Mailing-List: contact dev-help@geronimo.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@geronimo.apache.org
Received-SPF: pass (athena.apache.org: local policy)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
  s=s1024; d=yahoo.com;
  h=Received:X-YMail-OSG:X-Yahoo-Newman-Property:Message-Id:From:To:Content-Type:Content-Transfer-Encoding:Mime-Version:Subject:Date:X-Mailer;
  b=dmo5V+wMQKk/0Kv28jyLSc3/KL0D8UiJnFhRR0Swqtw4GGINWf52qy2UMW8vAlwfqyS5x4SEcrq7MGnzsfjap9Hkdhyud2e2xNjjxZjFqCzvbiPqM2qRJxUsLmyMa1uGpw9Pbb9CJow71DPto7NHeSSS7mbdLsiOa0Wb3Fi2QJ4=
  ;
Message-Id: <D6FA2FD9-4CBF-4747-988B-169ACB0659BC@yahoo.com>
From: David Jencks <david_jencks@yahoo.com>
To: "Geronimo Dev List (JIRA)" <dev@geronimo.apache.org>
Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes
Content-Transfer-Encoding: 7bit
Mime-Version: 1.0 (Apple Message framework v926)
Subject: No credentials for plugin installer gbean use of remote plugin repos
Date: Mon, 15 Sep 2008 10:38:42 -0700

I discovered a pretty big hole in our plugin system,https://issues.apache.org/jira/browse/GERONIMO-4304 
.

Basically there doesnt' seem to be a way to supply credentials for the  
plugin installer to access a password protected plugin repo, such as  
another geronimo server.

I can think of 2 immediate solutions to this.

1. include space for username and password in the plugin list schema  
sourceRepository element.  This intrusively ties us to basic auth and  
implies that the credentials are going to be easily visible in a lot  
of places.  On the other hand it doesn't require extra configuration  
of the server to know about specific plugin repos which is more  
convenient than...

2. configure the plugin installer gbean with a repo registry that  
includes credentials.  This would also make it easy to restrict a  
server to using only registered plugin repos which might be a  
desirable feature.

I'm going to go ahead with (2) but would really appreciate comments  
and other ideas as I don't think I've fully thought through the  
consequences of either choice.

thanks
david jencks