.services package.

In terms of what needs to be done next, here's what I told bigjools & stevenk:

I haven't done much thinking about what you'll need to do for Poppy itself. On the actual running-tcp-daemon side, you'll need to write some glue code that looks a bit like the code in daemons/sftp.tac and lib/lp/codehosting/sshserver/daemon.py. See
http://paste.ubuntu.com/415034/.

codehosting has its own avatar so the branchfs_proxy can get passed around – you probably won't need that. You won't need the ISession adapter either, since you won't be allowing any command execution or shell access.

You'll also need to implement whatever filesystem logic poppy has. You can find examples in lp/codehosting/sftp.py or in Twisted itself (twisted/conch/unix.py, iirc). If it's just "write stuff to disk like a regular SFTP server", then there's already support for that in Conch.

[Steve Kowalik (stevenk)]

The code for this has landed in both devel and db-devel, and is due to be rolled out with 10.05. There is a small update branch that is currently waiting to be landed.

I have written configuration for it which I will test on dogfood, modulo the port on the firewall being opened. Since this needs more work by the LOSAs to get turned on, and is pending discussion with IS, it needn't hold up the release.

[Steve Kowalik (stevenk)]

I have written a config branch to support sftp uploads for dogfood.launchpad.net, and verified that it works for uploading a source package to a PPA after getting IS to open the port to dogfood to me.

[Steve Kowalik (stevenk)]

Sadly, this isn't fixed released yet. I will set it back to In Progress even though the code has landed, since the service has yet to be activated.

[Julian Edwards (julian-edwards)]

Fix Released is ok here since there code is all done. We're blocked on IS and the LOSAs setting up the production environment,