Mailing-List: contact dev-help@impala.incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@impala.incubator.apache.org
MIME-Version: 1.0
In-Reply-To: <CAEoRBexzQv4JNL2gj=WpnP5cjF_jb5bCRiLkf5U_Rp83sno4jw@mail.gmail.com>
References: <CAC-pSX2NmQtX8sxhm7vpnHgFHfEBZJRcYLdmKz7s+dwQdW5N2Q@mail.gmail.com>
 <CAM7YqvO5hhro88T8fY66J-eq3N8u8773c1zW9H1qnzC=5oJdLQ@mail.gmail.com>
 <CAC-pSX2m7956embomkWwqn6SSRY3+2gZPyVRVAVHiTh4KAYt3Q@mail.gmail.com>
 <CAEoRBexFBp=ztkM63pNvXP4LzfRgd_t=-aA+Jx-G5EH9cDKcjA@mail.gmail.com>
 <CAC-pSX3oqdbie4_Xcefu+hiPHg9ATt+B0MGCd-w+2YZtCEe=3Q@mail.gmail.com>
 <CAEoRBewpuDhpmVJYJK5EfVXrH-Oe=JhONRQ6y8L5Yw=C2DVyzA@mail.gmail.com>
 <CAMvjXi8gtxWqA2WZoF4hKpqSx827hb6MbY0CJLThEgtjKsa9sg@mail.gmail.com> <CAEoRBexzQv4JNL2gj=WpnP5cjF_jb5bCRiLkf5U_Rp83sno4jw@mail.gmail.com>
From: Jim Apple <jbapple@cloudera.com>
Date: Wed, 14 Dec 2016 10:12:50 -0800
Message-ID: <CAC-pSX3jJyHOGMQhXFKE7P8vUWPOBFXA-nANGcRN4grJ+b=6tw@mail.gmail.com>
Subject: Re: Jenkins jobs to verify patches
To: "dev@impala" <dev@impala.incubator.apache.org>
Content-Type: multipart/alternative; boundary=089e010d8406f6920d0543a2482d
archived-at: Wed, 14 Dec 2016 18:13:02 -0000

--089e010d8406f6920d0543a2482d
Content-Type: text/plain; charset=UTF-8

Kudu runs tests preemptively when a gerrit patch first appears.
On Dec 14, 2016 9:58 AM, "Tim Armstrong" <tarmstrong@cloudera.com> wrote:

> I mean the contributor could email an email address (e.g. a mailing list)
> asking for credentials and we could email them privately.
>
> Do we know what other Apache projects do for situations like this?
>
> On Wed, Dec 14, 2016 at 9:18 AM, Alex Behm <alex.behm@cloudera.com> wrote:
>
> > Can you clarify the "credentials by mailing list" approach?
> >
> > If we send out the credentials on a public list, it's pretty close to
> open
> > access.
> >
> > If we send out credentials to contributors privately, we have an
> additional
> > hurdle to contributions.
> >
> > On Wed, Dec 14, 2016 at 9:12 AM, Tim Armstrong <tarmstrong@cloudera.com>
> > wrote:
> >
> > > Got it.
> > >
> > > I think I'd probably be more in favour of handing out login credential
> to
> > > contributors on demand (e.g. by mailing a list)  rather than having
> open
> > > access, just so we have a clearer idea of who's using it. I don't have
> a
> > > strong objection to the alternative.
> > >
> > > On Wed, Dec 14, 2016 at 8:52 AM, Jim Apple <jbapple@cloudera.com>
> wrote:
> > >
> > > > > How isolated is the Jenkins instance?
> > > >
> > > > As far as I know, the workers have little access to the coordinator.
> > See
> > > > here:
> > > >
> > > > https://wiki.jenkins-ci.org/display/JENKINS/Slave+To+
> > > Master+Access+Control
> > > >
> > > > This flag is on and there are no whitelisted exceptions.
> > > >
> > > > > Does the jenkins user have many privileges on the VM?
> > > >
> > > > They have passwordless sudo on the worker
> > > >
> > > > > Could it simply wipe
> > > > > out the job history to destroy the trail?
> > > >
> > > > Job history is stored on the coordinator.
> > > >
> > > > > Jenkins also presumably has
> > > > > credentials to make at least some changes to gerrit - are those
> > > > privileges
> > > > > restrictive enough that it couldn't cause problems there too?
> > > >
> > > > Those are stored only on the coordinator and cannot be used by the
> > > slaves.
> > > >
> > >
> >
>

--089e010d8406f6920d0543a2482d--