Allow any user or create a specific user for pip install about inductiva

[fabiocruz]

We can create a machine user for this purpose — I think it needs to be done by organization admins. Once created, we can create a personal access token for it, which should have read access to at least inductiva/inductiva, inductiva/inductiva-sph, inductiva/inductiva-data and inductiva/inductiva-utils.

[IvanPombo]

If I understand this correctly @fabiocruz, the machine user will not allows us to understand the behaviour of each user, right?It will be more centralized?

Not that we want login's as of now, but understanding individual presence is important for us to gain knowledge of user practices.

[sarmento]

@hpenedones : I think your help is needed here :)

[fabiocruz]

If I understand this correctly @fabiocruz, the machine user will not allows us to understand the behaviour of each user, right?It will be more centralized?

Not that we want login's as of now, but understanding individual presence is important for us to gain knowledge of user practices.

You're right!

The solution I proposed allows removing my personal access token (PAT) and username from the code. We would simply replace it by that of a machine user.

Of course in the future we will want to have an authentication system in our API, but that's not done through PAT to git clone or pip install the package(s), but rather through some user key passed to the API call(s). We briefly discussed this in one of our past meetings, but came to the conclusion that this wasn't a priority.

[hpenedones]

Let me see if I can create a machine user...
But we can also start the discussion of what needs to be done for us to feel comfortable to make those repos public.

[sarmento]

I think we should step up and go public. A quinta, 2/03/2023, 09:45, Hugo Penedones ***@***.***> escreveu:

…

Let me see if I can create a machine user... But we can also start the discussion of what needs to be done for us to feel comfortable to make those repos public. — Reply to this email directly, view it on GitHub <#48 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAKLWXOOZ5OH6EW3KVNGUZTW2BT4DANCNFSM6AAAAAAVLWGVCM> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[hpenedones]

Actually, having a quick look at the definition of machine user, it seems that it is associated with a single machine / computer / server, where you first need to follow a procedure to generate SSH keys, etc. This is not quite the scenario we want... It seems more directed towards a scenario where we would have one of ours servers running some automations that need access to the git repo, for example to run some heavy unit tests, or make deployments... No?

[fabiocruz]

Right... then I guess we could create a GitHub user account for the organization and set up a PAT there. Or make the repos public.

[sarmento]

Let's start by making "inductiva" public, and then working out the dependencias such that becomes the only package we need to make public for now.

…

On Thu, Mar 2, 2023 at 2:20 PM Fábio Cruz ***@***.***> wrote: Right... then I guess we could create a GitHub user account for the organization and set up a PAT there. Or make the repos public. — Reply to this email directly, view it on GitHub <#48 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAKLWXMLZAN3FUPYVGSLUPDW2CUCHANCNFSM6AAAAAAVLWGVCM> . You are receiving this because you authored the thread.Message ID: ***@***.***>