[arch-projects] [arch-repo-management] 2022-05-04 meeting notes

[Brett Cornwall]

Formatted minutes can be viewed here:

https://md.archlinux.org/s/rdnf9nzXj

Raw Markdown (still hoping for an easy md→text conversion that formats 
links in a citation style...)


# Arch-repo-management 2022-05-04 meeting

Date: 2022-05-04T17:00:00Z
Location: Jitsi
Scribe: Brett (ainola)

## Attendees

* Brett (ainola)
* dvzrv
* Torxed
* wCPO

## Agenda

### Documentation

* dvzrv has [created extensive sphinx documentation about the project](https://gitlab.archlinux.org/archlinux/arch-repo-management/-/merge_requests/31)!

#### Hosting

It would be nice to set up e.g. docs.archlinux.org as a central documentation platform related to Arch-related tooling/projects with each project having its own subdomain. For instance, repod.docs.archlinux.org.

* The wiki is more about configuration/situational help whereas the docs site would be more extensive documentation about the project itself: Much of the specifics don't belong on the wiki.

GitLab pages used for WKD docs, let's use pages for all of this documentation

* docs.archlinux.org would be a landing page
* CI/CD into a repository's GitLab pages
* foo.docs.archlinux.org would point to that repo's gitlab page.

#### Security concerns

The Gitlab page could potentially maliciously set cookies for archlinux.org. Since documentation changes can be deployed without DevOps, the accepted stewards of infrastructure, it means that non-DevOps members could theoretically maliciously attack the main site.

Refer: https://github.com/w3c/webappsec/issues/432

Suggestions for resolution:

1. Change https://archlinux.org to https://www.archlinux.org so that the main page is on a separate subdomain
     * This would likely cause our search rankings to reset. Cookies would have to be reworked to use the new domain
3. Disable JavaScript via CSP
     * This would break search functionality for the Sphinx theme
4. Use `<script-src>` [hash argument](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src) to restrict the JavaScript allowed to run (to be managed by DevOps)
5. Widen the range of trust to include more than DevOps members
     * This is the path of least resistance
6. Enhance archlinux.org security to require more than cookies to authenticate
     * Not trivial, unlikely to happen

No resolution made, we will revisit in a few weeks' time after the PR has been merged.


### Next Steps

* next up: [rename the project to repod](https://gitlab.archlinux.org/archlinux/arch-repo-management/-/issues/45)
* start implementing the consumption of package metadata (e.g. [.MTREE](https://gitlab.archlinux.org/archlinux/arch-repo-management/-/issues/51), [.BUILDINFO](https://gitlab.archlinux.org/archlinux/arch-repo-management/-/issues/52) (also selection of [.BUILDINFO fields](https://gitlab.archlinux.org/archlinux/arch-repo-management/-/issues/20)) and [.PKGINFO](https://gitlab.archlinux.org/archlinux/arch-repo-management/-/issues/53))

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-projects/attachments/20220504/bdb81216/attachment.sig>